projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix old_key_type logic for non-persistent keys
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
f48fd9c8 40#include <linux/workqueue.h>
1da177e4
LT		 41#include <linux/interrupt.h>
42#include <linux/notifier.h>
611b30f7 43#include <linux/rfkill.h>
6bd32326 44#include <linux/timer.h>
1da177e4
LT		 45#include <net/sock.h>
46
47#include <asm/system.h>
70f23020 48#include <linux/uaccess.h>
1da177e4
LT		 49#include <asm/unaligned.h>
50
51#include <net/bluetooth/bluetooth.h>
52#include <net/bluetooth/hci_core.h>
53
ab81cbf9
JH		 54#define AUTO_OFF_TIMEOUT 2000
55
1da177e4
LT		 56static void hci_cmd_task(unsigned long arg);
57static void hci_rx_task(unsigned long arg);
58static void hci_tx_task(unsigned long arg);
1da177e4
LT		 59
60static DEFINE_RWLOCK(hci_task_lock);
61
62/* HCI device list */
63LIST_HEAD(hci_dev_list);
64DEFINE_RWLOCK(hci_dev_list_lock);
65
66/* HCI callback list */
67LIST_HEAD(hci_cb_list);
68DEFINE_RWLOCK(hci_cb_list_lock);
69
70/* HCI protocols */
71#define HCI_MAX_PROTO 2
72struct hci_proto *hci_proto[HCI_MAX_PROTO];
73
74/* HCI notifiers list */
e041c683 75static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 76
77/* ---- HCI notifications ---- */
78
79int hci_register_notifier(struct notifier_block *nb)
80{
e041c683 81 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 82}
83
84int hci_unregister_notifier(struct notifier_block *nb)
85{
e041c683 86 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 87}
88
6516455d 89static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 90{
e041c683 91 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 92}
93
94/* ---- HCI requests ---- */
95
23bb5763 96void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 97{
23bb5763
JH		 98 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
99
a5040efa
JH		 100 /* If this is the init phase check if the completed command matches
101 * the last init command, and if not just return.
102 */
103 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
23bb5763 104 return;
1da177e4
LT		 105
106 if (hdev->req_status == HCI_REQ_PEND) {
107 hdev->req_result = result;
108 hdev->req_status = HCI_REQ_DONE;
109 wake_up_interruptible(&hdev->req_wait_q);
110 }
111}
112
113static void hci_req_cancel(struct hci_dev *hdev, int err)
114{
115 BT_DBG("%s err 0x%2.2x", hdev->name, err);
116
117 if (hdev->req_status == HCI_REQ_PEND) {
118 hdev->req_result = err;
119 hdev->req_status = HCI_REQ_CANCELED;
120 wake_up_interruptible(&hdev->req_wait_q);
121 }
122}
123
124/* Execute request and wait for completion. */
8e87d142 125static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 126 unsigned long opt, __u32 timeout)
1da177e4
LT		 127{
128 DECLARE_WAITQUEUE(wait, current);
129 int err = 0;
130
131 BT_DBG("%s start", hdev->name);
132
133 hdev->req_status = HCI_REQ_PEND;
134
135 add_wait_queue(&hdev->req_wait_q, &wait);
136 set_current_state(TASK_INTERRUPTIBLE);
137
138 req(hdev, opt);
139 schedule_timeout(timeout);
140
141 remove_wait_queue(&hdev->req_wait_q, &wait);
142
143 if (signal_pending(current))
144 return -EINTR;
145
146 switch (hdev->req_status) {
147 case HCI_REQ_DONE:
148 err = -bt_err(hdev->req_result);
149 break;
150
151 case HCI_REQ_CANCELED:
152 err = -hdev->req_result;
153 break;
154
155 default:
156 err = -ETIMEDOUT;
157 break;
3ff50b79 158 }
1da177e4 159
a5040efa 160 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 161
162 BT_DBG("%s end: err %d", hdev->name, err);
163
164 return err;
165}
166
167static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 168 unsigned long opt, __u32 timeout)
1da177e4
LT		 169{
170 int ret;
171
7c6a329e
MH		 172 if (!test_bit(HCI_UP, &hdev->flags))
173 return -ENETDOWN;
174
1da177e4
LT		 175 /* Serialize all requests */
176 hci_req_lock(hdev);
177 ret = __hci_request(hdev, req, opt, timeout);
178 hci_req_unlock(hdev);
179
180 return ret;
181}
182
183static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
184{
185 BT_DBG("%s %ld", hdev->name, opt);
186
187 /* Reset device */
10572132 188 set_bit(HCI_RESET, &hdev->flags);
a9de9248 189 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 190}
191
192static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
193{
b0916ea0 194 struct hci_cp_delete_stored_link_key cp;
1da177e4 195 struct sk_buff *skb;
1ebb9252 196 __le16 param;
89f2783d 197 __u8 flt_type;
1da177e4
LT		 198
199 BT_DBG("%s %ld", hdev->name, opt);
200
201 /* Driver initialization */
202
203 /* Special commands */
204 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 205 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 206 skb->dev = (void *) hdev;
c78ae283 207
1da177e4 208 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 209 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 210 }
211 skb_queue_purge(&hdev->driver_init);
212
213 /* Mandatory initialization */
214
215 /* Reset */
10572132
GP		 216 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
217 set_bit(HCI_RESET, &hdev->flags);
a9de9248 218 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
10572132 219 }
1da177e4
LT		 220
221 /* Read Local Supported Features */
a9de9248 222 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 223
1143e5a6 224 /* Read Local Version */
a9de9248 225 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 226
1da177e4 227 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 228 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 229
230#if 0
231 /* Host buffer size */
232 {
233 struct hci_cp_host_buffer_size cp;
aca3192c 234 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 235 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 236 cp.acl_max_pkt = cpu_to_le16(0xffff);
237 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 238 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 239 }
240#endif
241
242 /* Read BD Address */
a9de9248
MH		 243 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
244
245 /* Read Class of Device */
246 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
247
248 /* Read Local Name */
249 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 250
251 /* Read Voice Setting */
a9de9248 252 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 253
254 /* Optional initialization */
255
256 /* Clear Event Filters */
89f2783d 257 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 258 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4 259
1da177e4 260 /* Connection accept timeout ~20 secs */
aca3192c 261 param = cpu_to_le16(0x7d00);
a9de9248 262 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
b0916ea0
JH		 263
264 bacpy(&cp.bdaddr, BDADDR_ANY);
265 cp.delete_all = 1;
266 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
1da177e4
LT		 267}
268
6ed58ec5
VT		 269static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
270{
271 BT_DBG("%s", hdev->name);
272
273 /* Read LE buffer size */
274 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
275}
276
1da177e4
LT		 277static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
278{
279 __u8 scan = opt;
280
281 BT_DBG("%s %x", hdev->name, scan);
282
283 /* Inquiry and Page scans */
a9de9248 284 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 285}
286
287static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
288{
289 __u8 auth = opt;
290
291 BT_DBG("%s %x", hdev->name, auth);
292
293 /* Authentication */
a9de9248 294 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 295}
296
297static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
298{
299 __u8 encrypt = opt;
300
301 BT_DBG("%s %x", hdev->name, encrypt);
302
e4e8e37c 303 /* Encryption */
a9de9248 304 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 305}
306
e4e8e37c
MH		 307static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
308{
309 __le16 policy = cpu_to_le16(opt);
310
a418b893 311 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 312
313 /* Default link policy */
314 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
315}
316
8e87d142 317/* Get HCI device by index.
1da177e4
LT		 318 * Device is held on return. */
319struct hci_dev *hci_dev_get(int index)
320{
321 struct hci_dev *hdev = NULL;
322 struct list_head *p;
323
324 BT_DBG("%d", index);
325
326 if (index < 0)
327 return NULL;
328
329 read_lock(&hci_dev_list_lock);
330 list_for_each(p, &hci_dev_list) {
331 struct hci_dev *d = list_entry(p, struct hci_dev, list);
332 if (d->id == index) {
333 hdev = hci_dev_hold(d);
334 break;
335 }
336 }
337 read_unlock(&hci_dev_list_lock);
338 return hdev;
339}
1da177e4
LT		 340
341/* ---- Inquiry support ---- */
342static void inquiry_cache_flush(struct hci_dev *hdev)
343{
344 struct inquiry_cache *cache = &hdev->inq_cache;
345 struct inquiry_entry *next = cache->list, *e;
346
347 BT_DBG("cache %p", cache);
348
349 cache->list = NULL;
350 while ((e = next)) {
351 next = e->next;
352 kfree(e);
353 }
354}
355
356struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
357{
358 struct inquiry_cache *cache = &hdev->inq_cache;
359 struct inquiry_entry *e;
360
361 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
362
363 for (e = cache->list; e; e = e->next)
364 if (!bacmp(&e->data.bdaddr, bdaddr))
365 break;
366 return e;
367}
368
369void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
370{
371 struct inquiry_cache *cache = &hdev->inq_cache;
70f23020 372 struct inquiry_entry *ie;
1da177e4
LT		 373
374 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
375
70f23020
AE		 376 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
377 if (!ie) {
1da177e4 378 /* Entry not in the cache. Add new one. */
70f23020
AE		 379 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
380 if (!ie)
1da177e4 381 return;
70f23020
AE		 382
383 ie->next = cache->list;
384 cache->list = ie;
1da177e4
LT		 385 }
386
70f23020
AE		 387 memcpy(&ie->data, data, sizeof(*data));
388 ie->timestamp = jiffies;
1da177e4
LT		 389 cache->timestamp = jiffies;
390}
391
392static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
393{
394 struct inquiry_cache *cache = &hdev->inq_cache;
395 struct inquiry_info *info = (struct inquiry_info *) buf;
396 struct inquiry_entry *e;
397 int copied = 0;
398
399 for (e = cache->list; e && copied < num; e = e->next, copied++) {
400 struct inquiry_data *data = &e->data;
401 bacpy(&info->bdaddr, &data->bdaddr);
402 info->pscan_rep_mode = data->pscan_rep_mode;
403 info->pscan_period_mode = data->pscan_period_mode;
404 info->pscan_mode = data->pscan_mode;
405 memcpy(info->dev_class, data->dev_class, 3);
406 info->clock_offset = data->clock_offset;
407 info++;
408 }
409
410 BT_DBG("cache %p, copied %d", cache, copied);
411 return copied;
412}
413
414static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
415{
416 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
417 struct hci_cp_inquiry cp;
418
419 BT_DBG("%s", hdev->name);
420
421 if (test_bit(HCI_INQUIRY, &hdev->flags))
422 return;
423
424 /* Start Inquiry */
425 memcpy(&cp.lap, &ir->lap, 3);
426 cp.length = ir->length;
427 cp.num_rsp = ir->num_rsp;
a9de9248 428 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 429}
430
431int hci_inquiry(void __user *arg)
432{
433 __u8 __user *ptr = arg;
434 struct hci_inquiry_req ir;
435 struct hci_dev *hdev;
436 int err = 0, do_inquiry = 0, max_rsp;
437 long timeo;
438 __u8 *buf;
439
440 if (copy_from_user(&ir, ptr, sizeof(ir)))
441 return -EFAULT;
442
5a08ecce
AE		 443 hdev = hci_dev_get(ir.dev_id);
444 if (!hdev)
1da177e4
LT		 445 return -ENODEV;
446
447 hci_dev_lock_bh(hdev);
8e87d142 448 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
70f23020
AE		 449 inquiry_cache_empty(hdev) ||
450 ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 451 inquiry_cache_flush(hdev);
452 do_inquiry = 1;
453 }
454 hci_dev_unlock_bh(hdev);
455
04837f64 456 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 457
458 if (do_inquiry) {
459 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
460 if (err < 0)
461 goto done;
462 }
1da177e4
LT		 463
464 /* for unlimited number of responses we will use buffer with 255 entries */
465 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
466
467 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
468 * copy it to the user space.
469 */
01df8c31 470 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 471 if (!buf) {
1da177e4
LT		 472 err = -ENOMEM;
473 goto done;
474 }
475
476 hci_dev_lock_bh(hdev);
477 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
478 hci_dev_unlock_bh(hdev);
479
480 BT_DBG("num_rsp %d", ir.num_rsp);
481
482 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
483 ptr += sizeof(ir);
484 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
485 ir.num_rsp))
486 err = -EFAULT;
8e87d142 487 } else
1da177e4
LT		 488 err = -EFAULT;
489
490 kfree(buf);
491
492done:
493 hci_dev_put(hdev);
494 return err;
495}
496
497/* ---- HCI ioctl helpers ---- */
498
499int hci_dev_open(__u16 dev)
500{
501 struct hci_dev *hdev;
502 int ret = 0;
503
5a08ecce
AE		 504 hdev = hci_dev_get(dev);
505 if (!hdev)
1da177e4
LT		 506 return -ENODEV;
507
508 BT_DBG("%s %p", hdev->name, hdev);
509
510 hci_req_lock(hdev);
511
611b30f7
MH		 512 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
513 ret = -ERFKILL;
514 goto done;
515 }
516
1da177e4
LT		 517 if (test_bit(HCI_UP, &hdev->flags)) {
518 ret = -EALREADY;
519 goto done;
520 }
521
522 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
523 set_bit(HCI_RAW, &hdev->flags);
524
943da25d
MH		 525 /* Treat all non BR/EDR controllers as raw devices for now */
526 if (hdev->dev_type != HCI_BREDR)
527 set_bit(HCI_RAW, &hdev->flags);
528
1da177e4
LT		 529 if (hdev->open(hdev)) {
530 ret = -EIO;
531 goto done;
532 }
533
534 if (!test_bit(HCI_RAW, &hdev->flags)) {
535 atomic_set(&hdev->cmd_cnt, 1);
536 set_bit(HCI_INIT, &hdev->flags);
a5040efa 537 hdev->init_last_cmd = 0;
1da177e4 538
04837f64
MH		 539 ret = __hci_request(hdev, hci_init_req, 0,
540 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4 541
6ed58ec5
VT		 542 if (lmp_le_capable(hdev))
543 ret = __hci_request(hdev, hci_le_init_req, 0,
544 msecs_to_jiffies(HCI_INIT_TIMEOUT));
545
1da177e4
LT		 546 clear_bit(HCI_INIT, &hdev->flags);
547 }
548
549 if (!ret) {
550 hci_dev_hold(hdev);
551 set_bit(HCI_UP, &hdev->flags);
552 hci_notify(hdev, HCI_DEV_UP);
5add6af8
JH		 553 if (!test_bit(HCI_SETUP, &hdev->flags))
554 mgmt_powered(hdev->id, 1);
8e87d142 555 } else {
1da177e4
LT		 556 /* Init failed, cleanup */
557 tasklet_kill(&hdev->rx_task);
558 tasklet_kill(&hdev->tx_task);
559 tasklet_kill(&hdev->cmd_task);
560
561 skb_queue_purge(&hdev->cmd_q);
562 skb_queue_purge(&hdev->rx_q);
563
564 if (hdev->flush)
565 hdev->flush(hdev);
566
567 if (hdev->sent_cmd) {
568 kfree_skb(hdev->sent_cmd);
569 hdev->sent_cmd = NULL;
570 }
571
572 hdev->close(hdev);
573 hdev->flags = 0;
574 }
575
576done:
577 hci_req_unlock(hdev);
578 hci_dev_put(hdev);
579 return ret;
580}
581
582static int hci_dev_do_close(struct hci_dev *hdev)
583{
584 BT_DBG("%s %p", hdev->name, hdev);
585
586 hci_req_cancel(hdev, ENODEV);
587 hci_req_lock(hdev);
588
6f5ef998
TG		 589 /* Stop timer, it might be running */
590 del_timer_sync(&hdev->cmd_timer);
591
1da177e4 592 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 593 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 594 hci_req_unlock(hdev);
595 return 0;
596 }
597
598 /* Kill RX and TX tasks */
599 tasklet_kill(&hdev->rx_task);
600 tasklet_kill(&hdev->tx_task);
601
602 hci_dev_lock_bh(hdev);
603 inquiry_cache_flush(hdev);
604 hci_conn_hash_flush(hdev);
605 hci_dev_unlock_bh(hdev);
606
607 hci_notify(hdev, HCI_DEV_DOWN);
608
609 if (hdev->flush)
610 hdev->flush(hdev);
611
612 /* Reset device */
613 skb_queue_purge(&hdev->cmd_q);
614 atomic_set(&hdev->cmd_cnt, 1);
615 if (!test_bit(HCI_RAW, &hdev->flags)) {
616 set_bit(HCI_INIT, &hdev->flags);
04837f64
MH		 617 __hci_request(hdev, hci_reset_req, 0,
618 msecs_to_jiffies(250));
1da177e4
LT		 619 clear_bit(HCI_INIT, &hdev->flags);
620 }
621
622 /* Kill cmd task */
623 tasklet_kill(&hdev->cmd_task);
624
625 /* Drop queues */
626 skb_queue_purge(&hdev->rx_q);
627 skb_queue_purge(&hdev->cmd_q);
628 skb_queue_purge(&hdev->raw_q);
629
630 /* Drop last sent command */
631 if (hdev->sent_cmd) {
632 kfree_skb(hdev->sent_cmd);
633 hdev->sent_cmd = NULL;
634 }
635
636 /* After this point our queues are empty
637 * and no tasks are scheduled. */
638 hdev->close(hdev);
639
5add6af8
JH		 640 mgmt_powered(hdev->id, 0);
641
1da177e4
LT		 642 /* Clear flags */
643 hdev->flags = 0;
644
645 hci_req_unlock(hdev);
646
647 hci_dev_put(hdev);
648 return 0;
649}
650
651int hci_dev_close(__u16 dev)
652{
653 struct hci_dev *hdev;
654 int err;
655
70f23020
AE		 656 hdev = hci_dev_get(dev);
657 if (!hdev)
1da177e4
LT		 658 return -ENODEV;
659 err = hci_dev_do_close(hdev);
660 hci_dev_put(hdev);
661 return err;
662}
663
664int hci_dev_reset(__u16 dev)
665{
666 struct hci_dev *hdev;
667 int ret = 0;
668
70f23020
AE		 669 hdev = hci_dev_get(dev);
670 if (!hdev)
1da177e4
LT		 671 return -ENODEV;
672
673 hci_req_lock(hdev);
674 tasklet_disable(&hdev->tx_task);
675
676 if (!test_bit(HCI_UP, &hdev->flags))
677 goto done;
678
679 /* Drop queues */
680 skb_queue_purge(&hdev->rx_q);
681 skb_queue_purge(&hdev->cmd_q);
682
683 hci_dev_lock_bh(hdev);
684 inquiry_cache_flush(hdev);
685 hci_conn_hash_flush(hdev);
686 hci_dev_unlock_bh(hdev);
687
688 if (hdev->flush)
689 hdev->flush(hdev);
690
8e87d142 691 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 692 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 693
694 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 695 ret = __hci_request(hdev, hci_reset_req, 0,
696 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 697
698done:
699 tasklet_enable(&hdev->tx_task);
700 hci_req_unlock(hdev);
701 hci_dev_put(hdev);
702 return ret;
703}
704
705int hci_dev_reset_stat(__u16 dev)
706{
707 struct hci_dev *hdev;
708 int ret = 0;
709
70f23020
AE		 710 hdev = hci_dev_get(dev);
711 if (!hdev)
1da177e4
LT		 712 return -ENODEV;
713
714 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
715
716 hci_dev_put(hdev);
717
718 return ret;
719}
720
721int hci_dev_cmd(unsigned int cmd, void __user *arg)
722{
723 struct hci_dev *hdev;
724 struct hci_dev_req dr;
725 int err = 0;
726
727 if (copy_from_user(&dr, arg, sizeof(dr)))
728 return -EFAULT;
729
70f23020
AE		 730 hdev = hci_dev_get(dr.dev_id);
731 if (!hdev)
1da177e4
LT		 732 return -ENODEV;
733
734 switch (cmd) {
735 case HCISETAUTH:
04837f64
MH		 736 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
737 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 738 break;
739
740 case HCISETENCRYPT:
741 if (!lmp_encrypt_capable(hdev)) {
742 err = -EOPNOTSUPP;
743 break;
744 }
745
746 if (!test_bit(HCI_AUTH, &hdev->flags)) {
747 /* Auth must be enabled first */
04837f64
MH		 748 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
749 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 750 if (err)
751 break;
752 }
753
04837f64
MH		 754 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
755 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 756 break;
757
758 case HCISETSCAN:
04837f64
MH		 759 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
760 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 761 break;
762
1da177e4 763 case HCISETLINKPOL:
e4e8e37c
MH		 764 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
765 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 766 break;
767
768 case HCISETLINKMODE:
e4e8e37c
MH		 769 hdev->link_mode = ((__u16) dr.dev_opt) &
770 (HCI_LM_MASTER | HCI_LM_ACCEPT);
771 break;
772
773 case HCISETPTYPE:
774 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 775 break;
776
777 case HCISETACLMTU:
e4e8e37c
MH		 778 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
779 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 780 break;
781
782 case HCISETSCOMTU:
e4e8e37c
MH		 783 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
784 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 785 break;
786
787 default:
788 err = -EINVAL;
789 break;
790 }
e4e8e37c 791
1da177e4
LT		 792 hci_dev_put(hdev);
793 return err;
794}
795
796int hci_get_dev_list(void __user *arg)
797{
798 struct hci_dev_list_req *dl;
799 struct hci_dev_req *dr;
800 struct list_head *p;
801 int n = 0, size, err;
802 __u16 dev_num;
803
804 if (get_user(dev_num, (__u16 __user *) arg))
805 return -EFAULT;
806
807 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
808 return -EINVAL;
809
810 size = sizeof(*dl) + dev_num * sizeof(*dr);
811
70f23020
AE		 812 dl = kzalloc(size, GFP_KERNEL);
813 if (!dl)
1da177e4
LT		 814 return -ENOMEM;
815
816 dr = dl->dev_req;
817
818 read_lock_bh(&hci_dev_list_lock);
819 list_for_each(p, &hci_dev_list) {
820 struct hci_dev *hdev;
c542a06c 821
1da177e4 822 hdev = list_entry(p, struct hci_dev, list);
c542a06c 823
ab81cbf9 824 hci_del_off_timer(hdev);
c542a06c
JH		 825
826 if (!test_bit(HCI_MGMT, &hdev->flags))
827 set_bit(HCI_PAIRABLE, &hdev->flags);
828
1da177e4
LT		 829 (dr + n)->dev_id = hdev->id;
830 (dr + n)->dev_opt = hdev->flags;
c542a06c 831
1da177e4
LT		 832 if (++n >= dev_num)
833 break;
834 }
835 read_unlock_bh(&hci_dev_list_lock);
836
837 dl->dev_num = n;
838 size = sizeof(*dl) + n * sizeof(*dr);
839
840 err = copy_to_user(arg, dl, size);
841 kfree(dl);
842
843 return err ? -EFAULT : 0;
844}
845
846int hci_get_dev_info(void __user *arg)
847{
848 struct hci_dev *hdev;
849 struct hci_dev_info di;
850 int err = 0;
851
852 if (copy_from_user(&di, arg, sizeof(di)))
853 return -EFAULT;
854
70f23020
AE		 855 hdev = hci_dev_get(di.dev_id);
856 if (!hdev)
1da177e4
LT		 857 return -ENODEV;
858
ab81cbf9
JH		 859 hci_del_off_timer(hdev);
860
c542a06c
JH		 861 if (!test_bit(HCI_MGMT, &hdev->flags))
862 set_bit(HCI_PAIRABLE, &hdev->flags);
863
1da177e4
LT		 864 strcpy(di.name, hdev->name);
865 di.bdaddr = hdev->bdaddr;
943da25d 866 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 867 di.flags = hdev->flags;
868 di.pkt_type = hdev->pkt_type;
869 di.acl_mtu = hdev->acl_mtu;
870 di.acl_pkts = hdev->acl_pkts;
871 di.sco_mtu = hdev->sco_mtu;
872 di.sco_pkts = hdev->sco_pkts;
873 di.link_policy = hdev->link_policy;
874 di.link_mode = hdev->link_mode;
875
876 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
877 memcpy(&di.features, &hdev->features, sizeof(di.features));
878
879 if (copy_to_user(arg, &di, sizeof(di)))
880 err = -EFAULT;
881
882 hci_dev_put(hdev);
883
884 return err;
885}
886
887/* ---- Interface to HCI drivers ---- */
888
611b30f7
MH		 889static int hci_rfkill_set_block(void *data, bool blocked)
890{
891 struct hci_dev *hdev = data;
892
893 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
894
895 if (!blocked)
896 return 0;
897
898 hci_dev_do_close(hdev);
899
900 return 0;
901}
902
903static const struct rfkill_ops hci_rfkill_ops = {
904 .set_block = hci_rfkill_set_block,
905};
906
1da177e4
LT		 907/* Alloc HCI device */
908struct hci_dev *hci_alloc_dev(void)
909{
910 struct hci_dev *hdev;
911
25ea6db0 912 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 913 if (!hdev)
914 return NULL;
915
1da177e4
LT		 916 skb_queue_head_init(&hdev->driver_init);
917
918 return hdev;
919}
920EXPORT_SYMBOL(hci_alloc_dev);
921
922/* Free HCI device */
923void hci_free_dev(struct hci_dev *hdev)
924{
925 skb_queue_purge(&hdev->driver_init);
926
a91f2e39
MH		 927 /* will free via device release */
928 put_device(&hdev->dev);
1da177e4
LT		 929}
930EXPORT_SYMBOL(hci_free_dev);
931
ab81cbf9
JH		 932static void hci_power_on(struct work_struct *work)
933{
934 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
935
936 BT_DBG("%s", hdev->name);
937
938 if (hci_dev_open(hdev->id) < 0)
939 return;
940
941 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
942 mod_timer(&hdev->off_timer,
943 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
944
945 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
946 mgmt_index_added(hdev->id);
947}
948
949static void hci_power_off(struct work_struct *work)
950{
951 struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
952
953 BT_DBG("%s", hdev->name);
954
955 hci_dev_close(hdev->id);
956}
957
958static void hci_auto_off(unsigned long data)
959{
960 struct hci_dev *hdev = (struct hci_dev *) data;
961
962 BT_DBG("%s", hdev->name);
963
964 clear_bit(HCI_AUTO_OFF, &hdev->flags);
965
966 queue_work(hdev->workqueue, &hdev->power_off);
967}
968
969void hci_del_off_timer(struct hci_dev *hdev)
970{
971 BT_DBG("%s", hdev->name);
972
973 clear_bit(HCI_AUTO_OFF, &hdev->flags);
974 del_timer(&hdev->off_timer);
975}
976
2aeb9a1a
JH		 977int hci_uuids_clear(struct hci_dev *hdev)
978{
979 struct list_head *p, *n;
980
981 list_for_each_safe(p, n, &hdev->uuids) {
982 struct bt_uuid *uuid;
983
984 uuid = list_entry(p, struct bt_uuid, list);
985
986 list_del(p);
987 kfree(uuid);
988 }
989
990 return 0;
991}
992
55ed8ca1
JH		 993int hci_link_keys_clear(struct hci_dev *hdev)
994{
995 struct list_head *p, *n;
996
997 list_for_each_safe(p, n, &hdev->link_keys) {
998 struct link_key *key;
999
1000 key = list_entry(p, struct link_key, list);
1001
1002 list_del(p);
1003 kfree(key);
1004 }
1005
1006 return 0;
1007}
1008
1009struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1010{
1011 struct list_head *p;
1012
1013 list_for_each(p, &hdev->link_keys) {
1014 struct link_key *k;
1015
1016 k = list_entry(p, struct link_key, list);
1017
1018 if (bacmp(bdaddr, &k->bdaddr) == 0)
1019 return k;
1020 }
1021
1022 return NULL;
1023}
1024
d25e28ab
JH		 1025static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1026 u8 key_type, u8 old_key_type)
1027{
1028 /* Legacy key */
1029 if (key_type < 0x03)
1030 return 1;
1031
1032 /* Debug keys are insecure so don't store them persistently */
1033 if (key_type == HCI_LK_DEBUG_COMBINATION)
1034 return 0;
1035
1036 /* Changed combination key and there's no previous one */
1037 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1038 return 0;
1039
1040 /* Security mode 3 case */
1041 if (!conn)
1042 return 1;
1043
1044 /* Neither local nor remote side had no-bonding as requirement */
1045 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1046 return 1;
1047
1048 /* Local side had dedicated bonding as requirement */
1049 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1050 return 1;
1051
1052 /* Remote side had dedicated bonding as requirement */
1053 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1054 return 1;
1055
1056 /* If none of the above criteria match, then don't store the key
1057 * persistently */
1058 return 0;
1059}
1060
1061int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1062 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1063{
1064 struct link_key *key, *old_key;
1065 u8 old_key_type;
1066
1067 old_key = hci_find_link_key(hdev, bdaddr);
1068 if (old_key) {
1069 old_key_type = old_key->type;
1070 key = old_key;
1071 } else {
12adcf3a 1072 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1073 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1074 if (!key)
1075 return -ENOMEM;
1076 list_add(&key->list, &hdev->link_keys);
1077 }
1078
1079 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1080
d25e28ab
JH		 1081 /* Some buggy controller combinations generate a changed
1082 * combination key for legacy pairing even when there's no
1083 * previous key */
1084 if (type == HCI_LK_CHANGED_COMBINATION &&
1085 (!conn || conn->remote_auth == 0xff) &&
1086 old_key_type == 0xff)
1087 type = HCI_LK_COMBINATION;
1088
1089 if (new_key && !hci_persistent_key(hdev, conn, type, old_key_type)) {
1090 list_del(&key->list);
1091 kfree(key);
1092 return 0;
1093 }
1094
55ed8ca1
JH		 1095 bacpy(&key->bdaddr, bdaddr);
1096 memcpy(key->val, val, 16);
1097 key->type = type;
1098 key->pin_len = pin_len;
1099
1100 if (new_key)
1101 mgmt_new_key(hdev->id, key, old_key_type);
1102
b6020ba0 1103 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1
JH		 1104 key->type = old_key_type;
1105
1106 return 0;
1107}
1108
1109int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1110{
1111 struct link_key *key;
1112
1113 key = hci_find_link_key(hdev, bdaddr);
1114 if (!key)
1115 return -ENOENT;
1116
1117 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1118
1119 list_del(&key->list);
1120 kfree(key);
1121
1122 return 0;
1123}
1124
6bd32326
VT		 1125/* HCI command timer function */
1126static void hci_cmd_timer(unsigned long arg)
1127{
1128 struct hci_dev *hdev = (void *) arg;
1129
1130 BT_ERR("%s command tx timeout", hdev->name);
1131 atomic_set(&hdev->cmd_cnt, 1);
10572132 1132 clear_bit(HCI_RESET, &hdev->flags);
6bd32326
VT		 1133 tasklet_schedule(&hdev->cmd_task);
1134}
1135
2763eda6
SJ		 1136struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1137 bdaddr_t *bdaddr)
1138{
1139 struct oob_data *data;
1140
1141 list_for_each_entry(data, &hdev->remote_oob_data, list)
1142 if (bacmp(bdaddr, &data->bdaddr) == 0)
1143 return data;
1144
1145 return NULL;
1146}
1147
1148int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1149{
1150 struct oob_data *data;
1151
1152 data = hci_find_remote_oob_data(hdev, bdaddr);
1153 if (!data)
1154 return -ENOENT;
1155
1156 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1157
1158 list_del(&data->list);
1159 kfree(data);
1160
1161 return 0;
1162}
1163
1164int hci_remote_oob_data_clear(struct hci_dev *hdev)
1165{
1166 struct oob_data *data, *n;
1167
1168 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1169 list_del(&data->list);
1170 kfree(data);
1171 }
1172
1173 return 0;
1174}
1175
1176int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1177 u8 *randomizer)
1178{
1179 struct oob_data *data;
1180
1181 data = hci_find_remote_oob_data(hdev, bdaddr);
1182
1183 if (!data) {
1184 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1185 if (!data)
1186 return -ENOMEM;
1187
1188 bacpy(&data->bdaddr, bdaddr);
1189 list_add(&data->list, &hdev->remote_oob_data);
1190 }
1191
1192 memcpy(data->hash, hash, sizeof(data->hash));
1193 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1194
1195 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1196
1197 return 0;
1198}
1199
1da177e4
LT		 1200/* Register HCI device */
1201int hci_register_dev(struct hci_dev *hdev)
1202{
1203 struct list_head *head = &hci_dev_list, *p;
ef222013 1204 int i, id = 0;
1da177e4 1205
c13854ce
MH		 1206 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1207 hdev->bus, hdev->owner);
1da177e4
LT		 1208
1209 if (!hdev->open || !hdev->close || !hdev->destruct)
1210 return -EINVAL;
1211
1212 write_lock_bh(&hci_dev_list_lock);
1213
1214 /* Find first available device id */
1215 list_for_each(p, &hci_dev_list) {
1216 if (list_entry(p, struct hci_dev, list)->id != id)
1217 break;
1218 head = p; id++;
1219 }
8e87d142 1220
1da177e4
LT		 1221 sprintf(hdev->name, "hci%d", id);
1222 hdev->id = id;
1223 list_add(&hdev->list, head);
1224
1225 atomic_set(&hdev->refcnt, 1);
1226 spin_lock_init(&hdev->lock);
1227
1228 hdev->flags = 0;
1229 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 1230 hdev->esco_type = (ESCO_HV1);
1da177e4 1231 hdev->link_mode = (HCI_LM_ACCEPT);
17fa4b9d 1232 hdev->io_capability = 0x03; /* No Input No Output */
1da177e4 1233
04837f64
MH		 1234 hdev->idle_timeout = 0;
1235 hdev->sniff_max_interval = 800;
1236 hdev->sniff_min_interval = 80;
1237
70f23020 1238 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1da177e4
LT		 1239 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1240 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1241
1242 skb_queue_head_init(&hdev->rx_q);
1243 skb_queue_head_init(&hdev->cmd_q);
1244 skb_queue_head_init(&hdev->raw_q);
1245
6bd32326
VT		 1246 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1247
cd4c5391 1248 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1249 hdev->reassembly[i] = NULL;
1250
1da177e4 1251 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 1252 mutex_init(&hdev->req_lock);
1da177e4
LT		 1253
1254 inquiry_cache_init(hdev);
1255
1256 hci_conn_hash_init(hdev);
1257
ea4bd8ba 1258 INIT_LIST_HEAD(&hdev->blacklist);
f0358568 1259
2aeb9a1a
JH		 1260 INIT_LIST_HEAD(&hdev->uuids);
1261
55ed8ca1
JH		 1262 INIT_LIST_HEAD(&hdev->link_keys);
1263
2763eda6
SJ		 1264 INIT_LIST_HEAD(&hdev->remote_oob_data);
1265
ab81cbf9
JH		 1266 INIT_WORK(&hdev->power_on, hci_power_on);
1267 INIT_WORK(&hdev->power_off, hci_power_off);
1268 setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1269
1da177e4
LT		 1270 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1271
1272 atomic_set(&hdev->promisc, 0);
1273
1274 write_unlock_bh(&hci_dev_list_lock);
1275
f48fd9c8
MH		 1276 hdev->workqueue = create_singlethread_workqueue(hdev->name);
1277 if (!hdev->workqueue)
1278 goto nomem;
1279
1da177e4
LT		 1280 hci_register_sysfs(hdev);
1281
611b30f7
MH		 1282 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1283 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1284 if (hdev->rfkill) {
1285 if (rfkill_register(hdev->rfkill) < 0) {
1286 rfkill_destroy(hdev->rfkill);
1287 hdev->rfkill = NULL;
1288 }
1289 }
1290
ab81cbf9
JH		 1291 set_bit(HCI_AUTO_OFF, &hdev->flags);
1292 set_bit(HCI_SETUP, &hdev->flags);
1293 queue_work(hdev->workqueue, &hdev->power_on);
1294
1da177e4
LT		 1295 hci_notify(hdev, HCI_DEV_REG);
1296
1297 return id;
f48fd9c8
MH		 1298
1299nomem:
1300 write_lock_bh(&hci_dev_list_lock);
1301 list_del(&hdev->list);
1302 write_unlock_bh(&hci_dev_list_lock);
1303
1304 return -ENOMEM;
1da177e4
LT		 1305}
1306EXPORT_SYMBOL(hci_register_dev);
1307
1308/* Unregister HCI device */
1309int hci_unregister_dev(struct hci_dev *hdev)
1310{
ef222013
MH		 1311 int i;
1312
c13854ce 1313 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1314
1da177e4
LT		 1315 write_lock_bh(&hci_dev_list_lock);
1316 list_del(&hdev->list);
1317 write_unlock_bh(&hci_dev_list_lock);
1318
1319 hci_dev_do_close(hdev);
1320
cd4c5391 1321 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1322 kfree_skb(hdev->reassembly[i]);
1323
ab81cbf9
JH		 1324 if (!test_bit(HCI_INIT, &hdev->flags) &&
1325 !test_bit(HCI_SETUP, &hdev->flags))
1326 mgmt_index_removed(hdev->id);
1327
1da177e4
LT		 1328 hci_notify(hdev, HCI_DEV_UNREG);
1329
611b30f7
MH		 1330 if (hdev->rfkill) {
1331 rfkill_unregister(hdev->rfkill);
1332 rfkill_destroy(hdev->rfkill);
1333 }
1334
147e2d59
DY		 1335 hci_unregister_sysfs(hdev);
1336
c6f3c5f7
GP		 1337 hci_del_off_timer(hdev);
1338
f48fd9c8
MH		 1339 destroy_workqueue(hdev->workqueue);
1340
e2e0cacb
JH		 1341 hci_dev_lock_bh(hdev);
1342 hci_blacklist_clear(hdev);
2aeb9a1a 1343 hci_uuids_clear(hdev);
55ed8ca1 1344 hci_link_keys_clear(hdev);
2763eda6 1345 hci_remote_oob_data_clear(hdev);
e2e0cacb
JH		 1346 hci_dev_unlock_bh(hdev);
1347
1da177e4 1348 __hci_dev_put(hdev);
ef222013 1349
1da177e4
LT		 1350 return 0;
1351}
1352EXPORT_SYMBOL(hci_unregister_dev);
1353
1354/* Suspend HCI device */
1355int hci_suspend_dev(struct hci_dev *hdev)
1356{
1357 hci_notify(hdev, HCI_DEV_SUSPEND);
1358 return 0;
1359}
1360EXPORT_SYMBOL(hci_suspend_dev);
1361
1362/* Resume HCI device */
1363int hci_resume_dev(struct hci_dev *hdev)
1364{
1365 hci_notify(hdev, HCI_DEV_RESUME);
1366 return 0;
1367}
1368EXPORT_SYMBOL(hci_resume_dev);
1369
76bca880
MH		 1370/* Receive frame from HCI drivers */
1371int hci_recv_frame(struct sk_buff *skb)
1372{
1373 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1374 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1375 && !test_bit(HCI_INIT, &hdev->flags))) {
1376 kfree_skb(skb);
1377 return -ENXIO;
1378 }
1379
1380 /* Incomming skb */
1381 bt_cb(skb)->incoming = 1;
1382
1383 /* Time stamp */
1384 __net_timestamp(skb);
1385
1386 /* Queue frame for rx task */
1387 skb_queue_tail(&hdev->rx_q, skb);
c78ae283
MH		 1388 tasklet_schedule(&hdev->rx_task);
1389
76bca880
MH		 1390 return 0;
1391}
1392EXPORT_SYMBOL(hci_recv_frame);
1393
33e882a5 1394static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1e429f38 1395 int count, __u8 index)
33e882a5
SS		 1396{
1397 int len = 0;
1398 int hlen = 0;
1399 int remain = count;
1400 struct sk_buff *skb;
1401 struct bt_skb_cb *scb;
1402
1403 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1404 index >= NUM_REASSEMBLY)
1405 return -EILSEQ;
1406
1407 skb = hdev->reassembly[index];
1408
1409 if (!skb) {
1410 switch (type) {
1411 case HCI_ACLDATA_PKT:
1412 len = HCI_MAX_FRAME_SIZE;
1413 hlen = HCI_ACL_HDR_SIZE;
1414 break;
1415 case HCI_EVENT_PKT:
1416 len = HCI_MAX_EVENT_SIZE;
1417 hlen = HCI_EVENT_HDR_SIZE;
1418 break;
1419 case HCI_SCODATA_PKT:
1420 len = HCI_MAX_SCO_SIZE;
1421 hlen = HCI_SCO_HDR_SIZE;
1422 break;
1423 }
1424
1e429f38 1425 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 1426 if (!skb)
1427 return -ENOMEM;
1428
1429 scb = (void *) skb->cb;
1430 scb->expect = hlen;
1431 scb->pkt_type = type;
1432
1433 skb->dev = (void *) hdev;
1434 hdev->reassembly[index] = skb;
1435 }
1436
1437 while (count) {
1438 scb = (void *) skb->cb;
1439 len = min(scb->expect, (__u16)count);
1440
1441 memcpy(skb_put(skb, len), data, len);
1442
1443 count -= len;
1444 data += len;
1445 scb->expect -= len;
1446 remain = count;
1447
1448 switch (type) {
1449 case HCI_EVENT_PKT:
1450 if (skb->len == HCI_EVENT_HDR_SIZE) {
1451 struct hci_event_hdr *h = hci_event_hdr(skb);
1452 scb->expect = h->plen;
1453
1454 if (skb_tailroom(skb) < scb->expect) {
1455 kfree_skb(skb);
1456 hdev->reassembly[index] = NULL;
1457 return -ENOMEM;
1458 }
1459 }
1460 break;
1461
1462 case HCI_ACLDATA_PKT:
1463 if (skb->len == HCI_ACL_HDR_SIZE) {
1464 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1465 scb->expect = __le16_to_cpu(h->dlen);
1466
1467 if (skb_tailroom(skb) < scb->expect) {
1468 kfree_skb(skb);
1469 hdev->reassembly[index] = NULL;
1470 return -ENOMEM;
1471 }
1472 }
1473 break;
1474
1475 case HCI_SCODATA_PKT:
1476 if (skb->len == HCI_SCO_HDR_SIZE) {
1477 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1478 scb->expect = h->dlen;
1479
1480 if (skb_tailroom(skb) < scb->expect) {
1481 kfree_skb(skb);
1482 hdev->reassembly[index] = NULL;
1483 return -ENOMEM;
1484 }
1485 }
1486 break;
1487 }
1488
1489 if (scb->expect == 0) {
1490 /* Complete frame */
1491
1492 bt_cb(skb)->pkt_type = type;
1493 hci_recv_frame(skb);
1494
1495 hdev->reassembly[index] = NULL;
1496 return remain;
1497 }
1498 }
1499
1500 return remain;
1501}
1502
ef222013
MH		 1503int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1504{
f39a3c06
SS		 1505 int rem = 0;
1506
ef222013
MH		 1507 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1508 return -EILSEQ;
1509
da5f6c37 1510 while (count) {
1e429f38 1511 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 1512 if (rem < 0)
1513 return rem;
ef222013 1514
f39a3c06
SS		 1515 data += (count - rem);
1516 count = rem;
da5f6c37 1517 };
ef222013 1518
f39a3c06 1519 return rem;
ef222013
MH		 1520}
1521EXPORT_SYMBOL(hci_recv_fragment);
1522
99811510
SS		 1523#define STREAM_REASSEMBLY 0
1524
1525int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1526{
1527 int type;
1528 int rem = 0;
1529
da5f6c37 1530 while (count) {
99811510
SS		 1531 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1532
1533 if (!skb) {
1534 struct { char type; } *pkt;
1535
1536 /* Start of the frame */
1537 pkt = data;
1538 type = pkt->type;
1539
1540 data++;
1541 count--;
1542 } else
1543 type = bt_cb(skb)->pkt_type;
1544
1e429f38
GP		 1545 rem = hci_reassembly(hdev, type, data, count,
1546 STREAM_REASSEMBLY);
99811510
SS		 1547 if (rem < 0)
1548 return rem;
1549
1550 data += (count - rem);
1551 count = rem;
da5f6c37 1552 };
99811510
SS		 1553
1554 return rem;
1555}
1556EXPORT_SYMBOL(hci_recv_stream_fragment);
1557
1da177e4
LT		 1558/* ---- Interface to upper protocols ---- */
1559
1560/* Register/Unregister protocols.
1561 * hci_task_lock is used to ensure that no tasks are running. */
1562int hci_register_proto(struct hci_proto *hp)
1563{
1564 int err = 0;
1565
1566 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1567
1568 if (hp->id >= HCI_MAX_PROTO)
1569 return -EINVAL;
1570
1571 write_lock_bh(&hci_task_lock);
1572
1573 if (!hci_proto[hp->id])
1574 hci_proto[hp->id] = hp;
1575 else
1576 err = -EEXIST;
1577
1578 write_unlock_bh(&hci_task_lock);
1579
1580 return err;
1581}
1582EXPORT_SYMBOL(hci_register_proto);
1583
1584int hci_unregister_proto(struct hci_proto *hp)
1585{
1586 int err = 0;
1587
1588 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1589
1590 if (hp->id >= HCI_MAX_PROTO)
1591 return -EINVAL;
1592
1593 write_lock_bh(&hci_task_lock);
1594
1595 if (hci_proto[hp->id])
1596 hci_proto[hp->id] = NULL;
1597 else
1598 err = -ENOENT;
1599
1600 write_unlock_bh(&hci_task_lock);
1601
1602 return err;
1603}
1604EXPORT_SYMBOL(hci_unregister_proto);
1605
1606int hci_register_cb(struct hci_cb *cb)
1607{
1608 BT_DBG("%p name %s", cb, cb->name);
1609
1610 write_lock_bh(&hci_cb_list_lock);
1611 list_add(&cb->list, &hci_cb_list);
1612 write_unlock_bh(&hci_cb_list_lock);
1613
1614 return 0;
1615}
1616EXPORT_SYMBOL(hci_register_cb);
1617
1618int hci_unregister_cb(struct hci_cb *cb)
1619{
1620 BT_DBG("%p name %s", cb, cb->name);
1621
1622 write_lock_bh(&hci_cb_list_lock);
1623 list_del(&cb->list);
1624 write_unlock_bh(&hci_cb_list_lock);
1625
1626 return 0;
1627}
1628EXPORT_SYMBOL(hci_unregister_cb);
1629
1630static int hci_send_frame(struct sk_buff *skb)
1631{
1632 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1633
1634 if (!hdev) {
1635 kfree_skb(skb);
1636 return -ENODEV;
1637 }
1638
0d48d939 1639 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1640
1641 if (atomic_read(&hdev->promisc)) {
1642 /* Time stamp */
a61bbcf2 1643 __net_timestamp(skb);
1da177e4 1644
eec8d2bc 1645 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1646 }
1647
1648 /* Get rid of skb owner, prior to sending to the driver. */
1649 skb_orphan(skb);
1650
1651 return hdev->send(skb);
1652}
1653
1654/* Send HCI command */
a9de9248 1655int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1656{
1657 int len = HCI_COMMAND_HDR_SIZE + plen;
1658 struct hci_command_hdr *hdr;
1659 struct sk_buff *skb;
1660
a9de9248 1661 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1662
1663 skb = bt_skb_alloc(len, GFP_ATOMIC);
1664 if (!skb) {
ef222013 1665 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1666 return -ENOMEM;
1667 }
1668
1669 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1670 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1671 hdr->plen = plen;
1672
1673 if (plen)
1674 memcpy(skb_put(skb, plen), param, plen);
1675
1676 BT_DBG("skb len %d", skb->len);
1677
0d48d939 1678 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 1679 skb->dev = (void *) hdev;
c78ae283 1680
a5040efa
JH		 1681 if (test_bit(HCI_INIT, &hdev->flags))
1682 hdev->init_last_cmd = opcode;
1683
1da177e4 1684 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 1685 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 1686
1687 return 0;
1688}
1da177e4
LT		 1689
1690/* Get data from the previously sent command */
a9de9248 1691void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1692{
1693 struct hci_command_hdr *hdr;
1694
1695 if (!hdev->sent_cmd)
1696 return NULL;
1697
1698 hdr = (void *) hdev->sent_cmd->data;
1699
a9de9248 1700 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1701 return NULL;
1702
a9de9248 1703 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1704
1705 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1706}
1707
1708/* Send ACL data */
1709static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1710{
1711 struct hci_acl_hdr *hdr;
1712 int len = skb->len;
1713
badff6d0
ACM		 1714 skb_push(skb, HCI_ACL_HDR_SIZE);
1715 skb_reset_transport_header(skb);
9c70220b 1716 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1717 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1718 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1719}
1720
9a9c6a34 1721void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1da177e4
LT		 1722{
1723 struct hci_dev *hdev = conn->hdev;
1724 struct sk_buff *list;
1725
1726 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1727
1728 skb->dev = (void *) hdev;
0d48d939 1729 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1730 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4 1731
70f23020
AE		 1732 list = skb_shinfo(skb)->frag_list;
1733 if (!list) {
1da177e4
LT		 1734 /* Non fragmented */
1735 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1736
1737 skb_queue_tail(&conn->data_q, skb);
1738 } else {
1739 /* Fragmented */
1740 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1741
1742 skb_shinfo(skb)->frag_list = NULL;
1743
1744 /* Queue all fragments atomically */
1745 spin_lock_bh(&conn->data_q.lock);
1746
1747 __skb_queue_tail(&conn->data_q, skb);
e702112f
AE		 1748
1749 flags &= ~ACL_START;
1750 flags |= ACL_CONT;
1da177e4
LT		 1751 do {
1752 skb = list; list = list->next;
8e87d142 1753
1da177e4 1754 skb->dev = (void *) hdev;
0d48d939 1755 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1756 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 1757
1758 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1759
1760 __skb_queue_tail(&conn->data_q, skb);
1761 } while (list);
1762
1763 spin_unlock_bh(&conn->data_q.lock);
1764 }
1765
c78ae283 1766 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 1767}
1768EXPORT_SYMBOL(hci_send_acl);
1769
1770/* Send SCO data */
0d861d8b 1771void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 1772{
1773 struct hci_dev *hdev = conn->hdev;
1774 struct hci_sco_hdr hdr;
1775
1776 BT_DBG("%s len %d", hdev->name, skb->len);
1777
aca3192c 1778 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 1779 hdr.dlen = skb->len;
1780
badff6d0
ACM		 1781 skb_push(skb, HCI_SCO_HDR_SIZE);
1782 skb_reset_transport_header(skb);
9c70220b 1783 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 1784
1785 skb->dev = (void *) hdev;
0d48d939 1786 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 1787
1da177e4 1788 skb_queue_tail(&conn->data_q, skb);
c78ae283 1789 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 1790}
1791EXPORT_SYMBOL(hci_send_sco);
1792
1793/* ---- HCI TX task (outgoing data) ---- */
1794
1795/* HCI Connection scheduler */
1796static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1797{
1798 struct hci_conn_hash *h = &hdev->conn_hash;
5b7f9909 1799 struct hci_conn *conn = NULL;
1da177e4
LT		 1800 int num = 0, min = ~0;
1801 struct list_head *p;
1802
8e87d142 1803 /* We don't have to lock device here. Connections are always
1da177e4
LT		 1804 * added and removed with TX task disabled. */
1805 list_for_each(p, &h->list) {
1806 struct hci_conn *c;
1807 c = list_entry(p, struct hci_conn, list);
1808
769be974 1809 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 1810 continue;
769be974
MH		 1811
1812 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1813 continue;
1814
1da177e4
LT		 1815 num++;
1816
1817 if (c->sent < min) {
1818 min = c->sent;
1819 conn = c;
1820 }
1821 }
1822
1823 if (conn) {
6ed58ec5
VT		 1824 int cnt, q;
1825
1826 switch (conn->type) {
1827 case ACL_LINK:
1828 cnt = hdev->acl_cnt;
1829 break;
1830 case SCO_LINK:
1831 case ESCO_LINK:
1832 cnt = hdev->sco_cnt;
1833 break;
1834 case LE_LINK:
1835 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
1836 break;
1837 default:
1838 cnt = 0;
1839 BT_ERR("Unknown link type");
1840 }
1841
1842 q = cnt / num;
1da177e4
LT		 1843 *quote = q ? q : 1;
1844 } else
1845 *quote = 0;
1846
1847 BT_DBG("conn %p quote %d", conn, *quote);
1848 return conn;
1849}
1850
bae1f5d9 1851static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 1852{
1853 struct hci_conn_hash *h = &hdev->conn_hash;
1854 struct list_head *p;
1855 struct hci_conn *c;
1856
bae1f5d9 1857 BT_ERR("%s link tx timeout", hdev->name);
1da177e4
LT		 1858
1859 /* Kill stalled connections */
1860 list_for_each(p, &h->list) {
1861 c = list_entry(p, struct hci_conn, list);
bae1f5d9
VT		 1862 if (c->type == type && c->sent) {
1863 BT_ERR("%s killing stalled connection %s",
1da177e4
LT		 1864 hdev->name, batostr(&c->dst));
1865 hci_acl_disconn(c, 0x13);
1866 }
1867 }
1868}
1869
1870static inline void hci_sched_acl(struct hci_dev *hdev)
1871{
1872 struct hci_conn *conn;
1873 struct sk_buff *skb;
1874 int quote;
1875
1876 BT_DBG("%s", hdev->name);
1877
1878 if (!test_bit(HCI_RAW, &hdev->flags)) {
1879 /* ACL tx timeout must be longer than maximum
1880 * link supervision timeout (40.9 seconds) */
82453021 1881 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
bae1f5d9 1882 hci_link_tx_to(hdev, ACL_LINK);
1da177e4
LT		 1883 }
1884
1885 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1886 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1887 BT_DBG("skb %p len %d", skb, skb->len);
04837f64
MH		 1888
1889 hci_conn_enter_active_mode(conn);
1890
1da177e4
LT		 1891 hci_send_frame(skb);
1892 hdev->acl_last_tx = jiffies;
1893
1894 hdev->acl_cnt--;
1895 conn->sent++;
1896 }
1897 }
1898}
1899
1900/* Schedule SCO */
1901static inline void hci_sched_sco(struct hci_dev *hdev)
1902{
1903 struct hci_conn *conn;
1904 struct sk_buff *skb;
1905 int quote;
1906
1907 BT_DBG("%s", hdev->name);
1908
1909 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1910 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1911 BT_DBG("skb %p len %d", skb, skb->len);
1912 hci_send_frame(skb);
1913
1914 conn->sent++;
1915 if (conn->sent == ~0)
1916 conn->sent = 0;
1917 }
1918 }
1919}
1920
b6a0dc82
MH		 1921static inline void hci_sched_esco(struct hci_dev *hdev)
1922{
1923 struct hci_conn *conn;
1924 struct sk_buff *skb;
1925 int quote;
1926
1927 BT_DBG("%s", hdev->name);
1928
1929 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
1930 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1931 BT_DBG("skb %p len %d", skb, skb->len);
1932 hci_send_frame(skb);
1933
1934 conn->sent++;
1935 if (conn->sent == ~0)
1936 conn->sent = 0;
1937 }
1938 }
1939}
1940
6ed58ec5
VT		 1941static inline void hci_sched_le(struct hci_dev *hdev)
1942{
1943 struct hci_conn *conn;
1944 struct sk_buff *skb;
1945 int quote, cnt;
1946
1947 BT_DBG("%s", hdev->name);
1948
1949 if (!test_bit(HCI_RAW, &hdev->flags)) {
1950 /* LE tx timeout must be longer than maximum
1951 * link supervision timeout (40.9 seconds) */
bae1f5d9 1952 if (!hdev->le_cnt && hdev->le_pkts &&
6ed58ec5 1953 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 1954 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 1955 }
1956
1957 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
1958 while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
1959 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1960 BT_DBG("skb %p len %d", skb, skb->len);
1961
1962 hci_send_frame(skb);
1963 hdev->le_last_tx = jiffies;
1964
1965 cnt--;
1966 conn->sent++;
1967 }
1968 }
1969 if (hdev->le_pkts)
1970 hdev->le_cnt = cnt;
1971 else
1972 hdev->acl_cnt = cnt;
1973}
1974
1da177e4
LT		 1975static void hci_tx_task(unsigned long arg)
1976{
1977 struct hci_dev *hdev = (struct hci_dev *) arg;
1978 struct sk_buff *skb;
1979
1980 read_lock(&hci_task_lock);
1981
6ed58ec5
VT		 1982 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
1983 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 1984
1985 /* Schedule queues and send stuff to HCI driver */
1986
1987 hci_sched_acl(hdev);
1988
1989 hci_sched_sco(hdev);
1990
b6a0dc82
MH		 1991 hci_sched_esco(hdev);
1992
6ed58ec5
VT		 1993 hci_sched_le(hdev);
1994
1da177e4
LT		 1995 /* Send next queued raw (unknown type) packet */
1996 while ((skb = skb_dequeue(&hdev->raw_q)))
1997 hci_send_frame(skb);
1998
1999 read_unlock(&hci_task_lock);
2000}
2001
2002/* ----- HCI RX task (incoming data proccessing) ----- */
2003
2004/* ACL data packet */
2005static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2006{
2007 struct hci_acl_hdr *hdr = (void *) skb->data;
2008 struct hci_conn *conn;
2009 __u16 handle, flags;
2010
2011 skb_pull(skb, HCI_ACL_HDR_SIZE);
2012
2013 handle = __le16_to_cpu(hdr->handle);
2014 flags = hci_flags(handle);
2015 handle = hci_handle(handle);
2016
2017 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2018
2019 hdev->stat.acl_rx++;
2020
2021 hci_dev_lock(hdev);
2022 conn = hci_conn_hash_lookup_handle(hdev, handle);
2023 hci_dev_unlock(hdev);
8e87d142 2024
1da177e4
LT		 2025 if (conn) {
2026 register struct hci_proto *hp;
2027
04837f64
MH		 2028 hci_conn_enter_active_mode(conn);
2029
1da177e4 2030 /* Send to upper protocol */
70f23020
AE		 2031 hp = hci_proto[HCI_PROTO_L2CAP];
2032 if (hp && hp->recv_acldata) {
1da177e4
LT		 2033 hp->recv_acldata(conn, skb, flags);
2034 return;
2035 }
2036 } else {
8e87d142 2037 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 2038 hdev->name, handle);
2039 }
2040
2041 kfree_skb(skb);
2042}
2043
2044/* SCO data packet */
2045static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2046{
2047 struct hci_sco_hdr *hdr = (void *) skb->data;
2048 struct hci_conn *conn;
2049 __u16 handle;
2050
2051 skb_pull(skb, HCI_SCO_HDR_SIZE);
2052
2053 handle = __le16_to_cpu(hdr->handle);
2054
2055 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2056
2057 hdev->stat.sco_rx++;
2058
2059 hci_dev_lock(hdev);
2060 conn = hci_conn_hash_lookup_handle(hdev, handle);
2061 hci_dev_unlock(hdev);
2062
2063 if (conn) {
2064 register struct hci_proto *hp;
2065
2066 /* Send to upper protocol */
70f23020
AE		 2067 hp = hci_proto[HCI_PROTO_SCO];
2068 if (hp && hp->recv_scodata) {
1da177e4
LT		 2069 hp->recv_scodata(conn, skb);
2070 return;
2071 }
2072 } else {
8e87d142 2073 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 2074 hdev->name, handle);
2075 }
2076
2077 kfree_skb(skb);
2078}
2079
6516455d 2080static void hci_rx_task(unsigned long arg)
1da177e4
LT		 2081{
2082 struct hci_dev *hdev = (struct hci_dev *) arg;
2083 struct sk_buff *skb;
2084
2085 BT_DBG("%s", hdev->name);
2086
2087 read_lock(&hci_task_lock);
2088
2089 while ((skb = skb_dequeue(&hdev->rx_q))) {
2090 if (atomic_read(&hdev->promisc)) {
2091 /* Send copy to the sockets */
eec8d2bc 2092 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 2093 }
2094
2095 if (test_bit(HCI_RAW, &hdev->flags)) {
2096 kfree_skb(skb);
2097 continue;
2098 }
2099
2100 if (test_bit(HCI_INIT, &hdev->flags)) {
2101 /* Don't process data packets in this states. */
0d48d939 2102 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2103 case HCI_ACLDATA_PKT:
2104 case HCI_SCODATA_PKT:
2105 kfree_skb(skb);
2106 continue;
3ff50b79 2107 }
1da177e4
LT		 2108 }
2109
2110 /* Process frame */
0d48d939 2111 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2112 case HCI_EVENT_PKT:
2113 hci_event_packet(hdev, skb);
2114 break;
2115
2116 case HCI_ACLDATA_PKT:
2117 BT_DBG("%s ACL data packet", hdev->name);
2118 hci_acldata_packet(hdev, skb);
2119 break;
2120
2121 case HCI_SCODATA_PKT:
2122 BT_DBG("%s SCO data packet", hdev->name);
2123 hci_scodata_packet(hdev, skb);
2124 break;
2125
2126 default:
2127 kfree_skb(skb);
2128 break;
2129 }
2130 }
2131
2132 read_unlock(&hci_task_lock);
2133}
2134
2135static void hci_cmd_task(unsigned long arg)
2136{
2137 struct hci_dev *hdev = (struct hci_dev *) arg;
2138 struct sk_buff *skb;
2139
2140 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2141
1da177e4 2142 /* Send queued commands */
5a08ecce
AE		 2143 if (atomic_read(&hdev->cmd_cnt)) {
2144 skb = skb_dequeue(&hdev->cmd_q);
2145 if (!skb)
2146 return;
2147
7585b97a 2148 kfree_skb(hdev->sent_cmd);
1da177e4 2149
70f23020
AE		 2150 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2151 if (hdev->sent_cmd) {
1da177e4
LT		 2152 atomic_dec(&hdev->cmd_cnt);
2153 hci_send_frame(skb);
6bd32326
VT		 2154 mod_timer(&hdev->cmd_timer,
2155 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
1da177e4
LT		 2156 } else {
2157 skb_queue_head(&hdev->cmd_q, skb);
c78ae283 2158 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 2159 }
2160 }
2161}
kernel source for telekom puls (alcatel/mediatek)