Bluetooth: Remove some pointless conditionals before kfree_skb()
[linux-2.6.git] / net / bluetooth / hci_core.c
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22    SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI core. */
26
27 #include <linux/jiffies.h>
28 #include <linux/module.h>
29 #include <linux/kmod.h>
30
31 #include <linux/types.h>
32 #include <linux/errno.h>
33 #include <linux/kernel.h>
34 #include <linux/sched.h>
35 #include <linux/slab.h>
36 #include <linux/poll.h>
37 #include <linux/fcntl.h>
38 #include <linux/init.h>
39 #include <linux/skbuff.h>
40 #include <linux/interrupt.h>
41 #include <linux/notifier.h>
42 #include <net/sock.h>
43
44 #include <asm/system.h>
45 #include <asm/uaccess.h>
46 #include <asm/unaligned.h>
47
48 #include <net/bluetooth/bluetooth.h>
49 #include <net/bluetooth/hci_core.h>
50
51 static void hci_cmd_task(unsigned long arg);
52 static void hci_rx_task(unsigned long arg);
53 static void hci_tx_task(unsigned long arg);
54 static void hci_notify(struct hci_dev *hdev, int event);
55
56 static DEFINE_RWLOCK(hci_task_lock);
57
58 /* HCI device list */
59 LIST_HEAD(hci_dev_list);
60 DEFINE_RWLOCK(hci_dev_list_lock);
61
62 /* HCI callback list */
63 LIST_HEAD(hci_cb_list);
64 DEFINE_RWLOCK(hci_cb_list_lock);
65
66 /* HCI protocols */
67 #define HCI_MAX_PROTO   2
68 struct hci_proto *hci_proto[HCI_MAX_PROTO];
69
70 /* HCI notifiers list */
71 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
72
73 /* ---- HCI notifications ---- */
74
75 int hci_register_notifier(struct notifier_block *nb)
76 {
77         return atomic_notifier_chain_register(&hci_notifier, nb);
78 }
79
80 int hci_unregister_notifier(struct notifier_block *nb)
81 {
82         return atomic_notifier_chain_unregister(&hci_notifier, nb);
83 }
84
85 static void hci_notify(struct hci_dev *hdev, int event)
86 {
87         atomic_notifier_call_chain(&hci_notifier, event, hdev);
88 }
89
90 /* ---- HCI requests ---- */
91
92 void hci_req_complete(struct hci_dev *hdev, int result)
93 {
94         BT_DBG("%s result 0x%2.2x", hdev->name, result);
95
96         if (hdev->req_status == HCI_REQ_PEND) {
97                 hdev->req_result = result;
98                 hdev->req_status = HCI_REQ_DONE;
99                 wake_up_interruptible(&hdev->req_wait_q);
100         }
101 }
102
103 static void hci_req_cancel(struct hci_dev *hdev, int err)
104 {
105         BT_DBG("%s err 0x%2.2x", hdev->name, err);
106
107         if (hdev->req_status == HCI_REQ_PEND) {
108                 hdev->req_result = err;
109                 hdev->req_status = HCI_REQ_CANCELED;
110                 wake_up_interruptible(&hdev->req_wait_q);
111         }
112 }
113
114 /* Execute request and wait for completion. */
115 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
116                                 unsigned long opt, __u32 timeout)
117 {
118         DECLARE_WAITQUEUE(wait, current);
119         int err = 0;
120
121         BT_DBG("%s start", hdev->name);
122
123         hdev->req_status = HCI_REQ_PEND;
124
125         add_wait_queue(&hdev->req_wait_q, &wait);
126         set_current_state(TASK_INTERRUPTIBLE);
127
128         req(hdev, opt);
129         schedule_timeout(timeout);
130
131         remove_wait_queue(&hdev->req_wait_q, &wait);
132
133         if (signal_pending(current))
134                 return -EINTR;
135
136         switch (hdev->req_status) {
137         case HCI_REQ_DONE:
138                 err = -bt_err(hdev->req_result);
139                 break;
140
141         case HCI_REQ_CANCELED:
142                 err = -hdev->req_result;
143                 break;
144
145         default:
146                 err = -ETIMEDOUT;
147                 break;
148         }
149
150         hdev->req_status = hdev->req_result = 0;
151
152         BT_DBG("%s end: err %d", hdev->name, err);
153
154         return err;
155 }
156
157 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
158                                 unsigned long opt, __u32 timeout)
159 {
160         int ret;
161
162         if (!test_bit(HCI_UP, &hdev->flags))
163                 return -ENETDOWN;
164
165         /* Serialize all requests */
166         hci_req_lock(hdev);
167         ret = __hci_request(hdev, req, opt, timeout);
168         hci_req_unlock(hdev);
169
170         return ret;
171 }
172
173 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
174 {
175         BT_DBG("%s %ld", hdev->name, opt);
176
177         /* Reset device */
178         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
179 }
180
181 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
182 {
183         struct sk_buff *skb;
184         __le16 param;
185         __u8 flt_type;
186
187         BT_DBG("%s %ld", hdev->name, opt);
188
189         /* Driver initialization */
190
191         /* Special commands */
192         while ((skb = skb_dequeue(&hdev->driver_init))) {
193                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
194                 skb->dev = (void *) hdev;
195                 skb_queue_tail(&hdev->cmd_q, skb);
196                 hci_sched_cmd(hdev);
197         }
198         skb_queue_purge(&hdev->driver_init);
199
200         /* Mandatory initialization */
201
202         /* Reset */
203         if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks))
204                         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
205
206         /* Read Local Supported Features */
207         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
208
209         /* Read Local Version */
210         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
211
212         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
213         hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
214
215 #if 0
216         /* Host buffer size */
217         {
218                 struct hci_cp_host_buffer_size cp;
219                 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
220                 cp.sco_mtu = HCI_MAX_SCO_SIZE;
221                 cp.acl_max_pkt = cpu_to_le16(0xffff);
222                 cp.sco_max_pkt = cpu_to_le16(0xffff);
223                 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
224         }
225 #endif
226
227         /* Read BD Address */
228         hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
229
230         /* Read Class of Device */
231         hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
232
233         /* Read Local Name */
234         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
235
236         /* Read Voice Setting */
237         hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
238
239         /* Optional initialization */
240
241         /* Clear Event Filters */
242         flt_type = HCI_FLT_CLEAR_ALL;
243         hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
244
245         /* Page timeout ~20 secs */
246         param = cpu_to_le16(0x8000);
247         hci_send_cmd(hdev, HCI_OP_WRITE_PG_TIMEOUT, 2, &param);
248
249         /* Connection accept timeout ~20 secs */
250         param = cpu_to_le16(0x7d00);
251         hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
252 }
253
254 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
255 {
256         __u8 scan = opt;
257
258         BT_DBG("%s %x", hdev->name, scan);
259
260         /* Inquiry and Page scans */
261         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
262 }
263
264 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
265 {
266         __u8 auth = opt;
267
268         BT_DBG("%s %x", hdev->name, auth);
269
270         /* Authentication */
271         hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
272 }
273
274 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
275 {
276         __u8 encrypt = opt;
277
278         BT_DBG("%s %x", hdev->name, encrypt);
279
280         /* Encryption */
281         hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
282 }
283
284 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
285 {
286         __le16 policy = cpu_to_le16(opt);
287
288         BT_DBG("%s %x", hdev->name, policy);
289
290         /* Default link policy */
291         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
292 }
293
294 /* Get HCI device by index.
295  * Device is held on return. */
296 struct hci_dev *hci_dev_get(int index)
297 {
298         struct hci_dev *hdev = NULL;
299         struct list_head *p;
300
301         BT_DBG("%d", index);
302
303         if (index < 0)
304                 return NULL;
305
306         read_lock(&hci_dev_list_lock);
307         list_for_each(p, &hci_dev_list) {
308                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
309                 if (d->id == index) {
310                         hdev = hci_dev_hold(d);
311                         break;
312                 }
313         }
314         read_unlock(&hci_dev_list_lock);
315         return hdev;
316 }
317
318 /* ---- Inquiry support ---- */
319 static void inquiry_cache_flush(struct hci_dev *hdev)
320 {
321         struct inquiry_cache *cache = &hdev->inq_cache;
322         struct inquiry_entry *next  = cache->list, *e;
323
324         BT_DBG("cache %p", cache);
325
326         cache->list = NULL;
327         while ((e = next)) {
328                 next = e->next;
329                 kfree(e);
330         }
331 }
332
333 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
334 {
335         struct inquiry_cache *cache = &hdev->inq_cache;
336         struct inquiry_entry *e;
337
338         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
339
340         for (e = cache->list; e; e = e->next)
341                 if (!bacmp(&e->data.bdaddr, bdaddr))
342                         break;
343         return e;
344 }
345
346 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
347 {
348         struct inquiry_cache *cache = &hdev->inq_cache;
349         struct inquiry_entry *e;
350
351         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
352
353         if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
354                 /* Entry not in the cache. Add new one. */
355                 if (!(e = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
356                         return;
357                 e->next     = cache->list;
358                 cache->list = e;
359         }
360
361         memcpy(&e->data, data, sizeof(*data));
362         e->timestamp = jiffies;
363         cache->timestamp = jiffies;
364 }
365
366 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
367 {
368         struct inquiry_cache *cache = &hdev->inq_cache;
369         struct inquiry_info *info = (struct inquiry_info *) buf;
370         struct inquiry_entry *e;
371         int copied = 0;
372
373         for (e = cache->list; e && copied < num; e = e->next, copied++) {
374                 struct inquiry_data *data = &e->data;
375                 bacpy(&info->bdaddr, &data->bdaddr);
376                 info->pscan_rep_mode    = data->pscan_rep_mode;
377                 info->pscan_period_mode = data->pscan_period_mode;
378                 info->pscan_mode        = data->pscan_mode;
379                 memcpy(info->dev_class, data->dev_class, 3);
380                 info->clock_offset      = data->clock_offset;
381                 info++;
382         }
383
384         BT_DBG("cache %p, copied %d", cache, copied);
385         return copied;
386 }
387
388 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
389 {
390         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
391         struct hci_cp_inquiry cp;
392
393         BT_DBG("%s", hdev->name);
394
395         if (test_bit(HCI_INQUIRY, &hdev->flags))
396                 return;
397
398         /* Start Inquiry */
399         memcpy(&cp.lap, &ir->lap, 3);
400         cp.length  = ir->length;
401         cp.num_rsp = ir->num_rsp;
402         hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
403 }
404
405 int hci_inquiry(void __user *arg)
406 {
407         __u8 __user *ptr = arg;
408         struct hci_inquiry_req ir;
409         struct hci_dev *hdev;
410         int err = 0, do_inquiry = 0, max_rsp;
411         long timeo;
412         __u8 *buf;
413
414         if (copy_from_user(&ir, ptr, sizeof(ir)))
415                 return -EFAULT;
416
417         if (!(hdev = hci_dev_get(ir.dev_id)))
418                 return -ENODEV;
419
420         hci_dev_lock_bh(hdev);
421         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
422                                         inquiry_cache_empty(hdev) ||
423                                         ir.flags & IREQ_CACHE_FLUSH) {
424                 inquiry_cache_flush(hdev);
425                 do_inquiry = 1;
426         }
427         hci_dev_unlock_bh(hdev);
428
429         timeo = ir.length * msecs_to_jiffies(2000);
430         if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
431                 goto done;
432
433         /* for unlimited number of responses we will use buffer with 255 entries */
434         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
435
436         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
437          * copy it to the user space.
438          */
439         if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
440                 err = -ENOMEM;
441                 goto done;
442         }
443
444         hci_dev_lock_bh(hdev);
445         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
446         hci_dev_unlock_bh(hdev);
447
448         BT_DBG("num_rsp %d", ir.num_rsp);
449
450         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
451                 ptr += sizeof(ir);
452                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
453                                         ir.num_rsp))
454                         err = -EFAULT;
455         } else
456                 err = -EFAULT;
457
458         kfree(buf);
459
460 done:
461         hci_dev_put(hdev);
462         return err;
463 }
464
465 /* ---- HCI ioctl helpers ---- */
466
467 int hci_dev_open(__u16 dev)
468 {
469         struct hci_dev *hdev;
470         int ret = 0;
471
472         if (!(hdev = hci_dev_get(dev)))
473                 return -ENODEV;
474
475         BT_DBG("%s %p", hdev->name, hdev);
476
477         hci_req_lock(hdev);
478
479         if (test_bit(HCI_UP, &hdev->flags)) {
480                 ret = -EALREADY;
481                 goto done;
482         }
483
484         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
485                 set_bit(HCI_RAW, &hdev->flags);
486
487         if (hdev->open(hdev)) {
488                 ret = -EIO;
489                 goto done;
490         }
491
492         if (!test_bit(HCI_RAW, &hdev->flags)) {
493                 atomic_set(&hdev->cmd_cnt, 1);
494                 set_bit(HCI_INIT, &hdev->flags);
495
496                 //__hci_request(hdev, hci_reset_req, 0, HZ);
497                 ret = __hci_request(hdev, hci_init_req, 0,
498                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
499
500                 clear_bit(HCI_INIT, &hdev->flags);
501         }
502
503         if (!ret) {
504                 hci_dev_hold(hdev);
505                 set_bit(HCI_UP, &hdev->flags);
506                 hci_notify(hdev, HCI_DEV_UP);
507         } else {
508                 /* Init failed, cleanup */
509                 tasklet_kill(&hdev->rx_task);
510                 tasklet_kill(&hdev->tx_task);
511                 tasklet_kill(&hdev->cmd_task);
512
513                 skb_queue_purge(&hdev->cmd_q);
514                 skb_queue_purge(&hdev->rx_q);
515
516                 if (hdev->flush)
517                         hdev->flush(hdev);
518
519                 if (hdev->sent_cmd) {
520                         kfree_skb(hdev->sent_cmd);
521                         hdev->sent_cmd = NULL;
522                 }
523
524                 hdev->close(hdev);
525                 hdev->flags = 0;
526         }
527
528 done:
529         hci_req_unlock(hdev);
530         hci_dev_put(hdev);
531         return ret;
532 }
533
534 static int hci_dev_do_close(struct hci_dev *hdev)
535 {
536         BT_DBG("%s %p", hdev->name, hdev);
537
538         hci_req_cancel(hdev, ENODEV);
539         hci_req_lock(hdev);
540
541         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
542                 hci_req_unlock(hdev);
543                 return 0;
544         }
545
546         /* Kill RX and TX tasks */
547         tasklet_kill(&hdev->rx_task);
548         tasklet_kill(&hdev->tx_task);
549
550         hci_dev_lock_bh(hdev);
551         inquiry_cache_flush(hdev);
552         hci_conn_hash_flush(hdev);
553         hci_dev_unlock_bh(hdev);
554
555         hci_notify(hdev, HCI_DEV_DOWN);
556
557         if (hdev->flush)
558                 hdev->flush(hdev);
559
560         /* Reset device */
561         skb_queue_purge(&hdev->cmd_q);
562         atomic_set(&hdev->cmd_cnt, 1);
563         if (!test_bit(HCI_RAW, &hdev->flags)) {
564                 set_bit(HCI_INIT, &hdev->flags);
565                 __hci_request(hdev, hci_reset_req, 0,
566                                         msecs_to_jiffies(250));
567                 clear_bit(HCI_INIT, &hdev->flags);
568         }
569
570         /* Kill cmd task */
571         tasklet_kill(&hdev->cmd_task);
572
573         /* Drop queues */
574         skb_queue_purge(&hdev->rx_q);
575         skb_queue_purge(&hdev->cmd_q);
576         skb_queue_purge(&hdev->raw_q);
577
578         /* Drop last sent command */
579         if (hdev->sent_cmd) {
580                 kfree_skb(hdev->sent_cmd);
581                 hdev->sent_cmd = NULL;
582         }
583
584         /* After this point our queues are empty
585          * and no tasks are scheduled. */
586         hdev->close(hdev);
587
588         /* Clear flags */
589         hdev->flags = 0;
590
591         hci_req_unlock(hdev);
592
593         hci_dev_put(hdev);
594         return 0;
595 }
596
597 int hci_dev_close(__u16 dev)
598 {
599         struct hci_dev *hdev;
600         int err;
601
602         if (!(hdev = hci_dev_get(dev)))
603                 return -ENODEV;
604         err = hci_dev_do_close(hdev);
605         hci_dev_put(hdev);
606         return err;
607 }
608
609 int hci_dev_reset(__u16 dev)
610 {
611         struct hci_dev *hdev;
612         int ret = 0;
613
614         if (!(hdev = hci_dev_get(dev)))
615                 return -ENODEV;
616
617         hci_req_lock(hdev);
618         tasklet_disable(&hdev->tx_task);
619
620         if (!test_bit(HCI_UP, &hdev->flags))
621                 goto done;
622
623         /* Drop queues */
624         skb_queue_purge(&hdev->rx_q);
625         skb_queue_purge(&hdev->cmd_q);
626
627         hci_dev_lock_bh(hdev);
628         inquiry_cache_flush(hdev);
629         hci_conn_hash_flush(hdev);
630         hci_dev_unlock_bh(hdev);
631
632         if (hdev->flush)
633                 hdev->flush(hdev);
634
635         atomic_set(&hdev->cmd_cnt, 1);
636         hdev->acl_cnt = 0; hdev->sco_cnt = 0;
637
638         if (!test_bit(HCI_RAW, &hdev->flags))
639                 ret = __hci_request(hdev, hci_reset_req, 0,
640                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
641
642 done:
643         tasklet_enable(&hdev->tx_task);
644         hci_req_unlock(hdev);
645         hci_dev_put(hdev);
646         return ret;
647 }
648
649 int hci_dev_reset_stat(__u16 dev)
650 {
651         struct hci_dev *hdev;
652         int ret = 0;
653
654         if (!(hdev = hci_dev_get(dev)))
655                 return -ENODEV;
656
657         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
658
659         hci_dev_put(hdev);
660
661         return ret;
662 }
663
664 int hci_dev_cmd(unsigned int cmd, void __user *arg)
665 {
666         struct hci_dev *hdev;
667         struct hci_dev_req dr;
668         int err = 0;
669
670         if (copy_from_user(&dr, arg, sizeof(dr)))
671                 return -EFAULT;
672
673         if (!(hdev = hci_dev_get(dr.dev_id)))
674                 return -ENODEV;
675
676         switch (cmd) {
677         case HCISETAUTH:
678                 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
679                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
680                 break;
681
682         case HCISETENCRYPT:
683                 if (!lmp_encrypt_capable(hdev)) {
684                         err = -EOPNOTSUPP;
685                         break;
686                 }
687
688                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
689                         /* Auth must be enabled first */
690                         err = hci_request(hdev, hci_auth_req, dr.dev_opt,
691                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
692                         if (err)
693                                 break;
694                 }
695
696                 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
697                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
698                 break;
699
700         case HCISETSCAN:
701                 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
702                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
703                 break;
704
705         case HCISETLINKPOL:
706                 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
707                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
708                 break;
709
710         case HCISETLINKMODE:
711                 hdev->link_mode = ((__u16) dr.dev_opt) &
712                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
713                 break;
714
715         case HCISETPTYPE:
716                 hdev->pkt_type = (__u16) dr.dev_opt;
717                 break;
718
719         case HCISETACLMTU:
720                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
721                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
722                 break;
723
724         case HCISETSCOMTU:
725                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
726                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
727                 break;
728
729         default:
730                 err = -EINVAL;
731                 break;
732         }
733
734         hci_dev_put(hdev);
735         return err;
736 }
737
738 int hci_get_dev_list(void __user *arg)
739 {
740         struct hci_dev_list_req *dl;
741         struct hci_dev_req *dr;
742         struct list_head *p;
743         int n = 0, size, err;
744         __u16 dev_num;
745
746         if (get_user(dev_num, (__u16 __user *) arg))
747                 return -EFAULT;
748
749         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
750                 return -EINVAL;
751
752         size = sizeof(*dl) + dev_num * sizeof(*dr);
753
754         if (!(dl = kzalloc(size, GFP_KERNEL)))
755                 return -ENOMEM;
756
757         dr = dl->dev_req;
758
759         read_lock_bh(&hci_dev_list_lock);
760         list_for_each(p, &hci_dev_list) {
761                 struct hci_dev *hdev;
762                 hdev = list_entry(p, struct hci_dev, list);
763                 (dr + n)->dev_id  = hdev->id;
764                 (dr + n)->dev_opt = hdev->flags;
765                 if (++n >= dev_num)
766                         break;
767         }
768         read_unlock_bh(&hci_dev_list_lock);
769
770         dl->dev_num = n;
771         size = sizeof(*dl) + n * sizeof(*dr);
772
773         err = copy_to_user(arg, dl, size);
774         kfree(dl);
775
776         return err ? -EFAULT : 0;
777 }
778
779 int hci_get_dev_info(void __user *arg)
780 {
781         struct hci_dev *hdev;
782         struct hci_dev_info di;
783         int err = 0;
784
785         if (copy_from_user(&di, arg, sizeof(di)))
786                 return -EFAULT;
787
788         if (!(hdev = hci_dev_get(di.dev_id)))
789                 return -ENODEV;
790
791         strcpy(di.name, hdev->name);
792         di.bdaddr   = hdev->bdaddr;
793         di.type     = hdev->type;
794         di.flags    = hdev->flags;
795         di.pkt_type = hdev->pkt_type;
796         di.acl_mtu  = hdev->acl_mtu;
797         di.acl_pkts = hdev->acl_pkts;
798         di.sco_mtu  = hdev->sco_mtu;
799         di.sco_pkts = hdev->sco_pkts;
800         di.link_policy = hdev->link_policy;
801         di.link_mode   = hdev->link_mode;
802
803         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
804         memcpy(&di.features, &hdev->features, sizeof(di.features));
805
806         if (copy_to_user(arg, &di, sizeof(di)))
807                 err = -EFAULT;
808
809         hci_dev_put(hdev);
810
811         return err;
812 }
813
814 /* ---- Interface to HCI drivers ---- */
815
816 /* Alloc HCI device */
817 struct hci_dev *hci_alloc_dev(void)
818 {
819         struct hci_dev *hdev;
820
821         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
822         if (!hdev)
823                 return NULL;
824
825         skb_queue_head_init(&hdev->driver_init);
826
827         return hdev;
828 }
829 EXPORT_SYMBOL(hci_alloc_dev);
830
831 /* Free HCI device */
832 void hci_free_dev(struct hci_dev *hdev)
833 {
834         skb_queue_purge(&hdev->driver_init);
835
836         /* will free via device release */
837         put_device(&hdev->dev);
838 }
839 EXPORT_SYMBOL(hci_free_dev);
840
841 /* Register HCI device */
842 int hci_register_dev(struct hci_dev *hdev)
843 {
844         struct list_head *head = &hci_dev_list, *p;
845         int i, id = 0;
846
847         BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner);
848
849         if (!hdev->open || !hdev->close || !hdev->destruct)
850                 return -EINVAL;
851
852         write_lock_bh(&hci_dev_list_lock);
853
854         /* Find first available device id */
855         list_for_each(p, &hci_dev_list) {
856                 if (list_entry(p, struct hci_dev, list)->id != id)
857                         break;
858                 head = p; id++;
859         }
860
861         sprintf(hdev->name, "hci%d", id);
862         hdev->id = id;
863         list_add(&hdev->list, head);
864
865         atomic_set(&hdev->refcnt, 1);
866         spin_lock_init(&hdev->lock);
867
868         hdev->flags = 0;
869         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
870         hdev->esco_type = (ESCO_HV1);
871         hdev->link_mode = (HCI_LM_ACCEPT);
872
873         hdev->idle_timeout = 0;
874         hdev->sniff_max_interval = 800;
875         hdev->sniff_min_interval = 80;
876
877         tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
878         tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
879         tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
880
881         skb_queue_head_init(&hdev->rx_q);
882         skb_queue_head_init(&hdev->cmd_q);
883         skb_queue_head_init(&hdev->raw_q);
884
885         for (i = 0; i < 3; i++)
886                 hdev->reassembly[i] = NULL;
887
888         init_waitqueue_head(&hdev->req_wait_q);
889         init_MUTEX(&hdev->req_lock);
890
891         inquiry_cache_init(hdev);
892
893         hci_conn_hash_init(hdev);
894
895         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
896
897         atomic_set(&hdev->promisc, 0);
898
899         write_unlock_bh(&hci_dev_list_lock);
900
901         hci_register_sysfs(hdev);
902
903         hci_notify(hdev, HCI_DEV_REG);
904
905         return id;
906 }
907 EXPORT_SYMBOL(hci_register_dev);
908
909 /* Unregister HCI device */
910 int hci_unregister_dev(struct hci_dev *hdev)
911 {
912         int i;
913
914         BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
915
916         write_lock_bh(&hci_dev_list_lock);
917         list_del(&hdev->list);
918         write_unlock_bh(&hci_dev_list_lock);
919
920         hci_dev_do_close(hdev);
921
922         for (i = 0; i < 3; i++)
923                 kfree_skb(hdev->reassembly[i]);
924
925         hci_notify(hdev, HCI_DEV_UNREG);
926
927         hci_unregister_sysfs(hdev);
928
929         __hci_dev_put(hdev);
930
931         return 0;
932 }
933 EXPORT_SYMBOL(hci_unregister_dev);
934
935 /* Suspend HCI device */
936 int hci_suspend_dev(struct hci_dev *hdev)
937 {
938         hci_notify(hdev, HCI_DEV_SUSPEND);
939         return 0;
940 }
941 EXPORT_SYMBOL(hci_suspend_dev);
942
943 /* Resume HCI device */
944 int hci_resume_dev(struct hci_dev *hdev)
945 {
946         hci_notify(hdev, HCI_DEV_RESUME);
947         return 0;
948 }
949 EXPORT_SYMBOL(hci_resume_dev);
950
951 /* Receive packet type fragment */
952 #define __reassembly(hdev, type)  ((hdev)->reassembly[(type) - 2])
953
954 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
955 {
956         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
957                 return -EILSEQ;
958
959         while (count) {
960                 struct sk_buff *skb = __reassembly(hdev, type);
961                 struct { int expect; } *scb;
962                 int len = 0;
963
964                 if (!skb) {
965                         /* Start of the frame */
966
967                         switch (type) {
968                         case HCI_EVENT_PKT:
969                                 if (count >= HCI_EVENT_HDR_SIZE) {
970                                         struct hci_event_hdr *h = data;
971                                         len = HCI_EVENT_HDR_SIZE + h->plen;
972                                 } else
973                                         return -EILSEQ;
974                                 break;
975
976                         case HCI_ACLDATA_PKT:
977                                 if (count >= HCI_ACL_HDR_SIZE) {
978                                         struct hci_acl_hdr *h = data;
979                                         len = HCI_ACL_HDR_SIZE + __le16_to_cpu(h->dlen);
980                                 } else
981                                         return -EILSEQ;
982                                 break;
983
984                         case HCI_SCODATA_PKT:
985                                 if (count >= HCI_SCO_HDR_SIZE) {
986                                         struct hci_sco_hdr *h = data;
987                                         len = HCI_SCO_HDR_SIZE + h->dlen;
988                                 } else
989                                         return -EILSEQ;
990                                 break;
991                         }
992
993                         skb = bt_skb_alloc(len, GFP_ATOMIC);
994                         if (!skb) {
995                                 BT_ERR("%s no memory for packet", hdev->name);
996                                 return -ENOMEM;
997                         }
998
999                         skb->dev = (void *) hdev;
1000                         bt_cb(skb)->pkt_type = type;
1001
1002                         __reassembly(hdev, type) = skb;
1003
1004                         scb = (void *) skb->cb;
1005                         scb->expect = len;
1006                 } else {
1007                         /* Continuation */
1008
1009                         scb = (void *) skb->cb;
1010                         len = scb->expect;
1011                 }
1012
1013                 len = min(len, count);
1014
1015                 memcpy(skb_put(skb, len), data, len);
1016
1017                 scb->expect -= len;
1018
1019                 if (scb->expect == 0) {
1020                         /* Complete frame */
1021
1022                         __reassembly(hdev, type) = NULL;
1023
1024                         bt_cb(skb)->pkt_type = type;
1025                         hci_recv_frame(skb);
1026                 }
1027
1028                 count -= len; data += len;
1029         }
1030
1031         return 0;
1032 }
1033 EXPORT_SYMBOL(hci_recv_fragment);
1034
1035 /* ---- Interface to upper protocols ---- */
1036
1037 /* Register/Unregister protocols.
1038  * hci_task_lock is used to ensure that no tasks are running. */
1039 int hci_register_proto(struct hci_proto *hp)
1040 {
1041         int err = 0;
1042
1043         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1044
1045         if (hp->id >= HCI_MAX_PROTO)
1046                 return -EINVAL;
1047
1048         write_lock_bh(&hci_task_lock);
1049
1050         if (!hci_proto[hp->id])
1051                 hci_proto[hp->id] = hp;
1052         else
1053                 err = -EEXIST;
1054
1055         write_unlock_bh(&hci_task_lock);
1056
1057         return err;
1058 }
1059 EXPORT_SYMBOL(hci_register_proto);
1060
1061 int hci_unregister_proto(struct hci_proto *hp)
1062 {
1063         int err = 0;
1064
1065         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1066
1067         if (hp->id >= HCI_MAX_PROTO)
1068                 return -EINVAL;
1069
1070         write_lock_bh(&hci_task_lock);
1071
1072         if (hci_proto[hp->id])
1073                 hci_proto[hp->id] = NULL;
1074         else
1075                 err = -ENOENT;
1076
1077         write_unlock_bh(&hci_task_lock);
1078
1079         return err;
1080 }
1081 EXPORT_SYMBOL(hci_unregister_proto);
1082
1083 int hci_register_cb(struct hci_cb *cb)
1084 {
1085         BT_DBG("%p name %s", cb, cb->name);
1086
1087         write_lock_bh(&hci_cb_list_lock);
1088         list_add(&cb->list, &hci_cb_list);
1089         write_unlock_bh(&hci_cb_list_lock);
1090
1091         return 0;
1092 }
1093 EXPORT_SYMBOL(hci_register_cb);
1094
1095 int hci_unregister_cb(struct hci_cb *cb)
1096 {
1097         BT_DBG("%p name %s", cb, cb->name);
1098
1099         write_lock_bh(&hci_cb_list_lock);
1100         list_del(&cb->list);
1101         write_unlock_bh(&hci_cb_list_lock);
1102
1103         return 0;
1104 }
1105 EXPORT_SYMBOL(hci_unregister_cb);
1106
1107 static int hci_send_frame(struct sk_buff *skb)
1108 {
1109         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1110
1111         if (!hdev) {
1112                 kfree_skb(skb);
1113                 return -ENODEV;
1114         }
1115
1116         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1117
1118         if (atomic_read(&hdev->promisc)) {
1119                 /* Time stamp */
1120                 __net_timestamp(skb);
1121
1122                 hci_send_to_sock(hdev, skb);
1123         }
1124
1125         /* Get rid of skb owner, prior to sending to the driver. */
1126         skb_orphan(skb);
1127
1128         return hdev->send(skb);
1129 }
1130
1131 /* Send HCI command */
1132 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1133 {
1134         int len = HCI_COMMAND_HDR_SIZE + plen;
1135         struct hci_command_hdr *hdr;
1136         struct sk_buff *skb;
1137
1138         BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1139
1140         skb = bt_skb_alloc(len, GFP_ATOMIC);
1141         if (!skb) {
1142                 BT_ERR("%s no memory for command", hdev->name);
1143                 return -ENOMEM;
1144         }
1145
1146         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1147         hdr->opcode = cpu_to_le16(opcode);
1148         hdr->plen   = plen;
1149
1150         if (plen)
1151                 memcpy(skb_put(skb, plen), param, plen);
1152
1153         BT_DBG("skb len %d", skb->len);
1154
1155         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1156         skb->dev = (void *) hdev;
1157         skb_queue_tail(&hdev->cmd_q, skb);
1158         hci_sched_cmd(hdev);
1159
1160         return 0;
1161 }
1162
1163 /* Get data from the previously sent command */
1164 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1165 {
1166         struct hci_command_hdr *hdr;
1167
1168         if (!hdev->sent_cmd)
1169                 return NULL;
1170
1171         hdr = (void *) hdev->sent_cmd->data;
1172
1173         if (hdr->opcode != cpu_to_le16(opcode))
1174                 return NULL;
1175
1176         BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1177
1178         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1179 }
1180
1181 /* Send ACL data */
1182 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1183 {
1184         struct hci_acl_hdr *hdr;
1185         int len = skb->len;
1186
1187         skb_push(skb, HCI_ACL_HDR_SIZE);
1188         skb_reset_transport_header(skb);
1189         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
1190         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1191         hdr->dlen   = cpu_to_le16(len);
1192 }
1193
1194 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1195 {
1196         struct hci_dev *hdev = conn->hdev;
1197         struct sk_buff *list;
1198
1199         BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1200
1201         skb->dev = (void *) hdev;
1202         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1203         hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
1204
1205         if (!(list = skb_shinfo(skb)->frag_list)) {
1206                 /* Non fragmented */
1207                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1208
1209                 skb_queue_tail(&conn->data_q, skb);
1210         } else {
1211                 /* Fragmented */
1212                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1213
1214                 skb_shinfo(skb)->frag_list = NULL;
1215
1216                 /* Queue all fragments atomically */
1217                 spin_lock_bh(&conn->data_q.lock);
1218
1219                 __skb_queue_tail(&conn->data_q, skb);
1220                 do {
1221                         skb = list; list = list->next;
1222
1223                         skb->dev = (void *) hdev;
1224                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1225                         hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
1226
1227                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1228
1229                         __skb_queue_tail(&conn->data_q, skb);
1230                 } while (list);
1231
1232                 spin_unlock_bh(&conn->data_q.lock);
1233         }
1234
1235         hci_sched_tx(hdev);
1236         return 0;
1237 }
1238 EXPORT_SYMBOL(hci_send_acl);
1239
1240 /* Send SCO data */
1241 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1242 {
1243         struct hci_dev *hdev = conn->hdev;
1244         struct hci_sco_hdr hdr;
1245
1246         BT_DBG("%s len %d", hdev->name, skb->len);
1247
1248         if (skb->len > hdev->sco_mtu) {
1249                 kfree_skb(skb);
1250                 return -EINVAL;
1251         }
1252
1253         hdr.handle = cpu_to_le16(conn->handle);
1254         hdr.dlen   = skb->len;
1255
1256         skb_push(skb, HCI_SCO_HDR_SIZE);
1257         skb_reset_transport_header(skb);
1258         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1259
1260         skb->dev = (void *) hdev;
1261         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1262         skb_queue_tail(&conn->data_q, skb);
1263         hci_sched_tx(hdev);
1264         return 0;
1265 }
1266 EXPORT_SYMBOL(hci_send_sco);
1267
1268 /* ---- HCI TX task (outgoing data) ---- */
1269
1270 /* HCI Connection scheduler */
1271 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1272 {
1273         struct hci_conn_hash *h = &hdev->conn_hash;
1274         struct hci_conn *conn = NULL;
1275         int num = 0, min = ~0;
1276         struct list_head *p;
1277
1278         /* We don't have to lock device here. Connections are always
1279          * added and removed with TX task disabled. */
1280         list_for_each(p, &h->list) {
1281                 struct hci_conn *c;
1282                 c = list_entry(p, struct hci_conn, list);
1283
1284                 if (c->type != type || skb_queue_empty(&c->data_q))
1285                         continue;
1286
1287                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1288                         continue;
1289
1290                 num++;
1291
1292                 if (c->sent < min) {
1293                         min  = c->sent;
1294                         conn = c;
1295                 }
1296         }
1297
1298         if (conn) {
1299                 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
1300                 int q = cnt / num;
1301                 *quote = q ? q : 1;
1302         } else
1303                 *quote = 0;
1304
1305         BT_DBG("conn %p quote %d", conn, *quote);
1306         return conn;
1307 }
1308
1309 static inline void hci_acl_tx_to(struct hci_dev *hdev)
1310 {
1311         struct hci_conn_hash *h = &hdev->conn_hash;
1312         struct list_head *p;
1313         struct hci_conn  *c;
1314
1315         BT_ERR("%s ACL tx timeout", hdev->name);
1316
1317         /* Kill stalled connections */
1318         list_for_each(p, &h->list) {
1319                 c = list_entry(p, struct hci_conn, list);
1320                 if (c->type == ACL_LINK && c->sent) {
1321                         BT_ERR("%s killing stalled ACL connection %s",
1322                                 hdev->name, batostr(&c->dst));
1323                         hci_acl_disconn(c, 0x13);
1324                 }
1325         }
1326 }
1327
1328 static inline void hci_sched_acl(struct hci_dev *hdev)
1329 {
1330         struct hci_conn *conn;
1331         struct sk_buff *skb;
1332         int quote;
1333
1334         BT_DBG("%s", hdev->name);
1335
1336         if (!test_bit(HCI_RAW, &hdev->flags)) {
1337                 /* ACL tx timeout must be longer than maximum
1338                  * link supervision timeout (40.9 seconds) */
1339                 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
1340                         hci_acl_tx_to(hdev);
1341         }
1342
1343         while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1344                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1345                         BT_DBG("skb %p len %d", skb, skb->len);
1346
1347                         hci_conn_enter_active_mode(conn);
1348
1349                         hci_send_frame(skb);
1350                         hdev->acl_last_tx = jiffies;
1351
1352                         hdev->acl_cnt--;
1353                         conn->sent++;
1354                 }
1355         }
1356 }
1357
1358 /* Schedule SCO */
1359 static inline void hci_sched_sco(struct hci_dev *hdev)
1360 {
1361         struct hci_conn *conn;
1362         struct sk_buff *skb;
1363         int quote;
1364
1365         BT_DBG("%s", hdev->name);
1366
1367         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1368                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1369                         BT_DBG("skb %p len %d", skb, skb->len);
1370                         hci_send_frame(skb);
1371
1372                         conn->sent++;
1373                         if (conn->sent == ~0)
1374                                 conn->sent = 0;
1375                 }
1376         }
1377 }
1378
1379 static inline void hci_sched_esco(struct hci_dev *hdev)
1380 {
1381         struct hci_conn *conn;
1382         struct sk_buff *skb;
1383         int quote;
1384
1385         BT_DBG("%s", hdev->name);
1386
1387         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1388                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1389                         BT_DBG("skb %p len %d", skb, skb->len);
1390                         hci_send_frame(skb);
1391
1392                         conn->sent++;
1393                         if (conn->sent == ~0)
1394                                 conn->sent = 0;
1395                 }
1396         }
1397 }
1398
1399 static void hci_tx_task(unsigned long arg)
1400 {
1401         struct hci_dev *hdev = (struct hci_dev *) arg;
1402         struct sk_buff *skb;
1403
1404         read_lock(&hci_task_lock);
1405
1406         BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
1407
1408         /* Schedule queues and send stuff to HCI driver */
1409
1410         hci_sched_acl(hdev);
1411
1412         hci_sched_sco(hdev);
1413
1414         hci_sched_esco(hdev);
1415
1416         /* Send next queued raw (unknown type) packet */
1417         while ((skb = skb_dequeue(&hdev->raw_q)))
1418                 hci_send_frame(skb);
1419
1420         read_unlock(&hci_task_lock);
1421 }
1422
1423 /* ----- HCI RX task (incoming data proccessing) ----- */
1424
1425 /* ACL data packet */
1426 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1427 {
1428         struct hci_acl_hdr *hdr = (void *) skb->data;
1429         struct hci_conn *conn;
1430         __u16 handle, flags;
1431
1432         skb_pull(skb, HCI_ACL_HDR_SIZE);
1433
1434         handle = __le16_to_cpu(hdr->handle);
1435         flags  = hci_flags(handle);
1436         handle = hci_handle(handle);
1437
1438         BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1439
1440         hdev->stat.acl_rx++;
1441
1442         hci_dev_lock(hdev);
1443         conn = hci_conn_hash_lookup_handle(hdev, handle);
1444         hci_dev_unlock(hdev);
1445
1446         if (conn) {
1447                 register struct hci_proto *hp;
1448
1449                 hci_conn_enter_active_mode(conn);
1450
1451                 /* Send to upper protocol */
1452                 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
1453                         hp->recv_acldata(conn, skb, flags);
1454                         return;
1455                 }
1456         } else {
1457                 BT_ERR("%s ACL packet for unknown connection handle %d",
1458                         hdev->name, handle);
1459         }
1460
1461         kfree_skb(skb);
1462 }
1463
1464 /* SCO data packet */
1465 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1466 {
1467         struct hci_sco_hdr *hdr = (void *) skb->data;
1468         struct hci_conn *conn;
1469         __u16 handle;
1470
1471         skb_pull(skb, HCI_SCO_HDR_SIZE);
1472
1473         handle = __le16_to_cpu(hdr->handle);
1474
1475         BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1476
1477         hdev->stat.sco_rx++;
1478
1479         hci_dev_lock(hdev);
1480         conn = hci_conn_hash_lookup_handle(hdev, handle);
1481         hci_dev_unlock(hdev);
1482
1483         if (conn) {
1484                 register struct hci_proto *hp;
1485
1486                 /* Send to upper protocol */
1487                 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
1488                         hp->recv_scodata(conn, skb);
1489                         return;
1490                 }
1491         } else {
1492                 BT_ERR("%s SCO packet for unknown connection handle %d",
1493                         hdev->name, handle);
1494         }
1495
1496         kfree_skb(skb);
1497 }
1498
1499 static void hci_rx_task(unsigned long arg)
1500 {
1501         struct hci_dev *hdev = (struct hci_dev *) arg;
1502         struct sk_buff *skb;
1503
1504         BT_DBG("%s", hdev->name);
1505
1506         read_lock(&hci_task_lock);
1507
1508         while ((skb = skb_dequeue(&hdev->rx_q))) {
1509                 if (atomic_read(&hdev->promisc)) {
1510                         /* Send copy to the sockets */
1511                         hci_send_to_sock(hdev, skb);
1512                 }
1513
1514                 if (test_bit(HCI_RAW, &hdev->flags)) {
1515                         kfree_skb(skb);
1516                         continue;
1517                 }
1518
1519                 if (test_bit(HCI_INIT, &hdev->flags)) {
1520                         /* Don't process data packets in this states. */
1521                         switch (bt_cb(skb)->pkt_type) {
1522                         case HCI_ACLDATA_PKT:
1523                         case HCI_SCODATA_PKT:
1524                                 kfree_skb(skb);
1525                                 continue;
1526                         }
1527                 }
1528
1529                 /* Process frame */
1530                 switch (bt_cb(skb)->pkt_type) {
1531                 case HCI_EVENT_PKT:
1532                         hci_event_packet(hdev, skb);
1533                         break;
1534
1535                 case HCI_ACLDATA_PKT:
1536                         BT_DBG("%s ACL data packet", hdev->name);
1537                         hci_acldata_packet(hdev, skb);
1538                         break;
1539
1540                 case HCI_SCODATA_PKT:
1541                         BT_DBG("%s SCO data packet", hdev->name);
1542                         hci_scodata_packet(hdev, skb);
1543                         break;
1544
1545                 default:
1546                         kfree_skb(skb);
1547                         break;
1548                 }
1549         }
1550
1551         read_unlock(&hci_task_lock);
1552 }
1553
1554 static void hci_cmd_task(unsigned long arg)
1555 {
1556         struct hci_dev *hdev = (struct hci_dev *) arg;
1557         struct sk_buff *skb;
1558
1559         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
1560
1561         if (!atomic_read(&hdev->cmd_cnt) && time_after(jiffies, hdev->cmd_last_tx + HZ)) {
1562                 BT_ERR("%s command tx timeout", hdev->name);
1563                 atomic_set(&hdev->cmd_cnt, 1);
1564         }
1565
1566         /* Send queued commands */
1567         if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
1568                 kfree_skb(hdev->sent_cmd);
1569
1570                 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
1571                         atomic_dec(&hdev->cmd_cnt);
1572                         hci_send_frame(skb);
1573                         hdev->cmd_last_tx = jiffies;
1574                 } else {
1575                         skb_queue_head(&hdev->cmd_q, skb);
1576                         hci_sched_cmd(hdev);
1577                 }
1578         }
1579 }