projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Fix hci_connect error return values
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
82453021 28#include <linux/jiffies.h>
1da177e4
LT		 29#include <linux/module.h>
30#include <linux/kmod.h>
31
32#include <linux/types.h>
33#include <linux/errno.h>
34#include <linux/kernel.h>
1da177e4
LT		 35#include <linux/sched.h>
36#include <linux/slab.h>
37#include <linux/poll.h>
38#include <linux/fcntl.h>
39#include <linux/init.h>
40#include <linux/skbuff.h>
f48fd9c8 41#include <linux/workqueue.h>
1da177e4
LT		 42#include <linux/interrupt.h>
43#include <linux/notifier.h>
611b30f7 44#include <linux/rfkill.h>
6bd32326 45#include <linux/timer.h>
3a0259bb 46#include <linux/crypto.h>
1da177e4
LT		 47#include <net/sock.h>
48
49#include <asm/system.h>
70f23020 50#include <linux/uaccess.h>
1da177e4
LT		 51#include <asm/unaligned.h>
52
53#include <net/bluetooth/bluetooth.h>
54#include <net/bluetooth/hci_core.h>
55
ab81cbf9
JH		 56#define AUTO_OFF_TIMEOUT 2000
57
8b281b9c 58bool enable_hs;
7784d78f 59
b78752cc 60static void hci_rx_work(struct work_struct *work);
c347b765 61static void hci_cmd_work(struct work_struct *work);
3eff45ea 62static void hci_tx_work(struct work_struct *work);
1da177e4 63
1da177e4
LT		 64/* HCI device list */
65LIST_HEAD(hci_dev_list);
66DEFINE_RWLOCK(hci_dev_list_lock);
67
68/* HCI callback list */
69LIST_HEAD(hci_cb_list);
70DEFINE_RWLOCK(hci_cb_list_lock);
71
1da177e4 72/* HCI notifiers list */
e041c683 73static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 74
75/* ---- HCI notifications ---- */
76
77int hci_register_notifier(struct notifier_block *nb)
78{
e041c683 79 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 80}
81
82int hci_unregister_notifier(struct notifier_block *nb)
83{
e041c683 84 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 85}
86
6516455d 87static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 88{
e041c683 89 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 90}
91
92/* ---- HCI requests ---- */
93
23bb5763 94void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 95{
23bb5763
JH		 96 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
97
a5040efa
JH		 98 /* If this is the init phase check if the completed command matches
99 * the last init command, and if not just return.
100 */
101 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
23bb5763 102 return;
1da177e4
LT		 103
104 if (hdev->req_status == HCI_REQ_PEND) {
105 hdev->req_result = result;
106 hdev->req_status = HCI_REQ_DONE;
107 wake_up_interruptible(&hdev->req_wait_q);
108 }
109}
110
111static void hci_req_cancel(struct hci_dev *hdev, int err)
112{
113 BT_DBG("%s err 0x%2.2x", hdev->name, err);
114
115 if (hdev->req_status == HCI_REQ_PEND) {
116 hdev->req_result = err;
117 hdev->req_status = HCI_REQ_CANCELED;
118 wake_up_interruptible(&hdev->req_wait_q);
119 }
120}
121
122/* Execute request and wait for completion. */
8e87d142 123static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 124 unsigned long opt, __u32 timeout)
1da177e4
LT		 125{
126 DECLARE_WAITQUEUE(wait, current);
127 int err = 0;
128
129 BT_DBG("%s start", hdev->name);
130
131 hdev->req_status = HCI_REQ_PEND;
132
133 add_wait_queue(&hdev->req_wait_q, &wait);
134 set_current_state(TASK_INTERRUPTIBLE);
135
136 req(hdev, opt);
137 schedule_timeout(timeout);
138
139 remove_wait_queue(&hdev->req_wait_q, &wait);
140
141 if (signal_pending(current))
142 return -EINTR;
143
144 switch (hdev->req_status) {
145 case HCI_REQ_DONE:
e175072f 146 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 147 break;
148
149 case HCI_REQ_CANCELED:
150 err = -hdev->req_result;
151 break;
152
153 default:
154 err = -ETIMEDOUT;
155 break;
3ff50b79 156 }
1da177e4 157
a5040efa 158 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 159
160 BT_DBG("%s end: err %d", hdev->name, err);
161
162 return err;
163}
164
165static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 166 unsigned long opt, __u32 timeout)
1da177e4
LT		 167{
168 int ret;
169
7c6a329e
MH		 170 if (!test_bit(HCI_UP, &hdev->flags))
171 return -ENETDOWN;
172
1da177e4
LT		 173 /* Serialize all requests */
174 hci_req_lock(hdev);
175 ret = __hci_request(hdev, req, opt, timeout);
176 hci_req_unlock(hdev);
177
178 return ret;
179}
180
181static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
182{
183 BT_DBG("%s %ld", hdev->name, opt);
184
185 /* Reset device */
f630cf0d 186 set_bit(HCI_RESET, &hdev->flags);
a9de9248 187 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 188}
189
e61ef499 190static void bredr_init(struct hci_dev *hdev)
1da177e4 191{
b0916ea0 192 struct hci_cp_delete_stored_link_key cp;
1ebb9252 193 __le16 param;
89f2783d 194 __u8 flt_type;
1da177e4 195
2455a3ea
AE		 196 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
197
1da177e4
LT		 198 /* Mandatory initialization */
199
200 /* Reset */
f630cf0d 201 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
e61ef499
AE		 202 set_bit(HCI_RESET, &hdev->flags);
203 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
f630cf0d 204 }
1da177e4
LT		 205
206 /* Read Local Supported Features */
a9de9248 207 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 208
1143e5a6 209 /* Read Local Version */
a9de9248 210 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 211
1da177e4 212 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 213 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4 214
1da177e4 215 /* Read BD Address */
a9de9248
MH		 216 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
217
218 /* Read Class of Device */
219 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
220
221 /* Read Local Name */
222 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 223
224 /* Read Voice Setting */
a9de9248 225 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 226
227 /* Optional initialization */
228
229 /* Clear Event Filters */
89f2783d 230 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 231 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4 232
1da177e4 233 /* Connection accept timeout ~20 secs */
aca3192c 234 param = cpu_to_le16(0x7d00);
a9de9248 235 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
b0916ea0
JH		 236
237 bacpy(&cp.bdaddr, BDADDR_ANY);
238 cp.delete_all = 1;
239 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
1da177e4
LT		 240}
241
e61ef499
AE		 242static void amp_init(struct hci_dev *hdev)
243{
2455a3ea
AE		 244 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
245
e61ef499
AE		 246 /* Reset */
247 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
248
249 /* Read Local Version */
250 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
251}
252
253static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
254{
255 struct sk_buff *skb;
256
257 BT_DBG("%s %ld", hdev->name, opt);
258
259 /* Driver initialization */
260
261 /* Special commands */
262 while ((skb = skb_dequeue(&hdev->driver_init))) {
263 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
264 skb->dev = (void *) hdev;
265
266 skb_queue_tail(&hdev->cmd_q, skb);
267 queue_work(hdev->workqueue, &hdev->cmd_work);
268 }
269 skb_queue_purge(&hdev->driver_init);
270
271 switch (hdev->dev_type) {
272 case HCI_BREDR:
273 bredr_init(hdev);
274 break;
275
276 case HCI_AMP:
277 amp_init(hdev);
278 break;
279
280 default:
281 BT_ERR("Unknown device type %d", hdev->dev_type);
282 break;
283 }
284
285}
286
6ed58ec5
VT		 287static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
288{
289 BT_DBG("%s", hdev->name);
290
291 /* Read LE buffer size */
292 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
293}
294
1da177e4
LT		 295static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
296{
297 __u8 scan = opt;
298
299 BT_DBG("%s %x", hdev->name, scan);
300
301 /* Inquiry and Page scans */
a9de9248 302 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 303}
304
305static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
306{
307 __u8 auth = opt;
308
309 BT_DBG("%s %x", hdev->name, auth);
310
311 /* Authentication */
a9de9248 312 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 313}
314
315static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
316{
317 __u8 encrypt = opt;
318
319 BT_DBG("%s %x", hdev->name, encrypt);
320
e4e8e37c 321 /* Encryption */
a9de9248 322 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 323}
324
e4e8e37c
MH		 325static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
326{
327 __le16 policy = cpu_to_le16(opt);
328
a418b893 329 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 330
331 /* Default link policy */
332 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
333}
334
8e87d142 335/* Get HCI device by index.
1da177e4
LT		 336 * Device is held on return. */
337struct hci_dev *hci_dev_get(int index)
338{
8035ded4 339 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 340
341 BT_DBG("%d", index);
342
343 if (index < 0)
344 return NULL;
345
346 read_lock(&hci_dev_list_lock);
8035ded4 347 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 348 if (d->id == index) {
349 hdev = hci_dev_hold(d);
350 break;
351 }
352 }
353 read_unlock(&hci_dev_list_lock);
354 return hdev;
355}
1da177e4
LT		 356
357/* ---- Inquiry support ---- */
ff9ef578 358
30dc78e1
JH		 359bool hci_discovery_active(struct hci_dev *hdev)
360{
361 struct discovery_state *discov = &hdev->discovery;
362
6fbe195d 363 switch (discov->state) {
343f935b 364 case DISCOVERY_FINDING:
6fbe195d 365 case DISCOVERY_RESOLVING:
30dc78e1
JH		 366 return true;
367
6fbe195d
AG		 368 default:
369 return false;
370 }
30dc78e1
JH		 371}
372
ff9ef578
JH		 373void hci_discovery_set_state(struct hci_dev *hdev, int state)
374{
375 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
376
377 if (hdev->discovery.state == state)
378 return;
379
380 switch (state) {
381 case DISCOVERY_STOPPED:
4aab14e5
AG		 382 hdev->discovery.type = 0;
383
7b99b659
AG		 384 if (hdev->discovery.state != DISCOVERY_STARTING)
385 mgmt_discovering(hdev, 0);
ff9ef578
JH		 386 break;
387 case DISCOVERY_STARTING:
388 break;
343f935b 389 case DISCOVERY_FINDING:
ff9ef578
JH		 390 mgmt_discovering(hdev, 1);
391 break;
30dc78e1
JH		 392 case DISCOVERY_RESOLVING:
393 break;
ff9ef578
JH		 394 case DISCOVERY_STOPPING:
395 break;
396 }
397
398 hdev->discovery.state = state;
399}
400
1da177e4
LT		 401static void inquiry_cache_flush(struct hci_dev *hdev)
402{
30883512 403 struct discovery_state *cache = &hdev->discovery;
b57c1a56 404 struct inquiry_entry *p, *n;
1da177e4 405
561aafbc
JH		 406 list_for_each_entry_safe(p, n, &cache->all, all) {
407 list_del(&p->all);
b57c1a56 408 kfree(p);
1da177e4 409 }
561aafbc
JH		 410
411 INIT_LIST_HEAD(&cache->unknown);
412 INIT_LIST_HEAD(&cache->resolve);
ff9ef578 413 cache->state = DISCOVERY_STOPPED;
1da177e4
LT		 414}
415
416struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
417{
30883512 418 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 419 struct inquiry_entry *e;
420
421 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
422
561aafbc
JH		 423 list_for_each_entry(e, &cache->all, all) {
424 if (!bacmp(&e->data.bdaddr, bdaddr))
425 return e;
426 }
427
428 return NULL;
429}
430
431struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
432 bdaddr_t *bdaddr)
433{
30883512 434 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 435 struct inquiry_entry *e;
436
437 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
438
439 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 440 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 441 return e;
442 }
443
444 return NULL;
1da177e4
LT		 445}
446
30dc78e1
JH		 447struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
448 bdaddr_t *bdaddr,
449 int state)
450{
451 struct discovery_state *cache = &hdev->discovery;
452 struct inquiry_entry *e;
453
454 BT_DBG("cache %p bdaddr %s state %d", cache, batostr(bdaddr), state);
455
456 list_for_each_entry(e, &cache->resolve, list) {
457 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
458 return e;
459 if (!bacmp(&e->data.bdaddr, bdaddr))
460 return e;
461 }
462
463 return NULL;
464}
465
a3d4e20a
JH		 466void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
467 struct inquiry_entry *ie)
468{
469 struct discovery_state *cache = &hdev->discovery;
470 struct list_head *pos = &cache->resolve;
471 struct inquiry_entry *p;
472
473 list_del(&ie->list);
474
475 list_for_each_entry(p, &cache->resolve, list) {
476 if (p->name_state != NAME_PENDING &&
477 abs(p->data.rssi) >= abs(ie->data.rssi))
478 break;
479 pos = &p->list;
480 }
481
482 list_add(&ie->list, pos);
483}
484
3175405b 485bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
561aafbc 486 bool name_known)
1da177e4 487{
30883512 488 struct discovery_state *cache = &hdev->discovery;
70f23020 489 struct inquiry_entry *ie;
1da177e4
LT		 490
491 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
492
70f23020 493 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a
JH		 494 if (ie) {
495 if (ie->name_state == NAME_NEEDED &&
496 data->rssi != ie->data.rssi) {
497 ie->data.rssi = data->rssi;
498 hci_inquiry_cache_update_resolve(hdev, ie);
499 }
500
561aafbc 501 goto update;
a3d4e20a 502 }
561aafbc
JH		 503
504 /* Entry not in the cache. Add new one. */
505 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
506 if (!ie)
3175405b 507 return false;
561aafbc
JH		 508
509 list_add(&ie->all, &cache->all);
510
511 if (name_known) {
512 ie->name_state = NAME_KNOWN;
513 } else {
514 ie->name_state = NAME_NOT_KNOWN;
515 list_add(&ie->list, &cache->unknown);
516 }
70f23020 517
561aafbc
JH		 518update:
519 if (name_known && ie->name_state != NAME_KNOWN &&
520 ie->name_state != NAME_PENDING) {
521 ie->name_state = NAME_KNOWN;
522 list_del(&ie->list);
1da177e4
LT		 523 }
524
70f23020
AE		 525 memcpy(&ie->data, data, sizeof(*data));
526 ie->timestamp = jiffies;
1da177e4 527 cache->timestamp = jiffies;
3175405b
JH		 528
529 if (ie->name_state == NAME_NOT_KNOWN)
530 return false;
531
532 return true;
1da177e4
LT		 533}
534
535static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
536{
30883512 537 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 538 struct inquiry_info *info = (struct inquiry_info *) buf;
539 struct inquiry_entry *e;
540 int copied = 0;
541
561aafbc 542 list_for_each_entry(e, &cache->all, all) {
1da177e4 543 struct inquiry_data *data = &e->data;
b57c1a56
JH		 544
545 if (copied >= num)
546 break;
547
1da177e4
LT		 548 bacpy(&info->bdaddr, &data->bdaddr);
549 info->pscan_rep_mode = data->pscan_rep_mode;
550 info->pscan_period_mode = data->pscan_period_mode;
551 info->pscan_mode = data->pscan_mode;
552 memcpy(info->dev_class, data->dev_class, 3);
553 info->clock_offset = data->clock_offset;
b57c1a56 554
1da177e4 555 info++;
b57c1a56 556 copied++;
1da177e4
LT		 557 }
558
559 BT_DBG("cache %p, copied %d", cache, copied);
560 return copied;
561}
562
563static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
564{
565 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
566 struct hci_cp_inquiry cp;
567
568 BT_DBG("%s", hdev->name);
569
570 if (test_bit(HCI_INQUIRY, &hdev->flags))
571 return;
572
573 /* Start Inquiry */
574 memcpy(&cp.lap, &ir->lap, 3);
575 cp.length = ir->length;
576 cp.num_rsp = ir->num_rsp;
a9de9248 577 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 578}
579
580int hci_inquiry(void __user *arg)
581{
582 __u8 __user *ptr = arg;
583 struct hci_inquiry_req ir;
584 struct hci_dev *hdev;
585 int err = 0, do_inquiry = 0, max_rsp;
586 long timeo;
587 __u8 *buf;
588
589 if (copy_from_user(&ir, ptr, sizeof(ir)))
590 return -EFAULT;
591
5a08ecce
AE		 592 hdev = hci_dev_get(ir.dev_id);
593 if (!hdev)
1da177e4
LT		 594 return -ENODEV;
595
09fd0de5 596 hci_dev_lock(hdev);
8e87d142 597 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
70f23020
AE		 598 inquiry_cache_empty(hdev) ||
599 ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 600 inquiry_cache_flush(hdev);
601 do_inquiry = 1;
602 }
09fd0de5 603 hci_dev_unlock(hdev);
1da177e4 604
04837f64 605 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 606
607 if (do_inquiry) {
608 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
609 if (err < 0)
610 goto done;
611 }
1da177e4
LT		 612
613 /* for unlimited number of responses we will use buffer with 255 entries */
614 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
615
616 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
617 * copy it to the user space.
618 */
01df8c31 619 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 620 if (!buf) {
1da177e4
LT		 621 err = -ENOMEM;
622 goto done;
623 }
624
09fd0de5 625 hci_dev_lock(hdev);
1da177e4 626 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 627 hci_dev_unlock(hdev);
1da177e4
LT		 628
629 BT_DBG("num_rsp %d", ir.num_rsp);
630
631 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
632 ptr += sizeof(ir);
633 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
634 ir.num_rsp))
635 err = -EFAULT;
8e87d142 636 } else
1da177e4
LT		 637 err = -EFAULT;
638
639 kfree(buf);
640
641done:
642 hci_dev_put(hdev);
643 return err;
644}
645
646/* ---- HCI ioctl helpers ---- */
647
648int hci_dev_open(__u16 dev)
649{
650 struct hci_dev *hdev;
651 int ret = 0;
652
5a08ecce
AE		 653 hdev = hci_dev_get(dev);
654 if (!hdev)
1da177e4
LT		 655 return -ENODEV;
656
657 BT_DBG("%s %p", hdev->name, hdev);
658
659 hci_req_lock(hdev);
660
611b30f7
MH		 661 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
662 ret = -ERFKILL;
663 goto done;
664 }
665
1da177e4
LT		 666 if (test_bit(HCI_UP, &hdev->flags)) {
667 ret = -EALREADY;
668 goto done;
669 }
670
671 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
672 set_bit(HCI_RAW, &hdev->flags);
673
07e3b94a
AE		 674 /* Treat all non BR/EDR controllers as raw devices if
675 enable_hs is not set */
676 if (hdev->dev_type != HCI_BREDR && !enable_hs)
943da25d
MH		 677 set_bit(HCI_RAW, &hdev->flags);
678
1da177e4
LT		 679 if (hdev->open(hdev)) {
680 ret = -EIO;
681 goto done;
682 }
683
684 if (!test_bit(HCI_RAW, &hdev->flags)) {
685 atomic_set(&hdev->cmd_cnt, 1);
686 set_bit(HCI_INIT, &hdev->flags);
a5040efa 687 hdev->init_last_cmd = 0;
1da177e4 688
04837f64
MH		 689 ret = __hci_request(hdev, hci_init_req, 0,
690 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4 691
eead27da 692 if (lmp_host_le_capable(hdev))
6ed58ec5
VT		 693 ret = __hci_request(hdev, hci_le_init_req, 0,
694 msecs_to_jiffies(HCI_INIT_TIMEOUT));
695
1da177e4
LT		 696 clear_bit(HCI_INIT, &hdev->flags);
697 }
698
699 if (!ret) {
700 hci_dev_hold(hdev);
701 set_bit(HCI_UP, &hdev->flags);
702 hci_notify(hdev, HCI_DEV_UP);
a8b2d5c2 703 if (!test_bit(HCI_SETUP, &hdev->dev_flags)) {
09fd0de5 704 hci_dev_lock(hdev);
744cf19e 705 mgmt_powered(hdev, 1);
09fd0de5 706 hci_dev_unlock(hdev);
56e5cb86 707 }
8e87d142 708 } else {
1da177e4 709 /* Init failed, cleanup */
3eff45ea 710 flush_work(&hdev->tx_work);
c347b765 711 flush_work(&hdev->cmd_work);
b78752cc 712 flush_work(&hdev->rx_work);
1da177e4
LT		 713
714 skb_queue_purge(&hdev->cmd_q);
715 skb_queue_purge(&hdev->rx_q);
716
717 if (hdev->flush)
718 hdev->flush(hdev);
719
720 if (hdev->sent_cmd) {
721 kfree_skb(hdev->sent_cmd);
722 hdev->sent_cmd = NULL;
723 }
724
725 hdev->close(hdev);
726 hdev->flags = 0;
727 }
728
729done:
730 hci_req_unlock(hdev);
731 hci_dev_put(hdev);
732 return ret;
733}
734
735static int hci_dev_do_close(struct hci_dev *hdev)
736{
737 BT_DBG("%s %p", hdev->name, hdev);
738
28b75a89
AG		 739 cancel_work_sync(&hdev->le_scan);
740
1da177e4
LT		 741 hci_req_cancel(hdev, ENODEV);
742 hci_req_lock(hdev);
743
744 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 745 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 746 hci_req_unlock(hdev);
747 return 0;
748 }
749
3eff45ea
GP		 750 /* Flush RX and TX works */
751 flush_work(&hdev->tx_work);
b78752cc 752 flush_work(&hdev->rx_work);
1da177e4 753
16ab91ab 754 if (hdev->discov_timeout > 0) {
e0f9309f 755 cancel_delayed_work(&hdev->discov_off);
16ab91ab
JH		 756 hdev->discov_timeout = 0;
757 }
758
a8b2d5c2 759 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
e0f9309f 760 cancel_delayed_work(&hdev->power_off);
3243553f 761
a8b2d5c2 762 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 763 cancel_delayed_work(&hdev->service_cache);
764
7ba8b4be
AG		 765 cancel_delayed_work_sync(&hdev->le_scan_disable);
766
09fd0de5 767 hci_dev_lock(hdev);
1da177e4
LT		 768 inquiry_cache_flush(hdev);
769 hci_conn_hash_flush(hdev);
09fd0de5 770 hci_dev_unlock(hdev);
1da177e4
LT		 771
772 hci_notify(hdev, HCI_DEV_DOWN);
773
774 if (hdev->flush)
775 hdev->flush(hdev);
776
777 /* Reset device */
778 skb_queue_purge(&hdev->cmd_q);
779 atomic_set(&hdev->cmd_cnt, 1);
8af59467
JH		 780 if (!test_bit(HCI_RAW, &hdev->flags) &&
781 test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
1da177e4 782 set_bit(HCI_INIT, &hdev->flags);
04837f64 783 __hci_request(hdev, hci_reset_req, 0,
cad44c2b 784 msecs_to_jiffies(250));
1da177e4
LT		 785 clear_bit(HCI_INIT, &hdev->flags);
786 }
787
c347b765
GP		 788 /* flush cmd work */
789 flush_work(&hdev->cmd_work);
1da177e4
LT		 790
791 /* Drop queues */
792 skb_queue_purge(&hdev->rx_q);
793 skb_queue_purge(&hdev->cmd_q);
794 skb_queue_purge(&hdev->raw_q);
795
796 /* Drop last sent command */
797 if (hdev->sent_cmd) {
b79f44c1 798 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 799 kfree_skb(hdev->sent_cmd);
800 hdev->sent_cmd = NULL;
801 }
802
803 /* After this point our queues are empty
804 * and no tasks are scheduled. */
805 hdev->close(hdev);
806
09fd0de5 807 hci_dev_lock(hdev);
744cf19e 808 mgmt_powered(hdev, 0);
09fd0de5 809 hci_dev_unlock(hdev);
5add6af8 810
1da177e4
LT		 811 /* Clear flags */
812 hdev->flags = 0;
813
814 hci_req_unlock(hdev);
815
816 hci_dev_put(hdev);
817 return 0;
818}
819
820int hci_dev_close(__u16 dev)
821{
822 struct hci_dev *hdev;
823 int err;
824
70f23020
AE		 825 hdev = hci_dev_get(dev);
826 if (!hdev)
1da177e4
LT		 827 return -ENODEV;
828 err = hci_dev_do_close(hdev);
829 hci_dev_put(hdev);
830 return err;
831}
832
833int hci_dev_reset(__u16 dev)
834{
835 struct hci_dev *hdev;
836 int ret = 0;
837
70f23020
AE		 838 hdev = hci_dev_get(dev);
839 if (!hdev)
1da177e4
LT		 840 return -ENODEV;
841
842 hci_req_lock(hdev);
1da177e4
LT		 843
844 if (!test_bit(HCI_UP, &hdev->flags))
845 goto done;
846
847 /* Drop queues */
848 skb_queue_purge(&hdev->rx_q);
849 skb_queue_purge(&hdev->cmd_q);
850
09fd0de5 851 hci_dev_lock(hdev);
1da177e4
LT		 852 inquiry_cache_flush(hdev);
853 hci_conn_hash_flush(hdev);
09fd0de5 854 hci_dev_unlock(hdev);
1da177e4
LT		 855
856 if (hdev->flush)
857 hdev->flush(hdev);
858
8e87d142 859 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 860 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 861
862 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 863 ret = __hci_request(hdev, hci_reset_req, 0,
864 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 865
866done:
1da177e4
LT		 867 hci_req_unlock(hdev);
868 hci_dev_put(hdev);
869 return ret;
870}
871
872int hci_dev_reset_stat(__u16 dev)
873{
874 struct hci_dev *hdev;
875 int ret = 0;
876
70f23020
AE		 877 hdev = hci_dev_get(dev);
878 if (!hdev)
1da177e4
LT		 879 return -ENODEV;
880
881 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
882
883 hci_dev_put(hdev);
884
885 return ret;
886}
887
888int hci_dev_cmd(unsigned int cmd, void __user *arg)
889{
890 struct hci_dev *hdev;
891 struct hci_dev_req dr;
892 int err = 0;
893
894 if (copy_from_user(&dr, arg, sizeof(dr)))
895 return -EFAULT;
896
70f23020
AE		 897 hdev = hci_dev_get(dr.dev_id);
898 if (!hdev)
1da177e4
LT		 899 return -ENODEV;
900
901 switch (cmd) {
902 case HCISETAUTH:
04837f64
MH		 903 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
904 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 905 break;
906
907 case HCISETENCRYPT:
908 if (!lmp_encrypt_capable(hdev)) {
909 err = -EOPNOTSUPP;
910 break;
911 }
912
913 if (!test_bit(HCI_AUTH, &hdev->flags)) {
914 /* Auth must be enabled first */
04837f64
MH		 915 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
916 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 917 if (err)
918 break;
919 }
920
04837f64
MH		 921 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
922 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 923 break;
924
925 case HCISETSCAN:
04837f64
MH		 926 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
927 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 928 break;
929
1da177e4 930 case HCISETLINKPOL:
e4e8e37c
MH		 931 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
932 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 933 break;
934
935 case HCISETLINKMODE:
e4e8e37c
MH		 936 hdev->link_mode = ((__u16) dr.dev_opt) &
937 (HCI_LM_MASTER | HCI_LM_ACCEPT);
938 break;
939
940 case HCISETPTYPE:
941 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 942 break;
943
944 case HCISETACLMTU:
e4e8e37c
MH		 945 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
946 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 947 break;
948
949 case HCISETSCOMTU:
e4e8e37c
MH		 950 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
951 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 952 break;
953
954 default:
955 err = -EINVAL;
956 break;
957 }
e4e8e37c 958
1da177e4
LT		 959 hci_dev_put(hdev);
960 return err;
961}
962
963int hci_get_dev_list(void __user *arg)
964{
8035ded4 965 struct hci_dev *hdev;
1da177e4
LT		 966 struct hci_dev_list_req *dl;
967 struct hci_dev_req *dr;
1da177e4
LT		 968 int n = 0, size, err;
969 __u16 dev_num;
970
971 if (get_user(dev_num, (__u16 __user *) arg))
972 return -EFAULT;
973
974 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
975 return -EINVAL;
976
977 size = sizeof(*dl) + dev_num * sizeof(*dr);
978
70f23020
AE		 979 dl = kzalloc(size, GFP_KERNEL);
980 if (!dl)
1da177e4
LT		 981 return -ENOMEM;
982
983 dr = dl->dev_req;
984
f20d09d5 985 read_lock(&hci_dev_list_lock);
8035ded4 986 list_for_each_entry(hdev, &hci_dev_list, list) {
a8b2d5c2 987 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
e0f9309f 988 cancel_delayed_work(&hdev->power_off);
c542a06c 989
a8b2d5c2
JH		 990 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
991 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 992
1da177e4
LT		 993 (dr + n)->dev_id = hdev->id;
994 (dr + n)->dev_opt = hdev->flags;
c542a06c 995
1da177e4
LT		 996 if (++n >= dev_num)
997 break;
998 }
f20d09d5 999 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 1000
1001 dl->dev_num = n;
1002 size = sizeof(*dl) + n * sizeof(*dr);
1003
1004 err = copy_to_user(arg, dl, size);
1005 kfree(dl);
1006
1007 return err ? -EFAULT : 0;
1008}
1009
1010int hci_get_dev_info(void __user *arg)
1011{
1012 struct hci_dev *hdev;
1013 struct hci_dev_info di;
1014 int err = 0;
1015
1016 if (copy_from_user(&di, arg, sizeof(di)))
1017 return -EFAULT;
1018
70f23020
AE		 1019 hdev = hci_dev_get(di.dev_id);
1020 if (!hdev)
1da177e4
LT		 1021 return -ENODEV;
1022
a8b2d5c2 1023 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
3243553f 1024 cancel_delayed_work_sync(&hdev->power_off);
ab81cbf9 1025
a8b2d5c2
JH		 1026 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1027 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1028
1da177e4
LT		 1029 strcpy(di.name, hdev->name);
1030 di.bdaddr = hdev->bdaddr;
943da25d 1031 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 1032 di.flags = hdev->flags;
1033 di.pkt_type = hdev->pkt_type;
1034 di.acl_mtu = hdev->acl_mtu;
1035 di.acl_pkts = hdev->acl_pkts;
1036 di.sco_mtu = hdev->sco_mtu;
1037 di.sco_pkts = hdev->sco_pkts;
1038 di.link_policy = hdev->link_policy;
1039 di.link_mode = hdev->link_mode;
1040
1041 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1042 memcpy(&di.features, &hdev->features, sizeof(di.features));
1043
1044 if (copy_to_user(arg, &di, sizeof(di)))
1045 err = -EFAULT;
1046
1047 hci_dev_put(hdev);
1048
1049 return err;
1050}
1051
1052/* ---- Interface to HCI drivers ---- */
1053
611b30f7
MH		 1054static int hci_rfkill_set_block(void *data, bool blocked)
1055{
1056 struct hci_dev *hdev = data;
1057
1058 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1059
1060 if (!blocked)
1061 return 0;
1062
1063 hci_dev_do_close(hdev);
1064
1065 return 0;
1066}
1067
1068static const struct rfkill_ops hci_rfkill_ops = {
1069 .set_block = hci_rfkill_set_block,
1070};
1071
1da177e4
LT		 1072/* Alloc HCI device */
1073struct hci_dev *hci_alloc_dev(void)
1074{
1075 struct hci_dev *hdev;
1076
25ea6db0 1077 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 1078 if (!hdev)
1079 return NULL;
1080
0ac7e700 1081 hci_init_sysfs(hdev);
1da177e4
LT		 1082 skb_queue_head_init(&hdev->driver_init);
1083
1084 return hdev;
1085}
1086EXPORT_SYMBOL(hci_alloc_dev);
1087
1088/* Free HCI device */
1089void hci_free_dev(struct hci_dev *hdev)
1090{
1091 skb_queue_purge(&hdev->driver_init);
1092
a91f2e39
MH		 1093 /* will free via device release */
1094 put_device(&hdev->dev);
1da177e4
LT		 1095}
1096EXPORT_SYMBOL(hci_free_dev);
1097
ab81cbf9
JH		 1098static void hci_power_on(struct work_struct *work)
1099{
1100 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1101
1102 BT_DBG("%s", hdev->name);
1103
1104 if (hci_dev_open(hdev->id) < 0)
1105 return;
1106
a8b2d5c2 1107 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
80b7ab33 1108 schedule_delayed_work(&hdev->power_off,
3243553f 1109 msecs_to_jiffies(AUTO_OFF_TIMEOUT));
ab81cbf9 1110
a8b2d5c2 1111 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
744cf19e 1112 mgmt_index_added(hdev);
ab81cbf9
JH		 1113}
1114
1115static void hci_power_off(struct work_struct *work)
1116{
3243553f
JH		 1117 struct hci_dev *hdev = container_of(work, struct hci_dev,
1118 power_off.work);
ab81cbf9
JH		 1119
1120 BT_DBG("%s", hdev->name);
1121
a8b2d5c2 1122 clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
ab81cbf9 1123
3243553f 1124 hci_dev_close(hdev->id);
ab81cbf9
JH		 1125}
1126
16ab91ab
JH		 1127static void hci_discov_off(struct work_struct *work)
1128{
1129 struct hci_dev *hdev;
1130 u8 scan = SCAN_PAGE;
1131
1132 hdev = container_of(work, struct hci_dev, discov_off.work);
1133
1134 BT_DBG("%s", hdev->name);
1135
09fd0de5 1136 hci_dev_lock(hdev);
16ab91ab
JH		 1137
1138 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1139
1140 hdev->discov_timeout = 0;
1141
09fd0de5 1142 hci_dev_unlock(hdev);
16ab91ab
JH		 1143}
1144
2aeb9a1a
JH		 1145int hci_uuids_clear(struct hci_dev *hdev)
1146{
1147 struct list_head *p, *n;
1148
1149 list_for_each_safe(p, n, &hdev->uuids) {
1150 struct bt_uuid *uuid;
1151
1152 uuid = list_entry(p, struct bt_uuid, list);
1153
1154 list_del(p);
1155 kfree(uuid);
1156 }
1157
1158 return 0;
1159}
1160
55ed8ca1
JH		 1161int hci_link_keys_clear(struct hci_dev *hdev)
1162{
1163 struct list_head *p, *n;
1164
1165 list_for_each_safe(p, n, &hdev->link_keys) {
1166 struct link_key *key;
1167
1168 key = list_entry(p, struct link_key, list);
1169
1170 list_del(p);
1171 kfree(key);
1172 }
1173
1174 return 0;
1175}
1176
b899efaf
VCG		 1177int hci_smp_ltks_clear(struct hci_dev *hdev)
1178{
1179 struct smp_ltk *k, *tmp;
1180
1181 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1182 list_del(&k->list);
1183 kfree(k);
1184 }
1185
1186 return 0;
1187}
1188
55ed8ca1
JH		 1189struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1190{
8035ded4 1191 struct link_key *k;
55ed8ca1 1192
8035ded4 1193 list_for_each_entry(k, &hdev->link_keys, list)
55ed8ca1
JH		 1194 if (bacmp(bdaddr, &k->bdaddr) == 0)
1195 return k;
55ed8ca1
JH		 1196
1197 return NULL;
1198}
1199
d25e28ab
JH		 1200static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1201 u8 key_type, u8 old_key_type)
1202{
1203 /* Legacy key */
1204 if (key_type < 0x03)
1205 return 1;
1206
1207 /* Debug keys are insecure so don't store them persistently */
1208 if (key_type == HCI_LK_DEBUG_COMBINATION)
1209 return 0;
1210
1211 /* Changed combination key and there's no previous one */
1212 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1213 return 0;
1214
1215 /* Security mode 3 case */
1216 if (!conn)
1217 return 1;
1218
1219 /* Neither local nor remote side had no-bonding as requirement */
1220 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1221 return 1;
1222
1223 /* Local side had dedicated bonding as requirement */
1224 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1225 return 1;
1226
1227 /* Remote side had dedicated bonding as requirement */
1228 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1229 return 1;
1230
1231 /* If none of the above criteria match, then don't store the key
1232 * persistently */
1233 return 0;
1234}
1235
c9839a11 1236struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
75d262c2 1237{
c9839a11 1238 struct smp_ltk *k;
75d262c2 1239
c9839a11
VCG		 1240 list_for_each_entry(k, &hdev->long_term_keys, list) {
1241 if (k->ediv != ediv ||
1242 memcmp(rand, k->rand, sizeof(k->rand)))
75d262c2
VCG		 1243 continue;
1244
c9839a11 1245 return k;
75d262c2
VCG		 1246 }
1247
1248 return NULL;
1249}
1250EXPORT_SYMBOL(hci_find_ltk);
1251
c9839a11
VCG		 1252struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1253 u8 addr_type)
75d262c2 1254{
c9839a11 1255 struct smp_ltk *k;
75d262c2 1256
c9839a11
VCG		 1257 list_for_each_entry(k, &hdev->long_term_keys, list)
1258 if (addr_type == k->bdaddr_type &&
1259 bacmp(bdaddr, &k->bdaddr) == 0)
75d262c2
VCG		 1260 return k;
1261
1262 return NULL;
1263}
c9839a11 1264EXPORT_SYMBOL(hci_find_ltk_by_addr);
75d262c2 1265
d25e28ab
JH		 1266int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1267 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1268{
1269 struct link_key *key, *old_key;
4df378a1 1270 u8 old_key_type, persistent;
55ed8ca1
JH		 1271
1272 old_key = hci_find_link_key(hdev, bdaddr);
1273 if (old_key) {
1274 old_key_type = old_key->type;
1275 key = old_key;
1276 } else {
12adcf3a 1277 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1278 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1279 if (!key)
1280 return -ENOMEM;
1281 list_add(&key->list, &hdev->link_keys);
1282 }
1283
1284 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1285
d25e28ab
JH		 1286 /* Some buggy controller combinations generate a changed
1287 * combination key for legacy pairing even when there's no
1288 * previous key */
1289 if (type == HCI_LK_CHANGED_COMBINATION &&
1290 (!conn || conn->remote_auth == 0xff) &&
655fe6ec 1291 old_key_type == 0xff) {
d25e28ab 1292 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1293 if (conn)
1294 conn->key_type = type;
1295 }
d25e28ab 1296
55ed8ca1
JH		 1297 bacpy(&key->bdaddr, bdaddr);
1298 memcpy(key->val, val, 16);
55ed8ca1
JH		 1299 key->pin_len = pin_len;
1300
b6020ba0 1301 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1302 key->type = old_key_type;
4748fed2
JH		 1303 else
1304 key->type = type;
1305
4df378a1
JH		 1306 if (!new_key)
1307 return 0;
1308
1309 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1310
744cf19e 1311 mgmt_new_link_key(hdev, key, persistent);
4df378a1
JH		 1312
1313 if (!persistent) {
1314 list_del(&key->list);
1315 kfree(key);
1316 }
55ed8ca1
JH		 1317
1318 return 0;
1319}
1320
c9839a11
VCG		 1321int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
1322 int new_key, u8 authenticated, u8 tk[16],
1323 u8 enc_size, u16 ediv, u8 rand[8])
75d262c2 1324{
c9839a11 1325 struct smp_ltk *key, *old_key;
75d262c2 1326
c9839a11
VCG		 1327 if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1328 return 0;
75d262c2 1329
c9839a11
VCG		 1330 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1331 if (old_key)
75d262c2 1332 key = old_key;
c9839a11
VCG		 1333 else {
1334 key = kzalloc(sizeof(*key), GFP_ATOMIC);
75d262c2
VCG		 1335 if (!key)
1336 return -ENOMEM;
c9839a11 1337 list_add(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 1338 }
1339
75d262c2 1340 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 1341 key->bdaddr_type = addr_type;
1342 memcpy(key->val, tk, sizeof(key->val));
1343 key->authenticated = authenticated;
1344 key->ediv = ediv;
1345 key->enc_size = enc_size;
1346 key->type = type;
1347 memcpy(key->rand, rand, sizeof(key->rand));
75d262c2 1348
c9839a11
VCG		 1349 if (!new_key)
1350 return 0;
75d262c2 1351
261cc5aa
VCG		 1352 if (type & HCI_SMP_LTK)
1353 mgmt_new_ltk(hdev, key, 1);
1354
75d262c2
VCG		 1355 return 0;
1356}
1357
55ed8ca1
JH		 1358int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1359{
1360 struct link_key *key;
1361
1362 key = hci_find_link_key(hdev, bdaddr);
1363 if (!key)
1364 return -ENOENT;
1365
1366 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1367
1368 list_del(&key->list);
1369 kfree(key);
1370
1371 return 0;
1372}
1373
b899efaf
VCG		 1374int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1375{
1376 struct smp_ltk *k, *tmp;
1377
1378 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1379 if (bacmp(bdaddr, &k->bdaddr))
1380 continue;
1381
1382 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1383
1384 list_del(&k->list);
1385 kfree(k);
1386 }
1387
1388 return 0;
1389}
1390
6bd32326
VT		 1391/* HCI command timer function */
1392static void hci_cmd_timer(unsigned long arg)
1393{
1394 struct hci_dev *hdev = (void *) arg;
1395
1396 BT_ERR("%s command tx timeout", hdev->name);
1397 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1398 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1399}
1400
2763eda6
SJ		 1401struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1402 bdaddr_t *bdaddr)
1403{
1404 struct oob_data *data;
1405
1406 list_for_each_entry(data, &hdev->remote_oob_data, list)
1407 if (bacmp(bdaddr, &data->bdaddr) == 0)
1408 return data;
1409
1410 return NULL;
1411}
1412
1413int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1414{
1415 struct oob_data *data;
1416
1417 data = hci_find_remote_oob_data(hdev, bdaddr);
1418 if (!data)
1419 return -ENOENT;
1420
1421 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1422
1423 list_del(&data->list);
1424 kfree(data);
1425
1426 return 0;
1427}
1428
1429int hci_remote_oob_data_clear(struct hci_dev *hdev)
1430{
1431 struct oob_data *data, *n;
1432
1433 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1434 list_del(&data->list);
1435 kfree(data);
1436 }
1437
1438 return 0;
1439}
1440
1441int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1442 u8 *randomizer)
1443{
1444 struct oob_data *data;
1445
1446 data = hci_find_remote_oob_data(hdev, bdaddr);
1447
1448 if (!data) {
1449 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1450 if (!data)
1451 return -ENOMEM;
1452
1453 bacpy(&data->bdaddr, bdaddr);
1454 list_add(&data->list, &hdev->remote_oob_data);
1455 }
1456
1457 memcpy(data->hash, hash, sizeof(data->hash));
1458 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1459
1460 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1461
1462 return 0;
1463}
1464
b2a66aad
AJ		 1465struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1466 bdaddr_t *bdaddr)
1467{
8035ded4 1468 struct bdaddr_list *b;
b2a66aad 1469
8035ded4 1470 list_for_each_entry(b, &hdev->blacklist, list)
b2a66aad
AJ		 1471 if (bacmp(bdaddr, &b->bdaddr) == 0)
1472 return b;
b2a66aad
AJ		 1473
1474 return NULL;
1475}
1476
1477int hci_blacklist_clear(struct hci_dev *hdev)
1478{
1479 struct list_head *p, *n;
1480
1481 list_for_each_safe(p, n, &hdev->blacklist) {
1482 struct bdaddr_list *b;
1483
1484 b = list_entry(p, struct bdaddr_list, list);
1485
1486 list_del(p);
1487 kfree(b);
1488 }
1489
1490 return 0;
1491}
1492
88c1fe4b 1493int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 1494{
1495 struct bdaddr_list *entry;
b2a66aad
AJ		 1496
1497 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1498 return -EBADF;
1499
5e762444
AJ		 1500 if (hci_blacklist_lookup(hdev, bdaddr))
1501 return -EEXIST;
b2a66aad
AJ		 1502
1503 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
5e762444
AJ		 1504 if (!entry)
1505 return -ENOMEM;
b2a66aad
AJ		 1506
1507 bacpy(&entry->bdaddr, bdaddr);
1508
1509 list_add(&entry->list, &hdev->blacklist);
1510
88c1fe4b 1511 return mgmt_device_blocked(hdev, bdaddr, type);
b2a66aad
AJ		 1512}
1513
88c1fe4b 1514int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 1515{
1516 struct bdaddr_list *entry;
b2a66aad 1517
1ec918ce 1518 if (bacmp(bdaddr, BDADDR_ANY) == 0)
5e762444 1519 return hci_blacklist_clear(hdev);
b2a66aad
AJ		 1520
1521 entry = hci_blacklist_lookup(hdev, bdaddr);
1ec918ce 1522 if (!entry)
5e762444 1523 return -ENOENT;
b2a66aad
AJ		 1524
1525 list_del(&entry->list);
1526 kfree(entry);
1527
88c1fe4b 1528 return mgmt_device_unblocked(hdev, bdaddr, type);
b2a66aad
AJ		 1529}
1530
db323f2f 1531static void hci_clear_adv_cache(struct work_struct *work)
35815085 1532{
db323f2f
GP		 1533 struct hci_dev *hdev = container_of(work, struct hci_dev,
1534 adv_work.work);
35815085
AG		 1535
1536 hci_dev_lock(hdev);
1537
1538 hci_adv_entries_clear(hdev);
1539
1540 hci_dev_unlock(hdev);
1541}
1542
76c8686f
AG		 1543int hci_adv_entries_clear(struct hci_dev *hdev)
1544{
1545 struct adv_entry *entry, *tmp;
1546
1547 list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1548 list_del(&entry->list);
1549 kfree(entry);
1550 }
1551
1552 BT_DBG("%s adv cache cleared", hdev->name);
1553
1554 return 0;
1555}
1556
1557struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1558{
1559 struct adv_entry *entry;
1560
1561 list_for_each_entry(entry, &hdev->adv_entries, list)
1562 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1563 return entry;
1564
1565 return NULL;
1566}
1567
1568static inline int is_connectable_adv(u8 evt_type)
1569{
1570 if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1571 return 1;
1572
1573 return 0;
1574}
1575
1576int hci_add_adv_entry(struct hci_dev *hdev,
1577 struct hci_ev_le_advertising_info *ev)
1578{
1579 struct adv_entry *entry;
1580
1581 if (!is_connectable_adv(ev->evt_type))
1582 return -EINVAL;
1583
1584 /* Only new entries should be added to adv_entries. So, if
1585 * bdaddr was found, don't add it. */
1586 if (hci_find_adv_entry(hdev, &ev->bdaddr))
1587 return 0;
1588
4777bfde 1589 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
76c8686f
AG		 1590 if (!entry)
1591 return -ENOMEM;
1592
1593 bacpy(&entry->bdaddr, &ev->bdaddr);
1594 entry->bdaddr_type = ev->bdaddr_type;
1595
1596 list_add(&entry->list, &hdev->adv_entries);
1597
1598 BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1599 batostr(&entry->bdaddr), entry->bdaddr_type);
1600
1601 return 0;
1602}
1603
7ba8b4be
AG		 1604static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
1605{
1606 struct le_scan_params *param = (struct le_scan_params *) opt;
1607 struct hci_cp_le_set_scan_param cp;
1608
1609 memset(&cp, 0, sizeof(cp));
1610 cp.type = param->type;
1611 cp.interval = cpu_to_le16(param->interval);
1612 cp.window = cpu_to_le16(param->window);
1613
1614 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
1615}
1616
1617static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
1618{
1619 struct hci_cp_le_set_scan_enable cp;
1620
1621 memset(&cp, 0, sizeof(cp));
1622 cp.enable = 1;
1623
1624 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1625}
1626
1627static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
1628 u16 window, int timeout)
1629{
1630 long timeo = msecs_to_jiffies(3000);
1631 struct le_scan_params param;
1632 int err;
1633
1634 BT_DBG("%s", hdev->name);
1635
1636 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1637 return -EINPROGRESS;
1638
1639 param.type = type;
1640 param.interval = interval;
1641 param.window = window;
1642
1643 hci_req_lock(hdev);
1644
1645 err = __hci_request(hdev, le_scan_param_req, (unsigned long) &param,
1646 timeo);
1647 if (!err)
1648 err = __hci_request(hdev, le_scan_enable_req, 0, timeo);
1649
1650 hci_req_unlock(hdev);
1651
1652 if (err < 0)
1653 return err;
1654
1655 schedule_delayed_work(&hdev->le_scan_disable,
1656 msecs_to_jiffies(timeout));
1657
1658 return 0;
1659}
1660
1661static void le_scan_disable_work(struct work_struct *work)
1662{
1663 struct hci_dev *hdev = container_of(work, struct hci_dev,
1664 le_scan_disable.work);
1665 struct hci_cp_le_set_scan_enable cp;
1666
1667 BT_DBG("%s", hdev->name);
1668
1669 memset(&cp, 0, sizeof(cp));
1670
1671 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1672}
1673
28b75a89
AG		 1674static void le_scan_work(struct work_struct *work)
1675{
1676 struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
1677 struct le_scan_params *param = &hdev->le_scan_params;
1678
1679 BT_DBG("%s", hdev->name);
1680
1681 hci_do_le_scan(hdev, param->type, param->interval,
1682 param->window, param->timeout);
1683}
1684
1685int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
1686 int timeout)
1687{
1688 struct le_scan_params *param = &hdev->le_scan_params;
1689
1690 BT_DBG("%s", hdev->name);
1691
1692 if (work_busy(&hdev->le_scan))
1693 return -EINPROGRESS;
1694
1695 param->type = type;
1696 param->interval = interval;
1697 param->window = window;
1698 param->timeout = timeout;
1699
1700 queue_work(system_long_wq, &hdev->le_scan);
1701
1702 return 0;
1703}
1704
1da177e4
LT		 1705/* Register HCI device */
1706int hci_register_dev(struct hci_dev *hdev)
1707{
1708 struct list_head *head = &hci_dev_list, *p;
08add513 1709 int i, id, error;
1da177e4 1710
e9b9cfa1 1711 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1712
010666a1 1713 if (!hdev->open || !hdev->close)
1da177e4
LT		 1714 return -EINVAL;
1715
08add513
MM		 1716 /* Do not allow HCI_AMP devices to register at index 0,
1717 * so the index can be used as the AMP controller ID.
1718 */
1719 id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
1720
f20d09d5 1721 write_lock(&hci_dev_list_lock);
1da177e4
LT		 1722
1723 /* Find first available device id */
1724 list_for_each(p, &hci_dev_list) {
1725 if (list_entry(p, struct hci_dev, list)->id != id)
1726 break;
1727 head = p; id++;
1728 }
8e87d142 1729
1da177e4
LT		 1730 sprintf(hdev->name, "hci%d", id);
1731 hdev->id = id;
c6feeb28 1732 list_add_tail(&hdev->list, head);
1da177e4 1733
09fd0de5 1734 mutex_init(&hdev->lock);
1da177e4
LT		 1735
1736 hdev->flags = 0;
d23264a8 1737 hdev->dev_flags = 0;
1da177e4 1738 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 1739 hdev->esco_type = (ESCO_HV1);
1da177e4 1740 hdev->link_mode = (HCI_LM_ACCEPT);
17fa4b9d 1741 hdev->io_capability = 0x03; /* No Input No Output */
1da177e4 1742
04837f64
MH		 1743 hdev->idle_timeout = 0;
1744 hdev->sniff_max_interval = 800;
1745 hdev->sniff_min_interval = 80;
1746
b78752cc 1747 INIT_WORK(&hdev->rx_work, hci_rx_work);
c347b765 1748 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3eff45ea 1749 INIT_WORK(&hdev->tx_work, hci_tx_work);
b78752cc 1750
1da177e4
LT		 1751
1752 skb_queue_head_init(&hdev->rx_q);
1753 skb_queue_head_init(&hdev->cmd_q);
1754 skb_queue_head_init(&hdev->raw_q);
1755
6bd32326
VT		 1756 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1757
cd4c5391 1758 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1759 hdev->reassembly[i] = NULL;
1760
1da177e4 1761 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 1762 mutex_init(&hdev->req_lock);
1da177e4 1763
30883512 1764 discovery_init(hdev);
1da177e4
LT		 1765
1766 hci_conn_hash_init(hdev);
1767
2e58ef3e
JH		 1768 INIT_LIST_HEAD(&hdev->mgmt_pending);
1769
ea4bd8ba 1770 INIT_LIST_HEAD(&hdev->blacklist);
f0358568 1771
2aeb9a1a
JH		 1772 INIT_LIST_HEAD(&hdev->uuids);
1773
55ed8ca1 1774 INIT_LIST_HEAD(&hdev->link_keys);
b899efaf 1775 INIT_LIST_HEAD(&hdev->long_term_keys);
55ed8ca1 1776
2763eda6
SJ		 1777 INIT_LIST_HEAD(&hdev->remote_oob_data);
1778
76c8686f
AG		 1779 INIT_LIST_HEAD(&hdev->adv_entries);
1780
db323f2f 1781 INIT_DELAYED_WORK(&hdev->adv_work, hci_clear_adv_cache);
ab81cbf9 1782 INIT_WORK(&hdev->power_on, hci_power_on);
3243553f 1783 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
ab81cbf9 1784
16ab91ab
JH		 1785 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1786
1da177e4
LT		 1787 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1788
1789 atomic_set(&hdev->promisc, 0);
1790
28b75a89
AG		 1791 INIT_WORK(&hdev->le_scan, le_scan_work);
1792
7ba8b4be
AG		 1793 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
1794
f20d09d5 1795 write_unlock(&hci_dev_list_lock);
1da177e4 1796
32845eb1
GP		 1797 hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
1798 WQ_MEM_RECLAIM, 1);
33ca954d
DH		 1799 if (!hdev->workqueue) {
1800 error = -ENOMEM;
1801 goto err;
1802 }
f48fd9c8 1803
33ca954d
DH		 1804 error = hci_add_sysfs(hdev);
1805 if (error < 0)
1806 goto err_wqueue;
1da177e4 1807
611b30f7
MH		 1808 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1809 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1810 if (hdev->rfkill) {
1811 if (rfkill_register(hdev->rfkill) < 0) {
1812 rfkill_destroy(hdev->rfkill);
1813 hdev->rfkill = NULL;
1814 }
1815 }
1816
a8b2d5c2
JH		 1817 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
1818 set_bit(HCI_SETUP, &hdev->dev_flags);
7f971041 1819 schedule_work(&hdev->power_on);
ab81cbf9 1820
1da177e4 1821 hci_notify(hdev, HCI_DEV_REG);
dc946bd8 1822 hci_dev_hold(hdev);
1da177e4
LT		 1823
1824 return id;
f48fd9c8 1825
33ca954d
DH		 1826err_wqueue:
1827 destroy_workqueue(hdev->workqueue);
1828err:
f20d09d5 1829 write_lock(&hci_dev_list_lock);
f48fd9c8 1830 list_del(&hdev->list);
f20d09d5 1831 write_unlock(&hci_dev_list_lock);
f48fd9c8 1832
33ca954d 1833 return error;
1da177e4
LT		 1834}
1835EXPORT_SYMBOL(hci_register_dev);
1836
1837/* Unregister HCI device */
59735631 1838void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 1839{
ef222013
MH		 1840 int i;
1841
c13854ce 1842 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1843
f20d09d5 1844 write_lock(&hci_dev_list_lock);
1da177e4 1845 list_del(&hdev->list);
f20d09d5 1846 write_unlock(&hci_dev_list_lock);
1da177e4
LT		 1847
1848 hci_dev_do_close(hdev);
1849
cd4c5391 1850 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1851 kfree_skb(hdev->reassembly[i]);
1852
ab81cbf9 1853 if (!test_bit(HCI_INIT, &hdev->flags) &&
a8b2d5c2 1854 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
09fd0de5 1855 hci_dev_lock(hdev);
744cf19e 1856 mgmt_index_removed(hdev);
09fd0de5 1857 hci_dev_unlock(hdev);
56e5cb86 1858 }
ab81cbf9 1859
2e58ef3e
JH		 1860 /* mgmt_index_removed should take care of emptying the
1861 * pending list */
1862 BUG_ON(!list_empty(&hdev->mgmt_pending));
1863
1da177e4
LT		 1864 hci_notify(hdev, HCI_DEV_UNREG);
1865
611b30f7
MH		 1866 if (hdev->rfkill) {
1867 rfkill_unregister(hdev->rfkill);
1868 rfkill_destroy(hdev->rfkill);
1869 }
1870
ce242970 1871 hci_del_sysfs(hdev);
147e2d59 1872
db323f2f 1873 cancel_delayed_work_sync(&hdev->adv_work);
c6f3c5f7 1874
f48fd9c8
MH		 1875 destroy_workqueue(hdev->workqueue);
1876
09fd0de5 1877 hci_dev_lock(hdev);
e2e0cacb 1878 hci_blacklist_clear(hdev);
2aeb9a1a 1879 hci_uuids_clear(hdev);
55ed8ca1 1880 hci_link_keys_clear(hdev);
b899efaf 1881 hci_smp_ltks_clear(hdev);
2763eda6 1882 hci_remote_oob_data_clear(hdev);
76c8686f 1883 hci_adv_entries_clear(hdev);
09fd0de5 1884 hci_dev_unlock(hdev);
e2e0cacb 1885
dc946bd8 1886 hci_dev_put(hdev);
1da177e4
LT		 1887}
1888EXPORT_SYMBOL(hci_unregister_dev);
1889
1890/* Suspend HCI device */
1891int hci_suspend_dev(struct hci_dev *hdev)
1892{
1893 hci_notify(hdev, HCI_DEV_SUSPEND);
1894 return 0;
1895}
1896EXPORT_SYMBOL(hci_suspend_dev);
1897
1898/* Resume HCI device */
1899int hci_resume_dev(struct hci_dev *hdev)
1900{
1901 hci_notify(hdev, HCI_DEV_RESUME);
1902 return 0;
1903}
1904EXPORT_SYMBOL(hci_resume_dev);
1905
76bca880
MH		 1906/* Receive frame from HCI drivers */
1907int hci_recv_frame(struct sk_buff *skb)
1908{
1909 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1910 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1911 && !test_bit(HCI_INIT, &hdev->flags))) {
1912 kfree_skb(skb);
1913 return -ENXIO;
1914 }
1915
1916 /* Incomming skb */
1917 bt_cb(skb)->incoming = 1;
1918
1919 /* Time stamp */
1920 __net_timestamp(skb);
1921
76bca880 1922 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 1923 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 1924
76bca880
MH		 1925 return 0;
1926}
1927EXPORT_SYMBOL(hci_recv_frame);
1928
33e882a5 1929static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1e429f38 1930 int count, __u8 index)
33e882a5
SS		 1931{
1932 int len = 0;
1933 int hlen = 0;
1934 int remain = count;
1935 struct sk_buff *skb;
1936 struct bt_skb_cb *scb;
1937
1938 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1939 index >= NUM_REASSEMBLY)
1940 return -EILSEQ;
1941
1942 skb = hdev->reassembly[index];
1943
1944 if (!skb) {
1945 switch (type) {
1946 case HCI_ACLDATA_PKT:
1947 len = HCI_MAX_FRAME_SIZE;
1948 hlen = HCI_ACL_HDR_SIZE;
1949 break;
1950 case HCI_EVENT_PKT:
1951 len = HCI_MAX_EVENT_SIZE;
1952 hlen = HCI_EVENT_HDR_SIZE;
1953 break;
1954 case HCI_SCODATA_PKT:
1955 len = HCI_MAX_SCO_SIZE;
1956 hlen = HCI_SCO_HDR_SIZE;
1957 break;
1958 }
1959
1e429f38 1960 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 1961 if (!skb)
1962 return -ENOMEM;
1963
1964 scb = (void *) skb->cb;
1965 scb->expect = hlen;
1966 scb->pkt_type = type;
1967
1968 skb->dev = (void *) hdev;
1969 hdev->reassembly[index] = skb;
1970 }
1971
1972 while (count) {
1973 scb = (void *) skb->cb;
1974 len = min(scb->expect, (__u16)count);
1975
1976 memcpy(skb_put(skb, len), data, len);
1977
1978 count -= len;
1979 data += len;
1980 scb->expect -= len;
1981 remain = count;
1982
1983 switch (type) {
1984 case HCI_EVENT_PKT:
1985 if (skb->len == HCI_EVENT_HDR_SIZE) {
1986 struct hci_event_hdr *h = hci_event_hdr(skb);
1987 scb->expect = h->plen;
1988
1989 if (skb_tailroom(skb) < scb->expect) {
1990 kfree_skb(skb);
1991 hdev->reassembly[index] = NULL;
1992 return -ENOMEM;
1993 }
1994 }
1995 break;
1996
1997 case HCI_ACLDATA_PKT:
1998 if (skb->len == HCI_ACL_HDR_SIZE) {
1999 struct hci_acl_hdr *h = hci_acl_hdr(skb);
2000 scb->expect = __le16_to_cpu(h->dlen);
2001
2002 if (skb_tailroom(skb) < scb->expect) {
2003 kfree_skb(skb);
2004 hdev->reassembly[index] = NULL;
2005 return -ENOMEM;
2006 }
2007 }
2008 break;
2009
2010 case HCI_SCODATA_PKT:
2011 if (skb->len == HCI_SCO_HDR_SIZE) {
2012 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2013 scb->expect = h->dlen;
2014
2015 if (skb_tailroom(skb) < scb->expect) {
2016 kfree_skb(skb);
2017 hdev->reassembly[index] = NULL;
2018 return -ENOMEM;
2019 }
2020 }
2021 break;
2022 }
2023
2024 if (scb->expect == 0) {
2025 /* Complete frame */
2026
2027 bt_cb(skb)->pkt_type = type;
2028 hci_recv_frame(skb);
2029
2030 hdev->reassembly[index] = NULL;
2031 return remain;
2032 }
2033 }
2034
2035 return remain;
2036}
2037
ef222013
MH		 2038int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2039{
f39a3c06
SS		 2040 int rem = 0;
2041
ef222013
MH		 2042 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2043 return -EILSEQ;
2044
da5f6c37 2045 while (count) {
1e429f38 2046 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 2047 if (rem < 0)
2048 return rem;
ef222013 2049
f39a3c06
SS		 2050 data += (count - rem);
2051 count = rem;
f81c6224 2052 }
ef222013 2053
f39a3c06 2054 return rem;
ef222013
MH		 2055}
2056EXPORT_SYMBOL(hci_recv_fragment);
2057
99811510
SS		 2058#define STREAM_REASSEMBLY 0
2059
2060int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2061{
2062 int type;
2063 int rem = 0;
2064
da5f6c37 2065 while (count) {
99811510
SS		 2066 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2067
2068 if (!skb) {
2069 struct { char type; } *pkt;
2070
2071 /* Start of the frame */
2072 pkt = data;
2073 type = pkt->type;
2074
2075 data++;
2076 count--;
2077 } else
2078 type = bt_cb(skb)->pkt_type;
2079
1e429f38
GP		 2080 rem = hci_reassembly(hdev, type, data, count,
2081 STREAM_REASSEMBLY);
99811510
SS		 2082 if (rem < 0)
2083 return rem;
2084
2085 data += (count - rem);
2086 count = rem;
f81c6224 2087 }
99811510
SS		 2088
2089 return rem;
2090}
2091EXPORT_SYMBOL(hci_recv_stream_fragment);
2092
1da177e4
LT		 2093/* ---- Interface to upper protocols ---- */
2094
1da177e4
LT		 2095int hci_register_cb(struct hci_cb *cb)
2096{
2097 BT_DBG("%p name %s", cb, cb->name);
2098
f20d09d5 2099 write_lock(&hci_cb_list_lock);
1da177e4 2100 list_add(&cb->list, &hci_cb_list);
f20d09d5 2101 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2102
2103 return 0;
2104}
2105EXPORT_SYMBOL(hci_register_cb);
2106
2107int hci_unregister_cb(struct hci_cb *cb)
2108{
2109 BT_DBG("%p name %s", cb, cb->name);
2110
f20d09d5 2111 write_lock(&hci_cb_list_lock);
1da177e4 2112 list_del(&cb->list);
f20d09d5 2113 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2114
2115 return 0;
2116}
2117EXPORT_SYMBOL(hci_unregister_cb);
2118
2119static int hci_send_frame(struct sk_buff *skb)
2120{
2121 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2122
2123 if (!hdev) {
2124 kfree_skb(skb);
2125 return -ENODEV;
2126 }
2127
0d48d939 2128 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 2129
2130 if (atomic_read(&hdev->promisc)) {
2131 /* Time stamp */
a61bbcf2 2132 __net_timestamp(skb);
1da177e4 2133
eec8d2bc 2134 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 2135 }
2136
2137 /* Get rid of skb owner, prior to sending to the driver. */
2138 skb_orphan(skb);
2139
2140 return hdev->send(skb);
2141}
2142
2143/* Send HCI command */
a9de9248 2144int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 2145{
2146 int len = HCI_COMMAND_HDR_SIZE + plen;
2147 struct hci_command_hdr *hdr;
2148 struct sk_buff *skb;
2149
a9de9248 2150 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 2151
2152 skb = bt_skb_alloc(len, GFP_ATOMIC);
2153 if (!skb) {
ef222013 2154 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 2155 return -ENOMEM;
2156 }
2157
2158 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 2159 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 2160 hdr->plen = plen;
2161
2162 if (plen)
2163 memcpy(skb_put(skb, plen), param, plen);
2164
2165 BT_DBG("skb len %d", skb->len);
2166
0d48d939 2167 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 2168 skb->dev = (void *) hdev;
c78ae283 2169
a5040efa
JH		 2170 if (test_bit(HCI_INIT, &hdev->flags))
2171 hdev->init_last_cmd = opcode;
2172
1da177e4 2173 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 2174 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 2175
2176 return 0;
2177}
1da177e4
LT		 2178
2179/* Get data from the previously sent command */
a9de9248 2180void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 2181{
2182 struct hci_command_hdr *hdr;
2183
2184 if (!hdev->sent_cmd)
2185 return NULL;
2186
2187 hdr = (void *) hdev->sent_cmd->data;
2188
a9de9248 2189 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 2190 return NULL;
2191
a9de9248 2192 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 2193
2194 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2195}
2196
2197/* Send ACL data */
2198static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2199{
2200 struct hci_acl_hdr *hdr;
2201 int len = skb->len;
2202
badff6d0
ACM		 2203 skb_push(skb, HCI_ACL_HDR_SIZE);
2204 skb_reset_transport_header(skb);
9c70220b 2205 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 2206 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2207 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 2208}
2209
73d80deb
LAD		 2210static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
2211 struct sk_buff *skb, __u16 flags)
1da177e4
LT		 2212{
2213 struct hci_dev *hdev = conn->hdev;
2214 struct sk_buff *list;
2215
70f23020
AE		 2216 list = skb_shinfo(skb)->frag_list;
2217 if (!list) {
1da177e4
LT		 2218 /* Non fragmented */
2219 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2220
73d80deb 2221 skb_queue_tail(queue, skb);
1da177e4
LT		 2222 } else {
2223 /* Fragmented */
2224 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2225
2226 skb_shinfo(skb)->frag_list = NULL;
2227
2228 /* Queue all fragments atomically */
af3e6359 2229 spin_lock(&queue->lock);
1da177e4 2230
73d80deb 2231 __skb_queue_tail(queue, skb);
e702112f
AE		 2232
2233 flags &= ~ACL_START;
2234 flags |= ACL_CONT;
1da177e4
LT		 2235 do {
2236 skb = list; list = list->next;
8e87d142 2237
1da177e4 2238 skb->dev = (void *) hdev;
0d48d939 2239 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 2240 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 2241
2242 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2243
73d80deb 2244 __skb_queue_tail(queue, skb);
1da177e4
LT		 2245 } while (list);
2246
af3e6359 2247 spin_unlock(&queue->lock);
1da177e4 2248 }
73d80deb
LAD		 2249}
2250
2251void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2252{
2253 struct hci_conn *conn = chan->conn;
2254 struct hci_dev *hdev = conn->hdev;
2255
2256 BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
2257
2258 skb->dev = (void *) hdev;
2259 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2260 hci_add_acl_hdr(skb, conn->handle, flags);
2261
2262 hci_queue_acl(conn, &chan->data_q, skb, flags);
1da177e4 2263
3eff45ea 2264 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4
LT		 2265}
2266EXPORT_SYMBOL(hci_send_acl);
2267
2268/* Send SCO data */
0d861d8b 2269void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 2270{
2271 struct hci_dev *hdev = conn->hdev;
2272 struct hci_sco_hdr hdr;
2273
2274 BT_DBG("%s len %d", hdev->name, skb->len);
2275
aca3192c 2276 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 2277 hdr.dlen = skb->len;
2278
badff6d0
ACM		 2279 skb_push(skb, HCI_SCO_HDR_SIZE);
2280 skb_reset_transport_header(skb);
9c70220b 2281 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 2282
2283 skb->dev = (void *) hdev;
0d48d939 2284 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 2285
1da177e4 2286 skb_queue_tail(&conn->data_q, skb);
3eff45ea 2287 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4
LT		 2288}
2289EXPORT_SYMBOL(hci_send_sco);
2290
2291/* ---- HCI TX task (outgoing data) ---- */
2292
2293/* HCI Connection scheduler */
2294static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2295{
2296 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2297 struct hci_conn *conn = NULL, *c;
1da177e4 2298 int num = 0, min = ~0;
1da177e4 2299
8e87d142 2300 /* We don't have to lock device here. Connections are always
1da177e4 2301 * added and removed with TX task disabled. */
bf4c6325
GP		 2302
2303 rcu_read_lock();
2304
2305 list_for_each_entry_rcu(c, &h->list, list) {
769be974 2306 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2307 continue;
769be974
MH		 2308
2309 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2310 continue;
2311
1da177e4
LT		 2312 num++;
2313
2314 if (c->sent < min) {
2315 min = c->sent;
2316 conn = c;
2317 }
52087a79
LAD		 2318
2319 if (hci_conn_num(hdev, type) == num)
2320 break;
1da177e4
LT		 2321 }
2322
bf4c6325
GP		 2323 rcu_read_unlock();
2324
1da177e4 2325 if (conn) {
6ed58ec5
VT		 2326 int cnt, q;
2327
2328 switch (conn->type) {
2329 case ACL_LINK:
2330 cnt = hdev->acl_cnt;
2331 break;
2332 case SCO_LINK:
2333 case ESCO_LINK:
2334 cnt = hdev->sco_cnt;
2335 break;
2336 case LE_LINK:
2337 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2338 break;
2339 default:
2340 cnt = 0;
2341 BT_ERR("Unknown link type");
2342 }
2343
2344 q = cnt / num;
1da177e4
LT		 2345 *quote = q ? q : 1;
2346 } else
2347 *quote = 0;
2348
2349 BT_DBG("conn %p quote %d", conn, *quote);
2350 return conn;
2351}
2352
bae1f5d9 2353static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2354{
2355 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2356 struct hci_conn *c;
1da177e4 2357
bae1f5d9 2358 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 2359
bf4c6325
GP		 2360 rcu_read_lock();
2361
1da177e4 2362 /* Kill stalled connections */
bf4c6325 2363 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9
VT		 2364 if (c->type == type && c->sent) {
2365 BT_ERR("%s killing stalled connection %s",
1da177e4
LT		 2366 hdev->name, batostr(&c->dst));
2367 hci_acl_disconn(c, 0x13);
2368 }
2369 }
bf4c6325
GP		 2370
2371 rcu_read_unlock();
1da177e4
LT		 2372}
2373
73d80deb
LAD		 2374static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2375 int *quote)
1da177e4 2376{
73d80deb
LAD		 2377 struct hci_conn_hash *h = &hdev->conn_hash;
2378 struct hci_chan *chan = NULL;
2379 int num = 0, min = ~0, cur_prio = 0;
1da177e4 2380 struct hci_conn *conn;
73d80deb
LAD		 2381 int cnt, q, conn_num = 0;
2382
2383 BT_DBG("%s", hdev->name);
2384
bf4c6325
GP		 2385 rcu_read_lock();
2386
2387 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 2388 struct hci_chan *tmp;
2389
2390 if (conn->type != type)
2391 continue;
2392
2393 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2394 continue;
2395
2396 conn_num++;
2397
8192edef 2398 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 2399 struct sk_buff *skb;
2400
2401 if (skb_queue_empty(&tmp->data_q))
2402 continue;
2403
2404 skb = skb_peek(&tmp->data_q);
2405 if (skb->priority < cur_prio)
2406 continue;
2407
2408 if (skb->priority > cur_prio) {
2409 num = 0;
2410 min = ~0;
2411 cur_prio = skb->priority;
2412 }
2413
2414 num++;
2415
2416 if (conn->sent < min) {
2417 min = conn->sent;
2418 chan = tmp;
2419 }
2420 }
2421
2422 if (hci_conn_num(hdev, type) == conn_num)
2423 break;
2424 }
2425
bf4c6325
GP		 2426 rcu_read_unlock();
2427
73d80deb
LAD		 2428 if (!chan)
2429 return NULL;
2430
2431 switch (chan->conn->type) {
2432 case ACL_LINK:
2433 cnt = hdev->acl_cnt;
2434 break;
2435 case SCO_LINK:
2436 case ESCO_LINK:
2437 cnt = hdev->sco_cnt;
2438 break;
2439 case LE_LINK:
2440 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2441 break;
2442 default:
2443 cnt = 0;
2444 BT_ERR("Unknown link type");
2445 }
2446
2447 q = cnt / num;
2448 *quote = q ? q : 1;
2449 BT_DBG("chan %p quote %d", chan, *quote);
2450 return chan;
2451}
2452
02b20f0b
LAD		 2453static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2454{
2455 struct hci_conn_hash *h = &hdev->conn_hash;
2456 struct hci_conn *conn;
2457 int num = 0;
2458
2459 BT_DBG("%s", hdev->name);
2460
bf4c6325
GP		 2461 rcu_read_lock();
2462
2463 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 2464 struct hci_chan *chan;
2465
2466 if (conn->type != type)
2467 continue;
2468
2469 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2470 continue;
2471
2472 num++;
2473
8192edef 2474 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 2475 struct sk_buff *skb;
2476
2477 if (chan->sent) {
2478 chan->sent = 0;
2479 continue;
2480 }
2481
2482 if (skb_queue_empty(&chan->data_q))
2483 continue;
2484
2485 skb = skb_peek(&chan->data_q);
2486 if (skb->priority >= HCI_PRIO_MAX - 1)
2487 continue;
2488
2489 skb->priority = HCI_PRIO_MAX - 1;
2490
2491 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2492 skb->priority);
2493 }
2494
2495 if (hci_conn_num(hdev, type) == num)
2496 break;
2497 }
bf4c6325
GP		 2498
2499 rcu_read_unlock();
2500
02b20f0b
LAD		 2501}
2502
b71d385a
AE		 2503static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
2504{
2505 /* Calculate count of blocks used by this packet */
2506 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
2507}
2508
63d2bc1b 2509static inline void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 2510{
1da177e4
LT		 2511 if (!test_bit(HCI_RAW, &hdev->flags)) {
2512 /* ACL tx timeout must be longer than maximum
2513 * link supervision timeout (40.9 seconds) */
63d2bc1b 2514 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
cc48dc0a 2515 msecs_to_jiffies(HCI_ACL_TX_TIMEOUT)))
bae1f5d9 2516 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 2517 }
63d2bc1b 2518}
1da177e4 2519
63d2bc1b
AE		 2520static inline void hci_sched_acl_pkt(struct hci_dev *hdev)
2521{
2522 unsigned int cnt = hdev->acl_cnt;
2523 struct hci_chan *chan;
2524 struct sk_buff *skb;
2525 int quote;
2526
2527 __check_timeout(hdev, cnt);
04837f64 2528
73d80deb
LAD		 2529 while (hdev->acl_cnt &&
2530 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 2531 u32 priority = (skb_peek(&chan->data_q))->priority;
2532 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb
LAD		 2533 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2534 skb->len, skb->priority);
2535
ec1cce24
LAD		 2536 /* Stop if priority has changed */
2537 if (skb->priority < priority)
2538 break;
2539
2540 skb = skb_dequeue(&chan->data_q);
2541
73d80deb
LAD		 2542 hci_conn_enter_active_mode(chan->conn,
2543 bt_cb(skb)->force_active);
04837f64 2544
1da177e4
LT		 2545 hci_send_frame(skb);
2546 hdev->acl_last_tx = jiffies;
2547
2548 hdev->acl_cnt--;
73d80deb
LAD		 2549 chan->sent++;
2550 chan->conn->sent++;
1da177e4
LT		 2551 }
2552 }
02b20f0b
LAD		 2553
2554 if (cnt != hdev->acl_cnt)
2555 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 2556}
2557
b71d385a
AE		 2558static inline void hci_sched_acl_blk(struct hci_dev *hdev)
2559{
63d2bc1b 2560 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 2561 struct hci_chan *chan;
2562 struct sk_buff *skb;
2563 int quote;
b71d385a 2564
63d2bc1b 2565 __check_timeout(hdev, cnt);
b71d385a
AE		 2566
2567 while (hdev->block_cnt > 0 &&
2568 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2569 u32 priority = (skb_peek(&chan->data_q))->priority;
2570 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
2571 int blocks;
2572
2573 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2574 skb->len, skb->priority);
2575
2576 /* Stop if priority has changed */
2577 if (skb->priority < priority)
2578 break;
2579
2580 skb = skb_dequeue(&chan->data_q);
2581
2582 blocks = __get_blocks(hdev, skb);
2583 if (blocks > hdev->block_cnt)
2584 return;
2585
2586 hci_conn_enter_active_mode(chan->conn,
2587 bt_cb(skb)->force_active);
2588
2589 hci_send_frame(skb);
2590 hdev->acl_last_tx = jiffies;
2591
2592 hdev->block_cnt -= blocks;
2593 quote -= blocks;
2594
2595 chan->sent += blocks;
2596 chan->conn->sent += blocks;
2597 }
2598 }
2599
2600 if (cnt != hdev->block_cnt)
2601 hci_prio_recalculate(hdev, ACL_LINK);
2602}
2603
2604static inline void hci_sched_acl(struct hci_dev *hdev)
2605{
2606 BT_DBG("%s", hdev->name);
2607
2608 if (!hci_conn_num(hdev, ACL_LINK))
2609 return;
2610
2611 switch (hdev->flow_ctl_mode) {
2612 case HCI_FLOW_CTL_MODE_PACKET_BASED:
2613 hci_sched_acl_pkt(hdev);
2614 break;
2615
2616 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
2617 hci_sched_acl_blk(hdev);
2618 break;
2619 }
2620}
2621
1da177e4
LT		 2622/* Schedule SCO */
2623static inline void hci_sched_sco(struct hci_dev *hdev)
2624{
2625 struct hci_conn *conn;
2626 struct sk_buff *skb;
2627 int quote;
2628
2629 BT_DBG("%s", hdev->name);
2630
52087a79
LAD		 2631 if (!hci_conn_num(hdev, SCO_LINK))
2632 return;
2633
1da177e4
LT		 2634 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2635 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2636 BT_DBG("skb %p len %d", skb, skb->len);
2637 hci_send_frame(skb);
2638
2639 conn->sent++;
2640 if (conn->sent == ~0)
2641 conn->sent = 0;
2642 }
2643 }
2644}
2645
b6a0dc82
MH		 2646static inline void hci_sched_esco(struct hci_dev *hdev)
2647{
2648 struct hci_conn *conn;
2649 struct sk_buff *skb;
2650 int quote;
2651
2652 BT_DBG("%s", hdev->name);
2653
52087a79
LAD		 2654 if (!hci_conn_num(hdev, ESCO_LINK))
2655 return;
2656
b6a0dc82
MH		 2657 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2658 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2659 BT_DBG("skb %p len %d", skb, skb->len);
2660 hci_send_frame(skb);
2661
2662 conn->sent++;
2663 if (conn->sent == ~0)
2664 conn->sent = 0;
2665 }
2666 }
2667}
2668
6ed58ec5
VT		 2669static inline void hci_sched_le(struct hci_dev *hdev)
2670{
73d80deb 2671 struct hci_chan *chan;
6ed58ec5 2672 struct sk_buff *skb;
02b20f0b 2673 int quote, cnt, tmp;
6ed58ec5
VT		 2674
2675 BT_DBG("%s", hdev->name);
2676
52087a79
LAD		 2677 if (!hci_conn_num(hdev, LE_LINK))
2678 return;
2679
6ed58ec5
VT		 2680 if (!test_bit(HCI_RAW, &hdev->flags)) {
2681 /* LE tx timeout must be longer than maximum
2682 * link supervision timeout (40.9 seconds) */
bae1f5d9 2683 if (!hdev->le_cnt && hdev->le_pkts &&
6ed58ec5 2684 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 2685 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 2686 }
2687
2688 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 2689 tmp = cnt;
73d80deb 2690 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 2691 u32 priority = (skb_peek(&chan->data_q))->priority;
2692 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb
LAD		 2693 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2694 skb->len, skb->priority);
6ed58ec5 2695
ec1cce24
LAD		 2696 /* Stop if priority has changed */
2697 if (skb->priority < priority)
2698 break;
2699
2700 skb = skb_dequeue(&chan->data_q);
2701
6ed58ec5
VT		 2702 hci_send_frame(skb);
2703 hdev->le_last_tx = jiffies;
2704
2705 cnt--;
73d80deb
LAD		 2706 chan->sent++;
2707 chan->conn->sent++;
6ed58ec5
VT		 2708 }
2709 }
73d80deb 2710
6ed58ec5
VT		 2711 if (hdev->le_pkts)
2712 hdev->le_cnt = cnt;
2713 else
2714 hdev->acl_cnt = cnt;
02b20f0b
LAD		 2715
2716 if (cnt != tmp)
2717 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 2718}
2719
3eff45ea 2720static void hci_tx_work(struct work_struct *work)
1da177e4 2721{
3eff45ea 2722 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 2723 struct sk_buff *skb;
2724
6ed58ec5
VT		 2725 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2726 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 2727
2728 /* Schedule queues and send stuff to HCI driver */
2729
2730 hci_sched_acl(hdev);
2731
2732 hci_sched_sco(hdev);
2733
b6a0dc82
MH		 2734 hci_sched_esco(hdev);
2735
6ed58ec5
VT		 2736 hci_sched_le(hdev);
2737
1da177e4
LT		 2738 /* Send next queued raw (unknown type) packet */
2739 while ((skb = skb_dequeue(&hdev->raw_q)))
2740 hci_send_frame(skb);
1da177e4
LT		 2741}
2742
25985edc 2743/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 2744
2745/* ACL data packet */
2746static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2747{
2748 struct hci_acl_hdr *hdr = (void *) skb->data;
2749 struct hci_conn *conn;
2750 __u16 handle, flags;
2751
2752 skb_pull(skb, HCI_ACL_HDR_SIZE);
2753
2754 handle = __le16_to_cpu(hdr->handle);
2755 flags = hci_flags(handle);
2756 handle = hci_handle(handle);
2757
2758 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2759
2760 hdev->stat.acl_rx++;
2761
2762 hci_dev_lock(hdev);
2763 conn = hci_conn_hash_lookup_handle(hdev, handle);
2764 hci_dev_unlock(hdev);
8e87d142 2765
1da177e4 2766 if (conn) {
65983fc7 2767 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 2768
1da177e4 2769 /* Send to upper protocol */
686ebf28
UF		 2770 l2cap_recv_acldata(conn, skb, flags);
2771 return;
1da177e4 2772 } else {
8e87d142 2773 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 2774 hdev->name, handle);
2775 }
2776
2777 kfree_skb(skb);
2778}
2779
2780/* SCO data packet */
2781static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2782{
2783 struct hci_sco_hdr *hdr = (void *) skb->data;
2784 struct hci_conn *conn;
2785 __u16 handle;
2786
2787 skb_pull(skb, HCI_SCO_HDR_SIZE);
2788
2789 handle = __le16_to_cpu(hdr->handle);
2790
2791 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2792
2793 hdev->stat.sco_rx++;
2794
2795 hci_dev_lock(hdev);
2796 conn = hci_conn_hash_lookup_handle(hdev, handle);
2797 hci_dev_unlock(hdev);
2798
2799 if (conn) {
1da177e4 2800 /* Send to upper protocol */
686ebf28
UF		 2801 sco_recv_scodata(conn, skb);
2802 return;
1da177e4 2803 } else {
8e87d142 2804 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 2805 hdev->name, handle);
2806 }
2807
2808 kfree_skb(skb);
2809}
2810
b78752cc 2811static void hci_rx_work(struct work_struct *work)
1da177e4 2812{
b78752cc 2813 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 2814 struct sk_buff *skb;
2815
2816 BT_DBG("%s", hdev->name);
2817
1da177e4
LT		 2818 while ((skb = skb_dequeue(&hdev->rx_q))) {
2819 if (atomic_read(&hdev->promisc)) {
2820 /* Send copy to the sockets */
eec8d2bc 2821 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 2822 }
2823
2824 if (test_bit(HCI_RAW, &hdev->flags)) {
2825 kfree_skb(skb);
2826 continue;
2827 }
2828
2829 if (test_bit(HCI_INIT, &hdev->flags)) {
2830 /* Don't process data packets in this states. */
0d48d939 2831 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2832 case HCI_ACLDATA_PKT:
2833 case HCI_SCODATA_PKT:
2834 kfree_skb(skb);
2835 continue;
3ff50b79 2836 }
1da177e4
LT		 2837 }
2838
2839 /* Process frame */
0d48d939 2840 switch (bt_cb(skb)->pkt_type) {
1da177e4 2841 case HCI_EVENT_PKT:
b78752cc 2842 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 2843 hci_event_packet(hdev, skb);
2844 break;
2845
2846 case HCI_ACLDATA_PKT:
2847 BT_DBG("%s ACL data packet", hdev->name);
2848 hci_acldata_packet(hdev, skb);
2849 break;
2850
2851 case HCI_SCODATA_PKT:
2852 BT_DBG("%s SCO data packet", hdev->name);
2853 hci_scodata_packet(hdev, skb);
2854 break;
2855
2856 default:
2857 kfree_skb(skb);
2858 break;
2859 }
2860 }
1da177e4
LT		 2861}
2862
c347b765 2863static void hci_cmd_work(struct work_struct *work)
1da177e4 2864{
c347b765 2865 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 2866 struct sk_buff *skb;
2867
2868 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2869
1da177e4 2870 /* Send queued commands */
5a08ecce
AE		 2871 if (atomic_read(&hdev->cmd_cnt)) {
2872 skb = skb_dequeue(&hdev->cmd_q);
2873 if (!skb)
2874 return;
2875
7585b97a 2876 kfree_skb(hdev->sent_cmd);
1da177e4 2877
70f23020
AE		 2878 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2879 if (hdev->sent_cmd) {
1da177e4
LT		 2880 atomic_dec(&hdev->cmd_cnt);
2881 hci_send_frame(skb);
7bdb8a5c
SJ		 2882 if (test_bit(HCI_RESET, &hdev->flags))
2883 del_timer(&hdev->cmd_timer);
2884 else
2885 mod_timer(&hdev->cmd_timer,
6bd32326 2886 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
1da177e4
LT		 2887 } else {
2888 skb_queue_head(&hdev->cmd_q, skb);
c347b765 2889 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 2890 }
2891 }
2892}
2519a1fc
AG		 2893
2894int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2895{
2896 /* General inquiry access code (GIAC) */
2897 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2898 struct hci_cp_inquiry cp;
2899
2900 BT_DBG("%s", hdev->name);
2901
2902 if (test_bit(HCI_INQUIRY, &hdev->flags))
2903 return -EINPROGRESS;
2904
4663262c
JH		 2905 inquiry_cache_flush(hdev);
2906
2519a1fc
AG		 2907 memset(&cp, 0, sizeof(cp));
2908 memcpy(&cp.lap, lap, sizeof(cp.lap));
2909 cp.length = length;
2910
2911 return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2912}
023d5049
AG		 2913
2914int hci_cancel_inquiry(struct hci_dev *hdev)
2915{
2916 BT_DBG("%s", hdev->name);
2917
2918 if (!test_bit(HCI_INQUIRY, &hdev->flags))
2919 return -EPERM;
2920
2921 return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2922}
7784d78f
AE		 2923
2924module_param(enable_hs, bool, 0644);
2925MODULE_PARM_DESC(enable_hs, "Enable High Speed");
kernel source for telekom puls (alcatel/mediatek)