projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add a new workqueue for hci_request operations
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
3df92b31 29#include <linux/idr.h>
1da177e4 30
8c520a59 31#include <linux/rfkill.h>
1da177e4
LT		 32
33#include <net/bluetooth/bluetooth.h>
34#include <net/bluetooth/hci_core.h>
35
b78752cc 36static void hci_rx_work(struct work_struct *work);
c347b765 37static void hci_cmd_work(struct work_struct *work);
3eff45ea 38static void hci_tx_work(struct work_struct *work);
1da177e4 39
1da177e4
LT		 40/* HCI device list */
41LIST_HEAD(hci_dev_list);
42DEFINE_RWLOCK(hci_dev_list_lock);
43
44/* HCI callback list */
45LIST_HEAD(hci_cb_list);
46DEFINE_RWLOCK(hci_cb_list_lock);
47
3df92b31
SL		 48/* HCI ID Numbering */
49static DEFINE_IDA(hci_index_ida);
50
1da177e4
LT		 51/* ---- HCI notifications ---- */
52
6516455d 53static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 54{
040030ef 55 hci_sock_dev_event(hdev, event);
1da177e4
LT		 56}
57
58/* ---- HCI requests ---- */
59
23bb5763 60void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 61{
f0e09510 62 BT_DBG("%s command 0x%4.4x result 0x%2.2x", hdev->name, cmd, result);
23bb5763 63
a5040efa
JH		 64 /* If this is the init phase check if the completed command matches
65 * the last init command, and if not just return.
66 */
75fb0e32
JH		 67 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd) {
68 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1036b890 69 u16 opcode = __le16_to_cpu(sent->opcode);
75fb0e32
JH		 70 struct sk_buff *skb;
71
72 /* Some CSR based controllers generate a spontaneous
73 * reset complete event during init and any pending
74 * command will never be completed. In such a case we
75 * need to resend whatever was the last sent
76 * command.
77 */
78
1036b890 79 if (cmd != HCI_OP_RESET || opcode == HCI_OP_RESET)
75fb0e32
JH		 80 return;
81
82 skb = skb_clone(hdev->sent_cmd, GFP_ATOMIC);
83 if (skb) {
84 skb_queue_head(&hdev->cmd_q, skb);
85 queue_work(hdev->workqueue, &hdev->cmd_work);
86 }
87
23bb5763 88 return;
75fb0e32 89 }
1da177e4
LT		 90
91 if (hdev->req_status == HCI_REQ_PEND) {
92 hdev->req_result = result;
93 hdev->req_status = HCI_REQ_DONE;
94 wake_up_interruptible(&hdev->req_wait_q);
95 }
96}
97
98static void hci_req_cancel(struct hci_dev *hdev, int err)
99{
100 BT_DBG("%s err 0x%2.2x", hdev->name, err);
101
102 if (hdev->req_status == HCI_REQ_PEND) {
103 hdev->req_result = err;
104 hdev->req_status = HCI_REQ_CANCELED;
105 wake_up_interruptible(&hdev->req_wait_q);
106 }
107}
108
109/* Execute request and wait for completion. */
a8c5fb1a
GP		 110static int __hci_request(struct hci_dev *hdev,
111 void (*req)(struct hci_dev *hdev, unsigned long opt),
112 unsigned long opt, __u32 timeout)
1da177e4
LT		 113{
114 DECLARE_WAITQUEUE(wait, current);
115 int err = 0;
116
117 BT_DBG("%s start", hdev->name);
118
119 hdev->req_status = HCI_REQ_PEND;
120
121 add_wait_queue(&hdev->req_wait_q, &wait);
122 set_current_state(TASK_INTERRUPTIBLE);
123
124 req(hdev, opt);
125 schedule_timeout(timeout);
126
127 remove_wait_queue(&hdev->req_wait_q, &wait);
128
129 if (signal_pending(current))
130 return -EINTR;
131
132 switch (hdev->req_status) {
133 case HCI_REQ_DONE:
e175072f 134 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 135 break;
136
137 case HCI_REQ_CANCELED:
138 err = -hdev->req_result;
139 break;
140
141 default:
142 err = -ETIMEDOUT;
143 break;
3ff50b79 144 }
1da177e4 145
a5040efa 146 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 147
148 BT_DBG("%s end: err %d", hdev->name, err);
149
150 return err;
151}
152
6039aa73
GP		 153static int hci_request(struct hci_dev *hdev,
154 void (*req)(struct hci_dev *hdev, unsigned long opt),
155 unsigned long opt, __u32 timeout)
1da177e4
LT		 156{
157 int ret;
158
7c6a329e
MH		 159 if (!test_bit(HCI_UP, &hdev->flags))
160 return -ENETDOWN;
161
1da177e4
LT		 162 /* Serialize all requests */
163 hci_req_lock(hdev);
164 ret = __hci_request(hdev, req, opt, timeout);
165 hci_req_unlock(hdev);
166
167 return ret;
168}
169
170static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
171{
172 BT_DBG("%s %ld", hdev->name, opt);
173
174 /* Reset device */
f630cf0d 175 set_bit(HCI_RESET, &hdev->flags);
a9de9248 176 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 177}
178
e61ef499 179static void bredr_init(struct hci_dev *hdev)
1da177e4 180{
2455a3ea
AE		 181 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
182
1da177e4 183 /* Read Local Supported Features */
a9de9248 184 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 185
1143e5a6 186 /* Read Local Version */
a9de9248 187 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1da177e4
LT		 188}
189
e61ef499
AE		 190static void amp_init(struct hci_dev *hdev)
191{
2455a3ea
AE		 192 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
193
e61ef499
AE		 194 /* Read Local Version */
195 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489
AE		 196
197 /* Read Local AMP Info */
198 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 199
200 /* Read Data Blk size */
201 hci_send_cmd(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
e61ef499
AE		 202}
203
204static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
205{
206 struct sk_buff *skb;
207
208 BT_DBG("%s %ld", hdev->name, opt);
209
210 /* Driver initialization */
211
212 /* Special commands */
213 while ((skb = skb_dequeue(&hdev->driver_init))) {
214 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
215 skb->dev = (void *) hdev;
216
217 skb_queue_tail(&hdev->cmd_q, skb);
218 queue_work(hdev->workqueue, &hdev->cmd_work);
219 }
220 skb_queue_purge(&hdev->driver_init);
221
11778716
AE		 222 /* Reset */
223 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
224 hci_reset_req(hdev, 0);
225
e61ef499
AE		 226 switch (hdev->dev_type) {
227 case HCI_BREDR:
228 bredr_init(hdev);
229 break;
230
231 case HCI_AMP:
232 amp_init(hdev);
233 break;
234
235 default:
236 BT_ERR("Unknown device type %d", hdev->dev_type);
237 break;
238 }
e61ef499
AE		 239}
240
1da177e4
LT		 241static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
242{
243 __u8 scan = opt;
244
245 BT_DBG("%s %x", hdev->name, scan);
246
247 /* Inquiry and Page scans */
a9de9248 248 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 249}
250
251static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
252{
253 __u8 auth = opt;
254
255 BT_DBG("%s %x", hdev->name, auth);
256
257 /* Authentication */
a9de9248 258 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 259}
260
261static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
262{
263 __u8 encrypt = opt;
264
265 BT_DBG("%s %x", hdev->name, encrypt);
266
e4e8e37c 267 /* Encryption */
a9de9248 268 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 269}
270
e4e8e37c
MH		 271static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
272{
273 __le16 policy = cpu_to_le16(opt);
274
a418b893 275 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 276
277 /* Default link policy */
278 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
279}
280
8e87d142 281/* Get HCI device by index.
1da177e4
LT		 282 * Device is held on return. */
283struct hci_dev *hci_dev_get(int index)
284{
8035ded4 285 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 286
287 BT_DBG("%d", index);
288
289 if (index < 0)
290 return NULL;
291
292 read_lock(&hci_dev_list_lock);
8035ded4 293 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 294 if (d->id == index) {
295 hdev = hci_dev_hold(d);
296 break;
297 }
298 }
299 read_unlock(&hci_dev_list_lock);
300 return hdev;
301}
1da177e4
LT		 302
303/* ---- Inquiry support ---- */
ff9ef578 304
30dc78e1
JH		 305bool hci_discovery_active(struct hci_dev *hdev)
306{
307 struct discovery_state *discov = &hdev->discovery;
308
6fbe195d 309 switch (discov->state) {
343f935b 310 case DISCOVERY_FINDING:
6fbe195d 311 case DISCOVERY_RESOLVING:
30dc78e1
JH		 312 return true;
313
6fbe195d
AG		 314 default:
315 return false;
316 }
30dc78e1
JH		 317}
318
ff9ef578
JH		 319void hci_discovery_set_state(struct hci_dev *hdev, int state)
320{
321 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
322
323 if (hdev->discovery.state == state)
324 return;
325
326 switch (state) {
327 case DISCOVERY_STOPPED:
7b99b659
AG		 328 if (hdev->discovery.state != DISCOVERY_STARTING)
329 mgmt_discovering(hdev, 0);
ff9ef578
JH		 330 break;
331 case DISCOVERY_STARTING:
332 break;
343f935b 333 case DISCOVERY_FINDING:
ff9ef578
JH		 334 mgmt_discovering(hdev, 1);
335 break;
30dc78e1
JH		 336 case DISCOVERY_RESOLVING:
337 break;
ff9ef578
JH		 338 case DISCOVERY_STOPPING:
339 break;
340 }
341
342 hdev->discovery.state = state;
343}
344
1da177e4
LT		 345static void inquiry_cache_flush(struct hci_dev *hdev)
346{
30883512 347 struct discovery_state *cache = &hdev->discovery;
b57c1a56 348 struct inquiry_entry *p, *n;
1da177e4 349
561aafbc
JH		 350 list_for_each_entry_safe(p, n, &cache->all, all) {
351 list_del(&p->all);
b57c1a56 352 kfree(p);
1da177e4 353 }
561aafbc
JH		 354
355 INIT_LIST_HEAD(&cache->unknown);
356 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 357}
358
a8c5fb1a
GP		 359struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
360 bdaddr_t *bdaddr)
1da177e4 361{
30883512 362 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 363 struct inquiry_entry *e;
364
6ed93dc6 365 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 366
561aafbc
JH		 367 list_for_each_entry(e, &cache->all, all) {
368 if (!bacmp(&e->data.bdaddr, bdaddr))
369 return e;
370 }
371
372 return NULL;
373}
374
375struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 376 bdaddr_t *bdaddr)
561aafbc 377{
30883512 378 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 379 struct inquiry_entry *e;
380
6ed93dc6 381 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 382
383 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 384 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 385 return e;
386 }
387
388 return NULL;
1da177e4
LT		 389}
390
30dc78e1 391struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 392 bdaddr_t *bdaddr,
393 int state)
30dc78e1
JH		 394{
395 struct discovery_state *cache = &hdev->discovery;
396 struct inquiry_entry *e;
397
6ed93dc6 398 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 399
400 list_for_each_entry(e, &cache->resolve, list) {
401 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
402 return e;
403 if (!bacmp(&e->data.bdaddr, bdaddr))
404 return e;
405 }
406
407 return NULL;
408}
409
a3d4e20a 410void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 411 struct inquiry_entry *ie)
a3d4e20a
JH		 412{
413 struct discovery_state *cache = &hdev->discovery;
414 struct list_head *pos = &cache->resolve;
415 struct inquiry_entry *p;
416
417 list_del(&ie->list);
418
419 list_for_each_entry(p, &cache->resolve, list) {
420 if (p->name_state != NAME_PENDING &&
a8c5fb1a 421 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 422 break;
423 pos = &p->list;
424 }
425
426 list_add(&ie->list, pos);
427}
428
3175405b 429bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
04124681 430 bool name_known, bool *ssp)
1da177e4 431{
30883512 432 struct discovery_state *cache = &hdev->discovery;
70f23020 433 struct inquiry_entry *ie;
1da177e4 434
6ed93dc6 435 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 436
2b2fec4d
SJ		 437 hci_remove_remote_oob_data(hdev, &data->bdaddr);
438
388fc8fa
JH		 439 if (ssp)
440 *ssp = data->ssp_mode;
441
70f23020 442 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 443 if (ie) {
388fc8fa
JH		 444 if (ie->data.ssp_mode && ssp)
445 *ssp = true;
446
a3d4e20a 447 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 448 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 449 ie->data.rssi = data->rssi;
450 hci_inquiry_cache_update_resolve(hdev, ie);
451 }
452
561aafbc 453 goto update;
a3d4e20a 454 }
561aafbc
JH		 455
456 /* Entry not in the cache. Add new one. */
457 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
458 if (!ie)
3175405b 459 return false;
561aafbc
JH		 460
461 list_add(&ie->all, &cache->all);
462
463 if (name_known) {
464 ie->name_state = NAME_KNOWN;
465 } else {
466 ie->name_state = NAME_NOT_KNOWN;
467 list_add(&ie->list, &cache->unknown);
468 }
70f23020 469
561aafbc
JH		 470update:
471 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 472 ie->name_state != NAME_PENDING) {
561aafbc
JH		 473 ie->name_state = NAME_KNOWN;
474 list_del(&ie->list);
1da177e4
LT		 475 }
476
70f23020
AE		 477 memcpy(&ie->data, data, sizeof(*data));
478 ie->timestamp = jiffies;
1da177e4 479 cache->timestamp = jiffies;
3175405b
JH		 480
481 if (ie->name_state == NAME_NOT_KNOWN)
482 return false;
483
484 return true;
1da177e4
LT		 485}
486
487static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
488{
30883512 489 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 490 struct inquiry_info *info = (struct inquiry_info *) buf;
491 struct inquiry_entry *e;
492 int copied = 0;
493
561aafbc 494 list_for_each_entry(e, &cache->all, all) {
1da177e4 495 struct inquiry_data *data = &e->data;
b57c1a56
JH		 496
497 if (copied >= num)
498 break;
499
1da177e4
LT		 500 bacpy(&info->bdaddr, &data->bdaddr);
501 info->pscan_rep_mode = data->pscan_rep_mode;
502 info->pscan_period_mode = data->pscan_period_mode;
503 info->pscan_mode = data->pscan_mode;
504 memcpy(info->dev_class, data->dev_class, 3);
505 info->clock_offset = data->clock_offset;
b57c1a56 506
1da177e4 507 info++;
b57c1a56 508 copied++;
1da177e4
LT		 509 }
510
511 BT_DBG("cache %p, copied %d", cache, copied);
512 return copied;
513}
514
515static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
516{
517 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
518 struct hci_cp_inquiry cp;
519
520 BT_DBG("%s", hdev->name);
521
522 if (test_bit(HCI_INQUIRY, &hdev->flags))
523 return;
524
525 /* Start Inquiry */
526 memcpy(&cp.lap, &ir->lap, 3);
527 cp.length = ir->length;
528 cp.num_rsp = ir->num_rsp;
a9de9248 529 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 530}
531
532int hci_inquiry(void __user *arg)
533{
534 __u8 __user *ptr = arg;
535 struct hci_inquiry_req ir;
536 struct hci_dev *hdev;
537 int err = 0, do_inquiry = 0, max_rsp;
538 long timeo;
539 __u8 *buf;
540
541 if (copy_from_user(&ir, ptr, sizeof(ir)))
542 return -EFAULT;
543
5a08ecce
AE		 544 hdev = hci_dev_get(ir.dev_id);
545 if (!hdev)
1da177e4
LT		 546 return -ENODEV;
547
09fd0de5 548 hci_dev_lock(hdev);
8e87d142 549 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 550 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 551 inquiry_cache_flush(hdev);
552 do_inquiry = 1;
553 }
09fd0de5 554 hci_dev_unlock(hdev);
1da177e4 555
04837f64 556 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 557
558 if (do_inquiry) {
559 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
560 if (err < 0)
561 goto done;
562 }
1da177e4 563
8fc9ced3
GP		 564 /* for unlimited number of responses we will use buffer with
565 * 255 entries
566 */
1da177e4
LT		 567 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
568
569 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
570 * copy it to the user space.
571 */
01df8c31 572 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 573 if (!buf) {
1da177e4
LT		 574 err = -ENOMEM;
575 goto done;
576 }
577
09fd0de5 578 hci_dev_lock(hdev);
1da177e4 579 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 580 hci_dev_unlock(hdev);
1da177e4
LT		 581
582 BT_DBG("num_rsp %d", ir.num_rsp);
583
584 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
585 ptr += sizeof(ir);
586 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 587 ir.num_rsp))
1da177e4 588 err = -EFAULT;
8e87d142 589 } else
1da177e4
LT		 590 err = -EFAULT;
591
592 kfree(buf);
593
594done:
595 hci_dev_put(hdev);
596 return err;
597}
598
3f0f524b
JH		 599static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
600{
601 u8 ad_len = 0, flags = 0;
602 size_t name_len;
603
604 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
605 flags |= LE_AD_GENERAL;
606
607 if (!lmp_bredr_capable(hdev))
608 flags |= LE_AD_NO_BREDR;
609
610 if (lmp_le_br_capable(hdev))
611 flags |= LE_AD_SIM_LE_BREDR_CTRL;
612
613 if (lmp_host_le_br_capable(hdev))
614 flags |= LE_AD_SIM_LE_BREDR_HOST;
615
616 if (flags) {
617 BT_DBG("adv flags 0x%02x", flags);
618
619 ptr[0] = 2;
620 ptr[1] = EIR_FLAGS;
621 ptr[2] = flags;
622
623 ad_len += 3;
624 ptr += 3;
625 }
626
627 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
628 ptr[0] = 2;
629 ptr[1] = EIR_TX_POWER;
630 ptr[2] = (u8) hdev->adv_tx_power;
631
632 ad_len += 3;
633 ptr += 3;
634 }
635
636 name_len = strlen(hdev->dev_name);
637 if (name_len > 0) {
638 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
639
640 if (name_len > max_len) {
641 name_len = max_len;
642 ptr[1] = EIR_NAME_SHORT;
643 } else
644 ptr[1] = EIR_NAME_COMPLETE;
645
646 ptr[0] = name_len + 1;
647
648 memcpy(ptr + 2, hdev->dev_name, name_len);
649
650 ad_len += (name_len + 2);
651 ptr += (name_len + 2);
652 }
653
654 return ad_len;
655}
656
657int hci_update_ad(struct hci_dev *hdev)
658{
659 struct hci_cp_le_set_adv_data cp;
660 u8 len;
661 int err;
662
663 hci_dev_lock(hdev);
664
665 if (!lmp_le_capable(hdev)) {
666 err = -EINVAL;
667 goto unlock;
668 }
669
670 memset(&cp, 0, sizeof(cp));
671
672 len = create_ad(hdev, cp.data);
673
674 if (hdev->adv_data_len == len &&
675 memcmp(cp.data, hdev->adv_data, len) == 0) {
676 err = 0;
677 goto unlock;
678 }
679
680 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
681 hdev->adv_data_len = len;
682
683 cp.length = len;
684 err = hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
685
686unlock:
687 hci_dev_unlock(hdev);
688
689 return err;
690}
691
1da177e4
LT		 692/* ---- HCI ioctl helpers ---- */
693
694int hci_dev_open(__u16 dev)
695{
696 struct hci_dev *hdev;
697 int ret = 0;
698
5a08ecce
AE		 699 hdev = hci_dev_get(dev);
700 if (!hdev)
1da177e4
LT		 701 return -ENODEV;
702
703 BT_DBG("%s %p", hdev->name, hdev);
704
705 hci_req_lock(hdev);
706
94324962
JH		 707 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
708 ret = -ENODEV;
709 goto done;
710 }
711
611b30f7
MH		 712 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
713 ret = -ERFKILL;
714 goto done;
715 }
716
1da177e4
LT		 717 if (test_bit(HCI_UP, &hdev->flags)) {
718 ret = -EALREADY;
719 goto done;
720 }
721
722 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
723 set_bit(HCI_RAW, &hdev->flags);
724
07e3b94a
AE		 725 /* Treat all non BR/EDR controllers as raw devices if
726 enable_hs is not set */
727 if (hdev->dev_type != HCI_BREDR && !enable_hs)
943da25d
MH		 728 set_bit(HCI_RAW, &hdev->flags);
729
1da177e4
LT		 730 if (hdev->open(hdev)) {
731 ret = -EIO;
732 goto done;
733 }
734
735 if (!test_bit(HCI_RAW, &hdev->flags)) {
736 atomic_set(&hdev->cmd_cnt, 1);
737 set_bit(HCI_INIT, &hdev->flags);
a5040efa 738 hdev->init_last_cmd = 0;
1da177e4 739
5f246e89 740 ret = __hci_request(hdev, hci_init_req, 0, HCI_INIT_TIMEOUT);
1da177e4
LT		 741
742 clear_bit(HCI_INIT, &hdev->flags);
743 }
744
745 if (!ret) {
746 hci_dev_hold(hdev);
747 set_bit(HCI_UP, &hdev->flags);
748 hci_notify(hdev, HCI_DEV_UP);
3f0f524b 749 hci_update_ad(hdev);
bb4b2a9a
AE		 750 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
751 mgmt_valid_hdev(hdev)) {
09fd0de5 752 hci_dev_lock(hdev);
744cf19e 753 mgmt_powered(hdev, 1);
09fd0de5 754 hci_dev_unlock(hdev);
56e5cb86 755 }
8e87d142 756 } else {
1da177e4 757 /* Init failed, cleanup */
3eff45ea 758 flush_work(&hdev->tx_work);
c347b765 759 flush_work(&hdev->cmd_work);
b78752cc 760 flush_work(&hdev->rx_work);
1da177e4
LT		 761
762 skb_queue_purge(&hdev->cmd_q);
763 skb_queue_purge(&hdev->rx_q);
764
765 if (hdev->flush)
766 hdev->flush(hdev);
767
768 if (hdev->sent_cmd) {
769 kfree_skb(hdev->sent_cmd);
770 hdev->sent_cmd = NULL;
771 }
772
773 hdev->close(hdev);
774 hdev->flags = 0;
775 }
776
777done:
778 hci_req_unlock(hdev);
779 hci_dev_put(hdev);
780 return ret;
781}
782
783static int hci_dev_do_close(struct hci_dev *hdev)
784{
785 BT_DBG("%s %p", hdev->name, hdev);
786
28b75a89
AG		 787 cancel_work_sync(&hdev->le_scan);
788
78c04c0b
VCG		 789 cancel_delayed_work(&hdev->power_off);
790
1da177e4
LT		 791 hci_req_cancel(hdev, ENODEV);
792 hci_req_lock(hdev);
793
794 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 795 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 796 hci_req_unlock(hdev);
797 return 0;
798 }
799
3eff45ea
GP		 800 /* Flush RX and TX works */
801 flush_work(&hdev->tx_work);
b78752cc 802 flush_work(&hdev->rx_work);
1da177e4 803
16ab91ab 804 if (hdev->discov_timeout > 0) {
e0f9309f 805 cancel_delayed_work(&hdev->discov_off);
16ab91ab 806 hdev->discov_timeout = 0;
5e5282bb 807 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
16ab91ab
JH		 808 }
809
a8b2d5c2 810 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 811 cancel_delayed_work(&hdev->service_cache);
812
7ba8b4be
AG		 813 cancel_delayed_work_sync(&hdev->le_scan_disable);
814
09fd0de5 815 hci_dev_lock(hdev);
1da177e4
LT		 816 inquiry_cache_flush(hdev);
817 hci_conn_hash_flush(hdev);
09fd0de5 818 hci_dev_unlock(hdev);
1da177e4
LT		 819
820 hci_notify(hdev, HCI_DEV_DOWN);
821
822 if (hdev->flush)
823 hdev->flush(hdev);
824
825 /* Reset device */
826 skb_queue_purge(&hdev->cmd_q);
827 atomic_set(&hdev->cmd_cnt, 1);
8af59467 828 if (!test_bit(HCI_RAW, &hdev->flags) &&
a6c511c6 829 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1da177e4 830 set_bit(HCI_INIT, &hdev->flags);
5f246e89 831 __hci_request(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1da177e4
LT		 832 clear_bit(HCI_INIT, &hdev->flags);
833 }
834
c347b765
GP		 835 /* flush cmd work */
836 flush_work(&hdev->cmd_work);
1da177e4
LT		 837
838 /* Drop queues */
839 skb_queue_purge(&hdev->rx_q);
840 skb_queue_purge(&hdev->cmd_q);
841 skb_queue_purge(&hdev->raw_q);
842
843 /* Drop last sent command */
844 if (hdev->sent_cmd) {
b79f44c1 845 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 846 kfree_skb(hdev->sent_cmd);
847 hdev->sent_cmd = NULL;
848 }
849
850 /* After this point our queues are empty
851 * and no tasks are scheduled. */
852 hdev->close(hdev);
853
bb4b2a9a
AE		 854 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
855 mgmt_valid_hdev(hdev)) {
8ee56540
MH		 856 hci_dev_lock(hdev);
857 mgmt_powered(hdev, 0);
858 hci_dev_unlock(hdev);
859 }
5add6af8 860
1da177e4
LT		 861 /* Clear flags */
862 hdev->flags = 0;
863
ced5c338
AE		 864 /* Controller radio is available but is currently powered down */
865 hdev->amp_status = 0;
866
e59fda8d 867 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 868 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
e59fda8d 869
1da177e4
LT		 870 hci_req_unlock(hdev);
871
872 hci_dev_put(hdev);
873 return 0;
874}
875
876int hci_dev_close(__u16 dev)
877{
878 struct hci_dev *hdev;
879 int err;
880
70f23020
AE		 881 hdev = hci_dev_get(dev);
882 if (!hdev)
1da177e4 883 return -ENODEV;
8ee56540
MH		 884
885 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
886 cancel_delayed_work(&hdev->power_off);
887
1da177e4 888 err = hci_dev_do_close(hdev);
8ee56540 889
1da177e4
LT		 890 hci_dev_put(hdev);
891 return err;
892}
893
894int hci_dev_reset(__u16 dev)
895{
896 struct hci_dev *hdev;
897 int ret = 0;
898
70f23020
AE		 899 hdev = hci_dev_get(dev);
900 if (!hdev)
1da177e4
LT		 901 return -ENODEV;
902
903 hci_req_lock(hdev);
1da177e4
LT		 904
905 if (!test_bit(HCI_UP, &hdev->flags))
906 goto done;
907
908 /* Drop queues */
909 skb_queue_purge(&hdev->rx_q);
910 skb_queue_purge(&hdev->cmd_q);
911
09fd0de5 912 hci_dev_lock(hdev);
1da177e4
LT		 913 inquiry_cache_flush(hdev);
914 hci_conn_hash_flush(hdev);
09fd0de5 915 hci_dev_unlock(hdev);
1da177e4
LT		 916
917 if (hdev->flush)
918 hdev->flush(hdev);
919
8e87d142 920 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 921 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 922
923 if (!test_bit(HCI_RAW, &hdev->flags))
5f246e89 924 ret = __hci_request(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1da177e4
LT		 925
926done:
1da177e4
LT		 927 hci_req_unlock(hdev);
928 hci_dev_put(hdev);
929 return ret;
930}
931
932int hci_dev_reset_stat(__u16 dev)
933{
934 struct hci_dev *hdev;
935 int ret = 0;
936
70f23020
AE		 937 hdev = hci_dev_get(dev);
938 if (!hdev)
1da177e4
LT		 939 return -ENODEV;
940
941 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
942
943 hci_dev_put(hdev);
944
945 return ret;
946}
947
948int hci_dev_cmd(unsigned int cmd, void __user *arg)
949{
950 struct hci_dev *hdev;
951 struct hci_dev_req dr;
952 int err = 0;
953
954 if (copy_from_user(&dr, arg, sizeof(dr)))
955 return -EFAULT;
956
70f23020
AE		 957 hdev = hci_dev_get(dr.dev_id);
958 if (!hdev)
1da177e4
LT		 959 return -ENODEV;
960
961 switch (cmd) {
962 case HCISETAUTH:
04837f64 963 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
5f246e89 964 HCI_INIT_TIMEOUT);
1da177e4
LT		 965 break;
966
967 case HCISETENCRYPT:
968 if (!lmp_encrypt_capable(hdev)) {
969 err = -EOPNOTSUPP;
970 break;
971 }
972
973 if (!test_bit(HCI_AUTH, &hdev->flags)) {
974 /* Auth must be enabled first */
04837f64 975 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
5f246e89 976 HCI_INIT_TIMEOUT);
1da177e4
LT		 977 if (err)
978 break;
979 }
980
04837f64 981 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
5f246e89 982 HCI_INIT_TIMEOUT);
1da177e4
LT		 983 break;
984
985 case HCISETSCAN:
04837f64 986 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
5f246e89 987 HCI_INIT_TIMEOUT);
1da177e4
LT		 988 break;
989
1da177e4 990 case HCISETLINKPOL:
e4e8e37c 991 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
5f246e89 992 HCI_INIT_TIMEOUT);
1da177e4
LT		 993 break;
994
995 case HCISETLINKMODE:
e4e8e37c
MH		 996 hdev->link_mode = ((__u16) dr.dev_opt) &
997 (HCI_LM_MASTER | HCI_LM_ACCEPT);
998 break;
999
1000 case HCISETPTYPE:
1001 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 1002 break;
1003
1004 case HCISETACLMTU:
e4e8e37c
MH		 1005 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1006 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1007 break;
1008
1009 case HCISETSCOMTU:
e4e8e37c
MH		 1010 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1011 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1012 break;
1013
1014 default:
1015 err = -EINVAL;
1016 break;
1017 }
e4e8e37c 1018
1da177e4
LT		 1019 hci_dev_put(hdev);
1020 return err;
1021}
1022
1023int hci_get_dev_list(void __user *arg)
1024{
8035ded4 1025 struct hci_dev *hdev;
1da177e4
LT		 1026 struct hci_dev_list_req *dl;
1027 struct hci_dev_req *dr;
1da177e4
LT		 1028 int n = 0, size, err;
1029 __u16 dev_num;
1030
1031 if (get_user(dev_num, (__u16 __user *) arg))
1032 return -EFAULT;
1033
1034 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1035 return -EINVAL;
1036
1037 size = sizeof(*dl) + dev_num * sizeof(*dr);
1038
70f23020
AE		 1039 dl = kzalloc(size, GFP_KERNEL);
1040 if (!dl)
1da177e4
LT		 1041 return -ENOMEM;
1042
1043 dr = dl->dev_req;
1044
f20d09d5 1045 read_lock(&hci_dev_list_lock);
8035ded4 1046 list_for_each_entry(hdev, &hci_dev_list, list) {
a8b2d5c2 1047 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
e0f9309f 1048 cancel_delayed_work(&hdev->power_off);
c542a06c 1049
a8b2d5c2
JH		 1050 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1051 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1052
1da177e4
LT		 1053 (dr + n)->dev_id = hdev->id;
1054 (dr + n)->dev_opt = hdev->flags;
c542a06c 1055
1da177e4
LT		 1056 if (++n >= dev_num)
1057 break;
1058 }
f20d09d5 1059 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 1060
1061 dl->dev_num = n;
1062 size = sizeof(*dl) + n * sizeof(*dr);
1063
1064 err = copy_to_user(arg, dl, size);
1065 kfree(dl);
1066
1067 return err ? -EFAULT : 0;
1068}
1069
1070int hci_get_dev_info(void __user *arg)
1071{
1072 struct hci_dev *hdev;
1073 struct hci_dev_info di;
1074 int err = 0;
1075
1076 if (copy_from_user(&di, arg, sizeof(di)))
1077 return -EFAULT;
1078
70f23020
AE		 1079 hdev = hci_dev_get(di.dev_id);
1080 if (!hdev)
1da177e4
LT		 1081 return -ENODEV;
1082
a8b2d5c2 1083 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
3243553f 1084 cancel_delayed_work_sync(&hdev->power_off);
ab81cbf9 1085
a8b2d5c2
JH		 1086 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1087 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1088
1da177e4
LT		 1089 strcpy(di.name, hdev->name);
1090 di.bdaddr = hdev->bdaddr;
943da25d 1091 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 1092 di.flags = hdev->flags;
1093 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 1094 if (lmp_bredr_capable(hdev)) {
1095 di.acl_mtu = hdev->acl_mtu;
1096 di.acl_pkts = hdev->acl_pkts;
1097 di.sco_mtu = hdev->sco_mtu;
1098 di.sco_pkts = hdev->sco_pkts;
1099 } else {
1100 di.acl_mtu = hdev->le_mtu;
1101 di.acl_pkts = hdev->le_pkts;
1102 di.sco_mtu = 0;
1103 di.sco_pkts = 0;
1104 }
1da177e4
LT		 1105 di.link_policy = hdev->link_policy;
1106 di.link_mode = hdev->link_mode;
1107
1108 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1109 memcpy(&di.features, &hdev->features, sizeof(di.features));
1110
1111 if (copy_to_user(arg, &di, sizeof(di)))
1112 err = -EFAULT;
1113
1114 hci_dev_put(hdev);
1115
1116 return err;
1117}
1118
1119/* ---- Interface to HCI drivers ---- */
1120
611b30f7
MH		 1121static int hci_rfkill_set_block(void *data, bool blocked)
1122{
1123 struct hci_dev *hdev = data;
1124
1125 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1126
1127 if (!blocked)
1128 return 0;
1129
1130 hci_dev_do_close(hdev);
1131
1132 return 0;
1133}
1134
1135static const struct rfkill_ops hci_rfkill_ops = {
1136 .set_block = hci_rfkill_set_block,
1137};
1138
ab81cbf9
JH		 1139static void hci_power_on(struct work_struct *work)
1140{
1141 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1142
1143 BT_DBG("%s", hdev->name);
1144
1145 if (hci_dev_open(hdev->id) < 0)
1146 return;
1147
a8b2d5c2 1148 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
9345d40c 1149 schedule_delayed_work(&hdev->power_off, HCI_AUTO_OFF_TIMEOUT);
ab81cbf9 1150
a8b2d5c2 1151 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
744cf19e 1152 mgmt_index_added(hdev);
ab81cbf9
JH		 1153}
1154
1155static void hci_power_off(struct work_struct *work)
1156{
3243553f 1157 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 1158 power_off.work);
ab81cbf9
JH		 1159
1160 BT_DBG("%s", hdev->name);
1161
8ee56540 1162 hci_dev_do_close(hdev);
ab81cbf9
JH		 1163}
1164
16ab91ab
JH		 1165static void hci_discov_off(struct work_struct *work)
1166{
1167 struct hci_dev *hdev;
1168 u8 scan = SCAN_PAGE;
1169
1170 hdev = container_of(work, struct hci_dev, discov_off.work);
1171
1172 BT_DBG("%s", hdev->name);
1173
09fd0de5 1174 hci_dev_lock(hdev);
16ab91ab
JH		 1175
1176 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1177
1178 hdev->discov_timeout = 0;
1179
09fd0de5 1180 hci_dev_unlock(hdev);
16ab91ab
JH		 1181}
1182
2aeb9a1a
JH		 1183int hci_uuids_clear(struct hci_dev *hdev)
1184{
1185 struct list_head *p, *n;
1186
1187 list_for_each_safe(p, n, &hdev->uuids) {
1188 struct bt_uuid *uuid;
1189
1190 uuid = list_entry(p, struct bt_uuid, list);
1191
1192 list_del(p);
1193 kfree(uuid);
1194 }
1195
1196 return 0;
1197}
1198
55ed8ca1
JH		 1199int hci_link_keys_clear(struct hci_dev *hdev)
1200{
1201 struct list_head *p, *n;
1202
1203 list_for_each_safe(p, n, &hdev->link_keys) {
1204 struct link_key *key;
1205
1206 key = list_entry(p, struct link_key, list);
1207
1208 list_del(p);
1209 kfree(key);
1210 }
1211
1212 return 0;
1213}
1214
b899efaf
VCG		 1215int hci_smp_ltks_clear(struct hci_dev *hdev)
1216{
1217 struct smp_ltk *k, *tmp;
1218
1219 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1220 list_del(&k->list);
1221 kfree(k);
1222 }
1223
1224 return 0;
1225}
1226
55ed8ca1
JH		 1227struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1228{
8035ded4 1229 struct link_key *k;
55ed8ca1 1230
8035ded4 1231 list_for_each_entry(k, &hdev->link_keys, list)
55ed8ca1
JH		 1232 if (bacmp(bdaddr, &k->bdaddr) == 0)
1233 return k;
55ed8ca1
JH		 1234
1235 return NULL;
1236}
1237
745c0ce3 1238static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 1239 u8 key_type, u8 old_key_type)
d25e28ab
JH		 1240{
1241 /* Legacy key */
1242 if (key_type < 0x03)
745c0ce3 1243 return true;
d25e28ab
JH		 1244
1245 /* Debug keys are insecure so don't store them persistently */
1246 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 1247 return false;
d25e28ab
JH		 1248
1249 /* Changed combination key and there's no previous one */
1250 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 1251 return false;
d25e28ab
JH		 1252
1253 /* Security mode 3 case */
1254 if (!conn)
745c0ce3 1255 return true;
d25e28ab
JH		 1256
1257 /* Neither local nor remote side had no-bonding as requirement */
1258 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 1259 return true;
d25e28ab
JH		 1260
1261 /* Local side had dedicated bonding as requirement */
1262 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 1263 return true;
d25e28ab
JH		 1264
1265 /* Remote side had dedicated bonding as requirement */
1266 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 1267 return true;
d25e28ab
JH		 1268
1269 /* If none of the above criteria match, then don't store the key
1270 * persistently */
745c0ce3 1271 return false;
d25e28ab
JH		 1272}
1273
c9839a11 1274struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
75d262c2 1275{
c9839a11 1276 struct smp_ltk *k;
75d262c2 1277
c9839a11
VCG		 1278 list_for_each_entry(k, &hdev->long_term_keys, list) {
1279 if (k->ediv != ediv ||
a8c5fb1a 1280 memcmp(rand, k->rand, sizeof(k->rand)))
75d262c2
VCG		 1281 continue;
1282
c9839a11 1283 return k;
75d262c2
VCG		 1284 }
1285
1286 return NULL;
1287}
75d262c2 1288
c9839a11 1289struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 1290 u8 addr_type)
75d262c2 1291{
c9839a11 1292 struct smp_ltk *k;
75d262c2 1293
c9839a11
VCG		 1294 list_for_each_entry(k, &hdev->long_term_keys, list)
1295 if (addr_type == k->bdaddr_type &&
a8c5fb1a 1296 bacmp(bdaddr, &k->bdaddr) == 0)
75d262c2
VCG		 1297 return k;
1298
1299 return NULL;
1300}
75d262c2 1301
d25e28ab 1302int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
04124681 1303 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1304{
1305 struct link_key *key, *old_key;
745c0ce3
VA		 1306 u8 old_key_type;
1307 bool persistent;
55ed8ca1
JH		 1308
1309 old_key = hci_find_link_key(hdev, bdaddr);
1310 if (old_key) {
1311 old_key_type = old_key->type;
1312 key = old_key;
1313 } else {
12adcf3a 1314 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1315 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1316 if (!key)
1317 return -ENOMEM;
1318 list_add(&key->list, &hdev->link_keys);
1319 }
1320
6ed93dc6 1321 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 1322
d25e28ab
JH		 1323 /* Some buggy controller combinations generate a changed
1324 * combination key for legacy pairing even when there's no
1325 * previous key */
1326 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 1327 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 1328 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1329 if (conn)
1330 conn->key_type = type;
1331 }
d25e28ab 1332
55ed8ca1 1333 bacpy(&key->bdaddr, bdaddr);
9b3b4460 1334 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 1335 key->pin_len = pin_len;
1336
b6020ba0 1337 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1338 key->type = old_key_type;
4748fed2
JH		 1339 else
1340 key->type = type;
1341
4df378a1
JH		 1342 if (!new_key)
1343 return 0;
1344
1345 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1346
744cf19e 1347 mgmt_new_link_key(hdev, key, persistent);
4df378a1 1348
6ec5bcad
VA		 1349 if (conn)
1350 conn->flush_key = !persistent;
55ed8ca1
JH		 1351
1352 return 0;
1353}
1354
c9839a11 1355int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
9a006657 1356 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
04124681 1357 ediv, u8 rand[8])
75d262c2 1358{
c9839a11 1359 struct smp_ltk *key, *old_key;
75d262c2 1360
c9839a11
VCG		 1361 if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1362 return 0;
75d262c2 1363
c9839a11
VCG		 1364 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1365 if (old_key)
75d262c2 1366 key = old_key;
c9839a11
VCG		 1367 else {
1368 key = kzalloc(sizeof(*key), GFP_ATOMIC);
75d262c2
VCG		 1369 if (!key)
1370 return -ENOMEM;
c9839a11 1371 list_add(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 1372 }
1373
75d262c2 1374 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 1375 key->bdaddr_type = addr_type;
1376 memcpy(key->val, tk, sizeof(key->val));
1377 key->authenticated = authenticated;
1378 key->ediv = ediv;
1379 key->enc_size = enc_size;
1380 key->type = type;
1381 memcpy(key->rand, rand, sizeof(key->rand));
75d262c2 1382
c9839a11
VCG		 1383 if (!new_key)
1384 return 0;
75d262c2 1385
261cc5aa
VCG		 1386 if (type & HCI_SMP_LTK)
1387 mgmt_new_ltk(hdev, key, 1);
1388
75d262c2
VCG		 1389 return 0;
1390}
1391
55ed8ca1
JH		 1392int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1393{
1394 struct link_key *key;
1395
1396 key = hci_find_link_key(hdev, bdaddr);
1397 if (!key)
1398 return -ENOENT;
1399
6ed93dc6 1400 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1
JH		 1401
1402 list_del(&key->list);
1403 kfree(key);
1404
1405 return 0;
1406}
1407
b899efaf
VCG		 1408int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1409{
1410 struct smp_ltk *k, *tmp;
1411
1412 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1413 if (bacmp(bdaddr, &k->bdaddr))
1414 continue;
1415
6ed93dc6 1416 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf
VCG		 1417
1418 list_del(&k->list);
1419 kfree(k);
1420 }
1421
1422 return 0;
1423}
1424
6bd32326 1425/* HCI command timer function */
bda4f23a 1426static void hci_cmd_timeout(unsigned long arg)
6bd32326
VT		 1427{
1428 struct hci_dev *hdev = (void *) arg;
1429
bda4f23a
AE		 1430 if (hdev->sent_cmd) {
1431 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1432 u16 opcode = __le16_to_cpu(sent->opcode);
1433
1434 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
1435 } else {
1436 BT_ERR("%s command tx timeout", hdev->name);
1437 }
1438
6bd32326 1439 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1440 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1441}
1442
2763eda6 1443struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
04124681 1444 bdaddr_t *bdaddr)
2763eda6
SJ		 1445{
1446 struct oob_data *data;
1447
1448 list_for_each_entry(data, &hdev->remote_oob_data, list)
1449 if (bacmp(bdaddr, &data->bdaddr) == 0)
1450 return data;
1451
1452 return NULL;
1453}
1454
1455int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1456{
1457 struct oob_data *data;
1458
1459 data = hci_find_remote_oob_data(hdev, bdaddr);
1460 if (!data)
1461 return -ENOENT;
1462
6ed93dc6 1463 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1464
1465 list_del(&data->list);
1466 kfree(data);
1467
1468 return 0;
1469}
1470
1471int hci_remote_oob_data_clear(struct hci_dev *hdev)
1472{
1473 struct oob_data *data, *n;
1474
1475 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1476 list_del(&data->list);
1477 kfree(data);
1478 }
1479
1480 return 0;
1481}
1482
1483int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
04124681 1484 u8 *randomizer)
2763eda6
SJ		 1485{
1486 struct oob_data *data;
1487
1488 data = hci_find_remote_oob_data(hdev, bdaddr);
1489
1490 if (!data) {
1491 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1492 if (!data)
1493 return -ENOMEM;
1494
1495 bacpy(&data->bdaddr, bdaddr);
1496 list_add(&data->list, &hdev->remote_oob_data);
1497 }
1498
1499 memcpy(data->hash, hash, sizeof(data->hash));
1500 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1501
6ed93dc6 1502 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1503
1504 return 0;
1505}
1506
04124681 1507struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
b2a66aad 1508{
8035ded4 1509 struct bdaddr_list *b;
b2a66aad 1510
8035ded4 1511 list_for_each_entry(b, &hdev->blacklist, list)
b2a66aad
AJ		 1512 if (bacmp(bdaddr, &b->bdaddr) == 0)
1513 return b;
b2a66aad
AJ		 1514
1515 return NULL;
1516}
1517
1518int hci_blacklist_clear(struct hci_dev *hdev)
1519{
1520 struct list_head *p, *n;
1521
1522 list_for_each_safe(p, n, &hdev->blacklist) {
1523 struct bdaddr_list *b;
1524
1525 b = list_entry(p, struct bdaddr_list, list);
1526
1527 list_del(p);
1528 kfree(b);
1529 }
1530
1531 return 0;
1532}
1533
88c1fe4b 1534int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 1535{
1536 struct bdaddr_list *entry;
b2a66aad
AJ		 1537
1538 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1539 return -EBADF;
1540
5e762444
AJ		 1541 if (hci_blacklist_lookup(hdev, bdaddr))
1542 return -EEXIST;
b2a66aad
AJ		 1543
1544 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
5e762444
AJ		 1545 if (!entry)
1546 return -ENOMEM;
b2a66aad
AJ		 1547
1548 bacpy(&entry->bdaddr, bdaddr);
1549
1550 list_add(&entry->list, &hdev->blacklist);
1551
88c1fe4b 1552 return mgmt_device_blocked(hdev, bdaddr, type);
b2a66aad
AJ		 1553}
1554
88c1fe4b 1555int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 1556{
1557 struct bdaddr_list *entry;
b2a66aad 1558
1ec918ce 1559 if (bacmp(bdaddr, BDADDR_ANY) == 0)
5e762444 1560 return hci_blacklist_clear(hdev);
b2a66aad
AJ		 1561
1562 entry = hci_blacklist_lookup(hdev, bdaddr);
1ec918ce 1563 if (!entry)
5e762444 1564 return -ENOENT;
b2a66aad
AJ		 1565
1566 list_del(&entry->list);
1567 kfree(entry);
1568
88c1fe4b 1569 return mgmt_device_unblocked(hdev, bdaddr, type);
b2a66aad
AJ		 1570}
1571
7ba8b4be
AG		 1572static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
1573{
1574 struct le_scan_params *param = (struct le_scan_params *) opt;
1575 struct hci_cp_le_set_scan_param cp;
1576
1577 memset(&cp, 0, sizeof(cp));
1578 cp.type = param->type;
1579 cp.interval = cpu_to_le16(param->interval);
1580 cp.window = cpu_to_le16(param->window);
1581
1582 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
1583}
1584
1585static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
1586{
1587 struct hci_cp_le_set_scan_enable cp;
1588
1589 memset(&cp, 0, sizeof(cp));
1590 cp.enable = 1;
0431a43c 1591 cp.filter_dup = 1;
7ba8b4be
AG		 1592
1593 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1594}
1595
1596static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
04124681 1597 u16 window, int timeout)
7ba8b4be
AG		 1598{
1599 long timeo = msecs_to_jiffies(3000);
1600 struct le_scan_params param;
1601 int err;
1602
1603 BT_DBG("%s", hdev->name);
1604
1605 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1606 return -EINPROGRESS;
1607
1608 param.type = type;
1609 param.interval = interval;
1610 param.window = window;
1611
1612 hci_req_lock(hdev);
1613
1614 err = __hci_request(hdev, le_scan_param_req, (unsigned long) &param,
04124681 1615 timeo);
7ba8b4be
AG		 1616 if (!err)
1617 err = __hci_request(hdev, le_scan_enable_req, 0, timeo);
1618
1619 hci_req_unlock(hdev);
1620
1621 if (err < 0)
1622 return err;
1623
1624 schedule_delayed_work(&hdev->le_scan_disable,
04124681 1625 msecs_to_jiffies(timeout));
7ba8b4be
AG		 1626
1627 return 0;
1628}
1629
7dbfac1d
AG		 1630int hci_cancel_le_scan(struct hci_dev *hdev)
1631{
1632 BT_DBG("%s", hdev->name);
1633
1634 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1635 return -EALREADY;
1636
1637 if (cancel_delayed_work(&hdev->le_scan_disable)) {
1638 struct hci_cp_le_set_scan_enable cp;
1639
1640 /* Send HCI command to disable LE Scan */
1641 memset(&cp, 0, sizeof(cp));
1642 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1643 }
1644
1645 return 0;
1646}
1647
7ba8b4be
AG		 1648static void le_scan_disable_work(struct work_struct *work)
1649{
1650 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 1651 le_scan_disable.work);
7ba8b4be
AG		 1652 struct hci_cp_le_set_scan_enable cp;
1653
1654 BT_DBG("%s", hdev->name);
1655
1656 memset(&cp, 0, sizeof(cp));
1657
1658 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1659}
1660
28b75a89
AG		 1661static void le_scan_work(struct work_struct *work)
1662{
1663 struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
1664 struct le_scan_params *param = &hdev->le_scan_params;
1665
1666 BT_DBG("%s", hdev->name);
1667
04124681
GP		 1668 hci_do_le_scan(hdev, param->type, param->interval, param->window,
1669 param->timeout);
28b75a89
AG		 1670}
1671
1672int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
04124681 1673 int timeout)
28b75a89
AG		 1674{
1675 struct le_scan_params *param = &hdev->le_scan_params;
1676
1677 BT_DBG("%s", hdev->name);
1678
f1550478
JH		 1679 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
1680 return -ENOTSUPP;
1681
28b75a89
AG		 1682 if (work_busy(&hdev->le_scan))
1683 return -EINPROGRESS;
1684
1685 param->type = type;
1686 param->interval = interval;
1687 param->window = window;
1688 param->timeout = timeout;
1689
1690 queue_work(system_long_wq, &hdev->le_scan);
1691
1692 return 0;
1693}
1694
9be0dab7
DH		 1695/* Alloc HCI device */
1696struct hci_dev *hci_alloc_dev(void)
1697{
1698 struct hci_dev *hdev;
1699
1700 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1701 if (!hdev)
1702 return NULL;
1703
b1b813d4
DH		 1704 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1705 hdev->esco_type = (ESCO_HV1);
1706 hdev->link_mode = (HCI_LM_ACCEPT);
1707 hdev->io_capability = 0x03; /* No Input No Output */
bbaf444a
JH		 1708 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
1709 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
b1b813d4 1710
b1b813d4
DH		 1711 hdev->sniff_max_interval = 800;
1712 hdev->sniff_min_interval = 80;
1713
1714 mutex_init(&hdev->lock);
1715 mutex_init(&hdev->req_lock);
1716
1717 INIT_LIST_HEAD(&hdev->mgmt_pending);
1718 INIT_LIST_HEAD(&hdev->blacklist);
1719 INIT_LIST_HEAD(&hdev->uuids);
1720 INIT_LIST_HEAD(&hdev->link_keys);
1721 INIT_LIST_HEAD(&hdev->long_term_keys);
1722 INIT_LIST_HEAD(&hdev->remote_oob_data);
6b536b5e 1723 INIT_LIST_HEAD(&hdev->conn_hash.list);
b1b813d4
DH		 1724
1725 INIT_WORK(&hdev->rx_work, hci_rx_work);
1726 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
1727 INIT_WORK(&hdev->tx_work, hci_tx_work);
1728 INIT_WORK(&hdev->power_on, hci_power_on);
1729 INIT_WORK(&hdev->le_scan, le_scan_work);
1730
b1b813d4
DH		 1731 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
1732 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1733 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
1734
9be0dab7 1735 skb_queue_head_init(&hdev->driver_init);
b1b813d4
DH		 1736 skb_queue_head_init(&hdev->rx_q);
1737 skb_queue_head_init(&hdev->cmd_q);
1738 skb_queue_head_init(&hdev->raw_q);
1739
1740 init_waitqueue_head(&hdev->req_wait_q);
1741
bda4f23a 1742 setup_timer(&hdev->cmd_timer, hci_cmd_timeout, (unsigned long) hdev);
b1b813d4 1743
b1b813d4
DH		 1744 hci_init_sysfs(hdev);
1745 discovery_init(hdev);
9be0dab7
DH		 1746
1747 return hdev;
1748}
1749EXPORT_SYMBOL(hci_alloc_dev);
1750
1751/* Free HCI device */
1752void hci_free_dev(struct hci_dev *hdev)
1753{
1754 skb_queue_purge(&hdev->driver_init);
1755
1756 /* will free via device release */
1757 put_device(&hdev->dev);
1758}
1759EXPORT_SYMBOL(hci_free_dev);
1760
1da177e4
LT		 1761/* Register HCI device */
1762int hci_register_dev(struct hci_dev *hdev)
1763{
b1b813d4 1764 int id, error;
1da177e4 1765
010666a1 1766 if (!hdev->open || !hdev->close)
1da177e4
LT		 1767 return -EINVAL;
1768
08add513
MM		 1769 /* Do not allow HCI_AMP devices to register at index 0,
1770 * so the index can be used as the AMP controller ID.
1771 */
3df92b31
SL		 1772 switch (hdev->dev_type) {
1773 case HCI_BREDR:
1774 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
1775 break;
1776 case HCI_AMP:
1777 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
1778 break;
1779 default:
1780 return -EINVAL;
1da177e4 1781 }
8e87d142 1782
3df92b31
SL		 1783 if (id < 0)
1784 return id;
1785
1da177e4
LT		 1786 sprintf(hdev->name, "hci%d", id);
1787 hdev->id = id;
2d8b3a11
AE		 1788
1789 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1790
3df92b31
SL		 1791 write_lock(&hci_dev_list_lock);
1792 list_add(&hdev->list, &hci_dev_list);
f20d09d5 1793 write_unlock(&hci_dev_list_lock);
1da177e4 1794
32845eb1 1795 hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
a8c5fb1a 1796 WQ_MEM_RECLAIM, 1);
33ca954d
DH		 1797 if (!hdev->workqueue) {
1798 error = -ENOMEM;
1799 goto err;
1800 }
f48fd9c8 1801
6ead1bbc
JH		 1802 hdev->req_workqueue = alloc_workqueue(hdev->name,
1803 WQ_HIGHPRI | WQ_UNBOUND |
1804 WQ_MEM_RECLAIM, 1);
1805 if (!hdev->req_workqueue) {
1806 destroy_workqueue(hdev->workqueue);
1807 error = -ENOMEM;
1808 goto err;
1809 }
1810
33ca954d
DH		 1811 error = hci_add_sysfs(hdev);
1812 if (error < 0)
1813 goto err_wqueue;
1da177e4 1814
611b30f7 1815 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 1816 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
1817 hdev);
611b30f7
MH		 1818 if (hdev->rfkill) {
1819 if (rfkill_register(hdev->rfkill) < 0) {
1820 rfkill_destroy(hdev->rfkill);
1821 hdev->rfkill = NULL;
1822 }
1823 }
1824
a8b2d5c2 1825 set_bit(HCI_SETUP, &hdev->dev_flags);
ce2be9ac
AE		 1826
1827 if (hdev->dev_type != HCI_AMP)
1828 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
1829
1da177e4 1830 hci_notify(hdev, HCI_DEV_REG);
dc946bd8 1831 hci_dev_hold(hdev);
1da177e4 1832
fbe96d6f
MH		 1833 schedule_work(&hdev->power_on);
1834
1da177e4 1835 return id;
f48fd9c8 1836
33ca954d
DH		 1837err_wqueue:
1838 destroy_workqueue(hdev->workqueue);
6ead1bbc 1839 destroy_workqueue(hdev->req_workqueue);
33ca954d 1840err:
3df92b31 1841 ida_simple_remove(&hci_index_ida, hdev->id);
f20d09d5 1842 write_lock(&hci_dev_list_lock);
f48fd9c8 1843 list_del(&hdev->list);
f20d09d5 1844 write_unlock(&hci_dev_list_lock);
f48fd9c8 1845
33ca954d 1846 return error;
1da177e4
LT		 1847}
1848EXPORT_SYMBOL(hci_register_dev);
1849
1850/* Unregister HCI device */
59735631 1851void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 1852{
3df92b31 1853 int i, id;
ef222013 1854
c13854ce 1855 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1856
94324962
JH		 1857 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
1858
3df92b31
SL		 1859 id = hdev->id;
1860
f20d09d5 1861 write_lock(&hci_dev_list_lock);
1da177e4 1862 list_del(&hdev->list);
f20d09d5 1863 write_unlock(&hci_dev_list_lock);
1da177e4
LT		 1864
1865 hci_dev_do_close(hdev);
1866
cd4c5391 1867 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1868 kfree_skb(hdev->reassembly[i]);
1869
b9b5ef18
GP		 1870 cancel_work_sync(&hdev->power_on);
1871
ab81cbf9 1872 if (!test_bit(HCI_INIT, &hdev->flags) &&
a8c5fb1a 1873 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
09fd0de5 1874 hci_dev_lock(hdev);
744cf19e 1875 mgmt_index_removed(hdev);
09fd0de5 1876 hci_dev_unlock(hdev);
56e5cb86 1877 }
ab81cbf9 1878
2e58ef3e
JH		 1879 /* mgmt_index_removed should take care of emptying the
1880 * pending list */
1881 BUG_ON(!list_empty(&hdev->mgmt_pending));
1882
1da177e4
LT		 1883 hci_notify(hdev, HCI_DEV_UNREG);
1884
611b30f7
MH		 1885 if (hdev->rfkill) {
1886 rfkill_unregister(hdev->rfkill);
1887 rfkill_destroy(hdev->rfkill);
1888 }
1889
ce242970 1890 hci_del_sysfs(hdev);
147e2d59 1891
f48fd9c8 1892 destroy_workqueue(hdev->workqueue);
6ead1bbc 1893 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 1894
09fd0de5 1895 hci_dev_lock(hdev);
e2e0cacb 1896 hci_blacklist_clear(hdev);
2aeb9a1a 1897 hci_uuids_clear(hdev);
55ed8ca1 1898 hci_link_keys_clear(hdev);
b899efaf 1899 hci_smp_ltks_clear(hdev);
2763eda6 1900 hci_remote_oob_data_clear(hdev);
09fd0de5 1901 hci_dev_unlock(hdev);
e2e0cacb 1902
dc946bd8 1903 hci_dev_put(hdev);
3df92b31
SL		 1904
1905 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 1906}
1907EXPORT_SYMBOL(hci_unregister_dev);
1908
1909/* Suspend HCI device */
1910int hci_suspend_dev(struct hci_dev *hdev)
1911{
1912 hci_notify(hdev, HCI_DEV_SUSPEND);
1913 return 0;
1914}
1915EXPORT_SYMBOL(hci_suspend_dev);
1916
1917/* Resume HCI device */
1918int hci_resume_dev(struct hci_dev *hdev)
1919{
1920 hci_notify(hdev, HCI_DEV_RESUME);
1921 return 0;
1922}
1923EXPORT_SYMBOL(hci_resume_dev);
1924
76bca880
MH		 1925/* Receive frame from HCI drivers */
1926int hci_recv_frame(struct sk_buff *skb)
1927{
1928 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1929 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 1930 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 1931 kfree_skb(skb);
1932 return -ENXIO;
1933 }
1934
1935 /* Incomming skb */
1936 bt_cb(skb)->incoming = 1;
1937
1938 /* Time stamp */
1939 __net_timestamp(skb);
1940
76bca880 1941 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 1942 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 1943
76bca880
MH		 1944 return 0;
1945}
1946EXPORT_SYMBOL(hci_recv_frame);
1947
33e882a5 1948static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
a8c5fb1a 1949 int count, __u8 index)
33e882a5
SS		 1950{
1951 int len = 0;
1952 int hlen = 0;
1953 int remain = count;
1954 struct sk_buff *skb;
1955 struct bt_skb_cb *scb;
1956
1957 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
a8c5fb1a 1958 index >= NUM_REASSEMBLY)
33e882a5
SS		 1959 return -EILSEQ;
1960
1961 skb = hdev->reassembly[index];
1962
1963 if (!skb) {
1964 switch (type) {
1965 case HCI_ACLDATA_PKT:
1966 len = HCI_MAX_FRAME_SIZE;
1967 hlen = HCI_ACL_HDR_SIZE;
1968 break;
1969 case HCI_EVENT_PKT:
1970 len = HCI_MAX_EVENT_SIZE;
1971 hlen = HCI_EVENT_HDR_SIZE;
1972 break;
1973 case HCI_SCODATA_PKT:
1974 len = HCI_MAX_SCO_SIZE;
1975 hlen = HCI_SCO_HDR_SIZE;
1976 break;
1977 }
1978
1e429f38 1979 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 1980 if (!skb)
1981 return -ENOMEM;
1982
1983 scb = (void *) skb->cb;
1984 scb->expect = hlen;
1985 scb->pkt_type = type;
1986
1987 skb->dev = (void *) hdev;
1988 hdev->reassembly[index] = skb;
1989 }
1990
1991 while (count) {
1992 scb = (void *) skb->cb;
89bb46d0 1993 len = min_t(uint, scb->expect, count);
33e882a5
SS		 1994
1995 memcpy(skb_put(skb, len), data, len);
1996
1997 count -= len;
1998 data += len;
1999 scb->expect -= len;
2000 remain = count;
2001
2002 switch (type) {
2003 case HCI_EVENT_PKT:
2004 if (skb->len == HCI_EVENT_HDR_SIZE) {
2005 struct hci_event_hdr *h = hci_event_hdr(skb);
2006 scb->expect = h->plen;
2007
2008 if (skb_tailroom(skb) < scb->expect) {
2009 kfree_skb(skb);
2010 hdev->reassembly[index] = NULL;
2011 return -ENOMEM;
2012 }
2013 }
2014 break;
2015
2016 case HCI_ACLDATA_PKT:
2017 if (skb->len == HCI_ACL_HDR_SIZE) {
2018 struct hci_acl_hdr *h = hci_acl_hdr(skb);
2019 scb->expect = __le16_to_cpu(h->dlen);
2020
2021 if (skb_tailroom(skb) < scb->expect) {
2022 kfree_skb(skb);
2023 hdev->reassembly[index] = NULL;
2024 return -ENOMEM;
2025 }
2026 }
2027 break;
2028
2029 case HCI_SCODATA_PKT:
2030 if (skb->len == HCI_SCO_HDR_SIZE) {
2031 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2032 scb->expect = h->dlen;
2033
2034 if (skb_tailroom(skb) < scb->expect) {
2035 kfree_skb(skb);
2036 hdev->reassembly[index] = NULL;
2037 return -ENOMEM;
2038 }
2039 }
2040 break;
2041 }
2042
2043 if (scb->expect == 0) {
2044 /* Complete frame */
2045
2046 bt_cb(skb)->pkt_type = type;
2047 hci_recv_frame(skb);
2048
2049 hdev->reassembly[index] = NULL;
2050 return remain;
2051 }
2052 }
2053
2054 return remain;
2055}
2056
ef222013
MH		 2057int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2058{
f39a3c06
SS		 2059 int rem = 0;
2060
ef222013
MH		 2061 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2062 return -EILSEQ;
2063
da5f6c37 2064 while (count) {
1e429f38 2065 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 2066 if (rem < 0)
2067 return rem;
ef222013 2068
f39a3c06
SS		 2069 data += (count - rem);
2070 count = rem;
f81c6224 2071 }
ef222013 2072
f39a3c06 2073 return rem;
ef222013
MH		 2074}
2075EXPORT_SYMBOL(hci_recv_fragment);
2076
99811510
SS		 2077#define STREAM_REASSEMBLY 0
2078
2079int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2080{
2081 int type;
2082 int rem = 0;
2083
da5f6c37 2084 while (count) {
99811510
SS		 2085 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2086
2087 if (!skb) {
2088 struct { char type; } *pkt;
2089
2090 /* Start of the frame */
2091 pkt = data;
2092 type = pkt->type;
2093
2094 data++;
2095 count--;
2096 } else
2097 type = bt_cb(skb)->pkt_type;
2098
1e429f38 2099 rem = hci_reassembly(hdev, type, data, count,
a8c5fb1a 2100 STREAM_REASSEMBLY);
99811510
SS		 2101 if (rem < 0)
2102 return rem;
2103
2104 data += (count - rem);
2105 count = rem;
f81c6224 2106 }
99811510
SS		 2107
2108 return rem;
2109}
2110EXPORT_SYMBOL(hci_recv_stream_fragment);
2111
1da177e4
LT		 2112/* ---- Interface to upper protocols ---- */
2113
1da177e4
LT		 2114int hci_register_cb(struct hci_cb *cb)
2115{
2116 BT_DBG("%p name %s", cb, cb->name);
2117
f20d09d5 2118 write_lock(&hci_cb_list_lock);
1da177e4 2119 list_add(&cb->list, &hci_cb_list);
f20d09d5 2120 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2121
2122 return 0;
2123}
2124EXPORT_SYMBOL(hci_register_cb);
2125
2126int hci_unregister_cb(struct hci_cb *cb)
2127{
2128 BT_DBG("%p name %s", cb, cb->name);
2129
f20d09d5 2130 write_lock(&hci_cb_list_lock);
1da177e4 2131 list_del(&cb->list);
f20d09d5 2132 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2133
2134 return 0;
2135}
2136EXPORT_SYMBOL(hci_unregister_cb);
2137
2138static int hci_send_frame(struct sk_buff *skb)
2139{
2140 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2141
2142 if (!hdev) {
2143 kfree_skb(skb);
2144 return -ENODEV;
2145 }
2146
0d48d939 2147 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4 2148
cd82e61c
MH		 2149 /* Time stamp */
2150 __net_timestamp(skb);
1da177e4 2151
cd82e61c
MH		 2152 /* Send copy to monitor */
2153 hci_send_to_monitor(hdev, skb);
2154
2155 if (atomic_read(&hdev->promisc)) {
2156 /* Send copy to the sockets */
470fe1b5 2157 hci_send_to_sock(hdev, skb);
1da177e4
LT		 2158 }
2159
2160 /* Get rid of skb owner, prior to sending to the driver. */
2161 skb_orphan(skb);
2162
2163 return hdev->send(skb);
2164}
2165
2166/* Send HCI command */
a9de9248 2167int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 2168{
2169 int len = HCI_COMMAND_HDR_SIZE + plen;
2170 struct hci_command_hdr *hdr;
2171 struct sk_buff *skb;
2172
f0e09510 2173 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 2174
2175 skb = bt_skb_alloc(len, GFP_ATOMIC);
2176 if (!skb) {
ef222013 2177 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 2178 return -ENOMEM;
2179 }
2180
2181 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 2182 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 2183 hdr->plen = plen;
2184
2185 if (plen)
2186 memcpy(skb_put(skb, plen), param, plen);
2187
2188 BT_DBG("skb len %d", skb->len);
2189
0d48d939 2190 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 2191 skb->dev = (void *) hdev;
c78ae283 2192
a5040efa
JH		 2193 if (test_bit(HCI_INIT, &hdev->flags))
2194 hdev->init_last_cmd = opcode;
2195
1da177e4 2196 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 2197 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 2198
2199 return 0;
2200}
1da177e4
LT		 2201
2202/* Get data from the previously sent command */
a9de9248 2203void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 2204{
2205 struct hci_command_hdr *hdr;
2206
2207 if (!hdev->sent_cmd)
2208 return NULL;
2209
2210 hdr = (void *) hdev->sent_cmd->data;
2211
a9de9248 2212 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 2213 return NULL;
2214
f0e09510 2215 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 2216
2217 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2218}
2219
2220/* Send ACL data */
2221static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2222{
2223 struct hci_acl_hdr *hdr;
2224 int len = skb->len;
2225
badff6d0
ACM		 2226 skb_push(skb, HCI_ACL_HDR_SIZE);
2227 skb_reset_transport_header(skb);
9c70220b 2228 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 2229 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2230 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 2231}
2232
ee22be7e 2233static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 2234 struct sk_buff *skb, __u16 flags)
1da177e4 2235{
ee22be7e 2236 struct hci_conn *conn = chan->conn;
1da177e4
LT		 2237 struct hci_dev *hdev = conn->hdev;
2238 struct sk_buff *list;
2239
087bfd99
GP		 2240 skb->len = skb_headlen(skb);
2241 skb->data_len = 0;
2242
2243 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
204a6e54
AE		 2244
2245 switch (hdev->dev_type) {
2246 case HCI_BREDR:
2247 hci_add_acl_hdr(skb, conn->handle, flags);
2248 break;
2249 case HCI_AMP:
2250 hci_add_acl_hdr(skb, chan->handle, flags);
2251 break;
2252 default:
2253 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2254 return;
2255 }
087bfd99 2256
70f23020
AE		 2257 list = skb_shinfo(skb)->frag_list;
2258 if (!list) {
1da177e4
LT		 2259 /* Non fragmented */
2260 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2261
73d80deb 2262 skb_queue_tail(queue, skb);
1da177e4
LT		 2263 } else {
2264 /* Fragmented */
2265 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2266
2267 skb_shinfo(skb)->frag_list = NULL;
2268
2269 /* Queue all fragments atomically */
af3e6359 2270 spin_lock(&queue->lock);
1da177e4 2271
73d80deb 2272 __skb_queue_tail(queue, skb);
e702112f
AE		 2273
2274 flags &= ~ACL_START;
2275 flags |= ACL_CONT;
1da177e4
LT		 2276 do {
2277 skb = list; list = list->next;
8e87d142 2278
1da177e4 2279 skb->dev = (void *) hdev;
0d48d939 2280 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 2281 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 2282
2283 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2284
73d80deb 2285 __skb_queue_tail(queue, skb);
1da177e4
LT		 2286 } while (list);
2287
af3e6359 2288 spin_unlock(&queue->lock);
1da177e4 2289 }
73d80deb
LAD		 2290}
2291
2292void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2293{
ee22be7e 2294 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 2295
f0e09510 2296 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb
LAD		 2297
2298 skb->dev = (void *) hdev;
73d80deb 2299
ee22be7e 2300 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 2301
3eff45ea 2302 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 2303}
1da177e4
LT		 2304
2305/* Send SCO data */
0d861d8b 2306void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 2307{
2308 struct hci_dev *hdev = conn->hdev;
2309 struct hci_sco_hdr hdr;
2310
2311 BT_DBG("%s len %d", hdev->name, skb->len);
2312
aca3192c 2313 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 2314 hdr.dlen = skb->len;
2315
badff6d0
ACM		 2316 skb_push(skb, HCI_SCO_HDR_SIZE);
2317 skb_reset_transport_header(skb);
9c70220b 2318 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 2319
2320 skb->dev = (void *) hdev;
0d48d939 2321 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 2322
1da177e4 2323 skb_queue_tail(&conn->data_q, skb);
3eff45ea 2324 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 2325}
1da177e4
LT		 2326
2327/* ---- HCI TX task (outgoing data) ---- */
2328
2329/* HCI Connection scheduler */
6039aa73
GP		 2330static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
2331 int *quote)
1da177e4
LT		 2332{
2333 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2334 struct hci_conn *conn = NULL, *c;
abc5de8f 2335 unsigned int num = 0, min = ~0;
1da177e4 2336
8e87d142 2337 /* We don't have to lock device here. Connections are always
1da177e4 2338 * added and removed with TX task disabled. */
bf4c6325
GP		 2339
2340 rcu_read_lock();
2341
2342 list_for_each_entry_rcu(c, &h->list, list) {
769be974 2343 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2344 continue;
769be974
MH		 2345
2346 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2347 continue;
2348
1da177e4
LT		 2349 num++;
2350
2351 if (c->sent < min) {
2352 min = c->sent;
2353 conn = c;
2354 }
52087a79
LAD		 2355
2356 if (hci_conn_num(hdev, type) == num)
2357 break;
1da177e4
LT		 2358 }
2359
bf4c6325
GP		 2360 rcu_read_unlock();
2361
1da177e4 2362 if (conn) {
6ed58ec5
VT		 2363 int cnt, q;
2364
2365 switch (conn->type) {
2366 case ACL_LINK:
2367 cnt = hdev->acl_cnt;
2368 break;
2369 case SCO_LINK:
2370 case ESCO_LINK:
2371 cnt = hdev->sco_cnt;
2372 break;
2373 case LE_LINK:
2374 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2375 break;
2376 default:
2377 cnt = 0;
2378 BT_ERR("Unknown link type");
2379 }
2380
2381 q = cnt / num;
1da177e4
LT		 2382 *quote = q ? q : 1;
2383 } else
2384 *quote = 0;
2385
2386 BT_DBG("conn %p quote %d", conn, *quote);
2387 return conn;
2388}
2389
6039aa73 2390static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2391{
2392 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2393 struct hci_conn *c;
1da177e4 2394
bae1f5d9 2395 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 2396
bf4c6325
GP		 2397 rcu_read_lock();
2398
1da177e4 2399 /* Kill stalled connections */
bf4c6325 2400 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 2401 if (c->type == type && c->sent) {
6ed93dc6
AE		 2402 BT_ERR("%s killing stalled connection %pMR",
2403 hdev->name, &c->dst);
7490c6c2 2404 hci_acl_disconn(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 2405 }
2406 }
bf4c6325
GP		 2407
2408 rcu_read_unlock();
1da177e4
LT		 2409}
2410
6039aa73
GP		 2411static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2412 int *quote)
1da177e4 2413{
73d80deb
LAD		 2414 struct hci_conn_hash *h = &hdev->conn_hash;
2415 struct hci_chan *chan = NULL;
abc5de8f 2416 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 2417 struct hci_conn *conn;
73d80deb
LAD		 2418 int cnt, q, conn_num = 0;
2419
2420 BT_DBG("%s", hdev->name);
2421
bf4c6325
GP		 2422 rcu_read_lock();
2423
2424 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 2425 struct hci_chan *tmp;
2426
2427 if (conn->type != type)
2428 continue;
2429
2430 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2431 continue;
2432
2433 conn_num++;
2434
8192edef 2435 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 2436 struct sk_buff *skb;
2437
2438 if (skb_queue_empty(&tmp->data_q))
2439 continue;
2440
2441 skb = skb_peek(&tmp->data_q);
2442 if (skb->priority < cur_prio)
2443 continue;
2444
2445 if (skb->priority > cur_prio) {
2446 num = 0;
2447 min = ~0;
2448 cur_prio = skb->priority;
2449 }
2450
2451 num++;
2452
2453 if (conn->sent < min) {
2454 min = conn->sent;
2455 chan = tmp;
2456 }
2457 }
2458
2459 if (hci_conn_num(hdev, type) == conn_num)
2460 break;
2461 }
2462
bf4c6325
GP		 2463 rcu_read_unlock();
2464
73d80deb
LAD		 2465 if (!chan)
2466 return NULL;
2467
2468 switch (chan->conn->type) {
2469 case ACL_LINK:
2470 cnt = hdev->acl_cnt;
2471 break;
bd1eb66b
AE		 2472 case AMP_LINK:
2473 cnt = hdev->block_cnt;
2474 break;
73d80deb
LAD		 2475 case SCO_LINK:
2476 case ESCO_LINK:
2477 cnt = hdev->sco_cnt;
2478 break;
2479 case LE_LINK:
2480 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2481 break;
2482 default:
2483 cnt = 0;
2484 BT_ERR("Unknown link type");
2485 }
2486
2487 q = cnt / num;
2488 *quote = q ? q : 1;
2489 BT_DBG("chan %p quote %d", chan, *quote);
2490 return chan;
2491}
2492
02b20f0b
LAD		 2493static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2494{
2495 struct hci_conn_hash *h = &hdev->conn_hash;
2496 struct hci_conn *conn;
2497 int num = 0;
2498
2499 BT_DBG("%s", hdev->name);
2500
bf4c6325
GP		 2501 rcu_read_lock();
2502
2503 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 2504 struct hci_chan *chan;
2505
2506 if (conn->type != type)
2507 continue;
2508
2509 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2510 continue;
2511
2512 num++;
2513
8192edef 2514 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 2515 struct sk_buff *skb;
2516
2517 if (chan->sent) {
2518 chan->sent = 0;
2519 continue;
2520 }
2521
2522 if (skb_queue_empty(&chan->data_q))
2523 continue;
2524
2525 skb = skb_peek(&chan->data_q);
2526 if (skb->priority >= HCI_PRIO_MAX - 1)
2527 continue;
2528
2529 skb->priority = HCI_PRIO_MAX - 1;
2530
2531 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 2532 skb->priority);
02b20f0b
LAD		 2533 }
2534
2535 if (hci_conn_num(hdev, type) == num)
2536 break;
2537 }
bf4c6325
GP		 2538
2539 rcu_read_unlock();
2540
02b20f0b
LAD		 2541}
2542
b71d385a
AE		 2543static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
2544{
2545 /* Calculate count of blocks used by this packet */
2546 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
2547}
2548
6039aa73 2549static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 2550{
1da177e4
LT		 2551 if (!test_bit(HCI_RAW, &hdev->flags)) {
2552 /* ACL tx timeout must be longer than maximum
2553 * link supervision timeout (40.9 seconds) */
63d2bc1b 2554 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 2555 HCI_ACL_TX_TIMEOUT))
bae1f5d9 2556 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 2557 }
63d2bc1b 2558}
1da177e4 2559
6039aa73 2560static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 2561{
2562 unsigned int cnt = hdev->acl_cnt;
2563 struct hci_chan *chan;
2564 struct sk_buff *skb;
2565 int quote;
2566
2567 __check_timeout(hdev, cnt);
04837f64 2568
73d80deb 2569 while (hdev->acl_cnt &&
a8c5fb1a 2570 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 2571 u32 priority = (skb_peek(&chan->data_q))->priority;
2572 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 2573 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 2574 skb->len, skb->priority);
73d80deb 2575
ec1cce24
LAD		 2576 /* Stop if priority has changed */
2577 if (skb->priority < priority)
2578 break;
2579
2580 skb = skb_dequeue(&chan->data_q);
2581
73d80deb 2582 hci_conn_enter_active_mode(chan->conn,
04124681 2583 bt_cb(skb)->force_active);
04837f64 2584
1da177e4
LT		 2585 hci_send_frame(skb);
2586 hdev->acl_last_tx = jiffies;
2587
2588 hdev->acl_cnt--;
73d80deb
LAD		 2589 chan->sent++;
2590 chan->conn->sent++;
1da177e4
LT		 2591 }
2592 }
02b20f0b
LAD		 2593
2594 if (cnt != hdev->acl_cnt)
2595 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 2596}
2597
6039aa73 2598static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 2599{
63d2bc1b 2600 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 2601 struct hci_chan *chan;
2602 struct sk_buff *skb;
2603 int quote;
bd1eb66b 2604 u8 type;
b71d385a 2605
63d2bc1b 2606 __check_timeout(hdev, cnt);
b71d385a 2607
bd1eb66b
AE		 2608 BT_DBG("%s", hdev->name);
2609
2610 if (hdev->dev_type == HCI_AMP)
2611 type = AMP_LINK;
2612 else
2613 type = ACL_LINK;
2614
b71d385a 2615 while (hdev->block_cnt > 0 &&
bd1eb66b 2616 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 2617 u32 priority = (skb_peek(&chan->data_q))->priority;
2618 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
2619 int blocks;
2620
2621 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 2622 skb->len, skb->priority);
b71d385a
AE		 2623
2624 /* Stop if priority has changed */
2625 if (skb->priority < priority)
2626 break;
2627
2628 skb = skb_dequeue(&chan->data_q);
2629
2630 blocks = __get_blocks(hdev, skb);
2631 if (blocks > hdev->block_cnt)
2632 return;
2633
2634 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 2635 bt_cb(skb)->force_active);
b71d385a
AE		 2636
2637 hci_send_frame(skb);
2638 hdev->acl_last_tx = jiffies;
2639
2640 hdev->block_cnt -= blocks;
2641 quote -= blocks;
2642
2643 chan->sent += blocks;
2644 chan->conn->sent += blocks;
2645 }
2646 }
2647
2648 if (cnt != hdev->block_cnt)
bd1eb66b 2649 hci_prio_recalculate(hdev, type);
b71d385a
AE		 2650}
2651
6039aa73 2652static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 2653{
2654 BT_DBG("%s", hdev->name);
2655
bd1eb66b
AE		 2656 /* No ACL link over BR/EDR controller */
2657 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
2658 return;
2659
2660 /* No AMP link over AMP controller */
2661 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 2662 return;
2663
2664 switch (hdev->flow_ctl_mode) {
2665 case HCI_FLOW_CTL_MODE_PACKET_BASED:
2666 hci_sched_acl_pkt(hdev);
2667 break;
2668
2669 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
2670 hci_sched_acl_blk(hdev);
2671 break;
2672 }
2673}
2674
1da177e4 2675/* Schedule SCO */
6039aa73 2676static void hci_sched_sco(struct hci_dev *hdev)
1da177e4
LT		 2677{
2678 struct hci_conn *conn;
2679 struct sk_buff *skb;
2680 int quote;
2681
2682 BT_DBG("%s", hdev->name);
2683
52087a79
LAD		 2684 if (!hci_conn_num(hdev, SCO_LINK))
2685 return;
2686
1da177e4
LT		 2687 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2688 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2689 BT_DBG("skb %p len %d", skb, skb->len);
2690 hci_send_frame(skb);
2691
2692 conn->sent++;
2693 if (conn->sent == ~0)
2694 conn->sent = 0;
2695 }
2696 }
2697}
2698
6039aa73 2699static void hci_sched_esco(struct hci_dev *hdev)
b6a0dc82
MH		 2700{
2701 struct hci_conn *conn;
2702 struct sk_buff *skb;
2703 int quote;
2704
2705 BT_DBG("%s", hdev->name);
2706
52087a79
LAD		 2707 if (!hci_conn_num(hdev, ESCO_LINK))
2708 return;
2709
8fc9ced3
GP		 2710 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
2711 &quote))) {
b6a0dc82
MH		 2712 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2713 BT_DBG("skb %p len %d", skb, skb->len);
2714 hci_send_frame(skb);
2715
2716 conn->sent++;
2717 if (conn->sent == ~0)
2718 conn->sent = 0;
2719 }
2720 }
2721}
2722
6039aa73 2723static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 2724{
73d80deb 2725 struct hci_chan *chan;
6ed58ec5 2726 struct sk_buff *skb;
02b20f0b 2727 int quote, cnt, tmp;
6ed58ec5
VT		 2728
2729 BT_DBG("%s", hdev->name);
2730
52087a79
LAD		 2731 if (!hci_conn_num(hdev, LE_LINK))
2732 return;
2733
6ed58ec5
VT		 2734 if (!test_bit(HCI_RAW, &hdev->flags)) {
2735 /* LE tx timeout must be longer than maximum
2736 * link supervision timeout (40.9 seconds) */
bae1f5d9 2737 if (!hdev->le_cnt && hdev->le_pkts &&
a8c5fb1a 2738 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 2739 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 2740 }
2741
2742 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 2743 tmp = cnt;
73d80deb 2744 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 2745 u32 priority = (skb_peek(&chan->data_q))->priority;
2746 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 2747 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 2748 skb->len, skb->priority);
6ed58ec5 2749
ec1cce24
LAD		 2750 /* Stop if priority has changed */
2751 if (skb->priority < priority)
2752 break;
2753
2754 skb = skb_dequeue(&chan->data_q);
2755
6ed58ec5
VT		 2756 hci_send_frame(skb);
2757 hdev->le_last_tx = jiffies;
2758
2759 cnt--;
73d80deb
LAD		 2760 chan->sent++;
2761 chan->conn->sent++;
6ed58ec5
VT		 2762 }
2763 }
73d80deb 2764
6ed58ec5
VT		 2765 if (hdev->le_pkts)
2766 hdev->le_cnt = cnt;
2767 else
2768 hdev->acl_cnt = cnt;
02b20f0b
LAD		 2769
2770 if (cnt != tmp)
2771 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 2772}
2773
3eff45ea 2774static void hci_tx_work(struct work_struct *work)
1da177e4 2775{
3eff45ea 2776 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 2777 struct sk_buff *skb;
2778
6ed58ec5 2779 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 2780 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 2781
2782 /* Schedule queues and send stuff to HCI driver */
2783
2784 hci_sched_acl(hdev);
2785
2786 hci_sched_sco(hdev);
2787
b6a0dc82
MH		 2788 hci_sched_esco(hdev);
2789
6ed58ec5
VT		 2790 hci_sched_le(hdev);
2791
1da177e4
LT		 2792 /* Send next queued raw (unknown type) packet */
2793 while ((skb = skb_dequeue(&hdev->raw_q)))
2794 hci_send_frame(skb);
1da177e4
LT		 2795}
2796
25985edc 2797/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 2798
2799/* ACL data packet */
6039aa73 2800static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 2801{
2802 struct hci_acl_hdr *hdr = (void *) skb->data;
2803 struct hci_conn *conn;
2804 __u16 handle, flags;
2805
2806 skb_pull(skb, HCI_ACL_HDR_SIZE);
2807
2808 handle = __le16_to_cpu(hdr->handle);
2809 flags = hci_flags(handle);
2810 handle = hci_handle(handle);
2811
f0e09510 2812 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 2813 handle, flags);
1da177e4
LT		 2814
2815 hdev->stat.acl_rx++;
2816
2817 hci_dev_lock(hdev);
2818 conn = hci_conn_hash_lookup_handle(hdev, handle);
2819 hci_dev_unlock(hdev);
8e87d142 2820
1da177e4 2821 if (conn) {
65983fc7 2822 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 2823
671267bf
JH		 2824 hci_dev_lock(hdev);
2825 if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
2826 !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2827 mgmt_device_connected(hdev, &conn->dst, conn->type,
2828 conn->dst_type, 0, NULL, 0,
2829 conn->dev_class);
2830 hci_dev_unlock(hdev);
2831
1da177e4 2832 /* Send to upper protocol */
686ebf28
UF		 2833 l2cap_recv_acldata(conn, skb, flags);
2834 return;
1da177e4 2835 } else {
8e87d142 2836 BT_ERR("%s ACL packet for unknown connection handle %d",
a8c5fb1a 2837 hdev->name, handle);
1da177e4
LT		 2838 }
2839
2840 kfree_skb(skb);
2841}
2842
2843/* SCO data packet */
6039aa73 2844static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 2845{
2846 struct hci_sco_hdr *hdr = (void *) skb->data;
2847 struct hci_conn *conn;
2848 __u16 handle;
2849
2850 skb_pull(skb, HCI_SCO_HDR_SIZE);
2851
2852 handle = __le16_to_cpu(hdr->handle);
2853
f0e09510 2854 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
1da177e4
LT		 2855
2856 hdev->stat.sco_rx++;
2857
2858 hci_dev_lock(hdev);
2859 conn = hci_conn_hash_lookup_handle(hdev, handle);
2860 hci_dev_unlock(hdev);
2861
2862 if (conn) {
1da177e4 2863 /* Send to upper protocol */
686ebf28
UF		 2864 sco_recv_scodata(conn, skb);
2865 return;
1da177e4 2866 } else {
8e87d142 2867 BT_ERR("%s SCO packet for unknown connection handle %d",
a8c5fb1a 2868 hdev->name, handle);
1da177e4
LT		 2869 }
2870
2871 kfree_skb(skb);
2872}
2873
b78752cc 2874static void hci_rx_work(struct work_struct *work)
1da177e4 2875{
b78752cc 2876 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 2877 struct sk_buff *skb;
2878
2879 BT_DBG("%s", hdev->name);
2880
1da177e4 2881 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 2882 /* Send copy to monitor */
2883 hci_send_to_monitor(hdev, skb);
2884
1da177e4
LT		 2885 if (atomic_read(&hdev->promisc)) {
2886 /* Send copy to the sockets */
470fe1b5 2887 hci_send_to_sock(hdev, skb);
1da177e4
LT		 2888 }
2889
2890 if (test_bit(HCI_RAW, &hdev->flags)) {
2891 kfree_skb(skb);
2892 continue;
2893 }
2894
2895 if (test_bit(HCI_INIT, &hdev->flags)) {
2896 /* Don't process data packets in this states. */
0d48d939 2897 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2898 case HCI_ACLDATA_PKT:
2899 case HCI_SCODATA_PKT:
2900 kfree_skb(skb);
2901 continue;
3ff50b79 2902 }
1da177e4
LT		 2903 }
2904
2905 /* Process frame */
0d48d939 2906 switch (bt_cb(skb)->pkt_type) {
1da177e4 2907 case HCI_EVENT_PKT:
b78752cc 2908 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 2909 hci_event_packet(hdev, skb);
2910 break;
2911
2912 case HCI_ACLDATA_PKT:
2913 BT_DBG("%s ACL data packet", hdev->name);
2914 hci_acldata_packet(hdev, skb);
2915 break;
2916
2917 case HCI_SCODATA_PKT:
2918 BT_DBG("%s SCO data packet", hdev->name);
2919 hci_scodata_packet(hdev, skb);
2920 break;
2921
2922 default:
2923 kfree_skb(skb);
2924 break;
2925 }
2926 }
1da177e4
LT		 2927}
2928
c347b765 2929static void hci_cmd_work(struct work_struct *work)
1da177e4 2930{
c347b765 2931 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 2932 struct sk_buff *skb;
2933
2104786b
AE		 2934 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
2935 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 2936
1da177e4 2937 /* Send queued commands */
5a08ecce
AE		 2938 if (atomic_read(&hdev->cmd_cnt)) {
2939 skb = skb_dequeue(&hdev->cmd_q);
2940 if (!skb)
2941 return;
2942
7585b97a 2943 kfree_skb(hdev->sent_cmd);
1da177e4 2944
70f23020
AE		 2945 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2946 if (hdev->sent_cmd) {
1da177e4
LT		 2947 atomic_dec(&hdev->cmd_cnt);
2948 hci_send_frame(skb);
7bdb8a5c
SJ		 2949 if (test_bit(HCI_RESET, &hdev->flags))
2950 del_timer(&hdev->cmd_timer);
2951 else
2952 mod_timer(&hdev->cmd_timer,
5f246e89 2953 jiffies + HCI_CMD_TIMEOUT);
1da177e4
LT		 2954 } else {
2955 skb_queue_head(&hdev->cmd_q, skb);
c347b765 2956 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 2957 }
2958 }
2959}
2519a1fc
AG		 2960
2961int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2962{
2963 /* General inquiry access code (GIAC) */
2964 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2965 struct hci_cp_inquiry cp;
2966
2967 BT_DBG("%s", hdev->name);
2968
2969 if (test_bit(HCI_INQUIRY, &hdev->flags))
2970 return -EINPROGRESS;
2971
4663262c
JH		 2972 inquiry_cache_flush(hdev);
2973
2519a1fc
AG		 2974 memset(&cp, 0, sizeof(cp));
2975 memcpy(&cp.lap, lap, sizeof(cp.lap));
2976 cp.length = length;
2977
2978 return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2979}
023d5049
AG		 2980
2981int hci_cancel_inquiry(struct hci_dev *hdev)
2982{
2983 BT_DBG("%s", hdev->name);
2984
2985 if (!test_bit(HCI_INQUIRY, &hdev->flags))
7537e5c3 2986 return -EALREADY;
023d5049
AG		 2987
2988 return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2989}
31f7956c
AG		 2990
2991u8 bdaddr_to_le(u8 bdaddr_type)
2992{
2993 switch (bdaddr_type) {
2994 case BDADDR_LE_PUBLIC:
2995 return ADDR_LE_DEV_PUBLIC;
2996
2997 default:
2998 /* Fallback to LE Random address type */
2999 return ADDR_LE_DEV_RANDOM;
3000 }
3001}
kernel source for telekom puls (alcatel/mediatek)