]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/bluetooth/hci_core.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'master' of git://git.kernel.org/pub/scm/linux/kernel/git/linville/wireless
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_core.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2011 ProFUSION Embedded Systems
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth HCI core. */
27
28 #include <linux/jiffies.h>
29 #include <linux/module.h>
30 #include <linux/kmod.h>
31
32 #include <linux/types.h>
33 #include <linux/errno.h>
34 #include <linux/kernel.h>
35 #include <linux/sched.h>
36 #include <linux/slab.h>
37 #include <linux/poll.h>
38 #include <linux/fcntl.h>
39 #include <linux/init.h>
40 #include <linux/skbuff.h>
41 #include <linux/workqueue.h>
42 #include <linux/interrupt.h>
43 #include <linux/rfkill.h>
44 #include <linux/timer.h>
45 #include <linux/crypto.h>
46 #include <net/sock.h>
47
48 #include <linux/uaccess.h>
49 #include <asm/unaligned.h>
50
51 #include <net/bluetooth/bluetooth.h>
52 #include <net/bluetooth/hci_core.h>
53
54 #define AUTO_OFF_TIMEOUT 2000
55
56 static void hci_rx_work(struct work_struct *work);
57 static void hci_cmd_work(struct work_struct *work);
58 static void hci_tx_work(struct work_struct *work);
59
60 /* HCI device list */
61 LIST_HEAD(hci_dev_list);
62 DEFINE_RWLOCK(hci_dev_list_lock);
63
64 /* HCI callback list */
65 LIST_HEAD(hci_cb_list);
66 DEFINE_RWLOCK(hci_cb_list_lock);
67
68 /* ---- HCI notifications ---- */
69
70 static void hci_notify(struct hci_dev *hdev, int event)
71 {
72 hci_sock_dev_event(hdev, event);
73 }
74
75 /* ---- HCI requests ---- */
76
77 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
78 {
79 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
80
81 /* If this is the init phase check if the completed command matches
82 * the last init command, and if not just return.
83 */
84 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd) {
85 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
86 struct sk_buff *skb;
87
88 /* Some CSR based controllers generate a spontaneous
89 * reset complete event during init and any pending
90 * command will never be completed. In such a case we
91 * need to resend whatever was the last sent
92 * command.
93 */
94
95 if (cmd != HCI_OP_RESET || sent->opcode == HCI_OP_RESET)
96 return;
97
98 skb = skb_clone(hdev->sent_cmd, GFP_ATOMIC);
99 if (skb) {
100 skb_queue_head(&hdev->cmd_q, skb);
101 queue_work(hdev->workqueue, &hdev->cmd_work);
102 }
103
104 return;
105 }
106
107 if (hdev->req_status == HCI_REQ_PEND) {
108 hdev->req_result = result;
109 hdev->req_status = HCI_REQ_DONE;
110 wake_up_interruptible(&hdev->req_wait_q);
111 }
112 }
113
114 static void hci_req_cancel(struct hci_dev *hdev, int err)
115 {
116 BT_DBG("%s err 0x%2.2x", hdev->name, err);
117
118 if (hdev->req_status == HCI_REQ_PEND) {
119 hdev->req_result = err;
120 hdev->req_status = HCI_REQ_CANCELED;
121 wake_up_interruptible(&hdev->req_wait_q);
122 }
123 }
124
125 /* Execute request and wait for completion. */
126 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
127 unsigned long opt, __u32 timeout)
128 {
129 DECLARE_WAITQUEUE(wait, current);
130 int err = 0;
131
132 BT_DBG("%s start", hdev->name);
133
134 hdev->req_status = HCI_REQ_PEND;
135
136 add_wait_queue(&hdev->req_wait_q, &wait);
137 set_current_state(TASK_INTERRUPTIBLE);
138
139 req(hdev, opt);
140 schedule_timeout(timeout);
141
142 remove_wait_queue(&hdev->req_wait_q, &wait);
143
144 if (signal_pending(current))
145 return -EINTR;
146
147 switch (hdev->req_status) {
148 case HCI_REQ_DONE:
149 err = -bt_to_errno(hdev->req_result);
150 break;
151
152 case HCI_REQ_CANCELED:
153 err = -hdev->req_result;
154 break;
155
156 default:
157 err = -ETIMEDOUT;
158 break;
159 }
160
161 hdev->req_status = hdev->req_result = 0;
162
163 BT_DBG("%s end: err %d", hdev->name, err);
164
165 return err;
166 }
167
168 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
169 unsigned long opt, __u32 timeout)
170 {
171 int ret;
172
173 if (!test_bit(HCI_UP, &hdev->flags))
174 return -ENETDOWN;
175
176 /* Serialize all requests */
177 hci_req_lock(hdev);
178 ret = __hci_request(hdev, req, opt, timeout);
179 hci_req_unlock(hdev);
180
181 return ret;
182 }
183
184 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
185 {
186 BT_DBG("%s %ld", hdev->name, opt);
187
188 /* Reset device */
189 set_bit(HCI_RESET, &hdev->flags);
190 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
191 }
192
193 static void bredr_init(struct hci_dev *hdev)
194 {
195 struct hci_cp_delete_stored_link_key cp;
196 __le16 param;
197 __u8 flt_type;
198
199 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
200
201 /* Mandatory initialization */
202
203 /* Reset */
204 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
205 set_bit(HCI_RESET, &hdev->flags);
206 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
207 }
208
209 /* Read Local Supported Features */
210 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
211
212 /* Read Local Version */
213 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
214
215 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
216 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
217
218 /* Read BD Address */
219 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
220
221 /* Read Class of Device */
222 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
223
224 /* Read Local Name */
225 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
226
227 /* Read Voice Setting */
228 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
229
230 /* Optional initialization */
231
232 /* Clear Event Filters */
233 flt_type = HCI_FLT_CLEAR_ALL;
234 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
235
236 /* Connection accept timeout ~20 secs */
237 param = cpu_to_le16(0x7d00);
238 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
239
240 bacpy(&cp.bdaddr, BDADDR_ANY);
241 cp.delete_all = 1;
242 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
243 }
244
245 static void amp_init(struct hci_dev *hdev)
246 {
247 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
248
249 /* Reset */
250 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
251
252 /* Read Local Version */
253 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
254 }
255
256 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
257 {
258 struct sk_buff *skb;
259
260 BT_DBG("%s %ld", hdev->name, opt);
261
262 /* Driver initialization */
263
264 /* Special commands */
265 while ((skb = skb_dequeue(&hdev->driver_init))) {
266 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
267 skb->dev = (void *) hdev;
268
269 skb_queue_tail(&hdev->cmd_q, skb);
270 queue_work(hdev->workqueue, &hdev->cmd_work);
271 }
272 skb_queue_purge(&hdev->driver_init);
273
274 switch (hdev->dev_type) {
275 case HCI_BREDR:
276 bredr_init(hdev);
277 break;
278
279 case HCI_AMP:
280 amp_init(hdev);
281 break;
282
283 default:
284 BT_ERR("Unknown device type %d", hdev->dev_type);
285 break;
286 }
287
288 }
289
290 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
291 {
292 BT_DBG("%s", hdev->name);
293
294 /* Read LE buffer size */
295 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
296 }
297
298 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
299 {
300 __u8 scan = opt;
301
302 BT_DBG("%s %x", hdev->name, scan);
303
304 /* Inquiry and Page scans */
305 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
306 }
307
308 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
309 {
310 __u8 auth = opt;
311
312 BT_DBG("%s %x", hdev->name, auth);
313
314 /* Authentication */
315 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
316 }
317
318 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
319 {
320 __u8 encrypt = opt;
321
322 BT_DBG("%s %x", hdev->name, encrypt);
323
324 /* Encryption */
325 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
326 }
327
328 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
329 {
330 __le16 policy = cpu_to_le16(opt);
331
332 BT_DBG("%s %x", hdev->name, policy);
333
334 /* Default link policy */
335 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
336 }
337
338 /* Get HCI device by index.
339 * Device is held on return. */
340 struct hci_dev *hci_dev_get(int index)
341 {
342 struct hci_dev *hdev = NULL, *d;
343
344 BT_DBG("%d", index);
345
346 if (index < 0)
347 return NULL;
348
349 read_lock(&hci_dev_list_lock);
350 list_for_each_entry(d, &hci_dev_list, list) {
351 if (d->id == index) {
352 hdev = hci_dev_hold(d);
353 break;
354 }
355 }
356 read_unlock(&hci_dev_list_lock);
357 return hdev;
358 }
359
360 /* ---- Inquiry support ---- */
361
362 bool hci_discovery_active(struct hci_dev *hdev)
363 {
364 struct discovery_state *discov = &hdev->discovery;
365
366 switch (discov->state) {
367 case DISCOVERY_FINDING:
368 case DISCOVERY_RESOLVING:
369 return true;
370
371 default:
372 return false;
373 }
374 }
375
376 void hci_discovery_set_state(struct hci_dev *hdev, int state)
377 {
378 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
379
380 if (hdev->discovery.state == state)
381 return;
382
383 switch (state) {
384 case DISCOVERY_STOPPED:
385 if (hdev->discovery.state != DISCOVERY_STARTING)
386 mgmt_discovering(hdev, 0);
387 hdev->discovery.type = 0;
388 break;
389 case DISCOVERY_STARTING:
390 break;
391 case DISCOVERY_FINDING:
392 mgmt_discovering(hdev, 1);
393 break;
394 case DISCOVERY_RESOLVING:
395 break;
396 case DISCOVERY_STOPPING:
397 break;
398 }
399
400 hdev->discovery.state = state;
401 }
402
403 static void inquiry_cache_flush(struct hci_dev *hdev)
404 {
405 struct discovery_state *cache = &hdev->discovery;
406 struct inquiry_entry *p, *n;
407
408 list_for_each_entry_safe(p, n, &cache->all, all) {
409 list_del(&p->all);
410 kfree(p);
411 }
412
413 INIT_LIST_HEAD(&cache->unknown);
414 INIT_LIST_HEAD(&cache->resolve);
415 }
416
417 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
418 {
419 struct discovery_state *cache = &hdev->discovery;
420 struct inquiry_entry *e;
421
422 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
423
424 list_for_each_entry(e, &cache->all, all) {
425 if (!bacmp(&e->data.bdaddr, bdaddr))
426 return e;
427 }
428
429 return NULL;
430 }
431
432 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
433 bdaddr_t *bdaddr)
434 {
435 struct discovery_state *cache = &hdev->discovery;
436 struct inquiry_entry *e;
437
438 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
439
440 list_for_each_entry(e, &cache->unknown, list) {
441 if (!bacmp(&e->data.bdaddr, bdaddr))
442 return e;
443 }
444
445 return NULL;
446 }
447
448 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
449 bdaddr_t *bdaddr,
450 int state)
451 {
452 struct discovery_state *cache = &hdev->discovery;
453 struct inquiry_entry *e;
454
455 BT_DBG("cache %p bdaddr %s state %d", cache, batostr(bdaddr), state);
456
457 list_for_each_entry(e, &cache->resolve, list) {
458 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
459 return e;
460 if (!bacmp(&e->data.bdaddr, bdaddr))
461 return e;
462 }
463
464 return NULL;
465 }
466
467 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
468 struct inquiry_entry *ie)
469 {
470 struct discovery_state *cache = &hdev->discovery;
471 struct list_head *pos = &cache->resolve;
472 struct inquiry_entry *p;
473
474 list_del(&ie->list);
475
476 list_for_each_entry(p, &cache->resolve, list) {
477 if (p->name_state != NAME_PENDING &&
478 abs(p->data.rssi) >= abs(ie->data.rssi))
479 break;
480 pos = &p->list;
481 }
482
483 list_add(&ie->list, pos);
484 }
485
486 bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
487 bool name_known, bool *ssp)
488 {
489 struct discovery_state *cache = &hdev->discovery;
490 struct inquiry_entry *ie;
491
492 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
493
494 if (ssp)
495 *ssp = data->ssp_mode;
496
497 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
498 if (ie) {
499 if (ie->data.ssp_mode && ssp)
500 *ssp = true;
501
502 if (ie->name_state == NAME_NEEDED &&
503 data->rssi != ie->data.rssi) {
504 ie->data.rssi = data->rssi;
505 hci_inquiry_cache_update_resolve(hdev, ie);
506 }
507
508 goto update;
509 }
510
511 /* Entry not in the cache. Add new one. */
512 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
513 if (!ie)
514 return false;
515
516 list_add(&ie->all, &cache->all);
517
518 if (name_known) {
519 ie->name_state = NAME_KNOWN;
520 } else {
521 ie->name_state = NAME_NOT_KNOWN;
522 list_add(&ie->list, &cache->unknown);
523 }
524
525 update:
526 if (name_known && ie->name_state != NAME_KNOWN &&
527 ie->name_state != NAME_PENDING) {
528 ie->name_state = NAME_KNOWN;
529 list_del(&ie->list);
530 }
531
532 memcpy(&ie->data, data, sizeof(*data));
533 ie->timestamp = jiffies;
534 cache->timestamp = jiffies;
535
536 if (ie->name_state == NAME_NOT_KNOWN)
537 return false;
538
539 return true;
540 }
541
542 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
543 {
544 struct discovery_state *cache = &hdev->discovery;
545 struct inquiry_info *info = (struct inquiry_info *) buf;
546 struct inquiry_entry *e;
547 int copied = 0;
548
549 list_for_each_entry(e, &cache->all, all) {
550 struct inquiry_data *data = &e->data;
551
552 if (copied >= num)
553 break;
554
555 bacpy(&info->bdaddr, &data->bdaddr);
556 info->pscan_rep_mode = data->pscan_rep_mode;
557 info->pscan_period_mode = data->pscan_period_mode;
558 info->pscan_mode = data->pscan_mode;
559 memcpy(info->dev_class, data->dev_class, 3);
560 info->clock_offset = data->clock_offset;
561
562 info++;
563 copied++;
564 }
565
566 BT_DBG("cache %p, copied %d", cache, copied);
567 return copied;
568 }
569
570 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
571 {
572 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
573 struct hci_cp_inquiry cp;
574
575 BT_DBG("%s", hdev->name);
576
577 if (test_bit(HCI_INQUIRY, &hdev->flags))
578 return;
579
580 /* Start Inquiry */
581 memcpy(&cp.lap, &ir->lap, 3);
582 cp.length = ir->length;
583 cp.num_rsp = ir->num_rsp;
584 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
585 }
586
587 int hci_inquiry(void __user *arg)
588 {
589 __u8 __user *ptr = arg;
590 struct hci_inquiry_req ir;
591 struct hci_dev *hdev;
592 int err = 0, do_inquiry = 0, max_rsp;
593 long timeo;
594 __u8 *buf;
595
596 if (copy_from_user(&ir, ptr, sizeof(ir)))
597 return -EFAULT;
598
599 hdev = hci_dev_get(ir.dev_id);
600 if (!hdev)
601 return -ENODEV;
602
603 hci_dev_lock(hdev);
604 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
605 inquiry_cache_empty(hdev) ||
606 ir.flags & IREQ_CACHE_FLUSH) {
607 inquiry_cache_flush(hdev);
608 do_inquiry = 1;
609 }
610 hci_dev_unlock(hdev);
611
612 timeo = ir.length * msecs_to_jiffies(2000);
613
614 if (do_inquiry) {
615 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
616 if (err < 0)
617 goto done;
618 }
619
620 /* for unlimited number of responses we will use buffer with 255 entries */
621 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
622
623 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
624 * copy it to the user space.
625 */
626 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
627 if (!buf) {
628 err = -ENOMEM;
629 goto done;
630 }
631
632 hci_dev_lock(hdev);
633 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
634 hci_dev_unlock(hdev);
635
636 BT_DBG("num_rsp %d", ir.num_rsp);
637
638 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
639 ptr += sizeof(ir);
640 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
641 ir.num_rsp))
642 err = -EFAULT;
643 } else
644 err = -EFAULT;
645
646 kfree(buf);
647
648 done:
649 hci_dev_put(hdev);
650 return err;
651 }
652
653 /* ---- HCI ioctl helpers ---- */
654
655 int hci_dev_open(__u16 dev)
656 {
657 struct hci_dev *hdev;
658 int ret = 0;
659
660 hdev = hci_dev_get(dev);
661 if (!hdev)
662 return -ENODEV;
663
664 BT_DBG("%s %p", hdev->name, hdev);
665
666 hci_req_lock(hdev);
667
668 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
669 ret = -ENODEV;
670 goto done;
671 }
672
673 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
674 ret = -ERFKILL;
675 goto done;
676 }
677
678 if (test_bit(HCI_UP, &hdev->flags)) {
679 ret = -EALREADY;
680 goto done;
681 }
682
683 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
684 set_bit(HCI_RAW, &hdev->flags);
685
686 /* Treat all non BR/EDR controllers as raw devices if
687 enable_hs is not set */
688 if (hdev->dev_type != HCI_BREDR && !enable_hs)
689 set_bit(HCI_RAW, &hdev->flags);
690
691 if (hdev->open(hdev)) {
692 ret = -EIO;
693 goto done;
694 }
695
696 if (!test_bit(HCI_RAW, &hdev->flags)) {
697 atomic_set(&hdev->cmd_cnt, 1);
698 set_bit(HCI_INIT, &hdev->flags);
699 hdev->init_last_cmd = 0;
700
701 ret = __hci_request(hdev, hci_init_req, 0,
702 msecs_to_jiffies(HCI_INIT_TIMEOUT));
703
704 if (lmp_host_le_capable(hdev))
705 ret = __hci_request(hdev, hci_le_init_req, 0,
706 msecs_to_jiffies(HCI_INIT_TIMEOUT));
707
708 clear_bit(HCI_INIT, &hdev->flags);
709 }
710
711 if (!ret) {
712 hci_dev_hold(hdev);
713 set_bit(HCI_UP, &hdev->flags);
714 hci_notify(hdev, HCI_DEV_UP);
715 if (!test_bit(HCI_SETUP, &hdev->dev_flags)) {
716 hci_dev_lock(hdev);
717 mgmt_powered(hdev, 1);
718 hci_dev_unlock(hdev);
719 }
720 } else {
721 /* Init failed, cleanup */
722 flush_work(&hdev->tx_work);
723 flush_work(&hdev->cmd_work);
724 flush_work(&hdev->rx_work);
725
726 skb_queue_purge(&hdev->cmd_q);
727 skb_queue_purge(&hdev->rx_q);
728
729 if (hdev->flush)
730 hdev->flush(hdev);
731
732 if (hdev->sent_cmd) {
733 kfree_skb(hdev->sent_cmd);
734 hdev->sent_cmd = NULL;
735 }
736
737 hdev->close(hdev);
738 hdev->flags = 0;
739 }
740
741 done:
742 hci_req_unlock(hdev);
743 hci_dev_put(hdev);
744 return ret;
745 }
746
747 static int hci_dev_do_close(struct hci_dev *hdev)
748 {
749 BT_DBG("%s %p", hdev->name, hdev);
750
751 cancel_work_sync(&hdev->le_scan);
752
753 hci_req_cancel(hdev, ENODEV);
754 hci_req_lock(hdev);
755
756 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
757 del_timer_sync(&hdev->cmd_timer);
758 hci_req_unlock(hdev);
759 return 0;
760 }
761
762 /* Flush RX and TX works */
763 flush_work(&hdev->tx_work);
764 flush_work(&hdev->rx_work);
765
766 if (hdev->discov_timeout > 0) {
767 cancel_delayed_work(&hdev->discov_off);
768 hdev->discov_timeout = 0;
769 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
770 }
771
772 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
773 cancel_delayed_work(&hdev->service_cache);
774
775 cancel_delayed_work_sync(&hdev->le_scan_disable);
776
777 hci_dev_lock(hdev);
778 inquiry_cache_flush(hdev);
779 hci_conn_hash_flush(hdev);
780 hci_dev_unlock(hdev);
781
782 hci_notify(hdev, HCI_DEV_DOWN);
783
784 if (hdev->flush)
785 hdev->flush(hdev);
786
787 /* Reset device */
788 skb_queue_purge(&hdev->cmd_q);
789 atomic_set(&hdev->cmd_cnt, 1);
790 if (!test_bit(HCI_RAW, &hdev->flags) &&
791 test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
792 set_bit(HCI_INIT, &hdev->flags);
793 __hci_request(hdev, hci_reset_req, 0,
794 msecs_to_jiffies(250));
795 clear_bit(HCI_INIT, &hdev->flags);
796 }
797
798 /* flush cmd work */
799 flush_work(&hdev->cmd_work);
800
801 /* Drop queues */
802 skb_queue_purge(&hdev->rx_q);
803 skb_queue_purge(&hdev->cmd_q);
804 skb_queue_purge(&hdev->raw_q);
805
806 /* Drop last sent command */
807 if (hdev->sent_cmd) {
808 del_timer_sync(&hdev->cmd_timer);
809 kfree_skb(hdev->sent_cmd);
810 hdev->sent_cmd = NULL;
811 }
812
813 /* After this point our queues are empty
814 * and no tasks are scheduled. */
815 hdev->close(hdev);
816
817 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
818 hci_dev_lock(hdev);
819 mgmt_powered(hdev, 0);
820 hci_dev_unlock(hdev);
821 }
822
823 /* Clear flags */
824 hdev->flags = 0;
825
826 memset(hdev->eir, 0, sizeof(hdev->eir));
827 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
828
829 hci_req_unlock(hdev);
830
831 hci_dev_put(hdev);
832 return 0;
833 }
834
835 int hci_dev_close(__u16 dev)
836 {
837 struct hci_dev *hdev;
838 int err;
839
840 hdev = hci_dev_get(dev);
841 if (!hdev)
842 return -ENODEV;
843
844 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
845 cancel_delayed_work(&hdev->power_off);
846
847 err = hci_dev_do_close(hdev);
848
849 hci_dev_put(hdev);
850 return err;
851 }
852
853 int hci_dev_reset(__u16 dev)
854 {
855 struct hci_dev *hdev;
856 int ret = 0;
857
858 hdev = hci_dev_get(dev);
859 if (!hdev)
860 return -ENODEV;
861
862 hci_req_lock(hdev);
863
864 if (!test_bit(HCI_UP, &hdev->flags))
865 goto done;
866
867 /* Drop queues */
868 skb_queue_purge(&hdev->rx_q);
869 skb_queue_purge(&hdev->cmd_q);
870
871 hci_dev_lock(hdev);
872 inquiry_cache_flush(hdev);
873 hci_conn_hash_flush(hdev);
874 hci_dev_unlock(hdev);
875
876 if (hdev->flush)
877 hdev->flush(hdev);
878
879 atomic_set(&hdev->cmd_cnt, 1);
880 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
881
882 if (!test_bit(HCI_RAW, &hdev->flags))
883 ret = __hci_request(hdev, hci_reset_req, 0,
884 msecs_to_jiffies(HCI_INIT_TIMEOUT));
885
886 done:
887 hci_req_unlock(hdev);
888 hci_dev_put(hdev);
889 return ret;
890 }
891
892 int hci_dev_reset_stat(__u16 dev)
893 {
894 struct hci_dev *hdev;
895 int ret = 0;
896
897 hdev = hci_dev_get(dev);
898 if (!hdev)
899 return -ENODEV;
900
901 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
902
903 hci_dev_put(hdev);
904
905 return ret;
906 }
907
908 int hci_dev_cmd(unsigned int cmd, void __user *arg)
909 {
910 struct hci_dev *hdev;
911 struct hci_dev_req dr;
912 int err = 0;
913
914 if (copy_from_user(&dr, arg, sizeof(dr)))
915 return -EFAULT;
916
917 hdev = hci_dev_get(dr.dev_id);
918 if (!hdev)
919 return -ENODEV;
920
921 switch (cmd) {
922 case HCISETAUTH:
923 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
924 msecs_to_jiffies(HCI_INIT_TIMEOUT));
925 break;
926
927 case HCISETENCRYPT:
928 if (!lmp_encrypt_capable(hdev)) {
929 err = -EOPNOTSUPP;
930 break;
931 }
932
933 if (!test_bit(HCI_AUTH, &hdev->flags)) {
934 /* Auth must be enabled first */
935 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
936 msecs_to_jiffies(HCI_INIT_TIMEOUT));
937 if (err)
938 break;
939 }
940
941 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
942 msecs_to_jiffies(HCI_INIT_TIMEOUT));
943 break;
944
945 case HCISETSCAN:
946 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
947 msecs_to_jiffies(HCI_INIT_TIMEOUT));
948 break;
949
950 case HCISETLINKPOL:
951 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
952 msecs_to_jiffies(HCI_INIT_TIMEOUT));
953 break;
954
955 case HCISETLINKMODE:
956 hdev->link_mode = ((__u16) dr.dev_opt) &
957 (HCI_LM_MASTER | HCI_LM_ACCEPT);
958 break;
959
960 case HCISETPTYPE:
961 hdev->pkt_type = (__u16) dr.dev_opt;
962 break;
963
964 case HCISETACLMTU:
965 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
966 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
967 break;
968
969 case HCISETSCOMTU:
970 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
971 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
972 break;
973
974 default:
975 err = -EINVAL;
976 break;
977 }
978
979 hci_dev_put(hdev);
980 return err;
981 }
982
983 int hci_get_dev_list(void __user *arg)
984 {
985 struct hci_dev *hdev;
986 struct hci_dev_list_req *dl;
987 struct hci_dev_req *dr;
988 int n = 0, size, err;
989 __u16 dev_num;
990
991 if (get_user(dev_num, (__u16 __user *) arg))
992 return -EFAULT;
993
994 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
995 return -EINVAL;
996
997 size = sizeof(*dl) + dev_num * sizeof(*dr);
998
999 dl = kzalloc(size, GFP_KERNEL);
1000 if (!dl)
1001 return -ENOMEM;
1002
1003 dr = dl->dev_req;
1004
1005 read_lock(&hci_dev_list_lock);
1006 list_for_each_entry(hdev, &hci_dev_list, list) {
1007 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1008 cancel_delayed_work(&hdev->power_off);
1009
1010 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1011 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1012
1013 (dr + n)->dev_id = hdev->id;
1014 (dr + n)->dev_opt = hdev->flags;
1015
1016 if (++n >= dev_num)
1017 break;
1018 }
1019 read_unlock(&hci_dev_list_lock);
1020
1021 dl->dev_num = n;
1022 size = sizeof(*dl) + n * sizeof(*dr);
1023
1024 err = copy_to_user(arg, dl, size);
1025 kfree(dl);
1026
1027 return err ? -EFAULT : 0;
1028 }
1029
1030 int hci_get_dev_info(void __user *arg)
1031 {
1032 struct hci_dev *hdev;
1033 struct hci_dev_info di;
1034 int err = 0;
1035
1036 if (copy_from_user(&di, arg, sizeof(di)))
1037 return -EFAULT;
1038
1039 hdev = hci_dev_get(di.dev_id);
1040 if (!hdev)
1041 return -ENODEV;
1042
1043 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1044 cancel_delayed_work_sync(&hdev->power_off);
1045
1046 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1047 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1048
1049 strcpy(di.name, hdev->name);
1050 di.bdaddr = hdev->bdaddr;
1051 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1052 di.flags = hdev->flags;
1053 di.pkt_type = hdev->pkt_type;
1054 di.acl_mtu = hdev->acl_mtu;
1055 di.acl_pkts = hdev->acl_pkts;
1056 di.sco_mtu = hdev->sco_mtu;
1057 di.sco_pkts = hdev->sco_pkts;
1058 di.link_policy = hdev->link_policy;
1059 di.link_mode = hdev->link_mode;
1060
1061 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1062 memcpy(&di.features, &hdev->features, sizeof(di.features));
1063
1064 if (copy_to_user(arg, &di, sizeof(di)))
1065 err = -EFAULT;
1066
1067 hci_dev_put(hdev);
1068
1069 return err;
1070 }
1071
1072 /* ---- Interface to HCI drivers ---- */
1073
1074 static int hci_rfkill_set_block(void *data, bool blocked)
1075 {
1076 struct hci_dev *hdev = data;
1077
1078 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1079
1080 if (!blocked)
1081 return 0;
1082
1083 hci_dev_do_close(hdev);
1084
1085 return 0;
1086 }
1087
1088 static const struct rfkill_ops hci_rfkill_ops = {
1089 .set_block = hci_rfkill_set_block,
1090 };
1091
1092 /* Alloc HCI device */
1093 struct hci_dev *hci_alloc_dev(void)
1094 {
1095 struct hci_dev *hdev;
1096
1097 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1098 if (!hdev)
1099 return NULL;
1100
1101 hci_init_sysfs(hdev);
1102 skb_queue_head_init(&hdev->driver_init);
1103
1104 return hdev;
1105 }
1106 EXPORT_SYMBOL(hci_alloc_dev);
1107
1108 /* Free HCI device */
1109 void hci_free_dev(struct hci_dev *hdev)
1110 {
1111 skb_queue_purge(&hdev->driver_init);
1112
1113 /* will free via device release */
1114 put_device(&hdev->dev);
1115 }
1116 EXPORT_SYMBOL(hci_free_dev);
1117
1118 static void hci_power_on(struct work_struct *work)
1119 {
1120 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1121
1122 BT_DBG("%s", hdev->name);
1123
1124 if (hci_dev_open(hdev->id) < 0)
1125 return;
1126
1127 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1128 schedule_delayed_work(&hdev->power_off,
1129 msecs_to_jiffies(AUTO_OFF_TIMEOUT));
1130
1131 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
1132 mgmt_index_added(hdev);
1133 }
1134
1135 static void hci_power_off(struct work_struct *work)
1136 {
1137 struct hci_dev *hdev = container_of(work, struct hci_dev,
1138 power_off.work);
1139
1140 BT_DBG("%s", hdev->name);
1141
1142 hci_dev_do_close(hdev);
1143 }
1144
1145 static void hci_discov_off(struct work_struct *work)
1146 {
1147 struct hci_dev *hdev;
1148 u8 scan = SCAN_PAGE;
1149
1150 hdev = container_of(work, struct hci_dev, discov_off.work);
1151
1152 BT_DBG("%s", hdev->name);
1153
1154 hci_dev_lock(hdev);
1155
1156 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1157
1158 hdev->discov_timeout = 0;
1159
1160 hci_dev_unlock(hdev);
1161 }
1162
1163 int hci_uuids_clear(struct hci_dev *hdev)
1164 {
1165 struct list_head *p, *n;
1166
1167 list_for_each_safe(p, n, &hdev->uuids) {
1168 struct bt_uuid *uuid;
1169
1170 uuid = list_entry(p, struct bt_uuid, list);
1171
1172 list_del(p);
1173 kfree(uuid);
1174 }
1175
1176 return 0;
1177 }
1178
1179 int hci_link_keys_clear(struct hci_dev *hdev)
1180 {
1181 struct list_head *p, *n;
1182
1183 list_for_each_safe(p, n, &hdev->link_keys) {
1184 struct link_key *key;
1185
1186 key = list_entry(p, struct link_key, list);
1187
1188 list_del(p);
1189 kfree(key);
1190 }
1191
1192 return 0;
1193 }
1194
1195 int hci_smp_ltks_clear(struct hci_dev *hdev)
1196 {
1197 struct smp_ltk *k, *tmp;
1198
1199 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1200 list_del(&k->list);
1201 kfree(k);
1202 }
1203
1204 return 0;
1205 }
1206
1207 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1208 {
1209 struct link_key *k;
1210
1211 list_for_each_entry(k, &hdev->link_keys, list)
1212 if (bacmp(bdaddr, &k->bdaddr) == 0)
1213 return k;
1214
1215 return NULL;
1216 }
1217
1218 static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1219 u8 key_type, u8 old_key_type)
1220 {
1221 /* Legacy key */
1222 if (key_type < 0x03)
1223 return 1;
1224
1225 /* Debug keys are insecure so don't store them persistently */
1226 if (key_type == HCI_LK_DEBUG_COMBINATION)
1227 return 0;
1228
1229 /* Changed combination key and there's no previous one */
1230 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1231 return 0;
1232
1233 /* Security mode 3 case */
1234 if (!conn)
1235 return 1;
1236
1237 /* Neither local nor remote side had no-bonding as requirement */
1238 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1239 return 1;
1240
1241 /* Local side had dedicated bonding as requirement */
1242 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1243 return 1;
1244
1245 /* Remote side had dedicated bonding as requirement */
1246 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1247 return 1;
1248
1249 /* If none of the above criteria match, then don't store the key
1250 * persistently */
1251 return 0;
1252 }
1253
1254 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1255 {
1256 struct smp_ltk *k;
1257
1258 list_for_each_entry(k, &hdev->long_term_keys, list) {
1259 if (k->ediv != ediv ||
1260 memcmp(rand, k->rand, sizeof(k->rand)))
1261 continue;
1262
1263 return k;
1264 }
1265
1266 return NULL;
1267 }
1268 EXPORT_SYMBOL(hci_find_ltk);
1269
1270 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1271 u8 addr_type)
1272 {
1273 struct smp_ltk *k;
1274
1275 list_for_each_entry(k, &hdev->long_term_keys, list)
1276 if (addr_type == k->bdaddr_type &&
1277 bacmp(bdaddr, &k->bdaddr) == 0)
1278 return k;
1279
1280 return NULL;
1281 }
1282 EXPORT_SYMBOL(hci_find_ltk_by_addr);
1283
1284 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1285 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1286 {
1287 struct link_key *key, *old_key;
1288 u8 old_key_type, persistent;
1289
1290 old_key = hci_find_link_key(hdev, bdaddr);
1291 if (old_key) {
1292 old_key_type = old_key->type;
1293 key = old_key;
1294 } else {
1295 old_key_type = conn ? conn->key_type : 0xff;
1296 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1297 if (!key)
1298 return -ENOMEM;
1299 list_add(&key->list, &hdev->link_keys);
1300 }
1301
1302 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1303
1304 /* Some buggy controller combinations generate a changed
1305 * combination key for legacy pairing even when there's no
1306 * previous key */
1307 if (type == HCI_LK_CHANGED_COMBINATION &&
1308 (!conn || conn->remote_auth == 0xff) &&
1309 old_key_type == 0xff) {
1310 type = HCI_LK_COMBINATION;
1311 if (conn)
1312 conn->key_type = type;
1313 }
1314
1315 bacpy(&key->bdaddr, bdaddr);
1316 memcpy(key->val, val, 16);
1317 key->pin_len = pin_len;
1318
1319 if (type == HCI_LK_CHANGED_COMBINATION)
1320 key->type = old_key_type;
1321 else
1322 key->type = type;
1323
1324 if (!new_key)
1325 return 0;
1326
1327 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1328
1329 mgmt_new_link_key(hdev, key, persistent);
1330
1331 if (!persistent) {
1332 list_del(&key->list);
1333 kfree(key);
1334 }
1335
1336 return 0;
1337 }
1338
1339 int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
1340 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, u16
1341 ediv, u8 rand[8])
1342 {
1343 struct smp_ltk *key, *old_key;
1344
1345 if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1346 return 0;
1347
1348 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1349 if (old_key)
1350 key = old_key;
1351 else {
1352 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1353 if (!key)
1354 return -ENOMEM;
1355 list_add(&key->list, &hdev->long_term_keys);
1356 }
1357
1358 bacpy(&key->bdaddr, bdaddr);
1359 key->bdaddr_type = addr_type;
1360 memcpy(key->val, tk, sizeof(key->val));
1361 key->authenticated = authenticated;
1362 key->ediv = ediv;
1363 key->enc_size = enc_size;
1364 key->type = type;
1365 memcpy(key->rand, rand, sizeof(key->rand));
1366
1367 if (!new_key)
1368 return 0;
1369
1370 if (type & HCI_SMP_LTK)
1371 mgmt_new_ltk(hdev, key, 1);
1372
1373 return 0;
1374 }
1375
1376 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1377 {
1378 struct link_key *key;
1379
1380 key = hci_find_link_key(hdev, bdaddr);
1381 if (!key)
1382 return -ENOENT;
1383
1384 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1385
1386 list_del(&key->list);
1387 kfree(key);
1388
1389 return 0;
1390 }
1391
1392 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1393 {
1394 struct smp_ltk *k, *tmp;
1395
1396 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1397 if (bacmp(bdaddr, &k->bdaddr))
1398 continue;
1399
1400 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1401
1402 list_del(&k->list);
1403 kfree(k);
1404 }
1405
1406 return 0;
1407 }
1408
1409 /* HCI command timer function */
1410 static void hci_cmd_timer(unsigned long arg)
1411 {
1412 struct hci_dev *hdev = (void *) arg;
1413
1414 BT_ERR("%s command tx timeout", hdev->name);
1415 atomic_set(&hdev->cmd_cnt, 1);
1416 queue_work(hdev->workqueue, &hdev->cmd_work);
1417 }
1418
1419 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1420 bdaddr_t *bdaddr)
1421 {
1422 struct oob_data *data;
1423
1424 list_for_each_entry(data, &hdev->remote_oob_data, list)
1425 if (bacmp(bdaddr, &data->bdaddr) == 0)
1426 return data;
1427
1428 return NULL;
1429 }
1430
1431 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1432 {
1433 struct oob_data *data;
1434
1435 data = hci_find_remote_oob_data(hdev, bdaddr);
1436 if (!data)
1437 return -ENOENT;
1438
1439 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1440
1441 list_del(&data->list);
1442 kfree(data);
1443
1444 return 0;
1445 }
1446
1447 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1448 {
1449 struct oob_data *data, *n;
1450
1451 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1452 list_del(&data->list);
1453 kfree(data);
1454 }
1455
1456 return 0;
1457 }
1458
1459 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1460 u8 *randomizer)
1461 {
1462 struct oob_data *data;
1463
1464 data = hci_find_remote_oob_data(hdev, bdaddr);
1465
1466 if (!data) {
1467 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1468 if (!data)
1469 return -ENOMEM;
1470
1471 bacpy(&data->bdaddr, bdaddr);
1472 list_add(&data->list, &hdev->remote_oob_data);
1473 }
1474
1475 memcpy(data->hash, hash, sizeof(data->hash));
1476 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1477
1478 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1479
1480 return 0;
1481 }
1482
1483 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
1484 {
1485 struct bdaddr_list *b;
1486
1487 list_for_each_entry(b, &hdev->blacklist, list)
1488 if (bacmp(bdaddr, &b->bdaddr) == 0)
1489 return b;
1490
1491 return NULL;
1492 }
1493
1494 int hci_blacklist_clear(struct hci_dev *hdev)
1495 {
1496 struct list_head *p, *n;
1497
1498 list_for_each_safe(p, n, &hdev->blacklist) {
1499 struct bdaddr_list *b;
1500
1501 b = list_entry(p, struct bdaddr_list, list);
1502
1503 list_del(p);
1504 kfree(b);
1505 }
1506
1507 return 0;
1508 }
1509
1510 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1511 {
1512 struct bdaddr_list *entry;
1513
1514 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1515 return -EBADF;
1516
1517 if (hci_blacklist_lookup(hdev, bdaddr))
1518 return -EEXIST;
1519
1520 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1521 if (!entry)
1522 return -ENOMEM;
1523
1524 bacpy(&entry->bdaddr, bdaddr);
1525
1526 list_add(&entry->list, &hdev->blacklist);
1527
1528 return mgmt_device_blocked(hdev, bdaddr, type);
1529 }
1530
1531 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1532 {
1533 struct bdaddr_list *entry;
1534
1535 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1536 return hci_blacklist_clear(hdev);
1537
1538 entry = hci_blacklist_lookup(hdev, bdaddr);
1539 if (!entry)
1540 return -ENOENT;
1541
1542 list_del(&entry->list);
1543 kfree(entry);
1544
1545 return mgmt_device_unblocked(hdev, bdaddr, type);
1546 }
1547
1548 static void hci_clear_adv_cache(struct work_struct *work)
1549 {
1550 struct hci_dev *hdev = container_of(work, struct hci_dev,
1551 adv_work.work);
1552
1553 hci_dev_lock(hdev);
1554
1555 hci_adv_entries_clear(hdev);
1556
1557 hci_dev_unlock(hdev);
1558 }
1559
1560 int hci_adv_entries_clear(struct hci_dev *hdev)
1561 {
1562 struct adv_entry *entry, *tmp;
1563
1564 list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1565 list_del(&entry->list);
1566 kfree(entry);
1567 }
1568
1569 BT_DBG("%s adv cache cleared", hdev->name);
1570
1571 return 0;
1572 }
1573
1574 struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1575 {
1576 struct adv_entry *entry;
1577
1578 list_for_each_entry(entry, &hdev->adv_entries, list)
1579 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1580 return entry;
1581
1582 return NULL;
1583 }
1584
1585 static inline int is_connectable_adv(u8 evt_type)
1586 {
1587 if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1588 return 1;
1589
1590 return 0;
1591 }
1592
1593 int hci_add_adv_entry(struct hci_dev *hdev,
1594 struct hci_ev_le_advertising_info *ev) { struct adv_entry *entry; if (!is_connectable_adv(ev->evt_type))
1595 return -EINVAL;
1596
1597 /* Only new entries should be added to adv_entries. So, if
1598 * bdaddr was found, don't add it. */
1599 if (hci_find_adv_entry(hdev, &ev->bdaddr))
1600 return 0;
1601
1602 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1603 if (!entry)
1604 return -ENOMEM;
1605
1606 bacpy(&entry->bdaddr, &ev->bdaddr);
1607 entry->bdaddr_type = ev->bdaddr_type;
1608
1609 list_add(&entry->list, &hdev->adv_entries);
1610
1611 BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1612 batostr(&entry->bdaddr), entry->bdaddr_type);
1613
1614 return 0;
1615 }
1616
1617 static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
1618 {
1619 struct le_scan_params *param = (struct le_scan_params *) opt;
1620 struct hci_cp_le_set_scan_param cp;
1621
1622 memset(&cp, 0, sizeof(cp));
1623 cp.type = param->type;
1624 cp.interval = cpu_to_le16(param->interval);
1625 cp.window = cpu_to_le16(param->window);
1626
1627 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
1628 }
1629
1630 static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
1631 {
1632 struct hci_cp_le_set_scan_enable cp;
1633
1634 memset(&cp, 0, sizeof(cp));
1635 cp.enable = 1;
1636
1637 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1638 }
1639
1640 static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
1641 u16 window, int timeout)
1642 {
1643 long timeo = msecs_to_jiffies(3000);
1644 struct le_scan_params param;
1645 int err;
1646
1647 BT_DBG("%s", hdev->name);
1648
1649 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1650 return -EINPROGRESS;
1651
1652 param.type = type;
1653 param.interval = interval;
1654 param.window = window;
1655
1656 hci_req_lock(hdev);
1657
1658 err = __hci_request(hdev, le_scan_param_req, (unsigned long) &param,
1659 timeo);
1660 if (!err)
1661 err = __hci_request(hdev, le_scan_enable_req, 0, timeo);
1662
1663 hci_req_unlock(hdev);
1664
1665 if (err < 0)
1666 return err;
1667
1668 schedule_delayed_work(&hdev->le_scan_disable,
1669 msecs_to_jiffies(timeout));
1670
1671 return 0;
1672 }
1673
1674 static void le_scan_disable_work(struct work_struct *work)
1675 {
1676 struct hci_dev *hdev = container_of(work, struct hci_dev,
1677 le_scan_disable.work);
1678 struct hci_cp_le_set_scan_enable cp;
1679
1680 BT_DBG("%s", hdev->name);
1681
1682 memset(&cp, 0, sizeof(cp));
1683
1684 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1685 }
1686
1687 static void le_scan_work(struct work_struct *work)
1688 {
1689 struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
1690 struct le_scan_params *param = &hdev->le_scan_params;
1691
1692 BT_DBG("%s", hdev->name);
1693
1694 hci_do_le_scan(hdev, param->type, param->interval, param->window,
1695 param->timeout);
1696 }
1697
1698 int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
1699 int timeout)
1700 {
1701 struct le_scan_params *param = &hdev->le_scan_params;
1702
1703 BT_DBG("%s", hdev->name);
1704
1705 if (work_busy(&hdev->le_scan))
1706 return -EINPROGRESS;
1707
1708 param->type = type;
1709 param->interval = interval;
1710 param->window = window;
1711 param->timeout = timeout;
1712
1713 queue_work(system_long_wq, &hdev->le_scan);
1714
1715 return 0;
1716 }
1717
1718 /* Register HCI device */
1719 int hci_register_dev(struct hci_dev *hdev)
1720 {
1721 struct list_head *head = &hci_dev_list, *p;
1722 int i, id, error;
1723
1724 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1725
1726 if (!hdev->open || !hdev->close)
1727 return -EINVAL;
1728
1729 /* Do not allow HCI_AMP devices to register at index 0,
1730 * so the index can be used as the AMP controller ID.
1731 */
1732 id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
1733
1734 write_lock(&hci_dev_list_lock);
1735
1736 /* Find first available device id */
1737 list_for_each(p, &hci_dev_list) {
1738 if (list_entry(p, struct hci_dev, list)->id != id)
1739 break;
1740 head = p; id++;
1741 }
1742
1743 sprintf(hdev->name, "hci%d", id);
1744 hdev->id = id;
1745 list_add_tail(&hdev->list, head);
1746
1747 mutex_init(&hdev->lock);
1748
1749 hdev->flags = 0;
1750 hdev->dev_flags = 0;
1751 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1752 hdev->esco_type = (ESCO_HV1);
1753 hdev->link_mode = (HCI_LM_ACCEPT);
1754 hdev->io_capability = 0x03; /* No Input No Output */
1755
1756 hdev->idle_timeout = 0;
1757 hdev->sniff_max_interval = 800;
1758 hdev->sniff_min_interval = 80;
1759
1760 INIT_WORK(&hdev->rx_work, hci_rx_work);
1761 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
1762 INIT_WORK(&hdev->tx_work, hci_tx_work);
1763
1764
1765 skb_queue_head_init(&hdev->rx_q);
1766 skb_queue_head_init(&hdev->cmd_q);
1767 skb_queue_head_init(&hdev->raw_q);
1768
1769 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1770
1771 for (i = 0; i < NUM_REASSEMBLY; i++)
1772 hdev->reassembly[i] = NULL;
1773
1774 init_waitqueue_head(&hdev->req_wait_q);
1775 mutex_init(&hdev->req_lock);
1776
1777 discovery_init(hdev);
1778
1779 hci_conn_hash_init(hdev);
1780
1781 INIT_LIST_HEAD(&hdev->mgmt_pending);
1782
1783 INIT_LIST_HEAD(&hdev->blacklist);
1784
1785 INIT_LIST_HEAD(&hdev->uuids);
1786
1787 INIT_LIST_HEAD(&hdev->link_keys);
1788 INIT_LIST_HEAD(&hdev->long_term_keys);
1789
1790 INIT_LIST_HEAD(&hdev->remote_oob_data);
1791
1792 INIT_LIST_HEAD(&hdev->adv_entries);
1793
1794 INIT_DELAYED_WORK(&hdev->adv_work, hci_clear_adv_cache);
1795 INIT_WORK(&hdev->power_on, hci_power_on);
1796 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
1797
1798 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1799
1800 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1801
1802 atomic_set(&hdev->promisc, 0);
1803
1804 INIT_WORK(&hdev->le_scan, le_scan_work);
1805
1806 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
1807
1808 write_unlock(&hci_dev_list_lock);
1809
1810 hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
1811 WQ_MEM_RECLAIM, 1);
1812 if (!hdev->workqueue) {
1813 error = -ENOMEM;
1814 goto err;
1815 }
1816
1817 error = hci_add_sysfs(hdev);
1818 if (error < 0)
1819 goto err_wqueue;
1820
1821 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1822 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1823 if (hdev->rfkill) {
1824 if (rfkill_register(hdev->rfkill) < 0) {
1825 rfkill_destroy(hdev->rfkill);
1826 hdev->rfkill = NULL;
1827 }
1828 }
1829
1830 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
1831 set_bit(HCI_SETUP, &hdev->dev_flags);
1832 schedule_work(&hdev->power_on);
1833
1834 hci_notify(hdev, HCI_DEV_REG);
1835 hci_dev_hold(hdev);
1836
1837 return id;
1838
1839 err_wqueue:
1840 destroy_workqueue(hdev->workqueue);
1841 err:
1842 write_lock(&hci_dev_list_lock);
1843 list_del(&hdev->list);
1844 write_unlock(&hci_dev_list_lock);
1845
1846 return error;
1847 }
1848 EXPORT_SYMBOL(hci_register_dev);
1849
1850 /* Unregister HCI device */
1851 void hci_unregister_dev(struct hci_dev *hdev)
1852 {
1853 int i;
1854
1855 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1856
1857 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
1858
1859 write_lock(&hci_dev_list_lock);
1860 list_del(&hdev->list);
1861 write_unlock(&hci_dev_list_lock);
1862
1863 hci_dev_do_close(hdev);
1864
1865 for (i = 0; i < NUM_REASSEMBLY; i++)
1866 kfree_skb(hdev->reassembly[i]);
1867
1868 if (!test_bit(HCI_INIT, &hdev->flags) &&
1869 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
1870 hci_dev_lock(hdev);
1871 mgmt_index_removed(hdev);
1872 hci_dev_unlock(hdev);
1873 }
1874
1875 /* mgmt_index_removed should take care of emptying the
1876 * pending list */
1877 BUG_ON(!list_empty(&hdev->mgmt_pending));
1878
1879 hci_notify(hdev, HCI_DEV_UNREG);
1880
1881 if (hdev->rfkill) {
1882 rfkill_unregister(hdev->rfkill);
1883 rfkill_destroy(hdev->rfkill);
1884 }
1885
1886 hci_del_sysfs(hdev);
1887
1888 cancel_delayed_work_sync(&hdev->adv_work);
1889
1890 destroy_workqueue(hdev->workqueue);
1891
1892 hci_dev_lock(hdev);
1893 hci_blacklist_clear(hdev);
1894 hci_uuids_clear(hdev);
1895 hci_link_keys_clear(hdev);
1896 hci_smp_ltks_clear(hdev);
1897 hci_remote_oob_data_clear(hdev);
1898 hci_adv_entries_clear(hdev);
1899 hci_dev_unlock(hdev);
1900
1901 hci_dev_put(hdev);
1902 }
1903 EXPORT_SYMBOL(hci_unregister_dev);
1904
1905 /* Suspend HCI device */
1906 int hci_suspend_dev(struct hci_dev *hdev)
1907 {
1908 hci_notify(hdev, HCI_DEV_SUSPEND);
1909 return 0;
1910 }
1911 EXPORT_SYMBOL(hci_suspend_dev);
1912
1913 /* Resume HCI device */
1914 int hci_resume_dev(struct hci_dev *hdev)
1915 {
1916 hci_notify(hdev, HCI_DEV_RESUME);
1917 return 0;
1918 }
1919 EXPORT_SYMBOL(hci_resume_dev);
1920
1921 /* Receive frame from HCI drivers */
1922 int hci_recv_frame(struct sk_buff *skb)
1923 {
1924 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1925 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1926 && !test_bit(HCI_INIT, &hdev->flags))) {
1927 kfree_skb(skb);
1928 return -ENXIO;
1929 }
1930
1931 /* Incomming skb */
1932 bt_cb(skb)->incoming = 1;
1933
1934 /* Time stamp */
1935 __net_timestamp(skb);
1936
1937 skb_queue_tail(&hdev->rx_q, skb);
1938 queue_work(hdev->workqueue, &hdev->rx_work);
1939
1940 return 0;
1941 }
1942 EXPORT_SYMBOL(hci_recv_frame);
1943
1944 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1945 int count, __u8 index)
1946 {
1947 int len = 0;
1948 int hlen = 0;
1949 int remain = count;
1950 struct sk_buff *skb;
1951 struct bt_skb_cb *scb;
1952
1953 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1954 index >= NUM_REASSEMBLY)
1955 return -EILSEQ;
1956
1957 skb = hdev->reassembly[index];
1958
1959 if (!skb) {
1960 switch (type) {
1961 case HCI_ACLDATA_PKT:
1962 len = HCI_MAX_FRAME_SIZE;
1963 hlen = HCI_ACL_HDR_SIZE;
1964 break;
1965 case HCI_EVENT_PKT:
1966 len = HCI_MAX_EVENT_SIZE;
1967 hlen = HCI_EVENT_HDR_SIZE;
1968 break;
1969 case HCI_SCODATA_PKT:
1970 len = HCI_MAX_SCO_SIZE;
1971 hlen = HCI_SCO_HDR_SIZE;
1972 break;
1973 }
1974
1975 skb = bt_skb_alloc(len, GFP_ATOMIC);
1976 if (!skb)
1977 return -ENOMEM;
1978
1979 scb = (void *) skb->cb;
1980 scb->expect = hlen;
1981 scb->pkt_type = type;
1982
1983 skb->dev = (void *) hdev;
1984 hdev->reassembly[index] = skb;
1985 }
1986
1987 while (count) {
1988 scb = (void *) skb->cb;
1989 len = min_t(uint, scb->expect, count);
1990
1991 memcpy(skb_put(skb, len), data, len);
1992
1993 count -= len;
1994 data += len;
1995 scb->expect -= len;
1996 remain = count;
1997
1998 switch (type) {
1999 case HCI_EVENT_PKT:
2000 if (skb->len == HCI_EVENT_HDR_SIZE) {
2001 struct hci_event_hdr *h = hci_event_hdr(skb);
2002 scb->expect = h->plen;
2003
2004 if (skb_tailroom(skb) < scb->expect) {
2005 kfree_skb(skb);
2006 hdev->reassembly[index] = NULL;
2007 return -ENOMEM;
2008 }
2009 }
2010 break;
2011
2012 case HCI_ACLDATA_PKT:
2013 if (skb->len == HCI_ACL_HDR_SIZE) {
2014 struct hci_acl_hdr *h = hci_acl_hdr(skb);
2015 scb->expect = __le16_to_cpu(h->dlen);
2016
2017 if (skb_tailroom(skb) < scb->expect) {
2018 kfree_skb(skb);
2019 hdev->reassembly[index] = NULL;
2020 return -ENOMEM;
2021 }
2022 }
2023 break;
2024
2025 case HCI_SCODATA_PKT:
2026 if (skb->len == HCI_SCO_HDR_SIZE) {
2027 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2028 scb->expect = h->dlen;
2029
2030 if (skb_tailroom(skb) < scb->expect) {
2031 kfree_skb(skb);
2032 hdev->reassembly[index] = NULL;
2033 return -ENOMEM;
2034 }
2035 }
2036 break;
2037 }
2038
2039 if (scb->expect == 0) {
2040 /* Complete frame */
2041
2042 bt_cb(skb)->pkt_type = type;
2043 hci_recv_frame(skb);
2044
2045 hdev->reassembly[index] = NULL;
2046 return remain;
2047 }
2048 }
2049
2050 return remain;
2051 }
2052
2053 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2054 {
2055 int rem = 0;
2056
2057 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2058 return -EILSEQ;
2059
2060 while (count) {
2061 rem = hci_reassembly(hdev, type, data, count, type - 1);
2062 if (rem < 0)
2063 return rem;
2064
2065 data += (count - rem);
2066 count = rem;
2067 }
2068
2069 return rem;
2070 }
2071 EXPORT_SYMBOL(hci_recv_fragment);
2072
2073 #define STREAM_REASSEMBLY 0
2074
2075 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2076 {
2077 int type;
2078 int rem = 0;
2079
2080 while (count) {
2081 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2082
2083 if (!skb) {
2084 struct { char type; } *pkt;
2085
2086 /* Start of the frame */
2087 pkt = data;
2088 type = pkt->type;
2089
2090 data++;
2091 count--;
2092 } else
2093 type = bt_cb(skb)->pkt_type;
2094
2095 rem = hci_reassembly(hdev, type, data, count,
2096 STREAM_REASSEMBLY);
2097 if (rem < 0)
2098 return rem;
2099
2100 data += (count - rem);
2101 count = rem;
2102 }
2103
2104 return rem;
2105 }
2106 EXPORT_SYMBOL(hci_recv_stream_fragment);
2107
2108 /* ---- Interface to upper protocols ---- */
2109
2110 int hci_register_cb(struct hci_cb *cb)
2111 {
2112 BT_DBG("%p name %s", cb, cb->name);
2113
2114 write_lock(&hci_cb_list_lock);
2115 list_add(&cb->list, &hci_cb_list);
2116 write_unlock(&hci_cb_list_lock);
2117
2118 return 0;
2119 }
2120 EXPORT_SYMBOL(hci_register_cb);
2121
2122 int hci_unregister_cb(struct hci_cb *cb)
2123 {
2124 BT_DBG("%p name %s", cb, cb->name);
2125
2126 write_lock(&hci_cb_list_lock);
2127 list_del(&cb->list);
2128 write_unlock(&hci_cb_list_lock);
2129
2130 return 0;
2131 }
2132 EXPORT_SYMBOL(hci_unregister_cb);
2133
2134 static int hci_send_frame(struct sk_buff *skb)
2135 {
2136 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2137
2138 if (!hdev) {
2139 kfree_skb(skb);
2140 return -ENODEV;
2141 }
2142
2143 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
2144
2145 /* Time stamp */
2146 __net_timestamp(skb);
2147
2148 /* Send copy to monitor */
2149 hci_send_to_monitor(hdev, skb);
2150
2151 if (atomic_read(&hdev->promisc)) {
2152 /* Send copy to the sockets */
2153 hci_send_to_sock(hdev, skb);
2154 }
2155
2156 /* Get rid of skb owner, prior to sending to the driver. */
2157 skb_orphan(skb);
2158
2159 return hdev->send(skb);
2160 }
2161
2162 /* Send HCI command */
2163 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
2164 {
2165 int len = HCI_COMMAND_HDR_SIZE + plen;
2166 struct hci_command_hdr *hdr;
2167 struct sk_buff *skb;
2168
2169 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
2170
2171 skb = bt_skb_alloc(len, GFP_ATOMIC);
2172 if (!skb) {
2173 BT_ERR("%s no memory for command", hdev->name);
2174 return -ENOMEM;
2175 }
2176
2177 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
2178 hdr->opcode = cpu_to_le16(opcode);
2179 hdr->plen = plen;
2180
2181 if (plen)
2182 memcpy(skb_put(skb, plen), param, plen);
2183
2184 BT_DBG("skb len %d", skb->len);
2185
2186 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
2187 skb->dev = (void *) hdev;
2188
2189 if (test_bit(HCI_INIT, &hdev->flags))
2190 hdev->init_last_cmd = opcode;
2191
2192 skb_queue_tail(&hdev->cmd_q, skb);
2193 queue_work(hdev->workqueue, &hdev->cmd_work);
2194
2195 return 0;
2196 }
2197
2198 /* Get data from the previously sent command */
2199 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
2200 {
2201 struct hci_command_hdr *hdr;
2202
2203 if (!hdev->sent_cmd)
2204 return NULL;
2205
2206 hdr = (void *) hdev->sent_cmd->data;
2207
2208 if (hdr->opcode != cpu_to_le16(opcode))
2209 return NULL;
2210
2211 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2212
2213 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2214 }
2215
2216 /* Send ACL data */
2217 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2218 {
2219 struct hci_acl_hdr *hdr;
2220 int len = skb->len;
2221
2222 skb_push(skb, HCI_ACL_HDR_SIZE);
2223 skb_reset_transport_header(skb);
2224 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
2225 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2226 hdr->dlen = cpu_to_le16(len);
2227 }
2228
2229 static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
2230 struct sk_buff *skb, __u16 flags)
2231 {
2232 struct hci_dev *hdev = conn->hdev;
2233 struct sk_buff *list;
2234
2235 list = skb_shinfo(skb)->frag_list;
2236 if (!list) {
2237 /* Non fragmented */
2238 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2239
2240 skb_queue_tail(queue, skb);
2241 } else {
2242 /* Fragmented */
2243 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2244
2245 skb_shinfo(skb)->frag_list = NULL;
2246
2247 /* Queue all fragments atomically */
2248 spin_lock(&queue->lock);
2249
2250 __skb_queue_tail(queue, skb);
2251
2252 flags &= ~ACL_START;
2253 flags |= ACL_CONT;
2254 do {
2255 skb = list; list = list->next;
2256
2257 skb->dev = (void *) hdev;
2258 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2259 hci_add_acl_hdr(skb, conn->handle, flags);
2260
2261 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2262
2263 __skb_queue_tail(queue, skb);
2264 } while (list);
2265
2266 spin_unlock(&queue->lock);
2267 }
2268 }
2269
2270 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2271 {
2272 struct hci_conn *conn = chan->conn;
2273 struct hci_dev *hdev = conn->hdev;
2274
2275 BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
2276
2277 skb->dev = (void *) hdev;
2278 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2279 hci_add_acl_hdr(skb, conn->handle, flags);
2280
2281 hci_queue_acl(conn, &chan->data_q, skb, flags);
2282
2283 queue_work(hdev->workqueue, &hdev->tx_work);
2284 }
2285 EXPORT_SYMBOL(hci_send_acl);
2286
2287 /* Send SCO data */
2288 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2289 {
2290 struct hci_dev *hdev = conn->hdev;
2291 struct hci_sco_hdr hdr;
2292
2293 BT_DBG("%s len %d", hdev->name, skb->len);
2294
2295 hdr.handle = cpu_to_le16(conn->handle);
2296 hdr.dlen = skb->len;
2297
2298 skb_push(skb, HCI_SCO_HDR_SIZE);
2299 skb_reset_transport_header(skb);
2300 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2301
2302 skb->dev = (void *) hdev;
2303 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2304
2305 skb_queue_tail(&conn->data_q, skb);
2306 queue_work(hdev->workqueue, &hdev->tx_work);
2307 }
2308 EXPORT_SYMBOL(hci_send_sco);
2309
2310 /* ---- HCI TX task (outgoing data) ---- */
2311
2312 /* HCI Connection scheduler */
2313 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2314 {
2315 struct hci_conn_hash *h = &hdev->conn_hash;
2316 struct hci_conn *conn = NULL, *c;
2317 int num = 0, min = ~0;
2318
2319 /* We don't have to lock device here. Connections are always
2320 * added and removed with TX task disabled. */
2321
2322 rcu_read_lock();
2323
2324 list_for_each_entry_rcu(c, &h->list, list) {
2325 if (c->type != type || skb_queue_empty(&c->data_q))
2326 continue;
2327
2328 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2329 continue;
2330
2331 num++;
2332
2333 if (c->sent < min) {
2334 min = c->sent;
2335 conn = c;
2336 }
2337
2338 if (hci_conn_num(hdev, type) == num)
2339 break;
2340 }
2341
2342 rcu_read_unlock();
2343
2344 if (conn) {
2345 int cnt, q;
2346
2347 switch (conn->type) {
2348 case ACL_LINK:
2349 cnt = hdev->acl_cnt;
2350 break;
2351 case SCO_LINK:
2352 case ESCO_LINK:
2353 cnt = hdev->sco_cnt;
2354 break;
2355 case LE_LINK:
2356 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2357 break;
2358 default:
2359 cnt = 0;
2360 BT_ERR("Unknown link type");
2361 }
2362
2363 q = cnt / num;
2364 *quote = q ? q : 1;
2365 } else
2366 *quote = 0;
2367
2368 BT_DBG("conn %p quote %d", conn, *quote);
2369 return conn;
2370 }
2371
2372 static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2373 {
2374 struct hci_conn_hash *h = &hdev->conn_hash;
2375 struct hci_conn *c;
2376
2377 BT_ERR("%s link tx timeout", hdev->name);
2378
2379 rcu_read_lock();
2380
2381 /* Kill stalled connections */
2382 list_for_each_entry_rcu(c, &h->list, list) {
2383 if (c->type == type && c->sent) {
2384 BT_ERR("%s killing stalled connection %s",
2385 hdev->name, batostr(&c->dst));
2386 hci_acl_disconn(c, 0x13);
2387 }
2388 }
2389
2390 rcu_read_unlock();
2391 }
2392
2393 static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2394 int *quote)
2395 {
2396 struct hci_conn_hash *h = &hdev->conn_hash;
2397 struct hci_chan *chan = NULL;
2398 int num = 0, min = ~0, cur_prio = 0;
2399 struct hci_conn *conn;
2400 int cnt, q, conn_num = 0;
2401
2402 BT_DBG("%s", hdev->name);
2403
2404 rcu_read_lock();
2405
2406 list_for_each_entry_rcu(conn, &h->list, list) {
2407 struct hci_chan *tmp;
2408
2409 if (conn->type != type)
2410 continue;
2411
2412 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2413 continue;
2414
2415 conn_num++;
2416
2417 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2418 struct sk_buff *skb;
2419
2420 if (skb_queue_empty(&tmp->data_q))
2421 continue;
2422
2423 skb = skb_peek(&tmp->data_q);
2424 if (skb->priority < cur_prio)
2425 continue;
2426
2427 if (skb->priority > cur_prio) {
2428 num = 0;
2429 min = ~0;
2430 cur_prio = skb->priority;
2431 }
2432
2433 num++;
2434
2435 if (conn->sent < min) {
2436 min = conn->sent;
2437 chan = tmp;
2438 }
2439 }
2440
2441 if (hci_conn_num(hdev, type) == conn_num)
2442 break;
2443 }
2444
2445 rcu_read_unlock();
2446
2447 if (!chan)
2448 return NULL;
2449
2450 switch (chan->conn->type) {
2451 case ACL_LINK:
2452 cnt = hdev->acl_cnt;
2453 break;
2454 case SCO_LINK:
2455 case ESCO_LINK:
2456 cnt = hdev->sco_cnt;
2457 break;
2458 case LE_LINK:
2459 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2460 break;
2461 default:
2462 cnt = 0;
2463 BT_ERR("Unknown link type");
2464 }
2465
2466 q = cnt / num;
2467 *quote = q ? q : 1;
2468 BT_DBG("chan %p quote %d", chan, *quote);
2469 return chan;
2470 }
2471
2472 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2473 {
2474 struct hci_conn_hash *h = &hdev->conn_hash;
2475 struct hci_conn *conn;
2476 int num = 0;
2477
2478 BT_DBG("%s", hdev->name);
2479
2480 rcu_read_lock();
2481
2482 list_for_each_entry_rcu(conn, &h->list, list) {
2483 struct hci_chan *chan;
2484
2485 if (conn->type != type)
2486 continue;
2487
2488 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2489 continue;
2490
2491 num++;
2492
2493 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
2494 struct sk_buff *skb;
2495
2496 if (chan->sent) {
2497 chan->sent = 0;
2498 continue;
2499 }
2500
2501 if (skb_queue_empty(&chan->data_q))
2502 continue;
2503
2504 skb = skb_peek(&chan->data_q);
2505 if (skb->priority >= HCI_PRIO_MAX - 1)
2506 continue;
2507
2508 skb->priority = HCI_PRIO_MAX - 1;
2509
2510 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2511 skb->priority);
2512 }
2513
2514 if (hci_conn_num(hdev, type) == num)
2515 break;
2516 }
2517
2518 rcu_read_unlock();
2519
2520 }
2521
2522 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
2523 {
2524 /* Calculate count of blocks used by this packet */
2525 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
2526 }
2527
2528 static inline void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
2529 {
2530 if (!test_bit(HCI_RAW, &hdev->flags)) {
2531 /* ACL tx timeout must be longer than maximum
2532 * link supervision timeout (40.9 seconds) */
2533 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
2534 msecs_to_jiffies(HCI_ACL_TX_TIMEOUT)))
2535 hci_link_tx_to(hdev, ACL_LINK);
2536 }
2537 }
2538
2539 static inline void hci_sched_acl_pkt(struct hci_dev *hdev)
2540 {
2541 unsigned int cnt = hdev->acl_cnt;
2542 struct hci_chan *chan;
2543 struct sk_buff *skb;
2544 int quote;
2545
2546 __check_timeout(hdev, cnt);
2547
2548 while (hdev->acl_cnt &&
2549 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2550 u32 priority = (skb_peek(&chan->data_q))->priority;
2551 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2552 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2553 skb->len, skb->priority);
2554
2555 /* Stop if priority has changed */
2556 if (skb->priority < priority)
2557 break;
2558
2559 skb = skb_dequeue(&chan->data_q);
2560
2561 hci_conn_enter_active_mode(chan->conn,
2562 bt_cb(skb)->force_active);
2563
2564 hci_send_frame(skb);
2565 hdev->acl_last_tx = jiffies;
2566
2567 hdev->acl_cnt--;
2568 chan->sent++;
2569 chan->conn->sent++;
2570 }
2571 }
2572
2573 if (cnt != hdev->acl_cnt)
2574 hci_prio_recalculate(hdev, ACL_LINK);
2575 }
2576
2577 static inline void hci_sched_acl_blk(struct hci_dev *hdev)
2578 {
2579 unsigned int cnt = hdev->block_cnt;
2580 struct hci_chan *chan;
2581 struct sk_buff *skb;
2582 int quote;
2583
2584 __check_timeout(hdev, cnt);
2585
2586 while (hdev->block_cnt > 0 &&
2587 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2588 u32 priority = (skb_peek(&chan->data_q))->priority;
2589 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
2590 int blocks;
2591
2592 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2593 skb->len, skb->priority);
2594
2595 /* Stop if priority has changed */
2596 if (skb->priority < priority)
2597 break;
2598
2599 skb = skb_dequeue(&chan->data_q);
2600
2601 blocks = __get_blocks(hdev, skb);
2602 if (blocks > hdev->block_cnt)
2603 return;
2604
2605 hci_conn_enter_active_mode(chan->conn,
2606 bt_cb(skb)->force_active);
2607
2608 hci_send_frame(skb);
2609 hdev->acl_last_tx = jiffies;
2610
2611 hdev->block_cnt -= blocks;
2612 quote -= blocks;
2613
2614 chan->sent += blocks;
2615 chan->conn->sent += blocks;
2616 }
2617 }
2618
2619 if (cnt != hdev->block_cnt)
2620 hci_prio_recalculate(hdev, ACL_LINK);
2621 }
2622
2623 static inline void hci_sched_acl(struct hci_dev *hdev)
2624 {
2625 BT_DBG("%s", hdev->name);
2626
2627 if (!hci_conn_num(hdev, ACL_LINK))
2628 return;
2629
2630 switch (hdev->flow_ctl_mode) {
2631 case HCI_FLOW_CTL_MODE_PACKET_BASED:
2632 hci_sched_acl_pkt(hdev);
2633 break;
2634
2635 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
2636 hci_sched_acl_blk(hdev);
2637 break;
2638 }
2639 }
2640
2641 /* Schedule SCO */
2642 static inline void hci_sched_sco(struct hci_dev *hdev)
2643 {
2644 struct hci_conn *conn;
2645 struct sk_buff *skb;
2646 int quote;
2647
2648 BT_DBG("%s", hdev->name);
2649
2650 if (!hci_conn_num(hdev, SCO_LINK))
2651 return;
2652
2653 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2654 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2655 BT_DBG("skb %p len %d", skb, skb->len);
2656 hci_send_frame(skb);
2657
2658 conn->sent++;
2659 if (conn->sent == ~0)
2660 conn->sent = 0;
2661 }
2662 }
2663 }
2664
2665 static inline void hci_sched_esco(struct hci_dev *hdev)
2666 {
2667 struct hci_conn *conn;
2668 struct sk_buff *skb;
2669 int quote;
2670
2671 BT_DBG("%s", hdev->name);
2672
2673 if (!hci_conn_num(hdev, ESCO_LINK))
2674 return;
2675
2676 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2677 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2678 BT_DBG("skb %p len %d", skb, skb->len);
2679 hci_send_frame(skb);
2680
2681 conn->sent++;
2682 if (conn->sent == ~0)
2683 conn->sent = 0;
2684 }
2685 }
2686 }
2687
2688 static inline void hci_sched_le(struct hci_dev *hdev)
2689 {
2690 struct hci_chan *chan;
2691 struct sk_buff *skb;
2692 int quote, cnt, tmp;
2693
2694 BT_DBG("%s", hdev->name);
2695
2696 if (!hci_conn_num(hdev, LE_LINK))
2697 return;
2698
2699 if (!test_bit(HCI_RAW, &hdev->flags)) {
2700 /* LE tx timeout must be longer than maximum
2701 * link supervision timeout (40.9 seconds) */
2702 if (!hdev->le_cnt && hdev->le_pkts &&
2703 time_after(jiffies, hdev->le_last_tx + HZ * 45))
2704 hci_link_tx_to(hdev, LE_LINK);
2705 }
2706
2707 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2708 tmp = cnt;
2709 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
2710 u32 priority = (skb_peek(&chan->data_q))->priority;
2711 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2712 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2713 skb->len, skb->priority);
2714
2715 /* Stop if priority has changed */
2716 if (skb->priority < priority)
2717 break;
2718
2719 skb = skb_dequeue(&chan->data_q);
2720
2721 hci_send_frame(skb);
2722 hdev->le_last_tx = jiffies;
2723
2724 cnt--;
2725 chan->sent++;
2726 chan->conn->sent++;
2727 }
2728 }
2729
2730 if (hdev->le_pkts)
2731 hdev->le_cnt = cnt;
2732 else
2733 hdev->acl_cnt = cnt;
2734
2735 if (cnt != tmp)
2736 hci_prio_recalculate(hdev, LE_LINK);
2737 }
2738
2739 static void hci_tx_work(struct work_struct *work)
2740 {
2741 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
2742 struct sk_buff *skb;
2743
2744 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2745 hdev->sco_cnt, hdev->le_cnt);
2746
2747 /* Schedule queues and send stuff to HCI driver */
2748
2749 hci_sched_acl(hdev);
2750
2751 hci_sched_sco(hdev);
2752
2753 hci_sched_esco(hdev);
2754
2755 hci_sched_le(hdev);
2756
2757 /* Send next queued raw (unknown type) packet */
2758 while ((skb = skb_dequeue(&hdev->raw_q)))
2759 hci_send_frame(skb);
2760 }
2761
2762 /* ----- HCI RX task (incoming data processing) ----- */
2763
2764 /* ACL data packet */
2765 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2766 {
2767 struct hci_acl_hdr *hdr = (void *) skb->data;
2768 struct hci_conn *conn;
2769 __u16 handle, flags;
2770
2771 skb_pull(skb, HCI_ACL_HDR_SIZE);
2772
2773 handle = __le16_to_cpu(hdr->handle);
2774 flags = hci_flags(handle);
2775 handle = hci_handle(handle);
2776
2777 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2778
2779 hdev->stat.acl_rx++;
2780
2781 hci_dev_lock(hdev);
2782 conn = hci_conn_hash_lookup_handle(hdev, handle);
2783 hci_dev_unlock(hdev);
2784
2785 if (conn) {
2786 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
2787
2788 /* Send to upper protocol */
2789 l2cap_recv_acldata(conn, skb, flags);
2790 return;
2791 } else {
2792 BT_ERR("%s ACL packet for unknown connection handle %d",
2793 hdev->name, handle);
2794 }
2795
2796 kfree_skb(skb);
2797 }
2798
2799 /* SCO data packet */
2800 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2801 {
2802 struct hci_sco_hdr *hdr = (void *) skb->data;
2803 struct hci_conn *conn;
2804 __u16 handle;
2805
2806 skb_pull(skb, HCI_SCO_HDR_SIZE);
2807
2808 handle = __le16_to_cpu(hdr->handle);
2809
2810 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2811
2812 hdev->stat.sco_rx++;
2813
2814 hci_dev_lock(hdev);
2815 conn = hci_conn_hash_lookup_handle(hdev, handle);
2816 hci_dev_unlock(hdev);
2817
2818 if (conn) {
2819 /* Send to upper protocol */
2820 sco_recv_scodata(conn, skb);
2821 return;
2822 } else {
2823 BT_ERR("%s SCO packet for unknown connection handle %d",
2824 hdev->name, handle);
2825 }
2826
2827 kfree_skb(skb);
2828 }
2829
2830 static void hci_rx_work(struct work_struct *work)
2831 {
2832 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
2833 struct sk_buff *skb;
2834
2835 BT_DBG("%s", hdev->name);
2836
2837 while ((skb = skb_dequeue(&hdev->rx_q))) {
2838 /* Send copy to monitor */
2839 hci_send_to_monitor(hdev, skb);
2840
2841 if (atomic_read(&hdev->promisc)) {
2842 /* Send copy to the sockets */
2843 hci_send_to_sock(hdev, skb);
2844 }
2845
2846 if (test_bit(HCI_RAW, &hdev->flags)) {
2847 kfree_skb(skb);
2848 continue;
2849 }
2850
2851 if (test_bit(HCI_INIT, &hdev->flags)) {
2852 /* Don't process data packets in this states. */
2853 switch (bt_cb(skb)->pkt_type) {
2854 case HCI_ACLDATA_PKT:
2855 case HCI_SCODATA_PKT:
2856 kfree_skb(skb);
2857 continue;
2858 }
2859 }
2860
2861 /* Process frame */
2862 switch (bt_cb(skb)->pkt_type) {
2863 case HCI_EVENT_PKT:
2864 BT_DBG("%s Event packet", hdev->name);
2865 hci_event_packet(hdev, skb);
2866 break;
2867
2868 case HCI_ACLDATA_PKT:
2869 BT_DBG("%s ACL data packet", hdev->name);
2870 hci_acldata_packet(hdev, skb);
2871 break;
2872
2873 case HCI_SCODATA_PKT:
2874 BT_DBG("%s SCO data packet", hdev->name);
2875 hci_scodata_packet(hdev, skb);
2876 break;
2877
2878 default:
2879 kfree_skb(skb);
2880 break;
2881 }
2882 }
2883 }
2884
2885 static void hci_cmd_work(struct work_struct *work)
2886 {
2887 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
2888 struct sk_buff *skb;
2889
2890 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2891
2892 /* Send queued commands */
2893 if (atomic_read(&hdev->cmd_cnt)) {
2894 skb = skb_dequeue(&hdev->cmd_q);
2895 if (!skb)
2896 return;
2897
2898 kfree_skb(hdev->sent_cmd);
2899
2900 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2901 if (hdev->sent_cmd) {
2902 atomic_dec(&hdev->cmd_cnt);
2903 hci_send_frame(skb);
2904 if (test_bit(HCI_RESET, &hdev->flags))
2905 del_timer(&hdev->cmd_timer);
2906 else
2907 mod_timer(&hdev->cmd_timer,
2908 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2909 } else {
2910 skb_queue_head(&hdev->cmd_q, skb);
2911 queue_work(hdev->workqueue, &hdev->cmd_work);
2912 }
2913 }
2914 }
2915
2916 int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2917 {
2918 /* General inquiry access code (GIAC) */
2919 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2920 struct hci_cp_inquiry cp;
2921
2922 BT_DBG("%s", hdev->name);
2923
2924 if (test_bit(HCI_INQUIRY, &hdev->flags))
2925 return -EINPROGRESS;
2926
2927 inquiry_cache_flush(hdev);
2928
2929 memset(&cp, 0, sizeof(cp));
2930 memcpy(&cp.lap, lap, sizeof(cp.lap));
2931 cp.length = length;
2932
2933 return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2934 }
2935
2936 int hci_cancel_inquiry(struct hci_dev *hdev)
2937 {
2938 BT_DBG("%s", hdev->name);
2939
2940 if (!test_bit(HCI_INQUIRY, &hdev->flags))
2941 return -EPERM;
2942
2943 return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2944 }
ubuntu-bionic-kernel mirror