net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2011 ProFUSION Embedded Systems
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI core. */
  27
  28 #include <linux/jiffies.h>
  29 #include <linux/module.h>
  30 #include <linux/kmod.h>
  31
  32 #include <linux/types.h>
  33 #include <linux/errno.h>
  34 #include <linux/kernel.h>
  35 #include <linux/sched.h>
  36 #include <linux/slab.h>
  37 #include <linux/poll.h>
  38 #include <linux/fcntl.h>
  39 #include <linux/init.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/interrupt.h>
  43 #include <linux/notifier.h>
  44 #include <linux/rfkill.h>
  45 #include <linux/timer.h>
  46 #include <linux/crypto.h>
  47 #include <net/sock.h>
  48
  49 #include <asm/system.h>
  50 #include <linux/uaccess.h>
  51 #include <asm/unaligned.h>
  52
  53 #include <net/bluetooth/bluetooth.h>
  54 #include <net/bluetooth/hci_core.h>
  55
  56 #define AUTO_OFF_TIMEOUT 2000
  57
  58 bool enable_hs;
  59
  60 static void hci_rx_work(struct work_struct *work);
  61 static void hci_cmd_work(struct work_struct *work);
  62 static void hci_tx_work(struct work_struct *work);
  63
  64 /* HCI device list */
  65 LIST_HEAD(hci_dev_list);
  66 DEFINE_RWLOCK(hci_dev_list_lock);
  67
  68 /* HCI callback list */
  69 LIST_HEAD(hci_cb_list);
  70 DEFINE_RWLOCK(hci_cb_list_lock);
  71
  72 /* HCI notifiers list */
  73 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
  74
  75 /* ---- HCI notifications ---- */
  76
  77 int hci_register_notifier(struct notifier_block *nb)
  78 {
  79         return atomic_notifier_chain_register(&hci_notifier, nb);
  80 }
  81
  82 int hci_unregister_notifier(struct notifier_block *nb)
  83 {
  84         return atomic_notifier_chain_unregister(&hci_notifier, nb);
  85 }
  86
  87 static void hci_notify(struct hci_dev *hdev, int event)
  88 {
  89         atomic_notifier_call_chain(&hci_notifier, event, hdev);
  90 }
  91
  92 /* ---- HCI requests ---- */
  93
  94 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
  95 {
  96         BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
  97
  98         /* If this is the init phase check if the completed command matches
  99          * the last init command, and if not just return.
 100          */
 101         if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
 102                 return;
 103
 104         if (hdev->req_status == HCI_REQ_PEND) {
 105                 hdev->req_result = result;
 106                 hdev->req_status = HCI_REQ_DONE;
 107                 wake_up_interruptible(&hdev->req_wait_q);
 108         }
 109 }
 110
 111 static void hci_req_cancel(struct hci_dev *hdev, int err)
 112 {
 113         BT_DBG("%s err 0x%2.2x", hdev->name, err);
 114
 115         if (hdev->req_status == HCI_REQ_PEND) {
 116                 hdev->req_result = err;
 117                 hdev->req_status = HCI_REQ_CANCELED;
 118                 wake_up_interruptible(&hdev->req_wait_q);
 119         }
 120 }
 121
 122 /* Execute request and wait for completion. */
 123 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 124                                         unsigned long opt, __u32 timeout)
 125 {
 126         DECLARE_WAITQUEUE(wait, current);
 127         int err = 0;
 128
 129         BT_DBG("%s start", hdev->name);
 130
 131         hdev->req_status = HCI_REQ_PEND;
 132
 133         add_wait_queue(&hdev->req_wait_q, &wait);
 134         set_current_state(TASK_INTERRUPTIBLE);
 135
 136         req(hdev, opt);
 137         schedule_timeout(timeout);
 138
 139         remove_wait_queue(&hdev->req_wait_q, &wait);
 140
 141         if (signal_pending(current))
 142                 return -EINTR;
 143
 144         switch (hdev->req_status) {
 145         case HCI_REQ_DONE:
 146                 err = -bt_to_errno(hdev->req_result);
 147                 break;
 148
 149         case HCI_REQ_CANCELED:
 150                 err = -hdev->req_result;
 151                 break;
 152
 153         default:
 154                 err = -ETIMEDOUT;
 155                 break;
 156         }
 157
 158         hdev->req_status = hdev->req_result = 0;
 159
 160         BT_DBG("%s end: err %d", hdev->name, err);
 161
 162         return err;
 163 }
 164
 165 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 166                                         unsigned long opt, __u32 timeout)
 167 {
 168         int ret;
 169
 170         if (!test_bit(HCI_UP, &hdev->flags))
 171                 return -ENETDOWN;
 172
 173         /* Serialize all requests */
 174         hci_req_lock(hdev);
 175         ret = __hci_request(hdev, req, opt, timeout);
 176         hci_req_unlock(hdev);
 177
 178         return ret;
 179 }
 180
 181 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
 182 {
 183         BT_DBG("%s %ld", hdev->name, opt);
 184
 185         /* Reset device */
 186         set_bit(HCI_RESET, &hdev->flags);
 187         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 188 }
 189
 190 static void bredr_init(struct hci_dev *hdev)
 191 {
 192         struct hci_cp_delete_stored_link_key cp;
 193         __le16 param;
 194         __u8 flt_type;
 195
 196         hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
 197
 198         /* Mandatory initialization */
 199
 200         /* Reset */
 201         if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
 202                 set_bit(HCI_RESET, &hdev->flags);
 203                 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 204         }
 205
 206         /* Read Local Supported Features */
 207         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 208
 209         /* Read Local Version */
 210         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 211
 212         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 213         hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 214
 215         /* Read BD Address */
 216         hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
 217
 218         /* Read Class of Device */
 219         hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 220
 221         /* Read Local Name */
 222         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 223
 224         /* Read Voice Setting */
 225         hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 226
 227         /* Optional initialization */
 228
 229         /* Clear Event Filters */
 230         flt_type = HCI_FLT_CLEAR_ALL;
 231         hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 232
 233         /* Connection accept timeout ~20 secs */
 234         param = cpu_to_le16(0x7d00);
 235         hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 236
 237         bacpy(&cp.bdaddr, BDADDR_ANY);
 238         cp.delete_all = 1;
 239         hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
 240 }
 241
 242 static void amp_init(struct hci_dev *hdev)
 243 {
 244         hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
 245
 246         /* Reset */
 247         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 248
 249         /* Read Local Version */
 250         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 251 }
 252
 253 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 254 {
 255         struct sk_buff *skb;
 256
 257         BT_DBG("%s %ld", hdev->name, opt);
 258
 259         /* Driver initialization */
 260
 261         /* Special commands */
 262         while ((skb = skb_dequeue(&hdev->driver_init))) {
 263                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
 264                 skb->dev = (void *) hdev;
 265
 266                 skb_queue_tail(&hdev->cmd_q, skb);
 267                 queue_work(hdev->workqueue, &hdev->cmd_work);
 268         }
 269         skb_queue_purge(&hdev->driver_init);
 270
 271         switch (hdev->dev_type) {
 272         case HCI_BREDR:
 273                 bredr_init(hdev);
 274                 break;
 275
 276         case HCI_AMP:
 277                 amp_init(hdev);
 278                 break;
 279
 280         default:
 281                 BT_ERR("Unknown device type %d", hdev->dev_type);
 282                 break;
 283         }
 284
 285 }
 286
 287 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
 288 {
 289         BT_DBG("%s", hdev->name);
 290
 291         /* Read LE buffer size */
 292         hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 293 }
 294
 295 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
 296 {
 297         __u8 scan = opt;
 298
 299         BT_DBG("%s %x", hdev->name, scan);
 300
 301         /* Inquiry and Page scans */
 302         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 303 }
 304
 305 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
 306 {
 307         __u8 auth = opt;
 308
 309         BT_DBG("%s %x", hdev->name, auth);
 310
 311         /* Authentication */
 312         hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 313 }
 314
 315 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
 316 {
 317         __u8 encrypt = opt;
 318
 319         BT_DBG("%s %x", hdev->name, encrypt);
 320
 321         /* Encryption */
 322         hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 323 }
 324
 325 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
 326 {
 327         __le16 policy = cpu_to_le16(opt);
 328
 329         BT_DBG("%s %x", hdev->name, policy);
 330
 331         /* Default link policy */
 332         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 333 }
 334
 335 /* Get HCI device by index.
 336  * Device is held on return. */
 337 struct hci_dev *hci_dev_get(int index)
 338 {
 339         struct hci_dev *hdev = NULL, *d;
 340
 341         BT_DBG("%d", index);
 342
 343         if (index < 0)
 344                 return NULL;
 345
 346         read_lock(&hci_dev_list_lock);
 347         list_for_each_entry(d, &hci_dev_list, list) {
 348                 if (d->id == index) {
 349                         hdev = hci_dev_hold(d);
 350                         break;
 351                 }
 352         }
 353         read_unlock(&hci_dev_list_lock);
 354         return hdev;
 355 }
 356
 357 /* ---- Inquiry support ---- */
 358
 359 bool hci_discovery_active(struct hci_dev *hdev)
 360 {
 361         struct discovery_state *discov = &hdev->discovery;
 362
 363         switch (discov->state) {
 364         case DISCOVERY_INQUIRY:
 365         case DISCOVERY_LE_SCAN:
 366         case DISCOVERY_RESOLVING:
 367                 return true;
 368
 369         default:
 370                 return false;
 371         }
 372 }
 373
 374 void hci_discovery_set_state(struct hci_dev *hdev, int state)
 375 {
 376         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
 377
 378         if (hdev->discovery.state == state)
 379                 return;
 380
 381         switch (state) {
 382         case DISCOVERY_STOPPED:
 383                 mgmt_discovering(hdev, 0);
 384                 break;
 385         case DISCOVERY_STARTING:
 386                 break;
 387         case DISCOVERY_INQUIRY:
 388         case DISCOVERY_LE_SCAN:
 389                 mgmt_discovering(hdev, 1);
 390                 break;
 391         case DISCOVERY_RESOLVING:
 392                 break;
 393         case DISCOVERY_STOPPING:
 394                 break;
 395         }
 396
 397         hdev->discovery.state = state;
 398 }
 399
 400 static void inquiry_cache_flush(struct hci_dev *hdev)
 401 {
 402         struct discovery_state *cache = &hdev->discovery;
 403         struct inquiry_entry *p, *n;
 404
 405         list_for_each_entry_safe(p, n, &cache->all, all) {
 406                 list_del(&p->all);
 407                 kfree(p);
 408         }
 409
 410         INIT_LIST_HEAD(&cache->unknown);
 411         INIT_LIST_HEAD(&cache->resolve);
 412         cache->state = DISCOVERY_STOPPED;
 413 }
 414
 415 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 416 {
 417         struct discovery_state *cache = &hdev->discovery;
 418         struct inquiry_entry *e;
 419
 420         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 421
 422         list_for_each_entry(e, &cache->all, all) {
 423                 if (!bacmp(&e->data.bdaddr, bdaddr))
 424                         return e;
 425         }
 426
 427         return NULL;
 428 }
 429
 430 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
 431                                                         bdaddr_t *bdaddr)
 432 {
 433         struct discovery_state *cache = &hdev->discovery;
 434         struct inquiry_entry *e;
 435
 436         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 437
 438         list_for_each_entry(e, &cache->unknown, list) {
 439                 if (!bacmp(&e->data.bdaddr, bdaddr))
 440                         return e;
 441         }
 442
 443         return NULL;
 444 }
 445
 446 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
 447                                                         bdaddr_t *bdaddr,
 448                                                         int state)
 449 {
 450         struct discovery_state *cache = &hdev->discovery;
 451         struct inquiry_entry *e;
 452
 453         BT_DBG("cache %p bdaddr %s state %d", cache, batostr(bdaddr), state);
 454
 455         list_for_each_entry(e, &cache->resolve, list) {
 456                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
 457                         return e;
 458                 if (!bacmp(&e->data.bdaddr, bdaddr))
 459                         return e;
 460         }
 461
 462         return NULL;
 463 }
 464
 465 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
 466                                                 struct inquiry_entry *ie)
 467 {
 468         struct discovery_state *cache = &hdev->discovery;
 469         struct list_head *pos = &cache->resolve;
 470         struct inquiry_entry *p;
 471
 472         list_del(&ie->list);
 473
 474         list_for_each_entry(p, &cache->resolve, list) {
 475                 if (p->name_state != NAME_PENDING &&
 476                                 abs(p->data.rssi) >= abs(ie->data.rssi))
 477                         break;
 478                 pos = &p->list;
 479         }
 480
 481         list_add(&ie->list, pos);
 482 }
 483
 484 bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
 485                                                         bool name_known)
 486 {
 487         struct discovery_state *cache = &hdev->discovery;
 488         struct inquiry_entry *ie;
 489
 490         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 491
 492         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
 493         if (ie) {
 494                 if (ie->name_state == NAME_NEEDED &&
 495                                                 data->rssi != ie->data.rssi) {
 496                         ie->data.rssi = data->rssi;
 497                         hci_inquiry_cache_update_resolve(hdev, ie);
 498                 }
 499
 500                 goto update;
 501         }
 502
 503         /* Entry not in the cache. Add new one. */
 504         ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
 505         if (!ie)
 506                 return false;
 507
 508         list_add(&ie->all, &cache->all);
 509
 510         if (name_known) {
 511                 ie->name_state = NAME_KNOWN;
 512         } else {
 513                 ie->name_state = NAME_NOT_KNOWN;
 514                 list_add(&ie->list, &cache->unknown);
 515         }
 516
 517 update:
 518         if (name_known && ie->name_state != NAME_KNOWN &&
 519                                         ie->name_state != NAME_PENDING) {
 520                 ie->name_state = NAME_KNOWN;
 521                 list_del(&ie->list);
 522         }
 523
 524         memcpy(&ie->data, data, sizeof(*data));
 525         ie->timestamp = jiffies;
 526         cache->timestamp = jiffies;
 527
 528         if (ie->name_state == NAME_NOT_KNOWN)
 529                 return false;
 530
 531         return true;
 532 }
 533
 534 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 535 {
 536         struct discovery_state *cache = &hdev->discovery;
 537         struct inquiry_info *info = (struct inquiry_info *) buf;
 538         struct inquiry_entry *e;
 539         int copied = 0;
 540
 541         list_for_each_entry(e, &cache->all, all) {
 542                 struct inquiry_data *data = &e->data;
 543
 544                 if (copied >= num)
 545                         break;
 546
 547                 bacpy(&info->bdaddr, &data->bdaddr);
 548                 info->pscan_rep_mode    = data->pscan_rep_mode;
 549                 info->pscan_period_mode = data->pscan_period_mode;
 550                 info->pscan_mode        = data->pscan_mode;
 551                 memcpy(info->dev_class, data->dev_class, 3);
 552                 info->clock_offset      = data->clock_offset;
 553
 554                 info++;
 555                 copied++;
 556         }
 557
 558         BT_DBG("cache %p, copied %d", cache, copied);
 559         return copied;
 560 }
 561
 562 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
 563 {
 564         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
 565         struct hci_cp_inquiry cp;
 566
 567         BT_DBG("%s", hdev->name);
 568
 569         if (test_bit(HCI_INQUIRY, &hdev->flags))
 570                 return;
 571
 572         /* Start Inquiry */
 573         memcpy(&cp.lap, &ir->lap, 3);
 574         cp.length  = ir->length;
 575         cp.num_rsp = ir->num_rsp;
 576         hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
 577 }
 578
 579 int hci_inquiry(void __user *arg)
 580 {
 581         __u8 __user *ptr = arg;
 582         struct hci_inquiry_req ir;
 583         struct hci_dev *hdev;
 584         int err = 0, do_inquiry = 0, max_rsp;
 585         long timeo;
 586         __u8 *buf;
 587
 588         if (copy_from_user(&ir, ptr, sizeof(ir)))
 589                 return -EFAULT;
 590
 591         hdev = hci_dev_get(ir.dev_id);
 592         if (!hdev)
 593                 return -ENODEV;
 594
 595         hci_dev_lock(hdev);
 596         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 597                                 inquiry_cache_empty(hdev) ||
 598                                 ir.flags & IREQ_CACHE_FLUSH) {
 599                 inquiry_cache_flush(hdev);
 600                 do_inquiry = 1;
 601         }
 602         hci_dev_unlock(hdev);
 603
 604         timeo = ir.length * msecs_to_jiffies(2000);
 605
 606         if (do_inquiry) {
 607                 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
 608                 if (err < 0)
 609                         goto done;
 610         }
 611
 612         /* for unlimited number of responses we will use buffer with 255 entries */
 613         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 614
 615         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
 616          * copy it to the user space.
 617          */
 618         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
 619         if (!buf) {
 620                 err = -ENOMEM;
 621                 goto done;
 622         }
 623
 624         hci_dev_lock(hdev);
 625         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
 626         hci_dev_unlock(hdev);
 627
 628         BT_DBG("num_rsp %d", ir.num_rsp);
 629
 630         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
 631                 ptr += sizeof(ir);
 632                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
 633                                         ir.num_rsp))
 634                         err = -EFAULT;
 635         } else
 636                 err = -EFAULT;
 637
 638         kfree(buf);
 639
 640 done:
 641         hci_dev_put(hdev);
 642         return err;
 643 }
 644
 645 /* ---- HCI ioctl helpers ---- */
 646
 647 int hci_dev_open(__u16 dev)
 648 {
 649         struct hci_dev *hdev;
 650         int ret = 0;
 651
 652         hdev = hci_dev_get(dev);
 653         if (!hdev)
 654                 return -ENODEV;
 655
 656         BT_DBG("%s %p", hdev->name, hdev);
 657
 658         hci_req_lock(hdev);
 659
 660         if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
 661                 ret = -ERFKILL;
 662                 goto done;
 663         }
 664
 665         if (test_bit(HCI_UP, &hdev->flags)) {
 666                 ret = -EALREADY;
 667                 goto done;
 668         }
 669
 670         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 671                 set_bit(HCI_RAW, &hdev->flags);
 672
 673         /* Treat all non BR/EDR controllers as raw devices if
 674            enable_hs is not set */
 675         if (hdev->dev_type != HCI_BREDR && !enable_hs)
 676                 set_bit(HCI_RAW, &hdev->flags);
 677
 678         if (hdev->open(hdev)) {
 679                 ret = -EIO;
 680                 goto done;
 681         }
 682
 683         if (!test_bit(HCI_RAW, &hdev->flags)) {
 684                 atomic_set(&hdev->cmd_cnt, 1);
 685                 set_bit(HCI_INIT, &hdev->flags);
 686                 hdev->init_last_cmd = 0;
 687
 688                 ret = __hci_request(hdev, hci_init_req, 0,
 689                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 690
 691                 if (lmp_host_le_capable(hdev))
 692                         ret = __hci_request(hdev, hci_le_init_req, 0,
 693                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 694
 695                 clear_bit(HCI_INIT, &hdev->flags);
 696         }
 697
 698         if (!ret) {
 699                 hci_dev_hold(hdev);
 700                 set_bit(HCI_UP, &hdev->flags);
 701                 hci_notify(hdev, HCI_DEV_UP);
 702                 if (!test_bit(HCI_SETUP, &hdev->dev_flags)) {
 703                         hci_dev_lock(hdev);
 704                         mgmt_powered(hdev, 1);
 705                         hci_dev_unlock(hdev);
 706                 }
 707         } else {
 708                 /* Init failed, cleanup */
 709                 flush_work(&hdev->tx_work);
 710                 flush_work(&hdev->cmd_work);
 711                 flush_work(&hdev->rx_work);
 712
 713                 skb_queue_purge(&hdev->cmd_q);
 714                 skb_queue_purge(&hdev->rx_q);
 715
 716                 if (hdev->flush)
 717                         hdev->flush(hdev);
 718
 719                 if (hdev->sent_cmd) {
 720                         kfree_skb(hdev->sent_cmd);
 721                         hdev->sent_cmd = NULL;
 722                 }
 723
 724                 hdev->close(hdev);
 725                 hdev->flags = 0;
 726         }
 727
 728 done:
 729         hci_req_unlock(hdev);
 730         hci_dev_put(hdev);
 731         return ret;
 732 }
 733
 734 static int hci_dev_do_close(struct hci_dev *hdev)
 735 {
 736         BT_DBG("%s %p", hdev->name, hdev);
 737
 738         cancel_work_sync(&hdev->le_scan);
 739
 740         hci_req_cancel(hdev, ENODEV);
 741         hci_req_lock(hdev);
 742
 743         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 744                 del_timer_sync(&hdev->cmd_timer);
 745                 hci_req_unlock(hdev);
 746                 return 0;
 747         }
 748
 749         /* Flush RX and TX works */
 750         flush_work(&hdev->tx_work);
 751         flush_work(&hdev->rx_work);
 752
 753         if (hdev->discov_timeout > 0) {
 754                 cancel_delayed_work(&hdev->discov_off);
 755                 hdev->discov_timeout = 0;
 756         }
 757
 758         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 759                 cancel_delayed_work(&hdev->power_off);
 760
 761         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 762                 cancel_delayed_work(&hdev->service_cache);
 763
 764         cancel_delayed_work_sync(&hdev->le_scan_disable);
 765
 766         hci_dev_lock(hdev);
 767         inquiry_cache_flush(hdev);
 768         hci_conn_hash_flush(hdev);
 769         hci_dev_unlock(hdev);
 770
 771         hci_notify(hdev, HCI_DEV_DOWN);
 772
 773         if (hdev->flush)
 774                 hdev->flush(hdev);
 775
 776         /* Reset device */
 777         skb_queue_purge(&hdev->cmd_q);
 778         atomic_set(&hdev->cmd_cnt, 1);
 779         if (!test_bit(HCI_RAW, &hdev->flags) &&
 780                                 test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
 781                 set_bit(HCI_INIT, &hdev->flags);
 782                 __hci_request(hdev, hci_reset_req, 0,
 783                                         msecs_to_jiffies(250));
 784                 clear_bit(HCI_INIT, &hdev->flags);
 785         }
 786
 787         /* flush cmd  work */
 788         flush_work(&hdev->cmd_work);
 789
 790         /* Drop queues */
 791         skb_queue_purge(&hdev->rx_q);
 792         skb_queue_purge(&hdev->cmd_q);
 793         skb_queue_purge(&hdev->raw_q);
 794
 795         /* Drop last sent command */
 796         if (hdev->sent_cmd) {
 797                 del_timer_sync(&hdev->cmd_timer);
 798                 kfree_skb(hdev->sent_cmd);
 799                 hdev->sent_cmd = NULL;
 800         }
 801
 802         /* After this point our queues are empty
 803          * and no tasks are scheduled. */
 804         hdev->close(hdev);
 805
 806         hci_dev_lock(hdev);
 807         mgmt_powered(hdev, 0);
 808         hci_dev_unlock(hdev);
 809
 810         /* Clear flags */
 811         hdev->flags = 0;
 812
 813         hci_req_unlock(hdev);
 814
 815         hci_dev_put(hdev);
 816         return 0;
 817 }
 818
 819 int hci_dev_close(__u16 dev)
 820 {
 821         struct hci_dev *hdev;
 822         int err;
 823
 824         hdev = hci_dev_get(dev);
 825         if (!hdev)
 826                 return -ENODEV;
 827         err = hci_dev_do_close(hdev);
 828         hci_dev_put(hdev);
 829         return err;
 830 }
 831
 832 int hci_dev_reset(__u16 dev)
 833 {
 834         struct hci_dev *hdev;
 835         int ret = 0;
 836
 837         hdev = hci_dev_get(dev);
 838         if (!hdev)
 839                 return -ENODEV;
 840
 841         hci_req_lock(hdev);
 842
 843         if (!test_bit(HCI_UP, &hdev->flags))
 844                 goto done;
 845
 846         /* Drop queues */
 847         skb_queue_purge(&hdev->rx_q);
 848         skb_queue_purge(&hdev->cmd_q);
 849
 850         hci_dev_lock(hdev);
 851         inquiry_cache_flush(hdev);
 852         hci_conn_hash_flush(hdev);
 853         hci_dev_unlock(hdev);
 854
 855         if (hdev->flush)
 856                 hdev->flush(hdev);
 857
 858         atomic_set(&hdev->cmd_cnt, 1);
 859         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
 860
 861         if (!test_bit(HCI_RAW, &hdev->flags))
 862                 ret = __hci_request(hdev, hci_reset_req, 0,
 863                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 864
 865 done:
 866         hci_req_unlock(hdev);
 867         hci_dev_put(hdev);
 868         return ret;
 869 }
 870
 871 int hci_dev_reset_stat(__u16 dev)
 872 {
 873         struct hci_dev *hdev;
 874         int ret = 0;
 875
 876         hdev = hci_dev_get(dev);
 877         if (!hdev)
 878                 return -ENODEV;
 879
 880         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 881
 882         hci_dev_put(hdev);
 883
 884         return ret;
 885 }
 886
 887 int hci_dev_cmd(unsigned int cmd, void __user *arg)
 888 {
 889         struct hci_dev *hdev;
 890         struct hci_dev_req dr;
 891         int err = 0;
 892
 893         if (copy_from_user(&dr, arg, sizeof(dr)))
 894                 return -EFAULT;
 895
 896         hdev = hci_dev_get(dr.dev_id);
 897         if (!hdev)
 898                 return -ENODEV;
 899
 900         switch (cmd) {
 901         case HCISETAUTH:
 902                 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 903                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 904                 break;
 905
 906         case HCISETENCRYPT:
 907                 if (!lmp_encrypt_capable(hdev)) {
 908                         err = -EOPNOTSUPP;
 909                         break;
 910                 }
 911
 912                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
 913                         /* Auth must be enabled first */
 914                         err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 915                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 916                         if (err)
 917                                 break;
 918                 }
 919
 920                 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
 921                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 922                 break;
 923
 924         case HCISETSCAN:
 925                 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
 926                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 927                 break;
 928
 929         case HCISETLINKPOL:
 930                 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
 931                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 932                 break;
 933
 934         case HCISETLINKMODE:
 935                 hdev->link_mode = ((__u16) dr.dev_opt) &
 936                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
 937                 break;
 938
 939         case HCISETPTYPE:
 940                 hdev->pkt_type = (__u16) dr.dev_opt;
 941                 break;
 942
 943         case HCISETACLMTU:
 944                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
 945                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
 946                 break;
 947
 948         case HCISETSCOMTU:
 949                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
 950                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
 951                 break;
 952
 953         default:
 954                 err = -EINVAL;
 955                 break;
 956         }
 957
 958         hci_dev_put(hdev);
 959         return err;
 960 }
 961
 962 int hci_get_dev_list(void __user *arg)
 963 {
 964         struct hci_dev *hdev;
 965         struct hci_dev_list_req *dl;
 966         struct hci_dev_req *dr;
 967         int n = 0, size, err;
 968         __u16 dev_num;
 969
 970         if (get_user(dev_num, (__u16 __user *) arg))
 971                 return -EFAULT;
 972
 973         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
 974                 return -EINVAL;
 975
 976         size = sizeof(*dl) + dev_num * sizeof(*dr);
 977
 978         dl = kzalloc(size, GFP_KERNEL);
 979         if (!dl)
 980                 return -ENOMEM;
 981
 982         dr = dl->dev_req;
 983
 984         read_lock(&hci_dev_list_lock);
 985         list_for_each_entry(hdev, &hci_dev_list, list) {
 986                 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 987                         cancel_delayed_work(&hdev->power_off);
 988
 989                 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
 990                         set_bit(HCI_PAIRABLE, &hdev->dev_flags);
 991
 992                 (dr + n)->dev_id  = hdev->id;
 993                 (dr + n)->dev_opt = hdev->flags;
 994
 995                 if (++n >= dev_num)
 996                         break;
 997         }
 998         read_unlock(&hci_dev_list_lock);
 999
1000         dl->dev_num = n;
1001         size = sizeof(*dl) + n * sizeof(*dr);
1002
1003         err = copy_to_user(arg, dl, size);
1004         kfree(dl);
1005
1006         return err ? -EFAULT : 0;
1007 }
1008
1009 int hci_get_dev_info(void __user *arg)
1010 {
1011         struct hci_dev *hdev;
1012         struct hci_dev_info di;
1013         int err = 0;
1014
1015         if (copy_from_user(&di, arg, sizeof(di)))
1016                 return -EFAULT;
1017
1018         hdev = hci_dev_get(di.dev_id);
1019         if (!hdev)
1020                 return -ENODEV;
1021
1022         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1023                 cancel_delayed_work_sync(&hdev->power_off);
1024
1025         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1026                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1027
1028         strcpy(di.name, hdev->name);
1029         di.bdaddr   = hdev->bdaddr;
1030         di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1031         di.flags    = hdev->flags;
1032         di.pkt_type = hdev->pkt_type;
1033         di.acl_mtu  = hdev->acl_mtu;
1034         di.acl_pkts = hdev->acl_pkts;
1035         di.sco_mtu  = hdev->sco_mtu;
1036         di.sco_pkts = hdev->sco_pkts;
1037         di.link_policy = hdev->link_policy;
1038         di.link_mode   = hdev->link_mode;
1039
1040         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1041         memcpy(&di.features, &hdev->features, sizeof(di.features));
1042
1043         if (copy_to_user(arg, &di, sizeof(di)))
1044                 err = -EFAULT;
1045
1046         hci_dev_put(hdev);
1047
1048         return err;
1049 }
1050
1051 /* ---- Interface to HCI drivers ---- */
1052
1053 static int hci_rfkill_set_block(void *data, bool blocked)
1054 {
1055         struct hci_dev *hdev = data;
1056
1057         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1058
1059         if (!blocked)
1060                 return 0;
1061
1062         hci_dev_do_close(hdev);
1063
1064         return 0;
1065 }
1066
1067 static const struct rfkill_ops hci_rfkill_ops = {
1068         .set_block = hci_rfkill_set_block,
1069 };
1070
1071 /* Alloc HCI device */
1072 struct hci_dev *hci_alloc_dev(void)
1073 {
1074         struct hci_dev *hdev;
1075
1076         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1077         if (!hdev)
1078                 return NULL;
1079
1080         hci_init_sysfs(hdev);
1081         skb_queue_head_init(&hdev->driver_init);
1082
1083         return hdev;
1084 }
1085 EXPORT_SYMBOL(hci_alloc_dev);
1086
1087 /* Free HCI device */
1088 void hci_free_dev(struct hci_dev *hdev)
1089 {
1090         skb_queue_purge(&hdev->driver_init);
1091
1092         /* will free via device release */
1093         put_device(&hdev->dev);
1094 }
1095 EXPORT_SYMBOL(hci_free_dev);
1096
1097 static void hci_power_on(struct work_struct *work)
1098 {
1099         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1100
1101         BT_DBG("%s", hdev->name);
1102
1103         if (hci_dev_open(hdev->id) < 0)
1104                 return;
1105
1106         if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1107                 schedule_delayed_work(&hdev->power_off,
1108                                         msecs_to_jiffies(AUTO_OFF_TIMEOUT));
1109
1110         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
1111                 mgmt_index_added(hdev);
1112 }
1113
1114 static void hci_power_off(struct work_struct *work)
1115 {
1116         struct hci_dev *hdev = container_of(work, struct hci_dev,
1117                                                         power_off.work);
1118
1119         BT_DBG("%s", hdev->name);
1120
1121         clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
1122
1123         hci_dev_close(hdev->id);
1124 }
1125
1126 static void hci_discov_off(struct work_struct *work)
1127 {
1128         struct hci_dev *hdev;
1129         u8 scan = SCAN_PAGE;
1130
1131         hdev = container_of(work, struct hci_dev, discov_off.work);
1132
1133         BT_DBG("%s", hdev->name);
1134
1135         hci_dev_lock(hdev);
1136
1137         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1138
1139         hdev->discov_timeout = 0;
1140
1141         hci_dev_unlock(hdev);
1142 }
1143
1144 int hci_uuids_clear(struct hci_dev *hdev)
1145 {
1146         struct list_head *p, *n;
1147
1148         list_for_each_safe(p, n, &hdev->uuids) {
1149                 struct bt_uuid *uuid;
1150
1151                 uuid = list_entry(p, struct bt_uuid, list);
1152
1153                 list_del(p);
1154                 kfree(uuid);
1155         }
1156
1157         return 0;
1158 }
1159
1160 int hci_link_keys_clear(struct hci_dev *hdev)
1161 {
1162         struct list_head *p, *n;
1163
1164         list_for_each_safe(p, n, &hdev->link_keys) {
1165                 struct link_key *key;
1166
1167                 key = list_entry(p, struct link_key, list);
1168
1169                 list_del(p);
1170                 kfree(key);
1171         }
1172
1173         return 0;
1174 }
1175
1176 int hci_smp_ltks_clear(struct hci_dev *hdev)
1177 {
1178         struct smp_ltk *k, *tmp;
1179
1180         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1181                 list_del(&k->list);
1182                 kfree(k);
1183         }
1184
1185         return 0;
1186 }
1187
1188 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1189 {
1190         struct link_key *k;
1191
1192         list_for_each_entry(k, &hdev->link_keys, list)
1193                 if (bacmp(bdaddr, &k->bdaddr) == 0)
1194                         return k;
1195
1196         return NULL;
1197 }
1198
1199 static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1200                                                 u8 key_type, u8 old_key_type)
1201 {
1202         /* Legacy key */
1203         if (key_type < 0x03)
1204                 return 1;
1205
1206         /* Debug keys are insecure so don't store them persistently */
1207         if (key_type == HCI_LK_DEBUG_COMBINATION)
1208                 return 0;
1209
1210         /* Changed combination key and there's no previous one */
1211         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1212                 return 0;
1213
1214         /* Security mode 3 case */
1215         if (!conn)
1216                 return 1;
1217
1218         /* Neither local nor remote side had no-bonding as requirement */
1219         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1220                 return 1;
1221
1222         /* Local side had dedicated bonding as requirement */
1223         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1224                 return 1;
1225
1226         /* Remote side had dedicated bonding as requirement */
1227         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1228                 return 1;
1229
1230         /* If none of the above criteria match, then don't store the key
1231          * persistently */
1232         return 0;
1233 }
1234
1235 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1236 {
1237         struct smp_ltk *k;
1238
1239         list_for_each_entry(k, &hdev->long_term_keys, list) {
1240                 if (k->ediv != ediv ||
1241                                 memcmp(rand, k->rand, sizeof(k->rand)))
1242                         continue;
1243
1244                 return k;
1245         }
1246
1247         return NULL;
1248 }
1249 EXPORT_SYMBOL(hci_find_ltk);
1250
1251 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1252                                                                 u8 addr_type)
1253 {
1254         struct smp_ltk *k;
1255
1256         list_for_each_entry(k, &hdev->long_term_keys, list)
1257                 if (addr_type == k->bdaddr_type &&
1258                                         bacmp(bdaddr, &k->bdaddr) == 0)
1259                         return k;
1260
1261         return NULL;
1262 }
1263 EXPORT_SYMBOL(hci_find_ltk_by_addr);
1264
1265 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1266                                 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1267 {
1268         struct link_key *key, *old_key;
1269         u8 old_key_type, persistent;
1270
1271         old_key = hci_find_link_key(hdev, bdaddr);
1272         if (old_key) {
1273                 old_key_type = old_key->type;
1274                 key = old_key;
1275         } else {
1276                 old_key_type = conn ? conn->key_type : 0xff;
1277                 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1278                 if (!key)
1279                         return -ENOMEM;
1280                 list_add(&key->list, &hdev->link_keys);
1281         }
1282
1283         BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1284
1285         /* Some buggy controller combinations generate a changed
1286          * combination key for legacy pairing even when there's no
1287          * previous key */
1288         if (type == HCI_LK_CHANGED_COMBINATION &&
1289                                         (!conn || conn->remote_auth == 0xff) &&
1290                                         old_key_type == 0xff) {
1291                 type = HCI_LK_COMBINATION;
1292                 if (conn)
1293                         conn->key_type = type;
1294         }
1295
1296         bacpy(&key->bdaddr, bdaddr);
1297         memcpy(key->val, val, 16);
1298         key->pin_len = pin_len;
1299
1300         if (type == HCI_LK_CHANGED_COMBINATION)
1301                 key->type = old_key_type;
1302         else
1303                 key->type = type;
1304
1305         if (!new_key)
1306                 return 0;
1307
1308         persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1309
1310         mgmt_new_link_key(hdev, key, persistent);
1311
1312         if (!persistent) {
1313                 list_del(&key->list);
1314                 kfree(key);
1315         }
1316
1317         return 0;
1318 }
1319
1320 int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
1321                                 int new_key, u8 authenticated, u8 tk[16],
1322                                 u8 enc_size, u16 ediv, u8 rand[8])
1323 {
1324         struct smp_ltk *key, *old_key;
1325
1326         if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1327                 return 0;
1328
1329         old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1330         if (old_key)
1331                 key = old_key;
1332         else {
1333                 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1334                 if (!key)
1335                         return -ENOMEM;
1336                 list_add(&key->list, &hdev->long_term_keys);
1337         }
1338
1339         bacpy(&key->bdaddr, bdaddr);
1340         key->bdaddr_type = addr_type;
1341         memcpy(key->val, tk, sizeof(key->val));
1342         key->authenticated = authenticated;
1343         key->ediv = ediv;
1344         key->enc_size = enc_size;
1345         key->type = type;
1346         memcpy(key->rand, rand, sizeof(key->rand));
1347
1348         if (!new_key)
1349                 return 0;
1350
1351         if (type & HCI_SMP_LTK)
1352                 mgmt_new_ltk(hdev, key, 1);
1353
1354         return 0;
1355 }
1356
1357 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1358 {
1359         struct link_key *key;
1360
1361         key = hci_find_link_key(hdev, bdaddr);
1362         if (!key)
1363                 return -ENOENT;
1364
1365         BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1366
1367         list_del(&key->list);
1368         kfree(key);
1369
1370         return 0;
1371 }
1372
1373 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1374 {
1375         struct smp_ltk *k, *tmp;
1376
1377         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1378                 if (bacmp(bdaddr, &k->bdaddr))
1379                         continue;
1380
1381                 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1382
1383                 list_del(&k->list);
1384                 kfree(k);
1385         }
1386
1387         return 0;
1388 }
1389
1390 /* HCI command timer function */
1391 static void hci_cmd_timer(unsigned long arg)
1392 {
1393         struct hci_dev *hdev = (void *) arg;
1394
1395         BT_ERR("%s command tx timeout", hdev->name);
1396         atomic_set(&hdev->cmd_cnt, 1);
1397         queue_work(hdev->workqueue, &hdev->cmd_work);
1398 }
1399
1400 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1401                                                         bdaddr_t *bdaddr)
1402 {
1403         struct oob_data *data;
1404
1405         list_for_each_entry(data, &hdev->remote_oob_data, list)
1406                 if (bacmp(bdaddr, &data->bdaddr) == 0)
1407                         return data;
1408
1409         return NULL;
1410 }
1411
1412 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1413 {
1414         struct oob_data *data;
1415
1416         data = hci_find_remote_oob_data(hdev, bdaddr);
1417         if (!data)
1418                 return -ENOENT;
1419
1420         BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1421
1422         list_del(&data->list);
1423         kfree(data);
1424
1425         return 0;
1426 }
1427
1428 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1429 {
1430         struct oob_data *data, *n;
1431
1432         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1433                 list_del(&data->list);
1434                 kfree(data);
1435         }
1436
1437         return 0;
1438 }
1439
1440 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1441                                                                 u8 *randomizer)
1442 {
1443         struct oob_data *data;
1444
1445         data = hci_find_remote_oob_data(hdev, bdaddr);
1446
1447         if (!data) {
1448                 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1449                 if (!data)
1450                         return -ENOMEM;
1451
1452                 bacpy(&data->bdaddr, bdaddr);
1453                 list_add(&data->list, &hdev->remote_oob_data);
1454         }
1455
1456         memcpy(data->hash, hash, sizeof(data->hash));
1457         memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1458
1459         BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1460
1461         return 0;
1462 }
1463
1464 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1465                                                 bdaddr_t *bdaddr)
1466 {
1467         struct bdaddr_list *b;
1468
1469         list_for_each_entry(b, &hdev->blacklist, list)
1470                 if (bacmp(bdaddr, &b->bdaddr) == 0)
1471                         return b;
1472
1473         return NULL;
1474 }
1475
1476 int hci_blacklist_clear(struct hci_dev *hdev)
1477 {
1478         struct list_head *p, *n;
1479
1480         list_for_each_safe(p, n, &hdev->blacklist) {
1481                 struct bdaddr_list *b;
1482
1483                 b = list_entry(p, struct bdaddr_list, list);
1484
1485                 list_del(p);
1486                 kfree(b);
1487         }
1488
1489         return 0;
1490 }
1491
1492 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1493 {
1494         struct bdaddr_list *entry;
1495
1496         if (bacmp(bdaddr, BDADDR_ANY) == 0)
1497                 return -EBADF;
1498
1499         if (hci_blacklist_lookup(hdev, bdaddr))
1500                 return -EEXIST;
1501
1502         entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1503         if (!entry)
1504                 return -ENOMEM;
1505
1506         bacpy(&entry->bdaddr, bdaddr);
1507
1508         list_add(&entry->list, &hdev->blacklist);
1509
1510         return mgmt_device_blocked(hdev, bdaddr);
1511 }
1512
1513 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1514 {
1515         struct bdaddr_list *entry;
1516
1517         if (bacmp(bdaddr, BDADDR_ANY) == 0)
1518                 return hci_blacklist_clear(hdev);
1519
1520         entry = hci_blacklist_lookup(hdev, bdaddr);
1521         if (!entry)
1522                 return -ENOENT;
1523
1524         list_del(&entry->list);
1525         kfree(entry);
1526
1527         return mgmt_device_unblocked(hdev, bdaddr);
1528 }
1529
1530 static void hci_clear_adv_cache(struct work_struct *work)
1531 {
1532         struct hci_dev *hdev = container_of(work, struct hci_dev,
1533                                                         adv_work.work);
1534
1535         hci_dev_lock(hdev);
1536
1537         hci_adv_entries_clear(hdev);
1538
1539         hci_dev_unlock(hdev);
1540 }
1541
1542 int hci_adv_entries_clear(struct hci_dev *hdev)
1543 {
1544         struct adv_entry *entry, *tmp;
1545
1546         list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1547                 list_del(&entry->list);
1548                 kfree(entry);
1549         }
1550
1551         BT_DBG("%s adv cache cleared", hdev->name);
1552
1553         return 0;
1554 }
1555
1556 struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1557 {
1558         struct adv_entry *entry;
1559
1560         list_for_each_entry(entry, &hdev->adv_entries, list)
1561                 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1562                         return entry;
1563
1564         return NULL;
1565 }
1566
1567 static inline int is_connectable_adv(u8 evt_type)
1568 {
1569         if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1570                 return 1;
1571
1572         return 0;
1573 }
1574
1575 int hci_add_adv_entry(struct hci_dev *hdev,
1576                                         struct hci_ev_le_advertising_info *ev)
1577 {
1578         struct adv_entry *entry;
1579
1580         if (!is_connectable_adv(ev->evt_type))
1581                 return -EINVAL;
1582
1583         /* Only new entries should be added to adv_entries. So, if
1584          * bdaddr was found, don't add it. */
1585         if (hci_find_adv_entry(hdev, &ev->bdaddr))
1586                 return 0;
1587
1588         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
1589         if (!entry)
1590                 return -ENOMEM;
1591
1592         bacpy(&entry->bdaddr, &ev->bdaddr);
1593         entry->bdaddr_type = ev->bdaddr_type;
1594
1595         list_add(&entry->list, &hdev->adv_entries);
1596
1597         BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1598                                 batostr(&entry->bdaddr), entry->bdaddr_type);
1599
1600         return 0;
1601 }
1602
1603 static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
1604 {
1605         struct le_scan_params *param =  (struct le_scan_params *) opt;
1606         struct hci_cp_le_set_scan_param cp;
1607
1608         memset(&cp, 0, sizeof(cp));
1609         cp.type = param->type;
1610         cp.interval = cpu_to_le16(param->interval);
1611         cp.window = cpu_to_le16(param->window);
1612
1613         hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
1614 }
1615
1616 static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
1617 {
1618         struct hci_cp_le_set_scan_enable cp;
1619
1620         memset(&cp, 0, sizeof(cp));
1621         cp.enable = 1;
1622
1623         hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1624 }
1625
1626 static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
1627                                                 u16 window, int timeout)
1628 {
1629         long timeo = msecs_to_jiffies(3000);
1630         struct le_scan_params param;
1631         int err;
1632
1633         BT_DBG("%s", hdev->name);
1634
1635         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1636                 return -EINPROGRESS;
1637
1638         param.type = type;
1639         param.interval = interval;
1640         param.window = window;
1641
1642         hci_req_lock(hdev);
1643
1644         err = __hci_request(hdev, le_scan_param_req, (unsigned long) &param,
1645                                                                         timeo);
1646         if (!err)
1647                 err = __hci_request(hdev, le_scan_enable_req, 0, timeo);
1648
1649         hci_req_unlock(hdev);
1650
1651         if (err < 0)
1652                 return err;
1653
1654         schedule_delayed_work(&hdev->le_scan_disable,
1655                                                 msecs_to_jiffies(timeout));
1656
1657         return 0;
1658 }
1659
1660 static void le_scan_disable_work(struct work_struct *work)
1661 {
1662         struct hci_dev *hdev = container_of(work, struct hci_dev,
1663                                                 le_scan_disable.work);
1664         struct hci_cp_le_set_scan_enable cp;
1665
1666         BT_DBG("%s", hdev->name);
1667
1668         memset(&cp, 0, sizeof(cp));
1669
1670         hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1671 }
1672
1673 static void le_scan_work(struct work_struct *work)
1674 {
1675         struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
1676         struct le_scan_params *param = &hdev->le_scan_params;
1677
1678         BT_DBG("%s", hdev->name);
1679
1680         hci_do_le_scan(hdev, param->type, param->interval,
1681                                         param->window, param->timeout);
1682 }
1683
1684 int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
1685                                                                 int timeout)
1686 {
1687         struct le_scan_params *param = &hdev->le_scan_params;
1688
1689         BT_DBG("%s", hdev->name);
1690
1691         if (work_busy(&hdev->le_scan))
1692                 return -EINPROGRESS;
1693
1694         param->type = type;
1695         param->interval = interval;
1696         param->window = window;
1697         param->timeout = timeout;
1698
1699         queue_work(system_long_wq, &hdev->le_scan);
1700
1701         return 0;
1702 }
1703
1704 /* Register HCI device */
1705 int hci_register_dev(struct hci_dev *hdev)
1706 {
1707         struct list_head *head = &hci_dev_list, *p;
1708         int i, id, error;
1709
1710         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1711
1712         if (!hdev->open || !hdev->close)
1713                 return -EINVAL;
1714
1715         /* Do not allow HCI_AMP devices to register at index 0,
1716          * so the index can be used as the AMP controller ID.
1717          */
1718         id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
1719
1720         write_lock(&hci_dev_list_lock);
1721
1722         /* Find first available device id */
1723         list_for_each(p, &hci_dev_list) {
1724                 if (list_entry(p, struct hci_dev, list)->id != id)
1725                         break;
1726                 head = p; id++;
1727         }
1728
1729         sprintf(hdev->name, "hci%d", id);
1730         hdev->id = id;
1731         list_add_tail(&hdev->list, head);
1732
1733         mutex_init(&hdev->lock);
1734
1735         hdev->flags = 0;
1736         hdev->dev_flags = 0;
1737         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1738         hdev->esco_type = (ESCO_HV1);
1739         hdev->link_mode = (HCI_LM_ACCEPT);
1740         hdev->io_capability = 0x03; /* No Input No Output */
1741
1742         hdev->idle_timeout = 0;
1743         hdev->sniff_max_interval = 800;
1744         hdev->sniff_min_interval = 80;
1745
1746         INIT_WORK(&hdev->rx_work, hci_rx_work);
1747         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
1748         INIT_WORK(&hdev->tx_work, hci_tx_work);
1749
1750
1751         skb_queue_head_init(&hdev->rx_q);
1752         skb_queue_head_init(&hdev->cmd_q);
1753         skb_queue_head_init(&hdev->raw_q);
1754
1755         setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1756
1757         for (i = 0; i < NUM_REASSEMBLY; i++)
1758                 hdev->reassembly[i] = NULL;
1759
1760         init_waitqueue_head(&hdev->req_wait_q);
1761         mutex_init(&hdev->req_lock);
1762
1763         discovery_init(hdev);
1764
1765         hci_conn_hash_init(hdev);
1766
1767         INIT_LIST_HEAD(&hdev->mgmt_pending);
1768
1769         INIT_LIST_HEAD(&hdev->blacklist);
1770
1771         INIT_LIST_HEAD(&hdev->uuids);
1772
1773         INIT_LIST_HEAD(&hdev->link_keys);
1774         INIT_LIST_HEAD(&hdev->long_term_keys);
1775
1776         INIT_LIST_HEAD(&hdev->remote_oob_data);
1777
1778         INIT_LIST_HEAD(&hdev->adv_entries);
1779
1780         INIT_DELAYED_WORK(&hdev->adv_work, hci_clear_adv_cache);
1781         INIT_WORK(&hdev->power_on, hci_power_on);
1782         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
1783
1784         INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1785
1786         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1787
1788         atomic_set(&hdev->promisc, 0);
1789
1790         INIT_WORK(&hdev->le_scan, le_scan_work);
1791
1792         INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
1793
1794         write_unlock(&hci_dev_list_lock);
1795
1796         hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
1797                                                         WQ_MEM_RECLAIM, 1);
1798         if (!hdev->workqueue) {
1799                 error = -ENOMEM;
1800                 goto err;
1801         }
1802
1803         error = hci_add_sysfs(hdev);
1804         if (error < 0)
1805                 goto err_wqueue;
1806
1807         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1808                                 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1809         if (hdev->rfkill) {
1810                 if (rfkill_register(hdev->rfkill) < 0) {
1811                         rfkill_destroy(hdev->rfkill);
1812                         hdev->rfkill = NULL;
1813                 }
1814         }
1815
1816         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
1817         set_bit(HCI_SETUP, &hdev->dev_flags);
1818         schedule_work(&hdev->power_on);
1819
1820         hci_notify(hdev, HCI_DEV_REG);
1821         hci_dev_hold(hdev);
1822
1823         return id;
1824
1825 err_wqueue:
1826         destroy_workqueue(hdev->workqueue);
1827 err:
1828         write_lock(&hci_dev_list_lock);
1829         list_del(&hdev->list);
1830         write_unlock(&hci_dev_list_lock);
1831
1832         return error;
1833 }
1834 EXPORT_SYMBOL(hci_register_dev);
1835
1836 /* Unregister HCI device */
1837 void hci_unregister_dev(struct hci_dev *hdev)
1838 {
1839         int i;
1840
1841         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1842
1843         write_lock(&hci_dev_list_lock);
1844         list_del(&hdev->list);
1845         write_unlock(&hci_dev_list_lock);
1846
1847         hci_dev_do_close(hdev);
1848
1849         for (i = 0; i < NUM_REASSEMBLY; i++)
1850                 kfree_skb(hdev->reassembly[i]);
1851
1852         if (!test_bit(HCI_INIT, &hdev->flags) &&
1853                                 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
1854                 hci_dev_lock(hdev);
1855                 mgmt_index_removed(hdev);
1856                 hci_dev_unlock(hdev);
1857         }
1858
1859         /* mgmt_index_removed should take care of emptying the
1860          * pending list */
1861         BUG_ON(!list_empty(&hdev->mgmt_pending));
1862
1863         hci_notify(hdev, HCI_DEV_UNREG);
1864
1865         if (hdev->rfkill) {
1866                 rfkill_unregister(hdev->rfkill);
1867                 rfkill_destroy(hdev->rfkill);
1868         }
1869
1870         hci_del_sysfs(hdev);
1871
1872         cancel_delayed_work_sync(&hdev->adv_work);
1873
1874         destroy_workqueue(hdev->workqueue);
1875
1876         hci_dev_lock(hdev);
1877         hci_blacklist_clear(hdev);
1878         hci_uuids_clear(hdev);
1879         hci_link_keys_clear(hdev);
1880         hci_smp_ltks_clear(hdev);
1881         hci_remote_oob_data_clear(hdev);
1882         hci_adv_entries_clear(hdev);
1883         hci_dev_unlock(hdev);
1884
1885         hci_dev_put(hdev);
1886 }
1887 EXPORT_SYMBOL(hci_unregister_dev);
1888
1889 /* Suspend HCI device */
1890 int hci_suspend_dev(struct hci_dev *hdev)
1891 {
1892         hci_notify(hdev, HCI_DEV_SUSPEND);
1893         return 0;
1894 }
1895 EXPORT_SYMBOL(hci_suspend_dev);
1896
1897 /* Resume HCI device */
1898 int hci_resume_dev(struct hci_dev *hdev)
1899 {
1900         hci_notify(hdev, HCI_DEV_RESUME);
1901         return 0;
1902 }
1903 EXPORT_SYMBOL(hci_resume_dev);
1904
1905 /* Receive frame from HCI drivers */
1906 int hci_recv_frame(struct sk_buff *skb)
1907 {
1908         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1909         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1910                                 && !test_bit(HCI_INIT, &hdev->flags))) {
1911                 kfree_skb(skb);
1912                 return -ENXIO;
1913         }
1914
1915         /* Incomming skb */
1916         bt_cb(skb)->incoming = 1;
1917
1918         /* Time stamp */
1919         __net_timestamp(skb);
1920
1921         skb_queue_tail(&hdev->rx_q, skb);
1922         queue_work(hdev->workqueue, &hdev->rx_work);
1923
1924         return 0;
1925 }
1926 EXPORT_SYMBOL(hci_recv_frame);
1927
1928 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1929                                                   int count, __u8 index)
1930 {
1931         int len = 0;
1932         int hlen = 0;
1933         int remain = count;
1934         struct sk_buff *skb;
1935         struct bt_skb_cb *scb;
1936
1937         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1938                                 index >= NUM_REASSEMBLY)
1939                 return -EILSEQ;
1940
1941         skb = hdev->reassembly[index];
1942
1943         if (!skb) {
1944                 switch (type) {
1945                 case HCI_ACLDATA_PKT:
1946                         len = HCI_MAX_FRAME_SIZE;
1947                         hlen = HCI_ACL_HDR_SIZE;
1948                         break;
1949                 case HCI_EVENT_PKT:
1950                         len = HCI_MAX_EVENT_SIZE;
1951                         hlen = HCI_EVENT_HDR_SIZE;
1952                         break;
1953                 case HCI_SCODATA_PKT:
1954                         len = HCI_MAX_SCO_SIZE;
1955                         hlen = HCI_SCO_HDR_SIZE;
1956                         break;
1957                 }
1958
1959                 skb = bt_skb_alloc(len, GFP_ATOMIC);
1960                 if (!skb)
1961                         return -ENOMEM;
1962
1963                 scb = (void *) skb->cb;
1964                 scb->expect = hlen;
1965                 scb->pkt_type = type;
1966
1967                 skb->dev = (void *) hdev;
1968                 hdev->reassembly[index] = skb;
1969         }
1970
1971         while (count) {
1972                 scb = (void *) skb->cb;
1973                 len = min(scb->expect, (__u16)count);
1974
1975                 memcpy(skb_put(skb, len), data, len);
1976
1977                 count -= len;
1978                 data += len;
1979                 scb->expect -= len;
1980                 remain = count;
1981
1982                 switch (type) {
1983                 case HCI_EVENT_PKT:
1984                         if (skb->len == HCI_EVENT_HDR_SIZE) {
1985                                 struct hci_event_hdr *h = hci_event_hdr(skb);
1986                                 scb->expect = h->plen;
1987
1988                                 if (skb_tailroom(skb) < scb->expect) {
1989                                         kfree_skb(skb);
1990                                         hdev->reassembly[index] = NULL;
1991                                         return -ENOMEM;
1992                                 }
1993                         }
1994                         break;
1995
1996                 case HCI_ACLDATA_PKT:
1997                         if (skb->len  == HCI_ACL_HDR_SIZE) {
1998                                 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1999                                 scb->expect = __le16_to_cpu(h->dlen);
2000
2001                                 if (skb_tailroom(skb) < scb->expect) {
2002                                         kfree_skb(skb);
2003                                         hdev->reassembly[index] = NULL;
2004                                         return -ENOMEM;
2005                                 }
2006                         }
2007                         break;
2008
2009                 case HCI_SCODATA_PKT:
2010                         if (skb->len == HCI_SCO_HDR_SIZE) {
2011                                 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2012                                 scb->expect = h->dlen;
2013
2014                                 if (skb_tailroom(skb) < scb->expect) {
2015                                         kfree_skb(skb);
2016                                         hdev->reassembly[index] = NULL;
2017                                         return -ENOMEM;
2018                                 }
2019                         }
2020                         break;
2021                 }
2022
2023                 if (scb->expect == 0) {
2024                         /* Complete frame */
2025
2026                         bt_cb(skb)->pkt_type = type;
2027                         hci_recv_frame(skb);
2028
2029                         hdev->reassembly[index] = NULL;
2030                         return remain;
2031                 }
2032         }
2033
2034         return remain;
2035 }
2036
2037 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2038 {
2039         int rem = 0;
2040
2041         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2042                 return -EILSEQ;
2043
2044         while (count) {
2045                 rem = hci_reassembly(hdev, type, data, count, type - 1);
2046                 if (rem < 0)
2047                         return rem;
2048
2049                 data += (count - rem);
2050                 count = rem;
2051         }
2052
2053         return rem;
2054 }
2055 EXPORT_SYMBOL(hci_recv_fragment);
2056
2057 #define STREAM_REASSEMBLY 0
2058
2059 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2060 {
2061         int type;
2062         int rem = 0;
2063
2064         while (count) {
2065                 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2066
2067                 if (!skb) {
2068                         struct { char type; } *pkt;
2069
2070                         /* Start of the frame */
2071                         pkt = data;
2072                         type = pkt->type;
2073
2074                         data++;
2075                         count--;
2076                 } else
2077                         type = bt_cb(skb)->pkt_type;
2078
2079                 rem = hci_reassembly(hdev, type, data, count,
2080                                                         STREAM_REASSEMBLY);
2081                 if (rem < 0)
2082                         return rem;
2083
2084                 data += (count - rem);
2085                 count = rem;
2086         }
2087
2088         return rem;
2089 }
2090 EXPORT_SYMBOL(hci_recv_stream_fragment);
2091
2092 /* ---- Interface to upper protocols ---- */
2093
2094 int hci_register_cb(struct hci_cb *cb)
2095 {
2096         BT_DBG("%p name %s", cb, cb->name);
2097
2098         write_lock(&hci_cb_list_lock);
2099         list_add(&cb->list, &hci_cb_list);
2100         write_unlock(&hci_cb_list_lock);
2101
2102         return 0;
2103 }
2104 EXPORT_SYMBOL(hci_register_cb);
2105
2106 int hci_unregister_cb(struct hci_cb *cb)
2107 {
2108         BT_DBG("%p name %s", cb, cb->name);
2109
2110         write_lock(&hci_cb_list_lock);
2111         list_del(&cb->list);
2112         write_unlock(&hci_cb_list_lock);
2113
2114         return 0;
2115 }
2116 EXPORT_SYMBOL(hci_unregister_cb);
2117
2118 static int hci_send_frame(struct sk_buff *skb)
2119 {
2120         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2121
2122         if (!hdev) {
2123                 kfree_skb(skb);
2124                 return -ENODEV;
2125         }
2126
2127         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
2128
2129         if (atomic_read(&hdev->promisc)) {
2130                 /* Time stamp */
2131                 __net_timestamp(skb);
2132
2133                 hci_send_to_sock(hdev, skb, NULL);
2134         }
2135
2136         /* Get rid of skb owner, prior to sending to the driver. */
2137         skb_orphan(skb);
2138
2139         return hdev->send(skb);
2140 }
2141
2142 /* Send HCI command */
2143 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
2144 {
2145         int len = HCI_COMMAND_HDR_SIZE + plen;
2146         struct hci_command_hdr *hdr;
2147         struct sk_buff *skb;
2148
2149         BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
2150
2151         skb = bt_skb_alloc(len, GFP_ATOMIC);
2152         if (!skb) {
2153                 BT_ERR("%s no memory for command", hdev->name);
2154                 return -ENOMEM;
2155         }
2156
2157         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
2158         hdr->opcode = cpu_to_le16(opcode);
2159         hdr->plen   = plen;
2160
2161         if (plen)
2162                 memcpy(skb_put(skb, plen), param, plen);
2163
2164         BT_DBG("skb len %d", skb->len);
2165
2166         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
2167         skb->dev = (void *) hdev;
2168
2169         if (test_bit(HCI_INIT, &hdev->flags))
2170                 hdev->init_last_cmd = opcode;
2171
2172         skb_queue_tail(&hdev->cmd_q, skb);
2173         queue_work(hdev->workqueue, &hdev->cmd_work);
2174
2175         return 0;
2176 }
2177
2178 /* Get data from the previously sent command */
2179 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
2180 {
2181         struct hci_command_hdr *hdr;
2182
2183         if (!hdev->sent_cmd)
2184                 return NULL;
2185
2186         hdr = (void *) hdev->sent_cmd->data;
2187
2188         if (hdr->opcode != cpu_to_le16(opcode))
2189                 return NULL;
2190
2191         BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2192
2193         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2194 }
2195
2196 /* Send ACL data */
2197 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2198 {
2199         struct hci_acl_hdr *hdr;
2200         int len = skb->len;
2201
2202         skb_push(skb, HCI_ACL_HDR_SIZE);
2203         skb_reset_transport_header(skb);
2204         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
2205         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2206         hdr->dlen   = cpu_to_le16(len);
2207 }
2208
2209 static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
2210                                 struct sk_buff *skb, __u16 flags)
2211 {
2212         struct hci_dev *hdev = conn->hdev;
2213         struct sk_buff *list;
2214
2215         list = skb_shinfo(skb)->frag_list;
2216         if (!list) {
2217                 /* Non fragmented */
2218                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2219
2220                 skb_queue_tail(queue, skb);
2221         } else {
2222                 /* Fragmented */
2223                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2224
2225                 skb_shinfo(skb)->frag_list = NULL;
2226
2227                 /* Queue all fragments atomically */
2228                 spin_lock(&queue->lock);
2229
2230                 __skb_queue_tail(queue, skb);
2231
2232                 flags &= ~ACL_START;
2233                 flags |= ACL_CONT;
2234                 do {
2235                         skb = list; list = list->next;
2236
2237                         skb->dev = (void *) hdev;
2238                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2239                         hci_add_acl_hdr(skb, conn->handle, flags);
2240
2241                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2242
2243                         __skb_queue_tail(queue, skb);
2244                 } while (list);
2245
2246                 spin_unlock(&queue->lock);
2247         }
2248 }
2249
2250 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2251 {
2252         struct hci_conn *conn = chan->conn;
2253         struct hci_dev *hdev = conn->hdev;
2254
2255         BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
2256
2257         skb->dev = (void *) hdev;
2258         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2259         hci_add_acl_hdr(skb, conn->handle, flags);
2260
2261         hci_queue_acl(conn, &chan->data_q, skb, flags);
2262
2263         queue_work(hdev->workqueue, &hdev->tx_work);
2264 }
2265 EXPORT_SYMBOL(hci_send_acl);
2266
2267 /* Send SCO data */
2268 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2269 {
2270         struct hci_dev *hdev = conn->hdev;
2271         struct hci_sco_hdr hdr;
2272
2273         BT_DBG("%s len %d", hdev->name, skb->len);
2274
2275         hdr.handle = cpu_to_le16(conn->handle);
2276         hdr.dlen   = skb->len;
2277
2278         skb_push(skb, HCI_SCO_HDR_SIZE);
2279         skb_reset_transport_header(skb);
2280         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2281
2282         skb->dev = (void *) hdev;
2283         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2284
2285         skb_queue_tail(&conn->data_q, skb);
2286         queue_work(hdev->workqueue, &hdev->tx_work);
2287 }
2288 EXPORT_SYMBOL(hci_send_sco);
2289
2290 /* ---- HCI TX task (outgoing data) ---- */
2291
2292 /* HCI Connection scheduler */
2293 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2294 {
2295         struct hci_conn_hash *h = &hdev->conn_hash;
2296         struct hci_conn *conn = NULL, *c;
2297         int num = 0, min = ~0;
2298
2299         /* We don't have to lock device here. Connections are always
2300          * added and removed with TX task disabled. */
2301
2302         rcu_read_lock();
2303
2304         list_for_each_entry_rcu(c, &h->list, list) {
2305                 if (c->type != type || skb_queue_empty(&c->data_q))
2306                         continue;
2307
2308                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2309                         continue;
2310
2311                 num++;
2312
2313                 if (c->sent < min) {
2314                         min  = c->sent;
2315                         conn = c;
2316                 }
2317
2318                 if (hci_conn_num(hdev, type) == num)
2319                         break;
2320         }
2321
2322         rcu_read_unlock();
2323
2324         if (conn) {
2325                 int cnt, q;
2326
2327                 switch (conn->type) {
2328                 case ACL_LINK:
2329                         cnt = hdev->acl_cnt;
2330                         break;
2331                 case SCO_LINK:
2332                 case ESCO_LINK:
2333                         cnt = hdev->sco_cnt;
2334                         break;
2335                 case LE_LINK:
2336                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2337                         break;
2338                 default:
2339                         cnt = 0;
2340                         BT_ERR("Unknown link type");
2341                 }
2342
2343                 q = cnt / num;
2344                 *quote = q ? q : 1;
2345         } else
2346                 *quote = 0;
2347
2348         BT_DBG("conn %p quote %d", conn, *quote);
2349         return conn;
2350 }
2351
2352 static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2353 {
2354         struct hci_conn_hash *h = &hdev->conn_hash;
2355         struct hci_conn *c;
2356
2357         BT_ERR("%s link tx timeout", hdev->name);
2358
2359         rcu_read_lock();
2360
2361         /* Kill stalled connections */
2362         list_for_each_entry_rcu(c, &h->list, list) {
2363                 if (c->type == type && c->sent) {
2364                         BT_ERR("%s killing stalled connection %s",
2365                                 hdev->name, batostr(&c->dst));
2366                         hci_acl_disconn(c, 0x13);
2367                 }
2368         }
2369
2370         rcu_read_unlock();
2371 }
2372
2373 static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2374                                                 int *quote)
2375 {
2376         struct hci_conn_hash *h = &hdev->conn_hash;
2377         struct hci_chan *chan = NULL;
2378         int num = 0, min = ~0, cur_prio = 0;
2379         struct hci_conn *conn;
2380         int cnt, q, conn_num = 0;
2381
2382         BT_DBG("%s", hdev->name);
2383
2384         rcu_read_lock();
2385
2386         list_for_each_entry_rcu(conn, &h->list, list) {
2387                 struct hci_chan *tmp;
2388
2389                 if (conn->type != type)
2390                         continue;
2391
2392                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2393                         continue;
2394
2395                 conn_num++;
2396
2397                 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2398                         struct sk_buff *skb;
2399
2400                         if (skb_queue_empty(&tmp->data_q))
2401                                 continue;
2402
2403                         skb = skb_peek(&tmp->data_q);
2404                         if (skb->priority < cur_prio)
2405                                 continue;
2406
2407                         if (skb->priority > cur_prio) {
2408                                 num = 0;
2409                                 min = ~0;
2410                                 cur_prio = skb->priority;
2411                         }
2412
2413                         num++;
2414
2415                         if (conn->sent < min) {
2416                                 min  = conn->sent;
2417                                 chan = tmp;
2418                         }
2419                 }
2420
2421                 if (hci_conn_num(hdev, type) == conn_num)
2422                         break;
2423         }
2424
2425         rcu_read_unlock();
2426
2427         if (!chan)
2428                 return NULL;
2429
2430         switch (chan->conn->type) {
2431         case ACL_LINK:
2432                 cnt = hdev->acl_cnt;
2433                 break;
2434         case SCO_LINK:
2435         case ESCO_LINK:
2436                 cnt = hdev->sco_cnt;
2437                 break;
2438         case LE_LINK:
2439                 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2440                 break;
2441         default:
2442                 cnt = 0;
2443                 BT_ERR("Unknown link type");
2444         }
2445
2446         q = cnt / num;
2447         *quote = q ? q : 1;
2448         BT_DBG("chan %p quote %d", chan, *quote);
2449         return chan;
2450 }
2451
2452 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2453 {
2454         struct hci_conn_hash *h = &hdev->conn_hash;
2455         struct hci_conn *conn;
2456         int num = 0;
2457
2458         BT_DBG("%s", hdev->name);
2459
2460         rcu_read_lock();
2461
2462         list_for_each_entry_rcu(conn, &h->list, list) {
2463                 struct hci_chan *chan;
2464
2465                 if (conn->type != type)
2466                         continue;
2467
2468                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2469                         continue;
2470
2471                 num++;
2472
2473                 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
2474                         struct sk_buff *skb;
2475
2476                         if (chan->sent) {
2477                                 chan->sent = 0;
2478                                 continue;
2479                         }
2480
2481                         if (skb_queue_empty(&chan->data_q))
2482                                 continue;
2483
2484                         skb = skb_peek(&chan->data_q);
2485                         if (skb->priority >= HCI_PRIO_MAX - 1)
2486                                 continue;
2487
2488                         skb->priority = HCI_PRIO_MAX - 1;
2489
2490                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2491                                                                 skb->priority);
2492                 }
2493
2494                 if (hci_conn_num(hdev, type) == num)
2495                         break;
2496         }
2497
2498         rcu_read_unlock();
2499
2500 }
2501
2502 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
2503 {
2504         /* Calculate count of blocks used by this packet */
2505         return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
2506 }
2507
2508 static inline void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
2509 {
2510         if (!test_bit(HCI_RAW, &hdev->flags)) {
2511                 /* ACL tx timeout must be longer than maximum
2512                  * link supervision timeout (40.9 seconds) */
2513                 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
2514                                         msecs_to_jiffies(HCI_ACL_TX_TIMEOUT)))
2515                         hci_link_tx_to(hdev, ACL_LINK);
2516         }
2517 }
2518
2519 static inline void hci_sched_acl_pkt(struct hci_dev *hdev)
2520 {
2521         unsigned int cnt = hdev->acl_cnt;
2522         struct hci_chan *chan;
2523         struct sk_buff *skb;
2524         int quote;
2525
2526         __check_timeout(hdev, cnt);
2527
2528         while (hdev->acl_cnt &&
2529                         (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2530                 u32 priority = (skb_peek(&chan->data_q))->priority;
2531                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2532                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2533                                         skb->len, skb->priority);
2534
2535                         /* Stop if priority has changed */
2536                         if (skb->priority < priority)
2537                                 break;
2538
2539                         skb = skb_dequeue(&chan->data_q);
2540
2541                         hci_conn_enter_active_mode(chan->conn,
2542                                                 bt_cb(skb)->force_active);
2543
2544                         hci_send_frame(skb);
2545                         hdev->acl_last_tx = jiffies;
2546
2547                         hdev->acl_cnt--;
2548                         chan->sent++;
2549                         chan->conn->sent++;
2550                 }
2551         }
2552
2553         if (cnt != hdev->acl_cnt)
2554                 hci_prio_recalculate(hdev, ACL_LINK);
2555 }
2556
2557 static inline void hci_sched_acl_blk(struct hci_dev *hdev)
2558 {
2559         unsigned int cnt = hdev->block_cnt;
2560         struct hci_chan *chan;
2561         struct sk_buff *skb;
2562         int quote;
2563
2564         __check_timeout(hdev, cnt);
2565
2566         while (hdev->block_cnt > 0 &&
2567                         (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2568                 u32 priority = (skb_peek(&chan->data_q))->priority;
2569                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
2570                         int blocks;
2571
2572                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2573                                                 skb->len, skb->priority);
2574
2575                         /* Stop if priority has changed */
2576                         if (skb->priority < priority)
2577                                 break;
2578
2579                         skb = skb_dequeue(&chan->data_q);
2580
2581                         blocks = __get_blocks(hdev, skb);
2582                         if (blocks > hdev->block_cnt)
2583                                 return;
2584
2585                         hci_conn_enter_active_mode(chan->conn,
2586                                                 bt_cb(skb)->force_active);
2587
2588                         hci_send_frame(skb);
2589                         hdev->acl_last_tx = jiffies;
2590
2591                         hdev->block_cnt -= blocks;
2592                         quote -= blocks;
2593
2594                         chan->sent += blocks;
2595                         chan->conn->sent += blocks;
2596                 }
2597         }
2598
2599         if (cnt != hdev->block_cnt)
2600                 hci_prio_recalculate(hdev, ACL_LINK);
2601 }
2602
2603 static inline void hci_sched_acl(struct hci_dev *hdev)
2604 {
2605         BT_DBG("%s", hdev->name);
2606
2607         if (!hci_conn_num(hdev, ACL_LINK))
2608                 return;
2609
2610         switch (hdev->flow_ctl_mode) {
2611         case HCI_FLOW_CTL_MODE_PACKET_BASED:
2612                 hci_sched_acl_pkt(hdev);
2613                 break;
2614
2615         case HCI_FLOW_CTL_MODE_BLOCK_BASED:
2616                 hci_sched_acl_blk(hdev);
2617                 break;
2618         }
2619 }
2620
2621 /* Schedule SCO */
2622 static inline void hci_sched_sco(struct hci_dev *hdev)
2623 {
2624         struct hci_conn *conn;
2625         struct sk_buff *skb;
2626         int quote;
2627
2628         BT_DBG("%s", hdev->name);
2629
2630         if (!hci_conn_num(hdev, SCO_LINK))
2631                 return;
2632
2633         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2634                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2635                         BT_DBG("skb %p len %d", skb, skb->len);
2636                         hci_send_frame(skb);
2637
2638                         conn->sent++;
2639                         if (conn->sent == ~0)
2640                                 conn->sent = 0;
2641                 }
2642         }
2643 }
2644
2645 static inline void hci_sched_esco(struct hci_dev *hdev)
2646 {
2647         struct hci_conn *conn;
2648         struct sk_buff *skb;
2649         int quote;
2650
2651         BT_DBG("%s", hdev->name);
2652
2653         if (!hci_conn_num(hdev, ESCO_LINK))
2654                 return;
2655
2656         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2657                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2658                         BT_DBG("skb %p len %d", skb, skb->len);
2659                         hci_send_frame(skb);
2660
2661                         conn->sent++;
2662                         if (conn->sent == ~0)
2663                                 conn->sent = 0;
2664                 }
2665         }
2666 }
2667
2668 static inline void hci_sched_le(struct hci_dev *hdev)
2669 {
2670         struct hci_chan *chan;
2671         struct sk_buff *skb;
2672         int quote, cnt, tmp;
2673
2674         BT_DBG("%s", hdev->name);
2675
2676         if (!hci_conn_num(hdev, LE_LINK))
2677                 return;
2678
2679         if (!test_bit(HCI_RAW, &hdev->flags)) {
2680                 /* LE tx timeout must be longer than maximum
2681                  * link supervision timeout (40.9 seconds) */
2682                 if (!hdev->le_cnt && hdev->le_pkts &&
2683                                 time_after(jiffies, hdev->le_last_tx + HZ * 45))
2684                         hci_link_tx_to(hdev, LE_LINK);
2685         }
2686
2687         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2688         tmp = cnt;
2689         while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
2690                 u32 priority = (skb_peek(&chan->data_q))->priority;
2691                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2692                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2693                                         skb->len, skb->priority);
2694
2695                         /* Stop if priority has changed */
2696                         if (skb->priority < priority)
2697                                 break;
2698
2699                         skb = skb_dequeue(&chan->data_q);
2700
2701                         hci_send_frame(skb);
2702                         hdev->le_last_tx = jiffies;
2703
2704                         cnt--;
2705                         chan->sent++;
2706                         chan->conn->sent++;
2707                 }
2708         }
2709
2710         if (hdev->le_pkts)
2711                 hdev->le_cnt = cnt;
2712         else
2713                 hdev->acl_cnt = cnt;
2714
2715         if (cnt != tmp)
2716                 hci_prio_recalculate(hdev, LE_LINK);
2717 }
2718
2719 static void hci_tx_work(struct work_struct *work)
2720 {
2721         struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
2722         struct sk_buff *skb;
2723
2724         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2725                 hdev->sco_cnt, hdev->le_cnt);
2726
2727         /* Schedule queues and send stuff to HCI driver */
2728
2729         hci_sched_acl(hdev);
2730
2731         hci_sched_sco(hdev);
2732
2733         hci_sched_esco(hdev);
2734
2735         hci_sched_le(hdev);
2736
2737         /* Send next queued raw (unknown type) packet */
2738         while ((skb = skb_dequeue(&hdev->raw_q)))
2739                 hci_send_frame(skb);
2740 }
2741
2742 /* ----- HCI RX task (incoming data processing) ----- */
2743
2744 /* ACL data packet */
2745 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2746 {
2747         struct hci_acl_hdr *hdr = (void *) skb->data;
2748         struct hci_conn *conn;
2749         __u16 handle, flags;
2750
2751         skb_pull(skb, HCI_ACL_HDR_SIZE);
2752
2753         handle = __le16_to_cpu(hdr->handle);
2754         flags  = hci_flags(handle);
2755         handle = hci_handle(handle);
2756
2757         BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2758
2759         hdev->stat.acl_rx++;
2760
2761         hci_dev_lock(hdev);
2762         conn = hci_conn_hash_lookup_handle(hdev, handle);
2763         hci_dev_unlock(hdev);
2764
2765         if (conn) {
2766                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
2767
2768                 /* Send to upper protocol */
2769                 l2cap_recv_acldata(conn, skb, flags);
2770                 return;
2771         } else {
2772                 BT_ERR("%s ACL packet for unknown connection handle %d",
2773                         hdev->name, handle);
2774         }
2775
2776         kfree_skb(skb);
2777 }
2778
2779 /* SCO data packet */
2780 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2781 {
2782         struct hci_sco_hdr *hdr = (void *) skb->data;
2783         struct hci_conn *conn;
2784         __u16 handle;
2785
2786         skb_pull(skb, HCI_SCO_HDR_SIZE);
2787
2788         handle = __le16_to_cpu(hdr->handle);
2789
2790         BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2791
2792         hdev->stat.sco_rx++;
2793
2794         hci_dev_lock(hdev);
2795         conn = hci_conn_hash_lookup_handle(hdev, handle);
2796         hci_dev_unlock(hdev);
2797
2798         if (conn) {
2799                 /* Send to upper protocol */
2800                 sco_recv_scodata(conn, skb);
2801                 return;
2802         } else {
2803                 BT_ERR("%s SCO packet for unknown connection handle %d",
2804                         hdev->name, handle);
2805         }
2806
2807         kfree_skb(skb);
2808 }
2809
2810 static void hci_rx_work(struct work_struct *work)
2811 {
2812         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
2813         struct sk_buff *skb;
2814
2815         BT_DBG("%s", hdev->name);
2816
2817         while ((skb = skb_dequeue(&hdev->rx_q))) {
2818                 if (atomic_read(&hdev->promisc)) {
2819                         /* Send copy to the sockets */
2820                         hci_send_to_sock(hdev, skb, NULL);
2821                 }
2822
2823                 if (test_bit(HCI_RAW, &hdev->flags)) {
2824                         kfree_skb(skb);
2825                         continue;
2826                 }
2827
2828                 if (test_bit(HCI_INIT, &hdev->flags)) {
2829                         /* Don't process data packets in this states. */
2830                         switch (bt_cb(skb)->pkt_type) {
2831                         case HCI_ACLDATA_PKT:
2832                         case HCI_SCODATA_PKT:
2833                                 kfree_skb(skb);
2834                                 continue;
2835                         }
2836                 }
2837
2838                 /* Process frame */
2839                 switch (bt_cb(skb)->pkt_type) {
2840                 case HCI_EVENT_PKT:
2841                         BT_DBG("%s Event packet", hdev->name);
2842                         hci_event_packet(hdev, skb);
2843                         break;
2844
2845                 case HCI_ACLDATA_PKT:
2846                         BT_DBG("%s ACL data packet", hdev->name);
2847                         hci_acldata_packet(hdev, skb);
2848                         break;
2849
2850                 case HCI_SCODATA_PKT:
2851                         BT_DBG("%s SCO data packet", hdev->name);
2852                         hci_scodata_packet(hdev, skb);
2853                         break;
2854
2855                 default:
2856                         kfree_skb(skb);
2857                         break;
2858                 }
2859         }
2860 }
2861
2862 static void hci_cmd_work(struct work_struct *work)
2863 {
2864         struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
2865         struct sk_buff *skb;
2866
2867         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2868
2869         /* Send queued commands */
2870         if (atomic_read(&hdev->cmd_cnt)) {
2871                 skb = skb_dequeue(&hdev->cmd_q);
2872                 if (!skb)
2873                         return;
2874
2875                 kfree_skb(hdev->sent_cmd);
2876
2877                 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2878                 if (hdev->sent_cmd) {
2879                         atomic_dec(&hdev->cmd_cnt);
2880                         hci_send_frame(skb);
2881                         if (test_bit(HCI_RESET, &hdev->flags))
2882                                 del_timer(&hdev->cmd_timer);
2883                         else
2884                                 mod_timer(&hdev->cmd_timer,
2885                                   jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2886                 } else {
2887                         skb_queue_head(&hdev->cmd_q, skb);
2888                         queue_work(hdev->workqueue, &hdev->cmd_work);
2889                 }
2890         }
2891 }
2892
2893 int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2894 {
2895         /* General inquiry access code (GIAC) */
2896         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2897         struct hci_cp_inquiry cp;
2898
2899         BT_DBG("%s", hdev->name);
2900
2901         if (test_bit(HCI_INQUIRY, &hdev->flags))
2902                 return -EINPROGRESS;
2903
2904         inquiry_cache_flush(hdev);
2905
2906         memset(&cp, 0, sizeof(cp));
2907         memcpy(&cp.lap, lap, sizeof(cp.lap));
2908         cp.length  = length;
2909
2910         return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2911 }
2912
2913 int hci_cancel_inquiry(struct hci_dev *hdev)
2914 {
2915         BT_DBG("%s", hdev->name);
2916
2917         if (!test_bit(HCI_INQUIRY, &hdev->flags))
2918                 return -EPERM;
2919
2920         return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2921 }
2922
2923 module_param(enable_hs, bool, 0644);
2924 MODULE_PARM_DESC(enable_hs, "Enable High Speed");