projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Remove lock from inquiry_cache
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
82453021 28#include <linux/jiffies.h>
1da177e4
LT		 29#include <linux/module.h>
30#include <linux/kmod.h>
31
32#include <linux/types.h>
33#include <linux/errno.h>
34#include <linux/kernel.h>
1da177e4
LT		 35#include <linux/sched.h>
36#include <linux/slab.h>
37#include <linux/poll.h>
38#include <linux/fcntl.h>
39#include <linux/init.h>
40#include <linux/skbuff.h>
f48fd9c8 41#include <linux/workqueue.h>
1da177e4
LT		 42#include <linux/interrupt.h>
43#include <linux/notifier.h>
611b30f7 44#include <linux/rfkill.h>
6bd32326 45#include <linux/timer.h>
3a0259bb 46#include <linux/crypto.h>
1da177e4
LT		 47#include <net/sock.h>
48
49#include <asm/system.h>
70f23020 50#include <linux/uaccess.h>
1da177e4
LT		 51#include <asm/unaligned.h>
52
53#include <net/bluetooth/bluetooth.h>
54#include <net/bluetooth/hci_core.h>
55
ab81cbf9
JH		 56#define AUTO_OFF_TIMEOUT 2000
57
7784d78f
AE		 58int enable_hs;
59
b78752cc 60static void hci_rx_work(struct work_struct *work);
c347b765 61static void hci_cmd_work(struct work_struct *work);
3eff45ea 62static void hci_tx_work(struct work_struct *work);
1da177e4 63
1da177e4
LT		 64/* HCI device list */
65LIST_HEAD(hci_dev_list);
66DEFINE_RWLOCK(hci_dev_list_lock);
67
68/* HCI callback list */
69LIST_HEAD(hci_cb_list);
70DEFINE_RWLOCK(hci_cb_list_lock);
71
1da177e4 72/* HCI notifiers list */
e041c683 73static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 74
75/* ---- HCI notifications ---- */
76
77int hci_register_notifier(struct notifier_block *nb)
78{
e041c683 79 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 80}
81
82int hci_unregister_notifier(struct notifier_block *nb)
83{
e041c683 84 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 85}
86
6516455d 87static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 88{
e041c683 89 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 90}
91
92/* ---- HCI requests ---- */
93
23bb5763 94void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 95{
23bb5763
JH		 96 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
97
a5040efa
JH		 98 /* If this is the init phase check if the completed command matches
99 * the last init command, and if not just return.
100 */
101 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
23bb5763 102 return;
1da177e4
LT		 103
104 if (hdev->req_status == HCI_REQ_PEND) {
105 hdev->req_result = result;
106 hdev->req_status = HCI_REQ_DONE;
107 wake_up_interruptible(&hdev->req_wait_q);
108 }
109}
110
111static void hci_req_cancel(struct hci_dev *hdev, int err)
112{
113 BT_DBG("%s err 0x%2.2x", hdev->name, err);
114
115 if (hdev->req_status == HCI_REQ_PEND) {
116 hdev->req_result = err;
117 hdev->req_status = HCI_REQ_CANCELED;
118 wake_up_interruptible(&hdev->req_wait_q);
119 }
120}
121
122/* Execute request and wait for completion. */
8e87d142 123static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 124 unsigned long opt, __u32 timeout)
1da177e4
LT		 125{
126 DECLARE_WAITQUEUE(wait, current);
127 int err = 0;
128
129 BT_DBG("%s start", hdev->name);
130
131 hdev->req_status = HCI_REQ_PEND;
132
133 add_wait_queue(&hdev->req_wait_q, &wait);
134 set_current_state(TASK_INTERRUPTIBLE);
135
136 req(hdev, opt);
137 schedule_timeout(timeout);
138
139 remove_wait_queue(&hdev->req_wait_q, &wait);
140
141 if (signal_pending(current))
142 return -EINTR;
143
144 switch (hdev->req_status) {
145 case HCI_REQ_DONE:
e175072f 146 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 147 break;
148
149 case HCI_REQ_CANCELED:
150 err = -hdev->req_result;
151 break;
152
153 default:
154 err = -ETIMEDOUT;
155 break;
3ff50b79 156 }
1da177e4 157
a5040efa 158 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 159
160 BT_DBG("%s end: err %d", hdev->name, err);
161
162 return err;
163}
164
165static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 166 unsigned long opt, __u32 timeout)
1da177e4
LT		 167{
168 int ret;
169
7c6a329e
MH		 170 if (!test_bit(HCI_UP, &hdev->flags))
171 return -ENETDOWN;
172
1da177e4
LT		 173 /* Serialize all requests */
174 hci_req_lock(hdev);
175 ret = __hci_request(hdev, req, opt, timeout);
176 hci_req_unlock(hdev);
177
178 return ret;
179}
180
181static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
182{
183 BT_DBG("%s %ld", hdev->name, opt);
184
185 /* Reset device */
f630cf0d 186 set_bit(HCI_RESET, &hdev->flags);
a9de9248 187 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 188}
189
e61ef499 190static void bredr_init(struct hci_dev *hdev)
1da177e4 191{
b0916ea0 192 struct hci_cp_delete_stored_link_key cp;
1ebb9252 193 __le16 param;
89f2783d 194 __u8 flt_type;
1da177e4 195
2455a3ea
AE		 196 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
197
1da177e4
LT		 198 /* Mandatory initialization */
199
200 /* Reset */
f630cf0d 201 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
e61ef499
AE		 202 set_bit(HCI_RESET, &hdev->flags);
203 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
f630cf0d 204 }
1da177e4
LT		 205
206 /* Read Local Supported Features */
a9de9248 207 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 208
1143e5a6 209 /* Read Local Version */
a9de9248 210 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 211
1da177e4 212 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 213 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4 214
1da177e4 215 /* Read BD Address */
a9de9248
MH		 216 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
217
218 /* Read Class of Device */
219 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
220
221 /* Read Local Name */
222 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 223
224 /* Read Voice Setting */
a9de9248 225 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 226
227 /* Optional initialization */
228
229 /* Clear Event Filters */
89f2783d 230 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 231 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4 232
1da177e4 233 /* Connection accept timeout ~20 secs */
aca3192c 234 param = cpu_to_le16(0x7d00);
a9de9248 235 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
b0916ea0
JH		 236
237 bacpy(&cp.bdaddr, BDADDR_ANY);
238 cp.delete_all = 1;
239 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
1da177e4
LT		 240}
241
e61ef499
AE		 242static void amp_init(struct hci_dev *hdev)
243{
2455a3ea
AE		 244 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
245
e61ef499
AE		 246 /* Reset */
247 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
248
249 /* Read Local Version */
250 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
251}
252
253static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
254{
255 struct sk_buff *skb;
256
257 BT_DBG("%s %ld", hdev->name, opt);
258
259 /* Driver initialization */
260
261 /* Special commands */
262 while ((skb = skb_dequeue(&hdev->driver_init))) {
263 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
264 skb->dev = (void *) hdev;
265
266 skb_queue_tail(&hdev->cmd_q, skb);
267 queue_work(hdev->workqueue, &hdev->cmd_work);
268 }
269 skb_queue_purge(&hdev->driver_init);
270
271 switch (hdev->dev_type) {
272 case HCI_BREDR:
273 bredr_init(hdev);
274 break;
275
276 case HCI_AMP:
277 amp_init(hdev);
278 break;
279
280 default:
281 BT_ERR("Unknown device type %d", hdev->dev_type);
282 break;
283 }
284
285}
286
6ed58ec5
VT		 287static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
288{
289 BT_DBG("%s", hdev->name);
290
291 /* Read LE buffer size */
292 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
293}
294
1da177e4
LT		 295static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
296{
297 __u8 scan = opt;
298
299 BT_DBG("%s %x", hdev->name, scan);
300
301 /* Inquiry and Page scans */
a9de9248 302 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 303}
304
305static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
306{
307 __u8 auth = opt;
308
309 BT_DBG("%s %x", hdev->name, auth);
310
311 /* Authentication */
a9de9248 312 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 313}
314
315static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
316{
317 __u8 encrypt = opt;
318
319 BT_DBG("%s %x", hdev->name, encrypt);
320
e4e8e37c 321 /* Encryption */
a9de9248 322 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 323}
324
e4e8e37c
MH		 325static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
326{
327 __le16 policy = cpu_to_le16(opt);
328
a418b893 329 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 330
331 /* Default link policy */
332 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
333}
334
8e87d142 335/* Get HCI device by index.
1da177e4
LT		 336 * Device is held on return. */
337struct hci_dev *hci_dev_get(int index)
338{
8035ded4 339 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 340
341 BT_DBG("%d", index);
342
343 if (index < 0)
344 return NULL;
345
346 read_lock(&hci_dev_list_lock);
8035ded4 347 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 348 if (d->id == index) {
349 hdev = hci_dev_hold(d);
350 break;
351 }
352 }
353 read_unlock(&hci_dev_list_lock);
354 return hdev;
355}
1da177e4
LT		 356
357/* ---- Inquiry support ---- */
358static void inquiry_cache_flush(struct hci_dev *hdev)
359{
360 struct inquiry_cache *cache = &hdev->inq_cache;
361 struct inquiry_entry *next = cache->list, *e;
362
363 BT_DBG("cache %p", cache);
364
365 cache->list = NULL;
366 while ((e = next)) {
367 next = e->next;
368 kfree(e);
369 }
370}
371
372struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
373{
374 struct inquiry_cache *cache = &hdev->inq_cache;
375 struct inquiry_entry *e;
376
377 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
378
379 for (e = cache->list; e; e = e->next)
380 if (!bacmp(&e->data.bdaddr, bdaddr))
381 break;
382 return e;
383}
384
385void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
386{
387 struct inquiry_cache *cache = &hdev->inq_cache;
70f23020 388 struct inquiry_entry *ie;
1da177e4
LT		 389
390 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
391
70f23020
AE		 392 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
393 if (!ie) {
1da177e4 394 /* Entry not in the cache. Add new one. */
70f23020
AE		 395 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
396 if (!ie)
1da177e4 397 return;
70f23020
AE		 398
399 ie->next = cache->list;
400 cache->list = ie;
1da177e4
LT		 401 }
402
70f23020
AE		 403 memcpy(&ie->data, data, sizeof(*data));
404 ie->timestamp = jiffies;
1da177e4
LT		 405 cache->timestamp = jiffies;
406}
407
408static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
409{
410 struct inquiry_cache *cache = &hdev->inq_cache;
411 struct inquiry_info *info = (struct inquiry_info *) buf;
412 struct inquiry_entry *e;
413 int copied = 0;
414
415 for (e = cache->list; e && copied < num; e = e->next, copied++) {
416 struct inquiry_data *data = &e->data;
417 bacpy(&info->bdaddr, &data->bdaddr);
418 info->pscan_rep_mode = data->pscan_rep_mode;
419 info->pscan_period_mode = data->pscan_period_mode;
420 info->pscan_mode = data->pscan_mode;
421 memcpy(info->dev_class, data->dev_class, 3);
422 info->clock_offset = data->clock_offset;
423 info++;
424 }
425
426 BT_DBG("cache %p, copied %d", cache, copied);
427 return copied;
428}
429
430static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
431{
432 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
433 struct hci_cp_inquiry cp;
434
435 BT_DBG("%s", hdev->name);
436
437 if (test_bit(HCI_INQUIRY, &hdev->flags))
438 return;
439
440 /* Start Inquiry */
441 memcpy(&cp.lap, &ir->lap, 3);
442 cp.length = ir->length;
443 cp.num_rsp = ir->num_rsp;
a9de9248 444 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 445}
446
447int hci_inquiry(void __user *arg)
448{
449 __u8 __user *ptr = arg;
450 struct hci_inquiry_req ir;
451 struct hci_dev *hdev;
452 int err = 0, do_inquiry = 0, max_rsp;
453 long timeo;
454 __u8 *buf;
455
456 if (copy_from_user(&ir, ptr, sizeof(ir)))
457 return -EFAULT;
458
5a08ecce
AE		 459 hdev = hci_dev_get(ir.dev_id);
460 if (!hdev)
1da177e4
LT		 461 return -ENODEV;
462
09fd0de5 463 hci_dev_lock(hdev);
8e87d142 464 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
70f23020
AE		 465 inquiry_cache_empty(hdev) ||
466 ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 467 inquiry_cache_flush(hdev);
468 do_inquiry = 1;
469 }
09fd0de5 470 hci_dev_unlock(hdev);
1da177e4 471
04837f64 472 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 473
474 if (do_inquiry) {
475 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
476 if (err < 0)
477 goto done;
478 }
1da177e4
LT		 479
480 /* for unlimited number of responses we will use buffer with 255 entries */
481 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
482
483 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
484 * copy it to the user space.
485 */
01df8c31 486 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 487 if (!buf) {
1da177e4
LT		 488 err = -ENOMEM;
489 goto done;
490 }
491
09fd0de5 492 hci_dev_lock(hdev);
1da177e4 493 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 494 hci_dev_unlock(hdev);
1da177e4
LT		 495
496 BT_DBG("num_rsp %d", ir.num_rsp);
497
498 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
499 ptr += sizeof(ir);
500 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
501 ir.num_rsp))
502 err = -EFAULT;
8e87d142 503 } else
1da177e4
LT		 504 err = -EFAULT;
505
506 kfree(buf);
507
508done:
509 hci_dev_put(hdev);
510 return err;
511}
512
513/* ---- HCI ioctl helpers ---- */
514
515int hci_dev_open(__u16 dev)
516{
517 struct hci_dev *hdev;
518 int ret = 0;
519
5a08ecce
AE		 520 hdev = hci_dev_get(dev);
521 if (!hdev)
1da177e4
LT		 522 return -ENODEV;
523
524 BT_DBG("%s %p", hdev->name, hdev);
525
526 hci_req_lock(hdev);
527
611b30f7
MH		 528 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
529 ret = -ERFKILL;
530 goto done;
531 }
532
1da177e4
LT		 533 if (test_bit(HCI_UP, &hdev->flags)) {
534 ret = -EALREADY;
535 goto done;
536 }
537
538 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
539 set_bit(HCI_RAW, &hdev->flags);
540
07e3b94a
AE		 541 /* Treat all non BR/EDR controllers as raw devices if
542 enable_hs is not set */
543 if (hdev->dev_type != HCI_BREDR && !enable_hs)
943da25d
MH		 544 set_bit(HCI_RAW, &hdev->flags);
545
1da177e4
LT		 546 if (hdev->open(hdev)) {
547 ret = -EIO;
548 goto done;
549 }
550
551 if (!test_bit(HCI_RAW, &hdev->flags)) {
552 atomic_set(&hdev->cmd_cnt, 1);
553 set_bit(HCI_INIT, &hdev->flags);
a5040efa 554 hdev->init_last_cmd = 0;
1da177e4 555
04837f64
MH		 556 ret = __hci_request(hdev, hci_init_req, 0,
557 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4 558
eead27da 559 if (lmp_host_le_capable(hdev))
6ed58ec5
VT		 560 ret = __hci_request(hdev, hci_le_init_req, 0,
561 msecs_to_jiffies(HCI_INIT_TIMEOUT));
562
1da177e4
LT		 563 clear_bit(HCI_INIT, &hdev->flags);
564 }
565
566 if (!ret) {
567 hci_dev_hold(hdev);
568 set_bit(HCI_UP, &hdev->flags);
569 hci_notify(hdev, HCI_DEV_UP);
56e5cb86 570 if (!test_bit(HCI_SETUP, &hdev->flags)) {
09fd0de5 571 hci_dev_lock(hdev);
744cf19e 572 mgmt_powered(hdev, 1);
09fd0de5 573 hci_dev_unlock(hdev);
56e5cb86 574 }
8e87d142 575 } else {
1da177e4 576 /* Init failed, cleanup */
3eff45ea 577 flush_work(&hdev->tx_work);
c347b765 578 flush_work(&hdev->cmd_work);
b78752cc 579 flush_work(&hdev->rx_work);
1da177e4
LT		 580
581 skb_queue_purge(&hdev->cmd_q);
582 skb_queue_purge(&hdev->rx_q);
583
584 if (hdev->flush)
585 hdev->flush(hdev);
586
587 if (hdev->sent_cmd) {
588 kfree_skb(hdev->sent_cmd);
589 hdev->sent_cmd = NULL;
590 }
591
592 hdev->close(hdev);
593 hdev->flags = 0;
594 }
595
596done:
597 hci_req_unlock(hdev);
598 hci_dev_put(hdev);
599 return ret;
600}
601
602static int hci_dev_do_close(struct hci_dev *hdev)
603{
604 BT_DBG("%s %p", hdev->name, hdev);
605
606 hci_req_cancel(hdev, ENODEV);
607 hci_req_lock(hdev);
608
609 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 610 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 611 hci_req_unlock(hdev);
612 return 0;
613 }
614
3eff45ea
GP		 615 /* Flush RX and TX works */
616 flush_work(&hdev->tx_work);
b78752cc 617 flush_work(&hdev->rx_work);
1da177e4 618
16ab91ab 619 if (hdev->discov_timeout > 0) {
e0f9309f 620 cancel_delayed_work(&hdev->discov_off);
16ab91ab
JH		 621 hdev->discov_timeout = 0;
622 }
623
3243553f 624 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
e0f9309f 625 cancel_delayed_work(&hdev->power_off);
3243553f 626
7d78525d
JH		 627 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
628 cancel_delayed_work(&hdev->service_cache);
629
09fd0de5 630 hci_dev_lock(hdev);
1da177e4
LT		 631 inquiry_cache_flush(hdev);
632 hci_conn_hash_flush(hdev);
09fd0de5 633 hci_dev_unlock(hdev);
1da177e4
LT		 634
635 hci_notify(hdev, HCI_DEV_DOWN);
636
637 if (hdev->flush)
638 hdev->flush(hdev);
639
640 /* Reset device */
641 skb_queue_purge(&hdev->cmd_q);
642 atomic_set(&hdev->cmd_cnt, 1);
643 if (!test_bit(HCI_RAW, &hdev->flags)) {
644 set_bit(HCI_INIT, &hdev->flags);
04837f64 645 __hci_request(hdev, hci_reset_req, 0,
43611a7b 646 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 647 clear_bit(HCI_INIT, &hdev->flags);
648 }
649
c347b765
GP		 650 /* flush cmd work */
651 flush_work(&hdev->cmd_work);
1da177e4
LT		 652
653 /* Drop queues */
654 skb_queue_purge(&hdev->rx_q);
655 skb_queue_purge(&hdev->cmd_q);
656 skb_queue_purge(&hdev->raw_q);
657
658 /* Drop last sent command */
659 if (hdev->sent_cmd) {
b79f44c1 660 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 661 kfree_skb(hdev->sent_cmd);
662 hdev->sent_cmd = NULL;
663 }
664
665 /* After this point our queues are empty
666 * and no tasks are scheduled. */
667 hdev->close(hdev);
668
09fd0de5 669 hci_dev_lock(hdev);
744cf19e 670 mgmt_powered(hdev, 0);
09fd0de5 671 hci_dev_unlock(hdev);
5add6af8 672
1da177e4
LT		 673 /* Clear flags */
674 hdev->flags = 0;
675
676 hci_req_unlock(hdev);
677
678 hci_dev_put(hdev);
679 return 0;
680}
681
682int hci_dev_close(__u16 dev)
683{
684 struct hci_dev *hdev;
685 int err;
686
70f23020
AE		 687 hdev = hci_dev_get(dev);
688 if (!hdev)
1da177e4
LT		 689 return -ENODEV;
690 err = hci_dev_do_close(hdev);
691 hci_dev_put(hdev);
692 return err;
693}
694
695int hci_dev_reset(__u16 dev)
696{
697 struct hci_dev *hdev;
698 int ret = 0;
699
70f23020
AE		 700 hdev = hci_dev_get(dev);
701 if (!hdev)
1da177e4
LT		 702 return -ENODEV;
703
704 hci_req_lock(hdev);
1da177e4
LT		 705
706 if (!test_bit(HCI_UP, &hdev->flags))
707 goto done;
708
709 /* Drop queues */
710 skb_queue_purge(&hdev->rx_q);
711 skb_queue_purge(&hdev->cmd_q);
712
09fd0de5 713 hci_dev_lock(hdev);
1da177e4
LT		 714 inquiry_cache_flush(hdev);
715 hci_conn_hash_flush(hdev);
09fd0de5 716 hci_dev_unlock(hdev);
1da177e4
LT		 717
718 if (hdev->flush)
719 hdev->flush(hdev);
720
8e87d142 721 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 722 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 723
724 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 725 ret = __hci_request(hdev, hci_reset_req, 0,
726 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 727
728done:
1da177e4
LT		 729 hci_req_unlock(hdev);
730 hci_dev_put(hdev);
731 return ret;
732}
733
734int hci_dev_reset_stat(__u16 dev)
735{
736 struct hci_dev *hdev;
737 int ret = 0;
738
70f23020
AE		 739 hdev = hci_dev_get(dev);
740 if (!hdev)
1da177e4
LT		 741 return -ENODEV;
742
743 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
744
745 hci_dev_put(hdev);
746
747 return ret;
748}
749
750int hci_dev_cmd(unsigned int cmd, void __user *arg)
751{
752 struct hci_dev *hdev;
753 struct hci_dev_req dr;
754 int err = 0;
755
756 if (copy_from_user(&dr, arg, sizeof(dr)))
757 return -EFAULT;
758
70f23020
AE		 759 hdev = hci_dev_get(dr.dev_id);
760 if (!hdev)
1da177e4
LT		 761 return -ENODEV;
762
763 switch (cmd) {
764 case HCISETAUTH:
04837f64
MH		 765 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
766 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 767 break;
768
769 case HCISETENCRYPT:
770 if (!lmp_encrypt_capable(hdev)) {
771 err = -EOPNOTSUPP;
772 break;
773 }
774
775 if (!test_bit(HCI_AUTH, &hdev->flags)) {
776 /* Auth must be enabled first */
04837f64
MH		 777 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
778 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 779 if (err)
780 break;
781 }
782
04837f64
MH		 783 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
784 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 785 break;
786
787 case HCISETSCAN:
04837f64
MH		 788 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
789 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 790 break;
791
1da177e4 792 case HCISETLINKPOL:
e4e8e37c
MH		 793 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
794 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 795 break;
796
797 case HCISETLINKMODE:
e4e8e37c
MH		 798 hdev->link_mode = ((__u16) dr.dev_opt) &
799 (HCI_LM_MASTER | HCI_LM_ACCEPT);
800 break;
801
802 case HCISETPTYPE:
803 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 804 break;
805
806 case HCISETACLMTU:
e4e8e37c
MH		 807 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
808 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 809 break;
810
811 case HCISETSCOMTU:
e4e8e37c
MH		 812 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
813 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 814 break;
815
816 default:
817 err = -EINVAL;
818 break;
819 }
e4e8e37c 820
1da177e4
LT		 821 hci_dev_put(hdev);
822 return err;
823}
824
825int hci_get_dev_list(void __user *arg)
826{
8035ded4 827 struct hci_dev *hdev;
1da177e4
LT		 828 struct hci_dev_list_req *dl;
829 struct hci_dev_req *dr;
1da177e4
LT		 830 int n = 0, size, err;
831 __u16 dev_num;
832
833 if (get_user(dev_num, (__u16 __user *) arg))
834 return -EFAULT;
835
836 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
837 return -EINVAL;
838
839 size = sizeof(*dl) + dev_num * sizeof(*dr);
840
70f23020
AE		 841 dl = kzalloc(size, GFP_KERNEL);
842 if (!dl)
1da177e4
LT		 843 return -ENOMEM;
844
845 dr = dl->dev_req;
846
847 read_lock_bh(&hci_dev_list_lock);
8035ded4 848 list_for_each_entry(hdev, &hci_dev_list, list) {
3243553f 849 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
e0f9309f 850 cancel_delayed_work(&hdev->power_off);
c542a06c
JH		 851
852 if (!test_bit(HCI_MGMT, &hdev->flags))
853 set_bit(HCI_PAIRABLE, &hdev->flags);
854
1da177e4
LT		 855 (dr + n)->dev_id = hdev->id;
856 (dr + n)->dev_opt = hdev->flags;
c542a06c 857
1da177e4
LT		 858 if (++n >= dev_num)
859 break;
860 }
861 read_unlock_bh(&hci_dev_list_lock);
862
863 dl->dev_num = n;
864 size = sizeof(*dl) + n * sizeof(*dr);
865
866 err = copy_to_user(arg, dl, size);
867 kfree(dl);
868
869 return err ? -EFAULT : 0;
870}
871
872int hci_get_dev_info(void __user *arg)
873{
874 struct hci_dev *hdev;
875 struct hci_dev_info di;
876 int err = 0;
877
878 if (copy_from_user(&di, arg, sizeof(di)))
879 return -EFAULT;
880
70f23020
AE		 881 hdev = hci_dev_get(di.dev_id);
882 if (!hdev)
1da177e4
LT		 883 return -ENODEV;
884
3243553f
JH		 885 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
886 cancel_delayed_work_sync(&hdev->power_off);
ab81cbf9 887
c542a06c
JH		 888 if (!test_bit(HCI_MGMT, &hdev->flags))
889 set_bit(HCI_PAIRABLE, &hdev->flags);
890
1da177e4
LT		 891 strcpy(di.name, hdev->name);
892 di.bdaddr = hdev->bdaddr;
943da25d 893 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 894 di.flags = hdev->flags;
895 di.pkt_type = hdev->pkt_type;
896 di.acl_mtu = hdev->acl_mtu;
897 di.acl_pkts = hdev->acl_pkts;
898 di.sco_mtu = hdev->sco_mtu;
899 di.sco_pkts = hdev->sco_pkts;
900 di.link_policy = hdev->link_policy;
901 di.link_mode = hdev->link_mode;
902
903 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
904 memcpy(&di.features, &hdev->features, sizeof(di.features));
905
906 if (copy_to_user(arg, &di, sizeof(di)))
907 err = -EFAULT;
908
909 hci_dev_put(hdev);
910
911 return err;
912}
913
914/* ---- Interface to HCI drivers ---- */
915
611b30f7
MH		 916static int hci_rfkill_set_block(void *data, bool blocked)
917{
918 struct hci_dev *hdev = data;
919
920 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
921
922 if (!blocked)
923 return 0;
924
925 hci_dev_do_close(hdev);
926
927 return 0;
928}
929
930static const struct rfkill_ops hci_rfkill_ops = {
931 .set_block = hci_rfkill_set_block,
932};
933
1da177e4
LT		 934/* Alloc HCI device */
935struct hci_dev *hci_alloc_dev(void)
936{
937 struct hci_dev *hdev;
938
25ea6db0 939 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 940 if (!hdev)
941 return NULL;
942
0ac7e700 943 hci_init_sysfs(hdev);
1da177e4
LT		 944 skb_queue_head_init(&hdev->driver_init);
945
946 return hdev;
947}
948EXPORT_SYMBOL(hci_alloc_dev);
949
950/* Free HCI device */
951void hci_free_dev(struct hci_dev *hdev)
952{
953 skb_queue_purge(&hdev->driver_init);
954
a91f2e39
MH		 955 /* will free via device release */
956 put_device(&hdev->dev);
1da177e4
LT		 957}
958EXPORT_SYMBOL(hci_free_dev);
959
ab81cbf9
JH		 960static void hci_power_on(struct work_struct *work)
961{
962 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
963
964 BT_DBG("%s", hdev->name);
965
966 if (hci_dev_open(hdev->id) < 0)
967 return;
968
969 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
80b7ab33 970 schedule_delayed_work(&hdev->power_off,
3243553f 971 msecs_to_jiffies(AUTO_OFF_TIMEOUT));
ab81cbf9
JH		 972
973 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
744cf19e 974 mgmt_index_added(hdev);
ab81cbf9
JH		 975}
976
977static void hci_power_off(struct work_struct *work)
978{
3243553f
JH		 979 struct hci_dev *hdev = container_of(work, struct hci_dev,
980 power_off.work);
ab81cbf9
JH		 981
982 BT_DBG("%s", hdev->name);
983
984 clear_bit(HCI_AUTO_OFF, &hdev->flags);
985
3243553f 986 hci_dev_close(hdev->id);
ab81cbf9
JH		 987}
988
16ab91ab
JH		 989static void hci_discov_off(struct work_struct *work)
990{
991 struct hci_dev *hdev;
992 u8 scan = SCAN_PAGE;
993
994 hdev = container_of(work, struct hci_dev, discov_off.work);
995
996 BT_DBG("%s", hdev->name);
997
09fd0de5 998 hci_dev_lock(hdev);
16ab91ab
JH		 999
1000 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1001
1002 hdev->discov_timeout = 0;
1003
09fd0de5 1004 hci_dev_unlock(hdev);
16ab91ab
JH		 1005}
1006
2aeb9a1a
JH		 1007int hci_uuids_clear(struct hci_dev *hdev)
1008{
1009 struct list_head *p, *n;
1010
1011 list_for_each_safe(p, n, &hdev->uuids) {
1012 struct bt_uuid *uuid;
1013
1014 uuid = list_entry(p, struct bt_uuid, list);
1015
1016 list_del(p);
1017 kfree(uuid);
1018 }
1019
1020 return 0;
1021}
1022
55ed8ca1
JH		 1023int hci_link_keys_clear(struct hci_dev *hdev)
1024{
1025 struct list_head *p, *n;
1026
1027 list_for_each_safe(p, n, &hdev->link_keys) {
1028 struct link_key *key;
1029
1030 key = list_entry(p, struct link_key, list);
1031
1032 list_del(p);
1033 kfree(key);
1034 }
1035
1036 return 0;
1037}
1038
1039struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1040{
8035ded4 1041 struct link_key *k;
55ed8ca1 1042
8035ded4 1043 list_for_each_entry(k, &hdev->link_keys, list)
55ed8ca1
JH		 1044 if (bacmp(bdaddr, &k->bdaddr) == 0)
1045 return k;
55ed8ca1
JH		 1046
1047 return NULL;
1048}
1049
d25e28ab
JH		 1050static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1051 u8 key_type, u8 old_key_type)
1052{
1053 /* Legacy key */
1054 if (key_type < 0x03)
1055 return 1;
1056
1057 /* Debug keys are insecure so don't store them persistently */
1058 if (key_type == HCI_LK_DEBUG_COMBINATION)
1059 return 0;
1060
1061 /* Changed combination key and there's no previous one */
1062 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1063 return 0;
1064
1065 /* Security mode 3 case */
1066 if (!conn)
1067 return 1;
1068
1069 /* Neither local nor remote side had no-bonding as requirement */
1070 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1071 return 1;
1072
1073 /* Local side had dedicated bonding as requirement */
1074 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1075 return 1;
1076
1077 /* Remote side had dedicated bonding as requirement */
1078 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1079 return 1;
1080
1081 /* If none of the above criteria match, then don't store the key
1082 * persistently */
1083 return 0;
1084}
1085
75d262c2
VCG		 1086struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1087{
1088 struct link_key *k;
1089
1090 list_for_each_entry(k, &hdev->link_keys, list) {
1091 struct key_master_id *id;
1092
1093 if (k->type != HCI_LK_SMP_LTK)
1094 continue;
1095
1096 if (k->dlen != sizeof(*id))
1097 continue;
1098
1099 id = (void *) &k->data;
1100 if (id->ediv == ediv &&
1101 (memcmp(rand, id->rand, sizeof(id->rand)) == 0))
1102 return k;
1103 }
1104
1105 return NULL;
1106}
1107EXPORT_SYMBOL(hci_find_ltk);
1108
1109struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
1110 bdaddr_t *bdaddr, u8 type)
1111{
1112 struct link_key *k;
1113
1114 list_for_each_entry(k, &hdev->link_keys, list)
1115 if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
1116 return k;
1117
1118 return NULL;
1119}
1120EXPORT_SYMBOL(hci_find_link_key_type);
1121
d25e28ab
JH		 1122int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1123 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1124{
1125 struct link_key *key, *old_key;
4df378a1 1126 u8 old_key_type, persistent;
55ed8ca1
JH		 1127
1128 old_key = hci_find_link_key(hdev, bdaddr);
1129 if (old_key) {
1130 old_key_type = old_key->type;
1131 key = old_key;
1132 } else {
12adcf3a 1133 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1134 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1135 if (!key)
1136 return -ENOMEM;
1137 list_add(&key->list, &hdev->link_keys);
1138 }
1139
1140 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1141
d25e28ab
JH		 1142 /* Some buggy controller combinations generate a changed
1143 * combination key for legacy pairing even when there's no
1144 * previous key */
1145 if (type == HCI_LK_CHANGED_COMBINATION &&
1146 (!conn || conn->remote_auth == 0xff) &&
655fe6ec 1147 old_key_type == 0xff) {
d25e28ab 1148 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1149 if (conn)
1150 conn->key_type = type;
1151 }
d25e28ab 1152
55ed8ca1
JH		 1153 bacpy(&key->bdaddr, bdaddr);
1154 memcpy(key->val, val, 16);
55ed8ca1
JH		 1155 key->pin_len = pin_len;
1156
b6020ba0 1157 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1158 key->type = old_key_type;
4748fed2
JH		 1159 else
1160 key->type = type;
1161
4df378a1
JH		 1162 if (!new_key)
1163 return 0;
1164
1165 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1166
744cf19e 1167 mgmt_new_link_key(hdev, key, persistent);
4df378a1
JH		 1168
1169 if (!persistent) {
1170 list_del(&key->list);
1171 kfree(key);
1172 }
55ed8ca1
JH		 1173
1174 return 0;
1175}
1176
75d262c2 1177int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
726b4ffc 1178 u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
75d262c2
VCG		 1179{
1180 struct link_key *key, *old_key;
1181 struct key_master_id *id;
1182 u8 old_key_type;
1183
1184 BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
1185
1186 old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
1187 if (old_key) {
1188 key = old_key;
1189 old_key_type = old_key->type;
1190 } else {
1191 key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
1192 if (!key)
1193 return -ENOMEM;
1194 list_add(&key->list, &hdev->link_keys);
1195 old_key_type = 0xff;
1196 }
1197
1198 key->dlen = sizeof(*id);
1199
1200 bacpy(&key->bdaddr, bdaddr);
1201 memcpy(key->val, ltk, sizeof(key->val));
1202 key->type = HCI_LK_SMP_LTK;
726b4ffc 1203 key->pin_len = key_size;
75d262c2
VCG		 1204
1205 id = (void *) &key->data;
1206 id->ediv = ediv;
1207 memcpy(id->rand, rand, sizeof(id->rand));
1208
1209 if (new_key)
744cf19e 1210 mgmt_new_link_key(hdev, key, old_key_type);
75d262c2
VCG		 1211
1212 return 0;
1213}
1214
55ed8ca1
JH		 1215int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1216{
1217 struct link_key *key;
1218
1219 key = hci_find_link_key(hdev, bdaddr);
1220 if (!key)
1221 return -ENOENT;
1222
1223 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1224
1225 list_del(&key->list);
1226 kfree(key);
1227
1228 return 0;
1229}
1230
6bd32326
VT		 1231/* HCI command timer function */
1232static void hci_cmd_timer(unsigned long arg)
1233{
1234 struct hci_dev *hdev = (void *) arg;
1235
1236 BT_ERR("%s command tx timeout", hdev->name);
1237 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1238 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1239}
1240
2763eda6
SJ		 1241struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1242 bdaddr_t *bdaddr)
1243{
1244 struct oob_data *data;
1245
1246 list_for_each_entry(data, &hdev->remote_oob_data, list)
1247 if (bacmp(bdaddr, &data->bdaddr) == 0)
1248 return data;
1249
1250 return NULL;
1251}
1252
1253int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1254{
1255 struct oob_data *data;
1256
1257 data = hci_find_remote_oob_data(hdev, bdaddr);
1258 if (!data)
1259 return -ENOENT;
1260
1261 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1262
1263 list_del(&data->list);
1264 kfree(data);
1265
1266 return 0;
1267}
1268
1269int hci_remote_oob_data_clear(struct hci_dev *hdev)
1270{
1271 struct oob_data *data, *n;
1272
1273 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1274 list_del(&data->list);
1275 kfree(data);
1276 }
1277
1278 return 0;
1279}
1280
1281int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1282 u8 *randomizer)
1283{
1284 struct oob_data *data;
1285
1286 data = hci_find_remote_oob_data(hdev, bdaddr);
1287
1288 if (!data) {
1289 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1290 if (!data)
1291 return -ENOMEM;
1292
1293 bacpy(&data->bdaddr, bdaddr);
1294 list_add(&data->list, &hdev->remote_oob_data);
1295 }
1296
1297 memcpy(data->hash, hash, sizeof(data->hash));
1298 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1299
1300 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1301
1302 return 0;
1303}
1304
b2a66aad
AJ		 1305struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1306 bdaddr_t *bdaddr)
1307{
8035ded4 1308 struct bdaddr_list *b;
b2a66aad 1309
8035ded4 1310 list_for_each_entry(b, &hdev->blacklist, list)
b2a66aad
AJ		 1311 if (bacmp(bdaddr, &b->bdaddr) == 0)
1312 return b;
b2a66aad
AJ		 1313
1314 return NULL;
1315}
1316
1317int hci_blacklist_clear(struct hci_dev *hdev)
1318{
1319 struct list_head *p, *n;
1320
1321 list_for_each_safe(p, n, &hdev->blacklist) {
1322 struct bdaddr_list *b;
1323
1324 b = list_entry(p, struct bdaddr_list, list);
1325
1326 list_del(p);
1327 kfree(b);
1328 }
1329
1330 return 0;
1331}
1332
1333int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1334{
1335 struct bdaddr_list *entry;
b2a66aad
AJ		 1336
1337 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1338 return -EBADF;
1339
5e762444
AJ		 1340 if (hci_blacklist_lookup(hdev, bdaddr))
1341 return -EEXIST;
b2a66aad
AJ		 1342
1343 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
5e762444
AJ		 1344 if (!entry)
1345 return -ENOMEM;
b2a66aad
AJ		 1346
1347 bacpy(&entry->bdaddr, bdaddr);
1348
1349 list_add(&entry->list, &hdev->blacklist);
1350
744cf19e 1351 return mgmt_device_blocked(hdev, bdaddr);
b2a66aad
AJ		 1352}
1353
1354int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1355{
1356 struct bdaddr_list *entry;
b2a66aad 1357
1ec918ce 1358 if (bacmp(bdaddr, BDADDR_ANY) == 0)
5e762444 1359 return hci_blacklist_clear(hdev);
b2a66aad
AJ		 1360
1361 entry = hci_blacklist_lookup(hdev, bdaddr);
1ec918ce 1362 if (!entry)
5e762444 1363 return -ENOENT;
b2a66aad
AJ		 1364
1365 list_del(&entry->list);
1366 kfree(entry);
1367
744cf19e 1368 return mgmt_device_unblocked(hdev, bdaddr);
b2a66aad
AJ		 1369}
1370
db323f2f 1371static void hci_clear_adv_cache(struct work_struct *work)
35815085 1372{
db323f2f
GP		 1373 struct hci_dev *hdev = container_of(work, struct hci_dev,
1374 adv_work.work);
35815085
AG		 1375
1376 hci_dev_lock(hdev);
1377
1378 hci_adv_entries_clear(hdev);
1379
1380 hci_dev_unlock(hdev);
1381}
1382
76c8686f
AG		 1383int hci_adv_entries_clear(struct hci_dev *hdev)
1384{
1385 struct adv_entry *entry, *tmp;
1386
1387 list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1388 list_del(&entry->list);
1389 kfree(entry);
1390 }
1391
1392 BT_DBG("%s adv cache cleared", hdev->name);
1393
1394 return 0;
1395}
1396
1397struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1398{
1399 struct adv_entry *entry;
1400
1401 list_for_each_entry(entry, &hdev->adv_entries, list)
1402 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1403 return entry;
1404
1405 return NULL;
1406}
1407
1408static inline int is_connectable_adv(u8 evt_type)
1409{
1410 if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1411 return 1;
1412
1413 return 0;
1414}
1415
1416int hci_add_adv_entry(struct hci_dev *hdev,
1417 struct hci_ev_le_advertising_info *ev)
1418{
1419 struct adv_entry *entry;
1420
1421 if (!is_connectable_adv(ev->evt_type))
1422 return -EINVAL;
1423
1424 /* Only new entries should be added to adv_entries. So, if
1425 * bdaddr was found, don't add it. */
1426 if (hci_find_adv_entry(hdev, &ev->bdaddr))
1427 return 0;
1428
1429 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1430 if (!entry)
1431 return -ENOMEM;
1432
1433 bacpy(&entry->bdaddr, &ev->bdaddr);
1434 entry->bdaddr_type = ev->bdaddr_type;
1435
1436 list_add(&entry->list, &hdev->adv_entries);
1437
1438 BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1439 batostr(&entry->bdaddr), entry->bdaddr_type);
1440
1441 return 0;
1442}
1443
1da177e4
LT		 1444/* Register HCI device */
1445int hci_register_dev(struct hci_dev *hdev)
1446{
1447 struct list_head *head = &hci_dev_list, *p;
08add513 1448 int i, id, error;
1da177e4 1449
c13854ce
MH		 1450 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1451 hdev->bus, hdev->owner);
1da177e4
LT		 1452
1453 if (!hdev->open || !hdev->close || !hdev->destruct)
1454 return -EINVAL;
1455
08add513
MM		 1456 /* Do not allow HCI_AMP devices to register at index 0,
1457 * so the index can be used as the AMP controller ID.
1458 */
1459 id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
1460
1da177e4
LT		 1461 write_lock_bh(&hci_dev_list_lock);
1462
1463 /* Find first available device id */
1464 list_for_each(p, &hci_dev_list) {
1465 if (list_entry(p, struct hci_dev, list)->id != id)
1466 break;
1467 head = p; id++;
1468 }
8e87d142 1469
1da177e4
LT		 1470 sprintf(hdev->name, "hci%d", id);
1471 hdev->id = id;
c6feeb28 1472 list_add_tail(&hdev->list, head);
1da177e4
LT		 1473
1474 atomic_set(&hdev->refcnt, 1);
09fd0de5 1475 mutex_init(&hdev->lock);
1da177e4
LT		 1476
1477 hdev->flags = 0;
d23264a8 1478 hdev->dev_flags = 0;
1da177e4 1479 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 1480 hdev->esco_type = (ESCO_HV1);
1da177e4 1481 hdev->link_mode = (HCI_LM_ACCEPT);
17fa4b9d 1482 hdev->io_capability = 0x03; /* No Input No Output */
1da177e4 1483
04837f64
MH		 1484 hdev->idle_timeout = 0;
1485 hdev->sniff_max_interval = 800;
1486 hdev->sniff_min_interval = 80;
1487
b78752cc 1488 INIT_WORK(&hdev->rx_work, hci_rx_work);
c347b765 1489 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3eff45ea 1490 INIT_WORK(&hdev->tx_work, hci_tx_work);
b78752cc 1491
1da177e4
LT		 1492
1493 skb_queue_head_init(&hdev->rx_q);
1494 skb_queue_head_init(&hdev->cmd_q);
1495 skb_queue_head_init(&hdev->raw_q);
1496
6bd32326
VT		 1497 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1498
cd4c5391 1499 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1500 hdev->reassembly[i] = NULL;
1501
1da177e4 1502 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 1503 mutex_init(&hdev->req_lock);
1da177e4
LT		 1504
1505 inquiry_cache_init(hdev);
1506
1507 hci_conn_hash_init(hdev);
1508
2e58ef3e
JH		 1509 INIT_LIST_HEAD(&hdev->mgmt_pending);
1510
ea4bd8ba 1511 INIT_LIST_HEAD(&hdev->blacklist);
f0358568 1512
2aeb9a1a
JH		 1513 INIT_LIST_HEAD(&hdev->uuids);
1514
55ed8ca1
JH		 1515 INIT_LIST_HEAD(&hdev->link_keys);
1516
2763eda6
SJ		 1517 INIT_LIST_HEAD(&hdev->remote_oob_data);
1518
76c8686f
AG		 1519 INIT_LIST_HEAD(&hdev->adv_entries);
1520
db323f2f 1521 INIT_DELAYED_WORK(&hdev->adv_work, hci_clear_adv_cache);
ab81cbf9 1522 INIT_WORK(&hdev->power_on, hci_power_on);
3243553f 1523 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
ab81cbf9 1524
16ab91ab
JH		 1525 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1526
1da177e4
LT		 1527 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1528
1529 atomic_set(&hdev->promisc, 0);
1530
1531 write_unlock_bh(&hci_dev_list_lock);
1532
32845eb1
GP		 1533 hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
1534 WQ_MEM_RECLAIM, 1);
33ca954d
DH		 1535 if (!hdev->workqueue) {
1536 error = -ENOMEM;
1537 goto err;
1538 }
f48fd9c8 1539
33ca954d
DH		 1540 error = hci_add_sysfs(hdev);
1541 if (error < 0)
1542 goto err_wqueue;
1da177e4 1543
611b30f7
MH		 1544 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1545 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1546 if (hdev->rfkill) {
1547 if (rfkill_register(hdev->rfkill) < 0) {
1548 rfkill_destroy(hdev->rfkill);
1549 hdev->rfkill = NULL;
1550 }
1551 }
1552
ab81cbf9
JH		 1553 set_bit(HCI_AUTO_OFF, &hdev->flags);
1554 set_bit(HCI_SETUP, &hdev->flags);
7f971041 1555 schedule_work(&hdev->power_on);
ab81cbf9 1556
1da177e4
LT		 1557 hci_notify(hdev, HCI_DEV_REG);
1558
1559 return id;
f48fd9c8 1560
33ca954d
DH		 1561err_wqueue:
1562 destroy_workqueue(hdev->workqueue);
1563err:
f48fd9c8
MH		 1564 write_lock_bh(&hci_dev_list_lock);
1565 list_del(&hdev->list);
1566 write_unlock_bh(&hci_dev_list_lock);
1567
33ca954d 1568 return error;
1da177e4
LT		 1569}
1570EXPORT_SYMBOL(hci_register_dev);
1571
1572/* Unregister HCI device */
59735631 1573void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 1574{
ef222013
MH		 1575 int i;
1576
c13854ce 1577 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1578
1da177e4
LT		 1579 write_lock_bh(&hci_dev_list_lock);
1580 list_del(&hdev->list);
1581 write_unlock_bh(&hci_dev_list_lock);
1582
1583 hci_dev_do_close(hdev);
1584
cd4c5391 1585 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1586 kfree_skb(hdev->reassembly[i]);
1587
ab81cbf9 1588 if (!test_bit(HCI_INIT, &hdev->flags) &&
56e5cb86 1589 !test_bit(HCI_SETUP, &hdev->flags)) {
09fd0de5 1590 hci_dev_lock(hdev);
744cf19e 1591 mgmt_index_removed(hdev);
09fd0de5 1592 hci_dev_unlock(hdev);
56e5cb86 1593 }
ab81cbf9 1594
2e58ef3e
JH		 1595 /* mgmt_index_removed should take care of emptying the
1596 * pending list */
1597 BUG_ON(!list_empty(&hdev->mgmt_pending));
1598
1da177e4
LT		 1599 hci_notify(hdev, HCI_DEV_UNREG);
1600
611b30f7
MH		 1601 if (hdev->rfkill) {
1602 rfkill_unregister(hdev->rfkill);
1603 rfkill_destroy(hdev->rfkill);
1604 }
1605
ce242970 1606 hci_del_sysfs(hdev);
147e2d59 1607
db323f2f 1608 cancel_delayed_work_sync(&hdev->adv_work);
c6f3c5f7 1609
f48fd9c8
MH		 1610 destroy_workqueue(hdev->workqueue);
1611
09fd0de5 1612 hci_dev_lock(hdev);
e2e0cacb 1613 hci_blacklist_clear(hdev);
2aeb9a1a 1614 hci_uuids_clear(hdev);
55ed8ca1 1615 hci_link_keys_clear(hdev);
2763eda6 1616 hci_remote_oob_data_clear(hdev);
76c8686f 1617 hci_adv_entries_clear(hdev);
09fd0de5 1618 hci_dev_unlock(hdev);
e2e0cacb 1619
1da177e4 1620 __hci_dev_put(hdev);
1da177e4
LT		 1621}
1622EXPORT_SYMBOL(hci_unregister_dev);
1623
1624/* Suspend HCI device */
1625int hci_suspend_dev(struct hci_dev *hdev)
1626{
1627 hci_notify(hdev, HCI_DEV_SUSPEND);
1628 return 0;
1629}
1630EXPORT_SYMBOL(hci_suspend_dev);
1631
1632/* Resume HCI device */
1633int hci_resume_dev(struct hci_dev *hdev)
1634{
1635 hci_notify(hdev, HCI_DEV_RESUME);
1636 return 0;
1637}
1638EXPORT_SYMBOL(hci_resume_dev);
1639
76bca880
MH		 1640/* Receive frame from HCI drivers */
1641int hci_recv_frame(struct sk_buff *skb)
1642{
1643 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1644 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1645 && !test_bit(HCI_INIT, &hdev->flags))) {
1646 kfree_skb(skb);
1647 return -ENXIO;
1648 }
1649
1650 /* Incomming skb */
1651 bt_cb(skb)->incoming = 1;
1652
1653 /* Time stamp */
1654 __net_timestamp(skb);
1655
76bca880 1656 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 1657 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 1658
76bca880
MH		 1659 return 0;
1660}
1661EXPORT_SYMBOL(hci_recv_frame);
1662
33e882a5 1663static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1e429f38 1664 int count, __u8 index)
33e882a5
SS		 1665{
1666 int len = 0;
1667 int hlen = 0;
1668 int remain = count;
1669 struct sk_buff *skb;
1670 struct bt_skb_cb *scb;
1671
1672 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1673 index >= NUM_REASSEMBLY)
1674 return -EILSEQ;
1675
1676 skb = hdev->reassembly[index];
1677
1678 if (!skb) {
1679 switch (type) {
1680 case HCI_ACLDATA_PKT:
1681 len = HCI_MAX_FRAME_SIZE;
1682 hlen = HCI_ACL_HDR_SIZE;
1683 break;
1684 case HCI_EVENT_PKT:
1685 len = HCI_MAX_EVENT_SIZE;
1686 hlen = HCI_EVENT_HDR_SIZE;
1687 break;
1688 case HCI_SCODATA_PKT:
1689 len = HCI_MAX_SCO_SIZE;
1690 hlen = HCI_SCO_HDR_SIZE;
1691 break;
1692 }
1693
1e429f38 1694 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 1695 if (!skb)
1696 return -ENOMEM;
1697
1698 scb = (void *) skb->cb;
1699 scb->expect = hlen;
1700 scb->pkt_type = type;
1701
1702 skb->dev = (void *) hdev;
1703 hdev->reassembly[index] = skb;
1704 }
1705
1706 while (count) {
1707 scb = (void *) skb->cb;
1708 len = min(scb->expect, (__u16)count);
1709
1710 memcpy(skb_put(skb, len), data, len);
1711
1712 count -= len;
1713 data += len;
1714 scb->expect -= len;
1715 remain = count;
1716
1717 switch (type) {
1718 case HCI_EVENT_PKT:
1719 if (skb->len == HCI_EVENT_HDR_SIZE) {
1720 struct hci_event_hdr *h = hci_event_hdr(skb);
1721 scb->expect = h->plen;
1722
1723 if (skb_tailroom(skb) < scb->expect) {
1724 kfree_skb(skb);
1725 hdev->reassembly[index] = NULL;
1726 return -ENOMEM;
1727 }
1728 }
1729 break;
1730
1731 case HCI_ACLDATA_PKT:
1732 if (skb->len == HCI_ACL_HDR_SIZE) {
1733 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1734 scb->expect = __le16_to_cpu(h->dlen);
1735
1736 if (skb_tailroom(skb) < scb->expect) {
1737 kfree_skb(skb);
1738 hdev->reassembly[index] = NULL;
1739 return -ENOMEM;
1740 }
1741 }
1742 break;
1743
1744 case HCI_SCODATA_PKT:
1745 if (skb->len == HCI_SCO_HDR_SIZE) {
1746 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1747 scb->expect = h->dlen;
1748
1749 if (skb_tailroom(skb) < scb->expect) {
1750 kfree_skb(skb);
1751 hdev->reassembly[index] = NULL;
1752 return -ENOMEM;
1753 }
1754 }
1755 break;
1756 }
1757
1758 if (scb->expect == 0) {
1759 /* Complete frame */
1760
1761 bt_cb(skb)->pkt_type = type;
1762 hci_recv_frame(skb);
1763
1764 hdev->reassembly[index] = NULL;
1765 return remain;
1766 }
1767 }
1768
1769 return remain;
1770}
1771
ef222013
MH		 1772int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1773{
f39a3c06
SS		 1774 int rem = 0;
1775
ef222013
MH		 1776 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1777 return -EILSEQ;
1778
da5f6c37 1779 while (count) {
1e429f38 1780 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 1781 if (rem < 0)
1782 return rem;
ef222013 1783
f39a3c06
SS		 1784 data += (count - rem);
1785 count = rem;
f81c6224 1786 }
ef222013 1787
f39a3c06 1788 return rem;
ef222013
MH		 1789}
1790EXPORT_SYMBOL(hci_recv_fragment);
1791
99811510
SS		 1792#define STREAM_REASSEMBLY 0
1793
1794int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1795{
1796 int type;
1797 int rem = 0;
1798
da5f6c37 1799 while (count) {
99811510
SS		 1800 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1801
1802 if (!skb) {
1803 struct { char type; } *pkt;
1804
1805 /* Start of the frame */
1806 pkt = data;
1807 type = pkt->type;
1808
1809 data++;
1810 count--;
1811 } else
1812 type = bt_cb(skb)->pkt_type;
1813
1e429f38
GP		 1814 rem = hci_reassembly(hdev, type, data, count,
1815 STREAM_REASSEMBLY);
99811510
SS		 1816 if (rem < 0)
1817 return rem;
1818
1819 data += (count - rem);
1820 count = rem;
f81c6224 1821 }
99811510
SS		 1822
1823 return rem;
1824}
1825EXPORT_SYMBOL(hci_recv_stream_fragment);
1826
1da177e4
LT		 1827/* ---- Interface to upper protocols ---- */
1828
1da177e4
LT		 1829int hci_register_cb(struct hci_cb *cb)
1830{
1831 BT_DBG("%p name %s", cb, cb->name);
1832
1833 write_lock_bh(&hci_cb_list_lock);
1834 list_add(&cb->list, &hci_cb_list);
1835 write_unlock_bh(&hci_cb_list_lock);
1836
1837 return 0;
1838}
1839EXPORT_SYMBOL(hci_register_cb);
1840
1841int hci_unregister_cb(struct hci_cb *cb)
1842{
1843 BT_DBG("%p name %s", cb, cb->name);
1844
1845 write_lock_bh(&hci_cb_list_lock);
1846 list_del(&cb->list);
1847 write_unlock_bh(&hci_cb_list_lock);
1848
1849 return 0;
1850}
1851EXPORT_SYMBOL(hci_unregister_cb);
1852
1853static int hci_send_frame(struct sk_buff *skb)
1854{
1855 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1856
1857 if (!hdev) {
1858 kfree_skb(skb);
1859 return -ENODEV;
1860 }
1861
0d48d939 1862 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1863
1864 if (atomic_read(&hdev->promisc)) {
1865 /* Time stamp */
a61bbcf2 1866 __net_timestamp(skb);
1da177e4 1867
eec8d2bc 1868 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1869 }
1870
1871 /* Get rid of skb owner, prior to sending to the driver. */
1872 skb_orphan(skb);
1873
1874 return hdev->send(skb);
1875}
1876
1877/* Send HCI command */
a9de9248 1878int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1879{
1880 int len = HCI_COMMAND_HDR_SIZE + plen;
1881 struct hci_command_hdr *hdr;
1882 struct sk_buff *skb;
1883
a9de9248 1884 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1885
1886 skb = bt_skb_alloc(len, GFP_ATOMIC);
1887 if (!skb) {
ef222013 1888 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1889 return -ENOMEM;
1890 }
1891
1892 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1893 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1894 hdr->plen = plen;
1895
1896 if (plen)
1897 memcpy(skb_put(skb, plen), param, plen);
1898
1899 BT_DBG("skb len %d", skb->len);
1900
0d48d939 1901 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 1902 skb->dev = (void *) hdev;
c78ae283 1903
a5040efa
JH		 1904 if (test_bit(HCI_INIT, &hdev->flags))
1905 hdev->init_last_cmd = opcode;
1906
1da177e4 1907 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 1908 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 1909
1910 return 0;
1911}
1da177e4
LT		 1912
1913/* Get data from the previously sent command */
a9de9248 1914void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1915{
1916 struct hci_command_hdr *hdr;
1917
1918 if (!hdev->sent_cmd)
1919 return NULL;
1920
1921 hdr = (void *) hdev->sent_cmd->data;
1922
a9de9248 1923 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1924 return NULL;
1925
a9de9248 1926 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1927
1928 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1929}
1930
1931/* Send ACL data */
1932static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1933{
1934 struct hci_acl_hdr *hdr;
1935 int len = skb->len;
1936
badff6d0
ACM		 1937 skb_push(skb, HCI_ACL_HDR_SIZE);
1938 skb_reset_transport_header(skb);
9c70220b 1939 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1940 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1941 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1942}
1943
73d80deb
LAD		 1944static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
1945 struct sk_buff *skb, __u16 flags)
1da177e4
LT		 1946{
1947 struct hci_dev *hdev = conn->hdev;
1948 struct sk_buff *list;
1949
70f23020
AE		 1950 list = skb_shinfo(skb)->frag_list;
1951 if (!list) {
1da177e4
LT		 1952 /* Non fragmented */
1953 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1954
73d80deb 1955 skb_queue_tail(queue, skb);
1da177e4
LT		 1956 } else {
1957 /* Fragmented */
1958 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1959
1960 skb_shinfo(skb)->frag_list = NULL;
1961
1962 /* Queue all fragments atomically */
73d80deb 1963 spin_lock_bh(&queue->lock);
1da177e4 1964
73d80deb 1965 __skb_queue_tail(queue, skb);
e702112f
AE		 1966
1967 flags &= ~ACL_START;
1968 flags |= ACL_CONT;
1da177e4
LT		 1969 do {
1970 skb = list; list = list->next;
8e87d142 1971
1da177e4 1972 skb->dev = (void *) hdev;
0d48d939 1973 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1974 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 1975
1976 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1977
73d80deb 1978 __skb_queue_tail(queue, skb);
1da177e4
LT		 1979 } while (list);
1980
73d80deb 1981 spin_unlock_bh(&queue->lock);
1da177e4 1982 }
73d80deb
LAD		 1983}
1984
1985void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
1986{
1987 struct hci_conn *conn = chan->conn;
1988 struct hci_dev *hdev = conn->hdev;
1989
1990 BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
1991
1992 skb->dev = (void *) hdev;
1993 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1994 hci_add_acl_hdr(skb, conn->handle, flags);
1995
1996 hci_queue_acl(conn, &chan->data_q, skb, flags);
1da177e4 1997
3eff45ea 1998 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4
LT		 1999}
2000EXPORT_SYMBOL(hci_send_acl);
2001
2002/* Send SCO data */
0d861d8b 2003void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 2004{
2005 struct hci_dev *hdev = conn->hdev;
2006 struct hci_sco_hdr hdr;
2007
2008 BT_DBG("%s len %d", hdev->name, skb->len);
2009
aca3192c 2010 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 2011 hdr.dlen = skb->len;
2012
badff6d0
ACM		 2013 skb_push(skb, HCI_SCO_HDR_SIZE);
2014 skb_reset_transport_header(skb);
9c70220b 2015 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 2016
2017 skb->dev = (void *) hdev;
0d48d939 2018 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 2019
1da177e4 2020 skb_queue_tail(&conn->data_q, skb);
3eff45ea 2021 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4
LT		 2022}
2023EXPORT_SYMBOL(hci_send_sco);
2024
2025/* ---- HCI TX task (outgoing data) ---- */
2026
2027/* HCI Connection scheduler */
2028static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2029{
2030 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2031 struct hci_conn *conn = NULL, *c;
1da177e4 2032 int num = 0, min = ~0;
1da177e4 2033
8e87d142 2034 /* We don't have to lock device here. Connections are always
1da177e4 2035 * added and removed with TX task disabled. */
bf4c6325
GP		 2036
2037 rcu_read_lock();
2038
2039 list_for_each_entry_rcu(c, &h->list, list) {
769be974 2040 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2041 continue;
769be974
MH		 2042
2043 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2044 continue;
2045
1da177e4
LT		 2046 num++;
2047
2048 if (c->sent < min) {
2049 min = c->sent;
2050 conn = c;
2051 }
52087a79
LAD		 2052
2053 if (hci_conn_num(hdev, type) == num)
2054 break;
1da177e4
LT		 2055 }
2056
bf4c6325
GP		 2057 rcu_read_unlock();
2058
1da177e4 2059 if (conn) {
6ed58ec5
VT		 2060 int cnt, q;
2061
2062 switch (conn->type) {
2063 case ACL_LINK:
2064 cnt = hdev->acl_cnt;
2065 break;
2066 case SCO_LINK:
2067 case ESCO_LINK:
2068 cnt = hdev->sco_cnt;
2069 break;
2070 case LE_LINK:
2071 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2072 break;
2073 default:
2074 cnt = 0;
2075 BT_ERR("Unknown link type");
2076 }
2077
2078 q = cnt / num;
1da177e4
LT		 2079 *quote = q ? q : 1;
2080 } else
2081 *quote = 0;
2082
2083 BT_DBG("conn %p quote %d", conn, *quote);
2084 return conn;
2085}
2086
bae1f5d9 2087static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2088{
2089 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2090 struct hci_conn *c;
1da177e4 2091
bae1f5d9 2092 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 2093
bf4c6325
GP		 2094 rcu_read_lock();
2095
1da177e4 2096 /* Kill stalled connections */
bf4c6325 2097 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9
VT		 2098 if (c->type == type && c->sent) {
2099 BT_ERR("%s killing stalled connection %s",
1da177e4
LT		 2100 hdev->name, batostr(&c->dst));
2101 hci_acl_disconn(c, 0x13);
2102 }
2103 }
bf4c6325
GP		 2104
2105 rcu_read_unlock();
1da177e4
LT		 2106}
2107
73d80deb
LAD		 2108static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2109 int *quote)
1da177e4 2110{
73d80deb
LAD		 2111 struct hci_conn_hash *h = &hdev->conn_hash;
2112 struct hci_chan *chan = NULL;
2113 int num = 0, min = ~0, cur_prio = 0;
1da177e4 2114 struct hci_conn *conn;
73d80deb
LAD		 2115 int cnt, q, conn_num = 0;
2116
2117 BT_DBG("%s", hdev->name);
2118
bf4c6325
GP		 2119 rcu_read_lock();
2120
2121 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 2122 struct hci_chan *tmp;
2123
2124 if (conn->type != type)
2125 continue;
2126
2127 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2128 continue;
2129
2130 conn_num++;
2131
8192edef 2132 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 2133 struct sk_buff *skb;
2134
2135 if (skb_queue_empty(&tmp->data_q))
2136 continue;
2137
2138 skb = skb_peek(&tmp->data_q);
2139 if (skb->priority < cur_prio)
2140 continue;
2141
2142 if (skb->priority > cur_prio) {
2143 num = 0;
2144 min = ~0;
2145 cur_prio = skb->priority;
2146 }
2147
2148 num++;
2149
2150 if (conn->sent < min) {
2151 min = conn->sent;
2152 chan = tmp;
2153 }
2154 }
2155
2156 if (hci_conn_num(hdev, type) == conn_num)
2157 break;
2158 }
2159
bf4c6325
GP		 2160 rcu_read_unlock();
2161
73d80deb
LAD		 2162 if (!chan)
2163 return NULL;
2164
2165 switch (chan->conn->type) {
2166 case ACL_LINK:
2167 cnt = hdev->acl_cnt;
2168 break;
2169 case SCO_LINK:
2170 case ESCO_LINK:
2171 cnt = hdev->sco_cnt;
2172 break;
2173 case LE_LINK:
2174 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2175 break;
2176 default:
2177 cnt = 0;
2178 BT_ERR("Unknown link type");
2179 }
2180
2181 q = cnt / num;
2182 *quote = q ? q : 1;
2183 BT_DBG("chan %p quote %d", chan, *quote);
2184 return chan;
2185}
2186
02b20f0b
LAD		 2187static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2188{
2189 struct hci_conn_hash *h = &hdev->conn_hash;
2190 struct hci_conn *conn;
2191 int num = 0;
2192
2193 BT_DBG("%s", hdev->name);
2194
bf4c6325
GP		 2195 rcu_read_lock();
2196
2197 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 2198 struct hci_chan *chan;
2199
2200 if (conn->type != type)
2201 continue;
2202
2203 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2204 continue;
2205
2206 num++;
2207
8192edef 2208 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 2209 struct sk_buff *skb;
2210
2211 if (chan->sent) {
2212 chan->sent = 0;
2213 continue;
2214 }
2215
2216 if (skb_queue_empty(&chan->data_q))
2217 continue;
2218
2219 skb = skb_peek(&chan->data_q);
2220 if (skb->priority >= HCI_PRIO_MAX - 1)
2221 continue;
2222
2223 skb->priority = HCI_PRIO_MAX - 1;
2224
2225 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2226 skb->priority);
2227 }
2228
2229 if (hci_conn_num(hdev, type) == num)
2230 break;
2231 }
bf4c6325
GP		 2232
2233 rcu_read_unlock();
2234
02b20f0b
LAD		 2235}
2236
73d80deb
LAD		 2237static inline void hci_sched_acl(struct hci_dev *hdev)
2238{
2239 struct hci_chan *chan;
1da177e4
LT		 2240 struct sk_buff *skb;
2241 int quote;
73d80deb 2242 unsigned int cnt;
1da177e4
LT		 2243
2244 BT_DBG("%s", hdev->name);
2245
52087a79
LAD		 2246 if (!hci_conn_num(hdev, ACL_LINK))
2247 return;
2248
1da177e4
LT		 2249 if (!test_bit(HCI_RAW, &hdev->flags)) {
2250 /* ACL tx timeout must be longer than maximum
2251 * link supervision timeout (40.9 seconds) */
82453021 2252 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
bae1f5d9 2253 hci_link_tx_to(hdev, ACL_LINK);
1da177e4
LT		 2254 }
2255
73d80deb 2256 cnt = hdev->acl_cnt;
04837f64 2257
73d80deb
LAD		 2258 while (hdev->acl_cnt &&
2259 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 2260 u32 priority = (skb_peek(&chan->data_q))->priority;
2261 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb
LAD		 2262 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2263 skb->len, skb->priority);
2264
ec1cce24
LAD		 2265 /* Stop if priority has changed */
2266 if (skb->priority < priority)
2267 break;
2268
2269 skb = skb_dequeue(&chan->data_q);
2270
73d80deb
LAD		 2271 hci_conn_enter_active_mode(chan->conn,
2272 bt_cb(skb)->force_active);
04837f64 2273
1da177e4
LT		 2274 hci_send_frame(skb);
2275 hdev->acl_last_tx = jiffies;
2276
2277 hdev->acl_cnt--;
73d80deb
LAD		 2278 chan->sent++;
2279 chan->conn->sent++;
1da177e4
LT		 2280 }
2281 }
02b20f0b
LAD		 2282
2283 if (cnt != hdev->acl_cnt)
2284 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 2285}
2286
2287/* Schedule SCO */
2288static inline void hci_sched_sco(struct hci_dev *hdev)
2289{
2290 struct hci_conn *conn;
2291 struct sk_buff *skb;
2292 int quote;
2293
2294 BT_DBG("%s", hdev->name);
2295
52087a79
LAD		 2296 if (!hci_conn_num(hdev, SCO_LINK))
2297 return;
2298
1da177e4
LT		 2299 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2300 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2301 BT_DBG("skb %p len %d", skb, skb->len);
2302 hci_send_frame(skb);
2303
2304 conn->sent++;
2305 if (conn->sent == ~0)
2306 conn->sent = 0;
2307 }
2308 }
2309}
2310
b6a0dc82
MH		 2311static inline void hci_sched_esco(struct hci_dev *hdev)
2312{
2313 struct hci_conn *conn;
2314 struct sk_buff *skb;
2315 int quote;
2316
2317 BT_DBG("%s", hdev->name);
2318
52087a79
LAD		 2319 if (!hci_conn_num(hdev, ESCO_LINK))
2320 return;
2321
b6a0dc82
MH		 2322 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2323 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2324 BT_DBG("skb %p len %d", skb, skb->len);
2325 hci_send_frame(skb);
2326
2327 conn->sent++;
2328 if (conn->sent == ~0)
2329 conn->sent = 0;
2330 }
2331 }
2332}
2333
6ed58ec5
VT		 2334static inline void hci_sched_le(struct hci_dev *hdev)
2335{
73d80deb 2336 struct hci_chan *chan;
6ed58ec5 2337 struct sk_buff *skb;
02b20f0b 2338 int quote, cnt, tmp;
6ed58ec5
VT		 2339
2340 BT_DBG("%s", hdev->name);
2341
52087a79
LAD		 2342 if (!hci_conn_num(hdev, LE_LINK))
2343 return;
2344
6ed58ec5
VT		 2345 if (!test_bit(HCI_RAW, &hdev->flags)) {
2346 /* LE tx timeout must be longer than maximum
2347 * link supervision timeout (40.9 seconds) */
bae1f5d9 2348 if (!hdev->le_cnt && hdev->le_pkts &&
6ed58ec5 2349 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 2350 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 2351 }
2352
2353 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 2354 tmp = cnt;
73d80deb 2355 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 2356 u32 priority = (skb_peek(&chan->data_q))->priority;
2357 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb
LAD		 2358 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2359 skb->len, skb->priority);
6ed58ec5 2360
ec1cce24
LAD		 2361 /* Stop if priority has changed */
2362 if (skb->priority < priority)
2363 break;
2364
2365 skb = skb_dequeue(&chan->data_q);
2366
6ed58ec5
VT		 2367 hci_send_frame(skb);
2368 hdev->le_last_tx = jiffies;
2369
2370 cnt--;
73d80deb
LAD		 2371 chan->sent++;
2372 chan->conn->sent++;
6ed58ec5
VT		 2373 }
2374 }
73d80deb 2375
6ed58ec5
VT		 2376 if (hdev->le_pkts)
2377 hdev->le_cnt = cnt;
2378 else
2379 hdev->acl_cnt = cnt;
02b20f0b
LAD		 2380
2381 if (cnt != tmp)
2382 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 2383}
2384
3eff45ea 2385static void hci_tx_work(struct work_struct *work)
1da177e4 2386{
3eff45ea 2387 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 2388 struct sk_buff *skb;
2389
6ed58ec5
VT		 2390 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2391 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 2392
2393 /* Schedule queues and send stuff to HCI driver */
2394
2395 hci_sched_acl(hdev);
2396
2397 hci_sched_sco(hdev);
2398
b6a0dc82
MH		 2399 hci_sched_esco(hdev);
2400
6ed58ec5
VT		 2401 hci_sched_le(hdev);
2402
1da177e4
LT		 2403 /* Send next queued raw (unknown type) packet */
2404 while ((skb = skb_dequeue(&hdev->raw_q)))
2405 hci_send_frame(skb);
1da177e4
LT		 2406}
2407
25985edc 2408/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 2409
2410/* ACL data packet */
2411static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2412{
2413 struct hci_acl_hdr *hdr = (void *) skb->data;
2414 struct hci_conn *conn;
2415 __u16 handle, flags;
2416
2417 skb_pull(skb, HCI_ACL_HDR_SIZE);
2418
2419 handle = __le16_to_cpu(hdr->handle);
2420 flags = hci_flags(handle);
2421 handle = hci_handle(handle);
2422
2423 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2424
2425 hdev->stat.acl_rx++;
2426
2427 hci_dev_lock(hdev);
2428 conn = hci_conn_hash_lookup_handle(hdev, handle);
2429 hci_dev_unlock(hdev);
8e87d142 2430
1da177e4 2431 if (conn) {
65983fc7 2432 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 2433
1da177e4 2434 /* Send to upper protocol */
686ebf28
UF		 2435 l2cap_recv_acldata(conn, skb, flags);
2436 return;
1da177e4 2437 } else {
8e87d142 2438 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 2439 hdev->name, handle);
2440 }
2441
2442 kfree_skb(skb);
2443}
2444
2445/* SCO data packet */
2446static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2447{
2448 struct hci_sco_hdr *hdr = (void *) skb->data;
2449 struct hci_conn *conn;
2450 __u16 handle;
2451
2452 skb_pull(skb, HCI_SCO_HDR_SIZE);
2453
2454 handle = __le16_to_cpu(hdr->handle);
2455
2456 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2457
2458 hdev->stat.sco_rx++;
2459
2460 hci_dev_lock(hdev);
2461 conn = hci_conn_hash_lookup_handle(hdev, handle);
2462 hci_dev_unlock(hdev);
2463
2464 if (conn) {
1da177e4 2465 /* Send to upper protocol */
686ebf28
UF		 2466 sco_recv_scodata(conn, skb);
2467 return;
1da177e4 2468 } else {
8e87d142 2469 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 2470 hdev->name, handle);
2471 }
2472
2473 kfree_skb(skb);
2474}
2475
b78752cc 2476static void hci_rx_work(struct work_struct *work)
1da177e4 2477{
b78752cc 2478 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 2479 struct sk_buff *skb;
2480
2481 BT_DBG("%s", hdev->name);
2482
1da177e4
LT		 2483 while ((skb = skb_dequeue(&hdev->rx_q))) {
2484 if (atomic_read(&hdev->promisc)) {
2485 /* Send copy to the sockets */
eec8d2bc 2486 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 2487 }
2488
2489 if (test_bit(HCI_RAW, &hdev->flags)) {
2490 kfree_skb(skb);
2491 continue;
2492 }
2493
2494 if (test_bit(HCI_INIT, &hdev->flags)) {
2495 /* Don't process data packets in this states. */
0d48d939 2496 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2497 case HCI_ACLDATA_PKT:
2498 case HCI_SCODATA_PKT:
2499 kfree_skb(skb);
2500 continue;
3ff50b79 2501 }
1da177e4
LT		 2502 }
2503
2504 /* Process frame */
0d48d939 2505 switch (bt_cb(skb)->pkt_type) {
1da177e4 2506 case HCI_EVENT_PKT:
b78752cc 2507 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 2508 hci_event_packet(hdev, skb);
2509 break;
2510
2511 case HCI_ACLDATA_PKT:
2512 BT_DBG("%s ACL data packet", hdev->name);
2513 hci_acldata_packet(hdev, skb);
2514 break;
2515
2516 case HCI_SCODATA_PKT:
2517 BT_DBG("%s SCO data packet", hdev->name);
2518 hci_scodata_packet(hdev, skb);
2519 break;
2520
2521 default:
2522 kfree_skb(skb);
2523 break;
2524 }
2525 }
1da177e4
LT		 2526}
2527
c347b765 2528static void hci_cmd_work(struct work_struct *work)
1da177e4 2529{
c347b765 2530 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 2531 struct sk_buff *skb;
2532
2533 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2534
1da177e4 2535 /* Send queued commands */
5a08ecce
AE		 2536 if (atomic_read(&hdev->cmd_cnt)) {
2537 skb = skb_dequeue(&hdev->cmd_q);
2538 if (!skb)
2539 return;
2540
7585b97a 2541 kfree_skb(hdev->sent_cmd);
1da177e4 2542
70f23020
AE		 2543 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2544 if (hdev->sent_cmd) {
1da177e4
LT		 2545 atomic_dec(&hdev->cmd_cnt);
2546 hci_send_frame(skb);
7bdb8a5c
SJ		 2547 if (test_bit(HCI_RESET, &hdev->flags))
2548 del_timer(&hdev->cmd_timer);
2549 else
2550 mod_timer(&hdev->cmd_timer,
6bd32326 2551 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
1da177e4
LT		 2552 } else {
2553 skb_queue_head(&hdev->cmd_q, skb);
c347b765 2554 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 2555 }
2556 }
2557}
2519a1fc
AG		 2558
2559int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2560{
2561 /* General inquiry access code (GIAC) */
2562 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2563 struct hci_cp_inquiry cp;
2564
2565 BT_DBG("%s", hdev->name);
2566
2567 if (test_bit(HCI_INQUIRY, &hdev->flags))
2568 return -EINPROGRESS;
2569
2570 memset(&cp, 0, sizeof(cp));
2571 memcpy(&cp.lap, lap, sizeof(cp.lap));
2572 cp.length = length;
2573
2574 return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2575}
023d5049
AG		 2576
2577int hci_cancel_inquiry(struct hci_dev *hdev)
2578{
2579 BT_DBG("%s", hdev->name);
2580
2581 if (!test_bit(HCI_INQUIRY, &hdev->flags))
2582 return -EPERM;
2583
2584 return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2585}
7784d78f
AE		 2586
2587module_param(enable_hs, bool, 0644);
2588MODULE_PARM_DESC(enable_hs, "Enable High Speed");
kernel source for telekom puls (alcatel/mediatek)