net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2011 ProFUSION Embedded Systems
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI core. */
  27
  28 #include <linux/jiffies.h>
  29 #include <linux/module.h>
  30 #include <linux/kmod.h>
  31
  32 #include <linux/types.h>
  33 #include <linux/errno.h>
  34 #include <linux/kernel.h>
  35 #include <linux/sched.h>
  36 #include <linux/slab.h>
  37 #include <linux/poll.h>
  38 #include <linux/fcntl.h>
  39 #include <linux/init.h>
  40 #include <linux/skbuff.h>
  41 #include <linux/workqueue.h>
  42 #include <linux/interrupt.h>
  43 #include <linux/notifier.h>
  44 #include <linux/rfkill.h>
  45 #include <linux/timer.h>
  46 #include <linux/crypto.h>
  47 #include <net/sock.h>
  48
  49 #include <asm/system.h>
  50 #include <linux/uaccess.h>
  51 #include <asm/unaligned.h>
  52
  53 #include <net/bluetooth/bluetooth.h>
  54 #include <net/bluetooth/hci_core.h>
  55
  56 #define AUTO_OFF_TIMEOUT 2000
  57
  58 int enable_hs;
  59
  60 static void hci_rx_work(struct work_struct *work);
  61 static void hci_cmd_work(struct work_struct *work);
  62 static void hci_tx_work(struct work_struct *work);
  63
  64 /* HCI device list */
  65 LIST_HEAD(hci_dev_list);
  66 DEFINE_RWLOCK(hci_dev_list_lock);
  67
  68 /* HCI callback list */
  69 LIST_HEAD(hci_cb_list);
  70 DEFINE_RWLOCK(hci_cb_list_lock);
  71
  72 /* HCI notifiers list */
  73 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
  74
  75 /* ---- HCI notifications ---- */
  76
  77 int hci_register_notifier(struct notifier_block *nb)
  78 {
  79         return atomic_notifier_chain_register(&hci_notifier, nb);
  80 }
  81
  82 int hci_unregister_notifier(struct notifier_block *nb)
  83 {
  84         return atomic_notifier_chain_unregister(&hci_notifier, nb);
  85 }
  86
  87 static void hci_notify(struct hci_dev *hdev, int event)
  88 {
  89         atomic_notifier_call_chain(&hci_notifier, event, hdev);
  90 }
  91
  92 /* ---- HCI requests ---- */
  93
  94 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
  95 {
  96         BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
  97
  98         /* If this is the init phase check if the completed command matches
  99          * the last init command, and if not just return.
 100          */
 101         if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
 102                 return;
 103
 104         if (hdev->req_status == HCI_REQ_PEND) {
 105                 hdev->req_result = result;
 106                 hdev->req_status = HCI_REQ_DONE;
 107                 wake_up_interruptible(&hdev->req_wait_q);
 108         }
 109 }
 110
 111 static void hci_req_cancel(struct hci_dev *hdev, int err)
 112 {
 113         BT_DBG("%s err 0x%2.2x", hdev->name, err);
 114
 115         if (hdev->req_status == HCI_REQ_PEND) {
 116                 hdev->req_result = err;
 117                 hdev->req_status = HCI_REQ_CANCELED;
 118                 wake_up_interruptible(&hdev->req_wait_q);
 119         }
 120 }
 121
 122 /* Execute request and wait for completion. */
 123 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 124                                         unsigned long opt, __u32 timeout)
 125 {
 126         DECLARE_WAITQUEUE(wait, current);
 127         int err = 0;
 128
 129         BT_DBG("%s start", hdev->name);
 130
 131         hdev->req_status = HCI_REQ_PEND;
 132
 133         add_wait_queue(&hdev->req_wait_q, &wait);
 134         set_current_state(TASK_INTERRUPTIBLE);
 135
 136         req(hdev, opt);
 137         schedule_timeout(timeout);
 138
 139         remove_wait_queue(&hdev->req_wait_q, &wait);
 140
 141         if (signal_pending(current))
 142                 return -EINTR;
 143
 144         switch (hdev->req_status) {
 145         case HCI_REQ_DONE:
 146                 err = -bt_to_errno(hdev->req_result);
 147                 break;
 148
 149         case HCI_REQ_CANCELED:
 150                 err = -hdev->req_result;
 151                 break;
 152
 153         default:
 154                 err = -ETIMEDOUT;
 155                 break;
 156         }
 157
 158         hdev->req_status = hdev->req_result = 0;
 159
 160         BT_DBG("%s end: err %d", hdev->name, err);
 161
 162         return err;
 163 }
 164
 165 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 166                                         unsigned long opt, __u32 timeout)
 167 {
 168         int ret;
 169
 170         if (!test_bit(HCI_UP, &hdev->flags))
 171                 return -ENETDOWN;
 172
 173         /* Serialize all requests */
 174         hci_req_lock(hdev);
 175         ret = __hci_request(hdev, req, opt, timeout);
 176         hci_req_unlock(hdev);
 177
 178         return ret;
 179 }
 180
 181 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
 182 {
 183         BT_DBG("%s %ld", hdev->name, opt);
 184
 185         /* Reset device */
 186         set_bit(HCI_RESET, &hdev->flags);
 187         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 188 }
 189
 190 static void bredr_init(struct hci_dev *hdev)
 191 {
 192         struct hci_cp_delete_stored_link_key cp;
 193         __le16 param;
 194         __u8 flt_type;
 195
 196         hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
 197
 198         /* Mandatory initialization */
 199
 200         /* Reset */
 201         if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
 202                 set_bit(HCI_RESET, &hdev->flags);
 203                 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 204         }
 205
 206         /* Read Local Supported Features */
 207         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 208
 209         /* Read Local Version */
 210         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 211
 212         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 213         hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 214
 215         /* Read BD Address */
 216         hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
 217
 218         /* Read Class of Device */
 219         hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 220
 221         /* Read Local Name */
 222         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 223
 224         /* Read Voice Setting */
 225         hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 226
 227         /* Optional initialization */
 228
 229         /* Clear Event Filters */
 230         flt_type = HCI_FLT_CLEAR_ALL;
 231         hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 232
 233         /* Connection accept timeout ~20 secs */
 234         param = cpu_to_le16(0x7d00);
 235         hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 236
 237         bacpy(&cp.bdaddr, BDADDR_ANY);
 238         cp.delete_all = 1;
 239         hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
 240 }
 241
 242 static void amp_init(struct hci_dev *hdev)
 243 {
 244         hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
 245
 246         /* Reset */
 247         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 248
 249         /* Read Local Version */
 250         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 251 }
 252
 253 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 254 {
 255         struct sk_buff *skb;
 256
 257         BT_DBG("%s %ld", hdev->name, opt);
 258
 259         /* Driver initialization */
 260
 261         /* Special commands */
 262         while ((skb = skb_dequeue(&hdev->driver_init))) {
 263                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
 264                 skb->dev = (void *) hdev;
 265
 266                 skb_queue_tail(&hdev->cmd_q, skb);
 267                 queue_work(hdev->workqueue, &hdev->cmd_work);
 268         }
 269         skb_queue_purge(&hdev->driver_init);
 270
 271         switch (hdev->dev_type) {
 272         case HCI_BREDR:
 273                 bredr_init(hdev);
 274                 break;
 275
 276         case HCI_AMP:
 277                 amp_init(hdev);
 278                 break;
 279
 280         default:
 281                 BT_ERR("Unknown device type %d", hdev->dev_type);
 282                 break;
 283         }
 284
 285 }
 286
 287 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
 288 {
 289         BT_DBG("%s", hdev->name);
 290
 291         /* Read LE buffer size */
 292         hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 293 }
 294
 295 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
 296 {
 297         __u8 scan = opt;
 298
 299         BT_DBG("%s %x", hdev->name, scan);
 300
 301         /* Inquiry and Page scans */
 302         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 303 }
 304
 305 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
 306 {
 307         __u8 auth = opt;
 308
 309         BT_DBG("%s %x", hdev->name, auth);
 310
 311         /* Authentication */
 312         hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 313 }
 314
 315 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
 316 {
 317         __u8 encrypt = opt;
 318
 319         BT_DBG("%s %x", hdev->name, encrypt);
 320
 321         /* Encryption */
 322         hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 323 }
 324
 325 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
 326 {
 327         __le16 policy = cpu_to_le16(opt);
 328
 329         BT_DBG("%s %x", hdev->name, policy);
 330
 331         /* Default link policy */
 332         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 333 }
 334
 335 /* Get HCI device by index.
 336  * Device is held on return. */
 337 struct hci_dev *hci_dev_get(int index)
 338 {
 339         struct hci_dev *hdev = NULL, *d;
 340
 341         BT_DBG("%d", index);
 342
 343         if (index < 0)
 344                 return NULL;
 345
 346         read_lock(&hci_dev_list_lock);
 347         list_for_each_entry(d, &hci_dev_list, list) {
 348                 if (d->id == index) {
 349                         hdev = hci_dev_hold(d);
 350                         break;
 351                 }
 352         }
 353         read_unlock(&hci_dev_list_lock);
 354         return hdev;
 355 }
 356
 357 /* ---- Inquiry support ---- */
 358
 359 bool hci_discovery_active(struct hci_dev *hdev)
 360 {
 361         struct discovery_state *discov = &hdev->discovery;
 362
 363         if (discov->state == DISCOVERY_INQUIRY ||
 364                                         discov->state == DISCOVERY_RESOLVING)
 365                 return true;
 366
 367         return false;
 368 }
 369
 370 void hci_discovery_set_state(struct hci_dev *hdev, int state)
 371 {
 372         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
 373
 374         if (hdev->discovery.state == state)
 375                 return;
 376
 377         switch (state) {
 378         case DISCOVERY_STOPPED:
 379                 mgmt_discovering(hdev, 0);
 380                 break;
 381         case DISCOVERY_STARTING:
 382                 break;
 383         case DISCOVERY_INQUIRY:
 384                 mgmt_discovering(hdev, 1);
 385                 break;
 386         case DISCOVERY_RESOLVING:
 387                 break;
 388         case DISCOVERY_STOPPING:
 389                 break;
 390         }
 391
 392         hdev->discovery.state = state;
 393 }
 394
 395 static void inquiry_cache_flush(struct hci_dev *hdev)
 396 {
 397         struct discovery_state *cache = &hdev->discovery;
 398         struct inquiry_entry *p, *n;
 399
 400         list_for_each_entry_safe(p, n, &cache->all, all) {
 401                 list_del(&p->all);
 402                 kfree(p);
 403         }
 404
 405         INIT_LIST_HEAD(&cache->unknown);
 406         INIT_LIST_HEAD(&cache->resolve);
 407         cache->state = DISCOVERY_STOPPED;
 408 }
 409
 410 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 411 {
 412         struct discovery_state *cache = &hdev->discovery;
 413         struct inquiry_entry *e;
 414
 415         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 416
 417         list_for_each_entry(e, &cache->all, all) {
 418                 if (!bacmp(&e->data.bdaddr, bdaddr))
 419                         return e;
 420         }
 421
 422         return NULL;
 423 }
 424
 425 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
 426                                                         bdaddr_t *bdaddr)
 427 {
 428         struct discovery_state *cache = &hdev->discovery;
 429         struct inquiry_entry *e;
 430
 431         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 432
 433         list_for_each_entry(e, &cache->unknown, list) {
 434                 if (!bacmp(&e->data.bdaddr, bdaddr))
 435                         return e;
 436         }
 437
 438         return NULL;
 439 }
 440
 441 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
 442                                                         bdaddr_t *bdaddr,
 443                                                         int state)
 444 {
 445         struct discovery_state *cache = &hdev->discovery;
 446         struct inquiry_entry *e;
 447
 448         BT_DBG("cache %p bdaddr %s state %d", cache, batostr(bdaddr), state);
 449
 450         list_for_each_entry(e, &cache->resolve, list) {
 451                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
 452                         return e;
 453                 if (!bacmp(&e->data.bdaddr, bdaddr))
 454                         return e;
 455         }
 456
 457         return NULL;
 458 }
 459
 460 bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
 461                                                         bool name_known)
 462 {
 463         struct discovery_state *cache = &hdev->discovery;
 464         struct inquiry_entry *ie;
 465
 466         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 467
 468         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
 469         if (ie)
 470                 goto update;
 471
 472         /* Entry not in the cache. Add new one. */
 473         ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
 474         if (!ie)
 475                 return false;
 476
 477         list_add(&ie->all, &cache->all);
 478
 479         if (name_known) {
 480                 ie->name_state = NAME_KNOWN;
 481         } else {
 482                 ie->name_state = NAME_NOT_KNOWN;
 483                 list_add(&ie->list, &cache->unknown);
 484         }
 485
 486 update:
 487         if (name_known && ie->name_state != NAME_KNOWN &&
 488                                         ie->name_state != NAME_PENDING) {
 489                 ie->name_state = NAME_KNOWN;
 490                 list_del(&ie->list);
 491         }
 492
 493         memcpy(&ie->data, data, sizeof(*data));
 494         ie->timestamp = jiffies;
 495         cache->timestamp = jiffies;
 496
 497         if (ie->name_state == NAME_NOT_KNOWN)
 498                 return false;
 499
 500         return true;
 501 }
 502
 503 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 504 {
 505         struct discovery_state *cache = &hdev->discovery;
 506         struct inquiry_info *info = (struct inquiry_info *) buf;
 507         struct inquiry_entry *e;
 508         int copied = 0;
 509
 510         list_for_each_entry(e, &cache->all, all) {
 511                 struct inquiry_data *data = &e->data;
 512
 513                 if (copied >= num)
 514                         break;
 515
 516                 bacpy(&info->bdaddr, &data->bdaddr);
 517                 info->pscan_rep_mode    = data->pscan_rep_mode;
 518                 info->pscan_period_mode = data->pscan_period_mode;
 519                 info->pscan_mode        = data->pscan_mode;
 520                 memcpy(info->dev_class, data->dev_class, 3);
 521                 info->clock_offset      = data->clock_offset;
 522
 523                 info++;
 524                 copied++;
 525         }
 526
 527         BT_DBG("cache %p, copied %d", cache, copied);
 528         return copied;
 529 }
 530
 531 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
 532 {
 533         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
 534         struct hci_cp_inquiry cp;
 535
 536         BT_DBG("%s", hdev->name);
 537
 538         if (test_bit(HCI_INQUIRY, &hdev->flags))
 539                 return;
 540
 541         /* Start Inquiry */
 542         memcpy(&cp.lap, &ir->lap, 3);
 543         cp.length  = ir->length;
 544         cp.num_rsp = ir->num_rsp;
 545         hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
 546 }
 547
 548 int hci_inquiry(void __user *arg)
 549 {
 550         __u8 __user *ptr = arg;
 551         struct hci_inquiry_req ir;
 552         struct hci_dev *hdev;
 553         int err = 0, do_inquiry = 0, max_rsp;
 554         long timeo;
 555         __u8 *buf;
 556
 557         if (copy_from_user(&ir, ptr, sizeof(ir)))
 558                 return -EFAULT;
 559
 560         hdev = hci_dev_get(ir.dev_id);
 561         if (!hdev)
 562                 return -ENODEV;
 563
 564         hci_dev_lock(hdev);
 565         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 566                                 inquiry_cache_empty(hdev) ||
 567                                 ir.flags & IREQ_CACHE_FLUSH) {
 568                 inquiry_cache_flush(hdev);
 569                 do_inquiry = 1;
 570         }
 571         hci_dev_unlock(hdev);
 572
 573         timeo = ir.length * msecs_to_jiffies(2000);
 574
 575         if (do_inquiry) {
 576                 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
 577                 if (err < 0)
 578                         goto done;
 579         }
 580
 581         /* for unlimited number of responses we will use buffer with 255 entries */
 582         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 583
 584         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
 585          * copy it to the user space.
 586          */
 587         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
 588         if (!buf) {
 589                 err = -ENOMEM;
 590                 goto done;
 591         }
 592
 593         hci_dev_lock(hdev);
 594         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
 595         hci_dev_unlock(hdev);
 596
 597         BT_DBG("num_rsp %d", ir.num_rsp);
 598
 599         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
 600                 ptr += sizeof(ir);
 601                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
 602                                         ir.num_rsp))
 603                         err = -EFAULT;
 604         } else
 605                 err = -EFAULT;
 606
 607         kfree(buf);
 608
 609 done:
 610         hci_dev_put(hdev);
 611         return err;
 612 }
 613
 614 /* ---- HCI ioctl helpers ---- */
 615
 616 int hci_dev_open(__u16 dev)
 617 {
 618         struct hci_dev *hdev;
 619         int ret = 0;
 620
 621         hdev = hci_dev_get(dev);
 622         if (!hdev)
 623                 return -ENODEV;
 624
 625         BT_DBG("%s %p", hdev->name, hdev);
 626
 627         hci_req_lock(hdev);
 628
 629         if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
 630                 ret = -ERFKILL;
 631                 goto done;
 632         }
 633
 634         if (test_bit(HCI_UP, &hdev->flags)) {
 635                 ret = -EALREADY;
 636                 goto done;
 637         }
 638
 639         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 640                 set_bit(HCI_RAW, &hdev->flags);
 641
 642         /* Treat all non BR/EDR controllers as raw devices if
 643            enable_hs is not set */
 644         if (hdev->dev_type != HCI_BREDR && !enable_hs)
 645                 set_bit(HCI_RAW, &hdev->flags);
 646
 647         if (hdev->open(hdev)) {
 648                 ret = -EIO;
 649                 goto done;
 650         }
 651
 652         if (!test_bit(HCI_RAW, &hdev->flags)) {
 653                 atomic_set(&hdev->cmd_cnt, 1);
 654                 set_bit(HCI_INIT, &hdev->flags);
 655                 hdev->init_last_cmd = 0;
 656
 657                 ret = __hci_request(hdev, hci_init_req, 0,
 658                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 659
 660                 if (lmp_host_le_capable(hdev))
 661                         ret = __hci_request(hdev, hci_le_init_req, 0,
 662                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 663
 664                 clear_bit(HCI_INIT, &hdev->flags);
 665         }
 666
 667         if (!ret) {
 668                 hci_dev_hold(hdev);
 669                 set_bit(HCI_UP, &hdev->flags);
 670                 hci_notify(hdev, HCI_DEV_UP);
 671                 if (!test_bit(HCI_SETUP, &hdev->flags)) {
 672                         hci_dev_lock(hdev);
 673                         mgmt_powered(hdev, 1);
 674                         hci_dev_unlock(hdev);
 675                 }
 676         } else {
 677                 /* Init failed, cleanup */
 678                 flush_work(&hdev->tx_work);
 679                 flush_work(&hdev->cmd_work);
 680                 flush_work(&hdev->rx_work);
 681
 682                 skb_queue_purge(&hdev->cmd_q);
 683                 skb_queue_purge(&hdev->rx_q);
 684
 685                 if (hdev->flush)
 686                         hdev->flush(hdev);
 687
 688                 if (hdev->sent_cmd) {
 689                         kfree_skb(hdev->sent_cmd);
 690                         hdev->sent_cmd = NULL;
 691                 }
 692
 693                 hdev->close(hdev);
 694                 hdev->flags = 0;
 695         }
 696
 697 done:
 698         hci_req_unlock(hdev);
 699         hci_dev_put(hdev);
 700         return ret;
 701 }
 702
 703 static int hci_dev_do_close(struct hci_dev *hdev)
 704 {
 705         BT_DBG("%s %p", hdev->name, hdev);
 706
 707         hci_req_cancel(hdev, ENODEV);
 708         hci_req_lock(hdev);
 709
 710         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 711                 del_timer_sync(&hdev->cmd_timer);
 712                 hci_req_unlock(hdev);
 713                 return 0;
 714         }
 715
 716         /* Flush RX and TX works */
 717         flush_work(&hdev->tx_work);
 718         flush_work(&hdev->rx_work);
 719
 720         if (hdev->discov_timeout > 0) {
 721                 cancel_delayed_work(&hdev->discov_off);
 722                 hdev->discov_timeout = 0;
 723         }
 724
 725         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 726                 cancel_delayed_work(&hdev->power_off);
 727
 728         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->flags))
 729                 cancel_delayed_work(&hdev->service_cache);
 730
 731         hci_dev_lock(hdev);
 732         inquiry_cache_flush(hdev);
 733         hci_conn_hash_flush(hdev);
 734         hci_dev_unlock(hdev);
 735
 736         hci_notify(hdev, HCI_DEV_DOWN);
 737
 738         if (hdev->flush)
 739                 hdev->flush(hdev);
 740
 741         /* Reset device */
 742         skb_queue_purge(&hdev->cmd_q);
 743         atomic_set(&hdev->cmd_cnt, 1);
 744         if (!test_bit(HCI_RAW, &hdev->flags)) {
 745                 set_bit(HCI_INIT, &hdev->flags);
 746                 __hci_request(hdev, hci_reset_req, 0,
 747                                         msecs_to_jiffies(250));
 748                 clear_bit(HCI_INIT, &hdev->flags);
 749         }
 750
 751         /* flush cmd  work */
 752         flush_work(&hdev->cmd_work);
 753
 754         /* Drop queues */
 755         skb_queue_purge(&hdev->rx_q);
 756         skb_queue_purge(&hdev->cmd_q);
 757         skb_queue_purge(&hdev->raw_q);
 758
 759         /* Drop last sent command */
 760         if (hdev->sent_cmd) {
 761                 del_timer_sync(&hdev->cmd_timer);
 762                 kfree_skb(hdev->sent_cmd);
 763                 hdev->sent_cmd = NULL;
 764         }
 765
 766         /* After this point our queues are empty
 767          * and no tasks are scheduled. */
 768         hdev->close(hdev);
 769
 770         hci_dev_lock(hdev);
 771         mgmt_powered(hdev, 0);
 772         hci_dev_unlock(hdev);
 773
 774         /* Clear flags */
 775         hdev->flags = 0;
 776
 777         hci_req_unlock(hdev);
 778
 779         hci_dev_put(hdev);
 780         return 0;
 781 }
 782
 783 int hci_dev_close(__u16 dev)
 784 {
 785         struct hci_dev *hdev;
 786         int err;
 787
 788         hdev = hci_dev_get(dev);
 789         if (!hdev)
 790                 return -ENODEV;
 791         err = hci_dev_do_close(hdev);
 792         hci_dev_put(hdev);
 793         return err;
 794 }
 795
 796 int hci_dev_reset(__u16 dev)
 797 {
 798         struct hci_dev *hdev;
 799         int ret = 0;
 800
 801         hdev = hci_dev_get(dev);
 802         if (!hdev)
 803                 return -ENODEV;
 804
 805         hci_req_lock(hdev);
 806
 807         if (!test_bit(HCI_UP, &hdev->flags))
 808                 goto done;
 809
 810         /* Drop queues */
 811         skb_queue_purge(&hdev->rx_q);
 812         skb_queue_purge(&hdev->cmd_q);
 813
 814         hci_dev_lock(hdev);
 815         inquiry_cache_flush(hdev);
 816         hci_conn_hash_flush(hdev);
 817         hci_dev_unlock(hdev);
 818
 819         if (hdev->flush)
 820                 hdev->flush(hdev);
 821
 822         atomic_set(&hdev->cmd_cnt, 1);
 823         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
 824
 825         if (!test_bit(HCI_RAW, &hdev->flags))
 826                 ret = __hci_request(hdev, hci_reset_req, 0,
 827                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 828
 829 done:
 830         hci_req_unlock(hdev);
 831         hci_dev_put(hdev);
 832         return ret;
 833 }
 834
 835 int hci_dev_reset_stat(__u16 dev)
 836 {
 837         struct hci_dev *hdev;
 838         int ret = 0;
 839
 840         hdev = hci_dev_get(dev);
 841         if (!hdev)
 842                 return -ENODEV;
 843
 844         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 845
 846         hci_dev_put(hdev);
 847
 848         return ret;
 849 }
 850
 851 int hci_dev_cmd(unsigned int cmd, void __user *arg)
 852 {
 853         struct hci_dev *hdev;
 854         struct hci_dev_req dr;
 855         int err = 0;
 856
 857         if (copy_from_user(&dr, arg, sizeof(dr)))
 858                 return -EFAULT;
 859
 860         hdev = hci_dev_get(dr.dev_id);
 861         if (!hdev)
 862                 return -ENODEV;
 863
 864         switch (cmd) {
 865         case HCISETAUTH:
 866                 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 867                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 868                 break;
 869
 870         case HCISETENCRYPT:
 871                 if (!lmp_encrypt_capable(hdev)) {
 872                         err = -EOPNOTSUPP;
 873                         break;
 874                 }
 875
 876                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
 877                         /* Auth must be enabled first */
 878                         err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 879                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 880                         if (err)
 881                                 break;
 882                 }
 883
 884                 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
 885                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 886                 break;
 887
 888         case HCISETSCAN:
 889                 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
 890                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 891                 break;
 892
 893         case HCISETLINKPOL:
 894                 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
 895                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 896                 break;
 897
 898         case HCISETLINKMODE:
 899                 hdev->link_mode = ((__u16) dr.dev_opt) &
 900                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
 901                 break;
 902
 903         case HCISETPTYPE:
 904                 hdev->pkt_type = (__u16) dr.dev_opt;
 905                 break;
 906
 907         case HCISETACLMTU:
 908                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
 909                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
 910                 break;
 911
 912         case HCISETSCOMTU:
 913                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
 914                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
 915                 break;
 916
 917         default:
 918                 err = -EINVAL;
 919                 break;
 920         }
 921
 922         hci_dev_put(hdev);
 923         return err;
 924 }
 925
 926 int hci_get_dev_list(void __user *arg)
 927 {
 928         struct hci_dev *hdev;
 929         struct hci_dev_list_req *dl;
 930         struct hci_dev_req *dr;
 931         int n = 0, size, err;
 932         __u16 dev_num;
 933
 934         if (get_user(dev_num, (__u16 __user *) arg))
 935                 return -EFAULT;
 936
 937         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
 938                 return -EINVAL;
 939
 940         size = sizeof(*dl) + dev_num * sizeof(*dr);
 941
 942         dl = kzalloc(size, GFP_KERNEL);
 943         if (!dl)
 944                 return -ENOMEM;
 945
 946         dr = dl->dev_req;
 947
 948         read_lock(&hci_dev_list_lock);
 949         list_for_each_entry(hdev, &hci_dev_list, list) {
 950                 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 951                         cancel_delayed_work(&hdev->power_off);
 952
 953                 if (!test_bit(HCI_MGMT, &hdev->flags))
 954                         set_bit(HCI_PAIRABLE, &hdev->flags);
 955
 956                 (dr + n)->dev_id  = hdev->id;
 957                 (dr + n)->dev_opt = hdev->flags;
 958
 959                 if (++n >= dev_num)
 960                         break;
 961         }
 962         read_unlock(&hci_dev_list_lock);
 963
 964         dl->dev_num = n;
 965         size = sizeof(*dl) + n * sizeof(*dr);
 966
 967         err = copy_to_user(arg, dl, size);
 968         kfree(dl);
 969
 970         return err ? -EFAULT : 0;
 971 }
 972
 973 int hci_get_dev_info(void __user *arg)
 974 {
 975         struct hci_dev *hdev;
 976         struct hci_dev_info di;
 977         int err = 0;
 978
 979         if (copy_from_user(&di, arg, sizeof(di)))
 980                 return -EFAULT;
 981
 982         hdev = hci_dev_get(di.dev_id);
 983         if (!hdev)
 984                 return -ENODEV;
 985
 986         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
 987                 cancel_delayed_work_sync(&hdev->power_off);
 988
 989         if (!test_bit(HCI_MGMT, &hdev->flags))
 990                 set_bit(HCI_PAIRABLE, &hdev->flags);
 991
 992         strcpy(di.name, hdev->name);
 993         di.bdaddr   = hdev->bdaddr;
 994         di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
 995         di.flags    = hdev->flags;
 996         di.pkt_type = hdev->pkt_type;
 997         di.acl_mtu  = hdev->acl_mtu;
 998         di.acl_pkts = hdev->acl_pkts;
 999         di.sco_mtu  = hdev->sco_mtu;
1000         di.sco_pkts = hdev->sco_pkts;
1001         di.link_policy = hdev->link_policy;
1002         di.link_mode   = hdev->link_mode;
1003
1004         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1005         memcpy(&di.features, &hdev->features, sizeof(di.features));
1006
1007         if (copy_to_user(arg, &di, sizeof(di)))
1008                 err = -EFAULT;
1009
1010         hci_dev_put(hdev);
1011
1012         return err;
1013 }
1014
1015 /* ---- Interface to HCI drivers ---- */
1016
1017 static int hci_rfkill_set_block(void *data, bool blocked)
1018 {
1019         struct hci_dev *hdev = data;
1020
1021         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1022
1023         if (!blocked)
1024                 return 0;
1025
1026         hci_dev_do_close(hdev);
1027
1028         return 0;
1029 }
1030
1031 static const struct rfkill_ops hci_rfkill_ops = {
1032         .set_block = hci_rfkill_set_block,
1033 };
1034
1035 /* Alloc HCI device */
1036 struct hci_dev *hci_alloc_dev(void)
1037 {
1038         struct hci_dev *hdev;
1039
1040         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1041         if (!hdev)
1042                 return NULL;
1043
1044         hci_init_sysfs(hdev);
1045         skb_queue_head_init(&hdev->driver_init);
1046
1047         return hdev;
1048 }
1049 EXPORT_SYMBOL(hci_alloc_dev);
1050
1051 /* Free HCI device */
1052 void hci_free_dev(struct hci_dev *hdev)
1053 {
1054         skb_queue_purge(&hdev->driver_init);
1055
1056         /* will free via device release */
1057         put_device(&hdev->dev);
1058 }
1059 EXPORT_SYMBOL(hci_free_dev);
1060
1061 static void hci_power_on(struct work_struct *work)
1062 {
1063         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1064
1065         BT_DBG("%s", hdev->name);
1066
1067         if (hci_dev_open(hdev->id) < 0)
1068                 return;
1069
1070         if (test_bit(HCI_AUTO_OFF, &hdev->flags))
1071                 schedule_delayed_work(&hdev->power_off,
1072                                         msecs_to_jiffies(AUTO_OFF_TIMEOUT));
1073
1074         if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
1075                 mgmt_index_added(hdev);
1076 }
1077
1078 static void hci_power_off(struct work_struct *work)
1079 {
1080         struct hci_dev *hdev = container_of(work, struct hci_dev,
1081                                                         power_off.work);
1082
1083         BT_DBG("%s", hdev->name);
1084
1085         clear_bit(HCI_AUTO_OFF, &hdev->flags);
1086
1087         hci_dev_close(hdev->id);
1088 }
1089
1090 static void hci_discov_off(struct work_struct *work)
1091 {
1092         struct hci_dev *hdev;
1093         u8 scan = SCAN_PAGE;
1094
1095         hdev = container_of(work, struct hci_dev, discov_off.work);
1096
1097         BT_DBG("%s", hdev->name);
1098
1099         hci_dev_lock(hdev);
1100
1101         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1102
1103         hdev->discov_timeout = 0;
1104
1105         hci_dev_unlock(hdev);
1106 }
1107
1108 int hci_uuids_clear(struct hci_dev *hdev)
1109 {
1110         struct list_head *p, *n;
1111
1112         list_for_each_safe(p, n, &hdev->uuids) {
1113                 struct bt_uuid *uuid;
1114
1115                 uuid = list_entry(p, struct bt_uuid, list);
1116
1117                 list_del(p);
1118                 kfree(uuid);
1119         }
1120
1121         return 0;
1122 }
1123
1124 int hci_link_keys_clear(struct hci_dev *hdev)
1125 {
1126         struct list_head *p, *n;
1127
1128         list_for_each_safe(p, n, &hdev->link_keys) {
1129                 struct link_key *key;
1130
1131                 key = list_entry(p, struct link_key, list);
1132
1133                 list_del(p);
1134                 kfree(key);
1135         }
1136
1137         return 0;
1138 }
1139
1140 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1141 {
1142         struct link_key *k;
1143
1144         list_for_each_entry(k, &hdev->link_keys, list)
1145                 if (bacmp(bdaddr, &k->bdaddr) == 0)
1146                         return k;
1147
1148         return NULL;
1149 }
1150
1151 static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1152                                                 u8 key_type, u8 old_key_type)
1153 {
1154         /* Legacy key */
1155         if (key_type < 0x03)
1156                 return 1;
1157
1158         /* Debug keys are insecure so don't store them persistently */
1159         if (key_type == HCI_LK_DEBUG_COMBINATION)
1160                 return 0;
1161
1162         /* Changed combination key and there's no previous one */
1163         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1164                 return 0;
1165
1166         /* Security mode 3 case */
1167         if (!conn)
1168                 return 1;
1169
1170         /* Neither local nor remote side had no-bonding as requirement */
1171         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1172                 return 1;
1173
1174         /* Local side had dedicated bonding as requirement */
1175         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1176                 return 1;
1177
1178         /* Remote side had dedicated bonding as requirement */
1179         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1180                 return 1;
1181
1182         /* If none of the above criteria match, then don't store the key
1183          * persistently */
1184         return 0;
1185 }
1186
1187 struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1188 {
1189         struct link_key *k;
1190
1191         list_for_each_entry(k, &hdev->link_keys, list) {
1192                 struct key_master_id *id;
1193
1194                 if (k->type != HCI_LK_SMP_LTK)
1195                         continue;
1196
1197                 if (k->dlen != sizeof(*id))
1198                         continue;
1199
1200                 id = (void *) &k->data;
1201                 if (id->ediv == ediv &&
1202                                 (memcmp(rand, id->rand, sizeof(id->rand)) == 0))
1203                         return k;
1204         }
1205
1206         return NULL;
1207 }
1208 EXPORT_SYMBOL(hci_find_ltk);
1209
1210 struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
1211                                         bdaddr_t *bdaddr, u8 type)
1212 {
1213         struct link_key *k;
1214
1215         list_for_each_entry(k, &hdev->link_keys, list)
1216                 if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
1217                         return k;
1218
1219         return NULL;
1220 }
1221 EXPORT_SYMBOL(hci_find_link_key_type);
1222
1223 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1224                                 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1225 {
1226         struct link_key *key, *old_key;
1227         u8 old_key_type, persistent;
1228
1229         old_key = hci_find_link_key(hdev, bdaddr);
1230         if (old_key) {
1231                 old_key_type = old_key->type;
1232                 key = old_key;
1233         } else {
1234                 old_key_type = conn ? conn->key_type : 0xff;
1235                 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1236                 if (!key)
1237                         return -ENOMEM;
1238                 list_add(&key->list, &hdev->link_keys);
1239         }
1240
1241         BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1242
1243         /* Some buggy controller combinations generate a changed
1244          * combination key for legacy pairing even when there's no
1245          * previous key */
1246         if (type == HCI_LK_CHANGED_COMBINATION &&
1247                                         (!conn || conn->remote_auth == 0xff) &&
1248                                         old_key_type == 0xff) {
1249                 type = HCI_LK_COMBINATION;
1250                 if (conn)
1251                         conn->key_type = type;
1252         }
1253
1254         bacpy(&key->bdaddr, bdaddr);
1255         memcpy(key->val, val, 16);
1256         key->pin_len = pin_len;
1257
1258         if (type == HCI_LK_CHANGED_COMBINATION)
1259                 key->type = old_key_type;
1260         else
1261                 key->type = type;
1262
1263         if (!new_key)
1264                 return 0;
1265
1266         persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1267
1268         mgmt_new_link_key(hdev, key, persistent);
1269
1270         if (!persistent) {
1271                 list_del(&key->list);
1272                 kfree(key);
1273         }
1274
1275         return 0;
1276 }
1277
1278 int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
1279                         u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
1280 {
1281         struct link_key *key, *old_key;
1282         struct key_master_id *id;
1283         u8 old_key_type;
1284
1285         BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
1286
1287         old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
1288         if (old_key) {
1289                 key = old_key;
1290                 old_key_type = old_key->type;
1291         } else {
1292                 key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
1293                 if (!key)
1294                         return -ENOMEM;
1295                 list_add(&key->list, &hdev->link_keys);
1296                 old_key_type = 0xff;
1297         }
1298
1299         key->dlen = sizeof(*id);
1300
1301         bacpy(&key->bdaddr, bdaddr);
1302         memcpy(key->val, ltk, sizeof(key->val));
1303         key->type = HCI_LK_SMP_LTK;
1304         key->pin_len = key_size;
1305
1306         id = (void *) &key->data;
1307         id->ediv = ediv;
1308         memcpy(id->rand, rand, sizeof(id->rand));
1309
1310         if (new_key)
1311                 mgmt_new_link_key(hdev, key, old_key_type);
1312
1313         return 0;
1314 }
1315
1316 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1317 {
1318         struct link_key *key;
1319
1320         key = hci_find_link_key(hdev, bdaddr);
1321         if (!key)
1322                 return -ENOENT;
1323
1324         BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1325
1326         list_del(&key->list);
1327         kfree(key);
1328
1329         return 0;
1330 }
1331
1332 /* HCI command timer function */
1333 static void hci_cmd_timer(unsigned long arg)
1334 {
1335         struct hci_dev *hdev = (void *) arg;
1336
1337         BT_ERR("%s command tx timeout", hdev->name);
1338         atomic_set(&hdev->cmd_cnt, 1);
1339         queue_work(hdev->workqueue, &hdev->cmd_work);
1340 }
1341
1342 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1343                                                         bdaddr_t *bdaddr)
1344 {
1345         struct oob_data *data;
1346
1347         list_for_each_entry(data, &hdev->remote_oob_data, list)
1348                 if (bacmp(bdaddr, &data->bdaddr) == 0)
1349                         return data;
1350
1351         return NULL;
1352 }
1353
1354 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1355 {
1356         struct oob_data *data;
1357
1358         data = hci_find_remote_oob_data(hdev, bdaddr);
1359         if (!data)
1360                 return -ENOENT;
1361
1362         BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1363
1364         list_del(&data->list);
1365         kfree(data);
1366
1367         return 0;
1368 }
1369
1370 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1371 {
1372         struct oob_data *data, *n;
1373
1374         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1375                 list_del(&data->list);
1376                 kfree(data);
1377         }
1378
1379         return 0;
1380 }
1381
1382 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1383                                                                 u8 *randomizer)
1384 {
1385         struct oob_data *data;
1386
1387         data = hci_find_remote_oob_data(hdev, bdaddr);
1388
1389         if (!data) {
1390                 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1391                 if (!data)
1392                         return -ENOMEM;
1393
1394                 bacpy(&data->bdaddr, bdaddr);
1395                 list_add(&data->list, &hdev->remote_oob_data);
1396         }
1397
1398         memcpy(data->hash, hash, sizeof(data->hash));
1399         memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1400
1401         BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1402
1403         return 0;
1404 }
1405
1406 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1407                                                 bdaddr_t *bdaddr)
1408 {
1409         struct bdaddr_list *b;
1410
1411         list_for_each_entry(b, &hdev->blacklist, list)
1412                 if (bacmp(bdaddr, &b->bdaddr) == 0)
1413                         return b;
1414
1415         return NULL;
1416 }
1417
1418 int hci_blacklist_clear(struct hci_dev *hdev)
1419 {
1420         struct list_head *p, *n;
1421
1422         list_for_each_safe(p, n, &hdev->blacklist) {
1423                 struct bdaddr_list *b;
1424
1425                 b = list_entry(p, struct bdaddr_list, list);
1426
1427                 list_del(p);
1428                 kfree(b);
1429         }
1430
1431         return 0;
1432 }
1433
1434 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1435 {
1436         struct bdaddr_list *entry;
1437
1438         if (bacmp(bdaddr, BDADDR_ANY) == 0)
1439                 return -EBADF;
1440
1441         if (hci_blacklist_lookup(hdev, bdaddr))
1442                 return -EEXIST;
1443
1444         entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1445         if (!entry)
1446                 return -ENOMEM;
1447
1448         bacpy(&entry->bdaddr, bdaddr);
1449
1450         list_add(&entry->list, &hdev->blacklist);
1451
1452         return mgmt_device_blocked(hdev, bdaddr);
1453 }
1454
1455 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1456 {
1457         struct bdaddr_list *entry;
1458
1459         if (bacmp(bdaddr, BDADDR_ANY) == 0)
1460                 return hci_blacklist_clear(hdev);
1461
1462         entry = hci_blacklist_lookup(hdev, bdaddr);
1463         if (!entry)
1464                 return -ENOENT;
1465
1466         list_del(&entry->list);
1467         kfree(entry);
1468
1469         return mgmt_device_unblocked(hdev, bdaddr);
1470 }
1471
1472 static void hci_clear_adv_cache(struct work_struct *work)
1473 {
1474         struct hci_dev *hdev = container_of(work, struct hci_dev,
1475                                                         adv_work.work);
1476
1477         hci_dev_lock(hdev);
1478
1479         hci_adv_entries_clear(hdev);
1480
1481         hci_dev_unlock(hdev);
1482 }
1483
1484 int hci_adv_entries_clear(struct hci_dev *hdev)
1485 {
1486         struct adv_entry *entry, *tmp;
1487
1488         list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1489                 list_del(&entry->list);
1490                 kfree(entry);
1491         }
1492
1493         BT_DBG("%s adv cache cleared", hdev->name);
1494
1495         return 0;
1496 }
1497
1498 struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1499 {
1500         struct adv_entry *entry;
1501
1502         list_for_each_entry(entry, &hdev->adv_entries, list)
1503                 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1504                         return entry;
1505
1506         return NULL;
1507 }
1508
1509 static inline int is_connectable_adv(u8 evt_type)
1510 {
1511         if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1512                 return 1;
1513
1514         return 0;
1515 }
1516
1517 int hci_add_adv_entry(struct hci_dev *hdev,
1518                                         struct hci_ev_le_advertising_info *ev)
1519 {
1520         struct adv_entry *entry;
1521
1522         if (!is_connectable_adv(ev->evt_type))
1523                 return -EINVAL;
1524
1525         /* Only new entries should be added to adv_entries. So, if
1526          * bdaddr was found, don't add it. */
1527         if (hci_find_adv_entry(hdev, &ev->bdaddr))
1528                 return 0;
1529
1530         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1531         if (!entry)
1532                 return -ENOMEM;
1533
1534         bacpy(&entry->bdaddr, &ev->bdaddr);
1535         entry->bdaddr_type = ev->bdaddr_type;
1536
1537         list_add(&entry->list, &hdev->adv_entries);
1538
1539         BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1540                                 batostr(&entry->bdaddr), entry->bdaddr_type);
1541
1542         return 0;
1543 }
1544
1545 /* Register HCI device */
1546 int hci_register_dev(struct hci_dev *hdev)
1547 {
1548         struct list_head *head = &hci_dev_list, *p;
1549         int i, id, error;
1550
1551         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1552
1553         if (!hdev->open || !hdev->close)
1554                 return -EINVAL;
1555
1556         /* Do not allow HCI_AMP devices to register at index 0,
1557          * so the index can be used as the AMP controller ID.
1558          */
1559         id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
1560
1561         write_lock(&hci_dev_list_lock);
1562
1563         /* Find first available device id */
1564         list_for_each(p, &hci_dev_list) {
1565                 if (list_entry(p, struct hci_dev, list)->id != id)
1566                         break;
1567                 head = p; id++;
1568         }
1569
1570         sprintf(hdev->name, "hci%d", id);
1571         hdev->id = id;
1572         list_add_tail(&hdev->list, head);
1573
1574         mutex_init(&hdev->lock);
1575
1576         hdev->flags = 0;
1577         hdev->dev_flags = 0;
1578         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1579         hdev->esco_type = (ESCO_HV1);
1580         hdev->link_mode = (HCI_LM_ACCEPT);
1581         hdev->io_capability = 0x03; /* No Input No Output */
1582
1583         hdev->idle_timeout = 0;
1584         hdev->sniff_max_interval = 800;
1585         hdev->sniff_min_interval = 80;
1586
1587         INIT_WORK(&hdev->rx_work, hci_rx_work);
1588         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
1589         INIT_WORK(&hdev->tx_work, hci_tx_work);
1590
1591
1592         skb_queue_head_init(&hdev->rx_q);
1593         skb_queue_head_init(&hdev->cmd_q);
1594         skb_queue_head_init(&hdev->raw_q);
1595
1596         setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1597
1598         for (i = 0; i < NUM_REASSEMBLY; i++)
1599                 hdev->reassembly[i] = NULL;
1600
1601         init_waitqueue_head(&hdev->req_wait_q);
1602         mutex_init(&hdev->req_lock);
1603
1604         discovery_init(hdev);
1605
1606         hci_conn_hash_init(hdev);
1607
1608         INIT_LIST_HEAD(&hdev->mgmt_pending);
1609
1610         INIT_LIST_HEAD(&hdev->blacklist);
1611
1612         INIT_LIST_HEAD(&hdev->uuids);
1613
1614         INIT_LIST_HEAD(&hdev->link_keys);
1615
1616         INIT_LIST_HEAD(&hdev->remote_oob_data);
1617
1618         INIT_LIST_HEAD(&hdev->adv_entries);
1619
1620         INIT_DELAYED_WORK(&hdev->adv_work, hci_clear_adv_cache);
1621         INIT_WORK(&hdev->power_on, hci_power_on);
1622         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
1623
1624         INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1625
1626         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1627
1628         atomic_set(&hdev->promisc, 0);
1629
1630         write_unlock(&hci_dev_list_lock);
1631
1632         hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
1633                                                         WQ_MEM_RECLAIM, 1);
1634         if (!hdev->workqueue) {
1635                 error = -ENOMEM;
1636                 goto err;
1637         }
1638
1639         error = hci_add_sysfs(hdev);
1640         if (error < 0)
1641                 goto err_wqueue;
1642
1643         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1644                                 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1645         if (hdev->rfkill) {
1646                 if (rfkill_register(hdev->rfkill) < 0) {
1647                         rfkill_destroy(hdev->rfkill);
1648                         hdev->rfkill = NULL;
1649                 }
1650         }
1651
1652         set_bit(HCI_AUTO_OFF, &hdev->flags);
1653         set_bit(HCI_SETUP, &hdev->flags);
1654         schedule_work(&hdev->power_on);
1655
1656         hci_notify(hdev, HCI_DEV_REG);
1657         __hci_dev_hold(hdev);
1658
1659         return id;
1660
1661 err_wqueue:
1662         destroy_workqueue(hdev->workqueue);
1663 err:
1664         write_lock(&hci_dev_list_lock);
1665         list_del(&hdev->list);
1666         write_unlock(&hci_dev_list_lock);
1667
1668         return error;
1669 }
1670 EXPORT_SYMBOL(hci_register_dev);
1671
1672 /* Unregister HCI device */
1673 void hci_unregister_dev(struct hci_dev *hdev)
1674 {
1675         int i;
1676
1677         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1678
1679         write_lock(&hci_dev_list_lock);
1680         list_del(&hdev->list);
1681         write_unlock(&hci_dev_list_lock);
1682
1683         hci_dev_do_close(hdev);
1684
1685         for (i = 0; i < NUM_REASSEMBLY; i++)
1686                 kfree_skb(hdev->reassembly[i]);
1687
1688         if (!test_bit(HCI_INIT, &hdev->flags) &&
1689                                         !test_bit(HCI_SETUP, &hdev->flags)) {
1690                 hci_dev_lock(hdev);
1691                 mgmt_index_removed(hdev);
1692                 hci_dev_unlock(hdev);
1693         }
1694
1695         /* mgmt_index_removed should take care of emptying the
1696          * pending list */
1697         BUG_ON(!list_empty(&hdev->mgmt_pending));
1698
1699         hci_notify(hdev, HCI_DEV_UNREG);
1700
1701         if (hdev->rfkill) {
1702                 rfkill_unregister(hdev->rfkill);
1703                 rfkill_destroy(hdev->rfkill);
1704         }
1705
1706         hci_del_sysfs(hdev);
1707
1708         cancel_delayed_work_sync(&hdev->adv_work);
1709
1710         destroy_workqueue(hdev->workqueue);
1711
1712         hci_dev_lock(hdev);
1713         hci_blacklist_clear(hdev);
1714         hci_uuids_clear(hdev);
1715         hci_link_keys_clear(hdev);
1716         hci_remote_oob_data_clear(hdev);
1717         hci_adv_entries_clear(hdev);
1718         hci_dev_unlock(hdev);
1719
1720         __hci_dev_put(hdev);
1721 }
1722 EXPORT_SYMBOL(hci_unregister_dev);
1723
1724 /* Suspend HCI device */
1725 int hci_suspend_dev(struct hci_dev *hdev)
1726 {
1727         hci_notify(hdev, HCI_DEV_SUSPEND);
1728         return 0;
1729 }
1730 EXPORT_SYMBOL(hci_suspend_dev);
1731
1732 /* Resume HCI device */
1733 int hci_resume_dev(struct hci_dev *hdev)
1734 {
1735         hci_notify(hdev, HCI_DEV_RESUME);
1736         return 0;
1737 }
1738 EXPORT_SYMBOL(hci_resume_dev);
1739
1740 /* Receive frame from HCI drivers */
1741 int hci_recv_frame(struct sk_buff *skb)
1742 {
1743         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1744         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1745                                 && !test_bit(HCI_INIT, &hdev->flags))) {
1746                 kfree_skb(skb);
1747                 return -ENXIO;
1748         }
1749
1750         /* Incomming skb */
1751         bt_cb(skb)->incoming = 1;
1752
1753         /* Time stamp */
1754         __net_timestamp(skb);
1755
1756         skb_queue_tail(&hdev->rx_q, skb);
1757         queue_work(hdev->workqueue, &hdev->rx_work);
1758
1759         return 0;
1760 }
1761 EXPORT_SYMBOL(hci_recv_frame);
1762
1763 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1764                                                   int count, __u8 index)
1765 {
1766         int len = 0;
1767         int hlen = 0;
1768         int remain = count;
1769         struct sk_buff *skb;
1770         struct bt_skb_cb *scb;
1771
1772         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1773                                 index >= NUM_REASSEMBLY)
1774                 return -EILSEQ;
1775
1776         skb = hdev->reassembly[index];
1777
1778         if (!skb) {
1779                 switch (type) {
1780                 case HCI_ACLDATA_PKT:
1781                         len = HCI_MAX_FRAME_SIZE;
1782                         hlen = HCI_ACL_HDR_SIZE;
1783                         break;
1784                 case HCI_EVENT_PKT:
1785                         len = HCI_MAX_EVENT_SIZE;
1786                         hlen = HCI_EVENT_HDR_SIZE;
1787                         break;
1788                 case HCI_SCODATA_PKT:
1789                         len = HCI_MAX_SCO_SIZE;
1790                         hlen = HCI_SCO_HDR_SIZE;
1791                         break;
1792                 }
1793
1794                 skb = bt_skb_alloc(len, GFP_ATOMIC);
1795                 if (!skb)
1796                         return -ENOMEM;
1797
1798                 scb = (void *) skb->cb;
1799                 scb->expect = hlen;
1800                 scb->pkt_type = type;
1801
1802                 skb->dev = (void *) hdev;
1803                 hdev->reassembly[index] = skb;
1804         }
1805
1806         while (count) {
1807                 scb = (void *) skb->cb;
1808                 len = min(scb->expect, (__u16)count);
1809
1810                 memcpy(skb_put(skb, len), data, len);
1811
1812                 count -= len;
1813                 data += len;
1814                 scb->expect -= len;
1815                 remain = count;
1816
1817                 switch (type) {
1818                 case HCI_EVENT_PKT:
1819                         if (skb->len == HCI_EVENT_HDR_SIZE) {
1820                                 struct hci_event_hdr *h = hci_event_hdr(skb);
1821                                 scb->expect = h->plen;
1822
1823                                 if (skb_tailroom(skb) < scb->expect) {
1824                                         kfree_skb(skb);
1825                                         hdev->reassembly[index] = NULL;
1826                                         return -ENOMEM;
1827                                 }
1828                         }
1829                         break;
1830
1831                 case HCI_ACLDATA_PKT:
1832                         if (skb->len  == HCI_ACL_HDR_SIZE) {
1833                                 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1834                                 scb->expect = __le16_to_cpu(h->dlen);
1835
1836                                 if (skb_tailroom(skb) < scb->expect) {
1837                                         kfree_skb(skb);
1838                                         hdev->reassembly[index] = NULL;
1839                                         return -ENOMEM;
1840                                 }
1841                         }
1842                         break;
1843
1844                 case HCI_SCODATA_PKT:
1845                         if (skb->len == HCI_SCO_HDR_SIZE) {
1846                                 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1847                                 scb->expect = h->dlen;
1848
1849                                 if (skb_tailroom(skb) < scb->expect) {
1850                                         kfree_skb(skb);
1851                                         hdev->reassembly[index] = NULL;
1852                                         return -ENOMEM;
1853                                 }
1854                         }
1855                         break;
1856                 }
1857
1858                 if (scb->expect == 0) {
1859                         /* Complete frame */
1860
1861                         bt_cb(skb)->pkt_type = type;
1862                         hci_recv_frame(skb);
1863
1864                         hdev->reassembly[index] = NULL;
1865                         return remain;
1866                 }
1867         }
1868
1869         return remain;
1870 }
1871
1872 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1873 {
1874         int rem = 0;
1875
1876         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1877                 return -EILSEQ;
1878
1879         while (count) {
1880                 rem = hci_reassembly(hdev, type, data, count, type - 1);
1881                 if (rem < 0)
1882                         return rem;
1883
1884                 data += (count - rem);
1885                 count = rem;
1886         }
1887
1888         return rem;
1889 }
1890 EXPORT_SYMBOL(hci_recv_fragment);
1891
1892 #define STREAM_REASSEMBLY 0
1893
1894 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1895 {
1896         int type;
1897         int rem = 0;
1898
1899         while (count) {
1900                 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1901
1902                 if (!skb) {
1903                         struct { char type; } *pkt;
1904
1905                         /* Start of the frame */
1906                         pkt = data;
1907                         type = pkt->type;
1908
1909                         data++;
1910                         count--;
1911                 } else
1912                         type = bt_cb(skb)->pkt_type;
1913
1914                 rem = hci_reassembly(hdev, type, data, count,
1915                                                         STREAM_REASSEMBLY);
1916                 if (rem < 0)
1917                         return rem;
1918
1919                 data += (count - rem);
1920                 count = rem;
1921         }
1922
1923         return rem;
1924 }
1925 EXPORT_SYMBOL(hci_recv_stream_fragment);
1926
1927 /* ---- Interface to upper protocols ---- */
1928
1929 int hci_register_cb(struct hci_cb *cb)
1930 {
1931         BT_DBG("%p name %s", cb, cb->name);
1932
1933         write_lock(&hci_cb_list_lock);
1934         list_add(&cb->list, &hci_cb_list);
1935         write_unlock(&hci_cb_list_lock);
1936
1937         return 0;
1938 }
1939 EXPORT_SYMBOL(hci_register_cb);
1940
1941 int hci_unregister_cb(struct hci_cb *cb)
1942 {
1943         BT_DBG("%p name %s", cb, cb->name);
1944
1945         write_lock(&hci_cb_list_lock);
1946         list_del(&cb->list);
1947         write_unlock(&hci_cb_list_lock);
1948
1949         return 0;
1950 }
1951 EXPORT_SYMBOL(hci_unregister_cb);
1952
1953 static int hci_send_frame(struct sk_buff *skb)
1954 {
1955         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1956
1957         if (!hdev) {
1958                 kfree_skb(skb);
1959                 return -ENODEV;
1960         }
1961
1962         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1963
1964         if (atomic_read(&hdev->promisc)) {
1965                 /* Time stamp */
1966                 __net_timestamp(skb);
1967
1968                 hci_send_to_sock(hdev, skb, NULL);
1969         }
1970
1971         /* Get rid of skb owner, prior to sending to the driver. */
1972         skb_orphan(skb);
1973
1974         return hdev->send(skb);
1975 }
1976
1977 /* Send HCI command */
1978 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1979 {
1980         int len = HCI_COMMAND_HDR_SIZE + plen;
1981         struct hci_command_hdr *hdr;
1982         struct sk_buff *skb;
1983
1984         BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1985
1986         skb = bt_skb_alloc(len, GFP_ATOMIC);
1987         if (!skb) {
1988                 BT_ERR("%s no memory for command", hdev->name);
1989                 return -ENOMEM;
1990         }
1991
1992         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1993         hdr->opcode = cpu_to_le16(opcode);
1994         hdr->plen   = plen;
1995
1996         if (plen)
1997                 memcpy(skb_put(skb, plen), param, plen);
1998
1999         BT_DBG("skb len %d", skb->len);
2000
2001         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
2002         skb->dev = (void *) hdev;
2003
2004         if (test_bit(HCI_INIT, &hdev->flags))
2005                 hdev->init_last_cmd = opcode;
2006
2007         skb_queue_tail(&hdev->cmd_q, skb);
2008         queue_work(hdev->workqueue, &hdev->cmd_work);
2009
2010         return 0;
2011 }
2012
2013 /* Get data from the previously sent command */
2014 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
2015 {
2016         struct hci_command_hdr *hdr;
2017
2018         if (!hdev->sent_cmd)
2019                 return NULL;
2020
2021         hdr = (void *) hdev->sent_cmd->data;
2022
2023         if (hdr->opcode != cpu_to_le16(opcode))
2024                 return NULL;
2025
2026         BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2027
2028         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2029 }
2030
2031 /* Send ACL data */
2032 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2033 {
2034         struct hci_acl_hdr *hdr;
2035         int len = skb->len;
2036
2037         skb_push(skb, HCI_ACL_HDR_SIZE);
2038         skb_reset_transport_header(skb);
2039         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
2040         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2041         hdr->dlen   = cpu_to_le16(len);
2042 }
2043
2044 static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
2045                                 struct sk_buff *skb, __u16 flags)
2046 {
2047         struct hci_dev *hdev = conn->hdev;
2048         struct sk_buff *list;
2049
2050         list = skb_shinfo(skb)->frag_list;
2051         if (!list) {
2052                 /* Non fragmented */
2053                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2054
2055                 skb_queue_tail(queue, skb);
2056         } else {
2057                 /* Fragmented */
2058                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2059
2060                 skb_shinfo(skb)->frag_list = NULL;
2061
2062                 /* Queue all fragments atomically */
2063                 spin_lock(&queue->lock);
2064
2065                 __skb_queue_tail(queue, skb);
2066
2067                 flags &= ~ACL_START;
2068                 flags |= ACL_CONT;
2069                 do {
2070                         skb = list; list = list->next;
2071
2072                         skb->dev = (void *) hdev;
2073                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2074                         hci_add_acl_hdr(skb, conn->handle, flags);
2075
2076                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2077
2078                         __skb_queue_tail(queue, skb);
2079                 } while (list);
2080
2081                 spin_unlock(&queue->lock);
2082         }
2083 }
2084
2085 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2086 {
2087         struct hci_conn *conn = chan->conn;
2088         struct hci_dev *hdev = conn->hdev;
2089
2090         BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
2091
2092         skb->dev = (void *) hdev;
2093         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2094         hci_add_acl_hdr(skb, conn->handle, flags);
2095
2096         hci_queue_acl(conn, &chan->data_q, skb, flags);
2097
2098         queue_work(hdev->workqueue, &hdev->tx_work);
2099 }
2100 EXPORT_SYMBOL(hci_send_acl);
2101
2102 /* Send SCO data */
2103 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2104 {
2105         struct hci_dev *hdev = conn->hdev;
2106         struct hci_sco_hdr hdr;
2107
2108         BT_DBG("%s len %d", hdev->name, skb->len);
2109
2110         hdr.handle = cpu_to_le16(conn->handle);
2111         hdr.dlen   = skb->len;
2112
2113         skb_push(skb, HCI_SCO_HDR_SIZE);
2114         skb_reset_transport_header(skb);
2115         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2116
2117         skb->dev = (void *) hdev;
2118         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2119
2120         skb_queue_tail(&conn->data_q, skb);
2121         queue_work(hdev->workqueue, &hdev->tx_work);
2122 }
2123 EXPORT_SYMBOL(hci_send_sco);
2124
2125 /* ---- HCI TX task (outgoing data) ---- */
2126
2127 /* HCI Connection scheduler */
2128 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2129 {
2130         struct hci_conn_hash *h = &hdev->conn_hash;
2131         struct hci_conn *conn = NULL, *c;
2132         int num = 0, min = ~0;
2133
2134         /* We don't have to lock device here. Connections are always
2135          * added and removed with TX task disabled. */
2136
2137         rcu_read_lock();
2138
2139         list_for_each_entry_rcu(c, &h->list, list) {
2140                 if (c->type != type || skb_queue_empty(&c->data_q))
2141                         continue;
2142
2143                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2144                         continue;
2145
2146                 num++;
2147
2148                 if (c->sent < min) {
2149                         min  = c->sent;
2150                         conn = c;
2151                 }
2152
2153                 if (hci_conn_num(hdev, type) == num)
2154                         break;
2155         }
2156
2157         rcu_read_unlock();
2158
2159         if (conn) {
2160                 int cnt, q;
2161
2162                 switch (conn->type) {
2163                 case ACL_LINK:
2164                         cnt = hdev->acl_cnt;
2165                         break;
2166                 case SCO_LINK:
2167                 case ESCO_LINK:
2168                         cnt = hdev->sco_cnt;
2169                         break;
2170                 case LE_LINK:
2171                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2172                         break;
2173                 default:
2174                         cnt = 0;
2175                         BT_ERR("Unknown link type");
2176                 }
2177
2178                 q = cnt / num;
2179                 *quote = q ? q : 1;
2180         } else
2181                 *quote = 0;
2182
2183         BT_DBG("conn %p quote %d", conn, *quote);
2184         return conn;
2185 }
2186
2187 static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2188 {
2189         struct hci_conn_hash *h = &hdev->conn_hash;
2190         struct hci_conn *c;
2191
2192         BT_ERR("%s link tx timeout", hdev->name);
2193
2194         rcu_read_lock();
2195
2196         /* Kill stalled connections */
2197         list_for_each_entry_rcu(c, &h->list, list) {
2198                 if (c->type == type && c->sent) {
2199                         BT_ERR("%s killing stalled connection %s",
2200                                 hdev->name, batostr(&c->dst));
2201                         hci_acl_disconn(c, 0x13);
2202                 }
2203         }
2204
2205         rcu_read_unlock();
2206 }
2207
2208 static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2209                                                 int *quote)
2210 {
2211         struct hci_conn_hash *h = &hdev->conn_hash;
2212         struct hci_chan *chan = NULL;
2213         int num = 0, min = ~0, cur_prio = 0;
2214         struct hci_conn *conn;
2215         int cnt, q, conn_num = 0;
2216
2217         BT_DBG("%s", hdev->name);
2218
2219         rcu_read_lock();
2220
2221         list_for_each_entry_rcu(conn, &h->list, list) {
2222                 struct hci_chan *tmp;
2223
2224                 if (conn->type != type)
2225                         continue;
2226
2227                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2228                         continue;
2229
2230                 conn_num++;
2231
2232                 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2233                         struct sk_buff *skb;
2234
2235                         if (skb_queue_empty(&tmp->data_q))
2236                                 continue;
2237
2238                         skb = skb_peek(&tmp->data_q);
2239                         if (skb->priority < cur_prio)
2240                                 continue;
2241
2242                         if (skb->priority > cur_prio) {
2243                                 num = 0;
2244                                 min = ~0;
2245                                 cur_prio = skb->priority;
2246                         }
2247
2248                         num++;
2249
2250                         if (conn->sent < min) {
2251                                 min  = conn->sent;
2252                                 chan = tmp;
2253                         }
2254                 }
2255
2256                 if (hci_conn_num(hdev, type) == conn_num)
2257                         break;
2258         }
2259
2260         rcu_read_unlock();
2261
2262         if (!chan)
2263                 return NULL;
2264
2265         switch (chan->conn->type) {
2266         case ACL_LINK:
2267                 cnt = hdev->acl_cnt;
2268                 break;
2269         case SCO_LINK:
2270         case ESCO_LINK:
2271                 cnt = hdev->sco_cnt;
2272                 break;
2273         case LE_LINK:
2274                 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2275                 break;
2276         default:
2277                 cnt = 0;
2278                 BT_ERR("Unknown link type");
2279         }
2280
2281         q = cnt / num;
2282         *quote = q ? q : 1;
2283         BT_DBG("chan %p quote %d", chan, *quote);
2284         return chan;
2285 }
2286
2287 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2288 {
2289         struct hci_conn_hash *h = &hdev->conn_hash;
2290         struct hci_conn *conn;
2291         int num = 0;
2292
2293         BT_DBG("%s", hdev->name);
2294
2295         rcu_read_lock();
2296
2297         list_for_each_entry_rcu(conn, &h->list, list) {
2298                 struct hci_chan *chan;
2299
2300                 if (conn->type != type)
2301                         continue;
2302
2303                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2304                         continue;
2305
2306                 num++;
2307
2308                 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
2309                         struct sk_buff *skb;
2310
2311                         if (chan->sent) {
2312                                 chan->sent = 0;
2313                                 continue;
2314                         }
2315
2316                         if (skb_queue_empty(&chan->data_q))
2317                                 continue;
2318
2319                         skb = skb_peek(&chan->data_q);
2320                         if (skb->priority >= HCI_PRIO_MAX - 1)
2321                                 continue;
2322
2323                         skb->priority = HCI_PRIO_MAX - 1;
2324
2325                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2326                                                                 skb->priority);
2327                 }
2328
2329                 if (hci_conn_num(hdev, type) == num)
2330                         break;
2331         }
2332
2333         rcu_read_unlock();
2334
2335 }
2336
2337 static inline void hci_sched_acl(struct hci_dev *hdev)
2338 {
2339         struct hci_chan *chan;
2340         struct sk_buff *skb;
2341         int quote;
2342         unsigned int cnt;
2343
2344         BT_DBG("%s", hdev->name);
2345
2346         if (!hci_conn_num(hdev, ACL_LINK))
2347                 return;
2348
2349         if (!test_bit(HCI_RAW, &hdev->flags)) {
2350                 /* ACL tx timeout must be longer than maximum
2351                  * link supervision timeout (40.9 seconds) */
2352                 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx +
2353                                         msecs_to_jiffies(HCI_ACL_TX_TIMEOUT)))
2354                         hci_link_tx_to(hdev, ACL_LINK);
2355         }
2356
2357         cnt = hdev->acl_cnt;
2358
2359         while (hdev->acl_cnt &&
2360                         (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2361                 u32 priority = (skb_peek(&chan->data_q))->priority;
2362                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2363                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2364                                         skb->len, skb->priority);
2365
2366                         /* Stop if priority has changed */
2367                         if (skb->priority < priority)
2368                                 break;
2369
2370                         skb = skb_dequeue(&chan->data_q);
2371
2372                         hci_conn_enter_active_mode(chan->conn,
2373                                                 bt_cb(skb)->force_active);
2374
2375                         hci_send_frame(skb);
2376                         hdev->acl_last_tx = jiffies;
2377
2378                         hdev->acl_cnt--;
2379                         chan->sent++;
2380                         chan->conn->sent++;
2381                 }
2382         }
2383
2384         if (cnt != hdev->acl_cnt)
2385                 hci_prio_recalculate(hdev, ACL_LINK);
2386 }
2387
2388 /* Schedule SCO */
2389 static inline void hci_sched_sco(struct hci_dev *hdev)
2390 {
2391         struct hci_conn *conn;
2392         struct sk_buff *skb;
2393         int quote;
2394
2395         BT_DBG("%s", hdev->name);
2396
2397         if (!hci_conn_num(hdev, SCO_LINK))
2398                 return;
2399
2400         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2401                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2402                         BT_DBG("skb %p len %d", skb, skb->len);
2403                         hci_send_frame(skb);
2404
2405                         conn->sent++;
2406                         if (conn->sent == ~0)
2407                                 conn->sent = 0;
2408                 }
2409         }
2410 }
2411
2412 static inline void hci_sched_esco(struct hci_dev *hdev)
2413 {
2414         struct hci_conn *conn;
2415         struct sk_buff *skb;
2416         int quote;
2417
2418         BT_DBG("%s", hdev->name);
2419
2420         if (!hci_conn_num(hdev, ESCO_LINK))
2421                 return;
2422
2423         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2424                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2425                         BT_DBG("skb %p len %d", skb, skb->len);
2426                         hci_send_frame(skb);
2427
2428                         conn->sent++;
2429                         if (conn->sent == ~0)
2430                                 conn->sent = 0;
2431                 }
2432         }
2433 }
2434
2435 static inline void hci_sched_le(struct hci_dev *hdev)
2436 {
2437         struct hci_chan *chan;
2438         struct sk_buff *skb;
2439         int quote, cnt, tmp;
2440
2441         BT_DBG("%s", hdev->name);
2442
2443         if (!hci_conn_num(hdev, LE_LINK))
2444                 return;
2445
2446         if (!test_bit(HCI_RAW, &hdev->flags)) {
2447                 /* LE tx timeout must be longer than maximum
2448                  * link supervision timeout (40.9 seconds) */
2449                 if (!hdev->le_cnt && hdev->le_pkts &&
2450                                 time_after(jiffies, hdev->le_last_tx + HZ * 45))
2451                         hci_link_tx_to(hdev, LE_LINK);
2452         }
2453
2454         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2455         tmp = cnt;
2456         while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
2457                 u32 priority = (skb_peek(&chan->data_q))->priority;
2458                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2459                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2460                                         skb->len, skb->priority);
2461
2462                         /* Stop if priority has changed */
2463                         if (skb->priority < priority)
2464                                 break;
2465
2466                         skb = skb_dequeue(&chan->data_q);
2467
2468                         hci_send_frame(skb);
2469                         hdev->le_last_tx = jiffies;
2470
2471                         cnt--;
2472                         chan->sent++;
2473                         chan->conn->sent++;
2474                 }
2475         }
2476
2477         if (hdev->le_pkts)
2478                 hdev->le_cnt = cnt;
2479         else
2480                 hdev->acl_cnt = cnt;
2481
2482         if (cnt != tmp)
2483                 hci_prio_recalculate(hdev, LE_LINK);
2484 }
2485
2486 static void hci_tx_work(struct work_struct *work)
2487 {
2488         struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
2489         struct sk_buff *skb;
2490
2491         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2492                 hdev->sco_cnt, hdev->le_cnt);
2493
2494         /* Schedule queues and send stuff to HCI driver */
2495
2496         hci_sched_acl(hdev);
2497
2498         hci_sched_sco(hdev);
2499
2500         hci_sched_esco(hdev);
2501
2502         hci_sched_le(hdev);
2503
2504         /* Send next queued raw (unknown type) packet */
2505         while ((skb = skb_dequeue(&hdev->raw_q)))
2506                 hci_send_frame(skb);
2507 }
2508
2509 /* ----- HCI RX task (incoming data processing) ----- */
2510
2511 /* ACL data packet */
2512 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2513 {
2514         struct hci_acl_hdr *hdr = (void *) skb->data;
2515         struct hci_conn *conn;
2516         __u16 handle, flags;
2517
2518         skb_pull(skb, HCI_ACL_HDR_SIZE);
2519
2520         handle = __le16_to_cpu(hdr->handle);
2521         flags  = hci_flags(handle);
2522         handle = hci_handle(handle);
2523
2524         BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2525
2526         hdev->stat.acl_rx++;
2527
2528         hci_dev_lock(hdev);
2529         conn = hci_conn_hash_lookup_handle(hdev, handle);
2530         hci_dev_unlock(hdev);
2531
2532         if (conn) {
2533                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
2534
2535                 /* Send to upper protocol */
2536                 l2cap_recv_acldata(conn, skb, flags);
2537                 return;
2538         } else {
2539                 BT_ERR("%s ACL packet for unknown connection handle %d",
2540                         hdev->name, handle);
2541         }
2542
2543         kfree_skb(skb);
2544 }
2545
2546 /* SCO data packet */
2547 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2548 {
2549         struct hci_sco_hdr *hdr = (void *) skb->data;
2550         struct hci_conn *conn;
2551         __u16 handle;
2552
2553         skb_pull(skb, HCI_SCO_HDR_SIZE);
2554
2555         handle = __le16_to_cpu(hdr->handle);
2556
2557         BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2558
2559         hdev->stat.sco_rx++;
2560
2561         hci_dev_lock(hdev);
2562         conn = hci_conn_hash_lookup_handle(hdev, handle);
2563         hci_dev_unlock(hdev);
2564
2565         if (conn) {
2566                 /* Send to upper protocol */
2567                 sco_recv_scodata(conn, skb);
2568                 return;
2569         } else {
2570                 BT_ERR("%s SCO packet for unknown connection handle %d",
2571                         hdev->name, handle);
2572         }
2573
2574         kfree_skb(skb);
2575 }
2576
2577 static void hci_rx_work(struct work_struct *work)
2578 {
2579         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
2580         struct sk_buff *skb;
2581
2582         BT_DBG("%s", hdev->name);
2583
2584         while ((skb = skb_dequeue(&hdev->rx_q))) {
2585                 if (atomic_read(&hdev->promisc)) {
2586                         /* Send copy to the sockets */
2587                         hci_send_to_sock(hdev, skb, NULL);
2588                 }
2589
2590                 if (test_bit(HCI_RAW, &hdev->flags)) {
2591                         kfree_skb(skb);
2592                         continue;
2593                 }
2594
2595                 if (test_bit(HCI_INIT, &hdev->flags)) {
2596                         /* Don't process data packets in this states. */
2597                         switch (bt_cb(skb)->pkt_type) {
2598                         case HCI_ACLDATA_PKT:
2599                         case HCI_SCODATA_PKT:
2600                                 kfree_skb(skb);
2601                                 continue;
2602                         }
2603                 }
2604
2605                 /* Process frame */
2606                 switch (bt_cb(skb)->pkt_type) {
2607                 case HCI_EVENT_PKT:
2608                         BT_DBG("%s Event packet", hdev->name);
2609                         hci_event_packet(hdev, skb);
2610                         break;
2611
2612                 case HCI_ACLDATA_PKT:
2613                         BT_DBG("%s ACL data packet", hdev->name);
2614                         hci_acldata_packet(hdev, skb);
2615                         break;
2616
2617                 case HCI_SCODATA_PKT:
2618                         BT_DBG("%s SCO data packet", hdev->name);
2619                         hci_scodata_packet(hdev, skb);
2620                         break;
2621
2622                 default:
2623                         kfree_skb(skb);
2624                         break;
2625                 }
2626         }
2627 }
2628
2629 static void hci_cmd_work(struct work_struct *work)
2630 {
2631         struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
2632         struct sk_buff *skb;
2633
2634         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2635
2636         /* Send queued commands */
2637         if (atomic_read(&hdev->cmd_cnt)) {
2638                 skb = skb_dequeue(&hdev->cmd_q);
2639                 if (!skb)
2640                         return;
2641
2642                 kfree_skb(hdev->sent_cmd);
2643
2644                 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2645                 if (hdev->sent_cmd) {
2646                         atomic_dec(&hdev->cmd_cnt);
2647                         hci_send_frame(skb);
2648                         if (test_bit(HCI_RESET, &hdev->flags))
2649                                 del_timer(&hdev->cmd_timer);
2650                         else
2651                                 mod_timer(&hdev->cmd_timer,
2652                                   jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2653                 } else {
2654                         skb_queue_head(&hdev->cmd_q, skb);
2655                         queue_work(hdev->workqueue, &hdev->cmd_work);
2656                 }
2657         }
2658 }
2659
2660 int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2661 {
2662         /* General inquiry access code (GIAC) */
2663         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2664         struct hci_cp_inquiry cp;
2665
2666         BT_DBG("%s", hdev->name);
2667
2668         if (test_bit(HCI_INQUIRY, &hdev->flags))
2669                 return -EINPROGRESS;
2670
2671         inquiry_cache_flush(hdev);
2672
2673         memset(&cp, 0, sizeof(cp));
2674         memcpy(&cp.lap, lap, sizeof(cp.lap));
2675         cp.length  = length;
2676
2677         return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2678 }
2679
2680 int hci_cancel_inquiry(struct hci_dev *hdev)
2681 {
2682         BT_DBG("%s", hdev->name);
2683
2684         if (!test_bit(HCI_INQUIRY, &hdev->flags))
2685                 return -EPERM;
2686
2687         return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2688 }
2689
2690 module_param(enable_hs, bool, 0644);
2691 MODULE_PARM_DESC(enable_hs, "Enable High Speed");