projects / deliverable / linux.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Bluetooth: convert tx_task to workqueue
[deliverable/linux.git] / net / bluetooth / hci_core.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4
5 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
6
7 This program is free software; you can redistribute it and/or modify
8 it under the terms of the GNU General Public License version 2 as
9 published by the Free Software Foundation;
10
11 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
12 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
13 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
14 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
15 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
16 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
17 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
18 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
19
20 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
21 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
22 SOFTWARE IS DISCLAIMED.
23 */
24
25 /* Bluetooth HCI core. */
26
27 #include <linux/jiffies.h>
28 #include <linux/module.h>
29 #include <linux/kmod.h>
30
31 #include <linux/types.h>
32 #include <linux/errno.h>
33 #include <linux/kernel.h>
34 #include <linux/sched.h>
35 #include <linux/slab.h>
36 #include <linux/poll.h>
37 #include <linux/fcntl.h>
38 #include <linux/init.h>
39 #include <linux/skbuff.h>
40 #include <linux/workqueue.h>
41 #include <linux/interrupt.h>
42 #include <linux/notifier.h>
43 #include <linux/rfkill.h>
44 #include <linux/timer.h>
45 #include <linux/crypto.h>
46 #include <net/sock.h>
47
48 #include <asm/system.h>
49 #include <linux/uaccess.h>
50 #include <asm/unaligned.h>
51
52 #include <net/bluetooth/bluetooth.h>
53 #include <net/bluetooth/hci_core.h>
54
55 #define AUTO_OFF_TIMEOUT 2000
56
57 int enable_hs;
58
59 static void hci_rx_work(struct work_struct *work);
60 static void hci_cmd_work(struct work_struct *work);
61 static void hci_tx_work(struct work_struct *work);
62
63 static DEFINE_MUTEX(hci_task_lock);
64
65 /* HCI device list */
66 LIST_HEAD(hci_dev_list);
67 DEFINE_RWLOCK(hci_dev_list_lock);
68
69 /* HCI callback list */
70 LIST_HEAD(hci_cb_list);
71 DEFINE_RWLOCK(hci_cb_list_lock);
72
73 /* HCI protocols */
74 #define HCI_MAX_PROTO 2
75 struct hci_proto *hci_proto[HCI_MAX_PROTO];
76
77 /* HCI notifiers list */
78 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
79
80 /* ---- HCI notifications ---- */
81
82 int hci_register_notifier(struct notifier_block *nb)
83 {
84 return atomic_notifier_chain_register(&hci_notifier, nb);
85 }
86
87 int hci_unregister_notifier(struct notifier_block *nb)
88 {
89 return atomic_notifier_chain_unregister(&hci_notifier, nb);
90 }
91
92 static void hci_notify(struct hci_dev *hdev, int event)
93 {
94 atomic_notifier_call_chain(&hci_notifier, event, hdev);
95 }
96
97 /* ---- HCI requests ---- */
98
99 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
100 {
101 BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
102
103 /* If this is the init phase check if the completed command matches
104 * the last init command, and if not just return.
105 */
106 if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
107 return;
108
109 if (hdev->req_status == HCI_REQ_PEND) {
110 hdev->req_result = result;
111 hdev->req_status = HCI_REQ_DONE;
112 wake_up_interruptible(&hdev->req_wait_q);
113 }
114 }
115
116 static void hci_req_cancel(struct hci_dev *hdev, int err)
117 {
118 BT_DBG("%s err 0x%2.2x", hdev->name, err);
119
120 if (hdev->req_status == HCI_REQ_PEND) {
121 hdev->req_result = err;
122 hdev->req_status = HCI_REQ_CANCELED;
123 wake_up_interruptible(&hdev->req_wait_q);
124 }
125 }
126
127 /* Execute request and wait for completion. */
128 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
129 unsigned long opt, __u32 timeout)
130 {
131 DECLARE_WAITQUEUE(wait, current);
132 int err = 0;
133
134 BT_DBG("%s start", hdev->name);
135
136 hdev->req_status = HCI_REQ_PEND;
137
138 add_wait_queue(&hdev->req_wait_q, &wait);
139 set_current_state(TASK_INTERRUPTIBLE);
140
141 req(hdev, opt);
142 schedule_timeout(timeout);
143
144 remove_wait_queue(&hdev->req_wait_q, &wait);
145
146 if (signal_pending(current))
147 return -EINTR;
148
149 switch (hdev->req_status) {
150 case HCI_REQ_DONE:
151 err = -bt_to_errno(hdev->req_result);
152 break;
153
154 case HCI_REQ_CANCELED:
155 err = -hdev->req_result;
156 break;
157
158 default:
159 err = -ETIMEDOUT;
160 break;
161 }
162
163 hdev->req_status = hdev->req_result = 0;
164
165 BT_DBG("%s end: err %d", hdev->name, err);
166
167 return err;
168 }
169
170 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
171 unsigned long opt, __u32 timeout)
172 {
173 int ret;
174
175 if (!test_bit(HCI_UP, &hdev->flags))
176 return -ENETDOWN;
177
178 /* Serialize all requests */
179 hci_req_lock(hdev);
180 ret = __hci_request(hdev, req, opt, timeout);
181 hci_req_unlock(hdev);
182
183 return ret;
184 }
185
186 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
187 {
188 BT_DBG("%s %ld", hdev->name, opt);
189
190 /* Reset device */
191 set_bit(HCI_RESET, &hdev->flags);
192 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
193 }
194
195 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
196 {
197 struct hci_cp_delete_stored_link_key cp;
198 struct sk_buff *skb;
199 __le16 param;
200 __u8 flt_type;
201
202 BT_DBG("%s %ld", hdev->name, opt);
203
204 /* Driver initialization */
205
206 /* Special commands */
207 while ((skb = skb_dequeue(&hdev->driver_init))) {
208 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
209 skb->dev = (void *) hdev;
210
211 skb_queue_tail(&hdev->cmd_q, skb);
212 queue_work(hdev->workqueue, &hdev->cmd_work);
213 }
214 skb_queue_purge(&hdev->driver_init);
215
216 /* Mandatory initialization */
217
218 /* Reset */
219 if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
220 set_bit(HCI_RESET, &hdev->flags);
221 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
222 }
223
224 /* Read Local Supported Features */
225 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
226
227 /* Read Local Version */
228 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
229
230 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
231 hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
232
233 /* Read BD Address */
234 hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
235
236 /* Read Class of Device */
237 hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
238
239 /* Read Local Name */
240 hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
241
242 /* Read Voice Setting */
243 hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
244
245 /* Optional initialization */
246
247 /* Clear Event Filters */
248 flt_type = HCI_FLT_CLEAR_ALL;
249 hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
250
251 /* Connection accept timeout ~20 secs */
252 param = cpu_to_le16(0x7d00);
253 hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
254
255 bacpy(&cp.bdaddr, BDADDR_ANY);
256 cp.delete_all = 1;
257 hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
258 }
259
260 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
261 {
262 BT_DBG("%s", hdev->name);
263
264 /* Read LE buffer size */
265 hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
266 }
267
268 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
269 {
270 __u8 scan = opt;
271
272 BT_DBG("%s %x", hdev->name, scan);
273
274 /* Inquiry and Page scans */
275 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
276 }
277
278 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
279 {
280 __u8 auth = opt;
281
282 BT_DBG("%s %x", hdev->name, auth);
283
284 /* Authentication */
285 hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
286 }
287
288 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
289 {
290 __u8 encrypt = opt;
291
292 BT_DBG("%s %x", hdev->name, encrypt);
293
294 /* Encryption */
295 hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
296 }
297
298 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
299 {
300 __le16 policy = cpu_to_le16(opt);
301
302 BT_DBG("%s %x", hdev->name, policy);
303
304 /* Default link policy */
305 hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
306 }
307
308 /* Get HCI device by index.
309 * Device is held on return. */
310 struct hci_dev *hci_dev_get(int index)
311 {
312 struct hci_dev *hdev = NULL, *d;
313
314 BT_DBG("%d", index);
315
316 if (index < 0)
317 return NULL;
318
319 read_lock(&hci_dev_list_lock);
320 list_for_each_entry(d, &hci_dev_list, list) {
321 if (d->id == index) {
322 hdev = hci_dev_hold(d);
323 break;
324 }
325 }
326 read_unlock(&hci_dev_list_lock);
327 return hdev;
328 }
329
330 /* ---- Inquiry support ---- */
331 static void inquiry_cache_flush(struct hci_dev *hdev)
332 {
333 struct inquiry_cache *cache = &hdev->inq_cache;
334 struct inquiry_entry *next = cache->list, *e;
335
336 BT_DBG("cache %p", cache);
337
338 cache->list = NULL;
339 while ((e = next)) {
340 next = e->next;
341 kfree(e);
342 }
343 }
344
345 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
346 {
347 struct inquiry_cache *cache = &hdev->inq_cache;
348 struct inquiry_entry *e;
349
350 BT_DBG("cache %p, %s", cache, batostr(bdaddr));
351
352 for (e = cache->list; e; e = e->next)
353 if (!bacmp(&e->data.bdaddr, bdaddr))
354 break;
355 return e;
356 }
357
358 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
359 {
360 struct inquiry_cache *cache = &hdev->inq_cache;
361 struct inquiry_entry *ie;
362
363 BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
364
365 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
366 if (!ie) {
367 /* Entry not in the cache. Add new one. */
368 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
369 if (!ie)
370 return;
371
372 ie->next = cache->list;
373 cache->list = ie;
374 }
375
376 memcpy(&ie->data, data, sizeof(*data));
377 ie->timestamp = jiffies;
378 cache->timestamp = jiffies;
379 }
380
381 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
382 {
383 struct inquiry_cache *cache = &hdev->inq_cache;
384 struct inquiry_info *info = (struct inquiry_info *) buf;
385 struct inquiry_entry *e;
386 int copied = 0;
387
388 for (e = cache->list; e && copied < num; e = e->next, copied++) {
389 struct inquiry_data *data = &e->data;
390 bacpy(&info->bdaddr, &data->bdaddr);
391 info->pscan_rep_mode = data->pscan_rep_mode;
392 info->pscan_period_mode = data->pscan_period_mode;
393 info->pscan_mode = data->pscan_mode;
394 memcpy(info->dev_class, data->dev_class, 3);
395 info->clock_offset = data->clock_offset;
396 info++;
397 }
398
399 BT_DBG("cache %p, copied %d", cache, copied);
400 return copied;
401 }
402
403 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
404 {
405 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
406 struct hci_cp_inquiry cp;
407
408 BT_DBG("%s", hdev->name);
409
410 if (test_bit(HCI_INQUIRY, &hdev->flags))
411 return;
412
413 /* Start Inquiry */
414 memcpy(&cp.lap, &ir->lap, 3);
415 cp.length = ir->length;
416 cp.num_rsp = ir->num_rsp;
417 hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
418 }
419
420 int hci_inquiry(void __user *arg)
421 {
422 __u8 __user *ptr = arg;
423 struct hci_inquiry_req ir;
424 struct hci_dev *hdev;
425 int err = 0, do_inquiry = 0, max_rsp;
426 long timeo;
427 __u8 *buf;
428
429 if (copy_from_user(&ir, ptr, sizeof(ir)))
430 return -EFAULT;
431
432 hdev = hci_dev_get(ir.dev_id);
433 if (!hdev)
434 return -ENODEV;
435
436 hci_dev_lock(hdev);
437 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
438 inquiry_cache_empty(hdev) ||
439 ir.flags & IREQ_CACHE_FLUSH) {
440 inquiry_cache_flush(hdev);
441 do_inquiry = 1;
442 }
443 hci_dev_unlock(hdev);
444
445 timeo = ir.length * msecs_to_jiffies(2000);
446
447 if (do_inquiry) {
448 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
449 if (err < 0)
450 goto done;
451 }
452
453 /* for unlimited number of responses we will use buffer with 255 entries */
454 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
455
456 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
457 * copy it to the user space.
458 */
459 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
460 if (!buf) {
461 err = -ENOMEM;
462 goto done;
463 }
464
465 hci_dev_lock(hdev);
466 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
467 hci_dev_unlock(hdev);
468
469 BT_DBG("num_rsp %d", ir.num_rsp);
470
471 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
472 ptr += sizeof(ir);
473 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
474 ir.num_rsp))
475 err = -EFAULT;
476 } else
477 err = -EFAULT;
478
479 kfree(buf);
480
481 done:
482 hci_dev_put(hdev);
483 return err;
484 }
485
486 /* ---- HCI ioctl helpers ---- */
487
488 int hci_dev_open(__u16 dev)
489 {
490 struct hci_dev *hdev;
491 int ret = 0;
492
493 hdev = hci_dev_get(dev);
494 if (!hdev)
495 return -ENODEV;
496
497 BT_DBG("%s %p", hdev->name, hdev);
498
499 hci_req_lock(hdev);
500
501 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
502 ret = -ERFKILL;
503 goto done;
504 }
505
506 if (test_bit(HCI_UP, &hdev->flags)) {
507 ret = -EALREADY;
508 goto done;
509 }
510
511 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
512 set_bit(HCI_RAW, &hdev->flags);
513
514 /* Treat all non BR/EDR controllers as raw devices if
515 enable_hs is not set */
516 if (hdev->dev_type != HCI_BREDR && !enable_hs)
517 set_bit(HCI_RAW, &hdev->flags);
518
519 if (hdev->open(hdev)) {
520 ret = -EIO;
521 goto done;
522 }
523
524 if (!test_bit(HCI_RAW, &hdev->flags)) {
525 atomic_set(&hdev->cmd_cnt, 1);
526 set_bit(HCI_INIT, &hdev->flags);
527 hdev->init_last_cmd = 0;
528
529 ret = __hci_request(hdev, hci_init_req, 0,
530 msecs_to_jiffies(HCI_INIT_TIMEOUT));
531
532 if (lmp_host_le_capable(hdev))
533 ret = __hci_request(hdev, hci_le_init_req, 0,
534 msecs_to_jiffies(HCI_INIT_TIMEOUT));
535
536 clear_bit(HCI_INIT, &hdev->flags);
537 }
538
539 if (!ret) {
540 hci_dev_hold(hdev);
541 set_bit(HCI_UP, &hdev->flags);
542 hci_notify(hdev, HCI_DEV_UP);
543 if (!test_bit(HCI_SETUP, &hdev->flags)) {
544 hci_dev_lock(hdev);
545 mgmt_powered(hdev, 1);
546 hci_dev_unlock(hdev);
547 }
548 } else {
549 /* Init failed, cleanup */
550 flush_work(&hdev->tx_work);
551 flush_work(&hdev->cmd_work);
552 flush_work(&hdev->rx_work);
553
554 skb_queue_purge(&hdev->cmd_q);
555 skb_queue_purge(&hdev->rx_q);
556
557 if (hdev->flush)
558 hdev->flush(hdev);
559
560 if (hdev->sent_cmd) {
561 kfree_skb(hdev->sent_cmd);
562 hdev->sent_cmd = NULL;
563 }
564
565 hdev->close(hdev);
566 hdev->flags = 0;
567 }
568
569 done:
570 hci_req_unlock(hdev);
571 hci_dev_put(hdev);
572 return ret;
573 }
574
575 static int hci_dev_do_close(struct hci_dev *hdev)
576 {
577 BT_DBG("%s %p", hdev->name, hdev);
578
579 hci_req_cancel(hdev, ENODEV);
580 hci_req_lock(hdev);
581
582 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
583 del_timer_sync(&hdev->cmd_timer);
584 hci_req_unlock(hdev);
585 return 0;
586 }
587
588 /* Flush RX and TX works */
589 flush_work(&hdev->tx_work);
590 flush_work(&hdev->rx_work);
591
592 if (hdev->discov_timeout > 0) {
593 cancel_delayed_work(&hdev->discov_off);
594 hdev->discov_timeout = 0;
595 }
596
597 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
598 cancel_delayed_work(&hdev->power_off);
599
600 hci_dev_lock(hdev);
601 inquiry_cache_flush(hdev);
602 hci_conn_hash_flush(hdev);
603 hci_dev_unlock(hdev);
604
605 hci_notify(hdev, HCI_DEV_DOWN);
606
607 if (hdev->flush)
608 hdev->flush(hdev);
609
610 /* Reset device */
611 skb_queue_purge(&hdev->cmd_q);
612 atomic_set(&hdev->cmd_cnt, 1);
613 if (!test_bit(HCI_RAW, &hdev->flags)) {
614 set_bit(HCI_INIT, &hdev->flags);
615 __hci_request(hdev, hci_reset_req, 0,
616 msecs_to_jiffies(HCI_INIT_TIMEOUT));
617 clear_bit(HCI_INIT, &hdev->flags);
618 }
619
620 /* flush cmd work */
621 flush_work(&hdev->cmd_work);
622
623 /* Drop queues */
624 skb_queue_purge(&hdev->rx_q);
625 skb_queue_purge(&hdev->cmd_q);
626 skb_queue_purge(&hdev->raw_q);
627
628 /* Drop last sent command */
629 if (hdev->sent_cmd) {
630 del_timer_sync(&hdev->cmd_timer);
631 kfree_skb(hdev->sent_cmd);
632 hdev->sent_cmd = NULL;
633 }
634
635 /* After this point our queues are empty
636 * and no tasks are scheduled. */
637 hdev->close(hdev);
638
639 hci_dev_lock(hdev);
640 mgmt_powered(hdev, 0);
641 hci_dev_unlock(hdev);
642
643 /* Clear flags */
644 hdev->flags = 0;
645
646 hci_req_unlock(hdev);
647
648 hci_dev_put(hdev);
649 return 0;
650 }
651
652 int hci_dev_close(__u16 dev)
653 {
654 struct hci_dev *hdev;
655 int err;
656
657 hdev = hci_dev_get(dev);
658 if (!hdev)
659 return -ENODEV;
660 err = hci_dev_do_close(hdev);
661 hci_dev_put(hdev);
662 return err;
663 }
664
665 int hci_dev_reset(__u16 dev)
666 {
667 struct hci_dev *hdev;
668 int ret = 0;
669
670 hdev = hci_dev_get(dev);
671 if (!hdev)
672 return -ENODEV;
673
674 hci_req_lock(hdev);
675
676 if (!test_bit(HCI_UP, &hdev->flags))
677 goto done;
678
679 /* Drop queues */
680 skb_queue_purge(&hdev->rx_q);
681 skb_queue_purge(&hdev->cmd_q);
682
683 hci_dev_lock(hdev);
684 inquiry_cache_flush(hdev);
685 hci_conn_hash_flush(hdev);
686 hci_dev_unlock(hdev);
687
688 if (hdev->flush)
689 hdev->flush(hdev);
690
691 atomic_set(&hdev->cmd_cnt, 1);
692 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
693
694 if (!test_bit(HCI_RAW, &hdev->flags))
695 ret = __hci_request(hdev, hci_reset_req, 0,
696 msecs_to_jiffies(HCI_INIT_TIMEOUT));
697
698 done:
699 hci_req_unlock(hdev);
700 hci_dev_put(hdev);
701 return ret;
702 }
703
704 int hci_dev_reset_stat(__u16 dev)
705 {
706 struct hci_dev *hdev;
707 int ret = 0;
708
709 hdev = hci_dev_get(dev);
710 if (!hdev)
711 return -ENODEV;
712
713 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
714
715 hci_dev_put(hdev);
716
717 return ret;
718 }
719
720 int hci_dev_cmd(unsigned int cmd, void __user *arg)
721 {
722 struct hci_dev *hdev;
723 struct hci_dev_req dr;
724 int err = 0;
725
726 if (copy_from_user(&dr, arg, sizeof(dr)))
727 return -EFAULT;
728
729 hdev = hci_dev_get(dr.dev_id);
730 if (!hdev)
731 return -ENODEV;
732
733 switch (cmd) {
734 case HCISETAUTH:
735 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
736 msecs_to_jiffies(HCI_INIT_TIMEOUT));
737 break;
738
739 case HCISETENCRYPT:
740 if (!lmp_encrypt_capable(hdev)) {
741 err = -EOPNOTSUPP;
742 break;
743 }
744
745 if (!test_bit(HCI_AUTH, &hdev->flags)) {
746 /* Auth must be enabled first */
747 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
748 msecs_to_jiffies(HCI_INIT_TIMEOUT));
749 if (err)
750 break;
751 }
752
753 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
754 msecs_to_jiffies(HCI_INIT_TIMEOUT));
755 break;
756
757 case HCISETSCAN:
758 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
759 msecs_to_jiffies(HCI_INIT_TIMEOUT));
760 break;
761
762 case HCISETLINKPOL:
763 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
764 msecs_to_jiffies(HCI_INIT_TIMEOUT));
765 break;
766
767 case HCISETLINKMODE:
768 hdev->link_mode = ((__u16) dr.dev_opt) &
769 (HCI_LM_MASTER | HCI_LM_ACCEPT);
770 break;
771
772 case HCISETPTYPE:
773 hdev->pkt_type = (__u16) dr.dev_opt;
774 break;
775
776 case HCISETACLMTU:
777 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
778 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
779 break;
780
781 case HCISETSCOMTU:
782 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
783 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
784 break;
785
786 default:
787 err = -EINVAL;
788 break;
789 }
790
791 hci_dev_put(hdev);
792 return err;
793 }
794
795 int hci_get_dev_list(void __user *arg)
796 {
797 struct hci_dev *hdev;
798 struct hci_dev_list_req *dl;
799 struct hci_dev_req *dr;
800 int n = 0, size, err;
801 __u16 dev_num;
802
803 if (get_user(dev_num, (__u16 __user *) arg))
804 return -EFAULT;
805
806 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
807 return -EINVAL;
808
809 size = sizeof(*dl) + dev_num * sizeof(*dr);
810
811 dl = kzalloc(size, GFP_KERNEL);
812 if (!dl)
813 return -ENOMEM;
814
815 dr = dl->dev_req;
816
817 read_lock_bh(&hci_dev_list_lock);
818 list_for_each_entry(hdev, &hci_dev_list, list) {
819 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
820 cancel_delayed_work(&hdev->power_off);
821
822 if (!test_bit(HCI_MGMT, &hdev->flags))
823 set_bit(HCI_PAIRABLE, &hdev->flags);
824
825 (dr + n)->dev_id = hdev->id;
826 (dr + n)->dev_opt = hdev->flags;
827
828 if (++n >= dev_num)
829 break;
830 }
831 read_unlock_bh(&hci_dev_list_lock);
832
833 dl->dev_num = n;
834 size = sizeof(*dl) + n * sizeof(*dr);
835
836 err = copy_to_user(arg, dl, size);
837 kfree(dl);
838
839 return err ? -EFAULT : 0;
840 }
841
842 int hci_get_dev_info(void __user *arg)
843 {
844 struct hci_dev *hdev;
845 struct hci_dev_info di;
846 int err = 0;
847
848 if (copy_from_user(&di, arg, sizeof(di)))
849 return -EFAULT;
850
851 hdev = hci_dev_get(di.dev_id);
852 if (!hdev)
853 return -ENODEV;
854
855 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->flags))
856 cancel_delayed_work_sync(&hdev->power_off);
857
858 if (!test_bit(HCI_MGMT, &hdev->flags))
859 set_bit(HCI_PAIRABLE, &hdev->flags);
860
861 strcpy(di.name, hdev->name);
862 di.bdaddr = hdev->bdaddr;
863 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
864 di.flags = hdev->flags;
865 di.pkt_type = hdev->pkt_type;
866 di.acl_mtu = hdev->acl_mtu;
867 di.acl_pkts = hdev->acl_pkts;
868 di.sco_mtu = hdev->sco_mtu;
869 di.sco_pkts = hdev->sco_pkts;
870 di.link_policy = hdev->link_policy;
871 di.link_mode = hdev->link_mode;
872
873 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
874 memcpy(&di.features, &hdev->features, sizeof(di.features));
875
876 if (copy_to_user(arg, &di, sizeof(di)))
877 err = -EFAULT;
878
879 hci_dev_put(hdev);
880
881 return err;
882 }
883
884 /* ---- Interface to HCI drivers ---- */
885
886 static int hci_rfkill_set_block(void *data, bool blocked)
887 {
888 struct hci_dev *hdev = data;
889
890 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
891
892 if (!blocked)
893 return 0;
894
895 hci_dev_do_close(hdev);
896
897 return 0;
898 }
899
900 static const struct rfkill_ops hci_rfkill_ops = {
901 .set_block = hci_rfkill_set_block,
902 };
903
904 /* Alloc HCI device */
905 struct hci_dev *hci_alloc_dev(void)
906 {
907 struct hci_dev *hdev;
908
909 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
910 if (!hdev)
911 return NULL;
912
913 hci_init_sysfs(hdev);
914 skb_queue_head_init(&hdev->driver_init);
915
916 return hdev;
917 }
918 EXPORT_SYMBOL(hci_alloc_dev);
919
920 /* Free HCI device */
921 void hci_free_dev(struct hci_dev *hdev)
922 {
923 skb_queue_purge(&hdev->driver_init);
924
925 /* will free via device release */
926 put_device(&hdev->dev);
927 }
928 EXPORT_SYMBOL(hci_free_dev);
929
930 static void hci_power_on(struct work_struct *work)
931 {
932 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
933
934 BT_DBG("%s", hdev->name);
935
936 if (hci_dev_open(hdev->id) < 0)
937 return;
938
939 if (test_bit(HCI_AUTO_OFF, &hdev->flags))
940 queue_delayed_work(hdev->workqueue, &hdev->power_off,
941 msecs_to_jiffies(AUTO_OFF_TIMEOUT));
942
943 if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
944 mgmt_index_added(hdev);
945 }
946
947 static void hci_power_off(struct work_struct *work)
948 {
949 struct hci_dev *hdev = container_of(work, struct hci_dev,
950 power_off.work);
951
952 BT_DBG("%s", hdev->name);
953
954 clear_bit(HCI_AUTO_OFF, &hdev->flags);
955
956 hci_dev_close(hdev->id);
957 }
958
959 static void hci_discov_off(struct work_struct *work)
960 {
961 struct hci_dev *hdev;
962 u8 scan = SCAN_PAGE;
963
964 hdev = container_of(work, struct hci_dev, discov_off.work);
965
966 BT_DBG("%s", hdev->name);
967
968 hci_dev_lock(hdev);
969
970 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
971
972 hdev->discov_timeout = 0;
973
974 hci_dev_unlock(hdev);
975 }
976
977 int hci_uuids_clear(struct hci_dev *hdev)
978 {
979 struct list_head *p, *n;
980
981 list_for_each_safe(p, n, &hdev->uuids) {
982 struct bt_uuid *uuid;
983
984 uuid = list_entry(p, struct bt_uuid, list);
985
986 list_del(p);
987 kfree(uuid);
988 }
989
990 return 0;
991 }
992
993 int hci_link_keys_clear(struct hci_dev *hdev)
994 {
995 struct list_head *p, *n;
996
997 list_for_each_safe(p, n, &hdev->link_keys) {
998 struct link_key *key;
999
1000 key = list_entry(p, struct link_key, list);
1001
1002 list_del(p);
1003 kfree(key);
1004 }
1005
1006 return 0;
1007 }
1008
1009 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1010 {
1011 struct link_key *k;
1012
1013 list_for_each_entry(k, &hdev->link_keys, list)
1014 if (bacmp(bdaddr, &k->bdaddr) == 0)
1015 return k;
1016
1017 return NULL;
1018 }
1019
1020 static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1021 u8 key_type, u8 old_key_type)
1022 {
1023 /* Legacy key */
1024 if (key_type < 0x03)
1025 return 1;
1026
1027 /* Debug keys are insecure so don't store them persistently */
1028 if (key_type == HCI_LK_DEBUG_COMBINATION)
1029 return 0;
1030
1031 /* Changed combination key and there's no previous one */
1032 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1033 return 0;
1034
1035 /* Security mode 3 case */
1036 if (!conn)
1037 return 1;
1038
1039 /* Neither local nor remote side had no-bonding as requirement */
1040 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1041 return 1;
1042
1043 /* Local side had dedicated bonding as requirement */
1044 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1045 return 1;
1046
1047 /* Remote side had dedicated bonding as requirement */
1048 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1049 return 1;
1050
1051 /* If none of the above criteria match, then don't store the key
1052 * persistently */
1053 return 0;
1054 }
1055
1056 struct link_key *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1057 {
1058 struct link_key *k;
1059
1060 list_for_each_entry(k, &hdev->link_keys, list) {
1061 struct key_master_id *id;
1062
1063 if (k->type != HCI_LK_SMP_LTK)
1064 continue;
1065
1066 if (k->dlen != sizeof(*id))
1067 continue;
1068
1069 id = (void *) &k->data;
1070 if (id->ediv == ediv &&
1071 (memcmp(rand, id->rand, sizeof(id->rand)) == 0))
1072 return k;
1073 }
1074
1075 return NULL;
1076 }
1077 EXPORT_SYMBOL(hci_find_ltk);
1078
1079 struct link_key *hci_find_link_key_type(struct hci_dev *hdev,
1080 bdaddr_t *bdaddr, u8 type)
1081 {
1082 struct link_key *k;
1083
1084 list_for_each_entry(k, &hdev->link_keys, list)
1085 if (k->type == type && bacmp(bdaddr, &k->bdaddr) == 0)
1086 return k;
1087
1088 return NULL;
1089 }
1090 EXPORT_SYMBOL(hci_find_link_key_type);
1091
1092 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1093 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1094 {
1095 struct link_key *key, *old_key;
1096 u8 old_key_type, persistent;
1097
1098 old_key = hci_find_link_key(hdev, bdaddr);
1099 if (old_key) {
1100 old_key_type = old_key->type;
1101 key = old_key;
1102 } else {
1103 old_key_type = conn ? conn->key_type : 0xff;
1104 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1105 if (!key)
1106 return -ENOMEM;
1107 list_add(&key->list, &hdev->link_keys);
1108 }
1109
1110 BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1111
1112 /* Some buggy controller combinations generate a changed
1113 * combination key for legacy pairing even when there's no
1114 * previous key */
1115 if (type == HCI_LK_CHANGED_COMBINATION &&
1116 (!conn || conn->remote_auth == 0xff) &&
1117 old_key_type == 0xff) {
1118 type = HCI_LK_COMBINATION;
1119 if (conn)
1120 conn->key_type = type;
1121 }
1122
1123 bacpy(&key->bdaddr, bdaddr);
1124 memcpy(key->val, val, 16);
1125 key->pin_len = pin_len;
1126
1127 if (type == HCI_LK_CHANGED_COMBINATION)
1128 key->type = old_key_type;
1129 else
1130 key->type = type;
1131
1132 if (!new_key)
1133 return 0;
1134
1135 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1136
1137 mgmt_new_link_key(hdev, key, persistent);
1138
1139 if (!persistent) {
1140 list_del(&key->list);
1141 kfree(key);
1142 }
1143
1144 return 0;
1145 }
1146
1147 int hci_add_ltk(struct hci_dev *hdev, int new_key, bdaddr_t *bdaddr,
1148 u8 key_size, __le16 ediv, u8 rand[8], u8 ltk[16])
1149 {
1150 struct link_key *key, *old_key;
1151 struct key_master_id *id;
1152 u8 old_key_type;
1153
1154 BT_DBG("%s addr %s", hdev->name, batostr(bdaddr));
1155
1156 old_key = hci_find_link_key_type(hdev, bdaddr, HCI_LK_SMP_LTK);
1157 if (old_key) {
1158 key = old_key;
1159 old_key_type = old_key->type;
1160 } else {
1161 key = kzalloc(sizeof(*key) + sizeof(*id), GFP_ATOMIC);
1162 if (!key)
1163 return -ENOMEM;
1164 list_add(&key->list, &hdev->link_keys);
1165 old_key_type = 0xff;
1166 }
1167
1168 key->dlen = sizeof(*id);
1169
1170 bacpy(&key->bdaddr, bdaddr);
1171 memcpy(key->val, ltk, sizeof(key->val));
1172 key->type = HCI_LK_SMP_LTK;
1173 key->pin_len = key_size;
1174
1175 id = (void *) &key->data;
1176 id->ediv = ediv;
1177 memcpy(id->rand, rand, sizeof(id->rand));
1178
1179 if (new_key)
1180 mgmt_new_link_key(hdev, key, old_key_type);
1181
1182 return 0;
1183 }
1184
1185 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1186 {
1187 struct link_key *key;
1188
1189 key = hci_find_link_key(hdev, bdaddr);
1190 if (!key)
1191 return -ENOENT;
1192
1193 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1194
1195 list_del(&key->list);
1196 kfree(key);
1197
1198 return 0;
1199 }
1200
1201 /* HCI command timer function */
1202 static void hci_cmd_timer(unsigned long arg)
1203 {
1204 struct hci_dev *hdev = (void *) arg;
1205
1206 BT_ERR("%s command tx timeout", hdev->name);
1207 atomic_set(&hdev->cmd_cnt, 1);
1208 queue_work(hdev->workqueue, &hdev->cmd_work);
1209 }
1210
1211 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1212 bdaddr_t *bdaddr)
1213 {
1214 struct oob_data *data;
1215
1216 list_for_each_entry(data, &hdev->remote_oob_data, list)
1217 if (bacmp(bdaddr, &data->bdaddr) == 0)
1218 return data;
1219
1220 return NULL;
1221 }
1222
1223 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1224 {
1225 struct oob_data *data;
1226
1227 data = hci_find_remote_oob_data(hdev, bdaddr);
1228 if (!data)
1229 return -ENOENT;
1230
1231 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1232
1233 list_del(&data->list);
1234 kfree(data);
1235
1236 return 0;
1237 }
1238
1239 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1240 {
1241 struct oob_data *data, *n;
1242
1243 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1244 list_del(&data->list);
1245 kfree(data);
1246 }
1247
1248 return 0;
1249 }
1250
1251 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1252 u8 *randomizer)
1253 {
1254 struct oob_data *data;
1255
1256 data = hci_find_remote_oob_data(hdev, bdaddr);
1257
1258 if (!data) {
1259 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1260 if (!data)
1261 return -ENOMEM;
1262
1263 bacpy(&data->bdaddr, bdaddr);
1264 list_add(&data->list, &hdev->remote_oob_data);
1265 }
1266
1267 memcpy(data->hash, hash, sizeof(data->hash));
1268 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1269
1270 BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1271
1272 return 0;
1273 }
1274
1275 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1276 bdaddr_t *bdaddr)
1277 {
1278 struct bdaddr_list *b;
1279
1280 list_for_each_entry(b, &hdev->blacklist, list)
1281 if (bacmp(bdaddr, &b->bdaddr) == 0)
1282 return b;
1283
1284 return NULL;
1285 }
1286
1287 int hci_blacklist_clear(struct hci_dev *hdev)
1288 {
1289 struct list_head *p, *n;
1290
1291 list_for_each_safe(p, n, &hdev->blacklist) {
1292 struct bdaddr_list *b;
1293
1294 b = list_entry(p, struct bdaddr_list, list);
1295
1296 list_del(p);
1297 kfree(b);
1298 }
1299
1300 return 0;
1301 }
1302
1303 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1304 {
1305 struct bdaddr_list *entry;
1306
1307 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1308 return -EBADF;
1309
1310 if (hci_blacklist_lookup(hdev, bdaddr))
1311 return -EEXIST;
1312
1313 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1314 if (!entry)
1315 return -ENOMEM;
1316
1317 bacpy(&entry->bdaddr, bdaddr);
1318
1319 list_add(&entry->list, &hdev->blacklist);
1320
1321 return mgmt_device_blocked(hdev, bdaddr);
1322 }
1323
1324 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1325 {
1326 struct bdaddr_list *entry;
1327
1328 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1329 return hci_blacklist_clear(hdev);
1330
1331 entry = hci_blacklist_lookup(hdev, bdaddr);
1332 if (!entry)
1333 return -ENOENT;
1334
1335 list_del(&entry->list);
1336 kfree(entry);
1337
1338 return mgmt_device_unblocked(hdev, bdaddr);
1339 }
1340
1341 static void hci_clear_adv_cache(struct work_struct *work)
1342 {
1343 struct hci_dev *hdev = container_of(work, struct hci_dev,
1344 adv_work.work);
1345
1346 hci_dev_lock(hdev);
1347
1348 hci_adv_entries_clear(hdev);
1349
1350 hci_dev_unlock(hdev);
1351 }
1352
1353 int hci_adv_entries_clear(struct hci_dev *hdev)
1354 {
1355 struct adv_entry *entry, *tmp;
1356
1357 list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1358 list_del(&entry->list);
1359 kfree(entry);
1360 }
1361
1362 BT_DBG("%s adv cache cleared", hdev->name);
1363
1364 return 0;
1365 }
1366
1367 struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1368 {
1369 struct adv_entry *entry;
1370
1371 list_for_each_entry(entry, &hdev->adv_entries, list)
1372 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1373 return entry;
1374
1375 return NULL;
1376 }
1377
1378 static inline int is_connectable_adv(u8 evt_type)
1379 {
1380 if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1381 return 1;
1382
1383 return 0;
1384 }
1385
1386 int hci_add_adv_entry(struct hci_dev *hdev,
1387 struct hci_ev_le_advertising_info *ev)
1388 {
1389 struct adv_entry *entry;
1390
1391 if (!is_connectable_adv(ev->evt_type))
1392 return -EINVAL;
1393
1394 /* Only new entries should be added to adv_entries. So, if
1395 * bdaddr was found, don't add it. */
1396 if (hci_find_adv_entry(hdev, &ev->bdaddr))
1397 return 0;
1398
1399 entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1400 if (!entry)
1401 return -ENOMEM;
1402
1403 bacpy(&entry->bdaddr, &ev->bdaddr);
1404 entry->bdaddr_type = ev->bdaddr_type;
1405
1406 list_add(&entry->list, &hdev->adv_entries);
1407
1408 BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1409 batostr(&entry->bdaddr), entry->bdaddr_type);
1410
1411 return 0;
1412 }
1413
1414 /* Register HCI device */
1415 int hci_register_dev(struct hci_dev *hdev)
1416 {
1417 struct list_head *head = &hci_dev_list, *p;
1418 int i, id, error;
1419
1420 BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1421 hdev->bus, hdev->owner);
1422
1423 if (!hdev->open || !hdev->close || !hdev->destruct)
1424 return -EINVAL;
1425
1426 /* Do not allow HCI_AMP devices to register at index 0,
1427 * so the index can be used as the AMP controller ID.
1428 */
1429 id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
1430
1431 write_lock_bh(&hci_dev_list_lock);
1432
1433 /* Find first available device id */
1434 list_for_each(p, &hci_dev_list) {
1435 if (list_entry(p, struct hci_dev, list)->id != id)
1436 break;
1437 head = p; id++;
1438 }
1439
1440 sprintf(hdev->name, "hci%d", id);
1441 hdev->id = id;
1442 list_add_tail(&hdev->list, head);
1443
1444 atomic_set(&hdev->refcnt, 1);
1445 mutex_init(&hdev->lock);
1446
1447 hdev->flags = 0;
1448 hdev->dev_flags = 0;
1449 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1450 hdev->esco_type = (ESCO_HV1);
1451 hdev->link_mode = (HCI_LM_ACCEPT);
1452 hdev->io_capability = 0x03; /* No Input No Output */
1453
1454 hdev->idle_timeout = 0;
1455 hdev->sniff_max_interval = 800;
1456 hdev->sniff_min_interval = 80;
1457
1458 INIT_WORK(&hdev->rx_work, hci_rx_work);
1459 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
1460 INIT_WORK(&hdev->tx_work, hci_tx_work);
1461
1462
1463 skb_queue_head_init(&hdev->rx_q);
1464 skb_queue_head_init(&hdev->cmd_q);
1465 skb_queue_head_init(&hdev->raw_q);
1466
1467 setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1468
1469 for (i = 0; i < NUM_REASSEMBLY; i++)
1470 hdev->reassembly[i] = NULL;
1471
1472 init_waitqueue_head(&hdev->req_wait_q);
1473 mutex_init(&hdev->req_lock);
1474
1475 inquiry_cache_init(hdev);
1476
1477 hci_conn_hash_init(hdev);
1478
1479 INIT_LIST_HEAD(&hdev->mgmt_pending);
1480
1481 INIT_LIST_HEAD(&hdev->blacklist);
1482
1483 INIT_LIST_HEAD(&hdev->uuids);
1484
1485 INIT_LIST_HEAD(&hdev->link_keys);
1486
1487 INIT_LIST_HEAD(&hdev->remote_oob_data);
1488
1489 INIT_LIST_HEAD(&hdev->adv_entries);
1490
1491 INIT_DELAYED_WORK(&hdev->adv_work, hci_clear_adv_cache);
1492 INIT_WORK(&hdev->power_on, hci_power_on);
1493 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
1494
1495 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1496
1497 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1498
1499 atomic_set(&hdev->promisc, 0);
1500
1501 write_unlock_bh(&hci_dev_list_lock);
1502
1503 hdev->workqueue = create_singlethread_workqueue(hdev->name);
1504 if (!hdev->workqueue) {
1505 error = -ENOMEM;
1506 goto err;
1507 }
1508
1509 error = hci_add_sysfs(hdev);
1510 if (error < 0)
1511 goto err_wqueue;
1512
1513 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1514 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1515 if (hdev->rfkill) {
1516 if (rfkill_register(hdev->rfkill) < 0) {
1517 rfkill_destroy(hdev->rfkill);
1518 hdev->rfkill = NULL;
1519 }
1520 }
1521
1522 set_bit(HCI_AUTO_OFF, &hdev->flags);
1523 set_bit(HCI_SETUP, &hdev->flags);
1524 queue_work(hdev->workqueue, &hdev->power_on);
1525
1526 hci_notify(hdev, HCI_DEV_REG);
1527
1528 return id;
1529
1530 err_wqueue:
1531 destroy_workqueue(hdev->workqueue);
1532 err:
1533 write_lock_bh(&hci_dev_list_lock);
1534 list_del(&hdev->list);
1535 write_unlock_bh(&hci_dev_list_lock);
1536
1537 return error;
1538 }
1539 EXPORT_SYMBOL(hci_register_dev);
1540
1541 /* Unregister HCI device */
1542 void hci_unregister_dev(struct hci_dev *hdev)
1543 {
1544 int i;
1545
1546 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1547
1548 write_lock_bh(&hci_dev_list_lock);
1549 list_del(&hdev->list);
1550 write_unlock_bh(&hci_dev_list_lock);
1551
1552 hci_dev_do_close(hdev);
1553
1554 for (i = 0; i < NUM_REASSEMBLY; i++)
1555 kfree_skb(hdev->reassembly[i]);
1556
1557 if (!test_bit(HCI_INIT, &hdev->flags) &&
1558 !test_bit(HCI_SETUP, &hdev->flags)) {
1559 hci_dev_lock(hdev);
1560 mgmt_index_removed(hdev);
1561 hci_dev_unlock(hdev);
1562 }
1563
1564 /* mgmt_index_removed should take care of emptying the
1565 * pending list */
1566 BUG_ON(!list_empty(&hdev->mgmt_pending));
1567
1568 hci_notify(hdev, HCI_DEV_UNREG);
1569
1570 if (hdev->rfkill) {
1571 rfkill_unregister(hdev->rfkill);
1572 rfkill_destroy(hdev->rfkill);
1573 }
1574
1575 hci_del_sysfs(hdev);
1576
1577 cancel_delayed_work_sync(&hdev->adv_work);
1578
1579 destroy_workqueue(hdev->workqueue);
1580
1581 hci_dev_lock(hdev);
1582 hci_blacklist_clear(hdev);
1583 hci_uuids_clear(hdev);
1584 hci_link_keys_clear(hdev);
1585 hci_remote_oob_data_clear(hdev);
1586 hci_adv_entries_clear(hdev);
1587 hci_dev_unlock(hdev);
1588
1589 __hci_dev_put(hdev);
1590 }
1591 EXPORT_SYMBOL(hci_unregister_dev);
1592
1593 /* Suspend HCI device */
1594 int hci_suspend_dev(struct hci_dev *hdev)
1595 {
1596 hci_notify(hdev, HCI_DEV_SUSPEND);
1597 return 0;
1598 }
1599 EXPORT_SYMBOL(hci_suspend_dev);
1600
1601 /* Resume HCI device */
1602 int hci_resume_dev(struct hci_dev *hdev)
1603 {
1604 hci_notify(hdev, HCI_DEV_RESUME);
1605 return 0;
1606 }
1607 EXPORT_SYMBOL(hci_resume_dev);
1608
1609 /* Receive frame from HCI drivers */
1610 int hci_recv_frame(struct sk_buff *skb)
1611 {
1612 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1613 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1614 && !test_bit(HCI_INIT, &hdev->flags))) {
1615 kfree_skb(skb);
1616 return -ENXIO;
1617 }
1618
1619 /* Incomming skb */
1620 bt_cb(skb)->incoming = 1;
1621
1622 /* Time stamp */
1623 __net_timestamp(skb);
1624
1625 skb_queue_tail(&hdev->rx_q, skb);
1626 queue_work(hdev->workqueue, &hdev->rx_work);
1627
1628 return 0;
1629 }
1630 EXPORT_SYMBOL(hci_recv_frame);
1631
1632 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1633 int count, __u8 index)
1634 {
1635 int len = 0;
1636 int hlen = 0;
1637 int remain = count;
1638 struct sk_buff *skb;
1639 struct bt_skb_cb *scb;
1640
1641 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1642 index >= NUM_REASSEMBLY)
1643 return -EILSEQ;
1644
1645 skb = hdev->reassembly[index];
1646
1647 if (!skb) {
1648 switch (type) {
1649 case HCI_ACLDATA_PKT:
1650 len = HCI_MAX_FRAME_SIZE;
1651 hlen = HCI_ACL_HDR_SIZE;
1652 break;
1653 case HCI_EVENT_PKT:
1654 len = HCI_MAX_EVENT_SIZE;
1655 hlen = HCI_EVENT_HDR_SIZE;
1656 break;
1657 case HCI_SCODATA_PKT:
1658 len = HCI_MAX_SCO_SIZE;
1659 hlen = HCI_SCO_HDR_SIZE;
1660 break;
1661 }
1662
1663 skb = bt_skb_alloc(len, GFP_ATOMIC);
1664 if (!skb)
1665 return -ENOMEM;
1666
1667 scb = (void *) skb->cb;
1668 scb->expect = hlen;
1669 scb->pkt_type = type;
1670
1671 skb->dev = (void *) hdev;
1672 hdev->reassembly[index] = skb;
1673 }
1674
1675 while (count) {
1676 scb = (void *) skb->cb;
1677 len = min(scb->expect, (__u16)count);
1678
1679 memcpy(skb_put(skb, len), data, len);
1680
1681 count -= len;
1682 data += len;
1683 scb->expect -= len;
1684 remain = count;
1685
1686 switch (type) {
1687 case HCI_EVENT_PKT:
1688 if (skb->len == HCI_EVENT_HDR_SIZE) {
1689 struct hci_event_hdr *h = hci_event_hdr(skb);
1690 scb->expect = h->plen;
1691
1692 if (skb_tailroom(skb) < scb->expect) {
1693 kfree_skb(skb);
1694 hdev->reassembly[index] = NULL;
1695 return -ENOMEM;
1696 }
1697 }
1698 break;
1699
1700 case HCI_ACLDATA_PKT:
1701 if (skb->len == HCI_ACL_HDR_SIZE) {
1702 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1703 scb->expect = __le16_to_cpu(h->dlen);
1704
1705 if (skb_tailroom(skb) < scb->expect) {
1706 kfree_skb(skb);
1707 hdev->reassembly[index] = NULL;
1708 return -ENOMEM;
1709 }
1710 }
1711 break;
1712
1713 case HCI_SCODATA_PKT:
1714 if (skb->len == HCI_SCO_HDR_SIZE) {
1715 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1716 scb->expect = h->dlen;
1717
1718 if (skb_tailroom(skb) < scb->expect) {
1719 kfree_skb(skb);
1720 hdev->reassembly[index] = NULL;
1721 return -ENOMEM;
1722 }
1723 }
1724 break;
1725 }
1726
1727 if (scb->expect == 0) {
1728 /* Complete frame */
1729
1730 bt_cb(skb)->pkt_type = type;
1731 hci_recv_frame(skb);
1732
1733 hdev->reassembly[index] = NULL;
1734 return remain;
1735 }
1736 }
1737
1738 return remain;
1739 }
1740
1741 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1742 {
1743 int rem = 0;
1744
1745 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1746 return -EILSEQ;
1747
1748 while (count) {
1749 rem = hci_reassembly(hdev, type, data, count, type - 1);
1750 if (rem < 0)
1751 return rem;
1752
1753 data += (count - rem);
1754 count = rem;
1755 }
1756
1757 return rem;
1758 }
1759 EXPORT_SYMBOL(hci_recv_fragment);
1760
1761 #define STREAM_REASSEMBLY 0
1762
1763 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1764 {
1765 int type;
1766 int rem = 0;
1767
1768 while (count) {
1769 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1770
1771 if (!skb) {
1772 struct { char type; } *pkt;
1773
1774 /* Start of the frame */
1775 pkt = data;
1776 type = pkt->type;
1777
1778 data++;
1779 count--;
1780 } else
1781 type = bt_cb(skb)->pkt_type;
1782
1783 rem = hci_reassembly(hdev, type, data, count,
1784 STREAM_REASSEMBLY);
1785 if (rem < 0)
1786 return rem;
1787
1788 data += (count - rem);
1789 count = rem;
1790 }
1791
1792 return rem;
1793 }
1794 EXPORT_SYMBOL(hci_recv_stream_fragment);
1795
1796 /* ---- Interface to upper protocols ---- */
1797
1798 /* Register/Unregister protocols.
1799 * hci_task_lock is used to ensure that no tasks are running. */
1800 int hci_register_proto(struct hci_proto *hp)
1801 {
1802 int err = 0;
1803
1804 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1805
1806 if (hp->id >= HCI_MAX_PROTO)
1807 return -EINVAL;
1808
1809 mutex_lock(&hci_task_lock);
1810
1811 if (!hci_proto[hp->id])
1812 hci_proto[hp->id] = hp;
1813 else
1814 err = -EEXIST;
1815
1816 mutex_unlock(&hci_task_lock);
1817
1818 return err;
1819 }
1820 EXPORT_SYMBOL(hci_register_proto);
1821
1822 int hci_unregister_proto(struct hci_proto *hp)
1823 {
1824 int err = 0;
1825
1826 BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1827
1828 if (hp->id >= HCI_MAX_PROTO)
1829 return -EINVAL;
1830
1831 mutex_lock(&hci_task_lock);
1832
1833 if (hci_proto[hp->id])
1834 hci_proto[hp->id] = NULL;
1835 else
1836 err = -ENOENT;
1837
1838 mutex_unlock(&hci_task_lock);
1839
1840 return err;
1841 }
1842 EXPORT_SYMBOL(hci_unregister_proto);
1843
1844 int hci_register_cb(struct hci_cb *cb)
1845 {
1846 BT_DBG("%p name %s", cb, cb->name);
1847
1848 write_lock_bh(&hci_cb_list_lock);
1849 list_add(&cb->list, &hci_cb_list);
1850 write_unlock_bh(&hci_cb_list_lock);
1851
1852 return 0;
1853 }
1854 EXPORT_SYMBOL(hci_register_cb);
1855
1856 int hci_unregister_cb(struct hci_cb *cb)
1857 {
1858 BT_DBG("%p name %s", cb, cb->name);
1859
1860 write_lock_bh(&hci_cb_list_lock);
1861 list_del(&cb->list);
1862 write_unlock_bh(&hci_cb_list_lock);
1863
1864 return 0;
1865 }
1866 EXPORT_SYMBOL(hci_unregister_cb);
1867
1868 static int hci_send_frame(struct sk_buff *skb)
1869 {
1870 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1871
1872 if (!hdev) {
1873 kfree_skb(skb);
1874 return -ENODEV;
1875 }
1876
1877 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1878
1879 if (atomic_read(&hdev->promisc)) {
1880 /* Time stamp */
1881 __net_timestamp(skb);
1882
1883 hci_send_to_sock(hdev, skb, NULL);
1884 }
1885
1886 /* Get rid of skb owner, prior to sending to the driver. */
1887 skb_orphan(skb);
1888
1889 return hdev->send(skb);
1890 }
1891
1892 /* Send HCI command */
1893 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1894 {
1895 int len = HCI_COMMAND_HDR_SIZE + plen;
1896 struct hci_command_hdr *hdr;
1897 struct sk_buff *skb;
1898
1899 BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1900
1901 skb = bt_skb_alloc(len, GFP_ATOMIC);
1902 if (!skb) {
1903 BT_ERR("%s no memory for command", hdev->name);
1904 return -ENOMEM;
1905 }
1906
1907 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1908 hdr->opcode = cpu_to_le16(opcode);
1909 hdr->plen = plen;
1910
1911 if (plen)
1912 memcpy(skb_put(skb, plen), param, plen);
1913
1914 BT_DBG("skb len %d", skb->len);
1915
1916 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1917 skb->dev = (void *) hdev;
1918
1919 if (test_bit(HCI_INIT, &hdev->flags))
1920 hdev->init_last_cmd = opcode;
1921
1922 skb_queue_tail(&hdev->cmd_q, skb);
1923 queue_work(hdev->workqueue, &hdev->cmd_work);
1924
1925 return 0;
1926 }
1927
1928 /* Get data from the previously sent command */
1929 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1930 {
1931 struct hci_command_hdr *hdr;
1932
1933 if (!hdev->sent_cmd)
1934 return NULL;
1935
1936 hdr = (void *) hdev->sent_cmd->data;
1937
1938 if (hdr->opcode != cpu_to_le16(opcode))
1939 return NULL;
1940
1941 BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1942
1943 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1944 }
1945
1946 /* Send ACL data */
1947 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1948 {
1949 struct hci_acl_hdr *hdr;
1950 int len = skb->len;
1951
1952 skb_push(skb, HCI_ACL_HDR_SIZE);
1953 skb_reset_transport_header(skb);
1954 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
1955 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1956 hdr->dlen = cpu_to_le16(len);
1957 }
1958
1959 static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
1960 struct sk_buff *skb, __u16 flags)
1961 {
1962 struct hci_dev *hdev = conn->hdev;
1963 struct sk_buff *list;
1964
1965 list = skb_shinfo(skb)->frag_list;
1966 if (!list) {
1967 /* Non fragmented */
1968 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1969
1970 skb_queue_tail(queue, skb);
1971 } else {
1972 /* Fragmented */
1973 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1974
1975 skb_shinfo(skb)->frag_list = NULL;
1976
1977 /* Queue all fragments atomically */
1978 spin_lock_bh(&queue->lock);
1979
1980 __skb_queue_tail(queue, skb);
1981
1982 flags &= ~ACL_START;
1983 flags |= ACL_CONT;
1984 do {
1985 skb = list; list = list->next;
1986
1987 skb->dev = (void *) hdev;
1988 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1989 hci_add_acl_hdr(skb, conn->handle, flags);
1990
1991 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1992
1993 __skb_queue_tail(queue, skb);
1994 } while (list);
1995
1996 spin_unlock_bh(&queue->lock);
1997 }
1998 }
1999
2000 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2001 {
2002 struct hci_conn *conn = chan->conn;
2003 struct hci_dev *hdev = conn->hdev;
2004
2005 BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
2006
2007 skb->dev = (void *) hdev;
2008 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2009 hci_add_acl_hdr(skb, conn->handle, flags);
2010
2011 hci_queue_acl(conn, &chan->data_q, skb, flags);
2012
2013 queue_work(hdev->workqueue, &hdev->tx_work);
2014 }
2015 EXPORT_SYMBOL(hci_send_acl);
2016
2017 /* Send SCO data */
2018 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2019 {
2020 struct hci_dev *hdev = conn->hdev;
2021 struct hci_sco_hdr hdr;
2022
2023 BT_DBG("%s len %d", hdev->name, skb->len);
2024
2025 hdr.handle = cpu_to_le16(conn->handle);
2026 hdr.dlen = skb->len;
2027
2028 skb_push(skb, HCI_SCO_HDR_SIZE);
2029 skb_reset_transport_header(skb);
2030 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2031
2032 skb->dev = (void *) hdev;
2033 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2034
2035 skb_queue_tail(&conn->data_q, skb);
2036 queue_work(hdev->workqueue, &hdev->tx_work);
2037 }
2038 EXPORT_SYMBOL(hci_send_sco);
2039
2040 /* ---- HCI TX task (outgoing data) ---- */
2041
2042 /* HCI Connection scheduler */
2043 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
2044 {
2045 struct hci_conn_hash *h = &hdev->conn_hash;
2046 struct hci_conn *conn = NULL, *c;
2047 int num = 0, min = ~0;
2048
2049 /* We don't have to lock device here. Connections are always
2050 * added and removed with TX task disabled. */
2051
2052 rcu_read_lock();
2053
2054 list_for_each_entry_rcu(c, &h->list, list) {
2055 if (c->type != type || skb_queue_empty(&c->data_q))
2056 continue;
2057
2058 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2059 continue;
2060
2061 num++;
2062
2063 if (c->sent < min) {
2064 min = c->sent;
2065 conn = c;
2066 }
2067
2068 if (hci_conn_num(hdev, type) == num)
2069 break;
2070 }
2071
2072 rcu_read_unlock();
2073
2074 if (conn) {
2075 int cnt, q;
2076
2077 switch (conn->type) {
2078 case ACL_LINK:
2079 cnt = hdev->acl_cnt;
2080 break;
2081 case SCO_LINK:
2082 case ESCO_LINK:
2083 cnt = hdev->sco_cnt;
2084 break;
2085 case LE_LINK:
2086 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2087 break;
2088 default:
2089 cnt = 0;
2090 BT_ERR("Unknown link type");
2091 }
2092
2093 q = cnt / num;
2094 *quote = q ? q : 1;
2095 } else
2096 *quote = 0;
2097
2098 BT_DBG("conn %p quote %d", conn, *quote);
2099 return conn;
2100 }
2101
2102 static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2103 {
2104 struct hci_conn_hash *h = &hdev->conn_hash;
2105 struct hci_conn *c;
2106
2107 BT_ERR("%s link tx timeout", hdev->name);
2108
2109 rcu_read_lock();
2110
2111 /* Kill stalled connections */
2112 list_for_each_entry_rcu(c, &h->list, list) {
2113 if (c->type == type && c->sent) {
2114 BT_ERR("%s killing stalled connection %s",
2115 hdev->name, batostr(&c->dst));
2116 hci_acl_disconn(c, 0x13);
2117 }
2118 }
2119
2120 rcu_read_unlock();
2121 }
2122
2123 static inline struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2124 int *quote)
2125 {
2126 struct hci_conn_hash *h = &hdev->conn_hash;
2127 struct hci_chan *chan = NULL;
2128 int num = 0, min = ~0, cur_prio = 0;
2129 struct hci_conn *conn;
2130 int cnt, q, conn_num = 0;
2131
2132 BT_DBG("%s", hdev->name);
2133
2134 rcu_read_lock();
2135
2136 list_for_each_entry_rcu(conn, &h->list, list) {
2137 struct hci_chan *tmp;
2138
2139 if (conn->type != type)
2140 continue;
2141
2142 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2143 continue;
2144
2145 conn_num++;
2146
2147 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2148 struct sk_buff *skb;
2149
2150 if (skb_queue_empty(&tmp->data_q))
2151 continue;
2152
2153 skb = skb_peek(&tmp->data_q);
2154 if (skb->priority < cur_prio)
2155 continue;
2156
2157 if (skb->priority > cur_prio) {
2158 num = 0;
2159 min = ~0;
2160 cur_prio = skb->priority;
2161 }
2162
2163 num++;
2164
2165 if (conn->sent < min) {
2166 min = conn->sent;
2167 chan = tmp;
2168 }
2169 }
2170
2171 if (hci_conn_num(hdev, type) == conn_num)
2172 break;
2173 }
2174
2175 rcu_read_unlock();
2176
2177 if (!chan)
2178 return NULL;
2179
2180 switch (chan->conn->type) {
2181 case ACL_LINK:
2182 cnt = hdev->acl_cnt;
2183 break;
2184 case SCO_LINK:
2185 case ESCO_LINK:
2186 cnt = hdev->sco_cnt;
2187 break;
2188 case LE_LINK:
2189 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2190 break;
2191 default:
2192 cnt = 0;
2193 BT_ERR("Unknown link type");
2194 }
2195
2196 q = cnt / num;
2197 *quote = q ? q : 1;
2198 BT_DBG("chan %p quote %d", chan, *quote);
2199 return chan;
2200 }
2201
2202 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2203 {
2204 struct hci_conn_hash *h = &hdev->conn_hash;
2205 struct hci_conn *conn;
2206 int num = 0;
2207
2208 BT_DBG("%s", hdev->name);
2209
2210 rcu_read_lock();
2211
2212 list_for_each_entry_rcu(conn, &h->list, list) {
2213 struct hci_chan *chan;
2214
2215 if (conn->type != type)
2216 continue;
2217
2218 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2219 continue;
2220
2221 num++;
2222
2223 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
2224 struct sk_buff *skb;
2225
2226 if (chan->sent) {
2227 chan->sent = 0;
2228 continue;
2229 }
2230
2231 if (skb_queue_empty(&chan->data_q))
2232 continue;
2233
2234 skb = skb_peek(&chan->data_q);
2235 if (skb->priority >= HCI_PRIO_MAX - 1)
2236 continue;
2237
2238 skb->priority = HCI_PRIO_MAX - 1;
2239
2240 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2241 skb->priority);
2242 }
2243
2244 if (hci_conn_num(hdev, type) == num)
2245 break;
2246 }
2247
2248 rcu_read_unlock();
2249
2250 }
2251
2252 static inline void hci_sched_acl(struct hci_dev *hdev)
2253 {
2254 struct hci_chan *chan;
2255 struct sk_buff *skb;
2256 int quote;
2257 unsigned int cnt;
2258
2259 BT_DBG("%s", hdev->name);
2260
2261 if (!hci_conn_num(hdev, ACL_LINK))
2262 return;
2263
2264 if (!test_bit(HCI_RAW, &hdev->flags)) {
2265 /* ACL tx timeout must be longer than maximum
2266 * link supervision timeout (40.9 seconds) */
2267 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
2268 hci_link_tx_to(hdev, ACL_LINK);
2269 }
2270
2271 cnt = hdev->acl_cnt;
2272
2273 while (hdev->acl_cnt &&
2274 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2275 u32 priority = (skb_peek(&chan->data_q))->priority;
2276 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2277 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2278 skb->len, skb->priority);
2279
2280 /* Stop if priority has changed */
2281 if (skb->priority < priority)
2282 break;
2283
2284 skb = skb_dequeue(&chan->data_q);
2285
2286 hci_conn_enter_active_mode(chan->conn,
2287 bt_cb(skb)->force_active);
2288
2289 hci_send_frame(skb);
2290 hdev->acl_last_tx = jiffies;
2291
2292 hdev->acl_cnt--;
2293 chan->sent++;
2294 chan->conn->sent++;
2295 }
2296 }
2297
2298 if (cnt != hdev->acl_cnt)
2299 hci_prio_recalculate(hdev, ACL_LINK);
2300 }
2301
2302 /* Schedule SCO */
2303 static inline void hci_sched_sco(struct hci_dev *hdev)
2304 {
2305 struct hci_conn *conn;
2306 struct sk_buff *skb;
2307 int quote;
2308
2309 BT_DBG("%s", hdev->name);
2310
2311 if (!hci_conn_num(hdev, SCO_LINK))
2312 return;
2313
2314 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2315 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2316 BT_DBG("skb %p len %d", skb, skb->len);
2317 hci_send_frame(skb);
2318
2319 conn->sent++;
2320 if (conn->sent == ~0)
2321 conn->sent = 0;
2322 }
2323 }
2324 }
2325
2326 static inline void hci_sched_esco(struct hci_dev *hdev)
2327 {
2328 struct hci_conn *conn;
2329 struct sk_buff *skb;
2330 int quote;
2331
2332 BT_DBG("%s", hdev->name);
2333
2334 if (!hci_conn_num(hdev, ESCO_LINK))
2335 return;
2336
2337 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2338 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2339 BT_DBG("skb %p len %d", skb, skb->len);
2340 hci_send_frame(skb);
2341
2342 conn->sent++;
2343 if (conn->sent == ~0)
2344 conn->sent = 0;
2345 }
2346 }
2347 }
2348
2349 static inline void hci_sched_le(struct hci_dev *hdev)
2350 {
2351 struct hci_chan *chan;
2352 struct sk_buff *skb;
2353 int quote, cnt, tmp;
2354
2355 BT_DBG("%s", hdev->name);
2356
2357 if (!hci_conn_num(hdev, LE_LINK))
2358 return;
2359
2360 if (!test_bit(HCI_RAW, &hdev->flags)) {
2361 /* LE tx timeout must be longer than maximum
2362 * link supervision timeout (40.9 seconds) */
2363 if (!hdev->le_cnt && hdev->le_pkts &&
2364 time_after(jiffies, hdev->le_last_tx + HZ * 45))
2365 hci_link_tx_to(hdev, LE_LINK);
2366 }
2367
2368 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2369 tmp = cnt;
2370 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
2371 u32 priority = (skb_peek(&chan->data_q))->priority;
2372 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2373 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2374 skb->len, skb->priority);
2375
2376 /* Stop if priority has changed */
2377 if (skb->priority < priority)
2378 break;
2379
2380 skb = skb_dequeue(&chan->data_q);
2381
2382 hci_send_frame(skb);
2383 hdev->le_last_tx = jiffies;
2384
2385 cnt--;
2386 chan->sent++;
2387 chan->conn->sent++;
2388 }
2389 }
2390
2391 if (hdev->le_pkts)
2392 hdev->le_cnt = cnt;
2393 else
2394 hdev->acl_cnt = cnt;
2395
2396 if (cnt != tmp)
2397 hci_prio_recalculate(hdev, LE_LINK);
2398 }
2399
2400 static void hci_tx_work(struct work_struct *work)
2401 {
2402 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
2403 struct sk_buff *skb;
2404
2405 mutex_lock(&hci_task_lock);
2406
2407 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2408 hdev->sco_cnt, hdev->le_cnt);
2409
2410 /* Schedule queues and send stuff to HCI driver */
2411
2412 hci_sched_acl(hdev);
2413
2414 hci_sched_sco(hdev);
2415
2416 hci_sched_esco(hdev);
2417
2418 hci_sched_le(hdev);
2419
2420 /* Send next queued raw (unknown type) packet */
2421 while ((skb = skb_dequeue(&hdev->raw_q)))
2422 hci_send_frame(skb);
2423
2424 mutex_unlock(&hci_task_lock);
2425 }
2426
2427 /* ----- HCI RX task (incoming data processing) ----- */
2428
2429 /* ACL data packet */
2430 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2431 {
2432 struct hci_acl_hdr *hdr = (void *) skb->data;
2433 struct hci_conn *conn;
2434 __u16 handle, flags;
2435
2436 skb_pull(skb, HCI_ACL_HDR_SIZE);
2437
2438 handle = __le16_to_cpu(hdr->handle);
2439 flags = hci_flags(handle);
2440 handle = hci_handle(handle);
2441
2442 BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2443
2444 hdev->stat.acl_rx++;
2445
2446 hci_dev_lock(hdev);
2447 conn = hci_conn_hash_lookup_handle(hdev, handle);
2448 hci_dev_unlock(hdev);
2449
2450 if (conn) {
2451 register struct hci_proto *hp;
2452
2453 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
2454
2455 /* Send to upper protocol */
2456 hp = hci_proto[HCI_PROTO_L2CAP];
2457 if (hp && hp->recv_acldata) {
2458 hp->recv_acldata(conn, skb, flags);
2459 return;
2460 }
2461 } else {
2462 BT_ERR("%s ACL packet for unknown connection handle %d",
2463 hdev->name, handle);
2464 }
2465
2466 kfree_skb(skb);
2467 }
2468
2469 /* SCO data packet */
2470 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2471 {
2472 struct hci_sco_hdr *hdr = (void *) skb->data;
2473 struct hci_conn *conn;
2474 __u16 handle;
2475
2476 skb_pull(skb, HCI_SCO_HDR_SIZE);
2477
2478 handle = __le16_to_cpu(hdr->handle);
2479
2480 BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2481
2482 hdev->stat.sco_rx++;
2483
2484 hci_dev_lock(hdev);
2485 conn = hci_conn_hash_lookup_handle(hdev, handle);
2486 hci_dev_unlock(hdev);
2487
2488 if (conn) {
2489 register struct hci_proto *hp;
2490
2491 /* Send to upper protocol */
2492 hp = hci_proto[HCI_PROTO_SCO];
2493 if (hp && hp->recv_scodata) {
2494 hp->recv_scodata(conn, skb);
2495 return;
2496 }
2497 } else {
2498 BT_ERR("%s SCO packet for unknown connection handle %d",
2499 hdev->name, handle);
2500 }
2501
2502 kfree_skb(skb);
2503 }
2504
2505 static void hci_rx_work(struct work_struct *work)
2506 {
2507 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
2508 struct sk_buff *skb;
2509
2510 BT_DBG("%s", hdev->name);
2511
2512 mutex_lock(&hci_task_lock);
2513
2514 while ((skb = skb_dequeue(&hdev->rx_q))) {
2515 if (atomic_read(&hdev->promisc)) {
2516 /* Send copy to the sockets */
2517 hci_send_to_sock(hdev, skb, NULL);
2518 }
2519
2520 if (test_bit(HCI_RAW, &hdev->flags)) {
2521 kfree_skb(skb);
2522 continue;
2523 }
2524
2525 if (test_bit(HCI_INIT, &hdev->flags)) {
2526 /* Don't process data packets in this states. */
2527 switch (bt_cb(skb)->pkt_type) {
2528 case HCI_ACLDATA_PKT:
2529 case HCI_SCODATA_PKT:
2530 kfree_skb(skb);
2531 continue;
2532 }
2533 }
2534
2535 /* Process frame */
2536 switch (bt_cb(skb)->pkt_type) {
2537 case HCI_EVENT_PKT:
2538 BT_DBG("%s Event packet", hdev->name);
2539 hci_event_packet(hdev, skb);
2540 break;
2541
2542 case HCI_ACLDATA_PKT:
2543 BT_DBG("%s ACL data packet", hdev->name);
2544 hci_acldata_packet(hdev, skb);
2545 break;
2546
2547 case HCI_SCODATA_PKT:
2548 BT_DBG("%s SCO data packet", hdev->name);
2549 hci_scodata_packet(hdev, skb);
2550 break;
2551
2552 default:
2553 kfree_skb(skb);
2554 break;
2555 }
2556 }
2557
2558 mutex_unlock(&hci_task_lock);
2559 }
2560
2561 static void hci_cmd_work(struct work_struct *work)
2562 {
2563 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
2564 struct sk_buff *skb;
2565
2566 BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2567
2568 /* Send queued commands */
2569 if (atomic_read(&hdev->cmd_cnt)) {
2570 skb = skb_dequeue(&hdev->cmd_q);
2571 if (!skb)
2572 return;
2573
2574 kfree_skb(hdev->sent_cmd);
2575
2576 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2577 if (hdev->sent_cmd) {
2578 atomic_dec(&hdev->cmd_cnt);
2579 hci_send_frame(skb);
2580 if (test_bit(HCI_RESET, &hdev->flags))
2581 del_timer(&hdev->cmd_timer);
2582 else
2583 mod_timer(&hdev->cmd_timer,
2584 jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2585 } else {
2586 skb_queue_head(&hdev->cmd_q, skb);
2587 queue_work(hdev->workqueue, &hdev->cmd_work);
2588 }
2589 }
2590 }
2591
2592 int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2593 {
2594 /* General inquiry access code (GIAC) */
2595 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2596 struct hci_cp_inquiry cp;
2597
2598 BT_DBG("%s", hdev->name);
2599
2600 if (test_bit(HCI_INQUIRY, &hdev->flags))
2601 return -EINPROGRESS;
2602
2603 memset(&cp, 0, sizeof(cp));
2604 memcpy(&cp.lap, lap, sizeof(cp.lap));
2605 cp.length = length;
2606
2607 return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2608 }
2609
2610 int hci_cancel_inquiry(struct hci_dev *hdev)
2611 {
2612 BT_DBG("%s", hdev->name);
2613
2614 if (!test_bit(HCI_INQUIRY, &hdev->flags))
2615 return -EPERM;
2616
2617 return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2618 }
2619
2620 module_param(enable_hs, bool, 0644);
2621 MODULE_PARM_DESC(enable_hs, "Enable High Speed");
Linux kernel - Deliverables
This page took 0.088722 seconds and 6 git commands to generate.