[PATCH] kill gratitious includes of major.h under net/*
[linux-2.6.git] / net / bluetooth / hci_core.c
1 /* 
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4
5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7    This program is free software; you can redistribute it and/or modify
8    it under the terms of the GNU General Public License version 2 as
9    published by the Free Software Foundation;
10
11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 
16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 
17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 
18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 
21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 
22    SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI core. */
26
27 #include <linux/config.h>
28 #include <linux/module.h>
29 #include <linux/kmod.h>
30
31 #include <linux/types.h>
32 #include <linux/errno.h>
33 #include <linux/kernel.h>
34 #include <linux/sched.h>
35 #include <linux/slab.h>
36 #include <linux/poll.h>
37 #include <linux/fcntl.h>
38 #include <linux/init.h>
39 #include <linux/skbuff.h>
40 #include <linux/interrupt.h>
41 #include <linux/notifier.h>
42 #include <net/sock.h>
43
44 #include <asm/system.h>
45 #include <asm/uaccess.h>
46 #include <asm/unaligned.h>
47
48 #include <net/bluetooth/bluetooth.h>
49 #include <net/bluetooth/hci_core.h>
50
51 #ifndef CONFIG_BT_HCI_CORE_DEBUG
52 #undef  BT_DBG
53 #define BT_DBG(D...)
54 #endif
55
56 static void hci_cmd_task(unsigned long arg);
57 static void hci_rx_task(unsigned long arg);
58 static void hci_tx_task(unsigned long arg);
59 static void hci_notify(struct hci_dev *hdev, int event);
60
61 static DEFINE_RWLOCK(hci_task_lock);
62
63 /* HCI device list */
64 LIST_HEAD(hci_dev_list);
65 DEFINE_RWLOCK(hci_dev_list_lock);
66
67 /* HCI callback list */
68 LIST_HEAD(hci_cb_list);
69 DEFINE_RWLOCK(hci_cb_list_lock);
70
71 /* HCI protocols */
72 #define HCI_MAX_PROTO   2
73 struct hci_proto *hci_proto[HCI_MAX_PROTO];
74
75 /* HCI notifiers list */
76 static struct notifier_block *hci_notifier;
77
78 /* ---- HCI notifications ---- */
79
80 int hci_register_notifier(struct notifier_block *nb)
81 {
82         return notifier_chain_register(&hci_notifier, nb);
83 }
84
85 int hci_unregister_notifier(struct notifier_block *nb)
86 {
87         return notifier_chain_unregister(&hci_notifier, nb);
88 }
89
90 void hci_notify(struct hci_dev *hdev, int event)
91 {
92         notifier_call_chain(&hci_notifier, event, hdev);
93 }
94
95 /* ---- HCI requests ---- */
96
97 void hci_req_complete(struct hci_dev *hdev, int result)
98 {
99         BT_DBG("%s result 0x%2.2x", hdev->name, result);
100
101         if (hdev->req_status == HCI_REQ_PEND) {
102                 hdev->req_result = result;
103                 hdev->req_status = HCI_REQ_DONE;
104                 wake_up_interruptible(&hdev->req_wait_q);
105         }
106 }
107
108 static void hci_req_cancel(struct hci_dev *hdev, int err)
109 {
110         BT_DBG("%s err 0x%2.2x", hdev->name, err);
111
112         if (hdev->req_status == HCI_REQ_PEND) {
113                 hdev->req_result = err;
114                 hdev->req_status = HCI_REQ_CANCELED;
115                 wake_up_interruptible(&hdev->req_wait_q);
116         }
117 }
118
119 /* Execute request and wait for completion. */
120 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt), 
121                                 unsigned long opt, __u32 timeout)
122 {
123         DECLARE_WAITQUEUE(wait, current);
124         int err = 0;
125
126         BT_DBG("%s start", hdev->name);
127
128         hdev->req_status = HCI_REQ_PEND;
129
130         add_wait_queue(&hdev->req_wait_q, &wait);
131         set_current_state(TASK_INTERRUPTIBLE);
132
133         req(hdev, opt);
134         schedule_timeout(timeout);
135
136         remove_wait_queue(&hdev->req_wait_q, &wait);
137
138         if (signal_pending(current))
139                 return -EINTR;
140
141         switch (hdev->req_status) {
142         case HCI_REQ_DONE:
143                 err = -bt_err(hdev->req_result);
144                 break;
145
146         case HCI_REQ_CANCELED:
147                 err = -hdev->req_result;
148                 break;
149
150         default:
151                 err = -ETIMEDOUT;
152                 break;
153         };
154
155         hdev->req_status = hdev->req_result = 0;
156
157         BT_DBG("%s end: err %d", hdev->name, err);
158
159         return err;
160 }
161
162 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
163                                 unsigned long opt, __u32 timeout)
164 {
165         int ret;
166
167         /* Serialize all requests */
168         hci_req_lock(hdev);
169         ret = __hci_request(hdev, req, opt, timeout);
170         hci_req_unlock(hdev);
171
172         return ret;
173 }
174
175 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
176 {
177         BT_DBG("%s %ld", hdev->name, opt);
178
179         /* Reset device */
180         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
181 }
182
183 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
184 {
185         struct sk_buff *skb;
186         __u16 param;
187
188         BT_DBG("%s %ld", hdev->name, opt);
189
190         /* Driver initialization */
191
192         /* Special commands */
193         while ((skb = skb_dequeue(&hdev->driver_init))) {
194                 skb->pkt_type = HCI_COMMAND_PKT;
195                 skb->dev = (void *) hdev;
196                 skb_queue_tail(&hdev->cmd_q, skb);
197                 hci_sched_cmd(hdev);
198         }
199         skb_queue_purge(&hdev->driver_init);
200
201         /* Mandatory initialization */
202
203         /* Reset */
204         if (test_bit(HCI_QUIRK_RESET_ON_INIT, &hdev->quirks))
205                         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_RESET, 0, NULL);
206
207         /* Read Local Supported Features */
208         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_LOCAL_FEATURES, 0, NULL);
209
210         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
211         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BUFFER_SIZE, 0, NULL);
212
213 #if 0
214         /* Host buffer size */
215         {
216                 struct hci_cp_host_buffer_size cp;
217                 cp.acl_mtu = __cpu_to_le16(HCI_MAX_ACL_SIZE);
218                 cp.sco_mtu = HCI_MAX_SCO_SIZE;
219                 cp.acl_max_pkt = __cpu_to_le16(0xffff);
220                 cp.sco_max_pkt = __cpu_to_le16(0xffff);
221                 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_HOST_BUFFER_SIZE, sizeof(cp), &cp);
222         }
223 #endif
224
225         /* Read BD Address */
226         hci_send_cmd(hdev, OGF_INFO_PARAM, OCF_READ_BD_ADDR, 0, NULL);
227
228         /* Read Voice Setting */
229         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_READ_VOICE_SETTING, 0, NULL);
230
231         /* Optional initialization */
232
233         /* Clear Event Filters */
234         {
235                 struct hci_cp_set_event_flt cp;
236                 cp.flt_type  = HCI_FLT_CLEAR_ALL;
237                 hci_send_cmd(hdev, OGF_HOST_CTL, OCF_SET_EVENT_FLT, sizeof(cp), &cp);
238         }
239
240         /* Page timeout ~20 secs */
241         param = __cpu_to_le16(0x8000);
242         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_PG_TIMEOUT, 2, &param);
243
244         /* Connection accept timeout ~20 secs */
245         param = __cpu_to_le16(0x7d00);
246         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_CA_TIMEOUT, 2, &param);
247 }
248
249 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
250 {
251         __u8 scan = opt;
252
253         BT_DBG("%s %x", hdev->name, scan);
254
255         /* Inquiry and Page scans */
256         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_SCAN_ENABLE, 1, &scan);
257 }
258
259 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
260 {
261         __u8 auth = opt;
262
263         BT_DBG("%s %x", hdev->name, auth);
264
265         /* Authentication */
266         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_AUTH_ENABLE, 1, &auth);
267 }
268
269 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
270 {
271         __u8 encrypt = opt;
272
273         BT_DBG("%s %x", hdev->name, encrypt);
274
275         /* Authentication */
276         hci_send_cmd(hdev, OGF_HOST_CTL, OCF_WRITE_ENCRYPT_MODE, 1, &encrypt);
277 }
278
279 /* Get HCI device by index. 
280  * Device is held on return. */
281 struct hci_dev *hci_dev_get(int index)
282 {
283         struct hci_dev *hdev = NULL;
284         struct list_head *p;
285
286         BT_DBG("%d", index);
287
288         if (index < 0)
289                 return NULL;
290
291         read_lock(&hci_dev_list_lock);
292         list_for_each(p, &hci_dev_list) {
293                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
294                 if (d->id == index) {
295                         hdev = hci_dev_hold(d);
296                         break;
297                 }
298         }
299         read_unlock(&hci_dev_list_lock);
300         return hdev;
301 }
302 EXPORT_SYMBOL(hci_dev_get);
303
304 /* ---- Inquiry support ---- */
305 static void inquiry_cache_flush(struct hci_dev *hdev)
306 {
307         struct inquiry_cache *cache = &hdev->inq_cache;
308         struct inquiry_entry *next  = cache->list, *e;
309
310         BT_DBG("cache %p", cache);
311
312         cache->list = NULL;
313         while ((e = next)) {
314                 next = e->next;
315                 kfree(e);
316         }
317 }
318
319 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
320 {
321         struct inquiry_cache *cache = &hdev->inq_cache;
322         struct inquiry_entry *e;
323
324         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
325
326         for (e = cache->list; e; e = e->next)
327                 if (!bacmp(&e->data.bdaddr, bdaddr))
328                         break;
329         return e;
330 }
331
332 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
333 {
334         struct inquiry_cache *cache = &hdev->inq_cache;
335         struct inquiry_entry *e;
336
337         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
338
339         if (!(e = hci_inquiry_cache_lookup(hdev, &data->bdaddr))) {
340                 /* Entry not in the cache. Add new one. */
341                 if (!(e = kmalloc(sizeof(struct inquiry_entry), GFP_ATOMIC)))
342                         return;
343                 memset(e, 0, sizeof(struct inquiry_entry));
344                 e->next     = cache->list;
345                 cache->list = e;
346         }
347
348         memcpy(&e->data, data, sizeof(*data));
349         e->timestamp = jiffies;
350         cache->timestamp = jiffies;
351 }
352
353 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
354 {
355         struct inquiry_cache *cache = &hdev->inq_cache;
356         struct inquiry_info *info = (struct inquiry_info *) buf;
357         struct inquiry_entry *e;
358         int copied = 0;
359
360         for (e = cache->list; e && copied < num; e = e->next, copied++) {
361                 struct inquiry_data *data = &e->data;
362                 bacpy(&info->bdaddr, &data->bdaddr);
363                 info->pscan_rep_mode    = data->pscan_rep_mode;
364                 info->pscan_period_mode = data->pscan_period_mode;
365                 info->pscan_mode        = data->pscan_mode;
366                 memcpy(info->dev_class, data->dev_class, 3);
367                 info->clock_offset      = data->clock_offset;
368                 info++;
369         }
370
371         BT_DBG("cache %p, copied %d", cache, copied);
372         return copied;
373 }
374
375 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
376 {
377         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
378         struct hci_cp_inquiry cp;
379
380         BT_DBG("%s", hdev->name);
381
382         if (test_bit(HCI_INQUIRY, &hdev->flags))
383                 return;
384
385         /* Start Inquiry */
386         memcpy(&cp.lap, &ir->lap, 3);
387         cp.length  = ir->length;
388         cp.num_rsp = ir->num_rsp;
389         hci_send_cmd(hdev, OGF_LINK_CTL, OCF_INQUIRY, sizeof(cp), &cp);
390 }
391
392 int hci_inquiry(void __user *arg)
393 {
394         __u8 __user *ptr = arg;
395         struct hci_inquiry_req ir;
396         struct hci_dev *hdev;
397         int err = 0, do_inquiry = 0, max_rsp;
398         long timeo;
399         __u8 *buf;
400
401         if (copy_from_user(&ir, ptr, sizeof(ir)))
402                 return -EFAULT;
403
404         if (!(hdev = hci_dev_get(ir.dev_id)))
405                 return -ENODEV;
406
407         hci_dev_lock_bh(hdev);
408         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || 
409                                         inquiry_cache_empty(hdev) ||
410                                         ir.flags & IREQ_CACHE_FLUSH) {
411                 inquiry_cache_flush(hdev);
412                 do_inquiry = 1;
413         }
414         hci_dev_unlock_bh(hdev);
415
416         timeo = ir.length * 2 * HZ;
417         if (do_inquiry && (err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo)) < 0)
418                 goto done;
419
420         /* for unlimited number of responses we will use buffer with 255 entries */
421         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
422
423         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
424          * copy it to the user space.
425          */
426         if (!(buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL))) {
427                 err = -ENOMEM;
428                 goto done;
429         }
430
431         hci_dev_lock_bh(hdev);
432         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
433         hci_dev_unlock_bh(hdev);
434
435         BT_DBG("num_rsp %d", ir.num_rsp);
436
437         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
438                 ptr += sizeof(ir);
439                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
440                                         ir.num_rsp))
441                         err = -EFAULT;
442         } else 
443                 err = -EFAULT;
444
445         kfree(buf);
446
447 done:
448         hci_dev_put(hdev);
449         return err;
450 }
451
452 /* ---- HCI ioctl helpers ---- */
453
454 int hci_dev_open(__u16 dev)
455 {
456         struct hci_dev *hdev;
457         int ret = 0;
458
459         if (!(hdev = hci_dev_get(dev)))
460                 return -ENODEV;
461
462         BT_DBG("%s %p", hdev->name, hdev);
463
464         hci_req_lock(hdev);
465
466         if (test_bit(HCI_UP, &hdev->flags)) {
467                 ret = -EALREADY;
468                 goto done;
469         }
470
471         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
472                 set_bit(HCI_RAW, &hdev->flags);
473
474         if (hdev->open(hdev)) {
475                 ret = -EIO;
476                 goto done;
477         }
478
479         if (!test_bit(HCI_RAW, &hdev->flags)) {
480                 atomic_set(&hdev->cmd_cnt, 1);
481                 set_bit(HCI_INIT, &hdev->flags);
482
483                 //__hci_request(hdev, hci_reset_req, 0, HZ);
484                 ret = __hci_request(hdev, hci_init_req, 0, HCI_INIT_TIMEOUT);
485
486                 clear_bit(HCI_INIT, &hdev->flags);
487         }
488
489         if (!ret) {
490                 hci_dev_hold(hdev);
491                 set_bit(HCI_UP, &hdev->flags);
492                 hci_notify(hdev, HCI_DEV_UP);
493         } else {        
494                 /* Init failed, cleanup */
495                 tasklet_kill(&hdev->rx_task);
496                 tasklet_kill(&hdev->tx_task);
497                 tasklet_kill(&hdev->cmd_task);
498
499                 skb_queue_purge(&hdev->cmd_q);
500                 skb_queue_purge(&hdev->rx_q);
501
502                 if (hdev->flush)
503                         hdev->flush(hdev);
504
505                 if (hdev->sent_cmd) {
506                         kfree_skb(hdev->sent_cmd);
507                         hdev->sent_cmd = NULL;
508                 }
509
510                 hdev->close(hdev);
511                 hdev->flags = 0;
512         }
513
514 done:
515         hci_req_unlock(hdev);
516         hci_dev_put(hdev);
517         return ret;
518 }
519
520 static int hci_dev_do_close(struct hci_dev *hdev)
521 {
522         BT_DBG("%s %p", hdev->name, hdev);
523
524         hci_req_cancel(hdev, ENODEV);
525         hci_req_lock(hdev);
526
527         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
528                 hci_req_unlock(hdev);
529                 return 0;
530         }
531
532         /* Kill RX and TX tasks */
533         tasklet_kill(&hdev->rx_task);
534         tasklet_kill(&hdev->tx_task);
535
536         hci_dev_lock_bh(hdev);
537         inquiry_cache_flush(hdev);
538         hci_conn_hash_flush(hdev);
539         hci_dev_unlock_bh(hdev);
540
541         hci_notify(hdev, HCI_DEV_DOWN);
542
543         if (hdev->flush)
544                 hdev->flush(hdev);
545
546         /* Reset device */
547         skb_queue_purge(&hdev->cmd_q);
548         atomic_set(&hdev->cmd_cnt, 1);
549         if (!test_bit(HCI_RAW, &hdev->flags)) {
550                 set_bit(HCI_INIT, &hdev->flags);
551                 __hci_request(hdev, hci_reset_req, 0, HZ/4);
552                 clear_bit(HCI_INIT, &hdev->flags);
553         }
554
555         /* Kill cmd task */
556         tasklet_kill(&hdev->cmd_task);
557
558         /* Drop queues */
559         skb_queue_purge(&hdev->rx_q);
560         skb_queue_purge(&hdev->cmd_q);
561         skb_queue_purge(&hdev->raw_q);
562
563         /* Drop last sent command */
564         if (hdev->sent_cmd) {
565                 kfree_skb(hdev->sent_cmd);
566                 hdev->sent_cmd = NULL;
567         }
568
569         /* After this point our queues are empty
570          * and no tasks are scheduled. */
571         hdev->close(hdev);
572
573         /* Clear flags */
574         hdev->flags = 0;
575
576         hci_req_unlock(hdev);
577
578         hci_dev_put(hdev);
579         return 0;
580 }
581
582 int hci_dev_close(__u16 dev)
583 {
584         struct hci_dev *hdev;
585         int err;
586
587         if (!(hdev = hci_dev_get(dev)))
588                 return -ENODEV;
589         err = hci_dev_do_close(hdev);
590         hci_dev_put(hdev);
591         return err;
592 }
593
594 int hci_dev_reset(__u16 dev)
595 {
596         struct hci_dev *hdev;
597         int ret = 0;
598
599         if (!(hdev = hci_dev_get(dev)))
600                 return -ENODEV;
601
602         hci_req_lock(hdev);
603         tasklet_disable(&hdev->tx_task);
604
605         if (!test_bit(HCI_UP, &hdev->flags))
606                 goto done;
607
608         /* Drop queues */
609         skb_queue_purge(&hdev->rx_q);
610         skb_queue_purge(&hdev->cmd_q);
611
612         hci_dev_lock_bh(hdev);
613         inquiry_cache_flush(hdev);
614         hci_conn_hash_flush(hdev);
615         hci_dev_unlock_bh(hdev);
616
617         if (hdev->flush)
618                 hdev->flush(hdev);
619
620         atomic_set(&hdev->cmd_cnt, 1); 
621         hdev->acl_cnt = 0; hdev->sco_cnt = 0;
622
623         if (!test_bit(HCI_RAW, &hdev->flags))
624                 ret = __hci_request(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
625
626 done:
627         tasklet_enable(&hdev->tx_task);
628         hci_req_unlock(hdev);
629         hci_dev_put(hdev);
630         return ret;
631 }
632
633 int hci_dev_reset_stat(__u16 dev)
634 {
635         struct hci_dev *hdev;
636         int ret = 0;
637
638         if (!(hdev = hci_dev_get(dev)))
639                 return -ENODEV;
640
641         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
642
643         hci_dev_put(hdev);
644
645         return ret;
646 }
647
648 int hci_dev_cmd(unsigned int cmd, void __user *arg)
649 {
650         struct hci_dev *hdev;
651         struct hci_dev_req dr;
652         int err = 0;
653
654         if (copy_from_user(&dr, arg, sizeof(dr)))
655                 return -EFAULT;
656
657         if (!(hdev = hci_dev_get(dr.dev_id)))
658                 return -ENODEV;
659
660         switch (cmd) {
661         case HCISETAUTH:
662                 err = hci_request(hdev, hci_auth_req, dr.dev_opt, HCI_INIT_TIMEOUT);
663                 break;
664
665         case HCISETENCRYPT:
666                 if (!lmp_encrypt_capable(hdev)) {
667                         err = -EOPNOTSUPP;
668                         break;
669                 }
670
671                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
672                         /* Auth must be enabled first */
673                         err = hci_request(hdev, hci_auth_req,
674                                         dr.dev_opt, HCI_INIT_TIMEOUT);
675                         if (err)
676                                 break;
677                 }
678
679                 err = hci_request(hdev, hci_encrypt_req,
680                                         dr.dev_opt, HCI_INIT_TIMEOUT);
681                 break;
682
683         case HCISETSCAN:
684                 err = hci_request(hdev, hci_scan_req, dr.dev_opt, HCI_INIT_TIMEOUT);
685                 break;
686
687         case HCISETPTYPE:
688                 hdev->pkt_type = (__u16) dr.dev_opt;
689                 break;
690
691         case HCISETLINKPOL:
692                 hdev->link_policy = (__u16) dr.dev_opt;
693                 break;
694
695         case HCISETLINKMODE:
696                 hdev->link_mode = ((__u16) dr.dev_opt) & (HCI_LM_MASTER | HCI_LM_ACCEPT);
697                 break;
698
699         case HCISETACLMTU:
700                 hdev->acl_mtu  = *((__u16 *)&dr.dev_opt + 1);
701                 hdev->acl_pkts = *((__u16 *)&dr.dev_opt + 0);
702                 break;
703
704         case HCISETSCOMTU:
705                 hdev->sco_mtu  = *((__u16 *)&dr.dev_opt + 1);
706                 hdev->sco_pkts = *((__u16 *)&dr.dev_opt + 0);
707                 break;
708
709         default:
710                 err = -EINVAL;
711                 break;
712         }
713         hci_dev_put(hdev);
714         return err;
715 }
716
717 int hci_get_dev_list(void __user *arg)
718 {
719         struct hci_dev_list_req *dl;
720         struct hci_dev_req *dr;
721         struct list_head *p;
722         int n = 0, size, err;
723         __u16 dev_num;
724
725         if (get_user(dev_num, (__u16 __user *) arg))
726                 return -EFAULT;
727
728         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
729                 return -EINVAL;
730
731         size = sizeof(*dl) + dev_num * sizeof(*dr);
732
733         if (!(dl = kmalloc(size, GFP_KERNEL)))
734                 return -ENOMEM;
735
736         dr = dl->dev_req;
737
738         read_lock_bh(&hci_dev_list_lock);
739         list_for_each(p, &hci_dev_list) {
740                 struct hci_dev *hdev;
741                 hdev = list_entry(p, struct hci_dev, list);
742                 (dr + n)->dev_id  = hdev->id;
743                 (dr + n)->dev_opt = hdev->flags;
744                 if (++n >= dev_num)
745                         break;
746         }
747         read_unlock_bh(&hci_dev_list_lock);
748
749         dl->dev_num = n;
750         size = sizeof(*dl) + n * sizeof(*dr);
751
752         err = copy_to_user(arg, dl, size);
753         kfree(dl);
754
755         return err ? -EFAULT : 0;
756 }
757
758 int hci_get_dev_info(void __user *arg)
759 {
760         struct hci_dev *hdev;
761         struct hci_dev_info di;
762         int err = 0;
763
764         if (copy_from_user(&di, arg, sizeof(di)))
765                 return -EFAULT;
766
767         if (!(hdev = hci_dev_get(di.dev_id)))
768                 return -ENODEV;
769
770         strcpy(di.name, hdev->name);
771         di.bdaddr   = hdev->bdaddr;
772         di.type     = hdev->type;
773         di.flags    = hdev->flags;
774         di.pkt_type = hdev->pkt_type;
775         di.acl_mtu  = hdev->acl_mtu;
776         di.acl_pkts = hdev->acl_pkts;
777         di.sco_mtu  = hdev->sco_mtu;
778         di.sco_pkts = hdev->sco_pkts;
779         di.link_policy = hdev->link_policy;
780         di.link_mode   = hdev->link_mode;
781
782         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
783         memcpy(&di.features, &hdev->features, sizeof(di.features));
784
785         if (copy_to_user(arg, &di, sizeof(di)))
786                 err = -EFAULT;
787
788         hci_dev_put(hdev);
789
790         return err;
791 }
792
793 /* ---- Interface to HCI drivers ---- */
794
795 /* Alloc HCI device */
796 struct hci_dev *hci_alloc_dev(void)
797 {
798         struct hci_dev *hdev;
799
800         hdev = kmalloc(sizeof(struct hci_dev), GFP_KERNEL);
801         if (!hdev)
802                 return NULL;
803
804         memset(hdev, 0, sizeof(struct hci_dev));
805
806         skb_queue_head_init(&hdev->driver_init);
807
808         return hdev;
809 }
810 EXPORT_SYMBOL(hci_alloc_dev);
811
812 /* Free HCI device */
813 void hci_free_dev(struct hci_dev *hdev)
814 {
815         skb_queue_purge(&hdev->driver_init);
816
817         /* will free via class release */
818         class_device_put(&hdev->class_dev);
819 }
820 EXPORT_SYMBOL(hci_free_dev);
821
822 /* Register HCI device */
823 int hci_register_dev(struct hci_dev *hdev)
824 {
825         struct list_head *head = &hci_dev_list, *p;
826         int id = 0;
827
828         BT_DBG("%p name %s type %d owner %p", hdev, hdev->name, hdev->type, hdev->owner);
829
830         if (!hdev->open || !hdev->close || !hdev->destruct)
831                 return -EINVAL;
832
833         write_lock_bh(&hci_dev_list_lock);
834
835         /* Find first available device id */
836         list_for_each(p, &hci_dev_list) {
837                 if (list_entry(p, struct hci_dev, list)->id != id)
838                         break;
839                 head = p; id++;
840         }
841         
842         sprintf(hdev->name, "hci%d", id);
843         hdev->id = id;
844         list_add(&hdev->list, head);
845
846         atomic_set(&hdev->refcnt, 1);
847         spin_lock_init(&hdev->lock);
848
849         hdev->flags = 0;
850         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
851         hdev->link_mode = (HCI_LM_ACCEPT);
852
853         tasklet_init(&hdev->cmd_task, hci_cmd_task,(unsigned long) hdev);
854         tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
855         tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
856
857         skb_queue_head_init(&hdev->rx_q);
858         skb_queue_head_init(&hdev->cmd_q);
859         skb_queue_head_init(&hdev->raw_q);
860
861         init_waitqueue_head(&hdev->req_wait_q);
862         init_MUTEX(&hdev->req_lock);
863
864         inquiry_cache_init(hdev);
865
866         hci_conn_hash_init(hdev);
867
868         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
869
870         atomic_set(&hdev->promisc, 0);
871
872         write_unlock_bh(&hci_dev_list_lock);
873
874         hci_register_sysfs(hdev);
875
876         hci_notify(hdev, HCI_DEV_REG);
877
878         return id;
879 }
880 EXPORT_SYMBOL(hci_register_dev);
881
882 /* Unregister HCI device */
883 int hci_unregister_dev(struct hci_dev *hdev)
884 {
885         BT_DBG("%p name %s type %d", hdev, hdev->name, hdev->type);
886
887         hci_unregister_sysfs(hdev);
888
889         write_lock_bh(&hci_dev_list_lock);
890         list_del(&hdev->list);
891         write_unlock_bh(&hci_dev_list_lock);
892
893         hci_dev_do_close(hdev);
894
895         hci_notify(hdev, HCI_DEV_UNREG);
896
897         __hci_dev_put(hdev);
898         return 0;
899 }
900 EXPORT_SYMBOL(hci_unregister_dev);
901
902 /* Suspend HCI device */
903 int hci_suspend_dev(struct hci_dev *hdev)
904 {
905         hci_notify(hdev, HCI_DEV_SUSPEND);
906         return 0;
907 }
908 EXPORT_SYMBOL(hci_suspend_dev);
909
910 /* Resume HCI device */
911 int hci_resume_dev(struct hci_dev *hdev)
912 {
913         hci_notify(hdev, HCI_DEV_RESUME);
914         return 0;
915 }
916 EXPORT_SYMBOL(hci_resume_dev);
917
918 /* ---- Interface to upper protocols ---- */
919
920 /* Register/Unregister protocols.
921  * hci_task_lock is used to ensure that no tasks are running. */
922 int hci_register_proto(struct hci_proto *hp)
923 {
924         int err = 0;
925
926         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
927
928         if (hp->id >= HCI_MAX_PROTO)
929                 return -EINVAL;
930
931         write_lock_bh(&hci_task_lock);
932
933         if (!hci_proto[hp->id])
934                 hci_proto[hp->id] = hp;
935         else
936                 err = -EEXIST;
937
938         write_unlock_bh(&hci_task_lock);
939
940         return err;
941 }
942 EXPORT_SYMBOL(hci_register_proto);
943
944 int hci_unregister_proto(struct hci_proto *hp)
945 {
946         int err = 0;
947
948         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
949
950         if (hp->id >= HCI_MAX_PROTO)
951                 return -EINVAL;
952
953         write_lock_bh(&hci_task_lock);
954
955         if (hci_proto[hp->id])
956                 hci_proto[hp->id] = NULL;
957         else
958                 err = -ENOENT;
959
960         write_unlock_bh(&hci_task_lock);
961
962         return err;
963 }
964 EXPORT_SYMBOL(hci_unregister_proto);
965
966 int hci_register_cb(struct hci_cb *cb)
967 {
968         BT_DBG("%p name %s", cb, cb->name);
969
970         write_lock_bh(&hci_cb_list_lock);
971         list_add(&cb->list, &hci_cb_list);
972         write_unlock_bh(&hci_cb_list_lock);
973
974         return 0;
975 }
976 EXPORT_SYMBOL(hci_register_cb);
977
978 int hci_unregister_cb(struct hci_cb *cb)
979 {
980         BT_DBG("%p name %s", cb, cb->name);
981
982         write_lock_bh(&hci_cb_list_lock);
983         list_del(&cb->list);
984         write_unlock_bh(&hci_cb_list_lock);
985
986         return 0;
987 }
988 EXPORT_SYMBOL(hci_unregister_cb);
989
990 static int hci_send_frame(struct sk_buff *skb)
991 {
992         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
993
994         if (!hdev) {
995                 kfree_skb(skb);
996                 return -ENODEV;
997         }
998
999         BT_DBG("%s type %d len %d", hdev->name, skb->pkt_type, skb->len);
1000
1001         if (atomic_read(&hdev->promisc)) {
1002                 /* Time stamp */
1003                 do_gettimeofday(&skb->stamp);
1004
1005                 hci_send_to_sock(hdev, skb);
1006         }
1007
1008         /* Get rid of skb owner, prior to sending to the driver. */
1009         skb_orphan(skb);
1010
1011         return hdev->send(skb);
1012 }
1013
1014 /* Send HCI command */
1015 int hci_send_cmd(struct hci_dev *hdev, __u16 ogf, __u16 ocf, __u32 plen, void *param)
1016 {
1017         int len = HCI_COMMAND_HDR_SIZE + plen;
1018         struct hci_command_hdr *hdr;
1019         struct sk_buff *skb;
1020
1021         BT_DBG("%s ogf 0x%x ocf 0x%x plen %d", hdev->name, ogf, ocf, plen);
1022
1023         skb = bt_skb_alloc(len, GFP_ATOMIC);
1024         if (!skb) {
1025                 BT_ERR("%s Can't allocate memory for HCI command", hdev->name);
1026                 return -ENOMEM;
1027         }
1028
1029         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1030         hdr->opcode = __cpu_to_le16(hci_opcode_pack(ogf, ocf));
1031         hdr->plen   = plen;
1032
1033         if (plen)
1034                 memcpy(skb_put(skb, plen), param, plen);
1035
1036         BT_DBG("skb len %d", skb->len);
1037
1038         skb->pkt_type = HCI_COMMAND_PKT;
1039         skb->dev = (void *) hdev;
1040         skb_queue_tail(&hdev->cmd_q, skb);
1041         hci_sched_cmd(hdev);
1042
1043         return 0;
1044 }
1045 EXPORT_SYMBOL(hci_send_cmd);
1046
1047 /* Get data from the previously sent command */
1048 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 ogf, __u16 ocf)
1049 {
1050         struct hci_command_hdr *hdr;
1051
1052         if (!hdev->sent_cmd)
1053                 return NULL;
1054
1055         hdr = (void *) hdev->sent_cmd->data;
1056
1057         if (hdr->opcode != __cpu_to_le16(hci_opcode_pack(ogf, ocf)))
1058                 return NULL;
1059
1060         BT_DBG("%s ogf 0x%x ocf 0x%x", hdev->name, ogf, ocf);
1061
1062         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1063 }
1064
1065 /* Send ACL data */
1066 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1067 {
1068         struct hci_acl_hdr *hdr;
1069         int len = skb->len;
1070
1071         hdr = (struct hci_acl_hdr *) skb_push(skb, HCI_ACL_HDR_SIZE);
1072         hdr->handle = __cpu_to_le16(hci_handle_pack(handle, flags));
1073         hdr->dlen   = __cpu_to_le16(len);
1074
1075         skb->h.raw = (void *) hdr;
1076 }
1077
1078 int hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1079 {
1080         struct hci_dev *hdev = conn->hdev;
1081         struct sk_buff *list;
1082
1083         BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1084
1085         skb->dev = (void *) hdev;
1086         skb->pkt_type = HCI_ACLDATA_PKT;
1087         hci_add_acl_hdr(skb, conn->handle, flags | ACL_START);
1088
1089         if (!(list = skb_shinfo(skb)->frag_list)) {
1090                 /* Non fragmented */
1091                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1092
1093                 skb_queue_tail(&conn->data_q, skb);
1094         } else {
1095                 /* Fragmented */
1096                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1097
1098                 skb_shinfo(skb)->frag_list = NULL;
1099
1100                 /* Queue all fragments atomically */
1101                 spin_lock_bh(&conn->data_q.lock);
1102
1103                 __skb_queue_tail(&conn->data_q, skb);
1104                 do {
1105                         skb = list; list = list->next;
1106                         
1107                         skb->dev = (void *) hdev;
1108                         skb->pkt_type = HCI_ACLDATA_PKT;
1109                         hci_add_acl_hdr(skb, conn->handle, flags | ACL_CONT);
1110
1111                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1112
1113                         __skb_queue_tail(&conn->data_q, skb);
1114                 } while (list);
1115
1116                 spin_unlock_bh(&conn->data_q.lock);
1117         }
1118
1119         hci_sched_tx(hdev);
1120         return 0;
1121 }
1122 EXPORT_SYMBOL(hci_send_acl);
1123
1124 /* Send SCO data */
1125 int hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1126 {
1127         struct hci_dev *hdev = conn->hdev;
1128         struct hci_sco_hdr hdr;
1129
1130         BT_DBG("%s len %d", hdev->name, skb->len);
1131
1132         if (skb->len > hdev->sco_mtu) {
1133                 kfree_skb(skb);
1134                 return -EINVAL;
1135         }
1136
1137         hdr.handle = __cpu_to_le16(conn->handle);
1138         hdr.dlen   = skb->len;
1139
1140         skb->h.raw = skb_push(skb, HCI_SCO_HDR_SIZE);
1141         memcpy(skb->h.raw, &hdr, HCI_SCO_HDR_SIZE);
1142
1143         skb->dev = (void *) hdev;
1144         skb->pkt_type = HCI_SCODATA_PKT;
1145         skb_queue_tail(&conn->data_q, skb);
1146         hci_sched_tx(hdev);
1147         return 0;
1148 }
1149 EXPORT_SYMBOL(hci_send_sco);
1150
1151 /* ---- HCI TX task (outgoing data) ---- */
1152
1153 /* HCI Connection scheduler */
1154 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1155 {
1156         struct hci_conn_hash *h = &hdev->conn_hash;
1157         struct hci_conn  *conn = NULL;
1158         int num = 0, min = ~0;
1159         struct list_head *p;
1160
1161         /* We don't have to lock device here. Connections are always 
1162          * added and removed with TX task disabled. */
1163         list_for_each(p, &h->list) {
1164                 struct hci_conn *c;
1165                 c = list_entry(p, struct hci_conn, list);
1166
1167                 if (c->type != type || c->state != BT_CONNECTED
1168                                 || skb_queue_empty(&c->data_q))
1169                         continue;
1170                 num++;
1171
1172                 if (c->sent < min) {
1173                         min  = c->sent;
1174                         conn = c;
1175                 }
1176         }
1177
1178         if (conn) {
1179                 int cnt = (type == ACL_LINK ? hdev->acl_cnt : hdev->sco_cnt);
1180                 int q = cnt / num;
1181                 *quote = q ? q : 1;
1182         } else
1183                 *quote = 0;
1184
1185         BT_DBG("conn %p quote %d", conn, *quote);
1186         return conn;
1187 }
1188
1189 static inline void hci_acl_tx_to(struct hci_dev *hdev)
1190 {
1191         struct hci_conn_hash *h = &hdev->conn_hash;
1192         struct list_head *p;
1193         struct hci_conn  *c;
1194
1195         BT_ERR("%s ACL tx timeout", hdev->name);
1196
1197         /* Kill stalled connections */
1198         list_for_each(p, &h->list) {
1199                 c = list_entry(p, struct hci_conn, list);
1200                 if (c->type == ACL_LINK && c->sent) {
1201                         BT_ERR("%s killing stalled ACL connection %s",
1202                                 hdev->name, batostr(&c->dst));
1203                         hci_acl_disconn(c, 0x13);
1204                 }
1205         }
1206 }
1207
1208 static inline void hci_sched_acl(struct hci_dev *hdev)
1209 {
1210         struct hci_conn *conn;
1211         struct sk_buff *skb;
1212         int quote;
1213
1214         BT_DBG("%s", hdev->name);
1215
1216         if (!test_bit(HCI_RAW, &hdev->flags)) {
1217                 /* ACL tx timeout must be longer than maximum
1218                  * link supervision timeout (40.9 seconds) */
1219                 if (!hdev->acl_cnt && (jiffies - hdev->acl_last_tx) > (HZ * 45))
1220                         hci_acl_tx_to(hdev);
1221         }
1222
1223         while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1224                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1225                         BT_DBG("skb %p len %d", skb, skb->len);
1226                         hci_send_frame(skb);
1227                         hdev->acl_last_tx = jiffies;
1228
1229                         hdev->acl_cnt--;
1230                         conn->sent++;
1231                 }
1232         }
1233 }
1234
1235 /* Schedule SCO */
1236 static inline void hci_sched_sco(struct hci_dev *hdev)
1237 {
1238         struct hci_conn *conn;
1239         struct sk_buff *skb;
1240         int quote;
1241
1242         BT_DBG("%s", hdev->name);
1243
1244         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1245                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1246                         BT_DBG("skb %p len %d", skb, skb->len);
1247                         hci_send_frame(skb);
1248
1249                         conn->sent++;
1250                         if (conn->sent == ~0)
1251                                 conn->sent = 0;
1252                 }
1253         }
1254 }
1255
1256 static void hci_tx_task(unsigned long arg)
1257 {
1258         struct hci_dev *hdev = (struct hci_dev *) arg;
1259         struct sk_buff *skb;
1260
1261         read_lock(&hci_task_lock);
1262
1263         BT_DBG("%s acl %d sco %d", hdev->name, hdev->acl_cnt, hdev->sco_cnt);
1264
1265         /* Schedule queues and send stuff to HCI driver */
1266
1267         hci_sched_acl(hdev);
1268
1269         hci_sched_sco(hdev);
1270
1271         /* Send next queued raw (unknown type) packet */
1272         while ((skb = skb_dequeue(&hdev->raw_q)))
1273                 hci_send_frame(skb);
1274
1275         read_unlock(&hci_task_lock);
1276 }
1277
1278 /* ----- HCI RX task (incoming data proccessing) ----- */
1279
1280 /* ACL data packet */
1281 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1282 {
1283         struct hci_acl_hdr *hdr = (void *) skb->data;
1284         struct hci_conn *conn;
1285         __u16 handle, flags;
1286
1287         skb_pull(skb, HCI_ACL_HDR_SIZE);
1288
1289         handle = __le16_to_cpu(hdr->handle);
1290         flags  = hci_flags(handle);
1291         handle = hci_handle(handle);
1292
1293         BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
1294
1295         hdev->stat.acl_rx++;
1296
1297         hci_dev_lock(hdev);
1298         conn = hci_conn_hash_lookup_handle(hdev, handle);
1299         hci_dev_unlock(hdev);
1300         
1301         if (conn) {
1302                 register struct hci_proto *hp;
1303
1304                 /* Send to upper protocol */
1305                 if ((hp = hci_proto[HCI_PROTO_L2CAP]) && hp->recv_acldata) {
1306                         hp->recv_acldata(conn, skb, flags);
1307                         return;
1308                 }
1309         } else {
1310                 BT_ERR("%s ACL packet for unknown connection handle %d", 
1311                         hdev->name, handle);
1312         }
1313
1314         kfree_skb(skb);
1315 }
1316
1317 /* SCO data packet */
1318 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1319 {
1320         struct hci_sco_hdr *hdr = (void *) skb->data;
1321         struct hci_conn *conn;
1322         __u16 handle;
1323
1324         skb_pull(skb, HCI_SCO_HDR_SIZE);
1325
1326         handle = __le16_to_cpu(hdr->handle);
1327
1328         BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
1329
1330         hdev->stat.sco_rx++;
1331
1332         hci_dev_lock(hdev);
1333         conn = hci_conn_hash_lookup_handle(hdev, handle);
1334         hci_dev_unlock(hdev);
1335
1336         if (conn) {
1337                 register struct hci_proto *hp;
1338
1339                 /* Send to upper protocol */
1340                 if ((hp = hci_proto[HCI_PROTO_SCO]) && hp->recv_scodata) {
1341                         hp->recv_scodata(conn, skb);
1342                         return;
1343                 }
1344         } else {
1345                 BT_ERR("%s SCO packet for unknown connection handle %d", 
1346                         hdev->name, handle);
1347         }
1348
1349         kfree_skb(skb);
1350 }
1351
1352 void hci_rx_task(unsigned long arg)
1353 {
1354         struct hci_dev *hdev = (struct hci_dev *) arg;
1355         struct sk_buff *skb;
1356
1357         BT_DBG("%s", hdev->name);
1358
1359         read_lock(&hci_task_lock);
1360
1361         while ((skb = skb_dequeue(&hdev->rx_q))) {
1362                 if (atomic_read(&hdev->promisc)) {
1363                         /* Send copy to the sockets */
1364                         hci_send_to_sock(hdev, skb);
1365                 }
1366
1367                 if (test_bit(HCI_RAW, &hdev->flags)) {
1368                         kfree_skb(skb);
1369                         continue;
1370                 }
1371
1372                 if (test_bit(HCI_INIT, &hdev->flags)) {
1373                         /* Don't process data packets in this states. */
1374                         switch (skb->pkt_type) {
1375                         case HCI_ACLDATA_PKT:
1376                         case HCI_SCODATA_PKT:
1377                                 kfree_skb(skb);
1378                                 continue;
1379                         };
1380                 }
1381
1382                 /* Process frame */
1383                 switch (skb->pkt_type) {
1384                 case HCI_EVENT_PKT:
1385                         hci_event_packet(hdev, skb);
1386                         break;
1387
1388                 case HCI_ACLDATA_PKT:
1389                         BT_DBG("%s ACL data packet", hdev->name);
1390                         hci_acldata_packet(hdev, skb);
1391                         break;
1392
1393                 case HCI_SCODATA_PKT:
1394                         BT_DBG("%s SCO data packet", hdev->name);
1395                         hci_scodata_packet(hdev, skb);
1396                         break;
1397
1398                 default:
1399                         kfree_skb(skb);
1400                         break;
1401                 }
1402         }
1403
1404         read_unlock(&hci_task_lock);
1405 }
1406
1407 static void hci_cmd_task(unsigned long arg)
1408 {
1409         struct hci_dev *hdev = (struct hci_dev *) arg;
1410         struct sk_buff *skb;
1411
1412         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
1413
1414         if (!atomic_read(&hdev->cmd_cnt) && (jiffies - hdev->cmd_last_tx) > HZ) {
1415                 BT_ERR("%s command tx timeout", hdev->name);
1416                 atomic_set(&hdev->cmd_cnt, 1);
1417         }
1418
1419         /* Send queued commands */
1420         if (atomic_read(&hdev->cmd_cnt) && (skb = skb_dequeue(&hdev->cmd_q))) {
1421                 if (hdev->sent_cmd)
1422                         kfree_skb(hdev->sent_cmd);
1423
1424                 if ((hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC))) {
1425                         atomic_dec(&hdev->cmd_cnt);
1426                         hci_send_frame(skb);
1427                         hdev->cmd_last_tx = jiffies;
1428                 } else {
1429                         skb_queue_head(&hdev->cmd_q, skb);
1430                         hci_sched_cmd(hdev);
1431                 }
1432         }
1433 }