projects / GitHub / mt8127 / android_kernel_alcatel_ttab.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: ERTM timeouts need to be converted to jiffies
[GitHub/mt8127/android_kernel_alcatel_ttab.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
f48fd9c8 40#include <linux/workqueue.h>
1da177e4
LT		 41#include <linux/interrupt.h>
42#include <linux/notifier.h>
611b30f7 43#include <linux/rfkill.h>
6bd32326 44#include <linux/timer.h>
3a0259bb 45#include <linux/crypto.h>
1da177e4
LT		 46#include <net/sock.h>
47
48#include <asm/system.h>
70f23020 49#include <linux/uaccess.h>
1da177e4
LT		 50#include <asm/unaligned.h>
51
52#include <net/bluetooth/bluetooth.h>
53#include <net/bluetooth/hci_core.h>
54
ab81cbf9
JH		 55#define AUTO_OFF_TIMEOUT 2000
56
1da177e4
LT		 57static void hci_cmd_task(unsigned long arg);
58static void hci_rx_task(unsigned long arg);
59static void hci_tx_task(unsigned long arg);
1da177e4
LT		 60
61static DEFINE_RWLOCK(hci_task_lock);
62
3a0259bb
VCG		 63static int enable_smp;
64
1da177e4
LT		 65/* HCI device list */
66LIST_HEAD(hci_dev_list);
67DEFINE_RWLOCK(hci_dev_list_lock);
68
69/* HCI callback list */
70LIST_HEAD(hci_cb_list);
71DEFINE_RWLOCK(hci_cb_list_lock);
72
73/* HCI protocols */
74#define HCI_MAX_PROTO 2
75struct hci_proto *hci_proto[HCI_MAX_PROTO];
76
77/* HCI notifiers list */
e041c683 78static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 79
80/* ---- HCI notifications ---- */
81
82int hci_register_notifier(struct notifier_block *nb)
83{
e041c683 84 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 85}
86
87int hci_unregister_notifier(struct notifier_block *nb)
88{
e041c683 89 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 90}
91
6516455d 92static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 93{
e041c683 94 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 95}
96
97/* ---- HCI requests ---- */
98
23bb5763 99void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 100{
23bb5763
JH		 101 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
102
a5040efa
JH		 103 /* If this is the init phase check if the completed command matches
104 * the last init command, and if not just return.
105 */
106 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
23bb5763 107 return;
1da177e4
LT		 108
109 if (hdev->req_status == HCI_REQ_PEND) {
110 hdev->req_result = result;
111 hdev->req_status = HCI_REQ_DONE;
112 wake_up_interruptible(&hdev->req_wait_q);
113 }
114}
115
116static void hci_req_cancel(struct hci_dev *hdev, int err)
117{
118 BT_DBG("%s err 0x%2.2x", hdev->name, err);
119
120 if (hdev->req_status == HCI_REQ_PEND) {
121 hdev->req_result = err;
122 hdev->req_status = HCI_REQ_CANCELED;
123 wake_up_interruptible(&hdev->req_wait_q);
124 }
125}
126
127/* Execute request and wait for completion. */
8e87d142 128static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 129 unsigned long opt, __u32 timeout)
1da177e4
LT		 130{
131 DECLARE_WAITQUEUE(wait, current);
132 int err = 0;
133
134 BT_DBG("%s start", hdev->name);
135
136 hdev->req_status = HCI_REQ_PEND;
137
138 add_wait_queue(&hdev->req_wait_q, &wait);
139 set_current_state(TASK_INTERRUPTIBLE);
140
141 req(hdev, opt);
142 schedule_timeout(timeout);
143
144 remove_wait_queue(&hdev->req_wait_q, &wait);
145
146 if (signal_pending(current))
147 return -EINTR;
148
149 switch (hdev->req_status) {
150 case HCI_REQ_DONE:
151 err = -bt_err(hdev->req_result);
152 break;
153
154 case HCI_REQ_CANCELED:
155 err = -hdev->req_result;
156 break;
157
158 default:
159 err = -ETIMEDOUT;
160 break;
3ff50b79 161 }
1da177e4 162
a5040efa 163 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 164
165 BT_DBG("%s end: err %d", hdev->name, err);
166
167 return err;
168}
169
170static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 171 unsigned long opt, __u32 timeout)
1da177e4
LT		 172{
173 int ret;
174
7c6a329e
MH		 175 if (!test_bit(HCI_UP, &hdev->flags))
176 return -ENETDOWN;
177
1da177e4
LT		 178 /* Serialize all requests */
179 hci_req_lock(hdev);
180 ret = __hci_request(hdev, req, opt, timeout);
181 hci_req_unlock(hdev);
182
183 return ret;
184}
185
186static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
187{
188 BT_DBG("%s %ld", hdev->name, opt);
189
190 /* Reset device */
f630cf0d 191 set_bit(HCI_RESET, &hdev->flags);
a9de9248 192 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 193}
194
195static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
196{
b0916ea0 197 struct hci_cp_delete_stored_link_key cp;
1da177e4 198 struct sk_buff *skb;
1ebb9252 199 __le16 param;
89f2783d 200 __u8 flt_type;
1da177e4
LT		 201
202 BT_DBG("%s %ld", hdev->name, opt);
203
204 /* Driver initialization */
205
206 /* Special commands */
207 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 208 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 209 skb->dev = (void *) hdev;
c78ae283 210
1da177e4 211 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 212 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 213 }
214 skb_queue_purge(&hdev->driver_init);
215
216 /* Mandatory initialization */
217
218 /* Reset */
f630cf0d
GP		 219 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
220 set_bit(HCI_RESET, &hdev->flags);
a9de9248 221 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
f630cf0d 222 }
1da177e4
LT		 223
224 /* Read Local Supported Features */
a9de9248 225 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 226
1143e5a6 227 /* Read Local Version */
a9de9248 228 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 229
1da177e4 230 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 231 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 232
233#if 0
234 /* Host buffer size */
235 {
236 struct hci_cp_host_buffer_size cp;
aca3192c 237 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 238 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 239 cp.acl_max_pkt = cpu_to_le16(0xffff);
240 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 241 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 242 }
243#endif
244
245 /* Read BD Address */
a9de9248
MH		 246 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
247
248 /* Read Class of Device */
249 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
250
251 /* Read Local Name */
252 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 253
254 /* Read Voice Setting */
a9de9248 255 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 256
257 /* Optional initialization */
258
259 /* Clear Event Filters */
89f2783d 260 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 261 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4 262
1da177e4 263 /* Connection accept timeout ~20 secs */
aca3192c 264 param = cpu_to_le16(0x7d00);
a9de9248 265 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
b0916ea0
JH		 266
267 bacpy(&cp.bdaddr, BDADDR_ANY);
268 cp.delete_all = 1;
269 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
1da177e4
LT		 270}
271
6ed58ec5
VT		 272static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
273{
274 BT_DBG("%s", hdev->name);
275
276 /* Read LE buffer size */
277 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
278}
279
1da177e4
LT		 280static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
281{
282 __u8 scan = opt;
283
284 BT_DBG("%s %x", hdev->name, scan);
285
286 /* Inquiry and Page scans */
a9de9248 287 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 288}
289
290static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
291{
292 __u8 auth = opt;
293
294 BT_DBG("%s %x", hdev->name, auth);
295
296 /* Authentication */
a9de9248 297 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 298}
299
300static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
301{
302 __u8 encrypt = opt;
303
304 BT_DBG("%s %x", hdev->name, encrypt);
305
e4e8e37c 306 /* Encryption */
a9de9248 307 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 308}
309
e4e8e37c
MH		 310static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
311{
312 __le16 policy = cpu_to_le16(opt);
313
a418b893 314 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 315
316 /* Default link policy */
317 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
318}
319
8e87d142 320/* Get HCI device by index.
1da177e4
LT		 321 * Device is held on return. */
322struct hci_dev *hci_dev_get(int index)
323{
324 struct hci_dev *hdev = NULL;
325 struct list_head *p;
326
327 BT_DBG("%d", index);
328
329 if (index < 0)
330 return NULL;
331
332 read_lock(&hci_dev_list_lock);
333 list_for_each(p, &hci_dev_list) {
334 struct hci_dev *d = list_entry(p, struct hci_dev, list);
335 if (d->id == index) {
336 hdev = hci_dev_hold(d);
337 break;
338 }
339 }
340 read_unlock(&hci_dev_list_lock);
341 return hdev;
342}
1da177e4
LT		 343
344/* ---- Inquiry support ---- */
345static void inquiry_cache_flush(struct hci_dev *hdev)
346{
347 struct inquiry_cache *cache = &hdev->inq_cache;
348 struct inquiry_entry *next = cache->list, *e;
349
350 BT_DBG("cache %p", cache);
351
352 cache->list = NULL;
353 while ((e = next)) {
354 next = e->next;
355 kfree(e);
356 }
357}
358
359struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
360{
361 struct inquiry_cache *cache = &hdev->inq_cache;
362 struct inquiry_entry *e;
363
364 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
365
366 for (e = cache->list; e; e = e->next)
367 if (!bacmp(&e->data.bdaddr, bdaddr))
368 break;
369 return e;
370}
371
372void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
373{
374 struct inquiry_cache *cache = &hdev->inq_cache;
70f23020 375 struct inquiry_entry *ie;
1da177e4
LT		 376
377 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
378
70f23020
AE		 379 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
380 if (!ie) {
1da177e4 381 /* Entry not in the cache. Add new one. */
70f23020
AE		 382 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
383 if (!ie)
1da177e4 384 return;
70f23020
AE		 385
386 ie->next = cache->list;
387 cache->list = ie;
1da177e4
LT		 388 }
389
70f23020
AE		 390 memcpy(&ie->data, data, sizeof(*data));
391 ie->timestamp = jiffies;
1da177e4
LT		 392 cache->timestamp = jiffies;
393}
394
395static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
396{
397 struct inquiry_cache *cache = &hdev->inq_cache;
398 struct inquiry_info *info = (struct inquiry_info *) buf;
399 struct inquiry_entry *e;
400 int copied = 0;
401
402 for (e = cache->list; e && copied < num; e = e->next, copied++) {
403 struct inquiry_data *data = &e->data;
404 bacpy(&info->bdaddr, &data->bdaddr);
405 info->pscan_rep_mode = data->pscan_rep_mode;
406 info->pscan_period_mode = data->pscan_period_mode;
407 info->pscan_mode = data->pscan_mode;
408 memcpy(info->dev_class, data->dev_class, 3);
409 info->clock_offset = data->clock_offset;
410 info++;
411 }
412
413 BT_DBG("cache %p, copied %d", cache, copied);
414 return copied;
415}
416
417static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
418{
419 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
420 struct hci_cp_inquiry cp;
421
422 BT_DBG("%s", hdev->name);
423
424 if (test_bit(HCI_INQUIRY, &hdev->flags))
425 return;
426
427 /* Start Inquiry */
428 memcpy(&cp.lap, &ir->lap, 3);
429 cp.length = ir->length;
430 cp.num_rsp = ir->num_rsp;
a9de9248 431 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 432}
433
434int hci_inquiry(void __user *arg)
435{
436 __u8 __user *ptr = arg;
437 struct hci_inquiry_req ir;
438 struct hci_dev *hdev;
439 int err = 0, do_inquiry = 0, max_rsp;
440 long timeo;
441 __u8 *buf;
442
443 if (copy_from_user(&ir, ptr, sizeof(ir)))
444 return -EFAULT;
445
5a08ecce
AE		 446 hdev = hci_dev_get(ir.dev_id);
447 if (!hdev)
1da177e4
LT		 448 return -ENODEV;
449
450 hci_dev_lock_bh(hdev);
8e87d142 451 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
70f23020
AE		 452 inquiry_cache_empty(hdev) ||
453 ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 454 inquiry_cache_flush(hdev);
455 do_inquiry = 1;
456 }
457 hci_dev_unlock_bh(hdev);
458
04837f64 459 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 460
461 if (do_inquiry) {
462 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
463 if (err < 0)
464 goto done;
465 }
1da177e4
LT		 466
467 /* for unlimited number of responses we will use buffer with 255 entries */
468 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
469
470 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
471 * copy it to the user space.
472 */
01df8c31 473 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 474 if (!buf) {
1da177e4
LT		 475 err = -ENOMEM;
476 goto done;
477 }
478
479 hci_dev_lock_bh(hdev);
480 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
481 hci_dev_unlock_bh(hdev);
482
483 BT_DBG("num_rsp %d", ir.num_rsp);
484
485 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
486 ptr += sizeof(ir);
487 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
488 ir.num_rsp))
489 err = -EFAULT;
8e87d142 490 } else
1da177e4
LT		 491 err = -EFAULT;
492
493 kfree(buf);
494
495done:
496 hci_dev_put(hdev);
497 return err;
498}
499
500/* ---- HCI ioctl helpers ---- */
501
502int hci_dev_open(__u16 dev)
503{
504 struct hci_dev *hdev;
505 int ret = 0;
506
5a08ecce
AE		 507 hdev = hci_dev_get(dev);
508 if (!hdev)
1da177e4
LT		 509 return -ENODEV;
510
511 BT_DBG("%s %p", hdev->name, hdev);
512
513 hci_req_lock(hdev);
514
611b30f7
MH		 515 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
516 ret = -ERFKILL;
517 goto done;
518 }
519
1da177e4
LT		 520 if (test_bit(HCI_UP, &hdev->flags)) {
521 ret = -EALREADY;
522 goto done;
523 }
524
525 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
526 set_bit(HCI_RAW, &hdev->flags);
527
943da25d
MH		 528 /* Treat all non BR/EDR controllers as raw devices for now */
529 if (hdev->dev_type != HCI_BREDR)
530 set_bit(HCI_RAW, &hdev->flags);
531
1da177e4
LT		 532 if (hdev->open(hdev)) {
533 ret = -EIO;
534 goto done;
535 }
536
537 if (!test_bit(HCI_RAW, &hdev->flags)) {
538 atomic_set(&hdev->cmd_cnt, 1);
539 set_bit(HCI_INIT, &hdev->flags);
a5040efa 540 hdev->init_last_cmd = 0;
1da177e4 541
04837f64
MH		 542 ret = __hci_request(hdev, hci_init_req, 0,
543 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4 544
6ed58ec5
VT		 545 if (lmp_le_capable(hdev))
546 ret = __hci_request(hdev, hci_le_init_req, 0,
547 msecs_to_jiffies(HCI_INIT_TIMEOUT));
548
1da177e4
LT		 549 clear_bit(HCI_INIT, &hdev->flags);
550 }
551
552 if (!ret) {
553 hci_dev_hold(hdev);
554 set_bit(HCI_UP, &hdev->flags);
555 hci_notify(hdev, HCI_DEV_UP);
5add6af8
JH		 556 if (!test_bit(HCI_SETUP, &hdev->flags))
557 mgmt_powered(hdev->id, 1);
8e87d142 558 } else {
1da177e4
LT		 559 /* Init failed, cleanup */
560 tasklet_kill(&hdev->rx_task);
561 tasklet_kill(&hdev->tx_task);
562 tasklet_kill(&hdev->cmd_task);
563
564 skb_queue_purge(&hdev->cmd_q);
565 skb_queue_purge(&hdev->rx_q);
566
567 if (hdev->flush)
568 hdev->flush(hdev);
569
570 if (hdev->sent_cmd) {
571 kfree_skb(hdev->sent_cmd);
572 hdev->sent_cmd = NULL;
573 }
574
575 hdev->close(hdev);
576 hdev->flags = 0;
577 }
578
579done:
580 hci_req_unlock(hdev);
581 hci_dev_put(hdev);
582 return ret;
583}
584
585static int hci_dev_do_close(struct hci_dev *hdev)
586{
587 BT_DBG("%s %p", hdev->name, hdev);
588
589 hci_req_cancel(hdev, ENODEV);
590 hci_req_lock(hdev);
591
592 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 593 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 594 hci_req_unlock(hdev);
595 return 0;
596 }
597
598 /* Kill RX and TX tasks */
599 tasklet_kill(&hdev->rx_task);
600 tasklet_kill(&hdev->tx_task);
601
602 hci_dev_lock_bh(hdev);
603 inquiry_cache_flush(hdev);
604 hci_conn_hash_flush(hdev);
605 hci_dev_unlock_bh(hdev);
606
607 hci_notify(hdev, HCI_DEV_DOWN);
608
609 if (hdev->flush)
610 hdev->flush(hdev);
611
612 /* Reset device */
613 skb_queue_purge(&hdev->cmd_q);
614 atomic_set(&hdev->cmd_cnt, 1);
615 if (!test_bit(HCI_RAW, &hdev->flags)) {
616 set_bit(HCI_INIT, &hdev->flags);
04837f64
MH		 617 __hci_request(hdev, hci_reset_req, 0,
618 msecs_to_jiffies(250));
1da177e4
LT		 619 clear_bit(HCI_INIT, &hdev->flags);
620 }
621
622 /* Kill cmd task */
623 tasklet_kill(&hdev->cmd_task);
624
625 /* Drop queues */
626 skb_queue_purge(&hdev->rx_q);
627 skb_queue_purge(&hdev->cmd_q);
628 skb_queue_purge(&hdev->raw_q);
629
630 /* Drop last sent command */
631 if (hdev->sent_cmd) {
b79f44c1 632 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 633 kfree_skb(hdev->sent_cmd);
634 hdev->sent_cmd = NULL;
635 }
636
637 /* After this point our queues are empty
638 * and no tasks are scheduled. */
639 hdev->close(hdev);
640
5add6af8
JH		 641 mgmt_powered(hdev->id, 0);
642
1da177e4
LT		 643 /* Clear flags */
644 hdev->flags = 0;
645
646 hci_req_unlock(hdev);
647
648 hci_dev_put(hdev);
649 return 0;
650}
651
652int hci_dev_close(__u16 dev)
653{
654 struct hci_dev *hdev;
655 int err;
656
70f23020
AE		 657 hdev = hci_dev_get(dev);
658 if (!hdev)
1da177e4
LT		 659 return -ENODEV;
660 err = hci_dev_do_close(hdev);
661 hci_dev_put(hdev);
662 return err;
663}
664
665int hci_dev_reset(__u16 dev)
666{
667 struct hci_dev *hdev;
668 int ret = 0;
669
70f23020
AE		 670 hdev = hci_dev_get(dev);
671 if (!hdev)
1da177e4
LT		 672 return -ENODEV;
673
674 hci_req_lock(hdev);
675 tasklet_disable(&hdev->tx_task);
676
677 if (!test_bit(HCI_UP, &hdev->flags))
678 goto done;
679
680 /* Drop queues */
681 skb_queue_purge(&hdev->rx_q);
682 skb_queue_purge(&hdev->cmd_q);
683
684 hci_dev_lock_bh(hdev);
685 inquiry_cache_flush(hdev);
686 hci_conn_hash_flush(hdev);
687 hci_dev_unlock_bh(hdev);
688
689 if (hdev->flush)
690 hdev->flush(hdev);
691
8e87d142 692 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 693 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 694
695 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 696 ret = __hci_request(hdev, hci_reset_req, 0,
697 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 698
699done:
700 tasklet_enable(&hdev->tx_task);
701 hci_req_unlock(hdev);
702 hci_dev_put(hdev);
703 return ret;
704}
705
706int hci_dev_reset_stat(__u16 dev)
707{
708 struct hci_dev *hdev;
709 int ret = 0;
710
70f23020
AE		 711 hdev = hci_dev_get(dev);
712 if (!hdev)
1da177e4
LT		 713 return -ENODEV;
714
715 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
716
717 hci_dev_put(hdev);
718
719 return ret;
720}
721
722int hci_dev_cmd(unsigned int cmd, void __user *arg)
723{
724 struct hci_dev *hdev;
725 struct hci_dev_req dr;
726 int err = 0;
727
728 if (copy_from_user(&dr, arg, sizeof(dr)))
729 return -EFAULT;
730
70f23020
AE		 731 hdev = hci_dev_get(dr.dev_id);
732 if (!hdev)
1da177e4
LT		 733 return -ENODEV;
734
735 switch (cmd) {
736 case HCISETAUTH:
04837f64
MH		 737 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
738 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 739 break;
740
741 case HCISETENCRYPT:
742 if (!lmp_encrypt_capable(hdev)) {
743 err = -EOPNOTSUPP;
744 break;
745 }
746
747 if (!test_bit(HCI_AUTH, &hdev->flags)) {
748 /* Auth must be enabled first */
04837f64
MH		 749 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
750 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 751 if (err)
752 break;
753 }
754
04837f64
MH		 755 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
756 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 757 break;
758
759 case HCISETSCAN:
04837f64
MH		 760 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
761 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 762 break;
763
1da177e4 764 case HCISETLINKPOL:
e4e8e37c
MH		 765 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
766 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 767 break;
768
769 case HCISETLINKMODE:
e4e8e37c
MH		 770 hdev->link_mode = ((__u16) dr.dev_opt) &
771 (HCI_LM_MASTER | HCI_LM_ACCEPT);
772 break;
773
774 case HCISETPTYPE:
775 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 776 break;
777
778 case HCISETACLMTU:
e4e8e37c
MH		 779 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
780 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 781 break;
782
783 case HCISETSCOMTU:
e4e8e37c
MH		 784 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
785 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 786 break;
787
788 default:
789 err = -EINVAL;
790 break;
791 }
e4e8e37c 792
1da177e4
LT		 793 hci_dev_put(hdev);
794 return err;
795}
796
797int hci_get_dev_list(void __user *arg)
798{
799 struct hci_dev_list_req *dl;
800 struct hci_dev_req *dr;
801 struct list_head *p;
802 int n = 0, size, err;
803 __u16 dev_num;
804
805 if (get_user(dev_num, (__u16 __user *) arg))
806 return -EFAULT;
807
808 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
809 return -EINVAL;
810
811 size = sizeof(*dl) + dev_num * sizeof(*dr);
812
70f23020
AE		 813 dl = kzalloc(size, GFP_KERNEL);
814 if (!dl)
1da177e4
LT		 815 return -ENOMEM;
816
817 dr = dl->dev_req;
818
819 read_lock_bh(&hci_dev_list_lock);
820 list_for_each(p, &hci_dev_list) {
821 struct hci_dev *hdev;
c542a06c 822
1da177e4 823 hdev = list_entry(p, struct hci_dev, list);
c542a06c 824
ab81cbf9 825 hci_del_off_timer(hdev);
c542a06c
JH		 826
827 if (!test_bit(HCI_MGMT, &hdev->flags))
828 set_bit(HCI_PAIRABLE, &hdev->flags);
829
1da177e4
LT		 830 (dr + n)->dev_id = hdev->id;
831 (dr + n)->dev_opt = hdev->flags;
c542a06c 832
1da177e4
LT		 833 if (++n >= dev_num)
834 break;
835 }
836 read_unlock_bh(&hci_dev_list_lock);
837
838 dl->dev_num = n;
839 size = sizeof(*dl) + n * sizeof(*dr);
840
841 err = copy_to_user(arg, dl, size);
842 kfree(dl);
843
844 return err ? -EFAULT : 0;
845}
846
847int hci_get_dev_info(void __user *arg)
848{
849 struct hci_dev *hdev;
850 struct hci_dev_info di;
851 int err = 0;
852
853 if (copy_from_user(&di, arg, sizeof(di)))
854 return -EFAULT;
855
70f23020
AE		 856 hdev = hci_dev_get(di.dev_id);
857 if (!hdev)
1da177e4
LT		 858 return -ENODEV;
859
ab81cbf9
JH		 860 hci_del_off_timer(hdev);
861
c542a06c
JH		 862 if (!test_bit(HCI_MGMT, &hdev->flags))
863 set_bit(HCI_PAIRABLE, &hdev->flags);
864
1da177e4
LT		 865 strcpy(di.name, hdev->name);
866 di.bdaddr = hdev->bdaddr;
943da25d 867 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 868 di.flags = hdev->flags;
869 di.pkt_type = hdev->pkt_type;
870 di.acl_mtu = hdev->acl_mtu;
871 di.acl_pkts = hdev->acl_pkts;
872 di.sco_mtu = hdev->sco_mtu;
873 di.sco_pkts = hdev->sco_pkts;
874 di.link_policy = hdev->link_policy;
875 di.link_mode = hdev->link_mode;
876
877 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
878 memcpy(&di.features, &hdev->features, sizeof(di.features));
879
880 if (copy_to_user(arg, &di, sizeof(di)))
881 err = -EFAULT;
882
883 hci_dev_put(hdev);
884
885 return err;
886}
887
888/* ---- Interface to HCI drivers ---- */
889
611b30f7
MH		 890static int hci_rfkill_set_block(void *data, bool blocked)
891{
892 struct hci_dev *hdev = data;
893
894 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
895
896 if (!blocked)
897 return 0;
898
899 hci_dev_do_close(hdev);
900
901 return 0;
902}
903
904static const struct rfkill_ops hci_rfkill_ops = {
905 .set_block = hci_rfkill_set_block,
906};
907
1da177e4
LT		 908/* Alloc HCI device */
909struct hci_dev *hci_alloc_dev(void)
910{
911 struct hci_dev *hdev;
912
25ea6db0 913 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 914 if (!hdev)
915 return NULL;
916
1da177e4
LT		 917 skb_queue_head_init(&hdev->driver_init);
918
919 return hdev;
920}
921EXPORT_SYMBOL(hci_alloc_dev);
922
923/* Free HCI device */
924void hci_free_dev(struct hci_dev *hdev)
925{
926 skb_queue_purge(&hdev->driver_init);
927
a91f2e39
MH		 928 /* will free via device release */
929 put_device(&hdev->dev);
1da177e4
LT		 930}
931EXPORT_SYMBOL(hci_free_dev);
932
ab81cbf9
JH		 933static void hci_power_on(struct work_struct *work)
934{
935 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
936
937 BT_DBG("%s", hdev->name);
938
939 if (hci_dev_open(hdev->id) < 0)
940 return;
941
942 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
943 mod_timer(&hdev->off_timer,
944 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
945
946 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
947 mgmt_index_added(hdev->id);
948}
949
950static void hci_power_off(struct work_struct *work)
951{
952 struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
953
954 BT_DBG("%s", hdev->name);
955
956 hci_dev_close(hdev->id);
957}
958
959static void hci_auto_off(unsigned long data)
960{
961 struct hci_dev *hdev = (struct hci_dev *) data;
962
963 BT_DBG("%s", hdev->name);
964
965 clear_bit(HCI_AUTO_OFF, &hdev->flags);
966
967 queue_work(hdev->workqueue, &hdev->power_off);
968}
969
970void hci_del_off_timer(struct hci_dev *hdev)
971{
972 BT_DBG("%s", hdev->name);
973
974 clear_bit(HCI_AUTO_OFF, &hdev->flags);
975 del_timer(&hdev->off_timer);
976}
977
2aeb9a1a
JH		 978int hci_uuids_clear(struct hci_dev *hdev)
979{
980 struct list_head *p, *n;
981
982 list_for_each_safe(p, n, &hdev->uuids) {
983 struct bt_uuid *uuid;
984
985 uuid = list_entry(p, struct bt_uuid, list);
986
987 list_del(p);
988 kfree(uuid);
989 }
990
991 return 0;
992}
993
55ed8ca1
JH		 994int hci_link_keys_clear(struct hci_dev *hdev)
995{
996 struct list_head *p, *n;
997
998 list_for_each_safe(p, n, &hdev->link_keys) {
999 struct link_key *key;
1000
1001 key = list_entry(p, struct link_key, list);
1002
1003 list_del(p);
1004 kfree(key);
1005 }
1006
1007 return 0;
1008}
1009
1010struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1011{
1012 struct list_head *p;
1013
1014 list_for_each(p, &hdev->link_keys) {
1015 struct link_key *k;
1016
1017 k = list_entry(p, struct link_key, list);
1018
1019 if (bacmp(bdaddr, &k->bdaddr) == 0)
1020 return k;
1021 }
1022
1023 return NULL;
1024}
1025
d25e28ab
JH		 1026static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1027 u8 key_type, u8 old_key_type)
1028{
1029 /* Legacy key */
1030 if (key_type < 0x03)
1031 return 1;
1032
1033 /* Debug keys are insecure so don't store them persistently */
1034 if (key_type == HCI_LK_DEBUG_COMBINATION)
1035 return 0;
1036
1037 /* Changed combination key and there's no previous one */
1038 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1039 return 0;
1040
1041 /* Security mode 3 case */
1042 if (!conn)
1043 return 1;
1044
1045 /* Neither local nor remote side had no-bonding as requirement */
1046 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1047 return 1;
1048
1049 /* Local side had dedicated bonding as requirement */
1050 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1051 return 1;
1052
1053 /* Remote side had dedicated bonding as requirement */
1054 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1055 return 1;
1056
1057 /* If none of the above criteria match, then don't store the key
1058 * persistently */
1059 return 0;
1060}
1061
1062int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1063 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1064{
1065 struct link_key *key, *old_key;
4df378a1 1066 u8 old_key_type, persistent;
55ed8ca1
JH		 1067
1068 old_key = hci_find_link_key(hdev, bdaddr);
1069 if (old_key) {
1070 old_key_type = old_key->type;
1071 key = old_key;
1072 } else {
12adcf3a 1073 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1074 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1075 if (!key)
1076 return -ENOMEM;
1077 list_add(&key->list, &hdev->link_keys);
1078 }
1079
1080 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1081
d25e28ab
JH		 1082 /* Some buggy controller combinations generate a changed
1083 * combination key for legacy pairing even when there's no
1084 * previous key */
1085 if (type == HCI_LK_CHANGED_COMBINATION &&
1086 (!conn || conn->remote_auth == 0xff) &&
655fe6ec 1087 old_key_type == 0xff) {
d25e28ab 1088 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1089 if (conn)
1090 conn->key_type = type;
1091 }
d25e28ab 1092
55ed8ca1
JH		 1093 bacpy(&key->bdaddr, bdaddr);
1094 memcpy(key->val, val, 16);
55ed8ca1
JH		 1095 key->pin_len = pin_len;
1096
b6020ba0 1097 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1098 key->type = old_key_type;
4748fed2
JH		 1099 else
1100 key->type = type;
1101
4df378a1
JH		 1102 if (!new_key)
1103 return 0;
1104
1105 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1106
1107 mgmt_new_key(hdev->id, key, persistent);
1108
1109 if (!persistent) {
1110 list_del(&key->list);
1111 kfree(key);
1112 }
55ed8ca1
JH		 1113
1114 return 0;
1115}
1116
1117int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1118{
1119 struct link_key *key;
1120
1121 key = hci_find_link_key(hdev, bdaddr);
1122 if (!key)
1123 return -ENOENT;
1124
1125 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1126
1127 list_del(&key->list);
1128 kfree(key);
1129
1130 return 0;
1131}
1132
6bd32326
VT		 1133/* HCI command timer function */
1134static void hci_cmd_timer(unsigned long arg)
1135{
1136 struct hci_dev *hdev = (void *) arg;
1137
1138 BT_ERR("%s command tx timeout", hdev->name);
1139 atomic_set(&hdev->cmd_cnt, 1);
f630cf0d 1140 clear_bit(HCI_RESET, &hdev->flags);
6bd32326
VT		 1141 tasklet_schedule(&hdev->cmd_task);
1142}
1143
2763eda6
SJ		 1144struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1145 bdaddr_t *bdaddr)
1146{
1147 struct oob_data *data;
1148
1149 list_for_each_entry(data, &hdev->remote_oob_data, list)
1150 if (bacmp(bdaddr, &data->bdaddr) == 0)
1151 return data;
1152
1153 return NULL;
1154}
1155
1156int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1157{
1158 struct oob_data *data;
1159
1160 data = hci_find_remote_oob_data(hdev, bdaddr);
1161 if (!data)
1162 return -ENOENT;
1163
1164 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1165
1166 list_del(&data->list);
1167 kfree(data);
1168
1169 return 0;
1170}
1171
1172int hci_remote_oob_data_clear(struct hci_dev *hdev)
1173{
1174 struct oob_data *data, *n;
1175
1176 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1177 list_del(&data->list);
1178 kfree(data);
1179 }
1180
1181 return 0;
1182}
1183
1184int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1185 u8 *randomizer)
1186{
1187 struct oob_data *data;
1188
1189 data = hci_find_remote_oob_data(hdev, bdaddr);
1190
1191 if (!data) {
1192 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1193 if (!data)
1194 return -ENOMEM;
1195
1196 bacpy(&data->bdaddr, bdaddr);
1197 list_add(&data->list, &hdev->remote_oob_data);
1198 }
1199
1200 memcpy(data->hash, hash, sizeof(data->hash));
1201 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1202
1203 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1204
1205 return 0;
1206}
1207
b2a66aad
AJ		 1208struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1209 bdaddr_t *bdaddr)
1210{
1211 struct list_head *p;
1212
1213 list_for_each(p, &hdev->blacklist) {
1214 struct bdaddr_list *b;
1215
1216 b = list_entry(p, struct bdaddr_list, list);
1217
1218 if (bacmp(bdaddr, &b->bdaddr) == 0)
1219 return b;
1220 }
1221
1222 return NULL;
1223}
1224
1225int hci_blacklist_clear(struct hci_dev *hdev)
1226{
1227 struct list_head *p, *n;
1228
1229 list_for_each_safe(p, n, &hdev->blacklist) {
1230 struct bdaddr_list *b;
1231
1232 b = list_entry(p, struct bdaddr_list, list);
1233
1234 list_del(p);
1235 kfree(b);
1236 }
1237
1238 return 0;
1239}
1240
1241int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1242{
1243 struct bdaddr_list *entry;
a7925bd2 1244 int err;
b2a66aad
AJ		 1245
1246 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1247 return -EBADF;
1248
a7925bd2
GP		 1249 hci_dev_lock(hdev);
1250
1251 if (hci_blacklist_lookup(hdev, bdaddr)) {
1252 err = -EEXIST;
1253 goto err;
1254 }
b2a66aad
AJ		 1255
1256 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
a7925bd2 1257 if (!entry) {
b2a66aad 1258 return -ENOMEM;
a7925bd2
GP		 1259 goto err;
1260 }
b2a66aad
AJ		 1261
1262 bacpy(&entry->bdaddr, bdaddr);
1263
1264 list_add(&entry->list, &hdev->blacklist);
1265
a7925bd2 1266 err = 0;
b2a66aad 1267
a7925bd2
GP		 1268err:
1269 hci_dev_unlock(hdev);
1270 return err;
b2a66aad
AJ		 1271}
1272
1273int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1274{
1275 struct bdaddr_list *entry;
a7925bd2 1276 int err = 0;
b2a66aad
AJ		 1277
1278 hci_dev_lock(hdev);
1279
a7925bd2
GP		 1280 if (bacmp(bdaddr, BDADDR_ANY) == 0) {
1281 hci_blacklist_clear(hdev);
1282 goto done;
1283 }
b2a66aad
AJ		 1284
1285 entry = hci_blacklist_lookup(hdev, bdaddr);
a7925bd2
GP		 1286 if (!entry) {
1287 err = -ENOENT;
1288 goto done;
1289 }
b2a66aad
AJ		 1290
1291 list_del(&entry->list);
1292 kfree(entry);
1293
a7925bd2 1294done:
b2a66aad 1295 hci_dev_unlock(hdev);
a7925bd2 1296 return err;
b2a66aad
AJ		 1297}
1298
35815085
AG		 1299static void hci_clear_adv_cache(unsigned long arg)
1300{
1301 struct hci_dev *hdev = (void *) arg;
1302
1303 hci_dev_lock(hdev);
1304
1305 hci_adv_entries_clear(hdev);
1306
1307 hci_dev_unlock(hdev);
1308}
1309
76c8686f
AG		 1310int hci_adv_entries_clear(struct hci_dev *hdev)
1311{
1312 struct adv_entry *entry, *tmp;
1313
1314 list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1315 list_del(&entry->list);
1316 kfree(entry);
1317 }
1318
1319 BT_DBG("%s adv cache cleared", hdev->name);
1320
1321 return 0;
1322}
1323
1324struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1325{
1326 struct adv_entry *entry;
1327
1328 list_for_each_entry(entry, &hdev->adv_entries, list)
1329 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1330 return entry;
1331
1332 return NULL;
1333}
1334
1335static inline int is_connectable_adv(u8 evt_type)
1336{
1337 if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1338 return 1;
1339
1340 return 0;
1341}
1342
1343int hci_add_adv_entry(struct hci_dev *hdev,
1344 struct hci_ev_le_advertising_info *ev)
1345{
1346 struct adv_entry *entry;
1347
1348 if (!is_connectable_adv(ev->evt_type))
1349 return -EINVAL;
1350
1351 /* Only new entries should be added to adv_entries. So, if
1352 * bdaddr was found, don't add it. */
1353 if (hci_find_adv_entry(hdev, &ev->bdaddr))
1354 return 0;
1355
1356 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1357 if (!entry)
1358 return -ENOMEM;
1359
1360 bacpy(&entry->bdaddr, &ev->bdaddr);
1361 entry->bdaddr_type = ev->bdaddr_type;
1362
1363 list_add(&entry->list, &hdev->adv_entries);
1364
1365 BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1366 batostr(&entry->bdaddr), entry->bdaddr_type);
1367
1368 return 0;
1369}
1370
3a0259bb
VCG		 1371static struct crypto_blkcipher *alloc_cypher(void)
1372{
1373 if (enable_smp)
1374 return crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1375
1376 return ERR_PTR(-ENOTSUPP);
1377}
1378
1da177e4
LT		 1379/* Register HCI device */
1380int hci_register_dev(struct hci_dev *hdev)
1381{
1382 struct list_head *head = &hci_dev_list, *p;
ef222013 1383 int i, id = 0;
1da177e4 1384
c13854ce
MH		 1385 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1386 hdev->bus, hdev->owner);
1da177e4
LT		 1387
1388 if (!hdev->open || !hdev->close || !hdev->destruct)
1389 return -EINVAL;
1390
1391 write_lock_bh(&hci_dev_list_lock);
1392
1393 /* Find first available device id */
1394 list_for_each(p, &hci_dev_list) {
1395 if (list_entry(p, struct hci_dev, list)->id != id)
1396 break;
1397 head = p; id++;
1398 }
8e87d142 1399
1da177e4
LT		 1400 sprintf(hdev->name, "hci%d", id);
1401 hdev->id = id;
1402 list_add(&hdev->list, head);
1403
1404 atomic_set(&hdev->refcnt, 1);
1405 spin_lock_init(&hdev->lock);
1406
1407 hdev->flags = 0;
1408 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 1409 hdev->esco_type = (ESCO_HV1);
1da177e4 1410 hdev->link_mode = (HCI_LM_ACCEPT);
17fa4b9d 1411 hdev->io_capability = 0x03; /* No Input No Output */
1da177e4 1412
04837f64
MH		 1413 hdev->idle_timeout = 0;
1414 hdev->sniff_max_interval = 800;
1415 hdev->sniff_min_interval = 80;
1416
70f23020 1417 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1da177e4
LT		 1418 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1419 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1420
1421 skb_queue_head_init(&hdev->rx_q);
1422 skb_queue_head_init(&hdev->cmd_q);
1423 skb_queue_head_init(&hdev->raw_q);
1424
6bd32326
VT		 1425 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1426
cd4c5391 1427 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1428 hdev->reassembly[i] = NULL;
1429
1da177e4 1430 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 1431 mutex_init(&hdev->req_lock);
1da177e4
LT		 1432
1433 inquiry_cache_init(hdev);
1434
1435 hci_conn_hash_init(hdev);
1436
ea4bd8ba 1437 INIT_LIST_HEAD(&hdev->blacklist);
f0358568 1438
2aeb9a1a
JH		 1439 INIT_LIST_HEAD(&hdev->uuids);
1440
55ed8ca1
JH		 1441 INIT_LIST_HEAD(&hdev->link_keys);
1442
2763eda6
SJ		 1443 INIT_LIST_HEAD(&hdev->remote_oob_data);
1444
76c8686f 1445 INIT_LIST_HEAD(&hdev->adv_entries);
35815085
AG		 1446 setup_timer(&hdev->adv_timer, hci_clear_adv_cache,
1447 (unsigned long) hdev);
76c8686f 1448
ab81cbf9
JH		 1449 INIT_WORK(&hdev->power_on, hci_power_on);
1450 INIT_WORK(&hdev->power_off, hci_power_off);
1451 setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1452
1da177e4
LT		 1453 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1454
1455 atomic_set(&hdev->promisc, 0);
1456
1457 write_unlock_bh(&hci_dev_list_lock);
1458
f48fd9c8
MH		 1459 hdev->workqueue = create_singlethread_workqueue(hdev->name);
1460 if (!hdev->workqueue)
1461 goto nomem;
1462
3a0259bb
VCG		 1463 hdev->tfm = alloc_cypher();
1464 if (IS_ERR(hdev->tfm))
1465 BT_INFO("Failed to load transform for ecb(aes): %ld",
1466 PTR_ERR(hdev->tfm));
1467
1da177e4
LT		 1468 hci_register_sysfs(hdev);
1469
611b30f7
MH		 1470 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1471 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1472 if (hdev->rfkill) {
1473 if (rfkill_register(hdev->rfkill) < 0) {
1474 rfkill_destroy(hdev->rfkill);
1475 hdev->rfkill = NULL;
1476 }
1477 }
1478
ab81cbf9
JH		 1479 set_bit(HCI_AUTO_OFF, &hdev->flags);
1480 set_bit(HCI_SETUP, &hdev->flags);
1481 queue_work(hdev->workqueue, &hdev->power_on);
1482
1da177e4
LT		 1483 hci_notify(hdev, HCI_DEV_REG);
1484
1485 return id;
f48fd9c8
MH		 1486
1487nomem:
1488 write_lock_bh(&hci_dev_list_lock);
1489 list_del(&hdev->list);
1490 write_unlock_bh(&hci_dev_list_lock);
1491
1492 return -ENOMEM;
1da177e4
LT		 1493}
1494EXPORT_SYMBOL(hci_register_dev);
1495
1496/* Unregister HCI device */
1497int hci_unregister_dev(struct hci_dev *hdev)
1498{
ef222013
MH		 1499 int i;
1500
c13854ce 1501 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1502
1da177e4
LT		 1503 write_lock_bh(&hci_dev_list_lock);
1504 list_del(&hdev->list);
1505 write_unlock_bh(&hci_dev_list_lock);
1506
1507 hci_dev_do_close(hdev);
1508
cd4c5391 1509 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1510 kfree_skb(hdev->reassembly[i]);
1511
ab81cbf9
JH		 1512 if (!test_bit(HCI_INIT, &hdev->flags) &&
1513 !test_bit(HCI_SETUP, &hdev->flags))
1514 mgmt_index_removed(hdev->id);
1515
3a0259bb
VCG		 1516 if (!IS_ERR(hdev->tfm))
1517 crypto_free_blkcipher(hdev->tfm);
1518
1da177e4
LT		 1519 hci_notify(hdev, HCI_DEV_UNREG);
1520
611b30f7
MH		 1521 if (hdev->rfkill) {
1522 rfkill_unregister(hdev->rfkill);
1523 rfkill_destroy(hdev->rfkill);
1524 }
1525
147e2d59
DY		 1526 hci_unregister_sysfs(hdev);
1527
c6f3c5f7 1528 hci_del_off_timer(hdev);
35815085 1529 del_timer(&hdev->adv_timer);
c6f3c5f7 1530
f48fd9c8
MH		 1531 destroy_workqueue(hdev->workqueue);
1532
e2e0cacb
JH		 1533 hci_dev_lock_bh(hdev);
1534 hci_blacklist_clear(hdev);
2aeb9a1a 1535 hci_uuids_clear(hdev);
55ed8ca1 1536 hci_link_keys_clear(hdev);
2763eda6 1537 hci_remote_oob_data_clear(hdev);
76c8686f 1538 hci_adv_entries_clear(hdev);
e2e0cacb
JH		 1539 hci_dev_unlock_bh(hdev);
1540
1da177e4 1541 __hci_dev_put(hdev);
ef222013 1542
1da177e4
LT		 1543 return 0;
1544}
1545EXPORT_SYMBOL(hci_unregister_dev);
1546
1547/* Suspend HCI device */
1548int hci_suspend_dev(struct hci_dev *hdev)
1549{
1550 hci_notify(hdev, HCI_DEV_SUSPEND);
1551 return 0;
1552}
1553EXPORT_SYMBOL(hci_suspend_dev);
1554
1555/* Resume HCI device */
1556int hci_resume_dev(struct hci_dev *hdev)
1557{
1558 hci_notify(hdev, HCI_DEV_RESUME);
1559 return 0;
1560}
1561EXPORT_SYMBOL(hci_resume_dev);
1562
76bca880
MH		 1563/* Receive frame from HCI drivers */
1564int hci_recv_frame(struct sk_buff *skb)
1565{
1566 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1567 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1568 && !test_bit(HCI_INIT, &hdev->flags))) {
1569 kfree_skb(skb);
1570 return -ENXIO;
1571 }
1572
1573 /* Incomming skb */
1574 bt_cb(skb)->incoming = 1;
1575
1576 /* Time stamp */
1577 __net_timestamp(skb);
1578
1579 /* Queue frame for rx task */
1580 skb_queue_tail(&hdev->rx_q, skb);
c78ae283
MH		 1581 tasklet_schedule(&hdev->rx_task);
1582
76bca880
MH		 1583 return 0;
1584}
1585EXPORT_SYMBOL(hci_recv_frame);
1586
33e882a5 1587static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1e429f38 1588 int count, __u8 index)
33e882a5
SS		 1589{
1590 int len = 0;
1591 int hlen = 0;
1592 int remain = count;
1593 struct sk_buff *skb;
1594 struct bt_skb_cb *scb;
1595
1596 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1597 index >= NUM_REASSEMBLY)
1598 return -EILSEQ;
1599
1600 skb = hdev->reassembly[index];
1601
1602 if (!skb) {
1603 switch (type) {
1604 case HCI_ACLDATA_PKT:
1605 len = HCI_MAX_FRAME_SIZE;
1606 hlen = HCI_ACL_HDR_SIZE;
1607 break;
1608 case HCI_EVENT_PKT:
1609 len = HCI_MAX_EVENT_SIZE;
1610 hlen = HCI_EVENT_HDR_SIZE;
1611 break;
1612 case HCI_SCODATA_PKT:
1613 len = HCI_MAX_SCO_SIZE;
1614 hlen = HCI_SCO_HDR_SIZE;
1615 break;
1616 }
1617
1e429f38 1618 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 1619 if (!skb)
1620 return -ENOMEM;
1621
1622 scb = (void *) skb->cb;
1623 scb->expect = hlen;
1624 scb->pkt_type = type;
1625
1626 skb->dev = (void *) hdev;
1627 hdev->reassembly[index] = skb;
1628 }
1629
1630 while (count) {
1631 scb = (void *) skb->cb;
1632 len = min(scb->expect, (__u16)count);
1633
1634 memcpy(skb_put(skb, len), data, len);
1635
1636 count -= len;
1637 data += len;
1638 scb->expect -= len;
1639 remain = count;
1640
1641 switch (type) {
1642 case HCI_EVENT_PKT:
1643 if (skb->len == HCI_EVENT_HDR_SIZE) {
1644 struct hci_event_hdr *h = hci_event_hdr(skb);
1645 scb->expect = h->plen;
1646
1647 if (skb_tailroom(skb) < scb->expect) {
1648 kfree_skb(skb);
1649 hdev->reassembly[index] = NULL;
1650 return -ENOMEM;
1651 }
1652 }
1653 break;
1654
1655 case HCI_ACLDATA_PKT:
1656 if (skb->len == HCI_ACL_HDR_SIZE) {
1657 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1658 scb->expect = __le16_to_cpu(h->dlen);
1659
1660 if (skb_tailroom(skb) < scb->expect) {
1661 kfree_skb(skb);
1662 hdev->reassembly[index] = NULL;
1663 return -ENOMEM;
1664 }
1665 }
1666 break;
1667
1668 case HCI_SCODATA_PKT:
1669 if (skb->len == HCI_SCO_HDR_SIZE) {
1670 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1671 scb->expect = h->dlen;
1672
1673 if (skb_tailroom(skb) < scb->expect) {
1674 kfree_skb(skb);
1675 hdev->reassembly[index] = NULL;
1676 return -ENOMEM;
1677 }
1678 }
1679 break;
1680 }
1681
1682 if (scb->expect == 0) {
1683 /* Complete frame */
1684
1685 bt_cb(skb)->pkt_type = type;
1686 hci_recv_frame(skb);
1687
1688 hdev->reassembly[index] = NULL;
1689 return remain;
1690 }
1691 }
1692
1693 return remain;
1694}
1695
ef222013
MH		 1696int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1697{
f39a3c06
SS		 1698 int rem = 0;
1699
ef222013
MH		 1700 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1701 return -EILSEQ;
1702
da5f6c37 1703 while (count) {
1e429f38 1704 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 1705 if (rem < 0)
1706 return rem;
ef222013 1707
f39a3c06
SS		 1708 data += (count - rem);
1709 count = rem;
da5f6c37 1710 };
ef222013 1711
f39a3c06 1712 return rem;
ef222013
MH		 1713}
1714EXPORT_SYMBOL(hci_recv_fragment);
1715
99811510
SS		 1716#define STREAM_REASSEMBLY 0
1717
1718int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1719{
1720 int type;
1721 int rem = 0;
1722
da5f6c37 1723 while (count) {
99811510
SS		 1724 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1725
1726 if (!skb) {
1727 struct { char type; } *pkt;
1728
1729 /* Start of the frame */
1730 pkt = data;
1731 type = pkt->type;
1732
1733 data++;
1734 count--;
1735 } else
1736 type = bt_cb(skb)->pkt_type;
1737
1e429f38
GP		 1738 rem = hci_reassembly(hdev, type, data, count,
1739 STREAM_REASSEMBLY);
99811510
SS		 1740 if (rem < 0)
1741 return rem;
1742
1743 data += (count - rem);
1744 count = rem;
da5f6c37 1745 };
99811510
SS		 1746
1747 return rem;
1748}
1749EXPORT_SYMBOL(hci_recv_stream_fragment);
1750
1da177e4
LT		 1751/* ---- Interface to upper protocols ---- */
1752
1753/* Register/Unregister protocols.
1754 * hci_task_lock is used to ensure that no tasks are running. */
1755int hci_register_proto(struct hci_proto *hp)
1756{
1757 int err = 0;
1758
1759 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1760
1761 if (hp->id >= HCI_MAX_PROTO)
1762 return -EINVAL;
1763
1764 write_lock_bh(&hci_task_lock);
1765
1766 if (!hci_proto[hp->id])
1767 hci_proto[hp->id] = hp;
1768 else
1769 err = -EEXIST;
1770
1771 write_unlock_bh(&hci_task_lock);
1772
1773 return err;
1774}
1775EXPORT_SYMBOL(hci_register_proto);
1776
1777int hci_unregister_proto(struct hci_proto *hp)
1778{
1779 int err = 0;
1780
1781 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1782
1783 if (hp->id >= HCI_MAX_PROTO)
1784 return -EINVAL;
1785
1786 write_lock_bh(&hci_task_lock);
1787
1788 if (hci_proto[hp->id])
1789 hci_proto[hp->id] = NULL;
1790 else
1791 err = -ENOENT;
1792
1793 write_unlock_bh(&hci_task_lock);
1794
1795 return err;
1796}
1797EXPORT_SYMBOL(hci_unregister_proto);
1798
1799int hci_register_cb(struct hci_cb *cb)
1800{
1801 BT_DBG("%p name %s", cb, cb->name);
1802
1803 write_lock_bh(&hci_cb_list_lock);
1804 list_add(&cb->list, &hci_cb_list);
1805 write_unlock_bh(&hci_cb_list_lock);
1806
1807 return 0;
1808}
1809EXPORT_SYMBOL(hci_register_cb);
1810
1811int hci_unregister_cb(struct hci_cb *cb)
1812{
1813 BT_DBG("%p name %s", cb, cb->name);
1814
1815 write_lock_bh(&hci_cb_list_lock);
1816 list_del(&cb->list);
1817 write_unlock_bh(&hci_cb_list_lock);
1818
1819 return 0;
1820}
1821EXPORT_SYMBOL(hci_unregister_cb);
1822
1823static int hci_send_frame(struct sk_buff *skb)
1824{
1825 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1826
1827 if (!hdev) {
1828 kfree_skb(skb);
1829 return -ENODEV;
1830 }
1831
0d48d939 1832 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1833
1834 if (atomic_read(&hdev->promisc)) {
1835 /* Time stamp */
a61bbcf2 1836 __net_timestamp(skb);
1da177e4 1837
eec8d2bc 1838 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1839 }
1840
1841 /* Get rid of skb owner, prior to sending to the driver. */
1842 skb_orphan(skb);
1843
1844 return hdev->send(skb);
1845}
1846
1847/* Send HCI command */
a9de9248 1848int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1849{
1850 int len = HCI_COMMAND_HDR_SIZE + plen;
1851 struct hci_command_hdr *hdr;
1852 struct sk_buff *skb;
1853
a9de9248 1854 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1855
1856 skb = bt_skb_alloc(len, GFP_ATOMIC);
1857 if (!skb) {
ef222013 1858 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1859 return -ENOMEM;
1860 }
1861
1862 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1863 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1864 hdr->plen = plen;
1865
1866 if (plen)
1867 memcpy(skb_put(skb, plen), param, plen);
1868
1869 BT_DBG("skb len %d", skb->len);
1870
0d48d939 1871 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 1872 skb->dev = (void *) hdev;
c78ae283 1873
a5040efa
JH		 1874 if (test_bit(HCI_INIT, &hdev->flags))
1875 hdev->init_last_cmd = opcode;
1876
1da177e4 1877 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 1878 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 1879
1880 return 0;
1881}
1da177e4
LT		 1882
1883/* Get data from the previously sent command */
a9de9248 1884void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1885{
1886 struct hci_command_hdr *hdr;
1887
1888 if (!hdev->sent_cmd)
1889 return NULL;
1890
1891 hdr = (void *) hdev->sent_cmd->data;
1892
a9de9248 1893 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1894 return NULL;
1895
a9de9248 1896 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1897
1898 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1899}
1900
1901/* Send ACL data */
1902static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1903{
1904 struct hci_acl_hdr *hdr;
1905 int len = skb->len;
1906
badff6d0
ACM		 1907 skb_push(skb, HCI_ACL_HDR_SIZE);
1908 skb_reset_transport_header(skb);
9c70220b 1909 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1910 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1911 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1912}
1913
9a9c6a34 1914void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1da177e4
LT		 1915{
1916 struct hci_dev *hdev = conn->hdev;
1917 struct sk_buff *list;
1918
1919 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1920
1921 skb->dev = (void *) hdev;
0d48d939 1922 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1923 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4 1924
70f23020
AE		 1925 list = skb_shinfo(skb)->frag_list;
1926 if (!list) {
1da177e4
LT		 1927 /* Non fragmented */
1928 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1929
1930 skb_queue_tail(&conn->data_q, skb);
1931 } else {
1932 /* Fragmented */
1933 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1934
1935 skb_shinfo(skb)->frag_list = NULL;
1936
1937 /* Queue all fragments atomically */
1938 spin_lock_bh(&conn->data_q.lock);
1939
1940 __skb_queue_tail(&conn->data_q, skb);
e702112f
AE		 1941
1942 flags &= ~ACL_START;
1943 flags |= ACL_CONT;
1da177e4
LT		 1944 do {
1945 skb = list; list = list->next;
8e87d142 1946
1da177e4 1947 skb->dev = (void *) hdev;
0d48d939 1948 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1949 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 1950
1951 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1952
1953 __skb_queue_tail(&conn->data_q, skb);
1954 } while (list);
1955
1956 spin_unlock_bh(&conn->data_q.lock);
1957 }
1958
c78ae283 1959 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 1960}
1961EXPORT_SYMBOL(hci_send_acl);
1962
1963/* Send SCO data */
0d861d8b 1964void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 1965{
1966 struct hci_dev *hdev = conn->hdev;
1967 struct hci_sco_hdr hdr;
1968
1969 BT_DBG("%s len %d", hdev->name, skb->len);
1970
aca3192c 1971 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 1972 hdr.dlen = skb->len;
1973
badff6d0
ACM		 1974 skb_push(skb, HCI_SCO_HDR_SIZE);
1975 skb_reset_transport_header(skb);
9c70220b 1976 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 1977
1978 skb->dev = (void *) hdev;
0d48d939 1979 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 1980
1da177e4 1981 skb_queue_tail(&conn->data_q, skb);
c78ae283 1982 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 1983}
1984EXPORT_SYMBOL(hci_send_sco);
1985
1986/* ---- HCI TX task (outgoing data) ---- */
1987
1988/* HCI Connection scheduler */
1989static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1990{
1991 struct hci_conn_hash *h = &hdev->conn_hash;
5b7f9909 1992 struct hci_conn *conn = NULL;
1da177e4
LT		 1993 int num = 0, min = ~0;
1994 struct list_head *p;
1995
8e87d142 1996 /* We don't have to lock device here. Connections are always
1da177e4
LT		 1997 * added and removed with TX task disabled. */
1998 list_for_each(p, &h->list) {
1999 struct hci_conn *c;
2000 c = list_entry(p, struct hci_conn, list);
2001
769be974 2002 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2003 continue;
769be974
MH		 2004
2005 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2006 continue;
2007
1da177e4
LT		 2008 num++;
2009
2010 if (c->sent < min) {
2011 min = c->sent;
2012 conn = c;
2013 }
2014 }
2015
2016 if (conn) {
6ed58ec5
VT		 2017 int cnt, q;
2018
2019 switch (conn->type) {
2020 case ACL_LINK:
2021 cnt = hdev->acl_cnt;
2022 break;
2023 case SCO_LINK:
2024 case ESCO_LINK:
2025 cnt = hdev->sco_cnt;
2026 break;
2027 case LE_LINK:
2028 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2029 break;
2030 default:
2031 cnt = 0;
2032 BT_ERR("Unknown link type");
2033 }
2034
2035 q = cnt / num;
1da177e4
LT		 2036 *quote = q ? q : 1;
2037 } else
2038 *quote = 0;
2039
2040 BT_DBG("conn %p quote %d", conn, *quote);
2041 return conn;
2042}
2043
bae1f5d9 2044static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2045{
2046 struct hci_conn_hash *h = &hdev->conn_hash;
2047 struct list_head *p;
2048 struct hci_conn *c;
2049
bae1f5d9 2050 BT_ERR("%s link tx timeout", hdev->name);
1da177e4
LT		 2051
2052 /* Kill stalled connections */
2053 list_for_each(p, &h->list) {
2054 c = list_entry(p, struct hci_conn, list);
bae1f5d9
VT		 2055 if (c->type == type && c->sent) {
2056 BT_ERR("%s killing stalled connection %s",
1da177e4
LT		 2057 hdev->name, batostr(&c->dst));
2058 hci_acl_disconn(c, 0x13);
2059 }
2060 }
2061}
2062
2063static inline void hci_sched_acl(struct hci_dev *hdev)
2064{
2065 struct hci_conn *conn;
2066 struct sk_buff *skb;
2067 int quote;
2068
2069 BT_DBG("%s", hdev->name);
2070
2071 if (!test_bit(HCI_RAW, &hdev->flags)) {
2072 /* ACL tx timeout must be longer than maximum
2073 * link supervision timeout (40.9 seconds) */
82453021 2074 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
bae1f5d9 2075 hci_link_tx_to(hdev, ACL_LINK);
1da177e4
LT		 2076 }
2077
2078 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
2079 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2080 BT_DBG("skb %p len %d", skb, skb->len);
04837f64 2081
14b12d0b 2082 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
04837f64 2083
1da177e4
LT		 2084 hci_send_frame(skb);
2085 hdev->acl_last_tx = jiffies;
2086
2087 hdev->acl_cnt--;
2088 conn->sent++;
2089 }
2090 }
2091}
2092
2093/* Schedule SCO */
2094static inline void hci_sched_sco(struct hci_dev *hdev)
2095{
2096 struct hci_conn *conn;
2097 struct sk_buff *skb;
2098 int quote;
2099
2100 BT_DBG("%s", hdev->name);
2101
2102 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2103 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2104 BT_DBG("skb %p len %d", skb, skb->len);
2105 hci_send_frame(skb);
2106
2107 conn->sent++;
2108 if (conn->sent == ~0)
2109 conn->sent = 0;
2110 }
2111 }
2112}
2113
b6a0dc82
MH		 2114static inline void hci_sched_esco(struct hci_dev *hdev)
2115{
2116 struct hci_conn *conn;
2117 struct sk_buff *skb;
2118 int quote;
2119
2120 BT_DBG("%s", hdev->name);
2121
2122 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2123 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2124 BT_DBG("skb %p len %d", skb, skb->len);
2125 hci_send_frame(skb);
2126
2127 conn->sent++;
2128 if (conn->sent == ~0)
2129 conn->sent = 0;
2130 }
2131 }
2132}
2133
6ed58ec5
VT		 2134static inline void hci_sched_le(struct hci_dev *hdev)
2135{
2136 struct hci_conn *conn;
2137 struct sk_buff *skb;
2138 int quote, cnt;
2139
2140 BT_DBG("%s", hdev->name);
2141
2142 if (!test_bit(HCI_RAW, &hdev->flags)) {
2143 /* LE tx timeout must be longer than maximum
2144 * link supervision timeout (40.9 seconds) */
bae1f5d9 2145 if (!hdev->le_cnt && hdev->le_pkts &&
6ed58ec5 2146 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 2147 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 2148 }
2149
2150 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2151 while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
2152 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2153 BT_DBG("skb %p len %d", skb, skb->len);
2154
2155 hci_send_frame(skb);
2156 hdev->le_last_tx = jiffies;
2157
2158 cnt--;
2159 conn->sent++;
2160 }
2161 }
2162 if (hdev->le_pkts)
2163 hdev->le_cnt = cnt;
2164 else
2165 hdev->acl_cnt = cnt;
2166}
2167
1da177e4
LT		 2168static void hci_tx_task(unsigned long arg)
2169{
2170 struct hci_dev *hdev = (struct hci_dev *) arg;
2171 struct sk_buff *skb;
2172
2173 read_lock(&hci_task_lock);
2174
6ed58ec5
VT		 2175 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2176 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 2177
2178 /* Schedule queues and send stuff to HCI driver */
2179
2180 hci_sched_acl(hdev);
2181
2182 hci_sched_sco(hdev);
2183
b6a0dc82
MH		 2184 hci_sched_esco(hdev);
2185
6ed58ec5
VT		 2186 hci_sched_le(hdev);
2187
1da177e4
LT		 2188 /* Send next queued raw (unknown type) packet */
2189 while ((skb = skb_dequeue(&hdev->raw_q)))
2190 hci_send_frame(skb);
2191
2192 read_unlock(&hci_task_lock);
2193}
2194
25985edc 2195/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 2196
2197/* ACL data packet */
2198static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2199{
2200 struct hci_acl_hdr *hdr = (void *) skb->data;
2201 struct hci_conn *conn;
2202 __u16 handle, flags;
2203
2204 skb_pull(skb, HCI_ACL_HDR_SIZE);
2205
2206 handle = __le16_to_cpu(hdr->handle);
2207 flags = hci_flags(handle);
2208 handle = hci_handle(handle);
2209
2210 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2211
2212 hdev->stat.acl_rx++;
2213
2214 hci_dev_lock(hdev);
2215 conn = hci_conn_hash_lookup_handle(hdev, handle);
2216 hci_dev_unlock(hdev);
8e87d142 2217
1da177e4
LT		 2218 if (conn) {
2219 register struct hci_proto *hp;
2220
14b12d0b 2221 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
04837f64 2222
1da177e4 2223 /* Send to upper protocol */
70f23020
AE		 2224 hp = hci_proto[HCI_PROTO_L2CAP];
2225 if (hp && hp->recv_acldata) {
1da177e4
LT		 2226 hp->recv_acldata(conn, skb, flags);
2227 return;
2228 }
2229 } else {
8e87d142 2230 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 2231 hdev->name, handle);
2232 }
2233
2234 kfree_skb(skb);
2235}
2236
2237/* SCO data packet */
2238static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2239{
2240 struct hci_sco_hdr *hdr = (void *) skb->data;
2241 struct hci_conn *conn;
2242 __u16 handle;
2243
2244 skb_pull(skb, HCI_SCO_HDR_SIZE);
2245
2246 handle = __le16_to_cpu(hdr->handle);
2247
2248 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2249
2250 hdev->stat.sco_rx++;
2251
2252 hci_dev_lock(hdev);
2253 conn = hci_conn_hash_lookup_handle(hdev, handle);
2254 hci_dev_unlock(hdev);
2255
2256 if (conn) {
2257 register struct hci_proto *hp;
2258
2259 /* Send to upper protocol */
70f23020
AE		 2260 hp = hci_proto[HCI_PROTO_SCO];
2261 if (hp && hp->recv_scodata) {
1da177e4
LT		 2262 hp->recv_scodata(conn, skb);
2263 return;
2264 }
2265 } else {
8e87d142 2266 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 2267 hdev->name, handle);
2268 }
2269
2270 kfree_skb(skb);
2271}
2272
6516455d 2273static void hci_rx_task(unsigned long arg)
1da177e4
LT		 2274{
2275 struct hci_dev *hdev = (struct hci_dev *) arg;
2276 struct sk_buff *skb;
2277
2278 BT_DBG("%s", hdev->name);
2279
2280 read_lock(&hci_task_lock);
2281
2282 while ((skb = skb_dequeue(&hdev->rx_q))) {
2283 if (atomic_read(&hdev->promisc)) {
2284 /* Send copy to the sockets */
eec8d2bc 2285 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 2286 }
2287
2288 if (test_bit(HCI_RAW, &hdev->flags)) {
2289 kfree_skb(skb);
2290 continue;
2291 }
2292
2293 if (test_bit(HCI_INIT, &hdev->flags)) {
2294 /* Don't process data packets in this states. */
0d48d939 2295 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2296 case HCI_ACLDATA_PKT:
2297 case HCI_SCODATA_PKT:
2298 kfree_skb(skb);
2299 continue;
3ff50b79 2300 }
1da177e4
LT		 2301 }
2302
2303 /* Process frame */
0d48d939 2304 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2305 case HCI_EVENT_PKT:
2306 hci_event_packet(hdev, skb);
2307 break;
2308
2309 case HCI_ACLDATA_PKT:
2310 BT_DBG("%s ACL data packet", hdev->name);
2311 hci_acldata_packet(hdev, skb);
2312 break;
2313
2314 case HCI_SCODATA_PKT:
2315 BT_DBG("%s SCO data packet", hdev->name);
2316 hci_scodata_packet(hdev, skb);
2317 break;
2318
2319 default:
2320 kfree_skb(skb);
2321 break;
2322 }
2323 }
2324
2325 read_unlock(&hci_task_lock);
2326}
2327
2328static void hci_cmd_task(unsigned long arg)
2329{
2330 struct hci_dev *hdev = (struct hci_dev *) arg;
2331 struct sk_buff *skb;
2332
2333 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2334
1da177e4 2335 /* Send queued commands */
5a08ecce
AE		 2336 if (atomic_read(&hdev->cmd_cnt)) {
2337 skb = skb_dequeue(&hdev->cmd_q);
2338 if (!skb)
2339 return;
2340
7585b97a 2341 kfree_skb(hdev->sent_cmd);
1da177e4 2342
70f23020
AE		 2343 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2344 if (hdev->sent_cmd) {
1da177e4
LT		 2345 atomic_dec(&hdev->cmd_cnt);
2346 hci_send_frame(skb);
6bd32326
VT		 2347 mod_timer(&hdev->cmd_timer,
2348 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
1da177e4
LT		 2349 } else {
2350 skb_queue_head(&hdev->cmd_q, skb);
c78ae283 2351 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 2352 }
2353 }
2354}
3a0259bb
VCG		 2355
2356module_param(enable_smp, bool, 0644);
2357MODULE_PARM_DESC(enable_smp, "Enable SMP support (LE only)");
kernel source for telekom puls (alcatel/mediatek)