projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Refactor l2cap_send_disconn_req
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
3df92b31 29#include <linux/idr.h>
1da177e4 30
8c520a59 31#include <linux/rfkill.h>
1da177e4
LT		 32
33#include <net/bluetooth/bluetooth.h>
34#include <net/bluetooth/hci_core.h>
35
b78752cc 36static void hci_rx_work(struct work_struct *work);
c347b765 37static void hci_cmd_work(struct work_struct *work);
3eff45ea 38static void hci_tx_work(struct work_struct *work);
1da177e4 39
1da177e4
LT		 40/* HCI device list */
41LIST_HEAD(hci_dev_list);
42DEFINE_RWLOCK(hci_dev_list_lock);
43
44/* HCI callback list */
45LIST_HEAD(hci_cb_list);
46DEFINE_RWLOCK(hci_cb_list_lock);
47
3df92b31
SL		 48/* HCI ID Numbering */
49static DEFINE_IDA(hci_index_ida);
50
1da177e4
LT		 51/* ---- HCI notifications ---- */
52
6516455d 53static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 54{
040030ef 55 hci_sock_dev_event(hdev, event);
1da177e4
LT		 56}
57
58/* ---- HCI requests ---- */
59
23bb5763 60void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 61{
f0e09510 62 BT_DBG("%s command 0x%4.4x result 0x%2.2x", hdev->name, cmd, result);
23bb5763 63
a5040efa
JH		 64 /* If this is the init phase check if the completed command matches
65 * the last init command, and if not just return.
66 */
75fb0e32
JH		 67 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd) {
68 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1036b890 69 u16 opcode = __le16_to_cpu(sent->opcode);
75fb0e32
JH		 70 struct sk_buff *skb;
71
72 /* Some CSR based controllers generate a spontaneous
73 * reset complete event during init and any pending
74 * command will never be completed. In such a case we
75 * need to resend whatever was the last sent
76 * command.
77 */
78
1036b890 79 if (cmd != HCI_OP_RESET || opcode == HCI_OP_RESET)
75fb0e32
JH		 80 return;
81
82 skb = skb_clone(hdev->sent_cmd, GFP_ATOMIC);
83 if (skb) {
84 skb_queue_head(&hdev->cmd_q, skb);
85 queue_work(hdev->workqueue, &hdev->cmd_work);
86 }
87
23bb5763 88 return;
75fb0e32 89 }
1da177e4
LT		 90
91 if (hdev->req_status == HCI_REQ_PEND) {
92 hdev->req_result = result;
93 hdev->req_status = HCI_REQ_DONE;
94 wake_up_interruptible(&hdev->req_wait_q);
95 }
96}
97
98static void hci_req_cancel(struct hci_dev *hdev, int err)
99{
100 BT_DBG("%s err 0x%2.2x", hdev->name, err);
101
102 if (hdev->req_status == HCI_REQ_PEND) {
103 hdev->req_result = err;
104 hdev->req_status = HCI_REQ_CANCELED;
105 wake_up_interruptible(&hdev->req_wait_q);
106 }
107}
108
109/* Execute request and wait for completion. */
a8c5fb1a
GP		 110static int __hci_request(struct hci_dev *hdev,
111 void (*req)(struct hci_dev *hdev, unsigned long opt),
112 unsigned long opt, __u32 timeout)
1da177e4
LT		 113{
114 DECLARE_WAITQUEUE(wait, current);
115 int err = 0;
116
117 BT_DBG("%s start", hdev->name);
118
119 hdev->req_status = HCI_REQ_PEND;
120
121 add_wait_queue(&hdev->req_wait_q, &wait);
122 set_current_state(TASK_INTERRUPTIBLE);
123
124 req(hdev, opt);
125 schedule_timeout(timeout);
126
127 remove_wait_queue(&hdev->req_wait_q, &wait);
128
129 if (signal_pending(current))
130 return -EINTR;
131
132 switch (hdev->req_status) {
133 case HCI_REQ_DONE:
e175072f 134 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 135 break;
136
137 case HCI_REQ_CANCELED:
138 err = -hdev->req_result;
139 break;
140
141 default:
142 err = -ETIMEDOUT;
143 break;
3ff50b79 144 }
1da177e4 145
a5040efa 146 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 147
148 BT_DBG("%s end: err %d", hdev->name, err);
149
150 return err;
151}
152
6039aa73
GP		 153static int hci_request(struct hci_dev *hdev,
154 void (*req)(struct hci_dev *hdev, unsigned long opt),
155 unsigned long opt, __u32 timeout)
1da177e4
LT		 156{
157 int ret;
158
7c6a329e
MH		 159 if (!test_bit(HCI_UP, &hdev->flags))
160 return -ENETDOWN;
161
1da177e4
LT		 162 /* Serialize all requests */
163 hci_req_lock(hdev);
164 ret = __hci_request(hdev, req, opt, timeout);
165 hci_req_unlock(hdev);
166
167 return ret;
168}
169
170static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
171{
172 BT_DBG("%s %ld", hdev->name, opt);
173
174 /* Reset device */
f630cf0d 175 set_bit(HCI_RESET, &hdev->flags);
a9de9248 176 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 177}
178
e61ef499 179static void bredr_init(struct hci_dev *hdev)
1da177e4 180{
2455a3ea
AE		 181 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
182
1da177e4 183 /* Read Local Supported Features */
a9de9248 184 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 185
1143e5a6 186 /* Read Local Version */
a9de9248 187 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1da177e4
LT		 188}
189
e61ef499
AE		 190static void amp_init(struct hci_dev *hdev)
191{
2455a3ea
AE		 192 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
193
e61ef499
AE		 194 /* Read Local Version */
195 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489
AE		 196
197 /* Read Local AMP Info */
198 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 199
200 /* Read Data Blk size */
201 hci_send_cmd(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
e61ef499
AE		 202}
203
204static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
205{
206 struct sk_buff *skb;
207
208 BT_DBG("%s %ld", hdev->name, opt);
209
210 /* Driver initialization */
211
212 /* Special commands */
213 while ((skb = skb_dequeue(&hdev->driver_init))) {
214 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
215 skb->dev = (void *) hdev;
216
217 skb_queue_tail(&hdev->cmd_q, skb);
218 queue_work(hdev->workqueue, &hdev->cmd_work);
219 }
220 skb_queue_purge(&hdev->driver_init);
221
11778716
AE		 222 /* Reset */
223 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
224 hci_reset_req(hdev, 0);
225
e61ef499
AE		 226 switch (hdev->dev_type) {
227 case HCI_BREDR:
228 bredr_init(hdev);
229 break;
230
231 case HCI_AMP:
232 amp_init(hdev);
233 break;
234
235 default:
236 BT_ERR("Unknown device type %d", hdev->dev_type);
237 break;
238 }
e61ef499
AE		 239}
240
1da177e4
LT		 241static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
242{
243 __u8 scan = opt;
244
245 BT_DBG("%s %x", hdev->name, scan);
246
247 /* Inquiry and Page scans */
a9de9248 248 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 249}
250
251static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
252{
253 __u8 auth = opt;
254
255 BT_DBG("%s %x", hdev->name, auth);
256
257 /* Authentication */
a9de9248 258 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 259}
260
261static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
262{
263 __u8 encrypt = opt;
264
265 BT_DBG("%s %x", hdev->name, encrypt);
266
e4e8e37c 267 /* Encryption */
a9de9248 268 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 269}
270
e4e8e37c
MH		 271static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
272{
273 __le16 policy = cpu_to_le16(opt);
274
a418b893 275 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 276
277 /* Default link policy */
278 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
279}
280
8e87d142 281/* Get HCI device by index.
1da177e4
LT		 282 * Device is held on return. */
283struct hci_dev *hci_dev_get(int index)
284{
8035ded4 285 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 286
287 BT_DBG("%d", index);
288
289 if (index < 0)
290 return NULL;
291
292 read_lock(&hci_dev_list_lock);
8035ded4 293 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 294 if (d->id == index) {
295 hdev = hci_dev_hold(d);
296 break;
297 }
298 }
299 read_unlock(&hci_dev_list_lock);
300 return hdev;
301}
1da177e4
LT		 302
303/* ---- Inquiry support ---- */
ff9ef578 304
30dc78e1
JH		 305bool hci_discovery_active(struct hci_dev *hdev)
306{
307 struct discovery_state *discov = &hdev->discovery;
308
6fbe195d 309 switch (discov->state) {
343f935b 310 case DISCOVERY_FINDING:
6fbe195d 311 case DISCOVERY_RESOLVING:
30dc78e1
JH		 312 return true;
313
6fbe195d
AG		 314 default:
315 return false;
316 }
30dc78e1
JH		 317}
318
ff9ef578
JH		 319void hci_discovery_set_state(struct hci_dev *hdev, int state)
320{
321 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
322
323 if (hdev->discovery.state == state)
324 return;
325
326 switch (state) {
327 case DISCOVERY_STOPPED:
7b99b659
AG		 328 if (hdev->discovery.state != DISCOVERY_STARTING)
329 mgmt_discovering(hdev, 0);
ff9ef578
JH		 330 break;
331 case DISCOVERY_STARTING:
332 break;
343f935b 333 case DISCOVERY_FINDING:
ff9ef578
JH		 334 mgmt_discovering(hdev, 1);
335 break;
30dc78e1
JH		 336 case DISCOVERY_RESOLVING:
337 break;
ff9ef578
JH		 338 case DISCOVERY_STOPPING:
339 break;
340 }
341
342 hdev->discovery.state = state;
343}
344
1da177e4
LT		 345static void inquiry_cache_flush(struct hci_dev *hdev)
346{
30883512 347 struct discovery_state *cache = &hdev->discovery;
b57c1a56 348 struct inquiry_entry *p, *n;
1da177e4 349
561aafbc
JH		 350 list_for_each_entry_safe(p, n, &cache->all, all) {
351 list_del(&p->all);
b57c1a56 352 kfree(p);
1da177e4 353 }
561aafbc
JH		 354
355 INIT_LIST_HEAD(&cache->unknown);
356 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 357}
358
a8c5fb1a
GP		 359struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
360 bdaddr_t *bdaddr)
1da177e4 361{
30883512 362 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 363 struct inquiry_entry *e;
364
6ed93dc6 365 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 366
561aafbc
JH		 367 list_for_each_entry(e, &cache->all, all) {
368 if (!bacmp(&e->data.bdaddr, bdaddr))
369 return e;
370 }
371
372 return NULL;
373}
374
375struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 376 bdaddr_t *bdaddr)
561aafbc 377{
30883512 378 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 379 struct inquiry_entry *e;
380
6ed93dc6 381 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 382
383 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 384 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 385 return e;
386 }
387
388 return NULL;
1da177e4
LT		 389}
390
30dc78e1 391struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 392 bdaddr_t *bdaddr,
393 int state)
30dc78e1
JH		 394{
395 struct discovery_state *cache = &hdev->discovery;
396 struct inquiry_entry *e;
397
6ed93dc6 398 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 399
400 list_for_each_entry(e, &cache->resolve, list) {
401 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
402 return e;
403 if (!bacmp(&e->data.bdaddr, bdaddr))
404 return e;
405 }
406
407 return NULL;
408}
409
a3d4e20a 410void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 411 struct inquiry_entry *ie)
a3d4e20a
JH		 412{
413 struct discovery_state *cache = &hdev->discovery;
414 struct list_head *pos = &cache->resolve;
415 struct inquiry_entry *p;
416
417 list_del(&ie->list);
418
419 list_for_each_entry(p, &cache->resolve, list) {
420 if (p->name_state != NAME_PENDING &&
a8c5fb1a 421 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 422 break;
423 pos = &p->list;
424 }
425
426 list_add(&ie->list, pos);
427}
428
3175405b 429bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
04124681 430 bool name_known, bool *ssp)
1da177e4 431{
30883512 432 struct discovery_state *cache = &hdev->discovery;
70f23020 433 struct inquiry_entry *ie;
1da177e4 434
6ed93dc6 435 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 436
2b2fec4d
SJ		 437 hci_remove_remote_oob_data(hdev, &data->bdaddr);
438
388fc8fa
JH		 439 if (ssp)
440 *ssp = data->ssp_mode;
441
70f23020 442 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 443 if (ie) {
388fc8fa
JH		 444 if (ie->data.ssp_mode && ssp)
445 *ssp = true;
446
a3d4e20a 447 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 448 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 449 ie->data.rssi = data->rssi;
450 hci_inquiry_cache_update_resolve(hdev, ie);
451 }
452
561aafbc 453 goto update;
a3d4e20a 454 }
561aafbc
JH		 455
456 /* Entry not in the cache. Add new one. */
457 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
458 if (!ie)
3175405b 459 return false;
561aafbc
JH		 460
461 list_add(&ie->all, &cache->all);
462
463 if (name_known) {
464 ie->name_state = NAME_KNOWN;
465 } else {
466 ie->name_state = NAME_NOT_KNOWN;
467 list_add(&ie->list, &cache->unknown);
468 }
70f23020 469
561aafbc
JH		 470update:
471 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 472 ie->name_state != NAME_PENDING) {
561aafbc
JH		 473 ie->name_state = NAME_KNOWN;
474 list_del(&ie->list);
1da177e4
LT		 475 }
476
70f23020
AE		 477 memcpy(&ie->data, data, sizeof(*data));
478 ie->timestamp = jiffies;
1da177e4 479 cache->timestamp = jiffies;
3175405b
JH		 480
481 if (ie->name_state == NAME_NOT_KNOWN)
482 return false;
483
484 return true;
1da177e4
LT		 485}
486
487static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
488{
30883512 489 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 490 struct inquiry_info *info = (struct inquiry_info *) buf;
491 struct inquiry_entry *e;
492 int copied = 0;
493
561aafbc 494 list_for_each_entry(e, &cache->all, all) {
1da177e4 495 struct inquiry_data *data = &e->data;
b57c1a56
JH		 496
497 if (copied >= num)
498 break;
499
1da177e4
LT		 500 bacpy(&info->bdaddr, &data->bdaddr);
501 info->pscan_rep_mode = data->pscan_rep_mode;
502 info->pscan_period_mode = data->pscan_period_mode;
503 info->pscan_mode = data->pscan_mode;
504 memcpy(info->dev_class, data->dev_class, 3);
505 info->clock_offset = data->clock_offset;
b57c1a56 506
1da177e4 507 info++;
b57c1a56 508 copied++;
1da177e4
LT		 509 }
510
511 BT_DBG("cache %p, copied %d", cache, copied);
512 return copied;
513}
514
515static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
516{
517 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
518 struct hci_cp_inquiry cp;
519
520 BT_DBG("%s", hdev->name);
521
522 if (test_bit(HCI_INQUIRY, &hdev->flags))
523 return;
524
525 /* Start Inquiry */
526 memcpy(&cp.lap, &ir->lap, 3);
527 cp.length = ir->length;
528 cp.num_rsp = ir->num_rsp;
a9de9248 529 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 530}
531
532int hci_inquiry(void __user *arg)
533{
534 __u8 __user *ptr = arg;
535 struct hci_inquiry_req ir;
536 struct hci_dev *hdev;
537 int err = 0, do_inquiry = 0, max_rsp;
538 long timeo;
539 __u8 *buf;
540
541 if (copy_from_user(&ir, ptr, sizeof(ir)))
542 return -EFAULT;
543
5a08ecce
AE		 544 hdev = hci_dev_get(ir.dev_id);
545 if (!hdev)
1da177e4
LT		 546 return -ENODEV;
547
09fd0de5 548 hci_dev_lock(hdev);
8e87d142 549 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 550 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 551 inquiry_cache_flush(hdev);
552 do_inquiry = 1;
553 }
09fd0de5 554 hci_dev_unlock(hdev);
1da177e4 555
04837f64 556 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 557
558 if (do_inquiry) {
559 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
560 if (err < 0)
561 goto done;
562 }
1da177e4 563
8fc9ced3
GP		 564 /* for unlimited number of responses we will use buffer with
565 * 255 entries
566 */
1da177e4
LT		 567 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
568
569 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
570 * copy it to the user space.
571 */
01df8c31 572 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 573 if (!buf) {
1da177e4
LT		 574 err = -ENOMEM;
575 goto done;
576 }
577
09fd0de5 578 hci_dev_lock(hdev);
1da177e4 579 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 580 hci_dev_unlock(hdev);
1da177e4
LT		 581
582 BT_DBG("num_rsp %d", ir.num_rsp);
583
584 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
585 ptr += sizeof(ir);
586 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 587 ir.num_rsp))
1da177e4 588 err = -EFAULT;
8e87d142 589 } else
1da177e4
LT		 590 err = -EFAULT;
591
592 kfree(buf);
593
594done:
595 hci_dev_put(hdev);
596 return err;
597}
598
3f0f524b
JH		 599static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
600{
601 u8 ad_len = 0, flags = 0;
602 size_t name_len;
603
604 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
605 flags |= LE_AD_GENERAL;
606
607 if (!lmp_bredr_capable(hdev))
608 flags |= LE_AD_NO_BREDR;
609
610 if (lmp_le_br_capable(hdev))
611 flags |= LE_AD_SIM_LE_BREDR_CTRL;
612
613 if (lmp_host_le_br_capable(hdev))
614 flags |= LE_AD_SIM_LE_BREDR_HOST;
615
616 if (flags) {
617 BT_DBG("adv flags 0x%02x", flags);
618
619 ptr[0] = 2;
620 ptr[1] = EIR_FLAGS;
621 ptr[2] = flags;
622
623 ad_len += 3;
624 ptr += 3;
625 }
626
627 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
628 ptr[0] = 2;
629 ptr[1] = EIR_TX_POWER;
630 ptr[2] = (u8) hdev->adv_tx_power;
631
632 ad_len += 3;
633 ptr += 3;
634 }
635
636 name_len = strlen(hdev->dev_name);
637 if (name_len > 0) {
638 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
639
640 if (name_len > max_len) {
641 name_len = max_len;
642 ptr[1] = EIR_NAME_SHORT;
643 } else
644 ptr[1] = EIR_NAME_COMPLETE;
645
646 ptr[0] = name_len + 1;
647
648 memcpy(ptr + 2, hdev->dev_name, name_len);
649
650 ad_len += (name_len + 2);
651 ptr += (name_len + 2);
652 }
653
654 return ad_len;
655}
656
657int hci_update_ad(struct hci_dev *hdev)
658{
659 struct hci_cp_le_set_adv_data cp;
660 u8 len;
661 int err;
662
663 hci_dev_lock(hdev);
664
665 if (!lmp_le_capable(hdev)) {
666 err = -EINVAL;
667 goto unlock;
668 }
669
670 memset(&cp, 0, sizeof(cp));
671
672 len = create_ad(hdev, cp.data);
673
674 if (hdev->adv_data_len == len &&
675 memcmp(cp.data, hdev->adv_data, len) == 0) {
676 err = 0;
677 goto unlock;
678 }
679
680 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
681 hdev->adv_data_len = len;
682
683 cp.length = len;
684 err = hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
685
686unlock:
687 hci_dev_unlock(hdev);
688
689 return err;
690}
691
1da177e4
LT		 692/* ---- HCI ioctl helpers ---- */
693
694int hci_dev_open(__u16 dev)
695{
696 struct hci_dev *hdev;
697 int ret = 0;
698
5a08ecce
AE		 699 hdev = hci_dev_get(dev);
700 if (!hdev)
1da177e4
LT		 701 return -ENODEV;
702
703 BT_DBG("%s %p", hdev->name, hdev);
704
705 hci_req_lock(hdev);
706
94324962
JH		 707 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
708 ret = -ENODEV;
709 goto done;
710 }
711
611b30f7
MH		 712 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
713 ret = -ERFKILL;
714 goto done;
715 }
716
1da177e4
LT		 717 if (test_bit(HCI_UP, &hdev->flags)) {
718 ret = -EALREADY;
719 goto done;
720 }
721
722 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
723 set_bit(HCI_RAW, &hdev->flags);
724
07e3b94a
AE		 725 /* Treat all non BR/EDR controllers as raw devices if
726 enable_hs is not set */
727 if (hdev->dev_type != HCI_BREDR && !enable_hs)
943da25d
MH		 728 set_bit(HCI_RAW, &hdev->flags);
729
1da177e4
LT		 730 if (hdev->open(hdev)) {
731 ret = -EIO;
732 goto done;
733 }
734
735 if (!test_bit(HCI_RAW, &hdev->flags)) {
736 atomic_set(&hdev->cmd_cnt, 1);
737 set_bit(HCI_INIT, &hdev->flags);
a5040efa 738 hdev->init_last_cmd = 0;
1da177e4 739
5f246e89 740 ret = __hci_request(hdev, hci_init_req, 0, HCI_INIT_TIMEOUT);
1da177e4
LT		 741
742 clear_bit(HCI_INIT, &hdev->flags);
743 }
744
745 if (!ret) {
746 hci_dev_hold(hdev);
747 set_bit(HCI_UP, &hdev->flags);
748 hci_notify(hdev, HCI_DEV_UP);
3f0f524b 749 hci_update_ad(hdev);
bb4b2a9a
AE		 750 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
751 mgmt_valid_hdev(hdev)) {
09fd0de5 752 hci_dev_lock(hdev);
744cf19e 753 mgmt_powered(hdev, 1);
09fd0de5 754 hci_dev_unlock(hdev);
56e5cb86 755 }
8e87d142 756 } else {
1da177e4 757 /* Init failed, cleanup */
3eff45ea 758 flush_work(&hdev->tx_work);
c347b765 759 flush_work(&hdev->cmd_work);
b78752cc 760 flush_work(&hdev->rx_work);
1da177e4
LT		 761
762 skb_queue_purge(&hdev->cmd_q);
763 skb_queue_purge(&hdev->rx_q);
764
765 if (hdev->flush)
766 hdev->flush(hdev);
767
768 if (hdev->sent_cmd) {
769 kfree_skb(hdev->sent_cmd);
770 hdev->sent_cmd = NULL;
771 }
772
773 hdev->close(hdev);
774 hdev->flags = 0;
775 }
776
777done:
778 hci_req_unlock(hdev);
779 hci_dev_put(hdev);
780 return ret;
781}
782
783static int hci_dev_do_close(struct hci_dev *hdev)
784{
785 BT_DBG("%s %p", hdev->name, hdev);
786
28b75a89
AG		 787 cancel_work_sync(&hdev->le_scan);
788
78c04c0b
VCG		 789 cancel_delayed_work(&hdev->power_off);
790
1da177e4
LT		 791 hci_req_cancel(hdev, ENODEV);
792 hci_req_lock(hdev);
793
794 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 795 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 796 hci_req_unlock(hdev);
797 return 0;
798 }
799
3eff45ea
GP		 800 /* Flush RX and TX works */
801 flush_work(&hdev->tx_work);
b78752cc 802 flush_work(&hdev->rx_work);
1da177e4 803
16ab91ab 804 if (hdev->discov_timeout > 0) {
e0f9309f 805 cancel_delayed_work(&hdev->discov_off);
16ab91ab 806 hdev->discov_timeout = 0;
5e5282bb 807 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
16ab91ab
JH		 808 }
809
a8b2d5c2 810 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 811 cancel_delayed_work(&hdev->service_cache);
812
7ba8b4be
AG		 813 cancel_delayed_work_sync(&hdev->le_scan_disable);
814
09fd0de5 815 hci_dev_lock(hdev);
1da177e4
LT		 816 inquiry_cache_flush(hdev);
817 hci_conn_hash_flush(hdev);
09fd0de5 818 hci_dev_unlock(hdev);
1da177e4
LT		 819
820 hci_notify(hdev, HCI_DEV_DOWN);
821
822 if (hdev->flush)
823 hdev->flush(hdev);
824
825 /* Reset device */
826 skb_queue_purge(&hdev->cmd_q);
827 atomic_set(&hdev->cmd_cnt, 1);
8af59467 828 if (!test_bit(HCI_RAW, &hdev->flags) &&
a6c511c6 829 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1da177e4 830 set_bit(HCI_INIT, &hdev->flags);
5f246e89 831 __hci_request(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1da177e4
LT		 832 clear_bit(HCI_INIT, &hdev->flags);
833 }
834
c347b765
GP		 835 /* flush cmd work */
836 flush_work(&hdev->cmd_work);
1da177e4
LT		 837
838 /* Drop queues */
839 skb_queue_purge(&hdev->rx_q);
840 skb_queue_purge(&hdev->cmd_q);
841 skb_queue_purge(&hdev->raw_q);
842
843 /* Drop last sent command */
844 if (hdev->sent_cmd) {
b79f44c1 845 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 846 kfree_skb(hdev->sent_cmd);
847 hdev->sent_cmd = NULL;
848 }
849
850 /* After this point our queues are empty
851 * and no tasks are scheduled. */
852 hdev->close(hdev);
853
bb4b2a9a
AE		 854 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
855 mgmt_valid_hdev(hdev)) {
8ee56540
MH		 856 hci_dev_lock(hdev);
857 mgmt_powered(hdev, 0);
858 hci_dev_unlock(hdev);
859 }
5add6af8 860
1da177e4
LT		 861 /* Clear flags */
862 hdev->flags = 0;
863
e59fda8d 864 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 865 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
e59fda8d 866
1da177e4
LT		 867 hci_req_unlock(hdev);
868
869 hci_dev_put(hdev);
870 return 0;
871}
872
873int hci_dev_close(__u16 dev)
874{
875 struct hci_dev *hdev;
876 int err;
877
70f23020
AE		 878 hdev = hci_dev_get(dev);
879 if (!hdev)
1da177e4 880 return -ENODEV;
8ee56540
MH		 881
882 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
883 cancel_delayed_work(&hdev->power_off);
884
1da177e4 885 err = hci_dev_do_close(hdev);
8ee56540 886
1da177e4
LT		 887 hci_dev_put(hdev);
888 return err;
889}
890
891int hci_dev_reset(__u16 dev)
892{
893 struct hci_dev *hdev;
894 int ret = 0;
895
70f23020
AE		 896 hdev = hci_dev_get(dev);
897 if (!hdev)
1da177e4
LT		 898 return -ENODEV;
899
900 hci_req_lock(hdev);
1da177e4
LT		 901
902 if (!test_bit(HCI_UP, &hdev->flags))
903 goto done;
904
905 /* Drop queues */
906 skb_queue_purge(&hdev->rx_q);
907 skb_queue_purge(&hdev->cmd_q);
908
09fd0de5 909 hci_dev_lock(hdev);
1da177e4
LT		 910 inquiry_cache_flush(hdev);
911 hci_conn_hash_flush(hdev);
09fd0de5 912 hci_dev_unlock(hdev);
1da177e4
LT		 913
914 if (hdev->flush)
915 hdev->flush(hdev);
916
8e87d142 917 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 918 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 919
920 if (!test_bit(HCI_RAW, &hdev->flags))
5f246e89 921 ret = __hci_request(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1da177e4
LT		 922
923done:
1da177e4
LT		 924 hci_req_unlock(hdev);
925 hci_dev_put(hdev);
926 return ret;
927}
928
929int hci_dev_reset_stat(__u16 dev)
930{
931 struct hci_dev *hdev;
932 int ret = 0;
933
70f23020
AE		 934 hdev = hci_dev_get(dev);
935 if (!hdev)
1da177e4
LT		 936 return -ENODEV;
937
938 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
939
940 hci_dev_put(hdev);
941
942 return ret;
943}
944
945int hci_dev_cmd(unsigned int cmd, void __user *arg)
946{
947 struct hci_dev *hdev;
948 struct hci_dev_req dr;
949 int err = 0;
950
951 if (copy_from_user(&dr, arg, sizeof(dr)))
952 return -EFAULT;
953
70f23020
AE		 954 hdev = hci_dev_get(dr.dev_id);
955 if (!hdev)
1da177e4
LT		 956 return -ENODEV;
957
958 switch (cmd) {
959 case HCISETAUTH:
04837f64 960 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
5f246e89 961 HCI_INIT_TIMEOUT);
1da177e4
LT		 962 break;
963
964 case HCISETENCRYPT:
965 if (!lmp_encrypt_capable(hdev)) {
966 err = -EOPNOTSUPP;
967 break;
968 }
969
970 if (!test_bit(HCI_AUTH, &hdev->flags)) {
971 /* Auth must be enabled first */
04837f64 972 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
5f246e89 973 HCI_INIT_TIMEOUT);
1da177e4
LT		 974 if (err)
975 break;
976 }
977
04837f64 978 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
5f246e89 979 HCI_INIT_TIMEOUT);
1da177e4
LT		 980 break;
981
982 case HCISETSCAN:
04837f64 983 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
5f246e89 984 HCI_INIT_TIMEOUT);
1da177e4
LT		 985 break;
986
1da177e4 987 case HCISETLINKPOL:
e4e8e37c 988 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
5f246e89 989 HCI_INIT_TIMEOUT);
1da177e4
LT		 990 break;
991
992 case HCISETLINKMODE:
e4e8e37c
MH		 993 hdev->link_mode = ((__u16) dr.dev_opt) &
994 (HCI_LM_MASTER | HCI_LM_ACCEPT);
995 break;
996
997 case HCISETPTYPE:
998 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 999 break;
1000
1001 case HCISETACLMTU:
e4e8e37c
MH		 1002 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1003 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1004 break;
1005
1006 case HCISETSCOMTU:
e4e8e37c
MH		 1007 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1008 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1009 break;
1010
1011 default:
1012 err = -EINVAL;
1013 break;
1014 }
e4e8e37c 1015
1da177e4
LT		 1016 hci_dev_put(hdev);
1017 return err;
1018}
1019
1020int hci_get_dev_list(void __user *arg)
1021{
8035ded4 1022 struct hci_dev *hdev;
1da177e4
LT		 1023 struct hci_dev_list_req *dl;
1024 struct hci_dev_req *dr;
1da177e4
LT		 1025 int n = 0, size, err;
1026 __u16 dev_num;
1027
1028 if (get_user(dev_num, (__u16 __user *) arg))
1029 return -EFAULT;
1030
1031 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1032 return -EINVAL;
1033
1034 size = sizeof(*dl) + dev_num * sizeof(*dr);
1035
70f23020
AE		 1036 dl = kzalloc(size, GFP_KERNEL);
1037 if (!dl)
1da177e4
LT		 1038 return -ENOMEM;
1039
1040 dr = dl->dev_req;
1041
f20d09d5 1042 read_lock(&hci_dev_list_lock);
8035ded4 1043 list_for_each_entry(hdev, &hci_dev_list, list) {
a8b2d5c2 1044 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
e0f9309f 1045 cancel_delayed_work(&hdev->power_off);
c542a06c 1046
a8b2d5c2
JH		 1047 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1048 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1049
1da177e4
LT		 1050 (dr + n)->dev_id = hdev->id;
1051 (dr + n)->dev_opt = hdev->flags;
c542a06c 1052
1da177e4
LT		 1053 if (++n >= dev_num)
1054 break;
1055 }
f20d09d5 1056 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 1057
1058 dl->dev_num = n;
1059 size = sizeof(*dl) + n * sizeof(*dr);
1060
1061 err = copy_to_user(arg, dl, size);
1062 kfree(dl);
1063
1064 return err ? -EFAULT : 0;
1065}
1066
1067int hci_get_dev_info(void __user *arg)
1068{
1069 struct hci_dev *hdev;
1070 struct hci_dev_info di;
1071 int err = 0;
1072
1073 if (copy_from_user(&di, arg, sizeof(di)))
1074 return -EFAULT;
1075
70f23020
AE		 1076 hdev = hci_dev_get(di.dev_id);
1077 if (!hdev)
1da177e4
LT		 1078 return -ENODEV;
1079
a8b2d5c2 1080 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
3243553f 1081 cancel_delayed_work_sync(&hdev->power_off);
ab81cbf9 1082
a8b2d5c2
JH		 1083 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1084 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1085
1da177e4
LT		 1086 strcpy(di.name, hdev->name);
1087 di.bdaddr = hdev->bdaddr;
943da25d 1088 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 1089 di.flags = hdev->flags;
1090 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 1091 if (lmp_bredr_capable(hdev)) {
1092 di.acl_mtu = hdev->acl_mtu;
1093 di.acl_pkts = hdev->acl_pkts;
1094 di.sco_mtu = hdev->sco_mtu;
1095 di.sco_pkts = hdev->sco_pkts;
1096 } else {
1097 di.acl_mtu = hdev->le_mtu;
1098 di.acl_pkts = hdev->le_pkts;
1099 di.sco_mtu = 0;
1100 di.sco_pkts = 0;
1101 }
1da177e4
LT		 1102 di.link_policy = hdev->link_policy;
1103 di.link_mode = hdev->link_mode;
1104
1105 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1106 memcpy(&di.features, &hdev->features, sizeof(di.features));
1107
1108 if (copy_to_user(arg, &di, sizeof(di)))
1109 err = -EFAULT;
1110
1111 hci_dev_put(hdev);
1112
1113 return err;
1114}
1115
1116/* ---- Interface to HCI drivers ---- */
1117
611b30f7
MH		 1118static int hci_rfkill_set_block(void *data, bool blocked)
1119{
1120 struct hci_dev *hdev = data;
1121
1122 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1123
1124 if (!blocked)
1125 return 0;
1126
1127 hci_dev_do_close(hdev);
1128
1129 return 0;
1130}
1131
1132static const struct rfkill_ops hci_rfkill_ops = {
1133 .set_block = hci_rfkill_set_block,
1134};
1135
ab81cbf9
JH		 1136static void hci_power_on(struct work_struct *work)
1137{
1138 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1139
1140 BT_DBG("%s", hdev->name);
1141
1142 if (hci_dev_open(hdev->id) < 0)
1143 return;
1144
a8b2d5c2 1145 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
9345d40c 1146 schedule_delayed_work(&hdev->power_off, HCI_AUTO_OFF_TIMEOUT);
ab81cbf9 1147
a8b2d5c2 1148 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
744cf19e 1149 mgmt_index_added(hdev);
ab81cbf9
JH		 1150}
1151
1152static void hci_power_off(struct work_struct *work)
1153{
3243553f 1154 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 1155 power_off.work);
ab81cbf9
JH		 1156
1157 BT_DBG("%s", hdev->name);
1158
8ee56540 1159 hci_dev_do_close(hdev);
ab81cbf9
JH		 1160}
1161
16ab91ab
JH		 1162static void hci_discov_off(struct work_struct *work)
1163{
1164 struct hci_dev *hdev;
1165 u8 scan = SCAN_PAGE;
1166
1167 hdev = container_of(work, struct hci_dev, discov_off.work);
1168
1169 BT_DBG("%s", hdev->name);
1170
09fd0de5 1171 hci_dev_lock(hdev);
16ab91ab
JH		 1172
1173 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1174
1175 hdev->discov_timeout = 0;
1176
09fd0de5 1177 hci_dev_unlock(hdev);
16ab91ab
JH		 1178}
1179
2aeb9a1a
JH		 1180int hci_uuids_clear(struct hci_dev *hdev)
1181{
1182 struct list_head *p, *n;
1183
1184 list_for_each_safe(p, n, &hdev->uuids) {
1185 struct bt_uuid *uuid;
1186
1187 uuid = list_entry(p, struct bt_uuid, list);
1188
1189 list_del(p);
1190 kfree(uuid);
1191 }
1192
1193 return 0;
1194}
1195
55ed8ca1
JH		 1196int hci_link_keys_clear(struct hci_dev *hdev)
1197{
1198 struct list_head *p, *n;
1199
1200 list_for_each_safe(p, n, &hdev->link_keys) {
1201 struct link_key *key;
1202
1203 key = list_entry(p, struct link_key, list);
1204
1205 list_del(p);
1206 kfree(key);
1207 }
1208
1209 return 0;
1210}
1211
b899efaf
VCG		 1212int hci_smp_ltks_clear(struct hci_dev *hdev)
1213{
1214 struct smp_ltk *k, *tmp;
1215
1216 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1217 list_del(&k->list);
1218 kfree(k);
1219 }
1220
1221 return 0;
1222}
1223
55ed8ca1
JH		 1224struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1225{
8035ded4 1226 struct link_key *k;
55ed8ca1 1227
8035ded4 1228 list_for_each_entry(k, &hdev->link_keys, list)
55ed8ca1
JH		 1229 if (bacmp(bdaddr, &k->bdaddr) == 0)
1230 return k;
55ed8ca1
JH		 1231
1232 return NULL;
1233}
1234
745c0ce3 1235static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 1236 u8 key_type, u8 old_key_type)
d25e28ab
JH		 1237{
1238 /* Legacy key */
1239 if (key_type < 0x03)
745c0ce3 1240 return true;
d25e28ab
JH		 1241
1242 /* Debug keys are insecure so don't store them persistently */
1243 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 1244 return false;
d25e28ab
JH		 1245
1246 /* Changed combination key and there's no previous one */
1247 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 1248 return false;
d25e28ab
JH		 1249
1250 /* Security mode 3 case */
1251 if (!conn)
745c0ce3 1252 return true;
d25e28ab
JH		 1253
1254 /* Neither local nor remote side had no-bonding as requirement */
1255 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 1256 return true;
d25e28ab
JH		 1257
1258 /* Local side had dedicated bonding as requirement */
1259 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 1260 return true;
d25e28ab
JH		 1261
1262 /* Remote side had dedicated bonding as requirement */
1263 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 1264 return true;
d25e28ab
JH		 1265
1266 /* If none of the above criteria match, then don't store the key
1267 * persistently */
745c0ce3 1268 return false;
d25e28ab
JH		 1269}
1270
c9839a11 1271struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
75d262c2 1272{
c9839a11 1273 struct smp_ltk *k;
75d262c2 1274
c9839a11
VCG		 1275 list_for_each_entry(k, &hdev->long_term_keys, list) {
1276 if (k->ediv != ediv ||
a8c5fb1a 1277 memcmp(rand, k->rand, sizeof(k->rand)))
75d262c2
VCG		 1278 continue;
1279
c9839a11 1280 return k;
75d262c2
VCG		 1281 }
1282
1283 return NULL;
1284}
75d262c2 1285
c9839a11 1286struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 1287 u8 addr_type)
75d262c2 1288{
c9839a11 1289 struct smp_ltk *k;
75d262c2 1290
c9839a11
VCG		 1291 list_for_each_entry(k, &hdev->long_term_keys, list)
1292 if (addr_type == k->bdaddr_type &&
a8c5fb1a 1293 bacmp(bdaddr, &k->bdaddr) == 0)
75d262c2
VCG		 1294 return k;
1295
1296 return NULL;
1297}
75d262c2 1298
d25e28ab 1299int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
04124681 1300 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1301{
1302 struct link_key *key, *old_key;
745c0ce3
VA		 1303 u8 old_key_type;
1304 bool persistent;
55ed8ca1
JH		 1305
1306 old_key = hci_find_link_key(hdev, bdaddr);
1307 if (old_key) {
1308 old_key_type = old_key->type;
1309 key = old_key;
1310 } else {
12adcf3a 1311 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1312 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1313 if (!key)
1314 return -ENOMEM;
1315 list_add(&key->list, &hdev->link_keys);
1316 }
1317
6ed93dc6 1318 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 1319
d25e28ab
JH		 1320 /* Some buggy controller combinations generate a changed
1321 * combination key for legacy pairing even when there's no
1322 * previous key */
1323 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 1324 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 1325 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1326 if (conn)
1327 conn->key_type = type;
1328 }
d25e28ab 1329
55ed8ca1 1330 bacpy(&key->bdaddr, bdaddr);
9b3b4460 1331 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 1332 key->pin_len = pin_len;
1333
b6020ba0 1334 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1335 key->type = old_key_type;
4748fed2
JH		 1336 else
1337 key->type = type;
1338
4df378a1
JH		 1339 if (!new_key)
1340 return 0;
1341
1342 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1343
744cf19e 1344 mgmt_new_link_key(hdev, key, persistent);
4df378a1 1345
6ec5bcad
VA		 1346 if (conn)
1347 conn->flush_key = !persistent;
55ed8ca1
JH		 1348
1349 return 0;
1350}
1351
c9839a11 1352int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
9a006657 1353 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
04124681 1354 ediv, u8 rand[8])
75d262c2 1355{
c9839a11 1356 struct smp_ltk *key, *old_key;
75d262c2 1357
c9839a11
VCG		 1358 if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1359 return 0;
75d262c2 1360
c9839a11
VCG		 1361 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1362 if (old_key)
75d262c2 1363 key = old_key;
c9839a11
VCG		 1364 else {
1365 key = kzalloc(sizeof(*key), GFP_ATOMIC);
75d262c2
VCG		 1366 if (!key)
1367 return -ENOMEM;
c9839a11 1368 list_add(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 1369 }
1370
75d262c2 1371 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 1372 key->bdaddr_type = addr_type;
1373 memcpy(key->val, tk, sizeof(key->val));
1374 key->authenticated = authenticated;
1375 key->ediv = ediv;
1376 key->enc_size = enc_size;
1377 key->type = type;
1378 memcpy(key->rand, rand, sizeof(key->rand));
75d262c2 1379
c9839a11
VCG		 1380 if (!new_key)
1381 return 0;
75d262c2 1382
261cc5aa
VCG		 1383 if (type & HCI_SMP_LTK)
1384 mgmt_new_ltk(hdev, key, 1);
1385
75d262c2
VCG		 1386 return 0;
1387}
1388
55ed8ca1
JH		 1389int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1390{
1391 struct link_key *key;
1392
1393 key = hci_find_link_key(hdev, bdaddr);
1394 if (!key)
1395 return -ENOENT;
1396
6ed93dc6 1397 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1
JH		 1398
1399 list_del(&key->list);
1400 kfree(key);
1401
1402 return 0;
1403}
1404
b899efaf
VCG		 1405int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1406{
1407 struct smp_ltk *k, *tmp;
1408
1409 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1410 if (bacmp(bdaddr, &k->bdaddr))
1411 continue;
1412
6ed93dc6 1413 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf
VCG		 1414
1415 list_del(&k->list);
1416 kfree(k);
1417 }
1418
1419 return 0;
1420}
1421
6bd32326 1422/* HCI command timer function */
bda4f23a 1423static void hci_cmd_timeout(unsigned long arg)
6bd32326
VT		 1424{
1425 struct hci_dev *hdev = (void *) arg;
1426
bda4f23a
AE		 1427 if (hdev->sent_cmd) {
1428 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1429 u16 opcode = __le16_to_cpu(sent->opcode);
1430
1431 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
1432 } else {
1433 BT_ERR("%s command tx timeout", hdev->name);
1434 }
1435
6bd32326 1436 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1437 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1438}
1439
2763eda6 1440struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
04124681 1441 bdaddr_t *bdaddr)
2763eda6
SJ		 1442{
1443 struct oob_data *data;
1444
1445 list_for_each_entry(data, &hdev->remote_oob_data, list)
1446 if (bacmp(bdaddr, &data->bdaddr) == 0)
1447 return data;
1448
1449 return NULL;
1450}
1451
1452int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1453{
1454 struct oob_data *data;
1455
1456 data = hci_find_remote_oob_data(hdev, bdaddr);
1457 if (!data)
1458 return -ENOENT;
1459
6ed93dc6 1460 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1461
1462 list_del(&data->list);
1463 kfree(data);
1464
1465 return 0;
1466}
1467
1468int hci_remote_oob_data_clear(struct hci_dev *hdev)
1469{
1470 struct oob_data *data, *n;
1471
1472 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1473 list_del(&data->list);
1474 kfree(data);
1475 }
1476
1477 return 0;
1478}
1479
1480int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
04124681 1481 u8 *randomizer)
2763eda6
SJ		 1482{
1483 struct oob_data *data;
1484
1485 data = hci_find_remote_oob_data(hdev, bdaddr);
1486
1487 if (!data) {
1488 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1489 if (!data)
1490 return -ENOMEM;
1491
1492 bacpy(&data->bdaddr, bdaddr);
1493 list_add(&data->list, &hdev->remote_oob_data);
1494 }
1495
1496 memcpy(data->hash, hash, sizeof(data->hash));
1497 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1498
6ed93dc6 1499 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1500
1501 return 0;
1502}
1503
04124681 1504struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
b2a66aad 1505{
8035ded4 1506 struct bdaddr_list *b;
b2a66aad 1507
8035ded4 1508 list_for_each_entry(b, &hdev->blacklist, list)
b2a66aad
AJ		 1509 if (bacmp(bdaddr, &b->bdaddr) == 0)
1510 return b;
b2a66aad
AJ		 1511
1512 return NULL;
1513}
1514
1515int hci_blacklist_clear(struct hci_dev *hdev)
1516{
1517 struct list_head *p, *n;
1518
1519 list_for_each_safe(p, n, &hdev->blacklist) {
1520 struct bdaddr_list *b;
1521
1522 b = list_entry(p, struct bdaddr_list, list);
1523
1524 list_del(p);
1525 kfree(b);
1526 }
1527
1528 return 0;
1529}
1530
88c1fe4b 1531int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 1532{
1533 struct bdaddr_list *entry;
b2a66aad
AJ		 1534
1535 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1536 return -EBADF;
1537
5e762444
AJ		 1538 if (hci_blacklist_lookup(hdev, bdaddr))
1539 return -EEXIST;
b2a66aad
AJ		 1540
1541 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
5e762444
AJ		 1542 if (!entry)
1543 return -ENOMEM;
b2a66aad
AJ		 1544
1545 bacpy(&entry->bdaddr, bdaddr);
1546
1547 list_add(&entry->list, &hdev->blacklist);
1548
88c1fe4b 1549 return mgmt_device_blocked(hdev, bdaddr, type);
b2a66aad
AJ		 1550}
1551
88c1fe4b 1552int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 1553{
1554 struct bdaddr_list *entry;
b2a66aad 1555
1ec918ce 1556 if (bacmp(bdaddr, BDADDR_ANY) == 0)
5e762444 1557 return hci_blacklist_clear(hdev);
b2a66aad
AJ		 1558
1559 entry = hci_blacklist_lookup(hdev, bdaddr);
1ec918ce 1560 if (!entry)
5e762444 1561 return -ENOENT;
b2a66aad
AJ		 1562
1563 list_del(&entry->list);
1564 kfree(entry);
1565
88c1fe4b 1566 return mgmt_device_unblocked(hdev, bdaddr, type);
b2a66aad
AJ		 1567}
1568
7ba8b4be
AG		 1569static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
1570{
1571 struct le_scan_params *param = (struct le_scan_params *) opt;
1572 struct hci_cp_le_set_scan_param cp;
1573
1574 memset(&cp, 0, sizeof(cp));
1575 cp.type = param->type;
1576 cp.interval = cpu_to_le16(param->interval);
1577 cp.window = cpu_to_le16(param->window);
1578
1579 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
1580}
1581
1582static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
1583{
1584 struct hci_cp_le_set_scan_enable cp;
1585
1586 memset(&cp, 0, sizeof(cp));
1587 cp.enable = 1;
0431a43c 1588 cp.filter_dup = 1;
7ba8b4be
AG		 1589
1590 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1591}
1592
1593static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
04124681 1594 u16 window, int timeout)
7ba8b4be
AG		 1595{
1596 long timeo = msecs_to_jiffies(3000);
1597 struct le_scan_params param;
1598 int err;
1599
1600 BT_DBG("%s", hdev->name);
1601
1602 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1603 return -EINPROGRESS;
1604
1605 param.type = type;
1606 param.interval = interval;
1607 param.window = window;
1608
1609 hci_req_lock(hdev);
1610
1611 err = __hci_request(hdev, le_scan_param_req, (unsigned long) &param,
04124681 1612 timeo);
7ba8b4be
AG		 1613 if (!err)
1614 err = __hci_request(hdev, le_scan_enable_req, 0, timeo);
1615
1616 hci_req_unlock(hdev);
1617
1618 if (err < 0)
1619 return err;
1620
1621 schedule_delayed_work(&hdev->le_scan_disable,
04124681 1622 msecs_to_jiffies(timeout));
7ba8b4be
AG		 1623
1624 return 0;
1625}
1626
7dbfac1d
AG		 1627int hci_cancel_le_scan(struct hci_dev *hdev)
1628{
1629 BT_DBG("%s", hdev->name);
1630
1631 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1632 return -EALREADY;
1633
1634 if (cancel_delayed_work(&hdev->le_scan_disable)) {
1635 struct hci_cp_le_set_scan_enable cp;
1636
1637 /* Send HCI command to disable LE Scan */
1638 memset(&cp, 0, sizeof(cp));
1639 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1640 }
1641
1642 return 0;
1643}
1644
7ba8b4be
AG		 1645static void le_scan_disable_work(struct work_struct *work)
1646{
1647 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1648 le_scan_disable.work);
7ba8b4be
AG		 1649 struct hci_cp_le_set_scan_enable cp;
1650
1651 BT_DBG("%s", hdev->name);
1652
1653 memset(&cp, 0, sizeof(cp));
1654
1655 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1656}
1657
28b75a89
AG		 1658static void le_scan_work(struct work_struct *work)
1659{
1660 struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
1661 struct le_scan_params *param = &hdev->le_scan_params;
1662
1663 BT_DBG("%s", hdev->name);
1664
04124681
GP		 1665 hci_do_le_scan(hdev, param->type, param->interval, param->window,
1666 param->timeout);
28b75a89
AG		 1667}
1668
1669int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
04124681 1670 int timeout)
28b75a89
AG		 1671{
1672 struct le_scan_params *param = &hdev->le_scan_params;
1673
1674 BT_DBG("%s", hdev->name);
1675
f1550478
JH		 1676 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
1677 return -ENOTSUPP;
1678
28b75a89
AG		 1679 if (work_busy(&hdev->le_scan))
1680 return -EINPROGRESS;
1681
1682 param->type = type;
1683 param->interval = interval;
1684 param->window = window;
1685 param->timeout = timeout;
1686
1687 queue_work(system_long_wq, &hdev->le_scan);
1688
1689 return 0;
1690}
1691
9be0dab7
DH		 1692/* Alloc HCI device */
1693struct hci_dev *hci_alloc_dev(void)
1694{
1695 struct hci_dev *hdev;
1696
1697 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1698 if (!hdev)
1699 return NULL;
1700
b1b813d4
DH		 1701 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1702 hdev->esco_type = (ESCO_HV1);
1703 hdev->link_mode = (HCI_LM_ACCEPT);
1704 hdev->io_capability = 0x03; /* No Input No Output */
bbaf444a
JH		 1705 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
1706 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
b1b813d4 1707
b1b813d4
DH		 1708 hdev->sniff_max_interval = 800;
1709 hdev->sniff_min_interval = 80;
1710
1711 mutex_init(&hdev->lock);
1712 mutex_init(&hdev->req_lock);
1713
1714 INIT_LIST_HEAD(&hdev->mgmt_pending);
1715 INIT_LIST_HEAD(&hdev->blacklist);
1716 INIT_LIST_HEAD(&hdev->uuids);
1717 INIT_LIST_HEAD(&hdev->link_keys);
1718 INIT_LIST_HEAD(&hdev->long_term_keys);
1719 INIT_LIST_HEAD(&hdev->remote_oob_data);
6b536b5e 1720 INIT_LIST_HEAD(&hdev->conn_hash.list);
b1b813d4
DH		 1721
1722 INIT_WORK(&hdev->rx_work, hci_rx_work);
1723 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
1724 INIT_WORK(&hdev->tx_work, hci_tx_work);
1725 INIT_WORK(&hdev->power_on, hci_power_on);
1726 INIT_WORK(&hdev->le_scan, le_scan_work);
1727
b1b813d4
DH		 1728 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
1729 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1730 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
1731
9be0dab7 1732 skb_queue_head_init(&hdev->driver_init);
b1b813d4
DH		 1733 skb_queue_head_init(&hdev->rx_q);
1734 skb_queue_head_init(&hdev->cmd_q);
1735 skb_queue_head_init(&hdev->raw_q);
1736
1737 init_waitqueue_head(&hdev->req_wait_q);
1738
bda4f23a 1739 setup_timer(&hdev->cmd_timer, hci_cmd_timeout, (unsigned long) hdev);
b1b813d4 1740
b1b813d4
DH		 1741 hci_init_sysfs(hdev);
1742 discovery_init(hdev);
9be0dab7
DH		 1743
1744 return hdev;
1745}
1746EXPORT_SYMBOL(hci_alloc_dev);
1747
1748/* Free HCI device */
1749void hci_free_dev(struct hci_dev *hdev)
1750{
1751 skb_queue_purge(&hdev->driver_init);
1752
1753 /* will free via device release */
1754 put_device(&hdev->dev);
1755}
1756EXPORT_SYMBOL(hci_free_dev);
1757
1da177e4
LT		 1758/* Register HCI device */
1759int hci_register_dev(struct hci_dev *hdev)
1760{
b1b813d4 1761 int id, error;
1da177e4 1762
010666a1 1763 if (!hdev->open || !hdev->close)
1da177e4
LT		 1764 return -EINVAL;
1765
08add513
MM		 1766 /* Do not allow HCI_AMP devices to register at index 0,
1767 * so the index can be used as the AMP controller ID.
1768 */
3df92b31
SL		 1769 switch (hdev->dev_type) {
1770 case HCI_BREDR:
1771 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
1772 break;
1773 case HCI_AMP:
1774 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
1775 break;
1776 default:
1777 return -EINVAL;
1da177e4 1778 }
8e87d142 1779
3df92b31
SL		 1780 if (id < 0)
1781 return id;
1782
1da177e4
LT		 1783 sprintf(hdev->name, "hci%d", id);
1784 hdev->id = id;
2d8b3a11
AE		 1785
1786 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1787
3df92b31
SL		 1788 write_lock(&hci_dev_list_lock);
1789 list_add(&hdev->list, &hci_dev_list);
f20d09d5 1790 write_unlock(&hci_dev_list_lock);
1da177e4 1791
32845eb1 1792 hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
a8c5fb1a 1793 WQ_MEM_RECLAIM, 1);
33ca954d
DH		 1794 if (!hdev->workqueue) {
1795 error = -ENOMEM;
1796 goto err;
1797 }
f48fd9c8 1798
33ca954d
DH		 1799 error = hci_add_sysfs(hdev);
1800 if (error < 0)
1801 goto err_wqueue;
1da177e4 1802
611b30f7 1803 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 1804 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
1805 hdev);
611b30f7
MH		 1806 if (hdev->rfkill) {
1807 if (rfkill_register(hdev->rfkill) < 0) {
1808 rfkill_destroy(hdev->rfkill);
1809 hdev->rfkill = NULL;
1810 }
1811 }
1812
a8b2d5c2 1813 set_bit(HCI_SETUP, &hdev->dev_flags);
ce2be9ac
AE		 1814
1815 if (hdev->dev_type != HCI_AMP)
1816 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
1817
7f971041 1818 schedule_work(&hdev->power_on);
ab81cbf9 1819
1da177e4 1820 hci_notify(hdev, HCI_DEV_REG);
dc946bd8 1821 hci_dev_hold(hdev);
1da177e4
LT		 1822
1823 return id;
f48fd9c8 1824
33ca954d
DH		 1825err_wqueue:
1826 destroy_workqueue(hdev->workqueue);
1827err:
3df92b31 1828 ida_simple_remove(&hci_index_ida, hdev->id);
f20d09d5 1829 write_lock(&hci_dev_list_lock);
f48fd9c8 1830 list_del(&hdev->list);
f20d09d5 1831 write_unlock(&hci_dev_list_lock);
f48fd9c8 1832
33ca954d 1833 return error;
1da177e4
LT		 1834}
1835EXPORT_SYMBOL(hci_register_dev);
1836
1837/* Unregister HCI device */
59735631 1838void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 1839{
3df92b31 1840 int i, id;
ef222013 1841
c13854ce 1842 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1843
94324962
JH		 1844 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
1845
3df92b31
SL		 1846 id = hdev->id;
1847
f20d09d5 1848 write_lock(&hci_dev_list_lock);
1da177e4 1849 list_del(&hdev->list);
f20d09d5 1850 write_unlock(&hci_dev_list_lock);
1da177e4
LT		 1851
1852 hci_dev_do_close(hdev);
1853
cd4c5391 1854 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1855 kfree_skb(hdev->reassembly[i]);
1856
b9b5ef18
GP		 1857 cancel_work_sync(&hdev->power_on);
1858
ab81cbf9 1859 if (!test_bit(HCI_INIT, &hdev->flags) &&
a8c5fb1a 1860 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
09fd0de5 1861 hci_dev_lock(hdev);
744cf19e 1862 mgmt_index_removed(hdev);
09fd0de5 1863 hci_dev_unlock(hdev);
56e5cb86 1864 }
ab81cbf9 1865
2e58ef3e
JH		 1866 /* mgmt_index_removed should take care of emptying the
1867 * pending list */
1868 BUG_ON(!list_empty(&hdev->mgmt_pending));
1869
1da177e4
LT		 1870 hci_notify(hdev, HCI_DEV_UNREG);
1871
611b30f7
MH		 1872 if (hdev->rfkill) {
1873 rfkill_unregister(hdev->rfkill);
1874 rfkill_destroy(hdev->rfkill);
1875 }
1876
ce242970 1877 hci_del_sysfs(hdev);
147e2d59 1878
f48fd9c8
MH		 1879 destroy_workqueue(hdev->workqueue);
1880
09fd0de5 1881 hci_dev_lock(hdev);
e2e0cacb 1882 hci_blacklist_clear(hdev);
2aeb9a1a 1883 hci_uuids_clear(hdev);
55ed8ca1 1884 hci_link_keys_clear(hdev);
b899efaf 1885 hci_smp_ltks_clear(hdev);
2763eda6 1886 hci_remote_oob_data_clear(hdev);
09fd0de5 1887 hci_dev_unlock(hdev);
e2e0cacb 1888
dc946bd8 1889 hci_dev_put(hdev);
3df92b31
SL		 1890
1891 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 1892}
1893EXPORT_SYMBOL(hci_unregister_dev);
1894
1895/* Suspend HCI device */
1896int hci_suspend_dev(struct hci_dev *hdev)
1897{
1898 hci_notify(hdev, HCI_DEV_SUSPEND);
1899 return 0;
1900}
1901EXPORT_SYMBOL(hci_suspend_dev);
1902
1903/* Resume HCI device */
1904int hci_resume_dev(struct hci_dev *hdev)
1905{
1906 hci_notify(hdev, HCI_DEV_RESUME);
1907 return 0;
1908}
1909EXPORT_SYMBOL(hci_resume_dev);
1910
76bca880
MH		 1911/* Receive frame from HCI drivers */
1912int hci_recv_frame(struct sk_buff *skb)
1913{
1914 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1915 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 1916 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 1917 kfree_skb(skb);
1918 return -ENXIO;
1919 }
1920
1921 /* Incomming skb */
1922 bt_cb(skb)->incoming = 1;
1923
1924 /* Time stamp */
1925 __net_timestamp(skb);
1926
76bca880 1927 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 1928 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 1929
76bca880
MH		 1930 return 0;
1931}
1932EXPORT_SYMBOL(hci_recv_frame);
1933
33e882a5 1934static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
a8c5fb1a 1935 int count, __u8 index)
33e882a5
SS		 1936{
1937 int len = 0;
1938 int hlen = 0;
1939 int remain = count;
1940 struct sk_buff *skb;
1941 struct bt_skb_cb *scb;
1942
1943 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
a8c5fb1a 1944 index >= NUM_REASSEMBLY)
33e882a5
SS		 1945 return -EILSEQ;
1946
1947 skb = hdev->reassembly[index];
1948
1949 if (!skb) {
1950 switch (type) {
1951 case HCI_ACLDATA_PKT:
1952 len = HCI_MAX_FRAME_SIZE;
1953 hlen = HCI_ACL_HDR_SIZE;
1954 break;
1955 case HCI_EVENT_PKT:
1956 len = HCI_MAX_EVENT_SIZE;
1957 hlen = HCI_EVENT_HDR_SIZE;
1958 break;
1959 case HCI_SCODATA_PKT:
1960 len = HCI_MAX_SCO_SIZE;
1961 hlen = HCI_SCO_HDR_SIZE;
1962 break;
1963 }
1964
1e429f38 1965 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 1966 if (!skb)
1967 return -ENOMEM;
1968
1969 scb = (void *) skb->cb;
1970 scb->expect = hlen;
1971 scb->pkt_type = type;
1972
1973 skb->dev = (void *) hdev;
1974 hdev->reassembly[index] = skb;
1975 }
1976
1977 while (count) {
1978 scb = (void *) skb->cb;
89bb46d0 1979 len = min_t(uint, scb->expect, count);
33e882a5
SS		 1980
1981 memcpy(skb_put(skb, len), data, len);
1982
1983 count -= len;
1984 data += len;
1985 scb->expect -= len;
1986 remain = count;
1987
1988 switch (type) {
1989 case HCI_EVENT_PKT:
1990 if (skb->len == HCI_EVENT_HDR_SIZE) {
1991 struct hci_event_hdr *h = hci_event_hdr(skb);
1992 scb->expect = h->plen;
1993
1994 if (skb_tailroom(skb) < scb->expect) {
1995 kfree_skb(skb);
1996 hdev->reassembly[index] = NULL;
1997 return -ENOMEM;
1998 }
1999 }
2000 break;
2001
2002 case HCI_ACLDATA_PKT:
2003 if (skb->len == HCI_ACL_HDR_SIZE) {
2004 struct hci_acl_hdr *h = hci_acl_hdr(skb);
2005 scb->expect = __le16_to_cpu(h->dlen);
2006
2007 if (skb_tailroom(skb) < scb->expect) {
2008 kfree_skb(skb);
2009 hdev->reassembly[index] = NULL;
2010 return -ENOMEM;
2011 }
2012 }
2013 break;
2014
2015 case HCI_SCODATA_PKT:
2016 if (skb->len == HCI_SCO_HDR_SIZE) {
2017 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2018 scb->expect = h->dlen;
2019
2020 if (skb_tailroom(skb) < scb->expect) {
2021 kfree_skb(skb);
2022 hdev->reassembly[index] = NULL;
2023 return -ENOMEM;
2024 }
2025 }
2026 break;
2027 }
2028
2029 if (scb->expect == 0) {
2030 /* Complete frame */
2031
2032 bt_cb(skb)->pkt_type = type;
2033 hci_recv_frame(skb);
2034
2035 hdev->reassembly[index] = NULL;
2036 return remain;
2037 }
2038 }
2039
2040 return remain;
2041}
2042
ef222013
MH		 2043int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2044{
f39a3c06
SS		 2045 int rem = 0;
2046
ef222013
MH		 2047 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2048 return -EILSEQ;
2049
da5f6c37 2050 while (count) {
1e429f38 2051 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 2052 if (rem < 0)
2053 return rem;
ef222013 2054
f39a3c06
SS		 2055 data += (count - rem);
2056 count = rem;
f81c6224 2057 }
ef222013 2058
f39a3c06 2059 return rem;
ef222013
MH		 2060}
2061EXPORT_SYMBOL(hci_recv_fragment);
2062
99811510
SS		 2063#define STREAM_REASSEMBLY 0
2064
2065int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2066{
2067 int type;
2068 int rem = 0;
2069
da5f6c37 2070 while (count) {
99811510
SS		 2071 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2072
2073 if (!skb) {
2074 struct { char type; } *pkt;
2075
2076 /* Start of the frame */
2077 pkt = data;
2078 type = pkt->type;
2079
2080 data++;
2081 count--;
2082 } else
2083 type = bt_cb(skb)->pkt_type;
2084
1e429f38 2085 rem = hci_reassembly(hdev, type, data, count,
a8c5fb1a 2086 STREAM_REASSEMBLY);
99811510
SS		 2087 if (rem < 0)
2088 return rem;
2089
2090 data += (count - rem);
2091 count = rem;
f81c6224 2092 }
99811510
SS		 2093
2094 return rem;
2095}
2096EXPORT_SYMBOL(hci_recv_stream_fragment);
2097
1da177e4
LT		 2098/* ---- Interface to upper protocols ---- */
2099
1da177e4
LT		 2100int hci_register_cb(struct hci_cb *cb)
2101{
2102 BT_DBG("%p name %s", cb, cb->name);
2103
f20d09d5 2104 write_lock(&hci_cb_list_lock);
1da177e4 2105 list_add(&cb->list, &hci_cb_list);
f20d09d5 2106 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2107
2108 return 0;
2109}
2110EXPORT_SYMBOL(hci_register_cb);
2111
2112int hci_unregister_cb(struct hci_cb *cb)
2113{
2114 BT_DBG("%p name %s", cb, cb->name);
2115
f20d09d5 2116 write_lock(&hci_cb_list_lock);
1da177e4 2117 list_del(&cb->list);
f20d09d5 2118 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2119
2120 return 0;
2121}
2122EXPORT_SYMBOL(hci_unregister_cb);
2123
2124static int hci_send_frame(struct sk_buff *skb)
2125{
2126 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2127
2128 if (!hdev) {
2129 kfree_skb(skb);
2130 return -ENODEV;
2131 }
2132
0d48d939 2133 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4 2134
cd82e61c
MH		 2135 /* Time stamp */
2136 __net_timestamp(skb);
1da177e4 2137
cd82e61c
MH		 2138 /* Send copy to monitor */
2139 hci_send_to_monitor(hdev, skb);
2140
2141 if (atomic_read(&hdev->promisc)) {
2142 /* Send copy to the sockets */
470fe1b5 2143 hci_send_to_sock(hdev, skb);
1da177e4
LT		 2144 }
2145
2146 /* Get rid of skb owner, prior to sending to the driver. */
2147 skb_orphan(skb);
2148
2149 return hdev->send(skb);
2150}
2151
2152/* Send HCI command */
a9de9248 2153int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 2154{
2155 int len = HCI_COMMAND_HDR_SIZE + plen;
2156 struct hci_command_hdr *hdr;
2157 struct sk_buff *skb;
2158
f0e09510 2159 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 2160
2161 skb = bt_skb_alloc(len, GFP_ATOMIC);
2162 if (!skb) {
ef222013 2163 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 2164 return -ENOMEM;
2165 }
2166
2167 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 2168 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 2169 hdr->plen = plen;
2170
2171 if (plen)
2172 memcpy(skb_put(skb, plen), param, plen);
2173
2174 BT_DBG("skb len %d", skb->len);
2175
0d48d939 2176 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 2177 skb->dev = (void *) hdev;
c78ae283 2178
a5040efa
JH		 2179 if (test_bit(HCI_INIT, &hdev->flags))
2180 hdev->init_last_cmd = opcode;
2181
1da177e4 2182 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 2183 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 2184
2185 return 0;
2186}
1da177e4
LT		 2187
2188/* Get data from the previously sent command */
a9de9248 2189void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 2190{
2191 struct hci_command_hdr *hdr;
2192
2193 if (!hdev->sent_cmd)
2194 return NULL;
2195
2196 hdr = (void *) hdev->sent_cmd->data;
2197
a9de9248 2198 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 2199 return NULL;
2200
f0e09510 2201 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 2202
2203 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2204}
2205
2206/* Send ACL data */
2207static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2208{
2209 struct hci_acl_hdr *hdr;
2210 int len = skb->len;
2211
badff6d0
ACM		 2212 skb_push(skb, HCI_ACL_HDR_SIZE);
2213 skb_reset_transport_header(skb);
9c70220b 2214 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 2215 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2216 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 2217}
2218
ee22be7e 2219static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 2220 struct sk_buff *skb, __u16 flags)
1da177e4 2221{
ee22be7e 2222 struct hci_conn *conn = chan->conn;
1da177e4
LT		 2223 struct hci_dev *hdev = conn->hdev;
2224 struct sk_buff *list;
2225
087bfd99
GP		 2226 skb->len = skb_headlen(skb);
2227 skb->data_len = 0;
2228
2229 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
204a6e54
AE		 2230
2231 switch (hdev->dev_type) {
2232 case HCI_BREDR:
2233 hci_add_acl_hdr(skb, conn->handle, flags);
2234 break;
2235 case HCI_AMP:
2236 hci_add_acl_hdr(skb, chan->handle, flags);
2237 break;
2238 default:
2239 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2240 return;
2241 }
087bfd99 2242
70f23020
AE		 2243 list = skb_shinfo(skb)->frag_list;
2244 if (!list) {
1da177e4
LT		 2245 /* Non fragmented */
2246 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2247
73d80deb 2248 skb_queue_tail(queue, skb);
1da177e4
LT		 2249 } else {
2250 /* Fragmented */
2251 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2252
2253 skb_shinfo(skb)->frag_list = NULL;
2254
2255 /* Queue all fragments atomically */
af3e6359 2256 spin_lock(&queue->lock);
1da177e4 2257
73d80deb 2258 __skb_queue_tail(queue, skb);
e702112f
AE		 2259
2260 flags &= ~ACL_START;
2261 flags |= ACL_CONT;
1da177e4
LT		 2262 do {
2263 skb = list; list = list->next;
8e87d142 2264
1da177e4 2265 skb->dev = (void *) hdev;
0d48d939 2266 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 2267 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 2268
2269 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2270
73d80deb 2271 __skb_queue_tail(queue, skb);
1da177e4
LT		 2272 } while (list);
2273
af3e6359 2274 spin_unlock(&queue->lock);
1da177e4 2275 }
73d80deb
LAD		 2276}
2277
2278void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2279{
ee22be7e 2280 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 2281
f0e09510 2282 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb
LAD		 2283
2284 skb->dev = (void *) hdev;
73d80deb 2285
ee22be7e 2286 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 2287
3eff45ea 2288 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 2289}
1da177e4
LT		 2290
2291/* Send SCO data */
0d861d8b 2292void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 2293{
2294 struct hci_dev *hdev = conn->hdev;
2295 struct hci_sco_hdr hdr;
2296
2297 BT_DBG("%s len %d", hdev->name, skb->len);
2298
aca3192c 2299 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 2300 hdr.dlen = skb->len;
2301
badff6d0
ACM		 2302 skb_push(skb, HCI_SCO_HDR_SIZE);
2303 skb_reset_transport_header(skb);
9c70220b 2304 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 2305
2306 skb->dev = (void *) hdev;
0d48d939 2307 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 2308
1da177e4 2309 skb_queue_tail(&conn->data_q, skb);
3eff45ea 2310 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 2311}
1da177e4
LT		 2312
2313/* ---- HCI TX task (outgoing data) ---- */
2314
2315/* HCI Connection scheduler */
6039aa73
GP		 2316static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
2317 int *quote)
1da177e4
LT		 2318{
2319 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2320 struct hci_conn *conn = NULL, *c;
abc5de8f 2321 unsigned int num = 0, min = ~0;
1da177e4 2322
8e87d142 2323 /* We don't have to lock device here. Connections are always
1da177e4 2324 * added and removed with TX task disabled. */
bf4c6325
GP		 2325
2326 rcu_read_lock();
2327
2328 list_for_each_entry_rcu(c, &h->list, list) {
769be974 2329 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2330 continue;
769be974
MH		 2331
2332 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2333 continue;
2334
1da177e4
LT		 2335 num++;
2336
2337 if (c->sent < min) {
2338 min = c->sent;
2339 conn = c;
2340 }
52087a79
LAD		 2341
2342 if (hci_conn_num(hdev, type) == num)
2343 break;
1da177e4
LT		 2344 }
2345
bf4c6325
GP		 2346 rcu_read_unlock();
2347
1da177e4 2348 if (conn) {
6ed58ec5
VT		 2349 int cnt, q;
2350
2351 switch (conn->type) {
2352 case ACL_LINK:
2353 cnt = hdev->acl_cnt;
2354 break;
2355 case SCO_LINK:
2356 case ESCO_LINK:
2357 cnt = hdev->sco_cnt;
2358 break;
2359 case LE_LINK:
2360 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2361 break;
2362 default:
2363 cnt = 0;
2364 BT_ERR("Unknown link type");
2365 }
2366
2367 q = cnt / num;
1da177e4
LT		 2368 *quote = q ? q : 1;
2369 } else
2370 *quote = 0;
2371
2372 BT_DBG("conn %p quote %d", conn, *quote);
2373 return conn;
2374}
2375
6039aa73 2376static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2377{
2378 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2379 struct hci_conn *c;
1da177e4 2380
bae1f5d9 2381 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 2382
bf4c6325
GP		 2383 rcu_read_lock();
2384
1da177e4 2385 /* Kill stalled connections */
bf4c6325 2386 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 2387 if (c->type == type && c->sent) {
6ed93dc6
AE		 2388 BT_ERR("%s killing stalled connection %pMR",
2389 hdev->name, &c->dst);
7490c6c2 2390 hci_acl_disconn(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 2391 }
2392 }
bf4c6325
GP		 2393
2394 rcu_read_unlock();
1da177e4
LT		 2395}
2396
6039aa73
GP		 2397static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2398 int *quote)
1da177e4 2399{
73d80deb
LAD		 2400 struct hci_conn_hash *h = &hdev->conn_hash;
2401 struct hci_chan *chan = NULL;
abc5de8f 2402 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 2403 struct hci_conn *conn;
73d80deb
LAD		 2404 int cnt, q, conn_num = 0;
2405
2406 BT_DBG("%s", hdev->name);
2407
bf4c6325
GP		 2408 rcu_read_lock();
2409
2410 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 2411 struct hci_chan *tmp;
2412
2413 if (conn->type != type)
2414 continue;
2415
2416 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2417 continue;
2418
2419 conn_num++;
2420
8192edef 2421 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 2422 struct sk_buff *skb;
2423
2424 if (skb_queue_empty(&tmp->data_q))
2425 continue;
2426
2427 skb = skb_peek(&tmp->data_q);
2428 if (skb->priority < cur_prio)
2429 continue;
2430
2431 if (skb->priority > cur_prio) {
2432 num = 0;
2433 min = ~0;
2434 cur_prio = skb->priority;
2435 }
2436
2437 num++;
2438
2439 if (conn->sent < min) {
2440 min = conn->sent;
2441 chan = tmp;
2442 }
2443 }
2444
2445 if (hci_conn_num(hdev, type) == conn_num)
2446 break;
2447 }
2448
bf4c6325
GP		 2449 rcu_read_unlock();
2450
73d80deb
LAD		 2451 if (!chan)
2452 return NULL;
2453
2454 switch (chan->conn->type) {
2455 case ACL_LINK:
2456 cnt = hdev->acl_cnt;
2457 break;
bd1eb66b
AE		 2458 case AMP_LINK:
2459 cnt = hdev->block_cnt;
2460 break;
73d80deb
LAD		 2461 case SCO_LINK:
2462 case ESCO_LINK:
2463 cnt = hdev->sco_cnt;
2464 break;
2465 case LE_LINK:
2466 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2467 break;
2468 default:
2469 cnt = 0;
2470 BT_ERR("Unknown link type");
2471 }
2472
2473 q = cnt / num;
2474 *quote = q ? q : 1;
2475 BT_DBG("chan %p quote %d", chan, *quote);
2476 return chan;
2477}
2478
02b20f0b
LAD		 2479static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2480{
2481 struct hci_conn_hash *h = &hdev->conn_hash;
2482 struct hci_conn *conn;
2483 int num = 0;
2484
2485 BT_DBG("%s", hdev->name);
2486
bf4c6325
GP		 2487 rcu_read_lock();
2488
2489 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 2490 struct hci_chan *chan;
2491
2492 if (conn->type != type)
2493 continue;
2494
2495 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2496 continue;
2497
2498 num++;
2499
8192edef 2500 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 2501 struct sk_buff *skb;
2502
2503 if (chan->sent) {
2504 chan->sent = 0;
2505 continue;
2506 }
2507
2508 if (skb_queue_empty(&chan->data_q))
2509 continue;
2510
2511 skb = skb_peek(&chan->data_q);
2512 if (skb->priority >= HCI_PRIO_MAX - 1)
2513 continue;
2514
2515 skb->priority = HCI_PRIO_MAX - 1;
2516
2517 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 2518 skb->priority);
02b20f0b
LAD		 2519 }
2520
2521 if (hci_conn_num(hdev, type) == num)
2522 break;
2523 }
bf4c6325
GP		 2524
2525 rcu_read_unlock();
2526
02b20f0b
LAD		 2527}
2528
b71d385a
AE		 2529static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
2530{
2531 /* Calculate count of blocks used by this packet */
2532 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
2533}
2534
6039aa73 2535static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 2536{
1da177e4
LT		 2537 if (!test_bit(HCI_RAW, &hdev->flags)) {
2538 /* ACL tx timeout must be longer than maximum
2539 * link supervision timeout (40.9 seconds) */
63d2bc1b 2540 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 2541 HCI_ACL_TX_TIMEOUT))
bae1f5d9 2542 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 2543 }
63d2bc1b 2544}
1da177e4 2545
6039aa73 2546static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 2547{
2548 unsigned int cnt = hdev->acl_cnt;
2549 struct hci_chan *chan;
2550 struct sk_buff *skb;
2551 int quote;
2552
2553 __check_timeout(hdev, cnt);
04837f64 2554
73d80deb 2555 while (hdev->acl_cnt &&
a8c5fb1a 2556 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 2557 u32 priority = (skb_peek(&chan->data_q))->priority;
2558 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 2559 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 2560 skb->len, skb->priority);
73d80deb 2561
ec1cce24
LAD		 2562 /* Stop if priority has changed */
2563 if (skb->priority < priority)
2564 break;
2565
2566 skb = skb_dequeue(&chan->data_q);
2567
73d80deb 2568 hci_conn_enter_active_mode(chan->conn,
04124681 2569 bt_cb(skb)->force_active);
04837f64 2570
1da177e4
LT		 2571 hci_send_frame(skb);
2572 hdev->acl_last_tx = jiffies;
2573
2574 hdev->acl_cnt--;
73d80deb
LAD		 2575 chan->sent++;
2576 chan->conn->sent++;
1da177e4
LT		 2577 }
2578 }
02b20f0b
LAD		 2579
2580 if (cnt != hdev->acl_cnt)
2581 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 2582}
2583
6039aa73 2584static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 2585{
63d2bc1b 2586 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 2587 struct hci_chan *chan;
2588 struct sk_buff *skb;
2589 int quote;
bd1eb66b 2590 u8 type;
b71d385a 2591
63d2bc1b 2592 __check_timeout(hdev, cnt);
b71d385a 2593
bd1eb66b
AE		 2594 BT_DBG("%s", hdev->name);
2595
2596 if (hdev->dev_type == HCI_AMP)
2597 type = AMP_LINK;
2598 else
2599 type = ACL_LINK;
2600
b71d385a 2601 while (hdev->block_cnt > 0 &&
bd1eb66b 2602 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 2603 u32 priority = (skb_peek(&chan->data_q))->priority;
2604 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
2605 int blocks;
2606
2607 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 2608 skb->len, skb->priority);
b71d385a
AE		 2609
2610 /* Stop if priority has changed */
2611 if (skb->priority < priority)
2612 break;
2613
2614 skb = skb_dequeue(&chan->data_q);
2615
2616 blocks = __get_blocks(hdev, skb);
2617 if (blocks > hdev->block_cnt)
2618 return;
2619
2620 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 2621 bt_cb(skb)->force_active);
b71d385a
AE		 2622
2623 hci_send_frame(skb);
2624 hdev->acl_last_tx = jiffies;
2625
2626 hdev->block_cnt -= blocks;
2627 quote -= blocks;
2628
2629 chan->sent += blocks;
2630 chan->conn->sent += blocks;
2631 }
2632 }
2633
2634 if (cnt != hdev->block_cnt)
bd1eb66b 2635 hci_prio_recalculate(hdev, type);
b71d385a
AE		 2636}
2637
6039aa73 2638static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 2639{
2640 BT_DBG("%s", hdev->name);
2641
bd1eb66b
AE		 2642 /* No ACL link over BR/EDR controller */
2643 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
2644 return;
2645
2646 /* No AMP link over AMP controller */
2647 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 2648 return;
2649
2650 switch (hdev->flow_ctl_mode) {
2651 case HCI_FLOW_CTL_MODE_PACKET_BASED:
2652 hci_sched_acl_pkt(hdev);
2653 break;
2654
2655 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
2656 hci_sched_acl_blk(hdev);
2657 break;
2658 }
2659}
2660
1da177e4 2661/* Schedule SCO */
6039aa73 2662static void hci_sched_sco(struct hci_dev *hdev)
1da177e4
LT		 2663{
2664 struct hci_conn *conn;
2665 struct sk_buff *skb;
2666 int quote;
2667
2668 BT_DBG("%s", hdev->name);
2669
52087a79
LAD		 2670 if (!hci_conn_num(hdev, SCO_LINK))
2671 return;
2672
1da177e4
LT		 2673 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2674 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2675 BT_DBG("skb %p len %d", skb, skb->len);
2676 hci_send_frame(skb);
2677
2678 conn->sent++;
2679 if (conn->sent == ~0)
2680 conn->sent = 0;
2681 }
2682 }
2683}
2684
6039aa73 2685static void hci_sched_esco(struct hci_dev *hdev)
b6a0dc82
MH		 2686{
2687 struct hci_conn *conn;
2688 struct sk_buff *skb;
2689 int quote;
2690
2691 BT_DBG("%s", hdev->name);
2692
52087a79
LAD		 2693 if (!hci_conn_num(hdev, ESCO_LINK))
2694 return;
2695
8fc9ced3
GP		 2696 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
2697 &quote))) {
b6a0dc82
MH		 2698 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2699 BT_DBG("skb %p len %d", skb, skb->len);
2700 hci_send_frame(skb);
2701
2702 conn->sent++;
2703 if (conn->sent == ~0)
2704 conn->sent = 0;
2705 }
2706 }
2707}
2708
6039aa73 2709static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 2710{
73d80deb 2711 struct hci_chan *chan;
6ed58ec5 2712 struct sk_buff *skb;
02b20f0b 2713 int quote, cnt, tmp;
6ed58ec5
VT		 2714
2715 BT_DBG("%s", hdev->name);
2716
52087a79
LAD		 2717 if (!hci_conn_num(hdev, LE_LINK))
2718 return;
2719
6ed58ec5
VT		 2720 if (!test_bit(HCI_RAW, &hdev->flags)) {
2721 /* LE tx timeout must be longer than maximum
2722 * link supervision timeout (40.9 seconds) */
bae1f5d9 2723 if (!hdev->le_cnt && hdev->le_pkts &&
a8c5fb1a 2724 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 2725 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 2726 }
2727
2728 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 2729 tmp = cnt;
73d80deb 2730 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 2731 u32 priority = (skb_peek(&chan->data_q))->priority;
2732 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 2733 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 2734 skb->len, skb->priority);
6ed58ec5 2735
ec1cce24
LAD		 2736 /* Stop if priority has changed */
2737 if (skb->priority < priority)
2738 break;
2739
2740 skb = skb_dequeue(&chan->data_q);
2741
6ed58ec5
VT		 2742 hci_send_frame(skb);
2743 hdev->le_last_tx = jiffies;
2744
2745 cnt--;
73d80deb
LAD		 2746 chan->sent++;
2747 chan->conn->sent++;
6ed58ec5
VT		 2748 }
2749 }
73d80deb 2750
6ed58ec5
VT		 2751 if (hdev->le_pkts)
2752 hdev->le_cnt = cnt;
2753 else
2754 hdev->acl_cnt = cnt;
02b20f0b
LAD		 2755
2756 if (cnt != tmp)
2757 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 2758}
2759
3eff45ea 2760static void hci_tx_work(struct work_struct *work)
1da177e4 2761{
3eff45ea 2762 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 2763 struct sk_buff *skb;
2764
6ed58ec5 2765 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 2766 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 2767
2768 /* Schedule queues and send stuff to HCI driver */
2769
2770 hci_sched_acl(hdev);
2771
2772 hci_sched_sco(hdev);
2773
b6a0dc82
MH		 2774 hci_sched_esco(hdev);
2775
6ed58ec5
VT		 2776 hci_sched_le(hdev);
2777
1da177e4
LT		 2778 /* Send next queued raw (unknown type) packet */
2779 while ((skb = skb_dequeue(&hdev->raw_q)))
2780 hci_send_frame(skb);
1da177e4
LT		 2781}
2782
25985edc 2783/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 2784
2785/* ACL data packet */
6039aa73 2786static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 2787{
2788 struct hci_acl_hdr *hdr = (void *) skb->data;
2789 struct hci_conn *conn;
2790 __u16 handle, flags;
2791
2792 skb_pull(skb, HCI_ACL_HDR_SIZE);
2793
2794 handle = __le16_to_cpu(hdr->handle);
2795 flags = hci_flags(handle);
2796 handle = hci_handle(handle);
2797
f0e09510 2798 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 2799 handle, flags);
1da177e4
LT		 2800
2801 hdev->stat.acl_rx++;
2802
2803 hci_dev_lock(hdev);
2804 conn = hci_conn_hash_lookup_handle(hdev, handle);
2805 hci_dev_unlock(hdev);
8e87d142 2806
1da177e4 2807 if (conn) {
65983fc7 2808 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 2809
671267bf
JH		 2810 hci_dev_lock(hdev);
2811 if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
2812 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2813 mgmt_device_connected(hdev, &conn->dst, conn->type,
2814 conn->dst_type, 0, NULL, 0,
2815 conn->dev_class);
2816 hci_dev_unlock(hdev);
2817
1da177e4 2818 /* Send to upper protocol */
686ebf28
UF		 2819 l2cap_recv_acldata(conn, skb, flags);
2820 return;
1da177e4 2821 } else {
8e87d142 2822 BT_ERR("%s ACL packet for unknown connection handle %d",
a8c5fb1a 2823 hdev->name, handle);
1da177e4
LT		 2824 }
2825
2826 kfree_skb(skb);
2827}
2828
2829/* SCO data packet */
6039aa73 2830static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 2831{
2832 struct hci_sco_hdr *hdr = (void *) skb->data;
2833 struct hci_conn *conn;
2834 __u16 handle;
2835
2836 skb_pull(skb, HCI_SCO_HDR_SIZE);
2837
2838 handle = __le16_to_cpu(hdr->handle);
2839
f0e09510 2840 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
1da177e4
LT		 2841
2842 hdev->stat.sco_rx++;
2843
2844 hci_dev_lock(hdev);
2845 conn = hci_conn_hash_lookup_handle(hdev, handle);
2846 hci_dev_unlock(hdev);
2847
2848 if (conn) {
1da177e4 2849 /* Send to upper protocol */
686ebf28
UF		 2850 sco_recv_scodata(conn, skb);
2851 return;
1da177e4 2852 } else {
8e87d142 2853 BT_ERR("%s SCO packet for unknown connection handle %d",
a8c5fb1a 2854 hdev->name, handle);
1da177e4
LT		 2855 }
2856
2857 kfree_skb(skb);
2858}
2859
b78752cc 2860static void hci_rx_work(struct work_struct *work)
1da177e4 2861{
b78752cc 2862 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 2863 struct sk_buff *skb;
2864
2865 BT_DBG("%s", hdev->name);
2866
1da177e4 2867 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 2868 /* Send copy to monitor */
2869 hci_send_to_monitor(hdev, skb);
2870
1da177e4
LT		 2871 if (atomic_read(&hdev->promisc)) {
2872 /* Send copy to the sockets */
470fe1b5 2873 hci_send_to_sock(hdev, skb);
1da177e4
LT		 2874 }
2875
2876 if (test_bit(HCI_RAW, &hdev->flags)) {
2877 kfree_skb(skb);
2878 continue;
2879 }
2880
2881 if (test_bit(HCI_INIT, &hdev->flags)) {
2882 /* Don't process data packets in this states. */
0d48d939 2883 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2884 case HCI_ACLDATA_PKT:
2885 case HCI_SCODATA_PKT:
2886 kfree_skb(skb);
2887 continue;
3ff50b79 2888 }
1da177e4
LT		 2889 }
2890
2891 /* Process frame */
0d48d939 2892 switch (bt_cb(skb)->pkt_type) {
1da177e4 2893 case HCI_EVENT_PKT:
b78752cc 2894 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 2895 hci_event_packet(hdev, skb);
2896 break;
2897
2898 case HCI_ACLDATA_PKT:
2899 BT_DBG("%s ACL data packet", hdev->name);
2900 hci_acldata_packet(hdev, skb);
2901 break;
2902
2903 case HCI_SCODATA_PKT:
2904 BT_DBG("%s SCO data packet", hdev->name);
2905 hci_scodata_packet(hdev, skb);
2906 break;
2907
2908 default:
2909 kfree_skb(skb);
2910 break;
2911 }
2912 }
1da177e4
LT		 2913}
2914
c347b765 2915static void hci_cmd_work(struct work_struct *work)
1da177e4 2916{
c347b765 2917 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 2918 struct sk_buff *skb;
2919
2104786b
AE		 2920 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
2921 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 2922
1da177e4 2923 /* Send queued commands */
5a08ecce
AE		 2924 if (atomic_read(&hdev->cmd_cnt)) {
2925 skb = skb_dequeue(&hdev->cmd_q);
2926 if (!skb)
2927 return;
2928
7585b97a 2929 kfree_skb(hdev->sent_cmd);
1da177e4 2930
70f23020
AE		 2931 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2932 if (hdev->sent_cmd) {
1da177e4
LT		 2933 atomic_dec(&hdev->cmd_cnt);
2934 hci_send_frame(skb);
7bdb8a5c
SJ		 2935 if (test_bit(HCI_RESET, &hdev->flags))
2936 del_timer(&hdev->cmd_timer);
2937 else
2938 mod_timer(&hdev->cmd_timer,
5f246e89 2939 jiffies + HCI_CMD_TIMEOUT);
1da177e4
LT		 2940 } else {
2941 skb_queue_head(&hdev->cmd_q, skb);
c347b765 2942 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 2943 }
2944 }
2945}
2519a1fc
AG		 2946
2947int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2948{
2949 /* General inquiry access code (GIAC) */
2950 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2951 struct hci_cp_inquiry cp;
2952
2953 BT_DBG("%s", hdev->name);
2954
2955 if (test_bit(HCI_INQUIRY, &hdev->flags))
2956 return -EINPROGRESS;
2957
4663262c
JH		 2958 inquiry_cache_flush(hdev);
2959
2519a1fc
AG		 2960 memset(&cp, 0, sizeof(cp));
2961 memcpy(&cp.lap, lap, sizeof(cp.lap));
2962 cp.length = length;
2963
2964 return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2965}
023d5049
AG		 2966
2967int hci_cancel_inquiry(struct hci_dev *hdev)
2968{
2969 BT_DBG("%s", hdev->name);
2970
2971 if (!test_bit(HCI_INQUIRY, &hdev->flags))
7537e5c3 2972 return -EALREADY;
023d5049
AG		 2973
2974 return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2975}
31f7956c
AG		 2976
2977u8 bdaddr_to_le(u8 bdaddr_type)
2978{
2979 switch (bdaddr_type) {
2980 case BDADDR_LE_PUBLIC:
2981 return ADDR_LE_DEV_PUBLIC;
2982
2983 default:
2984 /* Fallback to LE Random address type */
2985 return ADDR_LE_DEV_RANDOM;
2986 }
2987}
kernel source for telekom puls (alcatel/mediatek)