?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git/cjb/mmc
[cris-mirror.git] / net / bluetooth / hci_core.c
blobb372fb8bcdcfdbbcbb7c190ce9b12baff125c12d
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI core. */
26
27 #include <linux/jiffies.h>
28 #include <linux/module.h>
29 #include <linux/kmod.h>
30
31 #include <linux/types.h>
32 #include <linux/errno.h>
33 #include <linux/kernel.h>
34 #include <linux/sched.h>
35 #include <linux/slab.h>
36 #include <linux/poll.h>
37 #include <linux/fcntl.h>
38 #include <linux/init.h>
39 #include <linux/skbuff.h>
40 #include <linux/workqueue.h>
41 #include <linux/interrupt.h>
42 #include <linux/notifier.h>
43 #include <linux/rfkill.h>
44 #include <linux/timer.h>
45 #include <net/sock.h>
46
47 #include <asm/system.h>
48 #include <linux/uaccess.h>
49 #include <asm/unaligned.h>
50
51 #include <net/bluetooth/bluetooth.h>
52 #include <net/bluetooth/hci_core.h>
53
54 #define AUTO_OFF_TIMEOUT 2000
55
56 static void hci_cmd_task(unsigned long arg);
57 static void hci_rx_task(unsigned long arg);
58 static void hci_tx_task(unsigned long arg);
59 static void hci_notify(struct hci_dev *hdev, int event);
60
61 static DEFINE_RWLOCK(hci_task_lock);
62
63 /* HCI device list */
64 LIST_HEAD(hci_dev_list);
65 DEFINE_RWLOCK(hci_dev_list_lock);
66
67 /* HCI callback list */
68 LIST_HEAD(hci_cb_list);
69 DEFINE_RWLOCK(hci_cb_list_lock);
70
71 /* HCI protocols */
72 #define HCI_MAX_PROTO 2
73 struct hci_proto *hci_proto[HCI_MAX_PROTO];
74
75 /* HCI notifiers list */
76 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
77
78 /* ---- HCI notifications ---- */
79
80 int hci_register_notifier(struct notifier_block *nb)
81 {
82 return atomic_notifier_chain_register(&hci_notifier, nb);
83 }
84
85 int hci_unregister_notifier(struct notifier_block *nb)
86 {
87 return atomic_notifier_chain_unregister(&hci_notifier, nb);
88 }
89
90 static void hci_notify(struct hci_dev *hdev, int event)
91 {
92 atomic_notifier_call_chain(&hci_notifier, event, hdev);
93 }
94
95 /* ---- HCI requests ---- */
96
97 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
98 {
99 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
100
101 /* If this is the init phase check if the completed command matches
102 * the last init command, and if not just return.
103 */
104 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
105 return;
106
107 if (hdev->req_status == HCI_REQ_PEND) {
108 hdev->req_result = result;
109 hdev->req_status = HCI_REQ_DONE;
110 wake_up_interruptible(&hdev->req_wait_q);
111 }
112 }
113
114 static void hci_req_cancel(struct hci_dev *hdev, int err)
115 {
116 BT_DBG("%s err 0x%2.2x", hdev->name, err);
117
118 if (hdev->req_status == HCI_REQ_PEND) {
119 hdev->req_result = err;
120 hdev->req_status = HCI_REQ_CANCELED;
121 wake_up_interruptible(&hdev->req_wait_q);
122 }
123 }
124
125 /* Execute request and wait for completion. */
126 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
127 unsigned long opt, __u32 timeout)
128 {
129 DECLARE_WAITQUEUE(wait, current);
130 int err = 0;
131
132 BT_DBG("%s start", hdev->name);
133
134 hdev->req_status = HCI_REQ_PEND;
135
136 add_wait_queue(&hdev->req_wait_q, &wait);
137 set_current_state(TASK_INTERRUPTIBLE);
138
139 req(hdev, opt);
140 schedule_timeout(timeout);
141
142 remove_wait_queue(&hdev->req_wait_q, &wait);
143
144 if (signal_pending(current))
145 return -EINTR;
146
147 switch (hdev->req_status) {
148 case HCI_REQ_DONE:
149 err = -bt_err(hdev->req_result);
150 break;
151
152 case HCI_REQ_CANCELED:
153 err = -hdev->req_result;
154 break;
155
156 default:
157 err = -ETIMEDOUT;
158 break;
159 }
160
161 hdev->req_status = hdev->req_result = 0;
162
163 BT_DBG("%s end: err %d", hdev->name, err);
164
165 return err;
166 }
167
168 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
169 unsigned long opt, __u32 timeout)
170 {
171 int ret;
172
173 if (!test_bit(HCI_UP, &hdev->flags))
174 return -ENETDOWN;
175
176 /* Serialize all requests */
177 hci_req_lock(hdev);
178 ret = __hci_request(hdev, req, opt, timeout);
179 hci_req_unlock(hdev);
180
181 return ret;
182 }
183
184 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
185 {
186 BT_DBG("%s %ld", hdev->name, opt);
187
188 /* Reset device */
189 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
190 }
191
192 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
193 {
194 struct hci_cp_delete_stored_link_key cp;
195 struct sk_buff *skb;
196 __le16 param;
197 __u8 flt_type;
198
199 BT_DBG("%s %ld", hdev->name, opt);
200
201 /* Driver initialization */
202
203 /* Special commands */
204 while ((skb = skb_dequeue(&hdev->driver_init))) {
205 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
206 skb->dev = (void *) hdev;
207
208 skb_queue_tail(&hdev->cmd_q, skb);
209 tasklet_schedule(&hdev->cmd_task);
210 }
211 skb_queue_purge(&hdev->driver_init);
212
213 /* Mandatory initialization */
214
215 /* Reset */
216 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks))
217 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
218
219 /* Read Local Supported Features */
220 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
221
222 /* Read Local Version */
223 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
224
225 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
226 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
227
228 #if 0
229 /* Host buffer size */
230 {
231 struct hci_cp_host_buffer_size cp;
232 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
233 cp.sco_mtu = HCI_MAX_SCO_SIZE;
234 cp.acl_max_pkt = cpu_to_le16(0xffff);
235 cp.sco_max_pkt = cpu_to_le16(0xffff);
236 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
237 }
238 #endif
239
240 /* Read BD Address */
241 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
242
243 /* Read Class of Device */
244 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
245
246 /* Read Local Name */
247 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
248
249 /* Read Voice Setting */
250 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
251
252 /* Optional initialization */
253
254 /* Clear Event Filters */
255 flt_type = HCI_FLT_CLEAR_ALL;
256 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
257
258 /* Connection accept timeout ~20 secs */
259 param = cpu_to_le16(0x7d00);
260 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
261
262 bacpy(&cp.bdaddr, BDADDR_ANY);
263 cp.delete_all = 1;
264 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
265 }
266
267 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
268 {
269 BT_DBG("%s", hdev->name);
270
271 /* Read LE buffer size */
272 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
273 }
274
275 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
276 {
277 __u8 scan = opt;
278
279 BT_DBG("%s %x", hdev->name, scan);
280
281 /* Inquiry and Page scans */
282 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
283 }
284
285 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
286 {
287 __u8 auth = opt;
288
289 BT_DBG("%s %x", hdev->name, auth);
290
291 /* Authentication */
292 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
293 }
294
295 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
296 {
297 __u8 encrypt = opt;
298
299 BT_DBG("%s %x", hdev->name, encrypt);
300
301 /* Encryption */
302 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
303 }
304
305 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
306 {
307 __le16 policy = cpu_to_le16(opt);
308
309 BT_DBG("%s %x", hdev->name, policy);
310
311 /* Default link policy */
312 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
313 }
314
315 /* Get HCI device by index.
316 * Device is held on return. */
317 struct hci_dev *hci_dev_get(int index)
318 {
319 struct hci_dev *hdev = NULL;
320 struct list_head *p;
321
322 BT_DBG("%d", index);
323
324 if (index < 0)
325 return NULL;
326
327 read_lock(&hci_dev_list_lock);
328 list_for_each(p, &hci_dev_list) {
329 struct hci_dev *d = list_entry(p, struct hci_dev, list);
330 if (d->id == index) {
331 hdev = hci_dev_hold(d);
332 break;
333 }
334 }
335 read_unlock(&hci_dev_list_lock);
336 return hdev;
337 }
338
339 /* ---- Inquiry support ---- */
340 static void inquiry_cache_flush(struct hci_dev *hdev)
341 {
342 struct inquiry_cache *cache = &hdev->inq_cache;
343 struct inquiry_entry *next = cache->list, *e;
344
345 BT_DBG("cache %p", cache);
346
347 cache->list = NULL;
348 while ((e = next)) {
349 next = e->next;
350 kfree(e);
351 }
352 }
353
354 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
355 {
356 struct inquiry_cache *cache = &hdev->inq_cache;
357 struct inquiry_entry *e;
358
359 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
360
361 for (e = cache->list; e; e = e->next)
362 if (!bacmp(&e->data.bdaddr, bdaddr))
363 break;
364 return e;
365 }
366
367 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
368 {
369 struct inquiry_cache *cache = &hdev->inq_cache;
370 struct inquiry_entry *ie;
371
372 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
373
374 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
375 if (!ie) {
376 /* Entry not in the cache. Add new one. */
377 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
378 if (!ie)
379 return;
380
381 ie->next = cache->list;
382 cache->list = ie;
383 }
384
385 memcpy(&ie->data, data, sizeof(*data));
386 ie->timestamp = jiffies;
387 cache->timestamp = jiffies;
388 }
389
390 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
391 {
392 struct inquiry_cache *cache = &hdev->inq_cache;
393 struct inquiry_info *info = (struct inquiry_info *) buf;
394 struct inquiry_entry *e;
395 int copied = 0;
396
397 for (e = cache->list; e && copied < num; e = e->next, copied++) {
398 struct inquiry_data *data = &e->data;
399 bacpy(&info->bdaddr, &data->bdaddr);
400 info->pscan_rep_mode = data->pscan_rep_mode;
401 info->pscan_period_mode = data->pscan_period_mode;
402 info->pscan_mode = data->pscan_mode;
403 memcpy(info->dev_class, data->dev_class, 3);
404 info->clock_offset = data->clock_offset;
405 info++;
406 }
407
408 BT_DBG("cache %p, copied %d", cache, copied);
409 return copied;
410 }
411
412 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
413 {
414 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
415 struct hci_cp_inquiry cp;
416
417 BT_DBG("%s", hdev->name);
418
419 if (test_bit(HCI_INQUIRY, &hdev->flags))
420 return;
421
422 /* Start Inquiry */
423 memcpy(&cp.lap, &ir->lap, 3);
424 cp.length = ir->length;
425 cp.num_rsp = ir->num_rsp;
426 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
427 }
428
429 int hci_inquiry(void __user *arg)
430 {
431 __u8 __user *ptr = arg;
432 struct hci_inquiry_req ir;
433 struct hci_dev *hdev;
434 int err = 0, do_inquiry = 0, max_rsp;
435 long timeo;
436 __u8 *buf;
437
438 if (copy_from_user(&ir, ptr, sizeof(ir)))
439 return -EFAULT;
440
441 hdev = hci_dev_get(ir.dev_id);
442 if (!hdev)
443 return -ENODEV;
444
445 hci_dev_lock_bh(hdev);
446 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
447 inquiry_cache_empty(hdev) ||
448 ir.flags & IREQ_CACHE_FLUSH) {
449 inquiry_cache_flush(hdev);
450 do_inquiry = 1;
451 }
452 hci_dev_unlock_bh(hdev);
453
454 timeo = ir.length * msecs_to_jiffies(2000);
455
456 if (do_inquiry) {
457 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
458 if (err < 0)
459 goto done;
460 }
461
462 /* for unlimited number of responses we will use buffer with 255 entries */
463 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
464
465 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
466 * copy it to the user space.
467 */
468 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
469 if (!buf) {
470 err = -ENOMEM;
471 goto done;
472 }
473
474 hci_dev_lock_bh(hdev);
475 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
476 hci_dev_unlock_bh(hdev);
477
478 BT_DBG("num_rsp %d", ir.num_rsp);
479
480 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
481 ptr += sizeof(ir);
482 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
483 ir.num_rsp))
484 err = -EFAULT;
485 } else
486 err = -EFAULT;
487
488 kfree(buf);
489
490 done:
491 hci_dev_put(hdev);
492 return err;
493 }
494
495 /* ---- HCI ioctl helpers ---- */
496
497 int hci_dev_open(__u16 dev)
498 {
499 struct hci_dev *hdev;
500 int ret = 0;
501
502 hdev = hci_dev_get(dev);
503 if (!hdev)
504 return -ENODEV;
505
506 BT_DBG("%s %p", hdev->name, hdev);
507
508 hci_req_lock(hdev);
509
510 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
511 ret = -ERFKILL;
512 goto done;
513 }
514
515 if (test_bit(HCI_UP, &hdev->flags)) {
516 ret = -EALREADY;
517 goto done;
518 }
519
520 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
521 set_bit(HCI_RAW, &hdev->flags);
522
523 /* Treat all non BR/EDR controllers as raw devices for now */
524 if (hdev->dev_type != HCI_BREDR)
525 set_bit(HCI_RAW, &hdev->flags);
526
527 if (hdev->open(hdev)) {
528 ret = -EIO;
529 goto done;
530 }
531
532 if (!test_bit(HCI_RAW, &hdev->flags)) {
533 atomic_set(&hdev->cmd_cnt, 1);
534 set_bit(HCI_INIT, &hdev->flags);
535 hdev->init_last_cmd = 0;
536
537 ret = __hci_request(hdev, hci_init_req, 0,
538 msecs_to_jiffies(HCI_INIT_TIMEOUT));
539
540 if (lmp_le_capable(hdev))
541 ret = __hci_request(hdev, hci_le_init_req, 0,
542 msecs_to_jiffies(HCI_INIT_TIMEOUT));
543
544 clear_bit(HCI_INIT, &hdev->flags);
545 }
546
547 if (!ret) {
548 hci_dev_hold(hdev);
549 set_bit(HCI_UP, &hdev->flags);
550 hci_notify(hdev, HCI_DEV_UP);
551 if (!test_bit(HCI_SETUP, &hdev->flags))
552 mgmt_powered(hdev->id, 1);
553 } else {
554 /* Init failed, cleanup */
555 tasklet_kill(&hdev->rx_task);
556 tasklet_kill(&hdev->tx_task);
557 tasklet_kill(&hdev->cmd_task);
558
559 skb_queue_purge(&hdev->cmd_q);
560 skb_queue_purge(&hdev->rx_q);
561
562 if (hdev->flush)
563 hdev->flush(hdev);
564
565 if (hdev->sent_cmd) {
566 kfree_skb(hdev->sent_cmd);
567 hdev->sent_cmd = NULL;
568 }
569
570 hdev->close(hdev);
571 hdev->flags = 0;
572 }
573
574 done:
575 hci_req_unlock(hdev);
576 hci_dev_put(hdev);
577 return ret;
578 }
579
580 static int hci_dev_do_close(struct hci_dev *hdev)
581 {
582 BT_DBG("%s %p", hdev->name, hdev);
583
584 hci_req_cancel(hdev, ENODEV);
585 hci_req_lock(hdev);
586
587 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
588 hci_req_unlock(hdev);
589 return 0;
590 }
591
592 /* Kill RX and TX tasks */
593 tasklet_kill(&hdev->rx_task);
594 tasklet_kill(&hdev->tx_task);
595
596 hci_dev_lock_bh(hdev);
597 inquiry_cache_flush(hdev);
598 hci_conn_hash_flush(hdev);
599 hci_dev_unlock_bh(hdev);
600
601 hci_notify(hdev, HCI_DEV_DOWN);
602
603 if (hdev->flush)
604 hdev->flush(hdev);
605
606 /* Reset device */
607 skb_queue_purge(&hdev->cmd_q);
608 atomic_set(&hdev->cmd_cnt, 1);
609 if (!test_bit(HCI_RAW, &hdev->flags)) {
610 set_bit(HCI_INIT, &hdev->flags);
611 __hci_request(hdev, hci_reset_req, 0,
612 msecs_to_jiffies(250));
613 clear_bit(HCI_INIT, &hdev->flags);
614 }
615
616 /* Kill cmd task */
617 tasklet_kill(&hdev->cmd_task);
618
619 /* Drop queues */
620 skb_queue_purge(&hdev->rx_q);
621 skb_queue_purge(&hdev->cmd_q);
622 skb_queue_purge(&hdev->raw_q);
623
624 /* Drop last sent command */
625 if (hdev->sent_cmd) {
626 del_timer_sync(&hdev->cmd_timer);
627 kfree_skb(hdev->sent_cmd);
628 hdev->sent_cmd = NULL;
629 }
630
631 /* After this point our queues are empty
632 * and no tasks are scheduled. */
633 hdev->close(hdev);
634
635 mgmt_powered(hdev->id, 0);
636
637 /* Clear flags */
638 hdev->flags = 0;
639
640 hci_req_unlock(hdev);
641
642 hci_dev_put(hdev);
643 return 0;
644 }
645
646 int hci_dev_close(__u16 dev)
647 {
648 struct hci_dev *hdev;
649 int err;
650
651 hdev = hci_dev_get(dev);
652 if (!hdev)
653 return -ENODEV;
654 err = hci_dev_do_close(hdev);
655 hci_dev_put(hdev);
656 return err;
657 }
658
659 int hci_dev_reset(__u16 dev)
660 {
661 struct hci_dev *hdev;
662 int ret = 0;
663
664 hdev = hci_dev_get(dev);
665 if (!hdev)
666 return -ENODEV;
667
668 hci_req_lock(hdev);
669 tasklet_disable(&hdev->tx_task);
670
671 if (!test_bit(HCI_UP, &hdev->flags))
672 goto done;
673
674 /* Drop queues */
675 skb_queue_purge(&hdev->rx_q);
676 skb_queue_purge(&hdev->cmd_q);
677
678 hci_dev_lock_bh(hdev);
679 inquiry_cache_flush(hdev);
680 hci_conn_hash_flush(hdev);
681 hci_dev_unlock_bh(hdev);
682
683 if (hdev->flush)
684 hdev->flush(hdev);
685
686 atomic_set(&hdev->cmd_cnt, 1);
687 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
688
689 if (!test_bit(HCI_RAW, &hdev->flags))
690 ret = __hci_request(hdev, hci_reset_req, 0,
691 msecs_to_jiffies(HCI_INIT_TIMEOUT));
692
693 done:
694 tasklet_enable(&hdev->tx_task);
695 hci_req_unlock(hdev);
696 hci_dev_put(hdev);
697 return ret;
698 }
699
700 int hci_dev_reset_stat(__u16 dev)
701 {
702 struct hci_dev *hdev;
703 int ret = 0;
704
705 hdev = hci_dev_get(dev);
706 if (!hdev)
707 return -ENODEV;
708
709 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
710
711 hci_dev_put(hdev);
712
713 return ret;
714 }
715
716 int hci_dev_cmd(unsigned int cmd, void __user *arg)
717 {
718 struct hci_dev *hdev;
719 struct hci_dev_req dr;
720 int err = 0;
721
722 if (copy_from_user(&dr, arg, sizeof(dr)))
723 return -EFAULT;
724
725 hdev = hci_dev_get(dr.dev_id);
726 if (!hdev)
727 return -ENODEV;
728
729 switch (cmd) {
730 case HCISETAUTH:
731 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
732 msecs_to_jiffies(HCI_INIT_TIMEOUT));
733 break;
734
735 case HCISETENCRYPT:
736 if (!lmp_encrypt_capable(hdev)) {
737 err = -EOPNOTSUPP;
738 break;
739 }
740
741 if (!test_bit(HCI_AUTH, &hdev->flags)) {
742 /* Auth must be enabled first */
743 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
744 msecs_to_jiffies(HCI_INIT_TIMEOUT));
745 if (err)
746 break;
747 }
748
749 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
750 msecs_to_jiffies(HCI_INIT_TIMEOUT));
751 break;
752
753 case HCISETSCAN:
754 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
755 msecs_to_jiffies(HCI_INIT_TIMEOUT));
756 break;
757
758 case HCISETLINKPOL:
759 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
760 msecs_to_jiffies(HCI_INIT_TIMEOUT));
761 break;
762
763 case HCISETLINKMODE:
764 hdev->link_mode = ((__u16) dr.dev_opt) &
765 (HCI_LM_MASTER | HCI_LM_ACCEPT);
766 break;
767
768 case HCISETPTYPE:
769 hdev->pkt_type = (__u16) dr.dev_opt;
770 break;
771
772 case HCISETACLMTU:
773 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
774 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
775 break;
776
777 case HCISETSCOMTU:
778 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
779 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
780 break;
781
782 default:
783 err = -EINVAL;
784 break;
785 }
786
787 hci_dev_put(hdev);
788 return err;
789 }
790
791 int hci_get_dev_list(void __user *arg)
792 {
793 struct hci_dev_list_req *dl;
794 struct hci_dev_req *dr;
795 struct list_head *p;
796 int n = 0, size, err;
797 __u16 dev_num;
798
799 if (get_user(dev_num, (__u16 __user *) arg))
800 return -EFAULT;
801
802 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
803 return -EINVAL;
804
805 size = sizeof(*dl) + dev_num * sizeof(*dr);
806
807 dl = kzalloc(size, GFP_KERNEL);
808 if (!dl)
809 return -ENOMEM;
810
811 dr = dl->dev_req;
812
813 read_lock_bh(&hci_dev_list_lock);
814 list_for_each(p, &hci_dev_list) {
815 struct hci_dev *hdev;
816
817 hdev = list_entry(p, struct hci_dev, list);
818
819 hci_del_off_timer(hdev);
820
821 if (!test_bit(HCI_MGMT, &hdev->flags))
822 set_bit(HCI_PAIRABLE, &hdev->flags);
823
824 (dr + n)->dev_id = hdev->id;
825 (dr + n)->dev_opt = hdev->flags;
826
827 if (++n >= dev_num)
828 break;
829 }
830 read_unlock_bh(&hci_dev_list_lock);
831
832 dl->dev_num = n;
833 size = sizeof(*dl) + n * sizeof(*dr);
834
835 err = copy_to_user(arg, dl, size);
836 kfree(dl);
837
838 return err ? -EFAULT : 0;
839 }
840
841 int hci_get_dev_info(void __user *arg)
842 {
843 struct hci_dev *hdev;
844 struct hci_dev_info di;
845 int err = 0;
846
847 if (copy_from_user(&di, arg, sizeof(di)))
848 return -EFAULT;
849
850 hdev = hci_dev_get(di.dev_id);
851 if (!hdev)
852 return -ENODEV;
853
854 hci_del_off_timer(hdev);
855
856 if (!test_bit(HCI_MGMT, &hdev->flags))
857 set_bit(HCI_PAIRABLE, &hdev->flags);
858
859 strcpy(di.name, hdev->name);
860 di.bdaddr = hdev->bdaddr;
861 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
862 di.flags = hdev->flags;
863 di.pkt_type = hdev->pkt_type;
864 di.acl_mtu = hdev->acl_mtu;
865 di.acl_pkts = hdev->acl_pkts;
866 di.sco_mtu = hdev->sco_mtu;
867 di.sco_pkts = hdev->sco_pkts;
868 di.link_policy = hdev->link_policy;
869 di.link_mode = hdev->link_mode;
870
871 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
872 memcpy(&di.features, &hdev->features, sizeof(di.features));
873
874 if (copy_to_user(arg, &di, sizeof(di)))
875 err = -EFAULT;
876
877 hci_dev_put(hdev);
878
879 return err;
880 }
881
882 /* ---- Interface to HCI drivers ---- */
883
884 static int hci_rfkill_set_block(void *data, bool blocked)
885 {
886 struct hci_dev *hdev = data;
887
888 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
889
890 if (!blocked)
891 return 0;
892
893 hci_dev_do_close(hdev);
894
895 return 0;
896 }
897
898 static const struct rfkill_ops hci_rfkill_ops = {
899 .set_block = hci_rfkill_set_block,
900 };
901
902 /* Alloc HCI device */
903 struct hci_dev *hci_alloc_dev(void)
904 {
905 struct hci_dev *hdev;
906
907 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
908 if (!hdev)
909 return NULL;
910
911 skb_queue_head_init(&hdev->driver_init);
912
913 return hdev;
914 }
915 EXPORT_SYMBOL(hci_alloc_dev);
916
917 /* Free HCI device */
918 void hci_free_dev(struct hci_dev *hdev)
919 {
920 skb_queue_purge(&hdev->driver_init);
921
922 /* will free via device release */
923 put_device(&hdev->dev);
924 }
925 EXPORT_SYMBOL(hci_free_dev);
926
927 static void hci_power_on(struct work_struct *work)
928 {
929 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
930
931 BT_DBG("%s", hdev->name);
932
933 if (hci_dev_open(hdev->id) < 0)
934 return;
935
936 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
937 mod_timer(&hdev->off_timer,
938 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
939
940 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
941 mgmt_index_added(hdev->id);
942 }
943
944 static void hci_power_off(struct work_struct *work)
945 {
946 struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
947
948 BT_DBG("%s", hdev->name);
949
950 hci_dev_close(hdev->id);
951 }
952
953 static void hci_auto_off(unsigned long data)
954 {
955 struct hci_dev *hdev = (struct hci_dev *) data;
956
957 BT_DBG("%s", hdev->name);
958
959 clear_bit(HCI_AUTO_OFF, &hdev->flags);
960
961 queue_work(hdev->workqueue, &hdev->power_off);
962 }
963
964 void hci_del_off_timer(struct hci_dev *hdev)
965 {
966 BT_DBG("%s", hdev->name);
967
968 clear_bit(HCI_AUTO_OFF, &hdev->flags);
969 del_timer(&hdev->off_timer);
970 }
971
972 int hci_uuids_clear(struct hci_dev *hdev)
973 {
974 struct list_head *p, *n;
975
976 list_for_each_safe(p, n, &hdev->uuids) {
977 struct bt_uuid *uuid;
978
979 uuid = list_entry(p, struct bt_uuid, list);
980
981 list_del(p);
982 kfree(uuid);
983 }
984
985 return 0;
986 }
987
988 int hci_link_keys_clear(struct hci_dev *hdev)
989 {
990 struct list_head *p, *n;
991
992 list_for_each_safe(p, n, &hdev->link_keys) {
993 struct link_key *key;
994
995 key = list_entry(p, struct link_key, list);
996
997 list_del(p);
998 kfree(key);
999 }
1000
1001 return 0;
1002 }
1003
1004 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1005 {
1006 struct list_head *p;
1007
1008 list_for_each(p, &hdev->link_keys) {
1009 struct link_key *k;
1010
1011 k = list_entry(p, struct link_key, list);
1012
1013 if (bacmp(bdaddr, &k->bdaddr) == 0)
1014 return k;
1015 }
1016
1017 return NULL;
1018 }
1019
1020 int hci_add_link_key(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
1021 u8 *val, u8 type, u8 pin_len)
1022 {
1023 struct link_key *key, *old_key;
1024 u8 old_key_type;
1025
1026 old_key = hci_find_link_key(hdev, bdaddr);
1027 if (old_key) {
1028 old_key_type = old_key->type;
1029 key = old_key;
1030 } else {
1031 old_key_type = 0xff;
1032 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1033 if (!key)
1034 return -ENOMEM;
1035 list_add(&key->list, &hdev->link_keys);
1036 }
1037
1038 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1039
1040 bacpy(&key->bdaddr, bdaddr);
1041 memcpy(key->val, val, 16);
1042 key->type = type;
1043 key->pin_len = pin_len;
1044
1045 if (new_key)
1046 mgmt_new_key(hdev->id, key, old_key_type);
1047
1048 if (type == 0x06)
1049 key->type = old_key_type;
1050
1051 return 0;
1052 }
1053
1054 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1055 {
1056 struct link_key *key;
1057
1058 key = hci_find_link_key(hdev, bdaddr);
1059 if (!key)
1060 return -ENOENT;
1061
1062 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1063
1064 list_del(&key->list);
1065 kfree(key);
1066
1067 return 0;
1068 }
1069
1070 /* HCI command timer function */
1071 static void hci_cmd_timer(unsigned long arg)
1072 {
1073 struct hci_dev *hdev = (void *) arg;
1074
1075 BT_ERR("%s command tx timeout", hdev->name);
1076 atomic_set(&hdev->cmd_cnt, 1);
1077 tasklet_schedule(&hdev->cmd_task);
1078 }
1079
1080 /* Register HCI device */
1081 int hci_register_dev(struct hci_dev *hdev)
1082 {
1083 struct list_head *head = &hci_dev_list, *p;
1084 int i, id = 0;
1085
1086 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1087 hdev->bus, hdev->owner);
1088
1089 if (!hdev->open || !hdev->close || !hdev->destruct)
1090 return -EINVAL;
1091
1092 write_lock_bh(&hci_dev_list_lock);
1093
1094 /* Find first available device id */
1095 list_for_each(p, &hci_dev_list) {
1096 if (list_entry(p, struct hci_dev, list)->id != id)
1097 break;
1098 head = p; id++;
1099 }
1100
1101 sprintf(hdev->name, "hci%d", id);
1102 hdev->id = id;
1103 list_add(&hdev->list, head);
1104
1105 atomic_set(&hdev->refcnt, 1);
1106 spin_lock_init(&hdev->lock);
1107
1108 hdev->flags = 0;
1109 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1110 hdev->esco_type = (ESCO_HV1);
1111 hdev->link_mode = (HCI_LM_ACCEPT);
1112 hdev->io_capability = 0x03; /* No Input No Output */
1113
1114 hdev->idle_timeout = 0;
1115 hdev->sniff_max_interval = 800;
1116 hdev->sniff_min_interval = 80;
1117
1118 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1119 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1120 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1121
1122 skb_queue_head_init(&hdev->rx_q);
1123 skb_queue_head_init(&hdev->cmd_q);
1124 skb_queue_head_init(&hdev->raw_q);
1125
1126 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1127
1128 for (i = 0; i < NUM_REASSEMBLY; i++)
1129 hdev->reassembly[i] = NULL;
1130
1131 init_waitqueue_head(&hdev->req_wait_q);
1132 mutex_init(&hdev->req_lock);
1133
1134 inquiry_cache_init(hdev);
1135
1136 hci_conn_hash_init(hdev);
1137
1138 INIT_LIST_HEAD(&hdev->blacklist);
1139
1140 INIT_LIST_HEAD(&hdev->uuids);
1141
1142 INIT_LIST_HEAD(&hdev->link_keys);
1143
1144 INIT_WORK(&hdev->power_on, hci_power_on);
1145 INIT_WORK(&hdev->power_off, hci_power_off);
1146 setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1147
1148 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1149
1150 atomic_set(&hdev->promisc, 0);
1151
1152 write_unlock_bh(&hci_dev_list_lock);
1153
1154 hdev->workqueue = create_singlethread_workqueue(hdev->name);
1155 if (!hdev->workqueue)
1156 goto nomem;
1157
1158 hci_register_sysfs(hdev);
1159
1160 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1161 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1162 if (hdev->rfkill) {
1163 if (rfkill_register(hdev->rfkill) < 0) {
1164 rfkill_destroy(hdev->rfkill);
1165 hdev->rfkill = NULL;
1166 }
1167 }
1168
1169 set_bit(HCI_AUTO_OFF, &hdev->flags);
1170 set_bit(HCI_SETUP, &hdev->flags);
1171 queue_work(hdev->workqueue, &hdev->power_on);
1172
1173 hci_notify(hdev, HCI_DEV_REG);
1174
1175 return id;
1176
1177 nomem:
1178 write_lock_bh(&hci_dev_list_lock);
1179 list_del(&hdev->list);
1180 write_unlock_bh(&hci_dev_list_lock);
1181
1182 return -ENOMEM;
1183 }
1184 EXPORT_SYMBOL(hci_register_dev);
1185
1186 /* Unregister HCI device */
1187 int hci_unregister_dev(struct hci_dev *hdev)
1188 {
1189 int i;
1190
1191 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1192
1193 write_lock_bh(&hci_dev_list_lock);
1194 list_del(&hdev->list);
1195 write_unlock_bh(&hci_dev_list_lock);
1196
1197 hci_dev_do_close(hdev);
1198
1199 for (i = 0; i < NUM_REASSEMBLY; i++)
1200 kfree_skb(hdev->reassembly[i]);
1201
1202 if (!test_bit(HCI_INIT, &hdev->flags) &&
1203 !test_bit(HCI_SETUP, &hdev->flags))
1204 mgmt_index_removed(hdev->id);
1205
1206 hci_notify(hdev, HCI_DEV_UNREG);
1207
1208 if (hdev->rfkill) {
1209 rfkill_unregister(hdev->rfkill);
1210 rfkill_destroy(hdev->rfkill);
1211 }
1212
1213 hci_unregister_sysfs(hdev);
1214
1215 hci_del_off_timer(hdev);
1216
1217 destroy_workqueue(hdev->workqueue);
1218
1219 hci_dev_lock_bh(hdev);
1220 hci_blacklist_clear(hdev);
1221 hci_uuids_clear(hdev);
1222 hci_link_keys_clear(hdev);
1223 hci_dev_unlock_bh(hdev);
1224
1225 __hci_dev_put(hdev);
1226
1227 return 0;
1228 }
1229 EXPORT_SYMBOL(hci_unregister_dev);
1230
1231 /* Suspend HCI device */
1232 int hci_suspend_dev(struct hci_dev *hdev)
1233 {
1234 hci_notify(hdev, HCI_DEV_SUSPEND);
1235 return 0;
1236 }
1237 EXPORT_SYMBOL(hci_suspend_dev);
1238
1239 /* Resume HCI device */
1240 int hci_resume_dev(struct hci_dev *hdev)
1241 {
1242 hci_notify(hdev, HCI_DEV_RESUME);
1243 return 0;
1244 }
1245 EXPORT_SYMBOL(hci_resume_dev);
1246
1247 /* Receive frame from HCI drivers */
1248 int hci_recv_frame(struct sk_buff *skb)
1249 {
1250 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1251 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1252 && !test_bit(HCI_INIT, &hdev->flags))) {
1253 kfree_skb(skb);
1254 return -ENXIO;
1255 }
1256
1257 /* Incomming skb */
1258 bt_cb(skb)->incoming = 1;
1259
1260 /* Time stamp */
1261 __net_timestamp(skb);
1262
1263 /* Queue frame for rx task */
1264 skb_queue_tail(&hdev->rx_q, skb);
1265 tasklet_schedule(&hdev->rx_task);
1266
1267 return 0;
1268 }
1269 EXPORT_SYMBOL(hci_recv_frame);
1270
1271 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1272 int count, __u8 index, gfp_t gfp_mask)
1273 {
1274 int len = 0;
1275 int hlen = 0;
1276 int remain = count;
1277 struct sk_buff *skb;
1278 struct bt_skb_cb *scb;
1279
1280 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1281 index >= NUM_REASSEMBLY)
1282 return -EILSEQ;
1283
1284 skb = hdev->reassembly[index];
1285
1286 if (!skb) {
1287 switch (type) {
1288 case HCI_ACLDATA_PKT:
1289 len = HCI_MAX_FRAME_SIZE;
1290 hlen = HCI_ACL_HDR_SIZE;
1291 break;
1292 case HCI_EVENT_PKT:
1293 len = HCI_MAX_EVENT_SIZE;
1294 hlen = HCI_EVENT_HDR_SIZE;
1295 break;
1296 case HCI_SCODATA_PKT:
1297 len = HCI_MAX_SCO_SIZE;
1298 hlen = HCI_SCO_HDR_SIZE;
1299 break;
1300 }
1301
1302 skb = bt_skb_alloc(len, gfp_mask);
1303 if (!skb)
1304 return -ENOMEM;
1305
1306 scb = (void *) skb->cb;
1307 scb->expect = hlen;
1308 scb->pkt_type = type;
1309
1310 skb->dev = (void *) hdev;
1311 hdev->reassembly[index] = skb;
1312 }
1313
1314 while (count) {
1315 scb = (void *) skb->cb;
1316 len = min(scb->expect, (__u16)count);
1317
1318 memcpy(skb_put(skb, len), data, len);
1319
1320 count -= len;
1321 data += len;
1322 scb->expect -= len;
1323 remain = count;
1324
1325 switch (type) {
1326 case HCI_EVENT_PKT:
1327 if (skb->len == HCI_EVENT_HDR_SIZE) {
1328 struct hci_event_hdr *h = hci_event_hdr(skb);
1329 scb->expect = h->plen;
1330
1331 if (skb_tailroom(skb) < scb->expect) {
1332 kfree_skb(skb);
1333 hdev->reassembly[index] = NULL;
1334 return -ENOMEM;
1335 }
1336 }
1337 break;
1338
1339 case HCI_ACLDATA_PKT:
1340 if (skb->len == HCI_ACL_HDR_SIZE) {
1341 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1342 scb->expect = __le16_to_cpu(h->dlen);
1343
1344 if (skb_tailroom(skb) < scb->expect) {
1345 kfree_skb(skb);
1346 hdev->reassembly[index] = NULL;
1347 return -ENOMEM;
1348 }
1349 }
1350 break;
1351
1352 case HCI_SCODATA_PKT:
1353 if (skb->len == HCI_SCO_HDR_SIZE) {
1354 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1355 scb->expect = h->dlen;
1356
1357 if (skb_tailroom(skb) < scb->expect) {
1358 kfree_skb(skb);
1359 hdev->reassembly[index] = NULL;
1360 return -ENOMEM;
1361 }
1362 }
1363 break;
1364 }
1365
1366 if (scb->expect == 0) {
1367 /* Complete frame */
1368
1369 bt_cb(skb)->pkt_type = type;
1370 hci_recv_frame(skb);
1371
1372 hdev->reassembly[index] = NULL;
1373 return remain;
1374 }
1375 }
1376
1377 return remain;
1378 }
1379
1380 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1381 {
1382 int rem = 0;
1383
1384 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1385 return -EILSEQ;
1386
1387 while (count) {
1388 rem = hci_reassembly(hdev, type, data, count,
1389 type - 1, GFP_ATOMIC);
1390 if (rem < 0)
1391 return rem;
1392
1393 data += (count - rem);
1394 count = rem;
1395 };
1396
1397 return rem;
1398 }
1399 EXPORT_SYMBOL(hci_recv_fragment);
1400
1401 #define STREAM_REASSEMBLY 0
1402
1403 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1404 {
1405 int type;
1406 int rem = 0;
1407
1408 while (count) {
1409 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1410
1411 if (!skb) {
1412 struct { char type; } *pkt;
1413
1414 /* Start of the frame */
1415 pkt = data;
1416 type = pkt->type;
1417
1418 data++;
1419 count--;
1420 } else
1421 type = bt_cb(skb)->pkt_type;
1422
1423 rem = hci_reassembly(hdev, type, data,
1424 count, STREAM_REASSEMBLY, GFP_ATOMIC);
1425 if (rem < 0)
1426 return rem;
1427
1428 data += (count - rem);
1429 count = rem;
1430 };
1431
1432 return rem;
1433 }
1434 EXPORT_SYMBOL(hci_recv_stream_fragment);
1435
1436 /* ---- Interface to upper protocols ---- */
1437
1438 /* Register/Unregister protocols.
1439 * hci_task_lock is used to ensure that no tasks are running. */
1440 int hci_register_proto(struct hci_proto *hp)
1441 {
1442 int err = 0;
1443
1444 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1445
1446 if (hp->id >= HCI_MAX_PROTO)
1447 return -EINVAL;
1448
1449 write_lock_bh(&hci_task_lock);
1450
1451 if (!hci_proto[hp->id])
1452 hci_proto[hp->id] = hp;
1453 else
1454 err = -EEXIST;
1455
1456 write_unlock_bh(&hci_task_lock);
1457
1458 return err;
1459 }
1460 EXPORT_SYMBOL(hci_register_proto);
1461
1462 int hci_unregister_proto(struct hci_proto *hp)
1463 {
1464 int err = 0;
1465
1466 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1467
1468 if (hp->id >= HCI_MAX_PROTO)
1469 return -EINVAL;
1470
1471 write_lock_bh(&hci_task_lock);
1472
1473 if (hci_proto[hp->id])
1474 hci_proto[hp->id] = NULL;
1475 else
1476 err = -ENOENT;
1477
1478 write_unlock_bh(&hci_task_lock);
1479
1480 return err;
1481 }
1482 EXPORT_SYMBOL(hci_unregister_proto);
1483
1484 int hci_register_cb(struct hci_cb *cb)
1485 {
1486 BT_DBG("%p name %s", cb, cb->name);
1487
1488 write_lock_bh(&hci_cb_list_lock);
1489 list_add(&cb->list, &hci_cb_list);
1490 write_unlock_bh(&hci_cb_list_lock);
1491
1492 return 0;
1493 }
1494 EXPORT_SYMBOL(hci_register_cb);
1495
1496 int hci_unregister_cb(struct hci_cb *cb)
1497 {
1498 BT_DBG("%p name %s", cb, cb->name);
1499
1500 write_lock_bh(&hci_cb_list_lock);
1501 list_del(&cb->list);
1502 write_unlock_bh(&hci_cb_list_lock);
1503
1504 return 0;
1505 }
1506 EXPORT_SYMBOL(hci_unregister_cb);
1507
1508 static int hci_send_frame(struct sk_buff *skb)
1509 {
1510 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1511
1512 if (!hdev) {
1513 kfree_skb(skb);
1514 return -ENODEV;
1515 }
1516
1517 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1518
1519 if (atomic_read(&hdev->promisc)) {
1520 /* Time stamp */
1521 __net_timestamp(skb);
1522
1523 hci_send_to_sock(hdev, skb, NULL);
1524 }
1525
1526 /* Get rid of skb owner, prior to sending to the driver. */
1527 skb_orphan(skb);
1528
1529 return hdev->send(skb);
1530 }
1531
1532 /* Send HCI command */
1533 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1534 {
1535 int len = HCI_COMMAND_HDR_SIZE + plen;
1536 struct hci_command_hdr *hdr;
1537 struct sk_buff *skb;
1538
1539 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1540
1541 skb = bt_skb_alloc(len, GFP_ATOMIC);
1542 if (!skb) {
1543 BT_ERR("%s no memory for command", hdev->name);
1544 return -ENOMEM;
1545 }
1546
1547 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1548 hdr->opcode = cpu_to_le16(opcode);
1549 hdr->plen = plen;
1550
1551 if (plen)
1552 memcpy(skb_put(skb, plen), param, plen);
1553
1554 BT_DBG("skb len %d", skb->len);
1555
1556 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1557 skb->dev = (void *) hdev;
1558
1559 if (test_bit(HCI_INIT, &hdev->flags))
1560 hdev->init_last_cmd = opcode;
1561
1562 skb_queue_tail(&hdev->cmd_q, skb);
1563 tasklet_schedule(&hdev->cmd_task);
1564
1565 return 0;
1566 }
1567
1568 /* Get data from the previously sent command */
1569 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1570 {
1571 struct hci_command_hdr *hdr;
1572
1573 if (!hdev->sent_cmd)
1574 return NULL;
1575
1576 hdr = (void *) hdev->sent_cmd->data;
1577
1578 if (hdr->opcode != cpu_to_le16(opcode))
1579 return NULL;
1580
1581 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1582
1583 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1584 }
1585
1586 /* Send ACL data */
1587 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1588 {
1589 struct hci_acl_hdr *hdr;
1590 int len = skb->len;
1591
1592 skb_push(skb, HCI_ACL_HDR_SIZE);
1593 skb_reset_transport_header(skb);
1594 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
1595 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1596 hdr->dlen = cpu_to_le16(len);
1597 }
1598
1599 void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1600 {
1601 struct hci_dev *hdev = conn->hdev;
1602 struct sk_buff *list;
1603
1604 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1605
1606 skb->dev = (void *) hdev;
1607 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1608 hci_add_acl_hdr(skb, conn->handle, flags);
1609
1610 list = skb_shinfo(skb)->frag_list;
1611 if (!list) {
1612 /* Non fragmented */
1613 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1614
1615 skb_queue_tail(&conn->data_q, skb);
1616 } else {
1617 /* Fragmented */
1618 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1619
1620 skb_shinfo(skb)->frag_list = NULL;
1621
1622 /* Queue all fragments atomically */
1623 spin_lock_bh(&conn->data_q.lock);
1624
1625 __skb_queue_tail(&conn->data_q, skb);
1626
1627 flags &= ~ACL_START;
1628 flags |= ACL_CONT;
1629 do {
1630 skb = list; list = list->next;
1631
1632 skb->dev = (void *) hdev;
1633 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1634 hci_add_acl_hdr(skb, conn->handle, flags);
1635
1636 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1637
1638 __skb_queue_tail(&conn->data_q, skb);
1639 } while (list);
1640
1641 spin_unlock_bh(&conn->data_q.lock);
1642 }
1643
1644 tasklet_schedule(&hdev->tx_task);
1645 }
1646 EXPORT_SYMBOL(hci_send_acl);
1647
1648 /* Send SCO data */
1649 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1650 {
1651 struct hci_dev *hdev = conn->hdev;
1652 struct hci_sco_hdr hdr;
1653
1654 BT_DBG("%s len %d", hdev->name, skb->len);
1655
1656 hdr.handle = cpu_to_le16(conn->handle);
1657 hdr.dlen = skb->len;
1658
1659 skb_push(skb, HCI_SCO_HDR_SIZE);
1660 skb_reset_transport_header(skb);
1661 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1662
1663 skb->dev = (void *) hdev;
1664 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1665
1666 skb_queue_tail(&conn->data_q, skb);
1667 tasklet_schedule(&hdev->tx_task);
1668 }
1669 EXPORT_SYMBOL(hci_send_sco);
1670
1671 /* ---- HCI TX task (outgoing data) ---- */
1672
1673 /* HCI Connection scheduler */
1674 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1675 {
1676 struct hci_conn_hash *h = &hdev->conn_hash;
1677 struct hci_conn *conn = NULL;
1678 int num = 0, min = ~0;
1679 struct list_head *p;
1680
1681 /* We don't have to lock device here. Connections are always
1682 * added and removed with TX task disabled. */
1683 list_for_each(p, &h->list) {
1684 struct hci_conn *c;
1685 c = list_entry(p, struct hci_conn, list);
1686
1687 if (c->type != type || skb_queue_empty(&c->data_q))
1688 continue;
1689
1690 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1691 continue;
1692
1693 num++;
1694
1695 if (c->sent < min) {
1696 min = c->sent;
1697 conn = c;
1698 }
1699 }
1700
1701 if (conn) {
1702 int cnt, q;
1703
1704 switch (conn->type) {
1705 case ACL_LINK:
1706 cnt = hdev->acl_cnt;
1707 break;
1708 case SCO_LINK:
1709 case ESCO_LINK:
1710 cnt = hdev->sco_cnt;
1711 break;
1712 case LE_LINK:
1713 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
1714 break;
1715 default:
1716 cnt = 0;
1717 BT_ERR("Unknown link type");
1718 }
1719
1720 q = cnt / num;
1721 *quote = q ? q : 1;
1722 } else
1723 *quote = 0;
1724
1725 BT_DBG("conn %p quote %d", conn, *quote);
1726 return conn;
1727 }
1728
1729 static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1730 {
1731 struct hci_conn_hash *h = &hdev->conn_hash;
1732 struct list_head *p;
1733 struct hci_conn *c;
1734
1735 BT_ERR("%s link tx timeout", hdev->name);
1736
1737 /* Kill stalled connections */
1738 list_for_each(p, &h->list) {
1739 c = list_entry(p, struct hci_conn, list);
1740 if (c->type == type && c->sent) {
1741 BT_ERR("%s killing stalled connection %s",
1742 hdev->name, batostr(&c->dst));
1743 hci_acl_disconn(c, 0x13);
1744 }
1745 }
1746 }
1747
1748 static inline void hci_sched_acl(struct hci_dev *hdev)
1749 {
1750 struct hci_conn *conn;
1751 struct sk_buff *skb;
1752 int quote;
1753
1754 BT_DBG("%s", hdev->name);
1755
1756 if (!test_bit(HCI_RAW, &hdev->flags)) {
1757 /* ACL tx timeout must be longer than maximum
1758 * link supervision timeout (40.9 seconds) */
1759 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
1760 hci_link_tx_to(hdev, ACL_LINK);
1761 }
1762
1763 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1764 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1765 BT_DBG("skb %p len %d", skb, skb->len);
1766
1767 hci_conn_enter_active_mode(conn);
1768
1769 hci_send_frame(skb);
1770 hdev->acl_last_tx = jiffies;
1771
1772 hdev->acl_cnt--;
1773 conn->sent++;
1774 }
1775 }
1776 }
1777
1778 /* Schedule SCO */
1779 static inline void hci_sched_sco(struct hci_dev *hdev)
1780 {
1781 struct hci_conn *conn;
1782 struct sk_buff *skb;
1783 int quote;
1784
1785 BT_DBG("%s", hdev->name);
1786
1787 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1788 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1789 BT_DBG("skb %p len %d", skb, skb->len);
1790 hci_send_frame(skb);
1791
1792 conn->sent++;
1793 if (conn->sent == ~0)
1794 conn->sent = 0;
1795 }
1796 }
1797 }
1798
1799 static inline void hci_sched_esco(struct hci_dev *hdev)
1800 {
1801 struct hci_conn *conn;
1802 struct sk_buff *skb;
1803 int quote;
1804
1805 BT_DBG("%s", hdev->name);
1806
1807 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1808 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1809 BT_DBG("skb %p len %d", skb, skb->len);
1810 hci_send_frame(skb);
1811
1812 conn->sent++;
1813 if (conn->sent == ~0)
1814 conn->sent = 0;
1815 }
1816 }
1817 }
1818
1819 static inline void hci_sched_le(struct hci_dev *hdev)
1820 {
1821 struct hci_conn *conn;
1822 struct sk_buff *skb;
1823 int quote, cnt;
1824
1825 BT_DBG("%s", hdev->name);
1826
1827 if (!test_bit(HCI_RAW, &hdev->flags)) {
1828 /* LE tx timeout must be longer than maximum
1829 * link supervision timeout (40.9 seconds) */
1830 if (!hdev->le_cnt && hdev->le_pkts &&
1831 time_after(jiffies, hdev->le_last_tx + HZ * 45))
1832 hci_link_tx_to(hdev, LE_LINK);
1833 }
1834
1835 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
1836 while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
1837 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1838 BT_DBG("skb %p len %d", skb, skb->len);
1839
1840 hci_send_frame(skb);
1841 hdev->le_last_tx = jiffies;
1842
1843 cnt--;
1844 conn->sent++;
1845 }
1846 }
1847 if (hdev->le_pkts)
1848 hdev->le_cnt = cnt;
1849 else
1850 hdev->acl_cnt = cnt;
1851 }
1852
1853 static void hci_tx_task(unsigned long arg)
1854 {
1855 struct hci_dev *hdev = (struct hci_dev *) arg;
1856 struct sk_buff *skb;
1857
1858 read_lock(&hci_task_lock);
1859
1860 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
1861 hdev->sco_cnt, hdev->le_cnt);
1862
1863 /* Schedule queues and send stuff to HCI driver */
1864
1865 hci_sched_acl(hdev);
1866
1867 hci_sched_sco(hdev);
1868
1869 hci_sched_esco(hdev);
1870
1871 hci_sched_le(hdev);
1872
1873 /* Send next queued raw (unknown type) packet */
1874 while ((skb = skb_dequeue(&hdev->raw_q)))
1875 hci_send_frame(skb);
1876
1877 read_unlock(&hci_task_lock);
1878 }
1879
1880 /* ----- HCI RX task (incoming data proccessing) ----- */
1881
1882 /* ACL data packet */
1883 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1884 {
1885 struct hci_acl_hdr *hdr = (void *) skb->data;
1886 struct hci_conn *conn;
1887 __u16 handle, flags;
1888
1889 skb_pull(skb, HCI_ACL_HDR_SIZE);
1890
1891 handle = __le16_to_cpu(hdr->handle);
1892 flags = hci_flags(handle);
1893 handle = hci_handle(handle);
1894
1895 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1896
1897 hdev->stat.acl_rx++;
1898
1899 hci_dev_lock(hdev);
1900 conn = hci_conn_hash_lookup_handle(hdev, handle);
1901 hci_dev_unlock(hdev);
1902
1903 if (conn) {
1904 register struct hci_proto *hp;
1905
1906 hci_conn_enter_active_mode(conn);
1907
1908 /* Send to upper protocol */
1909 hp = hci_proto[HCI_PROTO_L2CAP];
1910 if (hp && hp->recv_acldata) {
1911 hp->recv_acldata(conn, skb, flags);
1912 return;
1913 }
1914 } else {
1915 BT_ERR("%s ACL packet for unknown connection handle %d",
1916 hdev->name, handle);
1917 }
1918
1919 kfree_skb(skb);
1920 }
1921
1922 /* SCO data packet */
1923 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1924 {
1925 struct hci_sco_hdr *hdr = (void *) skb->data;
1926 struct hci_conn *conn;
1927 __u16 handle;
1928
1929 skb_pull(skb, HCI_SCO_HDR_SIZE);
1930
1931 handle = __le16_to_cpu(hdr->handle);
1932
1933 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1934
1935 hdev->stat.sco_rx++;
1936
1937 hci_dev_lock(hdev);
1938 conn = hci_conn_hash_lookup_handle(hdev, handle);
1939 hci_dev_unlock(hdev);
1940
1941 if (conn) {
1942 register struct hci_proto *hp;
1943
1944 /* Send to upper protocol */
1945 hp = hci_proto[HCI_PROTO_SCO];
1946 if (hp && hp->recv_scodata) {
1947 hp->recv_scodata(conn, skb);
1948 return;
1949 }
1950 } else {
1951 BT_ERR("%s SCO packet for unknown connection handle %d",
1952 hdev->name, handle);
1953 }
1954
1955 kfree_skb(skb);
1956 }
1957
1958 static void hci_rx_task(unsigned long arg)
1959 {
1960 struct hci_dev *hdev = (struct hci_dev *) arg;
1961 struct sk_buff *skb;
1962
1963 BT_DBG("%s", hdev->name);
1964
1965 read_lock(&hci_task_lock);
1966
1967 while ((skb = skb_dequeue(&hdev->rx_q))) {
1968 if (atomic_read(&hdev->promisc)) {
1969 /* Send copy to the sockets */
1970 hci_send_to_sock(hdev, skb, NULL);
1971 }
1972
1973 if (test_bit(HCI_RAW, &hdev->flags)) {
1974 kfree_skb(skb);
1975 continue;
1976 }
1977
1978 if (test_bit(HCI_INIT, &hdev->flags)) {
1979 /* Don't process data packets in this states. */
1980 switch (bt_cb(skb)->pkt_type) {
1981 case HCI_ACLDATA_PKT:
1982 case HCI_SCODATA_PKT:
1983 kfree_skb(skb);
1984 continue;
1985 }
1986 }
1987
1988 /* Process frame */
1989 switch (bt_cb(skb)->pkt_type) {
1990 case HCI_EVENT_PKT:
1991 hci_event_packet(hdev, skb);
1992 break;
1993
1994 case HCI_ACLDATA_PKT:
1995 BT_DBG("%s ACL data packet", hdev->name);
1996 hci_acldata_packet(hdev, skb);
1997 break;
1998
1999 case HCI_SCODATA_PKT:
2000 BT_DBG("%s SCO data packet", hdev->name);
2001 hci_scodata_packet(hdev, skb);
2002 break;
2003
2004 default:
2005 kfree_skb(skb);
2006 break;
2007 }
2008 }
2009
2010 read_unlock(&hci_task_lock);
2011 }
2012
2013 static void hci_cmd_task(unsigned long arg)
2014 {
2015 struct hci_dev *hdev = (struct hci_dev *) arg;
2016 struct sk_buff *skb;
2017
2018 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2019
2020 /* Send queued commands */
2021 if (atomic_read(&hdev->cmd_cnt)) {
2022 skb = skb_dequeue(&hdev->cmd_q);
2023 if (!skb)
2024 return;
2025
2026 kfree_skb(hdev->sent_cmd);
2027
2028 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2029 if (hdev->sent_cmd) {
2030 atomic_dec(&hdev->cmd_cnt);
2031 hci_send_frame(skb);
2032 mod_timer(&hdev->cmd_timer,
2033 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2034 } else {
2035 skb_queue_head(&hdev->cmd_q, skb);
2036 tasklet_schedule(&hdev->cmd_task);
2037 }
2038 }
2039 }
CRIS linux kernel tree