net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI core. */
  26
  27 #include <linux/module.h>
  28 #include <linux/kmod.h>
  29
  30 #include <linux/types.h>
  31 #include <linux/errno.h>
  32 #include <linux/kernel.h>
  33 #include <linux/sched.h>
  34 #include <linux/slab.h>
  35 #include <linux/poll.h>
  36 #include <linux/fcntl.h>
  37 #include <linux/init.h>
  38 #include <linux/skbuff.h>
  39 #include <linux/interrupt.h>
  40 #include <linux/notifier.h>
  41 #include <net/sock.h>
  42
  43 #include <asm/system.h>
  44 #include <asm/uaccess.h>
  45 #include <asm/unaligned.h>
  46
  47 #include <net/bluetooth/bluetooth.h>
  48 #include <net/bluetooth/hci_core.h>
  49
  50 #ifndef CONFIG_BT_HCI_CORE_DEBUG
  51 #undef  BT_DBG
  52 #define BT_DBG(D...)
  53 #endif
  54
  55 static void hci_cmd_task(unsigned long arg);
  56 static void hci_rx_task(unsigned long arg);
  57 static void hci_tx_task(unsigned long arg);
  58 static void hci_notify(struct hci_dev *hdev, int event);
  59
  60 static DEFINE_RWLOCK(hci_task_lock);
  61
  62 /* HCI device list */
  63 LIST_HEAD(hci_dev_list);
  64 DEFINE_RWLOCK(hci_dev_list_lock);
  65
  66 /* HCI callback list */
  67 LIST_HEAD(hci_cb_list);
  68 DEFINE_RWLOCK(hci_cb_list_lock);
  69
  70 /* HCI protocols */
  71 #define HCI_MAX_PROTO   2
  72 struct hci_proto *hci_proto[HCI_MAX_PROTO];
  73
  74 /* HCI notifiers list */
  75 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
  76
  77 /* ---- HCI notifications ---- */
  78
  79 int hci_register_notifier(struct notifier_block *nb)
  80 {
  81         return atomic_notifier_chain_register(&hci_notifier, nb);
  82 }
  83
  84 int hci_unregister_notifier(struct notifier_block *nb)
  85 {
  86         return atomic_notifier_chain_unregister(&hci_notifier, nb);
  87 }
  88
  89 static void hci_notify(struct hci_dev *hdev, int event)
  90 {
  91         atomic_notifier_call_chain(&hci_notifier, event, hdev);
  92 }
  93
  94 /* ---- HCI requests ---- */
  95
  96 void hci_req_complete(struct hci_dev *hdev, int result)
  97 {
  98         BT_DBG("%s result 0x%2.2x", hdev->name, result);
  99
 100         if (hdev->req_status == HCI_REQ_PEND) {
 101                 hdev->req_result = result;
 102                 hdev->req_status = HCI_REQ_DONE;
 103                 wake_up_interruptible(&hdev->req_wait_q);
 104         }
 105 }
 106
 107 static void hci_req_cancel(struct hci_dev *hdev, int err)
 108 {
 109         BT_DBG("%s err 0x%2.2x", hdev->name, err);
 110
 111         if (hdev->req_status == HCI_REQ_PEND) {
 112                 hdev->req_result = err;
 113                 hdev->req_status = HCI_REQ_CANCELED;
 114                 wake_up_interruptible(&hdev->req_wait_q);
 115         }
 116 }
 117
 118 /* Execute request and wait for completion. */
 119 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 120                                 unsigned long opt, __u32 timeout)
 121 {
 122         DECLARE_WAITQUEUE(wait, current);
 123         int err = 0;
 124
 125         BT_DBG("%s start", hdev->name);
 126
 127         hdev->req_status = HCI_REQ_PEND;
 128
 129         add_wait_queue(&hdev->req_wait_q, &wait);
 130         set_current_state(TASK_INTERRUPTIBLE);
 131
 132         req(hdev, opt);
 133         schedule_timeout(timeout);
 134
 135         remove_wait_queue(&hdev->req_wait_q, &wait);
 136
 137         if (signal_pending(current))
 138                 return -EINTR;
 139
 140         switch (hdev->req_status) {
 141         case HCI_REQ_DONE:
 142                 err = -bt_err(hdev->req_result);
 143                 break;
 144
 145         case HCI_REQ_CANCELED:
 146                 err = -hdev->req_result;
 147                 break;
 148
 149         default:
 150                 err = -ETIMEDOUT;
 151                 break;
 152         };
 153
 154         hdev->req_status = hdev->req_result = 0;
 155
 156         BT_DBG("%s end: err %d", hdev->name, err);
 157
 158         return err;
 159 }
 160
 161 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 162                                 unsigned long opt, __u32 timeout)
 163 {
 164         int ret;
 165
 166         /* Serialize all requests */
 167         hci_req_lock(hdev);
 168         ret = __hci_request(hdev, req, opt, timeout);
 169         hci_req_unlock(hdev);
 170
 171         return ret;
 172 }
 173
 174 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
 175 {
 176         BT_DBG("%s %ld", hdev->name, opt);
 177
 178         /* Reset device */
 179         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
 180 }
 181
 182 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 183 {
 184         struct sk_buff *skb;
 185         __le16 param;
 186
 187         BT_DBG("%s %ld", hdev->name, opt);
 188
 189         /* Driver initialization */
 190
 191         /* Special commands */
 192         while ((skb = skb_dequeue(&hdev->driver_init))) {
 193                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
 194                 skb->dev = (void *) hdev;
 195                 skb_queue_tail(&hdev->cmd_q, skb);
 196                 hci_sched_cmd(hdev);
 197         }
 198         skb_queue_purge(&hdev->driver_init);
 199
 200         /* Mandatory initialization */
 201
 202         /* Reset */
 203         if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks))
 204                         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
 205
 206         /* Read Local Supported Features */
 207         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_FEATURES, 0, NULL);
 208
 209         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 210         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BUFFER_SIZE, 0, NULL);
 211
 212 #if 0
 213         /* Host buffer size */
 214         {
 215                 struct hci_cp_host_buffer_size cp;
 216                 cp.acl_mtu = __cpu_to_le16(HCI_MAX_ACL_SIZE);
 217                 cp.sco_mtu = HCI_MAX_SCO_SIZE;
 218                 cp.acl_max_pkt = __cpu_to_le16(0xffff);
 219                 cp.sco_max_pkt = __cpu_to_le16(0xffff);
 220                 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_HOST_BUFFER_SIZE, sizeof(cp), &cp);
 221         }
 222 #endif
 223
 224         /* Read BD Address */
 225         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, NULL);
 226
 227         /* Read Voice Setting */
 228         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_READ_VOICE_SETTING, 0, NULL);
 229
 230         /* Optional initialization */
 231
 232         /* Clear Event Filters */
 233         {
 234                 struct hci_cp_set_event_flt cp;
 235                 cp.flt_type  = HCI_FLT_CLEAR_ALL;
 236                 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, sizeof(cp), &cp);
 237         }
 238
 239         /* Page timeout ~20 secs */
 240         param = __cpu_to_le16(0x8000);
 241         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_PG_TIMEOUT, 2, &param);
 242
 243         /* Connection accept timeout ~20 secs */
 244         param = __cpu_to_le16(0x7d00);
 245         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_CA_TIMEOUT, 2, &param);
 246 }
 247
 248 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
 249 {
 250         __u8 scan = opt;
 251
 252         BT_DBG("%s %x", hdev->name, scan);
 253
 254         /* Inquiry and Page scans */
 255         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, &scan);
 256 }
 257
 258 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
 259 {
 260         __u8 auth = opt;
 261
 262         BT_DBG("%s %x", hdev->name, auth);
 263
 264         /* Authentication */
 265         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE, 1, &auth);
 266 }
 267
 268 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
 269 {
 270         __u8 encrypt = opt;
 271
 272         BT_DBG("%s %x", hdev->name, encrypt);
 273
 274         /* Authentication */
 275         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE, 1, &encrypt);
 276 }
 277
 278 /* Get HCI device by index.
 279  * Device is held on return. */
 280 struct hci_dev *hci_dev_get(int index)
 281 {
 282         struct hci_dev *hdev = NULL;
 283         struct list_head *p;
 284
 285         BT_DBG("%d", index);
 286
 287         if (index < 0)
 288                 return NULL;
 289
 290         read_lock(&hci_dev_list_lock);
 291         list_for_each(p, &hci_dev_list) {
 292                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 293                 if (d->id == index) {
 294                         hdev = hci_dev_hold(d);
 295                         break;
 296                 }
 297         }
 298         read_unlock(&hci_dev_list_lock);
 299         return hdev;
 300 }
 301
 302 /* ---- Inquiry support ---- */
 303 static void inquiry_cache_flush(struct hci_dev *hdev)
 304 {
 305         struct inquiry_cache *cache = &hdev->inq_cache;
 306         struct inquiry_entry *next  = cache->list, *e;
 307
 308         BT_DBG("cache %p", cache);
 309
 310         cache->list = NULL;
 311         while ((e = next)) {
 312                 next = e->next;
 313                 kfree(e);
 314         }
 315 }
 316
 317 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 318 {
 319         struct inquiry_cache *cache = &hdev->inq_cache;
 320         struct inquiry_entry *e;
 321
 322         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 323
 324         for (e = cache->list; e; e = e->next)
 325                 if (!bacmp(&e->data.bdaddr, bdaddr))
 326                         break;
 327         return e;
 328 }
 329
 330 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
 331 {
 332         struct inquiry_cache *cache = &hdev->inq_cache;
 333         struct inquiry_entry *e;
 334
 335         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 336
 337         if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
 338                 /* Entry not in the cache. Add new one. */
 339                 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
 340                         return;
 341                 e->next     = cache->list;
 342                 cache->list = e;
 343         }
 344
 345         memcpy(&e->data, data, sizeof(*data));
 346         e->timestamp = jiffies;
 347         cache->timestamp = jiffies;
 348 }
 349
 350 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 351 {
 352         struct inquiry_cache *cache = &hdev->inq_cache;
 353         struct inquiry_info *info = (struct inquiry_info *) buf;
 354         struct inquiry_entry *e;
 355         int copied = 0;
 356
 357         for (e = cache->list; e && copied < num; e = e->next, copied++) {
 358                 struct inquiry_data *data = &e->data;
 359                 bacpy(&info->bdaddr, &data->bdaddr);
 360                 info->pscan_rep_mode    = data->pscan_rep_mode;
 361                 info->pscan_period_mode = data->pscan_period_mode;
 362                 info->pscan_mode        = data->pscan_mode;
 363                 memcpy(info->dev_class, data->dev_class, 3);
 364                 info->clock_offset      = data->clock_offset;
 365                 info++;
 366         }
 367
 368         BT_DBG("cache %p, copied %d", cache, copied);
 369         return copied;
 370 }
 371
 372 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
 373 {
 374         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
 375         struct hci_cp_inquiry cp;
 376
 377         BT_DBG("%s", hdev->name);
 378
 379         if (test_bit(HCI_INQUIRY, &hdev->flags))
 380                 return;
 381
 382         /* Start Inquiry */
 383         memcpy(&cp.lap, &ir->lap, 3);
 384         cp.length  = ir->length;
 385         cp.num_rsp = ir->num_rsp;
 386         hci_send_cmd(hdev, OGF_LINK_CTL, OCF_INQUIRY, sizeof(cp), &cp);
 387 }
 388
 389 int hci_inquiry(void __user *arg)
 390 {
 391         __u8 __user *ptr = arg;
 392         struct hci_inquiry_req ir;
 393         struct hci_dev *hdev;
 394         int err = 0, do_inquiry = 0, max_rsp;
 395         long timeo;
 396         __u8 *buf;
 397
 398         if (copy_from_user(&ir, ptr, sizeof(ir)))
 399                 return -EFAULT;
 400
 401         if (!(hdev = hci_dev_get(ir.dev_id)))
 402                 return -ENODEV;
 403
 404         hci_dev_lock_bh(hdev);
 405         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 406                                         inquiry_cache_empty(hdev) ||
 407                                         ir.flags & IREQ_CACHE_FLUSH) {
 408                 inquiry_cache_flush(hdev);
 409                 do_inquiry = 1;
 410         }
 411         hci_dev_unlock_bh(hdev);
 412
 413         timeo = ir.length * msecs_to_jiffies(2000);
 414         if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
 415                 goto done;
 416
 417         /* for unlimited number of responses we will use buffer with 255 entries */
 418         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 419
 420         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
 421          * copy it to the user space.
 422          */
 423         if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
 424                 err = -ENOMEM;
 425                 goto done;
 426         }
 427
 428         hci_dev_lock_bh(hdev);
 429         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
 430         hci_dev_unlock_bh(hdev);
 431
 432         BT_DBG("num_rsp %d", ir.num_rsp);
 433
 434         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
 435                 ptr += sizeof(ir);
 436                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
 437                                         ir.num_rsp))
 438                         err = -EFAULT;
 439         } else
 440                 err = -EFAULT;
 441
 442         kfree(buf);
 443
 444 done:
 445         hci_dev_put(hdev);
 446         return err;
 447 }
 448
 449 /* ---- HCI ioctl helpers ---- */
 450
 451 int hci_dev_open(__u16 dev)
 452 {
 453         struct hci_dev *hdev;
 454         int ret = 0;
 455
 456         if (!(hdev = hci_dev_get(dev)))
 457                 return -ENODEV;
 458
 459         BT_DBG("%s %p", hdev->name, hdev);
 460
 461         hci_req_lock(hdev);
 462
 463         if (test_bit(HCI_UP, &hdev->flags)) {
 464                 ret = -EALREADY;
 465                 goto done;
 466         }
 467
 468         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 469                 set_bit(HCI_RAW, &hdev->flags);
 470
 471         if (hdev->open(hdev)) {
 472                 ret = -EIO;
 473                 goto done;
 474         }
 475
 476         if (!test_bit(HCI_RAW, &hdev->flags)) {
 477                 atomic_set(&hdev->cmd_cnt, 1);
 478                 set_bit(HCI_INIT, &hdev->flags);
 479
 480                 //__hci_request(hdev, hci_reset_req, 0, HZ);
 481                 ret = __hci_request(hdev, hci_init_req, 0,
 482                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 483
 484                 clear_bit(HCI_INIT, &hdev->flags);
 485         }
 486
 487         if (!ret) {
 488                 hci_dev_hold(hdev);
 489                 set_bit(HCI_UP, &hdev->flags);
 490                 hci_notify(hdev, HCI_DEV_UP);
 491         } else {
 492                 /* Init failed, cleanup */
 493                 tasklet_kill(&hdev->rx_task);
 494                 tasklet_kill(&hdev->tx_task);
 495                 tasklet_kill(&hdev->cmd_task);
 496
 497                 skb_queue_purge(&hdev->cmd_q);
 498                 skb_queue_purge(&hdev->rx_q);
 499
 500                 if (hdev->flush)
 501                         hdev->flush(hdev);
 502
 503                 if (hdev->sent_cmd) {
 504                         kfree_skb(hdev->sent_cmd);
 505                         hdev->sent_cmd = NULL;
 506                 }
 507
 508                 hdev->close(hdev);
 509                 hdev->flags = 0;
 510         }
 511
 512 done:
 513         hci_req_unlock(hdev);
 514         hci_dev_put(hdev);
 515         return ret;
 516 }
 517
 518 static int hci_dev_do_close(struct hci_dev *hdev)
 519 {
 520         BT_DBG("%s %p", hdev->name, hdev);
 521
 522         hci_req_cancel(hdev, ENODEV);
 523         hci_req_lock(hdev);
 524
 525         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 526                 hci_req_unlock(hdev);
 527                 return 0;
 528         }
 529
 530         /* Kill RX and TX tasks */
 531         tasklet_kill(&hdev->rx_task);
 532         tasklet_kill(&hdev->tx_task);
 533
 534         hci_dev_lock_bh(hdev);
 535         inquiry_cache_flush(hdev);
 536         hci_conn_hash_flush(hdev);
 537         hci_dev_unlock_bh(hdev);
 538
 539         hci_notify(hdev, HCI_DEV_DOWN);
 540
 541         if (hdev->flush)
 542                 hdev->flush(hdev);
 543
 544         /* Reset device */
 545         skb_queue_purge(&hdev->cmd_q);
 546         atomic_set(&hdev->cmd_cnt, 1);
 547         if (!test_bit(HCI_RAW, &hdev->flags)) {
 548                 set_bit(HCI_INIT, &hdev->flags);
 549                 __hci_request(hdev, hci_reset_req, 0,
 550                                         msecs_to_jiffies(250));
 551                 clear_bit(HCI_INIT, &hdev->flags);
 552         }
 553
 554         /* Kill cmd task */
 555         tasklet_kill(&hdev->cmd_task);
 556
 557         /* Drop queues */
 558         skb_queue_purge(&hdev->rx_q);
 559         skb_queue_purge(&hdev->cmd_q);
 560         skb_queue_purge(&hdev->raw_q);
 561
 562         /* Drop last sent command */
 563         if (hdev->sent_cmd) {
 564                 kfree_skb(hdev->sent_cmd);
 565                 hdev->sent_cmd = NULL;
 566         }
 567
 568         /* After this point our queues are empty
 569          * and no tasks are scheduled. */
 570         hdev->close(hdev);
 571
 572         /* Clear flags */
 573         hdev->flags = 0;
 574
 575         hci_req_unlock(hdev);
 576
 577         hci_dev_put(hdev);
 578         return 0;
 579 }
 580
 581 int hci_dev_close(__u16 dev)
 582 {
 583         struct hci_dev *hdev;
 584         int err;
 585
 586         if (!(hdev = hci_dev_get(dev)))
 587                 return -ENODEV;
 588         err = hci_dev_do_close(hdev);
 589         hci_dev_put(hdev);
 590         return err;
 591 }
 592
 593 int hci_dev_reset(__u16 dev)
 594 {
 595         struct hci_dev *hdev;
 596         int ret = 0;
 597
 598         if (!(hdev = hci_dev_get(dev)))
 599                 return -ENODEV;
 600
 601         hci_req_lock(hdev);
 602         tasklet_disable(&hdev->tx_task);
 603
 604         if (!test_bit(HCI_UP, &hdev->flags))
 605                 goto done;
 606
 607         /* Drop queues */
 608         skb_queue_purge(&hdev->rx_q);
 609         skb_queue_purge(&hdev->cmd_q);
 610
 611         hci_dev_lock_bh(hdev);
 612         inquiry_cache_flush(hdev);
 613         hci_conn_hash_flush(hdev);
 614         hci_dev_unlock_bh(hdev);
 615
 616         if (hdev->flush)
 617                 hdev->flush(hdev);
 618
 619         atomic_set(&hdev->cmd_cnt, 1);
 620         hdev->acl_cnt = 0; hdev->sco_cnt = 0;
 621
 622         if (!test_bit(HCI_RAW, &hdev->flags))
 623                 ret = __hci_request(hdev, hci_reset_req, 0,
 624                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 625
 626 done:
 627         tasklet_enable(&hdev->tx_task);
 628         hci_req_unlock(hdev);
 629         hci_dev_put(hdev);
 630         return ret;
 631 }
 632
 633 int hci_dev_reset_stat(__u16 dev)
 634 {
 635         struct hci_dev *hdev;
 636         int ret = 0;
 637
 638         if (!(hdev = hci_dev_get(dev)))
 639                 return -ENODEV;
 640
 641         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 642
 643         hci_dev_put(hdev);
 644
 645         return ret;
 646 }
 647
 648 int hci_dev_cmd(unsigned int cmd, void __user *arg)
 649 {
 650         struct hci_dev *hdev;
 651         struct hci_dev_req dr;
 652         int err = 0;
 653
 654         if (copy_from_user(&dr, arg, sizeof(dr)))
 655                 return -EFAULT;
 656
 657         if (!(hdev = hci_dev_get(dr.dev_id)))
 658                 return -ENODEV;
 659
 660         switch (cmd) {
 661         case HCISETAUTH:
 662                 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 663                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 664                 break;
 665
 666         case HCISETENCRYPT:
 667                 if (!lmp_encrypt_capable(hdev)) {
 668                         err = -EOPNOTSUPP;
 669                         break;
 670                 }
 671
 672                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
 673                         /* Auth must be enabled first */
 674                         err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 675                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 676                         if (err)
 677                                 break;
 678                 }
 679
 680                 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
 681                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 682                 break;
 683
 684         case HCISETSCAN:
 685                 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
 686                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 687                 break;
 688
 689         case HCISETPTYPE:
 690                 hdev->pkt_type = (__u16) dr.dev_opt;
 691                 break;
 692
 693         case HCISETLINKPOL:
 694                 hdev->link_policy = (__u16) dr.dev_opt;
 695                 break;
 696
 697         case HCISETLINKMODE:
 698                 hdev->link_mode = ((__u16) dr.dev_opt) & (HCI_LM_MASTER | HCI_LM_ACCEPT);
 699                 break;
 700
 701         case HCISETACLMTU:
 702                 hdev->acl_mtu  = *((__u16 *)&dr.dev_opt + 1);
 703                 hdev->acl_pkts = *((__u16 *)&dr.dev_opt + 0);
 704                 break;
 705
 706         case HCISETSCOMTU:
 707                 hdev->sco_mtu  = *((__u16 *)&dr.dev_opt + 1);
 708                 hdev->sco_pkts = *((__u16 *)&dr.dev_opt + 0);
 709                 break;
 710
 711         default:
 712                 err = -EINVAL;
 713                 break;
 714         }
 715         hci_dev_put(hdev);
 716         return err;
 717 }
 718
 719 int hci_get_dev_list(void __user *arg)
 720 {
 721         struct hci_dev_list_req *dl;
 722         struct hci_dev_req *dr;
 723         struct list_head *p;
 724         int n = 0, size, err;
 725         __u16 dev_num;
 726
 727         if (get_user(dev_num, (__u16 __user *) arg))
 728                 return -EFAULT;
 729
 730         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
 731                 return -EINVAL;
 732
 733         size = sizeof(*dl) + dev_num * sizeof(*dr);
 734
 735         if (!(dl = kmalloc(size, GFP_KERNEL)))
 736                 return -ENOMEM;
 737
 738         dr = dl->dev_req;
 739
 740         read_lock_bh(&hci_dev_list_lock);
 741         list_for_each(p, &hci_dev_list) {
 742                 struct hci_dev *hdev;
 743                 hdev = list_entry(p, struct hci_dev, list);
 744                 (dr + n)->dev_id  = hdev->id;
 745                 (dr + n)->dev_opt = hdev->flags;
 746                 if (++n >= dev_num)
 747                         break;
 748         }
 749         read_unlock_bh(&hci_dev_list_lock);
 750
 751         dl->dev_num = n;
 752         size = sizeof(*dl) + n * sizeof(*dr);
 753
 754         err = copy_to_user(arg, dl, size);
 755         kfree(dl);
 756
 757         return err ? -EFAULT : 0;
 758 }
 759
 760 int hci_get_dev_info(void __user *arg)
 761 {
 762         struct hci_dev *hdev;
 763         struct hci_dev_info di;
 764         int err = 0;
 765
 766         if (copy_from_user(&di, arg, sizeof(di)))
 767                 return -EFAULT;
 768
 769         if (!(hdev = hci_dev_get(di.dev_id)))
 770                 return -ENODEV;
 771
 772         strcpy(di.name, hdev->name);
 773         di.bdaddr   = hdev->bdaddr;
 774         di.type     = hdev->type;
 775         di.flags    = hdev->flags;
 776         di.pkt_type = hdev->pkt_type;
 777         di.acl_mtu  = hdev->acl_mtu;
 778         di.acl_pkts = hdev->acl_pkts;
 779         di.sco_mtu  = hdev->sco_mtu;
 780         di.sco_pkts = hdev->sco_pkts;
 781         di.link_policy = hdev->link_policy;
 782         di.link_mode   = hdev->link_mode;
 783
 784         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
 785         memcpy(&di.features, &hdev->features, sizeof(di.features));
 786
 787         if (copy_to_user(arg, &di, sizeof(di)))
 788                 err = -EFAULT;
 789
 790         hci_dev_put(hdev);
 791
 792         return err;
 793 }
 794
 795 /* ---- Interface to HCI drivers ---- */
 796
 797 /* Alloc HCI device */
 798 struct hci_dev *hci_alloc_dev(void)
 799 {
 800         struct hci_dev *hdev;
 801
 802         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
 803         if (!hdev)
 804                 return NULL;
 805
 806         skb_queue_head_init(&hdev->driver_init);
 807
 808         return hdev;
 809 }
 810 EXPORT_SYMBOL(hci_alloc_dev);
 811
 812 /* Free HCI device */
 813 void hci_free_dev(struct hci_dev *hdev)
 814 {
 815         skb_queue_purge(&hdev->driver_init);
 816
 817         /* will free via device release */
 818         put_device(&hdev->dev);
 819 }
 820 EXPORT_SYMBOL(hci_free_dev);
 821
 822 /* Register HCI device */
 823 int hci_register_dev(struct hci_dev *hdev)
 824 {
 825         struct list_head *head = &hci_dev_list, *p;
 826         int id = 0;
 827
 828         BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner);
 829
 830         if (!hdev->open || !hdev->close || !hdev->destruct)
 831                 return -EINVAL;
 832
 833         write_lock_bh(&hci_dev_list_lock);
 834
 835         /* Find first available device id */
 836         list_for_each(p, &hci_dev_list) {
 837                 if (list_entry(p, struct hci_dev, list)->id != id)
 838                         break;
 839                 head = p; id++;
 840         }
 841
 842         sprintf(hdev->name, "hci%d", id);
 843         hdev->id = id;
 844         list_add(&hdev->list, head);
 845
 846         atomic_set(&hdev->refcnt, 1);
 847         spin_lock_init(&hdev->lock);
 848
 849         hdev->flags = 0;
 850         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
 851         hdev->link_mode = (HCI_LM_ACCEPT);
 852
 853         hdev->idle_timeout = 0;
 854         hdev->sniff_max_interval = 800;
 855         hdev->sniff_min_interval = 80;
 856
 857         tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
 858         tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
 859         tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
 860
 861         skb_queue_head_init(&hdev->rx_q);
 862         skb_queue_head_init(&hdev->cmd_q);
 863         skb_queue_head_init(&hdev->raw_q);
 864
 865         init_waitqueue_head(&hdev->req_wait_q);
 866         init_MUTEX(&hdev->req_lock);
 867
 868         inquiry_cache_init(hdev);
 869
 870         hci_conn_hash_init(hdev);
 871
 872         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 873
 874         atomic_set(&hdev->promisc, 0);
 875
 876         write_unlock_bh(&hci_dev_list_lock);
 877
 878         hci_register_sysfs(hdev);
 879
 880         hci_notify(hdev, HCI_DEV_REG);
 881
 882         return id;
 883 }
 884 EXPORT_SYMBOL(hci_register_dev);
 885
 886 /* Unregister HCI device */
 887 int hci_unregister_dev(struct hci_dev *hdev)
 888 {
 889         BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
 890
 891         hci_unregister_sysfs(hdev);
 892
 893         write_lock_bh(&hci_dev_list_lock);
 894         list_del(&hdev->list);
 895         write_unlock_bh(&hci_dev_list_lock);
 896
 897         hci_dev_do_close(hdev);
 898
 899         hci_notify(hdev, HCI_DEV_UNREG);
 900
 901         __hci_dev_put(hdev);
 902         return 0;
 903 }
 904 EXPORT_SYMBOL(hci_unregister_dev);
 905
 906 /* Suspend HCI device */
 907 int hci_suspend_dev(struct hci_dev *hdev)
 908 {
 909         hci_notify(hdev, HCI_DEV_SUSPEND);
 910         return 0;
 911 }
 912 EXPORT_SYMBOL(hci_suspend_dev);
 913
 914 /* Resume HCI device */
 915 int hci_resume_dev(struct hci_dev *hdev)
 916 {
 917         hci_notify(hdev, HCI_DEV_RESUME);
 918         return 0;
 919 }
 920 EXPORT_SYMBOL(hci_resume_dev);
 921
 922 /* ---- Interface to upper protocols ---- */
 923
 924 /* Register/Unregister protocols.
 925  * hci_task_lock is used to ensure that no tasks are running. */
 926 int hci_register_proto(struct hci_proto *hp)
 927 {
 928         int err = 0;
 929
 930         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
 931
 932         if (hp->id >= HCI_MAX_PROTO)
 933                 return -EINVAL;
 934
 935         write_lock_bh(&hci_task_lock);
 936
 937         if (!hci_proto[hp->id])
 938                 hci_proto[hp->id] = hp;
 939         else
 940                 err = -EEXIST;
 941
 942         write_unlock_bh(&hci_task_lock);
 943
 944         return err;
 945 }
 946 EXPORT_SYMBOL(hci_register_proto);
 947
 948 int hci_unregister_proto(struct hci_proto *hp)
 949 {
 950         int err = 0;
 951
 952         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
 953
 954         if (hp->id >= HCI_MAX_PROTO)
 955                 return -EINVAL;
 956
 957         write_lock_bh(&hci_task_lock);
 958
 959         if (hci_proto[hp->id])
 960                 hci_proto[hp->id] = NULL;
 961         else
 962                 err = -ENOENT;
 963
 964         write_unlock_bh(&hci_task_lock);
 965
 966         return err;
 967 }
 968 EXPORT_SYMBOL(hci_unregister_proto);
 969
 970 int hci_register_cb(struct hci_cb *cb)
 971 {
 972         BT_DBG("%p name %s", cb, cb->name);
 973
 974         write_lock_bh(&hci_cb_list_lock);
 975         list_add(&cb->list, &hci_cb_list);
 976         write_unlock_bh(&hci_cb_list_lock);
 977
 978         return 0;
 979 }
 980 EXPORT_SYMBOL(hci_register_cb);
 981
 982 int hci_unregister_cb(struct hci_cb *cb)
 983 {
 984         BT_DBG("%p name %s", cb, cb->name);
 985
 986         write_lock_bh(&hci_cb_list_lock);
 987         list_del(&cb->list);
 988         write_unlock_bh(&hci_cb_list_lock);
 989
 990         return 0;
 991 }
 992 EXPORT_SYMBOL(hci_unregister_cb);
 993
 994 static int hci_send_frame(struct sk_buff *skb)
 995 {
 996         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
 997
 998         if (!hdev) {
 999                 kfree_skb(skb);
1000                 return -ENODEV;
1001         }
1002
1003         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1004
1005         if (atomic_read(&hdev->promisc)) {
1006                 /* Time stamp */
1007                 __net_timestamp(skb);
1008
1009                 hci_send_to_sock(hdev, skb);
1010         }
1011
1012         /* Get rid of skb owner, prior to sending to the driver. */
1013         skb_orphan(skb);
1014
1015         return hdev->send(skb);
1016 }
1017
1018 /* Send HCI command */
1019 int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *param)
1020 {
1021         int len = HCI_COMMAND_HDR_SIZE + plen;
1022         struct hci_command_hdr *hdr;
1023         struct sk_buff *skb;
1024
1025         BT_DBG("%s ogf 0x%x ocf 0x%x plen %d", hdev->name, ogf, ocf, plen);
1026
1027         skb = bt_skb_alloc(len, GFP_ATOMIC);
1028         if (!skb) {
1029                 BT_ERR("%s Can't allocate memory for HCI command", hdev->name);
1030                 return -ENOMEM;
1031         }
1032
1033         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1034         hdr->opcode = __cpu_to_le16(hci_opcode_pack(ogf, ocf));
1035         hdr->plen   = plen;
1036
1037         if (plen)
1038                 memcpy(skb_put(skb, plen), param, plen);
1039
1040         BT_DBG("skb len %d", skb->len);
1041
1042         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1043         skb->dev = (void *) hdev;
1044         skb_queue_tail(&hdev->cmd_q, skb);
1045         hci_sched_cmd(hdev);
1046
1047         return 0;
1048 }
1049
1050 /* Get data from the previously sent command */
1051 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
1052 {
1053         struct hci_command_hdr *hdr;
1054
1055         if (!hdev->sent_cmd)
1056                 return NULL;
1057
1058         hdr = (void *) hdev->sent_cmd->data;
1059
1060         if (hdr->opcode != __cpu_to_le16(hci_opcode_pack(ogf, ocf)))
1061                 return NULL;
1062
1063         BT_DBG("%s ogf 0x%x ocf 0x%x", hdev->name, ogf, ocf);
1064
1065         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1066 }
1067
1068 /* Send ACL data */
1069 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1070 {
1071         struct hci_acl_hdr *hdr;
1072         int len = skb->len;
1073
1074         hdr = (struct hci_acl_hdr *) skb_push(skb, HCI_ACL_HDR_SIZE);
1075         hdr->handle = __cpu_to_le16(hci_handle_pack(handle, flags));
1076         hdr->dlen   = __cpu_to_le16(len);
1077
1078         skb->h.raw = (void *) hdr;
1079 }
1080
1081 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1082 {
1083         struct hci_dev *hdev = conn->hdev;
1084         struct sk_buff *list;
1085
1086         BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1087
1088         skb->dev = (void *) hdev;
1089         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1090         hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
1091
1092         if (!(list = skb_shinfo(skb)->frag_list)) {
1093                 /* Non fragmented */
1094                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1095
1096                 skb_queue_tail(&conn->data_q, skb);
1097         } else {
1098                 /* Fragmented */
1099                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1100
1101                 skb_shinfo(skb)->frag_list = NULL;
1102
1103                 /* Queue all fragments atomically */
1104                 spin_lock_bh(&conn->data_q.lock);
1105
1106                 __skb_queue_tail(&conn->data_q, skb);
1107                 do {
1108                         skb = list; list = list->next;
1109
1110                         skb->dev = (void *) hdev;
1111                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1112                         hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
1113
1114                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1115
1116                         __skb_queue_tail(&conn->data_q, skb);
1117                 } while (list);
1118
1119                 spin_unlock_bh(&conn->data_q.lock);
1120         }
1121
1122         hci_sched_tx(hdev);
1123         return 0;
1124 }
1125 EXPORT_SYMBOL(hci_send_acl);
1126
1127 /* Send SCO data */
1128 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1129 {
1130         struct hci_dev *hdev = conn->hdev;
1131         struct hci_sco_hdr hdr;
1132
1133         BT_DBG("%s len %d", hdev->name, skb->len);
1134
1135         if (skb->len > hdev->sco_mtu) {
1136                 kfree_skb(skb);
1137                 return -EINVAL;
1138         }
1139
1140         hdr.handle = __cpu_to_le16(conn->handle);
1141         hdr.dlen   = skb->len;
1142
1143         skb->h.raw = skb_push(skb, HCI_SCO_HDR_SIZE);
1144         memcpy(skb->h.raw, &hdr, HCI_SCO_HDR_SIZE);
1145
1146         skb->dev = (void *) hdev;
1147         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1148         skb_queue_tail(&conn->data_q, skb);
1149         hci_sched_tx(hdev);
1150         return 0;
1151 }
1152 EXPORT_SYMBOL(hci_send_sco);
1153
1154 /* ---- HCI TX task (outgoing data) ---- */
1155
1156 /* HCI Connection scheduler */
1157 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1158 {
1159         struct hci_conn_hash *h = &hdev->conn_hash;
1160         struct hci_conn  *conn = NULL;
1161         int num = 0, min = ~0;
1162         struct list_head *p;
1163
1164         /* We don't have to lock device here. Connections are always
1165          * added and removed with TX task disabled. */
1166         list_for_each(p, &h->list) {
1167                 struct hci_conn *c;
1168                 c = list_entry(p, struct hci_conn, list);
1169
1170                 if (c->type != type || c->state != BT_CONNECTED
1171                                 || skb_queue_empty(&c->data_q))
1172                         continue;
1173                 num++;
1174
1175                 if (c->sent < min) {
1176                         min  = c->sent;
1177                         conn = c;
1178                 }
1179         }
1180
1181         if (conn) {
1182                 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
1183                 int q = cnt / num;
1184                 *quote = q ? q : 1;
1185         } else
1186                 *quote = 0;
1187
1188         BT_DBG("conn %p quote %d", conn, *quote);
1189         return conn;
1190 }
1191
1192 static inline void hci_acl_tx_to(struct hci_dev *hdev)
1193 {
1194         struct hci_conn_hash *h = &hdev->conn_hash;
1195         struct list_head *p;
1196         struct hci_conn  *c;
1197
1198         BT_ERR("%s ACL tx timeout", hdev->name);
1199
1200         /* Kill stalled connections */
1201         list_for_each(p, &h->list) {
1202                 c = list_entry(p, struct hci_conn, list);
1203                 if (c->type == ACL_LINK && c->sent) {
1204                         BT_ERR("%s killing stalled ACL connection %s",
1205                                 hdev->name, batostr(&c->dst));
1206                         hci_acl_disconn(c, 0x13);
1207                 }
1208         }
1209 }
1210
1211 static inline void hci_sched_acl(struct hci_dev *hdev)
1212 {
1213         struct hci_conn *conn;
1214         struct sk_buff *skb;
1215         int quote;
1216
1217         BT_DBG("%s", hdev->name);
1218
1219         if (!test_bit(HCI_RAW, &hdev->flags)) {
1220                 /* ACL tx timeout must be longer than maximum
1221                  * link supervision timeout (40.9 seconds) */
1222                 if (!hdev->acl_cnt && (jiffies - hdev->acl_last_tx) > (HZ * 45))
1223                         hci_acl_tx_to(hdev);
1224         }
1225
1226         while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1227                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1228                         BT_DBG("skb %p len %d", skb, skb->len);
1229
1230                         hci_conn_enter_active_mode(conn);
1231
1232                         hci_send_frame(skb);
1233                         hdev->acl_last_tx = jiffies;
1234
1235                         hdev->acl_cnt--;
1236                         conn->sent++;
1237                 }
1238         }
1239 }
1240
1241 /* Schedule SCO */
1242 static inline void hci_sched_sco(struct hci_dev *hdev)
1243 {
1244         struct hci_conn *conn;
1245         struct sk_buff *skb;
1246         int quote;
1247
1248         BT_DBG("%s", hdev->name);
1249
1250         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1251                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1252                         BT_DBG("skb %p len %d", skb, skb->len);
1253                         hci_send_frame(skb);
1254
1255                         conn->sent++;
1256                         if (conn->sent == ~0)
1257                                 conn->sent = 0;
1258                 }
1259         }
1260 }
1261
1262 static void hci_tx_task(unsigned long arg)
1263 {
1264         struct hci_dev *hdev = (struct hci_dev *) arg;
1265         struct sk_buff *skb;
1266
1267         read_lock(&hci_task_lock);
1268
1269         BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
1270
1271         /* Schedule queues and send stuff to HCI driver */
1272
1273         hci_sched_acl(hdev);
1274
1275         hci_sched_sco(hdev);
1276
1277         /* Send next queued raw (unknown type) packet */
1278         while ((skb = skb_dequeue(&hdev->raw_q)))
1279                 hci_send_frame(skb);
1280
1281         read_unlock(&hci_task_lock);
1282 }
1283
1284 /* ----- HCI RX task (incoming data proccessing) ----- */
1285
1286 /* ACL data packet */
1287 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1288 {
1289         struct hci_acl_hdr *hdr = (void *) skb->data;
1290         struct hci_conn *conn;
1291         __u16 handle, flags;
1292
1293         skb_pull(skb, HCI_ACL_HDR_SIZE);
1294
1295         handle = __le16_to_cpu(hdr->handle);
1296         flags  = hci_flags(handle);
1297         handle = hci_handle(handle);
1298
1299         BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1300
1301         hdev->stat.acl_rx++;
1302
1303         hci_dev_lock(hdev);
1304         conn = hci_conn_hash_lookup_handle(hdev, handle);
1305         hci_dev_unlock(hdev);
1306
1307         if (conn) {
1308                 register struct hci_proto *hp;
1309
1310                 hci_conn_enter_active_mode(conn);
1311
1312                 /* Send to upper protocol */
1313                 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
1314                         hp->recv_acldata(conn, skb, flags);
1315                         return;
1316                 }
1317         } else {
1318                 BT_ERR("%s ACL packet for unknown connection handle %d",
1319                         hdev->name, handle);
1320         }
1321
1322         kfree_skb(skb);
1323 }
1324
1325 /* SCO data packet */
1326 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1327 {
1328         struct hci_sco_hdr *hdr = (void *) skb->data;
1329         struct hci_conn *conn;
1330         __u16 handle;
1331
1332         skb_pull(skb, HCI_SCO_HDR_SIZE);
1333
1334         handle = __le16_to_cpu(hdr->handle);
1335
1336         BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1337
1338         hdev->stat.sco_rx++;
1339
1340         hci_dev_lock(hdev);
1341         conn = hci_conn_hash_lookup_handle(hdev, handle);
1342         hci_dev_unlock(hdev);
1343
1344         if (conn) {
1345                 register struct hci_proto *hp;
1346
1347                 /* Send to upper protocol */
1348                 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
1349                         hp->recv_scodata(conn, skb);
1350                         return;
1351                 }
1352         } else {
1353                 BT_ERR("%s SCO packet for unknown connection handle %d",
1354                         hdev->name, handle);
1355         }
1356
1357         kfree_skb(skb);
1358 }
1359
1360 static void hci_rx_task(unsigned long arg)
1361 {
1362         struct hci_dev *hdev = (struct hci_dev *) arg;
1363         struct sk_buff *skb;
1364
1365         BT_DBG("%s", hdev->name);
1366
1367         read_lock(&hci_task_lock);
1368
1369         while ((skb = skb_dequeue(&hdev->rx_q))) {
1370                 if (atomic_read(&hdev->promisc)) {
1371                         /* Send copy to the sockets */
1372                         hci_send_to_sock(hdev, skb);
1373                 }
1374
1375                 if (test_bit(HCI_RAW, &hdev->flags)) {
1376                         kfree_skb(skb);
1377                         continue;
1378                 }
1379
1380                 if (test_bit(HCI_INIT, &hdev->flags)) {
1381                         /* Don't process data packets in this states. */
1382                         switch (bt_cb(skb)->pkt_type) {
1383                         case HCI_ACLDATA_PKT:
1384                         case HCI_SCODATA_PKT:
1385                                 kfree_skb(skb);
1386                                 continue;
1387                         };
1388                 }
1389
1390                 /* Process frame */
1391                 switch (bt_cb(skb)->pkt_type) {
1392                 case HCI_EVENT_PKT:
1393                         hci_event_packet(hdev, skb);
1394                         break;
1395
1396                 case HCI_ACLDATA_PKT:
1397                         BT_DBG("%s ACL data packet", hdev->name);
1398                         hci_acldata_packet(hdev, skb);
1399                         break;
1400
1401                 case HCI_SCODATA_PKT:
1402                         BT_DBG("%s SCO data packet", hdev->name);
1403                         hci_scodata_packet(hdev, skb);
1404                         break;
1405
1406                 default:
1407                         kfree_skb(skb);
1408                         break;
1409                 }
1410         }
1411
1412         read_unlock(&hci_task_lock);
1413 }
1414
1415 static void hci_cmd_task(unsigned long arg)
1416 {
1417         struct hci_dev *hdev = (struct hci_dev *) arg;
1418         struct sk_buff *skb;
1419
1420         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
1421
1422         if (!atomic_read(&hdev->cmd_cnt) && (jiffies - hdev->cmd_last_tx) > HZ) {
1423                 BT_ERR("%s command tx timeout", hdev->name);
1424                 atomic_set(&hdev->cmd_cnt, 1);
1425         }
1426
1427         /* Send queued commands */
1428         if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
1429                 if (hdev->sent_cmd)
1430                         kfree_skb(hdev->sent_cmd);
1431
1432                 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
1433                         atomic_dec(&hdev->cmd_cnt);
1434                         hci_send_frame(skb);
1435                         hdev->cmd_last_tx = jiffies;
1436                 } else {
1437                         skb_queue_head(&hdev->cmd_q, skb);
1438                         hci_sched_cmd(hdev);
1439                 }
1440         }
1441 }