hci_core.c 61.9 KB
Newer Older
1
/*
L
Linus Torvalds 已提交
2 3
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated
4
   Copyright (C) 2011 ProFUSION Embedded Systems
L
Linus Torvalds 已提交
5 6 7 8 9 10 11 12 13 14 15

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 17 18
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
L
Linus Torvalds 已提交
19 20
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

21 22
   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
L
Linus Torvalds 已提交
23 24 25 26 27
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI core. */

28
#include <linux/export.h>
29
#include <linux/idr.h>
L
Linus Torvalds 已提交
30

31
#include <linux/rfkill.h>
L
Linus Torvalds 已提交
32 33 34 35

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>

36
static void hci_rx_work(struct work_struct *work);
37
static void hci_cmd_work(struct work_struct *work);
38
static void hci_tx_work(struct work_struct *work);
L
Linus Torvalds 已提交
39 40 41 42 43 44 45 46 47

/* HCI device list */
LIST_HEAD(hci_dev_list);
DEFINE_RWLOCK(hci_dev_list_lock);

/* HCI callback list */
LIST_HEAD(hci_cb_list);
DEFINE_RWLOCK(hci_cb_list_lock);

48 49 50
/* HCI ID Numbering */
static DEFINE_IDA(hci_index_ida);

L
Linus Torvalds 已提交
51 52
/* ---- HCI notifications ---- */

53
static void hci_notify(struct hci_dev *hdev, int event)
L
Linus Torvalds 已提交
54
{
55
	hci_sock_dev_event(hdev, event);
L
Linus Torvalds 已提交
56 57 58 59
}

/* ---- HCI requests ---- */

60
void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
L
Linus Torvalds 已提交
61
{
62
	BT_DBG("%s command 0x%4.4x result 0x%2.2x", hdev->name, cmd, result);
63

64 65 66
	/* If this is the init phase check if the completed command matches
	 * the last init command, and if not just return.
	 */
67 68
	if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd) {
		struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
69
		u16 opcode = __le16_to_cpu(sent->opcode);
70 71 72 73 74 75 76 77 78
		struct sk_buff *skb;

		/* Some CSR based controllers generate a spontaneous
		 * reset complete event during init and any pending
		 * command will never be completed. In such a case we
		 * need to resend whatever was the last sent
		 * command.
		 */

79
		if (cmd != HCI_OP_RESET || opcode == HCI_OP_RESET)
80 81 82 83 84 85 86 87
			return;

		skb = skb_clone(hdev->sent_cmd, GFP_ATOMIC);
		if (skb) {
			skb_queue_head(&hdev->cmd_q, skb);
			queue_work(hdev->workqueue, &hdev->cmd_work);
		}

88
		return;
89
	}
L
Linus Torvalds 已提交
90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109

	if (hdev->req_status == HCI_REQ_PEND) {
		hdev->req_result = result;
		hdev->req_status = HCI_REQ_DONE;
		wake_up_interruptible(&hdev->req_wait_q);
	}
}

static void hci_req_cancel(struct hci_dev *hdev, int err)
{
	BT_DBG("%s err 0x%2.2x", hdev->name, err);

	if (hdev->req_status == HCI_REQ_PEND) {
		hdev->req_result = err;
		hdev->req_status = HCI_REQ_CANCELED;
		wake_up_interruptible(&hdev->req_wait_q);
	}
}

/* Execute request and wait for completion. */
110 111 112
static int __hci_request(struct hci_dev *hdev,
			 void (*req)(struct hci_dev *hdev, unsigned long opt),
			 unsigned long opt, __u32 timeout)
L
Linus Torvalds 已提交
113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131 132 133
{
	DECLARE_WAITQUEUE(wait, current);
	int err = 0;

	BT_DBG("%s start", hdev->name);

	hdev->req_status = HCI_REQ_PEND;

	add_wait_queue(&hdev->req_wait_q, &wait);
	set_current_state(TASK_INTERRUPTIBLE);

	req(hdev, opt);
	schedule_timeout(timeout);

	remove_wait_queue(&hdev->req_wait_q, &wait);

	if (signal_pending(current))
		return -EINTR;

	switch (hdev->req_status) {
	case HCI_REQ_DONE:
134
		err = -bt_to_errno(hdev->req_result);
L
Linus Torvalds 已提交
135 136 137 138 139 140 141 142 143
		break;

	case HCI_REQ_CANCELED:
		err = -hdev->req_result;
		break;

	default:
		err = -ETIMEDOUT;
		break;
144
	}
L
Linus Torvalds 已提交
145

146
	hdev->req_status = hdev->req_result = 0;
L
Linus Torvalds 已提交
147 148 149 150 151 152

	BT_DBG("%s end: err %d", hdev->name, err);

	return err;
}

153 154 155
static int hci_request(struct hci_dev *hdev,
		       void (*req)(struct hci_dev *hdev, unsigned long opt),
		       unsigned long opt, __u32 timeout)
L
Linus Torvalds 已提交
156 157 158
{
	int ret;

159 160 161
	if (!test_bit(HCI_UP, &hdev->flags))
		return -ENETDOWN;

L
Linus Torvalds 已提交
162 163 164 165 166 167 168 169 170 171 172 173 174
	/* Serialize all requests */
	hci_req_lock(hdev);
	ret = __hci_request(hdev, req, opt, timeout);
	hci_req_unlock(hdev);

	return ret;
}

static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
{
	BT_DBG("%s %ld", hdev->name, opt);

	/* Reset device */
175
	set_bit(HCI_RESET, &hdev->flags);
176
	hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
L
Linus Torvalds 已提交
177 178
}

179
static void bredr_init(struct hci_dev *hdev)
L
Linus Torvalds 已提交
180
{
181 182
	hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;

L
Linus Torvalds 已提交
183
	/* Read Local Supported Features */
184
	hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
L
Linus Torvalds 已提交
185

186
	/* Read Local Version */
187
	hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
L
Linus Torvalds 已提交
188 189
}

190 191
static void amp_init(struct hci_dev *hdev)
{
192 193
	hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;

194 195
	/* Read Local Version */
	hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
196 197 198

	/* Read Local AMP Info */
	hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
199 200 201

	/* Read Data Blk size */
	hci_send_cmd(hdev, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
202 203 204 205 206 207 208 209 210 211 212 213 214 215 216 217 218 219 220 221
}

static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
{
	struct sk_buff *skb;

	BT_DBG("%s %ld", hdev->name, opt);

	/* Driver initialization */

	/* Special commands */
	while ((skb = skb_dequeue(&hdev->driver_init))) {
		bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
		skb->dev = (void *) hdev;

		skb_queue_tail(&hdev->cmd_q, skb);
		queue_work(hdev->workqueue, &hdev->cmd_work);
	}
	skb_queue_purge(&hdev->driver_init);

222 223 224 225
	/* Reset */
	if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
		hci_reset_req(hdev, 0);

226 227 228 229 230 231 232 233 234 235 236 237 238 239 240
	switch (hdev->dev_type) {
	case HCI_BREDR:
		bredr_init(hdev);
		break;

	case HCI_AMP:
		amp_init(hdev);
		break;

	default:
		BT_ERR("Unknown device type %d", hdev->dev_type);
		break;
	}
}

L
Linus Torvalds 已提交
241 242 243 244 245 246 247
static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
{
	__u8 scan = opt;

	BT_DBG("%s %x", hdev->name, scan);

	/* Inquiry and Page scans */
248
	hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
L
Linus Torvalds 已提交
249 250 251 252 253 254 255 256 257
}

static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
{
	__u8 auth = opt;

	BT_DBG("%s %x", hdev->name, auth);

	/* Authentication */
258
	hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
L
Linus Torvalds 已提交
259 260 261 262 263 264 265 266
}

static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
{
	__u8 encrypt = opt;

	BT_DBG("%s %x", hdev->name, encrypt);

267
	/* Encryption */
268
	hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
L
Linus Torvalds 已提交
269 270
}

271 272 273 274
static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
{
	__le16 policy = cpu_to_le16(opt);

275
	BT_DBG("%s %x", hdev->name, policy);
276 277 278 279 280

	/* Default link policy */
	hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
}

281
/* Get HCI device by index.
L
Linus Torvalds 已提交
282 283 284
 * Device is held on return. */
struct hci_dev *hci_dev_get(int index)
{
285
	struct hci_dev *hdev = NULL, *d;
L
Linus Torvalds 已提交
286 287 288 289 290 291 292

	BT_DBG("%d", index);

	if (index < 0)
		return NULL;

	read_lock(&hci_dev_list_lock);
293
	list_for_each_entry(d, &hci_dev_list, list) {
L
Linus Torvalds 已提交
294 295 296 297 298 299 300 301 302 303
		if (d->id == index) {
			hdev = hci_dev_hold(d);
			break;
		}
	}
	read_unlock(&hci_dev_list_lock);
	return hdev;
}

/* ---- Inquiry support ---- */
304

305 306 307 308
bool hci_discovery_active(struct hci_dev *hdev)
{
	struct discovery_state *discov = &hdev->discovery;

A
Andre Guedes 已提交
309
	switch (discov->state) {
310
	case DISCOVERY_FINDING:
A
Andre Guedes 已提交
311
	case DISCOVERY_RESOLVING:
312 313
		return true;

A
Andre Guedes 已提交
314 315 316
	default:
		return false;
	}
317 318
}

319 320 321 322 323 324 325 326 327
void hci_discovery_set_state(struct hci_dev *hdev, int state)
{
	BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);

	if (hdev->discovery.state == state)
		return;

	switch (state) {
	case DISCOVERY_STOPPED:
328 329
		if (hdev->discovery.state != DISCOVERY_STARTING)
			mgmt_discovering(hdev, 0);
330 331 332
		break;
	case DISCOVERY_STARTING:
		break;
333
	case DISCOVERY_FINDING:
334 335
		mgmt_discovering(hdev, 1);
		break;
336 337
	case DISCOVERY_RESOLVING:
		break;
338 339 340 341 342 343 344
	case DISCOVERY_STOPPING:
		break;
	}

	hdev->discovery.state = state;
}

L
Linus Torvalds 已提交
345 346
static void inquiry_cache_flush(struct hci_dev *hdev)
{
347
	struct discovery_state *cache = &hdev->discovery;
348
	struct inquiry_entry *p, *n;
L
Linus Torvalds 已提交
349

350 351
	list_for_each_entry_safe(p, n, &cache->all, all) {
		list_del(&p->all);
352
		kfree(p);
L
Linus Torvalds 已提交
353
	}
354 355 356

	INIT_LIST_HEAD(&cache->unknown);
	INIT_LIST_HEAD(&cache->resolve);
L
Linus Torvalds 已提交
357 358
}

359 360
struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
					       bdaddr_t *bdaddr)
L
Linus Torvalds 已提交
361
{
362
	struct discovery_state *cache = &hdev->discovery;
L
Linus Torvalds 已提交
363 364
	struct inquiry_entry *e;

365
	BT_DBG("cache %p, %pMR", cache, bdaddr);
L
Linus Torvalds 已提交
366

367 368 369 370 371 372 373 374 375
	list_for_each_entry(e, &cache->all, all) {
		if (!bacmp(&e->data.bdaddr, bdaddr))
			return e;
	}

	return NULL;
}

struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
376
						       bdaddr_t *bdaddr)
377
{
378
	struct discovery_state *cache = &hdev->discovery;
379 380
	struct inquiry_entry *e;

381
	BT_DBG("cache %p, %pMR", cache, bdaddr);
382 383

	list_for_each_entry(e, &cache->unknown, list) {
L
Linus Torvalds 已提交
384
		if (!bacmp(&e->data.bdaddr, bdaddr))
385 386 387 388
			return e;
	}

	return NULL;
L
Linus Torvalds 已提交
389 390
}

391
struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
392 393
						       bdaddr_t *bdaddr,
						       int state)
394 395 396 397
{
	struct discovery_state *cache = &hdev->discovery;
	struct inquiry_entry *e;

398
	BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
399 400 401 402 403 404 405 406 407 408 409

	list_for_each_entry(e, &cache->resolve, list) {
		if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
			return e;
		if (!bacmp(&e->data.bdaddr, bdaddr))
			return e;
	}

	return NULL;
}

410
void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
411
				      struct inquiry_entry *ie)
412 413 414 415 416 417 418 419 420
{
	struct discovery_state *cache = &hdev->discovery;
	struct list_head *pos = &cache->resolve;
	struct inquiry_entry *p;

	list_del(&ie->list);

	list_for_each_entry(p, &cache->resolve, list) {
		if (p->name_state != NAME_PENDING &&
421
		    abs(p->data.rssi) >= abs(ie->data.rssi))
422 423 424 425 426 427 428
			break;
		pos = &p->list;
	}

	list_add(&ie->list, pos);
}

429
bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
430
			      bool name_known, bool *ssp)
L
Linus Torvalds 已提交
431
{
432
	struct discovery_state *cache = &hdev->discovery;
A
Andrei Emeltchenko 已提交
433
	struct inquiry_entry *ie;
L
Linus Torvalds 已提交
434

435
	BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
L
Linus Torvalds 已提交
436

437 438 439
	if (ssp)
		*ssp = data->ssp_mode;

A
Andrei Emeltchenko 已提交
440
	ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
441
	if (ie) {
442 443 444
		if (ie->data.ssp_mode && ssp)
			*ssp = true;

445
		if (ie->name_state == NAME_NEEDED &&
446
		    data->rssi != ie->data.rssi) {
447 448 449 450
			ie->data.rssi = data->rssi;
			hci_inquiry_cache_update_resolve(hdev, ie);
		}

451
		goto update;
452
	}
453 454 455 456

	/* Entry not in the cache. Add new one. */
	ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
	if (!ie)
457
		return false;
458 459 460 461 462 463 464 465 466

	list_add(&ie->all, &cache->all);

	if (name_known) {
		ie->name_state = NAME_KNOWN;
	} else {
		ie->name_state = NAME_NOT_KNOWN;
		list_add(&ie->list, &cache->unknown);
	}
A
Andrei Emeltchenko 已提交
467

468 469
update:
	if (name_known && ie->name_state != NAME_KNOWN &&
470
	    ie->name_state != NAME_PENDING) {
471 472
		ie->name_state = NAME_KNOWN;
		list_del(&ie->list);
L
Linus Torvalds 已提交
473 474
	}

A
Andrei Emeltchenko 已提交
475 476
	memcpy(&ie->data, data, sizeof(*data));
	ie->timestamp = jiffies;
L
Linus Torvalds 已提交
477
	cache->timestamp = jiffies;
478 479 480 481 482

	if (ie->name_state == NAME_NOT_KNOWN)
		return false;

	return true;
L
Linus Torvalds 已提交
483 484 485 486
}

static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
{
487
	struct discovery_state *cache = &hdev->discovery;
L
Linus Torvalds 已提交
488 489 490 491
	struct inquiry_info *info = (struct inquiry_info *) buf;
	struct inquiry_entry *e;
	int copied = 0;

492
	list_for_each_entry(e, &cache->all, all) {
L
Linus Torvalds 已提交
493
		struct inquiry_data *data = &e->data;
494 495 496 497

		if (copied >= num)
			break;

L
Linus Torvalds 已提交
498 499 500 501 502 503
		bacpy(&info->bdaddr, &data->bdaddr);
		info->pscan_rep_mode	= data->pscan_rep_mode;
		info->pscan_period_mode	= data->pscan_period_mode;
		info->pscan_mode	= data->pscan_mode;
		memcpy(info->dev_class, data->dev_class, 3);
		info->clock_offset	= data->clock_offset;
504

L
Linus Torvalds 已提交
505
		info++;
506
		copied++;
L
Linus Torvalds 已提交
507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526
	}

	BT_DBG("cache %p, copied %d", cache, copied);
	return copied;
}

static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
{
	struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
	struct hci_cp_inquiry cp;

	BT_DBG("%s", hdev->name);

	if (test_bit(HCI_INQUIRY, &hdev->flags))
		return;

	/* Start Inquiry */
	memcpy(&cp.lap, &ir->lap, 3);
	cp.length  = ir->length;
	cp.num_rsp = ir->num_rsp;
527
	hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
L
Linus Torvalds 已提交
528 529 530 531 532 533 534 535 536 537 538 539 540 541
}

int hci_inquiry(void __user *arg)
{
	__u8 __user *ptr = arg;
	struct hci_inquiry_req ir;
	struct hci_dev *hdev;
	int err = 0, do_inquiry = 0, max_rsp;
	long timeo;
	__u8 *buf;

	if (copy_from_user(&ir, ptr, sizeof(ir)))
		return -EFAULT;

542 543
	hdev = hci_dev_get(ir.dev_id);
	if (!hdev)
L
Linus Torvalds 已提交
544 545
		return -ENODEV;

546
	hci_dev_lock(hdev);
547
	if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
548
	    inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
L
Linus Torvalds 已提交
549 550 551
		inquiry_cache_flush(hdev);
		do_inquiry = 1;
	}
552
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
553

554
	timeo = ir.length * msecs_to_jiffies(2000);
A
Andrei Emeltchenko 已提交
555 556 557 558 559 560

	if (do_inquiry) {
		err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
		if (err < 0)
			goto done;
	}
L
Linus Torvalds 已提交
561

562 563 564
	/* for unlimited number of responses we will use buffer with
	 * 255 entries
	 */
L
Linus Torvalds 已提交
565 566 567 568 569
	max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;

	/* cache_dump can't sleep. Therefore we allocate temp buffer and then
	 * copy it to the user space.
	 */
570
	buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
A
Andrei Emeltchenko 已提交
571
	if (!buf) {
L
Linus Torvalds 已提交
572 573 574 575
		err = -ENOMEM;
		goto done;
	}

576
	hci_dev_lock(hdev);
L
Linus Torvalds 已提交
577
	ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
578
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
579 580 581 582 583 584

	BT_DBG("num_rsp %d", ir.num_rsp);

	if (!copy_to_user(ptr, &ir, sizeof(ir))) {
		ptr += sizeof(ir);
		if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
585
				 ir.num_rsp))
L
Linus Torvalds 已提交
586
			err = -EFAULT;
587
	} else
L
Linus Torvalds 已提交
588 589 590 591 592 593 594 595 596
		err = -EFAULT;

	kfree(buf);

done:
	hci_dev_put(hdev);
	return err;
}

597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641 642 643 644 645 646 647 648 649 650 651 652 653 654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671 672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689
static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
{
	u8 ad_len = 0, flags = 0;
	size_t name_len;

	if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
		flags |= LE_AD_GENERAL;

	if (!lmp_bredr_capable(hdev))
		flags |= LE_AD_NO_BREDR;

	if (lmp_le_br_capable(hdev))
		flags |= LE_AD_SIM_LE_BREDR_CTRL;

	if (lmp_host_le_br_capable(hdev))
		flags |= LE_AD_SIM_LE_BREDR_HOST;

	if (flags) {
		BT_DBG("adv flags 0x%02x", flags);

		ptr[0] = 2;
		ptr[1] = EIR_FLAGS;
		ptr[2] = flags;

		ad_len += 3;
		ptr += 3;
	}

	if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
		ptr[0] = 2;
		ptr[1] = EIR_TX_POWER;
		ptr[2] = (u8) hdev->adv_tx_power;

		ad_len += 3;
		ptr += 3;
	}

	name_len = strlen(hdev->dev_name);
	if (name_len > 0) {
		size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;

		if (name_len > max_len) {
			name_len = max_len;
			ptr[1] = EIR_NAME_SHORT;
		} else
			ptr[1] = EIR_NAME_COMPLETE;

		ptr[0] = name_len + 1;

		memcpy(ptr + 2, hdev->dev_name, name_len);

		ad_len += (name_len + 2);
		ptr += (name_len + 2);
	}

	return ad_len;
}

int hci_update_ad(struct hci_dev *hdev)
{
	struct hci_cp_le_set_adv_data cp;
	u8 len;
	int err;

	hci_dev_lock(hdev);

	if (!lmp_le_capable(hdev)) {
		err = -EINVAL;
		goto unlock;
	}

	memset(&cp, 0, sizeof(cp));

	len = create_ad(hdev, cp.data);

	if (hdev->adv_data_len == len &&
	    memcmp(cp.data, hdev->adv_data, len) == 0) {
		err = 0;
		goto unlock;
	}

	memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
	hdev->adv_data_len = len;

	cp.length = len;
	err = hci_send_cmd(hdev, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);

unlock:
	hci_dev_unlock(hdev);

	return err;
}

L
Linus Torvalds 已提交
690 691 692 693 694 695 696
/* ---- HCI ioctl helpers ---- */

int hci_dev_open(__u16 dev)
{
	struct hci_dev *hdev;
	int ret = 0;

697 698
	hdev = hci_dev_get(dev);
	if (!hdev)
L
Linus Torvalds 已提交
699 700 701 702 703 704
		return -ENODEV;

	BT_DBG("%s %p", hdev->name, hdev);

	hci_req_lock(hdev);

705 706 707 708 709
	if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
		ret = -ENODEV;
		goto done;
	}

710 711 712 713 714
	if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
		ret = -ERFKILL;
		goto done;
	}

L
Linus Torvalds 已提交
715 716 717 718 719 720 721 722
	if (test_bit(HCI_UP, &hdev->flags)) {
		ret = -EALREADY;
		goto done;
	}

	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
		set_bit(HCI_RAW, &hdev->flags);

723 724 725
	/* Treat all non BR/EDR controllers as raw devices if
	   enable_hs is not set */
	if (hdev->dev_type != HCI_BREDR && !enable_hs)
726 727
		set_bit(HCI_RAW, &hdev->flags);

L
Linus Torvalds 已提交
728 729 730 731 732 733 734 735
	if (hdev->open(hdev)) {
		ret = -EIO;
		goto done;
	}

	if (!test_bit(HCI_RAW, &hdev->flags)) {
		atomic_set(&hdev->cmd_cnt, 1);
		set_bit(HCI_INIT, &hdev->flags);
736
		hdev->init_last_cmd = 0;
L
Linus Torvalds 已提交
737

738
		ret = __hci_request(hdev, hci_init_req, 0, HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
739 740 741 742 743 744 745 746

		clear_bit(HCI_INIT, &hdev->flags);
	}

	if (!ret) {
		hci_dev_hold(hdev);
		set_bit(HCI_UP, &hdev->flags);
		hci_notify(hdev, HCI_DEV_UP);
747
		hci_update_ad(hdev);
748 749
		if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
		    mgmt_valid_hdev(hdev)) {
750
			hci_dev_lock(hdev);
751
			mgmt_powered(hdev, 1);
752
			hci_dev_unlock(hdev);
753
		}
754
	} else {
L
Linus Torvalds 已提交
755
		/* Init failed, cleanup */
756
		flush_work(&hdev->tx_work);
757
		flush_work(&hdev->cmd_work);
758
		flush_work(&hdev->rx_work);
L
Linus Torvalds 已提交
759 760 761 762 763 764 765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784

		skb_queue_purge(&hdev->cmd_q);
		skb_queue_purge(&hdev->rx_q);

		if (hdev->flush)
			hdev->flush(hdev);

		if (hdev->sent_cmd) {
			kfree_skb(hdev->sent_cmd);
			hdev->sent_cmd = NULL;
		}

		hdev->close(hdev);
		hdev->flags = 0;
	}

done:
	hci_req_unlock(hdev);
	hci_dev_put(hdev);
	return ret;
}

static int hci_dev_do_close(struct hci_dev *hdev)
{
	BT_DBG("%s %p", hdev->name, hdev);

A
Andre Guedes 已提交
785 786
	cancel_work_sync(&hdev->le_scan);

787 788
	cancel_delayed_work(&hdev->power_off);

L
Linus Torvalds 已提交
789 790 791 792
	hci_req_cancel(hdev, ENODEV);
	hci_req_lock(hdev);

	if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
793
		del_timer_sync(&hdev->cmd_timer);
L
Linus Torvalds 已提交
794 795 796 797
		hci_req_unlock(hdev);
		return 0;
	}

798 799
	/* Flush RX and TX works */
	flush_work(&hdev->tx_work);
800
	flush_work(&hdev->rx_work);
L
Linus Torvalds 已提交
801

802
	if (hdev->discov_timeout > 0) {
803
		cancel_delayed_work(&hdev->discov_off);
804
		hdev->discov_timeout = 0;
805
		clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
806 807
	}

808
	if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
809 810
		cancel_delayed_work(&hdev->service_cache);

A
Andre Guedes 已提交
811 812
	cancel_delayed_work_sync(&hdev->le_scan_disable);

813
	hci_dev_lock(hdev);
L
Linus Torvalds 已提交
814 815
	inquiry_cache_flush(hdev);
	hci_conn_hash_flush(hdev);
816
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
817 818 819 820 821 822 823 824 825

	hci_notify(hdev, HCI_DEV_DOWN);

	if (hdev->flush)
		hdev->flush(hdev);

	/* Reset device */
	skb_queue_purge(&hdev->cmd_q);
	atomic_set(&hdev->cmd_cnt, 1);
826
	if (!test_bit(HCI_RAW, &hdev->flags) &&
827
	    test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
L
Linus Torvalds 已提交
828
		set_bit(HCI_INIT, &hdev->flags);
829
		__hci_request(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
L
Linus Torvalds 已提交
830 831 832
		clear_bit(HCI_INIT, &hdev->flags);
	}

833 834
	/* flush cmd  work */
	flush_work(&hdev->cmd_work);
L
Linus Torvalds 已提交
835 836 837 838 839 840 841 842

	/* Drop queues */
	skb_queue_purge(&hdev->rx_q);
	skb_queue_purge(&hdev->cmd_q);
	skb_queue_purge(&hdev->raw_q);

	/* Drop last sent command */
	if (hdev->sent_cmd) {
843
		del_timer_sync(&hdev->cmd_timer);
L
Linus Torvalds 已提交
844 845 846 847 848 849 850 851
		kfree_skb(hdev->sent_cmd);
		hdev->sent_cmd = NULL;
	}

	/* After this point our queues are empty
	 * and no tasks are scheduled. */
	hdev->close(hdev);

852 853
	if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
	    mgmt_valid_hdev(hdev)) {
854 855 856 857
		hci_dev_lock(hdev);
		mgmt_powered(hdev, 0);
		hci_dev_unlock(hdev);
	}
858

L
Linus Torvalds 已提交
859 860 861
	/* Clear flags */
	hdev->flags = 0;

862
	memset(hdev->eir, 0, sizeof(hdev->eir));
863
	memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
864

L
Linus Torvalds 已提交
865 866 867 868 869 870 871 872 873 874 875
	hci_req_unlock(hdev);

	hci_dev_put(hdev);
	return 0;
}

int hci_dev_close(__u16 dev)
{
	struct hci_dev *hdev;
	int err;

A
Andrei Emeltchenko 已提交
876 877
	hdev = hci_dev_get(dev);
	if (!hdev)
L
Linus Torvalds 已提交
878
		return -ENODEV;
879 880 881 882

	if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
		cancel_delayed_work(&hdev->power_off);

L
Linus Torvalds 已提交
883
	err = hci_dev_do_close(hdev);
884

L
Linus Torvalds 已提交
885 886 887 888 889 890 891 892 893
	hci_dev_put(hdev);
	return err;
}

int hci_dev_reset(__u16 dev)
{
	struct hci_dev *hdev;
	int ret = 0;

A
Andrei Emeltchenko 已提交
894 895
	hdev = hci_dev_get(dev);
	if (!hdev)
L
Linus Torvalds 已提交
896 897 898 899 900 901 902 903 904 905 906
		return -ENODEV;

	hci_req_lock(hdev);

	if (!test_bit(HCI_UP, &hdev->flags))
		goto done;

	/* Drop queues */
	skb_queue_purge(&hdev->rx_q);
	skb_queue_purge(&hdev->cmd_q);

907
	hci_dev_lock(hdev);
L
Linus Torvalds 已提交
908 909
	inquiry_cache_flush(hdev);
	hci_conn_hash_flush(hdev);
910
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
911 912 913 914

	if (hdev->flush)
		hdev->flush(hdev);

915
	atomic_set(&hdev->cmd_cnt, 1);
916
	hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
L
Linus Torvalds 已提交
917 918

	if (!test_bit(HCI_RAW, &hdev->flags))
919
		ret = __hci_request(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
920 921 922 923 924 925 926 927 928 929 930 931

done:
	hci_req_unlock(hdev);
	hci_dev_put(hdev);
	return ret;
}

int hci_dev_reset_stat(__u16 dev)
{
	struct hci_dev *hdev;
	int ret = 0;

A
Andrei Emeltchenko 已提交
932 933
	hdev = hci_dev_get(dev);
	if (!hdev)
L
Linus Torvalds 已提交
934 935 936 937 938 939 940 941 942 943 944 945 946 947 948 949 950 951
		return -ENODEV;

	memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));

	hci_dev_put(hdev);

	return ret;
}

int hci_dev_cmd(unsigned int cmd, void __user *arg)
{
	struct hci_dev *hdev;
	struct hci_dev_req dr;
	int err = 0;

	if (copy_from_user(&dr, arg, sizeof(dr)))
		return -EFAULT;

A
Andrei Emeltchenko 已提交
952 953
	hdev = hci_dev_get(dr.dev_id);
	if (!hdev)
L
Linus Torvalds 已提交
954 955 956 957
		return -ENODEV;

	switch (cmd) {
	case HCISETAUTH:
958
		err = hci_request(hdev, hci_auth_req, dr.dev_opt,
959
				  HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
960 961 962 963 964 965 966 967 968 969
		break;

	case HCISETENCRYPT:
		if (!lmp_encrypt_capable(hdev)) {
			err = -EOPNOTSUPP;
			break;
		}

		if (!test_bit(HCI_AUTH, &hdev->flags)) {
			/* Auth must be enabled first */
970
			err = hci_request(hdev, hci_auth_req, dr.dev_opt,
971
					  HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
972 973 974 975
			if (err)
				break;
		}

976
		err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
977
				  HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
978 979 980
		break;

	case HCISETSCAN:
981
		err = hci_request(hdev, hci_scan_req, dr.dev_opt,
982
				  HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
983 984 985
		break;

	case HCISETLINKPOL:
986
		err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
987
				  HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
988 989 990
		break;

	case HCISETLINKMODE:
991 992 993 994 995 996
		hdev->link_mode = ((__u16) dr.dev_opt) &
					(HCI_LM_MASTER | HCI_LM_ACCEPT);
		break;

	case HCISETPTYPE:
		hdev->pkt_type = (__u16) dr.dev_opt;
L
Linus Torvalds 已提交
997 998 999
		break;

	case HCISETACLMTU:
1000 1001
		hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
		hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
L
Linus Torvalds 已提交
1002 1003 1004
		break;

	case HCISETSCOMTU:
1005 1006
		hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
		hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
L
Linus Torvalds 已提交
1007 1008 1009 1010 1011 1012
		break;

	default:
		err = -EINVAL;
		break;
	}
1013

L
Linus Torvalds 已提交
1014 1015 1016 1017 1018 1019
	hci_dev_put(hdev);
	return err;
}

int hci_get_dev_list(void __user *arg)
{
1020
	struct hci_dev *hdev;
L
Linus Torvalds 已提交
1021 1022 1023 1024 1025 1026 1027 1028 1029 1030 1031 1032 1033
	struct hci_dev_list_req *dl;
	struct hci_dev_req *dr;
	int n = 0, size, err;
	__u16 dev_num;

	if (get_user(dev_num, (__u16 __user *) arg))
		return -EFAULT;

	if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
		return -EINVAL;

	size = sizeof(*dl) + dev_num * sizeof(*dr);

A
Andrei Emeltchenko 已提交
1034 1035
	dl = kzalloc(size, GFP_KERNEL);
	if (!dl)
L
Linus Torvalds 已提交
1036 1037 1038 1039
		return -ENOMEM;

	dr = dl->dev_req;

1040
	read_lock(&hci_dev_list_lock);
1041
	list_for_each_entry(hdev, &hci_dev_list, list) {
1042
		if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1043
			cancel_delayed_work(&hdev->power_off);
1044

1045 1046
		if (!test_bit(HCI_MGMT, &hdev->dev_flags))
			set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1047

L
Linus Torvalds 已提交
1048 1049
		(dr + n)->dev_id  = hdev->id;
		(dr + n)->dev_opt = hdev->flags;
1050

L
Linus Torvalds 已提交
1051 1052 1053
		if (++n >= dev_num)
			break;
	}
1054
	read_unlock(&hci_dev_list_lock);
L
Linus Torvalds 已提交
1055 1056 1057 1058 1059 1060 1061 1062 1063 1064 1065 1066 1067 1068 1069 1070 1071 1072 1073

	dl->dev_num = n;
	size = sizeof(*dl) + n * sizeof(*dr);

	err = copy_to_user(arg, dl, size);
	kfree(dl);

	return err ? -EFAULT : 0;
}

int hci_get_dev_info(void __user *arg)
{
	struct hci_dev *hdev;
	struct hci_dev_info di;
	int err = 0;

	if (copy_from_user(&di, arg, sizeof(di)))
		return -EFAULT;

A
Andrei Emeltchenko 已提交
1074 1075
	hdev = hci_dev_get(di.dev_id);
	if (!hdev)
L
Linus Torvalds 已提交
1076 1077
		return -ENODEV;

1078
	if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1079
		cancel_delayed_work_sync(&hdev->power_off);
1080

1081 1082
	if (!test_bit(HCI_MGMT, &hdev->dev_flags))
		set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1083

L
Linus Torvalds 已提交
1084 1085
	strcpy(di.name, hdev->name);
	di.bdaddr   = hdev->bdaddr;
1086
	di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
L
Linus Torvalds 已提交
1087 1088
	di.flags    = hdev->flags;
	di.pkt_type = hdev->pkt_type;
1089 1090 1091 1092 1093 1094 1095 1096 1097 1098 1099
	if (lmp_bredr_capable(hdev)) {
		di.acl_mtu  = hdev->acl_mtu;
		di.acl_pkts = hdev->acl_pkts;
		di.sco_mtu  = hdev->sco_mtu;
		di.sco_pkts = hdev->sco_pkts;
	} else {
		di.acl_mtu  = hdev->le_mtu;
		di.acl_pkts = hdev->le_pkts;
		di.sco_mtu  = 0;
		di.sco_pkts = 0;
	}
L
Linus Torvalds 已提交
1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115
	di.link_policy = hdev->link_policy;
	di.link_mode   = hdev->link_mode;

	memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
	memcpy(&di.features, &hdev->features, sizeof(di.features));

	if (copy_to_user(arg, &di, sizeof(di)))
		err = -EFAULT;

	hci_dev_put(hdev);

	return err;
}

/* ---- Interface to HCI drivers ---- */

1116 1117 1118 1119 1120 1121 1122 1123 1124 1125 1126 1127 1128 1129 1130 1131 1132 1133
static int hci_rfkill_set_block(void *data, bool blocked)
{
	struct hci_dev *hdev = data;

	BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);

	if (!blocked)
		return 0;

	hci_dev_do_close(hdev);

	return 0;
}

static const struct rfkill_ops hci_rfkill_ops = {
	.set_block = hci_rfkill_set_block,
};

1134 1135 1136 1137 1138 1139 1140 1141 1142
static void hci_power_on(struct work_struct *work)
{
	struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);

	BT_DBG("%s", hdev->name);

	if (hci_dev_open(hdev->id) < 0)
		return;

1143
	if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1144
		schedule_delayed_work(&hdev->power_off, HCI_AUTO_OFF_TIMEOUT);
1145

1146
	if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
1147
		mgmt_index_added(hdev);
1148 1149 1150 1151
}

static void hci_power_off(struct work_struct *work)
{
1152
	struct hci_dev *hdev = container_of(work, struct hci_dev,
1153
					    power_off.work);
1154 1155 1156

	BT_DBG("%s", hdev->name);

1157
	hci_dev_do_close(hdev);
1158 1159
}

1160 1161 1162 1163 1164 1165 1166 1167 1168
static void hci_discov_off(struct work_struct *work)
{
	struct hci_dev *hdev;
	u8 scan = SCAN_PAGE;

	hdev = container_of(work, struct hci_dev, discov_off.work);

	BT_DBG("%s", hdev->name);

1169
	hci_dev_lock(hdev);
1170 1171 1172 1173 1174

	hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);

	hdev->discov_timeout = 0;

1175
	hci_dev_unlock(hdev);
1176 1177
}

1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193
int hci_uuids_clear(struct hci_dev *hdev)
{
	struct list_head *p, *n;

	list_for_each_safe(p, n, &hdev->uuids) {
		struct bt_uuid *uuid;

		uuid = list_entry(p, struct bt_uuid, list);

		list_del(p);
		kfree(uuid);
	}

	return 0;
}

1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204 1205 1206 1207 1208 1209
int hci_link_keys_clear(struct hci_dev *hdev)
{
	struct list_head *p, *n;

	list_for_each_safe(p, n, &hdev->link_keys) {
		struct link_key *key;

		key = list_entry(p, struct link_key, list);

		list_del(p);
		kfree(key);
	}

	return 0;
}

1210 1211 1212 1213 1214 1215 1216 1217 1218 1219 1220 1221
int hci_smp_ltks_clear(struct hci_dev *hdev)
{
	struct smp_ltk *k, *tmp;

	list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
		list_del(&k->list);
		kfree(k);
	}

	return 0;
}

1222 1223
struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
{
1224
	struct link_key *k;
1225

1226
	list_for_each_entry(k, &hdev->link_keys, list)
1227 1228 1229 1230 1231 1232
		if (bacmp(bdaddr, &k->bdaddr) == 0)
			return k;

	return NULL;
}

1233
static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1234
			       u8 key_type, u8 old_key_type)
1235 1236 1237
{
	/* Legacy key */
	if (key_type < 0x03)
1238
		return true;
1239 1240 1241

	/* Debug keys are insecure so don't store them persistently */
	if (key_type == HCI_LK_DEBUG_COMBINATION)
1242
		return false;
1243 1244 1245

	/* Changed combination key and there's no previous one */
	if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1246
		return false;
1247 1248 1249

	/* Security mode 3 case */
	if (!conn)
1250
		return true;
1251 1252 1253

	/* Neither local nor remote side had no-bonding as requirement */
	if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1254
		return true;
1255 1256 1257

	/* Local side had dedicated bonding as requirement */
	if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1258
		return true;
1259 1260 1261

	/* Remote side had dedicated bonding as requirement */
	if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1262
		return true;
1263 1264 1265

	/* If none of the above criteria match, then don't store the key
	 * persistently */
1266
	return false;
1267 1268
}

1269
struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1270
{
1271
	struct smp_ltk *k;
1272

1273 1274
	list_for_each_entry(k, &hdev->long_term_keys, list) {
		if (k->ediv != ediv ||
1275
		    memcmp(rand, k->rand, sizeof(k->rand)))
1276 1277
			continue;

1278
		return k;
1279 1280 1281 1282 1283
	}

	return NULL;
}

1284
struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1285
				     u8 addr_type)
1286
{
1287
	struct smp_ltk *k;
1288

1289 1290
	list_for_each_entry(k, &hdev->long_term_keys, list)
		if (addr_type == k->bdaddr_type &&
1291
		    bacmp(bdaddr, &k->bdaddr) == 0)
1292 1293 1294 1295 1296
			return k;

	return NULL;
}

1297
int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1298
		     bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1299 1300
{
	struct link_key *key, *old_key;
1301 1302
	u8 old_key_type;
	bool persistent;
1303 1304 1305 1306 1307 1308

	old_key = hci_find_link_key(hdev, bdaddr);
	if (old_key) {
		old_key_type = old_key->type;
		key = old_key;
	} else {
1309
		old_key_type = conn ? conn->key_type : 0xff;
1310 1311 1312 1313 1314 1315
		key = kzalloc(sizeof(*key), GFP_ATOMIC);
		if (!key)
			return -ENOMEM;
		list_add(&key->list, &hdev->link_keys);
	}

1316
	BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
1317

1318 1319 1320 1321
	/* Some buggy controller combinations generate a changed
	 * combination key for legacy pairing even when there's no
	 * previous key */
	if (type == HCI_LK_CHANGED_COMBINATION &&
1322
	    (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
1323
		type = HCI_LK_COMBINATION;
1324 1325 1326
		if (conn)
			conn->key_type = type;
	}
1327

1328
	bacpy(&key->bdaddr, bdaddr);
1329
	memcpy(key->val, val, HCI_LINK_KEY_SIZE);
1330 1331
	key->pin_len = pin_len;

1332
	if (type == HCI_LK_CHANGED_COMBINATION)
1333
		key->type = old_key_type;
1334 1335 1336
	else
		key->type = type;

1337 1338 1339 1340 1341
	if (!new_key)
		return 0;

	persistent = hci_persistent_key(hdev, conn, type, old_key_type);

1342
	mgmt_new_link_key(hdev, key, persistent);
1343

1344 1345
	if (conn)
		conn->flush_key = !persistent;
1346 1347 1348 1349

	return 0;
}

1350
int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
1351
		int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
1352
		ediv, u8 rand[8])
1353
{
1354
	struct smp_ltk *key, *old_key;
1355

1356 1357
	if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
		return 0;
1358

1359 1360
	old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
	if (old_key)
1361
		key = old_key;
1362 1363
	else {
		key = kzalloc(sizeof(*key), GFP_ATOMIC);
1364 1365
		if (!key)
			return -ENOMEM;
1366
		list_add(&key->list, &hdev->long_term_keys);
1367 1368 1369
	}

	bacpy(&key->bdaddr, bdaddr);
1370 1371 1372 1373 1374 1375 1376
	key->bdaddr_type = addr_type;
	memcpy(key->val, tk, sizeof(key->val));
	key->authenticated = authenticated;
	key->ediv = ediv;
	key->enc_size = enc_size;
	key->type = type;
	memcpy(key->rand, rand, sizeof(key->rand));
1377

1378 1379
	if (!new_key)
		return 0;
1380

1381 1382 1383
	if (type & HCI_SMP_LTK)
		mgmt_new_ltk(hdev, key, 1);

1384 1385 1386
	return 0;
}

1387 1388 1389 1390 1391 1392 1393 1394
int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
{
	struct link_key *key;

	key = hci_find_link_key(hdev, bdaddr);
	if (!key)
		return -ENOENT;

1395
	BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1396 1397 1398 1399 1400 1401 1402

	list_del(&key->list);
	kfree(key);

	return 0;
}

1403 1404 1405 1406 1407 1408 1409 1410
int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
{
	struct smp_ltk *k, *tmp;

	list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
		if (bacmp(bdaddr, &k->bdaddr))
			continue;

1411
		BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1412 1413 1414 1415 1416 1417 1418 1419

		list_del(&k->list);
		kfree(k);
	}

	return 0;
}

1420
/* HCI command timer function */
1421
static void hci_cmd_timeout(unsigned long arg)
1422 1423 1424
{
	struct hci_dev *hdev = (void *) arg;

1425 1426 1427 1428 1429 1430 1431 1432 1433
	if (hdev->sent_cmd) {
		struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
		u16 opcode = __le16_to_cpu(sent->opcode);

		BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
	} else {
		BT_ERR("%s command tx timeout", hdev->name);
	}

1434
	atomic_set(&hdev->cmd_cnt, 1);
1435
	queue_work(hdev->workqueue, &hdev->cmd_work);
1436 1437
}

1438
struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1439
					  bdaddr_t *bdaddr)
1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457
{
	struct oob_data *data;

	list_for_each_entry(data, &hdev->remote_oob_data, list)
		if (bacmp(bdaddr, &data->bdaddr) == 0)
			return data;

	return NULL;
}

int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
{
	struct oob_data *data;

	data = hci_find_remote_oob_data(hdev, bdaddr);
	if (!data)
		return -ENOENT;

1458
	BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1459 1460 1461 1462 1463 1464 1465 1466 1467 1468 1469 1470 1471 1472 1473 1474 1475 1476 1477 1478

	list_del(&data->list);
	kfree(data);

	return 0;
}

int hci_remote_oob_data_clear(struct hci_dev *hdev)
{
	struct oob_data *data, *n;

	list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
		list_del(&data->list);
		kfree(data);
	}

	return 0;
}

int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1479
			    u8 *randomizer)
1480 1481 1482 1483 1484 1485 1486 1487 1488 1489 1490 1491 1492 1493 1494 1495 1496
{
	struct oob_data *data;

	data = hci_find_remote_oob_data(hdev, bdaddr);

	if (!data) {
		data = kmalloc(sizeof(*data), GFP_ATOMIC);
		if (!data)
			return -ENOMEM;

		bacpy(&data->bdaddr, bdaddr);
		list_add(&data->list, &hdev->remote_oob_data);
	}

	memcpy(data->hash, hash, sizeof(data->hash));
	memcpy(data->randomizer, randomizer, sizeof(data->randomizer));

1497
	BT_DBG("%s for %pMR", hdev->name, bdaddr);
1498 1499 1500 1501

	return 0;
}

1502
struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
1503
{
1504
	struct bdaddr_list *b;
1505

1506
	list_for_each_entry(b, &hdev->blacklist, list)
1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528
		if (bacmp(bdaddr, &b->bdaddr) == 0)
			return b;

	return NULL;
}

int hci_blacklist_clear(struct hci_dev *hdev)
{
	struct list_head *p, *n;

	list_for_each_safe(p, n, &hdev->blacklist) {
		struct bdaddr_list *b;

		b = list_entry(p, struct bdaddr_list, list);

		list_del(p);
		kfree(b);
	}

	return 0;
}

1529
int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1530 1531 1532 1533 1534 1535
{
	struct bdaddr_list *entry;

	if (bacmp(bdaddr, BDADDR_ANY) == 0)
		return -EBADF;

1536 1537
	if (hci_blacklist_lookup(hdev, bdaddr))
		return -EEXIST;
1538 1539

	entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1540 1541
	if (!entry)
		return -ENOMEM;
1542 1543 1544 1545 1546

	bacpy(&entry->bdaddr, bdaddr);

	list_add(&entry->list, &hdev->blacklist);

1547
	return mgmt_device_blocked(hdev, bdaddr, type);
1548 1549
}

1550
int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1551 1552 1553
{
	struct bdaddr_list *entry;

1554
	if (bacmp(bdaddr, BDADDR_ANY) == 0)
1555
		return hci_blacklist_clear(hdev);
1556 1557

	entry = hci_blacklist_lookup(hdev, bdaddr);
1558
	if (!entry)
1559
		return -ENOENT;
1560 1561 1562 1563

	list_del(&entry->list);
	kfree(entry);

1564
	return mgmt_device_unblocked(hdev, bdaddr, type);
1565 1566
}

A
Andre Guedes 已提交
1567 1568 1569 1570 1571 1572 1573 1574 1575 1576 1577 1578 1579 1580 1581 1582 1583 1584 1585
static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
{
	struct le_scan_params *param =  (struct le_scan_params *) opt;
	struct hci_cp_le_set_scan_param cp;

	memset(&cp, 0, sizeof(cp));
	cp.type = param->type;
	cp.interval = cpu_to_le16(param->interval);
	cp.window = cpu_to_le16(param->window);

	hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
}

static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
{
	struct hci_cp_le_set_scan_enable cp;

	memset(&cp, 0, sizeof(cp));
	cp.enable = 1;
1586
	cp.filter_dup = 1;
A
Andre Guedes 已提交
1587 1588 1589 1590 1591

	hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
}

static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
1592
			  u16 window, int timeout)
A
Andre Guedes 已提交
1593 1594 1595 1596 1597 1598 1599 1600 1601 1602 1603 1604 1605 1606 1607 1608 1609
{
	long timeo = msecs_to_jiffies(3000);
	struct le_scan_params param;
	int err;

	BT_DBG("%s", hdev->name);

	if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
		return -EINPROGRESS;

	param.type = type;
	param.interval = interval;
	param.window = window;

	hci_req_lock(hdev);

	err = __hci_request(hdev, le_scan_param_req, (unsigned long) &param,
1610
			    timeo);
A
Andre Guedes 已提交
1611 1612 1613 1614 1615 1616 1617 1618 1619
	if (!err)
		err = __hci_request(hdev, le_scan_enable_req, 0, timeo);

	hci_req_unlock(hdev);

	if (err < 0)
		return err;

	schedule_delayed_work(&hdev->le_scan_disable,
1620
			      msecs_to_jiffies(timeout));
A
Andre Guedes 已提交
1621 1622 1623 1624

	return 0;
}

1625 1626 1627 1628 1629 1630 1631 1632 1633 1634 1635 1636 1637 1638 1639 1640 1641 1642
int hci_cancel_le_scan(struct hci_dev *hdev)
{
	BT_DBG("%s", hdev->name);

	if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
		return -EALREADY;

	if (cancel_delayed_work(&hdev->le_scan_disable)) {
		struct hci_cp_le_set_scan_enable cp;

		/* Send HCI command to disable LE Scan */
		memset(&cp, 0, sizeof(cp));
		hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
	}

	return 0;
}

A
Andre Guedes 已提交
1643 1644 1645
static void le_scan_disable_work(struct work_struct *work)
{
	struct hci_dev *hdev = container_of(work, struct hci_dev,
1646
					    le_scan_disable.work);
A
Andre Guedes 已提交
1647 1648 1649 1650 1651 1652 1653 1654 1655
	struct hci_cp_le_set_scan_enable cp;

	BT_DBG("%s", hdev->name);

	memset(&cp, 0, sizeof(cp));

	hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
}

A
Andre Guedes 已提交
1656 1657 1658 1659 1660 1661 1662
static void le_scan_work(struct work_struct *work)
{
	struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
	struct le_scan_params *param = &hdev->le_scan_params;

	BT_DBG("%s", hdev->name);

1663 1664
	hci_do_le_scan(hdev, param->type, param->interval, param->window,
		       param->timeout);
A
Andre Guedes 已提交
1665 1666 1667
}

int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
1668
		int timeout)
A
Andre Guedes 已提交
1669 1670 1671 1672 1673
{
	struct le_scan_params *param = &hdev->le_scan_params;

	BT_DBG("%s", hdev->name);

1674 1675 1676
	if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
		return -ENOTSUPP;

A
Andre Guedes 已提交
1677 1678 1679 1680 1681 1682 1683 1684 1685 1686 1687 1688 1689
	if (work_busy(&hdev->le_scan))
		return -EINPROGRESS;

	param->type = type;
	param->interval = interval;
	param->window = window;
	param->timeout = timeout;

	queue_work(system_long_wq, &hdev->le_scan);

	return 0;
}

1690 1691 1692 1693 1694 1695 1696 1697 1698
/* Alloc HCI device */
struct hci_dev *hci_alloc_dev(void)
{
	struct hci_dev *hdev;

	hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
	if (!hdev)
		return NULL;

1699 1700 1701 1702
	hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
	hdev->esco_type = (ESCO_HV1);
	hdev->link_mode = (HCI_LM_ACCEPT);
	hdev->io_capability = 0x03; /* No Input No Output */
1703 1704
	hdev->inq_tx_power = HCI_TX_POWER_INVALID;
	hdev->adv_tx_power = HCI_TX_POWER_INVALID;
1705 1706 1707 1708 1709 1710 1711 1712 1713 1714 1715 1716 1717

	hdev->sniff_max_interval = 800;
	hdev->sniff_min_interval = 80;

	mutex_init(&hdev->lock);
	mutex_init(&hdev->req_lock);

	INIT_LIST_HEAD(&hdev->mgmt_pending);
	INIT_LIST_HEAD(&hdev->blacklist);
	INIT_LIST_HEAD(&hdev->uuids);
	INIT_LIST_HEAD(&hdev->link_keys);
	INIT_LIST_HEAD(&hdev->long_term_keys);
	INIT_LIST_HEAD(&hdev->remote_oob_data);
1718
	INIT_LIST_HEAD(&hdev->conn_hash.list);
1719 1720 1721 1722 1723 1724 1725 1726 1727 1728 1729

	INIT_WORK(&hdev->rx_work, hci_rx_work);
	INIT_WORK(&hdev->cmd_work, hci_cmd_work);
	INIT_WORK(&hdev->tx_work, hci_tx_work);
	INIT_WORK(&hdev->power_on, hci_power_on);
	INIT_WORK(&hdev->le_scan, le_scan_work);

	INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
	INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
	INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);

1730
	skb_queue_head_init(&hdev->driver_init);
1731 1732 1733 1734 1735 1736
	skb_queue_head_init(&hdev->rx_q);
	skb_queue_head_init(&hdev->cmd_q);
	skb_queue_head_init(&hdev->raw_q);

	init_waitqueue_head(&hdev->req_wait_q);

1737
	setup_timer(&hdev->cmd_timer, hci_cmd_timeout, (unsigned long) hdev);
1738 1739 1740

	hci_init_sysfs(hdev);
	discovery_init(hdev);
1741 1742 1743 1744 1745 1746 1747 1748 1749 1750 1751 1752 1753 1754 1755

	return hdev;
}
EXPORT_SYMBOL(hci_alloc_dev);

/* Free HCI device */
void hci_free_dev(struct hci_dev *hdev)
{
	skb_queue_purge(&hdev->driver_init);

	/* will free via device release */
	put_device(&hdev->dev);
}
EXPORT_SYMBOL(hci_free_dev);

L
Linus Torvalds 已提交
1756 1757 1758
/* Register HCI device */
int hci_register_dev(struct hci_dev *hdev)
{
1759
	int id, error;
L
Linus Torvalds 已提交
1760

1761
	if (!hdev->open || !hdev->close)
L
Linus Torvalds 已提交
1762 1763
		return -EINVAL;

1764 1765 1766
	/* Do not allow HCI_AMP devices to register at index 0,
	 * so the index can be used as the AMP controller ID.
	 */
1767 1768 1769 1770 1771 1772 1773 1774 1775
	switch (hdev->dev_type) {
	case HCI_BREDR:
		id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
		break;
	case HCI_AMP:
		id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
		break;
	default:
		return -EINVAL;
L
Linus Torvalds 已提交
1776
	}
1777

1778 1779 1780
	if (id < 0)
		return id;

L
Linus Torvalds 已提交
1781 1782
	sprintf(hdev->name, "hci%d", id);
	hdev->id = id;
1783 1784 1785

	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);

1786 1787
	write_lock(&hci_dev_list_lock);
	list_add(&hdev->list, &hci_dev_list);
1788
	write_unlock(&hci_dev_list_lock);
L
Linus Torvalds 已提交
1789

1790
	hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
1791
					  WQ_MEM_RECLAIM, 1);
1792 1793 1794 1795
	if (!hdev->workqueue) {
		error = -ENOMEM;
		goto err;
	}
1796

1797 1798 1799
	error = hci_add_sysfs(hdev);
	if (error < 0)
		goto err_wqueue;
L
Linus Torvalds 已提交
1800

1801
	hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1802 1803
				    RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
				    hdev);
1804 1805 1806 1807 1808 1809 1810
	if (hdev->rfkill) {
		if (rfkill_register(hdev->rfkill) < 0) {
			rfkill_destroy(hdev->rfkill);
			hdev->rfkill = NULL;
		}
	}

1811
	set_bit(HCI_SETUP, &hdev->dev_flags);
1812 1813 1814 1815

	if (hdev->dev_type != HCI_AMP)
		set_bit(HCI_AUTO_OFF, &hdev->dev_flags);

1816
	schedule_work(&hdev->power_on);
1817

L
Linus Torvalds 已提交
1818
	hci_notify(hdev, HCI_DEV_REG);
1819
	hci_dev_hold(hdev);
L
Linus Torvalds 已提交
1820 1821

	return id;
1822

1823 1824 1825
err_wqueue:
	destroy_workqueue(hdev->workqueue);
err:
1826
	ida_simple_remove(&hci_index_ida, hdev->id);
1827
	write_lock(&hci_dev_list_lock);
1828
	list_del(&hdev->list);
1829
	write_unlock(&hci_dev_list_lock);
1830

1831
	return error;
L
Linus Torvalds 已提交
1832 1833 1834 1835
}
EXPORT_SYMBOL(hci_register_dev);

/* Unregister HCI device */
1836
void hci_unregister_dev(struct hci_dev *hdev)
L
Linus Torvalds 已提交
1837
{
1838
	int i, id;
1839

1840
	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
L
Linus Torvalds 已提交
1841

1842 1843
	set_bit(HCI_UNREGISTER, &hdev->dev_flags);

1844 1845
	id = hdev->id;

1846
	write_lock(&hci_dev_list_lock);
L
Linus Torvalds 已提交
1847
	list_del(&hdev->list);
1848
	write_unlock(&hci_dev_list_lock);
L
Linus Torvalds 已提交
1849 1850 1851

	hci_dev_do_close(hdev);

1852
	for (i = 0; i < NUM_REASSEMBLY; i++)
1853 1854
		kfree_skb(hdev->reassembly[i]);

1855
	if (!test_bit(HCI_INIT, &hdev->flags) &&
1856
	    !test_bit(HCI_SETUP, &hdev->dev_flags)) {
1857
		hci_dev_lock(hdev);
1858
		mgmt_index_removed(hdev);
1859
		hci_dev_unlock(hdev);
1860
	}
1861

1862 1863 1864 1865
	/* mgmt_index_removed should take care of emptying the
	 * pending list */
	BUG_ON(!list_empty(&hdev->mgmt_pending));

L
Linus Torvalds 已提交
1866 1867
	hci_notify(hdev, HCI_DEV_UNREG);

1868 1869 1870 1871 1872
	if (hdev->rfkill) {
		rfkill_unregister(hdev->rfkill);
		rfkill_destroy(hdev->rfkill);
	}

1873
	hci_del_sysfs(hdev);
1874

1875 1876
	destroy_workqueue(hdev->workqueue);

1877
	hci_dev_lock(hdev);
1878
	hci_blacklist_clear(hdev);
1879
	hci_uuids_clear(hdev);
1880
	hci_link_keys_clear(hdev);
1881
	hci_smp_ltks_clear(hdev);
1882
	hci_remote_oob_data_clear(hdev);
1883
	hci_dev_unlock(hdev);
1884

1885
	hci_dev_put(hdev);
1886 1887

	ida_simple_remove(&hci_index_ida, id);
L
Linus Torvalds 已提交
1888 1889 1890 1891 1892 1893 1894 1895 1896 1897 1898 1899 1900 1901 1902 1903 1904 1905 1906
}
EXPORT_SYMBOL(hci_unregister_dev);

/* Suspend HCI device */
int hci_suspend_dev(struct hci_dev *hdev)
{
	hci_notify(hdev, HCI_DEV_SUSPEND);
	return 0;
}
EXPORT_SYMBOL(hci_suspend_dev);

/* Resume HCI device */
int hci_resume_dev(struct hci_dev *hdev)
{
	hci_notify(hdev, HCI_DEV_RESUME);
	return 0;
}
EXPORT_SYMBOL(hci_resume_dev);

1907 1908 1909 1910 1911
/* Receive frame from HCI drivers */
int hci_recv_frame(struct sk_buff *skb)
{
	struct hci_dev *hdev = (struct hci_dev *) skb->dev;
	if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1912
		      && !test_bit(HCI_INIT, &hdev->flags))) {
1913 1914 1915 1916 1917 1918 1919 1920 1921 1922 1923
		kfree_skb(skb);
		return -ENXIO;
	}

	/* Incomming skb */
	bt_cb(skb)->incoming = 1;

	/* Time stamp */
	__net_timestamp(skb);

	skb_queue_tail(&hdev->rx_q, skb);
1924
	queue_work(hdev->workqueue, &hdev->rx_work);
1925

1926 1927 1928 1929
	return 0;
}
EXPORT_SYMBOL(hci_recv_frame);

1930
static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1931
			  int count, __u8 index)
1932 1933 1934 1935 1936 1937 1938 1939
{
	int len = 0;
	int hlen = 0;
	int remain = count;
	struct sk_buff *skb;
	struct bt_skb_cb *scb;

	if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1940
	    index >= NUM_REASSEMBLY)
1941 1942 1943 1944 1945 1946 1947 1948 1949 1950 1951 1952 1953 1954 1955 1956 1957 1958 1959 1960
		return -EILSEQ;

	skb = hdev->reassembly[index];

	if (!skb) {
		switch (type) {
		case HCI_ACLDATA_PKT:
			len = HCI_MAX_FRAME_SIZE;
			hlen = HCI_ACL_HDR_SIZE;
			break;
		case HCI_EVENT_PKT:
			len = HCI_MAX_EVENT_SIZE;
			hlen = HCI_EVENT_HDR_SIZE;
			break;
		case HCI_SCODATA_PKT:
			len = HCI_MAX_SCO_SIZE;
			hlen = HCI_SCO_HDR_SIZE;
			break;
		}

1961
		skb = bt_skb_alloc(len, GFP_ATOMIC);
1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974
		if (!skb)
			return -ENOMEM;

		scb = (void *) skb->cb;
		scb->expect = hlen;
		scb->pkt_type = type;

		skb->dev = (void *) hdev;
		hdev->reassembly[index] = skb;
	}

	while (count) {
		scb = (void *) skb->cb;
1975
		len = min_t(uint, scb->expect, count);
1976 1977 1978 1979 1980 1981 1982 1983 1984 1985 1986 1987 1988 1989 1990 1991 1992 1993 1994 1995 1996 1997 1998 1999 2000 2001 2002 2003 2004 2005 2006 2007 2008 2009 2010 2011 2012 2013 2014 2015 2016 2017 2018 2019 2020 2021 2022 2023 2024 2025 2026 2027 2028 2029 2030 2031 2032 2033 2034 2035 2036 2037 2038

		memcpy(skb_put(skb, len), data, len);

		count -= len;
		data += len;
		scb->expect -= len;
		remain = count;

		switch (type) {
		case HCI_EVENT_PKT:
			if (skb->len == HCI_EVENT_HDR_SIZE) {
				struct hci_event_hdr *h = hci_event_hdr(skb);
				scb->expect = h->plen;

				if (skb_tailroom(skb) < scb->expect) {
					kfree_skb(skb);
					hdev->reassembly[index] = NULL;
					return -ENOMEM;
				}
			}
			break;

		case HCI_ACLDATA_PKT:
			if (skb->len  == HCI_ACL_HDR_SIZE) {
				struct hci_acl_hdr *h = hci_acl_hdr(skb);
				scb->expect = __le16_to_cpu(h->dlen);

				if (skb_tailroom(skb) < scb->expect) {
					kfree_skb(skb);
					hdev->reassembly[index] = NULL;
					return -ENOMEM;
				}
			}
			break;

		case HCI_SCODATA_PKT:
			if (skb->len == HCI_SCO_HDR_SIZE) {
				struct hci_sco_hdr *h = hci_sco_hdr(skb);
				scb->expect = h->dlen;

				if (skb_tailroom(skb) < scb->expect) {
					kfree_skb(skb);
					hdev->reassembly[index] = NULL;
					return -ENOMEM;
				}
			}
			break;
		}

		if (scb->expect == 0) {
			/* Complete frame */

			bt_cb(skb)->pkt_type = type;
			hci_recv_frame(skb);

			hdev->reassembly[index] = NULL;
			return remain;
		}
	}

	return remain;
}

2039 2040
int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
{
2041 2042
	int rem = 0;

2043 2044 2045
	if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
		return -EILSEQ;

2046
	while (count) {
2047
		rem = hci_reassembly(hdev, type, data, count, type - 1);
2048 2049
		if (rem < 0)
			return rem;
2050

2051 2052
		data += (count - rem);
		count = rem;
J
Joe Perches 已提交
2053
	}
2054

2055
	return rem;
2056 2057 2058
}
EXPORT_SYMBOL(hci_recv_fragment);

2059 2060 2061 2062 2063 2064 2065
#define STREAM_REASSEMBLY 0

int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
{
	int type;
	int rem = 0;

2066
	while (count) {
2067 2068 2069 2070 2071 2072 2073 2074 2075 2076 2077 2078 2079 2080
		struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];

		if (!skb) {
			struct { char type; } *pkt;

			/* Start of the frame */
			pkt = data;
			type = pkt->type;

			data++;
			count--;
		} else
			type = bt_cb(skb)->pkt_type;

2081
		rem = hci_reassembly(hdev, type, data, count,
2082
				     STREAM_REASSEMBLY);
2083 2084 2085 2086 2087
		if (rem < 0)
			return rem;

		data += (count - rem);
		count = rem;
J
Joe Perches 已提交
2088
	}
2089 2090 2091 2092 2093

	return rem;
}
EXPORT_SYMBOL(hci_recv_stream_fragment);

L
Linus Torvalds 已提交
2094 2095 2096 2097 2098 2099
/* ---- Interface to upper protocols ---- */

int hci_register_cb(struct hci_cb *cb)
{
	BT_DBG("%p name %s", cb, cb->name);

2100
	write_lock(&hci_cb_list_lock);
L
Linus Torvalds 已提交
2101
	list_add(&cb->list, &hci_cb_list);
2102
	write_unlock(&hci_cb_list_lock);
L
Linus Torvalds 已提交
2103 2104 2105 2106 2107 2108 2109 2110 2111

	return 0;
}
EXPORT_SYMBOL(hci_register_cb);

int hci_unregister_cb(struct hci_cb *cb)
{
	BT_DBG("%p name %s", cb, cb->name);

2112
	write_lock(&hci_cb_list_lock);
L
Linus Torvalds 已提交
2113
	list_del(&cb->list);
2114
	write_unlock(&hci_cb_list_lock);
L
Linus Torvalds 已提交
2115 2116 2117 2118 2119 2120 2121 2122 2123 2124 2125 2126 2127 2128

	return 0;
}
EXPORT_SYMBOL(hci_unregister_cb);

static int hci_send_frame(struct sk_buff *skb)
{
	struct hci_dev *hdev = (struct hci_dev *) skb->dev;

	if (!hdev) {
		kfree_skb(skb);
		return -ENODEV;
	}

2129
	BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
L
Linus Torvalds 已提交
2130

2131 2132
	/* Time stamp */
	__net_timestamp(skb);
L
Linus Torvalds 已提交
2133

2134 2135 2136 2137 2138
	/* Send copy to monitor */
	hci_send_to_monitor(hdev, skb);

	if (atomic_read(&hdev->promisc)) {
		/* Send copy to the sockets */
2139
		hci_send_to_sock(hdev, skb);
L
Linus Torvalds 已提交
2140 2141 2142 2143 2144 2145 2146 2147 2148
	}

	/* Get rid of skb owner, prior to sending to the driver. */
	skb_orphan(skb);

	return hdev->send(skb);
}

/* Send HCI command */
2149
int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
L
Linus Torvalds 已提交
2150 2151 2152 2153 2154
{
	int len = HCI_COMMAND_HDR_SIZE + plen;
	struct hci_command_hdr *hdr;
	struct sk_buff *skb;

2155
	BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
L
Linus Torvalds 已提交
2156 2157 2158

	skb = bt_skb_alloc(len, GFP_ATOMIC);
	if (!skb) {
2159
		BT_ERR("%s no memory for command", hdev->name);
L
Linus Torvalds 已提交
2160 2161 2162 2163
		return -ENOMEM;
	}

	hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
2164
	hdr->opcode = cpu_to_le16(opcode);
L
Linus Torvalds 已提交
2165 2166 2167 2168 2169 2170 2171
	hdr->plen   = plen;

	if (plen)
		memcpy(skb_put(skb, plen), param, plen);

	BT_DBG("skb len %d", skb->len);

2172
	bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
L
Linus Torvalds 已提交
2173
	skb->dev = (void *) hdev;
2174

2175 2176 2177
	if (test_bit(HCI_INIT, &hdev->flags))
		hdev->init_last_cmd = opcode;

L
Linus Torvalds 已提交
2178
	skb_queue_tail(&hdev->cmd_q, skb);
2179
	queue_work(hdev->workqueue, &hdev->cmd_work);
L
Linus Torvalds 已提交
2180 2181 2182 2183 2184

	return 0;
}

/* Get data from the previously sent command */
2185
void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
L
Linus Torvalds 已提交
2186 2187 2188 2189 2190 2191 2192 2193
{
	struct hci_command_hdr *hdr;

	if (!hdev->sent_cmd)
		return NULL;

	hdr = (void *) hdev->sent_cmd->data;

2194
	if (hdr->opcode != cpu_to_le16(opcode))
L
Linus Torvalds 已提交
2195 2196
		return NULL;

2197
	BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
L
Linus Torvalds 已提交
2198 2199 2200 2201 2202 2203 2204 2205 2206 2207

	return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
}

/* Send ACL data */
static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
{
	struct hci_acl_hdr *hdr;
	int len = skb->len;

2208 2209
	skb_push(skb, HCI_ACL_HDR_SIZE);
	skb_reset_transport_header(skb);
2210
	hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
2211 2212
	hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
	hdr->dlen   = cpu_to_le16(len);
L
Linus Torvalds 已提交
2213 2214
}

2215
static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
2216
			  struct sk_buff *skb, __u16 flags)
L
Linus Torvalds 已提交
2217
{
2218
	struct hci_conn *conn = chan->conn;
L
Linus Torvalds 已提交
2219 2220 2221
	struct hci_dev *hdev = conn->hdev;
	struct sk_buff *list;

2222 2223 2224 2225
	skb->len = skb_headlen(skb);
	skb->data_len = 0;

	bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2226 2227 2228 2229 2230 2231 2232 2233 2234 2235 2236 2237

	switch (hdev->dev_type) {
	case HCI_BREDR:
		hci_add_acl_hdr(skb, conn->handle, flags);
		break;
	case HCI_AMP:
		hci_add_acl_hdr(skb, chan->handle, flags);
		break;
	default:
		BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
		return;
	}
2238

A
Andrei Emeltchenko 已提交
2239 2240
	list = skb_shinfo(skb)->frag_list;
	if (!list) {
L
Linus Torvalds 已提交
2241 2242 2243
		/* Non fragmented */
		BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);

2244
		skb_queue_tail(queue, skb);
L
Linus Torvalds 已提交
2245 2246 2247 2248 2249 2250 2251
	} else {
		/* Fragmented */
		BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);

		skb_shinfo(skb)->frag_list = NULL;

		/* Queue all fragments atomically */
2252
		spin_lock(&queue->lock);
L
Linus Torvalds 已提交
2253

2254
		__skb_queue_tail(queue, skb);
2255 2256 2257

		flags &= ~ACL_START;
		flags |= ACL_CONT;
L
Linus Torvalds 已提交
2258 2259
		do {
			skb = list; list = list->next;
2260

L
Linus Torvalds 已提交
2261
			skb->dev = (void *) hdev;
2262
			bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2263
			hci_add_acl_hdr(skb, conn->handle, flags);
L
Linus Torvalds 已提交
2264 2265 2266

			BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);

2267
			__skb_queue_tail(queue, skb);
L
Linus Torvalds 已提交
2268 2269
		} while (list);

2270
		spin_unlock(&queue->lock);
L
Linus Torvalds 已提交
2271
	}
2272 2273 2274 2275
}

void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
{
2276
	struct hci_dev *hdev = chan->conn->hdev;
2277

2278
	BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
2279 2280 2281

	skb->dev = (void *) hdev;

2282
	hci_queue_acl(chan, &chan->data_q, skb, flags);
L
Linus Torvalds 已提交
2283

2284
	queue_work(hdev->workqueue, &hdev->tx_work);
L
Linus Torvalds 已提交
2285 2286 2287
}

/* Send SCO data */
2288
void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
L
Linus Torvalds 已提交
2289 2290 2291 2292 2293 2294
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_sco_hdr hdr;

	BT_DBG("%s len %d", hdev->name, skb->len);

2295
	hdr.handle = cpu_to_le16(conn->handle);
L
Linus Torvalds 已提交
2296 2297
	hdr.dlen   = skb->len;

2298 2299
	skb_push(skb, HCI_SCO_HDR_SIZE);
	skb_reset_transport_header(skb);
2300
	memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
L
Linus Torvalds 已提交
2301 2302

	skb->dev = (void *) hdev;
2303
	bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2304

L
Linus Torvalds 已提交
2305
	skb_queue_tail(&conn->data_q, skb);
2306
	queue_work(hdev->workqueue, &hdev->tx_work);
L
Linus Torvalds 已提交
2307 2308 2309 2310 2311
}

/* ---- HCI TX task (outgoing data) ---- */

/* HCI Connection scheduler */
2312 2313
static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
				     int *quote)
L
Linus Torvalds 已提交
2314 2315
{
	struct hci_conn_hash *h = &hdev->conn_hash;
2316
	struct hci_conn *conn = NULL, *c;
2317
	unsigned int num = 0, min = ~0;
L
Linus Torvalds 已提交
2318

2319
	/* We don't have to lock device here. Connections are always
L
Linus Torvalds 已提交
2320
	 * added and removed with TX task disabled. */
2321 2322 2323 2324

	rcu_read_lock();

	list_for_each_entry_rcu(c, &h->list, list) {
2325
		if (c->type != type || skb_queue_empty(&c->data_q))
L
Linus Torvalds 已提交
2326
			continue;
2327 2328 2329 2330

		if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
			continue;

L
Linus Torvalds 已提交
2331 2332 2333 2334 2335 2336
		num++;

		if (c->sent < min) {
			min  = c->sent;
			conn = c;
		}
2337 2338 2339

		if (hci_conn_num(hdev, type) == num)
			break;
L
Linus Torvalds 已提交
2340 2341
	}

2342 2343
	rcu_read_unlock();

L
Linus Torvalds 已提交
2344
	if (conn) {
2345 2346 2347 2348 2349 2350 2351 2352 2353 2354 2355 2356 2357 2358 2359 2360 2361 2362 2363
		int cnt, q;

		switch (conn->type) {
		case ACL_LINK:
			cnt = hdev->acl_cnt;
			break;
		case SCO_LINK:
		case ESCO_LINK:
			cnt = hdev->sco_cnt;
			break;
		case LE_LINK:
			cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
			break;
		default:
			cnt = 0;
			BT_ERR("Unknown link type");
		}

		q = cnt / num;
L
Linus Torvalds 已提交
2364 2365 2366 2367 2368 2369 2370 2371
		*quote = q ? q : 1;
	} else
		*quote = 0;

	BT_DBG("conn %p quote %d", conn, *quote);
	return conn;
}

2372
static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
L
Linus Torvalds 已提交
2373 2374
{
	struct hci_conn_hash *h = &hdev->conn_hash;
2375
	struct hci_conn *c;
L
Linus Torvalds 已提交
2376

2377
	BT_ERR("%s link tx timeout", hdev->name);
L
Linus Torvalds 已提交
2378

2379 2380
	rcu_read_lock();

L
Linus Torvalds 已提交
2381
	/* Kill stalled connections */
2382
	list_for_each_entry_rcu(c, &h->list, list) {
2383
		if (c->type == type && c->sent) {
2384 2385
			BT_ERR("%s killing stalled connection %pMR",
			       hdev->name, &c->dst);
2386
			hci_acl_disconn(c, HCI_ERROR_REMOTE_USER_TERM);
L
Linus Torvalds 已提交
2387 2388
		}
	}
2389 2390

	rcu_read_unlock();
L
Linus Torvalds 已提交
2391 2392
}

2393 2394
static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
				      int *quote)
L
Linus Torvalds 已提交
2395
{
2396 2397
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct hci_chan *chan = NULL;
2398
	unsigned int num = 0, min = ~0, cur_prio = 0;
L
Linus Torvalds 已提交
2399
	struct hci_conn *conn;
2400 2401 2402 2403
	int cnt, q, conn_num = 0;

	BT_DBG("%s", hdev->name);

2404 2405 2406
	rcu_read_lock();

	list_for_each_entry_rcu(conn, &h->list, list) {
2407 2408 2409 2410 2411 2412 2413 2414 2415 2416
		struct hci_chan *tmp;

		if (conn->type != type)
			continue;

		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
			continue;

		conn_num++;

2417
		list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2418 2419 2420 2421 2422 2423 2424 2425 2426 2427 2428 2429 2430 2431 2432 2433 2434 2435 2436 2437 2438 2439 2440 2441 2442 2443 2444
			struct sk_buff *skb;

			if (skb_queue_empty(&tmp->data_q))
				continue;

			skb = skb_peek(&tmp->data_q);
			if (skb->priority < cur_prio)
				continue;

			if (skb->priority > cur_prio) {
				num = 0;
				min = ~0;
				cur_prio = skb->priority;
			}

			num++;

			if (conn->sent < min) {
				min  = conn->sent;
				chan = tmp;
			}
		}

		if (hci_conn_num(hdev, type) == conn_num)
			break;
	}

2445 2446
	rcu_read_unlock();

2447 2448 2449 2450 2451 2452 2453
	if (!chan)
		return NULL;

	switch (chan->conn->type) {
	case ACL_LINK:
		cnt = hdev->acl_cnt;
		break;
2454 2455 2456
	case AMP_LINK:
		cnt = hdev->block_cnt;
		break;
2457 2458 2459 2460 2461 2462 2463 2464 2465 2466 2467 2468 2469 2470 2471 2472 2473 2474
	case SCO_LINK:
	case ESCO_LINK:
		cnt = hdev->sco_cnt;
		break;
	case LE_LINK:
		cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
		break;
	default:
		cnt = 0;
		BT_ERR("Unknown link type");
	}

	q = cnt / num;
	*quote = q ? q : 1;
	BT_DBG("chan %p quote %d", chan, *quote);
	return chan;
}

2475 2476 2477 2478 2479 2480 2481 2482
static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct hci_conn *conn;
	int num = 0;

	BT_DBG("%s", hdev->name);

2483 2484 2485
	rcu_read_lock();

	list_for_each_entry_rcu(conn, &h->list, list) {
2486 2487 2488 2489 2490 2491 2492 2493 2494 2495
		struct hci_chan *chan;

		if (conn->type != type)
			continue;

		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
			continue;

		num++;

2496
		list_for_each_entry_rcu(chan, &conn->chan_list, list) {
2497 2498 2499 2500 2501 2502 2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513
			struct sk_buff *skb;

			if (chan->sent) {
				chan->sent = 0;
				continue;
			}

			if (skb_queue_empty(&chan->data_q))
				continue;

			skb = skb_peek(&chan->data_q);
			if (skb->priority >= HCI_PRIO_MAX - 1)
				continue;

			skb->priority = HCI_PRIO_MAX - 1;

			BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2514
			       skb->priority);
2515 2516 2517 2518 2519
		}

		if (hci_conn_num(hdev, type) == num)
			break;
	}
2520 2521 2522

	rcu_read_unlock();

2523 2524
}

2525 2526 2527 2528 2529 2530
static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
{
	/* Calculate count of blocks used by this packet */
	return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
}

2531
static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
2532
{
L
Linus Torvalds 已提交
2533 2534 2535
	if (!test_bit(HCI_RAW, &hdev->flags)) {
		/* ACL tx timeout must be longer than maximum
		 * link supervision timeout (40.9 seconds) */
2536
		if (!cnt && time_after(jiffies, hdev->acl_last_tx +
2537
				       HCI_ACL_TX_TIMEOUT))
2538
			hci_link_tx_to(hdev, ACL_LINK);
L
Linus Torvalds 已提交
2539
	}
2540
}
L
Linus Torvalds 已提交
2541

2542
static void hci_sched_acl_pkt(struct hci_dev *hdev)
2543 2544 2545 2546 2547 2548 2549
{
	unsigned int cnt = hdev->acl_cnt;
	struct hci_chan *chan;
	struct sk_buff *skb;
	int quote;

	__check_timeout(hdev, cnt);
2550

2551
	while (hdev->acl_cnt &&
2552
	       (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2553 2554
		u32 priority = (skb_peek(&chan->data_q))->priority;
		while (quote-- && (skb = skb_peek(&chan->data_q))) {
2555
			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2556
			       skb->len, skb->priority);
2557

2558 2559 2560 2561 2562 2563
			/* Stop if priority has changed */
			if (skb->priority < priority)
				break;

			skb = skb_dequeue(&chan->data_q);

2564
			hci_conn_enter_active_mode(chan->conn,
2565
						   bt_cb(skb)->force_active);
2566

L
Linus Torvalds 已提交
2567 2568 2569 2570
			hci_send_frame(skb);
			hdev->acl_last_tx = jiffies;

			hdev->acl_cnt--;
2571 2572
			chan->sent++;
			chan->conn->sent++;
L
Linus Torvalds 已提交
2573 2574
		}
	}
2575 2576 2577

	if (cnt != hdev->acl_cnt)
		hci_prio_recalculate(hdev, ACL_LINK);
L
Linus Torvalds 已提交
2578 2579
}

2580
static void hci_sched_acl_blk(struct hci_dev *hdev)
2581
{
2582
	unsigned int cnt = hdev->block_cnt;
2583 2584 2585
	struct hci_chan *chan;
	struct sk_buff *skb;
	int quote;
2586
	u8 type;
2587

2588
	__check_timeout(hdev, cnt);
2589

2590 2591 2592 2593 2594 2595 2596
	BT_DBG("%s", hdev->name);

	if (hdev->dev_type == HCI_AMP)
		type = AMP_LINK;
	else
		type = ACL_LINK;

2597
	while (hdev->block_cnt > 0 &&
2598
	       (chan = hci_chan_sent(hdev, type, &quote))) {
2599 2600 2601 2602 2603
		u32 priority = (skb_peek(&chan->data_q))->priority;
		while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
			int blocks;

			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2604
			       skb->len, skb->priority);
2605 2606 2607 2608 2609 2610 2611 2612 2613 2614 2615 2616

			/* Stop if priority has changed */
			if (skb->priority < priority)
				break;

			skb = skb_dequeue(&chan->data_q);

			blocks = __get_blocks(hdev, skb);
			if (blocks > hdev->block_cnt)
				return;

			hci_conn_enter_active_mode(chan->conn,
2617
						   bt_cb(skb)->force_active);
2618 2619 2620 2621 2622 2623 2624 2625 2626 2627 2628 2629 2630

			hci_send_frame(skb);
			hdev->acl_last_tx = jiffies;

			hdev->block_cnt -= blocks;
			quote -= blocks;

			chan->sent += blocks;
			chan->conn->sent += blocks;
		}
	}

	if (cnt != hdev->block_cnt)
2631
		hci_prio_recalculate(hdev, type);
2632 2633
}

2634
static void hci_sched_acl(struct hci_dev *hdev)
2635 2636 2637
{
	BT_DBG("%s", hdev->name);

2638 2639 2640 2641 2642 2643
	/* No ACL link over BR/EDR controller */
	if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
		return;

	/* No AMP link over AMP controller */
	if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
2644 2645 2646 2647 2648 2649 2650 2651 2652 2653 2654 2655 2656
		return;

	switch (hdev->flow_ctl_mode) {
	case HCI_FLOW_CTL_MODE_PACKET_BASED:
		hci_sched_acl_pkt(hdev);
		break;

	case HCI_FLOW_CTL_MODE_BLOCK_BASED:
		hci_sched_acl_blk(hdev);
		break;
	}
}

L
Linus Torvalds 已提交
2657
/* Schedule SCO */
2658
static void hci_sched_sco(struct hci_dev *hdev)
L
Linus Torvalds 已提交
2659 2660 2661 2662 2663 2664 2665
{
	struct hci_conn *conn;
	struct sk_buff *skb;
	int quote;

	BT_DBG("%s", hdev->name);

2666 2667 2668
	if (!hci_conn_num(hdev, SCO_LINK))
		return;

L
Linus Torvalds 已提交
2669 2670 2671 2672 2673 2674 2675 2676 2677 2678 2679 2680
	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
			BT_DBG("skb %p len %d", skb, skb->len);
			hci_send_frame(skb);

			conn->sent++;
			if (conn->sent == ~0)
				conn->sent = 0;
		}
	}
}

2681
static void hci_sched_esco(struct hci_dev *hdev)
2682 2683 2684 2685 2686 2687 2688
{
	struct hci_conn *conn;
	struct sk_buff *skb;
	int quote;

	BT_DBG("%s", hdev->name);

2689 2690 2691
	if (!hci_conn_num(hdev, ESCO_LINK))
		return;

2692 2693
	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
						     &quote))) {
2694 2695 2696 2697 2698 2699 2700 2701 2702 2703 2704
		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
			BT_DBG("skb %p len %d", skb, skb->len);
			hci_send_frame(skb);

			conn->sent++;
			if (conn->sent == ~0)
				conn->sent = 0;
		}
	}
}

2705
static void hci_sched_le(struct hci_dev *hdev)
2706
{
2707
	struct hci_chan *chan;
2708
	struct sk_buff *skb;
2709
	int quote, cnt, tmp;
2710 2711 2712

	BT_DBG("%s", hdev->name);

2713 2714 2715
	if (!hci_conn_num(hdev, LE_LINK))
		return;

2716 2717 2718
	if (!test_bit(HCI_RAW, &hdev->flags)) {
		/* LE tx timeout must be longer than maximum
		 * link supervision timeout (40.9 seconds) */
2719
		if (!hdev->le_cnt && hdev->le_pkts &&
2720
		    time_after(jiffies, hdev->le_last_tx + HZ * 45))
2721
			hci_link_tx_to(hdev, LE_LINK);
2722 2723 2724
	}

	cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2725
	tmp = cnt;
2726
	while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
2727 2728
		u32 priority = (skb_peek(&chan->data_q))->priority;
		while (quote-- && (skb = skb_peek(&chan->data_q))) {
2729
			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2730
			       skb->len, skb->priority);
2731

2732 2733 2734 2735 2736 2737
			/* Stop if priority has changed */
			if (skb->priority < priority)
				break;

			skb = skb_dequeue(&chan->data_q);

2738 2739 2740 2741
			hci_send_frame(skb);
			hdev->le_last_tx = jiffies;

			cnt--;
2742 2743
			chan->sent++;
			chan->conn->sent++;
2744 2745
		}
	}
2746

2747 2748 2749 2750
	if (hdev->le_pkts)
		hdev->le_cnt = cnt;
	else
		hdev->acl_cnt = cnt;
2751 2752 2753

	if (cnt != tmp)
		hci_prio_recalculate(hdev, LE_LINK);
2754 2755
}

2756
static void hci_tx_work(struct work_struct *work)
L
Linus Torvalds 已提交
2757
{
2758
	struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
L
Linus Torvalds 已提交
2759 2760
	struct sk_buff *skb;

2761
	BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2762
	       hdev->sco_cnt, hdev->le_cnt);
L
Linus Torvalds 已提交
2763 2764 2765 2766 2767 2768 2769

	/* Schedule queues and send stuff to HCI driver */

	hci_sched_acl(hdev);

	hci_sched_sco(hdev);

2770 2771
	hci_sched_esco(hdev);

2772 2773
	hci_sched_le(hdev);

L
Linus Torvalds 已提交
2774 2775 2776 2777 2778
	/* Send next queued raw (unknown type) packet */
	while ((skb = skb_dequeue(&hdev->raw_q)))
		hci_send_frame(skb);
}

L
Lucas De Marchi 已提交
2779
/* ----- HCI RX task (incoming data processing) ----- */
L
Linus Torvalds 已提交
2780 2781

/* ACL data packet */
2782
static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
2783 2784 2785 2786 2787 2788 2789 2790 2791 2792 2793
{
	struct hci_acl_hdr *hdr = (void *) skb->data;
	struct hci_conn *conn;
	__u16 handle, flags;

	skb_pull(skb, HCI_ACL_HDR_SIZE);

	handle = __le16_to_cpu(hdr->handle);
	flags  = hci_flags(handle);
	handle = hci_handle(handle);

2794
	BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
2795
	       handle, flags);
L
Linus Torvalds 已提交
2796 2797 2798 2799 2800 2801

	hdev->stat.acl_rx++;

	hci_dev_lock(hdev);
	conn = hci_conn_hash_lookup_handle(hdev, handle);
	hci_dev_unlock(hdev);
2802

L
Linus Torvalds 已提交
2803
	if (conn) {
2804
		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
2805

2806 2807 2808 2809 2810 2811 2812 2813
		hci_dev_lock(hdev);
		if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
		    !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
			mgmt_device_connected(hdev, &conn->dst, conn->type,
					      conn->dst_type, 0, NULL, 0,
					      conn->dev_class);
		hci_dev_unlock(hdev);

L
Linus Torvalds 已提交
2814
		/* Send to upper protocol */
2815 2816
		l2cap_recv_acldata(conn, skb, flags);
		return;
L
Linus Torvalds 已提交
2817
	} else {
2818
		BT_ERR("%s ACL packet for unknown connection handle %d",
2819
		       hdev->name, handle);
L
Linus Torvalds 已提交
2820 2821 2822 2823 2824 2825
	}

	kfree_skb(skb);
}

/* SCO data packet */
2826
static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
2827 2828 2829 2830 2831 2832 2833 2834 2835
{
	struct hci_sco_hdr *hdr = (void *) skb->data;
	struct hci_conn *conn;
	__u16 handle;

	skb_pull(skb, HCI_SCO_HDR_SIZE);

	handle = __le16_to_cpu(hdr->handle);

2836
	BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
L
Linus Torvalds 已提交
2837 2838 2839 2840 2841 2842 2843 2844 2845

	hdev->stat.sco_rx++;

	hci_dev_lock(hdev);
	conn = hci_conn_hash_lookup_handle(hdev, handle);
	hci_dev_unlock(hdev);

	if (conn) {
		/* Send to upper protocol */
2846 2847
		sco_recv_scodata(conn, skb);
		return;
L
Linus Torvalds 已提交
2848
	} else {
2849
		BT_ERR("%s SCO packet for unknown connection handle %d",
2850
		       hdev->name, handle);
L
Linus Torvalds 已提交
2851 2852 2853 2854 2855
	}

	kfree_skb(skb);
}

2856
static void hci_rx_work(struct work_struct *work)
L
Linus Torvalds 已提交
2857
{
2858
	struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
L
Linus Torvalds 已提交
2859 2860 2861 2862 2863
	struct sk_buff *skb;

	BT_DBG("%s", hdev->name);

	while ((skb = skb_dequeue(&hdev->rx_q))) {
2864 2865 2866
		/* Send copy to monitor */
		hci_send_to_monitor(hdev, skb);

L
Linus Torvalds 已提交
2867 2868
		if (atomic_read(&hdev->promisc)) {
			/* Send copy to the sockets */
2869
			hci_send_to_sock(hdev, skb);
L
Linus Torvalds 已提交
2870 2871 2872 2873 2874 2875 2876 2877 2878
		}

		if (test_bit(HCI_RAW, &hdev->flags)) {
			kfree_skb(skb);
			continue;
		}

		if (test_bit(HCI_INIT, &hdev->flags)) {
			/* Don't process data packets in this states. */
2879
			switch (bt_cb(skb)->pkt_type) {
L
Linus Torvalds 已提交
2880 2881 2882 2883
			case HCI_ACLDATA_PKT:
			case HCI_SCODATA_PKT:
				kfree_skb(skb);
				continue;
2884
			}
L
Linus Torvalds 已提交
2885 2886 2887
		}

		/* Process frame */
2888
		switch (bt_cb(skb)->pkt_type) {
L
Linus Torvalds 已提交
2889
		case HCI_EVENT_PKT:
2890
			BT_DBG("%s Event packet", hdev->name);
L
Linus Torvalds 已提交
2891 2892 2893 2894 2895 2896 2897 2898 2899 2900 2901 2902 2903 2904 2905 2906 2907 2908 2909 2910
			hci_event_packet(hdev, skb);
			break;

		case HCI_ACLDATA_PKT:
			BT_DBG("%s ACL data packet", hdev->name);
			hci_acldata_packet(hdev, skb);
			break;

		case HCI_SCODATA_PKT:
			BT_DBG("%s SCO data packet", hdev->name);
			hci_scodata_packet(hdev, skb);
			break;

		default:
			kfree_skb(skb);
			break;
		}
	}
}

2911
static void hci_cmd_work(struct work_struct *work)
L
Linus Torvalds 已提交
2912
{
2913
	struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
L
Linus Torvalds 已提交
2914 2915
	struct sk_buff *skb;

2916 2917
	BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
	       atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
L
Linus Torvalds 已提交
2918 2919

	/* Send queued commands */
2920 2921 2922 2923 2924
	if (atomic_read(&hdev->cmd_cnt)) {
		skb = skb_dequeue(&hdev->cmd_q);
		if (!skb)
			return;

2925
		kfree_skb(hdev->sent_cmd);
L
Linus Torvalds 已提交
2926

A
Andrei Emeltchenko 已提交
2927 2928
		hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
		if (hdev->sent_cmd) {
L
Linus Torvalds 已提交
2929 2930
			atomic_dec(&hdev->cmd_cnt);
			hci_send_frame(skb);
2931 2932 2933 2934
			if (test_bit(HCI_RESET, &hdev->flags))
				del_timer(&hdev->cmd_timer);
			else
				mod_timer(&hdev->cmd_timer,
2935
					  jiffies + HCI_CMD_TIMEOUT);
L
Linus Torvalds 已提交
2936 2937
		} else {
			skb_queue_head(&hdev->cmd_q, skb);
2938
			queue_work(hdev->workqueue, &hdev->cmd_work);
L
Linus Torvalds 已提交
2939 2940 2941
		}
	}
}
A
Andre Guedes 已提交
2942 2943 2944 2945 2946 2947 2948 2949 2950 2951 2952 2953

int hci_do_inquiry(struct hci_dev *hdev, u8 length)
{
	/* General inquiry access code (GIAC) */
	u8 lap[3] = { 0x33, 0x8b, 0x9e };
	struct hci_cp_inquiry cp;

	BT_DBG("%s", hdev->name);

	if (test_bit(HCI_INQUIRY, &hdev->flags))
		return -EINPROGRESS;

2954 2955
	inquiry_cache_flush(hdev);

A
Andre Guedes 已提交
2956 2957 2958 2959 2960 2961
	memset(&cp, 0, sizeof(cp));
	memcpy(&cp.lap, lap, sizeof(cp.lap));
	cp.length  = length;

	return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
}
2962 2963 2964 2965 2966 2967

int hci_cancel_inquiry(struct hci_dev *hdev)
{
	BT_DBG("%s", hdev->name);

	if (!test_bit(HCI_INQUIRY, &hdev->flags))
2968
		return -EALREADY;
2969 2970 2971

	return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
}
2972 2973 2974 2975 2976 2977 2978 2979 2980 2981 2982 2983

u8 bdaddr_to_le(u8 bdaddr_type)
{
	switch (bdaddr_type) {
	case BDADDR_LE_PUBLIC:
		return ADDR_LE_DEV_PUBLIC;

	default:
		/* Fallback to LE Random address type */
		return ADDR_LE_DEV_RANDOM;
	}
}