net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI core. */
  26
  27 #include <linux/jiffies.h>
  28 #include <linux/module.h>
  29 #include <linux/kmod.h>
  30
  31 #include <linux/types.h>
  32 #include <linux/errno.h>
  33 #include <linux/kernel.h>
  34 #include <linux/sched.h>
  35 #include <linux/slab.h>
  36 #include <linux/poll.h>
  37 #include <linux/fcntl.h>
  38 #include <linux/init.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/interrupt.h>
  41 #include <linux/notifier.h>
  42 #include <net/sock.h>
  43
  44 #include <asm/system.h>
  45 #include <asm/uaccess.h>
  46 #include <asm/unaligned.h>
  47
  48 #include <net/bluetooth/bluetooth.h>
  49 #include <net/bluetooth/hci_core.h>
  50
  51 #ifndef CONFIG_BT_HCI_CORE_DEBUG
  52 #undef  BT_DBG
  53 #define BT_DBG(D...)
  54 #endif
  55
  56 static void hci_cmd_task(unsigned long arg);
  57 static void hci_rx_task(unsigned long arg);
  58 static void hci_tx_task(unsigned long arg);
  59 static void hci_notify(struct hci_dev *hdev, int event);
  60
  61 static DEFINE_RWLOCK(hci_task_lock);
  62
  63 /* HCI device list */
  64 LIST_HEAD(hci_dev_list);
  65 DEFINE_RWLOCK(hci_dev_list_lock);
  66
  67 /* HCI callback list */
  68 LIST_HEAD(hci_cb_list);
  69 DEFINE_RWLOCK(hci_cb_list_lock);
  70
  71 /* HCI protocols */
  72 #define HCI_MAX_PROTO   2
  73 struct hci_proto *hci_proto[HCI_MAX_PROTO];
  74
  75 /* HCI notifiers list */
  76 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
  77
  78 /* ---- HCI notifications ---- */
  79
  80 int hci_register_notifier(struct notifier_block *nb)
  81 {
  82         return atomic_notifier_chain_register(&hci_notifier, nb);
  83 }
  84
  85 int hci_unregister_notifier(struct notifier_block *nb)
  86 {
  87         return atomic_notifier_chain_unregister(&hci_notifier, nb);
  88 }
  89
  90 static void hci_notify(struct hci_dev *hdev, int event)
  91 {
  92         atomic_notifier_call_chain(&hci_notifier, event, hdev);
  93 }
  94
  95 /* ---- HCI requests ---- */
  96
  97 void hci_req_complete(struct hci_dev *hdev, int result)
  98 {
  99         BT_DBG("%s result 0x%2.2x", hdev->name, result);
 100
 101         if (hdev->req_status == HCI_REQ_PEND) {
 102                 hdev->req_result = result;
 103                 hdev->req_status = HCI_REQ_DONE;
 104                 wake_up_interruptible(&hdev->req_wait_q);
 105         }
 106 }
 107
 108 static void hci_req_cancel(struct hci_dev *hdev, int err)
 109 {
 110         BT_DBG("%s err 0x%2.2x", hdev->name, err);
 111
 112         if (hdev->req_status == HCI_REQ_PEND) {
 113                 hdev->req_result = err;
 114                 hdev->req_status = HCI_REQ_CANCELED;
 115                 wake_up_interruptible(&hdev->req_wait_q);
 116         }
 117 }
 118
 119 /* Execute request and wait for completion. */
 120 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 121                                 unsigned long opt, __u32 timeout)
 122 {
 123         DECLARE_WAITQUEUE(wait, current);
 124         int err = 0;
 125
 126         BT_DBG("%s start", hdev->name);
 127
 128         hdev->req_status = HCI_REQ_PEND;
 129
 130         add_wait_queue(&hdev->req_wait_q, &wait);
 131         set_current_state(TASK_INTERRUPTIBLE);
 132
 133         req(hdev, opt);
 134         schedule_timeout(timeout);
 135
 136         remove_wait_queue(&hdev->req_wait_q, &wait);
 137
 138         if (signal_pending(current))
 139                 return -EINTR;
 140
 141         switch (hdev->req_status) {
 142         case HCI_REQ_DONE:
 143                 err = -bt_err(hdev->req_result);
 144                 break;
 145
 146         case HCI_REQ_CANCELED:
 147                 err = -hdev->req_result;
 148                 break;
 149
 150         default:
 151                 err = -ETIMEDOUT;
 152                 break;
 153         }
 154
 155         hdev->req_status = hdev->req_result = 0;
 156
 157         BT_DBG("%s end: err %d", hdev->name, err);
 158
 159         return err;
 160 }
 161
 162 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 163                                 unsigned long opt, __u32 timeout)
 164 {
 165         int ret;
 166
 167         /* Serialize all requests */
 168         hci_req_lock(hdev);
 169         ret = __hci_request(hdev, req, opt, timeout);
 170         hci_req_unlock(hdev);
 171
 172         return ret;
 173 }
 174
 175 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
 176 {
 177         BT_DBG("%s %ld", hdev->name, opt);
 178
 179         /* Reset device */
 180         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 181 }
 182
 183 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 184 {
 185         struct sk_buff *skb;
 186         __le16 param;
 187         __u8 flt_type;
 188
 189         BT_DBG("%s %ld", hdev->name, opt);
 190
 191         /* Driver initialization */
 192
 193         /* Special commands */
 194         while ((skb = skb_dequeue(&hdev->driver_init))) {
 195                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
 196                 skb->dev = (void *) hdev;
 197                 skb_queue_tail(&hdev->cmd_q, skb);
 198                 hci_sched_cmd(hdev);
 199         }
 200         skb_queue_purge(&hdev->driver_init);
 201
 202         /* Mandatory initialization */
 203
 204         /* Reset */
 205         if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks))
 206                         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 207
 208         /* Read Local Supported Features */
 209         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 210
 211         /* Read Local Version */
 212         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 213
 214         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 215         hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 216
 217 #if 0
 218         /* Host buffer size */
 219         {
 220                 struct hci_cp_host_buffer_size cp;
 221                 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
 222                 cp.sco_mtu = HCI_MAX_SCO_SIZE;
 223                 cp.acl_max_pkt = cpu_to_le16(0xffff);
 224                 cp.sco_max_pkt = cpu_to_le16(0xffff);
 225                 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
 226         }
 227 #endif
 228
 229         /* Read BD Address */
 230         hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
 231
 232         /* Read Class of Device */
 233         hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 234
 235         /* Read Local Name */
 236         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 237
 238         /* Read Voice Setting */
 239         hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 240
 241         /* Optional initialization */
 242
 243         /* Clear Event Filters */
 244         flt_type = HCI_FLT_CLEAR_ALL;
 245         hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 246
 247         /* Page timeout ~20 secs */
 248         param = cpu_to_le16(0x8000);
 249         hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, &param);
 250
 251         /* Connection accept timeout ~20 secs */
 252         param = cpu_to_le16(0x7d00);
 253         hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 254 }
 255
 256 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
 257 {
 258         __u8 scan = opt;
 259
 260         BT_DBG("%s %x", hdev->name, scan);
 261
 262         /* Inquiry and Page scans */
 263         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 264 }
 265
 266 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
 267 {
 268         __u8 auth = opt;
 269
 270         BT_DBG("%s %x", hdev->name, auth);
 271
 272         /* Authentication */
 273         hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 274 }
 275
 276 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
 277 {
 278         __u8 encrypt = opt;
 279
 280         BT_DBG("%s %x", hdev->name, encrypt);
 281
 282         /* Encryption */
 283         hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 284 }
 285
 286 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
 287 {
 288         __le16 policy = cpu_to_le16(opt);
 289
 290         BT_DBG("%s %x", hdev->name, opt);
 291
 292         /* Default link policy */
 293         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 294 }
 295
 296 /* Get HCI device by index.
 297  * Device is held on return. */
 298 struct hci_dev *hci_dev_get(int index)
 299 {
 300         struct hci_dev *hdev = NULL;
 301         struct list_head *p;
 302
 303         BT_DBG("%d", index);
 304
 305         if (index < 0)
 306                 return NULL;
 307
 308         read_lock(&hci_dev_list_lock);
 309         list_for_each(p, &hci_dev_list) {
 310                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 311                 if (d->id == index) {
 312                         hdev = hci_dev_hold(d);
 313                         break;
 314                 }
 315         }
 316         read_unlock(&hci_dev_list_lock);
 317         return hdev;
 318 }
 319
 320 /* ---- Inquiry support ---- */
 321 static void inquiry_cache_flush(struct hci_dev *hdev)
 322 {
 323         struct inquiry_cache *cache = &hdev->inq_cache;
 324         struct inquiry_entry *next  = cache->list, *e;
 325
 326         BT_DBG("cache %p", cache);
 327
 328         cache->list = NULL;
 329         while ((e = next)) {
 330                 next = e->next;
 331                 kfree(e);
 332         }
 333 }
 334
 335 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 336 {
 337         struct inquiry_cache *cache = &hdev->inq_cache;
 338         struct inquiry_entry *e;
 339
 340         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 341
 342         for (e = cache->list; e; e = e->next)
 343                 if (!bacmp(&e->data.bdaddr, bdaddr))
 344                         break;
 345         return e;
 346 }
 347
 348 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
 349 {
 350         struct inquiry_cache *cache = &hdev->inq_cache;
 351         struct inquiry_entry *e;
 352
 353         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 354
 355         if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
 356                 /* Entry not in the cache. Add new one. */
 357                 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
 358                         return;
 359                 e->next     = cache->list;
 360                 cache->list = e;
 361         }
 362
 363         memcpy(&e->data, data, sizeof(*data));
 364         e->timestamp = jiffies;
 365         cache->timestamp = jiffies;
 366 }
 367
 368 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 369 {
 370         struct inquiry_cache *cache = &hdev->inq_cache;
 371         struct inquiry_info *info = (struct inquiry_info *) buf;
 372         struct inquiry_entry *e;
 373         int copied = 0;
 374
 375         for (e = cache->list; e && copied < num; e = e->next, copied++) {
 376                 struct inquiry_data *data = &e->data;
 377                 bacpy(&info->bdaddr, &data->bdaddr);
 378                 info->pscan_rep_mode    = data->pscan_rep_mode;
 379                 info->pscan_period_mode = data->pscan_period_mode;
 380                 info->pscan_mode        = data->pscan_mode;
 381                 memcpy(info->dev_class, data->dev_class, 3);
 382                 info->clock_offset      = data->clock_offset;
 383                 info++;
 384         }
 385
 386         BT_DBG("cache %p, copied %d", cache, copied);
 387         return copied;
 388 }
 389
 390 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
 391 {
 392         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
 393         struct hci_cp_inquiry cp;
 394
 395         BT_DBG("%s", hdev->name);
 396
 397         if (test_bit(HCI_INQUIRY, &hdev->flags))
 398                 return;
 399
 400         /* Start Inquiry */
 401         memcpy(&cp.lap, &ir->lap, 3);
 402         cp.length  = ir->length;
 403         cp.num_rsp = ir->num_rsp;
 404         hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
 405 }
 406
 407 int hci_inquiry(void __user *arg)
 408 {
 409         __u8 __user *ptr = arg;
 410         struct hci_inquiry_req ir;
 411         struct hci_dev *hdev;
 412         int err = 0, do_inquiry = 0, max_rsp;
 413         long timeo;
 414         __u8 *buf;
 415
 416         if (copy_from_user(&ir, ptr, sizeof(ir)))
 417                 return -EFAULT;
 418
 419         if (!(hdev = hci_dev_get(ir.dev_id)))
 420                 return -ENODEV;
 421
 422         hci_dev_lock_bh(hdev);
 423         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 424                                         inquiry_cache_empty(hdev) ||
 425                                         ir.flags & IREQ_CACHE_FLUSH) {
 426                 inquiry_cache_flush(hdev);
 427                 do_inquiry = 1;
 428         }
 429         hci_dev_unlock_bh(hdev);
 430
 431         timeo = ir.length * msecs_to_jiffies(2000);
 432         if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
 433                 goto done;
 434
 435         /* for unlimited number of responses we will use buffer with 255 entries */
 436         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 437
 438         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
 439          * copy it to the user space.
 440          */
 441         if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
 442                 err = -ENOMEM;
 443                 goto done;
 444         }
 445
 446         hci_dev_lock_bh(hdev);
 447         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
 448         hci_dev_unlock_bh(hdev);
 449
 450         BT_DBG("num_rsp %d", ir.num_rsp);
 451
 452         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
 453                 ptr += sizeof(ir);
 454                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
 455                                         ir.num_rsp))
 456                         err = -EFAULT;
 457         } else
 458                 err = -EFAULT;
 459
 460         kfree(buf);
 461
 462 done:
 463         hci_dev_put(hdev);
 464         return err;
 465 }
 466
 467 /* ---- HCI ioctl helpers ---- */
 468
 469 int hci_dev_open(__u16 dev)
 470 {
 471         struct hci_dev *hdev;
 472         int ret = 0;
 473
 474         if (!(hdev = hci_dev_get(dev)))
 475                 return -ENODEV;
 476
 477         BT_DBG("%s %p", hdev->name, hdev);
 478
 479         hci_req_lock(hdev);
 480
 481         if (test_bit(HCI_UP, &hdev->flags)) {
 482                 ret = -EALREADY;
 483                 goto done;
 484         }
 485
 486         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 487                 set_bit(HCI_RAW, &hdev->flags);
 488
 489         if (hdev->open(hdev)) {
 490                 ret = -EIO;
 491                 goto done;
 492         }
 493
 494         if (!test_bit(HCI_RAW, &hdev->flags)) {
 495                 atomic_set(&hdev->cmd_cnt, 1);
 496                 set_bit(HCI_INIT, &hdev->flags);
 497
 498                 //__hci_request(hdev, hci_reset_req, 0, HZ);
 499                 ret = __hci_request(hdev, hci_init_req, 0,
 500                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 501
 502                 clear_bit(HCI_INIT, &hdev->flags);
 503         }
 504
 505         if (!ret) {
 506                 hci_dev_hold(hdev);
 507                 set_bit(HCI_UP, &hdev->flags);
 508                 hci_notify(hdev, HCI_DEV_UP);
 509         } else {
 510                 /* Init failed, cleanup */
 511                 tasklet_kill(&hdev->rx_task);
 512                 tasklet_kill(&hdev->tx_task);
 513                 tasklet_kill(&hdev->cmd_task);
 514
 515                 skb_queue_purge(&hdev->cmd_q);
 516                 skb_queue_purge(&hdev->rx_q);
 517
 518                 if (hdev->flush)
 519                         hdev->flush(hdev);
 520
 521                 if (hdev->sent_cmd) {
 522                         kfree_skb(hdev->sent_cmd);
 523                         hdev->sent_cmd = NULL;
 524                 }
 525
 526                 hdev->close(hdev);
 527                 hdev->flags = 0;
 528         }
 529
 530 done:
 531         hci_req_unlock(hdev);
 532         hci_dev_put(hdev);
 533         return ret;
 534 }
 535
 536 static int hci_dev_do_close(struct hci_dev *hdev)
 537 {
 538         BT_DBG("%s %p", hdev->name, hdev);
 539
 540         hci_req_cancel(hdev, ENODEV);
 541         hci_req_lock(hdev);
 542
 543         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 544                 hci_req_unlock(hdev);
 545                 return 0;
 546         }
 547
 548         /* Kill RX and TX tasks */
 549         tasklet_kill(&hdev->rx_task);
 550         tasklet_kill(&hdev->tx_task);
 551
 552         hci_dev_lock_bh(hdev);
 553         inquiry_cache_flush(hdev);
 554         hci_conn_hash_flush(hdev);
 555         hci_dev_unlock_bh(hdev);
 556
 557         hci_notify(hdev, HCI_DEV_DOWN);
 558
 559         if (hdev->flush)
 560                 hdev->flush(hdev);
 561
 562         /* Reset device */
 563         skb_queue_purge(&hdev->cmd_q);
 564         atomic_set(&hdev->cmd_cnt, 1);
 565         if (!test_bit(HCI_RAW, &hdev->flags)) {
 566                 set_bit(HCI_INIT, &hdev->flags);
 567                 __hci_request(hdev, hci_reset_req, 0,
 568                                         msecs_to_jiffies(250));
 569                 clear_bit(HCI_INIT, &hdev->flags);
 570         }
 571
 572         /* Kill cmd task */
 573         tasklet_kill(&hdev->cmd_task);
 574
 575         /* Drop queues */
 576         skb_queue_purge(&hdev->rx_q);
 577         skb_queue_purge(&hdev->cmd_q);
 578         skb_queue_purge(&hdev->raw_q);
 579
 580         /* Drop last sent command */
 581         if (hdev->sent_cmd) {
 582                 kfree_skb(hdev->sent_cmd);
 583                 hdev->sent_cmd = NULL;
 584         }
 585
 586         /* After this point our queues are empty
 587          * and no tasks are scheduled. */
 588         hdev->close(hdev);
 589
 590         /* Clear flags */
 591         hdev->flags = 0;
 592
 593         hci_req_unlock(hdev);
 594
 595         hci_dev_put(hdev);
 596         return 0;
 597 }
 598
 599 int hci_dev_close(__u16 dev)
 600 {
 601         struct hci_dev *hdev;
 602         int err;
 603
 604         if (!(hdev = hci_dev_get(dev)))
 605                 return -ENODEV;
 606         err = hci_dev_do_close(hdev);
 607         hci_dev_put(hdev);
 608         return err;
 609 }
 610
 611 int hci_dev_reset(__u16 dev)
 612 {
 613         struct hci_dev *hdev;
 614         int ret = 0;
 615
 616         if (!(hdev = hci_dev_get(dev)))
 617                 return -ENODEV;
 618
 619         hci_req_lock(hdev);
 620         tasklet_disable(&hdev->tx_task);
 621
 622         if (!test_bit(HCI_UP, &hdev->flags))
 623                 goto done;
 624
 625         /* Drop queues */
 626         skb_queue_purge(&hdev->rx_q);
 627         skb_queue_purge(&hdev->cmd_q);
 628
 629         hci_dev_lock_bh(hdev);
 630         inquiry_cache_flush(hdev);
 631         hci_conn_hash_flush(hdev);
 632         hci_dev_unlock_bh(hdev);
 633
 634         if (hdev->flush)
 635                 hdev->flush(hdev);
 636
 637         atomic_set(&hdev->cmd_cnt, 1);
 638         hdev->acl_cnt = 0; hdev->sco_cnt = 0;
 639
 640         if (!test_bit(HCI_RAW, &hdev->flags))
 641                 ret = __hci_request(hdev, hci_reset_req, 0,
 642                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 643
 644 done:
 645         tasklet_enable(&hdev->tx_task);
 646         hci_req_unlock(hdev);
 647         hci_dev_put(hdev);
 648         return ret;
 649 }
 650
 651 int hci_dev_reset_stat(__u16 dev)
 652 {
 653         struct hci_dev *hdev;
 654         int ret = 0;
 655
 656         if (!(hdev = hci_dev_get(dev)))
 657                 return -ENODEV;
 658
 659         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 660
 661         hci_dev_put(hdev);
 662
 663         return ret;
 664 }
 665
 666 int hci_dev_cmd(unsigned int cmd, void __user *arg)
 667 {
 668         struct hci_dev *hdev;
 669         struct hci_dev_req dr;
 670         int err = 0;
 671
 672         if (copy_from_user(&dr, arg, sizeof(dr)))
 673                 return -EFAULT;
 674
 675         if (!(hdev = hci_dev_get(dr.dev_id)))
 676                 return -ENODEV;
 677
 678         switch (cmd) {
 679         case HCISETAUTH:
 680                 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 681                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 682                 break;
 683
 684         case HCISETENCRYPT:
 685                 if (!lmp_encrypt_capable(hdev)) {
 686                         err = -EOPNOTSUPP;
 687                         break;
 688                 }
 689
 690                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
 691                         /* Auth must be enabled first */
 692                         err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 693                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 694                         if (err)
 695                                 break;
 696                 }
 697
 698                 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
 699                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 700                 break;
 701
 702         case HCISETSCAN:
 703                 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
 704                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 705                 break;
 706
 707         case HCISETLINKPOL:
 708                 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
 709                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 710                 break;
 711
 712         case HCISETLINKMODE:
 713                 hdev->link_mode = ((__u16) dr.dev_opt) &
 714                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
 715                 break;
 716
 717         case HCISETPTYPE:
 718                 hdev->pkt_type = (__u16) dr.dev_opt;
 719                 break;
 720
 721         case HCISETACLMTU:
 722                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
 723                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
 724                 break;
 725
 726         case HCISETSCOMTU:
 727                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
 728                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
 729                 break;
 730
 731         default:
 732                 err = -EINVAL;
 733                 break;
 734         }
 735
 736         hci_dev_put(hdev);
 737         return err;
 738 }
 739
 740 int hci_get_dev_list(void __user *arg)
 741 {
 742         struct hci_dev_list_req *dl;
 743         struct hci_dev_req *dr;
 744         struct list_head *p;
 745         int n = 0, size, err;
 746         __u16 dev_num;
 747
 748         if (get_user(dev_num, (__u16 __user *) arg))
 749                 return -EFAULT;
 750
 751         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
 752                 return -EINVAL;
 753
 754         size = sizeof(*dl) + dev_num * sizeof(*dr);
 755
 756         if (!(dl = kmalloc(size, GFP_KERNEL)))
 757                 return -ENOMEM;
 758
 759         dr = dl->dev_req;
 760
 761         read_lock_bh(&hci_dev_list_lock);
 762         list_for_each(p, &hci_dev_list) {
 763                 struct hci_dev *hdev;
 764                 hdev = list_entry(p, struct hci_dev, list);
 765                 (dr + n)->dev_id  = hdev->id;
 766                 (dr + n)->dev_opt = hdev->flags;
 767                 if (++n >= dev_num)
 768                         break;
 769         }
 770         read_unlock_bh(&hci_dev_list_lock);
 771
 772         dl->dev_num = n;
 773         size = sizeof(*dl) + n * sizeof(*dr);
 774
 775         err = copy_to_user(arg, dl, size);
 776         kfree(dl);
 777
 778         return err ? -EFAULT : 0;
 779 }
 780
 781 int hci_get_dev_info(void __user *arg)
 782 {
 783         struct hci_dev *hdev;
 784         struct hci_dev_info di;
 785         int err = 0;
 786
 787         if (copy_from_user(&di, arg, sizeof(di)))
 788                 return -EFAULT;
 789
 790         if (!(hdev = hci_dev_get(di.dev_id)))
 791                 return -ENODEV;
 792
 793         strcpy(di.name, hdev->name);
 794         di.bdaddr   = hdev->bdaddr;
 795         di.type     = hdev->type;
 796         di.flags    = hdev->flags;
 797         di.pkt_type = hdev->pkt_type;
 798         di.acl_mtu  = hdev->acl_mtu;
 799         di.acl_pkts = hdev->acl_pkts;
 800         di.sco_mtu  = hdev->sco_mtu;
 801         di.sco_pkts = hdev->sco_pkts;
 802         di.link_policy = hdev->link_policy;
 803         di.link_mode   = hdev->link_mode;
 804
 805         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
 806         memcpy(&di.features, &hdev->features, sizeof(di.features));
 807
 808         if (copy_to_user(arg, &di, sizeof(di)))
 809                 err = -EFAULT;
 810
 811         hci_dev_put(hdev);
 812
 813         return err;
 814 }
 815
 816 /* ---- Interface to HCI drivers ---- */
 817
 818 /* Alloc HCI device */
 819 struct hci_dev *hci_alloc_dev(void)
 820 {
 821         struct hci_dev *hdev;
 822
 823         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
 824         if (!hdev)
 825                 return NULL;
 826
 827         skb_queue_head_init(&hdev->driver_init);
 828
 829         return hdev;
 830 }
 831 EXPORT_SYMBOL(hci_alloc_dev);
 832
 833 /* Free HCI device */
 834 void hci_free_dev(struct hci_dev *hdev)
 835 {
 836         skb_queue_purge(&hdev->driver_init);
 837
 838         /* will free via device release */
 839         put_device(&hdev->dev);
 840 }
 841 EXPORT_SYMBOL(hci_free_dev);
 842
 843 /* Register HCI device */
 844 int hci_register_dev(struct hci_dev *hdev)
 845 {
 846         struct list_head *head = &hci_dev_list, *p;
 847         int i, id = 0;
 848
 849         BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner);
 850
 851         if (!hdev->open || !hdev->close || !hdev->destruct)
 852                 return -EINVAL;
 853
 854         write_lock_bh(&hci_dev_list_lock);
 855
 856         /* Find first available device id */
 857         list_for_each(p, &hci_dev_list) {
 858                 if (list_entry(p, struct hci_dev, list)->id != id)
 859                         break;
 860                 head = p; id++;
 861         }
 862
 863         sprintf(hdev->name, "hci%d", id);
 864         hdev->id = id;
 865         list_add(&hdev->list, head);
 866
 867         atomic_set(&hdev->refcnt, 1);
 868         spin_lock_init(&hdev->lock);
 869
 870         hdev->flags = 0;
 871         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
 872         hdev->esco_type = (ESCO_HV1);
 873         hdev->link_mode = (HCI_LM_ACCEPT);
 874
 875         hdev->idle_timeout = 0;
 876         hdev->sniff_max_interval = 800;
 877         hdev->sniff_min_interval = 80;
 878
 879         tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
 880         tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
 881         tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
 882
 883         skb_queue_head_init(&hdev->rx_q);
 884         skb_queue_head_init(&hdev->cmd_q);
 885         skb_queue_head_init(&hdev->raw_q);
 886
 887         for (i = 0; i < 3; i++)
 888                 hdev->reassembly[i] = NULL;
 889
 890         init_waitqueue_head(&hdev->req_wait_q);
 891         init_MUTEX(&hdev->req_lock);
 892
 893         inquiry_cache_init(hdev);
 894
 895         hci_conn_hash_init(hdev);
 896
 897         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 898
 899         atomic_set(&hdev->promisc, 0);
 900
 901         write_unlock_bh(&hci_dev_list_lock);
 902
 903         hci_register_sysfs(hdev);
 904
 905         hci_notify(hdev, HCI_DEV_REG);
 906
 907         return id;
 908 }
 909 EXPORT_SYMBOL(hci_register_dev);
 910
 911 /* Unregister HCI device */
 912 int hci_unregister_dev(struct hci_dev *hdev)
 913 {
 914         int i;
 915
 916         BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
 917
 918         write_lock_bh(&hci_dev_list_lock);
 919         list_del(&hdev->list);
 920         write_unlock_bh(&hci_dev_list_lock);
 921
 922         hci_dev_do_close(hdev);
 923
 924         for (i = 0; i < 3; i++)
 925                 kfree_skb(hdev->reassembly[i]);
 926
 927         hci_notify(hdev, HCI_DEV_UNREG);
 928
 929         hci_unregister_sysfs(hdev);
 930
 931         __hci_dev_put(hdev);
 932
 933         return 0;
 934 }
 935 EXPORT_SYMBOL(hci_unregister_dev);
 936
 937 /* Suspend HCI device */
 938 int hci_suspend_dev(struct hci_dev *hdev)
 939 {
 940         hci_notify(hdev, HCI_DEV_SUSPEND);
 941         return 0;
 942 }
 943 EXPORT_SYMBOL(hci_suspend_dev);
 944
 945 /* Resume HCI device */
 946 int hci_resume_dev(struct hci_dev *hdev)
 947 {
 948         hci_notify(hdev, HCI_DEV_RESUME);
 949         return 0;
 950 }
 951 EXPORT_SYMBOL(hci_resume_dev);
 952
 953 /* Receive packet type fragment */
 954 #define __reassembly(hdev, type)  ((hdev)->reassembly[(type) - 2])
 955
 956 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
 957 {
 958         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
 959                 return -EILSEQ;
 960
 961         while (count) {
 962                 struct sk_buff *skb = __reassembly(hdev, type);
 963                 struct { int expect; } *scb;
 964                 int len = 0;
 965
 966                 if (!skb) {
 967                         /* Start of the frame */
 968
 969                         switch (type) {
 970                         case HCI_EVENT_PKT:
 971                                 if (count >= HCI_EVENT_HDR_SIZE) {
 972                                         struct hci_event_hdr *h = data;
 973                                         len = HCI_EVENT_HDR_SIZE + h->plen;
 974                                 } else
 975                                         return -EILSEQ;
 976                                 break;
 977
 978                         case HCI_ACLDATA_PKT:
 979                                 if (count >= HCI_ACL_HDR_SIZE) {
 980                                         struct hci_acl_hdr *h = data;
 981                                         len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen);
 982                                 } else
 983                                         return -EILSEQ;
 984                                 break;
 985
 986                         case HCI_SCODATA_PKT:
 987                                 if (count >= HCI_SCO_HDR_SIZE) {
 988                                         struct hci_sco_hdr *h = data;
 989                                         len = HCI_SCO_HDR_SIZE + h->dlen;
 990                                 } else
 991                                         return -EILSEQ;
 992                                 break;
 993                         }
 994
 995                         skb = bt_skb_alloc(len, GFP_ATOMIC);
 996                         if (!skb) {
 997                                 BT_ERR("%s no memory for packet", hdev->name);
 998                                 return -ENOMEM;
 999                         }
1000
1001                         skb->dev = (void *) hdev;
1002                         bt_cb(skb)->pkt_type = type;
1003
1004                         __reassembly(hdev, type) = skb;
1005
1006                         scb = (void *) skb->cb;
1007                         scb->expect = len;
1008                 } else {
1009                         /* Continuation */
1010
1011                         scb = (void *) skb->cb;
1012                         len = scb->expect;
1013                 }
1014
1015                 len = min(len, count);
1016
1017                 memcpy(skb_put(skb, len), data, len);
1018
1019                 scb->expect -= len;
1020
1021                 if (scb->expect == 0) {
1022                         /* Complete frame */
1023
1024                         __reassembly(hdev, type) = NULL;
1025
1026                         bt_cb(skb)->pkt_type = type;
1027                         hci_recv_frame(skb);
1028                 }
1029
1030                 count -= len; data += len;
1031         }
1032
1033         return 0;
1034 }
1035 EXPORT_SYMBOL(hci_recv_fragment);
1036
1037 /* ---- Interface to upper protocols ---- */
1038
1039 /* Register/Unregister protocols.
1040  * hci_task_lock is used to ensure that no tasks are running. */
1041 int hci_register_proto(struct hci_proto *hp)
1042 {
1043         int err = 0;
1044
1045         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1046
1047         if (hp->id >= HCI_MAX_PROTO)
1048                 return -EINVAL;
1049
1050         write_lock_bh(&hci_task_lock);
1051
1052         if (!hci_proto[hp->id])
1053                 hci_proto[hp->id] = hp;
1054         else
1055                 err = -EEXIST;
1056
1057         write_unlock_bh(&hci_task_lock);
1058
1059         return err;
1060 }
1061 EXPORT_SYMBOL(hci_register_proto);
1062
1063 int hci_unregister_proto(struct hci_proto *hp)
1064 {
1065         int err = 0;
1066
1067         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1068
1069         if (hp->id >= HCI_MAX_PROTO)
1070                 return -EINVAL;
1071
1072         write_lock_bh(&hci_task_lock);
1073
1074         if (hci_proto[hp->id])
1075                 hci_proto[hp->id] = NULL;
1076         else
1077                 err = -ENOENT;
1078
1079         write_unlock_bh(&hci_task_lock);
1080
1081         return err;
1082 }
1083 EXPORT_SYMBOL(hci_unregister_proto);
1084
1085 int hci_register_cb(struct hci_cb *cb)
1086 {
1087         BT_DBG("%p name %s", cb, cb->name);
1088
1089         write_lock_bh(&hci_cb_list_lock);
1090         list_add(&cb->list, &hci_cb_list);
1091         write_unlock_bh(&hci_cb_list_lock);
1092
1093         return 0;
1094 }
1095 EXPORT_SYMBOL(hci_register_cb);
1096
1097 int hci_unregister_cb(struct hci_cb *cb)
1098 {
1099         BT_DBG("%p name %s", cb, cb->name);
1100
1101         write_lock_bh(&hci_cb_list_lock);
1102         list_del(&cb->list);
1103         write_unlock_bh(&hci_cb_list_lock);
1104
1105         return 0;
1106 }
1107 EXPORT_SYMBOL(hci_unregister_cb);
1108
1109 static int hci_send_frame(struct sk_buff *skb)
1110 {
1111         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1112
1113         if (!hdev) {
1114                 kfree_skb(skb);
1115                 return -ENODEV;
1116         }
1117
1118         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1119
1120         if (atomic_read(&hdev->promisc)) {
1121                 /* Time stamp */
1122                 __net_timestamp(skb);
1123
1124                 hci_send_to_sock(hdev, skb);
1125         }
1126
1127         /* Get rid of skb owner, prior to sending to the driver. */
1128         skb_orphan(skb);
1129
1130         return hdev->send(skb);
1131 }
1132
1133 /* Send HCI command */
1134 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1135 {
1136         int len = HCI_COMMAND_HDR_SIZE + plen;
1137         struct hci_command_hdr *hdr;
1138         struct sk_buff *skb;
1139
1140         BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1141
1142         skb = bt_skb_alloc(len, GFP_ATOMIC);
1143         if (!skb) {
1144                 BT_ERR("%s no memory for command", hdev->name);
1145                 return -ENOMEM;
1146         }
1147
1148         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1149         hdr->opcode = cpu_to_le16(opcode);
1150         hdr->plen   = plen;
1151
1152         if (plen)
1153                 memcpy(skb_put(skb, plen), param, plen);
1154
1155         BT_DBG("skb len %d", skb->len);
1156
1157         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1158         skb->dev = (void *) hdev;
1159         skb_queue_tail(&hdev->cmd_q, skb);
1160         hci_sched_cmd(hdev);
1161
1162         return 0;
1163 }
1164
1165 /* Get data from the previously sent command */
1166 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1167 {
1168         struct hci_command_hdr *hdr;
1169
1170         if (!hdev->sent_cmd)
1171                 return NULL;
1172
1173         hdr = (void *) hdev->sent_cmd->data;
1174
1175         if (hdr->opcode != cpu_to_le16(opcode))
1176                 return NULL;
1177
1178         BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1179
1180         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1181 }
1182
1183 /* Send ACL data */
1184 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1185 {
1186         struct hci_acl_hdr *hdr;
1187         int len = skb->len;
1188
1189         skb_push(skb, HCI_ACL_HDR_SIZE);
1190         skb_reset_transport_header(skb);
1191         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
1192         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1193         hdr->dlen   = cpu_to_le16(len);
1194 }
1195
1196 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1197 {
1198         struct hci_dev *hdev = conn->hdev;
1199         struct sk_buff *list;
1200
1201         BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1202
1203         skb->dev = (void *) hdev;
1204         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1205         hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
1206
1207         if (!(list = skb_shinfo(skb)->frag_list)) {
1208                 /* Non fragmented */
1209                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1210
1211                 skb_queue_tail(&conn->data_q, skb);
1212         } else {
1213                 /* Fragmented */
1214                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1215
1216                 skb_shinfo(skb)->frag_list = NULL;
1217
1218                 /* Queue all fragments atomically */
1219                 spin_lock_bh(&conn->data_q.lock);
1220
1221                 __skb_queue_tail(&conn->data_q, skb);
1222                 do {
1223                         skb = list; list = list->next;
1224
1225                         skb->dev = (void *) hdev;
1226                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1227                         hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
1228
1229                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1230
1231                         __skb_queue_tail(&conn->data_q, skb);
1232                 } while (list);
1233
1234                 spin_unlock_bh(&conn->data_q.lock);
1235         }
1236
1237         hci_sched_tx(hdev);
1238         return 0;
1239 }
1240 EXPORT_SYMBOL(hci_send_acl);
1241
1242 /* Send SCO data */
1243 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1244 {
1245         struct hci_dev *hdev = conn->hdev;
1246         struct hci_sco_hdr hdr;
1247
1248         BT_DBG("%s len %d", hdev->name, skb->len);
1249
1250         if (skb->len > hdev->sco_mtu) {
1251                 kfree_skb(skb);
1252                 return -EINVAL;
1253         }
1254
1255         hdr.handle = cpu_to_le16(conn->handle);
1256         hdr.dlen   = skb->len;
1257
1258         skb_push(skb, HCI_SCO_HDR_SIZE);
1259         skb_reset_transport_header(skb);
1260         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1261
1262         skb->dev = (void *) hdev;
1263         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1264         skb_queue_tail(&conn->data_q, skb);
1265         hci_sched_tx(hdev);
1266         return 0;
1267 }
1268 EXPORT_SYMBOL(hci_send_sco);
1269
1270 /* ---- HCI TX task (outgoing data) ---- */
1271
1272 /* HCI Connection scheduler */
1273 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1274 {
1275         struct hci_conn_hash *h = &hdev->conn_hash;
1276         struct hci_conn *conn = NULL;
1277         int num = 0, min = ~0;
1278         struct list_head *p;
1279
1280         /* We don't have to lock device here. Connections are always
1281          * added and removed with TX task disabled. */
1282         list_for_each(p, &h->list) {
1283                 struct hci_conn *c;
1284                 c = list_entry(p, struct hci_conn, list);
1285
1286                 if (c->type != type || skb_queue_empty(&c->data_q))
1287                         continue;
1288
1289                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1290                         continue;
1291
1292                 num++;
1293
1294                 if (c->sent < min) {
1295                         min  = c->sent;
1296                         conn = c;
1297                 }
1298         }
1299
1300         if (conn) {
1301                 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
1302                 int q = cnt / num;
1303                 *quote = q ? q : 1;
1304         } else
1305                 *quote = 0;
1306
1307         BT_DBG("conn %p quote %d", conn, *quote);
1308         return conn;
1309 }
1310
1311 static inline void hci_acl_tx_to(struct hci_dev *hdev)
1312 {
1313         struct hci_conn_hash *h = &hdev->conn_hash;
1314         struct list_head *p;
1315         struct hci_conn  *c;
1316
1317         BT_ERR("%s ACL tx timeout", hdev->name);
1318
1319         /* Kill stalled connections */
1320         list_for_each(p, &h->list) {
1321                 c = list_entry(p, struct hci_conn, list);
1322                 if (c->type == ACL_LINK && c->sent) {
1323                         BT_ERR("%s killing stalled ACL connection %s",
1324                                 hdev->name, batostr(&c->dst));
1325                         hci_acl_disconn(c, 0x13);
1326                 }
1327         }
1328 }
1329
1330 static inline void hci_sched_acl(struct hci_dev *hdev)
1331 {
1332         struct hci_conn *conn;
1333         struct sk_buff *skb;
1334         int quote;
1335
1336         BT_DBG("%s", hdev->name);
1337
1338         if (!test_bit(HCI_RAW, &hdev->flags)) {
1339                 /* ACL tx timeout must be longer than maximum
1340                  * link supervision timeout (40.9 seconds) */
1341                 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
1342                         hci_acl_tx_to(hdev);
1343         }
1344
1345         while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1346                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1347                         BT_DBG("skb %p len %d", skb, skb->len);
1348
1349                         hci_conn_enter_active_mode(conn);
1350
1351                         hci_send_frame(skb);
1352                         hdev->acl_last_tx = jiffies;
1353
1354                         hdev->acl_cnt--;
1355                         conn->sent++;
1356                 }
1357         }
1358 }
1359
1360 /* Schedule SCO */
1361 static inline void hci_sched_sco(struct hci_dev *hdev)
1362 {
1363         struct hci_conn *conn;
1364         struct sk_buff *skb;
1365         int quote;
1366
1367         BT_DBG("%s", hdev->name);
1368
1369         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1370                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1371                         BT_DBG("skb %p len %d", skb, skb->len);
1372                         hci_send_frame(skb);
1373
1374                         conn->sent++;
1375                         if (conn->sent == ~0)
1376                                 conn->sent = 0;
1377                 }
1378         }
1379 }
1380
1381 static inline void hci_sched_esco(struct hci_dev *hdev)
1382 {
1383         struct hci_conn *conn;
1384         struct sk_buff *skb;
1385         int quote;
1386
1387         BT_DBG("%s", hdev->name);
1388
1389         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1390                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1391                         BT_DBG("skb %p len %d", skb, skb->len);
1392                         hci_send_frame(skb);
1393
1394                         conn->sent++;
1395                         if (conn->sent == ~0)
1396                                 conn->sent = 0;
1397                 }
1398         }
1399 }
1400
1401 static void hci_tx_task(unsigned long arg)
1402 {
1403         struct hci_dev *hdev = (struct hci_dev *) arg;
1404         struct sk_buff *skb;
1405
1406         read_lock(&hci_task_lock);
1407
1408         BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
1409
1410         /* Schedule queues and send stuff to HCI driver */
1411
1412         hci_sched_acl(hdev);
1413
1414         hci_sched_sco(hdev);
1415
1416         hci_sched_esco(hdev);
1417
1418         /* Send next queued raw (unknown type) packet */
1419         while ((skb = skb_dequeue(&hdev->raw_q)))
1420                 hci_send_frame(skb);
1421
1422         read_unlock(&hci_task_lock);
1423 }
1424
1425 /* ----- HCI RX task (incoming data proccessing) ----- */
1426
1427 /* ACL data packet */
1428 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1429 {
1430         struct hci_acl_hdr *hdr = (void *) skb->data;
1431         struct hci_conn *conn;
1432         __u16 handle, flags;
1433
1434         skb_pull(skb, HCI_ACL_HDR_SIZE);
1435
1436         handle = __le16_to_cpu(hdr->handle);
1437         flags  = hci_flags(handle);
1438         handle = hci_handle(handle);
1439
1440         BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1441
1442         hdev->stat.acl_rx++;
1443
1444         hci_dev_lock(hdev);
1445         conn = hci_conn_hash_lookup_handle(hdev, handle);
1446         hci_dev_unlock(hdev);
1447
1448         if (conn) {
1449                 register struct hci_proto *hp;
1450
1451                 hci_conn_enter_active_mode(conn);
1452
1453                 /* Send to upper protocol */
1454                 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
1455                         hp->recv_acldata(conn, skb, flags);
1456                         return;
1457                 }
1458         } else {
1459                 BT_ERR("%s ACL packet for unknown connection handle %d",
1460                         hdev->name, handle);
1461         }
1462
1463         kfree_skb(skb);
1464 }
1465
1466 /* SCO data packet */
1467 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1468 {
1469         struct hci_sco_hdr *hdr = (void *) skb->data;
1470         struct hci_conn *conn;
1471         __u16 handle;
1472
1473         skb_pull(skb, HCI_SCO_HDR_SIZE);
1474
1475         handle = __le16_to_cpu(hdr->handle);
1476
1477         BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1478
1479         hdev->stat.sco_rx++;
1480
1481         hci_dev_lock(hdev);
1482         conn = hci_conn_hash_lookup_handle(hdev, handle);
1483         hci_dev_unlock(hdev);
1484
1485         if (conn) {
1486                 register struct hci_proto *hp;
1487
1488                 /* Send to upper protocol */
1489                 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
1490                         hp->recv_scodata(conn, skb);
1491                         return;
1492                 }
1493         } else {
1494                 BT_ERR("%s SCO packet for unknown connection handle %d",
1495                         hdev->name, handle);
1496         }
1497
1498         kfree_skb(skb);
1499 }
1500
1501 static void hci_rx_task(unsigned long arg)
1502 {
1503         struct hci_dev *hdev = (struct hci_dev *) arg;
1504         struct sk_buff *skb;
1505
1506         BT_DBG("%s", hdev->name);
1507
1508         read_lock(&hci_task_lock);
1509
1510         while ((skb = skb_dequeue(&hdev->rx_q))) {
1511                 if (atomic_read(&hdev->promisc)) {
1512                         /* Send copy to the sockets */
1513                         hci_send_to_sock(hdev, skb);
1514                 }
1515
1516                 if (test_bit(HCI_RAW, &hdev->flags)) {
1517                         kfree_skb(skb);
1518                         continue;
1519                 }
1520
1521                 if (test_bit(HCI_INIT, &hdev->flags)) {
1522                         /* Don't process data packets in this states. */
1523                         switch (bt_cb(skb)->pkt_type) {
1524                         case HCI_ACLDATA_PKT:
1525                         case HCI_SCODATA_PKT:
1526                                 kfree_skb(skb);
1527                                 continue;
1528                         }
1529                 }
1530
1531                 /* Process frame */
1532                 switch (bt_cb(skb)->pkt_type) {
1533                 case HCI_EVENT_PKT:
1534                         hci_event_packet(hdev, skb);
1535                         break;
1536
1537                 case HCI_ACLDATA_PKT:
1538                         BT_DBG("%s ACL data packet", hdev->name);
1539                         hci_acldata_packet(hdev, skb);
1540                         break;
1541
1542                 case HCI_SCODATA_PKT:
1543                         BT_DBG("%s SCO data packet", hdev->name);
1544                         hci_scodata_packet(hdev, skb);
1545                         break;
1546
1547                 default:
1548                         kfree_skb(skb);
1549                         break;
1550                 }
1551         }
1552
1553         read_unlock(&hci_task_lock);
1554 }
1555
1556 static void hci_cmd_task(unsigned long arg)
1557 {
1558         struct hci_dev *hdev = (struct hci_dev *) arg;
1559         struct sk_buff *skb;
1560
1561         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
1562
1563         if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) {
1564                 BT_ERR("%s command tx timeout", hdev->name);
1565                 atomic_set(&hdev->cmd_cnt, 1);
1566         }
1567
1568         /* Send queued commands */
1569         if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
1570                 if (hdev->sent_cmd)
1571                         kfree_skb(hdev->sent_cmd);
1572
1573                 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
1574                         atomic_dec(&hdev->cmd_cnt);
1575                         hci_send_frame(skb);
1576                         hdev->cmd_last_tx = jiffies;
1577                 } else {
1578                         skb_queue_head(&hdev->cmd_q, skb);
1579                         hci_sched_cmd(hdev);
1580                 }
1581         }
1582 }