?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
ARM: EXYNOS: add support uart for EXYNOS4 and EXYNOS5
[linux-2.6/libata-dev.git] / net / bluetooth / hci_core.c
blob5aeb62491198b193b26e7b5e2c46a90b089bf848
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2011 ProFUSION Embedded Systems
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth HCI core. */
27
28 #include <linux/jiffies.h>
29 #include <linux/module.h>
30 #include <linux/kmod.h>
31
32 #include <linux/types.h>
33 #include <linux/errno.h>
34 #include <linux/kernel.h>
35 #include <linux/sched.h>
36 #include <linux/slab.h>
37 #include <linux/poll.h>
38 #include <linux/fcntl.h>
39 #include <linux/init.h>
40 #include <linux/skbuff.h>
41 #include <linux/workqueue.h>
42 #include <linux/interrupt.h>
43 #include <linux/notifier.h>
44 #include <linux/rfkill.h>
45 #include <linux/timer.h>
46 #include <linux/crypto.h>
47 #include <net/sock.h>
48
49 #include <asm/system.h>
50 #include <linux/uaccess.h>
51 #include <asm/unaligned.h>
52
53 #include <net/bluetooth/bluetooth.h>
54 #include <net/bluetooth/hci_core.h>
55
56 #define AUTO_OFF_TIMEOUT 2000
57
58 bool enable_hs;
59
60 static void hci_rx_work(struct work_struct *work);
61 static void hci_cmd_work(struct work_struct *work);
62 static void hci_tx_work(struct work_struct *work);
63
64 /* HCI device list */
65 LIST_HEAD(hci_dev_list);
66 DEFINE_RWLOCK(hci_dev_list_lock);
67
68 /* HCI callback list */
69 LIST_HEAD(hci_cb_list);
70 DEFINE_RWLOCK(hci_cb_list_lock);
71
72 /* HCI notifiers list */
73 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
74
75 /* ---- HCI notifications ---- */
76
77 int hci_register_notifier(struct notifier_block *nb)
78 {
79 return atomic_notifier_chain_register(&hci_notifier, nb);
80 }
81
82 int hci_unregister_notifier(struct notifier_block *nb)
83 {
84 return atomic_notifier_chain_unregister(&hci_notifier, nb);
85 }
86
87 static void hci_notify(struct hci_dev *hdev, int event)
88 {
89 atomic_notifier_call_chain(&hci_notifier, event, hdev);
90 }
91
92 /* ---- HCI requests ---- */
93
94 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
95 {
96 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
97
98 /* If this is the init phase check if the completed command matches
99 * the last init command, and if not just return.
100 */
101 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
102 return;
103
104 if (hdev->req_status == HCI_REQ_PEND) {
105 hdev->req_result = result;
106 hdev->req_status = HCI_REQ_DONE;
107 wake_up_interruptible(&hdev->req_wait_q);
108 }
109 }
110
111 static void hci_req_cancel(struct hci_dev *hdev, int err)
112 {
113 BT_DBG("%s err 0x%2.2x", hdev->name, err);
114
115 if (hdev->req_status == HCI_REQ_PEND) {
116 hdev->req_result = err;
117 hdev->req_status = HCI_REQ_CANCELED;
118 wake_up_interruptible(&hdev->req_wait_q);
119 }
120 }
121
122 /* Execute request and wait for completion. */
123 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
124 unsigned long opt, __u32 timeout)
125 {
126 DECLARE_WAITQUEUE(wait, current);
127 int err = 0;
128
129 BT_DBG("%s start", hdev->name);
130
131 hdev->req_status = HCI_REQ_PEND;
132
133 add_wait_queue(&hdev->req_wait_q, &wait);
134 set_current_state(TASK_INTERRUPTIBLE);
135
136 req(hdev, opt);
137 schedule_timeout(timeout);
138
139 remove_wait_queue(&hdev->req_wait_q, &wait);
140
141 if (signal_pending(current))
142 return -EINTR;
143
144 switch (hdev->req_status) {
145 case HCI_REQ_DONE:
146 err = -bt_to_errno(hdev->req_result);
147 break;
148
149 case HCI_REQ_CANCELED:
150 err = -hdev->req_result;
151 break;
152
153 default:
154 err = -ETIMEDOUT;
155 break;
156 }
157
158 hdev->req_status = hdev->req_result = 0;
159
160 BT_DBG("%s end: err %d", hdev->name, err);
161
162 return err;
163 }
164
165 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
166 unsigned long opt, __u32 timeout)
167 {
168 int ret;
169
170 if (!test_bit(HCI_UP, &hdev->flags))
171 return -ENETDOWN;
172
173 /* Serialize all requests */
174 hci_req_lock(hdev);
175 ret = __hci_request(hdev, req, opt, timeout);
176 hci_req_unlock(hdev);
177
178 return ret;
179 }
180
181 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
182 {
183 BT_DBG("%s %ld", hdev->name, opt);
184
185 /* Reset device */
186 set_bit(HCI_RESET, &hdev->flags);
187 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
188 }
189
190 static void bredr_init(struct hci_dev *hdev)
191 {
192 struct hci_cp_delete_stored_link_key cp;
193 __le16 param;
194 __u8 flt_type;
195
196 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
197
198 /* Mandatory initialization */
199
200 /* Reset */
201 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
202 set_bit(HCI_RESET, &hdev->flags);
203 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
204 }
205
206 /* Read Local Supported Features */
207 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
208
209 /* Read Local Version */
210 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
211
212 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
213 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
214
215 /* Read BD Address */
216 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
217
218 /* Read Class of Device */
219 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
220
221 /* Read Local Name */
222 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
223
224 /* Read Voice Setting */
225 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
226
227 /* Optional initialization */
228
229 /* Clear Event Filters */
230 flt_type = HCI_FLT_CLEAR_ALL;
231 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
232
233 /* Connection accept timeout ~20 secs */
234 param = cpu_to_le16(0x7d00);
235 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
236
237 bacpy(&cp.bdaddr, BDADDR_ANY);
238 cp.delete_all = 1;
239 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
240 }
241
242 static void amp_init(struct hci_dev *hdev)
243 {
244 hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
245
246 /* Reset */
247 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
248
249 /* Read Local Version */
250 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
251 }
252
253 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
254 {
255 struct sk_buff *skb;
256
257 BT_DBG("%s %ld", hdev->name, opt);
258
259 /* Driver initialization */
260
261 /* Special commands */
262 while ((skb = skb_dequeue(&hdev->driver_init))) {
263 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
264 skb->dev = (void *) hdev;
265
266 skb_queue_tail(&hdev->cmd_q, skb);
267 queue_work(hdev->workqueue, &hdev->cmd_work);
268 }
269 skb_queue_purge(&hdev->driver_init);
270
271 switch (hdev->dev_type) {
272 case HCI_BREDR:
273 bredr_init(hdev);
274 break;
275
276 case HCI_AMP:
277 amp_init(hdev);
278 break;
279
280 default:
281 BT_ERR("Unknown device type %d", hdev->dev_type);
282 break;
283 }
284
285 }
286
287 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
288 {
289 BT_DBG("%s", hdev->name);
290
291 /* Read LE buffer size */
292 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
293 }
294
295 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
296 {
297 __u8 scan = opt;
298
299 BT_DBG("%s %x", hdev->name, scan);
300
301 /* Inquiry and Page scans */
302 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
303 }
304
305 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
306 {
307 __u8 auth = opt;
308
309 BT_DBG("%s %x", hdev->name, auth);
310
311 /* Authentication */
312 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
313 }
314
315 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
316 {
317 __u8 encrypt = opt;
318
319 BT_DBG("%s %x", hdev->name, encrypt);
320
321 /* Encryption */
322 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
323 }
324
325 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
326 {
327 __le16 policy = cpu_to_le16(opt);
328
329 BT_DBG("%s %x", hdev->name, policy);
330
331 /* Default link policy */
332 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
333 }
334
335 /* Get HCI device by index.
336 * Device is held on return. */
337 struct hci_dev *hci_dev_get(int index)
338 {
339 struct hci_dev *hdev = NULL, *d;
340
341 BT_DBG("%d", index);
342
343 if (index < 0)
344 return NULL;
345
346 read_lock(&hci_dev_list_lock);
347 list_for_each_entry(d, &hci_dev_list, list) {
348 if (d->id == index) {
349 hdev = hci_dev_hold(d);
350 break;
351 }
352 }
353 read_unlock(&hci_dev_list_lock);
354 return hdev;
355 }
356
357 /* ---- Inquiry support ---- */
358 static void inquiry_cache_flush(struct hci_dev *hdev)
359 {
360 struct inquiry_cache *cache = &hdev->inq_cache;
361 struct inquiry_entry *next = cache->list, *e;
362
363 BT_DBG("cache %p", cache);
364
365 cache->list = NULL;
366 while ((e = next)) {
367 next = e->next;
368 kfree(e);
369 }
370 }
371
372 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
373 {
374 struct inquiry_cache *cache = &hdev->inq_cache;
375 struct inquiry_entry *e;
376
377 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
378
379 for (e = cache->list; e; e = e->next)
380 if (!bacmp(&e->data.bdaddr, bdaddr))
381 break;
382 return e;
383 }
384
385 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
386 {
387 struct inquiry_cache *cache = &hdev->inq_cache;
388 struct inquiry_entry *ie;
389
390 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
391
392 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
393 if (!ie) {
394 /* Entry not in the cache. Add new one. */
395 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
396 if (!ie)
397 return;
398
399 ie->next = cache->list;
400 cache->list = ie;
401 }
402
403 memcpy(&ie->data, data, sizeof(*data));
404 ie->timestamp = jiffies;
405 cache->timestamp = jiffies;
406 }
407
408 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
409 {
410 struct inquiry_cache *cache = &hdev->inq_cache;
411 struct inquiry_info *info = (struct inquiry_info *) buf;
412 struct inquiry_entry *e;
413 int copied = 0;
414
415 for (e = cache->list; e && copied < num; e = e->next, copied++) {
416 struct inquiry_data *data = &e->data;
417 bacpy(&info->bdaddr, &data->bdaddr);
418 info->pscan_rep_mode = data->pscan_rep_mode;
419 info->pscan_period_mode = data->pscan_period_mode;
420 info->pscan_mode = data->pscan_mode;
421 memcpy(info->dev_class, data->dev_class, 3);
422 info->clock_offset = data->clock_offset;
423 info++;
424 }
425
426 BT_DBG("cache %p, copied %d", cache, copied);
427 return copied;
428 }
429
430 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
431 {
432 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
433 struct hci_cp_inquiry cp;
434
435 BT_DBG("%s", hdev->name);
436
437 if (test_bit(HCI_INQUIRY, &hdev->flags))
438 return;
439
440 /* Start Inquiry */
441 memcpy(&cp.lap, &ir->lap, 3);
442 cp.length = ir->length;
443 cp.num_rsp = ir->num_rsp;
444 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
445 }
446
447 int hci_inquiry(void __user *arg)
448 {
449 __u8 __user *ptr = arg;
450 struct hci_inquiry_req ir;
451 struct hci_dev *hdev;
452 int err = 0, do_inquiry = 0, max_rsp;
453 long timeo;
454 __u8 *buf;
455
456 if (copy_from_user(&ir, ptr, sizeof(ir)))
457 return -EFAULT;
458
459 hdev = hci_dev_get(ir.dev_id);
460 if (!hdev)
461 return -ENODEV;
462
463 hci_dev_lock(hdev);
464 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
465 inquiry_cache_empty(hdev) ||
466 ir.flags & IREQ_CACHE_FLUSH) {
467 inquiry_cache_flush(hdev);
468 do_inquiry = 1;
469 }
470 hci_dev_unlock(hdev);
471
472 timeo = ir.length * msecs_to_jiffies(2000);
473
474 if (do_inquiry) {
475 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
476 if (err < 0)
477 goto done;
478 }
479
480 /* for unlimited number of responses we will use buffer with 255 entries */
481 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
482
483 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
484 * copy it to the user space.
485 */
486 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
487 if (!buf) {
488 err = -ENOMEM;
489 goto done;
490 }
491
492 hci_dev_lock(hdev);
493 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
494 hci_dev_unlock(hdev);
495
496 BT_DBG("num_rsp %d", ir.num_rsp);
497
498 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
499 ptr += sizeof(ir);
500 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
501 ir.num_rsp))
502 err = -EFAULT;
503 } else
504 err = -EFAULT;
505
506 kfree(buf);
507
508 done:
509 hci_dev_put(hdev);
510 return err;
511 }
512
513 /* ---- HCI ioctl helpers ---- */
514
515 int hci_dev_open(__u16 dev)
516 {
517 struct hci_dev *hdev;
518 int ret = 0;
519
520 hdev = hci_dev_get(dev);
521 if (!hdev)
522 return -ENODEV;
523
524 BT_DBG("%s %p", hdev->name, hdev);
525
526 hci_req_lock(hdev);
527
528 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
529 ret = -ERFKILL;
530 goto done;
531 }
532
533 if (test_bit(HCI_UP, &hdev->flags)) {
534 ret = -EALREADY;
535 goto done;
536 }
537
538 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
539 set_bit(HCI_RAW, &hdev->flags);
540
541 /* Treat all non BR/EDR controllers as raw devices if
542 enable_hs is not set */
543 if (hdev->dev_type != HCI_BREDR && !enable_hs)
544 set_bit(HCI_RAW, &hdev->flags);
545
546 if (hdev->open(hdev)) {
547 ret = -EIO;
548 goto done;
549 }
550
551 if (!test_bit(HCI_RAW, &hdev->flags)) {
552 atomic_set(&hdev->cmd_cnt, 1);
553 set_bit(HCI_INIT, &hdev->flags);
554 hdev->init_last_cmd = 0;
555
556 ret = __hci_request(hdev, hci_init_req, 0,
557 msecs_to_jiffies(HCI_INIT_TIMEOUT));
558
559 if (lmp_host_le_capable(hdev))
560 ret = __hci_request(hdev, hci_le_init_req, 0,
561 msecs_to_jiffies(HCI_INIT_TIMEOUT));
562
563 clear_bit(HCI_INIT, &hdev->flags);
564 }
565
566 if (!ret) {
567 hci_dev_hold(hdev);
568 set_bit(HCI_UP, &hdev->flags);
569 hci_notify(hdev, HCI_DEV_UP);
570 if (!test_bit(HCI_SETUP, &hdev->flags)) {
571 hci_dev_lock(hdev);
572 mgmt_powered(hdev, 1);
573 hci_dev_unlock(hdev);
574 }
575 } else {
576 /* Init failed, cleanup */
577 flush_work(&hdev->tx_work);
578 flush_work(&hdev->cmd_work);
579 flush_work(&hdev->rx_work);
580
581 skb_queue_purge(&hdev->cmd_q);
582 skb_queue_purge(&hdev->rx_q);
583
584 if (hdev->flush)
585 hdev->flush(hdev);
586
587 if (hdev->sent_cmd) {
588 kfree_skb(hdev->sent_cmd);
589 hdev->sent_cmd = NULL;
590 }
591
592 hdev->close(hdev);
593 hdev->flags = 0;
594 }
595
596 done:
597 hci_req_unlock(hdev);
598 hci_dev_put(hdev);
599 return ret;
600 }
601
602 static int hci_dev_do_close(struct hci_dev *hdev)
603 {
604 BT_DBG("%s %p", hdev->name, hdev);
605
606 hci_req_cancel(hdev, ENODEV);
607 hci_req_lock(hdev);
608
609 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
610 del_timer_sync(&hdev->cmd_timer);
611 hci_req_unlock(hdev);
612 return 0;
613 }
614
615 /* Flush RX and TX works */
616 flush_work(&hdev->tx_work);
617 flush_work(&hdev->rx_work);
618
619 if (hdev->discov_timeout > 0) {
620 cancel_delayed_work(&hdev->discov_off);
621 hdev->discov_timeout = 0;
622 }
623
624 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
625 cancel_delayed_work(&hdev->power_off);
626
627 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
628 cancel_delayed_work(&hdev->service_cache);
629
630 hci_dev_lock(hdev);
631 inquiry_cache_flush(hdev);
632 hci_conn_hash_flush(hdev);
633 hci_dev_unlock(hdev);
634
635 hci_notify(hdev, HCI_DEV_DOWN);
636
637 if (hdev->flush)
638 hdev->flush(hdev);
639
640 /* Reset device */
641 skb_queue_purge(&hdev->cmd_q);
642 atomic_set(&hdev->cmd_cnt, 1);
643 if (!test_bit(HCI_RAW, &hdev->flags) &&
644 test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
645 set_bit(HCI_INIT, &hdev->flags);
646 __hci_request(hdev, hci_reset_req, 0,
647 msecs_to_jiffies(250));
648 clear_bit(HCI_INIT, &hdev->flags);
649 }
650
651 /* flush cmd work */
652 flush_work(&hdev->cmd_work);
653
654 /* Drop queues */
655 skb_queue_purge(&hdev->rx_q);
656 skb_queue_purge(&hdev->cmd_q);
657 skb_queue_purge(&hdev->raw_q);
658
659 /* Drop last sent command */
660 if (hdev->sent_cmd) {
661 del_timer_sync(&hdev->cmd_timer);
662 kfree_skb(hdev->sent_cmd);
663 hdev->sent_cmd = NULL;
664 }
665
666 /* After this point our queues are empty
667 * and no tasks are scheduled. */
668 hdev->close(hdev);
669
670 hci_dev_lock(hdev);
671 mgmt_powered(hdev, 0);
672 hci_dev_unlock(hdev);
673
674 /* Clear flags */
675 hdev->flags = 0;
676
677 hci_req_unlock(hdev);
678
679 hci_dev_put(hdev);
680 return 0;
681 }
682
683 int hci_dev_close(__u16 dev)
684 {
685 struct hci_dev *hdev;
686 int err;
687
688 hdev = hci_dev_get(dev);
689 if (!hdev)
690 return -ENODEV;
691 err = hci_dev_do_close(hdev);
692 hci_dev_put(hdev);
693 return err;
694 }
695
696 int hci_dev_reset(__u16 dev)
697 {
698 struct hci_dev *hdev;
699 int ret = 0;
700
701 hdev = hci_dev_get(dev);
702 if (!hdev)
703 return -ENODEV;
704
705 hci_req_lock(hdev);
706
707 if (!test_bit(HCI_UP, &hdev->flags))
708 goto done;
709
710 /* Drop queues */
711 skb_queue_purge(&hdev->rx_q);
712 skb_queue_purge(&hdev->cmd_q);
713
714 hci_dev_lock(hdev);
715 inquiry_cache_flush(hdev);
716 hci_conn_hash_flush(hdev);
717 hci_dev_unlock(hdev);
718
719 if (hdev->flush)
720 hdev->flush(hdev);
721
722 atomic_set(&hdev->cmd_cnt, 1);
723 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
724
725 if (!test_bit(HCI_RAW, &hdev->flags))
726 ret = __hci_request(hdev, hci_reset_req, 0,
727 msecs_to_jiffies(HCI_INIT_TIMEOUT));
728
729 done:
730 hci_req_unlock(hdev);
731 hci_dev_put(hdev);
732 return ret;
733 }
734
735 int hci_dev_reset_stat(__u16 dev)
736 {
737 struct hci_dev *hdev;
738 int ret = 0;
739
740 hdev = hci_dev_get(dev);
741 if (!hdev)
742 return -ENODEV;
743
744 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
745
746 hci_dev_put(hdev);
747
748 return ret;
749 }
750
751 int hci_dev_cmd(unsigned int cmd, void __user *arg)
752 {
753 struct hci_dev *hdev;
754 struct hci_dev_req dr;
755 int err = 0;
756
757 if (copy_from_user(&dr, arg, sizeof(dr)))
758 return -EFAULT;
759
760 hdev = hci_dev_get(dr.dev_id);
761 if (!hdev)
762 return -ENODEV;
763
764 switch (cmd) {
765 case HCISETAUTH:
766 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
767 msecs_to_jiffies(HCI_INIT_TIMEOUT));
768 break;
769
770 case HCISETENCRYPT:
771 if (!lmp_encrypt_capable(hdev)) {
772 err = -EOPNOTSUPP;
773 break;
774 }
775
776 if (!test_bit(HCI_AUTH, &hdev->flags)) {
777 /* Auth must be enabled first */
778 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
779 msecs_to_jiffies(HCI_INIT_TIMEOUT));
780 if (err)
781 break;
782 }
783
784 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
785 msecs_to_jiffies(HCI_INIT_TIMEOUT));
786 break;
787
788 case HCISETSCAN:
789 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
790 msecs_to_jiffies(HCI_INIT_TIMEOUT));
791 break;
792
793 case HCISETLINKPOL:
794 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
795 msecs_to_jiffies(HCI_INIT_TIMEOUT));
796 break;
797
798 case HCISETLINKMODE:
799 hdev->link_mode = ((__u16) dr.dev_opt) &
800 (HCI_LM_MASTER | HCI_LM_ACCEPT);
801 break;
802
803 case HCISETPTYPE:
804 hdev->pkt_type = (__u16) dr.dev_opt;
805 break;
806
807 case HCISETACLMTU:
808 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
809 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
810 break;
811
812 case HCISETSCOMTU:
813 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
814 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
815 break;
816
817 default:
818 err = -EINVAL;
819 break;
820 }
821
822 hci_dev_put(hdev);
823 return err;
824 }
825
826 int hci_get_dev_list(void __user *arg)
827 {
828 struct hci_dev *hdev;
829 struct hci_dev_list_req *dl;
830 struct hci_dev_req *dr;
831 int n = 0, size, err;
832 __u16 dev_num;
833
834 if (get_user(dev_num, (__u16 __user *) arg))
835 return -EFAULT;
836
837 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
838 return -EINVAL;
839
840 size = sizeof(*dl) + dev_num * sizeof(*dr);
841
842 dl = kzalloc(size, GFP_KERNEL);
843 if (!dl)
844 return -ENOMEM;
845
846 dr = dl->dev_req;
847
848 read_lock(&hci_dev_list_lock);
849 list_for_each_entry(hdev, &hci_dev_list, list) {
850 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
851 cancel_delayed_work(&hdev->power_off);
852
853 if (!test_bit(HCI_MGMT, &hdev->flags))
854 set_bit(HCI_PAIRABLE, &hdev->flags);
855
856 (dr + n)->dev_id = hdev->id;
857 (dr + n)->dev_opt = hdev->flags;
858
859 if (++n >= dev_num)
860 break;
861 }
862 read_unlock(&hci_dev_list_lock);
863
864 dl->dev_num = n;
865 size = sizeof(*dl) + n * sizeof(*dr);
866
867 err = copy_to_user(arg, dl, size);
868 kfree(dl);
869
870 return err ? -EFAULT : 0;
871 }
872
873 int hci_get_dev_info(void __user *arg)
874 {
875 struct hci_dev *hdev;
876 struct hci_dev_info di;
877 int err = 0;
878
879 if (copy_from_user(&di, arg, sizeof(di)))
880 return -EFAULT;
881
882 hdev = hci_dev_get(di.dev_id);
883 if (!hdev)
884 return -ENODEV;
885
886 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
887 cancel_delayed_work_sync(&hdev->power_off);
888
889 if (!test_bit(HCI_MGMT, &hdev->flags))
890 set_bit(HCI_PAIRABLE, &hdev->flags);
891
892 strcpy(di.name, hdev->name);
893 di.bdaddr = hdev->bdaddr;
894 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
895 di.flags = hdev->flags;
896 di.pkt_type = hdev->pkt_type;
897 di.acl_mtu = hdev->acl_mtu;
898 di.acl_pkts = hdev->acl_pkts;
899 di.sco_mtu = hdev->sco_mtu;
900 di.sco_pkts = hdev->sco_pkts;
901 di.link_policy = hdev->link_policy;
902 di.link_mode = hdev->link_mode;
903
904 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
905 memcpy(&di.features, &hdev->features, sizeof(di.features));
906
907 if (copy_to_user(arg, &di, sizeof(di)))
908 err = -EFAULT;
909
910 hci_dev_put(hdev);
911
912 return err;
913 }
914
915 /* ---- Interface to HCI drivers ---- */
916
917 static int hci_rfkill_set_block(void *data, bool blocked)
918 {
919 struct hci_dev *hdev = data;
920
921 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
922
923 if (!blocked)
924 return 0;
925
926 hci_dev_do_close(hdev);
927
928 return 0;
929 }
930
931 static const struct rfkill_ops hci_rfkill_ops = {
932 .set_block = hci_rfkill_set_block,
933 };
934
935 /* Alloc HCI device */
936 struct hci_dev *hci_alloc_dev(void)
937 {
938 struct hci_dev *hdev;
939
940 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
941 if (!hdev)
942 return NULL;
943
944 hci_init_sysfs(hdev);
945 skb_queue_head_init(&hdev->driver_init);
946
947 return hdev;
948 }
949 EXPORT_SYMBOL(hci_alloc_dev);
950
951 /* Free HCI device */
952 void hci_free_dev(struct hci_dev *hdev)
953 {
954 skb_queue_purge(&hdev->driver_init);
955
956 /* will free via device release */
957 put_device(&hdev->dev);
958 }
959 EXPORT_SYMBOL(hci_free_dev);
960
961 static void hci_power_on(struct work_struct *work)
962 {
963 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
964
965 BT_DBG("%s", hdev->name);
966
967 if (hci_dev_open(hdev->id) < 0)
968 return;
969
970 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
971 schedule_delayed_work(&hdev->power_off,
972 msecs_to_jiffies(AUTO_OFF_TIMEOUT));
973
974 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
975 mgmt_index_added(hdev);
976 }
977
978 static void hci_power_off(struct work_struct *work)
979 {
980 struct hci_dev *hdev = container_of(work, struct hci_dev,
981 power_off.work);
982
983 BT_DBG("%s", hdev->name);
984
985 clear_bit(HCI_AUTO_OFF, &hdev->flags);
986
987 hci_dev_close(hdev->id);
988 }
989
990 static void hci_discov_off(struct work_struct *work)
991 {
992 struct hci_dev *hdev;
993 u8 scan = SCAN_PAGE;
994
995 hdev = container_of(work, struct hci_dev, discov_off.work);
996
997 BT_DBG("%s", hdev->name);
998
999 hci_dev_lock(hdev);
1000
1001 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1002
1003 hdev->discov_timeout = 0;
1004
1005 hci_dev_unlock(hdev);
1006 }
1007
1008 int hci_uuids_clear(struct hci_dev *hdev)
1009 {
1010 struct list_head *p, *n;
1011
1012 list_for_each_safe(p, n, &hdev->uuids) {
1013 struct bt_uuid *uuid;
1014
1015 uuid = list_entry(p, struct bt_uuid, list);
1016
1017 list_del(p);
1018 kfree(uuid);
1019 }
1020
1021 return 0;
1022 }
1023
1024 int hci_link_keys_clear(struct hci_dev *hdev)
1025 {
1026 struct list_head *p, *n;
1027
1028 list_for_each_safe(p, n, &hdev->link_keys) {
1029 struct link_key *key;
1030
1031 key = list_entry(p, struct link_key, list);
1032
1033 list_del(p);
1034 kfree(key);
1035 }
1036
1037 return 0;
1038 }
1039
1040 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1041 {
1042 struct link_key *k;
1043
1044 list_for_each_entry(k, &hdev->link_keys, list)
1045 if (bacmp(bdaddr, &k->bdaddr) == 0)
1046 return k;
1047
1048 return NULL;
1049 }
1050
1051 static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1052 u8 key_type, u8 old_key_type)
1053 {
1054 /* Legacy key */
1055 if (key_type < 0x03)
1056 return 1;
1057
1058 /* Debug keys are insecure so don't store them persistently */
1059 if (key_type == HCI_LK_DEBUG_COMBINATION)
1060 return 0;
1061
1062 /* Changed combination key and there's no previous one */
1063 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1064 return 0;
1065
1066 /* Security mode 3 case */
1067 if (!conn)
1068 return 1;
1069
1070 /* Neither local nor remote side had no-bonding as requirement */
1071 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1072 return 1;
1073
1074 /* Local side had dedicated bonding as requirement */
1075 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1076 return 1;
1077
1078 /* Remote side had dedicated bonding as requirement */
1079 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1080 return 1;
1081
1082 /* If none of the above criteria match, then don't store the key
1083 * persistently */
1084 return 0;
1085 }
1086
1087 struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1088 {
1089 struct link_key *k;
1090
1091 list_for_each_entry(k, &hdev->link_keys, list) {
1092 struct key_master_id *id;
1093
1094 if (k->type != HCI_LK_SMP_LTK)
1095 continue;
1096
1097 if (k->dlen != sizeof(*id))
1098 continue;
1099
1100 id = (void *) &k->data;
1101 if (id->ediv == ediv &&
1102 (memcmp(rand, id->rand, sizeof(id->rand)) == 0))
1103 return k;
1104 }
1105
1106 return NULL;
1107 }
1108 EXPORT_SYMBOL(hci_find_ltk);
1109
1110 struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
1111 bdaddr_t *bdaddr, u8 type)
1112 {
1113 struct link_key *k;
1114
1115 list_for_each_entry(k, &hdev->link_keys, list)
1116 if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
1117 return k;
1118
1119 return NULL;
1120 }
1121 EXPORT_SYMBOL(hci_find_link_key_type);
1122
1123 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1124 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1125 {
1126 struct link_key *key, *old_key;
1127 u8 old_key_type, persistent;
1128
1129 old_key = hci_find_link_key(hdev, bdaddr);
1130 if (old_key) {
1131 old_key_type = old_key->type;
1132 key = old_key;
1133 } else {
1134 old_key_type = conn ? conn->key_type : 0xff;
1135 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1136 if (!key)
1137 return -ENOMEM;
1138 list_add(&key->list, &hdev->link_keys);
1139 }
1140
1141 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1142
1143 /* Some buggy controller combinations generate a changed
1144 * combination key for legacy pairing even when there's no
1145 * previous key */
1146 if (type == HCI_LK_CHANGED_COMBINATION &&
1147 (!conn || conn->remote_auth == 0xff) &&
1148 old_key_type == 0xff) {
1149 type = HCI_LK_COMBINATION;
1150 if (conn)
1151 conn->key_type = type;
1152 }
1153
1154 bacpy(&key->bdaddr, bdaddr);
1155 memcpy(key->val, val, 16);
1156 key->pin_len = pin_len;
1157
1158 if (type == HCI_LK_CHANGED_COMBINATION)
1159 key->type = old_key_type;
1160 else
1161 key->type = type;
1162
1163 if (!new_key)
1164 return 0;
1165
1166 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1167
1168 mgmt_new_link_key(hdev, key, persistent);
1169
1170 if (!persistent) {
1171 list_del(&key->list);
1172 kfree(key);
1173 }
1174
1175 return 0;
1176 }
1177
1178 int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
1179 u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
1180 {
1181 struct link_key *key, *old_key;
1182 struct key_master_id *id;
1183 u8 old_key_type;
1184
1185 BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
1186
1187 old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
1188 if (old_key) {
1189 key = old_key;
1190 old_key_type = old_key->type;
1191 } else {
1192 key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
1193 if (!key)
1194 return -ENOMEM;
1195 list_add(&key->list, &hdev->link_keys);
1196 old_key_type = 0xff;
1197 }
1198
1199 key->dlen = sizeof(*id);
1200
1201 bacpy(&key->bdaddr, bdaddr);
1202 memcpy(key->val, ltk, sizeof(key->val));
1203 key->type = HCI_LK_SMP_LTK;
1204 key->pin_len = key_size;
1205
1206 id = (void *) &key->data;
1207 id->ediv = ediv;
1208 memcpy(id->rand, rand, sizeof(id->rand));
1209
1210 if (new_key)
1211 mgmt_new_link_key(hdev, key, old_key_type);
1212
1213 return 0;
1214 }
1215
1216 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1217 {
1218 struct link_key *key;
1219
1220 key = hci_find_link_key(hdev, bdaddr);
1221 if (!key)
1222 return -ENOENT;
1223
1224 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1225
1226 list_del(&key->list);
1227 kfree(key);
1228
1229 return 0;
1230 }
1231
1232 /* HCI command timer function */
1233 static void hci_cmd_timer(unsigned long arg)
1234 {
1235 struct hci_dev *hdev = (void *) arg;
1236
1237 BT_ERR("%s command tx timeout", hdev->name);
1238 atomic_set(&hdev->cmd_cnt, 1);
1239 queue_work(hdev->workqueue, &hdev->cmd_work);
1240 }
1241
1242 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1243 bdaddr_t *bdaddr)
1244 {
1245 struct oob_data *data;
1246
1247 list_for_each_entry(data, &hdev->remote_oob_data, list)
1248 if (bacmp(bdaddr, &data->bdaddr) == 0)
1249 return data;
1250
1251 return NULL;
1252 }
1253
1254 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1255 {
1256 struct oob_data *data;
1257
1258 data = hci_find_remote_oob_data(hdev, bdaddr);
1259 if (!data)
1260 return -ENOENT;
1261
1262 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1263
1264 list_del(&data->list);
1265 kfree(data);
1266
1267 return 0;
1268 }
1269
1270 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1271 {
1272 struct oob_data *data, *n;
1273
1274 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1275 list_del(&data->list);
1276 kfree(data);
1277 }
1278
1279 return 0;
1280 }
1281
1282 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1283 u8 *randomizer)
1284 {
1285 struct oob_data *data;
1286
1287 data = hci_find_remote_oob_data(hdev, bdaddr);
1288
1289 if (!data) {
1290 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1291 if (!data)
1292 return -ENOMEM;
1293
1294 bacpy(&data->bdaddr, bdaddr);
1295 list_add(&data->list, &hdev->remote_oob_data);
1296 }
1297
1298 memcpy(data->hash, hash, sizeof(data->hash));
1299 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1300
1301 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1302
1303 return 0;
1304 }
1305
1306 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1307 bdaddr_t *bdaddr)
1308 {
1309 struct bdaddr_list *b;
1310
1311 list_for_each_entry(b, &hdev->blacklist, list)
1312 if (bacmp(bdaddr, &b->bdaddr) == 0)
1313 return b;
1314
1315 return NULL;
1316 }
1317
1318 int hci_blacklist_clear(struct hci_dev *hdev)
1319 {
1320 struct list_head *p, *n;
1321
1322 list_for_each_safe(p, n, &hdev->blacklist) {
1323 struct bdaddr_list *b;
1324
1325 b = list_entry(p, struct bdaddr_list, list);
1326
1327 list_del(p);
1328 kfree(b);
1329 }
1330
1331 return 0;
1332 }
1333
1334 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1335 {
1336 struct bdaddr_list *entry;
1337
1338 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1339 return -EBADF;
1340
1341 if (hci_blacklist_lookup(hdev, bdaddr))
1342 return -EEXIST;
1343
1344 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1345 if (!entry)
1346 return -ENOMEM;
1347
1348 bacpy(&entry->bdaddr, bdaddr);
1349
1350 list_add(&entry->list, &hdev->blacklist);
1351
1352 return mgmt_device_blocked(hdev, bdaddr);
1353 }
1354
1355 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1356 {
1357 struct bdaddr_list *entry;
1358
1359 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1360 return hci_blacklist_clear(hdev);
1361
1362 entry = hci_blacklist_lookup(hdev, bdaddr);
1363 if (!entry)
1364 return -ENOENT;
1365
1366 list_del(&entry->list);
1367 kfree(entry);
1368
1369 return mgmt_device_unblocked(hdev, bdaddr);
1370 }
1371
1372 static void hci_clear_adv_cache(struct work_struct *work)
1373 {
1374 struct hci_dev *hdev = container_of(work, struct hci_dev,
1375 adv_work.work);
1376
1377 hci_dev_lock(hdev);
1378
1379 hci_adv_entries_clear(hdev);
1380
1381 hci_dev_unlock(hdev);
1382 }
1383
1384 int hci_adv_entries_clear(struct hci_dev *hdev)
1385 {
1386 struct adv_entry *entry, *tmp;
1387
1388 list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1389 list_del(&entry->list);
1390 kfree(entry);
1391 }
1392
1393 BT_DBG("%s adv cache cleared", hdev->name);
1394
1395 return 0;
1396 }
1397
1398 struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1399 {
1400 struct adv_entry *entry;
1401
1402 list_for_each_entry(entry, &hdev->adv_entries, list)
1403 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1404 return entry;
1405
1406 return NULL;
1407 }
1408
1409 static inline int is_connectable_adv(u8 evt_type)
1410 {
1411 if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1412 return 1;
1413
1414 return 0;
1415 }
1416
1417 int hci_add_adv_entry(struct hci_dev *hdev,
1418 struct hci_ev_le_advertising_info *ev)
1419 {
1420 struct adv_entry *entry;
1421
1422 if (!is_connectable_adv(ev->evt_type))
1423 return -EINVAL;
1424
1425 /* Only new entries should be added to adv_entries. So, if
1426 * bdaddr was found, don't add it. */
1427 if (hci_find_adv_entry(hdev, &ev->bdaddr))
1428 return 0;
1429
1430 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1431 if (!entry)
1432 return -ENOMEM;
1433
1434 bacpy(&entry->bdaddr, &ev->bdaddr);
1435 entry->bdaddr_type = ev->bdaddr_type;
1436
1437 list_add(&entry->list, &hdev->adv_entries);
1438
1439 BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1440 batostr(&entry->bdaddr), entry->bdaddr_type);
1441
1442 return 0;
1443 }
1444
1445 /* Register HCI device */
1446 int hci_register_dev(struct hci_dev *hdev)
1447 {
1448 struct list_head *head = &hci_dev_list, *p;
1449 int i, id, error;
1450
1451 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1452 hdev->bus, hdev->owner);
1453
1454 if (!hdev->open || !hdev->close || !hdev->destruct)
1455 return -EINVAL;
1456
1457 /* Do not allow HCI_AMP devices to register at index 0,
1458 * so the index can be used as the AMP controller ID.
1459 */
1460 id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
1461
1462 write_lock(&hci_dev_list_lock);
1463
1464 /* Find first available device id */
1465 list_for_each(p, &hci_dev_list) {
1466 if (list_entry(p, struct hci_dev, list)->id != id)
1467 break;
1468 head = p; id++;
1469 }
1470
1471 sprintf(hdev->name, "hci%d", id);
1472 hdev->id = id;
1473 list_add_tail(&hdev->list, head);
1474
1475 atomic_set(&hdev->refcnt, 1);
1476 mutex_init(&hdev->lock);
1477
1478 hdev->flags = 0;
1479 hdev->dev_flags = 0;
1480 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1481 hdev->esco_type = (ESCO_HV1);
1482 hdev->link_mode = (HCI_LM_ACCEPT);
1483 hdev->io_capability = 0x03; /* No Input No Output */
1484
1485 hdev->idle_timeout = 0;
1486 hdev->sniff_max_interval = 800;
1487 hdev->sniff_min_interval = 80;
1488
1489 INIT_WORK(&hdev->rx_work, hci_rx_work);
1490 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
1491 INIT_WORK(&hdev->tx_work, hci_tx_work);
1492
1493
1494 skb_queue_head_init(&hdev->rx_q);
1495 skb_queue_head_init(&hdev->cmd_q);
1496 skb_queue_head_init(&hdev->raw_q);
1497
1498 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1499
1500 for (i = 0; i < NUM_REASSEMBLY; i++)
1501 hdev->reassembly[i] = NULL;
1502
1503 init_waitqueue_head(&hdev->req_wait_q);
1504 mutex_init(&hdev->req_lock);
1505
1506 inquiry_cache_init(hdev);
1507
1508 hci_conn_hash_init(hdev);
1509
1510 INIT_LIST_HEAD(&hdev->mgmt_pending);
1511
1512 INIT_LIST_HEAD(&hdev->blacklist);
1513
1514 INIT_LIST_HEAD(&hdev->uuids);
1515
1516 INIT_LIST_HEAD(&hdev->link_keys);
1517
1518 INIT_LIST_HEAD(&hdev->remote_oob_data);
1519
1520 INIT_LIST_HEAD(&hdev->adv_entries);
1521
1522 INIT_DELAYED_WORK(&hdev->adv_work, hci_clear_adv_cache);
1523 INIT_WORK(&hdev->power_on, hci_power_on);
1524 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
1525
1526 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1527
1528 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1529
1530 atomic_set(&hdev->promisc, 0);
1531
1532 write_unlock(&hci_dev_list_lock);
1533
1534 hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
1535 WQ_MEM_RECLAIM, 1);
1536 if (!hdev->workqueue) {
1537 error = -ENOMEM;
1538 goto err;
1539 }
1540
1541 error = hci_add_sysfs(hdev);
1542 if (error < 0)
1543 goto err_wqueue;
1544
1545 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1546 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1547 if (hdev->rfkill) {
1548 if (rfkill_register(hdev->rfkill) < 0) {
1549 rfkill_destroy(hdev->rfkill);
1550 hdev->rfkill = NULL;
1551 }
1552 }
1553
1554 set_bit(HCI_AUTO_OFF, &hdev->flags);
1555 set_bit(HCI_SETUP, &hdev->flags);
1556 schedule_work(&hdev->power_on);
1557
1558 hci_notify(hdev, HCI_DEV_REG);
1559
1560 return id;
1561
1562 err_wqueue:
1563 destroy_workqueue(hdev->workqueue);
1564 err:
1565 write_lock(&hci_dev_list_lock);
1566 list_del(&hdev->list);
1567 write_unlock(&hci_dev_list_lock);
1568
1569 return error;
1570 }
1571 EXPORT_SYMBOL(hci_register_dev);
1572
1573 /* Unregister HCI device */
1574 void hci_unregister_dev(struct hci_dev *hdev)
1575 {
1576 int i;
1577
1578 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1579
1580 write_lock(&hci_dev_list_lock);
1581 list_del(&hdev->list);
1582 write_unlock(&hci_dev_list_lock);
1583
1584 hci_dev_do_close(hdev);
1585
1586 for (i = 0; i < NUM_REASSEMBLY; i++)
1587 kfree_skb(hdev->reassembly[i]);
1588
1589 if (!test_bit(HCI_INIT, &hdev->flags) &&
1590 !test_bit(HCI_SETUP, &hdev->flags)) {
1591 hci_dev_lock(hdev);
1592 mgmt_index_removed(hdev);
1593 hci_dev_unlock(hdev);
1594 }
1595
1596 /* mgmt_index_removed should take care of emptying the
1597 * pending list */
1598 BUG_ON(!list_empty(&hdev->mgmt_pending));
1599
1600 hci_notify(hdev, HCI_DEV_UNREG);
1601
1602 if (hdev->rfkill) {
1603 rfkill_unregister(hdev->rfkill);
1604 rfkill_destroy(hdev->rfkill);
1605 }
1606
1607 hci_del_sysfs(hdev);
1608
1609 cancel_delayed_work_sync(&hdev->adv_work);
1610
1611 destroy_workqueue(hdev->workqueue);
1612
1613 hci_dev_lock(hdev);
1614 hci_blacklist_clear(hdev);
1615 hci_uuids_clear(hdev);
1616 hci_link_keys_clear(hdev);
1617 hci_remote_oob_data_clear(hdev);
1618 hci_adv_entries_clear(hdev);
1619 hci_dev_unlock(hdev);
1620
1621 __hci_dev_put(hdev);
1622 }
1623 EXPORT_SYMBOL(hci_unregister_dev);
1624
1625 /* Suspend HCI device */
1626 int hci_suspend_dev(struct hci_dev *hdev)
1627 {
1628 hci_notify(hdev, HCI_DEV_SUSPEND);
1629 return 0;
1630 }
1631 EXPORT_SYMBOL(hci_suspend_dev);
1632
1633 /* Resume HCI device */
1634 int hci_resume_dev(struct hci_dev *hdev)
1635 {
1636 hci_notify(hdev, HCI_DEV_RESUME);
1637 return 0;
1638 }
1639 EXPORT_SYMBOL(hci_resume_dev);
1640
1641 /* Receive frame from HCI drivers */
1642 int hci_recv_frame(struct sk_buff *skb)
1643 {
1644 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1645 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1646 && !test_bit(HCI_INIT, &hdev->flags))) {
1647 kfree_skb(skb);
1648 return -ENXIO;
1649 }
1650
1651 /* Incomming skb */
1652 bt_cb(skb)->incoming = 1;
1653
1654 /* Time stamp */
1655 __net_timestamp(skb);
1656
1657 skb_queue_tail(&hdev->rx_q, skb);
1658 queue_work(hdev->workqueue, &hdev->rx_work);
1659
1660 return 0;
1661 }
1662 EXPORT_SYMBOL(hci_recv_frame);
1663
1664 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1665 int count, __u8 index)
1666 {
1667 int len = 0;
1668 int hlen = 0;
1669 int remain = count;
1670 struct sk_buff *skb;
1671 struct bt_skb_cb *scb;
1672
1673 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1674 index >= NUM_REASSEMBLY)
1675 return -EILSEQ;
1676
1677 skb = hdev->reassembly[index];
1678
1679 if (!skb) {
1680 switch (type) {
1681 case HCI_ACLDATA_PKT:
1682 len = HCI_MAX_FRAME_SIZE;
1683 hlen = HCI_ACL_HDR_SIZE;
1684 break;
1685 case HCI_EVENT_PKT:
1686 len = HCI_MAX_EVENT_SIZE;
1687 hlen = HCI_EVENT_HDR_SIZE;
1688 break;
1689 case HCI_SCODATA_PKT:
1690 len = HCI_MAX_SCO_SIZE;
1691 hlen = HCI_SCO_HDR_SIZE;
1692 break;
1693 }
1694
1695 skb = bt_skb_alloc(len, GFP_ATOMIC);
1696 if (!skb)
1697 return -ENOMEM;
1698
1699 scb = (void *) skb->cb;
1700 scb->expect = hlen;
1701 scb->pkt_type = type;
1702
1703 skb->dev = (void *) hdev;
1704 hdev->reassembly[index] = skb;
1705 }
1706
1707 while (count) {
1708 scb = (void *) skb->cb;
1709 len = min(scb->expect, (__u16)count);
1710
1711 memcpy(skb_put(skb, len), data, len);
1712
1713 count -= len;
1714 data += len;
1715 scb->expect -= len;
1716 remain = count;
1717
1718 switch (type) {
1719 case HCI_EVENT_PKT:
1720 if (skb->len == HCI_EVENT_HDR_SIZE) {
1721 struct hci_event_hdr *h = hci_event_hdr(skb);
1722 scb->expect = h->plen;
1723
1724 if (skb_tailroom(skb) < scb->expect) {
1725 kfree_skb(skb);
1726 hdev->reassembly[index] = NULL;
1727 return -ENOMEM;
1728 }
1729 }
1730 break;
1731
1732 case HCI_ACLDATA_PKT:
1733 if (skb->len == HCI_ACL_HDR_SIZE) {
1734 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1735 scb->expect = __le16_to_cpu(h->dlen);
1736
1737 if (skb_tailroom(skb) < scb->expect) {
1738 kfree_skb(skb);
1739 hdev->reassembly[index] = NULL;
1740 return -ENOMEM;
1741 }
1742 }
1743 break;
1744
1745 case HCI_SCODATA_PKT:
1746 if (skb->len == HCI_SCO_HDR_SIZE) {
1747 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1748 scb->expect = h->dlen;
1749
1750 if (skb_tailroom(skb) < scb->expect) {
1751 kfree_skb(skb);
1752 hdev->reassembly[index] = NULL;
1753 return -ENOMEM;
1754 }
1755 }
1756 break;
1757 }
1758
1759 if (scb->expect == 0) {
1760 /* Complete frame */
1761
1762 bt_cb(skb)->pkt_type = type;
1763 hci_recv_frame(skb);
1764
1765 hdev->reassembly[index] = NULL;
1766 return remain;
1767 }
1768 }
1769
1770 return remain;
1771 }
1772
1773 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1774 {
1775 int rem = 0;
1776
1777 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1778 return -EILSEQ;
1779
1780 while (count) {
1781 rem = hci_reassembly(hdev, type, data, count, type - 1);
1782 if (rem < 0)
1783 return rem;
1784
1785 data += (count - rem);
1786 count = rem;
1787 }
1788
1789 return rem;
1790 }
1791 EXPORT_SYMBOL(hci_recv_fragment);
1792
1793 #define STREAM_REASSEMBLY 0
1794
1795 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1796 {
1797 int type;
1798 int rem = 0;
1799
1800 while (count) {
1801 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1802
1803 if (!skb) {
1804 struct { char type; } *pkt;
1805
1806 /* Start of the frame */
1807 pkt = data;
1808 type = pkt->type;
1809
1810 data++;
1811 count--;
1812 } else
1813 type = bt_cb(skb)->pkt_type;
1814
1815 rem = hci_reassembly(hdev, type, data, count,
1816 STREAM_REASSEMBLY);
1817 if (rem < 0)
1818 return rem;
1819
1820 data += (count - rem);
1821 count = rem;
1822 }
1823
1824 return rem;
1825 }
1826 EXPORT_SYMBOL(hci_recv_stream_fragment);
1827
1828 /* ---- Interface to upper protocols ---- */
1829
1830 int hci_register_cb(struct hci_cb *cb)
1831 {
1832 BT_DBG("%p name %s", cb, cb->name);
1833
1834 write_lock(&hci_cb_list_lock);
1835 list_add(&cb->list, &hci_cb_list);
1836 write_unlock(&hci_cb_list_lock);
1837
1838 return 0;
1839 }
1840 EXPORT_SYMBOL(hci_register_cb);
1841
1842 int hci_unregister_cb(struct hci_cb *cb)
1843 {
1844 BT_DBG("%p name %s", cb, cb->name);
1845
1846 write_lock(&hci_cb_list_lock);
1847 list_del(&cb->list);
1848 write_unlock(&hci_cb_list_lock);
1849
1850 return 0;
1851 }
1852 EXPORT_SYMBOL(hci_unregister_cb);
1853
1854 static int hci_send_frame(struct sk_buff *skb)
1855 {
1856 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1857
1858 if (!hdev) {
1859 kfree_skb(skb);
1860 return -ENODEV;
1861 }
1862
1863 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1864
1865 if (atomic_read(&hdev->promisc)) {
1866 /* Time stamp */
1867 __net_timestamp(skb);
1868
1869 hci_send_to_sock(hdev, skb, NULL);
1870 }
1871
1872 /* Get rid of skb owner, prior to sending to the driver. */
1873 skb_orphan(skb);
1874
1875 return hdev->send(skb);
1876 }
1877
1878 /* Send HCI command */
1879 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1880 {
1881 int len = HCI_COMMAND_HDR_SIZE + plen;
1882 struct hci_command_hdr *hdr;
1883 struct sk_buff *skb;
1884
1885 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1886
1887 skb = bt_skb_alloc(len, GFP_ATOMIC);
1888 if (!skb) {
1889 BT_ERR("%s no memory for command", hdev->name);
1890 return -ENOMEM;
1891 }
1892
1893 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1894 hdr->opcode = cpu_to_le16(opcode);
1895 hdr->plen = plen;
1896
1897 if (plen)
1898 memcpy(skb_put(skb, plen), param, plen);
1899
1900 BT_DBG("skb len %d", skb->len);
1901
1902 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1903 skb->dev = (void *) hdev;
1904
1905 if (test_bit(HCI_INIT, &hdev->flags))
1906 hdev->init_last_cmd = opcode;
1907
1908 skb_queue_tail(&hdev->cmd_q, skb);
1909 queue_work(hdev->workqueue, &hdev->cmd_work);
1910
1911 return 0;
1912 }
1913
1914 /* Get data from the previously sent command */
1915 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1916 {
1917 struct hci_command_hdr *hdr;
1918
1919 if (!hdev->sent_cmd)
1920 return NULL;
1921
1922 hdr = (void *) hdev->sent_cmd->data;
1923
1924 if (hdr->opcode != cpu_to_le16(opcode))
1925 return NULL;
1926
1927 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1928
1929 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1930 }
1931
1932 /* Send ACL data */
1933 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1934 {
1935 struct hci_acl_hdr *hdr;
1936 int len = skb->len;
1937
1938 skb_push(skb, HCI_ACL_HDR_SIZE);
1939 skb_reset_transport_header(skb);
1940 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
1941 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1942 hdr->dlen = cpu_to_le16(len);
1943 }
1944
1945 static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
1946 struct sk_buff *skb, __u16 flags)
1947 {
1948 struct hci_dev *hdev = conn->hdev;
1949 struct sk_buff *list;
1950
1951 list = skb_shinfo(skb)->frag_list;
1952 if (!list) {
1953 /* Non fragmented */
1954 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1955
1956 skb_queue_tail(queue, skb);
1957 } else {
1958 /* Fragmented */
1959 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1960
1961 skb_shinfo(skb)->frag_list = NULL;
1962
1963 /* Queue all fragments atomically */
1964 spin_lock(&queue->lock);
1965
1966 __skb_queue_tail(queue, skb);
1967
1968 flags &= ~ACL_START;
1969 flags |= ACL_CONT;
1970 do {
1971 skb = list; list = list->next;
1972
1973 skb->dev = (void *) hdev;
1974 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1975 hci_add_acl_hdr(skb, conn->handle, flags);
1976
1977 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1978
1979 __skb_queue_tail(queue, skb);
1980 } while (list);
1981
1982 spin_unlock(&queue->lock);
1983 }
1984 }
1985
1986 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
1987 {
1988 struct hci_conn *conn = chan->conn;
1989 struct hci_dev *hdev = conn->hdev;
1990
1991 BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
1992
1993 skb->dev = (void *) hdev;
1994 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1995 hci_add_acl_hdr(skb, conn->handle, flags);
1996
1997 hci_queue_acl(conn, &chan->data_q, skb, flags);
1998
1999 queue_work(hdev->workqueue, &hdev->tx_work);
2000 }
2001 EXPORT_SYMBOL(hci_send_acl);
2002
2003 /* Send SCO data */
2004 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2005 {
2006 struct hci_dev *hdev = conn->hdev;
2007 struct hci_sco_hdr hdr;
2008
2009 BT_DBG("%s len %d", hdev->name, skb->len);
2010
2011 hdr.handle = cpu_to_le16(conn->handle);
2012 hdr.dlen = skb->len;
2013
2014 skb_push(skb, HCI_SCO_HDR_SIZE);
2015 skb_reset_transport_header(skb);
2016 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2017
2018 skb->dev = (void *) hdev;
2019 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2020
2021 skb_queue_tail(&conn->data_q, skb);
2022 queue_work(hdev->workqueue, &hdev->tx_work);
2023 }
2024 EXPORT_SYMBOL(hci_send_sco);
2025
2026 /* ---- HCI TX task (outgoing data) ---- */
2027
2028 /* HCI Connection scheduler */
2029 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2030 {
2031 struct hci_conn_hash *h = &hdev->conn_hash;
2032 struct hci_conn *conn = NULL, *c;
2033 int num = 0, min = ~0;
2034
2035 /* We don't have to lock device here. Connections are always
2036 * added and removed with TX task disabled. */
2037
2038 rcu_read_lock();
2039
2040 list_for_each_entry_rcu(c, &h->list, list) {
2041 if (c->type != type || skb_queue_empty(&c->data_q))
2042 continue;
2043
2044 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2045 continue;
2046
2047 num++;
2048
2049 if (c->sent < min) {
2050 min = c->sent;
2051 conn = c;
2052 }
2053
2054 if (hci_conn_num(hdev, type) == num)
2055 break;
2056 }
2057
2058 rcu_read_unlock();
2059
2060 if (conn) {
2061 int cnt, q;
2062
2063 switch (conn->type) {
2064 case ACL_LINK:
2065 cnt = hdev->acl_cnt;
2066 break;
2067 case SCO_LINK:
2068 case ESCO_LINK:
2069 cnt = hdev->sco_cnt;
2070 break;
2071 case LE_LINK:
2072 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2073 break;
2074 default:
2075 cnt = 0;
2076 BT_ERR("Unknown link type");
2077 }
2078
2079 q = cnt / num;
2080 *quote = q ? q : 1;
2081 } else
2082 *quote = 0;
2083
2084 BT_DBG("conn %p quote %d", conn, *quote);
2085 return conn;
2086 }
2087
2088 static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2089 {
2090 struct hci_conn_hash *h = &hdev->conn_hash;
2091 struct hci_conn *c;
2092
2093 BT_ERR("%s link tx timeout", hdev->name);
2094
2095 rcu_read_lock();
2096
2097 /* Kill stalled connections */
2098 list_for_each_entry_rcu(c, &h->list, list) {
2099 if (c->type == type && c->sent) {
2100 BT_ERR("%s killing stalled connection %s",
2101 hdev->name, batostr(&c->dst));
2102 hci_acl_disconn(c, 0x13);
2103 }
2104 }
2105
2106 rcu_read_unlock();
2107 }
2108
2109 static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2110 int *quote)
2111 {
2112 struct hci_conn_hash *h = &hdev->conn_hash;
2113 struct hci_chan *chan = NULL;
2114 int num = 0, min = ~0, cur_prio = 0;
2115 struct hci_conn *conn;
2116 int cnt, q, conn_num = 0;
2117
2118 BT_DBG("%s", hdev->name);
2119
2120 rcu_read_lock();
2121
2122 list_for_each_entry_rcu(conn, &h->list, list) {
2123 struct hci_chan *tmp;
2124
2125 if (conn->type != type)
2126 continue;
2127
2128 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2129 continue;
2130
2131 conn_num++;
2132
2133 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2134 struct sk_buff *skb;
2135
2136 if (skb_queue_empty(&tmp->data_q))
2137 continue;
2138
2139 skb = skb_peek(&tmp->data_q);
2140 if (skb->priority < cur_prio)
2141 continue;
2142
2143 if (skb->priority > cur_prio) {
2144 num = 0;
2145 min = ~0;
2146 cur_prio = skb->priority;
2147 }
2148
2149 num++;
2150
2151 if (conn->sent < min) {
2152 min = conn->sent;
2153 chan = tmp;
2154 }
2155 }
2156
2157 if (hci_conn_num(hdev, type) == conn_num)
2158 break;
2159 }
2160
2161 rcu_read_unlock();
2162
2163 if (!chan)
2164 return NULL;
2165
2166 switch (chan->conn->type) {
2167 case ACL_LINK:
2168 cnt = hdev->acl_cnt;
2169 break;
2170 case SCO_LINK:
2171 case ESCO_LINK:
2172 cnt = hdev->sco_cnt;
2173 break;
2174 case LE_LINK:
2175 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2176 break;
2177 default:
2178 cnt = 0;
2179 BT_ERR("Unknown link type");
2180 }
2181
2182 q = cnt / num;
2183 *quote = q ? q : 1;
2184 BT_DBG("chan %p quote %d", chan, *quote);
2185 return chan;
2186 }
2187
2188 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2189 {
2190 struct hci_conn_hash *h = &hdev->conn_hash;
2191 struct hci_conn *conn;
2192 int num = 0;
2193
2194 BT_DBG("%s", hdev->name);
2195
2196 rcu_read_lock();
2197
2198 list_for_each_entry_rcu(conn, &h->list, list) {
2199 struct hci_chan *chan;
2200
2201 if (conn->type != type)
2202 continue;
2203
2204 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2205 continue;
2206
2207 num++;
2208
2209 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
2210 struct sk_buff *skb;
2211
2212 if (chan->sent) {
2213 chan->sent = 0;
2214 continue;
2215 }
2216
2217 if (skb_queue_empty(&chan->data_q))
2218 continue;
2219
2220 skb = skb_peek(&chan->data_q);
2221 if (skb->priority >= HCI_PRIO_MAX - 1)
2222 continue;
2223
2224 skb->priority = HCI_PRIO_MAX - 1;
2225
2226 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2227 skb->priority);
2228 }
2229
2230 if (hci_conn_num(hdev, type) == num)
2231 break;
2232 }
2233
2234 rcu_read_unlock();
2235
2236 }
2237
2238 static inline void hci_sched_acl(struct hci_dev *hdev)
2239 {
2240 struct hci_chan *chan;
2241 struct sk_buff *skb;
2242 int quote;
2243 unsigned int cnt;
2244
2245 BT_DBG("%s", hdev->name);
2246
2247 if (!hci_conn_num(hdev, ACL_LINK))
2248 return;
2249
2250 if (!test_bit(HCI_RAW, &hdev->flags)) {
2251 /* ACL tx timeout must be longer than maximum
2252 * link supervision timeout (40.9 seconds) */
2253 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
2254 hci_link_tx_to(hdev, ACL_LINK);
2255 }
2256
2257 cnt = hdev->acl_cnt;
2258
2259 while (hdev->acl_cnt &&
2260 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2261 u32 priority = (skb_peek(&chan->data_q))->priority;
2262 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2263 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2264 skb->len, skb->priority);
2265
2266 /* Stop if priority has changed */
2267 if (skb->priority < priority)
2268 break;
2269
2270 skb = skb_dequeue(&chan->data_q);
2271
2272 hci_conn_enter_active_mode(chan->conn,
2273 bt_cb(skb)->force_active);
2274
2275 hci_send_frame(skb);
2276 hdev->acl_last_tx = jiffies;
2277
2278 hdev->acl_cnt--;
2279 chan->sent++;
2280 chan->conn->sent++;
2281 }
2282 }
2283
2284 if (cnt != hdev->acl_cnt)
2285 hci_prio_recalculate(hdev, ACL_LINK);
2286 }
2287
2288 /* Schedule SCO */
2289 static inline void hci_sched_sco(struct hci_dev *hdev)
2290 {
2291 struct hci_conn *conn;
2292 struct sk_buff *skb;
2293 int quote;
2294
2295 BT_DBG("%s", hdev->name);
2296
2297 if (!hci_conn_num(hdev, SCO_LINK))
2298 return;
2299
2300 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2301 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2302 BT_DBG("skb %p len %d", skb, skb->len);
2303 hci_send_frame(skb);
2304
2305 conn->sent++;
2306 if (conn->sent == ~0)
2307 conn->sent = 0;
2308 }
2309 }
2310 }
2311
2312 static inline void hci_sched_esco(struct hci_dev *hdev)
2313 {
2314 struct hci_conn *conn;
2315 struct sk_buff *skb;
2316 int quote;
2317
2318 BT_DBG("%s", hdev->name);
2319
2320 if (!hci_conn_num(hdev, ESCO_LINK))
2321 return;
2322
2323 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2324 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2325 BT_DBG("skb %p len %d", skb, skb->len);
2326 hci_send_frame(skb);
2327
2328 conn->sent++;
2329 if (conn->sent == ~0)
2330 conn->sent = 0;
2331 }
2332 }
2333 }
2334
2335 static inline void hci_sched_le(struct hci_dev *hdev)
2336 {
2337 struct hci_chan *chan;
2338 struct sk_buff *skb;
2339 int quote, cnt, tmp;
2340
2341 BT_DBG("%s", hdev->name);
2342
2343 if (!hci_conn_num(hdev, LE_LINK))
2344 return;
2345
2346 if (!test_bit(HCI_RAW, &hdev->flags)) {
2347 /* LE tx timeout must be longer than maximum
2348 * link supervision timeout (40.9 seconds) */
2349 if (!hdev->le_cnt && hdev->le_pkts &&
2350 time_after(jiffies, hdev->le_last_tx + HZ * 45))
2351 hci_link_tx_to(hdev, LE_LINK);
2352 }
2353
2354 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2355 tmp = cnt;
2356 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
2357 u32 priority = (skb_peek(&chan->data_q))->priority;
2358 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2359 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2360 skb->len, skb->priority);
2361
2362 /* Stop if priority has changed */
2363 if (skb->priority < priority)
2364 break;
2365
2366 skb = skb_dequeue(&chan->data_q);
2367
2368 hci_send_frame(skb);
2369 hdev->le_last_tx = jiffies;
2370
2371 cnt--;
2372 chan->sent++;
2373 chan->conn->sent++;
2374 }
2375 }
2376
2377 if (hdev->le_pkts)
2378 hdev->le_cnt = cnt;
2379 else
2380 hdev->acl_cnt = cnt;
2381
2382 if (cnt != tmp)
2383 hci_prio_recalculate(hdev, LE_LINK);
2384 }
2385
2386 static void hci_tx_work(struct work_struct *work)
2387 {
2388 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
2389 struct sk_buff *skb;
2390
2391 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2392 hdev->sco_cnt, hdev->le_cnt);
2393
2394 /* Schedule queues and send stuff to HCI driver */
2395
2396 hci_sched_acl(hdev);
2397
2398 hci_sched_sco(hdev);
2399
2400 hci_sched_esco(hdev);
2401
2402 hci_sched_le(hdev);
2403
2404 /* Send next queued raw (unknown type) packet */
2405 while ((skb = skb_dequeue(&hdev->raw_q)))
2406 hci_send_frame(skb);
2407 }
2408
2409 /* ----- HCI RX task (incoming data processing) ----- */
2410
2411 /* ACL data packet */
2412 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2413 {
2414 struct hci_acl_hdr *hdr = (void *) skb->data;
2415 struct hci_conn *conn;
2416 __u16 handle, flags;
2417
2418 skb_pull(skb, HCI_ACL_HDR_SIZE);
2419
2420 handle = __le16_to_cpu(hdr->handle);
2421 flags = hci_flags(handle);
2422 handle = hci_handle(handle);
2423
2424 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2425
2426 hdev->stat.acl_rx++;
2427
2428 hci_dev_lock(hdev);
2429 conn = hci_conn_hash_lookup_handle(hdev, handle);
2430 hci_dev_unlock(hdev);
2431
2432 if (conn) {
2433 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
2434
2435 /* Send to upper protocol */
2436 l2cap_recv_acldata(conn, skb, flags);
2437 return;
2438 } else {
2439 BT_ERR("%s ACL packet for unknown connection handle %d",
2440 hdev->name, handle);
2441 }
2442
2443 kfree_skb(skb);
2444 }
2445
2446 /* SCO data packet */
2447 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2448 {
2449 struct hci_sco_hdr *hdr = (void *) skb->data;
2450 struct hci_conn *conn;
2451 __u16 handle;
2452
2453 skb_pull(skb, HCI_SCO_HDR_SIZE);
2454
2455 handle = __le16_to_cpu(hdr->handle);
2456
2457 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2458
2459 hdev->stat.sco_rx++;
2460
2461 hci_dev_lock(hdev);
2462 conn = hci_conn_hash_lookup_handle(hdev, handle);
2463 hci_dev_unlock(hdev);
2464
2465 if (conn) {
2466 /* Send to upper protocol */
2467 sco_recv_scodata(conn, skb);
2468 return;
2469 } else {
2470 BT_ERR("%s SCO packet for unknown connection handle %d",
2471 hdev->name, handle);
2472 }
2473
2474 kfree_skb(skb);
2475 }
2476
2477 static void hci_rx_work(struct work_struct *work)
2478 {
2479 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
2480 struct sk_buff *skb;
2481
2482 BT_DBG("%s", hdev->name);
2483
2484 while ((skb = skb_dequeue(&hdev->rx_q))) {
2485 if (atomic_read(&hdev->promisc)) {
2486 /* Send copy to the sockets */
2487 hci_send_to_sock(hdev, skb, NULL);
2488 }
2489
2490 if (test_bit(HCI_RAW, &hdev->flags)) {
2491 kfree_skb(skb);
2492 continue;
2493 }
2494
2495 if (test_bit(HCI_INIT, &hdev->flags)) {
2496 /* Don't process data packets in this states. */
2497 switch (bt_cb(skb)->pkt_type) {
2498 case HCI_ACLDATA_PKT:
2499 case HCI_SCODATA_PKT:
2500 kfree_skb(skb);
2501 continue;
2502 }
2503 }
2504
2505 /* Process frame */
2506 switch (bt_cb(skb)->pkt_type) {
2507 case HCI_EVENT_PKT:
2508 BT_DBG("%s Event packet", hdev->name);
2509 hci_event_packet(hdev, skb);
2510 break;
2511
2512 case HCI_ACLDATA_PKT:
2513 BT_DBG("%s ACL data packet", hdev->name);
2514 hci_acldata_packet(hdev, skb);
2515 break;
2516
2517 case HCI_SCODATA_PKT:
2518 BT_DBG("%s SCO data packet", hdev->name);
2519 hci_scodata_packet(hdev, skb);
2520 break;
2521
2522 default:
2523 kfree_skb(skb);
2524 break;
2525 }
2526 }
2527 }
2528
2529 static void hci_cmd_work(struct work_struct *work)
2530 {
2531 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
2532 struct sk_buff *skb;
2533
2534 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2535
2536 /* Send queued commands */
2537 if (atomic_read(&hdev->cmd_cnt)) {
2538 skb = skb_dequeue(&hdev->cmd_q);
2539 if (!skb)
2540 return;
2541
2542 kfree_skb(hdev->sent_cmd);
2543
2544 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2545 if (hdev->sent_cmd) {
2546 atomic_dec(&hdev->cmd_cnt);
2547 hci_send_frame(skb);
2548 if (test_bit(HCI_RESET, &hdev->flags))
2549 del_timer(&hdev->cmd_timer);
2550 else
2551 mod_timer(&hdev->cmd_timer,
2552 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2553 } else {
2554 skb_queue_head(&hdev->cmd_q, skb);
2555 queue_work(hdev->workqueue, &hdev->cmd_work);
2556 }
2557 }
2558 }
2559
2560 int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2561 {
2562 /* General inquiry access code (GIAC) */
2563 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2564 struct hci_cp_inquiry cp;
2565
2566 BT_DBG("%s", hdev->name);
2567
2568 if (test_bit(HCI_INQUIRY, &hdev->flags))
2569 return -EINPROGRESS;
2570
2571 memset(&cp, 0, sizeof(cp));
2572 memcpy(&cp.lap, lap, sizeof(cp.lap));
2573 cp.length = length;
2574
2575 return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2576 }
2577
2578 int hci_cancel_inquiry(struct hci_dev *hdev)
2579 {
2580 BT_DBG("%s", hdev->name);
2581
2582 if (!test_bit(HCI_INQUIRY, &hdev->flags))
2583 return -EPERM;
2584
2585 return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2586 }
2587
2588 module_param(enable_hs, bool, 0644);
2589 MODULE_PARM_DESC(enable_hs, "Enable High Speed");
Linux 2.6 libata-dev (mirror)