1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 6 7 This program is free software; you can redistribute it and/or modify 8 it under the terms of the GNU General Public License version 2 as 9 published by the Free Software Foundation; 10 11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 19 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 22 SOFTWARE IS DISCLAIMED. 23 */ 24 25 /* Bluetooth HCI core. */ 26 27 #include <linux/jiffies.h> 28 #include <linux/module.h> 29 #include <linux/kmod.h> 30 31 #include <linux/types.h> 32 #include <linux/errno.h> 33 #include <linux/kernel.h> 34 #include <linux/sched.h> 35 #include <linux/slab.h> 36 #include <linux/poll.h> 37 #include <linux/fcntl.h> 38 #include <linux/init.h> 39 #include <linux/skbuff.h> 40 #include <linux/workqueue.h> 41 #include <linux/interrupt.h> 42 #include <linux/notifier.h> 43 #include <linux/rfkill.h> 44 #include <net/sock.h> 45 46 #include <asm/system.h> 47 #include <asm/uaccess.h> 48 #include <asm/unaligned.h> 49 50 #include <net/bluetooth/bluetooth.h> 51 #include <net/bluetooth/hci_core.h> 52 53 static void hci_cmd_task(unsigned long arg); 54 static void hci_rx_task(unsigned long arg); 55 static void hci_tx_task(unsigned long arg); 56 static void hci_notify(struct hci_dev *hdev, int event); 57 58 static DEFINE_RWLOCK(hci_task_lock); 59 60 /* HCI device list */ 61 LIST_HEAD(hci_dev_list); 62 DEFINE_RWLOCK(hci_dev_list_lock); 63 64 /* HCI callback list */ 65 LIST_HEAD(hci_cb_list); 66 DEFINE_RWLOCK(hci_cb_list_lock); 67 68 /* HCI protocols */ 69 #define HCI_MAX_PROTO 2 70 struct hci_proto *hci_proto[HCI_MAX_PROTO]; 71 72 /* HCI notifiers list */ 73 static ATOMIC_NOTIFIER_HEAD(hci_notifier); 74 75 /* ---- HCI notifications ---- */ 76 77 int hci_register_notifier(struct notifier_block *nb) 78 { 79 return atomic_notifier_chain_register(&hci_notifier, nb); 80 } 81 82 int hci_unregister_notifier(struct notifier_block *nb) 83 { 84 return atomic_notifier_chain_unregister(&hci_notifier, nb); 85 } 86 87 static void hci_notify(struct hci_dev *hdev, int event) 88 { 89 atomic_notifier_call_chain(&hci_notifier, event, hdev); 90 } 91 92 /* ---- HCI requests ---- */ 93 94 void hci_req_complete(struct hci_dev *hdev, int result) 95 { 96 BT_DBG("%s result 0x%2.2x", hdev->name, result); 97 98 if (hdev->req_status == HCI_REQ_PEND) { 99 hdev->req_result = result; 100 hdev->req_status = HCI_REQ_DONE; 101 wake_up_interruptible(&hdev->req_wait_q); 102 } 103 } 104 105 static void hci_req_cancel(struct hci_dev *hdev, int err) 106 { 107 BT_DBG("%s err 0x%2.2x", hdev->name, err); 108 109 if (hdev->req_status == HCI_REQ_PEND) { 110 hdev->req_result = err; 111 hdev->req_status = HCI_REQ_CANCELED; 112 wake_up_interruptible(&hdev->req_wait_q); 113 } 114 } 115 116 /* Execute request and wait for completion. */ 117 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 118 unsigned long opt, __u32 timeout) 119 { 120 DECLARE_WAITQUEUE(wait, current); 121 int err = 0; 122 123 BT_DBG("%s start", hdev->name); 124 125 hdev->req_status = HCI_REQ_PEND; 126 127 add_wait_queue(&hdev->req_wait_q, &wait); 128 set_current_state(TASK_INTERRUPTIBLE); 129 130 req(hdev, opt); 131 schedule_timeout(timeout); 132 133 remove_wait_queue(&hdev->req_wait_q, &wait); 134 135 if (signal_pending(current)) 136 return -EINTR; 137 138 switch (hdev->req_status) { 139 case HCI_REQ_DONE: 140 err = -bt_err(hdev->req_result); 141 break; 142 143 case HCI_REQ_CANCELED: 144 err = -hdev->req_result; 145 break; 146 147 default: 148 err = -ETIMEDOUT; 149 break; 150 } 151 152 hdev->req_status = hdev->req_result = 0; 153 154 BT_DBG("%s end: err %d", hdev->name, err); 155 156 return err; 157 } 158 159 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 160 unsigned long opt, __u32 timeout) 161 { 162 int ret; 163 164 if (!test_bit(HCI_UP, &hdev->flags)) 165 return -ENETDOWN; 166 167 /* Serialize all requests */ 168 hci_req_lock(hdev); 169 ret = __hci_request(hdev, req, opt, timeout); 170 hci_req_unlock(hdev); 171 172 return ret; 173 } 174 175 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt) 176 { 177 BT_DBG("%s %ld", hdev->name, opt); 178 179 /* Reset device */ 180 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL); 181 } 182 183 static void hci_init_req(struct hci_dev *hdev, unsigned long opt) 184 { 185 struct sk_buff *skb; 186 __le16 param; 187 __u8 flt_type; 188 189 BT_DBG("%s %ld", hdev->name, opt); 190 191 /* Driver initialization */ 192 193 /* Special commands */ 194 while ((skb = skb_dequeue(&hdev->driver_init))) { 195 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 196 skb->dev = (void *) hdev; 197 198 skb_queue_tail(&hdev->cmd_q, skb); 199 tasklet_schedule(&hdev->cmd_task); 200 } 201 skb_queue_purge(&hdev->driver_init); 202 203 /* Mandatory initialization */ 204 205 /* Reset */ 206 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) 207 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL); 208 209 /* Read Local Supported Features */ 210 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL); 211 212 /* Read Local Version */ 213 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL); 214 215 /* Read Buffer Size (ACL mtu, max pkt, etc.) */ 216 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL); 217 218 #if 0 219 /* Host buffer size */ 220 { 221 struct hci_cp_host_buffer_size cp; 222 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE); 223 cp.sco_mtu = HCI_MAX_SCO_SIZE; 224 cp.acl_max_pkt = cpu_to_le16(0xffff); 225 cp.sco_max_pkt = cpu_to_le16(0xffff); 226 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp); 227 } 228 #endif 229 230 /* Read BD Address */ 231 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL); 232 233 /* Read Class of Device */ 234 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL); 235 236 /* Read Local Name */ 237 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL); 238 239 /* Read Voice Setting */ 240 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL); 241 242 /* Optional initialization */ 243 244 /* Clear Event Filters */ 245 flt_type = HCI_FLT_CLEAR_ALL; 246 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type); 247 248 /* Page timeout ~20 secs */ 249 param = cpu_to_le16(0x8000); 250 hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, ¶m); 251 252 /* Connection accept timeout ~20 secs */ 253 param = cpu_to_le16(0x7d00); 254 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, ¶m); 255 } 256 257 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt) 258 { 259 __u8 scan = opt; 260 261 BT_DBG("%s %x", hdev->name, scan); 262 263 /* Inquiry and Page scans */ 264 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 265 } 266 267 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt) 268 { 269 __u8 auth = opt; 270 271 BT_DBG("%s %x", hdev->name, auth); 272 273 /* Authentication */ 274 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth); 275 } 276 277 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt) 278 { 279 __u8 encrypt = opt; 280 281 BT_DBG("%s %x", hdev->name, encrypt); 282 283 /* Encryption */ 284 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt); 285 } 286 287 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt) 288 { 289 __le16 policy = cpu_to_le16(opt); 290 291 BT_DBG("%s %x", hdev->name, policy); 292 293 /* Default link policy */ 294 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy); 295 } 296 297 /* Get HCI device by index. 298 * Device is held on return. */ 299 struct hci_dev *hci_dev_get(int index) 300 { 301 struct hci_dev *hdev = NULL; 302 struct list_head *p; 303 304 BT_DBG("%d", index); 305 306 if (index < 0) 307 return NULL; 308 309 read_lock(&hci_dev_list_lock); 310 list_for_each(p, &hci_dev_list) { 311 struct hci_dev *d = list_entry(p, struct hci_dev, list); 312 if (d->id == index) { 313 hdev = hci_dev_hold(d); 314 break; 315 } 316 } 317 read_unlock(&hci_dev_list_lock); 318 return hdev; 319 } 320 321 /* ---- Inquiry support ---- */ 322 static void inquiry_cache_flush(struct hci_dev *hdev) 323 { 324 struct inquiry_cache *cache = &hdev->inq_cache; 325 struct inquiry_entry *next = cache->list, *e; 326 327 BT_DBG("cache %p", cache); 328 329 cache->list = NULL; 330 while ((e = next)) { 331 next = e->next; 332 kfree(e); 333 } 334 } 335 336 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr) 337 { 338 struct inquiry_cache *cache = &hdev->inq_cache; 339 struct inquiry_entry *e; 340 341 BT_DBG("cache %p, %s", cache, batostr(bdaddr)); 342 343 for (e = cache->list; e; e = e->next) 344 if (!bacmp(&e->data.bdaddr, bdaddr)) 345 break; 346 return e; 347 } 348 349 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data) 350 { 351 struct inquiry_cache *cache = &hdev->inq_cache; 352 struct inquiry_entry *e; 353 354 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr)); 355 356 if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) { 357 /* Entry not in the cache. Add new one. */ 358 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC))) 359 return; 360 e->next = cache->list; 361 cache->list = e; 362 } 363 364 memcpy(&e->data, data, sizeof(*data)); 365 e->timestamp = jiffies; 366 cache->timestamp = jiffies; 367 } 368 369 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf) 370 { 371 struct inquiry_cache *cache = &hdev->inq_cache; 372 struct inquiry_info *info = (struct inquiry_info *) buf; 373 struct inquiry_entry *e; 374 int copied = 0; 375 376 for (e = cache->list; e && copied < num; e = e->next, copied++) { 377 struct inquiry_data *data = &e->data; 378 bacpy(&info->bdaddr, &data->bdaddr); 379 info->pscan_rep_mode = data->pscan_rep_mode; 380 info->pscan_period_mode = data->pscan_period_mode; 381 info->pscan_mode = data->pscan_mode; 382 memcpy(info->dev_class, data->dev_class, 3); 383 info->clock_offset = data->clock_offset; 384 info++; 385 } 386 387 BT_DBG("cache %p, copied %d", cache, copied); 388 return copied; 389 } 390 391 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt) 392 { 393 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt; 394 struct hci_cp_inquiry cp; 395 396 BT_DBG("%s", hdev->name); 397 398 if (test_bit(HCI_INQUIRY, &hdev->flags)) 399 return; 400 401 /* Start Inquiry */ 402 memcpy(&cp.lap, &ir->lap, 3); 403 cp.length = ir->length; 404 cp.num_rsp = ir->num_rsp; 405 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp); 406 } 407 408 int hci_inquiry(void __user *arg) 409 { 410 __u8 __user *ptr = arg; 411 struct hci_inquiry_req ir; 412 struct hci_dev *hdev; 413 int err = 0, do_inquiry = 0, max_rsp; 414 long timeo; 415 __u8 *buf; 416 417 if (copy_from_user(&ir, ptr, sizeof(ir))) 418 return -EFAULT; 419 420 if (!(hdev = hci_dev_get(ir.dev_id))) 421 return -ENODEV; 422 423 hci_dev_lock_bh(hdev); 424 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || 425 inquiry_cache_empty(hdev) || 426 ir.flags & IREQ_CACHE_FLUSH) { 427 inquiry_cache_flush(hdev); 428 do_inquiry = 1; 429 } 430 hci_dev_unlock_bh(hdev); 431 432 timeo = ir.length * msecs_to_jiffies(2000); 433 if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0) 434 goto done; 435 436 /* for unlimited number of responses we will use buffer with 255 entries */ 437 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp; 438 439 /* cache_dump can't sleep. Therefore we allocate temp buffer and then 440 * copy it to the user space. 441 */ 442 if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) { 443 err = -ENOMEM; 444 goto done; 445 } 446 447 hci_dev_lock_bh(hdev); 448 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf); 449 hci_dev_unlock_bh(hdev); 450 451 BT_DBG("num_rsp %d", ir.num_rsp); 452 453 if (!copy_to_user(ptr, &ir, sizeof(ir))) { 454 ptr += sizeof(ir); 455 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) * 456 ir.num_rsp)) 457 err = -EFAULT; 458 } else 459 err = -EFAULT; 460 461 kfree(buf); 462 463 done: 464 hci_dev_put(hdev); 465 return err; 466 } 467 468 /* ---- HCI ioctl helpers ---- */ 469 470 int hci_dev_open(__u16 dev) 471 { 472 struct hci_dev *hdev; 473 int ret = 0; 474 475 if (!(hdev = hci_dev_get(dev))) 476 return -ENODEV; 477 478 BT_DBG("%s %p", hdev->name, hdev); 479 480 hci_req_lock(hdev); 481 482 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) { 483 ret = -ERFKILL; 484 goto done; 485 } 486 487 if (test_bit(HCI_UP, &hdev->flags)) { 488 ret = -EALREADY; 489 goto done; 490 } 491 492 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 493 set_bit(HCI_RAW, &hdev->flags); 494 495 /* Treat all non BR/EDR controllers as raw devices for now */ 496 if (hdev->dev_type != HCI_BREDR) 497 set_bit(HCI_RAW, &hdev->flags); 498 499 if (hdev->open(hdev)) { 500 ret = -EIO; 501 goto done; 502 } 503 504 if (!test_bit(HCI_RAW, &hdev->flags)) { 505 atomic_set(&hdev->cmd_cnt, 1); 506 set_bit(HCI_INIT, &hdev->flags); 507 508 //__hci_request(hdev, hci_reset_req, 0, HZ); 509 ret = __hci_request(hdev, hci_init_req, 0, 510 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 511 512 clear_bit(HCI_INIT, &hdev->flags); 513 } 514 515 if (!ret) { 516 hci_dev_hold(hdev); 517 set_bit(HCI_UP, &hdev->flags); 518 hci_notify(hdev, HCI_DEV_UP); 519 } else { 520 /* Init failed, cleanup */ 521 tasklet_kill(&hdev->rx_task); 522 tasklet_kill(&hdev->tx_task); 523 tasklet_kill(&hdev->cmd_task); 524 525 skb_queue_purge(&hdev->cmd_q); 526 skb_queue_purge(&hdev->rx_q); 527 528 if (hdev->flush) 529 hdev->flush(hdev); 530 531 if (hdev->sent_cmd) { 532 kfree_skb(hdev->sent_cmd); 533 hdev->sent_cmd = NULL; 534 } 535 536 hdev->close(hdev); 537 hdev->flags = 0; 538 } 539 540 done: 541 hci_req_unlock(hdev); 542 hci_dev_put(hdev); 543 return ret; 544 } 545 546 static int hci_dev_do_close(struct hci_dev *hdev) 547 { 548 BT_DBG("%s %p", hdev->name, hdev); 549 550 hci_req_cancel(hdev, ENODEV); 551 hci_req_lock(hdev); 552 553 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { 554 hci_req_unlock(hdev); 555 return 0; 556 } 557 558 /* Kill RX and TX tasks */ 559 tasklet_kill(&hdev->rx_task); 560 tasklet_kill(&hdev->tx_task); 561 562 hci_dev_lock_bh(hdev); 563 inquiry_cache_flush(hdev); 564 hci_conn_hash_flush(hdev); 565 hci_blacklist_clear(hdev); 566 hci_dev_unlock_bh(hdev); 567 568 hci_notify(hdev, HCI_DEV_DOWN); 569 570 if (hdev->flush) 571 hdev->flush(hdev); 572 573 /* Reset device */ 574 skb_queue_purge(&hdev->cmd_q); 575 atomic_set(&hdev->cmd_cnt, 1); 576 if (!test_bit(HCI_RAW, &hdev->flags)) { 577 set_bit(HCI_INIT, &hdev->flags); 578 __hci_request(hdev, hci_reset_req, 0, 579 msecs_to_jiffies(250)); 580 clear_bit(HCI_INIT, &hdev->flags); 581 } 582 583 /* Kill cmd task */ 584 tasklet_kill(&hdev->cmd_task); 585 586 /* Drop queues */ 587 skb_queue_purge(&hdev->rx_q); 588 skb_queue_purge(&hdev->cmd_q); 589 skb_queue_purge(&hdev->raw_q); 590 591 /* Drop last sent command */ 592 if (hdev->sent_cmd) { 593 kfree_skb(hdev->sent_cmd); 594 hdev->sent_cmd = NULL; 595 } 596 597 /* After this point our queues are empty 598 * and no tasks are scheduled. */ 599 hdev->close(hdev); 600 601 /* Clear flags */ 602 hdev->flags = 0; 603 604 hci_req_unlock(hdev); 605 606 hci_dev_put(hdev); 607 return 0; 608 } 609 610 int hci_dev_close(__u16 dev) 611 { 612 struct hci_dev *hdev; 613 int err; 614 615 if (!(hdev = hci_dev_get(dev))) 616 return -ENODEV; 617 err = hci_dev_do_close(hdev); 618 hci_dev_put(hdev); 619 return err; 620 } 621 622 int hci_dev_reset(__u16 dev) 623 { 624 struct hci_dev *hdev; 625 int ret = 0; 626 627 if (!(hdev = hci_dev_get(dev))) 628 return -ENODEV; 629 630 hci_req_lock(hdev); 631 tasklet_disable(&hdev->tx_task); 632 633 if (!test_bit(HCI_UP, &hdev->flags)) 634 goto done; 635 636 /* Drop queues */ 637 skb_queue_purge(&hdev->rx_q); 638 skb_queue_purge(&hdev->cmd_q); 639 640 hci_dev_lock_bh(hdev); 641 inquiry_cache_flush(hdev); 642 hci_conn_hash_flush(hdev); 643 hci_dev_unlock_bh(hdev); 644 645 if (hdev->flush) 646 hdev->flush(hdev); 647 648 atomic_set(&hdev->cmd_cnt, 1); 649 hdev->acl_cnt = 0; hdev->sco_cnt = 0; 650 651 if (!test_bit(HCI_RAW, &hdev->flags)) 652 ret = __hci_request(hdev, hci_reset_req, 0, 653 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 654 655 done: 656 tasklet_enable(&hdev->tx_task); 657 hci_req_unlock(hdev); 658 hci_dev_put(hdev); 659 return ret; 660 } 661 662 int hci_dev_reset_stat(__u16 dev) 663 { 664 struct hci_dev *hdev; 665 int ret = 0; 666 667 if (!(hdev = hci_dev_get(dev))) 668 return -ENODEV; 669 670 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 671 672 hci_dev_put(hdev); 673 674 return ret; 675 } 676 677 int hci_dev_cmd(unsigned int cmd, void __user *arg) 678 { 679 struct hci_dev *hdev; 680 struct hci_dev_req dr; 681 int err = 0; 682 683 if (copy_from_user(&dr, arg, sizeof(dr))) 684 return -EFAULT; 685 686 if (!(hdev = hci_dev_get(dr.dev_id))) 687 return -ENODEV; 688 689 switch (cmd) { 690 case HCISETAUTH: 691 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 692 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 693 break; 694 695 case HCISETENCRYPT: 696 if (!lmp_encrypt_capable(hdev)) { 697 err = -EOPNOTSUPP; 698 break; 699 } 700 701 if (!test_bit(HCI_AUTH, &hdev->flags)) { 702 /* Auth must be enabled first */ 703 err = hci_request(hdev, hci_auth_req, dr.dev_opt, 704 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 705 if (err) 706 break; 707 } 708 709 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt, 710 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 711 break; 712 713 case HCISETSCAN: 714 err = hci_request(hdev, hci_scan_req, dr.dev_opt, 715 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 716 break; 717 718 case HCISETLINKPOL: 719 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt, 720 msecs_to_jiffies(HCI_INIT_TIMEOUT)); 721 break; 722 723 case HCISETLINKMODE: 724 hdev->link_mode = ((__u16) dr.dev_opt) & 725 (HCI_LM_MASTER | HCI_LM_ACCEPT); 726 break; 727 728 case HCISETPTYPE: 729 hdev->pkt_type = (__u16) dr.dev_opt; 730 break; 731 732 case HCISETACLMTU: 733 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1); 734 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0); 735 break; 736 737 case HCISETSCOMTU: 738 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1); 739 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0); 740 break; 741 742 default: 743 err = -EINVAL; 744 break; 745 } 746 747 hci_dev_put(hdev); 748 return err; 749 } 750 751 int hci_get_dev_list(void __user *arg) 752 { 753 struct hci_dev_list_req *dl; 754 struct hci_dev_req *dr; 755 struct list_head *p; 756 int n = 0, size, err; 757 __u16 dev_num; 758 759 if (get_user(dev_num, (__u16 __user *) arg)) 760 return -EFAULT; 761 762 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr)) 763 return -EINVAL; 764 765 size = sizeof(*dl) + dev_num * sizeof(*dr); 766 767 if (!(dl = kzalloc(size, GFP_KERNEL))) 768 return -ENOMEM; 769 770 dr = dl->dev_req; 771 772 read_lock_bh(&hci_dev_list_lock); 773 list_for_each(p, &hci_dev_list) { 774 struct hci_dev *hdev; 775 hdev = list_entry(p, struct hci_dev, list); 776 (dr + n)->dev_id = hdev->id; 777 (dr + n)->dev_opt = hdev->flags; 778 if (++n >= dev_num) 779 break; 780 } 781 read_unlock_bh(&hci_dev_list_lock); 782 783 dl->dev_num = n; 784 size = sizeof(*dl) + n * sizeof(*dr); 785 786 err = copy_to_user(arg, dl, size); 787 kfree(dl); 788 789 return err ? -EFAULT : 0; 790 } 791 792 int hci_get_dev_info(void __user *arg) 793 { 794 struct hci_dev *hdev; 795 struct hci_dev_info di; 796 int err = 0; 797 798 if (copy_from_user(&di, arg, sizeof(di))) 799 return -EFAULT; 800 801 if (!(hdev = hci_dev_get(di.dev_id))) 802 return -ENODEV; 803 804 strcpy(di.name, hdev->name); 805 di.bdaddr = hdev->bdaddr; 806 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4); 807 di.flags = hdev->flags; 808 di.pkt_type = hdev->pkt_type; 809 di.acl_mtu = hdev->acl_mtu; 810 di.acl_pkts = hdev->acl_pkts; 811 di.sco_mtu = hdev->sco_mtu; 812 di.sco_pkts = hdev->sco_pkts; 813 di.link_policy = hdev->link_policy; 814 di.link_mode = hdev->link_mode; 815 816 memcpy(&di.stat, &hdev->stat, sizeof(di.stat)); 817 memcpy(&di.features, &hdev->features, sizeof(di.features)); 818 819 if (copy_to_user(arg, &di, sizeof(di))) 820 err = -EFAULT; 821 822 hci_dev_put(hdev); 823 824 return err; 825 } 826 827 /* ---- Interface to HCI drivers ---- */ 828 829 static int hci_rfkill_set_block(void *data, bool blocked) 830 { 831 struct hci_dev *hdev = data; 832 833 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked); 834 835 if (!blocked) 836 return 0; 837 838 hci_dev_do_close(hdev); 839 840 return 0; 841 } 842 843 static const struct rfkill_ops hci_rfkill_ops = { 844 .set_block = hci_rfkill_set_block, 845 }; 846 847 /* Alloc HCI device */ 848 struct hci_dev *hci_alloc_dev(void) 849 { 850 struct hci_dev *hdev; 851 852 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL); 853 if (!hdev) 854 return NULL; 855 856 skb_queue_head_init(&hdev->driver_init); 857 858 return hdev; 859 } 860 EXPORT_SYMBOL(hci_alloc_dev); 861 862 /* Free HCI device */ 863 void hci_free_dev(struct hci_dev *hdev) 864 { 865 skb_queue_purge(&hdev->driver_init); 866 867 /* will free via device release */ 868 put_device(&hdev->dev); 869 } 870 EXPORT_SYMBOL(hci_free_dev); 871 872 /* Register HCI device */ 873 int hci_register_dev(struct hci_dev *hdev) 874 { 875 struct list_head *head = &hci_dev_list, *p; 876 int i, id = 0; 877 878 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name, 879 hdev->bus, hdev->owner); 880 881 if (!hdev->open || !hdev->close || !hdev->destruct) 882 return -EINVAL; 883 884 write_lock_bh(&hci_dev_list_lock); 885 886 /* Find first available device id */ 887 list_for_each(p, &hci_dev_list) { 888 if (list_entry(p, struct hci_dev, list)->id != id) 889 break; 890 head = p; id++; 891 } 892 893 sprintf(hdev->name, "hci%d", id); 894 hdev->id = id; 895 list_add(&hdev->list, head); 896 897 atomic_set(&hdev->refcnt, 1); 898 spin_lock_init(&hdev->lock); 899 900 hdev->flags = 0; 901 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); 902 hdev->esco_type = (ESCO_HV1); 903 hdev->link_mode = (HCI_LM_ACCEPT); 904 905 hdev->idle_timeout = 0; 906 hdev->sniff_max_interval = 800; 907 hdev->sniff_min_interval = 80; 908 909 tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev); 910 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev); 911 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev); 912 913 skb_queue_head_init(&hdev->rx_q); 914 skb_queue_head_init(&hdev->cmd_q); 915 skb_queue_head_init(&hdev->raw_q); 916 917 for (i = 0; i < NUM_REASSEMBLY; i++) 918 hdev->reassembly[i] = NULL; 919 920 init_waitqueue_head(&hdev->req_wait_q); 921 mutex_init(&hdev->req_lock); 922 923 inquiry_cache_init(hdev); 924 925 hci_conn_hash_init(hdev); 926 927 INIT_LIST_HEAD(&hdev->blacklist); 928 929 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 930 931 atomic_set(&hdev->promisc, 0); 932 933 write_unlock_bh(&hci_dev_list_lock); 934 935 hdev->workqueue = create_singlethread_workqueue(hdev->name); 936 if (!hdev->workqueue) 937 goto nomem; 938 939 hci_register_sysfs(hdev); 940 941 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev, 942 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev); 943 if (hdev->rfkill) { 944 if (rfkill_register(hdev->rfkill) < 0) { 945 rfkill_destroy(hdev->rfkill); 946 hdev->rfkill = NULL; 947 } 948 } 949 950 hci_notify(hdev, HCI_DEV_REG); 951 952 return id; 953 954 nomem: 955 write_lock_bh(&hci_dev_list_lock); 956 list_del(&hdev->list); 957 write_unlock_bh(&hci_dev_list_lock); 958 959 return -ENOMEM; 960 } 961 EXPORT_SYMBOL(hci_register_dev); 962 963 /* Unregister HCI device */ 964 int hci_unregister_dev(struct hci_dev *hdev) 965 { 966 int i; 967 968 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); 969 970 write_lock_bh(&hci_dev_list_lock); 971 list_del(&hdev->list); 972 write_unlock_bh(&hci_dev_list_lock); 973 974 hci_dev_do_close(hdev); 975 976 for (i = 0; i < NUM_REASSEMBLY; i++) 977 kfree_skb(hdev->reassembly[i]); 978 979 hci_notify(hdev, HCI_DEV_UNREG); 980 981 if (hdev->rfkill) { 982 rfkill_unregister(hdev->rfkill); 983 rfkill_destroy(hdev->rfkill); 984 } 985 986 hci_unregister_sysfs(hdev); 987 988 destroy_workqueue(hdev->workqueue); 989 990 __hci_dev_put(hdev); 991 992 return 0; 993 } 994 EXPORT_SYMBOL(hci_unregister_dev); 995 996 /* Suspend HCI device */ 997 int hci_suspend_dev(struct hci_dev *hdev) 998 { 999 hci_notify(hdev, HCI_DEV_SUSPEND); 1000 return 0; 1001 } 1002 EXPORT_SYMBOL(hci_suspend_dev); 1003 1004 /* Resume HCI device */ 1005 int hci_resume_dev(struct hci_dev *hdev) 1006 { 1007 hci_notify(hdev, HCI_DEV_RESUME); 1008 return 0; 1009 } 1010 EXPORT_SYMBOL(hci_resume_dev); 1011 1012 /* Receive frame from HCI drivers */ 1013 int hci_recv_frame(struct sk_buff *skb) 1014 { 1015 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 1016 if (!hdev || (!test_bit(HCI_UP, &hdev->flags) 1017 && !test_bit(HCI_INIT, &hdev->flags))) { 1018 kfree_skb(skb); 1019 return -ENXIO; 1020 } 1021 1022 /* Incomming skb */ 1023 bt_cb(skb)->incoming = 1; 1024 1025 /* Time stamp */ 1026 __net_timestamp(skb); 1027 1028 /* Queue frame for rx task */ 1029 skb_queue_tail(&hdev->rx_q, skb); 1030 tasklet_schedule(&hdev->rx_task); 1031 1032 return 0; 1033 } 1034 EXPORT_SYMBOL(hci_recv_frame); 1035 1036 static int hci_reassembly(struct hci_dev *hdev, int type, void *data, 1037 int count, __u8 index, gfp_t gfp_mask) 1038 { 1039 int len = 0; 1040 int hlen = 0; 1041 int remain = count; 1042 struct sk_buff *skb; 1043 struct bt_skb_cb *scb; 1044 1045 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) || 1046 index >= NUM_REASSEMBLY) 1047 return -EILSEQ; 1048 1049 skb = hdev->reassembly[index]; 1050 1051 if (!skb) { 1052 switch (type) { 1053 case HCI_ACLDATA_PKT: 1054 len = HCI_MAX_FRAME_SIZE; 1055 hlen = HCI_ACL_HDR_SIZE; 1056 break; 1057 case HCI_EVENT_PKT: 1058 len = HCI_MAX_EVENT_SIZE; 1059 hlen = HCI_EVENT_HDR_SIZE; 1060 break; 1061 case HCI_SCODATA_PKT: 1062 len = HCI_MAX_SCO_SIZE; 1063 hlen = HCI_SCO_HDR_SIZE; 1064 break; 1065 } 1066 1067 skb = bt_skb_alloc(len, gfp_mask); 1068 if (!skb) 1069 return -ENOMEM; 1070 1071 scb = (void *) skb->cb; 1072 scb->expect = hlen; 1073 scb->pkt_type = type; 1074 1075 skb->dev = (void *) hdev; 1076 hdev->reassembly[index] = skb; 1077 } 1078 1079 while (count) { 1080 scb = (void *) skb->cb; 1081 len = min(scb->expect, (__u16)count); 1082 1083 memcpy(skb_put(skb, len), data, len); 1084 1085 count -= len; 1086 data += len; 1087 scb->expect -= len; 1088 remain = count; 1089 1090 switch (type) { 1091 case HCI_EVENT_PKT: 1092 if (skb->len == HCI_EVENT_HDR_SIZE) { 1093 struct hci_event_hdr *h = hci_event_hdr(skb); 1094 scb->expect = h->plen; 1095 1096 if (skb_tailroom(skb) < scb->expect) { 1097 kfree_skb(skb); 1098 hdev->reassembly[index] = NULL; 1099 return -ENOMEM; 1100 } 1101 } 1102 break; 1103 1104 case HCI_ACLDATA_PKT: 1105 if (skb->len == HCI_ACL_HDR_SIZE) { 1106 struct hci_acl_hdr *h = hci_acl_hdr(skb); 1107 scb->expect = __le16_to_cpu(h->dlen); 1108 1109 if (skb_tailroom(skb) < scb->expect) { 1110 kfree_skb(skb); 1111 hdev->reassembly[index] = NULL; 1112 return -ENOMEM; 1113 } 1114 } 1115 break; 1116 1117 case HCI_SCODATA_PKT: 1118 if (skb->len == HCI_SCO_HDR_SIZE) { 1119 struct hci_sco_hdr *h = hci_sco_hdr(skb); 1120 scb->expect = h->dlen; 1121 1122 if (skb_tailroom(skb) < scb->expect) { 1123 kfree_skb(skb); 1124 hdev->reassembly[index] = NULL; 1125 return -ENOMEM; 1126 } 1127 } 1128 break; 1129 } 1130 1131 if (scb->expect == 0) { 1132 /* Complete frame */ 1133 1134 bt_cb(skb)->pkt_type = type; 1135 hci_recv_frame(skb); 1136 1137 hdev->reassembly[index] = NULL; 1138 return remain; 1139 } 1140 } 1141 1142 return remain; 1143 } 1144 1145 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count) 1146 { 1147 int rem = 0; 1148 1149 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) 1150 return -EILSEQ; 1151 1152 while (count) { 1153 rem = hci_reassembly(hdev, type, data, count, 1154 type - 1, GFP_ATOMIC); 1155 if (rem < 0) 1156 return rem; 1157 1158 data += (count - rem); 1159 count = rem; 1160 }; 1161 1162 return rem; 1163 } 1164 EXPORT_SYMBOL(hci_recv_fragment); 1165 1166 #define STREAM_REASSEMBLY 0 1167 1168 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count) 1169 { 1170 int type; 1171 int rem = 0; 1172 1173 while (count) { 1174 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY]; 1175 1176 if (!skb) { 1177 struct { char type; } *pkt; 1178 1179 /* Start of the frame */ 1180 pkt = data; 1181 type = pkt->type; 1182 1183 data++; 1184 count--; 1185 } else 1186 type = bt_cb(skb)->pkt_type; 1187 1188 rem = hci_reassembly(hdev, type, data, 1189 count, STREAM_REASSEMBLY, GFP_ATOMIC); 1190 if (rem < 0) 1191 return rem; 1192 1193 data += (count - rem); 1194 count = rem; 1195 }; 1196 1197 return rem; 1198 } 1199 EXPORT_SYMBOL(hci_recv_stream_fragment); 1200 1201 /* ---- Interface to upper protocols ---- */ 1202 1203 /* Register/Unregister protocols. 1204 * hci_task_lock is used to ensure that no tasks are running. */ 1205 int hci_register_proto(struct hci_proto *hp) 1206 { 1207 int err = 0; 1208 1209 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 1210 1211 if (hp->id >= HCI_MAX_PROTO) 1212 return -EINVAL; 1213 1214 write_lock_bh(&hci_task_lock); 1215 1216 if (!hci_proto[hp->id]) 1217 hci_proto[hp->id] = hp; 1218 else 1219 err = -EEXIST; 1220 1221 write_unlock_bh(&hci_task_lock); 1222 1223 return err; 1224 } 1225 EXPORT_SYMBOL(hci_register_proto); 1226 1227 int hci_unregister_proto(struct hci_proto *hp) 1228 { 1229 int err = 0; 1230 1231 BT_DBG("%p name %s id %d", hp, hp->name, hp->id); 1232 1233 if (hp->id >= HCI_MAX_PROTO) 1234 return -EINVAL; 1235 1236 write_lock_bh(&hci_task_lock); 1237 1238 if (hci_proto[hp->id]) 1239 hci_proto[hp->id] = NULL; 1240 else 1241 err = -ENOENT; 1242 1243 write_unlock_bh(&hci_task_lock); 1244 1245 return err; 1246 } 1247 EXPORT_SYMBOL(hci_unregister_proto); 1248 1249 int hci_register_cb(struct hci_cb *cb) 1250 { 1251 BT_DBG("%p name %s", cb, cb->name); 1252 1253 write_lock_bh(&hci_cb_list_lock); 1254 list_add(&cb->list, &hci_cb_list); 1255 write_unlock_bh(&hci_cb_list_lock); 1256 1257 return 0; 1258 } 1259 EXPORT_SYMBOL(hci_register_cb); 1260 1261 int hci_unregister_cb(struct hci_cb *cb) 1262 { 1263 BT_DBG("%p name %s", cb, cb->name); 1264 1265 write_lock_bh(&hci_cb_list_lock); 1266 list_del(&cb->list); 1267 write_unlock_bh(&hci_cb_list_lock); 1268 1269 return 0; 1270 } 1271 EXPORT_SYMBOL(hci_unregister_cb); 1272 1273 static int hci_send_frame(struct sk_buff *skb) 1274 { 1275 struct hci_dev *hdev = (struct hci_dev *) skb->dev; 1276 1277 if (!hdev) { 1278 kfree_skb(skb); 1279 return -ENODEV; 1280 } 1281 1282 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len); 1283 1284 if (atomic_read(&hdev->promisc)) { 1285 /* Time stamp */ 1286 __net_timestamp(skb); 1287 1288 hci_send_to_sock(hdev, skb); 1289 } 1290 1291 /* Get rid of skb owner, prior to sending to the driver. */ 1292 skb_orphan(skb); 1293 1294 return hdev->send(skb); 1295 } 1296 1297 /* Send HCI command */ 1298 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param) 1299 { 1300 int len = HCI_COMMAND_HDR_SIZE + plen; 1301 struct hci_command_hdr *hdr; 1302 struct sk_buff *skb; 1303 1304 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen); 1305 1306 skb = bt_skb_alloc(len, GFP_ATOMIC); 1307 if (!skb) { 1308 BT_ERR("%s no memory for command", hdev->name); 1309 return -ENOMEM; 1310 } 1311 1312 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE); 1313 hdr->opcode = cpu_to_le16(opcode); 1314 hdr->plen = plen; 1315 1316 if (plen) 1317 memcpy(skb_put(skb, plen), param, plen); 1318 1319 BT_DBG("skb len %d", skb->len); 1320 1321 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT; 1322 skb->dev = (void *) hdev; 1323 1324 skb_queue_tail(&hdev->cmd_q, skb); 1325 tasklet_schedule(&hdev->cmd_task); 1326 1327 return 0; 1328 } 1329 1330 /* Get data from the previously sent command */ 1331 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode) 1332 { 1333 struct hci_command_hdr *hdr; 1334 1335 if (!hdev->sent_cmd) 1336 return NULL; 1337 1338 hdr = (void *) hdev->sent_cmd->data; 1339 1340 if (hdr->opcode != cpu_to_le16(opcode)) 1341 return NULL; 1342 1343 BT_DBG("%s opcode 0x%x", hdev->name, opcode); 1344 1345 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE; 1346 } 1347 1348 /* Send ACL data */ 1349 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags) 1350 { 1351 struct hci_acl_hdr *hdr; 1352 int len = skb->len; 1353 1354 skb_push(skb, HCI_ACL_HDR_SIZE); 1355 skb_reset_transport_header(skb); 1356 hdr = (struct hci_acl_hdr *)skb_transport_header(skb); 1357 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags)); 1358 hdr->dlen = cpu_to_le16(len); 1359 } 1360 1361 void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags) 1362 { 1363 struct hci_dev *hdev = conn->hdev; 1364 struct sk_buff *list; 1365 1366 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags); 1367 1368 skb->dev = (void *) hdev; 1369 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1370 hci_add_acl_hdr(skb, conn->handle, flags | ACL_START); 1371 1372 if (!(list = skb_shinfo(skb)->frag_list)) { 1373 /* Non fragmented */ 1374 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len); 1375 1376 skb_queue_tail(&conn->data_q, skb); 1377 } else { 1378 /* Fragmented */ 1379 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1380 1381 skb_shinfo(skb)->frag_list = NULL; 1382 1383 /* Queue all fragments atomically */ 1384 spin_lock_bh(&conn->data_q.lock); 1385 1386 __skb_queue_tail(&conn->data_q, skb); 1387 do { 1388 skb = list; list = list->next; 1389 1390 skb->dev = (void *) hdev; 1391 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 1392 hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT); 1393 1394 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 1395 1396 __skb_queue_tail(&conn->data_q, skb); 1397 } while (list); 1398 1399 spin_unlock_bh(&conn->data_q.lock); 1400 } 1401 1402 tasklet_schedule(&hdev->tx_task); 1403 } 1404 EXPORT_SYMBOL(hci_send_acl); 1405 1406 /* Send SCO data */ 1407 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb) 1408 { 1409 struct hci_dev *hdev = conn->hdev; 1410 struct hci_sco_hdr hdr; 1411 1412 BT_DBG("%s len %d", hdev->name, skb->len); 1413 1414 hdr.handle = cpu_to_le16(conn->handle); 1415 hdr.dlen = skb->len; 1416 1417 skb_push(skb, HCI_SCO_HDR_SIZE); 1418 skb_reset_transport_header(skb); 1419 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE); 1420 1421 skb->dev = (void *) hdev; 1422 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT; 1423 1424 skb_queue_tail(&conn->data_q, skb); 1425 tasklet_schedule(&hdev->tx_task); 1426 } 1427 EXPORT_SYMBOL(hci_send_sco); 1428 1429 /* ---- HCI TX task (outgoing data) ---- */ 1430 1431 /* HCI Connection scheduler */ 1432 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote) 1433 { 1434 struct hci_conn_hash *h = &hdev->conn_hash; 1435 struct hci_conn *conn = NULL; 1436 int num = 0, min = ~0; 1437 struct list_head *p; 1438 1439 /* We don't have to lock device here. Connections are always 1440 * added and removed with TX task disabled. */ 1441 list_for_each(p, &h->list) { 1442 struct hci_conn *c; 1443 c = list_entry(p, struct hci_conn, list); 1444 1445 if (c->type != type || skb_queue_empty(&c->data_q)) 1446 continue; 1447 1448 if (c->state != BT_CONNECTED && c->state != BT_CONFIG) 1449 continue; 1450 1451 num++; 1452 1453 if (c->sent < min) { 1454 min = c->sent; 1455 conn = c; 1456 } 1457 } 1458 1459 if (conn) { 1460 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt); 1461 int q = cnt / num; 1462 *quote = q ? q : 1; 1463 } else 1464 *quote = 0; 1465 1466 BT_DBG("conn %p quote %d", conn, *quote); 1467 return conn; 1468 } 1469 1470 static inline void hci_acl_tx_to(struct hci_dev *hdev) 1471 { 1472 struct hci_conn_hash *h = &hdev->conn_hash; 1473 struct list_head *p; 1474 struct hci_conn *c; 1475 1476 BT_ERR("%s ACL tx timeout", hdev->name); 1477 1478 /* Kill stalled connections */ 1479 list_for_each(p, &h->list) { 1480 c = list_entry(p, struct hci_conn, list); 1481 if (c->type == ACL_LINK && c->sent) { 1482 BT_ERR("%s killing stalled ACL connection %s", 1483 hdev->name, batostr(&c->dst)); 1484 hci_acl_disconn(c, 0x13); 1485 } 1486 } 1487 } 1488 1489 static inline void hci_sched_acl(struct hci_dev *hdev) 1490 { 1491 struct hci_conn *conn; 1492 struct sk_buff *skb; 1493 int quote; 1494 1495 BT_DBG("%s", hdev->name); 1496 1497 if (!test_bit(HCI_RAW, &hdev->flags)) { 1498 /* ACL tx timeout must be longer than maximum 1499 * link supervision timeout (40.9 seconds) */ 1500 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45)) 1501 hci_acl_tx_to(hdev); 1502 } 1503 1504 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, "e))) { 1505 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1506 BT_DBG("skb %p len %d", skb, skb->len); 1507 1508 hci_conn_enter_active_mode(conn); 1509 1510 hci_send_frame(skb); 1511 hdev->acl_last_tx = jiffies; 1512 1513 hdev->acl_cnt--; 1514 conn->sent++; 1515 } 1516 } 1517 } 1518 1519 /* Schedule SCO */ 1520 static inline void hci_sched_sco(struct hci_dev *hdev) 1521 { 1522 struct hci_conn *conn; 1523 struct sk_buff *skb; 1524 int quote; 1525 1526 BT_DBG("%s", hdev->name); 1527 1528 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) { 1529 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1530 BT_DBG("skb %p len %d", skb, skb->len); 1531 hci_send_frame(skb); 1532 1533 conn->sent++; 1534 if (conn->sent == ~0) 1535 conn->sent = 0; 1536 } 1537 } 1538 } 1539 1540 static inline void hci_sched_esco(struct hci_dev *hdev) 1541 { 1542 struct hci_conn *conn; 1543 struct sk_buff *skb; 1544 int quote; 1545 1546 BT_DBG("%s", hdev->name); 1547 1548 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, "e))) { 1549 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 1550 BT_DBG("skb %p len %d", skb, skb->len); 1551 hci_send_frame(skb); 1552 1553 conn->sent++; 1554 if (conn->sent == ~0) 1555 conn->sent = 0; 1556 } 1557 } 1558 } 1559 1560 static void hci_tx_task(unsigned long arg) 1561 { 1562 struct hci_dev *hdev = (struct hci_dev *) arg; 1563 struct sk_buff *skb; 1564 1565 read_lock(&hci_task_lock); 1566 1567 BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt); 1568 1569 /* Schedule queues and send stuff to HCI driver */ 1570 1571 hci_sched_acl(hdev); 1572 1573 hci_sched_sco(hdev); 1574 1575 hci_sched_esco(hdev); 1576 1577 /* Send next queued raw (unknown type) packet */ 1578 while ((skb = skb_dequeue(&hdev->raw_q))) 1579 hci_send_frame(skb); 1580 1581 read_unlock(&hci_task_lock); 1582 } 1583 1584 /* ----- HCI RX task (incoming data proccessing) ----- */ 1585 1586 /* ACL data packet */ 1587 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1588 { 1589 struct hci_acl_hdr *hdr = (void *) skb->data; 1590 struct hci_conn *conn; 1591 __u16 handle, flags; 1592 1593 skb_pull(skb, HCI_ACL_HDR_SIZE); 1594 1595 handle = __le16_to_cpu(hdr->handle); 1596 flags = hci_flags(handle); 1597 handle = hci_handle(handle); 1598 1599 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags); 1600 1601 hdev->stat.acl_rx++; 1602 1603 hci_dev_lock(hdev); 1604 conn = hci_conn_hash_lookup_handle(hdev, handle); 1605 hci_dev_unlock(hdev); 1606 1607 if (conn) { 1608 register struct hci_proto *hp; 1609 1610 hci_conn_enter_active_mode(conn); 1611 1612 /* Send to upper protocol */ 1613 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) { 1614 hp->recv_acldata(conn, skb, flags); 1615 return; 1616 } 1617 } else { 1618 BT_ERR("%s ACL packet for unknown connection handle %d", 1619 hdev->name, handle); 1620 } 1621 1622 kfree_skb(skb); 1623 } 1624 1625 /* SCO data packet */ 1626 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb) 1627 { 1628 struct hci_sco_hdr *hdr = (void *) skb->data; 1629 struct hci_conn *conn; 1630 __u16 handle; 1631 1632 skb_pull(skb, HCI_SCO_HDR_SIZE); 1633 1634 handle = __le16_to_cpu(hdr->handle); 1635 1636 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle); 1637 1638 hdev->stat.sco_rx++; 1639 1640 hci_dev_lock(hdev); 1641 conn = hci_conn_hash_lookup_handle(hdev, handle); 1642 hci_dev_unlock(hdev); 1643 1644 if (conn) { 1645 register struct hci_proto *hp; 1646 1647 /* Send to upper protocol */ 1648 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) { 1649 hp->recv_scodata(conn, skb); 1650 return; 1651 } 1652 } else { 1653 BT_ERR("%s SCO packet for unknown connection handle %d", 1654 hdev->name, handle); 1655 } 1656 1657 kfree_skb(skb); 1658 } 1659 1660 static void hci_rx_task(unsigned long arg) 1661 { 1662 struct hci_dev *hdev = (struct hci_dev *) arg; 1663 struct sk_buff *skb; 1664 1665 BT_DBG("%s", hdev->name); 1666 1667 read_lock(&hci_task_lock); 1668 1669 while ((skb = skb_dequeue(&hdev->rx_q))) { 1670 if (atomic_read(&hdev->promisc)) { 1671 /* Send copy to the sockets */ 1672 hci_send_to_sock(hdev, skb); 1673 } 1674 1675 if (test_bit(HCI_RAW, &hdev->flags)) { 1676 kfree_skb(skb); 1677 continue; 1678 } 1679 1680 if (test_bit(HCI_INIT, &hdev->flags)) { 1681 /* Don't process data packets in this states. */ 1682 switch (bt_cb(skb)->pkt_type) { 1683 case HCI_ACLDATA_PKT: 1684 case HCI_SCODATA_PKT: 1685 kfree_skb(skb); 1686 continue; 1687 } 1688 } 1689 1690 /* Process frame */ 1691 switch (bt_cb(skb)->pkt_type) { 1692 case HCI_EVENT_PKT: 1693 hci_event_packet(hdev, skb); 1694 break; 1695 1696 case HCI_ACLDATA_PKT: 1697 BT_DBG("%s ACL data packet", hdev->name); 1698 hci_acldata_packet(hdev, skb); 1699 break; 1700 1701 case HCI_SCODATA_PKT: 1702 BT_DBG("%s SCO data packet", hdev->name); 1703 hci_scodata_packet(hdev, skb); 1704 break; 1705 1706 default: 1707 kfree_skb(skb); 1708 break; 1709 } 1710 } 1711 1712 read_unlock(&hci_task_lock); 1713 } 1714 1715 static void hci_cmd_task(unsigned long arg) 1716 { 1717 struct hci_dev *hdev = (struct hci_dev *) arg; 1718 struct sk_buff *skb; 1719 1720 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt)); 1721 1722 if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) { 1723 BT_ERR("%s command tx timeout", hdev->name); 1724 atomic_set(&hdev->cmd_cnt, 1); 1725 } 1726 1727 /* Send queued commands */ 1728 if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) { 1729 kfree_skb(hdev->sent_cmd); 1730 1731 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) { 1732 atomic_dec(&hdev->cmd_cnt); 1733 hci_send_frame(skb); 1734 hdev->cmd_last_tx = jiffies; 1735 } else { 1736 skb_queue_head(&hdev->cmd_q, skb); 1737 tasklet_schedule(&hdev->cmd_task); 1738 } 1739 } 1740 } 1741