1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI core. */ 26 27 #include <linux/module.h> 28 #include <linux/kmod.h> 29 30 #include <linux/types.h> 31 #include <linux/errno.h> 32 #include <linux/kernel.h> 33 #include <linux/sched.h> 34 #include <linux/slab.h> 35 #include <linux/poll.h> 36 #include <linux/fcntl.h> 37 #include <linux/init.h> 38 #include <linux/skbuff.h> 39 #include <linux/interrupt.h> 40 #include <linux/notifier.h> 41 #include <net/sock.h> 42 43 #include <asm/system.h> 44 #include <asm/uaccess.h> 45 #include <asm/unaligned.h> 46 47 #include <net/bluetooth/bluetooth.h> 48 #include <net/bluetooth/hci_core.h> 49 50 #ifndef CONFIG_BT_HCI_CORE_DEBUG 51 #undef BT_DBG 52 #define BT_DBG(D...) 53 #endif 54 55 static void hci_cmd_task(unsigned long arg); 56 static void hci_rx_task(unsigned long arg); 57 static void hci_tx_task(unsigned long arg); 58 static void hci_notify(struct hci_dev *hdev, int event); 59 60 static DEFINE_RWLOCK(hci_task_lock); 61 62 /* HCI device list */ 63 LIST_HEAD(hci_dev_list); 64 DEFINE_RWLOCK(hci_dev_list_lock); 65 66 /* HCI callback list */ 67 LIST_HEAD(hci_cb_list); 68 DEFINE_RWLOCK(hci_cb_list_lock); 69 70 /* HCI protocols */ 71 #define HCI_MAX_PROTO 2 72 struct hci_proto *hci_proto[HCI_MAX_PROTO]; 73 74 /* HCI notifiers list */ 75 static ATOMIC_NOTIFIER_HEAD(hci_notifier); 76 77 /* ---- HCI notifications ---- */ 78 79 int hci_register_notifier(struct notifier_block *nb) 80 { 81 return atomic_notifier_chain_register(&hci_notifier, nb); 82 } 83 84 int hci_unregister_notifier(struct notifier_block *nb) 85 { 86 return atomic_notifier_chain_unregister(&hci_notifier, nb); 87 } 88 89 static void hci_notify(struct hci_dev *hdev, int event) 90 { 91 atomic_notifier_call_chain(&hci_notifier, event, hdev); 92 } 93 94 /* ---- HCI requests ---- */ 95 96 void hci_req_complete(struct hci_dev *hdev, int result) 97 { 98 BT_DBG("%s result 0x%2.2x", hdev->name, result); 99 100 if (hdev->req_status == HCI_REQ_PEND) { 101 hdev->req_result = result; 102 hdev->req_status = HCI_REQ_DONE; 103 wake_up_interruptible(&hdev->req_wait_q); 104 } 105 } 106 107 static void hci_req_cancel(struct hci_dev *hdev, int err) 108 { 109 BT_DBG("%s err 0x%2.2x", hdev->name, err); 110 111 if (hdev->req_status == HCI_REQ_PEND) { 112 hdev->req_result = err; 113 hdev->req_status = HCI_REQ_CANCELED; 114 wake_up_interruptible(&hdev->req_wait_q); 115 } 116 } 117 118 /* Execute request and wait for completion. */ 119 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 120 unsigned long opt, __u32 timeout) 121 { 122 DECLARE_WAITQUEUE(wait, current); 123 int err = 0; 124 125 BT_DBG("%s start", hdev->name); 126 127 hdev->req_status = HCI_REQ_PEND; 128 129 add_wait_queue(&hdev->req_wait_q, &wait); 130 set_current_state(TASK_INTERRUPTIBLE); 131 132 req(hdev, opt); 133 schedule_timeout(timeout); 134 135 remove_wait_queue(&hdev->req_wait_q, &wait); 136 137 if (signal_pending(current)) 138 return -EINTR; 139 140 switch (hdev->req_status) { 141 case HCI_REQ_DONE: 142 err = -bt_err(hdev->req_result); 143 break; 144 145 case HCI_REQ_CANCELED: 146 err = -hdev->req_result; 147 break; 148 149 default: 150 err = -ETIMEDOUT; 151 break; 152 }; 153 154 hdev->req_status = hdev->req_result = 0; 155 156 BT_DBG("%s end: err %d", hdev->name, err); 157 158 return err; 159 } 160 161 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 162 unsigned long opt, __u32 timeout) 163 { 164 int ret; 165 166 /* Serialize all requests */ 167 hci_req_lock(hdev); 168 ret = __hci_request(hdev, req, opt, timeout); 169 hci_req_unlock(hdev); 170 171 return ret; 172 } 173 174 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt) 175 { 176 BT_DBG("%s %ld", hdev->name, opt); 177 178 /* Reset device */ 179 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL); 180 } 181 182 static void hci_init_req(struct hci_dev *hdev, unsigned long opt) 183 { 184 struct sk_buff *skb; 185 __le16 param; 186 187 BT_DBG("%s %ld", hdev->name, opt); 188 189 /* Driver initialization */ 190 191 /* Special commands */ 192 while ((skb = skb_dequeue(&hdev->driver_init))) { 193 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 194 skb->dev = (void *) hdev; 195 skb_queue_tail(&hdev->cmd_q, skb); 196 hci_sched_cmd(hdev); 197 } 198 skb_queue_purge(&hdev->driver_init); 199 200 /* Mandatory initialization */ 201 202 /* Reset */ 203 if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks)) 204 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL); 205 206 /* Read Local Supported Features */ 207 hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_FEATURES, 0, NULL); 208 209 /* Read Buffer Size (ACL mtu, max pkt, etc.) */ 210 hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BUFFER_SIZE, 0, NULL); 211 212 #if 0 213 /* Host buffer size */ 214 { 215 struct hci_cp_host_buffer_size cp; 216 cp.acl_mtu = __cpu_to_le16(HCI_MAX_ACL_SIZE); 217 cp.sco_mtu = HCI_MAX_SCO_SIZE; 218 cp.acl_max_pkt = __cpu_to_le16(0xffff); 219 cp.sco_max_pkt = __cpu_to_le16(0xffff); 220 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_HOST_BUFFER_SIZE, sizeof(cp), &cp); 221 } 222 #endif 223 224 /* Read BD Address */ 225 hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, NULL); 226 227 /* Read Voice Setting */ 228 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_READ_VOICE_SETTING, 0, NULL); 229 230 /* Optional initialization */ 231 232 /* Clear Event Filters */ 233 { 234 struct hci_cp_set_event_flt cp; 235 cp.flt_type = HCI_FLT_CLEAR_ALL; 236 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, sizeof(cp), &cp); 237 } 238 239 /* Page timeout ~20 secs */ 240 param = __cpu_to_le16(0x8000); 241 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_PG_TIMEOUT, 2, ¶m); 242 243 /* Connection accept timeout ~20 secs */ 244 param = __cpu_to_le16(0x7d00); 245 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_CA_TIMEOUT, 2, ¶m); 246 } 247 248 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt) 249 { 250 __u8 scan = opt; 251 252 BT_DBG("%s %x", hdev->name, scan); 253 254 /* Inquiry and Page scans */ 255 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, &scan); 256 } 257 258 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt) 259 { 260 __u8 auth = opt; 261 262 BT_DBG("%s %x", hdev->name, auth); 263 264 /* Authentication */ 265 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE, 1, &auth); 266 } 267 268 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt) 269 { 270 __u8 encrypt = opt; 271 272 BT_DBG("%s %x", hdev->name, encrypt); 273 274 /* Authentication */ 275 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE, 1, &encrypt); 276 } 277 278 /* Get HCI device by index. 279 * Device is held on return. */ 280 struct hci_dev *hci_dev_get(int index) 281 { 282 struct hci_dev *hdev = NULL; 283 struct list_head *p; 284 285 BT_DBG("%d", index); 286 287 if (index < 0) 288 return NULL; 289 290 read_lock(&hci_dev_list_lock); 291 list_for_each(p, &hci_dev_list) { 292 struct hci_dev *d = list_entry(p, struct hci_dev, list); 293 if (d->id == index) { 294 hdev = hci_dev_hold(d); 295 break; 296 } 297 } 298 read_unlock(&hci_dev_list_lock); 299 return hdev; 300 } 301 302 /* ---- Inquiry support ---- */ 303 static void inquiry_cache_flush(struct hci_dev *hdev) 304 { 305 struct inquiry_cache *cache = &hdev->inq_cache; 306 struct inquiry_entry *next = cache->list, *e; 307 308 BT_DBG("cache %p", cache); 309 310 cache->list = NULL; 311 while ((e = next)) { 312 next = e->next; 313 kfree(e); 314 } 315 } 316 317 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr) 318 { 319 struct inquiry_cache *cache = &hdev->inq_cache; 320 struct inquiry_entry *e; 321 322 BT_DBG("cache %p, %s", cache, batostr(bdaddr)); 323 324 for (e = cache->list; e; e = e->next) 325 if (!bacmp(&e->data.bdaddr, bdaddr)) 326 break; 327 return e; 328 } 329 330 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data) 331 { 332 struct inquiry_cache *cache = &hdev->inq_cache; 333 struct inquiry_entry *e; 334 335 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr)); 336 337 if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) { 338 /* Entry not in the cache. Add new one. */ 339 if (!(e = kmalloc(sizeof(struct inquiry_entry), GFP_ATOMIC))) 340 return; 341 memset(e, 0, sizeof(struct inquiry_entry)); 342 e->next = cache->list; 343 cache->list = e; 344 } 345 346 memcpy(&e->data, data, sizeof(*data)); 347 e->timestamp = jiffies; 348 cache->timestamp = jiffies; 349 } 350 351 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf) 352 { 353 struct inquiry_cache *cache = &hdev->inq_cache; 354 struct inquiry_info *info = (struct inquiry_info *) buf; 355 struct inquiry_entry *e; 356 int copied = 0; 357 358 for (e = cache->list; e && copied < num; e = e->next, copied++) { 359 struct inquiry_data *data = &e->data; 360 bacpy(&info->bdaddr, &data->bdaddr); 361 info->pscan_rep_mode = data->pscan_rep_mode; 362 info->pscan_period_mode = data->pscan_period_mode; 363 info->pscan_mode = data->pscan_mode; 364 memcpy(info->dev_class, data->dev_class, 3); 365 info->clock_offset = data->clock_offset; 366 info++; 367 } 368 369 BT_DBG("cache %p, copied %d", cache, copied); 370 return copied; 371 } 372 373 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt) 374 { 375 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt; 376 struct hci_cp_inquiry cp; 377 378 BT_DBG("%s", hdev->name); 379 380 if (test_bit(HCI_INQUIRY, &hdev->flags)) 381 return; 382 383 /* Start Inquiry */ 384 memcpy(&cp.lap, &ir->lap, 3); 385 cp.length = ir->length; 386 cp.num_rsp = ir->num_rsp; 387 hci_send_cmd(hdev, OGF_LINK_CTL, OCF_INQUIRY, sizeof(cp), &cp); 388 } 389 390 int hci_inquiry(void __user *arg) 391 { 392 __u8 __user *ptr = arg; 393 struct hci_inquiry_req ir; 394 struct hci_dev *hdev; 395 int err = 0, do_inquiry = 0, max_rsp; 396 long timeo; 397 __u8 *buf; 398 399 if (copy_from_user(&ir, ptr, sizeof(ir))) 400 return -EFAULT; 401 402 if (!(hdev = hci_dev_get(ir.dev_id))) 403 return -ENODEV; 404 405 hci_dev_lock_bh(hdev); 406 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || 407 inquiry_cache_empty(hdev) || 408 ir.flags & IREQ_CACHE_FLUSH) { 409 inquiry_cache_flush(hdev); 410 do_inquiry = 1; 411 } 412 hci_dev_unlock_bh(hdev); 413 414 timeo = ir.length * msecs_to_jiffies(2000); 415 if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0) 416 goto done; 417 418 /* for unlimited number of responses we will use buffer with 255 entries */ 419 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp; 420 421 /* cache_dump can't sleep. Therefore we allocate temp buffer and then 422 * copy it to the user space. 423 */ 424 if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) { 425 err = -ENOMEM; 426 goto done; 427 } 428 429 hci_dev_lock_bh(hdev); 430 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf); 431 hci_dev_unlock_bh(hdev); 432 433 BT_DBG("num_rsp %d", ir.num_rsp); 434 435 if (!copy_to_user(ptr, &ir, sizeof(ir))) { 436 ptr += sizeof(ir); 437 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) * 438 ir.num_rsp)) 439 err = -EFAULT; 440 } else 441 err = -EFAULT; 442 443 kfree(buf); 444 445 done: 446 hci_dev_put(hdev); 447 return err; 448 } 449 450 /* ---- HCI ioctl helpers ---- */ 451 452 int hci_dev_open(__u16 dev) 453 { 454 struct hci_dev *hdev; 455 int ret = 0; 456 457 if (!(hdev = hci_dev_get(dev))) 458 return -ENODEV; 459 460 BT_DBG("%s %p", hdev->name, hdev); 461 462 hci_req_lock(hdev); 463 464 if (test_bit(HCI_UP, &hdev->flags)) { 465 ret = -EALREADY; 466 goto done; 467 } 468 469 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 470 set_bit(HCI_RAW, &hdev->flags); 471 472 if (hdev->open(hdev)) { 473 ret = -EIO; 474 goto done; 475 } 476 477 if (!test_bit(HCI_RAW, &hdev->flags)) { 478 atomic_set(&hdev->cmd_cnt, 1); 479 set_bit(HCI_INIT, &hdev->flags); 480 481 //__hci_request(hdev, hci_reset_req, 0, HZ); 482 ret = __hci_request(hdev, hci_init_req, 0, 483 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 484 485 clear_bit(HCI_INIT, &hdev->flags); 486 } 487 488 if (!ret) { 489 hci_dev_hold(hdev); 490 set_bit(HCI_UP, &hdev->flags); 491 hci_notify(hdev, HCI_DEV_UP); 492 } else { 493 /* Init failed, cleanup */ 494 tasklet_kill(&hdev->rx_task); 495 tasklet_kill(&hdev->tx_task); 496 tasklet_kill(&hdev->cmd_task); 497 498 skb_queue_purge(&hdev->cmd_q); 499 skb_queue_purge(&hdev->rx_q); 500 501 if (hdev->flush) 502 hdev->flush(hdev); 503 504 if (hdev->sent_cmd) { 505 kfree_skb(hdev->sent_cmd); 506 hdev->sent_cmd = NULL; 507 } 508 509 hdev->close(hdev); 510 hdev->flags = 0; 511 } 512 513 done: 514 hci_req_unlock(hdev); 515 hci_dev_put(hdev); 516 return ret; 517 } 518 519 static int hci_dev_do_close(struct hci_dev *hdev) 520 { 521 BT_DBG("%s %p", hdev->name, hdev); 522 523 hci_req_cancel(hdev, ENODEV); 524 hci_req_lock(hdev); 525 526 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { 527 hci_req_unlock(hdev); 528 return 0; 529 } 530 531 /* Kill RX and TX tasks */ 532 tasklet_kill(&hdev->rx_task); 533 tasklet_kill(&hdev->tx_task); 534 535 hci_dev_lock_bh(hdev); 536 inquiry_cache_flush(hdev); 537 hci_conn_hash_flush(hdev); 538 hci_dev_unlock_bh(hdev); 539 540 hci_notify(hdev, HCI_DEV_DOWN); 541 542 if (hdev->flush) 543 hdev->flush(hdev); 544 545 /* Reset device */ 546 skb_queue_purge(&hdev->cmd_q); 547 atomic_set(&hdev->cmd_cnt, 1); 548 if (!test_bit(HCI_RAW, &hdev->flags)) { 549 set_bit(HCI_INIT, &hdev->flags); 550 __hci_request(hdev, hci_reset_req, 0, 551 msecs_to_jiffies(250)); 552 clear_bit(HCI_INIT, &hdev->flags); 553 } 554 555 /* Kill cmd task */ 556 tasklet_kill(&hdev->cmd_task); 557 558 /* Drop queues */ 559 skb_queue_purge(&hdev->rx_q); 560 skb_queue_purge(&hdev->cmd_q); 561 skb_queue_purge(&hdev->raw_q); 562 563 /* Drop last sent command */ 564 if (hdev->sent_cmd) { 565 kfree_skb(hdev->sent_cmd); 566 hdev->sent_cmd = NULL; 567 } 568 569 /* After this point our queues are empty 570 * and no tasks are scheduled. */ 571 hdev->close(hdev); 572 573 /* Clear flags */ 574 hdev->flags = 0; 575 576 hci_req_unlock(hdev); 577 578 hci_dev_put(hdev); 579 return 0; 580 } 581 582 int hci_dev_close(__u16 dev) 583 { 584 struct hci_dev *hdev; 585 int err; 586 587 if (!(hdev = hci_dev_get(dev))) 588 return -ENODEV; 589 err = hci_dev_do_close(hdev); 590 hci_dev_put(hdev); 591 return err; 592 } 593 594 int hci_dev_reset(__u16 dev) 595 { 596 struct hci_dev *hdev; 597 int ret = 0; 598 599 if (!(hdev = hci_dev_get(dev))) 600 return -ENODEV; 601 602 hci_req_lock(hdev); 603 tasklet_disable(&hdev->tx_task); 604 605 if (!test_bit(HCI_UP, &hdev->flags)) 606 goto done; 607 608 /* Drop queues */ 609 skb_queue_purge(&hdev->rx_q); 610 skb_queue_purge(&hdev->cmd_q); 611 612 hci_dev_lock_bh(hdev); 613 inquiry_cache_flush(hdev); 614 hci_conn_hash_flush(hdev); 615 hci_dev_unlock_bh(hdev); 616 617 if (hdev->flush) 618 hdev->flush(hdev); 619 620 atomic_set(&hdev->cmd_cnt, 1); 621 hdev->acl_cnt = 0; hdev->sco_cnt = 0; 622 623 if (!test_bit(HCI_RAW, &hdev->flags)) 624 ret = __hci_request(hdev, hci_reset_req, 0, 625 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 626 627 done: 628 tasklet_enable(&hdev->tx_task); 629 hci_req_unlock(hdev); 630 hci_dev_put(hdev); 631 return ret; 632 } 633 634 int hci_dev_reset_stat(__u16 dev) 635 { 636 struct hci_dev *hdev; 637 int ret = 0; 638 639 if (!(hdev = hci_dev_get(dev))) 640 return -ENODEV; 641 642 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 643 644 hci_dev_put(hdev); 645 646 return ret; 647 } 648 649 int hci_dev_cmd(unsigned int cmd, void __user *arg) 650 { 651 struct hci_dev *hdev; 652 struct hci_dev_req dr; 653 int err = 0; 654 655 if (copy_from_user(&dr, arg, sizeof(dr))) 656 return -EFAULT; 657 658 if (!(hdev = hci_dev_get(dr.dev_id))) 659 return -ENODEV; 660 661 switch (cmd) { 662 case HCISETAUTH: 663 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 664 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 665 break; 666 667 case HCISETENCRYPT: 668 if (!lmp_encrypt_capable(hdev)) { 669 err = -EOPNOTSUPP; 670 break; 671 } 672 673 if (!test_bit(HCI_AUTH, &hdev->flags)) { 674 /* Auth must be enabled first */ 675 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 676 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 677 if (err) 678 break; 679 } 680 681 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt, 682 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 683 break; 684 685 case HCISETSCAN: 686 err = hci_request(hdev, hci_scan_req, dr.dev_opt, 687 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 688 break; 689 690 case HCISETPTYPE: 691 hdev->pkt_type = (__u16) dr.dev_opt; 692 break; 693 694 case HCISETLINKPOL: 695 hdev->link_policy = (__u16) dr.dev_opt; 696 break; 697 698 case HCISETLINKMODE: 699 hdev->link_mode = ((__u16) dr.dev_opt) & (HCI_LM_MASTER | HCI_LM_ACCEPT); 700 break; 701 702 case HCISETACLMTU: 703 hdev->acl_mtu = *((__u16 *)&dr.dev_opt + 1); 704 hdev->acl_pkts = *((__u16 *)&dr.dev_opt + 0); 705 break; 706 707 case HCISETSCOMTU: 708 hdev->sco_mtu = *((__u16 *)&dr.dev_opt + 1); 709 hdev->sco_pkts = *((__u16 *)&dr.dev_opt + 0); 710 break; 711 712 default: 713 err = -EINVAL; 714 break; 715 } 716 hci_dev_put(hdev); 717 return err; 718 } 719 720 int hci_get_dev_list(void __user *arg) 721 { 722 struct hci_dev_list_req *dl; 723 struct hci_dev_req *dr; 724 struct list_head *p; 725 int n = 0, size, err; 726 __u16 dev_num; 727 728 if (get_user(dev_num, (__u16 __user *) arg)) 729 return -EFAULT; 730 731 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr)) 732 return -EINVAL; 733 734 size = sizeof(*dl) + dev_num * sizeof(*dr); 735 736 if (!(dl = kmalloc(size, GFP_KERNEL))) 737 return -ENOMEM; 738 739 dr = dl->dev_req; 740 741 read_lock_bh(&hci_dev_list_lock); 742 list_for_each(p, &hci_dev_list) { 743 struct hci_dev *hdev; 744 hdev = list_entry(p, struct hci_dev, list); 745 (dr + n)->dev_id = hdev->id; 746 (dr + n)->dev_opt = hdev->flags; 747 if (++n >= dev_num) 748 break; 749 } 750 read_unlock_bh(&hci_dev_list_lock); 751 752 dl->dev_num = n; 753 size = sizeof(*dl) + n * sizeof(*dr); 754 755 err = copy_to_user(arg, dl, size); 756 kfree(dl); 757 758 return err ? -EFAULT : 0; 759 } 760 761 int hci_get_dev_info(void __user *arg) 762 { 763 struct hci_dev *hdev; 764 struct hci_dev_info di; 765 int err = 0; 766 767 if (copy_from_user(&di, arg, sizeof(di))) 768 return -EFAULT; 769 770 if (!(hdev = hci_dev_get(di.dev_id))) 771 return -ENODEV; 772 773 strcpy(di.name, hdev->name); 774 di.bdaddr = hdev->bdaddr; 775 di.type = hdev->type; 776 di.flags = hdev->flags; 777 di.pkt_type = hdev->pkt_type; 778 di.acl_mtu = hdev->acl_mtu; 779 di.acl_pkts = hdev->acl_pkts; 780 di.sco_mtu = hdev->sco_mtu; 781 di.sco_pkts = hdev->sco_pkts; 782 di.link_policy = hdev->link_policy; 783 di.link_mode = hdev->link_mode; 784 785 memcpy(&di.stat, &hdev->stat, sizeof(di.stat)); 786 memcpy(&di.features, &hdev->features, sizeof(di.features)); 787 788 if (copy_to_user(arg, &di, sizeof(di))) 789 err = -EFAULT; 790 791 hci_dev_put(hdev); 792 793 return err; 794 } 795 796 /* ---- Interface to HCI drivers ---- */ 797 798 /* Alloc HCI device */ 799 struct hci_dev *hci_alloc_dev(void) 800 { 801 struct hci_dev *hdev; 802 803 hdev = kmalloc(sizeof(struct hci_dev), GFP_KERNEL); 804 if (!hdev) 805 return NULL; 806 807 memset(hdev, 0, sizeof(struct hci_dev)); 808 809 skb_queue_head_init(&hdev->driver_init); 810 811 return hdev; 812 } 813 EXPORT_SYMBOL(hci_alloc_dev); 814 815 /* Free HCI device */ 816 void hci_free_dev(struct hci_dev *hdev) 817 { 818 skb_queue_purge(&hdev->driver_init); 819 820 /* will free via device release */ 821 put_device(&hdev->dev); 822 } 823 EXPORT_SYMBOL(hci_free_dev); 824 825 /* Register HCI device */ 826 int hci_register_dev(struct hci_dev *hdev) 827 { 828 struct list_head *head = &hci_dev_list, *p; 829 int id = 0; 830 831 BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner); 832 833 if (!hdev->open || !hdev->close || !hdev->destruct) 834 return -EINVAL; 835 836 write_lock_bh(&hci_dev_list_lock); 837 838 /* Find first available device id */ 839 list_for_each(p, &hci_dev_list) { 840 if (list_entry(p, struct hci_dev, list)->id != id) 841 break; 842 head = p; id++; 843 } 844 845 sprintf(hdev->name, "hci%d", id); 846 hdev->id = id; 847 list_add(&hdev->list, head); 848 849 atomic_set(&hdev->refcnt, 1); 850 spin_lock_init(&hdev->lock); 851 852 hdev->flags = 0; 853 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); 854 hdev->link_mode = (HCI_LM_ACCEPT); 855 856 hdev->idle_timeout = 0; 857 hdev->sniff_max_interval = 800; 858 hdev->sniff_min_interval = 80; 859 860 tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev); 861 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev); 862 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev); 863 864 skb_queue_head_init(&hdev->rx_q); 865 skb_queue_head_init(&hdev->cmd_q); 866 skb_queue_head_init(&hdev->raw_q); 867 868 init_waitqueue_head(&hdev->req_wait_q); 869 init_MUTEX(&hdev->req_lock); 870 871 inquiry_cache_init(hdev); 872 873 hci_conn_hash_init(hdev); 874 875 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 876 877 atomic_set(&hdev->promisc, 0); 878 879 write_unlock_bh(&hci_dev_list_lock); 880 881 hci_register_sysfs(hdev); 882 883 hci_notify(hdev, HCI_DEV_REG); 884 885 return id; 886 } 887 EXPORT_SYMBOL(hci_register_dev); 888 889 /* Unregister HCI device */ 890 int hci_unregister_dev(struct hci_dev *hdev) 891 { 892 BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type); 893 894 hci_unregister_sysfs(hdev); 895 896 write_lock_bh(&hci_dev_list_lock); 897 list_del(&hdev->list); 898 write_unlock_bh(&hci_dev_list_lock); 899 900 hci_dev_do_close(hdev); 901 902 hci_notify(hdev, HCI_DEV_UNREG); 903 904 __hci_dev_put(hdev); 905 return 0; 906 } 907 EXPORT_SYMBOL(hci_unregister_dev); 908 909 /* Suspend HCI device */ 910 int hci_suspend_dev(struct hci_dev *hdev) 911 { 912 hci_notify(hdev, HCI_DEV_SUSPEND); 913 return 0; 914 } 915 EXPORT_SYMBOL(hci_suspend_dev); 916 917 /* Resume HCI device */ 918 int hci_resume_dev(struct hci_dev *hdev) 919 { 920 hci_notify(hdev, HCI_DEV_RESUME); 921 return 0; 922 } 923 EXPORT_SYMBOL(hci_resume_dev); 924 925 /* ---- Interface to upper protocols ---- */ 926 927 /* Register/Unregister protocols. 928 * hci_task_lock is used to ensure that no tasks are running. */ 929 int hci_register_proto(struct hci_proto *hp) 930 { 931 int err = 0; 932 933 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 934 935 if (hp->id >= HCI_MAX_PROTO) 936 return -EINVAL; 937 938 write_lock_bh(&hci_task_lock); 939 940 if (!hci_proto[hp->id]) 941 hci_proto[hp->id] = hp; 942 else 943 err = -EEXIST; 944 945 write_unlock_bh(&hci_task_lock); 946 947 return err; 948 } 949 EXPORT_SYMBOL(hci_register_proto); 950 951 int hci_unregister_proto(struct hci_proto *hp) 952 { 953 int err = 0; 954 955 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 956 957 if (hp->id >= HCI_MAX_PROTO) 958 return -EINVAL; 959 960 write_lock_bh(&hci_task_lock); 961 962 if (hci_proto[hp->id]) 963 hci_proto[hp->id] = NULL; 964 else 965 err = -ENOENT; 966 967 write_unlock_bh(&hci_task_lock); 968 969 return err; 970 } 971 EXPORT_SYMBOL(hci_unregister_proto); 972 973 int hci_register_cb(struct hci_cb *cb) 974 { 975 BT_DBG("%p name %s", cb, cb->name); 976 977 write_lock_bh(&hci_cb_list_lock); 978 list_add(&cb->list, &hci_cb_list); 979 write_unlock_bh(&hci_cb_list_lock); 980 981 return 0; 982 } 983 EXPORT_SYMBOL(hci_register_cb); 984 985 int hci_unregister_cb(struct hci_cb *cb) 986 { 987 BT_DBG("%p name %s", cb, cb->name); 988 989 write_lock_bh(&hci_cb_list_lock); 990 list_del(&cb->list); 991 write_unlock_bh(&hci_cb_list_lock); 992 993 return 0; 994 } 995 EXPORT_SYMBOL(hci_unregister_cb); 996 997 static int hci_send_frame(struct sk_buff *skb) 998 { 999 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 1000 1001 if (!hdev) { 1002 kfree_skb(skb); 1003 return -ENODEV; 1004 } 1005 1006 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len); 1007 1008 if (atomic_read(&hdev->promisc)) { 1009 /* Time stamp */ 1010 __net_timestamp(skb); 1011 1012 hci_send_to_sock(hdev, skb); 1013 } 1014 1015 /* Get rid of skb owner, prior to sending to the driver. */ 1016 skb_orphan(skb); 1017 1018 return hdev->send(skb); 1019 } 1020 1021 /* Send HCI command */ 1022 int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *param) 1023 { 1024 int len = HCI_COMMAND_HDR_SIZE + plen; 1025 struct hci_command_hdr *hdr; 1026 struct sk_buff *skb; 1027 1028 BT_DBG("%s ogf 0x%x ocf 0x%x plen %d", hdev->name, ogf, ocf, plen); 1029 1030 skb = bt_skb_alloc(len, GFP_ATOMIC); 1031 if (!skb) { 1032 BT_ERR("%s Can't allocate memory for HCI command", hdev->name); 1033 return -ENOMEM; 1034 } 1035 1036 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE); 1037 hdr->opcode = __cpu_to_le16(hci_opcode_pack(ogf, ocf)); 1038 hdr->plen = plen; 1039 1040 if (plen) 1041 memcpy(skb_put(skb, plen), param, plen); 1042 1043 BT_DBG("skb len %d", skb->len); 1044 1045 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 1046 skb->dev = (void *) hdev; 1047 skb_queue_tail(&hdev->cmd_q, skb); 1048 hci_sched_cmd(hdev); 1049 1050 return 0; 1051 } 1052 1053 /* Get data from the previously sent command */ 1054 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf) 1055 { 1056 struct hci_command_hdr *hdr; 1057 1058 if (!hdev->sent_cmd) 1059 return NULL; 1060 1061 hdr = (void *) hdev->sent_cmd->data; 1062 1063 if (hdr->opcode != __cpu_to_le16(hci_opcode_pack(ogf, ocf))) 1064 return NULL; 1065 1066 BT_DBG("%s ogf 0x%x ocf 0x%x", hdev->name, ogf, ocf); 1067 1068 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE; 1069 } 1070 1071 /* Send ACL data */ 1072 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags) 1073 { 1074 struct hci_acl_hdr *hdr; 1075 int len = skb->len; 1076 1077 hdr = (struct hci_acl_hdr *) skb_push(skb, HCI_ACL_HDR_SIZE); 1078 hdr->handle = __cpu_to_le16(hci_handle_pack(handle, flags)); 1079 hdr->dlen = __cpu_to_le16(len); 1080 1081 skb->h.raw = (void *) hdr; 1082 } 1083 1084 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags) 1085 { 1086 struct hci_dev *hdev = conn->hdev; 1087 struct sk_buff *list; 1088 1089 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags); 1090 1091 skb->dev = (void *) hdev; 1092 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1093 hci_add_acl_hdr(skb, conn->handle, flags | ACL_START); 1094 1095 if (!(list = skb_shinfo(skb)->frag_list)) { 1096 /* Non fragmented */ 1097 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len); 1098 1099 skb_queue_tail(&conn->data_q, skb); 1100 } else { 1101 /* Fragmented */ 1102 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1103 1104 skb_shinfo(skb)->frag_list = NULL; 1105 1106 /* Queue all fragments atomically */ 1107 spin_lock_bh(&conn->data_q.lock); 1108 1109 __skb_queue_tail(&conn->data_q, skb); 1110 do { 1111 skb = list; list = list->next; 1112 1113 skb->dev = (void *) hdev; 1114 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1115 hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT); 1116 1117 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1118 1119 __skb_queue_tail(&conn->data_q, skb); 1120 } while (list); 1121 1122 spin_unlock_bh(&conn->data_q.lock); 1123 } 1124 1125 hci_sched_tx(hdev); 1126 return 0; 1127 } 1128 EXPORT_SYMBOL(hci_send_acl); 1129 1130 /* Send SCO data */ 1131 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb) 1132 { 1133 struct hci_dev *hdev = conn->hdev; 1134 struct hci_sco_hdr hdr; 1135 1136 BT_DBG("%s len %d", hdev->name, skb->len); 1137 1138 if (skb->len > hdev->sco_mtu) { 1139 kfree_skb(skb); 1140 return -EINVAL; 1141 } 1142 1143 hdr.handle = __cpu_to_le16(conn->handle); 1144 hdr.dlen = skb->len; 1145 1146 skb->h.raw = skb_push(skb, HCI_SCO_HDR_SIZE); 1147 memcpy(skb->h.raw, &hdr, HCI_SCO_HDR_SIZE); 1148 1149 skb->dev = (void *) hdev; 1150 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT; 1151 skb_queue_tail(&conn->data_q, skb); 1152 hci_sched_tx(hdev); 1153 return 0; 1154 } 1155 EXPORT_SYMBOL(hci_send_sco); 1156 1157 /* ---- HCI TX task (outgoing data) ---- */ 1158 1159 /* HCI Connection scheduler */ 1160 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote) 1161 { 1162 struct hci_conn_hash *h = &hdev->conn_hash; 1163 struct hci_conn *conn = NULL; 1164 int num = 0, min = ~0; 1165 struct list_head *p; 1166 1167 /* We don't have to lock device here. Connections are always 1168 * added and removed with TX task disabled. */ 1169 list_for_each(p, &h->list) { 1170 struct hci_conn *c; 1171 c = list_entry(p, struct hci_conn, list); 1172 1173 if (c->type != type || c->state != BT_CONNECTED 1174 || skb_queue_empty(&c->data_q)) 1175 continue; 1176 num++; 1177 1178 if (c->sent < min) { 1179 min = c->sent; 1180 conn = c; 1181 } 1182 } 1183 1184 if (conn) { 1185 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt); 1186 int q = cnt / num; 1187 *quote = q ? q : 1; 1188 } else 1189 *quote = 0; 1190 1191 BT_DBG("conn %p quote %d", conn, *quote); 1192 return conn; 1193 } 1194 1195 static inline void hci_acl_tx_to(struct hci_dev *hdev) 1196 { 1197 struct hci_conn_hash *h = &hdev->conn_hash; 1198 struct list_head *p; 1199 struct hci_conn *c; 1200 1201 BT_ERR("%s ACL tx timeout", hdev->name); 1202 1203 /* Kill stalled connections */ 1204 list_for_each(p, &h->list) { 1205 c = list_entry(p, struct hci_conn, list); 1206 if (c->type == ACL_LINK && c->sent) { 1207 BT_ERR("%s killing stalled ACL connection %s", 1208 hdev->name, batostr(&c->dst)); 1209 hci_acl_disconn(c, 0x13); 1210 } 1211 } 1212 } 1213 1214 static inline void hci_sched_acl(struct hci_dev *hdev) 1215 { 1216 struct hci_conn *conn; 1217 struct sk_buff *skb; 1218 int quote; 1219 1220 BT_DBG("%s", hdev->name); 1221 1222 if (!test_bit(HCI_RAW, &hdev->flags)) { 1223 /* ACL tx timeout must be longer than maximum 1224 * link supervision timeout (40.9 seconds) */ 1225 if (!hdev->acl_cnt && (jiffies - hdev->acl_last_tx) > (HZ * 45)) 1226 hci_acl_tx_to(hdev); 1227 } 1228 1229 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, "e))) { 1230 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1231 BT_DBG("skb %p len %d", skb, skb->len); 1232 1233 hci_conn_enter_active_mode(conn); 1234 1235 hci_send_frame(skb); 1236 hdev->acl_last_tx = jiffies; 1237 1238 hdev->acl_cnt--; 1239 conn->sent++; 1240 } 1241 } 1242 } 1243 1244 /* Schedule SCO */ 1245 static inline void hci_sched_sco(struct hci_dev *hdev) 1246 { 1247 struct hci_conn *conn; 1248 struct sk_buff *skb; 1249 int quote; 1250 1251 BT_DBG("%s", hdev->name); 1252 1253 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) { 1254 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1255 BT_DBG("skb %p len %d", skb, skb->len); 1256 hci_send_frame(skb); 1257 1258 conn->sent++; 1259 if (conn->sent == ~0) 1260 conn->sent = 0; 1261 } 1262 } 1263 } 1264 1265 static void hci_tx_task(unsigned long arg) 1266 { 1267 struct hci_dev *hdev = (struct hci_dev *) arg; 1268 struct sk_buff *skb; 1269 1270 read_lock(&hci_task_lock); 1271 1272 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt); 1273 1274 /* Schedule queues and send stuff to HCI driver */ 1275 1276 hci_sched_acl(hdev); 1277 1278 hci_sched_sco(hdev); 1279 1280 /* Send next queued raw (unknown type) packet */ 1281 while ((skb = skb_dequeue(&hdev->raw_q))) 1282 hci_send_frame(skb); 1283 1284 read_unlock(&hci_task_lock); 1285 } 1286 1287 /* ----- HCI RX task (incoming data proccessing) ----- */ 1288 1289 /* ACL data packet */ 1290 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1291 { 1292 struct hci_acl_hdr *hdr = (void *) skb->data; 1293 struct hci_conn *conn; 1294 __u16 handle, flags; 1295 1296 skb_pull(skb, HCI_ACL_HDR_SIZE); 1297 1298 handle = __le16_to_cpu(hdr->handle); 1299 flags = hci_flags(handle); 1300 handle = hci_handle(handle); 1301 1302 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags); 1303 1304 hdev->stat.acl_rx++; 1305 1306 hci_dev_lock(hdev); 1307 conn = hci_conn_hash_lookup_handle(hdev, handle); 1308 hci_dev_unlock(hdev); 1309 1310 if (conn) { 1311 register struct hci_proto *hp; 1312 1313 hci_conn_enter_active_mode(conn); 1314 1315 /* Send to upper protocol */ 1316 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) { 1317 hp->recv_acldata(conn, skb, flags); 1318 return; 1319 } 1320 } else { 1321 BT_ERR("%s ACL packet for unknown connection handle %d", 1322 hdev->name, handle); 1323 } 1324 1325 kfree_skb(skb); 1326 } 1327 1328 /* SCO data packet */ 1329 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1330 { 1331 struct hci_sco_hdr *hdr = (void *) skb->data; 1332 struct hci_conn *conn; 1333 __u16 handle; 1334 1335 skb_pull(skb, HCI_SCO_HDR_SIZE); 1336 1337 handle = __le16_to_cpu(hdr->handle); 1338 1339 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle); 1340 1341 hdev->stat.sco_rx++; 1342 1343 hci_dev_lock(hdev); 1344 conn = hci_conn_hash_lookup_handle(hdev, handle); 1345 hci_dev_unlock(hdev); 1346 1347 if (conn) { 1348 register struct hci_proto *hp; 1349 1350 /* Send to upper protocol */ 1351 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) { 1352 hp->recv_scodata(conn, skb); 1353 return; 1354 } 1355 } else { 1356 BT_ERR("%s SCO packet for unknown connection handle %d", 1357 hdev->name, handle); 1358 } 1359 1360 kfree_skb(skb); 1361 } 1362 1363 static void hci_rx_task(unsigned long arg) 1364 { 1365 struct hci_dev *hdev = (struct hci_dev *) arg; 1366 struct sk_buff *skb; 1367 1368 BT_DBG("%s", hdev->name); 1369 1370 read_lock(&hci_task_lock); 1371 1372 while ((skb = skb_dequeue(&hdev->rx_q))) { 1373 if (atomic_read(&hdev->promisc)) { 1374 /* Send copy to the sockets */ 1375 hci_send_to_sock(hdev, skb); 1376 } 1377 1378 if (test_bit(HCI_RAW, &hdev->flags)) { 1379 kfree_skb(skb); 1380 continue; 1381 } 1382 1383 if (test_bit(HCI_INIT, &hdev->flags)) { 1384 /* Don't process data packets in this states. */ 1385 switch (bt_cb(skb)->pkt_type) { 1386 case HCI_ACLDATA_PKT: 1387 case HCI_SCODATA_PKT: 1388 kfree_skb(skb); 1389 continue; 1390 }; 1391 } 1392 1393 /* Process frame */ 1394 switch (bt_cb(skb)->pkt_type) { 1395 case HCI_EVENT_PKT: 1396 hci_event_packet(hdev, skb); 1397 break; 1398 1399 case HCI_ACLDATA_PKT: 1400 BT_DBG("%s ACL data packet", hdev->name); 1401 hci_acldata_packet(hdev, skb); 1402 break; 1403 1404 case HCI_SCODATA_PKT: 1405 BT_DBG("%s SCO data packet", hdev->name); 1406 hci_scodata_packet(hdev, skb); 1407 break; 1408 1409 default: 1410 kfree_skb(skb); 1411 break; 1412 } 1413 } 1414 1415 read_unlock(&hci_task_lock); 1416 } 1417 1418 static void hci_cmd_task(unsigned long arg) 1419 { 1420 struct hci_dev *hdev = (struct hci_dev *) arg; 1421 struct sk_buff *skb; 1422 1423 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt)); 1424 1425 if (!atomic_read(&hdev->cmd_cnt) && (jiffies - hdev->cmd_last_tx) > HZ) { 1426 BT_ERR("%s command tx timeout", hdev->name); 1427 atomic_set(&hdev->cmd_cnt, 1); 1428 } 1429 1430 /* Send queued commands */ 1431 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) { 1432 if (hdev->sent_cmd) 1433 kfree_skb(hdev->sent_cmd); 1434 1435 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) { 1436 atomic_dec(&hdev->cmd_cnt); 1437 hci_send_frame(skb); 1438 hdev->cmd_last_tx = jiffies; 1439 } else { 1440 skb_queue_head(&hdev->cmd_q, skb); 1441 hci_sched_cmd(hdev); 1442 } 1443 } 1444 } 1445