net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI core. */
  26
  27 #include <linux/jiffies.h>
  28 #include <linux/module.h>
  29 #include <linux/kmod.h>
  30
  31 #include <linux/types.h>
  32 #include <linux/errno.h>
  33 #include <linux/kernel.h>
  34 #include <linux/sched.h>
  35 #include <linux/slab.h>
  36 #include <linux/poll.h>
  37 #include <linux/fcntl.h>
  38 #include <linux/init.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/workqueue.h>
  41 #include <linux/interrupt.h>
  42 #include <linux/notifier.h>
  43 #include <linux/rfkill.h>
  44 #include <linux/timer.h>
  45 #include <linux/crypto.h>
  46 #include <net/sock.h>
  47
  48 #include <asm/system.h>
  49 #include <linux/uaccess.h>
  50 #include <asm/unaligned.h>
  51
  52 #include <net/bluetooth/bluetooth.h>
  53 #include <net/bluetooth/hci_core.h>
  54
  55 #define AUTO_OFF_TIMEOUT 2000
  56
  57 static void hci_cmd_task(unsigned long arg);
  58 static void hci_rx_task(unsigned long arg);
  59 static void hci_tx_task(unsigned long arg);
  60
  61 static DEFINE_RWLOCK(hci_task_lock);
  62
  63 /* HCI device list */
  64 LIST_HEAD(hci_dev_list);
  65 DEFINE_RWLOCK(hci_dev_list_lock);
  66
  67 /* HCI callback list */
  68 LIST_HEAD(hci_cb_list);
  69 DEFINE_RWLOCK(hci_cb_list_lock);
  70
  71 /* HCI protocols */
  72 #define HCI_MAX_PROTO   2
  73 struct hci_proto *hci_proto[HCI_MAX_PROTO];
  74
  75 /* HCI notifiers list */
  76 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
  77
  78 /* ---- HCI notifications ---- */
  79
  80 int hci_register_notifier(struct notifier_block *nb)
  81 {
  82         return atomic_notifier_chain_register(&hci_notifier, nb);
  83 }
  84
  85 int hci_unregister_notifier(struct notifier_block *nb)
  86 {
  87         return atomic_notifier_chain_unregister(&hci_notifier, nb);
  88 }
  89
  90 static void hci_notify(struct hci_dev *hdev, int event)
  91 {
  92         atomic_notifier_call_chain(&hci_notifier, event, hdev);
  93 }
  94
  95 /* ---- HCI requests ---- */
  96
  97 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
  98 {
  99         BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
 100
 101         /* If this is the init phase check if the completed command matches
 102          * the last init command, and if not just return.
 103          */
 104         if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
 105                 return;
 106
 107         if (hdev->req_status == HCI_REQ_PEND) {
 108                 hdev->req_result = result;
 109                 hdev->req_status = HCI_REQ_DONE;
 110                 wake_up_interruptible(&hdev->req_wait_q);
 111         }
 112 }
 113
 114 static void hci_req_cancel(struct hci_dev *hdev, int err)
 115 {
 116         BT_DBG("%s err 0x%2.2x", hdev->name, err);
 117
 118         if (hdev->req_status == HCI_REQ_PEND) {
 119                 hdev->req_result = err;
 120                 hdev->req_status = HCI_REQ_CANCELED;
 121                 wake_up_interruptible(&hdev->req_wait_q);
 122         }
 123 }
 124
 125 /* Execute request and wait for completion. */
 126 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 127                                         unsigned long opt, __u32 timeout)
 128 {
 129         DECLARE_WAITQUEUE(wait, current);
 130         int err = 0;
 131
 132         BT_DBG("%s start", hdev->name);
 133
 134         hdev->req_status = HCI_REQ_PEND;
 135
 136         add_wait_queue(&hdev->req_wait_q, &wait);
 137         set_current_state(TASK_INTERRUPTIBLE);
 138
 139         req(hdev, opt);
 140         schedule_timeout(timeout);
 141
 142         remove_wait_queue(&hdev->req_wait_q, &wait);
 143
 144         if (signal_pending(current))
 145                 return -EINTR;
 146
 147         switch (hdev->req_status) {
 148         case HCI_REQ_DONE:
 149                 err = -bt_to_errno(hdev->req_result);
 150                 break;
 151
 152         case HCI_REQ_CANCELED:
 153                 err = -hdev->req_result;
 154                 break;
 155
 156         default:
 157                 err = -ETIMEDOUT;
 158                 break;
 159         }
 160
 161         hdev->req_status = hdev->req_result = 0;
 162
 163         BT_DBG("%s end: err %d", hdev->name, err);
 164
 165         return err;
 166 }
 167
 168 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 169                                         unsigned long opt, __u32 timeout)
 170 {
 171         int ret;
 172
 173         if (!test_bit(HCI_UP, &hdev->flags))
 174                 return -ENETDOWN;
 175
 176         /* Serialize all requests */
 177         hci_req_lock(hdev);
 178         ret = __hci_request(hdev, req, opt, timeout);
 179         hci_req_unlock(hdev);
 180
 181         return ret;
 182 }
 183
 184 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
 185 {
 186         BT_DBG("%s %ld", hdev->name, opt);
 187
 188         /* Reset device */
 189         set_bit(HCI_RESET, &hdev->flags);
 190         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 191 }
 192
 193 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 194 {
 195         struct hci_cp_delete_stored_link_key cp;
 196         struct sk_buff *skb;
 197         __le16 param;
 198         __u8 flt_type;
 199
 200         BT_DBG("%s %ld", hdev->name, opt);
 201
 202         /* Driver initialization */
 203
 204         /* Special commands */
 205         while ((skb = skb_dequeue(&hdev->driver_init))) {
 206                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
 207                 skb->dev = (void *) hdev;
 208
 209                 skb_queue_tail(&hdev->cmd_q, skb);
 210                 tasklet_schedule(&hdev->cmd_task);
 211         }
 212         skb_queue_purge(&hdev->driver_init);
 213
 214         /* Mandatory initialization */
 215
 216         /* Reset */
 217         if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
 218                         set_bit(HCI_RESET, &hdev->flags);
 219                         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 220         }
 221
 222         /* Read Local Supported Features */
 223         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 224
 225         /* Read Local Version */
 226         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 227
 228         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 229         hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 230
 231 #if 0
 232         /* Host buffer size */
 233         {
 234                 struct hci_cp_host_buffer_size cp;
 235                 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
 236                 cp.sco_mtu = HCI_MAX_SCO_SIZE;
 237                 cp.acl_max_pkt = cpu_to_le16(0xffff);
 238                 cp.sco_max_pkt = cpu_to_le16(0xffff);
 239                 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
 240         }
 241 #endif
 242
 243         /* Read BD Address */
 244         hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
 245
 246         /* Read Class of Device */
 247         hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 248
 249         /* Read Local Name */
 250         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 251
 252         /* Read Voice Setting */
 253         hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 254
 255         /* Optional initialization */
 256
 257         /* Clear Event Filters */
 258         flt_type = HCI_FLT_CLEAR_ALL;
 259         hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 260
 261         /* Connection accept timeout ~20 secs */
 262         param = cpu_to_le16(0x7d00);
 263         hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 264
 265         bacpy(&cp.bdaddr, BDADDR_ANY);
 266         cp.delete_all = 1;
 267         hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
 268 }
 269
 270 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
 271 {
 272         BT_DBG("%s", hdev->name);
 273
 274         /* Read LE buffer size */
 275         hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 276 }
 277
 278 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
 279 {
 280         __u8 scan = opt;
 281
 282         BT_DBG("%s %x", hdev->name, scan);
 283
 284         /* Inquiry and Page scans */
 285         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 286 }
 287
 288 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
 289 {
 290         __u8 auth = opt;
 291
 292         BT_DBG("%s %x", hdev->name, auth);
 293
 294         /* Authentication */
 295         hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 296 }
 297
 298 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
 299 {
 300         __u8 encrypt = opt;
 301
 302         BT_DBG("%s %x", hdev->name, encrypt);
 303
 304         /* Encryption */
 305         hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 306 }
 307
 308 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
 309 {
 310         __le16 policy = cpu_to_le16(opt);
 311
 312         BT_DBG("%s %x", hdev->name, policy);
 313
 314         /* Default link policy */
 315         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 316 }
 317
 318 /* Get HCI device by index.
 319  * Device is held on return. */
 320 struct hci_dev *hci_dev_get(int index)
 321 {
 322         struct hci_dev *hdev = NULL;
 323         struct list_head *p;
 324
 325         BT_DBG("%d", index);
 326
 327         if (index < 0)
 328                 return NULL;
 329
 330         read_lock(&hci_dev_list_lock);
 331         list_for_each(p, &hci_dev_list) {
 332                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 333                 if (d->id == index) {
 334                         hdev = hci_dev_hold(d);
 335                         break;
 336                 }
 337         }
 338         read_unlock(&hci_dev_list_lock);
 339         return hdev;
 340 }
 341
 342 /* ---- Inquiry support ---- */
 343 static void inquiry_cache_flush(struct hci_dev *hdev)
 344 {
 345         struct inquiry_cache *cache = &hdev->inq_cache;
 346         struct inquiry_entry *next  = cache->list, *e;
 347
 348         BT_DBG("cache %p", cache);
 349
 350         cache->list = NULL;
 351         while ((e = next)) {
 352                 next = e->next;
 353                 kfree(e);
 354         }
 355 }
 356
 357 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 358 {
 359         struct inquiry_cache *cache = &hdev->inq_cache;
 360         struct inquiry_entry *e;
 361
 362         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 363
 364         for (e = cache->list; e; e = e->next)
 365                 if (!bacmp(&e->data.bdaddr, bdaddr))
 366                         break;
 367         return e;
 368 }
 369
 370 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
 371 {
 372         struct inquiry_cache *cache = &hdev->inq_cache;
 373         struct inquiry_entry *ie;
 374
 375         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 376
 377         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
 378         if (!ie) {
 379                 /* Entry not in the cache. Add new one. */
 380                 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
 381                 if (!ie)
 382                         return;
 383
 384                 ie->next = cache->list;
 385                 cache->list = ie;
 386         }
 387
 388         memcpy(&ie->data, data, sizeof(*data));
 389         ie->timestamp = jiffies;
 390         cache->timestamp = jiffies;
 391 }
 392
 393 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 394 {
 395         struct inquiry_cache *cache = &hdev->inq_cache;
 396         struct inquiry_info *info = (struct inquiry_info *) buf;
 397         struct inquiry_entry *e;
 398         int copied = 0;
 399
 400         for (e = cache->list; e && copied < num; e = e->next, copied++) {
 401                 struct inquiry_data *data = &e->data;
 402                 bacpy(&info->bdaddr, &data->bdaddr);
 403                 info->pscan_rep_mode    = data->pscan_rep_mode;
 404                 info->pscan_period_mode = data->pscan_period_mode;
 405                 info->pscan_mode        = data->pscan_mode;
 406                 memcpy(info->dev_class, data->dev_class, 3);
 407                 info->clock_offset      = data->clock_offset;
 408                 info++;
 409         }
 410
 411         BT_DBG("cache %p, copied %d", cache, copied);
 412         return copied;
 413 }
 414
 415 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
 416 {
 417         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
 418         struct hci_cp_inquiry cp;
 419
 420         BT_DBG("%s", hdev->name);
 421
 422         if (test_bit(HCI_INQUIRY, &hdev->flags))
 423                 return;
 424
 425         /* Start Inquiry */
 426         memcpy(&cp.lap, &ir->lap, 3);
 427         cp.length  = ir->length;
 428         cp.num_rsp = ir->num_rsp;
 429         hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
 430 }
 431
 432 int hci_inquiry(void __user *arg)
 433 {
 434         __u8 __user *ptr = arg;
 435         struct hci_inquiry_req ir;
 436         struct hci_dev *hdev;
 437         int err = 0, do_inquiry = 0, max_rsp;
 438         long timeo;
 439         __u8 *buf;
 440
 441         if (copy_from_user(&ir, ptr, sizeof(ir)))
 442                 return -EFAULT;
 443
 444         hdev = hci_dev_get(ir.dev_id);
 445         if (!hdev)
 446                 return -ENODEV;
 447
 448         hci_dev_lock_bh(hdev);
 449         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 450                                 inquiry_cache_empty(hdev) ||
 451                                 ir.flags & IREQ_CACHE_FLUSH) {
 452                 inquiry_cache_flush(hdev);
 453                 do_inquiry = 1;
 454         }
 455         hci_dev_unlock_bh(hdev);
 456
 457         timeo = ir.length * msecs_to_jiffies(2000);
 458
 459         if (do_inquiry) {
 460                 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
 461                 if (err < 0)
 462                         goto done;
 463         }
 464
 465         /* for unlimited number of responses we will use buffer with 255 entries */
 466         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 467
 468         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
 469          * copy it to the user space.
 470          */
 471         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
 472         if (!buf) {
 473                 err = -ENOMEM;
 474                 goto done;
 475         }
 476
 477         hci_dev_lock_bh(hdev);
 478         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
 479         hci_dev_unlock_bh(hdev);
 480
 481         BT_DBG("num_rsp %d", ir.num_rsp);
 482
 483         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
 484                 ptr += sizeof(ir);
 485                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
 486                                         ir.num_rsp))
 487                         err = -EFAULT;
 488         } else
 489                 err = -EFAULT;
 490
 491         kfree(buf);
 492
 493 done:
 494         hci_dev_put(hdev);
 495         return err;
 496 }
 497
 498 /* ---- HCI ioctl helpers ---- */
 499
 500 int hci_dev_open(__u16 dev)
 501 {
 502         struct hci_dev *hdev;
 503         int ret = 0;
 504
 505         hdev = hci_dev_get(dev);
 506         if (!hdev)
 507                 return -ENODEV;
 508
 509         BT_DBG("%s %p", hdev->name, hdev);
 510
 511         hci_req_lock(hdev);
 512
 513         if (test_bit(HCI_UNREGISTER, &hdev->flags)) {
 514                 ret = -ENODEV;
 515                 goto done;
 516         }
 517
 518         if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
 519                 ret = -ERFKILL;
 520                 goto done;
 521         }
 522
 523         if (test_bit(HCI_UP, &hdev->flags)) {
 524                 ret = -EALREADY;
 525                 goto done;
 526         }
 527
 528         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 529                 set_bit(HCI_RAW, &hdev->flags);
 530
 531         /* Treat all non BR/EDR controllers as raw devices for now */
 532         if (hdev->dev_type != HCI_BREDR)
 533                 set_bit(HCI_RAW, &hdev->flags);
 534
 535         if (hdev->open(hdev)) {
 536                 ret = -EIO;
 537                 goto done;
 538         }
 539
 540         if (!test_bit(HCI_RAW, &hdev->flags)) {
 541                 atomic_set(&hdev->cmd_cnt, 1);
 542                 set_bit(HCI_INIT, &hdev->flags);
 543                 hdev->init_last_cmd = 0;
 544
 545                 ret = __hci_request(hdev, hci_init_req, 0,
 546                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 547
 548                 if (lmp_host_le_capable(hdev))
 549                         ret = __hci_request(hdev, hci_le_init_req, 0,
 550                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 551
 552                 clear_bit(HCI_INIT, &hdev->flags);
 553         }
 554
 555         if (!ret) {
 556                 hci_dev_hold(hdev);
 557                 set_bit(HCI_UP, &hdev->flags);
 558                 hci_notify(hdev, HCI_DEV_UP);
 559                 if (!test_bit(HCI_SETUP, &hdev->flags))
 560                         mgmt_powered(hdev->id, 1);
 561         } else {
 562                 /* Init failed, cleanup */
 563                 tasklet_kill(&hdev->rx_task);
 564                 tasklet_kill(&hdev->tx_task);
 565                 tasklet_kill(&hdev->cmd_task);
 566
 567                 skb_queue_purge(&hdev->cmd_q);
 568                 skb_queue_purge(&hdev->rx_q);
 569
 570                 if (hdev->flush)
 571                         hdev->flush(hdev);
 572
 573                 if (hdev->sent_cmd) {
 574                         kfree_skb(hdev->sent_cmd);
 575                         hdev->sent_cmd = NULL;
 576                 }
 577
 578                 hdev->close(hdev);
 579                 hdev->flags = 0;
 580         }
 581
 582 done:
 583         hci_req_unlock(hdev);
 584         hci_dev_put(hdev);
 585         return ret;
 586 }
 587
 588 static int hci_dev_do_close(struct hci_dev *hdev)
 589 {
 590         BT_DBG("%s %p", hdev->name, hdev);
 591
 592         hci_req_cancel(hdev, ENODEV);
 593         hci_req_lock(hdev);
 594
 595         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 596                 del_timer_sync(&hdev->cmd_timer);
 597                 hci_req_unlock(hdev);
 598                 return 0;
 599         }
 600
 601         /* Kill RX and TX tasks */
 602         tasklet_kill(&hdev->rx_task);
 603         tasklet_kill(&hdev->tx_task);
 604
 605         hci_dev_lock_bh(hdev);
 606         inquiry_cache_flush(hdev);
 607         hci_conn_hash_flush(hdev);
 608         hci_dev_unlock_bh(hdev);
 609
 610         hci_notify(hdev, HCI_DEV_DOWN);
 611
 612         if (hdev->flush)
 613                 hdev->flush(hdev);
 614
 615         /* Reset device */
 616         skb_queue_purge(&hdev->cmd_q);
 617         atomic_set(&hdev->cmd_cnt, 1);
 618         if (!test_bit(HCI_RAW, &hdev->flags)) {
 619                 set_bit(HCI_INIT, &hdev->flags);
 620                 __hci_request(hdev, hci_reset_req, 0,
 621                                         msecs_to_jiffies(250));
 622                 clear_bit(HCI_INIT, &hdev->flags);
 623         }
 624
 625         /* Kill cmd task */
 626         tasklet_kill(&hdev->cmd_task);
 627
 628         /* Drop queues */
 629         skb_queue_purge(&hdev->rx_q);
 630         skb_queue_purge(&hdev->cmd_q);
 631         skb_queue_purge(&hdev->raw_q);
 632
 633         /* Drop last sent command */
 634         if (hdev->sent_cmd) {
 635                 del_timer_sync(&hdev->cmd_timer);
 636                 kfree_skb(hdev->sent_cmd);
 637                 hdev->sent_cmd = NULL;
 638         }
 639
 640         /* After this point our queues are empty
 641          * and no tasks are scheduled. */
 642         hdev->close(hdev);
 643
 644         mgmt_powered(hdev->id, 0);
 645
 646         /* Clear flags */
 647         hdev->flags = 0;
 648
 649         hci_req_unlock(hdev);
 650
 651         hci_dev_put(hdev);
 652         return 0;
 653 }
 654
 655 int hci_dev_close(__u16 dev)
 656 {
 657         struct hci_dev *hdev;
 658         int err;
 659
 660         hdev = hci_dev_get(dev);
 661         if (!hdev)
 662                 return -ENODEV;
 663         err = hci_dev_do_close(hdev);
 664         hci_dev_put(hdev);
 665         return err;
 666 }
 667
 668 int hci_dev_reset(__u16 dev)
 669 {
 670         struct hci_dev *hdev;
 671         int ret = 0;
 672
 673         hdev = hci_dev_get(dev);
 674         if (!hdev)
 675                 return -ENODEV;
 676
 677         hci_req_lock(hdev);
 678         tasklet_disable(&hdev->tx_task);
 679
 680         if (!test_bit(HCI_UP, &hdev->flags))
 681                 goto done;
 682
 683         /* Drop queues */
 684         skb_queue_purge(&hdev->rx_q);
 685         skb_queue_purge(&hdev->cmd_q);
 686
 687         hci_dev_lock_bh(hdev);
 688         inquiry_cache_flush(hdev);
 689         hci_conn_hash_flush(hdev);
 690         hci_dev_unlock_bh(hdev);
 691
 692         if (hdev->flush)
 693                 hdev->flush(hdev);
 694
 695         atomic_set(&hdev->cmd_cnt, 1);
 696         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
 697
 698         if (!test_bit(HCI_RAW, &hdev->flags))
 699                 ret = __hci_request(hdev, hci_reset_req, 0,
 700                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 701
 702 done:
 703         tasklet_enable(&hdev->tx_task);
 704         hci_req_unlock(hdev);
 705         hci_dev_put(hdev);
 706         return ret;
 707 }
 708
 709 int hci_dev_reset_stat(__u16 dev)
 710 {
 711         struct hci_dev *hdev;
 712         int ret = 0;
 713
 714         hdev = hci_dev_get(dev);
 715         if (!hdev)
 716                 return -ENODEV;
 717
 718         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 719
 720         hci_dev_put(hdev);
 721
 722         return ret;
 723 }
 724
 725 int hci_dev_cmd(unsigned int cmd, void __user *arg)
 726 {
 727         struct hci_dev *hdev;
 728         struct hci_dev_req dr;
 729         int err = 0;
 730
 731         if (copy_from_user(&dr, arg, sizeof(dr)))
 732                 return -EFAULT;
 733
 734         hdev = hci_dev_get(dr.dev_id);
 735         if (!hdev)
 736                 return -ENODEV;
 737
 738         switch (cmd) {
 739         case HCISETAUTH:
 740                 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 741                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 742                 break;
 743
 744         case HCISETENCRYPT:
 745                 if (!lmp_encrypt_capable(hdev)) {
 746                         err = -EOPNOTSUPP;
 747                         break;
 748                 }
 749
 750                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
 751                         /* Auth must be enabled first */
 752                         err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 753                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 754                         if (err)
 755                                 break;
 756                 }
 757
 758                 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
 759                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 760                 break;
 761
 762         case HCISETSCAN:
 763                 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
 764                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 765                 break;
 766
 767         case HCISETLINKPOL:
 768                 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
 769                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 770                 break;
 771
 772         case HCISETLINKMODE:
 773                 hdev->link_mode = ((__u16) dr.dev_opt) &
 774                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
 775                 break;
 776
 777         case HCISETPTYPE:
 778                 hdev->pkt_type = (__u16) dr.dev_opt;
 779                 break;
 780
 781         case HCISETACLMTU:
 782                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
 783                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
 784                 break;
 785
 786         case HCISETSCOMTU:
 787                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
 788                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
 789                 break;
 790
 791         default:
 792                 err = -EINVAL;
 793                 break;
 794         }
 795
 796         hci_dev_put(hdev);
 797         return err;
 798 }
 799
 800 int hci_get_dev_list(void __user *arg)
 801 {
 802         struct hci_dev_list_req *dl;
 803         struct hci_dev_req *dr;
 804         struct list_head *p;
 805         int n = 0, size, err;
 806         __u16 dev_num;
 807
 808         if (get_user(dev_num, (__u16 __user *) arg))
 809                 return -EFAULT;
 810
 811         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
 812                 return -EINVAL;
 813
 814         size = sizeof(*dl) + dev_num * sizeof(*dr);
 815
 816         dl = kzalloc(size, GFP_KERNEL);
 817         if (!dl)
 818                 return -ENOMEM;
 819
 820         dr = dl->dev_req;
 821
 822         read_lock_bh(&hci_dev_list_lock);
 823         list_for_each(p, &hci_dev_list) {
 824                 struct hci_dev *hdev;
 825
 826                 hdev = list_entry(p, struct hci_dev, list);
 827
 828                 hci_del_off_timer(hdev);
 829
 830                 if (!test_bit(HCI_MGMT, &hdev->flags))
 831                         set_bit(HCI_PAIRABLE, &hdev->flags);
 832
 833                 (dr + n)->dev_id  = hdev->id;
 834                 (dr + n)->dev_opt = hdev->flags;
 835
 836                 if (++n >= dev_num)
 837                         break;
 838         }
 839         read_unlock_bh(&hci_dev_list_lock);
 840
 841         dl->dev_num = n;
 842         size = sizeof(*dl) + n * sizeof(*dr);
 843
 844         err = copy_to_user(arg, dl, size);
 845         kfree(dl);
 846
 847         return err ? -EFAULT : 0;
 848 }
 849
 850 int hci_get_dev_info(void __user *arg)
 851 {
 852         struct hci_dev *hdev;
 853         struct hci_dev_info di;
 854         int err = 0;
 855
 856         if (copy_from_user(&di, arg, sizeof(di)))
 857                 return -EFAULT;
 858
 859         hdev = hci_dev_get(di.dev_id);
 860         if (!hdev)
 861                 return -ENODEV;
 862
 863         hci_del_off_timer(hdev);
 864
 865         if (!test_bit(HCI_MGMT, &hdev->flags))
 866                 set_bit(HCI_PAIRABLE, &hdev->flags);
 867
 868         strcpy(di.name, hdev->name);
 869         di.bdaddr   = hdev->bdaddr;
 870         di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
 871         di.flags    = hdev->flags;
 872         di.pkt_type = hdev->pkt_type;
 873         di.acl_mtu  = hdev->acl_mtu;
 874         di.acl_pkts = hdev->acl_pkts;
 875         di.sco_mtu  = hdev->sco_mtu;
 876         di.sco_pkts = hdev->sco_pkts;
 877         di.link_policy = hdev->link_policy;
 878         di.link_mode   = hdev->link_mode;
 879
 880         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
 881         memcpy(&di.features, &hdev->features, sizeof(di.features));
 882
 883         if (copy_to_user(arg, &di, sizeof(di)))
 884                 err = -EFAULT;
 885
 886         hci_dev_put(hdev);
 887
 888         return err;
 889 }
 890
 891 /* ---- Interface to HCI drivers ---- */
 892
 893 static int hci_rfkill_set_block(void *data, bool blocked)
 894 {
 895         struct hci_dev *hdev = data;
 896
 897         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
 898
 899         if (!blocked)
 900                 return 0;
 901
 902         hci_dev_do_close(hdev);
 903
 904         return 0;
 905 }
 906
 907 static const struct rfkill_ops hci_rfkill_ops = {
 908         .set_block = hci_rfkill_set_block,
 909 };
 910
 911 /* Alloc HCI device */
 912 struct hci_dev *hci_alloc_dev(void)
 913 {
 914         struct hci_dev *hdev;
 915
 916         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
 917         if (!hdev)
 918                 return NULL;
 919
 920         skb_queue_head_init(&hdev->driver_init);
 921
 922         return hdev;
 923 }
 924 EXPORT_SYMBOL(hci_alloc_dev);
 925
 926 /* Free HCI device */
 927 void hci_free_dev(struct hci_dev *hdev)
 928 {
 929         skb_queue_purge(&hdev->driver_init);
 930
 931         /* will free via device release */
 932         put_device(&hdev->dev);
 933 }
 934 EXPORT_SYMBOL(hci_free_dev);
 935
 936 static void hci_power_on(struct work_struct *work)
 937 {
 938         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
 939
 940         BT_DBG("%s", hdev->name);
 941
 942         if (hci_dev_open(hdev->id) < 0)
 943                 return;
 944
 945         if (test_bit(HCI_AUTO_OFF, &hdev->flags))
 946                 mod_timer(&hdev->off_timer,
 947                                 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
 948
 949         if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
 950                 mgmt_index_added(hdev->id);
 951 }
 952
 953 static void hci_power_off(struct work_struct *work)
 954 {
 955         struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
 956
 957         BT_DBG("%s", hdev->name);
 958
 959         hci_dev_close(hdev->id);
 960 }
 961
 962 static void hci_auto_off(unsigned long data)
 963 {
 964         struct hci_dev *hdev = (struct hci_dev *) data;
 965
 966         BT_DBG("%s", hdev->name);
 967
 968         clear_bit(HCI_AUTO_OFF, &hdev->flags);
 969
 970         queue_work(hdev->workqueue, &hdev->power_off);
 971 }
 972
 973 void hci_del_off_timer(struct hci_dev *hdev)
 974 {
 975         BT_DBG("%s", hdev->name);
 976
 977         clear_bit(HCI_AUTO_OFF, &hdev->flags);
 978         del_timer(&hdev->off_timer);
 979 }
 980
 981 int hci_uuids_clear(struct hci_dev *hdev)
 982 {
 983         struct list_head *p, *n;
 984
 985         list_for_each_safe(p, n, &hdev->uuids) {
 986                 struct bt_uuid *uuid;
 987
 988                 uuid = list_entry(p, struct bt_uuid, list);
 989
 990                 list_del(p);
 991                 kfree(uuid);
 992         }
 993
 994         return 0;
 995 }
 996
 997 int hci_link_keys_clear(struct hci_dev *hdev)
 998 {
 999         struct list_head *p, *n;
1000
1001         list_for_each_safe(p, n, &hdev->link_keys) {
1002                 struct link_key *key;
1003
1004                 key = list_entry(p, struct link_key, list);
1005
1006                 list_del(p);
1007                 kfree(key);
1008         }
1009
1010         return 0;
1011 }
1012
1013 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1014 {
1015         struct list_head *p;
1016
1017         list_for_each(p, &hdev->link_keys) {
1018                 struct link_key *k;
1019
1020                 k = list_entry(p, struct link_key, list);
1021
1022                 if (bacmp(bdaddr, &k->bdaddr) == 0)
1023                         return k;
1024         }
1025
1026         return NULL;
1027 }
1028
1029 static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1030                                                 u8 key_type, u8 old_key_type)
1031 {
1032         /* Legacy key */
1033         if (key_type < 0x03)
1034                 return 1;
1035
1036         /* Debug keys are insecure so don't store them persistently */
1037         if (key_type == HCI_LK_DEBUG_COMBINATION)
1038                 return 0;
1039
1040         /* Changed combination key and there's no previous one */
1041         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1042                 return 0;
1043
1044         /* Security mode 3 case */
1045         if (!conn)
1046                 return 1;
1047
1048         /* Neither local nor remote side had no-bonding as requirement */
1049         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1050                 return 1;
1051
1052         /* Local side had dedicated bonding as requirement */
1053         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1054                 return 1;
1055
1056         /* Remote side had dedicated bonding as requirement */
1057         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1058                 return 1;
1059
1060         /* If none of the above criteria match, then don't store the key
1061          * persistently */
1062         return 0;
1063 }
1064
1065 struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1066 {
1067         struct link_key *k;
1068
1069         list_for_each_entry(k, &hdev->link_keys, list) {
1070                 struct key_master_id *id;
1071
1072                 if (k->type != HCI_LK_SMP_LTK)
1073                         continue;
1074
1075                 if (k->dlen != sizeof(*id))
1076                         continue;
1077
1078                 id = (void *) &k->data;
1079                 if (id->ediv == ediv &&
1080                                 (memcmp(rand, id->rand, sizeof(id->rand)) == 0))
1081                         return k;
1082         }
1083
1084         return NULL;
1085 }
1086 EXPORT_SYMBOL(hci_find_ltk);
1087
1088 struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
1089                                         bdaddr_t *bdaddr, u8 type)
1090 {
1091         struct link_key *k;
1092
1093         list_for_each_entry(k, &hdev->link_keys, list)
1094                 if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
1095                         return k;
1096
1097         return NULL;
1098 }
1099 EXPORT_SYMBOL(hci_find_link_key_type);
1100
1101 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1102                                 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1103 {
1104         struct link_key *key, *old_key;
1105         u8 old_key_type, persistent;
1106
1107         old_key = hci_find_link_key(hdev, bdaddr);
1108         if (old_key) {
1109                 old_key_type = old_key->type;
1110                 key = old_key;
1111         } else {
1112                 old_key_type = conn ? conn->key_type : 0xff;
1113                 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1114                 if (!key)
1115                         return -ENOMEM;
1116                 list_add(&key->list, &hdev->link_keys);
1117         }
1118
1119         BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1120
1121         /* Some buggy controller combinations generate a changed
1122          * combination key for legacy pairing even when there's no
1123          * previous key */
1124         if (type == HCI_LK_CHANGED_COMBINATION &&
1125                                         (!conn || conn->remote_auth == 0xff) &&
1126                                         old_key_type == 0xff) {
1127                 type = HCI_LK_COMBINATION;
1128                 if (conn)
1129                         conn->key_type = type;
1130         }
1131
1132         bacpy(&key->bdaddr, bdaddr);
1133         memcpy(key->val, val, 16);
1134         key->pin_len = pin_len;
1135
1136         if (type == HCI_LK_CHANGED_COMBINATION)
1137                 key->type = old_key_type;
1138         else
1139                 key->type = type;
1140
1141         if (!new_key)
1142                 return 0;
1143
1144         persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1145
1146         mgmt_new_key(hdev->id, key, persistent);
1147
1148         if (!persistent) {
1149                 list_del(&key->list);
1150                 kfree(key);
1151         }
1152
1153         return 0;
1154 }
1155
1156 int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
1157                         u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
1158 {
1159         struct link_key *key, *old_key;
1160         struct key_master_id *id;
1161         u8 old_key_type;
1162
1163         BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
1164
1165         old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
1166         if (old_key) {
1167                 key = old_key;
1168                 old_key_type = old_key->type;
1169         } else {
1170                 key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
1171                 if (!key)
1172                         return -ENOMEM;
1173                 list_add(&key->list, &hdev->link_keys);
1174                 old_key_type = 0xff;
1175         }
1176
1177         key->dlen = sizeof(*id);
1178
1179         bacpy(&key->bdaddr, bdaddr);
1180         memcpy(key->val, ltk, sizeof(key->val));
1181         key->type = HCI_LK_SMP_LTK;
1182         key->pin_len = key_size;
1183
1184         id = (void *) &key->data;
1185         id->ediv = ediv;
1186         memcpy(id->rand, rand, sizeof(id->rand));
1187
1188         if (new_key)
1189                 mgmt_new_key(hdev->id, key, old_key_type);
1190
1191         return 0;
1192 }
1193
1194 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1195 {
1196         struct link_key *key;
1197
1198         key = hci_find_link_key(hdev, bdaddr);
1199         if (!key)
1200                 return -ENOENT;
1201
1202         BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1203
1204         list_del(&key->list);
1205         kfree(key);
1206
1207         return 0;
1208 }
1209
1210 /* HCI command timer function */
1211 static void hci_cmd_timer(unsigned long arg)
1212 {
1213         struct hci_dev *hdev = (void *) arg;
1214
1215         BT_ERR("%s command tx timeout", hdev->name);
1216         atomic_set(&hdev->cmd_cnt, 1);
1217         tasklet_schedule(&hdev->cmd_task);
1218 }
1219
1220 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1221                                                         bdaddr_t *bdaddr)
1222 {
1223         struct oob_data *data;
1224
1225         list_for_each_entry(data, &hdev->remote_oob_data, list)
1226                 if (bacmp(bdaddr, &data->bdaddr) == 0)
1227                         return data;
1228
1229         return NULL;
1230 }
1231
1232 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1233 {
1234         struct oob_data *data;
1235
1236         data = hci_find_remote_oob_data(hdev, bdaddr);
1237         if (!data)
1238                 return -ENOENT;
1239
1240         BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1241
1242         list_del(&data->list);
1243         kfree(data);
1244
1245         return 0;
1246 }
1247
1248 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1249 {
1250         struct oob_data *data, *n;
1251
1252         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1253                 list_del(&data->list);
1254                 kfree(data);
1255         }
1256
1257         return 0;
1258 }
1259
1260 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1261                                                                 u8 *randomizer)
1262 {
1263         struct oob_data *data;
1264
1265         data = hci_find_remote_oob_data(hdev, bdaddr);
1266
1267         if (!data) {
1268                 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1269                 if (!data)
1270                         return -ENOMEM;
1271
1272                 bacpy(&data->bdaddr, bdaddr);
1273                 list_add(&data->list, &hdev->remote_oob_data);
1274         }
1275
1276         memcpy(data->hash, hash, sizeof(data->hash));
1277         memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1278
1279         BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1280
1281         return 0;
1282 }
1283
1284 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1285                                                 bdaddr_t *bdaddr)
1286 {
1287         struct list_head *p;
1288
1289         list_for_each(p, &hdev->blacklist) {
1290                 struct bdaddr_list *b;
1291
1292                 b = list_entry(p, struct bdaddr_list, list);
1293
1294                 if (bacmp(bdaddr, &b->bdaddr) == 0)
1295                         return b;
1296         }
1297
1298         return NULL;
1299 }
1300
1301 int hci_blacklist_clear(struct hci_dev *hdev)
1302 {
1303         struct list_head *p, *n;
1304
1305         list_for_each_safe(p, n, &hdev->blacklist) {
1306                 struct bdaddr_list *b;
1307
1308                 b = list_entry(p, struct bdaddr_list, list);
1309
1310                 list_del(p);
1311                 kfree(b);
1312         }
1313
1314         return 0;
1315 }
1316
1317 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1318 {
1319         struct bdaddr_list *entry;
1320         int err;
1321
1322         if (bacmp(bdaddr, BDADDR_ANY) == 0)
1323                 return -EBADF;
1324
1325         hci_dev_lock_bh(hdev);
1326
1327         if (hci_blacklist_lookup(hdev, bdaddr)) {
1328                 err = -EEXIST;
1329                 goto err;
1330         }
1331
1332         entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1333         if (!entry) {
1334                 return -ENOMEM;
1335                 goto err;
1336         }
1337
1338         bacpy(&entry->bdaddr, bdaddr);
1339
1340         list_add(&entry->list, &hdev->blacklist);
1341
1342         err = 0;
1343
1344 err:
1345         hci_dev_unlock_bh(hdev);
1346         return err;
1347 }
1348
1349 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1350 {
1351         struct bdaddr_list *entry;
1352         int err = 0;
1353
1354         hci_dev_lock_bh(hdev);
1355
1356         if (bacmp(bdaddr, BDADDR_ANY) == 0) {
1357                 hci_blacklist_clear(hdev);
1358                 goto done;
1359         }
1360
1361         entry = hci_blacklist_lookup(hdev, bdaddr);
1362         if (!entry) {
1363                 err = -ENOENT;
1364                 goto done;
1365         }
1366
1367         list_del(&entry->list);
1368         kfree(entry);
1369
1370 done:
1371         hci_dev_unlock_bh(hdev);
1372         return err;
1373 }
1374
1375 static void hci_clear_adv_cache(unsigned long arg)
1376 {
1377         struct hci_dev *hdev = (void *) arg;
1378
1379         hci_dev_lock(hdev);
1380
1381         hci_adv_entries_clear(hdev);
1382
1383         hci_dev_unlock(hdev);
1384 }
1385
1386 int hci_adv_entries_clear(struct hci_dev *hdev)
1387 {
1388         struct adv_entry *entry, *tmp;
1389
1390         list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1391                 list_del(&entry->list);
1392                 kfree(entry);
1393         }
1394
1395         BT_DBG("%s adv cache cleared", hdev->name);
1396
1397         return 0;
1398 }
1399
1400 struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1401 {
1402         struct adv_entry *entry;
1403
1404         list_for_each_entry(entry, &hdev->adv_entries, list)
1405                 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1406                         return entry;
1407
1408         return NULL;
1409 }
1410
1411 static inline int is_connectable_adv(u8 evt_type)
1412 {
1413         if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1414                 return 1;
1415
1416         return 0;
1417 }
1418
1419 int hci_add_adv_entry(struct hci_dev *hdev,
1420                                         struct hci_ev_le_advertising_info *ev)
1421 {
1422         struct adv_entry *entry;
1423
1424         if (!is_connectable_adv(ev->evt_type))
1425                 return -EINVAL;
1426
1427         /* Only new entries should be added to adv_entries. So, if
1428          * bdaddr was found, don't add it. */
1429         if (hci_find_adv_entry(hdev, &ev->bdaddr))
1430                 return 0;
1431
1432         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1433         if (!entry)
1434                 return -ENOMEM;
1435
1436         bacpy(&entry->bdaddr, &ev->bdaddr);
1437         entry->bdaddr_type = ev->bdaddr_type;
1438
1439         list_add(&entry->list, &hdev->adv_entries);
1440
1441         BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1442                                 batostr(&entry->bdaddr), entry->bdaddr_type);
1443
1444         return 0;
1445 }
1446
1447 /* Register HCI device */
1448 int hci_register_dev(struct hci_dev *hdev)
1449 {
1450         struct list_head *head = &hci_dev_list, *p;
1451         int i, id = 0;
1452
1453         BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1454                                                 hdev->bus, hdev->owner);
1455
1456         if (!hdev->open || !hdev->close || !hdev->destruct)
1457                 return -EINVAL;
1458
1459         write_lock_bh(&hci_dev_list_lock);
1460
1461         /* Find first available device id */
1462         list_for_each(p, &hci_dev_list) {
1463                 if (list_entry(p, struct hci_dev, list)->id != id)
1464                         break;
1465                 head = p; id++;
1466         }
1467
1468         sprintf(hdev->name, "hci%d", id);
1469         hdev->id = id;
1470         list_add(&hdev->list, head);
1471
1472         atomic_set(&hdev->refcnt, 1);
1473         spin_lock_init(&hdev->lock);
1474
1475         hdev->flags = 0;
1476         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1477         hdev->esco_type = (ESCO_HV1);
1478         hdev->link_mode = (HCI_LM_ACCEPT);
1479         hdev->io_capability = 0x03; /* No Input No Output */
1480
1481         hdev->idle_timeout = 0;
1482         hdev->sniff_max_interval = 800;
1483         hdev->sniff_min_interval = 80;
1484
1485         tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1486         tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1487         tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1488
1489         skb_queue_head_init(&hdev->rx_q);
1490         skb_queue_head_init(&hdev->cmd_q);
1491         skb_queue_head_init(&hdev->raw_q);
1492
1493         setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1494
1495         for (i = 0; i < NUM_REASSEMBLY; i++)
1496                 hdev->reassembly[i] = NULL;
1497
1498         init_waitqueue_head(&hdev->req_wait_q);
1499         mutex_init(&hdev->req_lock);
1500
1501         inquiry_cache_init(hdev);
1502
1503         hci_conn_hash_init(hdev);
1504
1505         INIT_LIST_HEAD(&hdev->blacklist);
1506
1507         INIT_LIST_HEAD(&hdev->uuids);
1508
1509         INIT_LIST_HEAD(&hdev->link_keys);
1510
1511         INIT_LIST_HEAD(&hdev->remote_oob_data);
1512
1513         INIT_LIST_HEAD(&hdev->adv_entries);
1514         setup_timer(&hdev->adv_timer, hci_clear_adv_cache,
1515                                                 (unsigned long) hdev);
1516
1517         INIT_WORK(&hdev->power_on, hci_power_on);
1518         INIT_WORK(&hdev->power_off, hci_power_off);
1519         setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1520
1521         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1522
1523         atomic_set(&hdev->promisc, 0);
1524
1525         write_unlock_bh(&hci_dev_list_lock);
1526
1527         hdev->workqueue = create_singlethread_workqueue(hdev->name);
1528         if (!hdev->workqueue)
1529                 goto nomem;
1530
1531         hdev->tfm = crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1532         if (IS_ERR(hdev->tfm))
1533                 BT_INFO("Failed to load transform for ecb(aes): %ld",
1534                                                         PTR_ERR(hdev->tfm));
1535
1536         hci_register_sysfs(hdev);
1537
1538 #if !defined(CONFIG_MT6620)
1539         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1540                                 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1541         if (hdev->rfkill) {
1542                 if (rfkill_register(hdev->rfkill) < 0) {
1543                         rfkill_destroy(hdev->rfkill);
1544                         hdev->rfkill = NULL;
1545                 }
1546         }
1547
1548         set_bit(HCI_AUTO_OFF, &hdev->flags);
1549         set_bit(HCI_SETUP, &hdev->flags);
1550         queue_work(hdev->workqueue, &hdev->power_on);
1551 #endif
1552
1553         hci_notify(hdev, HCI_DEV_REG);
1554
1555         return id;
1556
1557 nomem:
1558         write_lock_bh(&hci_dev_list_lock);
1559         list_del(&hdev->list);
1560         write_unlock_bh(&hci_dev_list_lock);
1561
1562         return -ENOMEM;
1563 }
1564 EXPORT_SYMBOL(hci_register_dev);
1565
1566 /* Unregister HCI device */
1567 int hci_unregister_dev(struct hci_dev *hdev)
1568 {
1569         int i;
1570
1571         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1572
1573         set_bit(HCI_UNREGISTER, &hdev->flags);
1574
1575         write_lock_bh(&hci_dev_list_lock);
1576         list_del(&hdev->list);
1577         write_unlock_bh(&hci_dev_list_lock);
1578
1579         hci_dev_do_close(hdev);
1580
1581         for (i = 0; i < NUM_REASSEMBLY; i++)
1582                 kfree_skb(hdev->reassembly[i]);
1583
1584         if (!test_bit(HCI_INIT, &hdev->flags) &&
1585                                         !test_bit(HCI_SETUP, &hdev->flags))
1586                 mgmt_index_removed(hdev->id);
1587
1588         if (!IS_ERR(hdev->tfm))
1589                 crypto_free_blkcipher(hdev->tfm);
1590
1591         hci_notify(hdev, HCI_DEV_UNREG);
1592
1593         if (hdev->rfkill) {
1594                 rfkill_unregister(hdev->rfkill);
1595                 rfkill_destroy(hdev->rfkill);
1596         }
1597
1598         hci_unregister_sysfs(hdev);
1599
1600         hci_del_off_timer(hdev);
1601         del_timer(&hdev->adv_timer);
1602
1603         destroy_workqueue(hdev->workqueue);
1604
1605         hci_dev_lock_bh(hdev);
1606         hci_blacklist_clear(hdev);
1607         hci_uuids_clear(hdev);
1608         hci_link_keys_clear(hdev);
1609         hci_remote_oob_data_clear(hdev);
1610         hci_adv_entries_clear(hdev);
1611         hci_dev_unlock_bh(hdev);
1612
1613         __hci_dev_put(hdev);
1614
1615         return 0;
1616 }
1617 EXPORT_SYMBOL(hci_unregister_dev);
1618
1619 /* Suspend HCI device */
1620 int hci_suspend_dev(struct hci_dev *hdev)
1621 {
1622         hci_notify(hdev, HCI_DEV_SUSPEND);
1623         return 0;
1624 }
1625 EXPORT_SYMBOL(hci_suspend_dev);
1626
1627 /* Resume HCI device */
1628 int hci_resume_dev(struct hci_dev *hdev)
1629 {
1630         hci_notify(hdev, HCI_DEV_RESUME);
1631         return 0;
1632 }
1633 EXPORT_SYMBOL(hci_resume_dev);
1634
1635 /* Receive frame from HCI drivers */
1636 int hci_recv_frame(struct sk_buff *skb)
1637 {
1638         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1639         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1640                                 && !test_bit(HCI_INIT, &hdev->flags))) {
1641                 kfree_skb(skb);
1642                 return -ENXIO;
1643         }
1644
1645         /* Incomming skb */
1646         bt_cb(skb)->incoming = 1;
1647
1648         /* Time stamp */
1649         __net_timestamp(skb);
1650
1651         /* Queue frame for rx task */
1652         skb_queue_tail(&hdev->rx_q, skb);
1653         tasklet_schedule(&hdev->rx_task);
1654
1655         return 0;
1656 }
1657 EXPORT_SYMBOL(hci_recv_frame);
1658
1659 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1660                                                   int count, __u8 index)
1661 {
1662         int len = 0;
1663         int hlen = 0;
1664         int remain = count;
1665         struct sk_buff *skb;
1666         struct bt_skb_cb *scb;
1667
1668         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1669                                 index >= NUM_REASSEMBLY)
1670                 return -EILSEQ;
1671
1672         skb = hdev->reassembly[index];
1673
1674         if (!skb) {
1675                 switch (type) {
1676                 case HCI_ACLDATA_PKT:
1677                         len = HCI_MAX_FRAME_SIZE;
1678                         hlen = HCI_ACL_HDR_SIZE;
1679                         break;
1680                 case HCI_EVENT_PKT:
1681                         len = HCI_MAX_EVENT_SIZE;
1682                         hlen = HCI_EVENT_HDR_SIZE;
1683                         break;
1684                 case HCI_SCODATA_PKT:
1685                         len = HCI_MAX_SCO_SIZE;
1686                         hlen = HCI_SCO_HDR_SIZE;
1687                         break;
1688                 }
1689
1690                 skb = bt_skb_alloc(len, GFP_ATOMIC);
1691                 if (!skb)
1692                         return -ENOMEM;
1693
1694                 scb = (void *) skb->cb;
1695                 scb->expect = hlen;
1696                 scb->pkt_type = type;
1697
1698                 skb->dev = (void *) hdev;
1699                 hdev->reassembly[index] = skb;
1700         }
1701
1702         while (count) {
1703                 scb = (void *) skb->cb;
1704                 len = min(scb->expect, (__u16)count);
1705
1706                 memcpy(skb_put(skb, len), data, len);
1707
1708                 count -= len;
1709                 data += len;
1710                 scb->expect -= len;
1711                 remain = count;
1712
1713                 switch (type) {
1714                 case HCI_EVENT_PKT:
1715                         if (skb->len == HCI_EVENT_HDR_SIZE) {
1716                                 struct hci_event_hdr *h = hci_event_hdr(skb);
1717                                 scb->expect = h->plen;
1718
1719                                 if (skb_tailroom(skb) < scb->expect) {
1720                                         kfree_skb(skb);
1721                                         hdev->reassembly[index] = NULL;
1722                                         return -ENOMEM;
1723                                 }
1724                         }
1725                         break;
1726
1727                 case HCI_ACLDATA_PKT:
1728                         if (skb->len  == HCI_ACL_HDR_SIZE) {
1729                                 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1730                                 scb->expect = __le16_to_cpu(h->dlen);
1731
1732                                 if (skb_tailroom(skb) < scb->expect) {
1733                                         kfree_skb(skb);
1734                                         hdev->reassembly[index] = NULL;
1735                                         return -ENOMEM;
1736                                 }
1737                         }
1738                         break;
1739
1740                 case HCI_SCODATA_PKT:
1741                         if (skb->len == HCI_SCO_HDR_SIZE) {
1742                                 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1743                                 scb->expect = h->dlen;
1744
1745                                 if (skb_tailroom(skb) < scb->expect) {
1746                                         kfree_skb(skb);
1747                                         hdev->reassembly[index] = NULL;
1748                                         return -ENOMEM;
1749                                 }
1750                         }
1751                         break;
1752                 }
1753
1754                 if (scb->expect == 0) {
1755                         /* Complete frame */
1756
1757                         bt_cb(skb)->pkt_type = type;
1758                         hci_recv_frame(skb);
1759
1760                         hdev->reassembly[index] = NULL;
1761                         return remain;
1762                 }
1763         }
1764
1765         return remain;
1766 }
1767
1768 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1769 {
1770         int rem = 0;
1771
1772         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1773                 return -EILSEQ;
1774
1775         while (count) {
1776                 rem = hci_reassembly(hdev, type, data, count, type - 1);
1777                 if (rem < 0)
1778                         return rem;
1779
1780                 data += (count - rem);
1781                 count = rem;
1782         };
1783
1784         return rem;
1785 }
1786 EXPORT_SYMBOL(hci_recv_fragment);
1787
1788 #define STREAM_REASSEMBLY 0
1789
1790 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1791 {
1792         int type;
1793         int rem = 0;
1794
1795         while (count) {
1796                 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1797
1798                 if (!skb) {
1799                         struct { char type; } *pkt;
1800
1801                         /* Start of the frame */
1802                         pkt = data;
1803                         type = pkt->type;
1804
1805                         data++;
1806                         count--;
1807                 } else
1808                         type = bt_cb(skb)->pkt_type;
1809
1810                 rem = hci_reassembly(hdev, type, data, count,
1811                                                         STREAM_REASSEMBLY);
1812                 if (rem < 0)
1813                         return rem;
1814
1815                 data += (count - rem);
1816                 count = rem;
1817         };
1818
1819         return rem;
1820 }
1821 EXPORT_SYMBOL(hci_recv_stream_fragment);
1822
1823 /* ---- Interface to upper protocols ---- */
1824
1825 /* Register/Unregister protocols.
1826  * hci_task_lock is used to ensure that no tasks are running. */
1827 int hci_register_proto(struct hci_proto *hp)
1828 {
1829         int err = 0;
1830
1831         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1832
1833         if (hp->id >= HCI_MAX_PROTO)
1834                 return -EINVAL;
1835
1836         write_lock_bh(&hci_task_lock);
1837
1838         if (!hci_proto[hp->id])
1839                 hci_proto[hp->id] = hp;
1840         else
1841                 err = -EEXIST;
1842
1843         write_unlock_bh(&hci_task_lock);
1844
1845         return err;
1846 }
1847 EXPORT_SYMBOL(hci_register_proto);
1848
1849 int hci_unregister_proto(struct hci_proto *hp)
1850 {
1851         int err = 0;
1852
1853         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1854
1855         if (hp->id >= HCI_MAX_PROTO)
1856                 return -EINVAL;
1857
1858         write_lock_bh(&hci_task_lock);
1859
1860         if (hci_proto[hp->id])
1861                 hci_proto[hp->id] = NULL;
1862         else
1863                 err = -ENOENT;
1864
1865         write_unlock_bh(&hci_task_lock);
1866
1867         return err;
1868 }
1869 EXPORT_SYMBOL(hci_unregister_proto);
1870
1871 int hci_register_cb(struct hci_cb *cb)
1872 {
1873         BT_DBG("%p name %s", cb, cb->name);
1874
1875         write_lock_bh(&hci_cb_list_lock);
1876         list_add(&cb->list, &hci_cb_list);
1877         write_unlock_bh(&hci_cb_list_lock);
1878
1879         return 0;
1880 }
1881 EXPORT_SYMBOL(hci_register_cb);
1882
1883 int hci_unregister_cb(struct hci_cb *cb)
1884 {
1885         BT_DBG("%p name %s", cb, cb->name);
1886
1887         write_lock_bh(&hci_cb_list_lock);
1888         list_del(&cb->list);
1889         write_unlock_bh(&hci_cb_list_lock);
1890
1891         return 0;
1892 }
1893 EXPORT_SYMBOL(hci_unregister_cb);
1894
1895 static int hci_send_frame(struct sk_buff *skb)
1896 {
1897         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1898
1899         if (!hdev) {
1900                 kfree_skb(skb);
1901                 return -ENODEV;
1902         }
1903
1904         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1905
1906         if (atomic_read(&hdev->promisc)) {
1907                 /* Time stamp */
1908                 __net_timestamp(skb);
1909
1910                 hci_send_to_sock(hdev, skb, NULL);
1911         }
1912
1913         /* Get rid of skb owner, prior to sending to the driver. */
1914         skb_orphan(skb);
1915
1916         return hdev->send(skb);
1917 }
1918
1919 /* Send HCI command */
1920 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1921 {
1922         int len = HCI_COMMAND_HDR_SIZE + plen;
1923         struct hci_command_hdr *hdr;
1924         struct sk_buff *skb;
1925
1926         BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1927
1928         skb = bt_skb_alloc(len, GFP_ATOMIC);
1929         if (!skb) {
1930                 BT_ERR("%s no memory for command", hdev->name);
1931                 return -ENOMEM;
1932         }
1933
1934         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1935         hdr->opcode = cpu_to_le16(opcode);
1936         hdr->plen   = plen;
1937
1938         if (plen)
1939                 memcpy(skb_put(skb, plen), param, plen);
1940
1941         BT_DBG("skb len %d", skb->len);
1942
1943         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1944         skb->dev = (void *) hdev;
1945
1946         if (test_bit(HCI_INIT, &hdev->flags))
1947                 hdev->init_last_cmd = opcode;
1948
1949         skb_queue_tail(&hdev->cmd_q, skb);
1950         tasklet_schedule(&hdev->cmd_task);
1951
1952         return 0;
1953 }
1954
1955 /* Get data from the previously sent command */
1956 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1957 {
1958         struct hci_command_hdr *hdr;
1959
1960         if (!hdev->sent_cmd)
1961                 return NULL;
1962
1963         hdr = (void *) hdev->sent_cmd->data;
1964
1965         if (hdr->opcode != cpu_to_le16(opcode))
1966                 return NULL;
1967
1968         BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1969
1970         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1971 }
1972
1973 /* Send ACL data */
1974 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1975 {
1976         struct hci_acl_hdr *hdr;
1977         int len = skb->len;
1978
1979         skb_push(skb, HCI_ACL_HDR_SIZE);
1980         skb_reset_transport_header(skb);
1981         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
1982         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1983         hdr->dlen   = cpu_to_le16(len);
1984 }
1985
1986 void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1987 {
1988         struct hci_dev *hdev = conn->hdev;
1989         struct sk_buff *list;
1990
1991         BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1992
1993         skb->dev = (void *) hdev;
1994         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1995         hci_add_acl_hdr(skb, conn->handle, flags);
1996
1997         list = skb_shinfo(skb)->frag_list;
1998         if (!list) {
1999                 /* Non fragmented */
2000                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2001
2002                 skb_queue_tail(&conn->data_q, skb);
2003         } else {
2004                 /* Fragmented */
2005                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2006
2007                 skb_shinfo(skb)->frag_list = NULL;
2008
2009                 /* Queue all fragments atomically */
2010                 spin_lock_bh(&conn->data_q.lock);
2011
2012                 __skb_queue_tail(&conn->data_q, skb);
2013
2014                 flags &= ~ACL_START;
2015                 flags |= ACL_CONT;
2016                 do {
2017                         skb = list; list = list->next;
2018
2019                         skb->dev = (void *) hdev;
2020                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2021                         hci_add_acl_hdr(skb, conn->handle, flags);
2022
2023                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2024
2025                         __skb_queue_tail(&conn->data_q, skb);
2026                 } while (list);
2027
2028                 spin_unlock_bh(&conn->data_q.lock);
2029         }
2030
2031         tasklet_schedule(&hdev->tx_task);
2032 }
2033 EXPORT_SYMBOL(hci_send_acl);
2034
2035 /* Send SCO data */
2036 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2037 {
2038         struct hci_dev *hdev = conn->hdev;
2039         struct hci_sco_hdr hdr;
2040
2041         BT_DBG("%s len %d", hdev->name, skb->len);
2042
2043         hdr.handle = cpu_to_le16(conn->handle);
2044         hdr.dlen   = skb->len;
2045
2046         skb_push(skb, HCI_SCO_HDR_SIZE);
2047         skb_reset_transport_header(skb);
2048         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2049
2050         skb->dev = (void *) hdev;
2051         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2052
2053         skb_queue_tail(&conn->data_q, skb);
2054         tasklet_schedule(&hdev->tx_task);
2055 }
2056 EXPORT_SYMBOL(hci_send_sco);
2057
2058 /* ---- HCI TX task (outgoing data) ---- */
2059
2060 /* HCI Connection scheduler */
2061 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2062 {
2063         struct hci_conn_hash *h = &hdev->conn_hash;
2064         struct hci_conn *conn = NULL;
2065         int num = 0, min = ~0;
2066         struct list_head *p;
2067
2068         /* We don't have to lock device here. Connections are always
2069          * added and removed with TX task disabled. */
2070         list_for_each(p, &h->list) {
2071                 struct hci_conn *c;
2072                 c = list_entry(p, struct hci_conn, list);
2073
2074                 if (c->type != type || skb_queue_empty(&c->data_q))
2075                         continue;
2076
2077                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2078                         continue;
2079
2080                 num++;
2081
2082                 if (c->sent < min) {
2083                         min  = c->sent;
2084                         conn = c;
2085                 }
2086         }
2087
2088         if (conn) {
2089                 int cnt, q;
2090
2091                 switch (conn->type) {
2092                 case ACL_LINK:
2093                         cnt = hdev->acl_cnt;
2094                         break;
2095                 case SCO_LINK:
2096                 case ESCO_LINK:
2097                         cnt = hdev->sco_cnt;
2098                         break;
2099                 case LE_LINK:
2100                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2101                         break;
2102                 default:
2103                         cnt = 0;
2104                         BT_ERR("Unknown link type");
2105                 }
2106
2107                 q = cnt / num;
2108                 *quote = q ? q : 1;
2109         } else
2110                 *quote = 0;
2111
2112         BT_DBG("conn %p quote %d", conn, *quote);
2113         return conn;
2114 }
2115
2116 static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2117 {
2118         struct hci_conn_hash *h = &hdev->conn_hash;
2119         struct list_head *p;
2120         struct hci_conn  *c;
2121
2122         BT_ERR("%s link tx timeout", hdev->name);
2123
2124         /* Kill stalled connections */
2125         list_for_each(p, &h->list) {
2126                 c = list_entry(p, struct hci_conn, list);
2127                 if (c->type == type && c->sent) {
2128                         BT_ERR("%s killing stalled connection %s",
2129                                 hdev->name, batostr(&c->dst));
2130                         hci_acl_disconn(c, 0x13);
2131                 }
2132         }
2133 }
2134
2135 static inline void hci_sched_acl(struct hci_dev *hdev)
2136 {
2137         struct hci_conn *conn;
2138         struct sk_buff *skb;
2139         int quote;
2140
2141         BT_DBG("%s", hdev->name);
2142
2143         if (!test_bit(HCI_RAW, &hdev->flags)) {
2144                 /* ACL tx timeout must be longer than maximum
2145                  * link supervision timeout (40.9 seconds) */
2146                 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
2147                         hci_link_tx_to(hdev, ACL_LINK);
2148         }
2149
2150         while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
2151                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2152                         BT_DBG("skb %p len %d", skb, skb->len);
2153
2154                         hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
2155
2156                         hci_send_frame(skb);
2157                         hdev->acl_last_tx = jiffies;
2158
2159                         hdev->acl_cnt--;
2160                         conn->sent++;
2161                 }
2162         }
2163 }
2164
2165 /* Schedule SCO */
2166 static inline void hci_sched_sco(struct hci_dev *hdev)
2167 {
2168         struct hci_conn *conn;
2169         struct sk_buff *skb;
2170         int quote;
2171
2172         BT_DBG("%s", hdev->name);
2173
2174         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2175                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2176                         BT_DBG("skb %p len %d", skb, skb->len);
2177                         hci_send_frame(skb);
2178
2179                         conn->sent++;
2180                         if (conn->sent == ~0)
2181                                 conn->sent = 0;
2182                 }
2183         }
2184 }
2185
2186 static inline void hci_sched_esco(struct hci_dev *hdev)
2187 {
2188         struct hci_conn *conn;
2189         struct sk_buff *skb;
2190         int quote;
2191
2192         BT_DBG("%s", hdev->name);
2193
2194         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2195                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2196                         BT_DBG("skb %p len %d", skb, skb->len);
2197                         hci_send_frame(skb);
2198
2199                         conn->sent++;
2200                         if (conn->sent == ~0)
2201                                 conn->sent = 0;
2202                 }
2203         }
2204 }
2205
2206 static inline void hci_sched_le(struct hci_dev *hdev)
2207 {
2208         struct hci_conn *conn;
2209         struct sk_buff *skb;
2210         int quote, cnt;
2211
2212         BT_DBG("%s", hdev->name);
2213
2214         if (!test_bit(HCI_RAW, &hdev->flags)) {
2215                 /* LE tx timeout must be longer than maximum
2216                  * link supervision timeout (40.9 seconds) */
2217                 if (!hdev->le_cnt && hdev->le_pkts &&
2218                                 time_after(jiffies, hdev->le_last_tx + HZ * 45))
2219                         hci_link_tx_to(hdev, LE_LINK);
2220         }
2221
2222         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2223         while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
2224                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2225                         BT_DBG("skb %p len %d", skb, skb->len);
2226
2227                         hci_send_frame(skb);
2228                         hdev->le_last_tx = jiffies;
2229
2230                         cnt--;
2231                         conn->sent++;
2232                 }
2233         }
2234         if (hdev->le_pkts)
2235                 hdev->le_cnt = cnt;
2236         else
2237                 hdev->acl_cnt = cnt;
2238 }
2239
2240 static void hci_tx_task(unsigned long arg)
2241 {
2242         struct hci_dev *hdev = (struct hci_dev *) arg;
2243         struct sk_buff *skb;
2244
2245         read_lock(&hci_task_lock);
2246
2247         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2248                 hdev->sco_cnt, hdev->le_cnt);
2249
2250         /* Schedule queues and send stuff to HCI driver */
2251
2252         hci_sched_acl(hdev);
2253
2254         hci_sched_sco(hdev);
2255
2256         hci_sched_esco(hdev);
2257
2258         hci_sched_le(hdev);
2259
2260         /* Send next queued raw (unknown type) packet */
2261         while ((skb = skb_dequeue(&hdev->raw_q)))
2262                 hci_send_frame(skb);
2263
2264         read_unlock(&hci_task_lock);
2265 }
2266
2267 /* ----- HCI RX task (incoming data processing) ----- */
2268
2269 /* ACL data packet */
2270 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2271 {
2272         struct hci_acl_hdr *hdr = (void *) skb->data;
2273         struct hci_conn *conn;
2274         __u16 handle, flags;
2275
2276         skb_pull(skb, HCI_ACL_HDR_SIZE);
2277
2278         handle = __le16_to_cpu(hdr->handle);
2279         flags  = hci_flags(handle);
2280         handle = hci_handle(handle);
2281
2282         BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2283
2284         hdev->stat.acl_rx++;
2285
2286         hci_dev_lock(hdev);
2287         conn = hci_conn_hash_lookup_handle(hdev, handle);
2288         hci_dev_unlock(hdev);
2289
2290         if (conn) {
2291                 register struct hci_proto *hp;
2292
2293                 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
2294
2295                 /* Send to upper protocol */
2296                 hp = hci_proto[HCI_PROTO_L2CAP];
2297                 if (hp && hp->recv_acldata) {
2298                         hp->recv_acldata(conn, skb, flags);
2299                         return;
2300                 }
2301         } else {
2302                 BT_ERR("%s ACL packet for unknown connection handle %d",
2303                         hdev->name, handle);
2304         }
2305
2306         kfree_skb(skb);
2307 }
2308
2309 /* SCO data packet */
2310 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2311 {
2312         struct hci_sco_hdr *hdr = (void *) skb->data;
2313         struct hci_conn *conn;
2314         __u16 handle;
2315
2316         skb_pull(skb, HCI_SCO_HDR_SIZE);
2317
2318         handle = __le16_to_cpu(hdr->handle);
2319
2320         BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2321
2322         hdev->stat.sco_rx++;
2323
2324         hci_dev_lock(hdev);
2325         conn = hci_conn_hash_lookup_handle(hdev, handle);
2326         hci_dev_unlock(hdev);
2327
2328         if (conn) {
2329                 register struct hci_proto *hp;
2330
2331                 /* Send to upper protocol */
2332                 hp = hci_proto[HCI_PROTO_SCO];
2333                 if (hp && hp->recv_scodata) {
2334                         hp->recv_scodata(conn, skb);
2335                         return;
2336                 }
2337         } else {
2338                 BT_ERR("%s SCO packet for unknown connection handle %d",
2339                         hdev->name, handle);
2340         }
2341
2342         kfree_skb(skb);
2343 }
2344
2345 static void hci_rx_task(unsigned long arg)
2346 {
2347         struct hci_dev *hdev = (struct hci_dev *) arg;
2348         struct sk_buff *skb;
2349
2350         BT_DBG("%s", hdev->name);
2351
2352         read_lock(&hci_task_lock);
2353
2354         while ((skb = skb_dequeue(&hdev->rx_q))) {
2355                 if (atomic_read(&hdev->promisc)) {
2356                         /* Send copy to the sockets */
2357                         hci_send_to_sock(hdev, skb, NULL);
2358                 }
2359
2360                 if (test_bit(HCI_RAW, &hdev->flags)) {
2361                         kfree_skb(skb);
2362                         continue;
2363                 }
2364
2365                 if (test_bit(HCI_INIT, &hdev->flags)) {
2366                         /* Don't process data packets in this states. */
2367                         switch (bt_cb(skb)->pkt_type) {
2368                         case HCI_ACLDATA_PKT:
2369                         case HCI_SCODATA_PKT:
2370                                 kfree_skb(skb);
2371                                 continue;
2372                         }
2373                 }
2374
2375                 /* Process frame */
2376                 switch (bt_cb(skb)->pkt_type) {
2377                 case HCI_EVENT_PKT:
2378                         hci_event_packet(hdev, skb);
2379                         break;
2380
2381                 case HCI_ACLDATA_PKT:
2382                         BT_DBG("%s ACL data packet", hdev->name);
2383                         hci_acldata_packet(hdev, skb);
2384                         break;
2385
2386                 case HCI_SCODATA_PKT:
2387                         BT_DBG("%s SCO data packet", hdev->name);
2388                         hci_scodata_packet(hdev, skb);
2389                         break;
2390
2391                 default:
2392                         kfree_skb(skb);
2393                         break;
2394                 }
2395         }
2396
2397         read_unlock(&hci_task_lock);
2398 }
2399
2400 static void hci_cmd_task(unsigned long arg)
2401 {
2402         struct hci_dev *hdev = (struct hci_dev *) arg;
2403         struct sk_buff *skb;
2404
2405         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2406
2407         /* Send queued commands */
2408         if (atomic_read(&hdev->cmd_cnt)) {
2409                 skb = skb_dequeue(&hdev->cmd_q);
2410                 if (!skb)
2411                         return;
2412
2413                 kfree_skb(hdev->sent_cmd);
2414
2415                 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2416                 if (hdev->sent_cmd) {
2417                         atomic_dec(&hdev->cmd_cnt);
2418                         hci_send_frame(skb);
2419                         if (test_bit(HCI_RESET, &hdev->flags))
2420                                 del_timer(&hdev->cmd_timer);
2421                         else
2422                                 mod_timer(&hdev->cmd_timer,
2423                                   jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2424                 } else {
2425                         skb_queue_head(&hdev->cmd_q, skb);
2426                         tasklet_schedule(&hdev->cmd_task);
2427                 }
2428         }
2429 }