projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Move pending management command list into struct hci_dev
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
f48fd9c8 40#include <linux/workqueue.h>
1da177e4
LT		 41#include <linux/interrupt.h>
42#include <linux/notifier.h>
611b30f7 43#include <linux/rfkill.h>
6bd32326 44#include <linux/timer.h>
3a0259bb 45#include <linux/crypto.h>
1da177e4
LT		 46#include <net/sock.h>
47
48#include <asm/system.h>
70f23020 49#include <linux/uaccess.h>
1da177e4
LT		 50#include <asm/unaligned.h>
51
52#include <net/bluetooth/bluetooth.h>
53#include <net/bluetooth/hci_core.h>
54
ab81cbf9
JH		 55#define AUTO_OFF_TIMEOUT 2000
56
1da177e4
LT		 57static void hci_cmd_task(unsigned long arg);
58static void hci_rx_task(unsigned long arg);
59static void hci_tx_task(unsigned long arg);
1da177e4
LT		 60
61static DEFINE_RWLOCK(hci_task_lock);
62
63/* HCI device list */
64LIST_HEAD(hci_dev_list);
65DEFINE_RWLOCK(hci_dev_list_lock);
66
67/* HCI callback list */
68LIST_HEAD(hci_cb_list);
69DEFINE_RWLOCK(hci_cb_list_lock);
70
71/* HCI protocols */
72#define HCI_MAX_PROTO 2
73struct hci_proto *hci_proto[HCI_MAX_PROTO];
74
75/* HCI notifiers list */
e041c683 76static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 77
78/* ---- HCI notifications ---- */
79
80int hci_register_notifier(struct notifier_block *nb)
81{
e041c683 82 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 83}
84
85int hci_unregister_notifier(struct notifier_block *nb)
86{
e041c683 87 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 88}
89
6516455d 90static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 91{
e041c683 92 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 93}
94
95/* ---- HCI requests ---- */
96
23bb5763 97void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 98{
23bb5763
JH		 99 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
100
a5040efa
JH		 101 /* If this is the init phase check if the completed command matches
102 * the last init command, and if not just return.
103 */
104 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
23bb5763 105 return;
1da177e4
LT		 106
107 if (hdev->req_status == HCI_REQ_PEND) {
108 hdev->req_result = result;
109 hdev->req_status = HCI_REQ_DONE;
110 wake_up_interruptible(&hdev->req_wait_q);
111 }
112}
113
114static void hci_req_cancel(struct hci_dev *hdev, int err)
115{
116 BT_DBG("%s err 0x%2.2x", hdev->name, err);
117
118 if (hdev->req_status == HCI_REQ_PEND) {
119 hdev->req_result = err;
120 hdev->req_status = HCI_REQ_CANCELED;
121 wake_up_interruptible(&hdev->req_wait_q);
122 }
123}
124
125/* Execute request and wait for completion. */
8e87d142 126static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 127 unsigned long opt, __u32 timeout)
1da177e4
LT		 128{
129 DECLARE_WAITQUEUE(wait, current);
130 int err = 0;
131
132 BT_DBG("%s start", hdev->name);
133
134 hdev->req_status = HCI_REQ_PEND;
135
136 add_wait_queue(&hdev->req_wait_q, &wait);
137 set_current_state(TASK_INTERRUPTIBLE);
138
139 req(hdev, opt);
140 schedule_timeout(timeout);
141
142 remove_wait_queue(&hdev->req_wait_q, &wait);
143
144 if (signal_pending(current))
145 return -EINTR;
146
147 switch (hdev->req_status) {
148 case HCI_REQ_DONE:
e175072f 149 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 150 break;
151
152 case HCI_REQ_CANCELED:
153 err = -hdev->req_result;
154 break;
155
156 default:
157 err = -ETIMEDOUT;
158 break;
3ff50b79 159 }
1da177e4 160
a5040efa 161 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 162
163 BT_DBG("%s end: err %d", hdev->name, err);
164
165 return err;
166}
167
168static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 169 unsigned long opt, __u32 timeout)
1da177e4
LT		 170{
171 int ret;
172
7c6a329e
MH		 173 if (!test_bit(HCI_UP, &hdev->flags))
174 return -ENETDOWN;
175
1da177e4
LT		 176 /* Serialize all requests */
177 hci_req_lock(hdev);
178 ret = __hci_request(hdev, req, opt, timeout);
179 hci_req_unlock(hdev);
180
181 return ret;
182}
183
184static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
185{
186 BT_DBG("%s %ld", hdev->name, opt);
187
188 /* Reset device */
f630cf0d 189 set_bit(HCI_RESET, &hdev->flags);
a9de9248 190 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 191}
192
193static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
194{
b0916ea0 195 struct hci_cp_delete_stored_link_key cp;
1da177e4 196 struct sk_buff *skb;
1ebb9252 197 __le16 param;
89f2783d 198 __u8 flt_type;
1da177e4
LT		 199
200 BT_DBG("%s %ld", hdev->name, opt);
201
202 /* Driver initialization */
203
204 /* Special commands */
205 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 206 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 207 skb->dev = (void *) hdev;
c78ae283 208
1da177e4 209 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 210 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 211 }
212 skb_queue_purge(&hdev->driver_init);
213
214 /* Mandatory initialization */
215
216 /* Reset */
f630cf0d
GP		 217 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
218 set_bit(HCI_RESET, &hdev->flags);
a9de9248 219 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
f630cf0d 220 }
1da177e4
LT		 221
222 /* Read Local Supported Features */
a9de9248 223 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 224
1143e5a6 225 /* Read Local Version */
a9de9248 226 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 227
1da177e4 228 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 229 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 230
231#if 0
232 /* Host buffer size */
233 {
234 struct hci_cp_host_buffer_size cp;
aca3192c 235 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 236 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 237 cp.acl_max_pkt = cpu_to_le16(0xffff);
238 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 239 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 240 }
241#endif
242
243 /* Read BD Address */
a9de9248
MH		 244 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
245
246 /* Read Class of Device */
247 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
248
249 /* Read Local Name */
250 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 251
252 /* Read Voice Setting */
a9de9248 253 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 254
255 /* Optional initialization */
256
257 /* Clear Event Filters */
89f2783d 258 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 259 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4 260
1da177e4 261 /* Connection accept timeout ~20 secs */
aca3192c 262 param = cpu_to_le16(0x7d00);
a9de9248 263 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
b0916ea0
JH		 264
265 bacpy(&cp.bdaddr, BDADDR_ANY);
266 cp.delete_all = 1;
267 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
1da177e4
LT		 268}
269
6ed58ec5
VT		 270static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
271{
272 BT_DBG("%s", hdev->name);
273
274 /* Read LE buffer size */
275 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
276}
277
1da177e4
LT		 278static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
279{
280 __u8 scan = opt;
281
282 BT_DBG("%s %x", hdev->name, scan);
283
284 /* Inquiry and Page scans */
a9de9248 285 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 286}
287
288static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
289{
290 __u8 auth = opt;
291
292 BT_DBG("%s %x", hdev->name, auth);
293
294 /* Authentication */
a9de9248 295 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 296}
297
298static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
299{
300 __u8 encrypt = opt;
301
302 BT_DBG("%s %x", hdev->name, encrypt);
303
e4e8e37c 304 /* Encryption */
a9de9248 305 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 306}
307
e4e8e37c
MH		 308static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
309{
310 __le16 policy = cpu_to_le16(opt);
311
a418b893 312 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 313
314 /* Default link policy */
315 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
316}
317
8e87d142 318/* Get HCI device by index.
1da177e4
LT		 319 * Device is held on return. */
320struct hci_dev *hci_dev_get(int index)
321{
8035ded4 322 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 323
324 BT_DBG("%d", index);
325
326 if (index < 0)
327 return NULL;
328
329 read_lock(&hci_dev_list_lock);
8035ded4 330 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 331 if (d->id == index) {
332 hdev = hci_dev_hold(d);
333 break;
334 }
335 }
336 read_unlock(&hci_dev_list_lock);
337 return hdev;
338}
1da177e4
LT		 339
340/* ---- Inquiry support ---- */
341static void inquiry_cache_flush(struct hci_dev *hdev)
342{
343 struct inquiry_cache *cache = &hdev->inq_cache;
344 struct inquiry_entry *next = cache->list, *e;
345
346 BT_DBG("cache %p", cache);
347
348 cache->list = NULL;
349 while ((e = next)) {
350 next = e->next;
351 kfree(e);
352 }
353}
354
355struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
356{
357 struct inquiry_cache *cache = &hdev->inq_cache;
358 struct inquiry_entry *e;
359
360 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
361
362 for (e = cache->list; e; e = e->next)
363 if (!bacmp(&e->data.bdaddr, bdaddr))
364 break;
365 return e;
366}
367
368void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
369{
370 struct inquiry_cache *cache = &hdev->inq_cache;
70f23020 371 struct inquiry_entry *ie;
1da177e4
LT		 372
373 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
374
70f23020
AE		 375 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
376 if (!ie) {
1da177e4 377 /* Entry not in the cache. Add new one. */
70f23020
AE		 378 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
379 if (!ie)
1da177e4 380 return;
70f23020
AE		 381
382 ie->next = cache->list;
383 cache->list = ie;
1da177e4
LT		 384 }
385
70f23020
AE		 386 memcpy(&ie->data, data, sizeof(*data));
387 ie->timestamp = jiffies;
1da177e4
LT		 388 cache->timestamp = jiffies;
389}
390
391static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
392{
393 struct inquiry_cache *cache = &hdev->inq_cache;
394 struct inquiry_info *info = (struct inquiry_info *) buf;
395 struct inquiry_entry *e;
396 int copied = 0;
397
398 for (e = cache->list; e && copied < num; e = e->next, copied++) {
399 struct inquiry_data *data = &e->data;
400 bacpy(&info->bdaddr, &data->bdaddr);
401 info->pscan_rep_mode = data->pscan_rep_mode;
402 info->pscan_period_mode = data->pscan_period_mode;
403 info->pscan_mode = data->pscan_mode;
404 memcpy(info->dev_class, data->dev_class, 3);
405 info->clock_offset = data->clock_offset;
406 info++;
407 }
408
409 BT_DBG("cache %p, copied %d", cache, copied);
410 return copied;
411}
412
413static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
414{
415 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
416 struct hci_cp_inquiry cp;
417
418 BT_DBG("%s", hdev->name);
419
420 if (test_bit(HCI_INQUIRY, &hdev->flags))
421 return;
422
423 /* Start Inquiry */
424 memcpy(&cp.lap, &ir->lap, 3);
425 cp.length = ir->length;
426 cp.num_rsp = ir->num_rsp;
a9de9248 427 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 428}
429
430int hci_inquiry(void __user *arg)
431{
432 __u8 __user *ptr = arg;
433 struct hci_inquiry_req ir;
434 struct hci_dev *hdev;
435 int err = 0, do_inquiry = 0, max_rsp;
436 long timeo;
437 __u8 *buf;
438
439 if (copy_from_user(&ir, ptr, sizeof(ir)))
440 return -EFAULT;
441
5a08ecce
AE		 442 hdev = hci_dev_get(ir.dev_id);
443 if (!hdev)
1da177e4
LT		 444 return -ENODEV;
445
446 hci_dev_lock_bh(hdev);
8e87d142 447 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
70f23020
AE		 448 inquiry_cache_empty(hdev) ||
449 ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 450 inquiry_cache_flush(hdev);
451 do_inquiry = 1;
452 }
453 hci_dev_unlock_bh(hdev);
454
04837f64 455 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 456
457 if (do_inquiry) {
458 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
459 if (err < 0)
460 goto done;
461 }
1da177e4
LT		 462
463 /* for unlimited number of responses we will use buffer with 255 entries */
464 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
465
466 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
467 * copy it to the user space.
468 */
01df8c31 469 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 470 if (!buf) {
1da177e4
LT		 471 err = -ENOMEM;
472 goto done;
473 }
474
475 hci_dev_lock_bh(hdev);
476 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
477 hci_dev_unlock_bh(hdev);
478
479 BT_DBG("num_rsp %d", ir.num_rsp);
480
481 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
482 ptr += sizeof(ir);
483 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
484 ir.num_rsp))
485 err = -EFAULT;
8e87d142 486 } else
1da177e4
LT		 487 err = -EFAULT;
488
489 kfree(buf);
490
491done:
492 hci_dev_put(hdev);
493 return err;
494}
495
496/* ---- HCI ioctl helpers ---- */
497
498int hci_dev_open(__u16 dev)
499{
500 struct hci_dev *hdev;
501 int ret = 0;
502
5a08ecce
AE		 503 hdev = hci_dev_get(dev);
504 if (!hdev)
1da177e4
LT		 505 return -ENODEV;
506
507 BT_DBG("%s %p", hdev->name, hdev);
508
509 hci_req_lock(hdev);
510
611b30f7
MH		 511 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
512 ret = -ERFKILL;
513 goto done;
514 }
515
1da177e4
LT		 516 if (test_bit(HCI_UP, &hdev->flags)) {
517 ret = -EALREADY;
518 goto done;
519 }
520
521 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
522 set_bit(HCI_RAW, &hdev->flags);
523
943da25d
MH		 524 /* Treat all non BR/EDR controllers as raw devices for now */
525 if (hdev->dev_type != HCI_BREDR)
526 set_bit(HCI_RAW, &hdev->flags);
527
1da177e4
LT		 528 if (hdev->open(hdev)) {
529 ret = -EIO;
530 goto done;
531 }
532
533 if (!test_bit(HCI_RAW, &hdev->flags)) {
534 atomic_set(&hdev->cmd_cnt, 1);
535 set_bit(HCI_INIT, &hdev->flags);
a5040efa 536 hdev->init_last_cmd = 0;
1da177e4 537
04837f64
MH		 538 ret = __hci_request(hdev, hci_init_req, 0,
539 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4 540
eead27da 541 if (lmp_host_le_capable(hdev))
6ed58ec5
VT		 542 ret = __hci_request(hdev, hci_le_init_req, 0,
543 msecs_to_jiffies(HCI_INIT_TIMEOUT));
544
1da177e4
LT		 545 clear_bit(HCI_INIT, &hdev->flags);
546 }
547
548 if (!ret) {
549 hci_dev_hold(hdev);
550 set_bit(HCI_UP, &hdev->flags);
551 hci_notify(hdev, HCI_DEV_UP);
5add6af8 552 if (!test_bit(HCI_SETUP, &hdev->flags))
744cf19e 553 mgmt_powered(hdev, 1);
8e87d142 554 } else {
1da177e4
LT		 555 /* Init failed, cleanup */
556 tasklet_kill(&hdev->rx_task);
557 tasklet_kill(&hdev->tx_task);
558 tasklet_kill(&hdev->cmd_task);
559
560 skb_queue_purge(&hdev->cmd_q);
561 skb_queue_purge(&hdev->rx_q);
562
563 if (hdev->flush)
564 hdev->flush(hdev);
565
566 if (hdev->sent_cmd) {
567 kfree_skb(hdev->sent_cmd);
568 hdev->sent_cmd = NULL;
569 }
570
571 hdev->close(hdev);
572 hdev->flags = 0;
573 }
574
575done:
576 hci_req_unlock(hdev);
577 hci_dev_put(hdev);
578 return ret;
579}
580
581static int hci_dev_do_close(struct hci_dev *hdev)
582{
583 BT_DBG("%s %p", hdev->name, hdev);
584
585 hci_req_cancel(hdev, ENODEV);
586 hci_req_lock(hdev);
587
588 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 589 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 590 hci_req_unlock(hdev);
591 return 0;
592 }
593
594 /* Kill RX and TX tasks */
595 tasklet_kill(&hdev->rx_task);
596 tasklet_kill(&hdev->tx_task);
597
16ab91ab
JH		 598 if (hdev->discov_timeout > 0) {
599 cancel_delayed_work_sync(&hdev->discov_off);
600 hdev->discov_timeout = 0;
601 }
602
3243553f
JH		 603 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
604 cancel_delayed_work_sync(&hdev->power_off);
605
1da177e4
LT		 606 hci_dev_lock_bh(hdev);
607 inquiry_cache_flush(hdev);
608 hci_conn_hash_flush(hdev);
609 hci_dev_unlock_bh(hdev);
610
611 hci_notify(hdev, HCI_DEV_DOWN);
612
613 if (hdev->flush)
614 hdev->flush(hdev);
615
616 /* Reset device */
617 skb_queue_purge(&hdev->cmd_q);
618 atomic_set(&hdev->cmd_cnt, 1);
619 if (!test_bit(HCI_RAW, &hdev->flags)) {
620 set_bit(HCI_INIT, &hdev->flags);
04837f64 621 __hci_request(hdev, hci_reset_req, 0,
43611a7b 622 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 623 clear_bit(HCI_INIT, &hdev->flags);
624 }
625
626 /* Kill cmd task */
627 tasklet_kill(&hdev->cmd_task);
628
629 /* Drop queues */
630 skb_queue_purge(&hdev->rx_q);
631 skb_queue_purge(&hdev->cmd_q);
632 skb_queue_purge(&hdev->raw_q);
633
634 /* Drop last sent command */
635 if (hdev->sent_cmd) {
b79f44c1 636 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 637 kfree_skb(hdev->sent_cmd);
638 hdev->sent_cmd = NULL;
639 }
640
641 /* After this point our queues are empty
642 * and no tasks are scheduled. */
643 hdev->close(hdev);
644
744cf19e 645 mgmt_powered(hdev, 0);
5add6af8 646
1da177e4
LT		 647 /* Clear flags */
648 hdev->flags = 0;
649
650 hci_req_unlock(hdev);
651
652 hci_dev_put(hdev);
653 return 0;
654}
655
656int hci_dev_close(__u16 dev)
657{
658 struct hci_dev *hdev;
659 int err;
660
70f23020
AE		 661 hdev = hci_dev_get(dev);
662 if (!hdev)
1da177e4
LT		 663 return -ENODEV;
664 err = hci_dev_do_close(hdev);
665 hci_dev_put(hdev);
666 return err;
667}
668
669int hci_dev_reset(__u16 dev)
670{
671 struct hci_dev *hdev;
672 int ret = 0;
673
70f23020
AE		 674 hdev = hci_dev_get(dev);
675 if (!hdev)
1da177e4
LT		 676 return -ENODEV;
677
678 hci_req_lock(hdev);
679 tasklet_disable(&hdev->tx_task);
680
681 if (!test_bit(HCI_UP, &hdev->flags))
682 goto done;
683
684 /* Drop queues */
685 skb_queue_purge(&hdev->rx_q);
686 skb_queue_purge(&hdev->cmd_q);
687
688 hci_dev_lock_bh(hdev);
689 inquiry_cache_flush(hdev);
690 hci_conn_hash_flush(hdev);
691 hci_dev_unlock_bh(hdev);
692
693 if (hdev->flush)
694 hdev->flush(hdev);
695
8e87d142 696 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 697 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 698
699 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 700 ret = __hci_request(hdev, hci_reset_req, 0,
701 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 702
703done:
704 tasklet_enable(&hdev->tx_task);
705 hci_req_unlock(hdev);
706 hci_dev_put(hdev);
707 return ret;
708}
709
710int hci_dev_reset_stat(__u16 dev)
711{
712 struct hci_dev *hdev;
713 int ret = 0;
714
70f23020
AE		 715 hdev = hci_dev_get(dev);
716 if (!hdev)
1da177e4
LT		 717 return -ENODEV;
718
719 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
720
721 hci_dev_put(hdev);
722
723 return ret;
724}
725
726int hci_dev_cmd(unsigned int cmd, void __user *arg)
727{
728 struct hci_dev *hdev;
729 struct hci_dev_req dr;
730 int err = 0;
731
732 if (copy_from_user(&dr, arg, sizeof(dr)))
733 return -EFAULT;
734
70f23020
AE		 735 hdev = hci_dev_get(dr.dev_id);
736 if (!hdev)
1da177e4
LT		 737 return -ENODEV;
738
739 switch (cmd) {
740 case HCISETAUTH:
04837f64
MH		 741 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
742 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 743 break;
744
745 case HCISETENCRYPT:
746 if (!lmp_encrypt_capable(hdev)) {
747 err = -EOPNOTSUPP;
748 break;
749 }
750
751 if (!test_bit(HCI_AUTH, &hdev->flags)) {
752 /* Auth must be enabled first */
04837f64
MH		 753 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
754 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 755 if (err)
756 break;
757 }
758
04837f64
MH		 759 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
760 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 761 break;
762
763 case HCISETSCAN:
04837f64
MH		 764 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
765 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 766 break;
767
1da177e4 768 case HCISETLINKPOL:
e4e8e37c
MH		 769 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
770 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 771 break;
772
773 case HCISETLINKMODE:
e4e8e37c
MH		 774 hdev->link_mode = ((__u16) dr.dev_opt) &
775 (HCI_LM_MASTER | HCI_LM_ACCEPT);
776 break;
777
778 case HCISETPTYPE:
779 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 780 break;
781
782 case HCISETACLMTU:
e4e8e37c
MH		 783 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
784 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 785 break;
786
787 case HCISETSCOMTU:
e4e8e37c
MH		 788 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
789 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 790 break;
791
792 default:
793 err = -EINVAL;
794 break;
795 }
e4e8e37c 796
1da177e4
LT		 797 hci_dev_put(hdev);
798 return err;
799}
800
801int hci_get_dev_list(void __user *arg)
802{
8035ded4 803 struct hci_dev *hdev;
1da177e4
LT		 804 struct hci_dev_list_req *dl;
805 struct hci_dev_req *dr;
1da177e4
LT		 806 int n = 0, size, err;
807 __u16 dev_num;
808
809 if (get_user(dev_num, (__u16 __user *) arg))
810 return -EFAULT;
811
812 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
813 return -EINVAL;
814
815 size = sizeof(*dl) + dev_num * sizeof(*dr);
816
70f23020
AE		 817 dl = kzalloc(size, GFP_KERNEL);
818 if (!dl)
1da177e4
LT		 819 return -ENOMEM;
820
821 dr = dl->dev_req;
822
823 read_lock_bh(&hci_dev_list_lock);
8035ded4 824 list_for_each_entry(hdev, &hci_dev_list, list) {
3243553f
JH		 825 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
826 cancel_delayed_work_sync(&hdev->power_off);
c542a06c
JH		 827
828 if (!test_bit(HCI_MGMT, &hdev->flags))
829 set_bit(HCI_PAIRABLE, &hdev->flags);
830
1da177e4
LT		 831 (dr + n)->dev_id = hdev->id;
832 (dr + n)->dev_opt = hdev->flags;
c542a06c 833
1da177e4
LT		 834 if (++n >= dev_num)
835 break;
836 }
837 read_unlock_bh(&hci_dev_list_lock);
838
839 dl->dev_num = n;
840 size = sizeof(*dl) + n * sizeof(*dr);
841
842 err = copy_to_user(arg, dl, size);
843 kfree(dl);
844
845 return err ? -EFAULT : 0;
846}
847
848int hci_get_dev_info(void __user *arg)
849{
850 struct hci_dev *hdev;
851 struct hci_dev_info di;
852 int err = 0;
853
854 if (copy_from_user(&di, arg, sizeof(di)))
855 return -EFAULT;
856
70f23020
AE		 857 hdev = hci_dev_get(di.dev_id);
858 if (!hdev)
1da177e4
LT		 859 return -ENODEV;
860
3243553f
JH		 861 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
862 cancel_delayed_work_sync(&hdev->power_off);
ab81cbf9 863
c542a06c
JH		 864 if (!test_bit(HCI_MGMT, &hdev->flags))
865 set_bit(HCI_PAIRABLE, &hdev->flags);
866
1da177e4
LT		 867 strcpy(di.name, hdev->name);
868 di.bdaddr = hdev->bdaddr;
943da25d 869 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 870 di.flags = hdev->flags;
871 di.pkt_type = hdev->pkt_type;
872 di.acl_mtu = hdev->acl_mtu;
873 di.acl_pkts = hdev->acl_pkts;
874 di.sco_mtu = hdev->sco_mtu;
875 di.sco_pkts = hdev->sco_pkts;
876 di.link_policy = hdev->link_policy;
877 di.link_mode = hdev->link_mode;
878
879 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
880 memcpy(&di.features, &hdev->features, sizeof(di.features));
881
882 if (copy_to_user(arg, &di, sizeof(di)))
883 err = -EFAULT;
884
885 hci_dev_put(hdev);
886
887 return err;
888}
889
890/* ---- Interface to HCI drivers ---- */
891
611b30f7
MH		 892static int hci_rfkill_set_block(void *data, bool blocked)
893{
894 struct hci_dev *hdev = data;
895
896 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
897
898 if (!blocked)
899 return 0;
900
901 hci_dev_do_close(hdev);
902
903 return 0;
904}
905
906static const struct rfkill_ops hci_rfkill_ops = {
907 .set_block = hci_rfkill_set_block,
908};
909
1da177e4
LT		 910/* Alloc HCI device */
911struct hci_dev *hci_alloc_dev(void)
912{
913 struct hci_dev *hdev;
914
25ea6db0 915 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 916 if (!hdev)
917 return NULL;
918
0ac7e700 919 hci_init_sysfs(hdev);
1da177e4
LT		 920 skb_queue_head_init(&hdev->driver_init);
921
922 return hdev;
923}
924EXPORT_SYMBOL(hci_alloc_dev);
925
926/* Free HCI device */
927void hci_free_dev(struct hci_dev *hdev)
928{
929 skb_queue_purge(&hdev->driver_init);
930
a91f2e39
MH		 931 /* will free via device release */
932 put_device(&hdev->dev);
1da177e4
LT		 933}
934EXPORT_SYMBOL(hci_free_dev);
935
ab81cbf9
JH		 936static void hci_power_on(struct work_struct *work)
937{
938 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
939
940 BT_DBG("%s", hdev->name);
941
942 if (hci_dev_open(hdev->id) < 0)
943 return;
944
945 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
3243553f
JH		 946 queue_delayed_work(hdev->workqueue, &hdev->power_off,
947 msecs_to_jiffies(AUTO_OFF_TIMEOUT));
ab81cbf9
JH		 948
949 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
744cf19e 950 mgmt_index_added(hdev);
ab81cbf9
JH		 951}
952
953static void hci_power_off(struct work_struct *work)
954{
3243553f
JH		 955 struct hci_dev *hdev = container_of(work, struct hci_dev,
956 power_off.work);
ab81cbf9
JH		 957
958 BT_DBG("%s", hdev->name);
959
960 clear_bit(HCI_AUTO_OFF, &hdev->flags);
961
3243553f 962 hci_dev_close(hdev->id);
ab81cbf9
JH		 963}
964
16ab91ab
JH		 965static void hci_discov_off(struct work_struct *work)
966{
967 struct hci_dev *hdev;
968 u8 scan = SCAN_PAGE;
969
970 hdev = container_of(work, struct hci_dev, discov_off.work);
971
972 BT_DBG("%s", hdev->name);
973
974 hci_dev_lock_bh(hdev);
975
976 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
977
978 hdev->discov_timeout = 0;
979
980 hci_dev_unlock_bh(hdev);
981}
982
2aeb9a1a
JH		 983int hci_uuids_clear(struct hci_dev *hdev)
984{
985 struct list_head *p, *n;
986
987 list_for_each_safe(p, n, &hdev->uuids) {
988 struct bt_uuid *uuid;
989
990 uuid = list_entry(p, struct bt_uuid, list);
991
992 list_del(p);
993 kfree(uuid);
994 }
995
996 return 0;
997}
998
55ed8ca1
JH		 999int hci_link_keys_clear(struct hci_dev *hdev)
1000{
1001 struct list_head *p, *n;
1002
1003 list_for_each_safe(p, n, &hdev->link_keys) {
1004 struct link_key *key;
1005
1006 key = list_entry(p, struct link_key, list);
1007
1008 list_del(p);
1009 kfree(key);
1010 }
1011
1012 return 0;
1013}
1014
1015struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1016{
8035ded4 1017 struct link_key *k;
55ed8ca1 1018
8035ded4 1019 list_for_each_entry(k, &hdev->link_keys, list)
55ed8ca1
JH		 1020 if (bacmp(bdaddr, &k->bdaddr) == 0)
1021 return k;
55ed8ca1
JH		 1022
1023 return NULL;
1024}
1025
d25e28ab
JH		 1026static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1027 u8 key_type, u8 old_key_type)
1028{
1029 /* Legacy key */
1030 if (key_type < 0x03)
1031 return 1;
1032
1033 /* Debug keys are insecure so don't store them persistently */
1034 if (key_type == HCI_LK_DEBUG_COMBINATION)
1035 return 0;
1036
1037 /* Changed combination key and there's no previous one */
1038 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1039 return 0;
1040
1041 /* Security mode 3 case */
1042 if (!conn)
1043 return 1;
1044
1045 /* Neither local nor remote side had no-bonding as requirement */
1046 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1047 return 1;
1048
1049 /* Local side had dedicated bonding as requirement */
1050 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1051 return 1;
1052
1053 /* Remote side had dedicated bonding as requirement */
1054 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1055 return 1;
1056
1057 /* If none of the above criteria match, then don't store the key
1058 * persistently */
1059 return 0;
1060}
1061
75d262c2
VCG		 1062struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1063{
1064 struct link_key *k;
1065
1066 list_for_each_entry(k, &hdev->link_keys, list) {
1067 struct key_master_id *id;
1068
1069 if (k->type != HCI_LK_SMP_LTK)
1070 continue;
1071
1072 if (k->dlen != sizeof(*id))
1073 continue;
1074
1075 id = (void *) &k->data;
1076 if (id->ediv == ediv &&
1077 (memcmp(rand, id->rand, sizeof(id->rand)) == 0))
1078 return k;
1079 }
1080
1081 return NULL;
1082}
1083EXPORT_SYMBOL(hci_find_ltk);
1084
1085struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
1086 bdaddr_t *bdaddr, u8 type)
1087{
1088 struct link_key *k;
1089
1090 list_for_each_entry(k, &hdev->link_keys, list)
1091 if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
1092 return k;
1093
1094 return NULL;
1095}
1096EXPORT_SYMBOL(hci_find_link_key_type);
1097
d25e28ab
JH		 1098int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1099 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1100{
1101 struct link_key *key, *old_key;
4df378a1 1102 u8 old_key_type, persistent;
55ed8ca1
JH		 1103
1104 old_key = hci_find_link_key(hdev, bdaddr);
1105 if (old_key) {
1106 old_key_type = old_key->type;
1107 key = old_key;
1108 } else {
12adcf3a 1109 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1110 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1111 if (!key)
1112 return -ENOMEM;
1113 list_add(&key->list, &hdev->link_keys);
1114 }
1115
1116 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1117
d25e28ab
JH		 1118 /* Some buggy controller combinations generate a changed
1119 * combination key for legacy pairing even when there's no
1120 * previous key */
1121 if (type == HCI_LK_CHANGED_COMBINATION &&
1122 (!conn || conn->remote_auth == 0xff) &&
655fe6ec 1123 old_key_type == 0xff) {
d25e28ab 1124 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1125 if (conn)
1126 conn->key_type = type;
1127 }
d25e28ab 1128
55ed8ca1
JH		 1129 bacpy(&key->bdaddr, bdaddr);
1130 memcpy(key->val, val, 16);
55ed8ca1
JH		 1131 key->pin_len = pin_len;
1132
b6020ba0 1133 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1134 key->type = old_key_type;
4748fed2
JH		 1135 else
1136 key->type = type;
1137
4df378a1
JH		 1138 if (!new_key)
1139 return 0;
1140
1141 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1142
744cf19e 1143 mgmt_new_link_key(hdev, key, persistent);
4df378a1
JH		 1144
1145 if (!persistent) {
1146 list_del(&key->list);
1147 kfree(key);
1148 }
55ed8ca1
JH		 1149
1150 return 0;
1151}
1152
75d262c2 1153int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
726b4ffc 1154 u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
75d262c2
VCG		 1155{
1156 struct link_key *key, *old_key;
1157 struct key_master_id *id;
1158 u8 old_key_type;
1159
1160 BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
1161
1162 old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
1163 if (old_key) {
1164 key = old_key;
1165 old_key_type = old_key->type;
1166 } else {
1167 key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
1168 if (!key)
1169 return -ENOMEM;
1170 list_add(&key->list, &hdev->link_keys);
1171 old_key_type = 0xff;
1172 }
1173
1174 key->dlen = sizeof(*id);
1175
1176 bacpy(&key->bdaddr, bdaddr);
1177 memcpy(key->val, ltk, sizeof(key->val));
1178 key->type = HCI_LK_SMP_LTK;
726b4ffc 1179 key->pin_len = key_size;
75d262c2
VCG		 1180
1181 id = (void *) &key->data;
1182 id->ediv = ediv;
1183 memcpy(id->rand, rand, sizeof(id->rand));
1184
1185 if (new_key)
744cf19e 1186 mgmt_new_link_key(hdev, key, old_key_type);
75d262c2
VCG		 1187
1188 return 0;
1189}
1190
55ed8ca1
JH		 1191int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1192{
1193 struct link_key *key;
1194
1195 key = hci_find_link_key(hdev, bdaddr);
1196 if (!key)
1197 return -ENOENT;
1198
1199 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1200
1201 list_del(&key->list);
1202 kfree(key);
1203
1204 return 0;
1205}
1206
6bd32326
VT		 1207/* HCI command timer function */
1208static void hci_cmd_timer(unsigned long arg)
1209{
1210 struct hci_dev *hdev = (void *) arg;
1211
1212 BT_ERR("%s command tx timeout", hdev->name);
1213 atomic_set(&hdev->cmd_cnt, 1);
1214 tasklet_schedule(&hdev->cmd_task);
1215}
1216
2763eda6
SJ		 1217struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1218 bdaddr_t *bdaddr)
1219{
1220 struct oob_data *data;
1221
1222 list_for_each_entry(data, &hdev->remote_oob_data, list)
1223 if (bacmp(bdaddr, &data->bdaddr) == 0)
1224 return data;
1225
1226 return NULL;
1227}
1228
1229int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1230{
1231 struct oob_data *data;
1232
1233 data = hci_find_remote_oob_data(hdev, bdaddr);
1234 if (!data)
1235 return -ENOENT;
1236
1237 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1238
1239 list_del(&data->list);
1240 kfree(data);
1241
1242 return 0;
1243}
1244
1245int hci_remote_oob_data_clear(struct hci_dev *hdev)
1246{
1247 struct oob_data *data, *n;
1248
1249 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1250 list_del(&data->list);
1251 kfree(data);
1252 }
1253
1254 return 0;
1255}
1256
1257int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1258 u8 *randomizer)
1259{
1260 struct oob_data *data;
1261
1262 data = hci_find_remote_oob_data(hdev, bdaddr);
1263
1264 if (!data) {
1265 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1266 if (!data)
1267 return -ENOMEM;
1268
1269 bacpy(&data->bdaddr, bdaddr);
1270 list_add(&data->list, &hdev->remote_oob_data);
1271 }
1272
1273 memcpy(data->hash, hash, sizeof(data->hash));
1274 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1275
1276 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1277
1278 return 0;
1279}
1280
b2a66aad
AJ		 1281struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1282 bdaddr_t *bdaddr)
1283{
8035ded4 1284 struct bdaddr_list *b;
b2a66aad 1285
8035ded4 1286 list_for_each_entry(b, &hdev->blacklist, list)
b2a66aad
AJ		 1287 if (bacmp(bdaddr, &b->bdaddr) == 0)
1288 return b;
b2a66aad
AJ		 1289
1290 return NULL;
1291}
1292
1293int hci_blacklist_clear(struct hci_dev *hdev)
1294{
1295 struct list_head *p, *n;
1296
1297 list_for_each_safe(p, n, &hdev->blacklist) {
1298 struct bdaddr_list *b;
1299
1300 b = list_entry(p, struct bdaddr_list, list);
1301
1302 list_del(p);
1303 kfree(b);
1304 }
1305
1306 return 0;
1307}
1308
1309int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1310{
1311 struct bdaddr_list *entry;
b2a66aad
AJ		 1312
1313 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1314 return -EBADF;
1315
5e762444
AJ		 1316 if (hci_blacklist_lookup(hdev, bdaddr))
1317 return -EEXIST;
b2a66aad
AJ		 1318
1319 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
5e762444
AJ		 1320 if (!entry)
1321 return -ENOMEM;
b2a66aad
AJ		 1322
1323 bacpy(&entry->bdaddr, bdaddr);
1324
1325 list_add(&entry->list, &hdev->blacklist);
1326
744cf19e 1327 return mgmt_device_blocked(hdev, bdaddr);
b2a66aad
AJ		 1328}
1329
1330int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1331{
1332 struct bdaddr_list *entry;
b2a66aad 1333
a7925bd2 1334 if (bacmp(bdaddr, BDADDR_ANY) == 0) {
5e762444 1335 return hci_blacklist_clear(hdev);
a7925bd2 1336 }
b2a66aad
AJ		 1337
1338 entry = hci_blacklist_lookup(hdev, bdaddr);
a7925bd2 1339 if (!entry) {
5e762444 1340 return -ENOENT;
a7925bd2 1341 }
b2a66aad
AJ		 1342
1343 list_del(&entry->list);
1344 kfree(entry);
1345
744cf19e 1346 return mgmt_device_unblocked(hdev, bdaddr);
b2a66aad
AJ		 1347}
1348
35815085
AG		 1349static void hci_clear_adv_cache(unsigned long arg)
1350{
1351 struct hci_dev *hdev = (void *) arg;
1352
1353 hci_dev_lock(hdev);
1354
1355 hci_adv_entries_clear(hdev);
1356
1357 hci_dev_unlock(hdev);
1358}
1359
76c8686f
AG		 1360int hci_adv_entries_clear(struct hci_dev *hdev)
1361{
1362 struct adv_entry *entry, *tmp;
1363
1364 list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1365 list_del(&entry->list);
1366 kfree(entry);
1367 }
1368
1369 BT_DBG("%s adv cache cleared", hdev->name);
1370
1371 return 0;
1372}
1373
1374struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1375{
1376 struct adv_entry *entry;
1377
1378 list_for_each_entry(entry, &hdev->adv_entries, list)
1379 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1380 return entry;
1381
1382 return NULL;
1383}
1384
1385static inline int is_connectable_adv(u8 evt_type)
1386{
1387 if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1388 return 1;
1389
1390 return 0;
1391}
1392
1393int hci_add_adv_entry(struct hci_dev *hdev,
1394 struct hci_ev_le_advertising_info *ev)
1395{
1396 struct adv_entry *entry;
1397
1398 if (!is_connectable_adv(ev->evt_type))
1399 return -EINVAL;
1400
1401 /* Only new entries should be added to adv_entries. So, if
1402 * bdaddr was found, don't add it. */
1403 if (hci_find_adv_entry(hdev, &ev->bdaddr))
1404 return 0;
1405
1406 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1407 if (!entry)
1408 return -ENOMEM;
1409
1410 bacpy(&entry->bdaddr, &ev->bdaddr);
1411 entry->bdaddr_type = ev->bdaddr_type;
1412
1413 list_add(&entry->list, &hdev->adv_entries);
1414
1415 BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1416 batostr(&entry->bdaddr), entry->bdaddr_type);
1417
1418 return 0;
1419}
1420
1da177e4
LT		 1421/* Register HCI device */
1422int hci_register_dev(struct hci_dev *hdev)
1423{
1424 struct list_head *head = &hci_dev_list, *p;
08add513 1425 int i, id, error;
1da177e4 1426
c13854ce
MH		 1427 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1428 hdev->bus, hdev->owner);
1da177e4
LT		 1429
1430 if (!hdev->open || !hdev->close || !hdev->destruct)
1431 return -EINVAL;
1432
08add513
MM		 1433 /* Do not allow HCI_AMP devices to register at index 0,
1434 * so the index can be used as the AMP controller ID.
1435 */
1436 id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
1437
1da177e4
LT		 1438 write_lock_bh(&hci_dev_list_lock);
1439
1440 /* Find first available device id */
1441 list_for_each(p, &hci_dev_list) {
1442 if (list_entry(p, struct hci_dev, list)->id != id)
1443 break;
1444 head = p; id++;
1445 }
8e87d142 1446
1da177e4
LT		 1447 sprintf(hdev->name, "hci%d", id);
1448 hdev->id = id;
1449 list_add(&hdev->list, head);
1450
1451 atomic_set(&hdev->refcnt, 1);
1452 spin_lock_init(&hdev->lock);
1453
1454 hdev->flags = 0;
1455 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 1456 hdev->esco_type = (ESCO_HV1);
1da177e4 1457 hdev->link_mode = (HCI_LM_ACCEPT);
17fa4b9d 1458 hdev->io_capability = 0x03; /* No Input No Output */
1da177e4 1459
04837f64
MH		 1460 hdev->idle_timeout = 0;
1461 hdev->sniff_max_interval = 800;
1462 hdev->sniff_min_interval = 80;
1463
70f23020 1464 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1da177e4
LT		 1465 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1466 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1467
1468 skb_queue_head_init(&hdev->rx_q);
1469 skb_queue_head_init(&hdev->cmd_q);
1470 skb_queue_head_init(&hdev->raw_q);
1471
6bd32326
VT		 1472 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1473
cd4c5391 1474 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1475 hdev->reassembly[i] = NULL;
1476
1da177e4 1477 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 1478 mutex_init(&hdev->req_lock);
1da177e4
LT		 1479
1480 inquiry_cache_init(hdev);
1481
1482 hci_conn_hash_init(hdev);
1483
2e58ef3e
JH		 1484 INIT_LIST_HEAD(&hdev->mgmt_pending);
1485
ea4bd8ba 1486 INIT_LIST_HEAD(&hdev->blacklist);
f0358568 1487
2aeb9a1a
JH		 1488 INIT_LIST_HEAD(&hdev->uuids);
1489
55ed8ca1
JH		 1490 INIT_LIST_HEAD(&hdev->link_keys);
1491
2763eda6
SJ		 1492 INIT_LIST_HEAD(&hdev->remote_oob_data);
1493
76c8686f 1494 INIT_LIST_HEAD(&hdev->adv_entries);
35815085
AG		 1495 setup_timer(&hdev->adv_timer, hci_clear_adv_cache,
1496 (unsigned long) hdev);
76c8686f 1497
ab81cbf9 1498 INIT_WORK(&hdev->power_on, hci_power_on);
3243553f 1499 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
ab81cbf9 1500
16ab91ab
JH		 1501 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1502
1da177e4
LT		 1503 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1504
1505 atomic_set(&hdev->promisc, 0);
1506
1507 write_unlock_bh(&hci_dev_list_lock);
1508
f48fd9c8 1509 hdev->workqueue = create_singlethread_workqueue(hdev->name);
33ca954d
DH		 1510 if (!hdev->workqueue) {
1511 error = -ENOMEM;
1512 goto err;
1513 }
f48fd9c8 1514
33ca954d
DH		 1515 error = hci_add_sysfs(hdev);
1516 if (error < 0)
1517 goto err_wqueue;
1da177e4 1518
611b30f7
MH		 1519 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1520 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1521 if (hdev->rfkill) {
1522 if (rfkill_register(hdev->rfkill) < 0) {
1523 rfkill_destroy(hdev->rfkill);
1524 hdev->rfkill = NULL;
1525 }
1526 }
1527
ab81cbf9
JH		 1528 set_bit(HCI_AUTO_OFF, &hdev->flags);
1529 set_bit(HCI_SETUP, &hdev->flags);
1530 queue_work(hdev->workqueue, &hdev->power_on);
1531
1da177e4
LT		 1532 hci_notify(hdev, HCI_DEV_REG);
1533
1534 return id;
f48fd9c8 1535
33ca954d
DH		 1536err_wqueue:
1537 destroy_workqueue(hdev->workqueue);
1538err:
f48fd9c8
MH		 1539 write_lock_bh(&hci_dev_list_lock);
1540 list_del(&hdev->list);
1541 write_unlock_bh(&hci_dev_list_lock);
1542
33ca954d 1543 return error;
1da177e4
LT		 1544}
1545EXPORT_SYMBOL(hci_register_dev);
1546
1547/* Unregister HCI device */
59735631 1548void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 1549{
ef222013
MH		 1550 int i;
1551
c13854ce 1552 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1553
1da177e4
LT		 1554 write_lock_bh(&hci_dev_list_lock);
1555 list_del(&hdev->list);
1556 write_unlock_bh(&hci_dev_list_lock);
1557
1558 hci_dev_do_close(hdev);
1559
cd4c5391 1560 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1561 kfree_skb(hdev->reassembly[i]);
1562
ab81cbf9
JH		 1563 if (!test_bit(HCI_INIT, &hdev->flags) &&
1564 !test_bit(HCI_SETUP, &hdev->flags))
744cf19e 1565 mgmt_index_removed(hdev);
ab81cbf9 1566
2e58ef3e
JH		 1567 /* mgmt_index_removed should take care of emptying the
1568 * pending list */
1569 BUG_ON(!list_empty(&hdev->mgmt_pending));
1570
1da177e4
LT		 1571 hci_notify(hdev, HCI_DEV_UNREG);
1572
611b30f7
MH		 1573 if (hdev->rfkill) {
1574 rfkill_unregister(hdev->rfkill);
1575 rfkill_destroy(hdev->rfkill);
1576 }
1577
ce242970 1578 hci_del_sysfs(hdev);
147e2d59 1579
35815085 1580 del_timer(&hdev->adv_timer);
c6f3c5f7 1581
f48fd9c8
MH		 1582 destroy_workqueue(hdev->workqueue);
1583
e2e0cacb
JH		 1584 hci_dev_lock_bh(hdev);
1585 hci_blacklist_clear(hdev);
2aeb9a1a 1586 hci_uuids_clear(hdev);
55ed8ca1 1587 hci_link_keys_clear(hdev);
2763eda6 1588 hci_remote_oob_data_clear(hdev);
76c8686f 1589 hci_adv_entries_clear(hdev);
e2e0cacb
JH		 1590 hci_dev_unlock_bh(hdev);
1591
1da177e4 1592 __hci_dev_put(hdev);
1da177e4
LT		 1593}
1594EXPORT_SYMBOL(hci_unregister_dev);
1595
1596/* Suspend HCI device */
1597int hci_suspend_dev(struct hci_dev *hdev)
1598{
1599 hci_notify(hdev, HCI_DEV_SUSPEND);
1600 return 0;
1601}
1602EXPORT_SYMBOL(hci_suspend_dev);
1603
1604/* Resume HCI device */
1605int hci_resume_dev(struct hci_dev *hdev)
1606{
1607 hci_notify(hdev, HCI_DEV_RESUME);
1608 return 0;
1609}
1610EXPORT_SYMBOL(hci_resume_dev);
1611
76bca880
MH		 1612/* Receive frame from HCI drivers */
1613int hci_recv_frame(struct sk_buff *skb)
1614{
1615 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1616 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1617 && !test_bit(HCI_INIT, &hdev->flags))) {
1618 kfree_skb(skb);
1619 return -ENXIO;
1620 }
1621
1622 /* Incomming skb */
1623 bt_cb(skb)->incoming = 1;
1624
1625 /* Time stamp */
1626 __net_timestamp(skb);
1627
1628 /* Queue frame for rx task */
1629 skb_queue_tail(&hdev->rx_q, skb);
c78ae283
MH		 1630 tasklet_schedule(&hdev->rx_task);
1631
76bca880
MH		 1632 return 0;
1633}
1634EXPORT_SYMBOL(hci_recv_frame);
1635
33e882a5 1636static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1e429f38 1637 int count, __u8 index)
33e882a5
SS		 1638{
1639 int len = 0;
1640 int hlen = 0;
1641 int remain = count;
1642 struct sk_buff *skb;
1643 struct bt_skb_cb *scb;
1644
1645 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1646 index >= NUM_REASSEMBLY)
1647 return -EILSEQ;
1648
1649 skb = hdev->reassembly[index];
1650
1651 if (!skb) {
1652 switch (type) {
1653 case HCI_ACLDATA_PKT:
1654 len = HCI_MAX_FRAME_SIZE;
1655 hlen = HCI_ACL_HDR_SIZE;
1656 break;
1657 case HCI_EVENT_PKT:
1658 len = HCI_MAX_EVENT_SIZE;
1659 hlen = HCI_EVENT_HDR_SIZE;
1660 break;
1661 case HCI_SCODATA_PKT:
1662 len = HCI_MAX_SCO_SIZE;
1663 hlen = HCI_SCO_HDR_SIZE;
1664 break;
1665 }
1666
1e429f38 1667 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 1668 if (!skb)
1669 return -ENOMEM;
1670
1671 scb = (void *) skb->cb;
1672 scb->expect = hlen;
1673 scb->pkt_type = type;
1674
1675 skb->dev = (void *) hdev;
1676 hdev->reassembly[index] = skb;
1677 }
1678
1679 while (count) {
1680 scb = (void *) skb->cb;
1681 len = min(scb->expect, (__u16)count);
1682
1683 memcpy(skb_put(skb, len), data, len);
1684
1685 count -= len;
1686 data += len;
1687 scb->expect -= len;
1688 remain = count;
1689
1690 switch (type) {
1691 case HCI_EVENT_PKT:
1692 if (skb->len == HCI_EVENT_HDR_SIZE) {
1693 struct hci_event_hdr *h = hci_event_hdr(skb);
1694 scb->expect = h->plen;
1695
1696 if (skb_tailroom(skb) < scb->expect) {
1697 kfree_skb(skb);
1698 hdev->reassembly[index] = NULL;
1699 return -ENOMEM;
1700 }
1701 }
1702 break;
1703
1704 case HCI_ACLDATA_PKT:
1705 if (skb->len == HCI_ACL_HDR_SIZE) {
1706 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1707 scb->expect = __le16_to_cpu(h->dlen);
1708
1709 if (skb_tailroom(skb) < scb->expect) {
1710 kfree_skb(skb);
1711 hdev->reassembly[index] = NULL;
1712 return -ENOMEM;
1713 }
1714 }
1715 break;
1716
1717 case HCI_SCODATA_PKT:
1718 if (skb->len == HCI_SCO_HDR_SIZE) {
1719 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1720 scb->expect = h->dlen;
1721
1722 if (skb_tailroom(skb) < scb->expect) {
1723 kfree_skb(skb);
1724 hdev->reassembly[index] = NULL;
1725 return -ENOMEM;
1726 }
1727 }
1728 break;
1729 }
1730
1731 if (scb->expect == 0) {
1732 /* Complete frame */
1733
1734 bt_cb(skb)->pkt_type = type;
1735 hci_recv_frame(skb);
1736
1737 hdev->reassembly[index] = NULL;
1738 return remain;
1739 }
1740 }
1741
1742 return remain;
1743}
1744
ef222013
MH		 1745int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1746{
f39a3c06
SS		 1747 int rem = 0;
1748
ef222013
MH		 1749 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1750 return -EILSEQ;
1751
da5f6c37 1752 while (count) {
1e429f38 1753 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 1754 if (rem < 0)
1755 return rem;
ef222013 1756
f39a3c06
SS		 1757 data += (count - rem);
1758 count = rem;
f81c6224 1759 }
ef222013 1760
f39a3c06 1761 return rem;
ef222013
MH		 1762}
1763EXPORT_SYMBOL(hci_recv_fragment);
1764
99811510
SS		 1765#define STREAM_REASSEMBLY 0
1766
1767int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1768{
1769 int type;
1770 int rem = 0;
1771
da5f6c37 1772 while (count) {
99811510
SS		 1773 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1774
1775 if (!skb) {
1776 struct { char type; } *pkt;
1777
1778 /* Start of the frame */
1779 pkt = data;
1780 type = pkt->type;
1781
1782 data++;
1783 count--;
1784 } else
1785 type = bt_cb(skb)->pkt_type;
1786
1e429f38
GP		 1787 rem = hci_reassembly(hdev, type, data, count,
1788 STREAM_REASSEMBLY);
99811510
SS		 1789 if (rem < 0)
1790 return rem;
1791
1792 data += (count - rem);
1793 count = rem;
f81c6224 1794 }
99811510
SS		 1795
1796 return rem;
1797}
1798EXPORT_SYMBOL(hci_recv_stream_fragment);
1799
1da177e4
LT		 1800/* ---- Interface to upper protocols ---- */
1801
1802/* Register/Unregister protocols.
1803 * hci_task_lock is used to ensure that no tasks are running. */
1804int hci_register_proto(struct hci_proto *hp)
1805{
1806 int err = 0;
1807
1808 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1809
1810 if (hp->id >= HCI_MAX_PROTO)
1811 return -EINVAL;
1812
1813 write_lock_bh(&hci_task_lock);
1814
1815 if (!hci_proto[hp->id])
1816 hci_proto[hp->id] = hp;
1817 else
1818 err = -EEXIST;
1819
1820 write_unlock_bh(&hci_task_lock);
1821
1822 return err;
1823}
1824EXPORT_SYMBOL(hci_register_proto);
1825
1826int hci_unregister_proto(struct hci_proto *hp)
1827{
1828 int err = 0;
1829
1830 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1831
1832 if (hp->id >= HCI_MAX_PROTO)
1833 return -EINVAL;
1834
1835 write_lock_bh(&hci_task_lock);
1836
1837 if (hci_proto[hp->id])
1838 hci_proto[hp->id] = NULL;
1839 else
1840 err = -ENOENT;
1841
1842 write_unlock_bh(&hci_task_lock);
1843
1844 return err;
1845}
1846EXPORT_SYMBOL(hci_unregister_proto);
1847
1848int hci_register_cb(struct hci_cb *cb)
1849{
1850 BT_DBG("%p name %s", cb, cb->name);
1851
1852 write_lock_bh(&hci_cb_list_lock);
1853 list_add(&cb->list, &hci_cb_list);
1854 write_unlock_bh(&hci_cb_list_lock);
1855
1856 return 0;
1857}
1858EXPORT_SYMBOL(hci_register_cb);
1859
1860int hci_unregister_cb(struct hci_cb *cb)
1861{
1862 BT_DBG("%p name %s", cb, cb->name);
1863
1864 write_lock_bh(&hci_cb_list_lock);
1865 list_del(&cb->list);
1866 write_unlock_bh(&hci_cb_list_lock);
1867
1868 return 0;
1869}
1870EXPORT_SYMBOL(hci_unregister_cb);
1871
1872static int hci_send_frame(struct sk_buff *skb)
1873{
1874 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1875
1876 if (!hdev) {
1877 kfree_skb(skb);
1878 return -ENODEV;
1879 }
1880
0d48d939 1881 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1882
1883 if (atomic_read(&hdev->promisc)) {
1884 /* Time stamp */
a61bbcf2 1885 __net_timestamp(skb);
1da177e4 1886
eec8d2bc 1887 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1888 }
1889
1890 /* Get rid of skb owner, prior to sending to the driver. */
1891 skb_orphan(skb);
1892
1893 return hdev->send(skb);
1894}
1895
1896/* Send HCI command */
a9de9248 1897int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1898{
1899 int len = HCI_COMMAND_HDR_SIZE + plen;
1900 struct hci_command_hdr *hdr;
1901 struct sk_buff *skb;
1902
a9de9248 1903 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1904
1905 skb = bt_skb_alloc(len, GFP_ATOMIC);
1906 if (!skb) {
ef222013 1907 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1908 return -ENOMEM;
1909 }
1910
1911 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1912 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1913 hdr->plen = plen;
1914
1915 if (plen)
1916 memcpy(skb_put(skb, plen), param, plen);
1917
1918 BT_DBG("skb len %d", skb->len);
1919
0d48d939 1920 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 1921 skb->dev = (void *) hdev;
c78ae283 1922
a5040efa
JH		 1923 if (test_bit(HCI_INIT, &hdev->flags))
1924 hdev->init_last_cmd = opcode;
1925
1da177e4 1926 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 1927 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 1928
1929 return 0;
1930}
1da177e4
LT		 1931
1932/* Get data from the previously sent command */
a9de9248 1933void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1934{
1935 struct hci_command_hdr *hdr;
1936
1937 if (!hdev->sent_cmd)
1938 return NULL;
1939
1940 hdr = (void *) hdev->sent_cmd->data;
1941
a9de9248 1942 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1943 return NULL;
1944
a9de9248 1945 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1946
1947 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1948}
1949
1950/* Send ACL data */
1951static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1952{
1953 struct hci_acl_hdr *hdr;
1954 int len = skb->len;
1955
badff6d0
ACM		 1956 skb_push(skb, HCI_ACL_HDR_SIZE);
1957 skb_reset_transport_header(skb);
9c70220b 1958 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1959 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1960 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1961}
1962
73d80deb
LAD		 1963static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
1964 struct sk_buff *skb, __u16 flags)
1da177e4
LT		 1965{
1966 struct hci_dev *hdev = conn->hdev;
1967 struct sk_buff *list;
1968
70f23020
AE		 1969 list = skb_shinfo(skb)->frag_list;
1970 if (!list) {
1da177e4
LT		 1971 /* Non fragmented */
1972 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1973
73d80deb 1974 skb_queue_tail(queue, skb);
1da177e4
LT		 1975 } else {
1976 /* Fragmented */
1977 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1978
1979 skb_shinfo(skb)->frag_list = NULL;
1980
1981 /* Queue all fragments atomically */
73d80deb 1982 spin_lock_bh(&queue->lock);
1da177e4 1983
73d80deb 1984 __skb_queue_tail(queue, skb);
e702112f
AE		 1985
1986 flags &= ~ACL_START;
1987 flags |= ACL_CONT;
1da177e4
LT		 1988 do {
1989 skb = list; list = list->next;
8e87d142 1990
1da177e4 1991 skb->dev = (void *) hdev;
0d48d939 1992 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1993 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 1994
1995 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1996
73d80deb 1997 __skb_queue_tail(queue, skb);
1da177e4
LT		 1998 } while (list);
1999
73d80deb 2000 spin_unlock_bh(&queue->lock);
1da177e4 2001 }
73d80deb
LAD		 2002}
2003
2004void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2005{
2006 struct hci_conn *conn = chan->conn;
2007 struct hci_dev *hdev = conn->hdev;
2008
2009 BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
2010
2011 skb->dev = (void *) hdev;
2012 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2013 hci_add_acl_hdr(skb, conn->handle, flags);
2014
2015 hci_queue_acl(conn, &chan->data_q, skb, flags);
1da177e4 2016
c78ae283 2017 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 2018}
2019EXPORT_SYMBOL(hci_send_acl);
2020
2021/* Send SCO data */
0d861d8b 2022void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 2023{
2024 struct hci_dev *hdev = conn->hdev;
2025 struct hci_sco_hdr hdr;
2026
2027 BT_DBG("%s len %d", hdev->name, skb->len);
2028
aca3192c 2029 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 2030 hdr.dlen = skb->len;
2031
badff6d0
ACM		 2032 skb_push(skb, HCI_SCO_HDR_SIZE);
2033 skb_reset_transport_header(skb);
9c70220b 2034 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 2035
2036 skb->dev = (void *) hdev;
0d48d939 2037 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 2038
1da177e4 2039 skb_queue_tail(&conn->data_q, skb);
c78ae283 2040 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 2041}
2042EXPORT_SYMBOL(hci_send_sco);
2043
2044/* ---- HCI TX task (outgoing data) ---- */
2045
2046/* HCI Connection scheduler */
2047static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2048{
2049 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2050 struct hci_conn *conn = NULL, *c;
1da177e4 2051 int num = 0, min = ~0;
1da177e4 2052
8e87d142 2053 /* We don't have to lock device here. Connections are always
1da177e4 2054 * added and removed with TX task disabled. */
8035ded4 2055 list_for_each_entry(c, &h->list, list) {
769be974 2056 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2057 continue;
769be974
MH		 2058
2059 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2060 continue;
2061
1da177e4
LT		 2062 num++;
2063
2064 if (c->sent < min) {
2065 min = c->sent;
2066 conn = c;
2067 }
52087a79
LAD		 2068
2069 if (hci_conn_num(hdev, type) == num)
2070 break;
1da177e4
LT		 2071 }
2072
2073 if (conn) {
6ed58ec5
VT		 2074 int cnt, q;
2075
2076 switch (conn->type) {
2077 case ACL_LINK:
2078 cnt = hdev->acl_cnt;
2079 break;
2080 case SCO_LINK:
2081 case ESCO_LINK:
2082 cnt = hdev->sco_cnt;
2083 break;
2084 case LE_LINK:
2085 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2086 break;
2087 default:
2088 cnt = 0;
2089 BT_ERR("Unknown link type");
2090 }
2091
2092 q = cnt / num;
1da177e4
LT		 2093 *quote = q ? q : 1;
2094 } else
2095 *quote = 0;
2096
2097 BT_DBG("conn %p quote %d", conn, *quote);
2098 return conn;
2099}
2100
bae1f5d9 2101static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2102{
2103 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2104 struct hci_conn *c;
1da177e4 2105
bae1f5d9 2106 BT_ERR("%s link tx timeout", hdev->name);
1da177e4
LT		 2107
2108 /* Kill stalled connections */
8035ded4 2109 list_for_each_entry(c, &h->list, list) {
bae1f5d9
VT		 2110 if (c->type == type && c->sent) {
2111 BT_ERR("%s killing stalled connection %s",
1da177e4
LT		 2112 hdev->name, batostr(&c->dst));
2113 hci_acl_disconn(c, 0x13);
2114 }
2115 }
2116}
2117
73d80deb
LAD		 2118static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2119 int *quote)
1da177e4 2120{
73d80deb
LAD		 2121 struct hci_conn_hash *h = &hdev->conn_hash;
2122 struct hci_chan *chan = NULL;
2123 int num = 0, min = ~0, cur_prio = 0;
1da177e4 2124 struct hci_conn *conn;
73d80deb
LAD		 2125 int cnt, q, conn_num = 0;
2126
2127 BT_DBG("%s", hdev->name);
2128
2129 list_for_each_entry(conn, &h->list, list) {
2130 struct hci_chan_hash *ch;
2131 struct hci_chan *tmp;
2132
2133 if (conn->type != type)
2134 continue;
2135
2136 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2137 continue;
2138
2139 conn_num++;
2140
2141 ch = &conn->chan_hash;
2142
2143 list_for_each_entry(tmp, &ch->list, list) {
2144 struct sk_buff *skb;
2145
2146 if (skb_queue_empty(&tmp->data_q))
2147 continue;
2148
2149 skb = skb_peek(&tmp->data_q);
2150 if (skb->priority < cur_prio)
2151 continue;
2152
2153 if (skb->priority > cur_prio) {
2154 num = 0;
2155 min = ~0;
2156 cur_prio = skb->priority;
2157 }
2158
2159 num++;
2160
2161 if (conn->sent < min) {
2162 min = conn->sent;
2163 chan = tmp;
2164 }
2165 }
2166
2167 if (hci_conn_num(hdev, type) == conn_num)
2168 break;
2169 }
2170
2171 if (!chan)
2172 return NULL;
2173
2174 switch (chan->conn->type) {
2175 case ACL_LINK:
2176 cnt = hdev->acl_cnt;
2177 break;
2178 case SCO_LINK:
2179 case ESCO_LINK:
2180 cnt = hdev->sco_cnt;
2181 break;
2182 case LE_LINK:
2183 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2184 break;
2185 default:
2186 cnt = 0;
2187 BT_ERR("Unknown link type");
2188 }
2189
2190 q = cnt / num;
2191 *quote = q ? q : 1;
2192 BT_DBG("chan %p quote %d", chan, *quote);
2193 return chan;
2194}
2195
02b20f0b
LAD		 2196static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2197{
2198 struct hci_conn_hash *h = &hdev->conn_hash;
2199 struct hci_conn *conn;
2200 int num = 0;
2201
2202 BT_DBG("%s", hdev->name);
2203
2204 list_for_each_entry(conn, &h->list, list) {
2205 struct hci_chan_hash *ch;
2206 struct hci_chan *chan;
2207
2208 if (conn->type != type)
2209 continue;
2210
2211 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2212 continue;
2213
2214 num++;
2215
2216 ch = &conn->chan_hash;
2217 list_for_each_entry(chan, &ch->list, list) {
2218 struct sk_buff *skb;
2219
2220 if (chan->sent) {
2221 chan->sent = 0;
2222 continue;
2223 }
2224
2225 if (skb_queue_empty(&chan->data_q))
2226 continue;
2227
2228 skb = skb_peek(&chan->data_q);
2229 if (skb->priority >= HCI_PRIO_MAX - 1)
2230 continue;
2231
2232 skb->priority = HCI_PRIO_MAX - 1;
2233
2234 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2235 skb->priority);
2236 }
2237
2238 if (hci_conn_num(hdev, type) == num)
2239 break;
2240 }
2241}
2242
73d80deb
LAD		 2243static inline void hci_sched_acl(struct hci_dev *hdev)
2244{
2245 struct hci_chan *chan;
1da177e4
LT		 2246 struct sk_buff *skb;
2247 int quote;
73d80deb 2248 unsigned int cnt;
1da177e4
LT		 2249
2250 BT_DBG("%s", hdev->name);
2251
52087a79
LAD		 2252 if (!hci_conn_num(hdev, ACL_LINK))
2253 return;
2254
1da177e4
LT		 2255 if (!test_bit(HCI_RAW, &hdev->flags)) {
2256 /* ACL tx timeout must be longer than maximum
2257 * link supervision timeout (40.9 seconds) */
82453021 2258 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
bae1f5d9 2259 hci_link_tx_to(hdev, ACL_LINK);
1da177e4
LT		 2260 }
2261
73d80deb 2262 cnt = hdev->acl_cnt;
04837f64 2263
73d80deb
LAD		 2264 while (hdev->acl_cnt &&
2265 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 2266 u32 priority = (skb_peek(&chan->data_q))->priority;
2267 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb
LAD		 2268 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2269 skb->len, skb->priority);
2270
ec1cce24
LAD		 2271 /* Stop if priority has changed */
2272 if (skb->priority < priority)
2273 break;
2274
2275 skb = skb_dequeue(&chan->data_q);
2276
73d80deb
LAD		 2277 hci_conn_enter_active_mode(chan->conn,
2278 bt_cb(skb)->force_active);
04837f64 2279
1da177e4
LT		 2280 hci_send_frame(skb);
2281 hdev->acl_last_tx = jiffies;
2282
2283 hdev->acl_cnt--;
73d80deb
LAD		 2284 chan->sent++;
2285 chan->conn->sent++;
1da177e4
LT		 2286 }
2287 }
02b20f0b
LAD		 2288
2289 if (cnt != hdev->acl_cnt)
2290 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 2291}
2292
2293/* Schedule SCO */
2294static inline void hci_sched_sco(struct hci_dev *hdev)
2295{
2296 struct hci_conn *conn;
2297 struct sk_buff *skb;
2298 int quote;
2299
2300 BT_DBG("%s", hdev->name);
2301
52087a79
LAD		 2302 if (!hci_conn_num(hdev, SCO_LINK))
2303 return;
2304
1da177e4
LT		 2305 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2306 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2307 BT_DBG("skb %p len %d", skb, skb->len);
2308 hci_send_frame(skb);
2309
2310 conn->sent++;
2311 if (conn->sent == ~0)
2312 conn->sent = 0;
2313 }
2314 }
2315}
2316
b6a0dc82
MH		 2317static inline void hci_sched_esco(struct hci_dev *hdev)
2318{
2319 struct hci_conn *conn;
2320 struct sk_buff *skb;
2321 int quote;
2322
2323 BT_DBG("%s", hdev->name);
2324
52087a79
LAD		 2325 if (!hci_conn_num(hdev, ESCO_LINK))
2326 return;
2327
b6a0dc82
MH		 2328 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2329 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2330 BT_DBG("skb %p len %d", skb, skb->len);
2331 hci_send_frame(skb);
2332
2333 conn->sent++;
2334 if (conn->sent == ~0)
2335 conn->sent = 0;
2336 }
2337 }
2338}
2339
6ed58ec5
VT		 2340static inline void hci_sched_le(struct hci_dev *hdev)
2341{
73d80deb 2342 struct hci_chan *chan;
6ed58ec5 2343 struct sk_buff *skb;
02b20f0b 2344 int quote, cnt, tmp;
6ed58ec5
VT		 2345
2346 BT_DBG("%s", hdev->name);
2347
52087a79
LAD		 2348 if (!hci_conn_num(hdev, LE_LINK))
2349 return;
2350
6ed58ec5
VT		 2351 if (!test_bit(HCI_RAW, &hdev->flags)) {
2352 /* LE tx timeout must be longer than maximum
2353 * link supervision timeout (40.9 seconds) */
bae1f5d9 2354 if (!hdev->le_cnt && hdev->le_pkts &&
6ed58ec5 2355 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 2356 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 2357 }
2358
2359 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 2360 tmp = cnt;
73d80deb 2361 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 2362 u32 priority = (skb_peek(&chan->data_q))->priority;
2363 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb
LAD		 2364 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2365 skb->len, skb->priority);
6ed58ec5 2366
ec1cce24
LAD		 2367 /* Stop if priority has changed */
2368 if (skb->priority < priority)
2369 break;
2370
2371 skb = skb_dequeue(&chan->data_q);
2372
6ed58ec5
VT		 2373 hci_send_frame(skb);
2374 hdev->le_last_tx = jiffies;
2375
2376 cnt--;
73d80deb
LAD		 2377 chan->sent++;
2378 chan->conn->sent++;
6ed58ec5
VT		 2379 }
2380 }
73d80deb 2381
6ed58ec5
VT		 2382 if (hdev->le_pkts)
2383 hdev->le_cnt = cnt;
2384 else
2385 hdev->acl_cnt = cnt;
02b20f0b
LAD		 2386
2387 if (cnt != tmp)
2388 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 2389}
2390
1da177e4
LT		 2391static void hci_tx_task(unsigned long arg)
2392{
2393 struct hci_dev *hdev = (struct hci_dev *) arg;
2394 struct sk_buff *skb;
2395
2396 read_lock(&hci_task_lock);
2397
6ed58ec5
VT		 2398 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2399 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 2400
2401 /* Schedule queues and send stuff to HCI driver */
2402
2403 hci_sched_acl(hdev);
2404
2405 hci_sched_sco(hdev);
2406
b6a0dc82
MH		 2407 hci_sched_esco(hdev);
2408
6ed58ec5
VT		 2409 hci_sched_le(hdev);
2410
1da177e4
LT		 2411 /* Send next queued raw (unknown type) packet */
2412 while ((skb = skb_dequeue(&hdev->raw_q)))
2413 hci_send_frame(skb);
2414
2415 read_unlock(&hci_task_lock);
2416}
2417
25985edc 2418/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 2419
2420/* ACL data packet */
2421static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2422{
2423 struct hci_acl_hdr *hdr = (void *) skb->data;
2424 struct hci_conn *conn;
2425 __u16 handle, flags;
2426
2427 skb_pull(skb, HCI_ACL_HDR_SIZE);
2428
2429 handle = __le16_to_cpu(hdr->handle);
2430 flags = hci_flags(handle);
2431 handle = hci_handle(handle);
2432
2433 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2434
2435 hdev->stat.acl_rx++;
2436
2437 hci_dev_lock(hdev);
2438 conn = hci_conn_hash_lookup_handle(hdev, handle);
2439 hci_dev_unlock(hdev);
8e87d142 2440
1da177e4
LT		 2441 if (conn) {
2442 register struct hci_proto *hp;
2443
14b12d0b 2444 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
04837f64 2445
1da177e4 2446 /* Send to upper protocol */
70f23020
AE		 2447 hp = hci_proto[HCI_PROTO_L2CAP];
2448 if (hp && hp->recv_acldata) {
1da177e4
LT		 2449 hp->recv_acldata(conn, skb, flags);
2450 return;
2451 }
2452 } else {
8e87d142 2453 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 2454 hdev->name, handle);
2455 }
2456
2457 kfree_skb(skb);
2458}
2459
2460/* SCO data packet */
2461static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2462{
2463 struct hci_sco_hdr *hdr = (void *) skb->data;
2464 struct hci_conn *conn;
2465 __u16 handle;
2466
2467 skb_pull(skb, HCI_SCO_HDR_SIZE);
2468
2469 handle = __le16_to_cpu(hdr->handle);
2470
2471 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2472
2473 hdev->stat.sco_rx++;
2474
2475 hci_dev_lock(hdev);
2476 conn = hci_conn_hash_lookup_handle(hdev, handle);
2477 hci_dev_unlock(hdev);
2478
2479 if (conn) {
2480 register struct hci_proto *hp;
2481
2482 /* Send to upper protocol */
70f23020
AE		 2483 hp = hci_proto[HCI_PROTO_SCO];
2484 if (hp && hp->recv_scodata) {
1da177e4
LT		 2485 hp->recv_scodata(conn, skb);
2486 return;
2487 }
2488 } else {
8e87d142 2489 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 2490 hdev->name, handle);
2491 }
2492
2493 kfree_skb(skb);
2494}
2495
6516455d 2496static void hci_rx_task(unsigned long arg)
1da177e4
LT		 2497{
2498 struct hci_dev *hdev = (struct hci_dev *) arg;
2499 struct sk_buff *skb;
2500
2501 BT_DBG("%s", hdev->name);
2502
2503 read_lock(&hci_task_lock);
2504
2505 while ((skb = skb_dequeue(&hdev->rx_q))) {
2506 if (atomic_read(&hdev->promisc)) {
2507 /* Send copy to the sockets */
eec8d2bc 2508 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 2509 }
2510
2511 if (test_bit(HCI_RAW, &hdev->flags)) {
2512 kfree_skb(skb);
2513 continue;
2514 }
2515
2516 if (test_bit(HCI_INIT, &hdev->flags)) {
2517 /* Don't process data packets in this states. */
0d48d939 2518 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2519 case HCI_ACLDATA_PKT:
2520 case HCI_SCODATA_PKT:
2521 kfree_skb(skb);
2522 continue;
3ff50b79 2523 }
1da177e4
LT		 2524 }
2525
2526 /* Process frame */
0d48d939 2527 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2528 case HCI_EVENT_PKT:
2529 hci_event_packet(hdev, skb);
2530 break;
2531
2532 case HCI_ACLDATA_PKT:
2533 BT_DBG("%s ACL data packet", hdev->name);
2534 hci_acldata_packet(hdev, skb);
2535 break;
2536
2537 case HCI_SCODATA_PKT:
2538 BT_DBG("%s SCO data packet", hdev->name);
2539 hci_scodata_packet(hdev, skb);
2540 break;
2541
2542 default:
2543 kfree_skb(skb);
2544 break;
2545 }
2546 }
2547
2548 read_unlock(&hci_task_lock);
2549}
2550
2551static void hci_cmd_task(unsigned long arg)
2552{
2553 struct hci_dev *hdev = (struct hci_dev *) arg;
2554 struct sk_buff *skb;
2555
2556 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2557
1da177e4 2558 /* Send queued commands */
5a08ecce
AE		 2559 if (atomic_read(&hdev->cmd_cnt)) {
2560 skb = skb_dequeue(&hdev->cmd_q);
2561 if (!skb)
2562 return;
2563
7585b97a 2564 kfree_skb(hdev->sent_cmd);
1da177e4 2565
70f23020
AE		 2566 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2567 if (hdev->sent_cmd) {
1da177e4
LT		 2568 atomic_dec(&hdev->cmd_cnt);
2569 hci_send_frame(skb);
7bdb8a5c
SJ		 2570 if (test_bit(HCI_RESET, &hdev->flags))
2571 del_timer(&hdev->cmd_timer);
2572 else
2573 mod_timer(&hdev->cmd_timer,
6bd32326 2574 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
1da177e4
LT		 2575 } else {
2576 skb_queue_head(&hdev->cmd_q, skb);
c78ae283 2577 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 2578 }
2579 }
2580}
2519a1fc
AG		 2581
2582int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2583{
2584 /* General inquiry access code (GIAC) */
2585 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2586 struct hci_cp_inquiry cp;
2587
2588 BT_DBG("%s", hdev->name);
2589
2590 if (test_bit(HCI_INQUIRY, &hdev->flags))
2591 return -EINPROGRESS;
2592
2593 memset(&cp, 0, sizeof(cp));
2594 memcpy(&cp.lap, lap, sizeof(cp.lap));
2595 cp.length = length;
2596
2597 return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2598}
023d5049
AG		 2599
2600int hci_cancel_inquiry(struct hci_dev *hdev)
2601{
2602 BT_DBG("%s", hdev->name);
2603
2604 if (!test_bit(HCI_INQUIRY, &hdev->flags))
2605 return -EPERM;
2606
2607 return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2608}
kernel source for telekom puls (alcatel/mediatek)