?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Add linux-next specific files for 20110421
[linux-2.6/next.git] / net / bluetooth / hci_core.c
blobe057d123599636dc74d003f3b581e9dfd040aa2f
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI core. */
26
27 #include <linux/jiffies.h>
28 #include <linux/module.h>
29 #include <linux/kmod.h>
30
31 #include <linux/types.h>
32 #include <linux/errno.h>
33 #include <linux/kernel.h>
34 #include <linux/sched.h>
35 #include <linux/slab.h>
36 #include <linux/poll.h>
37 #include <linux/fcntl.h>
38 #include <linux/init.h>
39 #include <linux/skbuff.h>
40 #include <linux/workqueue.h>
41 #include <linux/interrupt.h>
42 #include <linux/notifier.h>
43 #include <linux/rfkill.h>
44 #include <linux/timer.h>
45 #include <net/sock.h>
46
47 #include <asm/system.h>
48 #include <linux/uaccess.h>
49 #include <asm/unaligned.h>
50
51 #include <net/bluetooth/bluetooth.h>
52 #include <net/bluetooth/hci_core.h>
53
54 #define AUTO_OFF_TIMEOUT 2000
55
56 static void hci_cmd_task(unsigned long arg);
57 static void hci_rx_task(unsigned long arg);
58 static void hci_tx_task(unsigned long arg);
59
60 static DEFINE_RWLOCK(hci_task_lock);
61
62 /* HCI device list */
63 LIST_HEAD(hci_dev_list);
64 DEFINE_RWLOCK(hci_dev_list_lock);
65
66 /* HCI callback list */
67 LIST_HEAD(hci_cb_list);
68 DEFINE_RWLOCK(hci_cb_list_lock);
69
70 /* HCI protocols */
71 #define HCI_MAX_PROTO 2
72 struct hci_proto *hci_proto[HCI_MAX_PROTO];
73
74 /* HCI notifiers list */
75 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
76
77 /* ---- HCI notifications ---- */
78
79 int hci_register_notifier(struct notifier_block *nb)
80 {
81 return atomic_notifier_chain_register(&hci_notifier, nb);
82 }
83
84 int hci_unregister_notifier(struct notifier_block *nb)
85 {
86 return atomic_notifier_chain_unregister(&hci_notifier, nb);
87 }
88
89 static void hci_notify(struct hci_dev *hdev, int event)
90 {
91 atomic_notifier_call_chain(&hci_notifier, event, hdev);
92 }
93
94 /* ---- HCI requests ---- */
95
96 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
97 {
98 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
99
100 /* If this is the init phase check if the completed command matches
101 * the last init command, and if not just return.
102 */
103 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
104 return;
105
106 if (hdev->req_status == HCI_REQ_PEND) {
107 hdev->req_result = result;
108 hdev->req_status = HCI_REQ_DONE;
109 wake_up_interruptible(&hdev->req_wait_q);
110 }
111 }
112
113 static void hci_req_cancel(struct hci_dev *hdev, int err)
114 {
115 BT_DBG("%s err 0x%2.2x", hdev->name, err);
116
117 if (hdev->req_status == HCI_REQ_PEND) {
118 hdev->req_result = err;
119 hdev->req_status = HCI_REQ_CANCELED;
120 wake_up_interruptible(&hdev->req_wait_q);
121 }
122 }
123
124 /* Execute request and wait for completion. */
125 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
126 unsigned long opt, __u32 timeout)
127 {
128 DECLARE_WAITQUEUE(wait, current);
129 int err = 0;
130
131 BT_DBG("%s start", hdev->name);
132
133 hdev->req_status = HCI_REQ_PEND;
134
135 add_wait_queue(&hdev->req_wait_q, &wait);
136 set_current_state(TASK_INTERRUPTIBLE);
137
138 req(hdev, opt);
139 schedule_timeout(timeout);
140
141 remove_wait_queue(&hdev->req_wait_q, &wait);
142
143 if (signal_pending(current))
144 return -EINTR;
145
146 switch (hdev->req_status) {
147 case HCI_REQ_DONE:
148 err = -bt_err(hdev->req_result);
149 break;
150
151 case HCI_REQ_CANCELED:
152 err = -hdev->req_result;
153 break;
154
155 default:
156 err = -ETIMEDOUT;
157 break;
158 }
159
160 hdev->req_status = hdev->req_result = 0;
161
162 BT_DBG("%s end: err %d", hdev->name, err);
163
164 return err;
165 }
166
167 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
168 unsigned long opt, __u32 timeout)
169 {
170 int ret;
171
172 if (!test_bit(HCI_UP, &hdev->flags))
173 return -ENETDOWN;
174
175 /* Serialize all requests */
176 hci_req_lock(hdev);
177 ret = __hci_request(hdev, req, opt, timeout);
178 hci_req_unlock(hdev);
179
180 return ret;
181 }
182
183 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
184 {
185 BT_DBG("%s %ld", hdev->name, opt);
186
187 /* Reset device */
188 set_bit(HCI_RESET, &hdev->flags);
189 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
190 }
191
192 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
193 {
194 struct hci_cp_delete_stored_link_key cp;
195 struct sk_buff *skb;
196 __le16 param;
197 __u8 flt_type;
198
199 BT_DBG("%s %ld", hdev->name, opt);
200
201 /* Driver initialization */
202
203 /* Special commands */
204 while ((skb = skb_dequeue(&hdev->driver_init))) {
205 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
206 skb->dev = (void *) hdev;
207
208 skb_queue_tail(&hdev->cmd_q, skb);
209 tasklet_schedule(&hdev->cmd_task);
210 }
211 skb_queue_purge(&hdev->driver_init);
212
213 /* Mandatory initialization */
214
215 /* Reset */
216 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
217 set_bit(HCI_RESET, &hdev->flags);
218 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
219 }
220
221 /* Read Local Supported Features */
222 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
223
224 /* Read Local Version */
225 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
226
227 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
228 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
229
230 #if 0
231 /* Host buffer size */
232 {
233 struct hci_cp_host_buffer_size cp;
234 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
235 cp.sco_mtu = HCI_MAX_SCO_SIZE;
236 cp.acl_max_pkt = cpu_to_le16(0xffff);
237 cp.sco_max_pkt = cpu_to_le16(0xffff);
238 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
239 }
240 #endif
241
242 /* Read BD Address */
243 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
244
245 /* Read Class of Device */
246 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
247
248 /* Read Local Name */
249 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
250
251 /* Read Voice Setting */
252 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
253
254 /* Optional initialization */
255
256 /* Clear Event Filters */
257 flt_type = HCI_FLT_CLEAR_ALL;
258 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
259
260 /* Connection accept timeout ~20 secs */
261 param = cpu_to_le16(0x7d00);
262 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
263
264 bacpy(&cp.bdaddr, BDADDR_ANY);
265 cp.delete_all = 1;
266 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
267 }
268
269 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
270 {
271 BT_DBG("%s", hdev->name);
272
273 /* Read LE buffer size */
274 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
275 }
276
277 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
278 {
279 __u8 scan = opt;
280
281 BT_DBG("%s %x", hdev->name, scan);
282
283 /* Inquiry and Page scans */
284 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
285 }
286
287 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
288 {
289 __u8 auth = opt;
290
291 BT_DBG("%s %x", hdev->name, auth);
292
293 /* Authentication */
294 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
295 }
296
297 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
298 {
299 __u8 encrypt = opt;
300
301 BT_DBG("%s %x", hdev->name, encrypt);
302
303 /* Encryption */
304 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
305 }
306
307 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
308 {
309 __le16 policy = cpu_to_le16(opt);
310
311 BT_DBG("%s %x", hdev->name, policy);
312
313 /* Default link policy */
314 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
315 }
316
317 /* Get HCI device by index.
318 * Device is held on return. */
319 struct hci_dev *hci_dev_get(int index)
320 {
321 struct hci_dev *hdev = NULL;
322 struct list_head *p;
323
324 BT_DBG("%d", index);
325
326 if (index < 0)
327 return NULL;
328
329 read_lock(&hci_dev_list_lock);
330 list_for_each(p, &hci_dev_list) {
331 struct hci_dev *d = list_entry(p, struct hci_dev, list);
332 if (d->id == index) {
333 hdev = hci_dev_hold(d);
334 break;
335 }
336 }
337 read_unlock(&hci_dev_list_lock);
338 return hdev;
339 }
340
341 /* ---- Inquiry support ---- */
342 static void inquiry_cache_flush(struct hci_dev *hdev)
343 {
344 struct inquiry_cache *cache = &hdev->inq_cache;
345 struct inquiry_entry *next = cache->list, *e;
346
347 BT_DBG("cache %p", cache);
348
349 cache->list = NULL;
350 while ((e = next)) {
351 next = e->next;
352 kfree(e);
353 }
354 }
355
356 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
357 {
358 struct inquiry_cache *cache = &hdev->inq_cache;
359 struct inquiry_entry *e;
360
361 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
362
363 for (e = cache->list; e; e = e->next)
364 if (!bacmp(&e->data.bdaddr, bdaddr))
365 break;
366 return e;
367 }
368
369 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
370 {
371 struct inquiry_cache *cache = &hdev->inq_cache;
372 struct inquiry_entry *ie;
373
374 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
375
376 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
377 if (!ie) {
378 /* Entry not in the cache. Add new one. */
379 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
380 if (!ie)
381 return;
382
383 ie->next = cache->list;
384 cache->list = ie;
385 }
386
387 memcpy(&ie->data, data, sizeof(*data));
388 ie->timestamp = jiffies;
389 cache->timestamp = jiffies;
390 }
391
392 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
393 {
394 struct inquiry_cache *cache = &hdev->inq_cache;
395 struct inquiry_info *info = (struct inquiry_info *) buf;
396 struct inquiry_entry *e;
397 int copied = 0;
398
399 for (e = cache->list; e && copied < num; e = e->next, copied++) {
400 struct inquiry_data *data = &e->data;
401 bacpy(&info->bdaddr, &data->bdaddr);
402 info->pscan_rep_mode = data->pscan_rep_mode;
403 info->pscan_period_mode = data->pscan_period_mode;
404 info->pscan_mode = data->pscan_mode;
405 memcpy(info->dev_class, data->dev_class, 3);
406 info->clock_offset = data->clock_offset;
407 info++;
408 }
409
410 BT_DBG("cache %p, copied %d", cache, copied);
411 return copied;
412 }
413
414 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
415 {
416 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
417 struct hci_cp_inquiry cp;
418
419 BT_DBG("%s", hdev->name);
420
421 if (test_bit(HCI_INQUIRY, &hdev->flags))
422 return;
423
424 /* Start Inquiry */
425 memcpy(&cp.lap, &ir->lap, 3);
426 cp.length = ir->length;
427 cp.num_rsp = ir->num_rsp;
428 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
429 }
430
431 int hci_inquiry(void __user *arg)
432 {
433 __u8 __user *ptr = arg;
434 struct hci_inquiry_req ir;
435 struct hci_dev *hdev;
436 int err = 0, do_inquiry = 0, max_rsp;
437 long timeo;
438 __u8 *buf;
439
440 if (copy_from_user(&ir, ptr, sizeof(ir)))
441 return -EFAULT;
442
443 hdev = hci_dev_get(ir.dev_id);
444 if (!hdev)
445 return -ENODEV;
446
447 hci_dev_lock_bh(hdev);
448 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
449 inquiry_cache_empty(hdev) ||
450 ir.flags & IREQ_CACHE_FLUSH) {
451 inquiry_cache_flush(hdev);
452 do_inquiry = 1;
453 }
454 hci_dev_unlock_bh(hdev);
455
456 timeo = ir.length * msecs_to_jiffies(2000);
457
458 if (do_inquiry) {
459 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
460 if (err < 0)
461 goto done;
462 }
463
464 /* for unlimited number of responses we will use buffer with 255 entries */
465 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
466
467 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
468 * copy it to the user space.
469 */
470 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
471 if (!buf) {
472 err = -ENOMEM;
473 goto done;
474 }
475
476 hci_dev_lock_bh(hdev);
477 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
478 hci_dev_unlock_bh(hdev);
479
480 BT_DBG("num_rsp %d", ir.num_rsp);
481
482 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
483 ptr += sizeof(ir);
484 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
485 ir.num_rsp))
486 err = -EFAULT;
487 } else
488 err = -EFAULT;
489
490 kfree(buf);
491
492 done:
493 hci_dev_put(hdev);
494 return err;
495 }
496
497 /* ---- HCI ioctl helpers ---- */
498
499 int hci_dev_open(__u16 dev)
500 {
501 struct hci_dev *hdev;
502 int ret = 0;
503
504 hdev = hci_dev_get(dev);
505 if (!hdev)
506 return -ENODEV;
507
508 BT_DBG("%s %p", hdev->name, hdev);
509
510 hci_req_lock(hdev);
511
512 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
513 ret = -ERFKILL;
514 goto done;
515 }
516
517 if (test_bit(HCI_UP, &hdev->flags)) {
518 ret = -EALREADY;
519 goto done;
520 }
521
522 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
523 set_bit(HCI_RAW, &hdev->flags);
524
525 /* Treat all non BR/EDR controllers as raw devices for now */
526 if (hdev->dev_type != HCI_BREDR)
527 set_bit(HCI_RAW, &hdev->flags);
528
529 if (hdev->open(hdev)) {
530 ret = -EIO;
531 goto done;
532 }
533
534 if (!test_bit(HCI_RAW, &hdev->flags)) {
535 atomic_set(&hdev->cmd_cnt, 1);
536 set_bit(HCI_INIT, &hdev->flags);
537 hdev->init_last_cmd = 0;
538
539 ret = __hci_request(hdev, hci_init_req, 0,
540 msecs_to_jiffies(HCI_INIT_TIMEOUT));
541
542 if (lmp_le_capable(hdev))
543 ret = __hci_request(hdev, hci_le_init_req, 0,
544 msecs_to_jiffies(HCI_INIT_TIMEOUT));
545
546 clear_bit(HCI_INIT, &hdev->flags);
547 }
548
549 if (!ret) {
550 hci_dev_hold(hdev);
551 set_bit(HCI_UP, &hdev->flags);
552 hci_notify(hdev, HCI_DEV_UP);
553 if (!test_bit(HCI_SETUP, &hdev->flags))
554 mgmt_powered(hdev->id, 1);
555 } else {
556 /* Init failed, cleanup */
557 tasklet_kill(&hdev->rx_task);
558 tasklet_kill(&hdev->tx_task);
559 tasklet_kill(&hdev->cmd_task);
560
561 skb_queue_purge(&hdev->cmd_q);
562 skb_queue_purge(&hdev->rx_q);
563
564 if (hdev->flush)
565 hdev->flush(hdev);
566
567 if (hdev->sent_cmd) {
568 kfree_skb(hdev->sent_cmd);
569 hdev->sent_cmd = NULL;
570 }
571
572 hdev->close(hdev);
573 hdev->flags = 0;
574 }
575
576 done:
577 hci_req_unlock(hdev);
578 hci_dev_put(hdev);
579 return ret;
580 }
581
582 static int hci_dev_do_close(struct hci_dev *hdev)
583 {
584 BT_DBG("%s %p", hdev->name, hdev);
585
586 hci_req_cancel(hdev, ENODEV);
587 hci_req_lock(hdev);
588
589 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
590 del_timer_sync(&hdev->cmd_timer);
591 hci_req_unlock(hdev);
592 return 0;
593 }
594
595 /* Kill RX and TX tasks */
596 tasklet_kill(&hdev->rx_task);
597 tasklet_kill(&hdev->tx_task);
598
599 hci_dev_lock_bh(hdev);
600 inquiry_cache_flush(hdev);
601 hci_conn_hash_flush(hdev);
602 hci_dev_unlock_bh(hdev);
603
604 hci_notify(hdev, HCI_DEV_DOWN);
605
606 if (hdev->flush)
607 hdev->flush(hdev);
608
609 /* Reset device */
610 skb_queue_purge(&hdev->cmd_q);
611 atomic_set(&hdev->cmd_cnt, 1);
612 if (!test_bit(HCI_RAW, &hdev->flags)) {
613 set_bit(HCI_INIT, &hdev->flags);
614 __hci_request(hdev, hci_reset_req, 0,
615 msecs_to_jiffies(250));
616 clear_bit(HCI_INIT, &hdev->flags);
617 }
618
619 /* Kill cmd task */
620 tasklet_kill(&hdev->cmd_task);
621
622 /* Drop queues */
623 skb_queue_purge(&hdev->rx_q);
624 skb_queue_purge(&hdev->cmd_q);
625 skb_queue_purge(&hdev->raw_q);
626
627 /* Drop last sent command */
628 if (hdev->sent_cmd) {
629 del_timer_sync(&hdev->cmd_timer);
630 kfree_skb(hdev->sent_cmd);
631 hdev->sent_cmd = NULL;
632 }
633
634 /* After this point our queues are empty
635 * and no tasks are scheduled. */
636 hdev->close(hdev);
637
638 mgmt_powered(hdev->id, 0);
639
640 /* Clear flags */
641 hdev->flags = 0;
642
643 hci_req_unlock(hdev);
644
645 hci_dev_put(hdev);
646 return 0;
647 }
648
649 int hci_dev_close(__u16 dev)
650 {
651 struct hci_dev *hdev;
652 int err;
653
654 hdev = hci_dev_get(dev);
655 if (!hdev)
656 return -ENODEV;
657 err = hci_dev_do_close(hdev);
658 hci_dev_put(hdev);
659 return err;
660 }
661
662 int hci_dev_reset(__u16 dev)
663 {
664 struct hci_dev *hdev;
665 int ret = 0;
666
667 hdev = hci_dev_get(dev);
668 if (!hdev)
669 return -ENODEV;
670
671 hci_req_lock(hdev);
672 tasklet_disable(&hdev->tx_task);
673
674 if (!test_bit(HCI_UP, &hdev->flags))
675 goto done;
676
677 /* Drop queues */
678 skb_queue_purge(&hdev->rx_q);
679 skb_queue_purge(&hdev->cmd_q);
680
681 hci_dev_lock_bh(hdev);
682 inquiry_cache_flush(hdev);
683 hci_conn_hash_flush(hdev);
684 hci_dev_unlock_bh(hdev);
685
686 if (hdev->flush)
687 hdev->flush(hdev);
688
689 atomic_set(&hdev->cmd_cnt, 1);
690 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
691
692 if (!test_bit(HCI_RAW, &hdev->flags))
693 ret = __hci_request(hdev, hci_reset_req, 0,
694 msecs_to_jiffies(HCI_INIT_TIMEOUT));
695
696 done:
697 tasklet_enable(&hdev->tx_task);
698 hci_req_unlock(hdev);
699 hci_dev_put(hdev);
700 return ret;
701 }
702
703 int hci_dev_reset_stat(__u16 dev)
704 {
705 struct hci_dev *hdev;
706 int ret = 0;
707
708 hdev = hci_dev_get(dev);
709 if (!hdev)
710 return -ENODEV;
711
712 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
713
714 hci_dev_put(hdev);
715
716 return ret;
717 }
718
719 int hci_dev_cmd(unsigned int cmd, void __user *arg)
720 {
721 struct hci_dev *hdev;
722 struct hci_dev_req dr;
723 int err = 0;
724
725 if (copy_from_user(&dr, arg, sizeof(dr)))
726 return -EFAULT;
727
728 hdev = hci_dev_get(dr.dev_id);
729 if (!hdev)
730 return -ENODEV;
731
732 switch (cmd) {
733 case HCISETAUTH:
734 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
735 msecs_to_jiffies(HCI_INIT_TIMEOUT));
736 break;
737
738 case HCISETENCRYPT:
739 if (!lmp_encrypt_capable(hdev)) {
740 err = -EOPNOTSUPP;
741 break;
742 }
743
744 if (!test_bit(HCI_AUTH, &hdev->flags)) {
745 /* Auth must be enabled first */
746 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
747 msecs_to_jiffies(HCI_INIT_TIMEOUT));
748 if (err)
749 break;
750 }
751
752 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
753 msecs_to_jiffies(HCI_INIT_TIMEOUT));
754 break;
755
756 case HCISETSCAN:
757 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
758 msecs_to_jiffies(HCI_INIT_TIMEOUT));
759 break;
760
761 case HCISETLINKPOL:
762 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
763 msecs_to_jiffies(HCI_INIT_TIMEOUT));
764 break;
765
766 case HCISETLINKMODE:
767 hdev->link_mode = ((__u16) dr.dev_opt) &
768 (HCI_LM_MASTER | HCI_LM_ACCEPT);
769 break;
770
771 case HCISETPTYPE:
772 hdev->pkt_type = (__u16) dr.dev_opt;
773 break;
774
775 case HCISETACLMTU:
776 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
777 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
778 break;
779
780 case HCISETSCOMTU:
781 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
782 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
783 break;
784
785 default:
786 err = -EINVAL;
787 break;
788 }
789
790 hci_dev_put(hdev);
791 return err;
792 }
793
794 int hci_get_dev_list(void __user *arg)
795 {
796 struct hci_dev_list_req *dl;
797 struct hci_dev_req *dr;
798 struct list_head *p;
799 int n = 0, size, err;
800 __u16 dev_num;
801
802 if (get_user(dev_num, (__u16 __user *) arg))
803 return -EFAULT;
804
805 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
806 return -EINVAL;
807
808 size = sizeof(*dl) + dev_num * sizeof(*dr);
809
810 dl = kzalloc(size, GFP_KERNEL);
811 if (!dl)
812 return -ENOMEM;
813
814 dr = dl->dev_req;
815
816 read_lock_bh(&hci_dev_list_lock);
817 list_for_each(p, &hci_dev_list) {
818 struct hci_dev *hdev;
819
820 hdev = list_entry(p, struct hci_dev, list);
821
822 hci_del_off_timer(hdev);
823
824 if (!test_bit(HCI_MGMT, &hdev->flags))
825 set_bit(HCI_PAIRABLE, &hdev->flags);
826
827 (dr + n)->dev_id = hdev->id;
828 (dr + n)->dev_opt = hdev->flags;
829
830 if (++n >= dev_num)
831 break;
832 }
833 read_unlock_bh(&hci_dev_list_lock);
834
835 dl->dev_num = n;
836 size = sizeof(*dl) + n * sizeof(*dr);
837
838 err = copy_to_user(arg, dl, size);
839 kfree(dl);
840
841 return err ? -EFAULT : 0;
842 }
843
844 int hci_get_dev_info(void __user *arg)
845 {
846 struct hci_dev *hdev;
847 struct hci_dev_info di;
848 int err = 0;
849
850 if (copy_from_user(&di, arg, sizeof(di)))
851 return -EFAULT;
852
853 hdev = hci_dev_get(di.dev_id);
854 if (!hdev)
855 return -ENODEV;
856
857 hci_del_off_timer(hdev);
858
859 if (!test_bit(HCI_MGMT, &hdev->flags))
860 set_bit(HCI_PAIRABLE, &hdev->flags);
861
862 strcpy(di.name, hdev->name);
863 di.bdaddr = hdev->bdaddr;
864 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
865 di.flags = hdev->flags;
866 di.pkt_type = hdev->pkt_type;
867 di.acl_mtu = hdev->acl_mtu;
868 di.acl_pkts = hdev->acl_pkts;
869 di.sco_mtu = hdev->sco_mtu;
870 di.sco_pkts = hdev->sco_pkts;
871 di.link_policy = hdev->link_policy;
872 di.link_mode = hdev->link_mode;
873
874 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
875 memcpy(&di.features, &hdev->features, sizeof(di.features));
876
877 if (copy_to_user(arg, &di, sizeof(di)))
878 err = -EFAULT;
879
880 hci_dev_put(hdev);
881
882 return err;
883 }
884
885 /* ---- Interface to HCI drivers ---- */
886
887 static int hci_rfkill_set_block(void *data, bool blocked)
888 {
889 struct hci_dev *hdev = data;
890
891 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
892
893 if (!blocked)
894 return 0;
895
896 hci_dev_do_close(hdev);
897
898 return 0;
899 }
900
901 static const struct rfkill_ops hci_rfkill_ops = {
902 .set_block = hci_rfkill_set_block,
903 };
904
905 /* Alloc HCI device */
906 struct hci_dev *hci_alloc_dev(void)
907 {
908 struct hci_dev *hdev;
909
910 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
911 if (!hdev)
912 return NULL;
913
914 skb_queue_head_init(&hdev->driver_init);
915
916 return hdev;
917 }
918 EXPORT_SYMBOL(hci_alloc_dev);
919
920 /* Free HCI device */
921 void hci_free_dev(struct hci_dev *hdev)
922 {
923 skb_queue_purge(&hdev->driver_init);
924
925 /* will free via device release */
926 put_device(&hdev->dev);
927 }
928 EXPORT_SYMBOL(hci_free_dev);
929
930 static void hci_power_on(struct work_struct *work)
931 {
932 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
933
934 BT_DBG("%s", hdev->name);
935
936 if (hci_dev_open(hdev->id) < 0)
937 return;
938
939 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
940 mod_timer(&hdev->off_timer,
941 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
942
943 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
944 mgmt_index_added(hdev->id);
945 }
946
947 static void hci_power_off(struct work_struct *work)
948 {
949 struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
950
951 BT_DBG("%s", hdev->name);
952
953 hci_dev_close(hdev->id);
954 }
955
956 static void hci_auto_off(unsigned long data)
957 {
958 struct hci_dev *hdev = (struct hci_dev *) data;
959
960 BT_DBG("%s", hdev->name);
961
962 clear_bit(HCI_AUTO_OFF, &hdev->flags);
963
964 queue_work(hdev->workqueue, &hdev->power_off);
965 }
966
967 void hci_del_off_timer(struct hci_dev *hdev)
968 {
969 BT_DBG("%s", hdev->name);
970
971 clear_bit(HCI_AUTO_OFF, &hdev->flags);
972 del_timer(&hdev->off_timer);
973 }
974
975 int hci_uuids_clear(struct hci_dev *hdev)
976 {
977 struct list_head *p, *n;
978
979 list_for_each_safe(p, n, &hdev->uuids) {
980 struct bt_uuid *uuid;
981
982 uuid = list_entry(p, struct bt_uuid, list);
983
984 list_del(p);
985 kfree(uuid);
986 }
987
988 return 0;
989 }
990
991 int hci_link_keys_clear(struct hci_dev *hdev)
992 {
993 struct list_head *p, *n;
994
995 list_for_each_safe(p, n, &hdev->link_keys) {
996 struct link_key *key;
997
998 key = list_entry(p, struct link_key, list);
999
1000 list_del(p);
1001 kfree(key);
1002 }
1003
1004 return 0;
1005 }
1006
1007 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1008 {
1009 struct list_head *p;
1010
1011 list_for_each(p, &hdev->link_keys) {
1012 struct link_key *k;
1013
1014 k = list_entry(p, struct link_key, list);
1015
1016 if (bacmp(bdaddr, &k->bdaddr) == 0)
1017 return k;
1018 }
1019
1020 return NULL;
1021 }
1022
1023 int hci_add_link_key(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
1024 u8 *val, u8 type, u8 pin_len)
1025 {
1026 struct link_key *key, *old_key;
1027 u8 old_key_type;
1028
1029 old_key = hci_find_link_key(hdev, bdaddr);
1030 if (old_key) {
1031 old_key_type = old_key->type;
1032 key = old_key;
1033 } else {
1034 old_key_type = 0xff;
1035 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1036 if (!key)
1037 return -ENOMEM;
1038 list_add(&key->list, &hdev->link_keys);
1039 }
1040
1041 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1042
1043 bacpy(&key->bdaddr, bdaddr);
1044 memcpy(key->val, val, 16);
1045 key->type = type;
1046 key->pin_len = pin_len;
1047
1048 if (new_key)
1049 mgmt_new_key(hdev->id, key, old_key_type);
1050
1051 if (type == 0x06)
1052 key->type = old_key_type;
1053
1054 return 0;
1055 }
1056
1057 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1058 {
1059 struct link_key *key;
1060
1061 key = hci_find_link_key(hdev, bdaddr);
1062 if (!key)
1063 return -ENOENT;
1064
1065 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1066
1067 list_del(&key->list);
1068 kfree(key);
1069
1070 return 0;
1071 }
1072
1073 /* HCI command timer function */
1074 static void hci_cmd_timer(unsigned long arg)
1075 {
1076 struct hci_dev *hdev = (void *) arg;
1077
1078 BT_ERR("%s command tx timeout", hdev->name);
1079 atomic_set(&hdev->cmd_cnt, 1);
1080 clear_bit(HCI_RESET, &hdev->flags);
1081 tasklet_schedule(&hdev->cmd_task);
1082 }
1083
1084 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1085 bdaddr_t *bdaddr)
1086 {
1087 struct oob_data *data;
1088
1089 list_for_each_entry(data, &hdev->remote_oob_data, list)
1090 if (bacmp(bdaddr, &data->bdaddr) == 0)
1091 return data;
1092
1093 return NULL;
1094 }
1095
1096 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1097 {
1098 struct oob_data *data;
1099
1100 data = hci_find_remote_oob_data(hdev, bdaddr);
1101 if (!data)
1102 return -ENOENT;
1103
1104 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1105
1106 list_del(&data->list);
1107 kfree(data);
1108
1109 return 0;
1110 }
1111
1112 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1113 {
1114 struct oob_data *data, *n;
1115
1116 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1117 list_del(&data->list);
1118 kfree(data);
1119 }
1120
1121 return 0;
1122 }
1123
1124 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1125 u8 *randomizer)
1126 {
1127 struct oob_data *data;
1128
1129 data = hci_find_remote_oob_data(hdev, bdaddr);
1130
1131 if (!data) {
1132 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1133 if (!data)
1134 return -ENOMEM;
1135
1136 bacpy(&data->bdaddr, bdaddr);
1137 list_add(&data->list, &hdev->remote_oob_data);
1138 }
1139
1140 memcpy(data->hash, hash, sizeof(data->hash));
1141 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1142
1143 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1144
1145 return 0;
1146 }
1147
1148 /* Register HCI device */
1149 int hci_register_dev(struct hci_dev *hdev)
1150 {
1151 struct list_head *head = &hci_dev_list, *p;
1152 int i, id = 0;
1153
1154 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1155 hdev->bus, hdev->owner);
1156
1157 if (!hdev->open || !hdev->close || !hdev->destruct)
1158 return -EINVAL;
1159
1160 write_lock_bh(&hci_dev_list_lock);
1161
1162 /* Find first available device id */
1163 list_for_each(p, &hci_dev_list) {
1164 if (list_entry(p, struct hci_dev, list)->id != id)
1165 break;
1166 head = p; id++;
1167 }
1168
1169 sprintf(hdev->name, "hci%d", id);
1170 hdev->id = id;
1171 list_add(&hdev->list, head);
1172
1173 atomic_set(&hdev->refcnt, 1);
1174 spin_lock_init(&hdev->lock);
1175
1176 hdev->flags = 0;
1177 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1178 hdev->esco_type = (ESCO_HV1);
1179 hdev->link_mode = (HCI_LM_ACCEPT);
1180 hdev->io_capability = 0x03; /* No Input No Output */
1181
1182 hdev->idle_timeout = 0;
1183 hdev->sniff_max_interval = 800;
1184 hdev->sniff_min_interval = 80;
1185
1186 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1187 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1188 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1189
1190 skb_queue_head_init(&hdev->rx_q);
1191 skb_queue_head_init(&hdev->cmd_q);
1192 skb_queue_head_init(&hdev->raw_q);
1193
1194 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1195
1196 for (i = 0; i < NUM_REASSEMBLY; i++)
1197 hdev->reassembly[i] = NULL;
1198
1199 init_waitqueue_head(&hdev->req_wait_q);
1200 mutex_init(&hdev->req_lock);
1201
1202 inquiry_cache_init(hdev);
1203
1204 hci_conn_hash_init(hdev);
1205
1206 INIT_LIST_HEAD(&hdev->blacklist);
1207
1208 INIT_LIST_HEAD(&hdev->uuids);
1209
1210 INIT_LIST_HEAD(&hdev->link_keys);
1211
1212 INIT_LIST_HEAD(&hdev->remote_oob_data);
1213
1214 INIT_WORK(&hdev->power_on, hci_power_on);
1215 INIT_WORK(&hdev->power_off, hci_power_off);
1216 setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1217
1218 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1219
1220 atomic_set(&hdev->promisc, 0);
1221
1222 write_unlock_bh(&hci_dev_list_lock);
1223
1224 hdev->workqueue = create_singlethread_workqueue(hdev->name);
1225 if (!hdev->workqueue)
1226 goto nomem;
1227
1228 hci_register_sysfs(hdev);
1229
1230 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1231 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1232 if (hdev->rfkill) {
1233 if (rfkill_register(hdev->rfkill) < 0) {
1234 rfkill_destroy(hdev->rfkill);
1235 hdev->rfkill = NULL;
1236 }
1237 }
1238
1239 set_bit(HCI_AUTO_OFF, &hdev->flags);
1240 set_bit(HCI_SETUP, &hdev->flags);
1241 queue_work(hdev->workqueue, &hdev->power_on);
1242
1243 hci_notify(hdev, HCI_DEV_REG);
1244
1245 return id;
1246
1247 nomem:
1248 write_lock_bh(&hci_dev_list_lock);
1249 list_del(&hdev->list);
1250 write_unlock_bh(&hci_dev_list_lock);
1251
1252 return -ENOMEM;
1253 }
1254 EXPORT_SYMBOL(hci_register_dev);
1255
1256 /* Unregister HCI device */
1257 int hci_unregister_dev(struct hci_dev *hdev)
1258 {
1259 int i;
1260
1261 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1262
1263 write_lock_bh(&hci_dev_list_lock);
1264 list_del(&hdev->list);
1265 write_unlock_bh(&hci_dev_list_lock);
1266
1267 hci_dev_do_close(hdev);
1268
1269 for (i = 0; i < NUM_REASSEMBLY; i++)
1270 kfree_skb(hdev->reassembly[i]);
1271
1272 if (!test_bit(HCI_INIT, &hdev->flags) &&
1273 !test_bit(HCI_SETUP, &hdev->flags))
1274 mgmt_index_removed(hdev->id);
1275
1276 hci_notify(hdev, HCI_DEV_UNREG);
1277
1278 if (hdev->rfkill) {
1279 rfkill_unregister(hdev->rfkill);
1280 rfkill_destroy(hdev->rfkill);
1281 }
1282
1283 hci_unregister_sysfs(hdev);
1284
1285 hci_del_off_timer(hdev);
1286
1287 destroy_workqueue(hdev->workqueue);
1288
1289 hci_dev_lock_bh(hdev);
1290 hci_blacklist_clear(hdev);
1291 hci_uuids_clear(hdev);
1292 hci_link_keys_clear(hdev);
1293 hci_remote_oob_data_clear(hdev);
1294 hci_dev_unlock_bh(hdev);
1295
1296 __hci_dev_put(hdev);
1297
1298 return 0;
1299 }
1300 EXPORT_SYMBOL(hci_unregister_dev);
1301
1302 /* Suspend HCI device */
1303 int hci_suspend_dev(struct hci_dev *hdev)
1304 {
1305 hci_notify(hdev, HCI_DEV_SUSPEND);
1306 return 0;
1307 }
1308 EXPORT_SYMBOL(hci_suspend_dev);
1309
1310 /* Resume HCI device */
1311 int hci_resume_dev(struct hci_dev *hdev)
1312 {
1313 hci_notify(hdev, HCI_DEV_RESUME);
1314 return 0;
1315 }
1316 EXPORT_SYMBOL(hci_resume_dev);
1317
1318 /* Receive frame from HCI drivers */
1319 int hci_recv_frame(struct sk_buff *skb)
1320 {
1321 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1322 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1323 && !test_bit(HCI_INIT, &hdev->flags))) {
1324 kfree_skb(skb);
1325 return -ENXIO;
1326 }
1327
1328 /* Incomming skb */
1329 bt_cb(skb)->incoming = 1;
1330
1331 /* Time stamp */
1332 __net_timestamp(skb);
1333
1334 /* Queue frame for rx task */
1335 skb_queue_tail(&hdev->rx_q, skb);
1336 tasklet_schedule(&hdev->rx_task);
1337
1338 return 0;
1339 }
1340 EXPORT_SYMBOL(hci_recv_frame);
1341
1342 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1343 int count, __u8 index)
1344 {
1345 int len = 0;
1346 int hlen = 0;
1347 int remain = count;
1348 struct sk_buff *skb;
1349 struct bt_skb_cb *scb;
1350
1351 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1352 index >= NUM_REASSEMBLY)
1353 return -EILSEQ;
1354
1355 skb = hdev->reassembly[index];
1356
1357 if (!skb) {
1358 switch (type) {
1359 case HCI_ACLDATA_PKT:
1360 len = HCI_MAX_FRAME_SIZE;
1361 hlen = HCI_ACL_HDR_SIZE;
1362 break;
1363 case HCI_EVENT_PKT:
1364 len = HCI_MAX_EVENT_SIZE;
1365 hlen = HCI_EVENT_HDR_SIZE;
1366 break;
1367 case HCI_SCODATA_PKT:
1368 len = HCI_MAX_SCO_SIZE;
1369 hlen = HCI_SCO_HDR_SIZE;
1370 break;
1371 }
1372
1373 skb = bt_skb_alloc(len, GFP_ATOMIC);
1374 if (!skb)
1375 return -ENOMEM;
1376
1377 scb = (void *) skb->cb;
1378 scb->expect = hlen;
1379 scb->pkt_type = type;
1380
1381 skb->dev = (void *) hdev;
1382 hdev->reassembly[index] = skb;
1383 }
1384
1385 while (count) {
1386 scb = (void *) skb->cb;
1387 len = min(scb->expect, (__u16)count);
1388
1389 memcpy(skb_put(skb, len), data, len);
1390
1391 count -= len;
1392 data += len;
1393 scb->expect -= len;
1394 remain = count;
1395
1396 switch (type) {
1397 case HCI_EVENT_PKT:
1398 if (skb->len == HCI_EVENT_HDR_SIZE) {
1399 struct hci_event_hdr *h = hci_event_hdr(skb);
1400 scb->expect = h->plen;
1401
1402 if (skb_tailroom(skb) < scb->expect) {
1403 kfree_skb(skb);
1404 hdev->reassembly[index] = NULL;
1405 return -ENOMEM;
1406 }
1407 }
1408 break;
1409
1410 case HCI_ACLDATA_PKT:
1411 if (skb->len == HCI_ACL_HDR_SIZE) {
1412 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1413 scb->expect = __le16_to_cpu(h->dlen);
1414
1415 if (skb_tailroom(skb) < scb->expect) {
1416 kfree_skb(skb);
1417 hdev->reassembly[index] = NULL;
1418 return -ENOMEM;
1419 }
1420 }
1421 break;
1422
1423 case HCI_SCODATA_PKT:
1424 if (skb->len == HCI_SCO_HDR_SIZE) {
1425 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1426 scb->expect = h->dlen;
1427
1428 if (skb_tailroom(skb) < scb->expect) {
1429 kfree_skb(skb);
1430 hdev->reassembly[index] = NULL;
1431 return -ENOMEM;
1432 }
1433 }
1434 break;
1435 }
1436
1437 if (scb->expect == 0) {
1438 /* Complete frame */
1439
1440 bt_cb(skb)->pkt_type = type;
1441 hci_recv_frame(skb);
1442
1443 hdev->reassembly[index] = NULL;
1444 return remain;
1445 }
1446 }
1447
1448 return remain;
1449 }
1450
1451 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1452 {
1453 int rem = 0;
1454
1455 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1456 return -EILSEQ;
1457
1458 while (count) {
1459 rem = hci_reassembly(hdev, type, data, count, type - 1);
1460 if (rem < 0)
1461 return rem;
1462
1463 data += (count - rem);
1464 count = rem;
1465 };
1466
1467 return rem;
1468 }
1469 EXPORT_SYMBOL(hci_recv_fragment);
1470
1471 #define STREAM_REASSEMBLY 0
1472
1473 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1474 {
1475 int type;
1476 int rem = 0;
1477
1478 while (count) {
1479 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1480
1481 if (!skb) {
1482 struct { char type; } *pkt;
1483
1484 /* Start of the frame */
1485 pkt = data;
1486 type = pkt->type;
1487
1488 data++;
1489 count--;
1490 } else
1491 type = bt_cb(skb)->pkt_type;
1492
1493 rem = hci_reassembly(hdev, type, data, count,
1494 STREAM_REASSEMBLY);
1495 if (rem < 0)
1496 return rem;
1497
1498 data += (count - rem);
1499 count = rem;
1500 };
1501
1502 return rem;
1503 }
1504 EXPORT_SYMBOL(hci_recv_stream_fragment);
1505
1506 /* ---- Interface to upper protocols ---- */
1507
1508 /* Register/Unregister protocols.
1509 * hci_task_lock is used to ensure that no tasks are running. */
1510 int hci_register_proto(struct hci_proto *hp)
1511 {
1512 int err = 0;
1513
1514 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1515
1516 if (hp->id >= HCI_MAX_PROTO)
1517 return -EINVAL;
1518
1519 write_lock_bh(&hci_task_lock);
1520
1521 if (!hci_proto[hp->id])
1522 hci_proto[hp->id] = hp;
1523 else
1524 err = -EEXIST;
1525
1526 write_unlock_bh(&hci_task_lock);
1527
1528 return err;
1529 }
1530 EXPORT_SYMBOL(hci_register_proto);
1531
1532 int hci_unregister_proto(struct hci_proto *hp)
1533 {
1534 int err = 0;
1535
1536 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1537
1538 if (hp->id >= HCI_MAX_PROTO)
1539 return -EINVAL;
1540
1541 write_lock_bh(&hci_task_lock);
1542
1543 if (hci_proto[hp->id])
1544 hci_proto[hp->id] = NULL;
1545 else
1546 err = -ENOENT;
1547
1548 write_unlock_bh(&hci_task_lock);
1549
1550 return err;
1551 }
1552 EXPORT_SYMBOL(hci_unregister_proto);
1553
1554 int hci_register_cb(struct hci_cb *cb)
1555 {
1556 BT_DBG("%p name %s", cb, cb->name);
1557
1558 write_lock_bh(&hci_cb_list_lock);
1559 list_add(&cb->list, &hci_cb_list);
1560 write_unlock_bh(&hci_cb_list_lock);
1561
1562 return 0;
1563 }
1564 EXPORT_SYMBOL(hci_register_cb);
1565
1566 int hci_unregister_cb(struct hci_cb *cb)
1567 {
1568 BT_DBG("%p name %s", cb, cb->name);
1569
1570 write_lock_bh(&hci_cb_list_lock);
1571 list_del(&cb->list);
1572 write_unlock_bh(&hci_cb_list_lock);
1573
1574 return 0;
1575 }
1576 EXPORT_SYMBOL(hci_unregister_cb);
1577
1578 static int hci_send_frame(struct sk_buff *skb)
1579 {
1580 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1581
1582 if (!hdev) {
1583 kfree_skb(skb);
1584 return -ENODEV;
1585 }
1586
1587 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1588
1589 if (atomic_read(&hdev->promisc)) {
1590 /* Time stamp */
1591 __net_timestamp(skb);
1592
1593 hci_send_to_sock(hdev, skb, NULL);
1594 }
1595
1596 /* Get rid of skb owner, prior to sending to the driver. */
1597 skb_orphan(skb);
1598
1599 return hdev->send(skb);
1600 }
1601
1602 /* Send HCI command */
1603 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1604 {
1605 int len = HCI_COMMAND_HDR_SIZE + plen;
1606 struct hci_command_hdr *hdr;
1607 struct sk_buff *skb;
1608
1609 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1610
1611 skb = bt_skb_alloc(len, GFP_ATOMIC);
1612 if (!skb) {
1613 BT_ERR("%s no memory for command", hdev->name);
1614 return -ENOMEM;
1615 }
1616
1617 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1618 hdr->opcode = cpu_to_le16(opcode);
1619 hdr->plen = plen;
1620
1621 if (plen)
1622 memcpy(skb_put(skb, plen), param, plen);
1623
1624 BT_DBG("skb len %d", skb->len);
1625
1626 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1627 skb->dev = (void *) hdev;
1628
1629 if (test_bit(HCI_INIT, &hdev->flags))
1630 hdev->init_last_cmd = opcode;
1631
1632 skb_queue_tail(&hdev->cmd_q, skb);
1633 tasklet_schedule(&hdev->cmd_task);
1634
1635 return 0;
1636 }
1637
1638 /* Get data from the previously sent command */
1639 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1640 {
1641 struct hci_command_hdr *hdr;
1642
1643 if (!hdev->sent_cmd)
1644 return NULL;
1645
1646 hdr = (void *) hdev->sent_cmd->data;
1647
1648 if (hdr->opcode != cpu_to_le16(opcode))
1649 return NULL;
1650
1651 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1652
1653 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1654 }
1655
1656 /* Send ACL data */
1657 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1658 {
1659 struct hci_acl_hdr *hdr;
1660 int len = skb->len;
1661
1662 skb_push(skb, HCI_ACL_HDR_SIZE);
1663 skb_reset_transport_header(skb);
1664 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
1665 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1666 hdr->dlen = cpu_to_le16(len);
1667 }
1668
1669 void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1670 {
1671 struct hci_dev *hdev = conn->hdev;
1672 struct sk_buff *list;
1673
1674 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1675
1676 skb->dev = (void *) hdev;
1677 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1678 hci_add_acl_hdr(skb, conn->handle, flags);
1679
1680 list = skb_shinfo(skb)->frag_list;
1681 if (!list) {
1682 /* Non fragmented */
1683 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1684
1685 skb_queue_tail(&conn->data_q, skb);
1686 } else {
1687 /* Fragmented */
1688 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1689
1690 skb_shinfo(skb)->frag_list = NULL;
1691
1692 /* Queue all fragments atomically */
1693 spin_lock_bh(&conn->data_q.lock);
1694
1695 __skb_queue_tail(&conn->data_q, skb);
1696
1697 flags &= ~ACL_START;
1698 flags |= ACL_CONT;
1699 do {
1700 skb = list; list = list->next;
1701
1702 skb->dev = (void *) hdev;
1703 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1704 hci_add_acl_hdr(skb, conn->handle, flags);
1705
1706 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1707
1708 __skb_queue_tail(&conn->data_q, skb);
1709 } while (list);
1710
1711 spin_unlock_bh(&conn->data_q.lock);
1712 }
1713
1714 tasklet_schedule(&hdev->tx_task);
1715 }
1716 EXPORT_SYMBOL(hci_send_acl);
1717
1718 /* Send SCO data */
1719 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1720 {
1721 struct hci_dev *hdev = conn->hdev;
1722 struct hci_sco_hdr hdr;
1723
1724 BT_DBG("%s len %d", hdev->name, skb->len);
1725
1726 hdr.handle = cpu_to_le16(conn->handle);
1727 hdr.dlen = skb->len;
1728
1729 skb_push(skb, HCI_SCO_HDR_SIZE);
1730 skb_reset_transport_header(skb);
1731 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1732
1733 skb->dev = (void *) hdev;
1734 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1735
1736 skb_queue_tail(&conn->data_q, skb);
1737 tasklet_schedule(&hdev->tx_task);
1738 }
1739 EXPORT_SYMBOL(hci_send_sco);
1740
1741 /* ---- HCI TX task (outgoing data) ---- */
1742
1743 /* HCI Connection scheduler */
1744 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1745 {
1746 struct hci_conn_hash *h = &hdev->conn_hash;
1747 struct hci_conn *conn = NULL;
1748 int num = 0, min = ~0;
1749 struct list_head *p;
1750
1751 /* We don't have to lock device here. Connections are always
1752 * added and removed with TX task disabled. */
1753 list_for_each(p, &h->list) {
1754 struct hci_conn *c;
1755 c = list_entry(p, struct hci_conn, list);
1756
1757 if (c->type != type || skb_queue_empty(&c->data_q))
1758 continue;
1759
1760 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1761 continue;
1762
1763 num++;
1764
1765 if (c->sent < min) {
1766 min = c->sent;
1767 conn = c;
1768 }
1769 }
1770
1771 if (conn) {
1772 int cnt, q;
1773
1774 switch (conn->type) {
1775 case ACL_LINK:
1776 cnt = hdev->acl_cnt;
1777 break;
1778 case SCO_LINK:
1779 case ESCO_LINK:
1780 cnt = hdev->sco_cnt;
1781 break;
1782 case LE_LINK:
1783 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
1784 break;
1785 default:
1786 cnt = 0;
1787 BT_ERR("Unknown link type");
1788 }
1789
1790 q = cnt / num;
1791 *quote = q ? q : 1;
1792 } else
1793 *quote = 0;
1794
1795 BT_DBG("conn %p quote %d", conn, *quote);
1796 return conn;
1797 }
1798
1799 static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1800 {
1801 struct hci_conn_hash *h = &hdev->conn_hash;
1802 struct list_head *p;
1803 struct hci_conn *c;
1804
1805 BT_ERR("%s link tx timeout", hdev->name);
1806
1807 /* Kill stalled connections */
1808 list_for_each(p, &h->list) {
1809 c = list_entry(p, struct hci_conn, list);
1810 if (c->type == type && c->sent) {
1811 BT_ERR("%s killing stalled connection %s",
1812 hdev->name, batostr(&c->dst));
1813 hci_acl_disconn(c, 0x13);
1814 }
1815 }
1816 }
1817
1818 static inline void hci_sched_acl(struct hci_dev *hdev)
1819 {
1820 struct hci_conn *conn;
1821 struct sk_buff *skb;
1822 int quote;
1823
1824 BT_DBG("%s", hdev->name);
1825
1826 if (!test_bit(HCI_RAW, &hdev->flags)) {
1827 /* ACL tx timeout must be longer than maximum
1828 * link supervision timeout (40.9 seconds) */
1829 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
1830 hci_link_tx_to(hdev, ACL_LINK);
1831 }
1832
1833 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1834 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1835 BT_DBG("skb %p len %d", skb, skb->len);
1836
1837 hci_conn_enter_active_mode(conn);
1838
1839 hci_send_frame(skb);
1840 hdev->acl_last_tx = jiffies;
1841
1842 hdev->acl_cnt--;
1843 conn->sent++;
1844 }
1845 }
1846 }
1847
1848 /* Schedule SCO */
1849 static inline void hci_sched_sco(struct hci_dev *hdev)
1850 {
1851 struct hci_conn *conn;
1852 struct sk_buff *skb;
1853 int quote;
1854
1855 BT_DBG("%s", hdev->name);
1856
1857 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1858 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1859 BT_DBG("skb %p len %d", skb, skb->len);
1860 hci_send_frame(skb);
1861
1862 conn->sent++;
1863 if (conn->sent == ~0)
1864 conn->sent = 0;
1865 }
1866 }
1867 }
1868
1869 static inline void hci_sched_esco(struct hci_dev *hdev)
1870 {
1871 struct hci_conn *conn;
1872 struct sk_buff *skb;
1873 int quote;
1874
1875 BT_DBG("%s", hdev->name);
1876
1877 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1878 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1879 BT_DBG("skb %p len %d", skb, skb->len);
1880 hci_send_frame(skb);
1881
1882 conn->sent++;
1883 if (conn->sent == ~0)
1884 conn->sent = 0;
1885 }
1886 }
1887 }
1888
1889 static inline void hci_sched_le(struct hci_dev *hdev)
1890 {
1891 struct hci_conn *conn;
1892 struct sk_buff *skb;
1893 int quote, cnt;
1894
1895 BT_DBG("%s", hdev->name);
1896
1897 if (!test_bit(HCI_RAW, &hdev->flags)) {
1898 /* LE tx timeout must be longer than maximum
1899 * link supervision timeout (40.9 seconds) */
1900 if (!hdev->le_cnt && hdev->le_pkts &&
1901 time_after(jiffies, hdev->le_last_tx + HZ * 45))
1902 hci_link_tx_to(hdev, LE_LINK);
1903 }
1904
1905 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
1906 while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
1907 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1908 BT_DBG("skb %p len %d", skb, skb->len);
1909
1910 hci_send_frame(skb);
1911 hdev->le_last_tx = jiffies;
1912
1913 cnt--;
1914 conn->sent++;
1915 }
1916 }
1917 if (hdev->le_pkts)
1918 hdev->le_cnt = cnt;
1919 else
1920 hdev->acl_cnt = cnt;
1921 }
1922
1923 static void hci_tx_task(unsigned long arg)
1924 {
1925 struct hci_dev *hdev = (struct hci_dev *) arg;
1926 struct sk_buff *skb;
1927
1928 read_lock(&hci_task_lock);
1929
1930 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
1931 hdev->sco_cnt, hdev->le_cnt);
1932
1933 /* Schedule queues and send stuff to HCI driver */
1934
1935 hci_sched_acl(hdev);
1936
1937 hci_sched_sco(hdev);
1938
1939 hci_sched_esco(hdev);
1940
1941 hci_sched_le(hdev);
1942
1943 /* Send next queued raw (unknown type) packet */
1944 while ((skb = skb_dequeue(&hdev->raw_q)))
1945 hci_send_frame(skb);
1946
1947 read_unlock(&hci_task_lock);
1948 }
1949
1950 /* ----- HCI RX task (incoming data processing) ----- */
1951
1952 /* ACL data packet */
1953 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1954 {
1955 struct hci_acl_hdr *hdr = (void *) skb->data;
1956 struct hci_conn *conn;
1957 __u16 handle, flags;
1958
1959 skb_pull(skb, HCI_ACL_HDR_SIZE);
1960
1961 handle = __le16_to_cpu(hdr->handle);
1962 flags = hci_flags(handle);
1963 handle = hci_handle(handle);
1964
1965 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1966
1967 hdev->stat.acl_rx++;
1968
1969 hci_dev_lock(hdev);
1970 conn = hci_conn_hash_lookup_handle(hdev, handle);
1971 hci_dev_unlock(hdev);
1972
1973 if (conn) {
1974 register struct hci_proto *hp;
1975
1976 hci_conn_enter_active_mode(conn);
1977
1978 /* Send to upper protocol */
1979 hp = hci_proto[HCI_PROTO_L2CAP];
1980 if (hp && hp->recv_acldata) {
1981 hp->recv_acldata(conn, skb, flags);
1982 return;
1983 }
1984 } else {
1985 BT_ERR("%s ACL packet for unknown connection handle %d",
1986 hdev->name, handle);
1987 }
1988
1989 kfree_skb(skb);
1990 }
1991
1992 /* SCO data packet */
1993 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1994 {
1995 struct hci_sco_hdr *hdr = (void *) skb->data;
1996 struct hci_conn *conn;
1997 __u16 handle;
1998
1999 skb_pull(skb, HCI_SCO_HDR_SIZE);
2000
2001 handle = __le16_to_cpu(hdr->handle);
2002
2003 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2004
2005 hdev->stat.sco_rx++;
2006
2007 hci_dev_lock(hdev);
2008 conn = hci_conn_hash_lookup_handle(hdev, handle);
2009 hci_dev_unlock(hdev);
2010
2011 if (conn) {
2012 register struct hci_proto *hp;
2013
2014 /* Send to upper protocol */
2015 hp = hci_proto[HCI_PROTO_SCO];
2016 if (hp && hp->recv_scodata) {
2017 hp->recv_scodata(conn, skb);
2018 return;
2019 }
2020 } else {
2021 BT_ERR("%s SCO packet for unknown connection handle %d",
2022 hdev->name, handle);
2023 }
2024
2025 kfree_skb(skb);
2026 }
2027
2028 static void hci_rx_task(unsigned long arg)
2029 {
2030 struct hci_dev *hdev = (struct hci_dev *) arg;
2031 struct sk_buff *skb;
2032
2033 BT_DBG("%s", hdev->name);
2034
2035 read_lock(&hci_task_lock);
2036
2037 while ((skb = skb_dequeue(&hdev->rx_q))) {
2038 if (atomic_read(&hdev->promisc)) {
2039 /* Send copy to the sockets */
2040 hci_send_to_sock(hdev, skb, NULL);
2041 }
2042
2043 if (test_bit(HCI_RAW, &hdev->flags)) {
2044 kfree_skb(skb);
2045 continue;
2046 }
2047
2048 if (test_bit(HCI_INIT, &hdev->flags)) {
2049 /* Don't process data packets in this states. */
2050 switch (bt_cb(skb)->pkt_type) {
2051 case HCI_ACLDATA_PKT:
2052 case HCI_SCODATA_PKT:
2053 kfree_skb(skb);
2054 continue;
2055 }
2056 }
2057
2058 /* Process frame */
2059 switch (bt_cb(skb)->pkt_type) {
2060 case HCI_EVENT_PKT:
2061 hci_event_packet(hdev, skb);
2062 break;
2063
2064 case HCI_ACLDATA_PKT:
2065 BT_DBG("%s ACL data packet", hdev->name);
2066 hci_acldata_packet(hdev, skb);
2067 break;
2068
2069 case HCI_SCODATA_PKT:
2070 BT_DBG("%s SCO data packet", hdev->name);
2071 hci_scodata_packet(hdev, skb);
2072 break;
2073
2074 default:
2075 kfree_skb(skb);
2076 break;
2077 }
2078 }
2079
2080 read_unlock(&hci_task_lock);
2081 }
2082
2083 static void hci_cmd_task(unsigned long arg)
2084 {
2085 struct hci_dev *hdev = (struct hci_dev *) arg;
2086 struct sk_buff *skb;
2087
2088 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2089
2090 /* Send queued commands */
2091 if (atomic_read(&hdev->cmd_cnt)) {
2092 skb = skb_dequeue(&hdev->cmd_q);
2093 if (!skb)
2094 return;
2095
2096 kfree_skb(hdev->sent_cmd);
2097
2098 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2099 if (hdev->sent_cmd) {
2100 atomic_dec(&hdev->cmd_cnt);
2101 hci_send_frame(skb);
2102 mod_timer(&hdev->cmd_timer,
2103 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2104 } else {
2105 skb_queue_head(&hdev->cmd_q, skb);
2106 tasklet_schedule(&hdev->cmd_task);
2107 }
2108 }
2109 }
linux-next