projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Ignore hci_unregister_dev return value
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
f48fd9c8 40#include <linux/workqueue.h>
1da177e4
LT		 41#include <linux/interrupt.h>
42#include <linux/notifier.h>
611b30f7 43#include <linux/rfkill.h>
6bd32326 44#include <linux/timer.h>
3a0259bb 45#include <linux/crypto.h>
1da177e4
LT		 46#include <net/sock.h>
47
48#include <asm/system.h>
70f23020 49#include <linux/uaccess.h>
1da177e4
LT		 50#include <asm/unaligned.h>
51
52#include <net/bluetooth/bluetooth.h>
53#include <net/bluetooth/hci_core.h>
54
ab81cbf9
JH		 55#define AUTO_OFF_TIMEOUT 2000
56
1da177e4
LT		 57static void hci_cmd_task(unsigned long arg);
58static void hci_rx_task(unsigned long arg);
59static void hci_tx_task(unsigned long arg);
1da177e4
LT		 60
61static DEFINE_RWLOCK(hci_task_lock);
62
63/* HCI device list */
64LIST_HEAD(hci_dev_list);
65DEFINE_RWLOCK(hci_dev_list_lock);
66
67/* HCI callback list */
68LIST_HEAD(hci_cb_list);
69DEFINE_RWLOCK(hci_cb_list_lock);
70
71/* HCI protocols */
72#define HCI_MAX_PROTO 2
73struct hci_proto *hci_proto[HCI_MAX_PROTO];
74
75/* HCI notifiers list */
e041c683 76static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 77
78/* ---- HCI notifications ---- */
79
80int hci_register_notifier(struct notifier_block *nb)
81{
e041c683 82 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 83}
84
85int hci_unregister_notifier(struct notifier_block *nb)
86{
e041c683 87 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 88}
89
6516455d 90static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 91{
e041c683 92 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 93}
94
95/* ---- HCI requests ---- */
96
23bb5763 97void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 98{
23bb5763
JH		 99 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
100
a5040efa
JH		 101 /* If this is the init phase check if the completed command matches
102 * the last init command, and if not just return.
103 */
104 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
23bb5763 105 return;
1da177e4
LT		 106
107 if (hdev->req_status == HCI_REQ_PEND) {
108 hdev->req_result = result;
109 hdev->req_status = HCI_REQ_DONE;
110 wake_up_interruptible(&hdev->req_wait_q);
111 }
112}
113
114static void hci_req_cancel(struct hci_dev *hdev, int err)
115{
116 BT_DBG("%s err 0x%2.2x", hdev->name, err);
117
118 if (hdev->req_status == HCI_REQ_PEND) {
119 hdev->req_result = err;
120 hdev->req_status = HCI_REQ_CANCELED;
121 wake_up_interruptible(&hdev->req_wait_q);
122 }
123}
124
125/* Execute request and wait for completion. */
8e87d142 126static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 127 unsigned long opt, __u32 timeout)
1da177e4
LT		 128{
129 DECLARE_WAITQUEUE(wait, current);
130 int err = 0;
131
132 BT_DBG("%s start", hdev->name);
133
134 hdev->req_status = HCI_REQ_PEND;
135
136 add_wait_queue(&hdev->req_wait_q, &wait);
137 set_current_state(TASK_INTERRUPTIBLE);
138
139 req(hdev, opt);
140 schedule_timeout(timeout);
141
142 remove_wait_queue(&hdev->req_wait_q, &wait);
143
144 if (signal_pending(current))
145 return -EINTR;
146
147 switch (hdev->req_status) {
148 case HCI_REQ_DONE:
e175072f 149 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 150 break;
151
152 case HCI_REQ_CANCELED:
153 err = -hdev->req_result;
154 break;
155
156 default:
157 err = -ETIMEDOUT;
158 break;
3ff50b79 159 }
1da177e4 160
a5040efa 161 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 162
163 BT_DBG("%s end: err %d", hdev->name, err);
164
165 return err;
166}
167
168static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 169 unsigned long opt, __u32 timeout)
1da177e4
LT		 170{
171 int ret;
172
7c6a329e
MH		 173 if (!test_bit(HCI_UP, &hdev->flags))
174 return -ENETDOWN;
175
1da177e4
LT		 176 /* Serialize all requests */
177 hci_req_lock(hdev);
178 ret = __hci_request(hdev, req, opt, timeout);
179 hci_req_unlock(hdev);
180
181 return ret;
182}
183
184static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
185{
186 BT_DBG("%s %ld", hdev->name, opt);
187
188 /* Reset device */
f630cf0d 189 set_bit(HCI_RESET, &hdev->flags);
a9de9248 190 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 191}
192
193static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
194{
b0916ea0 195 struct hci_cp_delete_stored_link_key cp;
1da177e4 196 struct sk_buff *skb;
1ebb9252 197 __le16 param;
89f2783d 198 __u8 flt_type;
1da177e4
LT		 199
200 BT_DBG("%s %ld", hdev->name, opt);
201
202 /* Driver initialization */
203
204 /* Special commands */
205 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 206 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 207 skb->dev = (void *) hdev;
c78ae283 208
1da177e4 209 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 210 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 211 }
212 skb_queue_purge(&hdev->driver_init);
213
214 /* Mandatory initialization */
215
216 /* Reset */
f630cf0d
GP		 217 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
218 set_bit(HCI_RESET, &hdev->flags);
a9de9248 219 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
f630cf0d 220 }
1da177e4
LT		 221
222 /* Read Local Supported Features */
a9de9248 223 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 224
1143e5a6 225 /* Read Local Version */
a9de9248 226 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 227
1da177e4 228 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 229 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 230
231#if 0
232 /* Host buffer size */
233 {
234 struct hci_cp_host_buffer_size cp;
aca3192c 235 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 236 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 237 cp.acl_max_pkt = cpu_to_le16(0xffff);
238 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 239 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 240 }
241#endif
242
243 /* Read BD Address */
a9de9248
MH		 244 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
245
246 /* Read Class of Device */
247 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
248
249 /* Read Local Name */
250 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 251
252 /* Read Voice Setting */
a9de9248 253 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 254
255 /* Optional initialization */
256
257 /* Clear Event Filters */
89f2783d 258 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 259 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4 260
1da177e4 261 /* Connection accept timeout ~20 secs */
aca3192c 262 param = cpu_to_le16(0x7d00);
a9de9248 263 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
b0916ea0
JH		 264
265 bacpy(&cp.bdaddr, BDADDR_ANY);
266 cp.delete_all = 1;
267 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
1da177e4
LT		 268}
269
6ed58ec5
VT		 270static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
271{
272 BT_DBG("%s", hdev->name);
273
274 /* Read LE buffer size */
275 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
276}
277
1da177e4
LT		 278static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
279{
280 __u8 scan = opt;
281
282 BT_DBG("%s %x", hdev->name, scan);
283
284 /* Inquiry and Page scans */
a9de9248 285 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 286}
287
288static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
289{
290 __u8 auth = opt;
291
292 BT_DBG("%s %x", hdev->name, auth);
293
294 /* Authentication */
a9de9248 295 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 296}
297
298static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
299{
300 __u8 encrypt = opt;
301
302 BT_DBG("%s %x", hdev->name, encrypt);
303
e4e8e37c 304 /* Encryption */
a9de9248 305 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 306}
307
e4e8e37c
MH		 308static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
309{
310 __le16 policy = cpu_to_le16(opt);
311
a418b893 312 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 313
314 /* Default link policy */
315 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
316}
317
8e87d142 318/* Get HCI device by index.
1da177e4
LT		 319 * Device is held on return. */
320struct hci_dev *hci_dev_get(int index)
321{
322 struct hci_dev *hdev = NULL;
323 struct list_head *p;
324
325 BT_DBG("%d", index);
326
327 if (index < 0)
328 return NULL;
329
330 read_lock(&hci_dev_list_lock);
331 list_for_each(p, &hci_dev_list) {
332 struct hci_dev *d = list_entry(p, struct hci_dev, list);
333 if (d->id == index) {
334 hdev = hci_dev_hold(d);
335 break;
336 }
337 }
338 read_unlock(&hci_dev_list_lock);
339 return hdev;
340}
1da177e4
LT		 341
342/* ---- Inquiry support ---- */
343static void inquiry_cache_flush(struct hci_dev *hdev)
344{
345 struct inquiry_cache *cache = &hdev->inq_cache;
346 struct inquiry_entry *next = cache->list, *e;
347
348 BT_DBG("cache %p", cache);
349
350 cache->list = NULL;
351 while ((e = next)) {
352 next = e->next;
353 kfree(e);
354 }
355}
356
357struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
358{
359 struct inquiry_cache *cache = &hdev->inq_cache;
360 struct inquiry_entry *e;
361
362 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
363
364 for (e = cache->list; e; e = e->next)
365 if (!bacmp(&e->data.bdaddr, bdaddr))
366 break;
367 return e;
368}
369
370void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
371{
372 struct inquiry_cache *cache = &hdev->inq_cache;
70f23020 373 struct inquiry_entry *ie;
1da177e4
LT		 374
375 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
376
70f23020
AE		 377 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
378 if (!ie) {
1da177e4 379 /* Entry not in the cache. Add new one. */
70f23020
AE		 380 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
381 if (!ie)
1da177e4 382 return;
70f23020
AE		 383
384 ie->next = cache->list;
385 cache->list = ie;
1da177e4
LT		 386 }
387
70f23020
AE		 388 memcpy(&ie->data, data, sizeof(*data));
389 ie->timestamp = jiffies;
1da177e4
LT		 390 cache->timestamp = jiffies;
391}
392
393static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
394{
395 struct inquiry_cache *cache = &hdev->inq_cache;
396 struct inquiry_info *info = (struct inquiry_info *) buf;
397 struct inquiry_entry *e;
398 int copied = 0;
399
400 for (e = cache->list; e && copied < num; e = e->next, copied++) {
401 struct inquiry_data *data = &e->data;
402 bacpy(&info->bdaddr, &data->bdaddr);
403 info->pscan_rep_mode = data->pscan_rep_mode;
404 info->pscan_period_mode = data->pscan_period_mode;
405 info->pscan_mode = data->pscan_mode;
406 memcpy(info->dev_class, data->dev_class, 3);
407 info->clock_offset = data->clock_offset;
408 info++;
409 }
410
411 BT_DBG("cache %p, copied %d", cache, copied);
412 return copied;
413}
414
415static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
416{
417 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
418 struct hci_cp_inquiry cp;
419
420 BT_DBG("%s", hdev->name);
421
422 if (test_bit(HCI_INQUIRY, &hdev->flags))
423 return;
424
425 /* Start Inquiry */
426 memcpy(&cp.lap, &ir->lap, 3);
427 cp.length = ir->length;
428 cp.num_rsp = ir->num_rsp;
a9de9248 429 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 430}
431
432int hci_inquiry(void __user *arg)
433{
434 __u8 __user *ptr = arg;
435 struct hci_inquiry_req ir;
436 struct hci_dev *hdev;
437 int err = 0, do_inquiry = 0, max_rsp;
438 long timeo;
439 __u8 *buf;
440
441 if (copy_from_user(&ir, ptr, sizeof(ir)))
442 return -EFAULT;
443
5a08ecce
AE		 444 hdev = hci_dev_get(ir.dev_id);
445 if (!hdev)
1da177e4
LT		 446 return -ENODEV;
447
448 hci_dev_lock_bh(hdev);
8e87d142 449 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
70f23020
AE		 450 inquiry_cache_empty(hdev) ||
451 ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 452 inquiry_cache_flush(hdev);
453 do_inquiry = 1;
454 }
455 hci_dev_unlock_bh(hdev);
456
04837f64 457 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 458
459 if (do_inquiry) {
460 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
461 if (err < 0)
462 goto done;
463 }
1da177e4
LT		 464
465 /* for unlimited number of responses we will use buffer with 255 entries */
466 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
467
468 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
469 * copy it to the user space.
470 */
01df8c31 471 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 472 if (!buf) {
1da177e4
LT		 473 err = -ENOMEM;
474 goto done;
475 }
476
477 hci_dev_lock_bh(hdev);
478 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
479 hci_dev_unlock_bh(hdev);
480
481 BT_DBG("num_rsp %d", ir.num_rsp);
482
483 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
484 ptr += sizeof(ir);
485 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
486 ir.num_rsp))
487 err = -EFAULT;
8e87d142 488 } else
1da177e4
LT		 489 err = -EFAULT;
490
491 kfree(buf);
492
493done:
494 hci_dev_put(hdev);
495 return err;
496}
497
498/* ---- HCI ioctl helpers ---- */
499
500int hci_dev_open(__u16 dev)
501{
502 struct hci_dev *hdev;
503 int ret = 0;
504
5a08ecce
AE		 505 hdev = hci_dev_get(dev);
506 if (!hdev)
1da177e4
LT		 507 return -ENODEV;
508
509 BT_DBG("%s %p", hdev->name, hdev);
510
511 hci_req_lock(hdev);
512
611b30f7
MH		 513 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
514 ret = -ERFKILL;
515 goto done;
516 }
517
1da177e4
LT		 518 if (test_bit(HCI_UP, &hdev->flags)) {
519 ret = -EALREADY;
520 goto done;
521 }
522
523 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
524 set_bit(HCI_RAW, &hdev->flags);
525
943da25d
MH		 526 /* Treat all non BR/EDR controllers as raw devices for now */
527 if (hdev->dev_type != HCI_BREDR)
528 set_bit(HCI_RAW, &hdev->flags);
529
1da177e4
LT		 530 if (hdev->open(hdev)) {
531 ret = -EIO;
532 goto done;
533 }
534
535 if (!test_bit(HCI_RAW, &hdev->flags)) {
536 atomic_set(&hdev->cmd_cnt, 1);
537 set_bit(HCI_INIT, &hdev->flags);
a5040efa 538 hdev->init_last_cmd = 0;
1da177e4 539
04837f64
MH		 540 ret = __hci_request(hdev, hci_init_req, 0,
541 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4 542
eead27da 543 if (lmp_host_le_capable(hdev))
6ed58ec5
VT		 544 ret = __hci_request(hdev, hci_le_init_req, 0,
545 msecs_to_jiffies(HCI_INIT_TIMEOUT));
546
1da177e4
LT		 547 clear_bit(HCI_INIT, &hdev->flags);
548 }
549
550 if (!ret) {
551 hci_dev_hold(hdev);
552 set_bit(HCI_UP, &hdev->flags);
553 hci_notify(hdev, HCI_DEV_UP);
5add6af8
JH		 554 if (!test_bit(HCI_SETUP, &hdev->flags))
555 mgmt_powered(hdev->id, 1);
8e87d142 556 } else {
1da177e4
LT		 557 /* Init failed, cleanup */
558 tasklet_kill(&hdev->rx_task);
559 tasklet_kill(&hdev->tx_task);
560 tasklet_kill(&hdev->cmd_task);
561
562 skb_queue_purge(&hdev->cmd_q);
563 skb_queue_purge(&hdev->rx_q);
564
565 if (hdev->flush)
566 hdev->flush(hdev);
567
568 if (hdev->sent_cmd) {
569 kfree_skb(hdev->sent_cmd);
570 hdev->sent_cmd = NULL;
571 }
572
573 hdev->close(hdev);
574 hdev->flags = 0;
575 }
576
577done:
578 hci_req_unlock(hdev);
579 hci_dev_put(hdev);
580 return ret;
581}
582
583static int hci_dev_do_close(struct hci_dev *hdev)
584{
585 BT_DBG("%s %p", hdev->name, hdev);
586
587 hci_req_cancel(hdev, ENODEV);
588 hci_req_lock(hdev);
589
590 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 591 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 592 hci_req_unlock(hdev);
593 return 0;
594 }
595
596 /* Kill RX and TX tasks */
597 tasklet_kill(&hdev->rx_task);
598 tasklet_kill(&hdev->tx_task);
599
600 hci_dev_lock_bh(hdev);
601 inquiry_cache_flush(hdev);
602 hci_conn_hash_flush(hdev);
603 hci_dev_unlock_bh(hdev);
604
605 hci_notify(hdev, HCI_DEV_DOWN);
606
607 if (hdev->flush)
608 hdev->flush(hdev);
609
610 /* Reset device */
611 skb_queue_purge(&hdev->cmd_q);
612 atomic_set(&hdev->cmd_cnt, 1);
613 if (!test_bit(HCI_RAW, &hdev->flags)) {
614 set_bit(HCI_INIT, &hdev->flags);
04837f64
MH		 615 __hci_request(hdev, hci_reset_req, 0,
616 msecs_to_jiffies(250));
1da177e4
LT		 617 clear_bit(HCI_INIT, &hdev->flags);
618 }
619
620 /* Kill cmd task */
621 tasklet_kill(&hdev->cmd_task);
622
623 /* Drop queues */
624 skb_queue_purge(&hdev->rx_q);
625 skb_queue_purge(&hdev->cmd_q);
626 skb_queue_purge(&hdev->raw_q);
627
628 /* Drop last sent command */
629 if (hdev->sent_cmd) {
b79f44c1 630 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 631 kfree_skb(hdev->sent_cmd);
632 hdev->sent_cmd = NULL;
633 }
634
635 /* After this point our queues are empty
636 * and no tasks are scheduled. */
637 hdev->close(hdev);
638
5add6af8
JH		 639 mgmt_powered(hdev->id, 0);
640
1da177e4
LT		 641 /* Clear flags */
642 hdev->flags = 0;
643
644 hci_req_unlock(hdev);
645
646 hci_dev_put(hdev);
647 return 0;
648}
649
650int hci_dev_close(__u16 dev)
651{
652 struct hci_dev *hdev;
653 int err;
654
70f23020
AE		 655 hdev = hci_dev_get(dev);
656 if (!hdev)
1da177e4
LT		 657 return -ENODEV;
658 err = hci_dev_do_close(hdev);
659 hci_dev_put(hdev);
660 return err;
661}
662
663int hci_dev_reset(__u16 dev)
664{
665 struct hci_dev *hdev;
666 int ret = 0;
667
70f23020
AE		 668 hdev = hci_dev_get(dev);
669 if (!hdev)
1da177e4
LT		 670 return -ENODEV;
671
672 hci_req_lock(hdev);
673 tasklet_disable(&hdev->tx_task);
674
675 if (!test_bit(HCI_UP, &hdev->flags))
676 goto done;
677
678 /* Drop queues */
679 skb_queue_purge(&hdev->rx_q);
680 skb_queue_purge(&hdev->cmd_q);
681
682 hci_dev_lock_bh(hdev);
683 inquiry_cache_flush(hdev);
684 hci_conn_hash_flush(hdev);
685 hci_dev_unlock_bh(hdev);
686
687 if (hdev->flush)
688 hdev->flush(hdev);
689
8e87d142 690 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 691 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 692
693 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 694 ret = __hci_request(hdev, hci_reset_req, 0,
695 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 696
697done:
698 tasklet_enable(&hdev->tx_task);
699 hci_req_unlock(hdev);
700 hci_dev_put(hdev);
701 return ret;
702}
703
704int hci_dev_reset_stat(__u16 dev)
705{
706 struct hci_dev *hdev;
707 int ret = 0;
708
70f23020
AE		 709 hdev = hci_dev_get(dev);
710 if (!hdev)
1da177e4
LT		 711 return -ENODEV;
712
713 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
714
715 hci_dev_put(hdev);
716
717 return ret;
718}
719
720int hci_dev_cmd(unsigned int cmd, void __user *arg)
721{
722 struct hci_dev *hdev;
723 struct hci_dev_req dr;
724 int err = 0;
725
726 if (copy_from_user(&dr, arg, sizeof(dr)))
727 return -EFAULT;
728
70f23020
AE		 729 hdev = hci_dev_get(dr.dev_id);
730 if (!hdev)
1da177e4
LT		 731 return -ENODEV;
732
733 switch (cmd) {
734 case HCISETAUTH:
04837f64
MH		 735 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
736 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 737 break;
738
739 case HCISETENCRYPT:
740 if (!lmp_encrypt_capable(hdev)) {
741 err = -EOPNOTSUPP;
742 break;
743 }
744
745 if (!test_bit(HCI_AUTH, &hdev->flags)) {
746 /* Auth must be enabled first */
04837f64
MH		 747 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
748 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 749 if (err)
750 break;
751 }
752
04837f64
MH		 753 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
754 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 755 break;
756
757 case HCISETSCAN:
04837f64
MH		 758 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
759 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 760 break;
761
1da177e4 762 case HCISETLINKPOL:
e4e8e37c
MH		 763 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
764 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 765 break;
766
767 case HCISETLINKMODE:
e4e8e37c
MH		 768 hdev->link_mode = ((__u16) dr.dev_opt) &
769 (HCI_LM_MASTER | HCI_LM_ACCEPT);
770 break;
771
772 case HCISETPTYPE:
773 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 774 break;
775
776 case HCISETACLMTU:
e4e8e37c
MH		 777 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
778 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 779 break;
780
781 case HCISETSCOMTU:
e4e8e37c
MH		 782 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
783 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 784 break;
785
786 default:
787 err = -EINVAL;
788 break;
789 }
e4e8e37c 790
1da177e4
LT		 791 hci_dev_put(hdev);
792 return err;
793}
794
795int hci_get_dev_list(void __user *arg)
796{
797 struct hci_dev_list_req *dl;
798 struct hci_dev_req *dr;
799 struct list_head *p;
800 int n = 0, size, err;
801 __u16 dev_num;
802
803 if (get_user(dev_num, (__u16 __user *) arg))
804 return -EFAULT;
805
806 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
807 return -EINVAL;
808
809 size = sizeof(*dl) + dev_num * sizeof(*dr);
810
70f23020
AE		 811 dl = kzalloc(size, GFP_KERNEL);
812 if (!dl)
1da177e4
LT		 813 return -ENOMEM;
814
815 dr = dl->dev_req;
816
817 read_lock_bh(&hci_dev_list_lock);
818 list_for_each(p, &hci_dev_list) {
819 struct hci_dev *hdev;
c542a06c 820
1da177e4 821 hdev = list_entry(p, struct hci_dev, list);
c542a06c 822
ab81cbf9 823 hci_del_off_timer(hdev);
c542a06c
JH		 824
825 if (!test_bit(HCI_MGMT, &hdev->flags))
826 set_bit(HCI_PAIRABLE, &hdev->flags);
827
1da177e4
LT		 828 (dr + n)->dev_id = hdev->id;
829 (dr + n)->dev_opt = hdev->flags;
c542a06c 830
1da177e4
LT		 831 if (++n >= dev_num)
832 break;
833 }
834 read_unlock_bh(&hci_dev_list_lock);
835
836 dl->dev_num = n;
837 size = sizeof(*dl) + n * sizeof(*dr);
838
839 err = copy_to_user(arg, dl, size);
840 kfree(dl);
841
842 return err ? -EFAULT : 0;
843}
844
845int hci_get_dev_info(void __user *arg)
846{
847 struct hci_dev *hdev;
848 struct hci_dev_info di;
849 int err = 0;
850
851 if (copy_from_user(&di, arg, sizeof(di)))
852 return -EFAULT;
853
70f23020
AE		 854 hdev = hci_dev_get(di.dev_id);
855 if (!hdev)
1da177e4
LT		 856 return -ENODEV;
857
ab81cbf9
JH		 858 hci_del_off_timer(hdev);
859
c542a06c
JH		 860 if (!test_bit(HCI_MGMT, &hdev->flags))
861 set_bit(HCI_PAIRABLE, &hdev->flags);
862
1da177e4
LT		 863 strcpy(di.name, hdev->name);
864 di.bdaddr = hdev->bdaddr;
943da25d 865 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 866 di.flags = hdev->flags;
867 di.pkt_type = hdev->pkt_type;
868 di.acl_mtu = hdev->acl_mtu;
869 di.acl_pkts = hdev->acl_pkts;
870 di.sco_mtu = hdev->sco_mtu;
871 di.sco_pkts = hdev->sco_pkts;
872 di.link_policy = hdev->link_policy;
873 di.link_mode = hdev->link_mode;
874
875 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
876 memcpy(&di.features, &hdev->features, sizeof(di.features));
877
878 if (copy_to_user(arg, &di, sizeof(di)))
879 err = -EFAULT;
880
881 hci_dev_put(hdev);
882
883 return err;
884}
885
886/* ---- Interface to HCI drivers ---- */
887
611b30f7
MH		 888static int hci_rfkill_set_block(void *data, bool blocked)
889{
890 struct hci_dev *hdev = data;
891
892 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
893
894 if (!blocked)
895 return 0;
896
897 hci_dev_do_close(hdev);
898
899 return 0;
900}
901
902static const struct rfkill_ops hci_rfkill_ops = {
903 .set_block = hci_rfkill_set_block,
904};
905
1da177e4
LT		 906/* Alloc HCI device */
907struct hci_dev *hci_alloc_dev(void)
908{
909 struct hci_dev *hdev;
910
25ea6db0 911 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 912 if (!hdev)
913 return NULL;
914
0ac7e700 915 hci_init_sysfs(hdev);
1da177e4
LT		 916 skb_queue_head_init(&hdev->driver_init);
917
918 return hdev;
919}
920EXPORT_SYMBOL(hci_alloc_dev);
921
922/* Free HCI device */
923void hci_free_dev(struct hci_dev *hdev)
924{
925 skb_queue_purge(&hdev->driver_init);
926
a91f2e39
MH		 927 /* will free via device release */
928 put_device(&hdev->dev);
1da177e4
LT		 929}
930EXPORT_SYMBOL(hci_free_dev);
931
ab81cbf9
JH		 932static void hci_power_on(struct work_struct *work)
933{
934 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
935
936 BT_DBG("%s", hdev->name);
937
938 if (hci_dev_open(hdev->id) < 0)
939 return;
940
941 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
942 mod_timer(&hdev->off_timer,
943 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
944
945 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
946 mgmt_index_added(hdev->id);
947}
948
949static void hci_power_off(struct work_struct *work)
950{
951 struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
952
953 BT_DBG("%s", hdev->name);
954
955 hci_dev_close(hdev->id);
956}
957
958static void hci_auto_off(unsigned long data)
959{
960 struct hci_dev *hdev = (struct hci_dev *) data;
961
962 BT_DBG("%s", hdev->name);
963
964 clear_bit(HCI_AUTO_OFF, &hdev->flags);
965
966 queue_work(hdev->workqueue, &hdev->power_off);
967}
968
969void hci_del_off_timer(struct hci_dev *hdev)
970{
971 BT_DBG("%s", hdev->name);
972
973 clear_bit(HCI_AUTO_OFF, &hdev->flags);
974 del_timer(&hdev->off_timer);
975}
976
2aeb9a1a
JH		 977int hci_uuids_clear(struct hci_dev *hdev)
978{
979 struct list_head *p, *n;
980
981 list_for_each_safe(p, n, &hdev->uuids) {
982 struct bt_uuid *uuid;
983
984 uuid = list_entry(p, struct bt_uuid, list);
985
986 list_del(p);
987 kfree(uuid);
988 }
989
990 return 0;
991}
992
55ed8ca1
JH		 993int hci_link_keys_clear(struct hci_dev *hdev)
994{
995 struct list_head *p, *n;
996
997 list_for_each_safe(p, n, &hdev->link_keys) {
998 struct link_key *key;
999
1000 key = list_entry(p, struct link_key, list);
1001
1002 list_del(p);
1003 kfree(key);
1004 }
1005
1006 return 0;
1007}
1008
1009struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1010{
1011 struct list_head *p;
1012
1013 list_for_each(p, &hdev->link_keys) {
1014 struct link_key *k;
1015
1016 k = list_entry(p, struct link_key, list);
1017
1018 if (bacmp(bdaddr, &k->bdaddr) == 0)
1019 return k;
1020 }
1021
1022 return NULL;
1023}
1024
d25e28ab
JH		 1025static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1026 u8 key_type, u8 old_key_type)
1027{
1028 /* Legacy key */
1029 if (key_type < 0x03)
1030 return 1;
1031
1032 /* Debug keys are insecure so don't store them persistently */
1033 if (key_type == HCI_LK_DEBUG_COMBINATION)
1034 return 0;
1035
1036 /* Changed combination key and there's no previous one */
1037 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1038 return 0;
1039
1040 /* Security mode 3 case */
1041 if (!conn)
1042 return 1;
1043
1044 /* Neither local nor remote side had no-bonding as requirement */
1045 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1046 return 1;
1047
1048 /* Local side had dedicated bonding as requirement */
1049 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1050 return 1;
1051
1052 /* Remote side had dedicated bonding as requirement */
1053 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1054 return 1;
1055
1056 /* If none of the above criteria match, then don't store the key
1057 * persistently */
1058 return 0;
1059}
1060
75d262c2
VCG		 1061struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1062{
1063 struct link_key *k;
1064
1065 list_for_each_entry(k, &hdev->link_keys, list) {
1066 struct key_master_id *id;
1067
1068 if (k->type != HCI_LK_SMP_LTK)
1069 continue;
1070
1071 if (k->dlen != sizeof(*id))
1072 continue;
1073
1074 id = (void *) &k->data;
1075 if (id->ediv == ediv &&
1076 (memcmp(rand, id->rand, sizeof(id->rand)) == 0))
1077 return k;
1078 }
1079
1080 return NULL;
1081}
1082EXPORT_SYMBOL(hci_find_ltk);
1083
1084struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
1085 bdaddr_t *bdaddr, u8 type)
1086{
1087 struct link_key *k;
1088
1089 list_for_each_entry(k, &hdev->link_keys, list)
1090 if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
1091 return k;
1092
1093 return NULL;
1094}
1095EXPORT_SYMBOL(hci_find_link_key_type);
1096
d25e28ab
JH		 1097int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1098 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1099{
1100 struct link_key *key, *old_key;
4df378a1 1101 u8 old_key_type, persistent;
55ed8ca1
JH		 1102
1103 old_key = hci_find_link_key(hdev, bdaddr);
1104 if (old_key) {
1105 old_key_type = old_key->type;
1106 key = old_key;
1107 } else {
12adcf3a 1108 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1109 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1110 if (!key)
1111 return -ENOMEM;
1112 list_add(&key->list, &hdev->link_keys);
1113 }
1114
1115 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1116
d25e28ab
JH		 1117 /* Some buggy controller combinations generate a changed
1118 * combination key for legacy pairing even when there's no
1119 * previous key */
1120 if (type == HCI_LK_CHANGED_COMBINATION &&
1121 (!conn || conn->remote_auth == 0xff) &&
655fe6ec 1122 old_key_type == 0xff) {
d25e28ab 1123 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1124 if (conn)
1125 conn->key_type = type;
1126 }
d25e28ab 1127
55ed8ca1
JH		 1128 bacpy(&key->bdaddr, bdaddr);
1129 memcpy(key->val, val, 16);
55ed8ca1
JH		 1130 key->pin_len = pin_len;
1131
b6020ba0 1132 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1133 key->type = old_key_type;
4748fed2
JH		 1134 else
1135 key->type = type;
1136
4df378a1
JH		 1137 if (!new_key)
1138 return 0;
1139
1140 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1141
1142 mgmt_new_key(hdev->id, key, persistent);
1143
1144 if (!persistent) {
1145 list_del(&key->list);
1146 kfree(key);
1147 }
55ed8ca1
JH		 1148
1149 return 0;
1150}
1151
75d262c2 1152int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
726b4ffc 1153 u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
75d262c2
VCG		 1154{
1155 struct link_key *key, *old_key;
1156 struct key_master_id *id;
1157 u8 old_key_type;
1158
1159 BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
1160
1161 old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
1162 if (old_key) {
1163 key = old_key;
1164 old_key_type = old_key->type;
1165 } else {
1166 key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
1167 if (!key)
1168 return -ENOMEM;
1169 list_add(&key->list, &hdev->link_keys);
1170 old_key_type = 0xff;
1171 }
1172
1173 key->dlen = sizeof(*id);
1174
1175 bacpy(&key->bdaddr, bdaddr);
1176 memcpy(key->val, ltk, sizeof(key->val));
1177 key->type = HCI_LK_SMP_LTK;
726b4ffc 1178 key->pin_len = key_size;
75d262c2
VCG		 1179
1180 id = (void *) &key->data;
1181 id->ediv = ediv;
1182 memcpy(id->rand, rand, sizeof(id->rand));
1183
1184 if (new_key)
1185 mgmt_new_key(hdev->id, key, old_key_type);
1186
1187 return 0;
1188}
1189
55ed8ca1
JH		 1190int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1191{
1192 struct link_key *key;
1193
1194 key = hci_find_link_key(hdev, bdaddr);
1195 if (!key)
1196 return -ENOENT;
1197
1198 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1199
1200 list_del(&key->list);
1201 kfree(key);
1202
1203 return 0;
1204}
1205
6bd32326
VT		 1206/* HCI command timer function */
1207static void hci_cmd_timer(unsigned long arg)
1208{
1209 struct hci_dev *hdev = (void *) arg;
1210
1211 BT_ERR("%s command tx timeout", hdev->name);
1212 atomic_set(&hdev->cmd_cnt, 1);
1213 tasklet_schedule(&hdev->cmd_task);
1214}
1215
2763eda6
SJ		 1216struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1217 bdaddr_t *bdaddr)
1218{
1219 struct oob_data *data;
1220
1221 list_for_each_entry(data, &hdev->remote_oob_data, list)
1222 if (bacmp(bdaddr, &data->bdaddr) == 0)
1223 return data;
1224
1225 return NULL;
1226}
1227
1228int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1229{
1230 struct oob_data *data;
1231
1232 data = hci_find_remote_oob_data(hdev, bdaddr);
1233 if (!data)
1234 return -ENOENT;
1235
1236 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1237
1238 list_del(&data->list);
1239 kfree(data);
1240
1241 return 0;
1242}
1243
1244int hci_remote_oob_data_clear(struct hci_dev *hdev)
1245{
1246 struct oob_data *data, *n;
1247
1248 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1249 list_del(&data->list);
1250 kfree(data);
1251 }
1252
1253 return 0;
1254}
1255
1256int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1257 u8 *randomizer)
1258{
1259 struct oob_data *data;
1260
1261 data = hci_find_remote_oob_data(hdev, bdaddr);
1262
1263 if (!data) {
1264 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1265 if (!data)
1266 return -ENOMEM;
1267
1268 bacpy(&data->bdaddr, bdaddr);
1269 list_add(&data->list, &hdev->remote_oob_data);
1270 }
1271
1272 memcpy(data->hash, hash, sizeof(data->hash));
1273 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1274
1275 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1276
1277 return 0;
1278}
1279
b2a66aad
AJ		 1280struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1281 bdaddr_t *bdaddr)
1282{
1283 struct list_head *p;
1284
1285 list_for_each(p, &hdev->blacklist) {
1286 struct bdaddr_list *b;
1287
1288 b = list_entry(p, struct bdaddr_list, list);
1289
1290 if (bacmp(bdaddr, &b->bdaddr) == 0)
1291 return b;
1292 }
1293
1294 return NULL;
1295}
1296
1297int hci_blacklist_clear(struct hci_dev *hdev)
1298{
1299 struct list_head *p, *n;
1300
1301 list_for_each_safe(p, n, &hdev->blacklist) {
1302 struct bdaddr_list *b;
1303
1304 b = list_entry(p, struct bdaddr_list, list);
1305
1306 list_del(p);
1307 kfree(b);
1308 }
1309
1310 return 0;
1311}
1312
1313int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1314{
1315 struct bdaddr_list *entry;
b2a66aad
AJ		 1316
1317 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1318 return -EBADF;
1319
5e762444
AJ		 1320 if (hci_blacklist_lookup(hdev, bdaddr))
1321 return -EEXIST;
b2a66aad
AJ		 1322
1323 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
5e762444
AJ		 1324 if (!entry)
1325 return -ENOMEM;
b2a66aad
AJ		 1326
1327 bacpy(&entry->bdaddr, bdaddr);
1328
1329 list_add(&entry->list, &hdev->blacklist);
1330
5e762444 1331 return mgmt_device_blocked(hdev->id, bdaddr);
b2a66aad
AJ		 1332}
1333
1334int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1335{
1336 struct bdaddr_list *entry;
b2a66aad 1337
a7925bd2 1338 if (bacmp(bdaddr, BDADDR_ANY) == 0) {
5e762444 1339 return hci_blacklist_clear(hdev);
a7925bd2 1340 }
b2a66aad
AJ		 1341
1342 entry = hci_blacklist_lookup(hdev, bdaddr);
a7925bd2 1343 if (!entry) {
5e762444 1344 return -ENOENT;
a7925bd2 1345 }
b2a66aad
AJ		 1346
1347 list_del(&entry->list);
1348 kfree(entry);
1349
5e762444 1350 return mgmt_device_unblocked(hdev->id, bdaddr);
b2a66aad
AJ		 1351}
1352
35815085
AG		 1353static void hci_clear_adv_cache(unsigned long arg)
1354{
1355 struct hci_dev *hdev = (void *) arg;
1356
1357 hci_dev_lock(hdev);
1358
1359 hci_adv_entries_clear(hdev);
1360
1361 hci_dev_unlock(hdev);
1362}
1363
76c8686f
AG		 1364int hci_adv_entries_clear(struct hci_dev *hdev)
1365{
1366 struct adv_entry *entry, *tmp;
1367
1368 list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1369 list_del(&entry->list);
1370 kfree(entry);
1371 }
1372
1373 BT_DBG("%s adv cache cleared", hdev->name);
1374
1375 return 0;
1376}
1377
1378struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1379{
1380 struct adv_entry *entry;
1381
1382 list_for_each_entry(entry, &hdev->adv_entries, list)
1383 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1384 return entry;
1385
1386 return NULL;
1387}
1388
1389static inline int is_connectable_adv(u8 evt_type)
1390{
1391 if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1392 return 1;
1393
1394 return 0;
1395}
1396
1397int hci_add_adv_entry(struct hci_dev *hdev,
1398 struct hci_ev_le_advertising_info *ev)
1399{
1400 struct adv_entry *entry;
1401
1402 if (!is_connectable_adv(ev->evt_type))
1403 return -EINVAL;
1404
1405 /* Only new entries should be added to adv_entries. So, if
1406 * bdaddr was found, don't add it. */
1407 if (hci_find_adv_entry(hdev, &ev->bdaddr))
1408 return 0;
1409
1410 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1411 if (!entry)
1412 return -ENOMEM;
1413
1414 bacpy(&entry->bdaddr, &ev->bdaddr);
1415 entry->bdaddr_type = ev->bdaddr_type;
1416
1417 list_add(&entry->list, &hdev->adv_entries);
1418
1419 BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1420 batostr(&entry->bdaddr), entry->bdaddr_type);
1421
1422 return 0;
1423}
1424
1da177e4
LT		 1425/* Register HCI device */
1426int hci_register_dev(struct hci_dev *hdev)
1427{
1428 struct list_head *head = &hci_dev_list, *p;
33ca954d 1429 int i, id = 0, error;
1da177e4 1430
c13854ce
MH		 1431 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1432 hdev->bus, hdev->owner);
1da177e4
LT		 1433
1434 if (!hdev->open || !hdev->close || !hdev->destruct)
1435 return -EINVAL;
1436
1437 write_lock_bh(&hci_dev_list_lock);
1438
1439 /* Find first available device id */
1440 list_for_each(p, &hci_dev_list) {
1441 if (list_entry(p, struct hci_dev, list)->id != id)
1442 break;
1443 head = p; id++;
1444 }
8e87d142 1445
1da177e4
LT		 1446 sprintf(hdev->name, "hci%d", id);
1447 hdev->id = id;
1448 list_add(&hdev->list, head);
1449
1450 atomic_set(&hdev->refcnt, 1);
1451 spin_lock_init(&hdev->lock);
1452
1453 hdev->flags = 0;
1454 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 1455 hdev->esco_type = (ESCO_HV1);
1da177e4 1456 hdev->link_mode = (HCI_LM_ACCEPT);
17fa4b9d 1457 hdev->io_capability = 0x03; /* No Input No Output */
1da177e4 1458
04837f64
MH		 1459 hdev->idle_timeout = 0;
1460 hdev->sniff_max_interval = 800;
1461 hdev->sniff_min_interval = 80;
1462
70f23020 1463 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1da177e4
LT		 1464 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1465 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1466
1467 skb_queue_head_init(&hdev->rx_q);
1468 skb_queue_head_init(&hdev->cmd_q);
1469 skb_queue_head_init(&hdev->raw_q);
1470
6bd32326
VT		 1471 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1472
cd4c5391 1473 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1474 hdev->reassembly[i] = NULL;
1475
1da177e4 1476 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 1477 mutex_init(&hdev->req_lock);
1da177e4
LT		 1478
1479 inquiry_cache_init(hdev);
1480
1481 hci_conn_hash_init(hdev);
1482
ea4bd8ba 1483 INIT_LIST_HEAD(&hdev->blacklist);
f0358568 1484
2aeb9a1a
JH		 1485 INIT_LIST_HEAD(&hdev->uuids);
1486
55ed8ca1
JH		 1487 INIT_LIST_HEAD(&hdev->link_keys);
1488
2763eda6
SJ		 1489 INIT_LIST_HEAD(&hdev->remote_oob_data);
1490
76c8686f 1491 INIT_LIST_HEAD(&hdev->adv_entries);
35815085
AG		 1492 setup_timer(&hdev->adv_timer, hci_clear_adv_cache,
1493 (unsigned long) hdev);
76c8686f 1494
ab81cbf9
JH		 1495 INIT_WORK(&hdev->power_on, hci_power_on);
1496 INIT_WORK(&hdev->power_off, hci_power_off);
1497 setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1498
1da177e4
LT		 1499 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1500
1501 atomic_set(&hdev->promisc, 0);
1502
1503 write_unlock_bh(&hci_dev_list_lock);
1504
f48fd9c8 1505 hdev->workqueue = create_singlethread_workqueue(hdev->name);
33ca954d
DH		 1506 if (!hdev->workqueue) {
1507 error = -ENOMEM;
1508 goto err;
1509 }
f48fd9c8 1510
33ca954d
DH		 1511 error = hci_add_sysfs(hdev);
1512 if (error < 0)
1513 goto err_wqueue;
1da177e4 1514
611b30f7
MH		 1515 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1516 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1517 if (hdev->rfkill) {
1518 if (rfkill_register(hdev->rfkill) < 0) {
1519 rfkill_destroy(hdev->rfkill);
1520 hdev->rfkill = NULL;
1521 }
1522 }
1523
ab81cbf9
JH		 1524 set_bit(HCI_AUTO_OFF, &hdev->flags);
1525 set_bit(HCI_SETUP, &hdev->flags);
1526 queue_work(hdev->workqueue, &hdev->power_on);
1527
1da177e4
LT		 1528 hci_notify(hdev, HCI_DEV_REG);
1529
1530 return id;
f48fd9c8 1531
33ca954d
DH		 1532err_wqueue:
1533 destroy_workqueue(hdev->workqueue);
1534err:
f48fd9c8
MH		 1535 write_lock_bh(&hci_dev_list_lock);
1536 list_del(&hdev->list);
1537 write_unlock_bh(&hci_dev_list_lock);
1538
33ca954d 1539 return error;
1da177e4
LT		 1540}
1541EXPORT_SYMBOL(hci_register_dev);
1542
1543/* Unregister HCI device */
1544int hci_unregister_dev(struct hci_dev *hdev)
1545{
ef222013
MH		 1546 int i;
1547
c13854ce 1548 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1549
1da177e4
LT		 1550 write_lock_bh(&hci_dev_list_lock);
1551 list_del(&hdev->list);
1552 write_unlock_bh(&hci_dev_list_lock);
1553
1554 hci_dev_do_close(hdev);
1555
cd4c5391 1556 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1557 kfree_skb(hdev->reassembly[i]);
1558
ab81cbf9
JH		 1559 if (!test_bit(HCI_INIT, &hdev->flags) &&
1560 !test_bit(HCI_SETUP, &hdev->flags))
1561 mgmt_index_removed(hdev->id);
1562
1da177e4
LT		 1563 hci_notify(hdev, HCI_DEV_UNREG);
1564
611b30f7
MH		 1565 if (hdev->rfkill) {
1566 rfkill_unregister(hdev->rfkill);
1567 rfkill_destroy(hdev->rfkill);
1568 }
1569
ce242970 1570 hci_del_sysfs(hdev);
147e2d59 1571
c6f3c5f7 1572 hci_del_off_timer(hdev);
35815085 1573 del_timer(&hdev->adv_timer);
c6f3c5f7 1574
f48fd9c8
MH		 1575 destroy_workqueue(hdev->workqueue);
1576
e2e0cacb
JH		 1577 hci_dev_lock_bh(hdev);
1578 hci_blacklist_clear(hdev);
2aeb9a1a 1579 hci_uuids_clear(hdev);
55ed8ca1 1580 hci_link_keys_clear(hdev);
2763eda6 1581 hci_remote_oob_data_clear(hdev);
76c8686f 1582 hci_adv_entries_clear(hdev);
e2e0cacb
JH		 1583 hci_dev_unlock_bh(hdev);
1584
1da177e4 1585 __hci_dev_put(hdev);
ef222013 1586
1da177e4
LT		 1587 return 0;
1588}
1589EXPORT_SYMBOL(hci_unregister_dev);
1590
1591/* Suspend HCI device */
1592int hci_suspend_dev(struct hci_dev *hdev)
1593{
1594 hci_notify(hdev, HCI_DEV_SUSPEND);
1595 return 0;
1596}
1597EXPORT_SYMBOL(hci_suspend_dev);
1598
1599/* Resume HCI device */
1600int hci_resume_dev(struct hci_dev *hdev)
1601{
1602 hci_notify(hdev, HCI_DEV_RESUME);
1603 return 0;
1604}
1605EXPORT_SYMBOL(hci_resume_dev);
1606
76bca880
MH		 1607/* Receive frame from HCI drivers */
1608int hci_recv_frame(struct sk_buff *skb)
1609{
1610 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1611 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1612 && !test_bit(HCI_INIT, &hdev->flags))) {
1613 kfree_skb(skb);
1614 return -ENXIO;
1615 }
1616
1617 /* Incomming skb */
1618 bt_cb(skb)->incoming = 1;
1619
1620 /* Time stamp */
1621 __net_timestamp(skb);
1622
1623 /* Queue frame for rx task */
1624 skb_queue_tail(&hdev->rx_q, skb);
c78ae283
MH		 1625 tasklet_schedule(&hdev->rx_task);
1626
76bca880
MH		 1627 return 0;
1628}
1629EXPORT_SYMBOL(hci_recv_frame);
1630
33e882a5 1631static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1e429f38 1632 int count, __u8 index)
33e882a5
SS		 1633{
1634 int len = 0;
1635 int hlen = 0;
1636 int remain = count;
1637 struct sk_buff *skb;
1638 struct bt_skb_cb *scb;
1639
1640 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1641 index >= NUM_REASSEMBLY)
1642 return -EILSEQ;
1643
1644 skb = hdev->reassembly[index];
1645
1646 if (!skb) {
1647 switch (type) {
1648 case HCI_ACLDATA_PKT:
1649 len = HCI_MAX_FRAME_SIZE;
1650 hlen = HCI_ACL_HDR_SIZE;
1651 break;
1652 case HCI_EVENT_PKT:
1653 len = HCI_MAX_EVENT_SIZE;
1654 hlen = HCI_EVENT_HDR_SIZE;
1655 break;
1656 case HCI_SCODATA_PKT:
1657 len = HCI_MAX_SCO_SIZE;
1658 hlen = HCI_SCO_HDR_SIZE;
1659 break;
1660 }
1661
1e429f38 1662 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 1663 if (!skb)
1664 return -ENOMEM;
1665
1666 scb = (void *) skb->cb;
1667 scb->expect = hlen;
1668 scb->pkt_type = type;
1669
1670 skb->dev = (void *) hdev;
1671 hdev->reassembly[index] = skb;
1672 }
1673
1674 while (count) {
1675 scb = (void *) skb->cb;
1676 len = min(scb->expect, (__u16)count);
1677
1678 memcpy(skb_put(skb, len), data, len);
1679
1680 count -= len;
1681 data += len;
1682 scb->expect -= len;
1683 remain = count;
1684
1685 switch (type) {
1686 case HCI_EVENT_PKT:
1687 if (skb->len == HCI_EVENT_HDR_SIZE) {
1688 struct hci_event_hdr *h = hci_event_hdr(skb);
1689 scb->expect = h->plen;
1690
1691 if (skb_tailroom(skb) < scb->expect) {
1692 kfree_skb(skb);
1693 hdev->reassembly[index] = NULL;
1694 return -ENOMEM;
1695 }
1696 }
1697 break;
1698
1699 case HCI_ACLDATA_PKT:
1700 if (skb->len == HCI_ACL_HDR_SIZE) {
1701 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1702 scb->expect = __le16_to_cpu(h->dlen);
1703
1704 if (skb_tailroom(skb) < scb->expect) {
1705 kfree_skb(skb);
1706 hdev->reassembly[index] = NULL;
1707 return -ENOMEM;
1708 }
1709 }
1710 break;
1711
1712 case HCI_SCODATA_PKT:
1713 if (skb->len == HCI_SCO_HDR_SIZE) {
1714 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1715 scb->expect = h->dlen;
1716
1717 if (skb_tailroom(skb) < scb->expect) {
1718 kfree_skb(skb);
1719 hdev->reassembly[index] = NULL;
1720 return -ENOMEM;
1721 }
1722 }
1723 break;
1724 }
1725
1726 if (scb->expect == 0) {
1727 /* Complete frame */
1728
1729 bt_cb(skb)->pkt_type = type;
1730 hci_recv_frame(skb);
1731
1732 hdev->reassembly[index] = NULL;
1733 return remain;
1734 }
1735 }
1736
1737 return remain;
1738}
1739
ef222013
MH		 1740int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1741{
f39a3c06
SS		 1742 int rem = 0;
1743
ef222013
MH		 1744 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1745 return -EILSEQ;
1746
da5f6c37 1747 while (count) {
1e429f38 1748 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 1749 if (rem < 0)
1750 return rem;
ef222013 1751
f39a3c06
SS		 1752 data += (count - rem);
1753 count = rem;
f81c6224 1754 }
ef222013 1755
f39a3c06 1756 return rem;
ef222013
MH		 1757}
1758EXPORT_SYMBOL(hci_recv_fragment);
1759
99811510
SS		 1760#define STREAM_REASSEMBLY 0
1761
1762int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1763{
1764 int type;
1765 int rem = 0;
1766
da5f6c37 1767 while (count) {
99811510
SS		 1768 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1769
1770 if (!skb) {
1771 struct { char type; } *pkt;
1772
1773 /* Start of the frame */
1774 pkt = data;
1775 type = pkt->type;
1776
1777 data++;
1778 count--;
1779 } else
1780 type = bt_cb(skb)->pkt_type;
1781
1e429f38
GP		 1782 rem = hci_reassembly(hdev, type, data, count,
1783 STREAM_REASSEMBLY);
99811510
SS		 1784 if (rem < 0)
1785 return rem;
1786
1787 data += (count - rem);
1788 count = rem;
f81c6224 1789 }
99811510
SS		 1790
1791 return rem;
1792}
1793EXPORT_SYMBOL(hci_recv_stream_fragment);
1794
1da177e4
LT		 1795/* ---- Interface to upper protocols ---- */
1796
1797/* Register/Unregister protocols.
1798 * hci_task_lock is used to ensure that no tasks are running. */
1799int hci_register_proto(struct hci_proto *hp)
1800{
1801 int err = 0;
1802
1803 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1804
1805 if (hp->id >= HCI_MAX_PROTO)
1806 return -EINVAL;
1807
1808 write_lock_bh(&hci_task_lock);
1809
1810 if (!hci_proto[hp->id])
1811 hci_proto[hp->id] = hp;
1812 else
1813 err = -EEXIST;
1814
1815 write_unlock_bh(&hci_task_lock);
1816
1817 return err;
1818}
1819EXPORT_SYMBOL(hci_register_proto);
1820
1821int hci_unregister_proto(struct hci_proto *hp)
1822{
1823 int err = 0;
1824
1825 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1826
1827 if (hp->id >= HCI_MAX_PROTO)
1828 return -EINVAL;
1829
1830 write_lock_bh(&hci_task_lock);
1831
1832 if (hci_proto[hp->id])
1833 hci_proto[hp->id] = NULL;
1834 else
1835 err = -ENOENT;
1836
1837 write_unlock_bh(&hci_task_lock);
1838
1839 return err;
1840}
1841EXPORT_SYMBOL(hci_unregister_proto);
1842
1843int hci_register_cb(struct hci_cb *cb)
1844{
1845 BT_DBG("%p name %s", cb, cb->name);
1846
1847 write_lock_bh(&hci_cb_list_lock);
1848 list_add(&cb->list, &hci_cb_list);
1849 write_unlock_bh(&hci_cb_list_lock);
1850
1851 return 0;
1852}
1853EXPORT_SYMBOL(hci_register_cb);
1854
1855int hci_unregister_cb(struct hci_cb *cb)
1856{
1857 BT_DBG("%p name %s", cb, cb->name);
1858
1859 write_lock_bh(&hci_cb_list_lock);
1860 list_del(&cb->list);
1861 write_unlock_bh(&hci_cb_list_lock);
1862
1863 return 0;
1864}
1865EXPORT_SYMBOL(hci_unregister_cb);
1866
1867static int hci_send_frame(struct sk_buff *skb)
1868{
1869 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1870
1871 if (!hdev) {
1872 kfree_skb(skb);
1873 return -ENODEV;
1874 }
1875
0d48d939 1876 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1877
1878 if (atomic_read(&hdev->promisc)) {
1879 /* Time stamp */
a61bbcf2 1880 __net_timestamp(skb);
1da177e4 1881
eec8d2bc 1882 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1883 }
1884
1885 /* Get rid of skb owner, prior to sending to the driver. */
1886 skb_orphan(skb);
1887
1888 return hdev->send(skb);
1889}
1890
1891/* Send HCI command */
a9de9248 1892int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1893{
1894 int len = HCI_COMMAND_HDR_SIZE + plen;
1895 struct hci_command_hdr *hdr;
1896 struct sk_buff *skb;
1897
a9de9248 1898 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1899
1900 skb = bt_skb_alloc(len, GFP_ATOMIC);
1901 if (!skb) {
ef222013 1902 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1903 return -ENOMEM;
1904 }
1905
1906 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1907 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1908 hdr->plen = plen;
1909
1910 if (plen)
1911 memcpy(skb_put(skb, plen), param, plen);
1912
1913 BT_DBG("skb len %d", skb->len);
1914
0d48d939 1915 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 1916 skb->dev = (void *) hdev;
c78ae283 1917
a5040efa
JH		 1918 if (test_bit(HCI_INIT, &hdev->flags))
1919 hdev->init_last_cmd = opcode;
1920
1da177e4 1921 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 1922 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 1923
1924 return 0;
1925}
1da177e4
LT		 1926
1927/* Get data from the previously sent command */
a9de9248 1928void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1929{
1930 struct hci_command_hdr *hdr;
1931
1932 if (!hdev->sent_cmd)
1933 return NULL;
1934
1935 hdr = (void *) hdev->sent_cmd->data;
1936
a9de9248 1937 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1938 return NULL;
1939
a9de9248 1940 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1941
1942 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1943}
1944
1945/* Send ACL data */
1946static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1947{
1948 struct hci_acl_hdr *hdr;
1949 int len = skb->len;
1950
badff6d0
ACM		 1951 skb_push(skb, HCI_ACL_HDR_SIZE);
1952 skb_reset_transport_header(skb);
9c70220b 1953 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1954 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1955 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1956}
1957
9a9c6a34 1958void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1da177e4
LT		 1959{
1960 struct hci_dev *hdev = conn->hdev;
1961 struct sk_buff *list;
1962
1963 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1964
1965 skb->dev = (void *) hdev;
0d48d939 1966 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1967 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4 1968
70f23020
AE		 1969 list = skb_shinfo(skb)->frag_list;
1970 if (!list) {
1da177e4
LT		 1971 /* Non fragmented */
1972 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1973
1974 skb_queue_tail(&conn->data_q, skb);
1975 } else {
1976 /* Fragmented */
1977 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1978
1979 skb_shinfo(skb)->frag_list = NULL;
1980
1981 /* Queue all fragments atomically */
1982 spin_lock_bh(&conn->data_q.lock);
1983
1984 __skb_queue_tail(&conn->data_q, skb);
e702112f
AE		 1985
1986 flags &= ~ACL_START;
1987 flags |= ACL_CONT;
1da177e4
LT		 1988 do {
1989 skb = list; list = list->next;
8e87d142 1990
1da177e4 1991 skb->dev = (void *) hdev;
0d48d939 1992 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1993 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 1994
1995 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1996
1997 __skb_queue_tail(&conn->data_q, skb);
1998 } while (list);
1999
2000 spin_unlock_bh(&conn->data_q.lock);
2001 }
2002
c78ae283 2003 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 2004}
2005EXPORT_SYMBOL(hci_send_acl);
2006
2007/* Send SCO data */
0d861d8b 2008void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 2009{
2010 struct hci_dev *hdev = conn->hdev;
2011 struct hci_sco_hdr hdr;
2012
2013 BT_DBG("%s len %d", hdev->name, skb->len);
2014
aca3192c 2015 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 2016 hdr.dlen = skb->len;
2017
badff6d0
ACM		 2018 skb_push(skb, HCI_SCO_HDR_SIZE);
2019 skb_reset_transport_header(skb);
9c70220b 2020 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 2021
2022 skb->dev = (void *) hdev;
0d48d939 2023 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 2024
1da177e4 2025 skb_queue_tail(&conn->data_q, skb);
c78ae283 2026 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 2027}
2028EXPORT_SYMBOL(hci_send_sco);
2029
2030/* ---- HCI TX task (outgoing data) ---- */
2031
2032/* HCI Connection scheduler */
2033static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2034{
2035 struct hci_conn_hash *h = &hdev->conn_hash;
5b7f9909 2036 struct hci_conn *conn = NULL;
1da177e4
LT		 2037 int num = 0, min = ~0;
2038 struct list_head *p;
2039
8e87d142 2040 /* We don't have to lock device here. Connections are always
1da177e4
LT		 2041 * added and removed with TX task disabled. */
2042 list_for_each(p, &h->list) {
2043 struct hci_conn *c;
2044 c = list_entry(p, struct hci_conn, list);
2045
769be974 2046 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2047 continue;
769be974
MH		 2048
2049 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2050 continue;
2051
1da177e4
LT		 2052 num++;
2053
2054 if (c->sent < min) {
2055 min = c->sent;
2056 conn = c;
2057 }
52087a79
LAD		 2058
2059 if (hci_conn_num(hdev, type) == num)
2060 break;
1da177e4
LT		 2061 }
2062
2063 if (conn) {
6ed58ec5
VT		 2064 int cnt, q;
2065
2066 switch (conn->type) {
2067 case ACL_LINK:
2068 cnt = hdev->acl_cnt;
2069 break;
2070 case SCO_LINK:
2071 case ESCO_LINK:
2072 cnt = hdev->sco_cnt;
2073 break;
2074 case LE_LINK:
2075 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2076 break;
2077 default:
2078 cnt = 0;
2079 BT_ERR("Unknown link type");
2080 }
2081
2082 q = cnt / num;
1da177e4
LT		 2083 *quote = q ? q : 1;
2084 } else
2085 *quote = 0;
2086
2087 BT_DBG("conn %p quote %d", conn, *quote);
2088 return conn;
2089}
2090
bae1f5d9 2091static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2092{
2093 struct hci_conn_hash *h = &hdev->conn_hash;
2094 struct list_head *p;
2095 struct hci_conn *c;
2096
bae1f5d9 2097 BT_ERR("%s link tx timeout", hdev->name);
1da177e4
LT		 2098
2099 /* Kill stalled connections */
2100 list_for_each(p, &h->list) {
2101 c = list_entry(p, struct hci_conn, list);
bae1f5d9
VT		 2102 if (c->type == type && c->sent) {
2103 BT_ERR("%s killing stalled connection %s",
1da177e4
LT		 2104 hdev->name, batostr(&c->dst));
2105 hci_acl_disconn(c, 0x13);
2106 }
2107 }
2108}
2109
2110static inline void hci_sched_acl(struct hci_dev *hdev)
2111{
2112 struct hci_conn *conn;
2113 struct sk_buff *skb;
2114 int quote;
2115
2116 BT_DBG("%s", hdev->name);
2117
52087a79
LAD		 2118 if (!hci_conn_num(hdev, ACL_LINK))
2119 return;
2120
1da177e4
LT		 2121 if (!test_bit(HCI_RAW, &hdev->flags)) {
2122 /* ACL tx timeout must be longer than maximum
2123 * link supervision timeout (40.9 seconds) */
82453021 2124 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
bae1f5d9 2125 hci_link_tx_to(hdev, ACL_LINK);
1da177e4
LT		 2126 }
2127
2128 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
2129 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2130 BT_DBG("skb %p len %d", skb, skb->len);
04837f64 2131
14b12d0b 2132 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
04837f64 2133
1da177e4
LT		 2134 hci_send_frame(skb);
2135 hdev->acl_last_tx = jiffies;
2136
2137 hdev->acl_cnt--;
2138 conn->sent++;
2139 }
2140 }
2141}
2142
2143/* Schedule SCO */
2144static inline void hci_sched_sco(struct hci_dev *hdev)
2145{
2146 struct hci_conn *conn;
2147 struct sk_buff *skb;
2148 int quote;
2149
2150 BT_DBG("%s", hdev->name);
2151
52087a79
LAD		 2152 if (!hci_conn_num(hdev, SCO_LINK))
2153 return;
2154
1da177e4
LT		 2155 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2156 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2157 BT_DBG("skb %p len %d", skb, skb->len);
2158 hci_send_frame(skb);
2159
2160 conn->sent++;
2161 if (conn->sent == ~0)
2162 conn->sent = 0;
2163 }
2164 }
2165}
2166
b6a0dc82
MH		 2167static inline void hci_sched_esco(struct hci_dev *hdev)
2168{
2169 struct hci_conn *conn;
2170 struct sk_buff *skb;
2171 int quote;
2172
2173 BT_DBG("%s", hdev->name);
2174
52087a79
LAD		 2175 if (!hci_conn_num(hdev, ESCO_LINK))
2176 return;
2177
b6a0dc82
MH		 2178 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2179 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2180 BT_DBG("skb %p len %d", skb, skb->len);
2181 hci_send_frame(skb);
2182
2183 conn->sent++;
2184 if (conn->sent == ~0)
2185 conn->sent = 0;
2186 }
2187 }
2188}
2189
6ed58ec5
VT		 2190static inline void hci_sched_le(struct hci_dev *hdev)
2191{
2192 struct hci_conn *conn;
2193 struct sk_buff *skb;
2194 int quote, cnt;
2195
2196 BT_DBG("%s", hdev->name);
2197
52087a79
LAD		 2198 if (!hci_conn_num(hdev, LE_LINK))
2199 return;
2200
6ed58ec5
VT		 2201 if (!test_bit(HCI_RAW, &hdev->flags)) {
2202 /* LE tx timeout must be longer than maximum
2203 * link supervision timeout (40.9 seconds) */
bae1f5d9 2204 if (!hdev->le_cnt && hdev->le_pkts &&
6ed58ec5 2205 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 2206 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 2207 }
2208
2209 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2210 while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
2211 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2212 BT_DBG("skb %p len %d", skb, skb->len);
2213
2214 hci_send_frame(skb);
2215 hdev->le_last_tx = jiffies;
2216
2217 cnt--;
2218 conn->sent++;
2219 }
2220 }
2221 if (hdev->le_pkts)
2222 hdev->le_cnt = cnt;
2223 else
2224 hdev->acl_cnt = cnt;
2225}
2226
1da177e4
LT		 2227static void hci_tx_task(unsigned long arg)
2228{
2229 struct hci_dev *hdev = (struct hci_dev *) arg;
2230 struct sk_buff *skb;
2231
2232 read_lock(&hci_task_lock);
2233
6ed58ec5
VT		 2234 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2235 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 2236
2237 /* Schedule queues and send stuff to HCI driver */
2238
2239 hci_sched_acl(hdev);
2240
2241 hci_sched_sco(hdev);
2242
b6a0dc82
MH		 2243 hci_sched_esco(hdev);
2244
6ed58ec5
VT		 2245 hci_sched_le(hdev);
2246
1da177e4
LT		 2247 /* Send next queued raw (unknown type) packet */
2248 while ((skb = skb_dequeue(&hdev->raw_q)))
2249 hci_send_frame(skb);
2250
2251 read_unlock(&hci_task_lock);
2252}
2253
25985edc 2254/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 2255
2256/* ACL data packet */
2257static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2258{
2259 struct hci_acl_hdr *hdr = (void *) skb->data;
2260 struct hci_conn *conn;
2261 __u16 handle, flags;
2262
2263 skb_pull(skb, HCI_ACL_HDR_SIZE);
2264
2265 handle = __le16_to_cpu(hdr->handle);
2266 flags = hci_flags(handle);
2267 handle = hci_handle(handle);
2268
2269 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2270
2271 hdev->stat.acl_rx++;
2272
2273 hci_dev_lock(hdev);
2274 conn = hci_conn_hash_lookup_handle(hdev, handle);
2275 hci_dev_unlock(hdev);
8e87d142 2276
1da177e4
LT		 2277 if (conn) {
2278 register struct hci_proto *hp;
2279
14b12d0b 2280 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
04837f64 2281
1da177e4 2282 /* Send to upper protocol */
70f23020
AE		 2283 hp = hci_proto[HCI_PROTO_L2CAP];
2284 if (hp && hp->recv_acldata) {
1da177e4
LT		 2285 hp->recv_acldata(conn, skb, flags);
2286 return;
2287 }
2288 } else {
8e87d142 2289 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 2290 hdev->name, handle);
2291 }
2292
2293 kfree_skb(skb);
2294}
2295
2296/* SCO data packet */
2297static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2298{
2299 struct hci_sco_hdr *hdr = (void *) skb->data;
2300 struct hci_conn *conn;
2301 __u16 handle;
2302
2303 skb_pull(skb, HCI_SCO_HDR_SIZE);
2304
2305 handle = __le16_to_cpu(hdr->handle);
2306
2307 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2308
2309 hdev->stat.sco_rx++;
2310
2311 hci_dev_lock(hdev);
2312 conn = hci_conn_hash_lookup_handle(hdev, handle);
2313 hci_dev_unlock(hdev);
2314
2315 if (conn) {
2316 register struct hci_proto *hp;
2317
2318 /* Send to upper protocol */
70f23020
AE		 2319 hp = hci_proto[HCI_PROTO_SCO];
2320 if (hp && hp->recv_scodata) {
1da177e4
LT		 2321 hp->recv_scodata(conn, skb);
2322 return;
2323 }
2324 } else {
8e87d142 2325 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 2326 hdev->name, handle);
2327 }
2328
2329 kfree_skb(skb);
2330}
2331
6516455d 2332static void hci_rx_task(unsigned long arg)
1da177e4
LT		 2333{
2334 struct hci_dev *hdev = (struct hci_dev *) arg;
2335 struct sk_buff *skb;
2336
2337 BT_DBG("%s", hdev->name);
2338
2339 read_lock(&hci_task_lock);
2340
2341 while ((skb = skb_dequeue(&hdev->rx_q))) {
2342 if (atomic_read(&hdev->promisc)) {
2343 /* Send copy to the sockets */
eec8d2bc 2344 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 2345 }
2346
2347 if (test_bit(HCI_RAW, &hdev->flags)) {
2348 kfree_skb(skb);
2349 continue;
2350 }
2351
2352 if (test_bit(HCI_INIT, &hdev->flags)) {
2353 /* Don't process data packets in this states. */
0d48d939 2354 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2355 case HCI_ACLDATA_PKT:
2356 case HCI_SCODATA_PKT:
2357 kfree_skb(skb);
2358 continue;
3ff50b79 2359 }
1da177e4
LT		 2360 }
2361
2362 /* Process frame */
0d48d939 2363 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2364 case HCI_EVENT_PKT:
2365 hci_event_packet(hdev, skb);
2366 break;
2367
2368 case HCI_ACLDATA_PKT:
2369 BT_DBG("%s ACL data packet", hdev->name);
2370 hci_acldata_packet(hdev, skb);
2371 break;
2372
2373 case HCI_SCODATA_PKT:
2374 BT_DBG("%s SCO data packet", hdev->name);
2375 hci_scodata_packet(hdev, skb);
2376 break;
2377
2378 default:
2379 kfree_skb(skb);
2380 break;
2381 }
2382 }
2383
2384 read_unlock(&hci_task_lock);
2385}
2386
2387static void hci_cmd_task(unsigned long arg)
2388{
2389 struct hci_dev *hdev = (struct hci_dev *) arg;
2390 struct sk_buff *skb;
2391
2392 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2393
1da177e4 2394 /* Send queued commands */
5a08ecce
AE		 2395 if (atomic_read(&hdev->cmd_cnt)) {
2396 skb = skb_dequeue(&hdev->cmd_q);
2397 if (!skb)
2398 return;
2399
7585b97a 2400 kfree_skb(hdev->sent_cmd);
1da177e4 2401
70f23020
AE		 2402 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2403 if (hdev->sent_cmd) {
1da177e4
LT		 2404 atomic_dec(&hdev->cmd_cnt);
2405 hci_send_frame(skb);
7bdb8a5c
SJ		 2406 if (test_bit(HCI_RESET, &hdev->flags))
2407 del_timer(&hdev->cmd_timer);
2408 else
2409 mod_timer(&hdev->cmd_timer,
6bd32326 2410 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
1da177e4
LT		 2411 } else {
2412 skb_queue_head(&hdev->cmd_q, skb);
c78ae283 2413 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 2414 }
2415 }
2416}
kernel source for telekom puls (alcatel/mediatek)