1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (C) 2000-2001 Qualcomm Incorporated
   4   Copyright (C) 2011 ProFUSION Embedded Systems
   5
   6   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8   This program is free software; you can redistribute it and/or modify
   9   it under the terms of the GNU General Public License version 2 as
  10   published by the Free Software Foundation;
  11
  12   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23   SOFTWARE IS DISCLAIMED.
  24*/
  25
  26/* Bluetooth HCI core. */
  27
  28#include <linux/jiffies.h>
  29#include <linux/module.h>
  30#include <linux/kmod.h>
  31
  32#include <linux/types.h>
  33#include <linux/errno.h>
  34#include <linux/kernel.h>
  35#include <linux/sched.h>
  36#include <linux/slab.h>
  37#include <linux/poll.h>
  38#include <linux/fcntl.h>
  39#include <linux/init.h>
  40#include <linux/skbuff.h>
  41#include <linux/workqueue.h>
  42#include <linux/interrupt.h>
  43#include <linux/rfkill.h>
  44#include <linux/timer.h>
  45#include <linux/crypto.h>
  46#include <net/sock.h>
  47
  48#include <linux/uaccess.h>
 
  49#include <asm/unaligned.h>
  50
  51#include <net/bluetooth/bluetooth.h>
  52#include <net/bluetooth/hci_core.h>
 
 
  53
  54#define AUTO_OFF_TIMEOUT 2000
 
 
 
 
 
 
  55
  56static void hci_rx_work(struct work_struct *work);
  57static void hci_cmd_work(struct work_struct *work);
  58static void hci_tx_work(struct work_struct *work);
  59
  60/* HCI device list */
  61LIST_HEAD(hci_dev_list);
  62DEFINE_RWLOCK(hci_dev_list_lock);
  63
  64/* HCI callback list */
  65LIST_HEAD(hci_cb_list);
  66DEFINE_RWLOCK(hci_cb_list_lock);
  67
  68/* ---- HCI notifications ---- */
  69
  70static void hci_notify(struct hci_dev *hdev, int event)
  71{
  72	hci_sock_dev_event(hdev, event);
  73}
  74
  75/* ---- HCI requests ---- */
  76
  77void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
  78{
  79	BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
  80
  81	/* If this is the init phase check if the completed command matches
  82	 * the last init command, and if not just return.
  83	 */
  84	if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd) {
  85		struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
  86		u16 opcode = __le16_to_cpu(sent->opcode);
  87		struct sk_buff *skb;
  88
  89		/* Some CSR based controllers generate a spontaneous
  90		 * reset complete event during init and any pending
  91		 * command will never be completed. In such a case we
  92		 * need to resend whatever was the last sent
  93		 * command.
  94		 */
  95
  96		if (cmd != HCI_OP_RESET || opcode == HCI_OP_RESET)
  97			return;
  98
  99		skb = skb_clone(hdev->sent_cmd, GFP_ATOMIC);
 100		if (skb) {
 101			skb_queue_head(&hdev->cmd_q, skb);
 102			queue_work(hdev->workqueue, &hdev->cmd_work);
 103		}
 104
 105		return;
 106	}
 107
 108	if (hdev->req_status == HCI_REQ_PEND) {
 109		hdev->req_result = result;
 110		hdev->req_status = HCI_REQ_DONE;
 111		wake_up_interruptible(&hdev->req_wait_q);
 112	}
 113}
 114
 115static void hci_req_cancel(struct hci_dev *hdev, int err)
 116{
 117	BT_DBG("%s err 0x%2.2x", hdev->name, err);
 118
 119	if (hdev->req_status == HCI_REQ_PEND) {
 120		hdev->req_result = err;
 121		hdev->req_status = HCI_REQ_CANCELED;
 122		wake_up_interruptible(&hdev->req_wait_q);
 123	}
 124}
 125
 126/* Execute request and wait for completion. */
 127static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 128					unsigned long opt, __u32 timeout)
 129{
 130	DECLARE_WAITQUEUE(wait, current);
 131	int err = 0;
 132
 133	BT_DBG("%s start", hdev->name);
 134
 135	hdev->req_status = HCI_REQ_PEND;
 136
 137	add_wait_queue(&hdev->req_wait_q, &wait);
 138	set_current_state(TASK_INTERRUPTIBLE);
 139
 140	req(hdev, opt);
 141	schedule_timeout(timeout);
 142
 143	remove_wait_queue(&hdev->req_wait_q, &wait);
 
 144
 145	if (signal_pending(current))
 146		return -EINTR;
 147
 148	switch (hdev->req_status) {
 149	case HCI_REQ_DONE:
 150		err = -bt_to_errno(hdev->req_result);
 151		break;
 152
 153	case HCI_REQ_CANCELED:
 154		err = -hdev->req_result;
 155		break;
 156
 157	default:
 158		err = -ETIMEDOUT;
 159		break;
 160	}
 161
 162	hdev->req_status = hdev->req_result = 0;
 163
 164	BT_DBG("%s end: err %d", hdev->name, err);
 165
 166	return err;
 167}
 168
 169static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 170					unsigned long opt, __u32 timeout)
 171{
 172	int ret;
 173
 174	if (!test_bit(HCI_UP, &hdev->flags))
 175		return -ENETDOWN;
 176
 177	/* Serialize all requests */
 178	hci_req_lock(hdev);
 179	ret = __hci_request(hdev, req, opt, timeout);
 180	hci_req_unlock(hdev);
 181
 182	return ret;
 183}
 184
 185static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
 186{
 187	BT_DBG("%s %ld", hdev->name, opt);
 188
 189	/* Reset device */
 190	set_bit(HCI_RESET, &hdev->flags);
 191	hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 192}
 193
 194static void bredr_init(struct hci_dev *hdev)
 195{
 196	struct hci_cp_delete_stored_link_key cp;
 197	__le16 param;
 198	__u8 flt_type;
 199
 200	hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
 201
 202	/* Mandatory initialization */
 203
 204	/* Reset */
 205	if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
 206		set_bit(HCI_RESET, &hdev->flags);
 207		hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 208	}
 209
 210	/* Read Local Supported Features */
 211	hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 212
 213	/* Read Local Version */
 214	hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 215
 216	/* Read Buffer Size (ACL mtu, max pkt, etc.) */
 217	hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 218
 219	/* Read BD Address */
 220	hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
 221
 222	/* Read Class of Device */
 223	hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 224
 225	/* Read Local Name */
 226	hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 227
 228	/* Read Voice Setting */
 229	hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 230
 231	/* Optional initialization */
 232
 233	/* Clear Event Filters */
 234	flt_type = HCI_FLT_CLEAR_ALL;
 235	hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 236
 237	/* Connection accept timeout ~20 secs */
 238	param = cpu_to_le16(0x7d00);
 239	hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 240
 241	bacpy(&cp.bdaddr, BDADDR_ANY);
 242	cp.delete_all = 1;
 243	hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
 244}
 245
 246static void amp_init(struct hci_dev *hdev)
 247{
 248	hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
 249
 250	/* Reset */
 251	hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 252
 253	/* Read Local Version */
 254	hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 255
 256	/* Read Local AMP Info */
 257	hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 258}
 259
 260static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 261{
 262	struct sk_buff *skb;
 263
 264	BT_DBG("%s %ld", hdev->name, opt);
 265
 266	/* Driver initialization */
 267
 268	/* Special commands */
 269	while ((skb = skb_dequeue(&hdev->driver_init))) {
 270		bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
 271		skb->dev = (void *) hdev;
 272
 273		skb_queue_tail(&hdev->cmd_q, skb);
 274		queue_work(hdev->workqueue, &hdev->cmd_work);
 275	}
 276	skb_queue_purge(&hdev->driver_init);
 277
 278	switch (hdev->dev_type) {
 279	case HCI_BREDR:
 280		bredr_init(hdev);
 281		break;
 282
 283	case HCI_AMP:
 284		amp_init(hdev);
 285		break;
 286
 287	default:
 288		BT_ERR("Unknown device type %d", hdev->dev_type);
 289		break;
 290	}
 291
 292}
 293
 294static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
 295{
 296	BT_DBG("%s", hdev->name);
 297
 298	/* Read LE buffer size */
 299	hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 300}
 301
 302static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
 303{
 304	__u8 scan = opt;
 305
 306	BT_DBG("%s %x", hdev->name, scan);
 307
 308	/* Inquiry and Page scans */
 309	hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 
 310}
 311
 312static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
 313{
 314	__u8 auth = opt;
 315
 316	BT_DBG("%s %x", hdev->name, auth);
 317
 318	/* Authentication */
 319	hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 
 320}
 321
 322static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
 323{
 324	__u8 encrypt = opt;
 325
 326	BT_DBG("%s %x", hdev->name, encrypt);
 327
 328	/* Encryption */
 329	hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 
 330}
 331
 332static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
 333{
 334	__le16 policy = cpu_to_le16(opt);
 335
 336	BT_DBG("%s %x", hdev->name, policy);
 337
 338	/* Default link policy */
 339	hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 
 340}
 341
 342/* Get HCI device by index.
 343 * Device is held on return. */
 344struct hci_dev *hci_dev_get(int index)
 345{
 346	struct hci_dev *hdev = NULL, *d;
 347
 348	BT_DBG("%d", index);
 349
 350	if (index < 0)
 351		return NULL;
 352
 353	read_lock(&hci_dev_list_lock);
 354	list_for_each_entry(d, &hci_dev_list, list) {
 355		if (d->id == index) {
 356			hdev = hci_dev_hold(d);
 357			break;
 358		}
 359	}
 360	read_unlock(&hci_dev_list_lock);
 361	return hdev;
 362}
 363
 364/* ---- Inquiry support ---- */
 365
 366bool hci_discovery_active(struct hci_dev *hdev)
 367{
 368	struct discovery_state *discov = &hdev->discovery;
 369
 370	switch (discov->state) {
 371	case DISCOVERY_FINDING:
 372	case DISCOVERY_RESOLVING:
 373		return true;
 374
 375	default:
 376		return false;
 377	}
 378}
 379
 380void hci_discovery_set_state(struct hci_dev *hdev, int state)
 381{
 
 
 382	BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
 383
 384	if (hdev->discovery.state == state)
 385		return;
 386
 
 
 387	switch (state) {
 388	case DISCOVERY_STOPPED:
 389		if (hdev->discovery.state != DISCOVERY_STARTING)
 
 
 390			mgmt_discovering(hdev, 0);
 391		break;
 392	case DISCOVERY_STARTING:
 393		break;
 394	case DISCOVERY_FINDING:
 395		mgmt_discovering(hdev, 1);
 396		break;
 397	case DISCOVERY_RESOLVING:
 398		break;
 399	case DISCOVERY_STOPPING:
 400		break;
 401	}
 402
 403	hdev->discovery.state = state;
 404}
 405
 406static void inquiry_cache_flush(struct hci_dev *hdev)
 407{
 408	struct discovery_state *cache = &hdev->discovery;
 409	struct inquiry_entry *p, *n;
 410
 411	list_for_each_entry_safe(p, n, &cache->all, all) {
 412		list_del(&p->all);
 413		kfree(p);
 414	}
 415
 416	INIT_LIST_HEAD(&cache->unknown);
 417	INIT_LIST_HEAD(&cache->resolve);
 418}
 419
 420struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 
 421{
 422	struct discovery_state *cache = &hdev->discovery;
 423	struct inquiry_entry *e;
 424
 425	BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 426
 427	list_for_each_entry(e, &cache->all, all) {
 428		if (!bacmp(&e->data.bdaddr, bdaddr))
 429			return e;
 430	}
 431
 432	return NULL;
 433}
 434
 435struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
 436						       bdaddr_t *bdaddr)
 437{
 438	struct discovery_state *cache = &hdev->discovery;
 439	struct inquiry_entry *e;
 440
 441	BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 442
 443	list_for_each_entry(e, &cache->unknown, list) {
 444		if (!bacmp(&e->data.bdaddr, bdaddr))
 445			return e;
 446	}
 447
 448	return NULL;
 449}
 450
 451struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
 452						       bdaddr_t *bdaddr,
 453						       int state)
 454{
 455	struct discovery_state *cache = &hdev->discovery;
 456	struct inquiry_entry *e;
 457
 458	BT_DBG("cache %p bdaddr %s state %d", cache, batostr(bdaddr), state);
 459
 460	list_for_each_entry(e, &cache->resolve, list) {
 461		if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
 462			return e;
 463		if (!bacmp(&e->data.bdaddr, bdaddr))
 464			return e;
 465	}
 466
 467	return NULL;
 468}
 469
 470void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
 471				      struct inquiry_entry *ie)
 472{
 473	struct discovery_state *cache = &hdev->discovery;
 474	struct list_head *pos = &cache->resolve;
 475	struct inquiry_entry *p;
 476
 477	list_del(&ie->list);
 478
 479	list_for_each_entry(p, &cache->resolve, list) {
 480		if (p->name_state != NAME_PENDING &&
 481				abs(p->data.rssi) >= abs(ie->data.rssi))
 482			break;
 483		pos = &p->list;
 484	}
 485
 486	list_add(&ie->list, pos);
 487}
 488
 489bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
 490			      bool name_known, bool *ssp)
 491{
 492	struct discovery_state *cache = &hdev->discovery;
 493	struct inquiry_entry *ie;
 
 
 
 494
 495	BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 496
 497	if (ssp)
 498		*ssp = data->ssp_mode;
 499
 500	ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
 501	if (ie) {
 502		if (ie->data.ssp_mode && ssp)
 503			*ssp = true;
 504
 505		if (ie->name_state == NAME_NEEDED &&
 506						data->rssi != ie->data.rssi) {
 507			ie->data.rssi = data->rssi;
 508			hci_inquiry_cache_update_resolve(hdev, ie);
 509		}
 510
 511		goto update;
 512	}
 513
 514	/* Entry not in the cache. Add new one. */
 515	ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
 516	if (!ie)
 517		return false;
 
 
 518
 519	list_add(&ie->all, &cache->all);
 520
 521	if (name_known) {
 522		ie->name_state = NAME_KNOWN;
 523	} else {
 524		ie->name_state = NAME_NOT_KNOWN;
 525		list_add(&ie->list, &cache->unknown);
 526	}
 527
 528update:
 529	if (name_known && ie->name_state != NAME_KNOWN &&
 530					ie->name_state != NAME_PENDING) {
 531		ie->name_state = NAME_KNOWN;
 532		list_del(&ie->list);
 533	}
 534
 535	memcpy(&ie->data, data, sizeof(*data));
 536	ie->timestamp = jiffies;
 537	cache->timestamp = jiffies;
 538
 539	if (ie->name_state == NAME_NOT_KNOWN)
 540		return false;
 541
 542	return true;
 
 543}
 544
 545static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 546{
 547	struct discovery_state *cache = &hdev->discovery;
 548	struct inquiry_info *info = (struct inquiry_info *) buf;
 549	struct inquiry_entry *e;
 550	int copied = 0;
 551
 552	list_for_each_entry(e, &cache->all, all) {
 553		struct inquiry_data *data = &e->data;
 554
 555		if (copied >= num)
 556			break;
 557
 558		bacpy(&info->bdaddr, &data->bdaddr);
 559		info->pscan_rep_mode	= data->pscan_rep_mode;
 560		info->pscan_period_mode	= data->pscan_period_mode;
 561		info->pscan_mode	= data->pscan_mode;
 562		memcpy(info->dev_class, data->dev_class, 3);
 563		info->clock_offset	= data->clock_offset;
 564
 565		info++;
 566		copied++;
 567	}
 568
 569	BT_DBG("cache %p, copied %d", cache, copied);
 570	return copied;
 571}
 572
 573static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
 574{
 575	struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
 
 576	struct hci_cp_inquiry cp;
 577
 578	BT_DBG("%s", hdev->name);
 579
 580	if (test_bit(HCI_INQUIRY, &hdev->flags))
 581		return;
 582
 583	/* Start Inquiry */
 584	memcpy(&cp.lap, &ir->lap, 3);
 585	cp.length  = ir->length;
 586	cp.num_rsp = ir->num_rsp;
 587	hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
 
 
 588}
 589
 590int hci_inquiry(void __user *arg)
 591{
 592	__u8 __user *ptr = arg;
 593	struct hci_inquiry_req ir;
 594	struct hci_dev *hdev;
 595	int err = 0, do_inquiry = 0, max_rsp;
 596	long timeo;
 597	__u8 *buf;
 598
 599	if (copy_from_user(&ir, ptr, sizeof(ir)))
 600		return -EFAULT;
 601
 602	hdev = hci_dev_get(ir.dev_id);
 603	if (!hdev)
 604		return -ENODEV;
 605
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 606	hci_dev_lock(hdev);
 607	if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 608				inquiry_cache_empty(hdev) ||
 609				ir.flags & IREQ_CACHE_FLUSH) {
 610		inquiry_cache_flush(hdev);
 611		do_inquiry = 1;
 612	}
 613	hci_dev_unlock(hdev);
 614
 615	timeo = ir.length * msecs_to_jiffies(2000);
 616
 617	if (do_inquiry) {
 618		err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
 
 619		if (err < 0)
 620			goto done;
 
 
 
 
 
 
 
 
 
 621	}
 622
 623	/* for unlimited number of responses we will use buffer with 255 entries */
 
 
 624	max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 625
 626	/* cache_dump can't sleep. Therefore we allocate temp buffer and then
 627	 * copy it to the user space.
 628	 */
 629	buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
 630	if (!buf) {
 631		err = -ENOMEM;
 632		goto done;
 633	}
 634
 635	hci_dev_lock(hdev);
 636	ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
 637	hci_dev_unlock(hdev);
 638
 639	BT_DBG("num_rsp %d", ir.num_rsp);
 640
 641	if (!copy_to_user(ptr, &ir, sizeof(ir))) {
 642		ptr += sizeof(ir);
 643		if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
 644					ir.num_rsp))
 645			err = -EFAULT;
 646	} else
 647		err = -EFAULT;
 648
 649	kfree(buf);
 650
 651done:
 652	hci_dev_put(hdev);
 653	return err;
 654}
 655
 656/* ---- HCI ioctl helpers ---- */
 657
 658int hci_dev_open(__u16 dev)
 659{
 660	struct hci_dev *hdev;
 661	int ret = 0;
 662
 663	hdev = hci_dev_get(dev);
 664	if (!hdev)
 665		return -ENODEV;
 666
 667	BT_DBG("%s %p", hdev->name, hdev);
 668
 669	hci_req_lock(hdev);
 670
 671	if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
 672		ret = -ENODEV;
 673		goto done;
 674	}
 675
 676	if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
 677		ret = -ERFKILL;
 678		goto done;
 679	}
 680
 681	if (test_bit(HCI_UP, &hdev->flags)) {
 682		ret = -EALREADY;
 683		goto done;
 684	}
 685
 686	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 687		set_bit(HCI_RAW, &hdev->flags);
 
 
 688
 689	/* Treat all non BR/EDR controllers as raw devices if
 690	   enable_hs is not set */
 691	if (hdev->dev_type != HCI_BREDR && !enable_hs)
 692		set_bit(HCI_RAW, &hdev->flags);
 693
 694	if (hdev->open(hdev)) {
 695		ret = -EIO;
 
 
 
 
 
 
 
 
 
 
 696		goto done;
 697	}
 698
 699	if (!test_bit(HCI_RAW, &hdev->flags)) {
 700		atomic_set(&hdev->cmd_cnt, 1);
 701		set_bit(HCI_INIT, &hdev->flags);
 702		hdev->init_last_cmd = 0;
 703
 704		ret = __hci_request(hdev, hci_init_req, 0,
 705					msecs_to_jiffies(HCI_INIT_TIMEOUT));
 706
 707		if (lmp_host_le_capable(hdev))
 708			ret = __hci_request(hdev, hci_le_init_req, 0,
 709					msecs_to_jiffies(HCI_INIT_TIMEOUT));
 710
 711		clear_bit(HCI_INIT, &hdev->flags);
 712	}
 713
 714	if (!ret) {
 715		hci_dev_hold(hdev);
 716		set_bit(HCI_UP, &hdev->flags);
 717		hci_notify(hdev, HCI_DEV_UP);
 718		if (!test_bit(HCI_SETUP, &hdev->dev_flags)) {
 719			hci_dev_lock(hdev);
 720			mgmt_powered(hdev, 1);
 721			hci_dev_unlock(hdev);
 722		}
 723	} else {
 724		/* Init failed, cleanup */
 725		flush_work(&hdev->tx_work);
 726		flush_work(&hdev->cmd_work);
 727		flush_work(&hdev->rx_work);
 728
 729		skb_queue_purge(&hdev->cmd_q);
 730		skb_queue_purge(&hdev->rx_q);
 731
 732		if (hdev->flush)
 733			hdev->flush(hdev);
 
 
 
 734
 735		if (hdev->sent_cmd) {
 736			kfree_skb(hdev->sent_cmd);
 737			hdev->sent_cmd = NULL;
 738		}
 
 
 
 
 
 739
 740		hdev->close(hdev);
 741		hdev->flags = 0;
 742	}
 743
 744done:
 745	hci_req_unlock(hdev);
 746	hci_dev_put(hdev);
 747	return ret;
 748}
 749
 750static int hci_dev_do_close(struct hci_dev *hdev)
 751{
 
 
 752	BT_DBG("%s %p", hdev->name, hdev);
 753
 754	cancel_work_sync(&hdev->le_scan);
 755
 756	cancel_delayed_work(&hdev->power_off);
 757
 758	hci_req_cancel(hdev, ENODEV);
 759	hci_req_lock(hdev);
 760
 761	if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 762		del_timer_sync(&hdev->cmd_timer);
 763		hci_req_unlock(hdev);
 764		return 0;
 765	}
 766
 767	/* Flush RX and TX works */
 768	flush_work(&hdev->tx_work);
 769	flush_work(&hdev->rx_work);
 
 770
 771	if (hdev->discov_timeout > 0) {
 772		cancel_delayed_work(&hdev->discov_off);
 773		hdev->discov_timeout = 0;
 774		clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 775	}
 776
 777	if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 778		cancel_delayed_work(&hdev->service_cache);
 
 
 779
 780	cancel_delayed_work_sync(&hdev->le_scan_disable);
 
 
 781
 782	hci_dev_lock(hdev);
 783	inquiry_cache_flush(hdev);
 784	hci_conn_hash_flush(hdev);
 785	hci_dev_unlock(hdev);
 786
 787	hci_notify(hdev, HCI_DEV_DOWN);
 
 
 
 788
 789	if (hdev->flush)
 790		hdev->flush(hdev);
 
 791
 792	/* Reset device */
 793	skb_queue_purge(&hdev->cmd_q);
 794	atomic_set(&hdev->cmd_cnt, 1);
 795	if (!test_bit(HCI_RAW, &hdev->flags) &&
 796				test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
 797		set_bit(HCI_INIT, &hdev->flags);
 798		__hci_request(hdev, hci_reset_req, 0,
 799					msecs_to_jiffies(250));
 800		clear_bit(HCI_INIT, &hdev->flags);
 801	}
 802
 803	/* flush cmd  work */
 804	flush_work(&hdev->cmd_work);
 805
 806	/* Drop queues */
 807	skb_queue_purge(&hdev->rx_q);
 808	skb_queue_purge(&hdev->cmd_q);
 809	skb_queue_purge(&hdev->raw_q);
 810
 811	/* Drop last sent command */
 812	if (hdev->sent_cmd) {
 813		del_timer_sync(&hdev->cmd_timer);
 814		kfree_skb(hdev->sent_cmd);
 815		hdev->sent_cmd = NULL;
 816	}
 
 
 
 
 
 
 
 
 
 
 
 
 817
 818	/* After this point our queues are empty
 819	 * and no tasks are scheduled. */
 820	hdev->close(hdev);
 
 821
 822	if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 823		hci_dev_lock(hdev);
 824		mgmt_powered(hdev, 0);
 825		hci_dev_unlock(hdev);
 826	}
 827
 828	/* Clear flags */
 829	hdev->flags = 0;
 830
 831	memset(hdev->eir, 0, sizeof(hdev->eir));
 832	memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
 
 
 
 833
 834	hci_req_unlock(hdev);
 835
 836	hci_dev_put(hdev);
 837	return 0;
 838}
 839
 840int hci_dev_close(__u16 dev)
 841{
 842	struct hci_dev *hdev;
 843	int err;
 844
 845	hdev = hci_dev_get(dev);
 846	if (!hdev)
 847		return -ENODEV;
 848
 849	if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 850		cancel_delayed_work(&hdev->power_off);
 
 
 851
 852	err = hci_dev_do_close(hdev);
 
 
 
 853
 
 
 
 
 
 
 
 
 854	hci_dev_put(hdev);
 855	return err;
 856}
 857
 858int hci_dev_reset(__u16 dev)
 859{
 860	struct hci_dev *hdev;
 861	int ret = 0;
 862
 863	hdev = hci_dev_get(dev);
 864	if (!hdev)
 865		return -ENODEV;
 866
 867	hci_req_lock(hdev);
 868
 869	if (!test_bit(HCI_UP, &hdev->flags))
 870		goto done;
 
 871
 872	/* Drop queues */
 873	skb_queue_purge(&hdev->rx_q);
 874	skb_queue_purge(&hdev->cmd_q);
 875
 876	hci_dev_lock(hdev);
 877	inquiry_cache_flush(hdev);
 878	hci_conn_hash_flush(hdev);
 879	hci_dev_unlock(hdev);
 880
 881	if (hdev->flush)
 882		hdev->flush(hdev);
 883
 884	atomic_set(&hdev->cmd_cnt, 1);
 885	hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
 886
 887	if (!test_bit(HCI_RAW, &hdev->flags))
 888		ret = __hci_request(hdev, hci_reset_req, 0,
 889					msecs_to_jiffies(HCI_INIT_TIMEOUT));
 890
 891done:
 892	hci_req_unlock(hdev);
 893	hci_dev_put(hdev);
 894	return ret;
 895}
 896
 897int hci_dev_reset_stat(__u16 dev)
 898{
 899	struct hci_dev *hdev;
 900	int ret = 0;
 901
 902	hdev = hci_dev_get(dev);
 903	if (!hdev)
 904		return -ENODEV;
 905
 906	memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 
 
 
 
 
 907
 908	hci_dev_put(hdev);
 
 
 
 
 
 
 
 909
 910	return ret;
 
 
 
 
 
 
 
 
 
 
 
 911}
 912
 913int hci_dev_cmd(unsigned int cmd, void __user *arg)
 914{
 915	struct hci_dev *hdev;
 916	struct hci_dev_req dr;
 917	int err = 0;
 918
 919	if (copy_from_user(&dr, arg, sizeof(dr)))
 920		return -EFAULT;
 921
 922	hdev = hci_dev_get(dr.dev_id);
 923	if (!hdev)
 924		return -ENODEV;
 925
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 926	switch (cmd) {
 927	case HCISETAUTH:
 928		err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 929					msecs_to_jiffies(HCI_INIT_TIMEOUT));
 930		break;
 931
 932	case HCISETENCRYPT:
 933		if (!lmp_encrypt_capable(hdev)) {
 934			err = -EOPNOTSUPP;
 935			break;
 936		}
 937
 938		if (!test_bit(HCI_AUTH, &hdev->flags)) {
 939			/* Auth must be enabled first */
 940			err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 941					msecs_to_jiffies(HCI_INIT_TIMEOUT));
 942			if (err)
 943				break;
 944		}
 945
 946		err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
 947					msecs_to_jiffies(HCI_INIT_TIMEOUT));
 948		break;
 949
 950	case HCISETSCAN:
 951		err = hci_request(hdev, hci_scan_req, dr.dev_opt,
 952					msecs_to_jiffies(HCI_INIT_TIMEOUT));
 
 
 
 
 
 
 953		break;
 954
 955	case HCISETLINKPOL:
 956		err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
 957					msecs_to_jiffies(HCI_INIT_TIMEOUT));
 958		break;
 959
 960	case HCISETLINKMODE:
 961		hdev->link_mode = ((__u16) dr.dev_opt) &
 962					(HCI_LM_MASTER | HCI_LM_ACCEPT);
 963		break;
 964
 965	case HCISETPTYPE:
 
 
 
 966		hdev->pkt_type = (__u16) dr.dev_opt;
 
 967		break;
 968
 969	case HCISETACLMTU:
 970		hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
 971		hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
 972		break;
 973
 974	case HCISETSCOMTU:
 975		hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
 976		hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
 977		break;
 978
 979	default:
 980		err = -EINVAL;
 981		break;
 982	}
 983
 
 984	hci_dev_put(hdev);
 985	return err;
 986}
 987
 988int hci_get_dev_list(void __user *arg)
 989{
 990	struct hci_dev *hdev;
 991	struct hci_dev_list_req *dl;
 992	struct hci_dev_req *dr;
 993	int n = 0, size, err;
 994	__u16 dev_num;
 995
 996	if (get_user(dev_num, (__u16 __user *) arg))
 997		return -EFAULT;
 998
 999	if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1000		return -EINVAL;
1001
1002	size = sizeof(*dl) + dev_num * sizeof(*dr);
1003
1004	dl = kzalloc(size, GFP_KERNEL);
1005	if (!dl)
1006		return -ENOMEM;
1007
1008	dr = dl->dev_req;
1009
1010	read_lock(&hci_dev_list_lock);
1011	list_for_each_entry(hdev, &hci_dev_list, list) {
1012		if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1013			cancel_delayed_work(&hdev->power_off);
1014
1015		if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1016			set_bit(HCI_PAIRABLE, &hdev->dev_flags);
 
 
 
 
1017
1018		(dr + n)->dev_id  = hdev->id;
1019		(dr + n)->dev_opt = hdev->flags;
1020
1021		if (++n >= dev_num)
1022			break;
1023	}
1024	read_unlock(&hci_dev_list_lock);
1025
1026	dl->dev_num = n;
1027	size = sizeof(*dl) + n * sizeof(*dr);
1028
1029	err = copy_to_user(arg, dl, size);
1030	kfree(dl);
1031
1032	return err ? -EFAULT : 0;
1033}
1034
1035int hci_get_dev_info(void __user *arg)
1036{
1037	struct hci_dev *hdev;
1038	struct hci_dev_info di;
 
1039	int err = 0;
1040
1041	if (copy_from_user(&di, arg, sizeof(di)))
1042		return -EFAULT;
1043
1044	hdev = hci_dev_get(di.dev_id);
1045	if (!hdev)
1046		return -ENODEV;
1047
1048	if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1049		cancel_delayed_work_sync(&hdev->power_off);
1050
1051	if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1052		set_bit(HCI_PAIRABLE, &hdev->dev_flags);
 
 
 
1053
1054	strcpy(di.name, hdev->name);
1055	di.bdaddr   = hdev->bdaddr;
1056	di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1057	di.flags    = hdev->flags;
1058	di.pkt_type = hdev->pkt_type;
1059	di.acl_mtu  = hdev->acl_mtu;
1060	di.acl_pkts = hdev->acl_pkts;
1061	di.sco_mtu  = hdev->sco_mtu;
1062	di.sco_pkts = hdev->sco_pkts;
 
 
 
 
 
 
 
1063	di.link_policy = hdev->link_policy;
1064	di.link_mode   = hdev->link_mode;
1065
1066	memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1067	memcpy(&di.features, &hdev->features, sizeof(di.features));
1068
1069	if (copy_to_user(arg, &di, sizeof(di)))
1070		err = -EFAULT;
1071
1072	hci_dev_put(hdev);
1073
1074	return err;
1075}
1076
1077/* ---- Interface to HCI drivers ---- */
1078
1079static int hci_rfkill_set_block(void *data, bool blocked)
1080{
1081	struct hci_dev *hdev = data;
1082
1083	BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1084
1085	if (!blocked)
1086		return 0;
1087
1088	hci_dev_do_close(hdev);
 
 
 
 
 
 
 
1089
1090	return 0;
1091}
1092
1093static const struct rfkill_ops hci_rfkill_ops = {
1094	.set_block = hci_rfkill_set_block,
1095};
1096
1097static void hci_power_on(struct work_struct *work)
1098{
1099	struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
 
1100
1101	BT_DBG("%s", hdev->name);
1102
1103	if (hci_dev_open(hdev->id) < 0)
 
 
 
 
 
1104		return;
 
1105
1106	if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1107		schedule_delayed_work(&hdev->power_off,
1108					msecs_to_jiffies(AUTO_OFF_TIMEOUT));
 
 
 
 
1109
1110	if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1111		mgmt_index_added(hdev);
 
1112}
1113
1114static void hci_power_off(struct work_struct *work)
1115{
1116	struct hci_dev *hdev = container_of(work, struct hci_dev,
1117							power_off.work);
1118
1119	BT_DBG("%s", hdev->name);
1120
1121	hci_dev_do_close(hdev);
1122}
1123
1124static void hci_discov_off(struct work_struct *work)
1125{
1126	struct hci_dev *hdev;
1127	u8 scan = SCAN_PAGE;
1128
1129	hdev = container_of(work, struct hci_dev, discov_off.work);
1130
 
1131	BT_DBG("%s", hdev->name);
1132
1133	hci_dev_lock(hdev);
1134
1135	hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
 
1136
1137	hdev->discov_timeout = 0;
 
1138
1139	hci_dev_unlock(hdev);
1140}
1141
1142int hci_uuids_clear(struct hci_dev *hdev)
1143{
1144	struct list_head *p, *n;
1145
1146	list_for_each_safe(p, n, &hdev->uuids) {
1147		struct bt_uuid *uuid;
1148
1149		uuid = list_entry(p, struct bt_uuid, list);
1150
1151		list_del(p);
 
1152		kfree(uuid);
1153	}
 
1154
1155	return 0;
 
 
 
 
 
 
 
1156}
1157
1158int hci_link_keys_clear(struct hci_dev *hdev)
1159{
1160	struct list_head *p, *n;
1161
1162	list_for_each_safe(p, n, &hdev->link_keys) {
1163		struct link_key *key;
 
 
 
1164
1165		key = list_entry(p, struct link_key, list);
 
 
1166
1167		list_del(p);
1168		kfree(key);
 
1169	}
 
1170
1171	return 0;
 
 
 
 
 
 
 
1172}
1173
1174int hci_smp_ltks_clear(struct hci_dev *hdev)
1175{
1176	struct smp_ltk *k, *tmp;
 
1177
1178	list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1179		list_del(&k->list);
1180		kfree(k);
 
 
 
1181	}
1182
1183	return 0;
 
1184}
1185
1186struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1187{
1188	struct link_key *k;
1189
1190	list_for_each_entry(k, &hdev->link_keys, list)
1191		if (bacmp(bdaddr, &k->bdaddr) == 0)
 
 
 
 
 
 
 
 
 
 
 
 
1192			return k;
 
 
 
1193
1194	return NULL;
1195}
1196
1197static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1198						u8 key_type, u8 old_key_type)
1199{
1200	/* Legacy key */
1201	if (key_type < 0x03)
1202		return true;
1203
1204	/* Debug keys are insecure so don't store them persistently */
1205	if (key_type == HCI_LK_DEBUG_COMBINATION)
1206		return false;
1207
1208	/* Changed combination key and there's no previous one */
1209	if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1210		return false;
1211
1212	/* Security mode 3 case */
1213	if (!conn)
1214		return true;
1215
 
 
 
 
1216	/* Neither local nor remote side had no-bonding as requirement */
1217	if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1218		return true;
1219
1220	/* Local side had dedicated bonding as requirement */
1221	if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1222		return true;
1223
1224	/* Remote side had dedicated bonding as requirement */
1225	if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1226		return true;
1227
1228	/* If none of the above criteria match, then don't store the key
1229	 * persistently */
1230	return false;
1231}
1232
1233struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
 
 
 
 
 
 
 
 
 
1234{
1235	struct smp_ltk *k;
1236
1237	list_for_each_entry(k, &hdev->long_term_keys, list) {
1238		if (k->ediv != ediv ||
1239				memcmp(rand, k->rand, sizeof(k->rand)))
1240			continue;
1241
1242		return k;
 
 
 
 
 
 
 
 
 
 
 
 
1243	}
 
1244
1245	return NULL;
1246}
1247EXPORT_SYMBOL(hci_find_ltk);
1248
1249struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1250				     u8 addr_type)
1251{
1252	struct smp_ltk *k;
 
1253
1254	list_for_each_entry(k, &hdev->long_term_keys, list)
1255		if (addr_type == k->bdaddr_type &&
1256					bacmp(bdaddr, &k->bdaddr) == 0)
1257			return k;
1258
1259	return NULL;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1260}
1261EXPORT_SYMBOL(hci_find_ltk_by_addr);
1262
1263int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1264		     bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
 
1265{
1266	struct link_key *key, *old_key;
1267	u8 old_key_type;
1268	bool persistent;
1269
1270	old_key = hci_find_link_key(hdev, bdaddr);
1271	if (old_key) {
1272		old_key_type = old_key->type;
1273		key = old_key;
1274	} else {
1275		old_key_type = conn ? conn->key_type : 0xff;
1276		key = kzalloc(sizeof(*key), GFP_ATOMIC);
1277		if (!key)
1278			return -ENOMEM;
1279		list_add(&key->list, &hdev->link_keys);
1280	}
1281
1282	BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1283
1284	/* Some buggy controller combinations generate a changed
1285	 * combination key for legacy pairing even when there's no
1286	 * previous key */
1287	if (type == HCI_LK_CHANGED_COMBINATION &&
1288					(!conn || conn->remote_auth == 0xff) &&
1289					old_key_type == 0xff) {
1290		type = HCI_LK_COMBINATION;
1291		if (conn)
1292			conn->key_type = type;
1293	}
1294
1295	bacpy(&key->bdaddr, bdaddr);
1296	memcpy(key->val, val, 16);
1297	key->pin_len = pin_len;
1298
1299	if (type == HCI_LK_CHANGED_COMBINATION)
1300		key->type = old_key_type;
1301	else
1302		key->type = type;
1303
1304	if (!new_key)
1305		return 0;
1306
1307	persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1308
1309	mgmt_new_link_key(hdev, key, persistent);
1310
1311	if (conn)
1312		conn->flush_key = !persistent;
1313
1314	return 0;
1315}
1316
1317int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
1318		int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
1319		ediv, u8 rand[8])
1320{
1321	struct smp_ltk *key, *old_key;
 
1322
1323	if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1324		return 0;
1325
1326	old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1327	if (old_key)
1328		key = old_key;
1329	else {
1330		key = kzalloc(sizeof(*key), GFP_ATOMIC);
1331		if (!key)
1332			return -ENOMEM;
1333		list_add(&key->list, &hdev->long_term_keys);
1334	}
1335
1336	bacpy(&key->bdaddr, bdaddr);
1337	key->bdaddr_type = addr_type;
1338	memcpy(key->val, tk, sizeof(key->val));
1339	key->authenticated = authenticated;
1340	key->ediv = ediv;
 
1341	key->enc_size = enc_size;
1342	key->type = type;
1343	memcpy(key->rand, rand, sizeof(key->rand));
1344
1345	if (!new_key)
1346		return 0;
 
 
 
 
 
1347
1348	if (type & HCI_SMP_LTK)
1349		mgmt_new_ltk(hdev, key, 1);
 
 
 
1350
1351	return 0;
 
 
 
 
 
 
 
 
 
1352}
1353
1354int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1355{
1356	struct link_key *key;
1357
1358	key = hci_find_link_key(hdev, bdaddr);
1359	if (!key)
1360		return -ENOENT;
1361
1362	BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1363
1364	list_del(&key->list);
1365	kfree(key);
1366
1367	return 0;
1368}
1369
1370int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1371{
1372	struct smp_ltk *k, *tmp;
 
1373
1374	list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1375		if (bacmp(bdaddr, &k->bdaddr))
1376			continue;
1377
1378		BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1379
1380		list_del(&k->list);
1381		kfree(k);
 
1382	}
1383
1384	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1385}
1386
1387/* HCI command timer function */
1388static void hci_cmd_timer(unsigned long arg)
1389{
1390	struct hci_dev *hdev = (void *) arg;
 
 
 
 
 
 
 
 
 
 
 
 
 
1391
1392	BT_ERR("%s command tx timeout", hdev->name);
1393	atomic_set(&hdev->cmd_cnt, 1);
1394	queue_work(hdev->workqueue, &hdev->cmd_work);
1395}
1396
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1397struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1398					  bdaddr_t *bdaddr)
1399{
1400	struct oob_data *data;
1401
1402	list_for_each_entry(data, &hdev->remote_oob_data, list)
1403		if (bacmp(bdaddr, &data->bdaddr) == 0)
1404			return data;
 
 
 
 
1405
1406	return NULL;
1407}
1408
1409int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
 
1410{
1411	struct oob_data *data;
1412
1413	data = hci_find_remote_oob_data(hdev, bdaddr);
1414	if (!data)
1415		return -ENOENT;
1416
1417	BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1418
1419	list_del(&data->list);
1420	kfree(data);
1421
1422	return 0;
1423}
1424
1425int hci_remote_oob_data_clear(struct hci_dev *hdev)
1426{
1427	struct oob_data *data, *n;
1428
1429	list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1430		list_del(&data->list);
1431		kfree(data);
1432	}
1433
1434	return 0;
1435}
1436
1437int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1438			    u8 *randomizer)
 
1439{
1440	struct oob_data *data;
1441
1442	data = hci_find_remote_oob_data(hdev, bdaddr);
1443
1444	if (!data) {
1445		data = kmalloc(sizeof(*data), GFP_ATOMIC);
1446		if (!data)
1447			return -ENOMEM;
1448
1449		bacpy(&data->bdaddr, bdaddr);
 
1450		list_add(&data->list, &hdev->remote_oob_data);
1451	}
1452
1453	memcpy(data->hash, hash, sizeof(data->hash));
1454	memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
 
 
 
 
 
 
 
 
 
 
 
1455
1456	BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
 
 
 
 
 
 
 
 
 
 
1457
1458	return 0;
1459}
1460
1461struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1462{
1463	struct bdaddr_list *b;
1464
1465	list_for_each_entry(b, &hdev->blacklist, list)
1466		if (bacmp(bdaddr, &b->bdaddr) == 0)
1467			return b;
 
1468
1469	return NULL;
1470}
1471
1472int hci_blacklist_clear(struct hci_dev *hdev)
 
 
1473{
1474	struct list_head *p, *n;
1475
1476	list_for_each_safe(p, n, &hdev->blacklist) {
1477		struct bdaddr_list *b;
 
 
1478
1479		b = list_entry(p, struct bdaddr_list, list);
 
1480
1481		list_del(p);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1482		kfree(b);
1483	}
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1484
1485	return 0;
1486}
1487
1488int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
 
1489{
1490	struct bdaddr_list *entry;
1491
1492	if (bacmp(bdaddr, BDADDR_ANY) == 0)
1493		return -EBADF;
1494
1495	if (hci_blacklist_lookup(hdev, bdaddr))
1496		return -EEXIST;
1497
1498	entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1499	if (!entry)
1500		return -ENOMEM;
1501
1502	bacpy(&entry->bdaddr, bdaddr);
 
 
 
 
 
 
 
1503
1504	list_add(&entry->list, &hdev->blacklist);
1505
1506	return mgmt_device_blocked(hdev, bdaddr, type);
1507}
1508
1509int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1510{
1511	struct bdaddr_list *entry;
1512
1513	if (bacmp(bdaddr, BDADDR_ANY) == 0)
1514		return hci_blacklist_clear(hdev);
 
 
1515
1516	entry = hci_blacklist_lookup(hdev, bdaddr);
1517	if (!entry)
1518		return -ENOENT;
1519
1520	list_del(&entry->list);
1521	kfree(entry);
1522
1523	return mgmt_device_unblocked(hdev, bdaddr, type);
1524}
1525
1526static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
 
1527{
1528	struct le_scan_params *param =  (struct le_scan_params *) opt;
1529	struct hci_cp_le_set_scan_param cp;
1530
1531	memset(&cp, 0, sizeof(cp));
1532	cp.type = param->type;
1533	cp.interval = cpu_to_le16(param->interval);
1534	cp.window = cpu_to_le16(param->window);
 
 
 
 
1535
1536	hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
 
 
 
1537}
1538
1539static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
 
1540{
1541	struct hci_cp_le_set_scan_enable cp;
 
 
 
 
 
1542
1543	memset(&cp, 0, sizeof(cp));
1544	cp.enable = 1;
 
1545
1546	hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
 
 
 
1547}
1548
1549static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
1550			  u16 window, int timeout)
1551{
1552	long timeo = msecs_to_jiffies(3000);
1553	struct le_scan_params param;
1554	int err;
 
 
 
 
 
 
1555
1556	BT_DBG("%s", hdev->name);
 
1557
1558	if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1559		return -EINPROGRESS;
 
 
 
1560
1561	param.type = type;
1562	param.interval = interval;
1563	param.window = window;
1564
1565	hci_req_lock(hdev);
 
 
 
 
 
 
1566
1567	err = __hci_request(hdev, le_scan_param_req, (unsigned long) &param,
1568			    timeo);
1569	if (!err)
1570		err = __hci_request(hdev, le_scan_enable_req, 0, timeo);
1571
1572	hci_req_unlock(hdev);
 
1573
1574	if (err < 0)
1575		return err;
 
 
 
1576
1577	schedule_delayed_work(&hdev->le_scan_disable,
1578			      msecs_to_jiffies(timeout));
 
 
1579
1580	return 0;
 
 
 
 
1581}
1582
1583int hci_cancel_le_scan(struct hci_dev *hdev)
 
 
1584{
1585	BT_DBG("%s", hdev->name);
 
 
 
 
 
 
 
 
 
 
1586
1587	if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1588		return -EALREADY;
1589
1590	if (cancel_delayed_work(&hdev->le_scan_disable)) {
1591		struct hci_cp_le_set_scan_enable cp;
1592
1593		/* Send HCI command to disable LE Scan */
1594		memset(&cp, 0, sizeof(cp));
1595		hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1596	}
1597
1598	return 0;
 
1599}
1600
1601static void le_scan_disable_work(struct work_struct *work)
 
1602{
1603	struct hci_dev *hdev = container_of(work, struct hci_dev,
1604					    le_scan_disable.work);
1605	struct hci_cp_le_set_scan_enable cp;
1606
1607	BT_DBG("%s", hdev->name);
 
 
1608
1609	memset(&cp, 0, sizeof(cp));
1610
1611	hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
 
 
1612}
1613
1614static void le_scan_work(struct work_struct *work)
 
1615{
1616	struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
1617	struct le_scan_params *param = &hdev->le_scan_params;
1618
1619	BT_DBG("%s", hdev->name);
 
 
1620
1621	hci_do_le_scan(hdev, param->type, param->interval, param->window,
1622		       param->timeout);
 
 
 
 
 
 
 
 
 
 
1623}
1624
1625int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
1626		int timeout)
1627{
1628	struct le_scan_params *param = &hdev->le_scan_params;
1629
1630	BT_DBG("%s", hdev->name);
 
 
 
 
1631
1632	if (work_busy(&hdev->le_scan))
1633		return -EINPROGRESS;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1634
1635	param->type = type;
1636	param->interval = interval;
1637	param->window = window;
1638	param->timeout = timeout;
1639
1640	queue_work(system_long_wq, &hdev->le_scan);
 
 
1641
1642	return 0;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1643}
1644
1645/* Alloc HCI device */
1646struct hci_dev *hci_alloc_dev(void)
1647{
1648	struct hci_dev *hdev;
 
1649
1650	hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
 
 
 
 
 
 
1651	if (!hdev)
1652		return NULL;
1653
1654	hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1655	hdev->esco_type = (ESCO_HV1);
1656	hdev->link_mode = (HCI_LM_ACCEPT);
1657	hdev->io_capability = 0x03; /* No Input No Output */
 
 
 
 
 
 
 
 
 
 
 
1658
1659	hdev->sniff_max_interval = 800;
1660	hdev->sniff_min_interval = 80;
1661
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1662	mutex_init(&hdev->lock);
1663	mutex_init(&hdev->req_lock);
1664
 
 
 
1665	INIT_LIST_HEAD(&hdev->mgmt_pending);
1666	INIT_LIST_HEAD(&hdev->blacklist);
 
1667	INIT_LIST_HEAD(&hdev->uuids);
1668	INIT_LIST_HEAD(&hdev->link_keys);
1669	INIT_LIST_HEAD(&hdev->long_term_keys);
 
1670	INIT_LIST_HEAD(&hdev->remote_oob_data);
 
 
 
 
 
 
 
 
 
1671
 
1672	INIT_WORK(&hdev->rx_work, hci_rx_work);
1673	INIT_WORK(&hdev->cmd_work, hci_cmd_work);
1674	INIT_WORK(&hdev->tx_work, hci_tx_work);
1675	INIT_WORK(&hdev->power_on, hci_power_on);
1676	INIT_WORK(&hdev->le_scan, le_scan_work);
 
 
1677
1678	INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
1679	INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1680	INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
1681
1682	skb_queue_head_init(&hdev->driver_init);
1683	skb_queue_head_init(&hdev->rx_q);
1684	skb_queue_head_init(&hdev->cmd_q);
1685	skb_queue_head_init(&hdev->raw_q);
1686
1687	init_waitqueue_head(&hdev->req_wait_q);
1688
1689	setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
 
 
 
 
1690
1691	hci_init_sysfs(hdev);
1692	discovery_init(hdev);
1693	hci_conn_hash_init(hdev);
1694
1695	return hdev;
1696}
1697EXPORT_SYMBOL(hci_alloc_dev);
1698
1699/* Free HCI device */
1700void hci_free_dev(struct hci_dev *hdev)
1701{
1702	skb_queue_purge(&hdev->driver_init);
1703
1704	/* will free via device release */
1705	put_device(&hdev->dev);
1706}
1707EXPORT_SYMBOL(hci_free_dev);
1708
1709/* Register HCI device */
1710int hci_register_dev(struct hci_dev *hdev)
1711{
1712	struct list_head *head, *p;
1713	int id, error;
1714
1715	if (!hdev->open || !hdev->close)
1716		return -EINVAL;
1717
1718	write_lock(&hci_dev_list_lock);
1719
1720	/* Do not allow HCI_AMP devices to register at index 0,
1721	 * so the index can be used as the AMP controller ID.
1722	 */
1723	id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
1724	head = &hci_dev_list;
1725
1726	/* Find first available device id */
1727	list_for_each(p, &hci_dev_list) {
1728		int nid = list_entry(p, struct hci_dev, list)->id;
1729		if (nid > id)
1730			break;
1731		if (nid == id)
1732			id++;
1733		head = p;
1734	}
1735
1736	sprintf(hdev->name, "hci%d", id);
1737	hdev->id = id;
1738
1739	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
 
 
1740
1741	list_add(&hdev->list, head);
 
1742
1743	write_unlock(&hci_dev_list_lock);
1744
1745	hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
1746							WQ_MEM_RECLAIM, 1);
1747	if (!hdev->workqueue) {
1748		error = -ENOMEM;
1749		goto err;
1750	}
1751
1752	error = hci_add_sysfs(hdev);
 
 
 
 
 
 
 
 
 
 
 
1753	if (error < 0)
1754		goto err_wqueue;
1755
 
 
1756	hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1757				RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
 
1758	if (hdev->rfkill) {
1759		if (rfkill_register(hdev->rfkill) < 0) {
1760			rfkill_destroy(hdev->rfkill);
1761			hdev->rfkill = NULL;
1762		}
1763	}
1764
1765	set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
1766	set_bit(HCI_SETUP, &hdev->dev_flags);
1767	schedule_work(&hdev->power_on);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1768
1769	hci_notify(hdev, HCI_DEV_REG);
1770	hci_dev_hold(hdev);
1771
 
 
 
 
 
 
 
 
 
1772	return id;
1773
1774err_wqueue:
 
1775	destroy_workqueue(hdev->workqueue);
 
1776err:
1777	write_lock(&hci_dev_list_lock);
1778	list_del(&hdev->list);
1779	write_unlock(&hci_dev_list_lock);
1780
1781	return error;
1782}
1783EXPORT_SYMBOL(hci_register_dev);
1784
1785/* Unregister HCI device */
1786void hci_unregister_dev(struct hci_dev *hdev)
1787{
1788	int i;
1789
1790	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1791
1792	set_bit(HCI_UNREGISTER, &hdev->dev_flags);
 
 
1793
1794	write_lock(&hci_dev_list_lock);
1795	list_del(&hdev->list);
1796	write_unlock(&hci_dev_list_lock);
1797
1798	hci_dev_do_close(hdev);
 
 
 
 
1799
1800	for (i = 0; i < NUM_REASSEMBLY; i++)
1801		kfree_skb(hdev->reassembly[i]);
 
1802
1803	if (!test_bit(HCI_INIT, &hdev->flags) &&
1804				!test_bit(HCI_SETUP, &hdev->dev_flags)) {
 
1805		hci_dev_lock(hdev);
1806		mgmt_index_removed(hdev);
1807		hci_dev_unlock(hdev);
1808	}
1809
1810	/* mgmt_index_removed should take care of emptying the
1811	 * pending list */
1812	BUG_ON(!list_empty(&hdev->mgmt_pending));
1813
1814	hci_notify(hdev, HCI_DEV_UNREG);
1815
1816	if (hdev->rfkill) {
1817		rfkill_unregister(hdev->rfkill);
1818		rfkill_destroy(hdev->rfkill);
1819	}
1820
1821	hci_del_sysfs(hdev);
 
 
 
 
 
 
 
 
 
 
 
1822
1823	destroy_workqueue(hdev->workqueue);
 
1824
1825	hci_dev_lock(hdev);
1826	hci_blacklist_clear(hdev);
 
1827	hci_uuids_clear(hdev);
1828	hci_link_keys_clear(hdev);
1829	hci_smp_ltks_clear(hdev);
 
1830	hci_remote_oob_data_clear(hdev);
 
 
 
 
 
 
 
 
1831	hci_dev_unlock(hdev);
1832
1833	hci_dev_put(hdev);
 
 
 
 
1834}
1835EXPORT_SYMBOL(hci_unregister_dev);
1836
1837/* Suspend HCI device */
1838int hci_suspend_dev(struct hci_dev *hdev)
1839{
1840	hci_notify(hdev, HCI_DEV_SUSPEND);
1841	return 0;
1842}
1843EXPORT_SYMBOL(hci_suspend_dev);
1844
1845/* Resume HCI device */
1846int hci_resume_dev(struct hci_dev *hdev)
1847{
1848	hci_notify(hdev, HCI_DEV_RESUME);
1849	return 0;
 
 
1850}
1851EXPORT_SYMBOL(hci_resume_dev);
1852
1853/* Receive frame from HCI drivers */
1854int hci_recv_frame(struct sk_buff *skb)
1855{
1856	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1857	if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1858				&& !test_bit(HCI_INIT, &hdev->flags))) {
1859		kfree_skb(skb);
1860		return -ENXIO;
 
1861	}
1862
1863	/* Incomming skb */
1864	bt_cb(skb)->incoming = 1;
1865
1866	/* Time stamp */
1867	__net_timestamp(skb);
 
 
1868
1869	skb_queue_tail(&hdev->rx_q, skb);
1870	queue_work(hdev->workqueue, &hdev->rx_work);
1871
1872	return 0;
1873}
1874EXPORT_SYMBOL(hci_recv_frame);
 
1875
1876static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1877						  int count, __u8 index)
1878{
1879	int len = 0;
1880	int hlen = 0;
1881	int remain = count;
1882	struct sk_buff *skb;
1883	struct bt_skb_cb *scb;
1884
1885	if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1886				index >= NUM_REASSEMBLY)
1887		return -EILSEQ;
1888
1889	skb = hdev->reassembly[index];
 
 
1890
1891	if (!skb) {
1892		switch (type) {
1893		case HCI_ACLDATA_PKT:
1894			len = HCI_MAX_FRAME_SIZE;
1895			hlen = HCI_ACL_HDR_SIZE;
1896			break;
1897		case HCI_EVENT_PKT:
1898			len = HCI_MAX_EVENT_SIZE;
1899			hlen = HCI_EVENT_HDR_SIZE;
1900			break;
1901		case HCI_SCODATA_PKT:
1902			len = HCI_MAX_SCO_SIZE;
1903			hlen = HCI_SCO_HDR_SIZE;
1904			break;
1905		}
1906
1907		skb = bt_skb_alloc(len, GFP_ATOMIC);
1908		if (!skb)
1909			return -ENOMEM;
 
1910
1911		scb = (void *) skb->cb;
1912		scb->expect = hlen;
1913		scb->pkt_type = type;
 
1914
1915		skb->dev = (void *) hdev;
1916		hdev->reassembly[index] = skb;
1917	}
1918
1919	while (count) {
1920		scb = (void *) skb->cb;
1921		len = min_t(uint, scb->expect, count);
 
1922
1923		memcpy(skb_put(skb, len), data, len);
 
 
1924
1925		count -= len;
1926		data += len;
1927		scb->expect -= len;
1928		remain = count;
1929
1930		switch (type) {
1931		case HCI_EVENT_PKT:
1932			if (skb->len == HCI_EVENT_HDR_SIZE) {
1933				struct hci_event_hdr *h = hci_event_hdr(skb);
1934				scb->expect = h->plen;
1935
1936				if (skb_tailroom(skb) < scb->expect) {
1937					kfree_skb(skb);
1938					hdev->reassembly[index] = NULL;
1939					return -ENOMEM;
1940				}
1941			}
1942			break;
1943
1944		case HCI_ACLDATA_PKT:
1945			if (skb->len  == HCI_ACL_HDR_SIZE) {
1946				struct hci_acl_hdr *h = hci_acl_hdr(skb);
1947				scb->expect = __le16_to_cpu(h->dlen);
1948
1949				if (skb_tailroom(skb) < scb->expect) {
1950					kfree_skb(skb);
1951					hdev->reassembly[index] = NULL;
1952					return -ENOMEM;
1953				}
1954			}
1955			break;
1956
1957		case HCI_SCODATA_PKT:
1958			if (skb->len == HCI_SCO_HDR_SIZE) {
1959				struct hci_sco_hdr *h = hci_sco_hdr(skb);
1960				scb->expect = h->dlen;
1961
1962				if (skb_tailroom(skb) < scb->expect) {
1963					kfree_skb(skb);
1964					hdev->reassembly[index] = NULL;
1965					return -ENOMEM;
1966				}
1967			}
1968			break;
1969		}
1970
1971		if (scb->expect == 0) {
1972			/* Complete frame */
 
1973
1974			bt_cb(skb)->pkt_type = type;
1975			hci_recv_frame(skb);
1976
1977			hdev->reassembly[index] = NULL;
1978			return remain;
1979		}
1980	}
1981
1982	return remain;
 
1983}
 
1984
1985int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
 
1986{
1987	int rem = 0;
 
 
 
 
1988
1989	if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1990		return -EILSEQ;
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
1991
1992	while (count) {
1993		rem = hci_reassembly(hdev, type, data, count, type - 1);
1994		if (rem < 0)
1995			return rem;
1996
1997		data += (count - rem);
1998		count = rem;
1999	}
2000
2001	return rem;
2002}
2003EXPORT_SYMBOL(hci_recv_fragment);
2004
2005#define STREAM_REASSEMBLY 0
 
 
2006
2007int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
 
2008{
2009	int type;
2010	int rem = 0;
2011
2012	while (count) {
2013		struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2014
2015		if (!skb) {
2016			struct { char type; } *pkt;
2017
2018			/* Start of the frame */
2019			pkt = data;
2020			type = pkt->type;
2021
2022			data++;
2023			count--;
2024		} else
2025			type = bt_cb(skb)->pkt_type;
2026
2027		rem = hci_reassembly(hdev, type, data, count,
2028							STREAM_REASSEMBLY);
2029		if (rem < 0)
2030			return rem;
 
 
2031
2032		data += (count - rem);
2033		count = rem;
2034	}
2035
2036	return rem;
 
 
 
2037}
2038EXPORT_SYMBOL(hci_recv_stream_fragment);
2039
2040/* ---- Interface to upper protocols ---- */
2041
2042int hci_register_cb(struct hci_cb *cb)
2043{
2044	BT_DBG("%p name %s", cb, cb->name);
2045
2046	write_lock(&hci_cb_list_lock);
2047	list_add(&cb->list, &hci_cb_list);
2048	write_unlock(&hci_cb_list_lock);
2049
2050	return 0;
2051}
2052EXPORT_SYMBOL(hci_register_cb);
2053
2054int hci_unregister_cb(struct hci_cb *cb)
2055{
2056	BT_DBG("%p name %s", cb, cb->name);
2057
2058	write_lock(&hci_cb_list_lock);
2059	list_del(&cb->list);
2060	write_unlock(&hci_cb_list_lock);
2061
2062	return 0;
2063}
2064EXPORT_SYMBOL(hci_unregister_cb);
2065
2066static int hci_send_frame(struct sk_buff *skb)
2067{
2068	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2069
2070	if (!hdev) {
2071		kfree_skb(skb);
2072		return -ENODEV;
2073	}
2074
2075	BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
2076
2077	/* Time stamp */
2078	__net_timestamp(skb);
2079
2080	/* Send copy to monitor */
2081	hci_send_to_monitor(hdev, skb);
2082
2083	if (atomic_read(&hdev->promisc)) {
2084		/* Send copy to the sockets */
2085		hci_send_to_sock(hdev, skb);
2086	}
2087
2088	/* Get rid of skb owner, prior to sending to the driver. */
2089	skb_orphan(skb);
2090
2091	return hdev->send(skb);
 
 
 
 
 
 
 
 
 
 
 
 
2092}
2093
2094/* Send HCI command */
2095int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
 
2096{
2097	int len = HCI_COMMAND_HDR_SIZE + plen;
2098	struct hci_command_hdr *hdr;
2099	struct sk_buff *skb;
2100
2101	BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
2102
2103	skb = bt_skb_alloc(len, GFP_ATOMIC);
2104	if (!skb) {
2105		BT_ERR("%s no memory for command", hdev->name);
2106		return -ENOMEM;
2107	}
2108
2109	hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
2110	hdr->opcode = cpu_to_le16(opcode);
2111	hdr->plen   = plen;
 
2112
2113	if (plen)
2114		memcpy(skb_put(skb, plen), param, plen);
2115
2116	BT_DBG("skb len %d", skb->len);
 
2117
2118	bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
2119	skb->dev = (void *) hdev;
 
 
2120
2121	if (test_bit(HCI_INIT, &hdev->flags))
2122		hdev->init_last_cmd = opcode;
 
 
 
 
 
 
 
 
 
 
2123
2124	skb_queue_tail(&hdev->cmd_q, skb);
2125	queue_work(hdev->workqueue, &hdev->cmd_work);
 
 
 
 
 
 
2126
2127	return 0;
2128}
 
2129
2130/* Get data from the previously sent command */
2131void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
2132{
2133	struct hci_command_hdr *hdr;
2134
2135	if (!hdev->sent_cmd)
2136		return NULL;
2137
2138	hdr = (void *) hdev->sent_cmd->data;
2139
2140	if (hdr->opcode != cpu_to_le16(opcode))
2141		return NULL;
2142
2143	BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2144
2145	return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2146}
2147
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2148/* Send ACL data */
2149static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2150{
2151	struct hci_acl_hdr *hdr;
2152	int len = skb->len;
2153
2154	skb_push(skb, HCI_ACL_HDR_SIZE);
2155	skb_reset_transport_header(skb);
2156	hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
2157	hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2158	hdr->dlen   = cpu_to_le16(len);
2159}
2160
2161static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
2162				struct sk_buff *skb, __u16 flags)
2163{
 
2164	struct hci_dev *hdev = conn->hdev;
2165	struct sk_buff *list;
2166
2167	skb->len = skb_headlen(skb);
2168	skb->data_len = 0;
2169
2170	bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2171	hci_add_acl_hdr(skb, conn->handle, flags);
 
 
 
 
 
 
 
 
 
 
 
2172
2173	list = skb_shinfo(skb)->frag_list;
2174	if (!list) {
2175		/* Non fragmented */
2176		BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2177
2178		skb_queue_tail(queue, skb);
2179	} else {
2180		/* Fragmented */
2181		BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2182
2183		skb_shinfo(skb)->frag_list = NULL;
2184
2185		/* Queue all fragments atomically */
2186		spin_lock(&queue->lock);
 
 
 
 
2187
2188		__skb_queue_tail(queue, skb);
2189
2190		flags &= ~ACL_START;
2191		flags |= ACL_CONT;
2192		do {
2193			skb = list; list = list->next;
2194
2195			skb->dev = (void *) hdev;
2196			bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2197			hci_add_acl_hdr(skb, conn->handle, flags);
2198
2199			BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2200
2201			__skb_queue_tail(queue, skb);
2202		} while (list);
2203
2204		spin_unlock(&queue->lock);
2205	}
2206}
2207
2208void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2209{
2210	struct hci_conn *conn = chan->conn;
2211	struct hci_dev *hdev = conn->hdev;
2212
2213	BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
2214
2215	skb->dev = (void *) hdev;
2216
2217	hci_queue_acl(conn, &chan->data_q, skb, flags);
2218
2219	queue_work(hdev->workqueue, &hdev->tx_work);
2220}
2221EXPORT_SYMBOL(hci_send_acl);
2222
2223/* Send SCO data */
2224void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2225{
2226	struct hci_dev *hdev = conn->hdev;
2227	struct hci_sco_hdr hdr;
2228
2229	BT_DBG("%s len %d", hdev->name, skb->len);
2230
2231	hdr.handle = cpu_to_le16(conn->handle);
2232	hdr.dlen   = skb->len;
2233
2234	skb_push(skb, HCI_SCO_HDR_SIZE);
2235	skb_reset_transport_header(skb);
2236	memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2237
2238	skb->dev = (void *) hdev;
2239	bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2240
2241	skb_queue_tail(&conn->data_q, skb);
2242	queue_work(hdev->workqueue, &hdev->tx_work);
2243}
2244EXPORT_SYMBOL(hci_send_sco);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2245
2246/* ---- HCI TX task (outgoing data) ---- */
2247
2248/* HCI Connection scheduler */
2249static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2250{
2251	struct hci_conn_hash *h = &hdev->conn_hash;
2252	struct hci_conn *conn = NULL, *c;
2253	unsigned int num = 0, min = ~0;
2254
2255	/* We don't have to lock device here. Connections are always
2256	 * added and removed with TX task disabled. */
2257
2258	rcu_read_lock();
2259
2260	list_for_each_entry_rcu(c, &h->list, list) {
2261		if (c->type != type || skb_queue_empty(&c->data_q))
2262			continue;
2263
2264		if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2265			continue;
2266
2267		num++;
2268
2269		if (c->sent < min) {
2270			min  = c->sent;
2271			conn = c;
2272		}
2273
2274		if (hci_conn_num(hdev, type) == num)
2275			break;
2276	}
2277
2278	rcu_read_unlock();
2279
2280	if (conn) {
2281		int cnt, q;
2282
2283		switch (conn->type) {
2284		case ACL_LINK:
2285			cnt = hdev->acl_cnt;
2286			break;
2287		case SCO_LINK:
2288		case ESCO_LINK:
2289			cnt = hdev->sco_cnt;
2290			break;
2291		case LE_LINK:
2292			cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2293			break;
2294		default:
2295			cnt = 0;
2296			BT_ERR("Unknown link type");
2297		}
2298
2299		q = cnt / num;
2300		*quote = q ? q : 1;
2301	} else
2302		*quote = 0;
2303
2304	BT_DBG("conn %p quote %d", conn, *quote);
2305	return conn;
2306}
2307
2308static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2309{
2310	struct hci_conn_hash *h = &hdev->conn_hash;
2311	struct hci_conn *c;
2312
2313	BT_ERR("%s link tx timeout", hdev->name);
2314
2315	rcu_read_lock();
2316
2317	/* Kill stalled connections */
2318	list_for_each_entry_rcu(c, &h->list, list) {
2319		if (c->type == type && c->sent) {
2320			BT_ERR("%s killing stalled connection %s",
2321				hdev->name, batostr(&c->dst));
2322			hci_acl_disconn(c, 0x13);
 
 
 
 
 
2323		}
2324	}
2325
2326	rcu_read_unlock();
2327}
2328
2329static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2330						int *quote)
2331{
2332	struct hci_conn_hash *h = &hdev->conn_hash;
2333	struct hci_chan *chan = NULL;
2334	unsigned int num = 0, min = ~0, cur_prio = 0;
2335	struct hci_conn *conn;
2336	int cnt, q, conn_num = 0;
2337
2338	BT_DBG("%s", hdev->name);
2339
2340	rcu_read_lock();
2341
2342	list_for_each_entry_rcu(conn, &h->list, list) {
2343		struct hci_chan *tmp;
2344
2345		if (conn->type != type)
2346			continue;
2347
2348		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2349			continue;
2350
2351		conn_num++;
2352
2353		list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2354			struct sk_buff *skb;
2355
2356			if (skb_queue_empty(&tmp->data_q))
2357				continue;
2358
2359			skb = skb_peek(&tmp->data_q);
2360			if (skb->priority < cur_prio)
2361				continue;
2362
2363			if (skb->priority > cur_prio) {
2364				num = 0;
2365				min = ~0;
2366				cur_prio = skb->priority;
2367			}
2368
2369			num++;
2370
2371			if (conn->sent < min) {
2372				min  = conn->sent;
2373				chan = tmp;
2374			}
2375		}
2376
2377		if (hci_conn_num(hdev, type) == conn_num)
2378			break;
2379	}
2380
2381	rcu_read_unlock();
2382
2383	if (!chan)
2384		return NULL;
2385
2386	switch (chan->conn->type) {
2387	case ACL_LINK:
2388		cnt = hdev->acl_cnt;
2389		break;
2390	case SCO_LINK:
2391	case ESCO_LINK:
2392		cnt = hdev->sco_cnt;
2393		break;
2394	case LE_LINK:
2395		cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2396		break;
2397	default:
2398		cnt = 0;
2399		BT_ERR("Unknown link type");
2400	}
2401
2402	q = cnt / num;
2403	*quote = q ? q : 1;
2404	BT_DBG("chan %p quote %d", chan, *quote);
2405	return chan;
2406}
2407
2408static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2409{
2410	struct hci_conn_hash *h = &hdev->conn_hash;
2411	struct hci_conn *conn;
2412	int num = 0;
2413
2414	BT_DBG("%s", hdev->name);
2415
2416	rcu_read_lock();
2417
2418	list_for_each_entry_rcu(conn, &h->list, list) {
2419		struct hci_chan *chan;
2420
2421		if (conn->type != type)
2422			continue;
2423
2424		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2425			continue;
2426
2427		num++;
2428
2429		list_for_each_entry_rcu(chan, &conn->chan_list, list) {
2430			struct sk_buff *skb;
2431
2432			if (chan->sent) {
2433				chan->sent = 0;
2434				continue;
2435			}
2436
2437			if (skb_queue_empty(&chan->data_q))
2438				continue;
2439
2440			skb = skb_peek(&chan->data_q);
2441			if (skb->priority >= HCI_PRIO_MAX - 1)
2442				continue;
2443
2444			skb->priority = HCI_PRIO_MAX - 1;
2445
2446			BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2447								skb->priority);
2448		}
2449
2450		if (hci_conn_num(hdev, type) == num)
2451			break;
2452	}
2453
2454	rcu_read_unlock();
2455
2456}
2457
2458static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
2459{
2460	/* Calculate count of blocks used by this packet */
2461	return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
2462}
2463
2464static inline void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
2465{
2466	if (!test_bit(HCI_RAW, &hdev->flags)) {
2467		/* ACL tx timeout must be longer than maximum
2468		 * link supervision timeout (40.9 seconds) */
2469		if (!cnt && time_after(jiffies, hdev->acl_last_tx +
2470					msecs_to_jiffies(HCI_ACL_TX_TIMEOUT)))
2471			hci_link_tx_to(hdev, ACL_LINK);
 
 
 
 
 
 
2472	}
 
 
 
 
 
 
2473}
2474
2475static inline void hci_sched_acl_pkt(struct hci_dev *hdev)
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2476{
2477	unsigned int cnt = hdev->acl_cnt;
2478	struct hci_chan *chan;
2479	struct sk_buff *skb;
2480	int quote;
2481
2482	__check_timeout(hdev, cnt);
2483
2484	while (hdev->acl_cnt &&
2485			(chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2486		u32 priority = (skb_peek(&chan->data_q))->priority;
2487		while (quote-- && (skb = skb_peek(&chan->data_q))) {
2488			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2489					skb->len, skb->priority);
2490
2491			/* Stop if priority has changed */
2492			if (skb->priority < priority)
2493				break;
2494
2495			skb = skb_dequeue(&chan->data_q);
2496
2497			hci_conn_enter_active_mode(chan->conn,
2498						   bt_cb(skb)->force_active);
2499
2500			hci_send_frame(skb);
2501			hdev->acl_last_tx = jiffies;
2502
2503			hdev->acl_cnt--;
2504			chan->sent++;
2505			chan->conn->sent++;
 
 
 
 
2506		}
2507	}
2508
2509	if (cnt != hdev->acl_cnt)
2510		hci_prio_recalculate(hdev, ACL_LINK);
2511}
2512
2513static inline void hci_sched_acl_blk(struct hci_dev *hdev)
2514{
2515	unsigned int cnt = hdev->block_cnt;
2516	struct hci_chan *chan;
2517	struct sk_buff *skb;
2518	int quote;
 
2519
2520	__check_timeout(hdev, cnt);
 
 
 
 
 
 
 
2521
2522	while (hdev->block_cnt > 0 &&
2523			(chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2524		u32 priority = (skb_peek(&chan->data_q))->priority;
2525		while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
2526			int blocks;
2527
2528			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2529						skb->len, skb->priority);
2530
2531			/* Stop if priority has changed */
2532			if (skb->priority < priority)
2533				break;
2534
2535			skb = skb_dequeue(&chan->data_q);
2536
2537			blocks = __get_blocks(hdev, skb);
2538			if (blocks > hdev->block_cnt)
2539				return;
2540
2541			hci_conn_enter_active_mode(chan->conn,
2542						bt_cb(skb)->force_active);
2543
2544			hci_send_frame(skb);
2545			hdev->acl_last_tx = jiffies;
2546
2547			hdev->block_cnt -= blocks;
2548			quote -= blocks;
2549
2550			chan->sent += blocks;
2551			chan->conn->sent += blocks;
2552		}
2553	}
2554
2555	if (cnt != hdev->block_cnt)
2556		hci_prio_recalculate(hdev, ACL_LINK);
2557}
2558
2559static inline void hci_sched_acl(struct hci_dev *hdev)
2560{
2561	BT_DBG("%s", hdev->name);
2562
2563	if (!hci_conn_num(hdev, ACL_LINK))
 
 
 
 
 
2564		return;
2565
2566	switch (hdev->flow_ctl_mode) {
2567	case HCI_FLOW_CTL_MODE_PACKET_BASED:
2568		hci_sched_acl_pkt(hdev);
2569		break;
2570
2571	case HCI_FLOW_CTL_MODE_BLOCK_BASED:
2572		hci_sched_acl_blk(hdev);
2573		break;
2574	}
2575}
2576
2577/* Schedule SCO */
2578static inline void hci_sched_sco(struct hci_dev *hdev)
2579{
2580	struct hci_conn *conn;
2581	struct sk_buff *skb;
2582	int quote;
2583
2584	BT_DBG("%s", hdev->name);
2585
2586	if (!hci_conn_num(hdev, SCO_LINK))
2587		return;
2588
2589	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2590		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2591			BT_DBG("skb %p len %d", skb, skb->len);
2592			hci_send_frame(skb);
2593
2594			conn->sent++;
2595			if (conn->sent == ~0)
2596				conn->sent = 0;
2597		}
2598	}
2599}
2600
2601static inline void hci_sched_esco(struct hci_dev *hdev)
2602{
2603	struct hci_conn *conn;
2604	struct sk_buff *skb;
2605	int quote;
2606
2607	BT_DBG("%s", hdev->name);
2608
2609	if (!hci_conn_num(hdev, ESCO_LINK))
2610		return;
2611
2612	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2613		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2614			BT_DBG("skb %p len %d", skb, skb->len);
2615			hci_send_frame(skb);
2616
2617			conn->sent++;
2618			if (conn->sent == ~0)
2619				conn->sent = 0;
2620		}
2621	}
2622}
2623
2624static inline void hci_sched_le(struct hci_dev *hdev)
2625{
2626	struct hci_chan *chan;
2627	struct sk_buff *skb;
2628	int quote, cnt, tmp;
2629
2630	BT_DBG("%s", hdev->name);
2631
2632	if (!hci_conn_num(hdev, LE_LINK))
2633		return;
2634
2635	if (!test_bit(HCI_RAW, &hdev->flags)) {
2636		/* LE tx timeout must be longer than maximum
2637		 * link supervision timeout (40.9 seconds) */
2638		if (!hdev->le_cnt && hdev->le_pkts &&
2639				time_after(jiffies, hdev->le_last_tx + HZ * 45))
2640			hci_link_tx_to(hdev, LE_LINK);
2641	}
2642
2643	cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
 
 
 
2644	tmp = cnt;
2645	while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
2646		u32 priority = (skb_peek(&chan->data_q))->priority;
2647		while (quote-- && (skb = skb_peek(&chan->data_q))) {
2648			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2649					skb->len, skb->priority);
2650
2651			/* Stop if priority has changed */
2652			if (skb->priority < priority)
2653				break;
2654
2655			skb = skb_dequeue(&chan->data_q);
2656
2657			hci_send_frame(skb);
2658			hdev->le_last_tx = jiffies;
2659
2660			cnt--;
2661			chan->sent++;
2662			chan->conn->sent++;
 
 
 
 
2663		}
2664	}
2665
2666	if (hdev->le_pkts)
2667		hdev->le_cnt = cnt;
2668	else
2669		hdev->acl_cnt = cnt;
2670
2671	if (cnt != tmp)
2672		hci_prio_recalculate(hdev, LE_LINK);
2673}
2674
2675static void hci_tx_work(struct work_struct *work)
 
2676{
2677	struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
2678	struct sk_buff *skb;
 
2679
2680	BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2681		hdev->sco_cnt, hdev->le_cnt);
2682
2683	/* Schedule queues and send stuff to HCI driver */
 
2684
2685	hci_sched_acl(hdev);
 
 
 
 
 
2686
2687	hci_sched_sco(hdev);
 
 
 
 
 
 
 
 
 
 
 
2688
2689	hci_sched_esco(hdev);
 
2690
2691	hci_sched_le(hdev);
 
 
 
 
 
 
 
2692
2693	/* Send next queued raw (unknown type) packet */
2694	while ((skb = skb_dequeue(&hdev->raw_q)))
2695		hci_send_frame(skb);
2696}
2697
2698/* ----- HCI RX task (incoming data processing) ----- */
2699
2700/* ACL data packet */
2701static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2702{
2703	struct hci_acl_hdr *hdr = (void *) skb->data;
2704	struct hci_conn *conn;
2705	__u16 handle, flags;
2706
2707	skb_pull(skb, HCI_ACL_HDR_SIZE);
2708
2709	handle = __le16_to_cpu(hdr->handle);
2710	flags  = hci_flags(handle);
2711	handle = hci_handle(handle);
2712
2713	BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
 
2714
2715	hdev->stat.acl_rx++;
2716
2717	hci_dev_lock(hdev);
2718	conn = hci_conn_hash_lookup_handle(hdev, handle);
2719	hci_dev_unlock(hdev);
2720
2721	if (conn) {
2722		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
2723
2724		hci_dev_lock(hdev);
2725		if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
2726		    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2727			mgmt_device_connected(hdev, &conn->dst, conn->type,
2728					      conn->dst_type, 0, NULL, 0,
2729					      conn->dev_class);
2730		hci_dev_unlock(hdev);
2731
2732		/* Send to upper protocol */
2733		l2cap_recv_acldata(conn, skb, flags);
2734		return;
2735	} else {
2736		BT_ERR("%s ACL packet for unknown connection handle %d",
2737			hdev->name, handle);
2738	}
2739
2740	kfree_skb(skb);
2741}
2742
2743/* SCO data packet */
2744static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2745{
2746	struct hci_sco_hdr *hdr = (void *) skb->data;
2747	struct hci_conn *conn;
2748	__u16 handle;
2749
2750	skb_pull(skb, HCI_SCO_HDR_SIZE);
2751
2752	handle = __le16_to_cpu(hdr->handle);
 
 
2753
2754	BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
 
2755
2756	hdev->stat.sco_rx++;
2757
2758	hci_dev_lock(hdev);
2759	conn = hci_conn_hash_lookup_handle(hdev, handle);
2760	hci_dev_unlock(hdev);
2761
2762	if (conn) {
2763		/* Send to upper protocol */
 
2764		sco_recv_scodata(conn, skb);
2765		return;
2766	} else {
2767		BT_ERR("%s SCO packet for unknown connection handle %d",
2768			hdev->name, handle);
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2769	}
2770
 
 
 
 
 
2771	kfree_skb(skb);
2772}
2773
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
2774static void hci_rx_work(struct work_struct *work)
2775{
2776	struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
2777	struct sk_buff *skb;
2778
2779	BT_DBG("%s", hdev->name);
2780
2781	while ((skb = skb_dequeue(&hdev->rx_q))) {
 
 
 
 
 
 
 
2782		/* Send copy to monitor */
2783		hci_send_to_monitor(hdev, skb);
2784
2785		if (atomic_read(&hdev->promisc)) {
2786			/* Send copy to the sockets */
2787			hci_send_to_sock(hdev, skb);
2788		}
2789
2790		if (test_bit(HCI_RAW, &hdev->flags)) {
 
 
 
 
 
 
 
2791			kfree_skb(skb);
2792			continue;
2793		}
2794
2795		if (test_bit(HCI_INIT, &hdev->flags)) {
2796			/* Don't process data packets in this states. */
2797			switch (bt_cb(skb)->pkt_type) {
2798			case HCI_ACLDATA_PKT:
2799			case HCI_SCODATA_PKT:
 
2800				kfree_skb(skb);
2801				continue;
2802			}
2803		}
2804
2805		/* Process frame */
2806		switch (bt_cb(skb)->pkt_type) {
2807		case HCI_EVENT_PKT:
2808			BT_DBG("%s Event packet", hdev->name);
2809			hci_event_packet(hdev, skb);
2810			break;
2811
2812		case HCI_ACLDATA_PKT:
2813			BT_DBG("%s ACL data packet", hdev->name);
2814			hci_acldata_packet(hdev, skb);
2815			break;
2816
2817		case HCI_SCODATA_PKT:
2818			BT_DBG("%s SCO data packet", hdev->name);
2819			hci_scodata_packet(hdev, skb);
2820			break;
2821
 
 
 
 
 
2822		default:
2823			kfree_skb(skb);
2824			break;
2825		}
2826	}
2827}
2828
2829static void hci_cmd_work(struct work_struct *work)
2830{
2831	struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
2832	struct sk_buff *skb;
2833
2834	BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
 
2835
2836	/* Send queued commands */
2837	if (atomic_read(&hdev->cmd_cnt)) {
2838		skb = skb_dequeue(&hdev->cmd_q);
2839		if (!skb)
2840			return;
2841
2842		kfree_skb(hdev->sent_cmd);
2843
2844		hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2845		if (hdev->sent_cmd) {
 
 
 
2846			atomic_dec(&hdev->cmd_cnt);
2847			hci_send_frame(skb);
2848			if (test_bit(HCI_RESET, &hdev->flags))
2849				del_timer(&hdev->cmd_timer);
 
 
 
 
 
 
2850			else
2851				mod_timer(&hdev->cmd_timer,
2852				  jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
 
2853		} else {
2854			skb_queue_head(&hdev->cmd_q, skb);
2855			queue_work(hdev->workqueue, &hdev->cmd_work);
2856		}
2857	}
2858}
2859
2860int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2861{
2862	/* General inquiry access code (GIAC) */
2863	u8 lap[3] = { 0x33, 0x8b, 0x9e };
2864	struct hci_cp_inquiry cp;
2865
2866	BT_DBG("%s", hdev->name);
2867
2868	if (test_bit(HCI_INQUIRY, &hdev->flags))
2869		return -EINPROGRESS;
2870
2871	inquiry_cache_flush(hdev);
2872
2873	memset(&cp, 0, sizeof(cp));
2874	memcpy(&cp.lap, lap, sizeof(cp.lap));
2875	cp.length  = length;
2876
2877	return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2878}
2879
2880int hci_cancel_inquiry(struct hci_dev *hdev)
2881{
2882	BT_DBG("%s", hdev->name);
2883
2884	if (!test_bit(HCI_INQUIRY, &hdev->flags))
2885		return -EALREADY;
2886
2887	return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2888}
2889
2890u8 bdaddr_to_le(u8 bdaddr_type)
2891{
2892	switch (bdaddr_type) {
2893	case BDADDR_LE_PUBLIC:
2894		return ADDR_LE_DEV_PUBLIC;
2895
2896	default:
2897		/* Fallback to LE Random address type */
2898		return ADDR_LE_DEV_RANDOM;
2899	}
2900}