projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
rt2x00: fix crash in rt2800usb_get_txwi
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
f48fd9c8 40#include <linux/workqueue.h>
1da177e4
LT		 41#include <linux/interrupt.h>
42#include <linux/notifier.h>
611b30f7 43#include <linux/rfkill.h>
6bd32326 44#include <linux/timer.h>
3a0259bb 45#include <linux/crypto.h>
1da177e4
LT		 46#include <net/sock.h>
47
48#include <asm/system.h>
70f23020 49#include <linux/uaccess.h>
1da177e4
LT		 50#include <asm/unaligned.h>
51
52#include <net/bluetooth/bluetooth.h>
53#include <net/bluetooth/hci_core.h>
54
ab81cbf9
JH		 55#define AUTO_OFF_TIMEOUT 2000
56
1da177e4
LT		 57static void hci_cmd_task(unsigned long arg);
58static void hci_rx_task(unsigned long arg);
59static void hci_tx_task(unsigned long arg);
1da177e4
LT		 60
61static DEFINE_RWLOCK(hci_task_lock);
62
63/* HCI device list */
64LIST_HEAD(hci_dev_list);
65DEFINE_RWLOCK(hci_dev_list_lock);
66
67/* HCI callback list */
68LIST_HEAD(hci_cb_list);
69DEFINE_RWLOCK(hci_cb_list_lock);
70
71/* HCI protocols */
72#define HCI_MAX_PROTO 2
73struct hci_proto *hci_proto[HCI_MAX_PROTO];
74
75/* HCI notifiers list */
e041c683 76static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 77
78/* ---- HCI notifications ---- */
79
80int hci_register_notifier(struct notifier_block *nb)
81{
e041c683 82 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 83}
84
85int hci_unregister_notifier(struct notifier_block *nb)
86{
e041c683 87 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 88}
89
6516455d 90static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 91{
e041c683 92 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 93}
94
95/* ---- HCI requests ---- */
96
23bb5763 97void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 98{
23bb5763
JH		 99 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
100
a5040efa
JH		 101 /* If this is the init phase check if the completed command matches
102 * the last init command, and if not just return.
103 */
104 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
23bb5763 105 return;
1da177e4
LT		 106
107 if (hdev->req_status == HCI_REQ_PEND) {
108 hdev->req_result = result;
109 hdev->req_status = HCI_REQ_DONE;
110 wake_up_interruptible(&hdev->req_wait_q);
111 }
112}
113
114static void hci_req_cancel(struct hci_dev *hdev, int err)
115{
116 BT_DBG("%s err 0x%2.2x", hdev->name, err);
117
118 if (hdev->req_status == HCI_REQ_PEND) {
119 hdev->req_result = err;
120 hdev->req_status = HCI_REQ_CANCELED;
121 wake_up_interruptible(&hdev->req_wait_q);
122 }
123}
124
125/* Execute request and wait for completion. */
8e87d142 126static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 127 unsigned long opt, __u32 timeout)
1da177e4
LT		 128{
129 DECLARE_WAITQUEUE(wait, current);
130 int err = 0;
131
132 BT_DBG("%s start", hdev->name);
133
134 hdev->req_status = HCI_REQ_PEND;
135
136 add_wait_queue(&hdev->req_wait_q, &wait);
137 set_current_state(TASK_INTERRUPTIBLE);
138
139 req(hdev, opt);
140 schedule_timeout(timeout);
141
142 remove_wait_queue(&hdev->req_wait_q, &wait);
143
144 if (signal_pending(current))
145 return -EINTR;
146
147 switch (hdev->req_status) {
148 case HCI_REQ_DONE:
e175072f 149 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 150 break;
151
152 case HCI_REQ_CANCELED:
153 err = -hdev->req_result;
154 break;
155
156 default:
157 err = -ETIMEDOUT;
158 break;
3ff50b79 159 }
1da177e4 160
a5040efa 161 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 162
163 BT_DBG("%s end: err %d", hdev->name, err);
164
165 return err;
166}
167
168static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 169 unsigned long opt, __u32 timeout)
1da177e4
LT		 170{
171 int ret;
172
7c6a329e
MH		 173 if (!test_bit(HCI_UP, &hdev->flags))
174 return -ENETDOWN;
175
1da177e4
LT		 176 /* Serialize all requests */
177 hci_req_lock(hdev);
178 ret = __hci_request(hdev, req, opt, timeout);
179 hci_req_unlock(hdev);
180
181 return ret;
182}
183
184static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
185{
186 BT_DBG("%s %ld", hdev->name, opt);
187
188 /* Reset device */
f630cf0d 189 set_bit(HCI_RESET, &hdev->flags);
a9de9248 190 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 191}
192
193static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
194{
b0916ea0 195 struct hci_cp_delete_stored_link_key cp;
1da177e4 196 struct sk_buff *skb;
1ebb9252 197 __le16 param;
89f2783d 198 __u8 flt_type;
1da177e4
LT		 199
200 BT_DBG("%s %ld", hdev->name, opt);
201
202 /* Driver initialization */
203
204 /* Special commands */
205 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 206 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 207 skb->dev = (void *) hdev;
c78ae283 208
1da177e4 209 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 210 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 211 }
212 skb_queue_purge(&hdev->driver_init);
213
214 /* Mandatory initialization */
215
216 /* Reset */
f630cf0d
GP		 217 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
218 set_bit(HCI_RESET, &hdev->flags);
a9de9248 219 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
f630cf0d 220 }
1da177e4
LT		 221
222 /* Read Local Supported Features */
a9de9248 223 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 224
1143e5a6 225 /* Read Local Version */
a9de9248 226 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 227
1da177e4 228 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 229 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 230
231#if 0
232 /* Host buffer size */
233 {
234 struct hci_cp_host_buffer_size cp;
aca3192c 235 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 236 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 237 cp.acl_max_pkt = cpu_to_le16(0xffff);
238 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 239 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 240 }
241#endif
242
243 /* Read BD Address */
a9de9248
MH		 244 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
245
246 /* Read Class of Device */
247 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
248
249 /* Read Local Name */
250 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 251
252 /* Read Voice Setting */
a9de9248 253 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 254
255 /* Optional initialization */
256
257 /* Clear Event Filters */
89f2783d 258 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 259 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4 260
1da177e4 261 /* Connection accept timeout ~20 secs */
aca3192c 262 param = cpu_to_le16(0x7d00);
a9de9248 263 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
b0916ea0
JH		 264
265 bacpy(&cp.bdaddr, BDADDR_ANY);
266 cp.delete_all = 1;
267 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
1da177e4
LT		 268}
269
6ed58ec5
VT		 270static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
271{
272 BT_DBG("%s", hdev->name);
273
274 /* Read LE buffer size */
275 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
276}
277
1da177e4
LT		 278static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
279{
280 __u8 scan = opt;
281
282 BT_DBG("%s %x", hdev->name, scan);
283
284 /* Inquiry and Page scans */
a9de9248 285 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 286}
287
288static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
289{
290 __u8 auth = opt;
291
292 BT_DBG("%s %x", hdev->name, auth);
293
294 /* Authentication */
a9de9248 295 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 296}
297
298static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
299{
300 __u8 encrypt = opt;
301
302 BT_DBG("%s %x", hdev->name, encrypt);
303
e4e8e37c 304 /* Encryption */
a9de9248 305 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 306}
307
e4e8e37c
MH		 308static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
309{
310 __le16 policy = cpu_to_le16(opt);
311
a418b893 312 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 313
314 /* Default link policy */
315 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
316}
317
8e87d142 318/* Get HCI device by index.
1da177e4
LT		 319 * Device is held on return. */
320struct hci_dev *hci_dev_get(int index)
321{
322 struct hci_dev *hdev = NULL;
323 struct list_head *p;
324
325 BT_DBG("%d", index);
326
327 if (index < 0)
328 return NULL;
329
330 read_lock(&hci_dev_list_lock);
331 list_for_each(p, &hci_dev_list) {
332 struct hci_dev *d = list_entry(p, struct hci_dev, list);
333 if (d->id == index) {
334 hdev = hci_dev_hold(d);
335 break;
336 }
337 }
338 read_unlock(&hci_dev_list_lock);
339 return hdev;
340}
1da177e4
LT		 341
342/* ---- Inquiry support ---- */
343static void inquiry_cache_flush(struct hci_dev *hdev)
344{
345 struct inquiry_cache *cache = &hdev->inq_cache;
346 struct inquiry_entry *next = cache->list, *e;
347
348 BT_DBG("cache %p", cache);
349
350 cache->list = NULL;
351 while ((e = next)) {
352 next = e->next;
353 kfree(e);
354 }
355}
356
357struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
358{
359 struct inquiry_cache *cache = &hdev->inq_cache;
360 struct inquiry_entry *e;
361
362 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
363
364 for (e = cache->list; e; e = e->next)
365 if (!bacmp(&e->data.bdaddr, bdaddr))
366 break;
367 return e;
368}
369
370void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
371{
372 struct inquiry_cache *cache = &hdev->inq_cache;
70f23020 373 struct inquiry_entry *ie;
1da177e4
LT		 374
375 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
376
70f23020
AE		 377 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
378 if (!ie) {
1da177e4 379 /* Entry not in the cache. Add new one. */
70f23020
AE		 380 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
381 if (!ie)
1da177e4 382 return;
70f23020
AE		 383
384 ie->next = cache->list;
385 cache->list = ie;
1da177e4
LT		 386 }
387
70f23020
AE		 388 memcpy(&ie->data, data, sizeof(*data));
389 ie->timestamp = jiffies;
1da177e4
LT		 390 cache->timestamp = jiffies;
391}
392
393static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
394{
395 struct inquiry_cache *cache = &hdev->inq_cache;
396 struct inquiry_info *info = (struct inquiry_info *) buf;
397 struct inquiry_entry *e;
398 int copied = 0;
399
400 for (e = cache->list; e && copied < num; e = e->next, copied++) {
401 struct inquiry_data *data = &e->data;
402 bacpy(&info->bdaddr, &data->bdaddr);
403 info->pscan_rep_mode = data->pscan_rep_mode;
404 info->pscan_period_mode = data->pscan_period_mode;
405 info->pscan_mode = data->pscan_mode;
406 memcpy(info->dev_class, data->dev_class, 3);
407 info->clock_offset = data->clock_offset;
408 info++;
409 }
410
411 BT_DBG("cache %p, copied %d", cache, copied);
412 return copied;
413}
414
415static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
416{
417 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
418 struct hci_cp_inquiry cp;
419
420 BT_DBG("%s", hdev->name);
421
422 if (test_bit(HCI_INQUIRY, &hdev->flags))
423 return;
424
425 /* Start Inquiry */
426 memcpy(&cp.lap, &ir->lap, 3);
427 cp.length = ir->length;
428 cp.num_rsp = ir->num_rsp;
a9de9248 429 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 430}
431
432int hci_inquiry(void __user *arg)
433{
434 __u8 __user *ptr = arg;
435 struct hci_inquiry_req ir;
436 struct hci_dev *hdev;
437 int err = 0, do_inquiry = 0, max_rsp;
438 long timeo;
439 __u8 *buf;
440
441 if (copy_from_user(&ir, ptr, sizeof(ir)))
442 return -EFAULT;
443
5a08ecce
AE		 444 hdev = hci_dev_get(ir.dev_id);
445 if (!hdev)
1da177e4
LT		 446 return -ENODEV;
447
448 hci_dev_lock_bh(hdev);
8e87d142 449 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
70f23020
AE		 450 inquiry_cache_empty(hdev) ||
451 ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 452 inquiry_cache_flush(hdev);
453 do_inquiry = 1;
454 }
455 hci_dev_unlock_bh(hdev);
456
04837f64 457 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 458
459 if (do_inquiry) {
460 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
461 if (err < 0)
462 goto done;
463 }
1da177e4
LT		 464
465 /* for unlimited number of responses we will use buffer with 255 entries */
466 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
467
468 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
469 * copy it to the user space.
470 */
01df8c31 471 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 472 if (!buf) {
1da177e4
LT		 473 err = -ENOMEM;
474 goto done;
475 }
476
477 hci_dev_lock_bh(hdev);
478 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
479 hci_dev_unlock_bh(hdev);
480
481 BT_DBG("num_rsp %d", ir.num_rsp);
482
483 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
484 ptr += sizeof(ir);
485 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
486 ir.num_rsp))
487 err = -EFAULT;
8e87d142 488 } else
1da177e4
LT		 489 err = -EFAULT;
490
491 kfree(buf);
492
493done:
494 hci_dev_put(hdev);
495 return err;
496}
497
498/* ---- HCI ioctl helpers ---- */
499
500int hci_dev_open(__u16 dev)
501{
502 struct hci_dev *hdev;
503 int ret = 0;
504
5a08ecce
AE		 505 hdev = hci_dev_get(dev);
506 if (!hdev)
1da177e4
LT		 507 return -ENODEV;
508
509 BT_DBG("%s %p", hdev->name, hdev);
510
511 hci_req_lock(hdev);
512
611b30f7
MH		 513 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
514 ret = -ERFKILL;
515 goto done;
516 }
517
1da177e4
LT		 518 if (test_bit(HCI_UP, &hdev->flags)) {
519 ret = -EALREADY;
520 goto done;
521 }
522
523 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
524 set_bit(HCI_RAW, &hdev->flags);
525
943da25d
MH		 526 /* Treat all non BR/EDR controllers as raw devices for now */
527 if (hdev->dev_type != HCI_BREDR)
528 set_bit(HCI_RAW, &hdev->flags);
529
1da177e4
LT		 530 if (hdev->open(hdev)) {
531 ret = -EIO;
532 goto done;
533 }
534
535 if (!test_bit(HCI_RAW, &hdev->flags)) {
536 atomic_set(&hdev->cmd_cnt, 1);
537 set_bit(HCI_INIT, &hdev->flags);
a5040efa 538 hdev->init_last_cmd = 0;
1da177e4 539
04837f64
MH		 540 ret = __hci_request(hdev, hci_init_req, 0,
541 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4 542
eead27da 543 if (lmp_host_le_capable(hdev))
6ed58ec5
VT		 544 ret = __hci_request(hdev, hci_le_init_req, 0,
545 msecs_to_jiffies(HCI_INIT_TIMEOUT));
546
1da177e4
LT		 547 clear_bit(HCI_INIT, &hdev->flags);
548 }
549
550 if (!ret) {
551 hci_dev_hold(hdev);
552 set_bit(HCI_UP, &hdev->flags);
553 hci_notify(hdev, HCI_DEV_UP);
5add6af8
JH		 554 if (!test_bit(HCI_SETUP, &hdev->flags))
555 mgmt_powered(hdev->id, 1);
8e87d142 556 } else {
1da177e4
LT		 557 /* Init failed, cleanup */
558 tasklet_kill(&hdev->rx_task);
559 tasklet_kill(&hdev->tx_task);
560 tasklet_kill(&hdev->cmd_task);
561
562 skb_queue_purge(&hdev->cmd_q);
563 skb_queue_purge(&hdev->rx_q);
564
565 if (hdev->flush)
566 hdev->flush(hdev);
567
568 if (hdev->sent_cmd) {
569 kfree_skb(hdev->sent_cmd);
570 hdev->sent_cmd = NULL;
571 }
572
573 hdev->close(hdev);
574 hdev->flags = 0;
575 }
576
577done:
578 hci_req_unlock(hdev);
579 hci_dev_put(hdev);
580 return ret;
581}
582
583static int hci_dev_do_close(struct hci_dev *hdev)
584{
585 BT_DBG("%s %p", hdev->name, hdev);
586
587 hci_req_cancel(hdev, ENODEV);
588 hci_req_lock(hdev);
589
590 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 591 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 592 hci_req_unlock(hdev);
593 return 0;
594 }
595
596 /* Kill RX and TX tasks */
597 tasklet_kill(&hdev->rx_task);
598 tasklet_kill(&hdev->tx_task);
599
600 hci_dev_lock_bh(hdev);
601 inquiry_cache_flush(hdev);
602 hci_conn_hash_flush(hdev);
603 hci_dev_unlock_bh(hdev);
604
605 hci_notify(hdev, HCI_DEV_DOWN);
606
607 if (hdev->flush)
608 hdev->flush(hdev);
609
610 /* Reset device */
611 skb_queue_purge(&hdev->cmd_q);
612 atomic_set(&hdev->cmd_cnt, 1);
613 if (!test_bit(HCI_RAW, &hdev->flags)) {
614 set_bit(HCI_INIT, &hdev->flags);
04837f64
MH		 615 __hci_request(hdev, hci_reset_req, 0,
616 msecs_to_jiffies(250));
1da177e4
LT		 617 clear_bit(HCI_INIT, &hdev->flags);
618 }
619
620 /* Kill cmd task */
621 tasklet_kill(&hdev->cmd_task);
622
623 /* Drop queues */
624 skb_queue_purge(&hdev->rx_q);
625 skb_queue_purge(&hdev->cmd_q);
626 skb_queue_purge(&hdev->raw_q);
627
628 /* Drop last sent command */
629 if (hdev->sent_cmd) {
b79f44c1 630 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 631 kfree_skb(hdev->sent_cmd);
632 hdev->sent_cmd = NULL;
633 }
634
635 /* After this point our queues are empty
636 * and no tasks are scheduled. */
637 hdev->close(hdev);
638
5add6af8
JH		 639 mgmt_powered(hdev->id, 0);
640
1da177e4
LT		 641 /* Clear flags */
642 hdev->flags = 0;
643
644 hci_req_unlock(hdev);
645
646 hci_dev_put(hdev);
647 return 0;
648}
649
650int hci_dev_close(__u16 dev)
651{
652 struct hci_dev *hdev;
653 int err;
654
70f23020
AE		 655 hdev = hci_dev_get(dev);
656 if (!hdev)
1da177e4
LT		 657 return -ENODEV;
658 err = hci_dev_do_close(hdev);
659 hci_dev_put(hdev);
660 return err;
661}
662
663int hci_dev_reset(__u16 dev)
664{
665 struct hci_dev *hdev;
666 int ret = 0;
667
70f23020
AE		 668 hdev = hci_dev_get(dev);
669 if (!hdev)
1da177e4
LT		 670 return -ENODEV;
671
672 hci_req_lock(hdev);
673 tasklet_disable(&hdev->tx_task);
674
675 if (!test_bit(HCI_UP, &hdev->flags))
676 goto done;
677
678 /* Drop queues */
679 skb_queue_purge(&hdev->rx_q);
680 skb_queue_purge(&hdev->cmd_q);
681
682 hci_dev_lock_bh(hdev);
683 inquiry_cache_flush(hdev);
684 hci_conn_hash_flush(hdev);
685 hci_dev_unlock_bh(hdev);
686
687 if (hdev->flush)
688 hdev->flush(hdev);
689
8e87d142 690 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 691 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 692
693 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 694 ret = __hci_request(hdev, hci_reset_req, 0,
695 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 696
697done:
698 tasklet_enable(&hdev->tx_task);
699 hci_req_unlock(hdev);
700 hci_dev_put(hdev);
701 return ret;
702}
703
704int hci_dev_reset_stat(__u16 dev)
705{
706 struct hci_dev *hdev;
707 int ret = 0;
708
70f23020
AE		 709 hdev = hci_dev_get(dev);
710 if (!hdev)
1da177e4
LT		 711 return -ENODEV;
712
713 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
714
715 hci_dev_put(hdev);
716
717 return ret;
718}
719
720int hci_dev_cmd(unsigned int cmd, void __user *arg)
721{
722 struct hci_dev *hdev;
723 struct hci_dev_req dr;
724 int err = 0;
725
726 if (copy_from_user(&dr, arg, sizeof(dr)))
727 return -EFAULT;
728
70f23020
AE		 729 hdev = hci_dev_get(dr.dev_id);
730 if (!hdev)
1da177e4
LT		 731 return -ENODEV;
732
733 switch (cmd) {
734 case HCISETAUTH:
04837f64
MH		 735 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
736 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 737 break;
738
739 case HCISETENCRYPT:
740 if (!lmp_encrypt_capable(hdev)) {
741 err = -EOPNOTSUPP;
742 break;
743 }
744
745 if (!test_bit(HCI_AUTH, &hdev->flags)) {
746 /* Auth must be enabled first */
04837f64
MH		 747 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
748 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 749 if (err)
750 break;
751 }
752
04837f64
MH		 753 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
754 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 755 break;
756
757 case HCISETSCAN:
04837f64
MH		 758 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
759 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 760 break;
761
1da177e4 762 case HCISETLINKPOL:
e4e8e37c
MH		 763 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
764 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 765 break;
766
767 case HCISETLINKMODE:
e4e8e37c
MH		 768 hdev->link_mode = ((__u16) dr.dev_opt) &
769 (HCI_LM_MASTER | HCI_LM_ACCEPT);
770 break;
771
772 case HCISETPTYPE:
773 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 774 break;
775
776 case HCISETACLMTU:
e4e8e37c
MH		 777 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
778 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 779 break;
780
781 case HCISETSCOMTU:
e4e8e37c
MH		 782 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
783 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 784 break;
785
786 default:
787 err = -EINVAL;
788 break;
789 }
e4e8e37c 790
1da177e4
LT		 791 hci_dev_put(hdev);
792 return err;
793}
794
795int hci_get_dev_list(void __user *arg)
796{
797 struct hci_dev_list_req *dl;
798 struct hci_dev_req *dr;
799 struct list_head *p;
800 int n = 0, size, err;
801 __u16 dev_num;
802
803 if (get_user(dev_num, (__u16 __user *) arg))
804 return -EFAULT;
805
806 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
807 return -EINVAL;
808
809 size = sizeof(*dl) + dev_num * sizeof(*dr);
810
70f23020
AE		 811 dl = kzalloc(size, GFP_KERNEL);
812 if (!dl)
1da177e4
LT		 813 return -ENOMEM;
814
815 dr = dl->dev_req;
816
817 read_lock_bh(&hci_dev_list_lock);
818 list_for_each(p, &hci_dev_list) {
819 struct hci_dev *hdev;
c542a06c 820
1da177e4 821 hdev = list_entry(p, struct hci_dev, list);
c542a06c 822
ab81cbf9 823 hci_del_off_timer(hdev);
c542a06c
JH		 824
825 if (!test_bit(HCI_MGMT, &hdev->flags))
826 set_bit(HCI_PAIRABLE, &hdev->flags);
827
1da177e4
LT		 828 (dr + n)->dev_id = hdev->id;
829 (dr + n)->dev_opt = hdev->flags;
c542a06c 830
1da177e4
LT		 831 if (++n >= dev_num)
832 break;
833 }
834 read_unlock_bh(&hci_dev_list_lock);
835
836 dl->dev_num = n;
837 size = sizeof(*dl) + n * sizeof(*dr);
838
839 err = copy_to_user(arg, dl, size);
840 kfree(dl);
841
842 return err ? -EFAULT : 0;
843}
844
845int hci_get_dev_info(void __user *arg)
846{
847 struct hci_dev *hdev;
848 struct hci_dev_info di;
849 int err = 0;
850
851 if (copy_from_user(&di, arg, sizeof(di)))
852 return -EFAULT;
853
70f23020
AE		 854 hdev = hci_dev_get(di.dev_id);
855 if (!hdev)
1da177e4
LT		 856 return -ENODEV;
857
ab81cbf9
JH		 858 hci_del_off_timer(hdev);
859
c542a06c
JH		 860 if (!test_bit(HCI_MGMT, &hdev->flags))
861 set_bit(HCI_PAIRABLE, &hdev->flags);
862
1da177e4
LT		 863 strcpy(di.name, hdev->name);
864 di.bdaddr = hdev->bdaddr;
943da25d 865 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 866 di.flags = hdev->flags;
867 di.pkt_type = hdev->pkt_type;
868 di.acl_mtu = hdev->acl_mtu;
869 di.acl_pkts = hdev->acl_pkts;
870 di.sco_mtu = hdev->sco_mtu;
871 di.sco_pkts = hdev->sco_pkts;
872 di.link_policy = hdev->link_policy;
873 di.link_mode = hdev->link_mode;
874
875 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
876 memcpy(&di.features, &hdev->features, sizeof(di.features));
877
878 if (copy_to_user(arg, &di, sizeof(di)))
879 err = -EFAULT;
880
881 hci_dev_put(hdev);
882
883 return err;
884}
885
886/* ---- Interface to HCI drivers ---- */
887
611b30f7
MH		 888static int hci_rfkill_set_block(void *data, bool blocked)
889{
890 struct hci_dev *hdev = data;
891
892 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
893
894 if (!blocked)
895 return 0;
896
897 hci_dev_do_close(hdev);
898
899 return 0;
900}
901
902static const struct rfkill_ops hci_rfkill_ops = {
903 .set_block = hci_rfkill_set_block,
904};
905
1da177e4
LT		 906/* Alloc HCI device */
907struct hci_dev *hci_alloc_dev(void)
908{
909 struct hci_dev *hdev;
910
25ea6db0 911 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 912 if (!hdev)
913 return NULL;
914
1da177e4
LT		 915 skb_queue_head_init(&hdev->driver_init);
916
917 return hdev;
918}
919EXPORT_SYMBOL(hci_alloc_dev);
920
921/* Free HCI device */
922void hci_free_dev(struct hci_dev *hdev)
923{
924 skb_queue_purge(&hdev->driver_init);
925
a91f2e39
MH		 926 /* will free via device release */
927 put_device(&hdev->dev);
1da177e4
LT		 928}
929EXPORT_SYMBOL(hci_free_dev);
930
ab81cbf9
JH		 931static void hci_power_on(struct work_struct *work)
932{
933 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
934
935 BT_DBG("%s", hdev->name);
936
937 if (hci_dev_open(hdev->id) < 0)
938 return;
939
940 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
941 mod_timer(&hdev->off_timer,
942 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
943
944 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
945 mgmt_index_added(hdev->id);
946}
947
948static void hci_power_off(struct work_struct *work)
949{
950 struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
951
952 BT_DBG("%s", hdev->name);
953
954 hci_dev_close(hdev->id);
955}
956
957static void hci_auto_off(unsigned long data)
958{
959 struct hci_dev *hdev = (struct hci_dev *) data;
960
961 BT_DBG("%s", hdev->name);
962
963 clear_bit(HCI_AUTO_OFF, &hdev->flags);
964
965 queue_work(hdev->workqueue, &hdev->power_off);
966}
967
968void hci_del_off_timer(struct hci_dev *hdev)
969{
970 BT_DBG("%s", hdev->name);
971
972 clear_bit(HCI_AUTO_OFF, &hdev->flags);
973 del_timer(&hdev->off_timer);
974}
975
2aeb9a1a
JH		 976int hci_uuids_clear(struct hci_dev *hdev)
977{
978 struct list_head *p, *n;
979
980 list_for_each_safe(p, n, &hdev->uuids) {
981 struct bt_uuid *uuid;
982
983 uuid = list_entry(p, struct bt_uuid, list);
984
985 list_del(p);
986 kfree(uuid);
987 }
988
989 return 0;
990}
991
55ed8ca1
JH		 992int hci_link_keys_clear(struct hci_dev *hdev)
993{
994 struct list_head *p, *n;
995
996 list_for_each_safe(p, n, &hdev->link_keys) {
997 struct link_key *key;
998
999 key = list_entry(p, struct link_key, list);
1000
1001 list_del(p);
1002 kfree(key);
1003 }
1004
1005 return 0;
1006}
1007
1008struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1009{
1010 struct list_head *p;
1011
1012 list_for_each(p, &hdev->link_keys) {
1013 struct link_key *k;
1014
1015 k = list_entry(p, struct link_key, list);
1016
1017 if (bacmp(bdaddr, &k->bdaddr) == 0)
1018 return k;
1019 }
1020
1021 return NULL;
1022}
1023
d25e28ab
JH		 1024static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1025 u8 key_type, u8 old_key_type)
1026{
1027 /* Legacy key */
1028 if (key_type < 0x03)
1029 return 1;
1030
1031 /* Debug keys are insecure so don't store them persistently */
1032 if (key_type == HCI_LK_DEBUG_COMBINATION)
1033 return 0;
1034
1035 /* Changed combination key and there's no previous one */
1036 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1037 return 0;
1038
1039 /* Security mode 3 case */
1040 if (!conn)
1041 return 1;
1042
1043 /* Neither local nor remote side had no-bonding as requirement */
1044 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1045 return 1;
1046
1047 /* Local side had dedicated bonding as requirement */
1048 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1049 return 1;
1050
1051 /* Remote side had dedicated bonding as requirement */
1052 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1053 return 1;
1054
1055 /* If none of the above criteria match, then don't store the key
1056 * persistently */
1057 return 0;
1058}
1059
75d262c2
VCG		 1060struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1061{
1062 struct link_key *k;
1063
1064 list_for_each_entry(k, &hdev->link_keys, list) {
1065 struct key_master_id *id;
1066
1067 if (k->type != HCI_LK_SMP_LTK)
1068 continue;
1069
1070 if (k->dlen != sizeof(*id))
1071 continue;
1072
1073 id = (void *) &k->data;
1074 if (id->ediv == ediv &&
1075 (memcmp(rand, id->rand, sizeof(id->rand)) == 0))
1076 return k;
1077 }
1078
1079 return NULL;
1080}
1081EXPORT_SYMBOL(hci_find_ltk);
1082
1083struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
1084 bdaddr_t *bdaddr, u8 type)
1085{
1086 struct link_key *k;
1087
1088 list_for_each_entry(k, &hdev->link_keys, list)
1089 if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
1090 return k;
1091
1092 return NULL;
1093}
1094EXPORT_SYMBOL(hci_find_link_key_type);
1095
d25e28ab
JH		 1096int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1097 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1098{
1099 struct link_key *key, *old_key;
4df378a1 1100 u8 old_key_type, persistent;
55ed8ca1
JH		 1101
1102 old_key = hci_find_link_key(hdev, bdaddr);
1103 if (old_key) {
1104 old_key_type = old_key->type;
1105 key = old_key;
1106 } else {
12adcf3a 1107 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1108 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1109 if (!key)
1110 return -ENOMEM;
1111 list_add(&key->list, &hdev->link_keys);
1112 }
1113
1114 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1115
d25e28ab
JH		 1116 /* Some buggy controller combinations generate a changed
1117 * combination key for legacy pairing even when there's no
1118 * previous key */
1119 if (type == HCI_LK_CHANGED_COMBINATION &&
1120 (!conn || conn->remote_auth == 0xff) &&
655fe6ec 1121 old_key_type == 0xff) {
d25e28ab 1122 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1123 if (conn)
1124 conn->key_type = type;
1125 }
d25e28ab 1126
55ed8ca1
JH		 1127 bacpy(&key->bdaddr, bdaddr);
1128 memcpy(key->val, val, 16);
55ed8ca1
JH		 1129 key->pin_len = pin_len;
1130
b6020ba0 1131 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1132 key->type = old_key_type;
4748fed2
JH		 1133 else
1134 key->type = type;
1135
4df378a1
JH		 1136 if (!new_key)
1137 return 0;
1138
1139 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1140
1141 mgmt_new_key(hdev->id, key, persistent);
1142
1143 if (!persistent) {
1144 list_del(&key->list);
1145 kfree(key);
1146 }
55ed8ca1
JH		 1147
1148 return 0;
1149}
1150
75d262c2 1151int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
726b4ffc 1152 u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
75d262c2
VCG		 1153{
1154 struct link_key *key, *old_key;
1155 struct key_master_id *id;
1156 u8 old_key_type;
1157
1158 BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
1159
1160 old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
1161 if (old_key) {
1162 key = old_key;
1163 old_key_type = old_key->type;
1164 } else {
1165 key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
1166 if (!key)
1167 return -ENOMEM;
1168 list_add(&key->list, &hdev->link_keys);
1169 old_key_type = 0xff;
1170 }
1171
1172 key->dlen = sizeof(*id);
1173
1174 bacpy(&key->bdaddr, bdaddr);
1175 memcpy(key->val, ltk, sizeof(key->val));
1176 key->type = HCI_LK_SMP_LTK;
726b4ffc 1177 key->pin_len = key_size;
75d262c2
VCG		 1178
1179 id = (void *) &key->data;
1180 id->ediv = ediv;
1181 memcpy(id->rand, rand, sizeof(id->rand));
1182
1183 if (new_key)
1184 mgmt_new_key(hdev->id, key, old_key_type);
1185
1186 return 0;
1187}
1188
55ed8ca1
JH		 1189int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1190{
1191 struct link_key *key;
1192
1193 key = hci_find_link_key(hdev, bdaddr);
1194 if (!key)
1195 return -ENOENT;
1196
1197 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1198
1199 list_del(&key->list);
1200 kfree(key);
1201
1202 return 0;
1203}
1204
6bd32326
VT		 1205/* HCI command timer function */
1206static void hci_cmd_timer(unsigned long arg)
1207{
1208 struct hci_dev *hdev = (void *) arg;
1209
1210 BT_ERR("%s command tx timeout", hdev->name);
1211 atomic_set(&hdev->cmd_cnt, 1);
f630cf0d 1212 clear_bit(HCI_RESET, &hdev->flags);
6bd32326
VT		 1213 tasklet_schedule(&hdev->cmd_task);
1214}
1215
2763eda6
SJ		 1216struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1217 bdaddr_t *bdaddr)
1218{
1219 struct oob_data *data;
1220
1221 list_for_each_entry(data, &hdev->remote_oob_data, list)
1222 if (bacmp(bdaddr, &data->bdaddr) == 0)
1223 return data;
1224
1225 return NULL;
1226}
1227
1228int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1229{
1230 struct oob_data *data;
1231
1232 data = hci_find_remote_oob_data(hdev, bdaddr);
1233 if (!data)
1234 return -ENOENT;
1235
1236 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1237
1238 list_del(&data->list);
1239 kfree(data);
1240
1241 return 0;
1242}
1243
1244int hci_remote_oob_data_clear(struct hci_dev *hdev)
1245{
1246 struct oob_data *data, *n;
1247
1248 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1249 list_del(&data->list);
1250 kfree(data);
1251 }
1252
1253 return 0;
1254}
1255
1256int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1257 u8 *randomizer)
1258{
1259 struct oob_data *data;
1260
1261 data = hci_find_remote_oob_data(hdev, bdaddr);
1262
1263 if (!data) {
1264 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1265 if (!data)
1266 return -ENOMEM;
1267
1268 bacpy(&data->bdaddr, bdaddr);
1269 list_add(&data->list, &hdev->remote_oob_data);
1270 }
1271
1272 memcpy(data->hash, hash, sizeof(data->hash));
1273 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1274
1275 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1276
1277 return 0;
1278}
1279
b2a66aad
AJ		 1280struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1281 bdaddr_t *bdaddr)
1282{
1283 struct list_head *p;
1284
1285 list_for_each(p, &hdev->blacklist) {
1286 struct bdaddr_list *b;
1287
1288 b = list_entry(p, struct bdaddr_list, list);
1289
1290 if (bacmp(bdaddr, &b->bdaddr) == 0)
1291 return b;
1292 }
1293
1294 return NULL;
1295}
1296
1297int hci_blacklist_clear(struct hci_dev *hdev)
1298{
1299 struct list_head *p, *n;
1300
1301 list_for_each_safe(p, n, &hdev->blacklist) {
1302 struct bdaddr_list *b;
1303
1304 b = list_entry(p, struct bdaddr_list, list);
1305
1306 list_del(p);
1307 kfree(b);
1308 }
1309
1310 return 0;
1311}
1312
1313int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1314{
1315 struct bdaddr_list *entry;
a7925bd2 1316 int err;
b2a66aad
AJ		 1317
1318 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1319 return -EBADF;
1320
8aded711 1321 hci_dev_lock_bh(hdev);
a7925bd2
GP		 1322
1323 if (hci_blacklist_lookup(hdev, bdaddr)) {
1324 err = -EEXIST;
1325 goto err;
1326 }
b2a66aad
AJ		 1327
1328 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
a7925bd2 1329 if (!entry) {
b2a66aad 1330 return -ENOMEM;
a7925bd2
GP		 1331 goto err;
1332 }
b2a66aad
AJ		 1333
1334 bacpy(&entry->bdaddr, bdaddr);
1335
1336 list_add(&entry->list, &hdev->blacklist);
1337
a7925bd2 1338 err = 0;
b2a66aad 1339
a7925bd2 1340err:
8aded711 1341 hci_dev_unlock_bh(hdev);
a7925bd2 1342 return err;
b2a66aad
AJ		 1343}
1344
1345int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1346{
1347 struct bdaddr_list *entry;
a7925bd2 1348 int err = 0;
b2a66aad 1349
8aded711 1350 hci_dev_lock_bh(hdev);
b2a66aad 1351
a7925bd2
GP		 1352 if (bacmp(bdaddr, BDADDR_ANY) == 0) {
1353 hci_blacklist_clear(hdev);
1354 goto done;
1355 }
b2a66aad
AJ		 1356
1357 entry = hci_blacklist_lookup(hdev, bdaddr);
a7925bd2
GP		 1358 if (!entry) {
1359 err = -ENOENT;
1360 goto done;
1361 }
b2a66aad
AJ		 1362
1363 list_del(&entry->list);
1364 kfree(entry);
1365
a7925bd2 1366done:
8aded711 1367 hci_dev_unlock_bh(hdev);
a7925bd2 1368 return err;
b2a66aad
AJ		 1369}
1370
35815085
AG		 1371static void hci_clear_adv_cache(unsigned long arg)
1372{
1373 struct hci_dev *hdev = (void *) arg;
1374
1375 hci_dev_lock(hdev);
1376
1377 hci_adv_entries_clear(hdev);
1378
1379 hci_dev_unlock(hdev);
1380}
1381
76c8686f
AG		 1382int hci_adv_entries_clear(struct hci_dev *hdev)
1383{
1384 struct adv_entry *entry, *tmp;
1385
1386 list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1387 list_del(&entry->list);
1388 kfree(entry);
1389 }
1390
1391 BT_DBG("%s adv cache cleared", hdev->name);
1392
1393 return 0;
1394}
1395
1396struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1397{
1398 struct adv_entry *entry;
1399
1400 list_for_each_entry(entry, &hdev->adv_entries, list)
1401 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1402 return entry;
1403
1404 return NULL;
1405}
1406
1407static inline int is_connectable_adv(u8 evt_type)
1408{
1409 if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1410 return 1;
1411
1412 return 0;
1413}
1414
1415int hci_add_adv_entry(struct hci_dev *hdev,
1416 struct hci_ev_le_advertising_info *ev)
1417{
1418 struct adv_entry *entry;
1419
1420 if (!is_connectable_adv(ev->evt_type))
1421 return -EINVAL;
1422
1423 /* Only new entries should be added to adv_entries. So, if
1424 * bdaddr was found, don't add it. */
1425 if (hci_find_adv_entry(hdev, &ev->bdaddr))
1426 return 0;
1427
1428 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1429 if (!entry)
1430 return -ENOMEM;
1431
1432 bacpy(&entry->bdaddr, &ev->bdaddr);
1433 entry->bdaddr_type = ev->bdaddr_type;
1434
1435 list_add(&entry->list, &hdev->adv_entries);
1436
1437 BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1438 batostr(&entry->bdaddr), entry->bdaddr_type);
1439
1440 return 0;
1441}
1442
1da177e4
LT		 1443/* Register HCI device */
1444int hci_register_dev(struct hci_dev *hdev)
1445{
1446 struct list_head *head = &hci_dev_list, *p;
ef222013 1447 int i, id = 0;
1da177e4 1448
c13854ce
MH		 1449 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1450 hdev->bus, hdev->owner);
1da177e4
LT		 1451
1452 if (!hdev->open || !hdev->close || !hdev->destruct)
1453 return -EINVAL;
1454
1455 write_lock_bh(&hci_dev_list_lock);
1456
1457 /* Find first available device id */
1458 list_for_each(p, &hci_dev_list) {
1459 if (list_entry(p, struct hci_dev, list)->id != id)
1460 break;
1461 head = p; id++;
1462 }
8e87d142 1463
1da177e4
LT		 1464 sprintf(hdev->name, "hci%d", id);
1465 hdev->id = id;
1466 list_add(&hdev->list, head);
1467
1468 atomic_set(&hdev->refcnt, 1);
1469 spin_lock_init(&hdev->lock);
1470
1471 hdev->flags = 0;
1472 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 1473 hdev->esco_type = (ESCO_HV1);
1da177e4 1474 hdev->link_mode = (HCI_LM_ACCEPT);
17fa4b9d 1475 hdev->io_capability = 0x03; /* No Input No Output */
1da177e4 1476
04837f64
MH		 1477 hdev->idle_timeout = 0;
1478 hdev->sniff_max_interval = 800;
1479 hdev->sniff_min_interval = 80;
1480
70f23020 1481 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1da177e4
LT		 1482 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1483 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1484
1485 skb_queue_head_init(&hdev->rx_q);
1486 skb_queue_head_init(&hdev->cmd_q);
1487 skb_queue_head_init(&hdev->raw_q);
1488
6bd32326
VT		 1489 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1490
cd4c5391 1491 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1492 hdev->reassembly[i] = NULL;
1493
1da177e4 1494 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 1495 mutex_init(&hdev->req_lock);
1da177e4
LT		 1496
1497 inquiry_cache_init(hdev);
1498
1499 hci_conn_hash_init(hdev);
1500
ea4bd8ba 1501 INIT_LIST_HEAD(&hdev->blacklist);
f0358568 1502
2aeb9a1a
JH		 1503 INIT_LIST_HEAD(&hdev->uuids);
1504
55ed8ca1
JH		 1505 INIT_LIST_HEAD(&hdev->link_keys);
1506
2763eda6
SJ		 1507 INIT_LIST_HEAD(&hdev->remote_oob_data);
1508
76c8686f 1509 INIT_LIST_HEAD(&hdev->adv_entries);
35815085
AG		 1510 setup_timer(&hdev->adv_timer, hci_clear_adv_cache,
1511 (unsigned long) hdev);
76c8686f 1512
ab81cbf9
JH		 1513 INIT_WORK(&hdev->power_on, hci_power_on);
1514 INIT_WORK(&hdev->power_off, hci_power_off);
1515 setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1516
1da177e4
LT		 1517 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1518
1519 atomic_set(&hdev->promisc, 0);
1520
1521 write_unlock_bh(&hci_dev_list_lock);
1522
f48fd9c8
MH		 1523 hdev->workqueue = create_singlethread_workqueue(hdev->name);
1524 if (!hdev->workqueue)
1525 goto nomem;
1526
2e65c9d2 1527 hdev->tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
3a0259bb
VCG		 1528 if (IS_ERR(hdev->tfm))
1529 BT_INFO("Failed to load transform for ecb(aes): %ld",
1530 PTR_ERR(hdev->tfm));
1531
1da177e4
LT		 1532 hci_register_sysfs(hdev);
1533
611b30f7
MH		 1534 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1535 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1536 if (hdev->rfkill) {
1537 if (rfkill_register(hdev->rfkill) < 0) {
1538 rfkill_destroy(hdev->rfkill);
1539 hdev->rfkill = NULL;
1540 }
1541 }
1542
ab81cbf9
JH		 1543 set_bit(HCI_AUTO_OFF, &hdev->flags);
1544 set_bit(HCI_SETUP, &hdev->flags);
1545 queue_work(hdev->workqueue, &hdev->power_on);
1546
1da177e4
LT		 1547 hci_notify(hdev, HCI_DEV_REG);
1548
1549 return id;
f48fd9c8
MH		 1550
1551nomem:
1552 write_lock_bh(&hci_dev_list_lock);
1553 list_del(&hdev->list);
1554 write_unlock_bh(&hci_dev_list_lock);
1555
1556 return -ENOMEM;
1da177e4
LT		 1557}
1558EXPORT_SYMBOL(hci_register_dev);
1559
1560/* Unregister HCI device */
1561int hci_unregister_dev(struct hci_dev *hdev)
1562{
ef222013
MH		 1563 int i;
1564
c13854ce 1565 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1566
1da177e4
LT		 1567 write_lock_bh(&hci_dev_list_lock);
1568 list_del(&hdev->list);
1569 write_unlock_bh(&hci_dev_list_lock);
1570
1571 hci_dev_do_close(hdev);
1572
cd4c5391 1573 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1574 kfree_skb(hdev->reassembly[i]);
1575
ab81cbf9
JH		 1576 if (!test_bit(HCI_INIT, &hdev->flags) &&
1577 !test_bit(HCI_SETUP, &hdev->flags))
1578 mgmt_index_removed(hdev->id);
1579
3a0259bb
VCG		 1580 if (!IS_ERR(hdev->tfm))
1581 crypto_free_blkcipher(hdev->tfm);
1582
1da177e4
LT		 1583 hci_notify(hdev, HCI_DEV_UNREG);
1584
611b30f7
MH		 1585 if (hdev->rfkill) {
1586 rfkill_unregister(hdev->rfkill);
1587 rfkill_destroy(hdev->rfkill);
1588 }
1589
147e2d59
DY		 1590 hci_unregister_sysfs(hdev);
1591
c6f3c5f7 1592 hci_del_off_timer(hdev);
35815085 1593 del_timer(&hdev->adv_timer);
c6f3c5f7 1594
f48fd9c8
MH		 1595 destroy_workqueue(hdev->workqueue);
1596
e2e0cacb
JH		 1597 hci_dev_lock_bh(hdev);
1598 hci_blacklist_clear(hdev);
2aeb9a1a 1599 hci_uuids_clear(hdev);
55ed8ca1 1600 hci_link_keys_clear(hdev);
2763eda6 1601 hci_remote_oob_data_clear(hdev);
76c8686f 1602 hci_adv_entries_clear(hdev);
e2e0cacb
JH		 1603 hci_dev_unlock_bh(hdev);
1604
1da177e4 1605 __hci_dev_put(hdev);
ef222013 1606
1da177e4
LT		 1607 return 0;
1608}
1609EXPORT_SYMBOL(hci_unregister_dev);
1610
1611/* Suspend HCI device */
1612int hci_suspend_dev(struct hci_dev *hdev)
1613{
1614 hci_notify(hdev, HCI_DEV_SUSPEND);
1615 return 0;
1616}
1617EXPORT_SYMBOL(hci_suspend_dev);
1618
1619/* Resume HCI device */
1620int hci_resume_dev(struct hci_dev *hdev)
1621{
1622 hci_notify(hdev, HCI_DEV_RESUME);
1623 return 0;
1624}
1625EXPORT_SYMBOL(hci_resume_dev);
1626
76bca880
MH		 1627/* Receive frame from HCI drivers */
1628int hci_recv_frame(struct sk_buff *skb)
1629{
1630 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1631 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1632 && !test_bit(HCI_INIT, &hdev->flags))) {
1633 kfree_skb(skb);
1634 return -ENXIO;
1635 }
1636
1637 /* Incomming skb */
1638 bt_cb(skb)->incoming = 1;
1639
1640 /* Time stamp */
1641 __net_timestamp(skb);
1642
1643 /* Queue frame for rx task */
1644 skb_queue_tail(&hdev->rx_q, skb);
c78ae283
MH		 1645 tasklet_schedule(&hdev->rx_task);
1646
76bca880
MH		 1647 return 0;
1648}
1649EXPORT_SYMBOL(hci_recv_frame);
1650
33e882a5 1651static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1e429f38 1652 int count, __u8 index)
33e882a5
SS		 1653{
1654 int len = 0;
1655 int hlen = 0;
1656 int remain = count;
1657 struct sk_buff *skb;
1658 struct bt_skb_cb *scb;
1659
1660 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1661 index >= NUM_REASSEMBLY)
1662 return -EILSEQ;
1663
1664 skb = hdev->reassembly[index];
1665
1666 if (!skb) {
1667 switch (type) {
1668 case HCI_ACLDATA_PKT:
1669 len = HCI_MAX_FRAME_SIZE;
1670 hlen = HCI_ACL_HDR_SIZE;
1671 break;
1672 case HCI_EVENT_PKT:
1673 len = HCI_MAX_EVENT_SIZE;
1674 hlen = HCI_EVENT_HDR_SIZE;
1675 break;
1676 case HCI_SCODATA_PKT:
1677 len = HCI_MAX_SCO_SIZE;
1678 hlen = HCI_SCO_HDR_SIZE;
1679 break;
1680 }
1681
1e429f38 1682 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 1683 if (!skb)
1684 return -ENOMEM;
1685
1686 scb = (void *) skb->cb;
1687 scb->expect = hlen;
1688 scb->pkt_type = type;
1689
1690 skb->dev = (void *) hdev;
1691 hdev->reassembly[index] = skb;
1692 }
1693
1694 while (count) {
1695 scb = (void *) skb->cb;
1696 len = min(scb->expect, (__u16)count);
1697
1698 memcpy(skb_put(skb, len), data, len);
1699
1700 count -= len;
1701 data += len;
1702 scb->expect -= len;
1703 remain = count;
1704
1705 switch (type) {
1706 case HCI_EVENT_PKT:
1707 if (skb->len == HCI_EVENT_HDR_SIZE) {
1708 struct hci_event_hdr *h = hci_event_hdr(skb);
1709 scb->expect = h->plen;
1710
1711 if (skb_tailroom(skb) < scb->expect) {
1712 kfree_skb(skb);
1713 hdev->reassembly[index] = NULL;
1714 return -ENOMEM;
1715 }
1716 }
1717 break;
1718
1719 case HCI_ACLDATA_PKT:
1720 if (skb->len == HCI_ACL_HDR_SIZE) {
1721 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1722 scb->expect = __le16_to_cpu(h->dlen);
1723
1724 if (skb_tailroom(skb) < scb->expect) {
1725 kfree_skb(skb);
1726 hdev->reassembly[index] = NULL;
1727 return -ENOMEM;
1728 }
1729 }
1730 break;
1731
1732 case HCI_SCODATA_PKT:
1733 if (skb->len == HCI_SCO_HDR_SIZE) {
1734 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1735 scb->expect = h->dlen;
1736
1737 if (skb_tailroom(skb) < scb->expect) {
1738 kfree_skb(skb);
1739 hdev->reassembly[index] = NULL;
1740 return -ENOMEM;
1741 }
1742 }
1743 break;
1744 }
1745
1746 if (scb->expect == 0) {
1747 /* Complete frame */
1748
1749 bt_cb(skb)->pkt_type = type;
1750 hci_recv_frame(skb);
1751
1752 hdev->reassembly[index] = NULL;
1753 return remain;
1754 }
1755 }
1756
1757 return remain;
1758}
1759
ef222013
MH		 1760int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1761{
f39a3c06
SS		 1762 int rem = 0;
1763
ef222013
MH		 1764 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1765 return -EILSEQ;
1766
da5f6c37 1767 while (count) {
1e429f38 1768 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 1769 if (rem < 0)
1770 return rem;
ef222013 1771
f39a3c06
SS		 1772 data += (count - rem);
1773 count = rem;
f81c6224 1774 }
ef222013 1775
f39a3c06 1776 return rem;
ef222013
MH		 1777}
1778EXPORT_SYMBOL(hci_recv_fragment);
1779
99811510
SS		 1780#define STREAM_REASSEMBLY 0
1781
1782int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1783{
1784 int type;
1785 int rem = 0;
1786
da5f6c37 1787 while (count) {
99811510
SS		 1788 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1789
1790 if (!skb) {
1791 struct { char type; } *pkt;
1792
1793 /* Start of the frame */
1794 pkt = data;
1795 type = pkt->type;
1796
1797 data++;
1798 count--;
1799 } else
1800 type = bt_cb(skb)->pkt_type;
1801
1e429f38
GP		 1802 rem = hci_reassembly(hdev, type, data, count,
1803 STREAM_REASSEMBLY);
99811510
SS		 1804 if (rem < 0)
1805 return rem;
1806
1807 data += (count - rem);
1808 count = rem;
f81c6224 1809 }
99811510
SS		 1810
1811 return rem;
1812}
1813EXPORT_SYMBOL(hci_recv_stream_fragment);
1814
1da177e4
LT		 1815/* ---- Interface to upper protocols ---- */
1816
1817/* Register/Unregister protocols.
1818 * hci_task_lock is used to ensure that no tasks are running. */
1819int hci_register_proto(struct hci_proto *hp)
1820{
1821 int err = 0;
1822
1823 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1824
1825 if (hp->id >= HCI_MAX_PROTO)
1826 return -EINVAL;
1827
1828 write_lock_bh(&hci_task_lock);
1829
1830 if (!hci_proto[hp->id])
1831 hci_proto[hp->id] = hp;
1832 else
1833 err = -EEXIST;
1834
1835 write_unlock_bh(&hci_task_lock);
1836
1837 return err;
1838}
1839EXPORT_SYMBOL(hci_register_proto);
1840
1841int hci_unregister_proto(struct hci_proto *hp)
1842{
1843 int err = 0;
1844
1845 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1846
1847 if (hp->id >= HCI_MAX_PROTO)
1848 return -EINVAL;
1849
1850 write_lock_bh(&hci_task_lock);
1851
1852 if (hci_proto[hp->id])
1853 hci_proto[hp->id] = NULL;
1854 else
1855 err = -ENOENT;
1856
1857 write_unlock_bh(&hci_task_lock);
1858
1859 return err;
1860}
1861EXPORT_SYMBOL(hci_unregister_proto);
1862
1863int hci_register_cb(struct hci_cb *cb)
1864{
1865 BT_DBG("%p name %s", cb, cb->name);
1866
1867 write_lock_bh(&hci_cb_list_lock);
1868 list_add(&cb->list, &hci_cb_list);
1869 write_unlock_bh(&hci_cb_list_lock);
1870
1871 return 0;
1872}
1873EXPORT_SYMBOL(hci_register_cb);
1874
1875int hci_unregister_cb(struct hci_cb *cb)
1876{
1877 BT_DBG("%p name %s", cb, cb->name);
1878
1879 write_lock_bh(&hci_cb_list_lock);
1880 list_del(&cb->list);
1881 write_unlock_bh(&hci_cb_list_lock);
1882
1883 return 0;
1884}
1885EXPORT_SYMBOL(hci_unregister_cb);
1886
1887static int hci_send_frame(struct sk_buff *skb)
1888{
1889 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1890
1891 if (!hdev) {
1892 kfree_skb(skb);
1893 return -ENODEV;
1894 }
1895
0d48d939 1896 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1897
1898 if (atomic_read(&hdev->promisc)) {
1899 /* Time stamp */
a61bbcf2 1900 __net_timestamp(skb);
1da177e4 1901
eec8d2bc 1902 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1903 }
1904
1905 /* Get rid of skb owner, prior to sending to the driver. */
1906 skb_orphan(skb);
1907
1908 return hdev->send(skb);
1909}
1910
1911/* Send HCI command */
a9de9248 1912int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1913{
1914 int len = HCI_COMMAND_HDR_SIZE + plen;
1915 struct hci_command_hdr *hdr;
1916 struct sk_buff *skb;
1917
a9de9248 1918 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1919
1920 skb = bt_skb_alloc(len, GFP_ATOMIC);
1921 if (!skb) {
ef222013 1922 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1923 return -ENOMEM;
1924 }
1925
1926 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1927 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1928 hdr->plen = plen;
1929
1930 if (plen)
1931 memcpy(skb_put(skb, plen), param, plen);
1932
1933 BT_DBG("skb len %d", skb->len);
1934
0d48d939 1935 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 1936 skb->dev = (void *) hdev;
c78ae283 1937
a5040efa
JH		 1938 if (test_bit(HCI_INIT, &hdev->flags))
1939 hdev->init_last_cmd = opcode;
1940
1da177e4 1941 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 1942 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 1943
1944 return 0;
1945}
1da177e4
LT		 1946
1947/* Get data from the previously sent command */
a9de9248 1948void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1949{
1950 struct hci_command_hdr *hdr;
1951
1952 if (!hdev->sent_cmd)
1953 return NULL;
1954
1955 hdr = (void *) hdev->sent_cmd->data;
1956
a9de9248 1957 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1958 return NULL;
1959
a9de9248 1960 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1961
1962 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1963}
1964
1965/* Send ACL data */
1966static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1967{
1968 struct hci_acl_hdr *hdr;
1969 int len = skb->len;
1970
badff6d0
ACM		 1971 skb_push(skb, HCI_ACL_HDR_SIZE);
1972 skb_reset_transport_header(skb);
9c70220b 1973 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1974 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1975 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1976}
1977
9a9c6a34 1978void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1da177e4
LT		 1979{
1980 struct hci_dev *hdev = conn->hdev;
1981 struct sk_buff *list;
1982
1983 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1984
1985 skb->dev = (void *) hdev;
0d48d939 1986 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1987 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4 1988
70f23020
AE		 1989 list = skb_shinfo(skb)->frag_list;
1990 if (!list) {
1da177e4
LT		 1991 /* Non fragmented */
1992 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1993
1994 skb_queue_tail(&conn->data_q, skb);
1995 } else {
1996 /* Fragmented */
1997 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1998
1999 skb_shinfo(skb)->frag_list = NULL;
2000
2001 /* Queue all fragments atomically */
2002 spin_lock_bh(&conn->data_q.lock);
2003
2004 __skb_queue_tail(&conn->data_q, skb);
e702112f
AE		 2005
2006 flags &= ~ACL_START;
2007 flags |= ACL_CONT;
1da177e4
LT		 2008 do {
2009 skb = list; list = list->next;
8e87d142 2010
1da177e4 2011 skb->dev = (void *) hdev;
0d48d939 2012 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 2013 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 2014
2015 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2016
2017 __skb_queue_tail(&conn->data_q, skb);
2018 } while (list);
2019
2020 spin_unlock_bh(&conn->data_q.lock);
2021 }
2022
c78ae283 2023 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 2024}
2025EXPORT_SYMBOL(hci_send_acl);
2026
2027/* Send SCO data */
0d861d8b 2028void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 2029{
2030 struct hci_dev *hdev = conn->hdev;
2031 struct hci_sco_hdr hdr;
2032
2033 BT_DBG("%s len %d", hdev->name, skb->len);
2034
aca3192c 2035 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 2036 hdr.dlen = skb->len;
2037
badff6d0
ACM		 2038 skb_push(skb, HCI_SCO_HDR_SIZE);
2039 skb_reset_transport_header(skb);
9c70220b 2040 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 2041
2042 skb->dev = (void *) hdev;
0d48d939 2043 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 2044
1da177e4 2045 skb_queue_tail(&conn->data_q, skb);
c78ae283 2046 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 2047}
2048EXPORT_SYMBOL(hci_send_sco);
2049
2050/* ---- HCI TX task (outgoing data) ---- */
2051
2052/* HCI Connection scheduler */
2053static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2054{
2055 struct hci_conn_hash *h = &hdev->conn_hash;
5b7f9909 2056 struct hci_conn *conn = NULL;
1da177e4
LT		 2057 int num = 0, min = ~0;
2058 struct list_head *p;
2059
8e87d142 2060 /* We don't have to lock device here. Connections are always
1da177e4
LT		 2061 * added and removed with TX task disabled. */
2062 list_for_each(p, &h->list) {
2063 struct hci_conn *c;
2064 c = list_entry(p, struct hci_conn, list);
2065
769be974 2066 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2067 continue;
769be974
MH		 2068
2069 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2070 continue;
2071
1da177e4
LT		 2072 num++;
2073
2074 if (c->sent < min) {
2075 min = c->sent;
2076 conn = c;
2077 }
2078 }
2079
2080 if (conn) {
6ed58ec5
VT		 2081 int cnt, q;
2082
2083 switch (conn->type) {
2084 case ACL_LINK:
2085 cnt = hdev->acl_cnt;
2086 break;
2087 case SCO_LINK:
2088 case ESCO_LINK:
2089 cnt = hdev->sco_cnt;
2090 break;
2091 case LE_LINK:
2092 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2093 break;
2094 default:
2095 cnt = 0;
2096 BT_ERR("Unknown link type");
2097 }
2098
2099 q = cnt / num;
1da177e4
LT		 2100 *quote = q ? q : 1;
2101 } else
2102 *quote = 0;
2103
2104 BT_DBG("conn %p quote %d", conn, *quote);
2105 return conn;
2106}
2107
bae1f5d9 2108static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2109{
2110 struct hci_conn_hash *h = &hdev->conn_hash;
2111 struct list_head *p;
2112 struct hci_conn *c;
2113
bae1f5d9 2114 BT_ERR("%s link tx timeout", hdev->name);
1da177e4
LT		 2115
2116 /* Kill stalled connections */
2117 list_for_each(p, &h->list) {
2118 c = list_entry(p, struct hci_conn, list);
bae1f5d9
VT		 2119 if (c->type == type && c->sent) {
2120 BT_ERR("%s killing stalled connection %s",
1da177e4
LT		 2121 hdev->name, batostr(&c->dst));
2122 hci_acl_disconn(c, 0x13);
2123 }
2124 }
2125}
2126
2127static inline void hci_sched_acl(struct hci_dev *hdev)
2128{
2129 struct hci_conn *conn;
2130 struct sk_buff *skb;
2131 int quote;
2132
2133 BT_DBG("%s", hdev->name);
2134
2135 if (!test_bit(HCI_RAW, &hdev->flags)) {
2136 /* ACL tx timeout must be longer than maximum
2137 * link supervision timeout (40.9 seconds) */
82453021 2138 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
bae1f5d9 2139 hci_link_tx_to(hdev, ACL_LINK);
1da177e4
LT		 2140 }
2141
2142 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
2143 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2144 BT_DBG("skb %p len %d", skb, skb->len);
04837f64 2145
14b12d0b 2146 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
04837f64 2147
1da177e4
LT		 2148 hci_send_frame(skb);
2149 hdev->acl_last_tx = jiffies;
2150
2151 hdev->acl_cnt--;
2152 conn->sent++;
2153 }
2154 }
2155}
2156
2157/* Schedule SCO */
2158static inline void hci_sched_sco(struct hci_dev *hdev)
2159{
2160 struct hci_conn *conn;
2161 struct sk_buff *skb;
2162 int quote;
2163
2164 BT_DBG("%s", hdev->name);
2165
2166 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2167 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2168 BT_DBG("skb %p len %d", skb, skb->len);
2169 hci_send_frame(skb);
2170
2171 conn->sent++;
2172 if (conn->sent == ~0)
2173 conn->sent = 0;
2174 }
2175 }
2176}
2177
b6a0dc82
MH		 2178static inline void hci_sched_esco(struct hci_dev *hdev)
2179{
2180 struct hci_conn *conn;
2181 struct sk_buff *skb;
2182 int quote;
2183
2184 BT_DBG("%s", hdev->name);
2185
2186 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2187 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2188 BT_DBG("skb %p len %d", skb, skb->len);
2189 hci_send_frame(skb);
2190
2191 conn->sent++;
2192 if (conn->sent == ~0)
2193 conn->sent = 0;
2194 }
2195 }
2196}
2197
6ed58ec5
VT		 2198static inline void hci_sched_le(struct hci_dev *hdev)
2199{
2200 struct hci_conn *conn;
2201 struct sk_buff *skb;
2202 int quote, cnt;
2203
2204 BT_DBG("%s", hdev->name);
2205
2206 if (!test_bit(HCI_RAW, &hdev->flags)) {
2207 /* LE tx timeout must be longer than maximum
2208 * link supervision timeout (40.9 seconds) */
bae1f5d9 2209 if (!hdev->le_cnt && hdev->le_pkts &&
6ed58ec5 2210 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 2211 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 2212 }
2213
2214 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2215 while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
2216 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2217 BT_DBG("skb %p len %d", skb, skb->len);
2218
2219 hci_send_frame(skb);
2220 hdev->le_last_tx = jiffies;
2221
2222 cnt--;
2223 conn->sent++;
2224 }
2225 }
2226 if (hdev->le_pkts)
2227 hdev->le_cnt = cnt;
2228 else
2229 hdev->acl_cnt = cnt;
2230}
2231
1da177e4
LT		 2232static void hci_tx_task(unsigned long arg)
2233{
2234 struct hci_dev *hdev = (struct hci_dev *) arg;
2235 struct sk_buff *skb;
2236
2237 read_lock(&hci_task_lock);
2238
6ed58ec5
VT		 2239 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2240 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 2241
2242 /* Schedule queues and send stuff to HCI driver */
2243
2244 hci_sched_acl(hdev);
2245
2246 hci_sched_sco(hdev);
2247
b6a0dc82
MH		 2248 hci_sched_esco(hdev);
2249
6ed58ec5
VT		 2250 hci_sched_le(hdev);
2251
1da177e4
LT		 2252 /* Send next queued raw (unknown type) packet */
2253 while ((skb = skb_dequeue(&hdev->raw_q)))
2254 hci_send_frame(skb);
2255
2256 read_unlock(&hci_task_lock);
2257}
2258
25985edc 2259/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 2260
2261/* ACL data packet */
2262static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2263{
2264 struct hci_acl_hdr *hdr = (void *) skb->data;
2265 struct hci_conn *conn;
2266 __u16 handle, flags;
2267
2268 skb_pull(skb, HCI_ACL_HDR_SIZE);
2269
2270 handle = __le16_to_cpu(hdr->handle);
2271 flags = hci_flags(handle);
2272 handle = hci_handle(handle);
2273
2274 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2275
2276 hdev->stat.acl_rx++;
2277
2278 hci_dev_lock(hdev);
2279 conn = hci_conn_hash_lookup_handle(hdev, handle);
2280 hci_dev_unlock(hdev);
8e87d142 2281
1da177e4
LT		 2282 if (conn) {
2283 register struct hci_proto *hp;
2284
14b12d0b 2285 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
04837f64 2286
1da177e4 2287 /* Send to upper protocol */
70f23020
AE		 2288 hp = hci_proto[HCI_PROTO_L2CAP];
2289 if (hp && hp->recv_acldata) {
1da177e4
LT		 2290 hp->recv_acldata(conn, skb, flags);
2291 return;
2292 }
2293 } else {
8e87d142 2294 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 2295 hdev->name, handle);
2296 }
2297
2298 kfree_skb(skb);
2299}
2300
2301/* SCO data packet */
2302static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2303{
2304 struct hci_sco_hdr *hdr = (void *) skb->data;
2305 struct hci_conn *conn;
2306 __u16 handle;
2307
2308 skb_pull(skb, HCI_SCO_HDR_SIZE);
2309
2310 handle = __le16_to_cpu(hdr->handle);
2311
2312 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2313
2314 hdev->stat.sco_rx++;
2315
2316 hci_dev_lock(hdev);
2317 conn = hci_conn_hash_lookup_handle(hdev, handle);
2318 hci_dev_unlock(hdev);
2319
2320 if (conn) {
2321 register struct hci_proto *hp;
2322
2323 /* Send to upper protocol */
70f23020
AE		 2324 hp = hci_proto[HCI_PROTO_SCO];
2325 if (hp && hp->recv_scodata) {
1da177e4
LT		 2326 hp->recv_scodata(conn, skb);
2327 return;
2328 }
2329 } else {
8e87d142 2330 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 2331 hdev->name, handle);
2332 }
2333
2334 kfree_skb(skb);
2335}
2336
6516455d 2337static void hci_rx_task(unsigned long arg)
1da177e4
LT		 2338{
2339 struct hci_dev *hdev = (struct hci_dev *) arg;
2340 struct sk_buff *skb;
2341
2342 BT_DBG("%s", hdev->name);
2343
2344 read_lock(&hci_task_lock);
2345
2346 while ((skb = skb_dequeue(&hdev->rx_q))) {
2347 if (atomic_read(&hdev->promisc)) {
2348 /* Send copy to the sockets */
eec8d2bc 2349 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 2350 }
2351
2352 if (test_bit(HCI_RAW, &hdev->flags)) {
2353 kfree_skb(skb);
2354 continue;
2355 }
2356
2357 if (test_bit(HCI_INIT, &hdev->flags)) {
2358 /* Don't process data packets in this states. */
0d48d939 2359 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2360 case HCI_ACLDATA_PKT:
2361 case HCI_SCODATA_PKT:
2362 kfree_skb(skb);
2363 continue;
3ff50b79 2364 }
1da177e4
LT		 2365 }
2366
2367 /* Process frame */
0d48d939 2368 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2369 case HCI_EVENT_PKT:
2370 hci_event_packet(hdev, skb);
2371 break;
2372
2373 case HCI_ACLDATA_PKT:
2374 BT_DBG("%s ACL data packet", hdev->name);
2375 hci_acldata_packet(hdev, skb);
2376 break;
2377
2378 case HCI_SCODATA_PKT:
2379 BT_DBG("%s SCO data packet", hdev->name);
2380 hci_scodata_packet(hdev, skb);
2381 break;
2382
2383 default:
2384 kfree_skb(skb);
2385 break;
2386 }
2387 }
2388
2389 read_unlock(&hci_task_lock);
2390}
2391
2392static void hci_cmd_task(unsigned long arg)
2393{
2394 struct hci_dev *hdev = (struct hci_dev *) arg;
2395 struct sk_buff *skb;
2396
2397 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2398
1da177e4 2399 /* Send queued commands */
5a08ecce
AE		 2400 if (atomic_read(&hdev->cmd_cnt)) {
2401 skb = skb_dequeue(&hdev->cmd_q);
2402 if (!skb)
2403 return;
2404
7585b97a 2405 kfree_skb(hdev->sent_cmd);
1da177e4 2406
70f23020
AE		 2407 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2408 if (hdev->sent_cmd) {
1da177e4
LT		 2409 atomic_dec(&hdev->cmd_cnt);
2410 hci_send_frame(skb);
6bd32326
VT		 2411 mod_timer(&hdev->cmd_timer,
2412 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
1da177e4
LT		 2413 } else {
2414 skb_queue_head(&hdev->cmd_q, skb);
c78ae283 2415 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 2416 }
2417 }
2418}
kernel source for telekom puls (alcatel/mediatek)