]> git.proxmox.com Git - mirror_ubuntu-artful-kernel.git/blame - net/bluetooth/hci_core.c
projects / mirror_ubuntu-artful-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Introduce a new HCI_RFKILLED flag
[mirror_ubuntu-artful-kernel.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
3df92b31 29#include <linux/idr.h>
1da177e4 30
8c520a59 31#include <linux/rfkill.h>
1da177e4
LT		 32
33#include <net/bluetooth/bluetooth.h>
34#include <net/bluetooth/hci_core.h>
35
b78752cc 36static void hci_rx_work(struct work_struct *work);
c347b765 37static void hci_cmd_work(struct work_struct *work);
3eff45ea 38static void hci_tx_work(struct work_struct *work);
1da177e4 39
1da177e4
LT		 40/* HCI device list */
41LIST_HEAD(hci_dev_list);
42DEFINE_RWLOCK(hci_dev_list_lock);
43
44/* HCI callback list */
45LIST_HEAD(hci_cb_list);
46DEFINE_RWLOCK(hci_cb_list_lock);
47
3df92b31
SL		 48/* HCI ID Numbering */
49static DEFINE_IDA(hci_index_ida);
50
1da177e4
LT		 51/* ---- HCI notifications ---- */
52
6516455d 53static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 54{
040030ef 55 hci_sock_dev_event(hdev, event);
1da177e4
LT		 56}
57
58/* ---- HCI requests ---- */
59
42c6b129 60static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
1da177e4 61{
42c6b129 62 BT_DBG("%s result 0x%2.2x", hdev->name, result);
1da177e4
LT		 63
64 if (hdev->req_status == HCI_REQ_PEND) {
65 hdev->req_result = result;
66 hdev->req_status = HCI_REQ_DONE;
67 wake_up_interruptible(&hdev->req_wait_q);
68 }
69}
70
71static void hci_req_cancel(struct hci_dev *hdev, int err)
72{
73 BT_DBG("%s err 0x%2.2x", hdev->name, err);
74
75 if (hdev->req_status == HCI_REQ_PEND) {
76 hdev->req_result = err;
77 hdev->req_status = HCI_REQ_CANCELED;
78 wake_up_interruptible(&hdev->req_wait_q);
79 }
80}
81
77a63e0a
FW		 82static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
83 u8 event)
75e84b7c
JH		 84{
85 struct hci_ev_cmd_complete *ev;
86 struct hci_event_hdr *hdr;
87 struct sk_buff *skb;
88
89 hci_dev_lock(hdev);
90
91 skb = hdev->recv_evt;
92 hdev->recv_evt = NULL;
93
94 hci_dev_unlock(hdev);
95
96 if (!skb)
97 return ERR_PTR(-ENODATA);
98
99 if (skb->len < sizeof(*hdr)) {
100 BT_ERR("Too short HCI event");
101 goto failed;
102 }
103
104 hdr = (void *) skb->data;
105 skb_pull(skb, HCI_EVENT_HDR_SIZE);
106
7b1abbbe
JH		 107 if (event) {
108 if (hdr->evt != event)
109 goto failed;
110 return skb;
111 }
112
75e84b7c
JH		 113 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
114 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
115 goto failed;
116 }
117
118 if (skb->len < sizeof(*ev)) {
119 BT_ERR("Too short cmd_complete event");
120 goto failed;
121 }
122
123 ev = (void *) skb->data;
124 skb_pull(skb, sizeof(*ev));
125
126 if (opcode == __le16_to_cpu(ev->opcode))
127 return skb;
128
129 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
130 __le16_to_cpu(ev->opcode));
131
132failed:
133 kfree_skb(skb);
134 return ERR_PTR(-ENODATA);
135}
136
7b1abbbe 137struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
07dc93dd 138 const void *param, u8 event, u32 timeout)
75e84b7c
JH		 139{
140 DECLARE_WAITQUEUE(wait, current);
141 struct hci_request req;
142 int err = 0;
143
144 BT_DBG("%s", hdev->name);
145
146 hci_req_init(&req, hdev);
147
7b1abbbe 148 hci_req_add_ev(&req, opcode, plen, param, event);
75e84b7c
JH		 149
150 hdev->req_status = HCI_REQ_PEND;
151
152 err = hci_req_run(&req, hci_req_sync_complete);
153 if (err < 0)
154 return ERR_PTR(err);
155
156 add_wait_queue(&hdev->req_wait_q, &wait);
157 set_current_state(TASK_INTERRUPTIBLE);
158
159 schedule_timeout(timeout);
160
161 remove_wait_queue(&hdev->req_wait_q, &wait);
162
163 if (signal_pending(current))
164 return ERR_PTR(-EINTR);
165
166 switch (hdev->req_status) {
167 case HCI_REQ_DONE:
168 err = -bt_to_errno(hdev->req_result);
169 break;
170
171 case HCI_REQ_CANCELED:
172 err = -hdev->req_result;
173 break;
174
175 default:
176 err = -ETIMEDOUT;
177 break;
178 }
179
180 hdev->req_status = hdev->req_result = 0;
181
182 BT_DBG("%s end: err %d", hdev->name, err);
183
184 if (err < 0)
185 return ERR_PTR(err);
186
7b1abbbe
JH		 187 return hci_get_cmd_complete(hdev, opcode, event);
188}
189EXPORT_SYMBOL(__hci_cmd_sync_ev);
190
191struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
07dc93dd 192 const void *param, u32 timeout)
7b1abbbe
JH		 193{
194 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
75e84b7c
JH		 195}
196EXPORT_SYMBOL(__hci_cmd_sync);
197
1da177e4 198/* Execute request and wait for completion. */
01178cd4 199static int __hci_req_sync(struct hci_dev *hdev,
42c6b129
JH		 200 void (*func)(struct hci_request *req,
201 unsigned long opt),
01178cd4 202 unsigned long opt, __u32 timeout)
1da177e4 203{
42c6b129 204 struct hci_request req;
1da177e4
LT		 205 DECLARE_WAITQUEUE(wait, current);
206 int err = 0;
207
208 BT_DBG("%s start", hdev->name);
209
42c6b129
JH		 210 hci_req_init(&req, hdev);
211
1da177e4
LT		 212 hdev->req_status = HCI_REQ_PEND;
213
42c6b129 214 func(&req, opt);
53cce22d 215
42c6b129
JH		 216 err = hci_req_run(&req, hci_req_sync_complete);
217 if (err < 0) {
53cce22d 218 hdev->req_status = 0;
920c8300
AG		 219
220 /* ENODATA means the HCI request command queue is empty.
221 * This can happen when a request with conditionals doesn't
222 * trigger any commands to be sent. This is normal behavior
223 * and should not trigger an error return.
42c6b129 224 */
920c8300
AG		 225 if (err == -ENODATA)
226 return 0;
227
228 return err;
53cce22d
JH		 229 }
230
bc4445c7
AG		 231 add_wait_queue(&hdev->req_wait_q, &wait);
232 set_current_state(TASK_INTERRUPTIBLE);
233
1da177e4
LT		 234 schedule_timeout(timeout);
235
236 remove_wait_queue(&hdev->req_wait_q, &wait);
237
238 if (signal_pending(current))
239 return -EINTR;
240
241 switch (hdev->req_status) {
242 case HCI_REQ_DONE:
e175072f 243 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 244 break;
245
246 case HCI_REQ_CANCELED:
247 err = -hdev->req_result;
248 break;
249
250 default:
251 err = -ETIMEDOUT;
252 break;
3ff50b79 253 }
1da177e4 254
a5040efa 255 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 256
257 BT_DBG("%s end: err %d", hdev->name, err);
258
259 return err;
260}
261
01178cd4 262static int hci_req_sync(struct hci_dev *hdev,
42c6b129
JH		 263 void (*req)(struct hci_request *req,
264 unsigned long opt),
01178cd4 265 unsigned long opt, __u32 timeout)
1da177e4
LT		 266{
267 int ret;
268
7c6a329e
MH		 269 if (!test_bit(HCI_UP, &hdev->flags))
270 return -ENETDOWN;
271
1da177e4
LT		 272 /* Serialize all requests */
273 hci_req_lock(hdev);
01178cd4 274 ret = __hci_req_sync(hdev, req, opt, timeout);
1da177e4
LT		 275 hci_req_unlock(hdev);
276
277 return ret;
278}
279
42c6b129 280static void hci_reset_req(struct hci_request *req, unsigned long opt)
1da177e4 281{
42c6b129 282 BT_DBG("%s %ld", req->hdev->name, opt);
1da177e4
LT		 283
284 /* Reset device */
42c6b129
JH		 285 set_bit(HCI_RESET, &req->hdev->flags);
286 hci_req_add(req, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 287}
288
42c6b129 289static void bredr_init(struct hci_request *req)
1da177e4 290{
42c6b129 291 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
2455a3ea 292
1da177e4 293 /* Read Local Supported Features */
42c6b129 294 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 295
1143e5a6 296 /* Read Local Version */
42c6b129 297 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
2177bab5
JH		 298
299 /* Read BD Address */
42c6b129 300 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1da177e4
LT		 301}
302
42c6b129 303static void amp_init(struct hci_request *req)
e61ef499 304{
42c6b129 305 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
2455a3ea 306
e61ef499 307 /* Read Local Version */
42c6b129 308 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489
AE		 309
310 /* Read Local AMP Info */
42c6b129 311 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 312
313 /* Read Data Blk size */
42c6b129 314 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
e61ef499
AE		 315}
316
42c6b129 317static void hci_init1_req(struct hci_request *req, unsigned long opt)
e61ef499 318{
42c6b129 319 struct hci_dev *hdev = req->hdev;
e61ef499
AE		 320
321 BT_DBG("%s %ld", hdev->name, opt);
322
11778716
AE		 323 /* Reset */
324 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
42c6b129 325 hci_reset_req(req, 0);
11778716 326
e61ef499
AE		 327 switch (hdev->dev_type) {
328 case HCI_BREDR:
42c6b129 329 bredr_init(req);
e61ef499
AE		 330 break;
331
332 case HCI_AMP:
42c6b129 333 amp_init(req);
e61ef499
AE		 334 break;
335
336 default:
337 BT_ERR("Unknown device type %d", hdev->dev_type);
338 break;
339 }
e61ef499
AE		 340}
341
42c6b129 342static void bredr_setup(struct hci_request *req)
2177bab5 343{
2177bab5
JH		 344 __le16 param;
345 __u8 flt_type;
346
347 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
42c6b129 348 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 349
350 /* Read Class of Device */
42c6b129 351 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
2177bab5
JH		 352
353 /* Read Local Name */
42c6b129 354 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
2177bab5
JH		 355
356 /* Read Voice Setting */
42c6b129 357 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
2177bab5
JH		 358
359 /* Clear Event Filters */
360 flt_type = HCI_FLT_CLEAR_ALL;
42c6b129 361 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
2177bab5
JH		 362
363 /* Connection accept timeout ~20 secs */
364 param = __constant_cpu_to_le16(0x7d00);
42c6b129 365 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
2177bab5 366
f332ec66
JH		 367 /* Read page scan parameters */
368 if (req->hdev->hci_ver > BLUETOOTH_VER_1_1) {
369 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
370 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
371 }
2177bab5
JH		 372}
373
42c6b129 374static void le_setup(struct hci_request *req)
2177bab5 375{
c73eee91
JH		 376 struct hci_dev *hdev = req->hdev;
377
2177bab5 378 /* Read LE Buffer Size */
42c6b129 379 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 380
381 /* Read LE Local Supported Features */
42c6b129 382 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
2177bab5
JH		 383
384 /* Read LE Advertising Channel TX Power */
42c6b129 385 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
2177bab5
JH		 386
387 /* Read LE White List Size */
42c6b129 388 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
2177bab5
JH		 389
390 /* Read LE Supported States */
42c6b129 391 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
c73eee91
JH		 392
393 /* LE-only controllers have LE implicitly enabled */
394 if (!lmp_bredr_capable(hdev))
395 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2177bab5
JH		 396}
397
398static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
399{
400 if (lmp_ext_inq_capable(hdev))
401 return 0x02;
402
403 if (lmp_inq_rssi_capable(hdev))
404 return 0x01;
405
406 if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
407 hdev->lmp_subver == 0x0757)
408 return 0x01;
409
410 if (hdev->manufacturer == 15) {
411 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
412 return 0x01;
413 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
414 return 0x01;
415 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
416 return 0x01;
417 }
418
419 if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
420 hdev->lmp_subver == 0x1805)
421 return 0x01;
422
423 return 0x00;
424}
425
42c6b129 426static void hci_setup_inquiry_mode(struct hci_request *req)
2177bab5
JH		 427{
428 u8 mode;
429
42c6b129 430 mode = hci_get_inquiry_mode(req->hdev);
2177bab5 431
42c6b129 432 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
2177bab5
JH		 433}
434
42c6b129 435static void hci_setup_event_mask(struct hci_request *req)
2177bab5 436{
42c6b129
JH		 437 struct hci_dev *hdev = req->hdev;
438
2177bab5
JH		 439 /* The second byte is 0xff instead of 0x9f (two reserved bits
440 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
441 * command otherwise.
442 */
443 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
444
445 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
446 * any event mask for pre 1.2 devices.
447 */
448 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
449 return;
450
451 if (lmp_bredr_capable(hdev)) {
452 events[4] |= 0x01; /* Flow Specification Complete */
453 events[4] |= 0x02; /* Inquiry Result with RSSI */
454 events[4] |= 0x04; /* Read Remote Extended Features Complete */
455 events[5] |= 0x08; /* Synchronous Connection Complete */
456 events[5] |= 0x10; /* Synchronous Connection Changed */
c7882cbd
MH		 457 } else {
458 /* Use a different default for LE-only devices */
459 memset(events, 0, sizeof(events));
460 events[0] |= 0x10; /* Disconnection Complete */
461 events[0] |= 0x80; /* Encryption Change */
462 events[1] |= 0x08; /* Read Remote Version Information Complete */
463 events[1] |= 0x20; /* Command Complete */
464 events[1] |= 0x40; /* Command Status */
465 events[1] |= 0x80; /* Hardware Error */
466 events[2] |= 0x04; /* Number of Completed Packets */
467 events[3] |= 0x02; /* Data Buffer Overflow */
468 events[5] |= 0x80; /* Encryption Key Refresh Complete */
2177bab5
JH		 469 }
470
471 if (lmp_inq_rssi_capable(hdev))
472 events[4] |= 0x02; /* Inquiry Result with RSSI */
473
474 if (lmp_sniffsubr_capable(hdev))
475 events[5] |= 0x20; /* Sniff Subrating */
476
477 if (lmp_pause_enc_capable(hdev))
478 events[5] |= 0x80; /* Encryption Key Refresh Complete */
479
480 if (lmp_ext_inq_capable(hdev))
481 events[5] |= 0x40; /* Extended Inquiry Result */
482
483 if (lmp_no_flush_capable(hdev))
484 events[7] |= 0x01; /* Enhanced Flush Complete */
485
486 if (lmp_lsto_capable(hdev))
487 events[6] |= 0x80; /* Link Supervision Timeout Changed */
488
489 if (lmp_ssp_capable(hdev)) {
490 events[6] |= 0x01; /* IO Capability Request */
491 events[6] |= 0x02; /* IO Capability Response */
492 events[6] |= 0x04; /* User Confirmation Request */
493 events[6] |= 0x08; /* User Passkey Request */
494 events[6] |= 0x10; /* Remote OOB Data Request */
495 events[6] |= 0x20; /* Simple Pairing Complete */
496 events[7] |= 0x04; /* User Passkey Notification */
497 events[7] |= 0x08; /* Keypress Notification */
498 events[7] |= 0x10; /* Remote Host Supported
499 * Features Notification
500 */
501 }
502
503 if (lmp_le_capable(hdev))
504 events[7] |= 0x20; /* LE Meta-Event */
505
42c6b129 506 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
2177bab5
JH		 507
508 if (lmp_le_capable(hdev)) {
509 memset(events, 0, sizeof(events));
510 events[0] = 0x1f;
42c6b129
JH		 511 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK,
512 sizeof(events), events);
2177bab5
JH		 513 }
514}
515
42c6b129 516static void hci_init2_req(struct hci_request *req, unsigned long opt)
2177bab5 517{
42c6b129
JH		 518 struct hci_dev *hdev = req->hdev;
519
2177bab5 520 if (lmp_bredr_capable(hdev))
42c6b129 521 bredr_setup(req);
2177bab5
JH		 522
523 if (lmp_le_capable(hdev))
42c6b129 524 le_setup(req);
2177bab5 525
42c6b129 526 hci_setup_event_mask(req);
2177bab5 527
3f8e2d75
JH		 528 /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
529 * local supported commands HCI command.
530 */
531 if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
42c6b129 532 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
2177bab5
JH		 533
534 if (lmp_ssp_capable(hdev)) {
535 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
536 u8 mode = 0x01;
42c6b129
JH		 537 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
538 sizeof(mode), &mode);
2177bab5
JH		 539 } else {
540 struct hci_cp_write_eir cp;
541
542 memset(hdev->eir, 0, sizeof(hdev->eir));
543 memset(&cp, 0, sizeof(cp));
544
42c6b129 545 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
2177bab5
JH		 546 }
547 }
548
549 if (lmp_inq_rssi_capable(hdev))
42c6b129 550 hci_setup_inquiry_mode(req);
2177bab5
JH		 551
552 if (lmp_inq_tx_pwr_capable(hdev))
42c6b129 553 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
2177bab5
JH		 554
555 if (lmp_ext_feat_capable(hdev)) {
556 struct hci_cp_read_local_ext_features cp;
557
558 cp.page = 0x01;
42c6b129
JH		 559 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
560 sizeof(cp), &cp);
2177bab5
JH		 561 }
562
563 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
564 u8 enable = 1;
42c6b129
JH		 565 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
566 &enable);
2177bab5
JH		 567 }
568}
569
42c6b129 570static void hci_setup_link_policy(struct hci_request *req)
2177bab5 571{
42c6b129 572 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 573 struct hci_cp_write_def_link_policy cp;
574 u16 link_policy = 0;
575
576 if (lmp_rswitch_capable(hdev))
577 link_policy |= HCI_LP_RSWITCH;
578 if (lmp_hold_capable(hdev))
579 link_policy |= HCI_LP_HOLD;
580 if (lmp_sniff_capable(hdev))
581 link_policy |= HCI_LP_SNIFF;
582 if (lmp_park_capable(hdev))
583 link_policy |= HCI_LP_PARK;
584
585 cp.policy = cpu_to_le16(link_policy);
42c6b129 586 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
2177bab5
JH		 587}
588
42c6b129 589static void hci_set_le_support(struct hci_request *req)
2177bab5 590{
42c6b129 591 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 592 struct hci_cp_write_le_host_supported cp;
593
c73eee91
JH		 594 /* LE-only devices do not support explicit enablement */
595 if (!lmp_bredr_capable(hdev))
596 return;
597
2177bab5
JH		 598 memset(&cp, 0, sizeof(cp));
599
600 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
601 cp.le = 0x01;
602 cp.simul = lmp_le_br_capable(hdev);
603 }
604
605 if (cp.le != lmp_host_le_capable(hdev))
42c6b129
JH		 606 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
607 &cp);
2177bab5
JH		 608}
609
42c6b129 610static void hci_init3_req(struct hci_request *req, unsigned long opt)
2177bab5 611{
42c6b129 612 struct hci_dev *hdev = req->hdev;
d2c5d77f 613 u8 p;
42c6b129 614
b8f4e068
GP		 615 /* Some Broadcom based Bluetooth controllers do not support the
616 * Delete Stored Link Key command. They are clearly indicating its
617 * absence in the bit mask of supported commands.
618 *
619 * Check the supported commands and only if the the command is marked
620 * as supported send it. If not supported assume that the controller
621 * does not have actual support for stored link keys which makes this
622 * command redundant anyway.
637b4cae 623 */
59f45d57
JH		 624 if (hdev->commands[6] & 0x80) {
625 struct hci_cp_delete_stored_link_key cp;
626
627 bacpy(&cp.bdaddr, BDADDR_ANY);
628 cp.delete_all = 0x01;
629 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
630 sizeof(cp), &cp);
631 }
632
2177bab5 633 if (hdev->commands[5] & 0x10)
42c6b129 634 hci_setup_link_policy(req);
2177bab5 635
04b4edcb 636 if (lmp_le_capable(hdev)) {
42c6b129 637 hci_set_le_support(req);
04b4edcb
JH		 638 hci_update_ad(req);
639 }
d2c5d77f
JH		 640
641 /* Read features beyond page 1 if available */
642 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
643 struct hci_cp_read_local_ext_features cp;
644
645 cp.page = p;
646 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
647 sizeof(cp), &cp);
648 }
2177bab5
JH		 649}
650
651static int __hci_init(struct hci_dev *hdev)
652{
653 int err;
654
655 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
656 if (err < 0)
657 return err;
658
659 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
660 * BR/EDR/LE type controllers. AMP controllers only need the
661 * first stage init.
662 */
663 if (hdev->dev_type != HCI_BREDR)
664 return 0;
665
666 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
667 if (err < 0)
668 return err;
669
670 return __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
671}
672
42c6b129 673static void hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 674{
675 __u8 scan = opt;
676
42c6b129 677 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 678
679 /* Inquiry and Page scans */
42c6b129 680 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 681}
682
42c6b129 683static void hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 684{
685 __u8 auth = opt;
686
42c6b129 687 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 688
689 /* Authentication */
42c6b129 690 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 691}
692
42c6b129 693static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 694{
695 __u8 encrypt = opt;
696
42c6b129 697 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 698
e4e8e37c 699 /* Encryption */
42c6b129 700 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 701}
702
42c6b129 703static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 704{
705 __le16 policy = cpu_to_le16(opt);
706
42c6b129 707 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 708
709 /* Default link policy */
42c6b129 710 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
e4e8e37c
MH		 711}
712
8e87d142 713/* Get HCI device by index.
1da177e4
LT		 714 * Device is held on return. */
715struct hci_dev *hci_dev_get(int index)
716{
8035ded4 717 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 718
719 BT_DBG("%d", index);
720
721 if (index < 0)
722 return NULL;
723
724 read_lock(&hci_dev_list_lock);
8035ded4 725 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 726 if (d->id == index) {
727 hdev = hci_dev_hold(d);
728 break;
729 }
730 }
731 read_unlock(&hci_dev_list_lock);
732 return hdev;
733}
1da177e4
LT		 734
735/* ---- Inquiry support ---- */
ff9ef578 736
30dc78e1
JH		 737bool hci_discovery_active(struct hci_dev *hdev)
738{
739 struct discovery_state *discov = &hdev->discovery;
740
6fbe195d 741 switch (discov->state) {
343f935b 742 case DISCOVERY_FINDING:
6fbe195d 743 case DISCOVERY_RESOLVING:
30dc78e1
JH		 744 return true;
745
6fbe195d
AG		 746 default:
747 return false;
748 }
30dc78e1
JH		 749}
750
ff9ef578
JH		 751void hci_discovery_set_state(struct hci_dev *hdev, int state)
752{
753 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
754
755 if (hdev->discovery.state == state)
756 return;
757
758 switch (state) {
759 case DISCOVERY_STOPPED:
7b99b659
AG		 760 if (hdev->discovery.state != DISCOVERY_STARTING)
761 mgmt_discovering(hdev, 0);
ff9ef578
JH		 762 break;
763 case DISCOVERY_STARTING:
764 break;
343f935b 765 case DISCOVERY_FINDING:
ff9ef578
JH		 766 mgmt_discovering(hdev, 1);
767 break;
30dc78e1
JH		 768 case DISCOVERY_RESOLVING:
769 break;
ff9ef578
JH		 770 case DISCOVERY_STOPPING:
771 break;
772 }
773
774 hdev->discovery.state = state;
775}
776
1f9b9a5d 777void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 778{
30883512 779 struct discovery_state *cache = &hdev->discovery;
b57c1a56 780 struct inquiry_entry *p, *n;
1da177e4 781
561aafbc
JH		 782 list_for_each_entry_safe(p, n, &cache->all, all) {
783 list_del(&p->all);
b57c1a56 784 kfree(p);
1da177e4 785 }
561aafbc
JH		 786
787 INIT_LIST_HEAD(&cache->unknown);
788 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 789}
790
a8c5fb1a
GP		 791struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
792 bdaddr_t *bdaddr)
1da177e4 793{
30883512 794 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 795 struct inquiry_entry *e;
796
6ed93dc6 797 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 798
561aafbc
JH		 799 list_for_each_entry(e, &cache->all, all) {
800 if (!bacmp(&e->data.bdaddr, bdaddr))
801 return e;
802 }
803
804 return NULL;
805}
806
807struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 808 bdaddr_t *bdaddr)
561aafbc 809{
30883512 810 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 811 struct inquiry_entry *e;
812
6ed93dc6 813 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 814
815 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 816 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 817 return e;
818 }
819
820 return NULL;
1da177e4
LT		 821}
822
30dc78e1 823struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 824 bdaddr_t *bdaddr,
825 int state)
30dc78e1
JH		 826{
827 struct discovery_state *cache = &hdev->discovery;
828 struct inquiry_entry *e;
829
6ed93dc6 830 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 831
832 list_for_each_entry(e, &cache->resolve, list) {
833 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
834 return e;
835 if (!bacmp(&e->data.bdaddr, bdaddr))
836 return e;
837 }
838
839 return NULL;
840}
841
a3d4e20a 842void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 843 struct inquiry_entry *ie)
a3d4e20a
JH		 844{
845 struct discovery_state *cache = &hdev->discovery;
846 struct list_head *pos = &cache->resolve;
847 struct inquiry_entry *p;
848
849 list_del(&ie->list);
850
851 list_for_each_entry(p, &cache->resolve, list) {
852 if (p->name_state != NAME_PENDING &&
a8c5fb1a 853 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 854 break;
855 pos = &p->list;
856 }
857
858 list_add(&ie->list, pos);
859}
860
3175405b 861bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
04124681 862 bool name_known, bool *ssp)
1da177e4 863{
30883512 864 struct discovery_state *cache = &hdev->discovery;
70f23020 865 struct inquiry_entry *ie;
1da177e4 866
6ed93dc6 867 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 868
2b2fec4d
SJ		 869 hci_remove_remote_oob_data(hdev, &data->bdaddr);
870
388fc8fa
JH		 871 if (ssp)
872 *ssp = data->ssp_mode;
873
70f23020 874 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 875 if (ie) {
388fc8fa
JH		 876 if (ie->data.ssp_mode && ssp)
877 *ssp = true;
878
a3d4e20a 879 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 880 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 881 ie->data.rssi = data->rssi;
882 hci_inquiry_cache_update_resolve(hdev, ie);
883 }
884
561aafbc 885 goto update;
a3d4e20a 886 }
561aafbc
JH		 887
888 /* Entry not in the cache. Add new one. */
889 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
890 if (!ie)
3175405b 891 return false;
561aafbc
JH		 892
893 list_add(&ie->all, &cache->all);
894
895 if (name_known) {
896 ie->name_state = NAME_KNOWN;
897 } else {
898 ie->name_state = NAME_NOT_KNOWN;
899 list_add(&ie->list, &cache->unknown);
900 }
70f23020 901
561aafbc
JH		 902update:
903 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 904 ie->name_state != NAME_PENDING) {
561aafbc
JH		 905 ie->name_state = NAME_KNOWN;
906 list_del(&ie->list);
1da177e4
LT		 907 }
908
70f23020
AE		 909 memcpy(&ie->data, data, sizeof(*data));
910 ie->timestamp = jiffies;
1da177e4 911 cache->timestamp = jiffies;
3175405b
JH		 912
913 if (ie->name_state == NAME_NOT_KNOWN)
914 return false;
915
916 return true;
1da177e4
LT		 917}
918
919static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
920{
30883512 921 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 922 struct inquiry_info *info = (struct inquiry_info *) buf;
923 struct inquiry_entry *e;
924 int copied = 0;
925
561aafbc 926 list_for_each_entry(e, &cache->all, all) {
1da177e4 927 struct inquiry_data *data = &e->data;
b57c1a56
JH		 928
929 if (copied >= num)
930 break;
931
1da177e4
LT		 932 bacpy(&info->bdaddr, &data->bdaddr);
933 info->pscan_rep_mode = data->pscan_rep_mode;
934 info->pscan_period_mode = data->pscan_period_mode;
935 info->pscan_mode = data->pscan_mode;
936 memcpy(info->dev_class, data->dev_class, 3);
937 info->clock_offset = data->clock_offset;
b57c1a56 938
1da177e4 939 info++;
b57c1a56 940 copied++;
1da177e4
LT		 941 }
942
943 BT_DBG("cache %p, copied %d", cache, copied);
944 return copied;
945}
946
42c6b129 947static void hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 948{
949 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 950 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 951 struct hci_cp_inquiry cp;
952
953 BT_DBG("%s", hdev->name);
954
955 if (test_bit(HCI_INQUIRY, &hdev->flags))
956 return;
957
958 /* Start Inquiry */
959 memcpy(&cp.lap, &ir->lap, 3);
960 cp.length = ir->length;
961 cp.num_rsp = ir->num_rsp;
42c6b129 962 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 963}
964
3e13fa1e
AG		 965static int wait_inquiry(void *word)
966{
967 schedule();
968 return signal_pending(current);
969}
970
1da177e4
LT		 971int hci_inquiry(void __user *arg)
972{
973 __u8 __user *ptr = arg;
974 struct hci_inquiry_req ir;
975 struct hci_dev *hdev;
976 int err = 0, do_inquiry = 0, max_rsp;
977 long timeo;
978 __u8 *buf;
979
980 if (copy_from_user(&ir, ptr, sizeof(ir)))
981 return -EFAULT;
982
5a08ecce
AE		 983 hdev = hci_dev_get(ir.dev_id);
984 if (!hdev)
1da177e4
LT		 985 return -ENODEV;
986
09fd0de5 987 hci_dev_lock(hdev);
8e87d142 988 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 989 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 990 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 991 do_inquiry = 1;
992 }
09fd0de5 993 hci_dev_unlock(hdev);
1da177e4 994
04837f64 995 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 996
997 if (do_inquiry) {
01178cd4
JH		 998 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
999 timeo);
70f23020
AE		 1000 if (err < 0)
1001 goto done;
3e13fa1e
AG		 1002
1003 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1004 * cleared). If it is interrupted by a signal, return -EINTR.
1005 */
1006 if (wait_on_bit(&hdev->flags, HCI_INQUIRY, wait_inquiry,
1007 TASK_INTERRUPTIBLE))
1008 return -EINTR;
70f23020 1009 }
1da177e4 1010
8fc9ced3
GP		 1011 /* for unlimited number of responses we will use buffer with
1012 * 255 entries
1013 */
1da177e4
LT		 1014 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1015
1016 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1017 * copy it to the user space.
1018 */
01df8c31 1019 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 1020 if (!buf) {
1da177e4
LT		 1021 err = -ENOMEM;
1022 goto done;
1023 }
1024
09fd0de5 1025 hci_dev_lock(hdev);
1da177e4 1026 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 1027 hci_dev_unlock(hdev);
1da177e4
LT		 1028
1029 BT_DBG("num_rsp %d", ir.num_rsp);
1030
1031 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1032 ptr += sizeof(ir);
1033 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 1034 ir.num_rsp))
1da177e4 1035 err = -EFAULT;
8e87d142 1036 } else
1da177e4
LT		 1037 err = -EFAULT;
1038
1039 kfree(buf);
1040
1041done:
1042 hci_dev_put(hdev);
1043 return err;
1044}
1045
3f0f524b
JH		 1046static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
1047{
1048 u8 ad_len = 0, flags = 0;
1049 size_t name_len;
1050
1051 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
1052 flags |= LE_AD_GENERAL;
1053
1054 if (!lmp_bredr_capable(hdev))
1055 flags |= LE_AD_NO_BREDR;
1056
1057 if (lmp_le_br_capable(hdev))
1058 flags |= LE_AD_SIM_LE_BREDR_CTRL;
1059
1060 if (lmp_host_le_br_capable(hdev))
1061 flags |= LE_AD_SIM_LE_BREDR_HOST;
1062
1063 if (flags) {
1064 BT_DBG("adv flags 0x%02x", flags);
1065
1066 ptr[0] = 2;
1067 ptr[1] = EIR_FLAGS;
1068 ptr[2] = flags;
1069
1070 ad_len += 3;
1071 ptr += 3;
1072 }
1073
1074 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
1075 ptr[0] = 2;
1076 ptr[1] = EIR_TX_POWER;
1077 ptr[2] = (u8) hdev->adv_tx_power;
1078
1079 ad_len += 3;
1080 ptr += 3;
1081 }
1082
1083 name_len = strlen(hdev->dev_name);
1084 if (name_len > 0) {
1085 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
1086
1087 if (name_len > max_len) {
1088 name_len = max_len;
1089 ptr[1] = EIR_NAME_SHORT;
1090 } else
1091 ptr[1] = EIR_NAME_COMPLETE;
1092
1093 ptr[0] = name_len + 1;
1094
1095 memcpy(ptr + 2, hdev->dev_name, name_len);
1096
1097 ad_len += (name_len + 2);
1098 ptr += (name_len + 2);
1099 }
1100
1101 return ad_len;
1102}
1103
04b4edcb 1104void hci_update_ad(struct hci_request *req)
3f0f524b 1105{
04b4edcb 1106 struct hci_dev *hdev = req->hdev;
3f0f524b
JH		 1107 struct hci_cp_le_set_adv_data cp;
1108 u8 len;
3f0f524b 1109
04b4edcb
JH		 1110 if (!lmp_le_capable(hdev))
1111 return;
3f0f524b
JH		 1112
1113 memset(&cp, 0, sizeof(cp));
1114
1115 len = create_ad(hdev, cp.data);
1116
1117 if (hdev->adv_data_len == len &&
04b4edcb
JH		 1118 memcmp(cp.data, hdev->adv_data, len) == 0)
1119 return;
3f0f524b
JH		 1120
1121 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1122 hdev->adv_data_len = len;
1123
1124 cp.length = len;
3f0f524b 1125
04b4edcb 1126 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
3f0f524b
JH		 1127}
1128
1da177e4
LT		 1129/* ---- HCI ioctl helpers ---- */
1130
1131int hci_dev_open(__u16 dev)
1132{
1133 struct hci_dev *hdev;
1134 int ret = 0;
1135
5a08ecce
AE		 1136 hdev = hci_dev_get(dev);
1137 if (!hdev)
1da177e4
LT		 1138 return -ENODEV;
1139
1140 BT_DBG("%s %p", hdev->name, hdev);
1141
1142 hci_req_lock(hdev);
1143
94324962
JH		 1144 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
1145 ret = -ENODEV;
1146 goto done;
1147 }
1148
5e130367 1149 if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
611b30f7
MH		 1150 ret = -ERFKILL;
1151 goto done;
1152 }
1153
1da177e4
LT		 1154 if (test_bit(HCI_UP, &hdev->flags)) {
1155 ret = -EALREADY;
1156 goto done;
1157 }
1158
1da177e4
LT		 1159 if (hdev->open(hdev)) {
1160 ret = -EIO;
1161 goto done;
1162 }
1163
f41c70c4
MH		 1164 atomic_set(&hdev->cmd_cnt, 1);
1165 set_bit(HCI_INIT, &hdev->flags);
1166
1167 if (hdev->setup && test_bit(HCI_SETUP, &hdev->dev_flags))
1168 ret = hdev->setup(hdev);
1169
1170 if (!ret) {
1171 /* Treat all non BR/EDR controllers as raw devices if
1172 * enable_hs is not set.
1173 */
1174 if (hdev->dev_type != HCI_BREDR && !enable_hs)
1175 set_bit(HCI_RAW, &hdev->flags);
1176
1177 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
1178 set_bit(HCI_RAW, &hdev->flags);
1179
1180 if (!test_bit(HCI_RAW, &hdev->flags))
1181 ret = __hci_init(hdev);
1da177e4
LT		 1182 }
1183
f41c70c4
MH		 1184 clear_bit(HCI_INIT, &hdev->flags);
1185
1da177e4
LT		 1186 if (!ret) {
1187 hci_dev_hold(hdev);
1188 set_bit(HCI_UP, &hdev->flags);
1189 hci_notify(hdev, HCI_DEV_UP);
bb4b2a9a
AE		 1190 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
1191 mgmt_valid_hdev(hdev)) {
09fd0de5 1192 hci_dev_lock(hdev);
744cf19e 1193 mgmt_powered(hdev, 1);
09fd0de5 1194 hci_dev_unlock(hdev);
56e5cb86 1195 }
8e87d142 1196 } else {
1da177e4 1197 /* Init failed, cleanup */
3eff45ea 1198 flush_work(&hdev->tx_work);
c347b765 1199 flush_work(&hdev->cmd_work);
b78752cc 1200 flush_work(&hdev->rx_work);
1da177e4
LT		 1201
1202 skb_queue_purge(&hdev->cmd_q);
1203 skb_queue_purge(&hdev->rx_q);
1204
1205 if (hdev->flush)
1206 hdev->flush(hdev);
1207
1208 if (hdev->sent_cmd) {
1209 kfree_skb(hdev->sent_cmd);
1210 hdev->sent_cmd = NULL;
1211 }
1212
1213 hdev->close(hdev);
1214 hdev->flags = 0;
1215 }
1216
1217done:
1218 hci_req_unlock(hdev);
1219 hci_dev_put(hdev);
1220 return ret;
1221}
1222
1223static int hci_dev_do_close(struct hci_dev *hdev)
1224{
1225 BT_DBG("%s %p", hdev->name, hdev);
1226
78c04c0b
VCG		 1227 cancel_delayed_work(&hdev->power_off);
1228
1da177e4
LT		 1229 hci_req_cancel(hdev, ENODEV);
1230 hci_req_lock(hdev);
1231
1232 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 1233 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 1234 hci_req_unlock(hdev);
1235 return 0;
1236 }
1237
3eff45ea
GP		 1238 /* Flush RX and TX works */
1239 flush_work(&hdev->tx_work);
b78752cc 1240 flush_work(&hdev->rx_work);
1da177e4 1241
16ab91ab 1242 if (hdev->discov_timeout > 0) {
e0f9309f 1243 cancel_delayed_work(&hdev->discov_off);
16ab91ab 1244 hdev->discov_timeout = 0;
5e5282bb 1245 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
16ab91ab
JH		 1246 }
1247
a8b2d5c2 1248 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 1249 cancel_delayed_work(&hdev->service_cache);
1250
7ba8b4be
AG		 1251 cancel_delayed_work_sync(&hdev->le_scan_disable);
1252
09fd0de5 1253 hci_dev_lock(hdev);
1f9b9a5d 1254 hci_inquiry_cache_flush(hdev);
1da177e4 1255 hci_conn_hash_flush(hdev);
09fd0de5 1256 hci_dev_unlock(hdev);
1da177e4
LT		 1257
1258 hci_notify(hdev, HCI_DEV_DOWN);
1259
1260 if (hdev->flush)
1261 hdev->flush(hdev);
1262
1263 /* Reset device */
1264 skb_queue_purge(&hdev->cmd_q);
1265 atomic_set(&hdev->cmd_cnt, 1);
8af59467 1266 if (!test_bit(HCI_RAW, &hdev->flags) &&
a6c511c6 1267 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1da177e4 1268 set_bit(HCI_INIT, &hdev->flags);
01178cd4 1269 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1da177e4
LT		 1270 clear_bit(HCI_INIT, &hdev->flags);
1271 }
1272
c347b765
GP		 1273 /* flush cmd work */
1274 flush_work(&hdev->cmd_work);
1da177e4
LT		 1275
1276 /* Drop queues */
1277 skb_queue_purge(&hdev->rx_q);
1278 skb_queue_purge(&hdev->cmd_q);
1279 skb_queue_purge(&hdev->raw_q);
1280
1281 /* Drop last sent command */
1282 if (hdev->sent_cmd) {
b79f44c1 1283 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 1284 kfree_skb(hdev->sent_cmd);
1285 hdev->sent_cmd = NULL;
1286 }
1287
b6ddb638
JH		 1288 kfree_skb(hdev->recv_evt);
1289 hdev->recv_evt = NULL;
1290
1da177e4
LT		 1291 /* After this point our queues are empty
1292 * and no tasks are scheduled. */
1293 hdev->close(hdev);
1294
35b973c9
JH		 1295 /* Clear flags */
1296 hdev->flags = 0;
1297 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
1298
bb4b2a9a
AE		 1299 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
1300 mgmt_valid_hdev(hdev)) {
8ee56540
MH		 1301 hci_dev_lock(hdev);
1302 mgmt_powered(hdev, 0);
1303 hci_dev_unlock(hdev);
1304 }
5add6af8 1305
ced5c338
AE		 1306 /* Controller radio is available but is currently powered down */
1307 hdev->amp_status = 0;
1308
e59fda8d 1309 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 1310 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
e59fda8d 1311
1da177e4
LT		 1312 hci_req_unlock(hdev);
1313
1314 hci_dev_put(hdev);
1315 return 0;
1316}
1317
1318int hci_dev_close(__u16 dev)
1319{
1320 struct hci_dev *hdev;
1321 int err;
1322
70f23020
AE		 1323 hdev = hci_dev_get(dev);
1324 if (!hdev)
1da177e4 1325 return -ENODEV;
8ee56540
MH		 1326
1327 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1328 cancel_delayed_work(&hdev->power_off);
1329
1da177e4 1330 err = hci_dev_do_close(hdev);
8ee56540 1331
1da177e4
LT		 1332 hci_dev_put(hdev);
1333 return err;
1334}
1335
1336int hci_dev_reset(__u16 dev)
1337{
1338 struct hci_dev *hdev;
1339 int ret = 0;
1340
70f23020
AE		 1341 hdev = hci_dev_get(dev);
1342 if (!hdev)
1da177e4
LT		 1343 return -ENODEV;
1344
1345 hci_req_lock(hdev);
1da177e4
LT		 1346
1347 if (!test_bit(HCI_UP, &hdev->flags))
1348 goto done;
1349
1350 /* Drop queues */
1351 skb_queue_purge(&hdev->rx_q);
1352 skb_queue_purge(&hdev->cmd_q);
1353
09fd0de5 1354 hci_dev_lock(hdev);
1f9b9a5d 1355 hci_inquiry_cache_flush(hdev);
1da177e4 1356 hci_conn_hash_flush(hdev);
09fd0de5 1357 hci_dev_unlock(hdev);
1da177e4
LT		 1358
1359 if (hdev->flush)
1360 hdev->flush(hdev);
1361
8e87d142 1362 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 1363 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 1364
1365 if (!test_bit(HCI_RAW, &hdev->flags))
01178cd4 1366 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1da177e4
LT		 1367
1368done:
1da177e4
LT		 1369 hci_req_unlock(hdev);
1370 hci_dev_put(hdev);
1371 return ret;
1372}
1373
1374int hci_dev_reset_stat(__u16 dev)
1375{
1376 struct hci_dev *hdev;
1377 int ret = 0;
1378
70f23020
AE		 1379 hdev = hci_dev_get(dev);
1380 if (!hdev)
1da177e4
LT		 1381 return -ENODEV;
1382
1383 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1384
1385 hci_dev_put(hdev);
1386
1387 return ret;
1388}
1389
1390int hci_dev_cmd(unsigned int cmd, void __user *arg)
1391{
1392 struct hci_dev *hdev;
1393 struct hci_dev_req dr;
1394 int err = 0;
1395
1396 if (copy_from_user(&dr, arg, sizeof(dr)))
1397 return -EFAULT;
1398
70f23020
AE		 1399 hdev = hci_dev_get(dr.dev_id);
1400 if (!hdev)
1da177e4
LT		 1401 return -ENODEV;
1402
1403 switch (cmd) {
1404 case HCISETAUTH:
01178cd4
JH		 1405 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1406 HCI_INIT_TIMEOUT);
1da177e4
LT		 1407 break;
1408
1409 case HCISETENCRYPT:
1410 if (!lmp_encrypt_capable(hdev)) {
1411 err = -EOPNOTSUPP;
1412 break;
1413 }
1414
1415 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1416 /* Auth must be enabled first */
01178cd4
JH		 1417 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1418 HCI_INIT_TIMEOUT);
1da177e4
LT		 1419 if (err)
1420 break;
1421 }
1422
01178cd4
JH		 1423 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1424 HCI_INIT_TIMEOUT);
1da177e4
LT		 1425 break;
1426
1427 case HCISETSCAN:
01178cd4
JH		 1428 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1429 HCI_INIT_TIMEOUT);
1da177e4
LT		 1430 break;
1431
1da177e4 1432 case HCISETLINKPOL:
01178cd4
JH		 1433 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1434 HCI_INIT_TIMEOUT);
1da177e4
LT		 1435 break;
1436
1437 case HCISETLINKMODE:
e4e8e37c
MH		 1438 hdev->link_mode = ((__u16) dr.dev_opt) &
1439 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1440 break;
1441
1442 case HCISETPTYPE:
1443 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 1444 break;
1445
1446 case HCISETACLMTU:
e4e8e37c
MH		 1447 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1448 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1449 break;
1450
1451 case HCISETSCOMTU:
e4e8e37c
MH		 1452 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1453 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1454 break;
1455
1456 default:
1457 err = -EINVAL;
1458 break;
1459 }
e4e8e37c 1460
1da177e4
LT		 1461 hci_dev_put(hdev);
1462 return err;
1463}
1464
1465int hci_get_dev_list(void __user *arg)
1466{
8035ded4 1467 struct hci_dev *hdev;
1da177e4
LT		 1468 struct hci_dev_list_req *dl;
1469 struct hci_dev_req *dr;
1da177e4
LT		 1470 int n = 0, size, err;
1471 __u16 dev_num;
1472
1473 if (get_user(dev_num, (__u16 __user *) arg))
1474 return -EFAULT;
1475
1476 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1477 return -EINVAL;
1478
1479 size = sizeof(*dl) + dev_num * sizeof(*dr);
1480
70f23020
AE		 1481 dl = kzalloc(size, GFP_KERNEL);
1482 if (!dl)
1da177e4
LT		 1483 return -ENOMEM;
1484
1485 dr = dl->dev_req;
1486
f20d09d5 1487 read_lock(&hci_dev_list_lock);
8035ded4 1488 list_for_each_entry(hdev, &hci_dev_list, list) {
a8b2d5c2 1489 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
e0f9309f 1490 cancel_delayed_work(&hdev->power_off);
c542a06c 1491
a8b2d5c2
JH		 1492 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1493 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1494
1da177e4
LT		 1495 (dr + n)->dev_id = hdev->id;
1496 (dr + n)->dev_opt = hdev->flags;
c542a06c 1497
1da177e4
LT		 1498 if (++n >= dev_num)
1499 break;
1500 }
f20d09d5 1501 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 1502
1503 dl->dev_num = n;
1504 size = sizeof(*dl) + n * sizeof(*dr);
1505
1506 err = copy_to_user(arg, dl, size);
1507 kfree(dl);
1508
1509 return err ? -EFAULT : 0;
1510}
1511
1512int hci_get_dev_info(void __user *arg)
1513{
1514 struct hci_dev *hdev;
1515 struct hci_dev_info di;
1516 int err = 0;
1517
1518 if (copy_from_user(&di, arg, sizeof(di)))
1519 return -EFAULT;
1520
70f23020
AE		 1521 hdev = hci_dev_get(di.dev_id);
1522 if (!hdev)
1da177e4
LT		 1523 return -ENODEV;
1524
a8b2d5c2 1525 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
3243553f 1526 cancel_delayed_work_sync(&hdev->power_off);
ab81cbf9 1527
a8b2d5c2
JH		 1528 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1529 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1530
1da177e4
LT		 1531 strcpy(di.name, hdev->name);
1532 di.bdaddr = hdev->bdaddr;
943da25d 1533 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 1534 di.flags = hdev->flags;
1535 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 1536 if (lmp_bredr_capable(hdev)) {
1537 di.acl_mtu = hdev->acl_mtu;
1538 di.acl_pkts = hdev->acl_pkts;
1539 di.sco_mtu = hdev->sco_mtu;
1540 di.sco_pkts = hdev->sco_pkts;
1541 } else {
1542 di.acl_mtu = hdev->le_mtu;
1543 di.acl_pkts = hdev->le_pkts;
1544 di.sco_mtu = 0;
1545 di.sco_pkts = 0;
1546 }
1da177e4
LT		 1547 di.link_policy = hdev->link_policy;
1548 di.link_mode = hdev->link_mode;
1549
1550 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1551 memcpy(&di.features, &hdev->features, sizeof(di.features));
1552
1553 if (copy_to_user(arg, &di, sizeof(di)))
1554 err = -EFAULT;
1555
1556 hci_dev_put(hdev);
1557
1558 return err;
1559}
1560
1561/* ---- Interface to HCI drivers ---- */
1562
611b30f7
MH		 1563static int hci_rfkill_set_block(void *data, bool blocked)
1564{
1565 struct hci_dev *hdev = data;
1566
1567 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1568
5e130367
JH		 1569 if (blocked) {
1570 set_bit(HCI_RFKILLED, &hdev->dev_flags);
1571 hci_dev_do_close(hdev);
1572 } else {
1573 clear_bit(HCI_RFKILLED, &hdev->dev_flags);
1574}
611b30f7
MH		 1575
1576 return 0;
1577}
1578
1579static const struct rfkill_ops hci_rfkill_ops = {
1580 .set_block = hci_rfkill_set_block,
1581};
1582
ab81cbf9
JH		 1583static void hci_power_on(struct work_struct *work)
1584{
1585 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 1586 int err;
ab81cbf9
JH		 1587
1588 BT_DBG("%s", hdev->name);
1589
96570ffc
JH		 1590 err = hci_dev_open(hdev->id);
1591 if (err < 0) {
1592 mgmt_set_powered_failed(hdev, err);
ab81cbf9 1593 return;
96570ffc 1594 }
ab81cbf9 1595
a8b2d5c2 1596 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
19202573
JH		 1597 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1598 HCI_AUTO_OFF_TIMEOUT);
ab81cbf9 1599
a8b2d5c2 1600 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
744cf19e 1601 mgmt_index_added(hdev);
ab81cbf9
JH		 1602}
1603
1604static void hci_power_off(struct work_struct *work)
1605{
3243553f 1606 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 1607 power_off.work);
ab81cbf9
JH		 1608
1609 BT_DBG("%s", hdev->name);
1610
8ee56540 1611 hci_dev_do_close(hdev);
ab81cbf9
JH		 1612}
1613
16ab91ab
JH		 1614static void hci_discov_off(struct work_struct *work)
1615{
1616 struct hci_dev *hdev;
1617 u8 scan = SCAN_PAGE;
1618
1619 hdev = container_of(work, struct hci_dev, discov_off.work);
1620
1621 BT_DBG("%s", hdev->name);
1622
09fd0de5 1623 hci_dev_lock(hdev);
16ab91ab
JH		 1624
1625 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1626
1627 hdev->discov_timeout = 0;
1628
09fd0de5 1629 hci_dev_unlock(hdev);
16ab91ab
JH		 1630}
1631
2aeb9a1a
JH		 1632int hci_uuids_clear(struct hci_dev *hdev)
1633{
4821002c 1634 struct bt_uuid *uuid, *tmp;
2aeb9a1a 1635
4821002c
JH		 1636 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1637 list_del(&uuid->list);
2aeb9a1a
JH		 1638 kfree(uuid);
1639 }
1640
1641 return 0;
1642}
1643
55ed8ca1
JH		 1644int hci_link_keys_clear(struct hci_dev *hdev)
1645{
1646 struct list_head *p, *n;
1647
1648 list_for_each_safe(p, n, &hdev->link_keys) {
1649 struct link_key *key;
1650
1651 key = list_entry(p, struct link_key, list);
1652
1653 list_del(p);
1654 kfree(key);
1655 }
1656
1657 return 0;
1658}
1659
b899efaf
VCG		 1660int hci_smp_ltks_clear(struct hci_dev *hdev)
1661{
1662 struct smp_ltk *k, *tmp;
1663
1664 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1665 list_del(&k->list);
1666 kfree(k);
1667 }
1668
1669 return 0;
1670}
1671
55ed8ca1
JH		 1672struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1673{
8035ded4 1674 struct link_key *k;
55ed8ca1 1675
8035ded4 1676 list_for_each_entry(k, &hdev->link_keys, list)
55ed8ca1
JH		 1677 if (bacmp(bdaddr, &k->bdaddr) == 0)
1678 return k;
55ed8ca1
JH		 1679
1680 return NULL;
1681}
1682
745c0ce3 1683static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 1684 u8 key_type, u8 old_key_type)
d25e28ab
JH		 1685{
1686 /* Legacy key */
1687 if (key_type < 0x03)
745c0ce3 1688 return true;
d25e28ab
JH		 1689
1690 /* Debug keys are insecure so don't store them persistently */
1691 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 1692 return false;
d25e28ab
JH		 1693
1694 /* Changed combination key and there's no previous one */
1695 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 1696 return false;
d25e28ab
JH		 1697
1698 /* Security mode 3 case */
1699 if (!conn)
745c0ce3 1700 return true;
d25e28ab
JH		 1701
1702 /* Neither local nor remote side had no-bonding as requirement */
1703 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 1704 return true;
d25e28ab
JH		 1705
1706 /* Local side had dedicated bonding as requirement */
1707 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 1708 return true;
d25e28ab
JH		 1709
1710 /* Remote side had dedicated bonding as requirement */
1711 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 1712 return true;
d25e28ab
JH		 1713
1714 /* If none of the above criteria match, then don't store the key
1715 * persistently */
745c0ce3 1716 return false;
d25e28ab
JH		 1717}
1718
c9839a11 1719struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
75d262c2 1720{
c9839a11 1721 struct smp_ltk *k;
75d262c2 1722
c9839a11
VCG		 1723 list_for_each_entry(k, &hdev->long_term_keys, list) {
1724 if (k->ediv != ediv ||
a8c5fb1a 1725 memcmp(rand, k->rand, sizeof(k->rand)))
75d262c2
VCG		 1726 continue;
1727
c9839a11 1728 return k;
75d262c2
VCG		 1729 }
1730
1731 return NULL;
1732}
75d262c2 1733
c9839a11 1734struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 1735 u8 addr_type)
75d262c2 1736{
c9839a11 1737 struct smp_ltk *k;
75d262c2 1738
c9839a11
VCG		 1739 list_for_each_entry(k, &hdev->long_term_keys, list)
1740 if (addr_type == k->bdaddr_type &&
a8c5fb1a 1741 bacmp(bdaddr, &k->bdaddr) == 0)
75d262c2
VCG		 1742 return k;
1743
1744 return NULL;
1745}
75d262c2 1746
d25e28ab 1747int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
04124681 1748 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1749{
1750 struct link_key *key, *old_key;
745c0ce3
VA		 1751 u8 old_key_type;
1752 bool persistent;
55ed8ca1
JH		 1753
1754 old_key = hci_find_link_key(hdev, bdaddr);
1755 if (old_key) {
1756 old_key_type = old_key->type;
1757 key = old_key;
1758 } else {
12adcf3a 1759 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1760 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1761 if (!key)
1762 return -ENOMEM;
1763 list_add(&key->list, &hdev->link_keys);
1764 }
1765
6ed93dc6 1766 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 1767
d25e28ab
JH		 1768 /* Some buggy controller combinations generate a changed
1769 * combination key for legacy pairing even when there's no
1770 * previous key */
1771 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 1772 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 1773 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1774 if (conn)
1775 conn->key_type = type;
1776 }
d25e28ab 1777
55ed8ca1 1778 bacpy(&key->bdaddr, bdaddr);
9b3b4460 1779 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 1780 key->pin_len = pin_len;
1781
b6020ba0 1782 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1783 key->type = old_key_type;
4748fed2
JH		 1784 else
1785 key->type = type;
1786
4df378a1
JH		 1787 if (!new_key)
1788 return 0;
1789
1790 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1791
744cf19e 1792 mgmt_new_link_key(hdev, key, persistent);
4df378a1 1793
6ec5bcad
VA		 1794 if (conn)
1795 conn->flush_key = !persistent;
55ed8ca1
JH		 1796
1797 return 0;
1798}
1799
c9839a11 1800int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
9a006657 1801 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
04124681 1802 ediv, u8 rand[8])
75d262c2 1803{
c9839a11 1804 struct smp_ltk *key, *old_key;
75d262c2 1805
c9839a11
VCG		 1806 if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1807 return 0;
75d262c2 1808
c9839a11
VCG		 1809 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1810 if (old_key)
75d262c2 1811 key = old_key;
c9839a11
VCG		 1812 else {
1813 key = kzalloc(sizeof(*key), GFP_ATOMIC);
75d262c2
VCG		 1814 if (!key)
1815 return -ENOMEM;
c9839a11 1816 list_add(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 1817 }
1818
75d262c2 1819 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 1820 key->bdaddr_type = addr_type;
1821 memcpy(key->val, tk, sizeof(key->val));
1822 key->authenticated = authenticated;
1823 key->ediv = ediv;
1824 key->enc_size = enc_size;
1825 key->type = type;
1826 memcpy(key->rand, rand, sizeof(key->rand));
75d262c2 1827
c9839a11
VCG		 1828 if (!new_key)
1829 return 0;
75d262c2 1830
261cc5aa
VCG		 1831 if (type & HCI_SMP_LTK)
1832 mgmt_new_ltk(hdev, key, 1);
1833
75d262c2
VCG		 1834 return 0;
1835}
1836
55ed8ca1
JH		 1837int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1838{
1839 struct link_key *key;
1840
1841 key = hci_find_link_key(hdev, bdaddr);
1842 if (!key)
1843 return -ENOENT;
1844
6ed93dc6 1845 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1
JH		 1846
1847 list_del(&key->list);
1848 kfree(key);
1849
1850 return 0;
1851}
1852
b899efaf
VCG		 1853int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1854{
1855 struct smp_ltk *k, *tmp;
1856
1857 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1858 if (bacmp(bdaddr, &k->bdaddr))
1859 continue;
1860
6ed93dc6 1861 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf
VCG		 1862
1863 list_del(&k->list);
1864 kfree(k);
1865 }
1866
1867 return 0;
1868}
1869
6bd32326 1870/* HCI command timer function */
bda4f23a 1871static void hci_cmd_timeout(unsigned long arg)
6bd32326
VT		 1872{
1873 struct hci_dev *hdev = (void *) arg;
1874
bda4f23a
AE		 1875 if (hdev->sent_cmd) {
1876 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1877 u16 opcode = __le16_to_cpu(sent->opcode);
1878
1879 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
1880 } else {
1881 BT_ERR("%s command tx timeout", hdev->name);
1882 }
1883
6bd32326 1884 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1885 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1886}
1887
2763eda6 1888struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
04124681 1889 bdaddr_t *bdaddr)
2763eda6
SJ		 1890{
1891 struct oob_data *data;
1892
1893 list_for_each_entry(data, &hdev->remote_oob_data, list)
1894 if (bacmp(bdaddr, &data->bdaddr) == 0)
1895 return data;
1896
1897 return NULL;
1898}
1899
1900int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1901{
1902 struct oob_data *data;
1903
1904 data = hci_find_remote_oob_data(hdev, bdaddr);
1905 if (!data)
1906 return -ENOENT;
1907
6ed93dc6 1908 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1909
1910 list_del(&data->list);
1911 kfree(data);
1912
1913 return 0;
1914}
1915
1916int hci_remote_oob_data_clear(struct hci_dev *hdev)
1917{
1918 struct oob_data *data, *n;
1919
1920 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1921 list_del(&data->list);
1922 kfree(data);
1923 }
1924
1925 return 0;
1926}
1927
1928int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
04124681 1929 u8 *randomizer)
2763eda6
SJ		 1930{
1931 struct oob_data *data;
1932
1933 data = hci_find_remote_oob_data(hdev, bdaddr);
1934
1935 if (!data) {
1936 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1937 if (!data)
1938 return -ENOMEM;
1939
1940 bacpy(&data->bdaddr, bdaddr);
1941 list_add(&data->list, &hdev->remote_oob_data);
1942 }
1943
1944 memcpy(data->hash, hash, sizeof(data->hash));
1945 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1946
6ed93dc6 1947 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1948
1949 return 0;
1950}
1951
04124681 1952struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
b2a66aad 1953{
8035ded4 1954 struct bdaddr_list *b;
b2a66aad 1955
8035ded4 1956 list_for_each_entry(b, &hdev->blacklist, list)
b2a66aad
AJ		 1957 if (bacmp(bdaddr, &b->bdaddr) == 0)
1958 return b;
b2a66aad
AJ		 1959
1960 return NULL;
1961}
1962
1963int hci_blacklist_clear(struct hci_dev *hdev)
1964{
1965 struct list_head *p, *n;
1966
1967 list_for_each_safe(p, n, &hdev->blacklist) {
1968 struct bdaddr_list *b;
1969
1970 b = list_entry(p, struct bdaddr_list, list);
1971
1972 list_del(p);
1973 kfree(b);
1974 }
1975
1976 return 0;
1977}
1978
88c1fe4b 1979int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 1980{
1981 struct bdaddr_list *entry;
b2a66aad
AJ		 1982
1983 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1984 return -EBADF;
1985
5e762444
AJ		 1986 if (hci_blacklist_lookup(hdev, bdaddr))
1987 return -EEXIST;
b2a66aad
AJ		 1988
1989 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
5e762444
AJ		 1990 if (!entry)
1991 return -ENOMEM;
b2a66aad
AJ		 1992
1993 bacpy(&entry->bdaddr, bdaddr);
1994
1995 list_add(&entry->list, &hdev->blacklist);
1996
88c1fe4b 1997 return mgmt_device_blocked(hdev, bdaddr, type);
b2a66aad
AJ		 1998}
1999
88c1fe4b 2000int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2001{
2002 struct bdaddr_list *entry;
b2a66aad 2003
1ec918ce 2004 if (bacmp(bdaddr, BDADDR_ANY) == 0)
5e762444 2005 return hci_blacklist_clear(hdev);
b2a66aad
AJ		 2006
2007 entry = hci_blacklist_lookup(hdev, bdaddr);
1ec918ce 2008 if (!entry)
5e762444 2009 return -ENOENT;
b2a66aad
AJ		 2010
2011 list_del(&entry->list);
2012 kfree(entry);
2013
88c1fe4b 2014 return mgmt_device_unblocked(hdev, bdaddr, type);
b2a66aad
AJ		 2015}
2016
4c87eaab 2017static void inquiry_complete(struct hci_dev *hdev, u8 status)
7ba8b4be 2018{
4c87eaab
AG		 2019 if (status) {
2020 BT_ERR("Failed to start inquiry: status %d", status);
7ba8b4be 2021
4c87eaab
AG		 2022 hci_dev_lock(hdev);
2023 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2024 hci_dev_unlock(hdev);
2025 return;
2026 }
7ba8b4be
AG		 2027}
2028
4c87eaab 2029static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
7ba8b4be 2030{
4c87eaab
AG		 2031 /* General inquiry access code (GIAC) */
2032 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2033 struct hci_request req;
2034 struct hci_cp_inquiry cp;
7ba8b4be
AG		 2035 int err;
2036
4c87eaab
AG		 2037 if (status) {
2038 BT_ERR("Failed to disable LE scanning: status %d", status);
2039 return;
2040 }
7ba8b4be 2041
4c87eaab
AG		 2042 switch (hdev->discovery.type) {
2043 case DISCOV_TYPE_LE:
2044 hci_dev_lock(hdev);
2045 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2046 hci_dev_unlock(hdev);
2047 break;
7ba8b4be 2048
4c87eaab
AG		 2049 case DISCOV_TYPE_INTERLEAVED:
2050 hci_req_init(&req, hdev);
7ba8b4be 2051
4c87eaab
AG		 2052 memset(&cp, 0, sizeof(cp));
2053 memcpy(&cp.lap, lap, sizeof(cp.lap));
2054 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
2055 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
7ba8b4be 2056
4c87eaab 2057 hci_dev_lock(hdev);
7dbfac1d 2058
4c87eaab 2059 hci_inquiry_cache_flush(hdev);
7dbfac1d 2060
4c87eaab
AG		 2061 err = hci_req_run(&req, inquiry_complete);
2062 if (err) {
2063 BT_ERR("Inquiry request failed: err %d", err);
2064 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2065 }
7dbfac1d 2066
4c87eaab
AG		 2067 hci_dev_unlock(hdev);
2068 break;
7dbfac1d 2069 }
7dbfac1d
AG		 2070}
2071
7ba8b4be
AG		 2072static void le_scan_disable_work(struct work_struct *work)
2073{
2074 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 2075 le_scan_disable.work);
7ba8b4be 2076 struct hci_cp_le_set_scan_enable cp;
4c87eaab
AG		 2077 struct hci_request req;
2078 int err;
7ba8b4be
AG		 2079
2080 BT_DBG("%s", hdev->name);
2081
4c87eaab 2082 hci_req_init(&req, hdev);
28b75a89 2083
7ba8b4be 2084 memset(&cp, 0, sizeof(cp));
4c87eaab
AG		 2085 cp.enable = LE_SCAN_DISABLE;
2086 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
28b75a89 2087
4c87eaab
AG		 2088 err = hci_req_run(&req, le_scan_disable_work_complete);
2089 if (err)
2090 BT_ERR("Disable LE scanning request failed: err %d", err);
28b75a89
AG		 2091}
2092
9be0dab7
DH		 2093/* Alloc HCI device */
2094struct hci_dev *hci_alloc_dev(void)
2095{
2096 struct hci_dev *hdev;
2097
2098 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
2099 if (!hdev)
2100 return NULL;
2101
b1b813d4
DH		 2102 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2103 hdev->esco_type = (ESCO_HV1);
2104 hdev->link_mode = (HCI_LM_ACCEPT);
2105 hdev->io_capability = 0x03; /* No Input No Output */
bbaf444a
JH		 2106 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2107 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
b1b813d4 2108
b1b813d4
DH		 2109 hdev->sniff_max_interval = 800;
2110 hdev->sniff_min_interval = 80;
2111
2112 mutex_init(&hdev->lock);
2113 mutex_init(&hdev->req_lock);
2114
2115 INIT_LIST_HEAD(&hdev->mgmt_pending);
2116 INIT_LIST_HEAD(&hdev->blacklist);
2117 INIT_LIST_HEAD(&hdev->uuids);
2118 INIT_LIST_HEAD(&hdev->link_keys);
2119 INIT_LIST_HEAD(&hdev->long_term_keys);
2120 INIT_LIST_HEAD(&hdev->remote_oob_data);
6b536b5e 2121 INIT_LIST_HEAD(&hdev->conn_hash.list);
b1b813d4
DH		 2122
2123 INIT_WORK(&hdev->rx_work, hci_rx_work);
2124 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2125 INIT_WORK(&hdev->tx_work, hci_tx_work);
2126 INIT_WORK(&hdev->power_on, hci_power_on);
b1b813d4 2127
b1b813d4
DH		 2128 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
2129 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
2130 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2131
b1b813d4
DH		 2132 skb_queue_head_init(&hdev->rx_q);
2133 skb_queue_head_init(&hdev->cmd_q);
2134 skb_queue_head_init(&hdev->raw_q);
2135
2136 init_waitqueue_head(&hdev->req_wait_q);
2137
bda4f23a 2138 setup_timer(&hdev->cmd_timer, hci_cmd_timeout, (unsigned long) hdev);
b1b813d4 2139
b1b813d4
DH		 2140 hci_init_sysfs(hdev);
2141 discovery_init(hdev);
9be0dab7
DH		 2142
2143 return hdev;
2144}
2145EXPORT_SYMBOL(hci_alloc_dev);
2146
2147/* Free HCI device */
2148void hci_free_dev(struct hci_dev *hdev)
2149{
9be0dab7
DH		 2150 /* will free via device release */
2151 put_device(&hdev->dev);
2152}
2153EXPORT_SYMBOL(hci_free_dev);
2154
1da177e4
LT		 2155/* Register HCI device */
2156int hci_register_dev(struct hci_dev *hdev)
2157{
b1b813d4 2158 int id, error;
1da177e4 2159
010666a1 2160 if (!hdev->open || !hdev->close)
1da177e4
LT		 2161 return -EINVAL;
2162
08add513
MM		 2163 /* Do not allow HCI_AMP devices to register at index 0,
2164 * so the index can be used as the AMP controller ID.
2165 */
3df92b31
SL		 2166 switch (hdev->dev_type) {
2167 case HCI_BREDR:
2168 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
2169 break;
2170 case HCI_AMP:
2171 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
2172 break;
2173 default:
2174 return -EINVAL;
1da177e4 2175 }
8e87d142 2176
3df92b31
SL		 2177 if (id < 0)
2178 return id;
2179
1da177e4
LT		 2180 sprintf(hdev->name, "hci%d", id);
2181 hdev->id = id;
2d8b3a11
AE		 2182
2183 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2184
d8537548
KC		 2185 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
2186 WQ_MEM_RECLAIM, 1, hdev->name);
33ca954d
DH		 2187 if (!hdev->workqueue) {
2188 error = -ENOMEM;
2189 goto err;
2190 }
f48fd9c8 2191
d8537548
KC		 2192 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
2193 WQ_MEM_RECLAIM, 1, hdev->name);
6ead1bbc
JH		 2194 if (!hdev->req_workqueue) {
2195 destroy_workqueue(hdev->workqueue);
2196 error = -ENOMEM;
2197 goto err;
2198 }
2199
33ca954d
DH		 2200 error = hci_add_sysfs(hdev);
2201 if (error < 0)
2202 goto err_wqueue;
1da177e4 2203
611b30f7 2204 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 2205 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2206 hdev);
611b30f7
MH		 2207 if (hdev->rfkill) {
2208 if (rfkill_register(hdev->rfkill) < 0) {
2209 rfkill_destroy(hdev->rfkill);
2210 hdev->rfkill = NULL;
2211 }
2212 }
2213
5e130367
JH		 2214 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
2215 set_bit(HCI_RFKILLED, &hdev->dev_flags);
2216
a8b2d5c2 2217 set_bit(HCI_SETUP, &hdev->dev_flags);
ce2be9ac
AE		 2218
2219 if (hdev->dev_type != HCI_AMP)
2220 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
2221
fcee3377
GP		 2222 write_lock(&hci_dev_list_lock);
2223 list_add(&hdev->list, &hci_dev_list);
2224 write_unlock(&hci_dev_list_lock);
2225
1da177e4 2226 hci_notify(hdev, HCI_DEV_REG);
dc946bd8 2227 hci_dev_hold(hdev);
1da177e4 2228
19202573 2229 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 2230
1da177e4 2231 return id;
f48fd9c8 2232
33ca954d
DH		 2233err_wqueue:
2234 destroy_workqueue(hdev->workqueue);
6ead1bbc 2235 destroy_workqueue(hdev->req_workqueue);
33ca954d 2236err:
3df92b31 2237 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 2238
33ca954d 2239 return error;
1da177e4
LT		 2240}
2241EXPORT_SYMBOL(hci_register_dev);
2242
2243/* Unregister HCI device */
59735631 2244void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 2245{
3df92b31 2246 int i, id;
ef222013 2247
c13854ce 2248 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 2249
94324962
JH		 2250 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
2251
3df92b31
SL		 2252 id = hdev->id;
2253
f20d09d5 2254 write_lock(&hci_dev_list_lock);
1da177e4 2255 list_del(&hdev->list);
f20d09d5 2256 write_unlock(&hci_dev_list_lock);
1da177e4
LT		 2257
2258 hci_dev_do_close(hdev);
2259
cd4c5391 2260 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 2261 kfree_skb(hdev->reassembly[i]);
2262
b9b5ef18
GP		 2263 cancel_work_sync(&hdev->power_on);
2264
ab81cbf9 2265 if (!test_bit(HCI_INIT, &hdev->flags) &&
a8c5fb1a 2266 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
09fd0de5 2267 hci_dev_lock(hdev);
744cf19e 2268 mgmt_index_removed(hdev);
09fd0de5 2269 hci_dev_unlock(hdev);
56e5cb86 2270 }
ab81cbf9 2271
2e58ef3e
JH		 2272 /* mgmt_index_removed should take care of emptying the
2273 * pending list */
2274 BUG_ON(!list_empty(&hdev->mgmt_pending));
2275
1da177e4
LT		 2276 hci_notify(hdev, HCI_DEV_UNREG);
2277
611b30f7
MH		 2278 if (hdev->rfkill) {
2279 rfkill_unregister(hdev->rfkill);
2280 rfkill_destroy(hdev->rfkill);
2281 }
2282
ce242970 2283 hci_del_sysfs(hdev);
147e2d59 2284
f48fd9c8 2285 destroy_workqueue(hdev->workqueue);
6ead1bbc 2286 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 2287
09fd0de5 2288 hci_dev_lock(hdev);
e2e0cacb 2289 hci_blacklist_clear(hdev);
2aeb9a1a 2290 hci_uuids_clear(hdev);
55ed8ca1 2291 hci_link_keys_clear(hdev);
b899efaf 2292 hci_smp_ltks_clear(hdev);
2763eda6 2293 hci_remote_oob_data_clear(hdev);
09fd0de5 2294 hci_dev_unlock(hdev);
e2e0cacb 2295
dc946bd8 2296 hci_dev_put(hdev);
3df92b31
SL		 2297
2298 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 2299}
2300EXPORT_SYMBOL(hci_unregister_dev);
2301
2302/* Suspend HCI device */
2303int hci_suspend_dev(struct hci_dev *hdev)
2304{
2305 hci_notify(hdev, HCI_DEV_SUSPEND);
2306 return 0;
2307}
2308EXPORT_SYMBOL(hci_suspend_dev);
2309
2310/* Resume HCI device */
2311int hci_resume_dev(struct hci_dev *hdev)
2312{
2313 hci_notify(hdev, HCI_DEV_RESUME);
2314 return 0;
2315}
2316EXPORT_SYMBOL(hci_resume_dev);
2317
76bca880
MH		 2318/* Receive frame from HCI drivers */
2319int hci_recv_frame(struct sk_buff *skb)
2320{
2321 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2322 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 2323 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 2324 kfree_skb(skb);
2325 return -ENXIO;
2326 }
2327
d82603c6 2328 /* Incoming skb */
76bca880
MH		 2329 bt_cb(skb)->incoming = 1;
2330
2331 /* Time stamp */
2332 __net_timestamp(skb);
2333
76bca880 2334 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 2335 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 2336
76bca880
MH		 2337 return 0;
2338}
2339EXPORT_SYMBOL(hci_recv_frame);
2340
33e882a5 2341static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
a8c5fb1a 2342 int count, __u8 index)
33e882a5
SS		 2343{
2344 int len = 0;
2345 int hlen = 0;
2346 int remain = count;
2347 struct sk_buff *skb;
2348 struct bt_skb_cb *scb;
2349
2350 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
a8c5fb1a 2351 index >= NUM_REASSEMBLY)
33e882a5
SS		 2352 return -EILSEQ;
2353
2354 skb = hdev->reassembly[index];
2355
2356 if (!skb) {
2357 switch (type) {
2358 case HCI_ACLDATA_PKT:
2359 len = HCI_MAX_FRAME_SIZE;
2360 hlen = HCI_ACL_HDR_SIZE;
2361 break;
2362 case HCI_EVENT_PKT:
2363 len = HCI_MAX_EVENT_SIZE;
2364 hlen = HCI_EVENT_HDR_SIZE;
2365 break;
2366 case HCI_SCODATA_PKT:
2367 len = HCI_MAX_SCO_SIZE;
2368 hlen = HCI_SCO_HDR_SIZE;
2369 break;
2370 }
2371
1e429f38 2372 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 2373 if (!skb)
2374 return -ENOMEM;
2375
2376 scb = (void *) skb->cb;
2377 scb->expect = hlen;
2378 scb->pkt_type = type;
2379
2380 skb->dev = (void *) hdev;
2381 hdev->reassembly[index] = skb;
2382 }
2383
2384 while (count) {
2385 scb = (void *) skb->cb;
89bb46d0 2386 len = min_t(uint, scb->expect, count);
33e882a5
SS		 2387
2388 memcpy(skb_put(skb, len), data, len);
2389
2390 count -= len;
2391 data += len;
2392 scb->expect -= len;
2393 remain = count;
2394
2395 switch (type) {
2396 case HCI_EVENT_PKT:
2397 if (skb->len == HCI_EVENT_HDR_SIZE) {
2398 struct hci_event_hdr *h = hci_event_hdr(skb);
2399 scb->expect = h->plen;
2400
2401 if (skb_tailroom(skb) < scb->expect) {
2402 kfree_skb(skb);
2403 hdev->reassembly[index] = NULL;
2404 return -ENOMEM;
2405 }
2406 }
2407 break;
2408
2409 case HCI_ACLDATA_PKT:
2410 if (skb->len == HCI_ACL_HDR_SIZE) {
2411 struct hci_acl_hdr *h = hci_acl_hdr(skb);
2412 scb->expect = __le16_to_cpu(h->dlen);
2413
2414 if (skb_tailroom(skb) < scb->expect) {
2415 kfree_skb(skb);
2416 hdev->reassembly[index] = NULL;
2417 return -ENOMEM;
2418 }
2419 }
2420 break;
2421
2422 case HCI_SCODATA_PKT:
2423 if (skb->len == HCI_SCO_HDR_SIZE) {
2424 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2425 scb->expect = h->dlen;
2426
2427 if (skb_tailroom(skb) < scb->expect) {
2428 kfree_skb(skb);
2429 hdev->reassembly[index] = NULL;
2430 return -ENOMEM;
2431 }
2432 }
2433 break;
2434 }
2435
2436 if (scb->expect == 0) {
2437 /* Complete frame */
2438
2439 bt_cb(skb)->pkt_type = type;
2440 hci_recv_frame(skb);
2441
2442 hdev->reassembly[index] = NULL;
2443 return remain;
2444 }
2445 }
2446
2447 return remain;
2448}
2449
ef222013
MH		 2450int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2451{
f39a3c06
SS		 2452 int rem = 0;
2453
ef222013
MH		 2454 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2455 return -EILSEQ;
2456
da5f6c37 2457 while (count) {
1e429f38 2458 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 2459 if (rem < 0)
2460 return rem;
ef222013 2461
f39a3c06
SS		 2462 data += (count - rem);
2463 count = rem;
f81c6224 2464 }
ef222013 2465
f39a3c06 2466 return rem;
ef222013
MH		 2467}
2468EXPORT_SYMBOL(hci_recv_fragment);
2469
99811510
SS		 2470#define STREAM_REASSEMBLY 0
2471
2472int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2473{
2474 int type;
2475 int rem = 0;
2476
da5f6c37 2477 while (count) {
99811510
SS		 2478 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2479
2480 if (!skb) {
2481 struct { char type; } *pkt;
2482
2483 /* Start of the frame */
2484 pkt = data;
2485 type = pkt->type;
2486
2487 data++;
2488 count--;
2489 } else
2490 type = bt_cb(skb)->pkt_type;
2491
1e429f38 2492 rem = hci_reassembly(hdev, type, data, count,
a8c5fb1a 2493 STREAM_REASSEMBLY);
99811510
SS		 2494 if (rem < 0)
2495 return rem;
2496
2497 data += (count - rem);
2498 count = rem;
f81c6224 2499 }
99811510
SS		 2500
2501 return rem;
2502}
2503EXPORT_SYMBOL(hci_recv_stream_fragment);
2504
1da177e4
LT		 2505/* ---- Interface to upper protocols ---- */
2506
1da177e4
LT		 2507int hci_register_cb(struct hci_cb *cb)
2508{
2509 BT_DBG("%p name %s", cb, cb->name);
2510
f20d09d5 2511 write_lock(&hci_cb_list_lock);
1da177e4 2512 list_add(&cb->list, &hci_cb_list);
f20d09d5 2513 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2514
2515 return 0;
2516}
2517EXPORT_SYMBOL(hci_register_cb);
2518
2519int hci_unregister_cb(struct hci_cb *cb)
2520{
2521 BT_DBG("%p name %s", cb, cb->name);
2522
f20d09d5 2523 write_lock(&hci_cb_list_lock);
1da177e4 2524 list_del(&cb->list);
f20d09d5 2525 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2526
2527 return 0;
2528}
2529EXPORT_SYMBOL(hci_unregister_cb);
2530
2531static int hci_send_frame(struct sk_buff *skb)
2532{
2533 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2534
2535 if (!hdev) {
2536 kfree_skb(skb);
2537 return -ENODEV;
2538 }
2539
0d48d939 2540 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4 2541
cd82e61c
MH		 2542 /* Time stamp */
2543 __net_timestamp(skb);
1da177e4 2544
cd82e61c
MH		 2545 /* Send copy to monitor */
2546 hci_send_to_monitor(hdev, skb);
2547
2548 if (atomic_read(&hdev->promisc)) {
2549 /* Send copy to the sockets */
470fe1b5 2550 hci_send_to_sock(hdev, skb);
1da177e4
LT		 2551 }
2552
2553 /* Get rid of skb owner, prior to sending to the driver. */
2554 skb_orphan(skb);
2555
2556 return hdev->send(skb);
2557}
2558
3119ae95
JH		 2559void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
2560{
2561 skb_queue_head_init(&req->cmd_q);
2562 req->hdev = hdev;
5d73e034 2563 req->err = 0;
3119ae95
JH		 2564}
2565
2566int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
2567{
2568 struct hci_dev *hdev = req->hdev;
2569 struct sk_buff *skb;
2570 unsigned long flags;
2571
2572 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
2573
5d73e034
AG		 2574 /* If an error occured during request building, remove all HCI
2575 * commands queued on the HCI request queue.
2576 */
2577 if (req->err) {
2578 skb_queue_purge(&req->cmd_q);
2579 return req->err;
2580 }
2581
3119ae95
JH		 2582 /* Do not allow empty requests */
2583 if (skb_queue_empty(&req->cmd_q))
382b0c39 2584 return -ENODATA;
3119ae95
JH		 2585
2586 skb = skb_peek_tail(&req->cmd_q);
2587 bt_cb(skb)->req.complete = complete;
2588
2589 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
2590 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
2591 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
2592
2593 queue_work(hdev->workqueue, &hdev->cmd_work);
2594
2595 return 0;
2596}
2597
1ca3a9d0 2598static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
07dc93dd 2599 u32 plen, const void *param)
1da177e4
LT		 2600{
2601 int len = HCI_COMMAND_HDR_SIZE + plen;
2602 struct hci_command_hdr *hdr;
2603 struct sk_buff *skb;
2604
1da177e4 2605 skb = bt_skb_alloc(len, GFP_ATOMIC);
1ca3a9d0
JH		 2606 if (!skb)
2607 return NULL;
1da177e4
LT		 2608
2609 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 2610 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 2611 hdr->plen = plen;
2612
2613 if (plen)
2614 memcpy(skb_put(skb, plen), param, plen);
2615
2616 BT_DBG("skb len %d", skb->len);
2617
0d48d939 2618 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 2619 skb->dev = (void *) hdev;
c78ae283 2620
1ca3a9d0
JH		 2621 return skb;
2622}
2623
2624/* Send HCI command */
07dc93dd
JH		 2625int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
2626 const void *param)
1ca3a9d0
JH		 2627{
2628 struct sk_buff *skb;
2629
2630 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2631
2632 skb = hci_prepare_cmd(hdev, opcode, plen, param);
2633 if (!skb) {
2634 BT_ERR("%s no memory for command", hdev->name);
2635 return -ENOMEM;
2636 }
2637
11714b3d
JH		 2638 /* Stand-alone HCI commands must be flaged as
2639 * single-command requests.
2640 */
2641 bt_cb(skb)->req.start = true;
2642
1da177e4 2643 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 2644 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 2645
2646 return 0;
2647}
1da177e4 2648
71c76a17 2649/* Queue a command to an asynchronous HCI request */
07dc93dd
JH		 2650void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
2651 const void *param, u8 event)
71c76a17
JH		 2652{
2653 struct hci_dev *hdev = req->hdev;
2654 struct sk_buff *skb;
2655
2656 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2657
34739c1e
AG		 2658 /* If an error occured during request building, there is no point in
2659 * queueing the HCI command. We can simply return.
2660 */
2661 if (req->err)
2662 return;
2663
71c76a17
JH		 2664 skb = hci_prepare_cmd(hdev, opcode, plen, param);
2665 if (!skb) {
5d73e034
AG		 2666 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
2667 hdev->name, opcode);
2668 req->err = -ENOMEM;
e348fe6b 2669 return;
71c76a17
JH		 2670 }
2671
2672 if (skb_queue_empty(&req->cmd_q))
2673 bt_cb(skb)->req.start = true;
2674
02350a72
JH		 2675 bt_cb(skb)->req.event = event;
2676
71c76a17 2677 skb_queue_tail(&req->cmd_q, skb);
71c76a17
JH		 2678}
2679
07dc93dd
JH		 2680void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
2681 const void *param)
02350a72
JH		 2682{
2683 hci_req_add_ev(req, opcode, plen, param, 0);
2684}
2685
1da177e4 2686/* Get data from the previously sent command */
a9de9248 2687void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 2688{
2689 struct hci_command_hdr *hdr;
2690
2691 if (!hdev->sent_cmd)
2692 return NULL;
2693
2694 hdr = (void *) hdev->sent_cmd->data;
2695
a9de9248 2696 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 2697 return NULL;
2698
f0e09510 2699 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 2700
2701 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2702}
2703
2704/* Send ACL data */
2705static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2706{
2707 struct hci_acl_hdr *hdr;
2708 int len = skb->len;
2709
badff6d0
ACM		 2710 skb_push(skb, HCI_ACL_HDR_SIZE);
2711 skb_reset_transport_header(skb);
9c70220b 2712 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 2713 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2714 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 2715}
2716
ee22be7e 2717static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 2718 struct sk_buff *skb, __u16 flags)
1da177e4 2719{
ee22be7e 2720 struct hci_conn *conn = chan->conn;
1da177e4
LT		 2721 struct hci_dev *hdev = conn->hdev;
2722 struct sk_buff *list;
2723
087bfd99
GP		 2724 skb->len = skb_headlen(skb);
2725 skb->data_len = 0;
2726
2727 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
204a6e54
AE		 2728
2729 switch (hdev->dev_type) {
2730 case HCI_BREDR:
2731 hci_add_acl_hdr(skb, conn->handle, flags);
2732 break;
2733 case HCI_AMP:
2734 hci_add_acl_hdr(skb, chan->handle, flags);
2735 break;
2736 default:
2737 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2738 return;
2739 }
087bfd99 2740
70f23020
AE		 2741 list = skb_shinfo(skb)->frag_list;
2742 if (!list) {
1da177e4
LT		 2743 /* Non fragmented */
2744 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2745
73d80deb 2746 skb_queue_tail(queue, skb);
1da177e4
LT		 2747 } else {
2748 /* Fragmented */
2749 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2750
2751 skb_shinfo(skb)->frag_list = NULL;
2752
2753 /* Queue all fragments atomically */
af3e6359 2754 spin_lock(&queue->lock);
1da177e4 2755
73d80deb 2756 __skb_queue_tail(queue, skb);
e702112f
AE		 2757
2758 flags &= ~ACL_START;
2759 flags |= ACL_CONT;
1da177e4
LT		 2760 do {
2761 skb = list; list = list->next;
8e87d142 2762
1da177e4 2763 skb->dev = (void *) hdev;
0d48d939 2764 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 2765 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 2766
2767 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2768
73d80deb 2769 __skb_queue_tail(queue, skb);
1da177e4
LT		 2770 } while (list);
2771
af3e6359 2772 spin_unlock(&queue->lock);
1da177e4 2773 }
73d80deb
LAD		 2774}
2775
2776void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2777{
ee22be7e 2778 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 2779
f0e09510 2780 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb
LAD		 2781
2782 skb->dev = (void *) hdev;
73d80deb 2783
ee22be7e 2784 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 2785
3eff45ea 2786 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 2787}
1da177e4
LT		 2788
2789/* Send SCO data */
0d861d8b 2790void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 2791{
2792 struct hci_dev *hdev = conn->hdev;
2793 struct hci_sco_hdr hdr;
2794
2795 BT_DBG("%s len %d", hdev->name, skb->len);
2796
aca3192c 2797 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 2798 hdr.dlen = skb->len;
2799
badff6d0
ACM		 2800 skb_push(skb, HCI_SCO_HDR_SIZE);
2801 skb_reset_transport_header(skb);
9c70220b 2802 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 2803
2804 skb->dev = (void *) hdev;
0d48d939 2805 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 2806
1da177e4 2807 skb_queue_tail(&conn->data_q, skb);
3eff45ea 2808 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 2809}
1da177e4
LT		 2810
2811/* ---- HCI TX task (outgoing data) ---- */
2812
2813/* HCI Connection scheduler */
6039aa73
GP		 2814static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
2815 int *quote)
1da177e4
LT		 2816{
2817 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2818 struct hci_conn *conn = NULL, *c;
abc5de8f 2819 unsigned int num = 0, min = ~0;
1da177e4 2820
8e87d142 2821 /* We don't have to lock device here. Connections are always
1da177e4 2822 * added and removed with TX task disabled. */
bf4c6325
GP		 2823
2824 rcu_read_lock();
2825
2826 list_for_each_entry_rcu(c, &h->list, list) {
769be974 2827 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2828 continue;
769be974
MH		 2829
2830 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2831 continue;
2832
1da177e4
LT		 2833 num++;
2834
2835 if (c->sent < min) {
2836 min = c->sent;
2837 conn = c;
2838 }
52087a79
LAD		 2839
2840 if (hci_conn_num(hdev, type) == num)
2841 break;
1da177e4
LT		 2842 }
2843
bf4c6325
GP		 2844 rcu_read_unlock();
2845
1da177e4 2846 if (conn) {
6ed58ec5
VT		 2847 int cnt, q;
2848
2849 switch (conn->type) {
2850 case ACL_LINK:
2851 cnt = hdev->acl_cnt;
2852 break;
2853 case SCO_LINK:
2854 case ESCO_LINK:
2855 cnt = hdev->sco_cnt;
2856 break;
2857 case LE_LINK:
2858 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2859 break;
2860 default:
2861 cnt = 0;
2862 BT_ERR("Unknown link type");
2863 }
2864
2865 q = cnt / num;
1da177e4
LT		 2866 *quote = q ? q : 1;
2867 } else
2868 *quote = 0;
2869
2870 BT_DBG("conn %p quote %d", conn, *quote);
2871 return conn;
2872}
2873
6039aa73 2874static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2875{
2876 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2877 struct hci_conn *c;
1da177e4 2878
bae1f5d9 2879 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 2880
bf4c6325
GP		 2881 rcu_read_lock();
2882
1da177e4 2883 /* Kill stalled connections */
bf4c6325 2884 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 2885 if (c->type == type && c->sent) {
6ed93dc6
AE		 2886 BT_ERR("%s killing stalled connection %pMR",
2887 hdev->name, &c->dst);
bed71748 2888 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 2889 }
2890 }
bf4c6325
GP		 2891
2892 rcu_read_unlock();
1da177e4
LT		 2893}
2894
6039aa73
GP		 2895static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2896 int *quote)
1da177e4 2897{
73d80deb
LAD		 2898 struct hci_conn_hash *h = &hdev->conn_hash;
2899 struct hci_chan *chan = NULL;
abc5de8f 2900 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 2901 struct hci_conn *conn;
73d80deb
LAD		 2902 int cnt, q, conn_num = 0;
2903
2904 BT_DBG("%s", hdev->name);
2905
bf4c6325
GP		 2906 rcu_read_lock();
2907
2908 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 2909 struct hci_chan *tmp;
2910
2911 if (conn->type != type)
2912 continue;
2913
2914 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2915 continue;
2916
2917 conn_num++;
2918
8192edef 2919 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 2920 struct sk_buff *skb;
2921
2922 if (skb_queue_empty(&tmp->data_q))
2923 continue;
2924
2925 skb = skb_peek(&tmp->data_q);
2926 if (skb->priority < cur_prio)
2927 continue;
2928
2929 if (skb->priority > cur_prio) {
2930 num = 0;
2931 min = ~0;
2932 cur_prio = skb->priority;
2933 }
2934
2935 num++;
2936
2937 if (conn->sent < min) {
2938 min = conn->sent;
2939 chan = tmp;
2940 }
2941 }
2942
2943 if (hci_conn_num(hdev, type) == conn_num)
2944 break;
2945 }
2946
bf4c6325
GP		 2947 rcu_read_unlock();
2948
73d80deb
LAD		 2949 if (!chan)
2950 return NULL;
2951
2952 switch (chan->conn->type) {
2953 case ACL_LINK:
2954 cnt = hdev->acl_cnt;
2955 break;
bd1eb66b
AE		 2956 case AMP_LINK:
2957 cnt = hdev->block_cnt;
2958 break;
73d80deb
LAD		 2959 case SCO_LINK:
2960 case ESCO_LINK:
2961 cnt = hdev->sco_cnt;
2962 break;
2963 case LE_LINK:
2964 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2965 break;
2966 default:
2967 cnt = 0;
2968 BT_ERR("Unknown link type");
2969 }
2970
2971 q = cnt / num;
2972 *quote = q ? q : 1;
2973 BT_DBG("chan %p quote %d", chan, *quote);
2974 return chan;
2975}
2976
02b20f0b
LAD		 2977static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2978{
2979 struct hci_conn_hash *h = &hdev->conn_hash;
2980 struct hci_conn *conn;
2981 int num = 0;
2982
2983 BT_DBG("%s", hdev->name);
2984
bf4c6325
GP		 2985 rcu_read_lock();
2986
2987 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 2988 struct hci_chan *chan;
2989
2990 if (conn->type != type)
2991 continue;
2992
2993 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2994 continue;
2995
2996 num++;
2997
8192edef 2998 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 2999 struct sk_buff *skb;
3000
3001 if (chan->sent) {
3002 chan->sent = 0;
3003 continue;
3004 }
3005
3006 if (skb_queue_empty(&chan->data_q))
3007 continue;
3008
3009 skb = skb_peek(&chan->data_q);
3010 if (skb->priority >= HCI_PRIO_MAX - 1)
3011 continue;
3012
3013 skb->priority = HCI_PRIO_MAX - 1;
3014
3015 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 3016 skb->priority);
02b20f0b
LAD		 3017 }
3018
3019 if (hci_conn_num(hdev, type) == num)
3020 break;
3021 }
bf4c6325
GP		 3022
3023 rcu_read_unlock();
3024
02b20f0b
LAD		 3025}
3026
b71d385a
AE		 3027static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3028{
3029 /* Calculate count of blocks used by this packet */
3030 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3031}
3032
6039aa73 3033static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 3034{
1da177e4
LT		 3035 if (!test_bit(HCI_RAW, &hdev->flags)) {
3036 /* ACL tx timeout must be longer than maximum
3037 * link supervision timeout (40.9 seconds) */
63d2bc1b 3038 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 3039 HCI_ACL_TX_TIMEOUT))
bae1f5d9 3040 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 3041 }
63d2bc1b 3042}
1da177e4 3043
6039aa73 3044static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 3045{
3046 unsigned int cnt = hdev->acl_cnt;
3047 struct hci_chan *chan;
3048 struct sk_buff *skb;
3049 int quote;
3050
3051 __check_timeout(hdev, cnt);
04837f64 3052
73d80deb 3053 while (hdev->acl_cnt &&
a8c5fb1a 3054 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 3055 u32 priority = (skb_peek(&chan->data_q))->priority;
3056 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3057 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3058 skb->len, skb->priority);
73d80deb 3059
ec1cce24
LAD		 3060 /* Stop if priority has changed */
3061 if (skb->priority < priority)
3062 break;
3063
3064 skb = skb_dequeue(&chan->data_q);
3065
73d80deb 3066 hci_conn_enter_active_mode(chan->conn,
04124681 3067 bt_cb(skb)->force_active);
04837f64 3068
1da177e4
LT		 3069 hci_send_frame(skb);
3070 hdev->acl_last_tx = jiffies;
3071
3072 hdev->acl_cnt--;
73d80deb
LAD		 3073 chan->sent++;
3074 chan->conn->sent++;
1da177e4
LT		 3075 }
3076 }
02b20f0b
LAD		 3077
3078 if (cnt != hdev->acl_cnt)
3079 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 3080}
3081
6039aa73 3082static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 3083{
63d2bc1b 3084 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 3085 struct hci_chan *chan;
3086 struct sk_buff *skb;
3087 int quote;
bd1eb66b 3088 u8 type;
b71d385a 3089
63d2bc1b 3090 __check_timeout(hdev, cnt);
b71d385a 3091
bd1eb66b
AE		 3092 BT_DBG("%s", hdev->name);
3093
3094 if (hdev->dev_type == HCI_AMP)
3095 type = AMP_LINK;
3096 else
3097 type = ACL_LINK;
3098
b71d385a 3099 while (hdev->block_cnt > 0 &&
bd1eb66b 3100 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 3101 u32 priority = (skb_peek(&chan->data_q))->priority;
3102 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3103 int blocks;
3104
3105 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3106 skb->len, skb->priority);
b71d385a
AE		 3107
3108 /* Stop if priority has changed */
3109 if (skb->priority < priority)
3110 break;
3111
3112 skb = skb_dequeue(&chan->data_q);
3113
3114 blocks = __get_blocks(hdev, skb);
3115 if (blocks > hdev->block_cnt)
3116 return;
3117
3118 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 3119 bt_cb(skb)->force_active);
b71d385a
AE		 3120
3121 hci_send_frame(skb);
3122 hdev->acl_last_tx = jiffies;
3123
3124 hdev->block_cnt -= blocks;
3125 quote -= blocks;
3126
3127 chan->sent += blocks;
3128 chan->conn->sent += blocks;
3129 }
3130 }
3131
3132 if (cnt != hdev->block_cnt)
bd1eb66b 3133 hci_prio_recalculate(hdev, type);
b71d385a
AE		 3134}
3135
6039aa73 3136static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 3137{
3138 BT_DBG("%s", hdev->name);
3139
bd1eb66b
AE		 3140 /* No ACL link over BR/EDR controller */
3141 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3142 return;
3143
3144 /* No AMP link over AMP controller */
3145 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 3146 return;
3147
3148 switch (hdev->flow_ctl_mode) {
3149 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3150 hci_sched_acl_pkt(hdev);
3151 break;
3152
3153 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3154 hci_sched_acl_blk(hdev);
3155 break;
3156 }
3157}
3158
1da177e4 3159/* Schedule SCO */
6039aa73 3160static void hci_sched_sco(struct hci_dev *hdev)
1da177e4
LT		 3161{
3162 struct hci_conn *conn;
3163 struct sk_buff *skb;
3164 int quote;
3165
3166 BT_DBG("%s", hdev->name);
3167
52087a79
LAD		 3168 if (!hci_conn_num(hdev, SCO_LINK))
3169 return;
3170
1da177e4
LT		 3171 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3172 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3173 BT_DBG("skb %p len %d", skb, skb->len);
3174 hci_send_frame(skb);
3175
3176 conn->sent++;
3177 if (conn->sent == ~0)
3178 conn->sent = 0;
3179 }
3180 }
3181}
3182
6039aa73 3183static void hci_sched_esco(struct hci_dev *hdev)
b6a0dc82
MH		 3184{
3185 struct hci_conn *conn;
3186 struct sk_buff *skb;
3187 int quote;
3188
3189 BT_DBG("%s", hdev->name);
3190
52087a79
LAD		 3191 if (!hci_conn_num(hdev, ESCO_LINK))
3192 return;
3193
8fc9ced3
GP		 3194 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3195 &quote))) {
b6a0dc82
MH		 3196 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3197 BT_DBG("skb %p len %d", skb, skb->len);
3198 hci_send_frame(skb);
3199
3200 conn->sent++;
3201 if (conn->sent == ~0)
3202 conn->sent = 0;
3203 }
3204 }
3205}
3206
6039aa73 3207static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 3208{
73d80deb 3209 struct hci_chan *chan;
6ed58ec5 3210 struct sk_buff *skb;
02b20f0b 3211 int quote, cnt, tmp;
6ed58ec5
VT		 3212
3213 BT_DBG("%s", hdev->name);
3214
52087a79
LAD		 3215 if (!hci_conn_num(hdev, LE_LINK))
3216 return;
3217
6ed58ec5
VT		 3218 if (!test_bit(HCI_RAW, &hdev->flags)) {
3219 /* LE tx timeout must be longer than maximum
3220 * link supervision timeout (40.9 seconds) */
bae1f5d9 3221 if (!hdev->le_cnt && hdev->le_pkts &&
a8c5fb1a 3222 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 3223 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 3224 }
3225
3226 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 3227 tmp = cnt;
73d80deb 3228 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 3229 u32 priority = (skb_peek(&chan->data_q))->priority;
3230 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3231 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3232 skb->len, skb->priority);
6ed58ec5 3233
ec1cce24
LAD		 3234 /* Stop if priority has changed */
3235 if (skb->priority < priority)
3236 break;
3237
3238 skb = skb_dequeue(&chan->data_q);
3239
6ed58ec5
VT		 3240 hci_send_frame(skb);
3241 hdev->le_last_tx = jiffies;
3242
3243 cnt--;
73d80deb
LAD		 3244 chan->sent++;
3245 chan->conn->sent++;
6ed58ec5
VT		 3246 }
3247 }
73d80deb 3248
6ed58ec5
VT		 3249 if (hdev->le_pkts)
3250 hdev->le_cnt = cnt;
3251 else
3252 hdev->acl_cnt = cnt;
02b20f0b
LAD		 3253
3254 if (cnt != tmp)
3255 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 3256}
3257
3eff45ea 3258static void hci_tx_work(struct work_struct *work)
1da177e4 3259{
3eff45ea 3260 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 3261 struct sk_buff *skb;
3262
6ed58ec5 3263 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 3264 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 3265
3266 /* Schedule queues and send stuff to HCI driver */
3267
3268 hci_sched_acl(hdev);
3269
3270 hci_sched_sco(hdev);
3271
b6a0dc82
MH		 3272 hci_sched_esco(hdev);
3273
6ed58ec5
VT		 3274 hci_sched_le(hdev);
3275
1da177e4
LT		 3276 /* Send next queued raw (unknown type) packet */
3277 while ((skb = skb_dequeue(&hdev->raw_q)))
3278 hci_send_frame(skb);
1da177e4
LT		 3279}
3280
25985edc 3281/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 3282
3283/* ACL data packet */
6039aa73 3284static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3285{
3286 struct hci_acl_hdr *hdr = (void *) skb->data;
3287 struct hci_conn *conn;
3288 __u16 handle, flags;
3289
3290 skb_pull(skb, HCI_ACL_HDR_SIZE);
3291
3292 handle = __le16_to_cpu(hdr->handle);
3293 flags = hci_flags(handle);
3294 handle = hci_handle(handle);
3295
f0e09510 3296 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 3297 handle, flags);
1da177e4
LT		 3298
3299 hdev->stat.acl_rx++;
3300
3301 hci_dev_lock(hdev);
3302 conn = hci_conn_hash_lookup_handle(hdev, handle);
3303 hci_dev_unlock(hdev);
8e87d142 3304
1da177e4 3305 if (conn) {
65983fc7 3306 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 3307
1da177e4 3308 /* Send to upper protocol */
686ebf28
UF		 3309 l2cap_recv_acldata(conn, skb, flags);
3310 return;
1da177e4 3311 } else {
8e87d142 3312 BT_ERR("%s ACL packet for unknown connection handle %d",
a8c5fb1a 3313 hdev->name, handle);
1da177e4
LT		 3314 }
3315
3316 kfree_skb(skb);
3317}
3318
3319/* SCO data packet */
6039aa73 3320static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3321{
3322 struct hci_sco_hdr *hdr = (void *) skb->data;
3323 struct hci_conn *conn;
3324 __u16 handle;
3325
3326 skb_pull(skb, HCI_SCO_HDR_SIZE);
3327
3328 handle = __le16_to_cpu(hdr->handle);
3329
f0e09510 3330 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
1da177e4
LT		 3331
3332 hdev->stat.sco_rx++;
3333
3334 hci_dev_lock(hdev);
3335 conn = hci_conn_hash_lookup_handle(hdev, handle);
3336 hci_dev_unlock(hdev);
3337
3338 if (conn) {
1da177e4 3339 /* Send to upper protocol */
686ebf28
UF		 3340 sco_recv_scodata(conn, skb);
3341 return;
1da177e4 3342 } else {
8e87d142 3343 BT_ERR("%s SCO packet for unknown connection handle %d",
a8c5fb1a 3344 hdev->name, handle);
1da177e4
LT		 3345 }
3346
3347 kfree_skb(skb);
3348}
3349
9238f36a
JH		 3350static bool hci_req_is_complete(struct hci_dev *hdev)
3351{
3352 struct sk_buff *skb;
3353
3354 skb = skb_peek(&hdev->cmd_q);
3355 if (!skb)
3356 return true;
3357
3358 return bt_cb(skb)->req.start;
3359}
3360
42c6b129
JH		 3361static void hci_resend_last(struct hci_dev *hdev)
3362{
3363 struct hci_command_hdr *sent;
3364 struct sk_buff *skb;
3365 u16 opcode;
3366
3367 if (!hdev->sent_cmd)
3368 return;
3369
3370 sent = (void *) hdev->sent_cmd->data;
3371 opcode = __le16_to_cpu(sent->opcode);
3372 if (opcode == HCI_OP_RESET)
3373 return;
3374
3375 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3376 if (!skb)
3377 return;
3378
3379 skb_queue_head(&hdev->cmd_q, skb);
3380 queue_work(hdev->workqueue, &hdev->cmd_work);
3381}
3382
9238f36a
JH		 3383void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
3384{
3385 hci_req_complete_t req_complete = NULL;
3386 struct sk_buff *skb;
3387 unsigned long flags;
3388
3389 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3390
42c6b129
JH		 3391 /* If the completed command doesn't match the last one that was
3392 * sent we need to do special handling of it.
9238f36a 3393 */
42c6b129
JH		 3394 if (!hci_sent_cmd_data(hdev, opcode)) {
3395 /* Some CSR based controllers generate a spontaneous
3396 * reset complete event during init and any pending
3397 * command will never be completed. In such a case we
3398 * need to resend whatever was the last sent
3399 * command.
3400 */
3401 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3402 hci_resend_last(hdev);
3403
9238f36a 3404 return;
42c6b129 3405 }
9238f36a
JH		 3406
3407 /* If the command succeeded and there's still more commands in
3408 * this request the request is not yet complete.
3409 */
3410 if (!status && !hci_req_is_complete(hdev))
3411 return;
3412
3413 /* If this was the last command in a request the complete
3414 * callback would be found in hdev->sent_cmd instead of the
3415 * command queue (hdev->cmd_q).
3416 */
3417 if (hdev->sent_cmd) {
3418 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
53e21fbc
JH		 3419
3420 if (req_complete) {
3421 /* We must set the complete callback to NULL to
3422 * avoid calling the callback more than once if
3423 * this function gets called again.
3424 */
3425 bt_cb(hdev->sent_cmd)->req.complete = NULL;
3426
9238f36a 3427 goto call_complete;
53e21fbc 3428 }
9238f36a
JH		 3429 }
3430
3431 /* Remove all pending commands belonging to this request */
3432 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
3433 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
3434 if (bt_cb(skb)->req.start) {
3435 __skb_queue_head(&hdev->cmd_q, skb);
3436 break;
3437 }
3438
3439 req_complete = bt_cb(skb)->req.complete;
3440 kfree_skb(skb);
3441 }
3442 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
3443
3444call_complete:
3445 if (req_complete)
3446 req_complete(hdev, status);
3447}
3448
b78752cc 3449static void hci_rx_work(struct work_struct *work)
1da177e4 3450{
b78752cc 3451 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 3452 struct sk_buff *skb;
3453
3454 BT_DBG("%s", hdev->name);
3455
1da177e4 3456 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 3457 /* Send copy to monitor */
3458 hci_send_to_monitor(hdev, skb);
3459
1da177e4
LT		 3460 if (atomic_read(&hdev->promisc)) {
3461 /* Send copy to the sockets */
470fe1b5 3462 hci_send_to_sock(hdev, skb);
1da177e4
LT		 3463 }
3464
3465 if (test_bit(HCI_RAW, &hdev->flags)) {
3466 kfree_skb(skb);
3467 continue;
3468 }
3469
3470 if (test_bit(HCI_INIT, &hdev->flags)) {
3471 /* Don't process data packets in this states. */
0d48d939 3472 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 3473 case HCI_ACLDATA_PKT:
3474 case HCI_SCODATA_PKT:
3475 kfree_skb(skb);
3476 continue;
3ff50b79 3477 }
1da177e4
LT		 3478 }
3479
3480 /* Process frame */
0d48d939 3481 switch (bt_cb(skb)->pkt_type) {
1da177e4 3482 case HCI_EVENT_PKT:
b78752cc 3483 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 3484 hci_event_packet(hdev, skb);
3485 break;
3486
3487 case HCI_ACLDATA_PKT:
3488 BT_DBG("%s ACL data packet", hdev->name);
3489 hci_acldata_packet(hdev, skb);
3490 break;
3491
3492 case HCI_SCODATA_PKT:
3493 BT_DBG("%s SCO data packet", hdev->name);
3494 hci_scodata_packet(hdev, skb);
3495 break;
3496
3497 default:
3498 kfree_skb(skb);
3499 break;
3500 }
3501 }
1da177e4
LT		 3502}
3503
c347b765 3504static void hci_cmd_work(struct work_struct *work)
1da177e4 3505{
c347b765 3506 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 3507 struct sk_buff *skb;
3508
2104786b
AE		 3509 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
3510 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 3511
1da177e4 3512 /* Send queued commands */
5a08ecce
AE		 3513 if (atomic_read(&hdev->cmd_cnt)) {
3514 skb = skb_dequeue(&hdev->cmd_q);
3515 if (!skb)
3516 return;
3517
7585b97a 3518 kfree_skb(hdev->sent_cmd);
1da177e4 3519
70f23020
AE		 3520 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
3521 if (hdev->sent_cmd) {
1da177e4
LT		 3522 atomic_dec(&hdev->cmd_cnt);
3523 hci_send_frame(skb);
7bdb8a5c
SJ		 3524 if (test_bit(HCI_RESET, &hdev->flags))
3525 del_timer(&hdev->cmd_timer);
3526 else
3527 mod_timer(&hdev->cmd_timer,
5f246e89 3528 jiffies + HCI_CMD_TIMEOUT);
1da177e4
LT		 3529 } else {
3530 skb_queue_head(&hdev->cmd_q, skb);
c347b765 3531 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3532 }
3533 }
3534}
2519a1fc 3535
31f7956c
AG		 3536u8 bdaddr_to_le(u8 bdaddr_type)
3537{
3538 switch (bdaddr_type) {
3539 case BDADDR_LE_PUBLIC:
3540 return ADDR_LE_DEV_PUBLIC;
3541
3542 default:
3543 /* Fallback to LE Random address type */
3544 return ADDR_LE_DEV_RANDOM;
3545 }
3546}
Ubuntu Artful kernel mirror