projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Add simple SMP pairing negotiation
[linux-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
8e87d142
YH		 20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 22 SOFTWARE IS DISCLAIMED.
23*/
24
25/* Bluetooth HCI core. */
26
82453021 27#include <linux/jiffies.h>
1da177e4
LT		 28#include <linux/module.h>
29#include <linux/kmod.h>
30
31#include <linux/types.h>
32#include <linux/errno.h>
33#include <linux/kernel.h>
1da177e4
LT		 34#include <linux/sched.h>
35#include <linux/slab.h>
36#include <linux/poll.h>
37#include <linux/fcntl.h>
38#include <linux/init.h>
39#include <linux/skbuff.h>
f48fd9c8 40#include <linux/workqueue.h>
1da177e4
LT		 41#include <linux/interrupt.h>
42#include <linux/notifier.h>
611b30f7 43#include <linux/rfkill.h>
6bd32326 44#include <linux/timer.h>
1da177e4
LT		 45#include <net/sock.h>
46
47#include <asm/system.h>
70f23020 48#include <linux/uaccess.h>
1da177e4
LT		 49#include <asm/unaligned.h>
50
51#include <net/bluetooth/bluetooth.h>
52#include <net/bluetooth/hci_core.h>
53
ab81cbf9
JH		 54#define AUTO_OFF_TIMEOUT 2000
55
1da177e4
LT		 56static void hci_cmd_task(unsigned long arg);
57static void hci_rx_task(unsigned long arg);
58static void hci_tx_task(unsigned long arg);
1da177e4
LT		 59
60static DEFINE_RWLOCK(hci_task_lock);
61
62/* HCI device list */
63LIST_HEAD(hci_dev_list);
64DEFINE_RWLOCK(hci_dev_list_lock);
65
66/* HCI callback list */
67LIST_HEAD(hci_cb_list);
68DEFINE_RWLOCK(hci_cb_list_lock);
69
70/* HCI protocols */
71#define HCI_MAX_PROTO 2
72struct hci_proto *hci_proto[HCI_MAX_PROTO];
73
74/* HCI notifiers list */
e041c683 75static ATOMIC_NOTIFIER_HEAD(hci_notifier);
1da177e4
LT		 76
77/* ---- HCI notifications ---- */
78
79int hci_register_notifier(struct notifier_block *nb)
80{
e041c683 81 return atomic_notifier_chain_register(&hci_notifier, nb);
1da177e4
LT		 82}
83
84int hci_unregister_notifier(struct notifier_block *nb)
85{
e041c683 86 return atomic_notifier_chain_unregister(&hci_notifier, nb);
1da177e4
LT		 87}
88
6516455d 89static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 90{
e041c683 91 atomic_notifier_call_chain(&hci_notifier, event, hdev);
1da177e4
LT		 92}
93
94/* ---- HCI requests ---- */
95
23bb5763 96void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
1da177e4 97{
23bb5763
JH		 98 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
99
a5040efa
JH		 100 /* If this is the init phase check if the completed command matches
101 * the last init command, and if not just return.
102 */
103 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
23bb5763 104 return;
1da177e4
LT		 105
106 if (hdev->req_status == HCI_REQ_PEND) {
107 hdev->req_result = result;
108 hdev->req_status = HCI_REQ_DONE;
109 wake_up_interruptible(&hdev->req_wait_q);
110 }
111}
112
113static void hci_req_cancel(struct hci_dev *hdev, int err)
114{
115 BT_DBG("%s err 0x%2.2x", hdev->name, err);
116
117 if (hdev->req_status == HCI_REQ_PEND) {
118 hdev->req_result = err;
119 hdev->req_status = HCI_REQ_CANCELED;
120 wake_up_interruptible(&hdev->req_wait_q);
121 }
122}
123
124/* Execute request and wait for completion. */
8e87d142 125static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 126 unsigned long opt, __u32 timeout)
1da177e4
LT		 127{
128 DECLARE_WAITQUEUE(wait, current);
129 int err = 0;
130
131 BT_DBG("%s start", hdev->name);
132
133 hdev->req_status = HCI_REQ_PEND;
134
135 add_wait_queue(&hdev->req_wait_q, &wait);
136 set_current_state(TASK_INTERRUPTIBLE);
137
138 req(hdev, opt);
139 schedule_timeout(timeout);
140
141 remove_wait_queue(&hdev->req_wait_q, &wait);
142
143 if (signal_pending(current))
144 return -EINTR;
145
146 switch (hdev->req_status) {
147 case HCI_REQ_DONE:
148 err = -bt_err(hdev->req_result);
149 break;
150
151 case HCI_REQ_CANCELED:
152 err = -hdev->req_result;
153 break;
154
155 default:
156 err = -ETIMEDOUT;
157 break;
3ff50b79 158 }
1da177e4 159
a5040efa 160 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 161
162 BT_DBG("%s end: err %d", hdev->name, err);
163
164 return err;
165}
166
167static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
01df8c31 168 unsigned long opt, __u32 timeout)
1da177e4
LT		 169{
170 int ret;
171
7c6a329e
MH		 172 if (!test_bit(HCI_UP, &hdev->flags))
173 return -ENETDOWN;
174
1da177e4
LT		 175 /* Serialize all requests */
176 hci_req_lock(hdev);
177 ret = __hci_request(hdev, req, opt, timeout);
178 hci_req_unlock(hdev);
179
180 return ret;
181}
182
183static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
184{
185 BT_DBG("%s %ld", hdev->name, opt);
186
187 /* Reset device */
f630cf0d 188 set_bit(HCI_RESET, &hdev->flags);
a9de9248 189 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 190}
191
192static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
193{
b0916ea0 194 struct hci_cp_delete_stored_link_key cp;
1da177e4 195 struct sk_buff *skb;
1ebb9252 196 __le16 param;
89f2783d 197 __u8 flt_type;
1da177e4
LT		 198
199 BT_DBG("%s %ld", hdev->name, opt);
200
201 /* Driver initialization */
202
203 /* Special commands */
204 while ((skb = skb_dequeue(&hdev->driver_init))) {
0d48d939 205 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 206 skb->dev = (void *) hdev;
c78ae283 207
1da177e4 208 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 209 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 210 }
211 skb_queue_purge(&hdev->driver_init);
212
213 /* Mandatory initialization */
214
215 /* Reset */
f630cf0d
GP		 216 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
217 set_bit(HCI_RESET, &hdev->flags);
a9de9248 218 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
f630cf0d 219 }
1da177e4
LT		 220
221 /* Read Local Supported Features */
a9de9248 222 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 223
1143e5a6 224 /* Read Local Version */
a9de9248 225 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1143e5a6 226
1da177e4 227 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
a9de9248 228 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1da177e4
LT		 229
230#if 0
231 /* Host buffer size */
232 {
233 struct hci_cp_host_buffer_size cp;
aca3192c 234 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
1da177e4 235 cp.sco_mtu = HCI_MAX_SCO_SIZE;
aca3192c
YH		 236 cp.acl_max_pkt = cpu_to_le16(0xffff);
237 cp.sco_max_pkt = cpu_to_le16(0xffff);
a9de9248 238 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
1da177e4
LT		 239 }
240#endif
241
242 /* Read BD Address */
a9de9248
MH		 243 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
244
245 /* Read Class of Device */
246 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
247
248 /* Read Local Name */
249 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1da177e4
LT		 250
251 /* Read Voice Setting */
a9de9248 252 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1da177e4
LT		 253
254 /* Optional initialization */
255
256 /* Clear Event Filters */
89f2783d 257 flt_type = HCI_FLT_CLEAR_ALL;
a9de9248 258 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1da177e4 259
1da177e4 260 /* Connection accept timeout ~20 secs */
aca3192c 261 param = cpu_to_le16(0x7d00);
a9de9248 262 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
b0916ea0
JH		 263
264 bacpy(&cp.bdaddr, BDADDR_ANY);
265 cp.delete_all = 1;
266 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
1da177e4
LT		 267}
268
6ed58ec5
VT		 269static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
270{
271 BT_DBG("%s", hdev->name);
272
273 /* Read LE buffer size */
274 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
275}
276
1da177e4
LT		 277static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
278{
279 __u8 scan = opt;
280
281 BT_DBG("%s %x", hdev->name, scan);
282
283 /* Inquiry and Page scans */
a9de9248 284 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 285}
286
287static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
288{
289 __u8 auth = opt;
290
291 BT_DBG("%s %x", hdev->name, auth);
292
293 /* Authentication */
a9de9248 294 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 295}
296
297static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
298{
299 __u8 encrypt = opt;
300
301 BT_DBG("%s %x", hdev->name, encrypt);
302
e4e8e37c 303 /* Encryption */
a9de9248 304 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 305}
306
e4e8e37c
MH		 307static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
308{
309 __le16 policy = cpu_to_le16(opt);
310
a418b893 311 BT_DBG("%s %x", hdev->name, policy);
e4e8e37c
MH		 312
313 /* Default link policy */
314 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
315}
316
8e87d142 317/* Get HCI device by index.
1da177e4
LT		 318 * Device is held on return. */
319struct hci_dev *hci_dev_get(int index)
320{
321 struct hci_dev *hdev = NULL;
322 struct list_head *p;
323
324 BT_DBG("%d", index);
325
326 if (index < 0)
327 return NULL;
328
329 read_lock(&hci_dev_list_lock);
330 list_for_each(p, &hci_dev_list) {
331 struct hci_dev *d = list_entry(p, struct hci_dev, list);
332 if (d->id == index) {
333 hdev = hci_dev_hold(d);
334 break;
335 }
336 }
337 read_unlock(&hci_dev_list_lock);
338 return hdev;
339}
1da177e4
LT		 340
341/* ---- Inquiry support ---- */
342static void inquiry_cache_flush(struct hci_dev *hdev)
343{
344 struct inquiry_cache *cache = &hdev->inq_cache;
345 struct inquiry_entry *next = cache->list, *e;
346
347 BT_DBG("cache %p", cache);
348
349 cache->list = NULL;
350 while ((e = next)) {
351 next = e->next;
352 kfree(e);
353 }
354}
355
356struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
357{
358 struct inquiry_cache *cache = &hdev->inq_cache;
359 struct inquiry_entry *e;
360
361 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
362
363 for (e = cache->list; e; e = e->next)
364 if (!bacmp(&e->data.bdaddr, bdaddr))
365 break;
366 return e;
367}
368
369void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
370{
371 struct inquiry_cache *cache = &hdev->inq_cache;
70f23020 372 struct inquiry_entry *ie;
1da177e4
LT		 373
374 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
375
70f23020
AE		 376 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
377 if (!ie) {
1da177e4 378 /* Entry not in the cache. Add new one. */
70f23020
AE		 379 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
380 if (!ie)
1da177e4 381 return;
70f23020
AE		 382
383 ie->next = cache->list;
384 cache->list = ie;
1da177e4
LT		 385 }
386
70f23020
AE		 387 memcpy(&ie->data, data, sizeof(*data));
388 ie->timestamp = jiffies;
1da177e4
LT		 389 cache->timestamp = jiffies;
390}
391
392static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
393{
394 struct inquiry_cache *cache = &hdev->inq_cache;
395 struct inquiry_info *info = (struct inquiry_info *) buf;
396 struct inquiry_entry *e;
397 int copied = 0;
398
399 for (e = cache->list; e && copied < num; e = e->next, copied++) {
400 struct inquiry_data *data = &e->data;
401 bacpy(&info->bdaddr, &data->bdaddr);
402 info->pscan_rep_mode = data->pscan_rep_mode;
403 info->pscan_period_mode = data->pscan_period_mode;
404 info->pscan_mode = data->pscan_mode;
405 memcpy(info->dev_class, data->dev_class, 3);
406 info->clock_offset = data->clock_offset;
407 info++;
408 }
409
410 BT_DBG("cache %p, copied %d", cache, copied);
411 return copied;
412}
413
414static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
415{
416 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
417 struct hci_cp_inquiry cp;
418
419 BT_DBG("%s", hdev->name);
420
421 if (test_bit(HCI_INQUIRY, &hdev->flags))
422 return;
423
424 /* Start Inquiry */
425 memcpy(&cp.lap, &ir->lap, 3);
426 cp.length = ir->length;
427 cp.num_rsp = ir->num_rsp;
a9de9248 428 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 429}
430
431int hci_inquiry(void __user *arg)
432{
433 __u8 __user *ptr = arg;
434 struct hci_inquiry_req ir;
435 struct hci_dev *hdev;
436 int err = 0, do_inquiry = 0, max_rsp;
437 long timeo;
438 __u8 *buf;
439
440 if (copy_from_user(&ir, ptr, sizeof(ir)))
441 return -EFAULT;
442
5a08ecce
AE		 443 hdev = hci_dev_get(ir.dev_id);
444 if (!hdev)
1da177e4
LT		 445 return -ENODEV;
446
447 hci_dev_lock_bh(hdev);
8e87d142 448 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
70f23020
AE		 449 inquiry_cache_empty(hdev) ||
450 ir.flags & IREQ_CACHE_FLUSH) {
1da177e4
LT		 451 inquiry_cache_flush(hdev);
452 do_inquiry = 1;
453 }
454 hci_dev_unlock_bh(hdev);
455
04837f64 456 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 457
458 if (do_inquiry) {
459 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
460 if (err < 0)
461 goto done;
462 }
1da177e4
LT		 463
464 /* for unlimited number of responses we will use buffer with 255 entries */
465 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
466
467 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
468 * copy it to the user space.
469 */
01df8c31 470 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 471 if (!buf) {
1da177e4
LT		 472 err = -ENOMEM;
473 goto done;
474 }
475
476 hci_dev_lock_bh(hdev);
477 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
478 hci_dev_unlock_bh(hdev);
479
480 BT_DBG("num_rsp %d", ir.num_rsp);
481
482 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
483 ptr += sizeof(ir);
484 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
485 ir.num_rsp))
486 err = -EFAULT;
8e87d142 487 } else
1da177e4
LT		 488 err = -EFAULT;
489
490 kfree(buf);
491
492done:
493 hci_dev_put(hdev);
494 return err;
495}
496
497/* ---- HCI ioctl helpers ---- */
498
499int hci_dev_open(__u16 dev)
500{
501 struct hci_dev *hdev;
502 int ret = 0;
503
5a08ecce
AE		 504 hdev = hci_dev_get(dev);
505 if (!hdev)
1da177e4
LT		 506 return -ENODEV;
507
508 BT_DBG("%s %p", hdev->name, hdev);
509
510 hci_req_lock(hdev);
511
611b30f7
MH		 512 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
513 ret = -ERFKILL;
514 goto done;
515 }
516
1da177e4
LT		 517 if (test_bit(HCI_UP, &hdev->flags)) {
518 ret = -EALREADY;
519 goto done;
520 }
521
522 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
523 set_bit(HCI_RAW, &hdev->flags);
524
943da25d
MH		 525 /* Treat all non BR/EDR controllers as raw devices for now */
526 if (hdev->dev_type != HCI_BREDR)
527 set_bit(HCI_RAW, &hdev->flags);
528
1da177e4
LT		 529 if (hdev->open(hdev)) {
530 ret = -EIO;
531 goto done;
532 }
533
534 if (!test_bit(HCI_RAW, &hdev->flags)) {
535 atomic_set(&hdev->cmd_cnt, 1);
536 set_bit(HCI_INIT, &hdev->flags);
a5040efa 537 hdev->init_last_cmd = 0;
1da177e4 538
04837f64
MH		 539 ret = __hci_request(hdev, hci_init_req, 0,
540 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4 541
6ed58ec5
VT		 542 if (lmp_le_capable(hdev))
543 ret = __hci_request(hdev, hci_le_init_req, 0,
544 msecs_to_jiffies(HCI_INIT_TIMEOUT));
545
1da177e4
LT		 546 clear_bit(HCI_INIT, &hdev->flags);
547 }
548
549 if (!ret) {
550 hci_dev_hold(hdev);
551 set_bit(HCI_UP, &hdev->flags);
552 hci_notify(hdev, HCI_DEV_UP);
5add6af8
JH		 553 if (!test_bit(HCI_SETUP, &hdev->flags))
554 mgmt_powered(hdev->id, 1);
8e87d142 555 } else {
1da177e4
LT		 556 /* Init failed, cleanup */
557 tasklet_kill(&hdev->rx_task);
558 tasklet_kill(&hdev->tx_task);
559 tasklet_kill(&hdev->cmd_task);
560
561 skb_queue_purge(&hdev->cmd_q);
562 skb_queue_purge(&hdev->rx_q);
563
564 if (hdev->flush)
565 hdev->flush(hdev);
566
567 if (hdev->sent_cmd) {
568 kfree_skb(hdev->sent_cmd);
569 hdev->sent_cmd = NULL;
570 }
571
572 hdev->close(hdev);
573 hdev->flags = 0;
574 }
575
576done:
577 hci_req_unlock(hdev);
578 hci_dev_put(hdev);
579 return ret;
580}
581
582static int hci_dev_do_close(struct hci_dev *hdev)
583{
584 BT_DBG("%s %p", hdev->name, hdev);
585
586 hci_req_cancel(hdev, ENODEV);
587 hci_req_lock(hdev);
588
589 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 590 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 591 hci_req_unlock(hdev);
592 return 0;
593 }
594
595 /* Kill RX and TX tasks */
596 tasklet_kill(&hdev->rx_task);
597 tasklet_kill(&hdev->tx_task);
598
599 hci_dev_lock_bh(hdev);
600 inquiry_cache_flush(hdev);
601 hci_conn_hash_flush(hdev);
602 hci_dev_unlock_bh(hdev);
603
604 hci_notify(hdev, HCI_DEV_DOWN);
605
606 if (hdev->flush)
607 hdev->flush(hdev);
608
609 /* Reset device */
610 skb_queue_purge(&hdev->cmd_q);
611 atomic_set(&hdev->cmd_cnt, 1);
612 if (!test_bit(HCI_RAW, &hdev->flags)) {
613 set_bit(HCI_INIT, &hdev->flags);
04837f64
MH		 614 __hci_request(hdev, hci_reset_req, 0,
615 msecs_to_jiffies(250));
1da177e4
LT		 616 clear_bit(HCI_INIT, &hdev->flags);
617 }
618
619 /* Kill cmd task */
620 tasklet_kill(&hdev->cmd_task);
621
622 /* Drop queues */
623 skb_queue_purge(&hdev->rx_q);
624 skb_queue_purge(&hdev->cmd_q);
625 skb_queue_purge(&hdev->raw_q);
626
627 /* Drop last sent command */
628 if (hdev->sent_cmd) {
b79f44c1 629 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 630 kfree_skb(hdev->sent_cmd);
631 hdev->sent_cmd = NULL;
632 }
633
634 /* After this point our queues are empty
635 * and no tasks are scheduled. */
636 hdev->close(hdev);
637
5add6af8
JH		 638 mgmt_powered(hdev->id, 0);
639
1da177e4
LT		 640 /* Clear flags */
641 hdev->flags = 0;
642
643 hci_req_unlock(hdev);
644
645 hci_dev_put(hdev);
646 return 0;
647}
648
649int hci_dev_close(__u16 dev)
650{
651 struct hci_dev *hdev;
652 int err;
653
70f23020
AE		 654 hdev = hci_dev_get(dev);
655 if (!hdev)
1da177e4
LT		 656 return -ENODEV;
657 err = hci_dev_do_close(hdev);
658 hci_dev_put(hdev);
659 return err;
660}
661
662int hci_dev_reset(__u16 dev)
663{
664 struct hci_dev *hdev;
665 int ret = 0;
666
70f23020
AE		 667 hdev = hci_dev_get(dev);
668 if (!hdev)
1da177e4
LT		 669 return -ENODEV;
670
671 hci_req_lock(hdev);
672 tasklet_disable(&hdev->tx_task);
673
674 if (!test_bit(HCI_UP, &hdev->flags))
675 goto done;
676
677 /* Drop queues */
678 skb_queue_purge(&hdev->rx_q);
679 skb_queue_purge(&hdev->cmd_q);
680
681 hci_dev_lock_bh(hdev);
682 inquiry_cache_flush(hdev);
683 hci_conn_hash_flush(hdev);
684 hci_dev_unlock_bh(hdev);
685
686 if (hdev->flush)
687 hdev->flush(hdev);
688
8e87d142 689 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 690 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 691
692 if (!test_bit(HCI_RAW, &hdev->flags))
04837f64
MH		 693 ret = __hci_request(hdev, hci_reset_req, 0,
694 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 695
696done:
697 tasklet_enable(&hdev->tx_task);
698 hci_req_unlock(hdev);
699 hci_dev_put(hdev);
700 return ret;
701}
702
703int hci_dev_reset_stat(__u16 dev)
704{
705 struct hci_dev *hdev;
706 int ret = 0;
707
70f23020
AE		 708 hdev = hci_dev_get(dev);
709 if (!hdev)
1da177e4
LT		 710 return -ENODEV;
711
712 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
713
714 hci_dev_put(hdev);
715
716 return ret;
717}
718
719int hci_dev_cmd(unsigned int cmd, void __user *arg)
720{
721 struct hci_dev *hdev;
722 struct hci_dev_req dr;
723 int err = 0;
724
725 if (copy_from_user(&dr, arg, sizeof(dr)))
726 return -EFAULT;
727
70f23020
AE		 728 hdev = hci_dev_get(dr.dev_id);
729 if (!hdev)
1da177e4
LT		 730 return -ENODEV;
731
732 switch (cmd) {
733 case HCISETAUTH:
04837f64
MH		 734 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
735 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 736 break;
737
738 case HCISETENCRYPT:
739 if (!lmp_encrypt_capable(hdev)) {
740 err = -EOPNOTSUPP;
741 break;
742 }
743
744 if (!test_bit(HCI_AUTH, &hdev->flags)) {
745 /* Auth must be enabled first */
04837f64
MH		 746 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
747 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 748 if (err)
749 break;
750 }
751
04837f64
MH		 752 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
753 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 754 break;
755
756 case HCISETSCAN:
04837f64
MH		 757 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
758 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 759 break;
760
1da177e4 761 case HCISETLINKPOL:
e4e8e37c
MH		 762 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
763 msecs_to_jiffies(HCI_INIT_TIMEOUT));
1da177e4
LT		 764 break;
765
766 case HCISETLINKMODE:
e4e8e37c
MH		 767 hdev->link_mode = ((__u16) dr.dev_opt) &
768 (HCI_LM_MASTER | HCI_LM_ACCEPT);
769 break;
770
771 case HCISETPTYPE:
772 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 773 break;
774
775 case HCISETACLMTU:
e4e8e37c
MH		 776 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
777 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 778 break;
779
780 case HCISETSCOMTU:
e4e8e37c
MH		 781 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
782 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 783 break;
784
785 default:
786 err = -EINVAL;
787 break;
788 }
e4e8e37c 789
1da177e4
LT		 790 hci_dev_put(hdev);
791 return err;
792}
793
794int hci_get_dev_list(void __user *arg)
795{
796 struct hci_dev_list_req *dl;
797 struct hci_dev_req *dr;
798 struct list_head *p;
799 int n = 0, size, err;
800 __u16 dev_num;
801
802 if (get_user(dev_num, (__u16 __user *) arg))
803 return -EFAULT;
804
805 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
806 return -EINVAL;
807
808 size = sizeof(*dl) + dev_num * sizeof(*dr);
809
70f23020
AE		 810 dl = kzalloc(size, GFP_KERNEL);
811 if (!dl)
1da177e4
LT		 812 return -ENOMEM;
813
814 dr = dl->dev_req;
815
816 read_lock_bh(&hci_dev_list_lock);
817 list_for_each(p, &hci_dev_list) {
818 struct hci_dev *hdev;
c542a06c 819
1da177e4 820 hdev = list_entry(p, struct hci_dev, list);
c542a06c 821
ab81cbf9 822 hci_del_off_timer(hdev);
c542a06c
JH		 823
824 if (!test_bit(HCI_MGMT, &hdev->flags))
825 set_bit(HCI_PAIRABLE, &hdev->flags);
826
1da177e4
LT		 827 (dr + n)->dev_id = hdev->id;
828 (dr + n)->dev_opt = hdev->flags;
c542a06c 829
1da177e4
LT		 830 if (++n >= dev_num)
831 break;
832 }
833 read_unlock_bh(&hci_dev_list_lock);
834
835 dl->dev_num = n;
836 size = sizeof(*dl) + n * sizeof(*dr);
837
838 err = copy_to_user(arg, dl, size);
839 kfree(dl);
840
841 return err ? -EFAULT : 0;
842}
843
844int hci_get_dev_info(void __user *arg)
845{
846 struct hci_dev *hdev;
847 struct hci_dev_info di;
848 int err = 0;
849
850 if (copy_from_user(&di, arg, sizeof(di)))
851 return -EFAULT;
852
70f23020
AE		 853 hdev = hci_dev_get(di.dev_id);
854 if (!hdev)
1da177e4
LT		 855 return -ENODEV;
856
ab81cbf9
JH		 857 hci_del_off_timer(hdev);
858
c542a06c
JH		 859 if (!test_bit(HCI_MGMT, &hdev->flags))
860 set_bit(HCI_PAIRABLE, &hdev->flags);
861
1da177e4
LT		 862 strcpy(di.name, hdev->name);
863 di.bdaddr = hdev->bdaddr;
943da25d 864 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 865 di.flags = hdev->flags;
866 di.pkt_type = hdev->pkt_type;
867 di.acl_mtu = hdev->acl_mtu;
868 di.acl_pkts = hdev->acl_pkts;
869 di.sco_mtu = hdev->sco_mtu;
870 di.sco_pkts = hdev->sco_pkts;
871 di.link_policy = hdev->link_policy;
872 di.link_mode = hdev->link_mode;
873
874 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
875 memcpy(&di.features, &hdev->features, sizeof(di.features));
876
877 if (copy_to_user(arg, &di, sizeof(di)))
878 err = -EFAULT;
879
880 hci_dev_put(hdev);
881
882 return err;
883}
884
885/* ---- Interface to HCI drivers ---- */
886
611b30f7
MH		 887static int hci_rfkill_set_block(void *data, bool blocked)
888{
889 struct hci_dev *hdev = data;
890
891 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
892
893 if (!blocked)
894 return 0;
895
896 hci_dev_do_close(hdev);
897
898 return 0;
899}
900
901static const struct rfkill_ops hci_rfkill_ops = {
902 .set_block = hci_rfkill_set_block,
903};
904
1da177e4
LT		 905/* Alloc HCI device */
906struct hci_dev *hci_alloc_dev(void)
907{
908 struct hci_dev *hdev;
909
25ea6db0 910 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1da177e4
LT		 911 if (!hdev)
912 return NULL;
913
1da177e4
LT		 914 skb_queue_head_init(&hdev->driver_init);
915
916 return hdev;
917}
918EXPORT_SYMBOL(hci_alloc_dev);
919
920/* Free HCI device */
921void hci_free_dev(struct hci_dev *hdev)
922{
923 skb_queue_purge(&hdev->driver_init);
924
a91f2e39
MH		 925 /* will free via device release */
926 put_device(&hdev->dev);
1da177e4
LT		 927}
928EXPORT_SYMBOL(hci_free_dev);
929
ab81cbf9
JH		 930static void hci_power_on(struct work_struct *work)
931{
932 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
933
934 BT_DBG("%s", hdev->name);
935
936 if (hci_dev_open(hdev->id) < 0)
937 return;
938
939 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
940 mod_timer(&hdev->off_timer,
941 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
942
943 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
944 mgmt_index_added(hdev->id);
945}
946
947static void hci_power_off(struct work_struct *work)
948{
949 struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
950
951 BT_DBG("%s", hdev->name);
952
953 hci_dev_close(hdev->id);
954}
955
956static void hci_auto_off(unsigned long data)
957{
958 struct hci_dev *hdev = (struct hci_dev *) data;
959
960 BT_DBG("%s", hdev->name);
961
962 clear_bit(HCI_AUTO_OFF, &hdev->flags);
963
964 queue_work(hdev->workqueue, &hdev->power_off);
965}
966
967void hci_del_off_timer(struct hci_dev *hdev)
968{
969 BT_DBG("%s", hdev->name);
970
971 clear_bit(HCI_AUTO_OFF, &hdev->flags);
972 del_timer(&hdev->off_timer);
973}
974
2aeb9a1a
JH		 975int hci_uuids_clear(struct hci_dev *hdev)
976{
977 struct list_head *p, *n;
978
979 list_for_each_safe(p, n, &hdev->uuids) {
980 struct bt_uuid *uuid;
981
982 uuid = list_entry(p, struct bt_uuid, list);
983
984 list_del(p);
985 kfree(uuid);
986 }
987
988 return 0;
989}
990
55ed8ca1
JH		 991int hci_link_keys_clear(struct hci_dev *hdev)
992{
993 struct list_head *p, *n;
994
995 list_for_each_safe(p, n, &hdev->link_keys) {
996 struct link_key *key;
997
998 key = list_entry(p, struct link_key, list);
999
1000 list_del(p);
1001 kfree(key);
1002 }
1003
1004 return 0;
1005}
1006
1007struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1008{
1009 struct list_head *p;
1010
1011 list_for_each(p, &hdev->link_keys) {
1012 struct link_key *k;
1013
1014 k = list_entry(p, struct link_key, list);
1015
1016 if (bacmp(bdaddr, &k->bdaddr) == 0)
1017 return k;
1018 }
1019
1020 return NULL;
1021}
1022
d25e28ab
JH		 1023static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1024 u8 key_type, u8 old_key_type)
1025{
1026 /* Legacy key */
1027 if (key_type < 0x03)
1028 return 1;
1029
1030 /* Debug keys are insecure so don't store them persistently */
1031 if (key_type == HCI_LK_DEBUG_COMBINATION)
1032 return 0;
1033
1034 /* Changed combination key and there's no previous one */
1035 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1036 return 0;
1037
1038 /* Security mode 3 case */
1039 if (!conn)
1040 return 1;
1041
1042 /* Neither local nor remote side had no-bonding as requirement */
1043 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1044 return 1;
1045
1046 /* Local side had dedicated bonding as requirement */
1047 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1048 return 1;
1049
1050 /* Remote side had dedicated bonding as requirement */
1051 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1052 return 1;
1053
1054 /* If none of the above criteria match, then don't store the key
1055 * persistently */
1056 return 0;
1057}
1058
1059int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1060 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1061{
1062 struct link_key *key, *old_key;
4df378a1 1063 u8 old_key_type, persistent;
55ed8ca1
JH		 1064
1065 old_key = hci_find_link_key(hdev, bdaddr);
1066 if (old_key) {
1067 old_key_type = old_key->type;
1068 key = old_key;
1069 } else {
12adcf3a 1070 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1071 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1072 if (!key)
1073 return -ENOMEM;
1074 list_add(&key->list, &hdev->link_keys);
1075 }
1076
1077 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1078
d25e28ab
JH		 1079 /* Some buggy controller combinations generate a changed
1080 * combination key for legacy pairing even when there's no
1081 * previous key */
1082 if (type == HCI_LK_CHANGED_COMBINATION &&
1083 (!conn || conn->remote_auth == 0xff) &&
655fe6ec 1084 old_key_type == 0xff) {
d25e28ab 1085 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1086 if (conn)
1087 conn->key_type = type;
1088 }
d25e28ab 1089
55ed8ca1
JH		 1090 bacpy(&key->bdaddr, bdaddr);
1091 memcpy(key->val, val, 16);
55ed8ca1
JH		 1092 key->pin_len = pin_len;
1093
b6020ba0 1094 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1095 key->type = old_key_type;
4748fed2
JH		 1096 else
1097 key->type = type;
1098
4df378a1
JH		 1099 if (!new_key)
1100 return 0;
1101
1102 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1103
1104 mgmt_new_key(hdev->id, key, persistent);
1105
1106 if (!persistent) {
1107 list_del(&key->list);
1108 kfree(key);
1109 }
55ed8ca1
JH		 1110
1111 return 0;
1112}
1113
1114int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1115{
1116 struct link_key *key;
1117
1118 key = hci_find_link_key(hdev, bdaddr);
1119 if (!key)
1120 return -ENOENT;
1121
1122 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1123
1124 list_del(&key->list);
1125 kfree(key);
1126
1127 return 0;
1128}
1129
6bd32326
VT		 1130/* HCI command timer function */
1131static void hci_cmd_timer(unsigned long arg)
1132{
1133 struct hci_dev *hdev = (void *) arg;
1134
1135 BT_ERR("%s command tx timeout", hdev->name);
1136 atomic_set(&hdev->cmd_cnt, 1);
f630cf0d 1137 clear_bit(HCI_RESET, &hdev->flags);
6bd32326
VT		 1138 tasklet_schedule(&hdev->cmd_task);
1139}
1140
2763eda6
SJ		 1141struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1142 bdaddr_t *bdaddr)
1143{
1144 struct oob_data *data;
1145
1146 list_for_each_entry(data, &hdev->remote_oob_data, list)
1147 if (bacmp(bdaddr, &data->bdaddr) == 0)
1148 return data;
1149
1150 return NULL;
1151}
1152
1153int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1154{
1155 struct oob_data *data;
1156
1157 data = hci_find_remote_oob_data(hdev, bdaddr);
1158 if (!data)
1159 return -ENOENT;
1160
1161 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1162
1163 list_del(&data->list);
1164 kfree(data);
1165
1166 return 0;
1167}
1168
1169int hci_remote_oob_data_clear(struct hci_dev *hdev)
1170{
1171 struct oob_data *data, *n;
1172
1173 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1174 list_del(&data->list);
1175 kfree(data);
1176 }
1177
1178 return 0;
1179}
1180
1181int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1182 u8 *randomizer)
1183{
1184 struct oob_data *data;
1185
1186 data = hci_find_remote_oob_data(hdev, bdaddr);
1187
1188 if (!data) {
1189 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1190 if (!data)
1191 return -ENOMEM;
1192
1193 bacpy(&data->bdaddr, bdaddr);
1194 list_add(&data->list, &hdev->remote_oob_data);
1195 }
1196
1197 memcpy(data->hash, hash, sizeof(data->hash));
1198 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1199
1200 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1201
1202 return 0;
1203}
1204
35815085
AG		 1205static void hci_clear_adv_cache(unsigned long arg)
1206{
1207 struct hci_dev *hdev = (void *) arg;
1208
1209 hci_dev_lock(hdev);
1210
1211 hci_adv_entries_clear(hdev);
1212
1213 hci_dev_unlock(hdev);
1214}
1215
76c8686f
AG		 1216int hci_adv_entries_clear(struct hci_dev *hdev)
1217{
1218 struct adv_entry *entry, *tmp;
1219
1220 list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1221 list_del(&entry->list);
1222 kfree(entry);
1223 }
1224
1225 BT_DBG("%s adv cache cleared", hdev->name);
1226
1227 return 0;
1228}
1229
1230struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1231{
1232 struct adv_entry *entry;
1233
1234 list_for_each_entry(entry, &hdev->adv_entries, list)
1235 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1236 return entry;
1237
1238 return NULL;
1239}
1240
1241static inline int is_connectable_adv(u8 evt_type)
1242{
1243 if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1244 return 1;
1245
1246 return 0;
1247}
1248
1249int hci_add_adv_entry(struct hci_dev *hdev,
1250 struct hci_ev_le_advertising_info *ev)
1251{
1252 struct adv_entry *entry;
1253
1254 if (!is_connectable_adv(ev->evt_type))
1255 return -EINVAL;
1256
1257 /* Only new entries should be added to adv_entries. So, if
1258 * bdaddr was found, don't add it. */
1259 if (hci_find_adv_entry(hdev, &ev->bdaddr))
1260 return 0;
1261
1262 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1263 if (!entry)
1264 return -ENOMEM;
1265
1266 bacpy(&entry->bdaddr, &ev->bdaddr);
1267 entry->bdaddr_type = ev->bdaddr_type;
1268
1269 list_add(&entry->list, &hdev->adv_entries);
1270
1271 BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1272 batostr(&entry->bdaddr), entry->bdaddr_type);
1273
1274 return 0;
1275}
1276
1da177e4
LT		 1277/* Register HCI device */
1278int hci_register_dev(struct hci_dev *hdev)
1279{
1280 struct list_head *head = &hci_dev_list, *p;
ef222013 1281 int i, id = 0;
1da177e4 1282
c13854ce
MH		 1283 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1284 hdev->bus, hdev->owner);
1da177e4
LT		 1285
1286 if (!hdev->open || !hdev->close || !hdev->destruct)
1287 return -EINVAL;
1288
1289 write_lock_bh(&hci_dev_list_lock);
1290
1291 /* Find first available device id */
1292 list_for_each(p, &hci_dev_list) {
1293 if (list_entry(p, struct hci_dev, list)->id != id)
1294 break;
1295 head = p; id++;
1296 }
8e87d142 1297
1da177e4
LT		 1298 sprintf(hdev->name, "hci%d", id);
1299 hdev->id = id;
1300 list_add(&hdev->list, head);
1301
1302 atomic_set(&hdev->refcnt, 1);
1303 spin_lock_init(&hdev->lock);
1304
1305 hdev->flags = 0;
1306 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
5b7f9909 1307 hdev->esco_type = (ESCO_HV1);
1da177e4 1308 hdev->link_mode = (HCI_LM_ACCEPT);
17fa4b9d 1309 hdev->io_capability = 0x03; /* No Input No Output */
1da177e4 1310
04837f64
MH		 1311 hdev->idle_timeout = 0;
1312 hdev->sniff_max_interval = 800;
1313 hdev->sniff_min_interval = 80;
1314
70f23020 1315 tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1da177e4
LT		 1316 tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1317 tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1318
1319 skb_queue_head_init(&hdev->rx_q);
1320 skb_queue_head_init(&hdev->cmd_q);
1321 skb_queue_head_init(&hdev->raw_q);
1322
6bd32326
VT		 1323 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1324
cd4c5391 1325 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1326 hdev->reassembly[i] = NULL;
1327
1da177e4 1328 init_waitqueue_head(&hdev->req_wait_q);
a6a67efd 1329 mutex_init(&hdev->req_lock);
1da177e4
LT		 1330
1331 inquiry_cache_init(hdev);
1332
1333 hci_conn_hash_init(hdev);
1334
ea4bd8ba 1335 INIT_LIST_HEAD(&hdev->blacklist);
f0358568 1336
2aeb9a1a
JH		 1337 INIT_LIST_HEAD(&hdev->uuids);
1338
55ed8ca1
JH		 1339 INIT_LIST_HEAD(&hdev->link_keys);
1340
2763eda6
SJ		 1341 INIT_LIST_HEAD(&hdev->remote_oob_data);
1342
76c8686f 1343 INIT_LIST_HEAD(&hdev->adv_entries);
35815085
AG		 1344 setup_timer(&hdev->adv_timer, hci_clear_adv_cache,
1345 (unsigned long) hdev);
76c8686f 1346
ab81cbf9
JH		 1347 INIT_WORK(&hdev->power_on, hci_power_on);
1348 INIT_WORK(&hdev->power_off, hci_power_off);
1349 setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1350
1da177e4
LT		 1351 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1352
1353 atomic_set(&hdev->promisc, 0);
1354
1355 write_unlock_bh(&hci_dev_list_lock);
1356
f48fd9c8
MH		 1357 hdev->workqueue = create_singlethread_workqueue(hdev->name);
1358 if (!hdev->workqueue)
1359 goto nomem;
1360
1da177e4
LT		 1361 hci_register_sysfs(hdev);
1362
611b30f7
MH		 1363 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1364 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1365 if (hdev->rfkill) {
1366 if (rfkill_register(hdev->rfkill) < 0) {
1367 rfkill_destroy(hdev->rfkill);
1368 hdev->rfkill = NULL;
1369 }
1370 }
1371
ab81cbf9
JH		 1372 set_bit(HCI_AUTO_OFF, &hdev->flags);
1373 set_bit(HCI_SETUP, &hdev->flags);
1374 queue_work(hdev->workqueue, &hdev->power_on);
1375
1da177e4
LT		 1376 hci_notify(hdev, HCI_DEV_REG);
1377
1378 return id;
f48fd9c8
MH		 1379
1380nomem:
1381 write_lock_bh(&hci_dev_list_lock);
1382 list_del(&hdev->list);
1383 write_unlock_bh(&hci_dev_list_lock);
1384
1385 return -ENOMEM;
1da177e4
LT		 1386}
1387EXPORT_SYMBOL(hci_register_dev);
1388
1389/* Unregister HCI device */
1390int hci_unregister_dev(struct hci_dev *hdev)
1391{
ef222013
MH		 1392 int i;
1393
c13854ce 1394 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 1395
1da177e4
LT		 1396 write_lock_bh(&hci_dev_list_lock);
1397 list_del(&hdev->list);
1398 write_unlock_bh(&hci_dev_list_lock);
1399
1400 hci_dev_do_close(hdev);
1401
cd4c5391 1402 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 1403 kfree_skb(hdev->reassembly[i]);
1404
ab81cbf9
JH		 1405 if (!test_bit(HCI_INIT, &hdev->flags) &&
1406 !test_bit(HCI_SETUP, &hdev->flags))
1407 mgmt_index_removed(hdev->id);
1408
1da177e4
LT		 1409 hci_notify(hdev, HCI_DEV_UNREG);
1410
611b30f7
MH		 1411 if (hdev->rfkill) {
1412 rfkill_unregister(hdev->rfkill);
1413 rfkill_destroy(hdev->rfkill);
1414 }
1415
147e2d59
DY		 1416 hci_unregister_sysfs(hdev);
1417
c6f3c5f7 1418 hci_del_off_timer(hdev);
35815085 1419 del_timer(&hdev->adv_timer);
c6f3c5f7 1420
f48fd9c8
MH		 1421 destroy_workqueue(hdev->workqueue);
1422
e2e0cacb
JH		 1423 hci_dev_lock_bh(hdev);
1424 hci_blacklist_clear(hdev);
2aeb9a1a 1425 hci_uuids_clear(hdev);
55ed8ca1 1426 hci_link_keys_clear(hdev);
2763eda6 1427 hci_remote_oob_data_clear(hdev);
76c8686f 1428 hci_adv_entries_clear(hdev);
e2e0cacb
JH		 1429 hci_dev_unlock_bh(hdev);
1430
1da177e4 1431 __hci_dev_put(hdev);
ef222013 1432
1da177e4
LT		 1433 return 0;
1434}
1435EXPORT_SYMBOL(hci_unregister_dev);
1436
1437/* Suspend HCI device */
1438int hci_suspend_dev(struct hci_dev *hdev)
1439{
1440 hci_notify(hdev, HCI_DEV_SUSPEND);
1441 return 0;
1442}
1443EXPORT_SYMBOL(hci_suspend_dev);
1444
1445/* Resume HCI device */
1446int hci_resume_dev(struct hci_dev *hdev)
1447{
1448 hci_notify(hdev, HCI_DEV_RESUME);
1449 return 0;
1450}
1451EXPORT_SYMBOL(hci_resume_dev);
1452
76bca880
MH		 1453/* Receive frame from HCI drivers */
1454int hci_recv_frame(struct sk_buff *skb)
1455{
1456 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1457 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1458 && !test_bit(HCI_INIT, &hdev->flags))) {
1459 kfree_skb(skb);
1460 return -ENXIO;
1461 }
1462
1463 /* Incomming skb */
1464 bt_cb(skb)->incoming = 1;
1465
1466 /* Time stamp */
1467 __net_timestamp(skb);
1468
1469 /* Queue frame for rx task */
1470 skb_queue_tail(&hdev->rx_q, skb);
c78ae283
MH		 1471 tasklet_schedule(&hdev->rx_task);
1472
76bca880
MH		 1473 return 0;
1474}
1475EXPORT_SYMBOL(hci_recv_frame);
1476
33e882a5 1477static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1e429f38 1478 int count, __u8 index)
33e882a5
SS		 1479{
1480 int len = 0;
1481 int hlen = 0;
1482 int remain = count;
1483 struct sk_buff *skb;
1484 struct bt_skb_cb *scb;
1485
1486 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1487 index >= NUM_REASSEMBLY)
1488 return -EILSEQ;
1489
1490 skb = hdev->reassembly[index];
1491
1492 if (!skb) {
1493 switch (type) {
1494 case HCI_ACLDATA_PKT:
1495 len = HCI_MAX_FRAME_SIZE;
1496 hlen = HCI_ACL_HDR_SIZE;
1497 break;
1498 case HCI_EVENT_PKT:
1499 len = HCI_MAX_EVENT_SIZE;
1500 hlen = HCI_EVENT_HDR_SIZE;
1501 break;
1502 case HCI_SCODATA_PKT:
1503 len = HCI_MAX_SCO_SIZE;
1504 hlen = HCI_SCO_HDR_SIZE;
1505 break;
1506 }
1507
1e429f38 1508 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 1509 if (!skb)
1510 return -ENOMEM;
1511
1512 scb = (void *) skb->cb;
1513 scb->expect = hlen;
1514 scb->pkt_type = type;
1515
1516 skb->dev = (void *) hdev;
1517 hdev->reassembly[index] = skb;
1518 }
1519
1520 while (count) {
1521 scb = (void *) skb->cb;
1522 len = min(scb->expect, (__u16)count);
1523
1524 memcpy(skb_put(skb, len), data, len);
1525
1526 count -= len;
1527 data += len;
1528 scb->expect -= len;
1529 remain = count;
1530
1531 switch (type) {
1532 case HCI_EVENT_PKT:
1533 if (skb->len == HCI_EVENT_HDR_SIZE) {
1534 struct hci_event_hdr *h = hci_event_hdr(skb);
1535 scb->expect = h->plen;
1536
1537 if (skb_tailroom(skb) < scb->expect) {
1538 kfree_skb(skb);
1539 hdev->reassembly[index] = NULL;
1540 return -ENOMEM;
1541 }
1542 }
1543 break;
1544
1545 case HCI_ACLDATA_PKT:
1546 if (skb->len == HCI_ACL_HDR_SIZE) {
1547 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1548 scb->expect = __le16_to_cpu(h->dlen);
1549
1550 if (skb_tailroom(skb) < scb->expect) {
1551 kfree_skb(skb);
1552 hdev->reassembly[index] = NULL;
1553 return -ENOMEM;
1554 }
1555 }
1556 break;
1557
1558 case HCI_SCODATA_PKT:
1559 if (skb->len == HCI_SCO_HDR_SIZE) {
1560 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1561 scb->expect = h->dlen;
1562
1563 if (skb_tailroom(skb) < scb->expect) {
1564 kfree_skb(skb);
1565 hdev->reassembly[index] = NULL;
1566 return -ENOMEM;
1567 }
1568 }
1569 break;
1570 }
1571
1572 if (scb->expect == 0) {
1573 /* Complete frame */
1574
1575 bt_cb(skb)->pkt_type = type;
1576 hci_recv_frame(skb);
1577
1578 hdev->reassembly[index] = NULL;
1579 return remain;
1580 }
1581 }
1582
1583 return remain;
1584}
1585
ef222013
MH		 1586int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1587{
f39a3c06
SS		 1588 int rem = 0;
1589
ef222013
MH		 1590 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1591 return -EILSEQ;
1592
da5f6c37 1593 while (count) {
1e429f38 1594 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 1595 if (rem < 0)
1596 return rem;
ef222013 1597
f39a3c06
SS		 1598 data += (count - rem);
1599 count = rem;
da5f6c37 1600 };
ef222013 1601
f39a3c06 1602 return rem;
ef222013
MH		 1603}
1604EXPORT_SYMBOL(hci_recv_fragment);
1605
99811510
SS		 1606#define STREAM_REASSEMBLY 0
1607
1608int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1609{
1610 int type;
1611 int rem = 0;
1612
da5f6c37 1613 while (count) {
99811510
SS		 1614 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1615
1616 if (!skb) {
1617 struct { char type; } *pkt;
1618
1619 /* Start of the frame */
1620 pkt = data;
1621 type = pkt->type;
1622
1623 data++;
1624 count--;
1625 } else
1626 type = bt_cb(skb)->pkt_type;
1627
1e429f38
GP		 1628 rem = hci_reassembly(hdev, type, data, count,
1629 STREAM_REASSEMBLY);
99811510
SS		 1630 if (rem < 0)
1631 return rem;
1632
1633 data += (count - rem);
1634 count = rem;
da5f6c37 1635 };
99811510
SS		 1636
1637 return rem;
1638}
1639EXPORT_SYMBOL(hci_recv_stream_fragment);
1640
1da177e4
LT		 1641/* ---- Interface to upper protocols ---- */
1642
1643/* Register/Unregister protocols.
1644 * hci_task_lock is used to ensure that no tasks are running. */
1645int hci_register_proto(struct hci_proto *hp)
1646{
1647 int err = 0;
1648
1649 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1650
1651 if (hp->id >= HCI_MAX_PROTO)
1652 return -EINVAL;
1653
1654 write_lock_bh(&hci_task_lock);
1655
1656 if (!hci_proto[hp->id])
1657 hci_proto[hp->id] = hp;
1658 else
1659 err = -EEXIST;
1660
1661 write_unlock_bh(&hci_task_lock);
1662
1663 return err;
1664}
1665EXPORT_SYMBOL(hci_register_proto);
1666
1667int hci_unregister_proto(struct hci_proto *hp)
1668{
1669 int err = 0;
1670
1671 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1672
1673 if (hp->id >= HCI_MAX_PROTO)
1674 return -EINVAL;
1675
1676 write_lock_bh(&hci_task_lock);
1677
1678 if (hci_proto[hp->id])
1679 hci_proto[hp->id] = NULL;
1680 else
1681 err = -ENOENT;
1682
1683 write_unlock_bh(&hci_task_lock);
1684
1685 return err;
1686}
1687EXPORT_SYMBOL(hci_unregister_proto);
1688
1689int hci_register_cb(struct hci_cb *cb)
1690{
1691 BT_DBG("%p name %s", cb, cb->name);
1692
1693 write_lock_bh(&hci_cb_list_lock);
1694 list_add(&cb->list, &hci_cb_list);
1695 write_unlock_bh(&hci_cb_list_lock);
1696
1697 return 0;
1698}
1699EXPORT_SYMBOL(hci_register_cb);
1700
1701int hci_unregister_cb(struct hci_cb *cb)
1702{
1703 BT_DBG("%p name %s", cb, cb->name);
1704
1705 write_lock_bh(&hci_cb_list_lock);
1706 list_del(&cb->list);
1707 write_unlock_bh(&hci_cb_list_lock);
1708
1709 return 0;
1710}
1711EXPORT_SYMBOL(hci_unregister_cb);
1712
1713static int hci_send_frame(struct sk_buff *skb)
1714{
1715 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1716
1717 if (!hdev) {
1718 kfree_skb(skb);
1719 return -ENODEV;
1720 }
1721
0d48d939 1722 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4
LT		 1723
1724 if (atomic_read(&hdev->promisc)) {
1725 /* Time stamp */
a61bbcf2 1726 __net_timestamp(skb);
1da177e4 1727
eec8d2bc 1728 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 1729 }
1730
1731 /* Get rid of skb owner, prior to sending to the driver. */
1732 skb_orphan(skb);
1733
1734 return hdev->send(skb);
1735}
1736
1737/* Send HCI command */
a9de9248 1738int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1da177e4
LT		 1739{
1740 int len = HCI_COMMAND_HDR_SIZE + plen;
1741 struct hci_command_hdr *hdr;
1742 struct sk_buff *skb;
1743
a9de9248 1744 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1da177e4
LT		 1745
1746 skb = bt_skb_alloc(len, GFP_ATOMIC);
1747 if (!skb) {
ef222013 1748 BT_ERR("%s no memory for command", hdev->name);
1da177e4
LT		 1749 return -ENOMEM;
1750 }
1751
1752 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 1753 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 1754 hdr->plen = plen;
1755
1756 if (plen)
1757 memcpy(skb_put(skb, plen), param, plen);
1758
1759 BT_DBG("skb len %d", skb->len);
1760
0d48d939 1761 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 1762 skb->dev = (void *) hdev;
c78ae283 1763
a5040efa
JH		 1764 if (test_bit(HCI_INIT, &hdev->flags))
1765 hdev->init_last_cmd = opcode;
1766
1da177e4 1767 skb_queue_tail(&hdev->cmd_q, skb);
c78ae283 1768 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 1769
1770 return 0;
1771}
1da177e4
LT		 1772
1773/* Get data from the previously sent command */
a9de9248 1774void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 1775{
1776 struct hci_command_hdr *hdr;
1777
1778 if (!hdev->sent_cmd)
1779 return NULL;
1780
1781 hdr = (void *) hdev->sent_cmd->data;
1782
a9de9248 1783 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 1784 return NULL;
1785
a9de9248 1786 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1da177e4
LT		 1787
1788 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1789}
1790
1791/* Send ACL data */
1792static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1793{
1794 struct hci_acl_hdr *hdr;
1795 int len = skb->len;
1796
badff6d0
ACM		 1797 skb_push(skb, HCI_ACL_HDR_SIZE);
1798 skb_reset_transport_header(skb);
9c70220b 1799 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 1800 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1801 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 1802}
1803
9a9c6a34 1804void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1da177e4
LT		 1805{
1806 struct hci_dev *hdev = conn->hdev;
1807 struct sk_buff *list;
1808
1809 BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1810
1811 skb->dev = (void *) hdev;
0d48d939 1812 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1813 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4 1814
70f23020
AE		 1815 list = skb_shinfo(skb)->frag_list;
1816 if (!list) {
1da177e4
LT		 1817 /* Non fragmented */
1818 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1819
1820 skb_queue_tail(&conn->data_q, skb);
1821 } else {
1822 /* Fragmented */
1823 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1824
1825 skb_shinfo(skb)->frag_list = NULL;
1826
1827 /* Queue all fragments atomically */
1828 spin_lock_bh(&conn->data_q.lock);
1829
1830 __skb_queue_tail(&conn->data_q, skb);
e702112f
AE		 1831
1832 flags &= ~ACL_START;
1833 flags |= ACL_CONT;
1da177e4
LT		 1834 do {
1835 skb = list; list = list->next;
8e87d142 1836
1da177e4 1837 skb->dev = (void *) hdev;
0d48d939 1838 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 1839 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 1840
1841 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1842
1843 __skb_queue_tail(&conn->data_q, skb);
1844 } while (list);
1845
1846 spin_unlock_bh(&conn->data_q.lock);
1847 }
1848
c78ae283 1849 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 1850}
1851EXPORT_SYMBOL(hci_send_acl);
1852
1853/* Send SCO data */
0d861d8b 1854void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 1855{
1856 struct hci_dev *hdev = conn->hdev;
1857 struct hci_sco_hdr hdr;
1858
1859 BT_DBG("%s len %d", hdev->name, skb->len);
1860
aca3192c 1861 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 1862 hdr.dlen = skb->len;
1863
badff6d0
ACM		 1864 skb_push(skb, HCI_SCO_HDR_SIZE);
1865 skb_reset_transport_header(skb);
9c70220b 1866 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 1867
1868 skb->dev = (void *) hdev;
0d48d939 1869 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 1870
1da177e4 1871 skb_queue_tail(&conn->data_q, skb);
c78ae283 1872 tasklet_schedule(&hdev->tx_task);
1da177e4
LT		 1873}
1874EXPORT_SYMBOL(hci_send_sco);
1875
1876/* ---- HCI TX task (outgoing data) ---- */
1877
1878/* HCI Connection scheduler */
1879static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1880{
1881 struct hci_conn_hash *h = &hdev->conn_hash;
5b7f9909 1882 struct hci_conn *conn = NULL;
1da177e4
LT		 1883 int num = 0, min = ~0;
1884 struct list_head *p;
1885
8e87d142 1886 /* We don't have to lock device here. Connections are always
1da177e4
LT		 1887 * added and removed with TX task disabled. */
1888 list_for_each(p, &h->list) {
1889 struct hci_conn *c;
1890 c = list_entry(p, struct hci_conn, list);
1891
769be974 1892 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 1893 continue;
769be974
MH		 1894
1895 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
1896 continue;
1897
1da177e4
LT		 1898 num++;
1899
1900 if (c->sent < min) {
1901 min = c->sent;
1902 conn = c;
1903 }
1904 }
1905
1906 if (conn) {
6ed58ec5
VT		 1907 int cnt, q;
1908
1909 switch (conn->type) {
1910 case ACL_LINK:
1911 cnt = hdev->acl_cnt;
1912 break;
1913 case SCO_LINK:
1914 case ESCO_LINK:
1915 cnt = hdev->sco_cnt;
1916 break;
1917 case LE_LINK:
1918 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
1919 break;
1920 default:
1921 cnt = 0;
1922 BT_ERR("Unknown link type");
1923 }
1924
1925 q = cnt / num;
1da177e4
LT		 1926 *quote = q ? q : 1;
1927 } else
1928 *quote = 0;
1929
1930 BT_DBG("conn %p quote %d", conn, *quote);
1931 return conn;
1932}
1933
bae1f5d9 1934static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 1935{
1936 struct hci_conn_hash *h = &hdev->conn_hash;
1937 struct list_head *p;
1938 struct hci_conn *c;
1939
bae1f5d9 1940 BT_ERR("%s link tx timeout", hdev->name);
1da177e4
LT		 1941
1942 /* Kill stalled connections */
1943 list_for_each(p, &h->list) {
1944 c = list_entry(p, struct hci_conn, list);
bae1f5d9
VT		 1945 if (c->type == type && c->sent) {
1946 BT_ERR("%s killing stalled connection %s",
1da177e4
LT		 1947 hdev->name, batostr(&c->dst));
1948 hci_acl_disconn(c, 0x13);
1949 }
1950 }
1951}
1952
1953static inline void hci_sched_acl(struct hci_dev *hdev)
1954{
1955 struct hci_conn *conn;
1956 struct sk_buff *skb;
1957 int quote;
1958
1959 BT_DBG("%s", hdev->name);
1960
1961 if (!test_bit(HCI_RAW, &hdev->flags)) {
1962 /* ACL tx timeout must be longer than maximum
1963 * link supervision timeout (40.9 seconds) */
82453021 1964 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
bae1f5d9 1965 hci_link_tx_to(hdev, ACL_LINK);
1da177e4
LT		 1966 }
1967
1968 while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
1969 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1970 BT_DBG("skb %p len %d", skb, skb->len);
04837f64 1971
14b12d0b 1972 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
04837f64 1973
1da177e4
LT		 1974 hci_send_frame(skb);
1975 hdev->acl_last_tx = jiffies;
1976
1977 hdev->acl_cnt--;
1978 conn->sent++;
1979 }
1980 }
1981}
1982
1983/* Schedule SCO */
1984static inline void hci_sched_sco(struct hci_dev *hdev)
1985{
1986 struct hci_conn *conn;
1987 struct sk_buff *skb;
1988 int quote;
1989
1990 BT_DBG("%s", hdev->name);
1991
1992 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
1993 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
1994 BT_DBG("skb %p len %d", skb, skb->len);
1995 hci_send_frame(skb);
1996
1997 conn->sent++;
1998 if (conn->sent == ~0)
1999 conn->sent = 0;
2000 }
2001 }
2002}
2003
b6a0dc82
MH		 2004static inline void hci_sched_esco(struct hci_dev *hdev)
2005{
2006 struct hci_conn *conn;
2007 struct sk_buff *skb;
2008 int quote;
2009
2010 BT_DBG("%s", hdev->name);
2011
2012 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2013 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2014 BT_DBG("skb %p len %d", skb, skb->len);
2015 hci_send_frame(skb);
2016
2017 conn->sent++;
2018 if (conn->sent == ~0)
2019 conn->sent = 0;
2020 }
2021 }
2022}
2023
6ed58ec5
VT		 2024static inline void hci_sched_le(struct hci_dev *hdev)
2025{
2026 struct hci_conn *conn;
2027 struct sk_buff *skb;
2028 int quote, cnt;
2029
2030 BT_DBG("%s", hdev->name);
2031
2032 if (!test_bit(HCI_RAW, &hdev->flags)) {
2033 /* LE tx timeout must be longer than maximum
2034 * link supervision timeout (40.9 seconds) */
bae1f5d9 2035 if (!hdev->le_cnt && hdev->le_pkts &&
6ed58ec5 2036 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 2037 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 2038 }
2039
2040 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2041 while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
2042 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2043 BT_DBG("skb %p len %d", skb, skb->len);
2044
2045 hci_send_frame(skb);
2046 hdev->le_last_tx = jiffies;
2047
2048 cnt--;
2049 conn->sent++;
2050 }
2051 }
2052 if (hdev->le_pkts)
2053 hdev->le_cnt = cnt;
2054 else
2055 hdev->acl_cnt = cnt;
2056}
2057
1da177e4
LT		 2058static void hci_tx_task(unsigned long arg)
2059{
2060 struct hci_dev *hdev = (struct hci_dev *) arg;
2061 struct sk_buff *skb;
2062
2063 read_lock(&hci_task_lock);
2064
6ed58ec5
VT		 2065 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2066 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 2067
2068 /* Schedule queues and send stuff to HCI driver */
2069
2070 hci_sched_acl(hdev);
2071
2072 hci_sched_sco(hdev);
2073
b6a0dc82
MH		 2074 hci_sched_esco(hdev);
2075
6ed58ec5
VT		 2076 hci_sched_le(hdev);
2077
1da177e4
LT		 2078 /* Send next queued raw (unknown type) packet */
2079 while ((skb = skb_dequeue(&hdev->raw_q)))
2080 hci_send_frame(skb);
2081
2082 read_unlock(&hci_task_lock);
2083}
2084
25985edc 2085/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 2086
2087/* ACL data packet */
2088static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2089{
2090 struct hci_acl_hdr *hdr = (void *) skb->data;
2091 struct hci_conn *conn;
2092 __u16 handle, flags;
2093
2094 skb_pull(skb, HCI_ACL_HDR_SIZE);
2095
2096 handle = __le16_to_cpu(hdr->handle);
2097 flags = hci_flags(handle);
2098 handle = hci_handle(handle);
2099
2100 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2101
2102 hdev->stat.acl_rx++;
2103
2104 hci_dev_lock(hdev);
2105 conn = hci_conn_hash_lookup_handle(hdev, handle);
2106 hci_dev_unlock(hdev);
8e87d142 2107
1da177e4
LT		 2108 if (conn) {
2109 register struct hci_proto *hp;
2110
14b12d0b 2111 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
04837f64 2112
1da177e4 2113 /* Send to upper protocol */
70f23020
AE		 2114 hp = hci_proto[HCI_PROTO_L2CAP];
2115 if (hp && hp->recv_acldata) {
1da177e4
LT		 2116 hp->recv_acldata(conn, skb, flags);
2117 return;
2118 }
2119 } else {
8e87d142 2120 BT_ERR("%s ACL packet for unknown connection handle %d",
1da177e4
LT		 2121 hdev->name, handle);
2122 }
2123
2124 kfree_skb(skb);
2125}
2126
2127/* SCO data packet */
2128static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2129{
2130 struct hci_sco_hdr *hdr = (void *) skb->data;
2131 struct hci_conn *conn;
2132 __u16 handle;
2133
2134 skb_pull(skb, HCI_SCO_HDR_SIZE);
2135
2136 handle = __le16_to_cpu(hdr->handle);
2137
2138 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2139
2140 hdev->stat.sco_rx++;
2141
2142 hci_dev_lock(hdev);
2143 conn = hci_conn_hash_lookup_handle(hdev, handle);
2144 hci_dev_unlock(hdev);
2145
2146 if (conn) {
2147 register struct hci_proto *hp;
2148
2149 /* Send to upper protocol */
70f23020
AE		 2150 hp = hci_proto[HCI_PROTO_SCO];
2151 if (hp && hp->recv_scodata) {
1da177e4
LT		 2152 hp->recv_scodata(conn, skb);
2153 return;
2154 }
2155 } else {
8e87d142 2156 BT_ERR("%s SCO packet for unknown connection handle %d",
1da177e4
LT		 2157 hdev->name, handle);
2158 }
2159
2160 kfree_skb(skb);
2161}
2162
6516455d 2163static void hci_rx_task(unsigned long arg)
1da177e4
LT		 2164{
2165 struct hci_dev *hdev = (struct hci_dev *) arg;
2166 struct sk_buff *skb;
2167
2168 BT_DBG("%s", hdev->name);
2169
2170 read_lock(&hci_task_lock);
2171
2172 while ((skb = skb_dequeue(&hdev->rx_q))) {
2173 if (atomic_read(&hdev->promisc)) {
2174 /* Send copy to the sockets */
eec8d2bc 2175 hci_send_to_sock(hdev, skb, NULL);
1da177e4
LT		 2176 }
2177
2178 if (test_bit(HCI_RAW, &hdev->flags)) {
2179 kfree_skb(skb);
2180 continue;
2181 }
2182
2183 if (test_bit(HCI_INIT, &hdev->flags)) {
2184 /* Don't process data packets in this states. */
0d48d939 2185 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2186 case HCI_ACLDATA_PKT:
2187 case HCI_SCODATA_PKT:
2188 kfree_skb(skb);
2189 continue;
3ff50b79 2190 }
1da177e4
LT		 2191 }
2192
2193 /* Process frame */
0d48d939 2194 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 2195 case HCI_EVENT_PKT:
2196 hci_event_packet(hdev, skb);
2197 break;
2198
2199 case HCI_ACLDATA_PKT:
2200 BT_DBG("%s ACL data packet", hdev->name);
2201 hci_acldata_packet(hdev, skb);
2202 break;
2203
2204 case HCI_SCODATA_PKT:
2205 BT_DBG("%s SCO data packet", hdev->name);
2206 hci_scodata_packet(hdev, skb);
2207 break;
2208
2209 default:
2210 kfree_skb(skb);
2211 break;
2212 }
2213 }
2214
2215 read_unlock(&hci_task_lock);
2216}
2217
2218static void hci_cmd_task(unsigned long arg)
2219{
2220 struct hci_dev *hdev = (struct hci_dev *) arg;
2221 struct sk_buff *skb;
2222
2223 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2224
1da177e4 2225 /* Send queued commands */
5a08ecce
AE		 2226 if (atomic_read(&hdev->cmd_cnt)) {
2227 skb = skb_dequeue(&hdev->cmd_q);
2228 if (!skb)
2229 return;
2230
7585b97a 2231 kfree_skb(hdev->sent_cmd);
1da177e4 2232
70f23020
AE		 2233 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2234 if (hdev->sent_cmd) {
1da177e4
LT		 2235 atomic_dec(&hdev->cmd_cnt);
2236 hci_send_frame(skb);
6bd32326
VT		 2237 mod_timer(&hdev->cmd_timer,
2238 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
1da177e4
LT		 2239 } else {
2240 skb_queue_head(&hdev->cmd_q, skb);
c78ae283 2241 tasklet_schedule(&hdev->cmd_task);
1da177e4
LT		 2242 }
2243 }
2244}
Linux 6.x block layer and io_uring tree(s)