]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blame - net/bluetooth/hci_core.c
projects / mirror_ubuntu-artful-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add support for setting DUT mode
[mirror_ubuntu-artful-kernel.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
3df92b31 29#include <linux/idr.h>
8c520a59 30#include <linux/rfkill.h>
baf27f6e 31#include <linux/debugfs.h>
47219839 32#include <asm/unaligned.h>
1da177e4
LT		 33
34#include <net/bluetooth/bluetooth.h>
35#include <net/bluetooth/hci_core.h>
36
b78752cc 37static void hci_rx_work(struct work_struct *work);
c347b765 38static void hci_cmd_work(struct work_struct *work);
3eff45ea 39static void hci_tx_work(struct work_struct *work);
1da177e4 40
1da177e4
LT		 41/* HCI device list */
42LIST_HEAD(hci_dev_list);
43DEFINE_RWLOCK(hci_dev_list_lock);
44
45/* HCI callback list */
46LIST_HEAD(hci_cb_list);
47DEFINE_RWLOCK(hci_cb_list_lock);
48
3df92b31
SL		 49/* HCI ID Numbering */
50static DEFINE_IDA(hci_index_ida);
51
1da177e4
LT		 52/* ---- HCI notifications ---- */
53
6516455d 54static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 55{
040030ef 56 hci_sock_dev_event(hdev, event);
1da177e4
LT		 57}
58
baf27f6e
MH		 59/* ---- HCI debugfs entries ---- */
60
4b4148e9
MH		 61static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
62 size_t count, loff_t *ppos)
63{
64 struct hci_dev *hdev = file->private_data;
65 char buf[3];
66
67 buf[0] = test_bit(HCI_DUT_MODE, &hdev->dev_flags) ? 'Y': 'N';
68 buf[1] = '\n';
69 buf[2] = '\0';
70 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
71}
72
73static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
74 size_t count, loff_t *ppos)
75{
76 struct hci_dev *hdev = file->private_data;
77 struct sk_buff *skb;
78 char buf[32];
79 size_t buf_size = min(count, (sizeof(buf)-1));
80 bool enable;
81 int err;
82
83 if (!test_bit(HCI_UP, &hdev->flags))
84 return -ENETDOWN;
85
86 if (copy_from_user(buf, user_buf, buf_size))
87 return -EFAULT;
88
89 buf[buf_size] = '\0';
90 if (strtobool(buf, &enable))
91 return -EINVAL;
92
93 if (enable == test_bit(HCI_DUT_MODE, &hdev->dev_flags))
94 return -EALREADY;
95
96 hci_req_lock(hdev);
97 if (enable)
98 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
99 HCI_CMD_TIMEOUT);
100 else
101 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
102 HCI_CMD_TIMEOUT);
103 hci_req_unlock(hdev);
104
105 if (IS_ERR(skb))
106 return PTR_ERR(skb);
107
108 err = -bt_to_errno(skb->data[0]);
109 kfree_skb(skb);
110
111 if (err < 0)
112 return err;
113
114 change_bit(HCI_DUT_MODE, &hdev->dev_flags);
115
116 return count;
117}
118
119static const struct file_operations dut_mode_fops = {
120 .open = simple_open,
121 .read = dut_mode_read,
122 .write = dut_mode_write,
123 .llseek = default_llseek,
124};
125
dfb826a8
MH		 126static int features_show(struct seq_file *f, void *ptr)
127{
128 struct hci_dev *hdev = f->private;
129 u8 p;
130
131 hci_dev_lock(hdev);
132 for (p = 0; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
cfbb2b5b 133 seq_printf(f, "%2u: 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x "
dfb826a8
MH		 134 "0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n", p,
135 hdev->features[p][0], hdev->features[p][1],
136 hdev->features[p][2], hdev->features[p][3],
137 hdev->features[p][4], hdev->features[p][5],
138 hdev->features[p][6], hdev->features[p][7]);
139 }
cfbb2b5b
MH		 140 if (lmp_le_capable(hdev))
141 seq_printf(f, "LE: 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x "
142 "0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n",
143 hdev->le_features[0], hdev->le_features[1],
144 hdev->le_features[2], hdev->le_features[3],
145 hdev->le_features[4], hdev->le_features[5],
146 hdev->le_features[6], hdev->le_features[7]);
dfb826a8
MH		 147 hci_dev_unlock(hdev);
148
149 return 0;
150}
151
152static int features_open(struct inode *inode, struct file *file)
153{
154 return single_open(file, features_show, inode->i_private);
155}
156
157static const struct file_operations features_fops = {
158 .open = features_open,
159 .read = seq_read,
160 .llseek = seq_lseek,
161 .release = single_release,
162};
163
70afe0b8
MH		 164static int blacklist_show(struct seq_file *f, void *p)
165{
166 struct hci_dev *hdev = f->private;
167 struct bdaddr_list *b;
168
169 hci_dev_lock(hdev);
170 list_for_each_entry(b, &hdev->blacklist, list)
b25f0785 171 seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
70afe0b8
MH		 172 hci_dev_unlock(hdev);
173
174 return 0;
175}
176
177static int blacklist_open(struct inode *inode, struct file *file)
178{
179 return single_open(file, blacklist_show, inode->i_private);
180}
181
182static const struct file_operations blacklist_fops = {
183 .open = blacklist_open,
184 .read = seq_read,
185 .llseek = seq_lseek,
186 .release = single_release,
187};
188
47219839
MH		 189static int uuids_show(struct seq_file *f, void *p)
190{
191 struct hci_dev *hdev = f->private;
192 struct bt_uuid *uuid;
193
194 hci_dev_lock(hdev);
195 list_for_each_entry(uuid, &hdev->uuids, list) {
196 u32 data0, data5;
197 u16 data1, data2, data3, data4;
198
199 data5 = get_unaligned_le32(uuid);
200 data4 = get_unaligned_le16(uuid + 4);
201 data3 = get_unaligned_le16(uuid + 6);
202 data2 = get_unaligned_le16(uuid + 8);
203 data1 = get_unaligned_le16(uuid + 10);
204 data0 = get_unaligned_le32(uuid + 12);
205
206 seq_printf(f, "%.8x-%.4x-%.4x-%.4x-%.4x%.8x\n",
207 data0, data1, data2, data3, data4, data5);
208 }
209 hci_dev_unlock(hdev);
210
211 return 0;
212}
213
214static int uuids_open(struct inode *inode, struct file *file)
215{
216 return single_open(file, uuids_show, inode->i_private);
217}
218
219static const struct file_operations uuids_fops = {
220 .open = uuids_open,
221 .read = seq_read,
222 .llseek = seq_lseek,
223 .release = single_release,
224};
225
baf27f6e
MH		 226static int inquiry_cache_show(struct seq_file *f, void *p)
227{
228 struct hci_dev *hdev = f->private;
229 struct discovery_state *cache = &hdev->discovery;
230 struct inquiry_entry *e;
231
232 hci_dev_lock(hdev);
233
234 list_for_each_entry(e, &cache->all, all) {
235 struct inquiry_data *data = &e->data;
236 seq_printf(f, "%pMR %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %d %u\n",
237 &data->bdaddr,
238 data->pscan_rep_mode, data->pscan_period_mode,
239 data->pscan_mode, data->dev_class[2],
240 data->dev_class[1], data->dev_class[0],
241 __le16_to_cpu(data->clock_offset),
242 data->rssi, data->ssp_mode, e->timestamp);
243 }
244
245 hci_dev_unlock(hdev);
246
247 return 0;
248}
249
250static int inquiry_cache_open(struct inode *inode, struct file *file)
251{
252 return single_open(file, inquiry_cache_show, inode->i_private);
253}
254
255static const struct file_operations inquiry_cache_fops = {
256 .open = inquiry_cache_open,
257 .read = seq_read,
258 .llseek = seq_lseek,
259 .release = single_release,
260};
261
02d08d15
MH		 262static int link_keys_show(struct seq_file *f, void *ptr)
263{
264 struct hci_dev *hdev = f->private;
265 struct list_head *p, *n;
266
267 hci_dev_lock(hdev);
268 list_for_each_safe(p, n, &hdev->link_keys) {
269 struct link_key *key = list_entry(p, struct link_key, list);
270 seq_printf(f, "%pMR %u %*phN %u\n", &key->bdaddr, key->type,
271 HCI_LINK_KEY_SIZE, key->val, key->pin_len);
272 }
273 hci_dev_unlock(hdev);
274
275 return 0;
276}
277
278static int link_keys_open(struct inode *inode, struct file *file)
279{
280 return single_open(file, link_keys_show, inode->i_private);
281}
282
283static const struct file_operations link_keys_fops = {
284 .open = link_keys_open,
285 .read = seq_read,
286 .llseek = seq_lseek,
287 .release = single_release,
288};
289
12c269d7
MH		 290static ssize_t use_debug_keys_read(struct file *file, char __user *user_buf,
291 size_t count, loff_t *ppos)
292{
293 struct hci_dev *hdev = file->private_data;
294 char buf[3];
295
296 buf[0] = test_bit(HCI_DEBUG_KEYS, &hdev->dev_flags) ? 'Y': 'N';
297 buf[1] = '\n';
298 buf[2] = '\0';
299 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
300}
301
302static const struct file_operations use_debug_keys_fops = {
303 .open = simple_open,
304 .read = use_debug_keys_read,
305 .llseek = default_llseek,
306};
307
babdbb3c
MH		 308static int dev_class_show(struct seq_file *f, void *ptr)
309{
310 struct hci_dev *hdev = f->private;
311
312 hci_dev_lock(hdev);
313 seq_printf(f, "0x%.2x%.2x%.2x\n", hdev->dev_class[2],
314 hdev->dev_class[1], hdev->dev_class[0]);
315 hci_dev_unlock(hdev);
316
317 return 0;
318}
319
320static int dev_class_open(struct inode *inode, struct file *file)
321{
322 return single_open(file, dev_class_show, inode->i_private);
323}
324
325static const struct file_operations dev_class_fops = {
326 .open = dev_class_open,
327 .read = seq_read,
328 .llseek = seq_lseek,
329 .release = single_release,
330};
331
041000b9
MH		 332static int voice_setting_get(void *data, u64 *val)
333{
334 struct hci_dev *hdev = data;
335
336 hci_dev_lock(hdev);
337 *val = hdev->voice_setting;
338 hci_dev_unlock(hdev);
339
340 return 0;
341}
342
343DEFINE_SIMPLE_ATTRIBUTE(voice_setting_fops, voice_setting_get,
344 NULL, "0x%4.4llx\n");
345
ebd1e33b
MH		 346static int auto_accept_delay_set(void *data, u64 val)
347{
348 struct hci_dev *hdev = data;
349
350 hci_dev_lock(hdev);
351 hdev->auto_accept_delay = val;
352 hci_dev_unlock(hdev);
353
354 return 0;
355}
356
357static int auto_accept_delay_get(void *data, u64 *val)
358{
359 struct hci_dev *hdev = data;
360
361 hci_dev_lock(hdev);
362 *val = hdev->auto_accept_delay;
363 hci_dev_unlock(hdev);
364
365 return 0;
366}
367
368DEFINE_SIMPLE_ATTRIBUTE(auto_accept_delay_fops, auto_accept_delay_get,
369 auto_accept_delay_set, "%llu\n");
370
06f5b778
MH		 371static int ssp_debug_mode_set(void *data, u64 val)
372{
373 struct hci_dev *hdev = data;
374 struct sk_buff *skb;
375 __u8 mode;
376 int err;
377
378 if (val != 0 && val != 1)
379 return -EINVAL;
380
381 if (!test_bit(HCI_UP, &hdev->flags))
382 return -ENETDOWN;
383
384 hci_req_lock(hdev);
385 mode = val;
386 skb = __hci_cmd_sync(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, sizeof(mode),
387 &mode, HCI_CMD_TIMEOUT);
388 hci_req_unlock(hdev);
389
390 if (IS_ERR(skb))
391 return PTR_ERR(skb);
392
393 err = -bt_to_errno(skb->data[0]);
394 kfree_skb(skb);
395
396 if (err < 0)
397 return err;
398
399 hci_dev_lock(hdev);
400 hdev->ssp_debug_mode = val;
401 hci_dev_unlock(hdev);
402
403 return 0;
404}
405
406static int ssp_debug_mode_get(void *data, u64 *val)
407{
408 struct hci_dev *hdev = data;
409
410 hci_dev_lock(hdev);
411 *val = hdev->ssp_debug_mode;
412 hci_dev_unlock(hdev);
413
414 return 0;
415}
416
417DEFINE_SIMPLE_ATTRIBUTE(ssp_debug_mode_fops, ssp_debug_mode_get,
418 ssp_debug_mode_set, "%llu\n");
419
2bfa3531
MH		 420static int idle_timeout_set(void *data, u64 val)
421{
422 struct hci_dev *hdev = data;
423
424 if (val != 0 && (val < 500 || val > 3600000))
425 return -EINVAL;
426
427 hci_dev_lock(hdev);
428 hdev->idle_timeout= val;
429 hci_dev_unlock(hdev);
430
431 return 0;
432}
433
434static int idle_timeout_get(void *data, u64 *val)
435{
436 struct hci_dev *hdev = data;
437
438 hci_dev_lock(hdev);
439 *val = hdev->idle_timeout;
440 hci_dev_unlock(hdev);
441
442 return 0;
443}
444
445DEFINE_SIMPLE_ATTRIBUTE(idle_timeout_fops, idle_timeout_get,
446 idle_timeout_set, "%llu\n");
447
448static int sniff_min_interval_set(void *data, u64 val)
449{
450 struct hci_dev *hdev = data;
451
452 if (val == 0 || val % 2 || val > hdev->sniff_max_interval)
453 return -EINVAL;
454
455 hci_dev_lock(hdev);
456 hdev->sniff_min_interval= val;
457 hci_dev_unlock(hdev);
458
459 return 0;
460}
461
462static int sniff_min_interval_get(void *data, u64 *val)
463{
464 struct hci_dev *hdev = data;
465
466 hci_dev_lock(hdev);
467 *val = hdev->sniff_min_interval;
468 hci_dev_unlock(hdev);
469
470 return 0;
471}
472
473DEFINE_SIMPLE_ATTRIBUTE(sniff_min_interval_fops, sniff_min_interval_get,
474 sniff_min_interval_set, "%llu\n");
475
476static int sniff_max_interval_set(void *data, u64 val)
477{
478 struct hci_dev *hdev = data;
479
480 if (val == 0 || val % 2 || val < hdev->sniff_min_interval)
481 return -EINVAL;
482
483 hci_dev_lock(hdev);
484 hdev->sniff_max_interval= val;
485 hci_dev_unlock(hdev);
486
487 return 0;
488}
489
490static int sniff_max_interval_get(void *data, u64 *val)
491{
492 struct hci_dev *hdev = data;
493
494 hci_dev_lock(hdev);
495 *val = hdev->sniff_max_interval;
496 hci_dev_unlock(hdev);
497
498 return 0;
499}
500
501DEFINE_SIMPLE_ATTRIBUTE(sniff_max_interval_fops, sniff_max_interval_get,
502 sniff_max_interval_set, "%llu\n");
503
e7b8fc92
MH		 504static int static_address_show(struct seq_file *f, void *p)
505{
506 struct hci_dev *hdev = f->private;
507
508 hci_dev_lock(hdev);
509 seq_printf(f, "%pMR\n", &hdev->static_addr);
510 hci_dev_unlock(hdev);
511
512 return 0;
513}
514
515static int static_address_open(struct inode *inode, struct file *file)
516{
517 return single_open(file, static_address_show, inode->i_private);
518}
519
520static const struct file_operations static_address_fops = {
521 .open = static_address_open,
522 .read = seq_read,
523 .llseek = seq_lseek,
524 .release = single_release,
525};
526
92202185
MH		 527static int own_address_type_set(void *data, u64 val)
528{
529 struct hci_dev *hdev = data;
530
531 if (val != 0 && val != 1)
532 return -EINVAL;
533
534 hci_dev_lock(hdev);
535 hdev->own_addr_type = val;
536 hci_dev_unlock(hdev);
537
538 return 0;
539}
540
541static int own_address_type_get(void *data, u64 *val)
542{
543 struct hci_dev *hdev = data;
544
545 hci_dev_lock(hdev);
546 *val = hdev->own_addr_type;
547 hci_dev_unlock(hdev);
548
549 return 0;
550}
551
552DEFINE_SIMPLE_ATTRIBUTE(own_address_type_fops, own_address_type_get,
553 own_address_type_set, "%llu\n");
554
8f8625cd
MH		 555static int long_term_keys_show(struct seq_file *f, void *ptr)
556{
557 struct hci_dev *hdev = f->private;
558 struct list_head *p, *n;
559
560 hci_dev_lock(hdev);
561 list_for_each_safe(p, n, &hdev->link_keys) {
562 struct smp_ltk *ltk = list_entry(p, struct smp_ltk, list);
563 seq_printf(f, "%pMR (type %u) %u %u %u %.4x %*phN %*phN\\n",
564 &ltk->bdaddr, ltk->bdaddr_type, ltk->authenticated,
565 ltk->type, ltk->enc_size, __le16_to_cpu(ltk->ediv),
566 8, ltk->rand, 16, ltk->val);
567 }
568 hci_dev_unlock(hdev);
569
570 return 0;
571}
572
573static int long_term_keys_open(struct inode *inode, struct file *file)
574{
575 return single_open(file, long_term_keys_show, inode->i_private);
576}
577
578static const struct file_operations long_term_keys_fops = {
579 .open = long_term_keys_open,
580 .read = seq_read,
581 .llseek = seq_lseek,
582 .release = single_release,
583};
584
4e70c7e7
MH		 585static int conn_min_interval_set(void *data, u64 val)
586{
587 struct hci_dev *hdev = data;
588
589 if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval)
590 return -EINVAL;
591
592 hci_dev_lock(hdev);
593 hdev->le_conn_min_interval= val;
594 hci_dev_unlock(hdev);
595
596 return 0;
597}
598
599static int conn_min_interval_get(void *data, u64 *val)
600{
601 struct hci_dev *hdev = data;
602
603 hci_dev_lock(hdev);
604 *val = hdev->le_conn_min_interval;
605 hci_dev_unlock(hdev);
606
607 return 0;
608}
609
610DEFINE_SIMPLE_ATTRIBUTE(conn_min_interval_fops, conn_min_interval_get,
611 conn_min_interval_set, "%llu\n");
612
613static int conn_max_interval_set(void *data, u64 val)
614{
615 struct hci_dev *hdev = data;
616
617 if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval)
618 return -EINVAL;
619
620 hci_dev_lock(hdev);
621 hdev->le_conn_max_interval= val;
622 hci_dev_unlock(hdev);
623
624 return 0;
625}
626
627static int conn_max_interval_get(void *data, u64 *val)
628{
629 struct hci_dev *hdev = data;
630
631 hci_dev_lock(hdev);
632 *val = hdev->le_conn_max_interval;
633 hci_dev_unlock(hdev);
634
635 return 0;
636}
637
638DEFINE_SIMPLE_ATTRIBUTE(conn_max_interval_fops, conn_max_interval_get,
639 conn_max_interval_set, "%llu\n");
640
1da177e4
LT		 641/* ---- HCI requests ---- */
642
42c6b129 643static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
1da177e4 644{
42c6b129 645 BT_DBG("%s result 0x%2.2x", hdev->name, result);
1da177e4
LT		 646
647 if (hdev->req_status == HCI_REQ_PEND) {
648 hdev->req_result = result;
649 hdev->req_status = HCI_REQ_DONE;
650 wake_up_interruptible(&hdev->req_wait_q);
651 }
652}
653
654static void hci_req_cancel(struct hci_dev *hdev, int err)
655{
656 BT_DBG("%s err 0x%2.2x", hdev->name, err);
657
658 if (hdev->req_status == HCI_REQ_PEND) {
659 hdev->req_result = err;
660 hdev->req_status = HCI_REQ_CANCELED;
661 wake_up_interruptible(&hdev->req_wait_q);
662 }
663}
664
77a63e0a
FW		 665static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
666 u8 event)
75e84b7c
JH		 667{
668 struct hci_ev_cmd_complete *ev;
669 struct hci_event_hdr *hdr;
670 struct sk_buff *skb;
671
672 hci_dev_lock(hdev);
673
674 skb = hdev->recv_evt;
675 hdev->recv_evt = NULL;
676
677 hci_dev_unlock(hdev);
678
679 if (!skb)
680 return ERR_PTR(-ENODATA);
681
682 if (skb->len < sizeof(*hdr)) {
683 BT_ERR("Too short HCI event");
684 goto failed;
685 }
686
687 hdr = (void *) skb->data;
688 skb_pull(skb, HCI_EVENT_HDR_SIZE);
689
7b1abbbe
JH		 690 if (event) {
691 if (hdr->evt != event)
692 goto failed;
693 return skb;
694 }
695
75e84b7c
JH		 696 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
697 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
698 goto failed;
699 }
700
701 if (skb->len < sizeof(*ev)) {
702 BT_ERR("Too short cmd_complete event");
703 goto failed;
704 }
705
706 ev = (void *) skb->data;
707 skb_pull(skb, sizeof(*ev));
708
709 if (opcode == __le16_to_cpu(ev->opcode))
710 return skb;
711
712 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
713 __le16_to_cpu(ev->opcode));
714
715failed:
716 kfree_skb(skb);
717 return ERR_PTR(-ENODATA);
718}
719
7b1abbbe 720struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
07dc93dd 721 const void *param, u8 event, u32 timeout)
75e84b7c
JH		 722{
723 DECLARE_WAITQUEUE(wait, current);
724 struct hci_request req;
725 int err = 0;
726
727 BT_DBG("%s", hdev->name);
728
729 hci_req_init(&req, hdev);
730
7b1abbbe 731 hci_req_add_ev(&req, opcode, plen, param, event);
75e84b7c
JH		 732
733 hdev->req_status = HCI_REQ_PEND;
734
735 err = hci_req_run(&req, hci_req_sync_complete);
736 if (err < 0)
737 return ERR_PTR(err);
738
739 add_wait_queue(&hdev->req_wait_q, &wait);
740 set_current_state(TASK_INTERRUPTIBLE);
741
742 schedule_timeout(timeout);
743
744 remove_wait_queue(&hdev->req_wait_q, &wait);
745
746 if (signal_pending(current))
747 return ERR_PTR(-EINTR);
748
749 switch (hdev->req_status) {
750 case HCI_REQ_DONE:
751 err = -bt_to_errno(hdev->req_result);
752 break;
753
754 case HCI_REQ_CANCELED:
755 err = -hdev->req_result;
756 break;
757
758 default:
759 err = -ETIMEDOUT;
760 break;
761 }
762
763 hdev->req_status = hdev->req_result = 0;
764
765 BT_DBG("%s end: err %d", hdev->name, err);
766
767 if (err < 0)
768 return ERR_PTR(err);
769
7b1abbbe
JH		 770 return hci_get_cmd_complete(hdev, opcode, event);
771}
772EXPORT_SYMBOL(__hci_cmd_sync_ev);
773
774struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
07dc93dd 775 const void *param, u32 timeout)
7b1abbbe
JH		 776{
777 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
75e84b7c
JH		 778}
779EXPORT_SYMBOL(__hci_cmd_sync);
780
1da177e4 781/* Execute request and wait for completion. */
01178cd4 782static int __hci_req_sync(struct hci_dev *hdev,
42c6b129
JH		 783 void (*func)(struct hci_request *req,
784 unsigned long opt),
01178cd4 785 unsigned long opt, __u32 timeout)
1da177e4 786{
42c6b129 787 struct hci_request req;
1da177e4
LT		 788 DECLARE_WAITQUEUE(wait, current);
789 int err = 0;
790
791 BT_DBG("%s start", hdev->name);
792
42c6b129
JH		 793 hci_req_init(&req, hdev);
794
1da177e4
LT		 795 hdev->req_status = HCI_REQ_PEND;
796
42c6b129 797 func(&req, opt);
53cce22d 798
42c6b129
JH		 799 err = hci_req_run(&req, hci_req_sync_complete);
800 if (err < 0) {
53cce22d 801 hdev->req_status = 0;
920c8300
AG		 802
803 /* ENODATA means the HCI request command queue is empty.
804 * This can happen when a request with conditionals doesn't
805 * trigger any commands to be sent. This is normal behavior
806 * and should not trigger an error return.
42c6b129 807 */
920c8300
AG		 808 if (err == -ENODATA)
809 return 0;
810
811 return err;
53cce22d
JH		 812 }
813
bc4445c7
AG		 814 add_wait_queue(&hdev->req_wait_q, &wait);
815 set_current_state(TASK_INTERRUPTIBLE);
816
1da177e4
LT		 817 schedule_timeout(timeout);
818
819 remove_wait_queue(&hdev->req_wait_q, &wait);
820
821 if (signal_pending(current))
822 return -EINTR;
823
824 switch (hdev->req_status) {
825 case HCI_REQ_DONE:
e175072f 826 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 827 break;
828
829 case HCI_REQ_CANCELED:
830 err = -hdev->req_result;
831 break;
832
833 default:
834 err = -ETIMEDOUT;
835 break;
3ff50b79 836 }
1da177e4 837
a5040efa 838 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 839
840 BT_DBG("%s end: err %d", hdev->name, err);
841
842 return err;
843}
844
01178cd4 845static int hci_req_sync(struct hci_dev *hdev,
42c6b129
JH		 846 void (*req)(struct hci_request *req,
847 unsigned long opt),
01178cd4 848 unsigned long opt, __u32 timeout)
1da177e4
LT		 849{
850 int ret;
851
7c6a329e
MH		 852 if (!test_bit(HCI_UP, &hdev->flags))
853 return -ENETDOWN;
854
1da177e4
LT		 855 /* Serialize all requests */
856 hci_req_lock(hdev);
01178cd4 857 ret = __hci_req_sync(hdev, req, opt, timeout);
1da177e4
LT		 858 hci_req_unlock(hdev);
859
860 return ret;
861}
862
42c6b129 863static void hci_reset_req(struct hci_request *req, unsigned long opt)
1da177e4 864{
42c6b129 865 BT_DBG("%s %ld", req->hdev->name, opt);
1da177e4
LT		 866
867 /* Reset device */
42c6b129
JH		 868 set_bit(HCI_RESET, &req->hdev->flags);
869 hci_req_add(req, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 870}
871
42c6b129 872static void bredr_init(struct hci_request *req)
1da177e4 873{
42c6b129 874 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
2455a3ea 875
1da177e4 876 /* Read Local Supported Features */
42c6b129 877 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 878
1143e5a6 879 /* Read Local Version */
42c6b129 880 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
2177bab5
JH		 881
882 /* Read BD Address */
42c6b129 883 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1da177e4
LT		 884}
885
42c6b129 886static void amp_init(struct hci_request *req)
e61ef499 887{
42c6b129 888 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
2455a3ea 889
e61ef499 890 /* Read Local Version */
42c6b129 891 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489 892
f6996cfe
MH		 893 /* Read Local Supported Commands */
894 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
895
896 /* Read Local Supported Features */
897 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
898
6bcbc489 899 /* Read Local AMP Info */
42c6b129 900 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 901
902 /* Read Data Blk size */
42c6b129 903 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
7528ca1c 904
f38ba941
MH		 905 /* Read Flow Control Mode */
906 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
907
7528ca1c
MH		 908 /* Read Location Data */
909 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
e61ef499
AE		 910}
911
42c6b129 912static void hci_init1_req(struct hci_request *req, unsigned long opt)
e61ef499 913{
42c6b129 914 struct hci_dev *hdev = req->hdev;
e61ef499
AE		 915
916 BT_DBG("%s %ld", hdev->name, opt);
917
11778716
AE		 918 /* Reset */
919 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
42c6b129 920 hci_reset_req(req, 0);
11778716 921
e61ef499
AE		 922 switch (hdev->dev_type) {
923 case HCI_BREDR:
42c6b129 924 bredr_init(req);
e61ef499
AE		 925 break;
926
927 case HCI_AMP:
42c6b129 928 amp_init(req);
e61ef499
AE		 929 break;
930
931 default:
932 BT_ERR("Unknown device type %d", hdev->dev_type);
933 break;
934 }
e61ef499
AE		 935}
936
42c6b129 937static void bredr_setup(struct hci_request *req)
2177bab5 938{
4ca048e3
MH		 939 struct hci_dev *hdev = req->hdev;
940
2177bab5
JH		 941 __le16 param;
942 __u8 flt_type;
943
944 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
42c6b129 945 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 946
947 /* Read Class of Device */
42c6b129 948 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
2177bab5
JH		 949
950 /* Read Local Name */
42c6b129 951 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
2177bab5
JH		 952
953 /* Read Voice Setting */
42c6b129 954 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
2177bab5 955
b4cb9fb2
MH		 956 /* Read Number of Supported IAC */
957 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
958
4b836f39
MH		 959 /* Read Current IAC LAP */
960 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
961
2177bab5
JH		 962 /* Clear Event Filters */
963 flt_type = HCI_FLT_CLEAR_ALL;
42c6b129 964 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
2177bab5
JH		 965
966 /* Connection accept timeout ~20 secs */
967 param = __constant_cpu_to_le16(0x7d00);
42c6b129 968 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
2177bab5 969
4ca048e3
MH		 970 /* AVM Berlin (31), aka "BlueFRITZ!", reports version 1.2,
971 * but it does not support page scan related HCI commands.
972 */
973 if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1) {
f332ec66
JH		 974 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
975 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
976 }
2177bab5
JH		 977}
978
42c6b129 979static void le_setup(struct hci_request *req)
2177bab5 980{
c73eee91
JH		 981 struct hci_dev *hdev = req->hdev;
982
2177bab5 983 /* Read LE Buffer Size */
42c6b129 984 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 985
986 /* Read LE Local Supported Features */
42c6b129 987 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
2177bab5
JH		 988
989 /* Read LE Advertising Channel TX Power */
42c6b129 990 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
2177bab5
JH		 991
992 /* Read LE White List Size */
42c6b129 993 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
2177bab5
JH		 994
995 /* Read LE Supported States */
42c6b129 996 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
c73eee91
JH		 997
998 /* LE-only controllers have LE implicitly enabled */
999 if (!lmp_bredr_capable(hdev))
1000 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2177bab5
JH		 1001}
1002
1003static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
1004{
1005 if (lmp_ext_inq_capable(hdev))
1006 return 0x02;
1007
1008 if (lmp_inq_rssi_capable(hdev))
1009 return 0x01;
1010
1011 if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
1012 hdev->lmp_subver == 0x0757)
1013 return 0x01;
1014
1015 if (hdev->manufacturer == 15) {
1016 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
1017 return 0x01;
1018 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
1019 return 0x01;
1020 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
1021 return 0x01;
1022 }
1023
1024 if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
1025 hdev->lmp_subver == 0x1805)
1026 return 0x01;
1027
1028 return 0x00;
1029}
1030
42c6b129 1031static void hci_setup_inquiry_mode(struct hci_request *req)
2177bab5
JH		 1032{
1033 u8 mode;
1034
42c6b129 1035 mode = hci_get_inquiry_mode(req->hdev);
2177bab5 1036
42c6b129 1037 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
2177bab5
JH		 1038}
1039
42c6b129 1040static void hci_setup_event_mask(struct hci_request *req)
2177bab5 1041{
42c6b129
JH		 1042 struct hci_dev *hdev = req->hdev;
1043
2177bab5
JH		 1044 /* The second byte is 0xff instead of 0x9f (two reserved bits
1045 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
1046 * command otherwise.
1047 */
1048 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
1049
1050 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
1051 * any event mask for pre 1.2 devices.
1052 */
1053 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1054 return;
1055
1056 if (lmp_bredr_capable(hdev)) {
1057 events[4] |= 0x01; /* Flow Specification Complete */
1058 events[4] |= 0x02; /* Inquiry Result with RSSI */
1059 events[4] |= 0x04; /* Read Remote Extended Features Complete */
1060 events[5] |= 0x08; /* Synchronous Connection Complete */
1061 events[5] |= 0x10; /* Synchronous Connection Changed */
c7882cbd
MH		 1062 } else {
1063 /* Use a different default for LE-only devices */
1064 memset(events, 0, sizeof(events));
1065 events[0] |= 0x10; /* Disconnection Complete */
1066 events[0] |= 0x80; /* Encryption Change */
1067 events[1] |= 0x08; /* Read Remote Version Information Complete */
1068 events[1] |= 0x20; /* Command Complete */
1069 events[1] |= 0x40; /* Command Status */
1070 events[1] |= 0x80; /* Hardware Error */
1071 events[2] |= 0x04; /* Number of Completed Packets */
1072 events[3] |= 0x02; /* Data Buffer Overflow */
1073 events[5] |= 0x80; /* Encryption Key Refresh Complete */
2177bab5
JH		 1074 }
1075
1076 if (lmp_inq_rssi_capable(hdev))
1077 events[4] |= 0x02; /* Inquiry Result with RSSI */
1078
1079 if (lmp_sniffsubr_capable(hdev))
1080 events[5] |= 0x20; /* Sniff Subrating */
1081
1082 if (lmp_pause_enc_capable(hdev))
1083 events[5] |= 0x80; /* Encryption Key Refresh Complete */
1084
1085 if (lmp_ext_inq_capable(hdev))
1086 events[5] |= 0x40; /* Extended Inquiry Result */
1087
1088 if (lmp_no_flush_capable(hdev))
1089 events[7] |= 0x01; /* Enhanced Flush Complete */
1090
1091 if (lmp_lsto_capable(hdev))
1092 events[6] |= 0x80; /* Link Supervision Timeout Changed */
1093
1094 if (lmp_ssp_capable(hdev)) {
1095 events[6] |= 0x01; /* IO Capability Request */
1096 events[6] |= 0x02; /* IO Capability Response */
1097 events[6] |= 0x04; /* User Confirmation Request */
1098 events[6] |= 0x08; /* User Passkey Request */
1099 events[6] |= 0x10; /* Remote OOB Data Request */
1100 events[6] |= 0x20; /* Simple Pairing Complete */
1101 events[7] |= 0x04; /* User Passkey Notification */
1102 events[7] |= 0x08; /* Keypress Notification */
1103 events[7] |= 0x10; /* Remote Host Supported
1104 * Features Notification
1105 */
1106 }
1107
1108 if (lmp_le_capable(hdev))
1109 events[7] |= 0x20; /* LE Meta-Event */
1110
42c6b129 1111 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
2177bab5
JH		 1112
1113 if (lmp_le_capable(hdev)) {
1114 memset(events, 0, sizeof(events));
1115 events[0] = 0x1f;
42c6b129
JH		 1116 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK,
1117 sizeof(events), events);
2177bab5
JH		 1118 }
1119}
1120
42c6b129 1121static void hci_init2_req(struct hci_request *req, unsigned long opt)
2177bab5 1122{
42c6b129
JH		 1123 struct hci_dev *hdev = req->hdev;
1124
2177bab5 1125 if (lmp_bredr_capable(hdev))
42c6b129 1126 bredr_setup(req);
56f87901
JH		 1127 else
1128 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
2177bab5
JH		 1129
1130 if (lmp_le_capable(hdev))
42c6b129 1131 le_setup(req);
2177bab5 1132
42c6b129 1133 hci_setup_event_mask(req);
2177bab5 1134
3f8e2d75
JH		 1135 /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
1136 * local supported commands HCI command.
1137 */
1138 if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
42c6b129 1139 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
2177bab5
JH		 1140
1141 if (lmp_ssp_capable(hdev)) {
57af75a8
MH		 1142 /* When SSP is available, then the host features page
1143 * should also be available as well. However some
1144 * controllers list the max_page as 0 as long as SSP
1145 * has not been enabled. To achieve proper debugging
1146 * output, force the minimum max_page to 1 at least.
1147 */
1148 hdev->max_page = 0x01;
1149
2177bab5
JH		 1150 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1151 u8 mode = 0x01;
42c6b129
JH		 1152 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
1153 sizeof(mode), &mode);
2177bab5
JH		 1154 } else {
1155 struct hci_cp_write_eir cp;
1156
1157 memset(hdev->eir, 0, sizeof(hdev->eir));
1158 memset(&cp, 0, sizeof(cp));
1159
42c6b129 1160 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
2177bab5
JH		 1161 }
1162 }
1163
1164 if (lmp_inq_rssi_capable(hdev))
42c6b129 1165 hci_setup_inquiry_mode(req);
2177bab5
JH		 1166
1167 if (lmp_inq_tx_pwr_capable(hdev))
42c6b129 1168 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
2177bab5
JH		 1169
1170 if (lmp_ext_feat_capable(hdev)) {
1171 struct hci_cp_read_local_ext_features cp;
1172
1173 cp.page = 0x01;
42c6b129
JH		 1174 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
1175 sizeof(cp), &cp);
2177bab5
JH		 1176 }
1177
1178 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
1179 u8 enable = 1;
42c6b129
JH		 1180 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
1181 &enable);
2177bab5
JH		 1182 }
1183}
1184
42c6b129 1185static void hci_setup_link_policy(struct hci_request *req)
2177bab5 1186{
42c6b129 1187 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 1188 struct hci_cp_write_def_link_policy cp;
1189 u16 link_policy = 0;
1190
1191 if (lmp_rswitch_capable(hdev))
1192 link_policy |= HCI_LP_RSWITCH;
1193 if (lmp_hold_capable(hdev))
1194 link_policy |= HCI_LP_HOLD;
1195 if (lmp_sniff_capable(hdev))
1196 link_policy |= HCI_LP_SNIFF;
1197 if (lmp_park_capable(hdev))
1198 link_policy |= HCI_LP_PARK;
1199
1200 cp.policy = cpu_to_le16(link_policy);
42c6b129 1201 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
2177bab5
JH		 1202}
1203
42c6b129 1204static void hci_set_le_support(struct hci_request *req)
2177bab5 1205{
42c6b129 1206 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 1207 struct hci_cp_write_le_host_supported cp;
1208
c73eee91
JH		 1209 /* LE-only devices do not support explicit enablement */
1210 if (!lmp_bredr_capable(hdev))
1211 return;
1212
2177bab5
JH		 1213 memset(&cp, 0, sizeof(cp));
1214
1215 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1216 cp.le = 0x01;
1217 cp.simul = lmp_le_br_capable(hdev);
1218 }
1219
1220 if (cp.le != lmp_host_le_capable(hdev))
42c6b129
JH		 1221 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
1222 &cp);
2177bab5
JH		 1223}
1224
d62e6d67
JH		 1225static void hci_set_event_mask_page_2(struct hci_request *req)
1226{
1227 struct hci_dev *hdev = req->hdev;
1228 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1229
1230 /* If Connectionless Slave Broadcast master role is supported
1231 * enable all necessary events for it.
1232 */
1233 if (hdev->features[2][0] & 0x01) {
1234 events[1] |= 0x40; /* Triggered Clock Capture */
1235 events[1] |= 0x80; /* Synchronization Train Complete */
1236 events[2] |= 0x10; /* Slave Page Response Timeout */
1237 events[2] |= 0x20; /* CSB Channel Map Change */
1238 }
1239
1240 /* If Connectionless Slave Broadcast slave role is supported
1241 * enable all necessary events for it.
1242 */
1243 if (hdev->features[2][0] & 0x02) {
1244 events[2] |= 0x01; /* Synchronization Train Received */
1245 events[2] |= 0x02; /* CSB Receive */
1246 events[2] |= 0x04; /* CSB Timeout */
1247 events[2] |= 0x08; /* Truncated Page Complete */
1248 }
1249
1250 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
1251}
1252
42c6b129 1253static void hci_init3_req(struct hci_request *req, unsigned long opt)
2177bab5 1254{
42c6b129 1255 struct hci_dev *hdev = req->hdev;
d2c5d77f 1256 u8 p;
42c6b129 1257
b8f4e068
GP		 1258 /* Some Broadcom based Bluetooth controllers do not support the
1259 * Delete Stored Link Key command. They are clearly indicating its
1260 * absence in the bit mask of supported commands.
1261 *
1262 * Check the supported commands and only if the the command is marked
1263 * as supported send it. If not supported assume that the controller
1264 * does not have actual support for stored link keys which makes this
1265 * command redundant anyway.
637b4cae 1266 */
59f45d57
JH		 1267 if (hdev->commands[6] & 0x80) {
1268 struct hci_cp_delete_stored_link_key cp;
1269
1270 bacpy(&cp.bdaddr, BDADDR_ANY);
1271 cp.delete_all = 0x01;
1272 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
1273 sizeof(cp), &cp);
1274 }
1275
2177bab5 1276 if (hdev->commands[5] & 0x10)
42c6b129 1277 hci_setup_link_policy(req);
2177bab5 1278
79830f66
MH		 1279 if (lmp_le_capable(hdev)) {
1280 /* If the controller has a public BD_ADDR, then by
1281 * default use that one. If this is a LE only
1282 * controller without one, default to the random
1283 * address.
1284 */
1285 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1286 hdev->own_addr_type = ADDR_LE_DEV_PUBLIC;
1287 else
1288 hdev->own_addr_type = ADDR_LE_DEV_RANDOM;
1289
42c6b129 1290 hci_set_le_support(req);
79830f66 1291 }
d2c5d77f
JH		 1292
1293 /* Read features beyond page 1 if available */
1294 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
1295 struct hci_cp_read_local_ext_features cp;
1296
1297 cp.page = p;
1298 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
1299 sizeof(cp), &cp);
1300 }
2177bab5
JH		 1301}
1302
5d4e7e8d
JH		 1303static void hci_init4_req(struct hci_request *req, unsigned long opt)
1304{
1305 struct hci_dev *hdev = req->hdev;
1306
d62e6d67
JH		 1307 /* Set event mask page 2 if the HCI command for it is supported */
1308 if (hdev->commands[22] & 0x04)
1309 hci_set_event_mask_page_2(req);
1310
5d4e7e8d
JH		 1311 /* Check for Synchronization Train support */
1312 if (hdev->features[2][0] & 0x04)
1313 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
1314}
1315
2177bab5
JH		 1316static int __hci_init(struct hci_dev *hdev)
1317{
1318 int err;
1319
1320 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
1321 if (err < 0)
1322 return err;
1323
4b4148e9
MH		 1324 /* The Device Under Test (DUT) mode is special and available for
1325 * all controller types. So just create it early on.
1326 */
1327 if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
1328 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
1329 &dut_mode_fops);
1330 }
1331
2177bab5
JH		 1332 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
1333 * BR/EDR/LE type controllers. AMP controllers only need the
1334 * first stage init.
1335 */
1336 if (hdev->dev_type != HCI_BREDR)
1337 return 0;
1338
1339 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
1340 if (err < 0)
1341 return err;
1342
5d4e7e8d
JH		 1343 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
1344 if (err < 0)
1345 return err;
1346
baf27f6e
MH		 1347 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
1348 if (err < 0)
1349 return err;
1350
1351 /* Only create debugfs entries during the initial setup
1352 * phase and not every time the controller gets powered on.
1353 */
1354 if (!test_bit(HCI_SETUP, &hdev->dev_flags))
1355 return 0;
1356
dfb826a8
MH		 1357 debugfs_create_file("features", 0444, hdev->debugfs, hdev,
1358 &features_fops);
ceeb3bc0
MH		 1359 debugfs_create_u16("manufacturer", 0444, hdev->debugfs,
1360 &hdev->manufacturer);
1361 debugfs_create_u8("hci_version", 0444, hdev->debugfs, &hdev->hci_ver);
1362 debugfs_create_u16("hci_revision", 0444, hdev->debugfs, &hdev->hci_rev);
70afe0b8
MH		 1363 debugfs_create_file("blacklist", 0444, hdev->debugfs, hdev,
1364 &blacklist_fops);
47219839
MH		 1365 debugfs_create_file("uuids", 0444, hdev->debugfs, hdev, &uuids_fops);
1366
baf27f6e
MH		 1367 if (lmp_bredr_capable(hdev)) {
1368 debugfs_create_file("inquiry_cache", 0444, hdev->debugfs,
1369 hdev, &inquiry_cache_fops);
02d08d15
MH		 1370 debugfs_create_file("link_keys", 0400, hdev->debugfs,
1371 hdev, &link_keys_fops);
12c269d7
MH		 1372 debugfs_create_file("use_debug_keys", 0444, hdev->debugfs,
1373 hdev, &use_debug_keys_fops);
babdbb3c
MH		 1374 debugfs_create_file("dev_class", 0444, hdev->debugfs,
1375 hdev, &dev_class_fops);
041000b9
MH		 1376 debugfs_create_file("voice_setting", 0444, hdev->debugfs,
1377 hdev, &voice_setting_fops);
baf27f6e
MH		 1378 }
1379
06f5b778 1380 if (lmp_ssp_capable(hdev)) {
ebd1e33b
MH		 1381 debugfs_create_file("auto_accept_delay", 0644, hdev->debugfs,
1382 hdev, &auto_accept_delay_fops);
06f5b778
MH		 1383 debugfs_create_file("ssp_debug_mode", 0644, hdev->debugfs,
1384 hdev, &ssp_debug_mode_fops);
1385 }
ebd1e33b 1386
2bfa3531
MH		 1387 if (lmp_sniff_capable(hdev)) {
1388 debugfs_create_file("idle_timeout", 0644, hdev->debugfs,
1389 hdev, &idle_timeout_fops);
1390 debugfs_create_file("sniff_min_interval", 0644, hdev->debugfs,
1391 hdev, &sniff_min_interval_fops);
1392 debugfs_create_file("sniff_max_interval", 0644, hdev->debugfs,
1393 hdev, &sniff_max_interval_fops);
1394 }
1395
d0f729b8
MH		 1396 if (lmp_le_capable(hdev)) {
1397 debugfs_create_u8("white_list_size", 0444, hdev->debugfs,
1398 &hdev->le_white_list_size);
e7b8fc92
MH		 1399 debugfs_create_file("static_address", 0444, hdev->debugfs,
1400 hdev, &static_address_fops);
92202185
MH		 1401 debugfs_create_file("own_address_type", 0644, hdev->debugfs,
1402 hdev, &own_address_type_fops);
8f8625cd
MH		 1403 debugfs_create_file("long_term_keys", 0400, hdev->debugfs,
1404 hdev, &long_term_keys_fops);
4e70c7e7
MH		 1405 debugfs_create_file("conn_min_interval", 0644, hdev->debugfs,
1406 hdev, &conn_min_interval_fops);
1407 debugfs_create_file("conn_max_interval", 0644, hdev->debugfs,
1408 hdev, &conn_max_interval_fops);
d0f729b8 1409 }
e7b8fc92 1410
baf27f6e 1411 return 0;
2177bab5
JH		 1412}
1413
42c6b129 1414static void hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1415{
1416 __u8 scan = opt;
1417
42c6b129 1418 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 1419
1420 /* Inquiry and Page scans */
42c6b129 1421 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 1422}
1423
42c6b129 1424static void hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1425{
1426 __u8 auth = opt;
1427
42c6b129 1428 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 1429
1430 /* Authentication */
42c6b129 1431 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 1432}
1433
42c6b129 1434static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1435{
1436 __u8 encrypt = opt;
1437
42c6b129 1438 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 1439
e4e8e37c 1440 /* Encryption */
42c6b129 1441 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 1442}
1443
42c6b129 1444static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 1445{
1446 __le16 policy = cpu_to_le16(opt);
1447
42c6b129 1448 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 1449
1450 /* Default link policy */
42c6b129 1451 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
e4e8e37c
MH		 1452}
1453
8e87d142 1454/* Get HCI device by index.
1da177e4
LT		 1455 * Device is held on return. */
1456struct hci_dev *hci_dev_get(int index)
1457{
8035ded4 1458 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 1459
1460 BT_DBG("%d", index);
1461
1462 if (index < 0)
1463 return NULL;
1464
1465 read_lock(&hci_dev_list_lock);
8035ded4 1466 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 1467 if (d->id == index) {
1468 hdev = hci_dev_hold(d);
1469 break;
1470 }
1471 }
1472 read_unlock(&hci_dev_list_lock);
1473 return hdev;
1474}
1da177e4
LT		 1475
1476/* ---- Inquiry support ---- */
ff9ef578 1477
30dc78e1
JH		 1478bool hci_discovery_active(struct hci_dev *hdev)
1479{
1480 struct discovery_state *discov = &hdev->discovery;
1481
6fbe195d 1482 switch (discov->state) {
343f935b 1483 case DISCOVERY_FINDING:
6fbe195d 1484 case DISCOVERY_RESOLVING:
30dc78e1
JH		 1485 return true;
1486
6fbe195d
AG		 1487 default:
1488 return false;
1489 }
30dc78e1
JH		 1490}
1491
ff9ef578
JH		 1492void hci_discovery_set_state(struct hci_dev *hdev, int state)
1493{
1494 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1495
1496 if (hdev->discovery.state == state)
1497 return;
1498
1499 switch (state) {
1500 case DISCOVERY_STOPPED:
7b99b659
AG		 1501 if (hdev->discovery.state != DISCOVERY_STARTING)
1502 mgmt_discovering(hdev, 0);
ff9ef578
JH		 1503 break;
1504 case DISCOVERY_STARTING:
1505 break;
343f935b 1506 case DISCOVERY_FINDING:
ff9ef578
JH		 1507 mgmt_discovering(hdev, 1);
1508 break;
30dc78e1
JH		 1509 case DISCOVERY_RESOLVING:
1510 break;
ff9ef578
JH		 1511 case DISCOVERY_STOPPING:
1512 break;
1513 }
1514
1515 hdev->discovery.state = state;
1516}
1517
1f9b9a5d 1518void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 1519{
30883512 1520 struct discovery_state *cache = &hdev->discovery;
b57c1a56 1521 struct inquiry_entry *p, *n;
1da177e4 1522
561aafbc
JH		 1523 list_for_each_entry_safe(p, n, &cache->all, all) {
1524 list_del(&p->all);
b57c1a56 1525 kfree(p);
1da177e4 1526 }
561aafbc
JH		 1527
1528 INIT_LIST_HEAD(&cache->unknown);
1529 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 1530}
1531
a8c5fb1a
GP		 1532struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1533 bdaddr_t *bdaddr)
1da177e4 1534{
30883512 1535 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 1536 struct inquiry_entry *e;
1537
6ed93dc6 1538 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 1539
561aafbc
JH		 1540 list_for_each_entry(e, &cache->all, all) {
1541 if (!bacmp(&e->data.bdaddr, bdaddr))
1542 return e;
1543 }
1544
1545 return NULL;
1546}
1547
1548struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 1549 bdaddr_t *bdaddr)
561aafbc 1550{
30883512 1551 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 1552 struct inquiry_entry *e;
1553
6ed93dc6 1554 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 1555
1556 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 1557 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 1558 return e;
1559 }
1560
1561 return NULL;
1da177e4
LT		 1562}
1563
30dc78e1 1564struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 1565 bdaddr_t *bdaddr,
1566 int state)
30dc78e1
JH		 1567{
1568 struct discovery_state *cache = &hdev->discovery;
1569 struct inquiry_entry *e;
1570
6ed93dc6 1571 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 1572
1573 list_for_each_entry(e, &cache->resolve, list) {
1574 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1575 return e;
1576 if (!bacmp(&e->data.bdaddr, bdaddr))
1577 return e;
1578 }
1579
1580 return NULL;
1581}
1582
a3d4e20a 1583void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 1584 struct inquiry_entry *ie)
a3d4e20a
JH		 1585{
1586 struct discovery_state *cache = &hdev->discovery;
1587 struct list_head *pos = &cache->resolve;
1588 struct inquiry_entry *p;
1589
1590 list_del(&ie->list);
1591
1592 list_for_each_entry(p, &cache->resolve, list) {
1593 if (p->name_state != NAME_PENDING &&
a8c5fb1a 1594 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 1595 break;
1596 pos = &p->list;
1597 }
1598
1599 list_add(&ie->list, pos);
1600}
1601
3175405b 1602bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
04124681 1603 bool name_known, bool *ssp)
1da177e4 1604{
30883512 1605 struct discovery_state *cache = &hdev->discovery;
70f23020 1606 struct inquiry_entry *ie;
1da177e4 1607
6ed93dc6 1608 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 1609
2b2fec4d
SJ		 1610 hci_remove_remote_oob_data(hdev, &data->bdaddr);
1611
388fc8fa
JH		 1612 if (ssp)
1613 *ssp = data->ssp_mode;
1614
70f23020 1615 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 1616 if (ie) {
388fc8fa
JH		 1617 if (ie->data.ssp_mode && ssp)
1618 *ssp = true;
1619
a3d4e20a 1620 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 1621 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 1622 ie->data.rssi = data->rssi;
1623 hci_inquiry_cache_update_resolve(hdev, ie);
1624 }
1625
561aafbc 1626 goto update;
a3d4e20a 1627 }
561aafbc
JH		 1628
1629 /* Entry not in the cache. Add new one. */
1630 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
1631 if (!ie)
3175405b 1632 return false;
561aafbc
JH		 1633
1634 list_add(&ie->all, &cache->all);
1635
1636 if (name_known) {
1637 ie->name_state = NAME_KNOWN;
1638 } else {
1639 ie->name_state = NAME_NOT_KNOWN;
1640 list_add(&ie->list, &cache->unknown);
1641 }
70f23020 1642
561aafbc
JH		 1643update:
1644 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 1645 ie->name_state != NAME_PENDING) {
561aafbc
JH		 1646 ie->name_state = NAME_KNOWN;
1647 list_del(&ie->list);
1da177e4
LT		 1648 }
1649
70f23020
AE		 1650 memcpy(&ie->data, data, sizeof(*data));
1651 ie->timestamp = jiffies;
1da177e4 1652 cache->timestamp = jiffies;
3175405b
JH		 1653
1654 if (ie->name_state == NAME_NOT_KNOWN)
1655 return false;
1656
1657 return true;
1da177e4
LT		 1658}
1659
1660static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1661{
30883512 1662 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 1663 struct inquiry_info *info = (struct inquiry_info *) buf;
1664 struct inquiry_entry *e;
1665 int copied = 0;
1666
561aafbc 1667 list_for_each_entry(e, &cache->all, all) {
1da177e4 1668 struct inquiry_data *data = &e->data;
b57c1a56
JH		 1669
1670 if (copied >= num)
1671 break;
1672
1da177e4
LT		 1673 bacpy(&info->bdaddr, &data->bdaddr);
1674 info->pscan_rep_mode = data->pscan_rep_mode;
1675 info->pscan_period_mode = data->pscan_period_mode;
1676 info->pscan_mode = data->pscan_mode;
1677 memcpy(info->dev_class, data->dev_class, 3);
1678 info->clock_offset = data->clock_offset;
b57c1a56 1679
1da177e4 1680 info++;
b57c1a56 1681 copied++;
1da177e4
LT		 1682 }
1683
1684 BT_DBG("cache %p, copied %d", cache, copied);
1685 return copied;
1686}
1687
42c6b129 1688static void hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1689{
1690 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 1691 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 1692 struct hci_cp_inquiry cp;
1693
1694 BT_DBG("%s", hdev->name);
1695
1696 if (test_bit(HCI_INQUIRY, &hdev->flags))
1697 return;
1698
1699 /* Start Inquiry */
1700 memcpy(&cp.lap, &ir->lap, 3);
1701 cp.length = ir->length;
1702 cp.num_rsp = ir->num_rsp;
42c6b129 1703 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 1704}
1705
3e13fa1e
AG		 1706static int wait_inquiry(void *word)
1707{
1708 schedule();
1709 return signal_pending(current);
1710}
1711
1da177e4
LT		 1712int hci_inquiry(void __user *arg)
1713{
1714 __u8 __user *ptr = arg;
1715 struct hci_inquiry_req ir;
1716 struct hci_dev *hdev;
1717 int err = 0, do_inquiry = 0, max_rsp;
1718 long timeo;
1719 __u8 *buf;
1720
1721 if (copy_from_user(&ir, ptr, sizeof(ir)))
1722 return -EFAULT;
1723
5a08ecce
AE		 1724 hdev = hci_dev_get(ir.dev_id);
1725 if (!hdev)
1da177e4
LT		 1726 return -ENODEV;
1727
0736cfa8
MH		 1728 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1729 err = -EBUSY;
1730 goto done;
1731 }
1732
5b69bef5
MH		 1733 if (hdev->dev_type != HCI_BREDR) {
1734 err = -EOPNOTSUPP;
1735 goto done;
1736 }
1737
56f87901
JH		 1738 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1739 err = -EOPNOTSUPP;
1740 goto done;
1741 }
1742
09fd0de5 1743 hci_dev_lock(hdev);
8e87d142 1744 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 1745 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 1746 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 1747 do_inquiry = 1;
1748 }
09fd0de5 1749 hci_dev_unlock(hdev);
1da177e4 1750
04837f64 1751 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 1752
1753 if (do_inquiry) {
01178cd4
JH		 1754 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1755 timeo);
70f23020
AE		 1756 if (err < 0)
1757 goto done;
3e13fa1e
AG		 1758
1759 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1760 * cleared). If it is interrupted by a signal, return -EINTR.
1761 */
1762 if (wait_on_bit(&hdev->flags, HCI_INQUIRY, wait_inquiry,
1763 TASK_INTERRUPTIBLE))
1764 return -EINTR;
70f23020 1765 }
1da177e4 1766
8fc9ced3
GP		 1767 /* for unlimited number of responses we will use buffer with
1768 * 255 entries
1769 */
1da177e4
LT		 1770 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1771
1772 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1773 * copy it to the user space.
1774 */
01df8c31 1775 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 1776 if (!buf) {
1da177e4
LT		 1777 err = -ENOMEM;
1778 goto done;
1779 }
1780
09fd0de5 1781 hci_dev_lock(hdev);
1da177e4 1782 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 1783 hci_dev_unlock(hdev);
1da177e4
LT		 1784
1785 BT_DBG("num_rsp %d", ir.num_rsp);
1786
1787 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1788 ptr += sizeof(ir);
1789 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 1790 ir.num_rsp))
1da177e4 1791 err = -EFAULT;
8e87d142 1792 } else
1da177e4
LT		 1793 err = -EFAULT;
1794
1795 kfree(buf);
1796
1797done:
1798 hci_dev_put(hdev);
1799 return err;
1800}
1801
cbed0ca1 1802static int hci_dev_do_open(struct hci_dev *hdev)
1da177e4 1803{
1da177e4
LT		 1804 int ret = 0;
1805
1da177e4
LT		 1806 BT_DBG("%s %p", hdev->name, hdev);
1807
1808 hci_req_lock(hdev);
1809
94324962
JH		 1810 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
1811 ret = -ENODEV;
1812 goto done;
1813 }
1814
a5c8f270
MH		 1815 if (!test_bit(HCI_SETUP, &hdev->dev_flags)) {
1816 /* Check for rfkill but allow the HCI setup stage to
1817 * proceed (which in itself doesn't cause any RF activity).
1818 */
1819 if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
1820 ret = -ERFKILL;
1821 goto done;
1822 }
1823
1824 /* Check for valid public address or a configured static
1825 * random adddress, but let the HCI setup proceed to
1826 * be able to determine if there is a public address
1827 * or not.
1828 *
1829 * This check is only valid for BR/EDR controllers
1830 * since AMP controllers do not have an address.
1831 */
1832 if (hdev->dev_type == HCI_BREDR &&
1833 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1834 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1835 ret = -EADDRNOTAVAIL;
1836 goto done;
1837 }
611b30f7
MH		 1838 }
1839
1da177e4
LT		 1840 if (test_bit(HCI_UP, &hdev->flags)) {
1841 ret = -EALREADY;
1842 goto done;
1843 }
1844
1da177e4
LT		 1845 if (hdev->open(hdev)) {
1846 ret = -EIO;
1847 goto done;
1848 }
1849
f41c70c4
MH		 1850 atomic_set(&hdev->cmd_cnt, 1);
1851 set_bit(HCI_INIT, &hdev->flags);
1852
1853 if (hdev->setup && test_bit(HCI_SETUP, &hdev->dev_flags))
1854 ret = hdev->setup(hdev);
1855
1856 if (!ret) {
f41c70c4
MH		 1857 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
1858 set_bit(HCI_RAW, &hdev->flags);
1859
0736cfa8
MH		 1860 if (!test_bit(HCI_RAW, &hdev->flags) &&
1861 !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
f41c70c4 1862 ret = __hci_init(hdev);
1da177e4
LT		 1863 }
1864
f41c70c4
MH		 1865 clear_bit(HCI_INIT, &hdev->flags);
1866
1da177e4
LT		 1867 if (!ret) {
1868 hci_dev_hold(hdev);
1869 set_bit(HCI_UP, &hdev->flags);
1870 hci_notify(hdev, HCI_DEV_UP);
bb4b2a9a 1871 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
0736cfa8 1872 !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
1514b892 1873 hdev->dev_type == HCI_BREDR) {
09fd0de5 1874 hci_dev_lock(hdev);
744cf19e 1875 mgmt_powered(hdev, 1);
09fd0de5 1876 hci_dev_unlock(hdev);
56e5cb86 1877 }
8e87d142 1878 } else {
1da177e4 1879 /* Init failed, cleanup */
3eff45ea 1880 flush_work(&hdev->tx_work);
c347b765 1881 flush_work(&hdev->cmd_work);
b78752cc 1882 flush_work(&hdev->rx_work);
1da177e4
LT		 1883
1884 skb_queue_purge(&hdev->cmd_q);
1885 skb_queue_purge(&hdev->rx_q);
1886
1887 if (hdev->flush)
1888 hdev->flush(hdev);
1889
1890 if (hdev->sent_cmd) {
1891 kfree_skb(hdev->sent_cmd);
1892 hdev->sent_cmd = NULL;
1893 }
1894
1895 hdev->close(hdev);
1896 hdev->flags = 0;
1897 }
1898
1899done:
1900 hci_req_unlock(hdev);
1da177e4
LT		 1901 return ret;
1902}
1903
cbed0ca1
JH		 1904/* ---- HCI ioctl helpers ---- */
1905
1906int hci_dev_open(__u16 dev)
1907{
1908 struct hci_dev *hdev;
1909 int err;
1910
1911 hdev = hci_dev_get(dev);
1912 if (!hdev)
1913 return -ENODEV;
1914
e1d08f40
JH		 1915 /* We need to ensure that no other power on/off work is pending
1916 * before proceeding to call hci_dev_do_open. This is
1917 * particularly important if the setup procedure has not yet
1918 * completed.
1919 */
1920 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1921 cancel_delayed_work(&hdev->power_off);
1922
a5c8f270
MH		 1923 /* After this call it is guaranteed that the setup procedure
1924 * has finished. This means that error conditions like RFKILL
1925 * or no valid public or static random address apply.
1926 */
e1d08f40
JH		 1927 flush_workqueue(hdev->req_workqueue);
1928
cbed0ca1
JH		 1929 err = hci_dev_do_open(hdev);
1930
1931 hci_dev_put(hdev);
1932
1933 return err;
1934}
1935
1da177e4
LT		 1936static int hci_dev_do_close(struct hci_dev *hdev)
1937{
1938 BT_DBG("%s %p", hdev->name, hdev);
1939
78c04c0b
VCG		 1940 cancel_delayed_work(&hdev->power_off);
1941
1da177e4
LT		 1942 hci_req_cancel(hdev, ENODEV);
1943 hci_req_lock(hdev);
1944
1945 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 1946 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 1947 hci_req_unlock(hdev);
1948 return 0;
1949 }
1950
3eff45ea
GP		 1951 /* Flush RX and TX works */
1952 flush_work(&hdev->tx_work);
b78752cc 1953 flush_work(&hdev->rx_work);
1da177e4 1954
16ab91ab 1955 if (hdev->discov_timeout > 0) {
e0f9309f 1956 cancel_delayed_work(&hdev->discov_off);
16ab91ab 1957 hdev->discov_timeout = 0;
5e5282bb 1958 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
310a3d48 1959 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
16ab91ab
JH		 1960 }
1961
a8b2d5c2 1962 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 1963 cancel_delayed_work(&hdev->service_cache);
1964
7ba8b4be
AG		 1965 cancel_delayed_work_sync(&hdev->le_scan_disable);
1966
09fd0de5 1967 hci_dev_lock(hdev);
1f9b9a5d 1968 hci_inquiry_cache_flush(hdev);
1da177e4 1969 hci_conn_hash_flush(hdev);
09fd0de5 1970 hci_dev_unlock(hdev);
1da177e4
LT		 1971
1972 hci_notify(hdev, HCI_DEV_DOWN);
1973
1974 if (hdev->flush)
1975 hdev->flush(hdev);
1976
1977 /* Reset device */
1978 skb_queue_purge(&hdev->cmd_q);
1979 atomic_set(&hdev->cmd_cnt, 1);
8af59467 1980 if (!test_bit(HCI_RAW, &hdev->flags) &&
3a6afbd2 1981 !test_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
a6c511c6 1982 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1da177e4 1983 set_bit(HCI_INIT, &hdev->flags);
01178cd4 1984 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1da177e4
LT		 1985 clear_bit(HCI_INIT, &hdev->flags);
1986 }
1987
c347b765
GP		 1988 /* flush cmd work */
1989 flush_work(&hdev->cmd_work);
1da177e4
LT		 1990
1991 /* Drop queues */
1992 skb_queue_purge(&hdev->rx_q);
1993 skb_queue_purge(&hdev->cmd_q);
1994 skb_queue_purge(&hdev->raw_q);
1995
1996 /* Drop last sent command */
1997 if (hdev->sent_cmd) {
b79f44c1 1998 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 1999 kfree_skb(hdev->sent_cmd);
2000 hdev->sent_cmd = NULL;
2001 }
2002
b6ddb638
JH		 2003 kfree_skb(hdev->recv_evt);
2004 hdev->recv_evt = NULL;
2005
1da177e4
LT		 2006 /* After this point our queues are empty
2007 * and no tasks are scheduled. */
2008 hdev->close(hdev);
2009
35b973c9
JH		 2010 /* Clear flags */
2011 hdev->flags = 0;
2012 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
2013
93c311a0
MH		 2014 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
2015 if (hdev->dev_type == HCI_BREDR) {
2016 hci_dev_lock(hdev);
2017 mgmt_powered(hdev, 0);
2018 hci_dev_unlock(hdev);
2019 }
8ee56540 2020 }
5add6af8 2021
ced5c338 2022 /* Controller radio is available but is currently powered down */
536619e8 2023 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
ced5c338 2024
e59fda8d 2025 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 2026 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
e59fda8d 2027
1da177e4
LT		 2028 hci_req_unlock(hdev);
2029
2030 hci_dev_put(hdev);
2031 return 0;
2032}
2033
2034int hci_dev_close(__u16 dev)
2035{
2036 struct hci_dev *hdev;
2037 int err;
2038
70f23020
AE		 2039 hdev = hci_dev_get(dev);
2040 if (!hdev)
1da177e4 2041 return -ENODEV;
8ee56540 2042
0736cfa8
MH		 2043 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2044 err = -EBUSY;
2045 goto done;
2046 }
2047
8ee56540
MH		 2048 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2049 cancel_delayed_work(&hdev->power_off);
2050
1da177e4 2051 err = hci_dev_do_close(hdev);
8ee56540 2052
0736cfa8 2053done:
1da177e4
LT		 2054 hci_dev_put(hdev);
2055 return err;
2056}
2057
2058int hci_dev_reset(__u16 dev)
2059{
2060 struct hci_dev *hdev;
2061 int ret = 0;
2062
70f23020
AE		 2063 hdev = hci_dev_get(dev);
2064 if (!hdev)
1da177e4
LT		 2065 return -ENODEV;
2066
2067 hci_req_lock(hdev);
1da177e4 2068
808a049e
MH		 2069 if (!test_bit(HCI_UP, &hdev->flags)) {
2070 ret = -ENETDOWN;
1da177e4 2071 goto done;
808a049e 2072 }
1da177e4 2073
0736cfa8
MH		 2074 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2075 ret = -EBUSY;
2076 goto done;
2077 }
2078
1da177e4
LT		 2079 /* Drop queues */
2080 skb_queue_purge(&hdev->rx_q);
2081 skb_queue_purge(&hdev->cmd_q);
2082
09fd0de5 2083 hci_dev_lock(hdev);
1f9b9a5d 2084 hci_inquiry_cache_flush(hdev);
1da177e4 2085 hci_conn_hash_flush(hdev);
09fd0de5 2086 hci_dev_unlock(hdev);
1da177e4
LT		 2087
2088 if (hdev->flush)
2089 hdev->flush(hdev);
2090
8e87d142 2091 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 2092 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 2093
2094 if (!test_bit(HCI_RAW, &hdev->flags))
01178cd4 2095 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1da177e4
LT		 2096
2097done:
1da177e4
LT		 2098 hci_req_unlock(hdev);
2099 hci_dev_put(hdev);
2100 return ret;
2101}
2102
2103int hci_dev_reset_stat(__u16 dev)
2104{
2105 struct hci_dev *hdev;
2106 int ret = 0;
2107
70f23020
AE		 2108 hdev = hci_dev_get(dev);
2109 if (!hdev)
1da177e4
LT		 2110 return -ENODEV;
2111
0736cfa8
MH		 2112 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2113 ret = -EBUSY;
2114 goto done;
2115 }
2116
1da177e4
LT		 2117 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
2118
0736cfa8 2119done:
1da177e4 2120 hci_dev_put(hdev);
1da177e4
LT		 2121 return ret;
2122}
2123
2124int hci_dev_cmd(unsigned int cmd, void __user *arg)
2125{
2126 struct hci_dev *hdev;
2127 struct hci_dev_req dr;
2128 int err = 0;
2129
2130 if (copy_from_user(&dr, arg, sizeof(dr)))
2131 return -EFAULT;
2132
70f23020
AE		 2133 hdev = hci_dev_get(dr.dev_id);
2134 if (!hdev)
1da177e4
LT		 2135 return -ENODEV;
2136
0736cfa8
MH		 2137 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2138 err = -EBUSY;
2139 goto done;
2140 }
2141
5b69bef5
MH		 2142 if (hdev->dev_type != HCI_BREDR) {
2143 err = -EOPNOTSUPP;
2144 goto done;
2145 }
2146
56f87901
JH		 2147 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2148 err = -EOPNOTSUPP;
2149 goto done;
2150 }
2151
1da177e4
LT		 2152 switch (cmd) {
2153 case HCISETAUTH:
01178cd4
JH		 2154 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2155 HCI_INIT_TIMEOUT);
1da177e4
LT		 2156 break;
2157
2158 case HCISETENCRYPT:
2159 if (!lmp_encrypt_capable(hdev)) {
2160 err = -EOPNOTSUPP;
2161 break;
2162 }
2163
2164 if (!test_bit(HCI_AUTH, &hdev->flags)) {
2165 /* Auth must be enabled first */
01178cd4
JH		 2166 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2167 HCI_INIT_TIMEOUT);
1da177e4
LT		 2168 if (err)
2169 break;
2170 }
2171
01178cd4
JH		 2172 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
2173 HCI_INIT_TIMEOUT);
1da177e4
LT		 2174 break;
2175
2176 case HCISETSCAN:
01178cd4
JH		 2177 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
2178 HCI_INIT_TIMEOUT);
1da177e4
LT		 2179 break;
2180
1da177e4 2181 case HCISETLINKPOL:
01178cd4
JH		 2182 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
2183 HCI_INIT_TIMEOUT);
1da177e4
LT		 2184 break;
2185
2186 case HCISETLINKMODE:
e4e8e37c
MH		 2187 hdev->link_mode = ((__u16) dr.dev_opt) &
2188 (HCI_LM_MASTER | HCI_LM_ACCEPT);
2189 break;
2190
2191 case HCISETPTYPE:
2192 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 2193 break;
2194
2195 case HCISETACLMTU:
e4e8e37c
MH		 2196 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
2197 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 2198 break;
2199
2200 case HCISETSCOMTU:
e4e8e37c
MH		 2201 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
2202 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 2203 break;
2204
2205 default:
2206 err = -EINVAL;
2207 break;
2208 }
e4e8e37c 2209
0736cfa8 2210done:
1da177e4
LT		 2211 hci_dev_put(hdev);
2212 return err;
2213}
2214
2215int hci_get_dev_list(void __user *arg)
2216{
8035ded4 2217 struct hci_dev *hdev;
1da177e4
LT		 2218 struct hci_dev_list_req *dl;
2219 struct hci_dev_req *dr;
1da177e4
LT		 2220 int n = 0, size, err;
2221 __u16 dev_num;
2222
2223 if (get_user(dev_num, (__u16 __user *) arg))
2224 return -EFAULT;
2225
2226 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2227 return -EINVAL;
2228
2229 size = sizeof(*dl) + dev_num * sizeof(*dr);
2230
70f23020
AE		 2231 dl = kzalloc(size, GFP_KERNEL);
2232 if (!dl)
1da177e4
LT		 2233 return -ENOMEM;
2234
2235 dr = dl->dev_req;
2236
f20d09d5 2237 read_lock(&hci_dev_list_lock);
8035ded4 2238 list_for_each_entry(hdev, &hci_dev_list, list) {
a8b2d5c2 2239 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
e0f9309f 2240 cancel_delayed_work(&hdev->power_off);
c542a06c 2241
a8b2d5c2
JH		 2242 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2243 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 2244
1da177e4
LT		 2245 (dr + n)->dev_id = hdev->id;
2246 (dr + n)->dev_opt = hdev->flags;
c542a06c 2247
1da177e4
LT		 2248 if (++n >= dev_num)
2249 break;
2250 }
f20d09d5 2251 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 2252
2253 dl->dev_num = n;
2254 size = sizeof(*dl) + n * sizeof(*dr);
2255
2256 err = copy_to_user(arg, dl, size);
2257 kfree(dl);
2258
2259 return err ? -EFAULT : 0;
2260}
2261
2262int hci_get_dev_info(void __user *arg)
2263{
2264 struct hci_dev *hdev;
2265 struct hci_dev_info di;
2266 int err = 0;
2267
2268 if (copy_from_user(&di, arg, sizeof(di)))
2269 return -EFAULT;
2270
70f23020
AE		 2271 hdev = hci_dev_get(di.dev_id);
2272 if (!hdev)
1da177e4
LT		 2273 return -ENODEV;
2274
a8b2d5c2 2275 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
3243553f 2276 cancel_delayed_work_sync(&hdev->power_off);
ab81cbf9 2277
a8b2d5c2
JH		 2278 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2279 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 2280
1da177e4
LT		 2281 strcpy(di.name, hdev->name);
2282 di.bdaddr = hdev->bdaddr;
60f2a3ed 2283 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
1da177e4
LT		 2284 di.flags = hdev->flags;
2285 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 2286 if (lmp_bredr_capable(hdev)) {
2287 di.acl_mtu = hdev->acl_mtu;
2288 di.acl_pkts = hdev->acl_pkts;
2289 di.sco_mtu = hdev->sco_mtu;
2290 di.sco_pkts = hdev->sco_pkts;
2291 } else {
2292 di.acl_mtu = hdev->le_mtu;
2293 di.acl_pkts = hdev->le_pkts;
2294 di.sco_mtu = 0;
2295 di.sco_pkts = 0;
2296 }
1da177e4
LT		 2297 di.link_policy = hdev->link_policy;
2298 di.link_mode = hdev->link_mode;
2299
2300 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2301 memcpy(&di.features, &hdev->features, sizeof(di.features));
2302
2303 if (copy_to_user(arg, &di, sizeof(di)))
2304 err = -EFAULT;
2305
2306 hci_dev_put(hdev);
2307
2308 return err;
2309}
2310
2311/* ---- Interface to HCI drivers ---- */
2312
611b30f7
MH		 2313static int hci_rfkill_set_block(void *data, bool blocked)
2314{
2315 struct hci_dev *hdev = data;
2316
2317 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2318
0736cfa8
MH		 2319 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
2320 return -EBUSY;
2321
5e130367
JH		 2322 if (blocked) {
2323 set_bit(HCI_RFKILLED, &hdev->dev_flags);
bf543036
JH		 2324 if (!test_bit(HCI_SETUP, &hdev->dev_flags))
2325 hci_dev_do_close(hdev);
5e130367
JH		 2326 } else {
2327 clear_bit(HCI_RFKILLED, &hdev->dev_flags);
1025c04c 2328 }
611b30f7
MH		 2329
2330 return 0;
2331}
2332
2333static const struct rfkill_ops hci_rfkill_ops = {
2334 .set_block = hci_rfkill_set_block,
2335};
2336
ab81cbf9
JH		 2337static void hci_power_on(struct work_struct *work)
2338{
2339 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 2340 int err;
ab81cbf9
JH		 2341
2342 BT_DBG("%s", hdev->name);
2343
cbed0ca1 2344 err = hci_dev_do_open(hdev);
96570ffc
JH		 2345 if (err < 0) {
2346 mgmt_set_powered_failed(hdev, err);
ab81cbf9 2347 return;
96570ffc 2348 }
ab81cbf9 2349
a5c8f270
MH		 2350 /* During the HCI setup phase, a few error conditions are
2351 * ignored and they need to be checked now. If they are still
2352 * valid, it is important to turn the device back off.
2353 */
2354 if (test_bit(HCI_RFKILLED, &hdev->dev_flags) ||
2355 (hdev->dev_type == HCI_BREDR &&
2356 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2357 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
bf543036
JH		 2358 clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
2359 hci_dev_do_close(hdev);
2360 } else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
19202573
JH		 2361 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2362 HCI_AUTO_OFF_TIMEOUT);
bf543036 2363 }
ab81cbf9 2364
a8b2d5c2 2365 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
744cf19e 2366 mgmt_index_added(hdev);
ab81cbf9
JH		 2367}
2368
2369static void hci_power_off(struct work_struct *work)
2370{
3243553f 2371 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 2372 power_off.work);
ab81cbf9
JH		 2373
2374 BT_DBG("%s", hdev->name);
2375
8ee56540 2376 hci_dev_do_close(hdev);
ab81cbf9
JH		 2377}
2378
16ab91ab
JH		 2379static void hci_discov_off(struct work_struct *work)
2380{
2381 struct hci_dev *hdev;
16ab91ab
JH		 2382
2383 hdev = container_of(work, struct hci_dev, discov_off.work);
2384
2385 BT_DBG("%s", hdev->name);
2386
d1967ff8 2387 mgmt_discoverable_timeout(hdev);
16ab91ab
JH		 2388}
2389
2aeb9a1a
JH		 2390int hci_uuids_clear(struct hci_dev *hdev)
2391{
4821002c 2392 struct bt_uuid *uuid, *tmp;
2aeb9a1a 2393
4821002c
JH		 2394 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2395 list_del(&uuid->list);
2aeb9a1a
JH		 2396 kfree(uuid);
2397 }
2398
2399 return 0;
2400}
2401
55ed8ca1
JH		 2402int hci_link_keys_clear(struct hci_dev *hdev)
2403{
2404 struct list_head *p, *n;
2405
2406 list_for_each_safe(p, n, &hdev->link_keys) {
2407 struct link_key *key;
2408
2409 key = list_entry(p, struct link_key, list);
2410
2411 list_del(p);
2412 kfree(key);
2413 }
2414
2415 return 0;
2416}
2417
b899efaf
VCG		 2418int hci_smp_ltks_clear(struct hci_dev *hdev)
2419{
2420 struct smp_ltk *k, *tmp;
2421
2422 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
2423 list_del(&k->list);
2424 kfree(k);
2425 }
2426
2427 return 0;
2428}
2429
55ed8ca1
JH		 2430struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2431{
8035ded4 2432 struct link_key *k;
55ed8ca1 2433
8035ded4 2434 list_for_each_entry(k, &hdev->link_keys, list)
55ed8ca1
JH		 2435 if (bacmp(bdaddr, &k->bdaddr) == 0)
2436 return k;
55ed8ca1
JH		 2437
2438 return NULL;
2439}
2440
745c0ce3 2441static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 2442 u8 key_type, u8 old_key_type)
d25e28ab
JH		 2443{
2444 /* Legacy key */
2445 if (key_type < 0x03)
745c0ce3 2446 return true;
d25e28ab
JH		 2447
2448 /* Debug keys are insecure so don't store them persistently */
2449 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 2450 return false;
d25e28ab
JH		 2451
2452 /* Changed combination key and there's no previous one */
2453 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 2454 return false;
d25e28ab
JH		 2455
2456 /* Security mode 3 case */
2457 if (!conn)
745c0ce3 2458 return true;
d25e28ab
JH		 2459
2460 /* Neither local nor remote side had no-bonding as requirement */
2461 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 2462 return true;
d25e28ab
JH		 2463
2464 /* Local side had dedicated bonding as requirement */
2465 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 2466 return true;
d25e28ab
JH		 2467
2468 /* Remote side had dedicated bonding as requirement */
2469 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 2470 return true;
d25e28ab
JH		 2471
2472 /* If none of the above criteria match, then don't store the key
2473 * persistently */
745c0ce3 2474 return false;
d25e28ab
JH		 2475}
2476
c9839a11 2477struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
75d262c2 2478{
c9839a11 2479 struct smp_ltk *k;
75d262c2 2480
c9839a11
VCG		 2481 list_for_each_entry(k, &hdev->long_term_keys, list) {
2482 if (k->ediv != ediv ||
a8c5fb1a 2483 memcmp(rand, k->rand, sizeof(k->rand)))
75d262c2
VCG		 2484 continue;
2485
c9839a11 2486 return k;
75d262c2
VCG		 2487 }
2488
2489 return NULL;
2490}
75d262c2 2491
c9839a11 2492struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 2493 u8 addr_type)
75d262c2 2494{
c9839a11 2495 struct smp_ltk *k;
75d262c2 2496
c9839a11
VCG		 2497 list_for_each_entry(k, &hdev->long_term_keys, list)
2498 if (addr_type == k->bdaddr_type &&
a8c5fb1a 2499 bacmp(bdaddr, &k->bdaddr) == 0)
75d262c2
VCG		 2500 return k;
2501
2502 return NULL;
2503}
75d262c2 2504
d25e28ab 2505int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
04124681 2506 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 2507{
2508 struct link_key *key, *old_key;
745c0ce3
VA		 2509 u8 old_key_type;
2510 bool persistent;
55ed8ca1
JH		 2511
2512 old_key = hci_find_link_key(hdev, bdaddr);
2513 if (old_key) {
2514 old_key_type = old_key->type;
2515 key = old_key;
2516 } else {
12adcf3a 2517 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 2518 key = kzalloc(sizeof(*key), GFP_ATOMIC);
2519 if (!key)
2520 return -ENOMEM;
2521 list_add(&key->list, &hdev->link_keys);
2522 }
2523
6ed93dc6 2524 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 2525
d25e28ab
JH		 2526 /* Some buggy controller combinations generate a changed
2527 * combination key for legacy pairing even when there's no
2528 * previous key */
2529 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 2530 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 2531 type = HCI_LK_COMBINATION;
655fe6ec
JH		 2532 if (conn)
2533 conn->key_type = type;
2534 }
d25e28ab 2535
55ed8ca1 2536 bacpy(&key->bdaddr, bdaddr);
9b3b4460 2537 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 2538 key->pin_len = pin_len;
2539
b6020ba0 2540 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 2541 key->type = old_key_type;
4748fed2
JH		 2542 else
2543 key->type = type;
2544
4df378a1
JH		 2545 if (!new_key)
2546 return 0;
2547
2548 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
2549
744cf19e 2550 mgmt_new_link_key(hdev, key, persistent);
4df378a1 2551
6ec5bcad
VA		 2552 if (conn)
2553 conn->flush_key = !persistent;
55ed8ca1
JH		 2554
2555 return 0;
2556}
2557
c9839a11 2558int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
9a006657 2559 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
04124681 2560 ediv, u8 rand[8])
75d262c2 2561{
c9839a11 2562 struct smp_ltk *key, *old_key;
75d262c2 2563
c9839a11
VCG		 2564 if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
2565 return 0;
75d262c2 2566
c9839a11
VCG		 2567 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
2568 if (old_key)
75d262c2 2569 key = old_key;
c9839a11
VCG		 2570 else {
2571 key = kzalloc(sizeof(*key), GFP_ATOMIC);
75d262c2
VCG		 2572 if (!key)
2573 return -ENOMEM;
c9839a11 2574 list_add(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 2575 }
2576
75d262c2 2577 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 2578 key->bdaddr_type = addr_type;
2579 memcpy(key->val, tk, sizeof(key->val));
2580 key->authenticated = authenticated;
2581 key->ediv = ediv;
2582 key->enc_size = enc_size;
2583 key->type = type;
2584 memcpy(key->rand, rand, sizeof(key->rand));
75d262c2 2585
c9839a11
VCG		 2586 if (!new_key)
2587 return 0;
75d262c2 2588
261cc5aa
VCG		 2589 if (type & HCI_SMP_LTK)
2590 mgmt_new_ltk(hdev, key, 1);
2591
75d262c2
VCG		 2592 return 0;
2593}
2594
55ed8ca1
JH		 2595int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2596{
2597 struct link_key *key;
2598
2599 key = hci_find_link_key(hdev, bdaddr);
2600 if (!key)
2601 return -ENOENT;
2602
6ed93dc6 2603 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1
JH		 2604
2605 list_del(&key->list);
2606 kfree(key);
2607
2608 return 0;
2609}
2610
b899efaf
VCG		 2611int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
2612{
2613 struct smp_ltk *k, *tmp;
2614
2615 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
2616 if (bacmp(bdaddr, &k->bdaddr))
2617 continue;
2618
6ed93dc6 2619 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf
VCG		 2620
2621 list_del(&k->list);
2622 kfree(k);
2623 }
2624
2625 return 0;
2626}
2627
6bd32326 2628/* HCI command timer function */
bda4f23a 2629static void hci_cmd_timeout(unsigned long arg)
6bd32326
VT		 2630{
2631 struct hci_dev *hdev = (void *) arg;
2632
bda4f23a
AE		 2633 if (hdev->sent_cmd) {
2634 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2635 u16 opcode = __le16_to_cpu(sent->opcode);
2636
2637 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
2638 } else {
2639 BT_ERR("%s command tx timeout", hdev->name);
2640 }
2641
6bd32326 2642 atomic_set(&hdev->cmd_cnt, 1);
c347b765 2643 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 2644}
2645
2763eda6 2646struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
04124681 2647 bdaddr_t *bdaddr)
2763eda6
SJ		 2648{
2649 struct oob_data *data;
2650
2651 list_for_each_entry(data, &hdev->remote_oob_data, list)
2652 if (bacmp(bdaddr, &data->bdaddr) == 0)
2653 return data;
2654
2655 return NULL;
2656}
2657
2658int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
2659{
2660 struct oob_data *data;
2661
2662 data = hci_find_remote_oob_data(hdev, bdaddr);
2663 if (!data)
2664 return -ENOENT;
2665
6ed93dc6 2666 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2763eda6
SJ		 2667
2668 list_del(&data->list);
2669 kfree(data);
2670
2671 return 0;
2672}
2673
2674int hci_remote_oob_data_clear(struct hci_dev *hdev)
2675{
2676 struct oob_data *data, *n;
2677
2678 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2679 list_del(&data->list);
2680 kfree(data);
2681 }
2682
2683 return 0;
2684}
2685
2686int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
04124681 2687 u8 *randomizer)
2763eda6
SJ		 2688{
2689 struct oob_data *data;
2690
2691 data = hci_find_remote_oob_data(hdev, bdaddr);
2692
2693 if (!data) {
2694 data = kmalloc(sizeof(*data), GFP_ATOMIC);
2695 if (!data)
2696 return -ENOMEM;
2697
2698 bacpy(&data->bdaddr, bdaddr);
2699 list_add(&data->list, &hdev->remote_oob_data);
2700 }
2701
2702 memcpy(data->hash, hash, sizeof(data->hash));
2703 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
2704
6ed93dc6 2705 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 2706
2707 return 0;
2708}
2709
b9ee0a78
MH		 2710struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
2711 bdaddr_t *bdaddr, u8 type)
b2a66aad 2712{
8035ded4 2713 struct bdaddr_list *b;
b2a66aad 2714
b9ee0a78
MH		 2715 list_for_each_entry(b, &hdev->blacklist, list) {
2716 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
b2a66aad 2717 return b;
b9ee0a78 2718 }
b2a66aad
AJ		 2719
2720 return NULL;
2721}
2722
2723int hci_blacklist_clear(struct hci_dev *hdev)
2724{
2725 struct list_head *p, *n;
2726
2727 list_for_each_safe(p, n, &hdev->blacklist) {
b9ee0a78 2728 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
b2a66aad
AJ		 2729
2730 list_del(p);
2731 kfree(b);
2732 }
2733
2734 return 0;
2735}
2736
88c1fe4b 2737int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2738{
2739 struct bdaddr_list *entry;
b2a66aad 2740
b9ee0a78 2741 if (!bacmp(bdaddr, BDADDR_ANY))
b2a66aad
AJ		 2742 return -EBADF;
2743
b9ee0a78 2744 if (hci_blacklist_lookup(hdev, bdaddr, type))
5e762444 2745 return -EEXIST;
b2a66aad
AJ		 2746
2747 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
5e762444
AJ		 2748 if (!entry)
2749 return -ENOMEM;
b2a66aad
AJ		 2750
2751 bacpy(&entry->bdaddr, bdaddr);
b9ee0a78 2752 entry->bdaddr_type = type;
b2a66aad
AJ		 2753
2754 list_add(&entry->list, &hdev->blacklist);
2755
88c1fe4b 2756 return mgmt_device_blocked(hdev, bdaddr, type);
b2a66aad
AJ		 2757}
2758
88c1fe4b 2759int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2760{
2761 struct bdaddr_list *entry;
b2a66aad 2762
b9ee0a78 2763 if (!bacmp(bdaddr, BDADDR_ANY))
5e762444 2764 return hci_blacklist_clear(hdev);
b2a66aad 2765
b9ee0a78 2766 entry = hci_blacklist_lookup(hdev, bdaddr, type);
1ec918ce 2767 if (!entry)
5e762444 2768 return -ENOENT;
b2a66aad
AJ		 2769
2770 list_del(&entry->list);
2771 kfree(entry);
2772
88c1fe4b 2773 return mgmt_device_unblocked(hdev, bdaddr, type);
b2a66aad
AJ		 2774}
2775
4c87eaab 2776static void inquiry_complete(struct hci_dev *hdev, u8 status)
7ba8b4be 2777{
4c87eaab
AG		 2778 if (status) {
2779 BT_ERR("Failed to start inquiry: status %d", status);
7ba8b4be 2780
4c87eaab
AG		 2781 hci_dev_lock(hdev);
2782 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2783 hci_dev_unlock(hdev);
2784 return;
2785 }
7ba8b4be
AG		 2786}
2787
4c87eaab 2788static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
7ba8b4be 2789{
4c87eaab
AG		 2790 /* General inquiry access code (GIAC) */
2791 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2792 struct hci_request req;
2793 struct hci_cp_inquiry cp;
7ba8b4be
AG		 2794 int err;
2795
4c87eaab
AG		 2796 if (status) {
2797 BT_ERR("Failed to disable LE scanning: status %d", status);
2798 return;
2799 }
7ba8b4be 2800
4c87eaab
AG		 2801 switch (hdev->discovery.type) {
2802 case DISCOV_TYPE_LE:
2803 hci_dev_lock(hdev);
2804 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2805 hci_dev_unlock(hdev);
2806 break;
7ba8b4be 2807
4c87eaab
AG		 2808 case DISCOV_TYPE_INTERLEAVED:
2809 hci_req_init(&req, hdev);
7ba8b4be 2810
4c87eaab
AG		 2811 memset(&cp, 0, sizeof(cp));
2812 memcpy(&cp.lap, lap, sizeof(cp.lap));
2813 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
2814 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
7ba8b4be 2815
4c87eaab 2816 hci_dev_lock(hdev);
7dbfac1d 2817
4c87eaab 2818 hci_inquiry_cache_flush(hdev);
7dbfac1d 2819
4c87eaab
AG		 2820 err = hci_req_run(&req, inquiry_complete);
2821 if (err) {
2822 BT_ERR("Inquiry request failed: err %d", err);
2823 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2824 }
7dbfac1d 2825
4c87eaab
AG		 2826 hci_dev_unlock(hdev);
2827 break;
7dbfac1d 2828 }
7dbfac1d
AG		 2829}
2830
7ba8b4be
AG		 2831static void le_scan_disable_work(struct work_struct *work)
2832{
2833 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 2834 le_scan_disable.work);
7ba8b4be 2835 struct hci_cp_le_set_scan_enable cp;
4c87eaab
AG		 2836 struct hci_request req;
2837 int err;
7ba8b4be
AG		 2838
2839 BT_DBG("%s", hdev->name);
2840
4c87eaab 2841 hci_req_init(&req, hdev);
28b75a89 2842
7ba8b4be 2843 memset(&cp, 0, sizeof(cp));
4c87eaab
AG		 2844 cp.enable = LE_SCAN_DISABLE;
2845 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
28b75a89 2846
4c87eaab
AG		 2847 err = hci_req_run(&req, le_scan_disable_work_complete);
2848 if (err)
2849 BT_ERR("Disable LE scanning request failed: err %d", err);
28b75a89
AG		 2850}
2851
9be0dab7
DH		 2852/* Alloc HCI device */
2853struct hci_dev *hci_alloc_dev(void)
2854{
2855 struct hci_dev *hdev;
2856
2857 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
2858 if (!hdev)
2859 return NULL;
2860
b1b813d4
DH		 2861 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2862 hdev->esco_type = (ESCO_HV1);
2863 hdev->link_mode = (HCI_LM_ACCEPT);
b4cb9fb2
MH		 2864 hdev->num_iac = 0x01; /* One IAC support is mandatory */
2865 hdev->io_capability = 0x03; /* No Input No Output */
bbaf444a
JH		 2866 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2867 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
b1b813d4 2868
b1b813d4
DH		 2869 hdev->sniff_max_interval = 800;
2870 hdev->sniff_min_interval = 80;
2871
bef64738
MH		 2872 hdev->le_scan_interval = 0x0060;
2873 hdev->le_scan_window = 0x0030;
4e70c7e7
MH		 2874 hdev->le_conn_min_interval = 0x0028;
2875 hdev->le_conn_max_interval = 0x0038;
bef64738 2876
b1b813d4
DH		 2877 mutex_init(&hdev->lock);
2878 mutex_init(&hdev->req_lock);
2879
2880 INIT_LIST_HEAD(&hdev->mgmt_pending);
2881 INIT_LIST_HEAD(&hdev->blacklist);
2882 INIT_LIST_HEAD(&hdev->uuids);
2883 INIT_LIST_HEAD(&hdev->link_keys);
2884 INIT_LIST_HEAD(&hdev->long_term_keys);
2885 INIT_LIST_HEAD(&hdev->remote_oob_data);
6b536b5e 2886 INIT_LIST_HEAD(&hdev->conn_hash.list);
b1b813d4
DH		 2887
2888 INIT_WORK(&hdev->rx_work, hci_rx_work);
2889 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2890 INIT_WORK(&hdev->tx_work, hci_tx_work);
2891 INIT_WORK(&hdev->power_on, hci_power_on);
b1b813d4 2892
b1b813d4
DH		 2893 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
2894 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
2895 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2896
b1b813d4
DH		 2897 skb_queue_head_init(&hdev->rx_q);
2898 skb_queue_head_init(&hdev->cmd_q);
2899 skb_queue_head_init(&hdev->raw_q);
2900
2901 init_waitqueue_head(&hdev->req_wait_q);
2902
bda4f23a 2903 setup_timer(&hdev->cmd_timer, hci_cmd_timeout, (unsigned long) hdev);
b1b813d4 2904
b1b813d4
DH		 2905 hci_init_sysfs(hdev);
2906 discovery_init(hdev);
9be0dab7
DH		 2907
2908 return hdev;
2909}
2910EXPORT_SYMBOL(hci_alloc_dev);
2911
2912/* Free HCI device */
2913void hci_free_dev(struct hci_dev *hdev)
2914{
9be0dab7
DH		 2915 /* will free via device release */
2916 put_device(&hdev->dev);
2917}
2918EXPORT_SYMBOL(hci_free_dev);
2919
1da177e4
LT		 2920/* Register HCI device */
2921int hci_register_dev(struct hci_dev *hdev)
2922{
b1b813d4 2923 int id, error;
1da177e4 2924
010666a1 2925 if (!hdev->open || !hdev->close)
1da177e4
LT		 2926 return -EINVAL;
2927
08add513
MM		 2928 /* Do not allow HCI_AMP devices to register at index 0,
2929 * so the index can be used as the AMP controller ID.
2930 */
3df92b31
SL		 2931 switch (hdev->dev_type) {
2932 case HCI_BREDR:
2933 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
2934 break;
2935 case HCI_AMP:
2936 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
2937 break;
2938 default:
2939 return -EINVAL;
1da177e4 2940 }
8e87d142 2941
3df92b31
SL		 2942 if (id < 0)
2943 return id;
2944
1da177e4
LT		 2945 sprintf(hdev->name, "hci%d", id);
2946 hdev->id = id;
2d8b3a11
AE		 2947
2948 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2949
d8537548
KC		 2950 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
2951 WQ_MEM_RECLAIM, 1, hdev->name);
33ca954d
DH		 2952 if (!hdev->workqueue) {
2953 error = -ENOMEM;
2954 goto err;
2955 }
f48fd9c8 2956
d8537548
KC		 2957 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
2958 WQ_MEM_RECLAIM, 1, hdev->name);
6ead1bbc
JH		 2959 if (!hdev->req_workqueue) {
2960 destroy_workqueue(hdev->workqueue);
2961 error = -ENOMEM;
2962 goto err;
2963 }
2964
0153e2ec
MH		 2965 if (!IS_ERR_OR_NULL(bt_debugfs))
2966 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
2967
bdc3e0f1
MH		 2968 dev_set_name(&hdev->dev, "%s", hdev->name);
2969
2970 error = device_add(&hdev->dev);
33ca954d
DH		 2971 if (error < 0)
2972 goto err_wqueue;
1da177e4 2973
611b30f7 2974 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 2975 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2976 hdev);
611b30f7
MH		 2977 if (hdev->rfkill) {
2978 if (rfkill_register(hdev->rfkill) < 0) {
2979 rfkill_destroy(hdev->rfkill);
2980 hdev->rfkill = NULL;
2981 }
2982 }
2983
5e130367
JH		 2984 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
2985 set_bit(HCI_RFKILLED, &hdev->dev_flags);
2986
a8b2d5c2 2987 set_bit(HCI_SETUP, &hdev->dev_flags);
004b0258 2988 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
ce2be9ac 2989
01cd3404 2990 if (hdev->dev_type == HCI_BREDR) {
56f87901
JH		 2991 /* Assume BR/EDR support until proven otherwise (such as
2992 * through reading supported features during init.
2993 */
2994 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
2995 }
ce2be9ac 2996
fcee3377
GP		 2997 write_lock(&hci_dev_list_lock);
2998 list_add(&hdev->list, &hci_dev_list);
2999 write_unlock(&hci_dev_list_lock);
3000
1da177e4 3001 hci_notify(hdev, HCI_DEV_REG);
dc946bd8 3002 hci_dev_hold(hdev);
1da177e4 3003
19202573 3004 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 3005
1da177e4 3006 return id;
f48fd9c8 3007
33ca954d
DH		 3008err_wqueue:
3009 destroy_workqueue(hdev->workqueue);
6ead1bbc 3010 destroy_workqueue(hdev->req_workqueue);
33ca954d 3011err:
3df92b31 3012 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 3013
33ca954d 3014 return error;
1da177e4
LT		 3015}
3016EXPORT_SYMBOL(hci_register_dev);
3017
3018/* Unregister HCI device */
59735631 3019void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 3020{
3df92b31 3021 int i, id;
ef222013 3022
c13854ce 3023 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 3024
94324962
JH		 3025 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
3026
3df92b31
SL		 3027 id = hdev->id;
3028
f20d09d5 3029 write_lock(&hci_dev_list_lock);
1da177e4 3030 list_del(&hdev->list);
f20d09d5 3031 write_unlock(&hci_dev_list_lock);
1da177e4
LT		 3032
3033 hci_dev_do_close(hdev);
3034
cd4c5391 3035 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 3036 kfree_skb(hdev->reassembly[i]);
3037
b9b5ef18
GP		 3038 cancel_work_sync(&hdev->power_on);
3039
ab81cbf9 3040 if (!test_bit(HCI_INIT, &hdev->flags) &&
a8c5fb1a 3041 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
09fd0de5 3042 hci_dev_lock(hdev);
744cf19e 3043 mgmt_index_removed(hdev);
09fd0de5 3044 hci_dev_unlock(hdev);
56e5cb86 3045 }
ab81cbf9 3046
2e58ef3e
JH		 3047 /* mgmt_index_removed should take care of emptying the
3048 * pending list */
3049 BUG_ON(!list_empty(&hdev->mgmt_pending));
3050
1da177e4
LT		 3051 hci_notify(hdev, HCI_DEV_UNREG);
3052
611b30f7
MH		 3053 if (hdev->rfkill) {
3054 rfkill_unregister(hdev->rfkill);
3055 rfkill_destroy(hdev->rfkill);
3056 }
3057
bdc3e0f1 3058 device_del(&hdev->dev);
147e2d59 3059
0153e2ec
MH		 3060 debugfs_remove_recursive(hdev->debugfs);
3061
f48fd9c8 3062 destroy_workqueue(hdev->workqueue);
6ead1bbc 3063 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 3064
09fd0de5 3065 hci_dev_lock(hdev);
e2e0cacb 3066 hci_blacklist_clear(hdev);
2aeb9a1a 3067 hci_uuids_clear(hdev);
55ed8ca1 3068 hci_link_keys_clear(hdev);
b899efaf 3069 hci_smp_ltks_clear(hdev);
2763eda6 3070 hci_remote_oob_data_clear(hdev);
09fd0de5 3071 hci_dev_unlock(hdev);
e2e0cacb 3072
dc946bd8 3073 hci_dev_put(hdev);
3df92b31
SL		 3074
3075 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 3076}
3077EXPORT_SYMBOL(hci_unregister_dev);
3078
3079/* Suspend HCI device */
3080int hci_suspend_dev(struct hci_dev *hdev)
3081{
3082 hci_notify(hdev, HCI_DEV_SUSPEND);
3083 return 0;
3084}
3085EXPORT_SYMBOL(hci_suspend_dev);
3086
3087/* Resume HCI device */
3088int hci_resume_dev(struct hci_dev *hdev)
3089{
3090 hci_notify(hdev, HCI_DEV_RESUME);
3091 return 0;
3092}
3093EXPORT_SYMBOL(hci_resume_dev);
3094
76bca880 3095/* Receive frame from HCI drivers */
e1a26170 3096int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
76bca880 3097{
76bca880 3098 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 3099 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 3100 kfree_skb(skb);
3101 return -ENXIO;
3102 }
3103
d82603c6 3104 /* Incoming skb */
76bca880
MH		 3105 bt_cb(skb)->incoming = 1;
3106
3107 /* Time stamp */
3108 __net_timestamp(skb);
3109
76bca880 3110 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 3111 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 3112
76bca880
MH		 3113 return 0;
3114}
3115EXPORT_SYMBOL(hci_recv_frame);
3116
33e882a5 3117static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
a8c5fb1a 3118 int count, __u8 index)
33e882a5
SS		 3119{
3120 int len = 0;
3121 int hlen = 0;
3122 int remain = count;
3123 struct sk_buff *skb;
3124 struct bt_skb_cb *scb;
3125
3126 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
a8c5fb1a 3127 index >= NUM_REASSEMBLY)
33e882a5
SS		 3128 return -EILSEQ;
3129
3130 skb = hdev->reassembly[index];
3131
3132 if (!skb) {
3133 switch (type) {
3134 case HCI_ACLDATA_PKT:
3135 len = HCI_MAX_FRAME_SIZE;
3136 hlen = HCI_ACL_HDR_SIZE;
3137 break;
3138 case HCI_EVENT_PKT:
3139 len = HCI_MAX_EVENT_SIZE;
3140 hlen = HCI_EVENT_HDR_SIZE;
3141 break;
3142 case HCI_SCODATA_PKT:
3143 len = HCI_MAX_SCO_SIZE;
3144 hlen = HCI_SCO_HDR_SIZE;
3145 break;
3146 }
3147
1e429f38 3148 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 3149 if (!skb)
3150 return -ENOMEM;
3151
3152 scb = (void *) skb->cb;
3153 scb->expect = hlen;
3154 scb->pkt_type = type;
3155
33e882a5
SS		 3156 hdev->reassembly[index] = skb;
3157 }
3158
3159 while (count) {
3160 scb = (void *) skb->cb;
89bb46d0 3161 len = min_t(uint, scb->expect, count);
33e882a5
SS		 3162
3163 memcpy(skb_put(skb, len), data, len);
3164
3165 count -= len;
3166 data += len;
3167 scb->expect -= len;
3168 remain = count;
3169
3170 switch (type) {
3171 case HCI_EVENT_PKT:
3172 if (skb->len == HCI_EVENT_HDR_SIZE) {
3173 struct hci_event_hdr *h = hci_event_hdr(skb);
3174 scb->expect = h->plen;
3175
3176 if (skb_tailroom(skb) < scb->expect) {
3177 kfree_skb(skb);
3178 hdev->reassembly[index] = NULL;
3179 return -ENOMEM;
3180 }
3181 }
3182 break;
3183
3184 case HCI_ACLDATA_PKT:
3185 if (skb->len == HCI_ACL_HDR_SIZE) {
3186 struct hci_acl_hdr *h = hci_acl_hdr(skb);
3187 scb->expect = __le16_to_cpu(h->dlen);
3188
3189 if (skb_tailroom(skb) < scb->expect) {
3190 kfree_skb(skb);
3191 hdev->reassembly[index] = NULL;
3192 return -ENOMEM;
3193 }
3194 }
3195 break;
3196
3197 case HCI_SCODATA_PKT:
3198 if (skb->len == HCI_SCO_HDR_SIZE) {
3199 struct hci_sco_hdr *h = hci_sco_hdr(skb);
3200 scb->expect = h->dlen;
3201
3202 if (skb_tailroom(skb) < scb->expect) {
3203 kfree_skb(skb);
3204 hdev->reassembly[index] = NULL;
3205 return -ENOMEM;
3206 }
3207 }
3208 break;
3209 }
3210
3211 if (scb->expect == 0) {
3212 /* Complete frame */
3213
3214 bt_cb(skb)->pkt_type = type;
e1a26170 3215 hci_recv_frame(hdev, skb);
33e882a5
SS		 3216
3217 hdev->reassembly[index] = NULL;
3218 return remain;
3219 }
3220 }
3221
3222 return remain;
3223}
3224
ef222013
MH		 3225int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
3226{
f39a3c06
SS		 3227 int rem = 0;
3228
ef222013
MH		 3229 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
3230 return -EILSEQ;
3231
da5f6c37 3232 while (count) {
1e429f38 3233 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 3234 if (rem < 0)
3235 return rem;
ef222013 3236
f39a3c06
SS		 3237 data += (count - rem);
3238 count = rem;
f81c6224 3239 }
ef222013 3240
f39a3c06 3241 return rem;
ef222013
MH		 3242}
3243EXPORT_SYMBOL(hci_recv_fragment);
3244
99811510
SS		 3245#define STREAM_REASSEMBLY 0
3246
3247int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
3248{
3249 int type;
3250 int rem = 0;
3251
da5f6c37 3252 while (count) {
99811510
SS		 3253 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
3254
3255 if (!skb) {
3256 struct { char type; } *pkt;
3257
3258 /* Start of the frame */
3259 pkt = data;
3260 type = pkt->type;
3261
3262 data++;
3263 count--;
3264 } else
3265 type = bt_cb(skb)->pkt_type;
3266
1e429f38 3267 rem = hci_reassembly(hdev, type, data, count,
a8c5fb1a 3268 STREAM_REASSEMBLY);
99811510
SS		 3269 if (rem < 0)
3270 return rem;
3271
3272 data += (count - rem);
3273 count = rem;
f81c6224 3274 }
99811510
SS		 3275
3276 return rem;
3277}
3278EXPORT_SYMBOL(hci_recv_stream_fragment);
3279
1da177e4
LT		 3280/* ---- Interface to upper protocols ---- */
3281
1da177e4
LT		 3282int hci_register_cb(struct hci_cb *cb)
3283{
3284 BT_DBG("%p name %s", cb, cb->name);
3285
f20d09d5 3286 write_lock(&hci_cb_list_lock);
1da177e4 3287 list_add(&cb->list, &hci_cb_list);
f20d09d5 3288 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 3289
3290 return 0;
3291}
3292EXPORT_SYMBOL(hci_register_cb);
3293
3294int hci_unregister_cb(struct hci_cb *cb)
3295{
3296 BT_DBG("%p name %s", cb, cb->name);
3297
f20d09d5 3298 write_lock(&hci_cb_list_lock);
1da177e4 3299 list_del(&cb->list);
f20d09d5 3300 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 3301
3302 return 0;
3303}
3304EXPORT_SYMBOL(hci_unregister_cb);
3305
51086991 3306static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3307{
0d48d939 3308 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4 3309
cd82e61c
MH		 3310 /* Time stamp */
3311 __net_timestamp(skb);
1da177e4 3312
cd82e61c
MH		 3313 /* Send copy to monitor */
3314 hci_send_to_monitor(hdev, skb);
3315
3316 if (atomic_read(&hdev->promisc)) {
3317 /* Send copy to the sockets */
470fe1b5 3318 hci_send_to_sock(hdev, skb);
1da177e4
LT		 3319 }
3320
3321 /* Get rid of skb owner, prior to sending to the driver. */
3322 skb_orphan(skb);
3323
7bd8f09f 3324 if (hdev->send(hdev, skb) < 0)
51086991 3325 BT_ERR("%s sending frame failed", hdev->name);
1da177e4
LT		 3326}
3327
3119ae95
JH		 3328void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
3329{
3330 skb_queue_head_init(&req->cmd_q);
3331 req->hdev = hdev;
5d73e034 3332 req->err = 0;
3119ae95
JH		 3333}
3334
3335int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
3336{
3337 struct hci_dev *hdev = req->hdev;
3338 struct sk_buff *skb;
3339 unsigned long flags;
3340
3341 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
3342
5d73e034
AG		 3343 /* If an error occured during request building, remove all HCI
3344 * commands queued on the HCI request queue.
3345 */
3346 if (req->err) {
3347 skb_queue_purge(&req->cmd_q);
3348 return req->err;
3349 }
3350
3119ae95
JH		 3351 /* Do not allow empty requests */
3352 if (skb_queue_empty(&req->cmd_q))
382b0c39 3353 return -ENODATA;
3119ae95
JH		 3354
3355 skb = skb_peek_tail(&req->cmd_q);
3356 bt_cb(skb)->req.complete = complete;
3357
3358 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
3359 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
3360 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
3361
3362 queue_work(hdev->workqueue, &hdev->cmd_work);
3363
3364 return 0;
3365}
3366
1ca3a9d0 3367static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
07dc93dd 3368 u32 plen, const void *param)
1da177e4
LT		 3369{
3370 int len = HCI_COMMAND_HDR_SIZE + plen;
3371 struct hci_command_hdr *hdr;
3372 struct sk_buff *skb;
3373
1da177e4 3374 skb = bt_skb_alloc(len, GFP_ATOMIC);
1ca3a9d0
JH		 3375 if (!skb)
3376 return NULL;
1da177e4
LT		 3377
3378 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 3379 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 3380 hdr->plen = plen;
3381
3382 if (plen)
3383 memcpy(skb_put(skb, plen), param, plen);
3384
3385 BT_DBG("skb len %d", skb->len);
3386
0d48d939 3387 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
c78ae283 3388
1ca3a9d0
JH		 3389 return skb;
3390}
3391
3392/* Send HCI command */
07dc93dd
JH		 3393int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3394 const void *param)
1ca3a9d0
JH		 3395{
3396 struct sk_buff *skb;
3397
3398 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3399
3400 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3401 if (!skb) {
3402 BT_ERR("%s no memory for command", hdev->name);
3403 return -ENOMEM;
3404 }
3405
11714b3d
JH		 3406 /* Stand-alone HCI commands must be flaged as
3407 * single-command requests.
3408 */
3409 bt_cb(skb)->req.start = true;
3410
1da177e4 3411 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 3412 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3413
3414 return 0;
3415}
1da177e4 3416
71c76a17 3417/* Queue a command to an asynchronous HCI request */
07dc93dd
JH		 3418void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
3419 const void *param, u8 event)
71c76a17
JH		 3420{
3421 struct hci_dev *hdev = req->hdev;
3422 struct sk_buff *skb;
3423
3424 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3425
34739c1e
AG		 3426 /* If an error occured during request building, there is no point in
3427 * queueing the HCI command. We can simply return.
3428 */
3429 if (req->err)
3430 return;
3431
71c76a17
JH		 3432 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3433 if (!skb) {
5d73e034
AG		 3434 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
3435 hdev->name, opcode);
3436 req->err = -ENOMEM;
e348fe6b 3437 return;
71c76a17
JH		 3438 }
3439
3440 if (skb_queue_empty(&req->cmd_q))
3441 bt_cb(skb)->req.start = true;
3442
02350a72
JH		 3443 bt_cb(skb)->req.event = event;
3444
71c76a17 3445 skb_queue_tail(&req->cmd_q, skb);
71c76a17
JH		 3446}
3447
07dc93dd
JH		 3448void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
3449 const void *param)
02350a72
JH		 3450{
3451 hci_req_add_ev(req, opcode, plen, param, 0);
3452}
3453
1da177e4 3454/* Get data from the previously sent command */
a9de9248 3455void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 3456{
3457 struct hci_command_hdr *hdr;
3458
3459 if (!hdev->sent_cmd)
3460 return NULL;
3461
3462 hdr = (void *) hdev->sent_cmd->data;
3463
a9de9248 3464 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 3465 return NULL;
3466
f0e09510 3467 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 3468
3469 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3470}
3471
3472/* Send ACL data */
3473static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3474{
3475 struct hci_acl_hdr *hdr;
3476 int len = skb->len;
3477
badff6d0
ACM		 3478 skb_push(skb, HCI_ACL_HDR_SIZE);
3479 skb_reset_transport_header(skb);
9c70220b 3480 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 3481 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3482 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 3483}
3484
ee22be7e 3485static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 3486 struct sk_buff *skb, __u16 flags)
1da177e4 3487{
ee22be7e 3488 struct hci_conn *conn = chan->conn;
1da177e4
LT		 3489 struct hci_dev *hdev = conn->hdev;
3490 struct sk_buff *list;
3491
087bfd99
GP		 3492 skb->len = skb_headlen(skb);
3493 skb->data_len = 0;
3494
3495 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
204a6e54
AE		 3496
3497 switch (hdev->dev_type) {
3498 case HCI_BREDR:
3499 hci_add_acl_hdr(skb, conn->handle, flags);
3500 break;
3501 case HCI_AMP:
3502 hci_add_acl_hdr(skb, chan->handle, flags);
3503 break;
3504 default:
3505 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3506 return;
3507 }
087bfd99 3508
70f23020
AE		 3509 list = skb_shinfo(skb)->frag_list;
3510 if (!list) {
1da177e4
LT		 3511 /* Non fragmented */
3512 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3513
73d80deb 3514 skb_queue_tail(queue, skb);
1da177e4
LT		 3515 } else {
3516 /* Fragmented */
3517 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3518
3519 skb_shinfo(skb)->frag_list = NULL;
3520
3521 /* Queue all fragments atomically */
af3e6359 3522 spin_lock(&queue->lock);
1da177e4 3523
73d80deb 3524 __skb_queue_tail(queue, skb);
e702112f
AE		 3525
3526 flags &= ~ACL_START;
3527 flags |= ACL_CONT;
1da177e4
LT		 3528 do {
3529 skb = list; list = list->next;
8e87d142 3530
0d48d939 3531 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 3532 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 3533
3534 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3535
73d80deb 3536 __skb_queue_tail(queue, skb);
1da177e4
LT		 3537 } while (list);
3538
af3e6359 3539 spin_unlock(&queue->lock);
1da177e4 3540 }
73d80deb
LAD		 3541}
3542
3543void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3544{
ee22be7e 3545 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 3546
f0e09510 3547 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb 3548
ee22be7e 3549 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 3550
3eff45ea 3551 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3552}
1da177e4
LT		 3553
3554/* Send SCO data */
0d861d8b 3555void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 3556{
3557 struct hci_dev *hdev = conn->hdev;
3558 struct hci_sco_hdr hdr;
3559
3560 BT_DBG("%s len %d", hdev->name, skb->len);
3561
aca3192c 3562 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 3563 hdr.dlen = skb->len;
3564
badff6d0
ACM		 3565 skb_push(skb, HCI_SCO_HDR_SIZE);
3566 skb_reset_transport_header(skb);
9c70220b 3567 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4 3568
0d48d939 3569 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 3570
1da177e4 3571 skb_queue_tail(&conn->data_q, skb);
3eff45ea 3572 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3573}
1da177e4
LT		 3574
3575/* ---- HCI TX task (outgoing data) ---- */
3576
3577/* HCI Connection scheduler */
6039aa73
GP		 3578static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3579 int *quote)
1da177e4
LT		 3580{
3581 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3582 struct hci_conn *conn = NULL, *c;
abc5de8f 3583 unsigned int num = 0, min = ~0;
1da177e4 3584
8e87d142 3585 /* We don't have to lock device here. Connections are always
1da177e4 3586 * added and removed with TX task disabled. */
bf4c6325
GP		 3587
3588 rcu_read_lock();
3589
3590 list_for_each_entry_rcu(c, &h->list, list) {
769be974 3591 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 3592 continue;
769be974
MH		 3593
3594 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3595 continue;
3596
1da177e4
LT		 3597 num++;
3598
3599 if (c->sent < min) {
3600 min = c->sent;
3601 conn = c;
3602 }
52087a79
LAD		 3603
3604 if (hci_conn_num(hdev, type) == num)
3605 break;
1da177e4
LT		 3606 }
3607
bf4c6325
GP		 3608 rcu_read_unlock();
3609
1da177e4 3610 if (conn) {
6ed58ec5
VT		 3611 int cnt, q;
3612
3613 switch (conn->type) {
3614 case ACL_LINK:
3615 cnt = hdev->acl_cnt;
3616 break;
3617 case SCO_LINK:
3618 case ESCO_LINK:
3619 cnt = hdev->sco_cnt;
3620 break;
3621 case LE_LINK:
3622 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3623 break;
3624 default:
3625 cnt = 0;
3626 BT_ERR("Unknown link type");
3627 }
3628
3629 q = cnt / num;
1da177e4
LT		 3630 *quote = q ? q : 1;
3631 } else
3632 *quote = 0;
3633
3634 BT_DBG("conn %p quote %d", conn, *quote);
3635 return conn;
3636}
3637
6039aa73 3638static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 3639{
3640 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3641 struct hci_conn *c;
1da177e4 3642
bae1f5d9 3643 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 3644
bf4c6325
GP		 3645 rcu_read_lock();
3646
1da177e4 3647 /* Kill stalled connections */
bf4c6325 3648 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 3649 if (c->type == type && c->sent) {
6ed93dc6
AE		 3650 BT_ERR("%s killing stalled connection %pMR",
3651 hdev->name, &c->dst);
bed71748 3652 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 3653 }
3654 }
bf4c6325
GP		 3655
3656 rcu_read_unlock();
1da177e4
LT		 3657}
3658
6039aa73
GP		 3659static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3660 int *quote)
1da177e4 3661{
73d80deb
LAD		 3662 struct hci_conn_hash *h = &hdev->conn_hash;
3663 struct hci_chan *chan = NULL;
abc5de8f 3664 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 3665 struct hci_conn *conn;
73d80deb
LAD		 3666 int cnt, q, conn_num = 0;
3667
3668 BT_DBG("%s", hdev->name);
3669
bf4c6325
GP		 3670 rcu_read_lock();
3671
3672 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 3673 struct hci_chan *tmp;
3674
3675 if (conn->type != type)
3676 continue;
3677
3678 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3679 continue;
3680
3681 conn_num++;
3682
8192edef 3683 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 3684 struct sk_buff *skb;
3685
3686 if (skb_queue_empty(&tmp->data_q))
3687 continue;
3688
3689 skb = skb_peek(&tmp->data_q);
3690 if (skb->priority < cur_prio)
3691 continue;
3692
3693 if (skb->priority > cur_prio) {
3694 num = 0;
3695 min = ~0;
3696 cur_prio = skb->priority;
3697 }
3698
3699 num++;
3700
3701 if (conn->sent < min) {
3702 min = conn->sent;
3703 chan = tmp;
3704 }
3705 }
3706
3707 if (hci_conn_num(hdev, type) == conn_num)
3708 break;
3709 }
3710
bf4c6325
GP		 3711 rcu_read_unlock();
3712
73d80deb
LAD		 3713 if (!chan)
3714 return NULL;
3715
3716 switch (chan->conn->type) {
3717 case ACL_LINK:
3718 cnt = hdev->acl_cnt;
3719 break;
bd1eb66b
AE		 3720 case AMP_LINK:
3721 cnt = hdev->block_cnt;
3722 break;
73d80deb
LAD		 3723 case SCO_LINK:
3724 case ESCO_LINK:
3725 cnt = hdev->sco_cnt;
3726 break;
3727 case LE_LINK:
3728 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3729 break;
3730 default:
3731 cnt = 0;
3732 BT_ERR("Unknown link type");
3733 }
3734
3735 q = cnt / num;
3736 *quote = q ? q : 1;
3737 BT_DBG("chan %p quote %d", chan, *quote);
3738 return chan;
3739}
3740
02b20f0b
LAD		 3741static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3742{
3743 struct hci_conn_hash *h = &hdev->conn_hash;
3744 struct hci_conn *conn;
3745 int num = 0;
3746
3747 BT_DBG("%s", hdev->name);
3748
bf4c6325
GP		 3749 rcu_read_lock();
3750
3751 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 3752 struct hci_chan *chan;
3753
3754 if (conn->type != type)
3755 continue;
3756
3757 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3758 continue;
3759
3760 num++;
3761
8192edef 3762 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 3763 struct sk_buff *skb;
3764
3765 if (chan->sent) {
3766 chan->sent = 0;
3767 continue;
3768 }
3769
3770 if (skb_queue_empty(&chan->data_q))
3771 continue;
3772
3773 skb = skb_peek(&chan->data_q);
3774 if (skb->priority >= HCI_PRIO_MAX - 1)
3775 continue;
3776
3777 skb->priority = HCI_PRIO_MAX - 1;
3778
3779 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 3780 skb->priority);
02b20f0b
LAD		 3781 }
3782
3783 if (hci_conn_num(hdev, type) == num)
3784 break;
3785 }
bf4c6325
GP		 3786
3787 rcu_read_unlock();
3788
02b20f0b
LAD		 3789}
3790
b71d385a
AE		 3791static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3792{
3793 /* Calculate count of blocks used by this packet */
3794 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3795}
3796
6039aa73 3797static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 3798{
1da177e4
LT		 3799 if (!test_bit(HCI_RAW, &hdev->flags)) {
3800 /* ACL tx timeout must be longer than maximum
3801 * link supervision timeout (40.9 seconds) */
63d2bc1b 3802 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 3803 HCI_ACL_TX_TIMEOUT))
bae1f5d9 3804 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 3805 }
63d2bc1b 3806}
1da177e4 3807
6039aa73 3808static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 3809{
3810 unsigned int cnt = hdev->acl_cnt;
3811 struct hci_chan *chan;
3812 struct sk_buff *skb;
3813 int quote;
3814
3815 __check_timeout(hdev, cnt);
04837f64 3816
73d80deb 3817 while (hdev->acl_cnt &&
a8c5fb1a 3818 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 3819 u32 priority = (skb_peek(&chan->data_q))->priority;
3820 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3821 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3822 skb->len, skb->priority);
73d80deb 3823
ec1cce24
LAD		 3824 /* Stop if priority has changed */
3825 if (skb->priority < priority)
3826 break;
3827
3828 skb = skb_dequeue(&chan->data_q);
3829
73d80deb 3830 hci_conn_enter_active_mode(chan->conn,
04124681 3831 bt_cb(skb)->force_active);
04837f64 3832
57d17d70 3833 hci_send_frame(hdev, skb);
1da177e4
LT		 3834 hdev->acl_last_tx = jiffies;
3835
3836 hdev->acl_cnt--;
73d80deb
LAD		 3837 chan->sent++;
3838 chan->conn->sent++;
1da177e4
LT		 3839 }
3840 }
02b20f0b
LAD		 3841
3842 if (cnt != hdev->acl_cnt)
3843 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 3844}
3845
6039aa73 3846static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 3847{
63d2bc1b 3848 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 3849 struct hci_chan *chan;
3850 struct sk_buff *skb;
3851 int quote;
bd1eb66b 3852 u8 type;
b71d385a 3853
63d2bc1b 3854 __check_timeout(hdev, cnt);
b71d385a 3855
bd1eb66b
AE		 3856 BT_DBG("%s", hdev->name);
3857
3858 if (hdev->dev_type == HCI_AMP)
3859 type = AMP_LINK;
3860 else
3861 type = ACL_LINK;
3862
b71d385a 3863 while (hdev->block_cnt > 0 &&
bd1eb66b 3864 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 3865 u32 priority = (skb_peek(&chan->data_q))->priority;
3866 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3867 int blocks;
3868
3869 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3870 skb->len, skb->priority);
b71d385a
AE		 3871
3872 /* Stop if priority has changed */
3873 if (skb->priority < priority)
3874 break;
3875
3876 skb = skb_dequeue(&chan->data_q);
3877
3878 blocks = __get_blocks(hdev, skb);
3879 if (blocks > hdev->block_cnt)
3880 return;
3881
3882 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 3883 bt_cb(skb)->force_active);
b71d385a 3884
57d17d70 3885 hci_send_frame(hdev, skb);
b71d385a
AE		 3886 hdev->acl_last_tx = jiffies;
3887
3888 hdev->block_cnt -= blocks;
3889 quote -= blocks;
3890
3891 chan->sent += blocks;
3892 chan->conn->sent += blocks;
3893 }
3894 }
3895
3896 if (cnt != hdev->block_cnt)
bd1eb66b 3897 hci_prio_recalculate(hdev, type);
b71d385a
AE		 3898}
3899
6039aa73 3900static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 3901{
3902 BT_DBG("%s", hdev->name);
3903
bd1eb66b
AE		 3904 /* No ACL link over BR/EDR controller */
3905 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3906 return;
3907
3908 /* No AMP link over AMP controller */
3909 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 3910 return;
3911
3912 switch (hdev->flow_ctl_mode) {
3913 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3914 hci_sched_acl_pkt(hdev);
3915 break;
3916
3917 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3918 hci_sched_acl_blk(hdev);
3919 break;
3920 }
3921}
3922
1da177e4 3923/* Schedule SCO */
6039aa73 3924static void hci_sched_sco(struct hci_dev *hdev)
1da177e4
LT		 3925{
3926 struct hci_conn *conn;
3927 struct sk_buff *skb;
3928 int quote;
3929
3930 BT_DBG("%s", hdev->name);
3931
52087a79
LAD		 3932 if (!hci_conn_num(hdev, SCO_LINK))
3933 return;
3934
1da177e4
LT		 3935 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3936 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3937 BT_DBG("skb %p len %d", skb, skb->len);
57d17d70 3938 hci_send_frame(hdev, skb);
1da177e4
LT		 3939
3940 conn->sent++;
3941 if (conn->sent == ~0)
3942 conn->sent = 0;
3943 }
3944 }
3945}
3946
6039aa73 3947static void hci_sched_esco(struct hci_dev *hdev)
b6a0dc82
MH		 3948{
3949 struct hci_conn *conn;
3950 struct sk_buff *skb;
3951 int quote;
3952
3953 BT_DBG("%s", hdev->name);
3954
52087a79
LAD		 3955 if (!hci_conn_num(hdev, ESCO_LINK))
3956 return;
3957
8fc9ced3
GP		 3958 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3959 &quote))) {
b6a0dc82
MH		 3960 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3961 BT_DBG("skb %p len %d", skb, skb->len);
57d17d70 3962 hci_send_frame(hdev, skb);
b6a0dc82
MH		 3963
3964 conn->sent++;
3965 if (conn->sent == ~0)
3966 conn->sent = 0;
3967 }
3968 }
3969}
3970
6039aa73 3971static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 3972{
73d80deb 3973 struct hci_chan *chan;
6ed58ec5 3974 struct sk_buff *skb;
02b20f0b 3975 int quote, cnt, tmp;
6ed58ec5
VT		 3976
3977 BT_DBG("%s", hdev->name);
3978
52087a79
LAD		 3979 if (!hci_conn_num(hdev, LE_LINK))
3980 return;
3981
6ed58ec5
VT		 3982 if (!test_bit(HCI_RAW, &hdev->flags)) {
3983 /* LE tx timeout must be longer than maximum
3984 * link supervision timeout (40.9 seconds) */
bae1f5d9 3985 if (!hdev->le_cnt && hdev->le_pkts &&
a8c5fb1a 3986 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 3987 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 3988 }
3989
3990 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 3991 tmp = cnt;
73d80deb 3992 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 3993 u32 priority = (skb_peek(&chan->data_q))->priority;
3994 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3995 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3996 skb->len, skb->priority);
6ed58ec5 3997
ec1cce24
LAD		 3998 /* Stop if priority has changed */
3999 if (skb->priority < priority)
4000 break;
4001
4002 skb = skb_dequeue(&chan->data_q);
4003
57d17d70 4004 hci_send_frame(hdev, skb);
6ed58ec5
VT		 4005 hdev->le_last_tx = jiffies;
4006
4007 cnt--;
73d80deb
LAD		 4008 chan->sent++;
4009 chan->conn->sent++;
6ed58ec5
VT		 4010 }
4011 }
73d80deb 4012
6ed58ec5
VT		 4013 if (hdev->le_pkts)
4014 hdev->le_cnt = cnt;
4015 else
4016 hdev->acl_cnt = cnt;
02b20f0b
LAD		 4017
4018 if (cnt != tmp)
4019 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 4020}
4021
3eff45ea 4022static void hci_tx_work(struct work_struct *work)
1da177e4 4023{
3eff45ea 4024 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 4025 struct sk_buff *skb;
4026
6ed58ec5 4027 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 4028 hdev->sco_cnt, hdev->le_cnt);
1da177e4 4029
52de599e
MH		 4030 if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4031 /* Schedule queues and send stuff to HCI driver */
4032 hci_sched_acl(hdev);
4033 hci_sched_sco(hdev);
4034 hci_sched_esco(hdev);
4035 hci_sched_le(hdev);
4036 }
6ed58ec5 4037
1da177e4
LT		 4038 /* Send next queued raw (unknown type) packet */
4039 while ((skb = skb_dequeue(&hdev->raw_q)))
57d17d70 4040 hci_send_frame(hdev, skb);
1da177e4
LT		 4041}
4042
25985edc 4043/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 4044
4045/* ACL data packet */
6039aa73 4046static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 4047{
4048 struct hci_acl_hdr *hdr = (void *) skb->data;
4049 struct hci_conn *conn;
4050 __u16 handle, flags;
4051
4052 skb_pull(skb, HCI_ACL_HDR_SIZE);
4053
4054 handle = __le16_to_cpu(hdr->handle);
4055 flags = hci_flags(handle);
4056 handle = hci_handle(handle);
4057
f0e09510 4058 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 4059 handle, flags);
1da177e4
LT		 4060
4061 hdev->stat.acl_rx++;
4062
4063 hci_dev_lock(hdev);
4064 conn = hci_conn_hash_lookup_handle(hdev, handle);
4065 hci_dev_unlock(hdev);
8e87d142 4066
1da177e4 4067 if (conn) {
65983fc7 4068 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 4069
1da177e4 4070 /* Send to upper protocol */
686ebf28
UF		 4071 l2cap_recv_acldata(conn, skb, flags);
4072 return;
1da177e4 4073 } else {
8e87d142 4074 BT_ERR("%s ACL packet for unknown connection handle %d",
a8c5fb1a 4075 hdev->name, handle);
1da177e4
LT		 4076 }
4077
4078 kfree_skb(skb);
4079}
4080
4081/* SCO data packet */
6039aa73 4082static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 4083{
4084 struct hci_sco_hdr *hdr = (void *) skb->data;
4085 struct hci_conn *conn;
4086 __u16 handle;
4087
4088 skb_pull(skb, HCI_SCO_HDR_SIZE);
4089
4090 handle = __le16_to_cpu(hdr->handle);
4091
f0e09510 4092 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
1da177e4
LT		 4093
4094 hdev->stat.sco_rx++;
4095
4096 hci_dev_lock(hdev);
4097 conn = hci_conn_hash_lookup_handle(hdev, handle);
4098 hci_dev_unlock(hdev);
4099
4100 if (conn) {
1da177e4 4101 /* Send to upper protocol */
686ebf28
UF		 4102 sco_recv_scodata(conn, skb);
4103 return;
1da177e4 4104 } else {
8e87d142 4105 BT_ERR("%s SCO packet for unknown connection handle %d",
a8c5fb1a 4106 hdev->name, handle);
1da177e4
LT		 4107 }
4108
4109 kfree_skb(skb);
4110}
4111
9238f36a
JH		 4112static bool hci_req_is_complete(struct hci_dev *hdev)
4113{
4114 struct sk_buff *skb;
4115
4116 skb = skb_peek(&hdev->cmd_q);
4117 if (!skb)
4118 return true;
4119
4120 return bt_cb(skb)->req.start;
4121}
4122
42c6b129
JH		 4123static void hci_resend_last(struct hci_dev *hdev)
4124{
4125 struct hci_command_hdr *sent;
4126 struct sk_buff *skb;
4127 u16 opcode;
4128
4129 if (!hdev->sent_cmd)
4130 return;
4131
4132 sent = (void *) hdev->sent_cmd->data;
4133 opcode = __le16_to_cpu(sent->opcode);
4134 if (opcode == HCI_OP_RESET)
4135 return;
4136
4137 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4138 if (!skb)
4139 return;
4140
4141 skb_queue_head(&hdev->cmd_q, skb);
4142 queue_work(hdev->workqueue, &hdev->cmd_work);
4143}
4144
9238f36a
JH		 4145void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
4146{
4147 hci_req_complete_t req_complete = NULL;
4148 struct sk_buff *skb;
4149 unsigned long flags;
4150
4151 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4152
42c6b129
JH		 4153 /* If the completed command doesn't match the last one that was
4154 * sent we need to do special handling of it.
9238f36a 4155 */
42c6b129
JH		 4156 if (!hci_sent_cmd_data(hdev, opcode)) {
4157 /* Some CSR based controllers generate a spontaneous
4158 * reset complete event during init and any pending
4159 * command will never be completed. In such a case we
4160 * need to resend whatever was the last sent
4161 * command.
4162 */
4163 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4164 hci_resend_last(hdev);
4165
9238f36a 4166 return;
42c6b129 4167 }
9238f36a
JH		 4168
4169 /* If the command succeeded and there's still more commands in
4170 * this request the request is not yet complete.
4171 */
4172 if (!status && !hci_req_is_complete(hdev))
4173 return;
4174
4175 /* If this was the last command in a request the complete
4176 * callback would be found in hdev->sent_cmd instead of the
4177 * command queue (hdev->cmd_q).
4178 */
4179 if (hdev->sent_cmd) {
4180 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
53e21fbc
JH		 4181
4182 if (req_complete) {
4183 /* We must set the complete callback to NULL to
4184 * avoid calling the callback more than once if
4185 * this function gets called again.
4186 */
4187 bt_cb(hdev->sent_cmd)->req.complete = NULL;
4188
9238f36a 4189 goto call_complete;
53e21fbc 4190 }
9238f36a
JH		 4191 }
4192
4193 /* Remove all pending commands belonging to this request */
4194 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4195 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4196 if (bt_cb(skb)->req.start) {
4197 __skb_queue_head(&hdev->cmd_q, skb);
4198 break;
4199 }
4200
4201 req_complete = bt_cb(skb)->req.complete;
4202 kfree_skb(skb);
4203 }
4204 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4205
4206call_complete:
4207 if (req_complete)
4208 req_complete(hdev, status);
4209}
4210
b78752cc 4211static void hci_rx_work(struct work_struct *work)
1da177e4 4212{
b78752cc 4213 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 4214 struct sk_buff *skb;
4215
4216 BT_DBG("%s", hdev->name);
4217
1da177e4 4218 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 4219 /* Send copy to monitor */
4220 hci_send_to_monitor(hdev, skb);
4221
1da177e4
LT		 4222 if (atomic_read(&hdev->promisc)) {
4223 /* Send copy to the sockets */
470fe1b5 4224 hci_send_to_sock(hdev, skb);
1da177e4
LT		 4225 }
4226
0736cfa8
MH		 4227 if (test_bit(HCI_RAW, &hdev->flags) ||
4228 test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1da177e4
LT		 4229 kfree_skb(skb);
4230 continue;
4231 }
4232
4233 if (test_bit(HCI_INIT, &hdev->flags)) {
4234 /* Don't process data packets in this states. */
0d48d939 4235 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 4236 case HCI_ACLDATA_PKT:
4237 case HCI_SCODATA_PKT:
4238 kfree_skb(skb);
4239 continue;
3ff50b79 4240 }
1da177e4
LT		 4241 }
4242
4243 /* Process frame */
0d48d939 4244 switch (bt_cb(skb)->pkt_type) {
1da177e4 4245 case HCI_EVENT_PKT:
b78752cc 4246 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 4247 hci_event_packet(hdev, skb);
4248 break;
4249
4250 case HCI_ACLDATA_PKT:
4251 BT_DBG("%s ACL data packet", hdev->name);
4252 hci_acldata_packet(hdev, skb);
4253 break;
4254
4255 case HCI_SCODATA_PKT:
4256 BT_DBG("%s SCO data packet", hdev->name);
4257 hci_scodata_packet(hdev, skb);
4258 break;
4259
4260 default:
4261 kfree_skb(skb);
4262 break;
4263 }
4264 }
1da177e4
LT		 4265}
4266
c347b765 4267static void hci_cmd_work(struct work_struct *work)
1da177e4 4268{
c347b765 4269 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 4270 struct sk_buff *skb;
4271
2104786b
AE		 4272 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4273 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 4274
1da177e4 4275 /* Send queued commands */
5a08ecce
AE		 4276 if (atomic_read(&hdev->cmd_cnt)) {
4277 skb = skb_dequeue(&hdev->cmd_q);
4278 if (!skb)
4279 return;
4280
7585b97a 4281 kfree_skb(hdev->sent_cmd);
1da177e4 4282
a675d7f1 4283 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
70f23020 4284 if (hdev->sent_cmd) {
1da177e4 4285 atomic_dec(&hdev->cmd_cnt);
57d17d70 4286 hci_send_frame(hdev, skb);
7bdb8a5c
SJ		 4287 if (test_bit(HCI_RESET, &hdev->flags))
4288 del_timer(&hdev->cmd_timer);
4289 else
4290 mod_timer(&hdev->cmd_timer,
5f246e89 4291 jiffies + HCI_CMD_TIMEOUT);
1da177e4
LT		 4292 } else {
4293 skb_queue_head(&hdev->cmd_q, skb);
c347b765 4294 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4295 }
4296 }
4297}
Ubuntu Artful kernel mirror