net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2011 ProFUSION Embedded Systems
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI core. */
  27
  28 #include <linux/export.h>
  29 #include <linux/idr.h>
  30
  31 #include <linux/rfkill.h>
  32
  33 #include <net/bluetooth/bluetooth.h>
  34 #include <net/bluetooth/hci_core.h>
  35
  36 static void hci_rx_work(struct work_struct *work);
  37 static void hci_cmd_work(struct work_struct *work);
  38 static void hci_tx_work(struct work_struct *work);
  39
  40 /* HCI device list */
  41 LIST_HEAD(hci_dev_list);
  42 DEFINE_RWLOCK(hci_dev_list_lock);
  43
  44 /* HCI callback list */
  45 LIST_HEAD(hci_cb_list);
  46 DEFINE_RWLOCK(hci_cb_list_lock);
  47
  48 /* HCI ID Numbering */
  49 static DEFINE_IDA(hci_index_ida);
  50
  51 /* ---- HCI notifications ---- */
  52
  53 static void hci_notify(struct hci_dev *hdev, int event)
  54 {
  55         hci_sock_dev_event(hdev, event);
  56 }
  57
  58 /* ---- HCI requests ---- */
  59
  60 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
  61 {
  62         BT_DBG("%s result 0x%2.2x", hdev->name, result);
  63
  64         if (hdev->req_status == HCI_REQ_PEND) {
  65                 hdev->req_result = result;
  66                 hdev->req_status = HCI_REQ_DONE;
  67                 wake_up_interruptible(&hdev->req_wait_q);
  68         }
  69 }
  70
  71 static void hci_req_cancel(struct hci_dev *hdev, int err)
  72 {
  73         BT_DBG("%s err 0x%2.2x", hdev->name, err);
  74
  75         if (hdev->req_status == HCI_REQ_PEND) {
  76                 hdev->req_result = err;
  77                 hdev->req_status = HCI_REQ_CANCELED;
  78                 wake_up_interruptible(&hdev->req_wait_q);
  79         }
  80 }
  81
  82 static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
  83                                             u8 event)
  84 {
  85         struct hci_ev_cmd_complete *ev;
  86         struct hci_event_hdr *hdr;
  87         struct sk_buff *skb;
  88
  89         hci_dev_lock(hdev);
  90
  91         skb = hdev->recv_evt;
  92         hdev->recv_evt = NULL;
  93
  94         hci_dev_unlock(hdev);
  95
  96         if (!skb)
  97                 return ERR_PTR(-ENODATA);
  98
  99         if (skb->len < sizeof(*hdr)) {
 100                 BT_ERR("Too short HCI event");
 101                 goto failed;
 102         }
 103
 104         hdr = (void *) skb->data;
 105         skb_pull(skb, HCI_EVENT_HDR_SIZE);
 106
 107         if (event) {
 108                 if (hdr->evt != event)
 109                         goto failed;
 110                 return skb;
 111         }
 112
 113         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
 114                 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
 115                 goto failed;
 116         }
 117
 118         if (skb->len < sizeof(*ev)) {
 119                 BT_ERR("Too short cmd_complete event");
 120                 goto failed;
 121         }
 122
 123         ev = (void *) skb->data;
 124         skb_pull(skb, sizeof(*ev));
 125
 126         if (opcode == __le16_to_cpu(ev->opcode))
 127                 return skb;
 128
 129         BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
 130                __le16_to_cpu(ev->opcode));
 131
 132 failed:
 133         kfree_skb(skb);
 134         return ERR_PTR(-ENODATA);
 135 }
 136
 137 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
 138                                   const void *param, u8 event, u32 timeout)
 139 {
 140         DECLARE_WAITQUEUE(wait, current);
 141         struct hci_request req;
 142         int err = 0;
 143
 144         BT_DBG("%s", hdev->name);
 145
 146         hci_req_init(&req, hdev);
 147
 148         hci_req_add_ev(&req, opcode, plen, param, event);
 149
 150         hdev->req_status = HCI_REQ_PEND;
 151
 152         err = hci_req_run(&req, hci_req_sync_complete);
 153         if (err < 0)
 154                 return ERR_PTR(err);
 155
 156         add_wait_queue(&hdev->req_wait_q, &wait);
 157         set_current_state(TASK_INTERRUPTIBLE);
 158
 159         schedule_timeout(timeout);
 160
 161         remove_wait_queue(&hdev->req_wait_q, &wait);
 162
 163         if (signal_pending(current))
 164                 return ERR_PTR(-EINTR);
 165
 166         switch (hdev->req_status) {
 167         case HCI_REQ_DONE:
 168                 err = -bt_to_errno(hdev->req_result);
 169                 break;
 170
 171         case HCI_REQ_CANCELED:
 172                 err = -hdev->req_result;
 173                 break;
 174
 175         default:
 176                 err = -ETIMEDOUT;
 177                 break;
 178         }
 179
 180         hdev->req_status = hdev->req_result = 0;
 181
 182         BT_DBG("%s end: err %d", hdev->name, err);
 183
 184         if (err < 0)
 185                 return ERR_PTR(err);
 186
 187         return hci_get_cmd_complete(hdev, opcode, event);
 188 }
 189 EXPORT_SYMBOL(__hci_cmd_sync_ev);
 190
 191 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
 192                                const void *param, u32 timeout)
 193 {
 194         return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
 195 }
 196 EXPORT_SYMBOL(__hci_cmd_sync);
 197
 198 /* Execute request and wait for completion. */
 199 static int __hci_req_sync(struct hci_dev *hdev,
 200                           void (*func)(struct hci_request *req,
 201                                       unsigned long opt),
 202                           unsigned long opt, __u32 timeout)
 203 {
 204         struct hci_request req;
 205         DECLARE_WAITQUEUE(wait, current);
 206         int err = 0;
 207
 208         BT_DBG("%s start", hdev->name);
 209
 210         hci_req_init(&req, hdev);
 211
 212         hdev->req_status = HCI_REQ_PEND;
 213
 214         func(&req, opt);
 215
 216         err = hci_req_run(&req, hci_req_sync_complete);
 217         if (err < 0) {
 218                 hdev->req_status = 0;
 219
 220                 /* ENODATA means the HCI request command queue is empty.
 221                  * This can happen when a request with conditionals doesn't
 222                  * trigger any commands to be sent. This is normal behavior
 223                  * and should not trigger an error return.
 224                  */
 225                 if (err == -ENODATA)
 226                         return 0;
 227
 228                 return err;
 229         }
 230
 231         add_wait_queue(&hdev->req_wait_q, &wait);
 232         set_current_state(TASK_INTERRUPTIBLE);
 233
 234         schedule_timeout(timeout);
 235
 236         remove_wait_queue(&hdev->req_wait_q, &wait);
 237
 238         if (signal_pending(current))
 239                 return -EINTR;
 240
 241         switch (hdev->req_status) {
 242         case HCI_REQ_DONE:
 243                 err = -bt_to_errno(hdev->req_result);
 244                 break;
 245
 246         case HCI_REQ_CANCELED:
 247                 err = -hdev->req_result;
 248                 break;
 249
 250         default:
 251                 err = -ETIMEDOUT;
 252                 break;
 253         }
 254
 255         hdev->req_status = hdev->req_result = 0;
 256
 257         BT_DBG("%s end: err %d", hdev->name, err);
 258
 259         return err;
 260 }
 261
 262 static int hci_req_sync(struct hci_dev *hdev,
 263                         void (*req)(struct hci_request *req,
 264                                     unsigned long opt),
 265                         unsigned long opt, __u32 timeout)
 266 {
 267         int ret;
 268
 269         if (!test_bit(HCI_UP, &hdev->flags))
 270                 return -ENETDOWN;
 271
 272         /* Serialize all requests */
 273         hci_req_lock(hdev);
 274         ret = __hci_req_sync(hdev, req, opt, timeout);
 275         hci_req_unlock(hdev);
 276
 277         return ret;
 278 }
 279
 280 static void hci_reset_req(struct hci_request *req, unsigned long opt)
 281 {
 282         BT_DBG("%s %ld", req->hdev->name, opt);
 283
 284         /* Reset device */
 285         set_bit(HCI_RESET, &req->hdev->flags);
 286         hci_req_add(req, HCI_OP_RESET, 0, NULL);
 287 }
 288
 289 static void bredr_init(struct hci_request *req)
 290 {
 291         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
 292
 293         /* Read Local Supported Features */
 294         hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 295
 296         /* Read Local Version */
 297         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 298
 299         /* Read BD Address */
 300         hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
 301 }
 302
 303 static void amp_init(struct hci_request *req)
 304 {
 305         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
 306
 307         /* Read Local Version */
 308         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 309
 310         /* Read Local AMP Info */
 311         hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 312
 313         /* Read Data Blk size */
 314         hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
 315 }
 316
 317 static void hci_init1_req(struct hci_request *req, unsigned long opt)
 318 {
 319         struct hci_dev *hdev = req->hdev;
 320
 321         BT_DBG("%s %ld", hdev->name, opt);
 322
 323         /* Reset */
 324         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
 325                 hci_reset_req(req, 0);
 326
 327         switch (hdev->dev_type) {
 328         case HCI_BREDR:
 329                 bredr_init(req);
 330                 break;
 331
 332         case HCI_AMP:
 333                 amp_init(req);
 334                 break;
 335
 336         default:
 337                 BT_ERR("Unknown device type %d", hdev->dev_type);
 338                 break;
 339         }
 340 }
 341
 342 static void bredr_setup(struct hci_request *req)
 343 {
 344         struct hci_cp_delete_stored_link_key cp;
 345         __le16 param;
 346         __u8 flt_type;
 347
 348         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 349         hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 350
 351         /* Read Class of Device */
 352         hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 353
 354         /* Read Local Name */
 355         hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 356
 357         /* Read Voice Setting */
 358         hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 359
 360         /* Clear Event Filters */
 361         flt_type = HCI_FLT_CLEAR_ALL;
 362         hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 363
 364         /* Connection accept timeout ~20 secs */
 365         param = __constant_cpu_to_le16(0x7d00);
 366         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 367
 368         bacpy(&cp.bdaddr, BDADDR_ANY);
 369         cp.delete_all = 0x01;
 370         hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
 371
 372         /* Read page scan parameters */
 373         if (req->hdev->hci_ver > BLUETOOTH_VER_1_1) {
 374                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
 375                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
 376         }
 377 }
 378
 379 static void le_setup(struct hci_request *req)
 380 {
 381         struct hci_dev *hdev = req->hdev;
 382
 383         /* Read LE Buffer Size */
 384         hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 385
 386         /* Read LE Local Supported Features */
 387         hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
 388
 389         /* Read LE Advertising Channel TX Power */
 390         hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
 391
 392         /* Read LE White List Size */
 393         hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
 394
 395         /* Read LE Supported States */
 396         hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
 397
 398         /* LE-only controllers have LE implicitly enabled */
 399         if (!lmp_bredr_capable(hdev))
 400                 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
 401 }
 402
 403 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
 404 {
 405         if (lmp_ext_inq_capable(hdev))
 406                 return 0x02;
 407
 408         if (lmp_inq_rssi_capable(hdev))
 409                 return 0x01;
 410
 411         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
 412             hdev->lmp_subver == 0x0757)
 413                 return 0x01;
 414
 415         if (hdev->manufacturer == 15) {
 416                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
 417                         return 0x01;
 418                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
 419                         return 0x01;
 420                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
 421                         return 0x01;
 422         }
 423
 424         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
 425             hdev->lmp_subver == 0x1805)
 426                 return 0x01;
 427
 428         return 0x00;
 429 }
 430
 431 static void hci_setup_inquiry_mode(struct hci_request *req)
 432 {
 433         u8 mode;
 434
 435         mode = hci_get_inquiry_mode(req->hdev);
 436
 437         hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 438 }
 439
 440 static void hci_setup_event_mask(struct hci_request *req)
 441 {
 442         struct hci_dev *hdev = req->hdev;
 443
 444         /* The second byte is 0xff instead of 0x9f (two reserved bits
 445          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 446          * command otherwise.
 447          */
 448         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 449
 450         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 451          * any event mask for pre 1.2 devices.
 452          */
 453         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 454                 return;
 455
 456         if (lmp_bredr_capable(hdev)) {
 457                 events[4] |= 0x01; /* Flow Specification Complete */
 458                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 459                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
 460                 events[5] |= 0x08; /* Synchronous Connection Complete */
 461                 events[5] |= 0x10; /* Synchronous Connection Changed */
 462         }
 463
 464         if (lmp_inq_rssi_capable(hdev))
 465                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 466
 467         if (lmp_sniffsubr_capable(hdev))
 468                 events[5] |= 0x20; /* Sniff Subrating */
 469
 470         if (lmp_pause_enc_capable(hdev))
 471                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 472
 473         if (lmp_ext_inq_capable(hdev))
 474                 events[5] |= 0x40; /* Extended Inquiry Result */
 475
 476         if (lmp_no_flush_capable(hdev))
 477                 events[7] |= 0x01; /* Enhanced Flush Complete */
 478
 479         if (lmp_lsto_capable(hdev))
 480                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 481
 482         if (lmp_ssp_capable(hdev)) {
 483                 events[6] |= 0x01;      /* IO Capability Request */
 484                 events[6] |= 0x02;      /* IO Capability Response */
 485                 events[6] |= 0x04;      /* User Confirmation Request */
 486                 events[6] |= 0x08;      /* User Passkey Request */
 487                 events[6] |= 0x10;      /* Remote OOB Data Request */
 488                 events[6] |= 0x20;      /* Simple Pairing Complete */
 489                 events[7] |= 0x04;      /* User Passkey Notification */
 490                 events[7] |= 0x08;      /* Keypress Notification */
 491                 events[7] |= 0x10;      /* Remote Host Supported
 492                                          * Features Notification
 493                                          */
 494         }
 495
 496         if (lmp_le_capable(hdev))
 497                 events[7] |= 0x20;      /* LE Meta-Event */
 498
 499         hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 500
 501         if (lmp_le_capable(hdev)) {
 502                 memset(events, 0, sizeof(events));
 503                 events[0] = 0x1f;
 504                 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK,
 505                             sizeof(events), events);
 506         }
 507 }
 508
 509 static void hci_init2_req(struct hci_request *req, unsigned long opt)
 510 {
 511         struct hci_dev *hdev = req->hdev;
 512
 513         if (lmp_bredr_capable(hdev))
 514                 bredr_setup(req);
 515
 516         if (lmp_le_capable(hdev))
 517                 le_setup(req);
 518
 519         hci_setup_event_mask(req);
 520
 521         if (hdev->hci_ver > BLUETOOTH_VER_1_1)
 522                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 523
 524         if (lmp_ssp_capable(hdev)) {
 525                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
 526                         u8 mode = 0x01;
 527                         hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
 528                                     sizeof(mode), &mode);
 529                 } else {
 530                         struct hci_cp_write_eir cp;
 531
 532                         memset(hdev->eir, 0, sizeof(hdev->eir));
 533                         memset(&cp, 0, sizeof(cp));
 534
 535                         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 536                 }
 537         }
 538
 539         if (lmp_inq_rssi_capable(hdev))
 540                 hci_setup_inquiry_mode(req);
 541
 542         if (lmp_inq_tx_pwr_capable(hdev))
 543                 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 544
 545         if (lmp_ext_feat_capable(hdev)) {
 546                 struct hci_cp_read_local_ext_features cp;
 547
 548                 cp.page = 0x01;
 549                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
 550                             sizeof(cp), &cp);
 551         }
 552
 553         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
 554                 u8 enable = 1;
 555                 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
 556                             &enable);
 557         }
 558 }
 559
 560 static void hci_setup_link_policy(struct hci_request *req)
 561 {
 562         struct hci_dev *hdev = req->hdev;
 563         struct hci_cp_write_def_link_policy cp;
 564         u16 link_policy = 0;
 565
 566         if (lmp_rswitch_capable(hdev))
 567                 link_policy |= HCI_LP_RSWITCH;
 568         if (lmp_hold_capable(hdev))
 569                 link_policy |= HCI_LP_HOLD;
 570         if (lmp_sniff_capable(hdev))
 571                 link_policy |= HCI_LP_SNIFF;
 572         if (lmp_park_capable(hdev))
 573                 link_policy |= HCI_LP_PARK;
 574
 575         cp.policy = cpu_to_le16(link_policy);
 576         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 577 }
 578
 579 static void hci_set_le_support(struct hci_request *req)
 580 {
 581         struct hci_dev *hdev = req->hdev;
 582         struct hci_cp_write_le_host_supported cp;
 583
 584         /* LE-only devices do not support explicit enablement */
 585         if (!lmp_bredr_capable(hdev))
 586                 return;
 587
 588         memset(&cp, 0, sizeof(cp));
 589
 590         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
 591                 cp.le = 0x01;
 592                 cp.simul = lmp_le_br_capable(hdev);
 593         }
 594
 595         if (cp.le != lmp_host_le_capable(hdev))
 596                 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
 597                             &cp);
 598 }
 599
 600 static void hci_init3_req(struct hci_request *req, unsigned long opt)
 601 {
 602         struct hci_dev *hdev = req->hdev;
 603         u8 p;
 604
 605         if (hdev->commands[5] & 0x10)
 606                 hci_setup_link_policy(req);
 607
 608         if (lmp_le_capable(hdev)) {
 609                 hci_set_le_support(req);
 610                 hci_update_ad(req);
 611         }
 612
 613         /* Read features beyond page 1 if available */
 614         for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
 615                 struct hci_cp_read_local_ext_features cp;
 616
 617                 cp.page = p;
 618                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
 619                             sizeof(cp), &cp);
 620         }
 621 }
 622
 623 static int __hci_init(struct hci_dev *hdev)
 624 {
 625         int err;
 626
 627         err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
 628         if (err < 0)
 629                 return err;
 630
 631         /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
 632          * BR/EDR/LE type controllers. AMP controllers only need the
 633          * first stage init.
 634          */
 635         if (hdev->dev_type != HCI_BREDR)
 636                 return 0;
 637
 638         err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
 639         if (err < 0)
 640                 return err;
 641
 642         return __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
 643 }
 644
 645 static void hci_scan_req(struct hci_request *req, unsigned long opt)
 646 {
 647         __u8 scan = opt;
 648
 649         BT_DBG("%s %x", req->hdev->name, scan);
 650
 651         /* Inquiry and Page scans */
 652         hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 653 }
 654
 655 static void hci_auth_req(struct hci_request *req, unsigned long opt)
 656 {
 657         __u8 auth = opt;
 658
 659         BT_DBG("%s %x", req->hdev->name, auth);
 660
 661         /* Authentication */
 662         hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 663 }
 664
 665 static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
 666 {
 667         __u8 encrypt = opt;
 668
 669         BT_DBG("%s %x", req->hdev->name, encrypt);
 670
 671         /* Encryption */
 672         hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 673 }
 674
 675 static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
 676 {
 677         __le16 policy = cpu_to_le16(opt);
 678
 679         BT_DBG("%s %x", req->hdev->name, policy);
 680
 681         /* Default link policy */
 682         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 683 }
 684
 685 /* Get HCI device by index.
 686  * Device is held on return. */
 687 struct hci_dev *hci_dev_get(int index)
 688 {
 689         struct hci_dev *hdev = NULL, *d;
 690
 691         BT_DBG("%d", index);
 692
 693         if (index < 0)
 694                 return NULL;
 695
 696         read_lock(&hci_dev_list_lock);
 697         list_for_each_entry(d, &hci_dev_list, list) {
 698                 if (d->id == index) {
 699                         hdev = hci_dev_hold(d);
 700                         break;
 701                 }
 702         }
 703         read_unlock(&hci_dev_list_lock);
 704         return hdev;
 705 }
 706
 707 /* ---- Inquiry support ---- */
 708
 709 bool hci_discovery_active(struct hci_dev *hdev)
 710 {
 711         struct discovery_state *discov = &hdev->discovery;
 712
 713         switch (discov->state) {
 714         case DISCOVERY_FINDING:
 715         case DISCOVERY_RESOLVING:
 716                 return true;
 717
 718         default:
 719                 return false;
 720         }
 721 }
 722
 723 void hci_discovery_set_state(struct hci_dev *hdev, int state)
 724 {
 725         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
 726
 727         if (hdev->discovery.state == state)
 728                 return;
 729
 730         switch (state) {
 731         case DISCOVERY_STOPPED:
 732                 if (hdev->discovery.state != DISCOVERY_STARTING)
 733                         mgmt_discovering(hdev, 0);
 734                 break;
 735         case DISCOVERY_STARTING:
 736                 break;
 737         case DISCOVERY_FINDING:
 738                 mgmt_discovering(hdev, 1);
 739                 break;
 740         case DISCOVERY_RESOLVING:
 741                 break;
 742         case DISCOVERY_STOPPING:
 743                 break;
 744         }
 745
 746         hdev->discovery.state = state;
 747 }
 748
 749 static void inquiry_cache_flush(struct hci_dev *hdev)
 750 {
 751         struct discovery_state *cache = &hdev->discovery;
 752         struct inquiry_entry *p, *n;
 753
 754         list_for_each_entry_safe(p, n, &cache->all, all) {
 755                 list_del(&p->all);
 756                 kfree(p);
 757         }
 758
 759         INIT_LIST_HEAD(&cache->unknown);
 760         INIT_LIST_HEAD(&cache->resolve);
 761 }
 762
 763 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
 764                                                bdaddr_t *bdaddr)
 765 {
 766         struct discovery_state *cache = &hdev->discovery;
 767         struct inquiry_entry *e;
 768
 769         BT_DBG("cache %p, %pMR", cache, bdaddr);
 770
 771         list_for_each_entry(e, &cache->all, all) {
 772                 if (!bacmp(&e->data.bdaddr, bdaddr))
 773                         return e;
 774         }
 775
 776         return NULL;
 777 }
 778
 779 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
 780                                                        bdaddr_t *bdaddr)
 781 {
 782         struct discovery_state *cache = &hdev->discovery;
 783         struct inquiry_entry *e;
 784
 785         BT_DBG("cache %p, %pMR", cache, bdaddr);
 786
 787         list_for_each_entry(e, &cache->unknown, list) {
 788                 if (!bacmp(&e->data.bdaddr, bdaddr))
 789                         return e;
 790         }
 791
 792         return NULL;
 793 }
 794
 795 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
 796                                                        bdaddr_t *bdaddr,
 797                                                        int state)
 798 {
 799         struct discovery_state *cache = &hdev->discovery;
 800         struct inquiry_entry *e;
 801
 802         BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
 803
 804         list_for_each_entry(e, &cache->resolve, list) {
 805                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
 806                         return e;
 807                 if (!bacmp(&e->data.bdaddr, bdaddr))
 808                         return e;
 809         }
 810
 811         return NULL;
 812 }
 813
 814 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
 815                                       struct inquiry_entry *ie)
 816 {
 817         struct discovery_state *cache = &hdev->discovery;
 818         struct list_head *pos = &cache->resolve;
 819         struct inquiry_entry *p;
 820
 821         list_del(&ie->list);
 822
 823         list_for_each_entry(p, &cache->resolve, list) {
 824                 if (p->name_state != NAME_PENDING &&
 825                     abs(p->data.rssi) >= abs(ie->data.rssi))
 826                         break;
 827                 pos = &p->list;
 828         }
 829
 830         list_add(&ie->list, pos);
 831 }
 832
 833 bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
 834                               bool name_known, bool *ssp)
 835 {
 836         struct discovery_state *cache = &hdev->discovery;
 837         struct inquiry_entry *ie;
 838
 839         BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
 840
 841         hci_remove_remote_oob_data(hdev, &data->bdaddr);
 842
 843         if (ssp)
 844                 *ssp = data->ssp_mode;
 845
 846         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
 847         if (ie) {
 848                 if (ie->data.ssp_mode && ssp)
 849                         *ssp = true;
 850
 851                 if (ie->name_state == NAME_NEEDED &&
 852                     data->rssi != ie->data.rssi) {
 853                         ie->data.rssi = data->rssi;
 854                         hci_inquiry_cache_update_resolve(hdev, ie);
 855                 }
 856
 857                 goto update;
 858         }
 859
 860         /* Entry not in the cache. Add new one. */
 861         ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
 862         if (!ie)
 863                 return false;
 864
 865         list_add(&ie->all, &cache->all);
 866
 867         if (name_known) {
 868                 ie->name_state = NAME_KNOWN;
 869         } else {
 870                 ie->name_state = NAME_NOT_KNOWN;
 871                 list_add(&ie->list, &cache->unknown);
 872         }
 873
 874 update:
 875         if (name_known && ie->name_state != NAME_KNOWN &&
 876             ie->name_state != NAME_PENDING) {
 877                 ie->name_state = NAME_KNOWN;
 878                 list_del(&ie->list);
 879         }
 880
 881         memcpy(&ie->data, data, sizeof(*data));
 882         ie->timestamp = jiffies;
 883         cache->timestamp = jiffies;
 884
 885         if (ie->name_state == NAME_NOT_KNOWN)
 886                 return false;
 887
 888         return true;
 889 }
 890
 891 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 892 {
 893         struct discovery_state *cache = &hdev->discovery;
 894         struct inquiry_info *info = (struct inquiry_info *) buf;
 895         struct inquiry_entry *e;
 896         int copied = 0;
 897
 898         list_for_each_entry(e, &cache->all, all) {
 899                 struct inquiry_data *data = &e->data;
 900
 901                 if (copied >= num)
 902                         break;
 903
 904                 bacpy(&info->bdaddr, &data->bdaddr);
 905                 info->pscan_rep_mode    = data->pscan_rep_mode;
 906                 info->pscan_period_mode = data->pscan_period_mode;
 907                 info->pscan_mode        = data->pscan_mode;
 908                 memcpy(info->dev_class, data->dev_class, 3);
 909                 info->clock_offset      = data->clock_offset;
 910
 911                 info++;
 912                 copied++;
 913         }
 914
 915         BT_DBG("cache %p, copied %d", cache, copied);
 916         return copied;
 917 }
 918
 919 static void hci_inq_req(struct hci_request *req, unsigned long opt)
 920 {
 921         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
 922         struct hci_dev *hdev = req->hdev;
 923         struct hci_cp_inquiry cp;
 924
 925         BT_DBG("%s", hdev->name);
 926
 927         if (test_bit(HCI_INQUIRY, &hdev->flags))
 928                 return;
 929
 930         /* Start Inquiry */
 931         memcpy(&cp.lap, &ir->lap, 3);
 932         cp.length  = ir->length;
 933         cp.num_rsp = ir->num_rsp;
 934         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
 935 }
 936
 937 static int wait_inquiry(void *word)
 938 {
 939         schedule();
 940         return signal_pending(current);
 941 }
 942
 943 int hci_inquiry(void __user *arg)
 944 {
 945         __u8 __user *ptr = arg;
 946         struct hci_inquiry_req ir;
 947         struct hci_dev *hdev;
 948         int err = 0, do_inquiry = 0, max_rsp;
 949         long timeo;
 950         __u8 *buf;
 951
 952         if (copy_from_user(&ir, ptr, sizeof(ir)))
 953                 return -EFAULT;
 954
 955         hdev = hci_dev_get(ir.dev_id);
 956         if (!hdev)
 957                 return -ENODEV;
 958
 959         hci_dev_lock(hdev);
 960         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 961             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
 962                 inquiry_cache_flush(hdev);
 963                 do_inquiry = 1;
 964         }
 965         hci_dev_unlock(hdev);
 966
 967         timeo = ir.length * msecs_to_jiffies(2000);
 968
 969         if (do_inquiry) {
 970                 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
 971                                    timeo);
 972                 if (err < 0)
 973                         goto done;
 974
 975                 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
 976                  * cleared). If it is interrupted by a signal, return -EINTR.
 977                  */
 978                 if (wait_on_bit(&hdev->flags, HCI_INQUIRY, wait_inquiry,
 979                                 TASK_INTERRUPTIBLE))
 980                         return -EINTR;
 981         }
 982
 983         /* for unlimited number of responses we will use buffer with
 984          * 255 entries
 985          */
 986         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 987
 988         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
 989          * copy it to the user space.
 990          */
 991         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
 992         if (!buf) {
 993                 err = -ENOMEM;
 994                 goto done;
 995         }
 996
 997         hci_dev_lock(hdev);
 998         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
 999         hci_dev_unlock(hdev);
1000
1001         BT_DBG("num_rsp %d", ir.num_rsp);
1002
1003         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1004                 ptr += sizeof(ir);
1005                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1006                                  ir.num_rsp))
1007                         err = -EFAULT;
1008         } else
1009                 err = -EFAULT;
1010
1011         kfree(buf);
1012
1013 done:
1014         hci_dev_put(hdev);
1015         return err;
1016 }
1017
1018 static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
1019 {
1020         u8 ad_len = 0, flags = 0;
1021         size_t name_len;
1022
1023         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
1024                 flags |= LE_AD_GENERAL;
1025
1026         if (!lmp_bredr_capable(hdev))
1027                 flags |= LE_AD_NO_BREDR;
1028
1029         if (lmp_le_br_capable(hdev))
1030                 flags |= LE_AD_SIM_LE_BREDR_CTRL;
1031
1032         if (lmp_host_le_br_capable(hdev))
1033                 flags |= LE_AD_SIM_LE_BREDR_HOST;
1034
1035         if (flags) {
1036                 BT_DBG("adv flags 0x%02x", flags);
1037
1038                 ptr[0] = 2;
1039                 ptr[1] = EIR_FLAGS;
1040                 ptr[2] = flags;
1041
1042                 ad_len += 3;
1043                 ptr += 3;
1044         }
1045
1046         if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
1047                 ptr[0] = 2;
1048                 ptr[1] = EIR_TX_POWER;
1049                 ptr[2] = (u8) hdev->adv_tx_power;
1050
1051                 ad_len += 3;
1052                 ptr += 3;
1053         }
1054
1055         name_len = strlen(hdev->dev_name);
1056         if (name_len > 0) {
1057                 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
1058
1059                 if (name_len > max_len) {
1060                         name_len = max_len;
1061                         ptr[1] = EIR_NAME_SHORT;
1062                 } else
1063                         ptr[1] = EIR_NAME_COMPLETE;
1064
1065                 ptr[0] = name_len + 1;
1066
1067                 memcpy(ptr + 2, hdev->dev_name, name_len);
1068
1069                 ad_len += (name_len + 2);
1070                 ptr += (name_len + 2);
1071         }
1072
1073         return ad_len;
1074 }
1075
1076 void hci_update_ad(struct hci_request *req)
1077 {
1078         struct hci_dev *hdev = req->hdev;
1079         struct hci_cp_le_set_adv_data cp;
1080         u8 len;
1081
1082         if (!lmp_le_capable(hdev))
1083                 return;
1084
1085         memset(&cp, 0, sizeof(cp));
1086
1087         len = create_ad(hdev, cp.data);
1088
1089         if (hdev->adv_data_len == len &&
1090             memcmp(cp.data, hdev->adv_data, len) == 0)
1091                 return;
1092
1093         memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1094         hdev->adv_data_len = len;
1095
1096         cp.length = len;
1097
1098         hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1099 }
1100
1101 /* ---- HCI ioctl helpers ---- */
1102
1103 int hci_dev_open(__u16 dev)
1104 {
1105         struct hci_dev *hdev;
1106         int ret = 0;
1107
1108         hdev = hci_dev_get(dev);
1109         if (!hdev)
1110                 return -ENODEV;
1111
1112         BT_DBG("%s %p", hdev->name, hdev);
1113
1114         hci_req_lock(hdev);
1115
1116         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
1117                 ret = -ENODEV;
1118                 goto done;
1119         }
1120
1121         if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
1122                 ret = -ERFKILL;
1123                 goto done;
1124         }
1125
1126         if (test_bit(HCI_UP, &hdev->flags)) {
1127                 ret = -EALREADY;
1128                 goto done;
1129         }
1130
1131         if (hdev->open(hdev)) {
1132                 ret = -EIO;
1133                 goto done;
1134         }
1135
1136         atomic_set(&hdev->cmd_cnt, 1);
1137         set_bit(HCI_INIT, &hdev->flags);
1138
1139         if (hdev->setup && test_bit(HCI_SETUP, &hdev->dev_flags))
1140                 ret = hdev->setup(hdev);
1141
1142         if (!ret) {
1143                 /* Treat all non BR/EDR controllers as raw devices if
1144                  * enable_hs is not set.
1145                  */
1146                 if (hdev->dev_type != HCI_BREDR && !enable_hs)
1147                         set_bit(HCI_RAW, &hdev->flags);
1148
1149                 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
1150                         set_bit(HCI_RAW, &hdev->flags);
1151
1152                 if (!test_bit(HCI_RAW, &hdev->flags))
1153                         ret = __hci_init(hdev);
1154         }
1155
1156         clear_bit(HCI_INIT, &hdev->flags);
1157
1158         if (!ret) {
1159                 hci_dev_hold(hdev);
1160                 set_bit(HCI_UP, &hdev->flags);
1161                 hci_notify(hdev, HCI_DEV_UP);
1162                 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
1163                     mgmt_valid_hdev(hdev)) {
1164                         hci_dev_lock(hdev);
1165                         mgmt_powered(hdev, 1);
1166                         hci_dev_unlock(hdev);
1167                 }
1168         } else {
1169                 /* Init failed, cleanup */
1170                 flush_work(&hdev->tx_work);
1171                 flush_work(&hdev->cmd_work);
1172                 flush_work(&hdev->rx_work);
1173
1174                 skb_queue_purge(&hdev->cmd_q);
1175                 skb_queue_purge(&hdev->rx_q);
1176
1177                 if (hdev->flush)
1178                         hdev->flush(hdev);
1179
1180                 if (hdev->sent_cmd) {
1181                         kfree_skb(hdev->sent_cmd);
1182                         hdev->sent_cmd = NULL;
1183                 }
1184
1185                 hdev->close(hdev);
1186                 hdev->flags = 0;
1187         }
1188
1189 done:
1190         hci_req_unlock(hdev);
1191         hci_dev_put(hdev);
1192         return ret;
1193 }
1194
1195 static int hci_dev_do_close(struct hci_dev *hdev)
1196 {
1197         BT_DBG("%s %p", hdev->name, hdev);
1198
1199         cancel_work_sync(&hdev->le_scan);
1200
1201         cancel_delayed_work(&hdev->power_off);
1202
1203         hci_req_cancel(hdev, ENODEV);
1204         hci_req_lock(hdev);
1205
1206         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1207                 del_timer_sync(&hdev->cmd_timer);
1208                 hci_req_unlock(hdev);
1209                 return 0;
1210         }
1211
1212         /* Flush RX and TX works */
1213         flush_work(&hdev->tx_work);
1214         flush_work(&hdev->rx_work);
1215
1216         if (hdev->discov_timeout > 0) {
1217                 cancel_delayed_work(&hdev->discov_off);
1218                 hdev->discov_timeout = 0;
1219                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1220         }
1221
1222         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1223                 cancel_delayed_work(&hdev->service_cache);
1224
1225         cancel_delayed_work_sync(&hdev->le_scan_disable);
1226
1227         hci_dev_lock(hdev);
1228         inquiry_cache_flush(hdev);
1229         hci_conn_hash_flush(hdev);
1230         hci_dev_unlock(hdev);
1231
1232         hci_notify(hdev, HCI_DEV_DOWN);
1233
1234         if (hdev->flush)
1235                 hdev->flush(hdev);
1236
1237         /* Reset device */
1238         skb_queue_purge(&hdev->cmd_q);
1239         atomic_set(&hdev->cmd_cnt, 1);
1240         if (!test_bit(HCI_RAW, &hdev->flags) &&
1241             test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1242                 set_bit(HCI_INIT, &hdev->flags);
1243                 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1244                 clear_bit(HCI_INIT, &hdev->flags);
1245         }
1246
1247         /* flush cmd  work */
1248         flush_work(&hdev->cmd_work);
1249
1250         /* Drop queues */
1251         skb_queue_purge(&hdev->rx_q);
1252         skb_queue_purge(&hdev->cmd_q);
1253         skb_queue_purge(&hdev->raw_q);
1254
1255         /* Drop last sent command */
1256         if (hdev->sent_cmd) {
1257                 del_timer_sync(&hdev->cmd_timer);
1258                 kfree_skb(hdev->sent_cmd);
1259                 hdev->sent_cmd = NULL;
1260         }
1261
1262         kfree_skb(hdev->recv_evt);
1263         hdev->recv_evt = NULL;
1264
1265         /* After this point our queues are empty
1266          * and no tasks are scheduled. */
1267         hdev->close(hdev);
1268
1269         /* Clear flags */
1270         hdev->flags = 0;
1271         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
1272
1273         if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
1274             mgmt_valid_hdev(hdev)) {
1275                 hci_dev_lock(hdev);
1276                 mgmt_powered(hdev, 0);
1277                 hci_dev_unlock(hdev);
1278         }
1279
1280         /* Controller radio is available but is currently powered down */
1281         hdev->amp_status = 0;
1282
1283         memset(hdev->eir, 0, sizeof(hdev->eir));
1284         memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1285
1286         hci_req_unlock(hdev);
1287
1288         hci_dev_put(hdev);
1289         return 0;
1290 }
1291
1292 int hci_dev_close(__u16 dev)
1293 {
1294         struct hci_dev *hdev;
1295         int err;
1296
1297         hdev = hci_dev_get(dev);
1298         if (!hdev)
1299                 return -ENODEV;
1300
1301         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1302                 cancel_delayed_work(&hdev->power_off);
1303
1304         err = hci_dev_do_close(hdev);
1305
1306         hci_dev_put(hdev);
1307         return err;
1308 }
1309
1310 int hci_dev_reset(__u16 dev)
1311 {
1312         struct hci_dev *hdev;
1313         int ret = 0;
1314
1315         hdev = hci_dev_get(dev);
1316         if (!hdev)
1317                 return -ENODEV;
1318
1319         hci_req_lock(hdev);
1320
1321         if (!test_bit(HCI_UP, &hdev->flags))
1322                 goto done;
1323
1324         /* Drop queues */
1325         skb_queue_purge(&hdev->rx_q);
1326         skb_queue_purge(&hdev->cmd_q);
1327
1328         hci_dev_lock(hdev);
1329         inquiry_cache_flush(hdev);
1330         hci_conn_hash_flush(hdev);
1331         hci_dev_unlock(hdev);
1332
1333         if (hdev->flush)
1334                 hdev->flush(hdev);
1335
1336         atomic_set(&hdev->cmd_cnt, 1);
1337         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1338
1339         if (!test_bit(HCI_RAW, &hdev->flags))
1340                 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1341
1342 done:
1343         hci_req_unlock(hdev);
1344         hci_dev_put(hdev);
1345         return ret;
1346 }
1347
1348 int hci_dev_reset_stat(__u16 dev)
1349 {
1350         struct hci_dev *hdev;
1351         int ret = 0;
1352
1353         hdev = hci_dev_get(dev);
1354         if (!hdev)
1355                 return -ENODEV;
1356
1357         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1358
1359         hci_dev_put(hdev);
1360
1361         return ret;
1362 }
1363
1364 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1365 {
1366         struct hci_dev *hdev;
1367         struct hci_dev_req dr;
1368         int err = 0;
1369
1370         if (copy_from_user(&dr, arg, sizeof(dr)))
1371                 return -EFAULT;
1372
1373         hdev = hci_dev_get(dr.dev_id);
1374         if (!hdev)
1375                 return -ENODEV;
1376
1377         switch (cmd) {
1378         case HCISETAUTH:
1379                 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1380                                    HCI_INIT_TIMEOUT);
1381                 break;
1382
1383         case HCISETENCRYPT:
1384                 if (!lmp_encrypt_capable(hdev)) {
1385                         err = -EOPNOTSUPP;
1386                         break;
1387                 }
1388
1389                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1390                         /* Auth must be enabled first */
1391                         err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1392                                            HCI_INIT_TIMEOUT);
1393                         if (err)
1394                                 break;
1395                 }
1396
1397                 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1398                                    HCI_INIT_TIMEOUT);
1399                 break;
1400
1401         case HCISETSCAN:
1402                 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1403                                    HCI_INIT_TIMEOUT);
1404                 break;
1405
1406         case HCISETLINKPOL:
1407                 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1408                                    HCI_INIT_TIMEOUT);
1409                 break;
1410
1411         case HCISETLINKMODE:
1412                 hdev->link_mode = ((__u16) dr.dev_opt) &
1413                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
1414                 break;
1415
1416         case HCISETPTYPE:
1417                 hdev->pkt_type = (__u16) dr.dev_opt;
1418                 break;
1419
1420         case HCISETACLMTU:
1421                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
1422                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1423                 break;
1424
1425         case HCISETSCOMTU:
1426                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
1427                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1428                 break;
1429
1430         default:
1431                 err = -EINVAL;
1432                 break;
1433         }
1434
1435         hci_dev_put(hdev);
1436         return err;
1437 }
1438
1439 int hci_get_dev_list(void __user *arg)
1440 {
1441         struct hci_dev *hdev;
1442         struct hci_dev_list_req *dl;
1443         struct hci_dev_req *dr;
1444         int n = 0, size, err;
1445         __u16 dev_num;
1446
1447         if (get_user(dev_num, (__u16 __user *) arg))
1448                 return -EFAULT;
1449
1450         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1451                 return -EINVAL;
1452
1453         size = sizeof(*dl) + dev_num * sizeof(*dr);
1454
1455         dl = kzalloc(size, GFP_KERNEL);
1456         if (!dl)
1457                 return -ENOMEM;
1458
1459         dr = dl->dev_req;
1460
1461         read_lock(&hci_dev_list_lock);
1462         list_for_each_entry(hdev, &hci_dev_list, list) {
1463                 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1464                         cancel_delayed_work(&hdev->power_off);
1465
1466                 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1467                         set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1468
1469                 (dr + n)->dev_id  = hdev->id;
1470                 (dr + n)->dev_opt = hdev->flags;
1471
1472                 if (++n >= dev_num)
1473                         break;
1474         }
1475         read_unlock(&hci_dev_list_lock);
1476
1477         dl->dev_num = n;
1478         size = sizeof(*dl) + n * sizeof(*dr);
1479
1480         err = copy_to_user(arg, dl, size);
1481         kfree(dl);
1482
1483         return err ? -EFAULT : 0;
1484 }
1485
1486 int hci_get_dev_info(void __user *arg)
1487 {
1488         struct hci_dev *hdev;
1489         struct hci_dev_info di;
1490         int err = 0;
1491
1492         if (copy_from_user(&di, arg, sizeof(di)))
1493                 return -EFAULT;
1494
1495         hdev = hci_dev_get(di.dev_id);
1496         if (!hdev)
1497                 return -ENODEV;
1498
1499         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1500                 cancel_delayed_work_sync(&hdev->power_off);
1501
1502         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1503                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1504
1505         strcpy(di.name, hdev->name);
1506         di.bdaddr   = hdev->bdaddr;
1507         di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1508         di.flags    = hdev->flags;
1509         di.pkt_type = hdev->pkt_type;
1510         if (lmp_bredr_capable(hdev)) {
1511                 di.acl_mtu  = hdev->acl_mtu;
1512                 di.acl_pkts = hdev->acl_pkts;
1513                 di.sco_mtu  = hdev->sco_mtu;
1514                 di.sco_pkts = hdev->sco_pkts;
1515         } else {
1516                 di.acl_mtu  = hdev->le_mtu;
1517                 di.acl_pkts = hdev->le_pkts;
1518                 di.sco_mtu  = 0;
1519                 di.sco_pkts = 0;
1520         }
1521         di.link_policy = hdev->link_policy;
1522         di.link_mode   = hdev->link_mode;
1523
1524         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1525         memcpy(&di.features, &hdev->features, sizeof(di.features));
1526
1527         if (copy_to_user(arg, &di, sizeof(di)))
1528                 err = -EFAULT;
1529
1530         hci_dev_put(hdev);
1531
1532         return err;
1533 }
1534
1535 /* ---- Interface to HCI drivers ---- */
1536
1537 static int hci_rfkill_set_block(void *data, bool blocked)
1538 {
1539         struct hci_dev *hdev = data;
1540
1541         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1542
1543         if (!blocked)
1544                 return 0;
1545
1546         hci_dev_do_close(hdev);
1547
1548         return 0;
1549 }
1550
1551 static const struct rfkill_ops hci_rfkill_ops = {
1552         .set_block = hci_rfkill_set_block,
1553 };
1554
1555 static void hci_power_on(struct work_struct *work)
1556 {
1557         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1558         int err;
1559
1560         BT_DBG("%s", hdev->name);
1561
1562         err = hci_dev_open(hdev->id);
1563         if (err < 0) {
1564                 mgmt_set_powered_failed(hdev, err);
1565                 return;
1566         }
1567
1568         if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1569                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1570                                    HCI_AUTO_OFF_TIMEOUT);
1571
1572         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
1573                 mgmt_index_added(hdev);
1574 }
1575
1576 static void hci_power_off(struct work_struct *work)
1577 {
1578         struct hci_dev *hdev = container_of(work, struct hci_dev,
1579                                             power_off.work);
1580
1581         BT_DBG("%s", hdev->name);
1582
1583         hci_dev_do_close(hdev);
1584 }
1585
1586 static void hci_discov_off(struct work_struct *work)
1587 {
1588         struct hci_dev *hdev;
1589         u8 scan = SCAN_PAGE;
1590
1591         hdev = container_of(work, struct hci_dev, discov_off.work);
1592
1593         BT_DBG("%s", hdev->name);
1594
1595         hci_dev_lock(hdev);
1596
1597         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1598
1599         hdev->discov_timeout = 0;
1600
1601         hci_dev_unlock(hdev);
1602 }
1603
1604 int hci_uuids_clear(struct hci_dev *hdev)
1605 {
1606         struct bt_uuid *uuid, *tmp;
1607
1608         list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1609                 list_del(&uuid->list);
1610                 kfree(uuid);
1611         }
1612
1613         return 0;
1614 }
1615
1616 int hci_link_keys_clear(struct hci_dev *hdev)
1617 {
1618         struct list_head *p, *n;
1619
1620         list_for_each_safe(p, n, &hdev->link_keys) {
1621                 struct link_key *key;
1622
1623                 key = list_entry(p, struct link_key, list);
1624
1625                 list_del(p);
1626                 kfree(key);
1627         }
1628
1629         return 0;
1630 }
1631
1632 int hci_smp_ltks_clear(struct hci_dev *hdev)
1633 {
1634         struct smp_ltk *k, *tmp;
1635
1636         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1637                 list_del(&k->list);
1638                 kfree(k);
1639         }
1640
1641         return 0;
1642 }
1643
1644 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1645 {
1646         struct link_key *k;
1647
1648         list_for_each_entry(k, &hdev->link_keys, list)
1649                 if (bacmp(bdaddr, &k->bdaddr) == 0)
1650                         return k;
1651
1652         return NULL;
1653 }
1654
1655 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1656                                u8 key_type, u8 old_key_type)
1657 {
1658         /* Legacy key */
1659         if (key_type < 0x03)
1660                 return true;
1661
1662         /* Debug keys are insecure so don't store them persistently */
1663         if (key_type == HCI_LK_DEBUG_COMBINATION)
1664                 return false;
1665
1666         /* Changed combination key and there's no previous one */
1667         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1668                 return false;
1669
1670         /* Security mode 3 case */
1671         if (!conn)
1672                 return true;
1673
1674         /* Neither local nor remote side had no-bonding as requirement */
1675         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1676                 return true;
1677
1678         /* Local side had dedicated bonding as requirement */
1679         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1680                 return true;
1681
1682         /* Remote side had dedicated bonding as requirement */
1683         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1684                 return true;
1685
1686         /* If none of the above criteria match, then don't store the key
1687          * persistently */
1688         return false;
1689 }
1690
1691 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1692 {
1693         struct smp_ltk *k;
1694
1695         list_for_each_entry(k, &hdev->long_term_keys, list) {
1696                 if (k->ediv != ediv ||
1697                     memcmp(rand, k->rand, sizeof(k->rand)))
1698                         continue;
1699
1700                 return k;
1701         }
1702
1703         return NULL;
1704 }
1705
1706 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1707                                      u8 addr_type)
1708 {
1709         struct smp_ltk *k;
1710
1711         list_for_each_entry(k, &hdev->long_term_keys, list)
1712                 if (addr_type == k->bdaddr_type &&
1713                     bacmp(bdaddr, &k->bdaddr) == 0)
1714                         return k;
1715
1716         return NULL;
1717 }
1718
1719 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1720                      bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1721 {
1722         struct link_key *key, *old_key;
1723         u8 old_key_type;
1724         bool persistent;
1725
1726         old_key = hci_find_link_key(hdev, bdaddr);
1727         if (old_key) {
1728                 old_key_type = old_key->type;
1729                 key = old_key;
1730         } else {
1731                 old_key_type = conn ? conn->key_type : 0xff;
1732                 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1733                 if (!key)
1734                         return -ENOMEM;
1735                 list_add(&key->list, &hdev->link_keys);
1736         }
1737
1738         BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
1739
1740         /* Some buggy controller combinations generate a changed
1741          * combination key for legacy pairing even when there's no
1742          * previous key */
1743         if (type == HCI_LK_CHANGED_COMBINATION &&
1744             (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
1745                 type = HCI_LK_COMBINATION;
1746                 if (conn)
1747                         conn->key_type = type;
1748         }
1749
1750         bacpy(&key->bdaddr, bdaddr);
1751         memcpy(key->val, val, HCI_LINK_KEY_SIZE);
1752         key->pin_len = pin_len;
1753
1754         if (type == HCI_LK_CHANGED_COMBINATION)
1755                 key->type = old_key_type;
1756         else
1757                 key->type = type;
1758
1759         if (!new_key)
1760                 return 0;
1761
1762         persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1763
1764         mgmt_new_link_key(hdev, key, persistent);
1765
1766         if (conn)
1767                 conn->flush_key = !persistent;
1768
1769         return 0;
1770 }
1771
1772 int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
1773                 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
1774                 ediv, u8 rand[8])
1775 {
1776         struct smp_ltk *key, *old_key;
1777
1778         if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1779                 return 0;
1780
1781         old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1782         if (old_key)
1783                 key = old_key;
1784         else {
1785                 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1786                 if (!key)
1787                         return -ENOMEM;
1788                 list_add(&key->list, &hdev->long_term_keys);
1789         }
1790
1791         bacpy(&key->bdaddr, bdaddr);
1792         key->bdaddr_type = addr_type;
1793         memcpy(key->val, tk, sizeof(key->val));
1794         key->authenticated = authenticated;
1795         key->ediv = ediv;
1796         key->enc_size = enc_size;
1797         key->type = type;
1798         memcpy(key->rand, rand, sizeof(key->rand));
1799
1800         if (!new_key)
1801                 return 0;
1802
1803         if (type & HCI_SMP_LTK)
1804                 mgmt_new_ltk(hdev, key, 1);
1805
1806         return 0;
1807 }
1808
1809 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1810 {
1811         struct link_key *key;
1812
1813         key = hci_find_link_key(hdev, bdaddr);
1814         if (!key)
1815                 return -ENOENT;
1816
1817         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1818
1819         list_del(&key->list);
1820         kfree(key);
1821
1822         return 0;
1823 }
1824
1825 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1826 {
1827         struct smp_ltk *k, *tmp;
1828
1829         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1830                 if (bacmp(bdaddr, &k->bdaddr))
1831                         continue;
1832
1833                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1834
1835                 list_del(&k->list);
1836                 kfree(k);
1837         }
1838
1839         return 0;
1840 }
1841
1842 /* HCI command timer function */
1843 static void hci_cmd_timeout(unsigned long arg)
1844 {
1845         struct hci_dev *hdev = (void *) arg;
1846
1847         if (hdev->sent_cmd) {
1848                 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1849                 u16 opcode = __le16_to_cpu(sent->opcode);
1850
1851                 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
1852         } else {
1853                 BT_ERR("%s command tx timeout", hdev->name);
1854         }
1855
1856         atomic_set(&hdev->cmd_cnt, 1);
1857         queue_work(hdev->workqueue, &hdev->cmd_work);
1858 }
1859
1860 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1861                                           bdaddr_t *bdaddr)
1862 {
1863         struct oob_data *data;
1864
1865         list_for_each_entry(data, &hdev->remote_oob_data, list)
1866                 if (bacmp(bdaddr, &data->bdaddr) == 0)
1867                         return data;
1868
1869         return NULL;
1870 }
1871
1872 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1873 {
1874         struct oob_data *data;
1875
1876         data = hci_find_remote_oob_data(hdev, bdaddr);
1877         if (!data)
1878                 return -ENOENT;
1879
1880         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1881
1882         list_del(&data->list);
1883         kfree(data);
1884
1885         return 0;
1886 }
1887
1888 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1889 {
1890         struct oob_data *data, *n;
1891
1892         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1893                 list_del(&data->list);
1894                 kfree(data);
1895         }
1896
1897         return 0;
1898 }
1899
1900 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1901                             u8 *randomizer)
1902 {
1903         struct oob_data *data;
1904
1905         data = hci_find_remote_oob_data(hdev, bdaddr);
1906
1907         if (!data) {
1908                 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1909                 if (!data)
1910                         return -ENOMEM;
1911
1912                 bacpy(&data->bdaddr, bdaddr);
1913                 list_add(&data->list, &hdev->remote_oob_data);
1914         }
1915
1916         memcpy(data->hash, hash, sizeof(data->hash));
1917         memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1918
1919         BT_DBG("%s for %pMR", hdev->name, bdaddr);
1920
1921         return 0;
1922 }
1923
1924 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
1925 {
1926         struct bdaddr_list *b;
1927
1928         list_for_each_entry(b, &hdev->blacklist, list)
1929                 if (bacmp(bdaddr, &b->bdaddr) == 0)
1930                         return b;
1931
1932         return NULL;
1933 }
1934
1935 int hci_blacklist_clear(struct hci_dev *hdev)
1936 {
1937         struct list_head *p, *n;
1938
1939         list_for_each_safe(p, n, &hdev->blacklist) {
1940                 struct bdaddr_list *b;
1941
1942                 b = list_entry(p, struct bdaddr_list, list);
1943
1944                 list_del(p);
1945                 kfree(b);
1946         }
1947
1948         return 0;
1949 }
1950
1951 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1952 {
1953         struct bdaddr_list *entry;
1954
1955         if (bacmp(bdaddr, BDADDR_ANY) == 0)
1956                 return -EBADF;
1957
1958         if (hci_blacklist_lookup(hdev, bdaddr))
1959                 return -EEXIST;
1960
1961         entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1962         if (!entry)
1963                 return -ENOMEM;
1964
1965         bacpy(&entry->bdaddr, bdaddr);
1966
1967         list_add(&entry->list, &hdev->blacklist);
1968
1969         return mgmt_device_blocked(hdev, bdaddr, type);
1970 }
1971
1972 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1973 {
1974         struct bdaddr_list *entry;
1975
1976         if (bacmp(bdaddr, BDADDR_ANY) == 0)
1977                 return hci_blacklist_clear(hdev);
1978
1979         entry = hci_blacklist_lookup(hdev, bdaddr);
1980         if (!entry)
1981                 return -ENOENT;
1982
1983         list_del(&entry->list);
1984         kfree(entry);
1985
1986         return mgmt_device_unblocked(hdev, bdaddr, type);
1987 }
1988
1989 static void le_scan_param_req(struct hci_request *req, unsigned long opt)
1990 {
1991         struct le_scan_params *param =  (struct le_scan_params *) opt;
1992         struct hci_cp_le_set_scan_param cp;
1993
1994         memset(&cp, 0, sizeof(cp));
1995         cp.type = param->type;
1996         cp.interval = cpu_to_le16(param->interval);
1997         cp.window = cpu_to_le16(param->window);
1998
1999         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
2000 }
2001
2002 static void le_scan_enable_req(struct hci_request *req, unsigned long opt)
2003 {
2004         struct hci_cp_le_set_scan_enable cp;
2005
2006         memset(&cp, 0, sizeof(cp));
2007         cp.enable = LE_SCAN_ENABLE;
2008         cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2009
2010         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2011 }
2012
2013 static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
2014                           u16 window, int timeout)
2015 {
2016         long timeo = msecs_to_jiffies(3000);
2017         struct le_scan_params param;
2018         int err;
2019
2020         BT_DBG("%s", hdev->name);
2021
2022         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
2023                 return -EINPROGRESS;
2024
2025         param.type = type;
2026         param.interval = interval;
2027         param.window = window;
2028
2029         hci_req_lock(hdev);
2030
2031         err = __hci_req_sync(hdev, le_scan_param_req, (unsigned long) &param,
2032                              timeo);
2033         if (!err)
2034                 err = __hci_req_sync(hdev, le_scan_enable_req, 0, timeo);
2035
2036         hci_req_unlock(hdev);
2037
2038         if (err < 0)
2039                 return err;
2040
2041         queue_delayed_work(hdev->workqueue, &hdev->le_scan_disable,
2042                            timeout);
2043
2044         return 0;
2045 }
2046
2047 int hci_cancel_le_scan(struct hci_dev *hdev)
2048 {
2049         BT_DBG("%s", hdev->name);
2050
2051         if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
2052                 return -EALREADY;
2053
2054         if (cancel_delayed_work(&hdev->le_scan_disable)) {
2055                 struct hci_cp_le_set_scan_enable cp;
2056
2057                 /* Send HCI command to disable LE Scan */
2058                 memset(&cp, 0, sizeof(cp));
2059                 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2060         }
2061
2062         return 0;
2063 }
2064
2065 static void le_scan_disable_work(struct work_struct *work)
2066 {
2067         struct hci_dev *hdev = container_of(work, struct hci_dev,
2068                                             le_scan_disable.work);
2069         struct hci_cp_le_set_scan_enable cp;
2070
2071         BT_DBG("%s", hdev->name);
2072
2073         memset(&cp, 0, sizeof(cp));
2074
2075         hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2076 }
2077
2078 static void le_scan_work(struct work_struct *work)
2079 {
2080         struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
2081         struct le_scan_params *param = &hdev->le_scan_params;
2082
2083         BT_DBG("%s", hdev->name);
2084
2085         hci_do_le_scan(hdev, param->type, param->interval, param->window,
2086                        param->timeout);
2087 }
2088
2089 int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
2090                 int timeout)
2091 {
2092         struct le_scan_params *param = &hdev->le_scan_params;
2093
2094         BT_DBG("%s", hdev->name);
2095
2096         if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
2097                 return -ENOTSUPP;
2098
2099         if (work_busy(&hdev->le_scan))
2100                 return -EINPROGRESS;
2101
2102         param->type = type;
2103         param->interval = interval;
2104         param->window = window;
2105         param->timeout = timeout;
2106
2107         queue_work(system_long_wq, &hdev->le_scan);
2108
2109         return 0;
2110 }
2111
2112 /* Alloc HCI device */
2113 struct hci_dev *hci_alloc_dev(void)
2114 {
2115         struct hci_dev *hdev;
2116
2117         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
2118         if (!hdev)
2119                 return NULL;
2120
2121         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2122         hdev->esco_type = (ESCO_HV1);
2123         hdev->link_mode = (HCI_LM_ACCEPT);
2124         hdev->io_capability = 0x03; /* No Input No Output */
2125         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2126         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
2127
2128         hdev->sniff_max_interval = 800;
2129         hdev->sniff_min_interval = 80;
2130
2131         mutex_init(&hdev->lock);
2132         mutex_init(&hdev->req_lock);
2133
2134         INIT_LIST_HEAD(&hdev->mgmt_pending);
2135         INIT_LIST_HEAD(&hdev->blacklist);
2136         INIT_LIST_HEAD(&hdev->uuids);
2137         INIT_LIST_HEAD(&hdev->link_keys);
2138         INIT_LIST_HEAD(&hdev->long_term_keys);
2139         INIT_LIST_HEAD(&hdev->remote_oob_data);
2140         INIT_LIST_HEAD(&hdev->conn_hash.list);
2141
2142         INIT_WORK(&hdev->rx_work, hci_rx_work);
2143         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2144         INIT_WORK(&hdev->tx_work, hci_tx_work);
2145         INIT_WORK(&hdev->power_on, hci_power_on);
2146         INIT_WORK(&hdev->le_scan, le_scan_work);
2147
2148         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
2149         INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
2150         INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2151
2152         skb_queue_head_init(&hdev->rx_q);
2153         skb_queue_head_init(&hdev->cmd_q);
2154         skb_queue_head_init(&hdev->raw_q);
2155
2156         init_waitqueue_head(&hdev->req_wait_q);
2157
2158         setup_timer(&hdev->cmd_timer, hci_cmd_timeout, (unsigned long) hdev);
2159
2160         hci_init_sysfs(hdev);
2161         discovery_init(hdev);
2162
2163         return hdev;
2164 }
2165 EXPORT_SYMBOL(hci_alloc_dev);
2166
2167 /* Free HCI device */
2168 void hci_free_dev(struct hci_dev *hdev)
2169 {
2170         /* will free via device release */
2171         put_device(&hdev->dev);
2172 }
2173 EXPORT_SYMBOL(hci_free_dev);
2174
2175 /* Register HCI device */
2176 int hci_register_dev(struct hci_dev *hdev)
2177 {
2178         int id, error;
2179
2180         if (!hdev->open || !hdev->close)
2181                 return -EINVAL;
2182
2183         /* Do not allow HCI_AMP devices to register at index 0,
2184          * so the index can be used as the AMP controller ID.
2185          */
2186         switch (hdev->dev_type) {
2187         case HCI_BREDR:
2188                 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
2189                 break;
2190         case HCI_AMP:
2191                 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
2192                 break;
2193         default:
2194                 return -EINVAL;
2195         }
2196
2197         if (id < 0)
2198                 return id;
2199
2200         sprintf(hdev->name, "hci%d", id);
2201         hdev->id = id;
2202
2203         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2204
2205         write_lock(&hci_dev_list_lock);
2206         list_add(&hdev->list, &hci_dev_list);
2207         write_unlock(&hci_dev_list_lock);
2208
2209         hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
2210                                           WQ_MEM_RECLAIM, 1);
2211         if (!hdev->workqueue) {
2212                 error = -ENOMEM;
2213                 goto err;
2214         }
2215
2216         hdev->req_workqueue = alloc_workqueue(hdev->name,
2217                                               WQ_HIGHPRI | WQ_UNBOUND |
2218                                               WQ_MEM_RECLAIM, 1);
2219         if (!hdev->req_workqueue) {
2220                 destroy_workqueue(hdev->workqueue);
2221                 error = -ENOMEM;
2222                 goto err;
2223         }
2224
2225         error = hci_add_sysfs(hdev);
2226         if (error < 0)
2227                 goto err_wqueue;
2228
2229         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
2230                                     RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2231                                     hdev);
2232         if (hdev->rfkill) {
2233                 if (rfkill_register(hdev->rfkill) < 0) {
2234                         rfkill_destroy(hdev->rfkill);
2235                         hdev->rfkill = NULL;
2236                 }
2237         }
2238
2239         set_bit(HCI_SETUP, &hdev->dev_flags);
2240
2241         if (hdev->dev_type != HCI_AMP)
2242                 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
2243
2244         hci_notify(hdev, HCI_DEV_REG);
2245         hci_dev_hold(hdev);
2246
2247         queue_work(hdev->req_workqueue, &hdev->power_on);
2248
2249         return id;
2250
2251 err_wqueue:
2252         destroy_workqueue(hdev->workqueue);
2253         destroy_workqueue(hdev->req_workqueue);
2254 err:
2255         ida_simple_remove(&hci_index_ida, hdev->id);
2256         write_lock(&hci_dev_list_lock);
2257         list_del(&hdev->list);
2258         write_unlock(&hci_dev_list_lock);
2259
2260         return error;
2261 }
2262 EXPORT_SYMBOL(hci_register_dev);
2263
2264 /* Unregister HCI device */
2265 void hci_unregister_dev(struct hci_dev *hdev)
2266 {
2267         int i, id;
2268
2269         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2270
2271         set_bit(HCI_UNREGISTER, &hdev->dev_flags);
2272
2273         id = hdev->id;
2274
2275         write_lock(&hci_dev_list_lock);
2276         list_del(&hdev->list);
2277         write_unlock(&hci_dev_list_lock);
2278
2279         hci_dev_do_close(hdev);
2280
2281         for (i = 0; i < NUM_REASSEMBLY; i++)
2282                 kfree_skb(hdev->reassembly[i]);
2283
2284         cancel_work_sync(&hdev->power_on);
2285
2286         if (!test_bit(HCI_INIT, &hdev->flags) &&
2287             !test_bit(HCI_SETUP, &hdev->dev_flags)) {
2288                 hci_dev_lock(hdev);
2289                 mgmt_index_removed(hdev);
2290                 hci_dev_unlock(hdev);
2291         }
2292
2293         /* mgmt_index_removed should take care of emptying the
2294          * pending list */
2295         BUG_ON(!list_empty(&hdev->mgmt_pending));
2296
2297         hci_notify(hdev, HCI_DEV_UNREG);
2298
2299         if (hdev->rfkill) {
2300                 rfkill_unregister(hdev->rfkill);
2301                 rfkill_destroy(hdev->rfkill);
2302         }
2303
2304         hci_del_sysfs(hdev);
2305
2306         destroy_workqueue(hdev->workqueue);
2307         destroy_workqueue(hdev->req_workqueue);
2308
2309         hci_dev_lock(hdev);
2310         hci_blacklist_clear(hdev);
2311         hci_uuids_clear(hdev);
2312         hci_link_keys_clear(hdev);
2313         hci_smp_ltks_clear(hdev);
2314         hci_remote_oob_data_clear(hdev);
2315         hci_dev_unlock(hdev);
2316
2317         hci_dev_put(hdev);
2318
2319         ida_simple_remove(&hci_index_ida, id);
2320 }
2321 EXPORT_SYMBOL(hci_unregister_dev);
2322
2323 /* Suspend HCI device */
2324 int hci_suspend_dev(struct hci_dev *hdev)
2325 {
2326         hci_notify(hdev, HCI_DEV_SUSPEND);
2327         return 0;
2328 }
2329 EXPORT_SYMBOL(hci_suspend_dev);
2330
2331 /* Resume HCI device */
2332 int hci_resume_dev(struct hci_dev *hdev)
2333 {
2334         hci_notify(hdev, HCI_DEV_RESUME);
2335         return 0;
2336 }
2337 EXPORT_SYMBOL(hci_resume_dev);
2338
2339 /* Receive frame from HCI drivers */
2340 int hci_recv_frame(struct sk_buff *skb)
2341 {
2342         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2343         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
2344                       && !test_bit(HCI_INIT, &hdev->flags))) {
2345                 kfree_skb(skb);
2346                 return -ENXIO;
2347         }
2348
2349         /* Incoming skb */
2350         bt_cb(skb)->incoming = 1;
2351
2352         /* Time stamp */
2353         __net_timestamp(skb);
2354
2355         skb_queue_tail(&hdev->rx_q, skb);
2356         queue_work(hdev->workqueue, &hdev->rx_work);
2357
2358         return 0;
2359 }
2360 EXPORT_SYMBOL(hci_recv_frame);
2361
2362 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
2363                           int count, __u8 index)
2364 {
2365         int len = 0;
2366         int hlen = 0;
2367         int remain = count;
2368         struct sk_buff *skb;
2369         struct bt_skb_cb *scb;
2370
2371         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
2372             index >= NUM_REASSEMBLY)
2373                 return -EILSEQ;
2374
2375         skb = hdev->reassembly[index];
2376
2377         if (!skb) {
2378                 switch (type) {
2379                 case HCI_ACLDATA_PKT:
2380                         len = HCI_MAX_FRAME_SIZE;
2381                         hlen = HCI_ACL_HDR_SIZE;
2382                         break;
2383                 case HCI_EVENT_PKT:
2384                         len = HCI_MAX_EVENT_SIZE;
2385                         hlen = HCI_EVENT_HDR_SIZE;
2386                         break;
2387                 case HCI_SCODATA_PKT:
2388                         len = HCI_MAX_SCO_SIZE;
2389                         hlen = HCI_SCO_HDR_SIZE;
2390                         break;
2391                 }
2392
2393                 skb = bt_skb_alloc(len, GFP_ATOMIC);
2394                 if (!skb)
2395                         return -ENOMEM;
2396
2397                 scb = (void *) skb->cb;
2398                 scb->expect = hlen;
2399                 scb->pkt_type = type;
2400
2401                 skb->dev = (void *) hdev;
2402                 hdev->reassembly[index] = skb;
2403         }
2404
2405         while (count) {
2406                 scb = (void *) skb->cb;
2407                 len = min_t(uint, scb->expect, count);
2408
2409                 memcpy(skb_put(skb, len), data, len);
2410
2411                 count -= len;
2412                 data += len;
2413                 scb->expect -= len;
2414                 remain = count;
2415
2416                 switch (type) {
2417                 case HCI_EVENT_PKT:
2418                         if (skb->len == HCI_EVENT_HDR_SIZE) {
2419                                 struct hci_event_hdr *h = hci_event_hdr(skb);
2420                                 scb->expect = h->plen;
2421
2422                                 if (skb_tailroom(skb) < scb->expect) {
2423                                         kfree_skb(skb);
2424                                         hdev->reassembly[index] = NULL;
2425                                         return -ENOMEM;
2426                                 }
2427                         }
2428                         break;
2429
2430                 case HCI_ACLDATA_PKT:
2431                         if (skb->len  == HCI_ACL_HDR_SIZE) {
2432                                 struct hci_acl_hdr *h = hci_acl_hdr(skb);
2433                                 scb->expect = __le16_to_cpu(h->dlen);
2434
2435                                 if (skb_tailroom(skb) < scb->expect) {
2436                                         kfree_skb(skb);
2437                                         hdev->reassembly[index] = NULL;
2438                                         return -ENOMEM;
2439                                 }
2440                         }
2441                         break;
2442
2443                 case HCI_SCODATA_PKT:
2444                         if (skb->len == HCI_SCO_HDR_SIZE) {
2445                                 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2446                                 scb->expect = h->dlen;
2447
2448                                 if (skb_tailroom(skb) < scb->expect) {
2449                                         kfree_skb(skb);
2450                                         hdev->reassembly[index] = NULL;
2451                                         return -ENOMEM;
2452                                 }
2453                         }
2454                         break;
2455                 }
2456
2457                 if (scb->expect == 0) {
2458                         /* Complete frame */
2459
2460                         bt_cb(skb)->pkt_type = type;
2461                         hci_recv_frame(skb);
2462
2463                         hdev->reassembly[index] = NULL;
2464                         return remain;
2465                 }
2466         }
2467
2468         return remain;
2469 }
2470
2471 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2472 {
2473         int rem = 0;
2474
2475         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2476                 return -EILSEQ;
2477
2478         while (count) {
2479                 rem = hci_reassembly(hdev, type, data, count, type - 1);
2480                 if (rem < 0)
2481                         return rem;
2482
2483                 data += (count - rem);
2484                 count = rem;
2485         }
2486
2487         return rem;
2488 }
2489 EXPORT_SYMBOL(hci_recv_fragment);
2490
2491 #define STREAM_REASSEMBLY 0
2492
2493 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2494 {
2495         int type;
2496         int rem = 0;
2497
2498         while (count) {
2499                 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2500
2501                 if (!skb) {
2502                         struct { char type; } *pkt;
2503
2504                         /* Start of the frame */
2505                         pkt = data;
2506                         type = pkt->type;
2507
2508                         data++;
2509                         count--;
2510                 } else
2511                         type = bt_cb(skb)->pkt_type;
2512
2513                 rem = hci_reassembly(hdev, type, data, count,
2514                                      STREAM_REASSEMBLY);
2515                 if (rem < 0)
2516                         return rem;
2517
2518                 data += (count - rem);
2519                 count = rem;
2520         }
2521
2522         return rem;
2523 }
2524 EXPORT_SYMBOL(hci_recv_stream_fragment);
2525
2526 /* ---- Interface to upper protocols ---- */
2527
2528 int hci_register_cb(struct hci_cb *cb)
2529 {
2530         BT_DBG("%p name %s", cb, cb->name);
2531
2532         write_lock(&hci_cb_list_lock);
2533         list_add(&cb->list, &hci_cb_list);
2534         write_unlock(&hci_cb_list_lock);
2535
2536         return 0;
2537 }
2538 EXPORT_SYMBOL(hci_register_cb);
2539
2540 int hci_unregister_cb(struct hci_cb *cb)
2541 {
2542         BT_DBG("%p name %s", cb, cb->name);
2543
2544         write_lock(&hci_cb_list_lock);
2545         list_del(&cb->list);
2546         write_unlock(&hci_cb_list_lock);
2547
2548         return 0;
2549 }
2550 EXPORT_SYMBOL(hci_unregister_cb);
2551
2552 static int hci_send_frame(struct sk_buff *skb)
2553 {
2554         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2555
2556         if (!hdev) {
2557                 kfree_skb(skb);
2558                 return -ENODEV;
2559         }
2560
2561         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
2562
2563         /* Time stamp */
2564         __net_timestamp(skb);
2565
2566         /* Send copy to monitor */
2567         hci_send_to_monitor(hdev, skb);
2568
2569         if (atomic_read(&hdev->promisc)) {
2570                 /* Send copy to the sockets */
2571                 hci_send_to_sock(hdev, skb);
2572         }
2573
2574         /* Get rid of skb owner, prior to sending to the driver. */
2575         skb_orphan(skb);
2576
2577         return hdev->send(skb);
2578 }
2579
2580 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
2581 {
2582         skb_queue_head_init(&req->cmd_q);
2583         req->hdev = hdev;
2584         req->err = 0;
2585 }
2586
2587 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
2588 {
2589         struct hci_dev *hdev = req->hdev;
2590         struct sk_buff *skb;
2591         unsigned long flags;
2592
2593         BT_DBG("length %u", skb_queue_len(&req->cmd_q));
2594
2595         /* If an error occured during request building, remove all HCI
2596          * commands queued on the HCI request queue.
2597          */
2598         if (req->err) {
2599                 skb_queue_purge(&req->cmd_q);
2600                 return req->err;
2601         }
2602
2603         /* Do not allow empty requests */
2604         if (skb_queue_empty(&req->cmd_q))
2605                 return -ENODATA;
2606
2607         skb = skb_peek_tail(&req->cmd_q);
2608         bt_cb(skb)->req.complete = complete;
2609
2610         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
2611         skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
2612         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
2613
2614         queue_work(hdev->workqueue, &hdev->cmd_work);
2615
2616         return 0;
2617 }
2618
2619 static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
2620                                        u32 plen, const void *param)
2621 {
2622         int len = HCI_COMMAND_HDR_SIZE + plen;
2623         struct hci_command_hdr *hdr;
2624         struct sk_buff *skb;
2625
2626         skb = bt_skb_alloc(len, GFP_ATOMIC);
2627         if (!skb)
2628                 return NULL;
2629
2630         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
2631         hdr->opcode = cpu_to_le16(opcode);
2632         hdr->plen   = plen;
2633
2634         if (plen)
2635                 memcpy(skb_put(skb, plen), param, plen);
2636
2637         BT_DBG("skb len %d", skb->len);
2638
2639         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
2640         skb->dev = (void *) hdev;
2641
2642         return skb;
2643 }
2644
2645 /* Send HCI command */
2646 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
2647                  const void *param)
2648 {
2649         struct sk_buff *skb;
2650
2651         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2652
2653         skb = hci_prepare_cmd(hdev, opcode, plen, param);
2654         if (!skb) {
2655                 BT_ERR("%s no memory for command", hdev->name);
2656                 return -ENOMEM;
2657         }
2658
2659         /* Stand-alone HCI commands must be flaged as
2660          * single-command requests.
2661          */
2662         bt_cb(skb)->req.start = true;
2663
2664         skb_queue_tail(&hdev->cmd_q, skb);
2665         queue_work(hdev->workqueue, &hdev->cmd_work);
2666
2667         return 0;
2668 }
2669
2670 /* Queue a command to an asynchronous HCI request */
2671 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
2672                     const void *param, u8 event)
2673 {
2674         struct hci_dev *hdev = req->hdev;
2675         struct sk_buff *skb;
2676
2677         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2678
2679         /* If an error occured during request building, there is no point in
2680          * queueing the HCI command. We can simply return.
2681          */
2682         if (req->err)
2683                 return;
2684
2685         skb = hci_prepare_cmd(hdev, opcode, plen, param);
2686         if (!skb) {
2687                 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
2688                        hdev->name, opcode);
2689                 req->err = -ENOMEM;
2690                 return;
2691         }
2692
2693         if (skb_queue_empty(&req->cmd_q))
2694                 bt_cb(skb)->req.start = true;
2695
2696         bt_cb(skb)->req.event = event;
2697
2698         skb_queue_tail(&req->cmd_q, skb);
2699 }
2700
2701 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
2702                  const void *param)
2703 {
2704         hci_req_add_ev(req, opcode, plen, param, 0);
2705 }
2706
2707 /* Get data from the previously sent command */
2708 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
2709 {
2710         struct hci_command_hdr *hdr;
2711
2712         if (!hdev->sent_cmd)
2713                 return NULL;
2714
2715         hdr = (void *) hdev->sent_cmd->data;
2716
2717         if (hdr->opcode != cpu_to_le16(opcode))
2718                 return NULL;
2719
2720         BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2721
2722         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2723 }
2724
2725 /* Send ACL data */
2726 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2727 {
2728         struct hci_acl_hdr *hdr;
2729         int len = skb->len;
2730
2731         skb_push(skb, HCI_ACL_HDR_SIZE);
2732         skb_reset_transport_header(skb);
2733         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
2734         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2735         hdr->dlen   = cpu_to_le16(len);
2736 }
2737
2738 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
2739                           struct sk_buff *skb, __u16 flags)
2740 {
2741         struct hci_conn *conn = chan->conn;
2742         struct hci_dev *hdev = conn->hdev;
2743         struct sk_buff *list;
2744
2745         skb->len = skb_headlen(skb);
2746         skb->data_len = 0;
2747
2748         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2749
2750         switch (hdev->dev_type) {
2751         case HCI_BREDR:
2752                 hci_add_acl_hdr(skb, conn->handle, flags);
2753                 break;
2754         case HCI_AMP:
2755                 hci_add_acl_hdr(skb, chan->handle, flags);
2756                 break;
2757         default:
2758                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2759                 return;
2760         }
2761
2762         list = skb_shinfo(skb)->frag_list;
2763         if (!list) {
2764                 /* Non fragmented */
2765                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2766
2767                 skb_queue_tail(queue, skb);
2768         } else {
2769                 /* Fragmented */
2770                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2771
2772                 skb_shinfo(skb)->frag_list = NULL;
2773
2774                 /* Queue all fragments atomically */
2775                 spin_lock(&queue->lock);
2776
2777                 __skb_queue_tail(queue, skb);
2778
2779                 flags &= ~ACL_START;
2780                 flags |= ACL_CONT;
2781                 do {
2782                         skb = list; list = list->next;
2783
2784                         skb->dev = (void *) hdev;
2785                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2786                         hci_add_acl_hdr(skb, conn->handle, flags);
2787
2788                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2789
2790                         __skb_queue_tail(queue, skb);
2791                 } while (list);
2792
2793                 spin_unlock(&queue->lock);
2794         }
2795 }
2796
2797 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2798 {
2799         struct hci_dev *hdev = chan->conn->hdev;
2800
2801         BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
2802
2803         skb->dev = (void *) hdev;
2804
2805         hci_queue_acl(chan, &chan->data_q, skb, flags);
2806
2807         queue_work(hdev->workqueue, &hdev->tx_work);
2808 }
2809
2810 /* Send SCO data */
2811 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2812 {
2813         struct hci_dev *hdev = conn->hdev;
2814         struct hci_sco_hdr hdr;
2815
2816         BT_DBG("%s len %d", hdev->name, skb->len);
2817
2818         hdr.handle = cpu_to_le16(conn->handle);
2819         hdr.dlen   = skb->len;
2820
2821         skb_push(skb, HCI_SCO_HDR_SIZE);
2822         skb_reset_transport_header(skb);
2823         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2824
2825         skb->dev = (void *) hdev;
2826         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2827
2828         skb_queue_tail(&conn->data_q, skb);
2829         queue_work(hdev->workqueue, &hdev->tx_work);
2830 }
2831
2832 /* ---- HCI TX task (outgoing data) ---- */
2833
2834 /* HCI Connection scheduler */
2835 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
2836                                      int *quote)
2837 {
2838         struct hci_conn_hash *h = &hdev->conn_hash;
2839         struct hci_conn *conn = NULL, *c;
2840         unsigned int num = 0, min = ~0;
2841
2842         /* We don't have to lock device here. Connections are always
2843          * added and removed with TX task disabled. */
2844
2845         rcu_read_lock();
2846
2847         list_for_each_entry_rcu(c, &h->list, list) {
2848                 if (c->type != type || skb_queue_empty(&c->data_q))
2849                         continue;
2850
2851                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2852                         continue;
2853
2854                 num++;
2855
2856                 if (c->sent < min) {
2857                         min  = c->sent;
2858                         conn = c;
2859                 }
2860
2861                 if (hci_conn_num(hdev, type) == num)
2862                         break;
2863         }
2864
2865         rcu_read_unlock();
2866
2867         if (conn) {
2868                 int cnt, q;
2869
2870                 switch (conn->type) {
2871                 case ACL_LINK:
2872                         cnt = hdev->acl_cnt;
2873                         break;
2874                 case SCO_LINK:
2875                 case ESCO_LINK:
2876                         cnt = hdev->sco_cnt;
2877                         break;
2878                 case LE_LINK:
2879                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2880                         break;
2881                 default:
2882                         cnt = 0;
2883                         BT_ERR("Unknown link type");
2884                 }
2885
2886                 q = cnt / num;
2887                 *quote = q ? q : 1;
2888         } else
2889                 *quote = 0;
2890
2891         BT_DBG("conn %p quote %d", conn, *quote);
2892         return conn;
2893 }
2894
2895 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2896 {
2897         struct hci_conn_hash *h = &hdev->conn_hash;
2898         struct hci_conn *c;
2899
2900         BT_ERR("%s link tx timeout", hdev->name);
2901
2902         rcu_read_lock();
2903
2904         /* Kill stalled connections */
2905         list_for_each_entry_rcu(c, &h->list, list) {
2906                 if (c->type == type && c->sent) {
2907                         BT_ERR("%s killing stalled connection %pMR",
2908                                hdev->name, &c->dst);
2909                         hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
2910                 }
2911         }
2912
2913         rcu_read_unlock();
2914 }
2915
2916 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2917                                       int *quote)
2918 {
2919         struct hci_conn_hash *h = &hdev->conn_hash;
2920         struct hci_chan *chan = NULL;
2921         unsigned int num = 0, min = ~0, cur_prio = 0;
2922         struct hci_conn *conn;
2923         int cnt, q, conn_num = 0;
2924
2925         BT_DBG("%s", hdev->name);
2926
2927         rcu_read_lock();
2928
2929         list_for_each_entry_rcu(conn, &h->list, list) {
2930                 struct hci_chan *tmp;
2931
2932                 if (conn->type != type)
2933                         continue;
2934
2935                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2936                         continue;
2937
2938                 conn_num++;
2939
2940                 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2941                         struct sk_buff *skb;
2942
2943                         if (skb_queue_empty(&tmp->data_q))
2944                                 continue;
2945
2946                         skb = skb_peek(&tmp->data_q);
2947                         if (skb->priority < cur_prio)
2948                                 continue;
2949
2950                         if (skb->priority > cur_prio) {
2951                                 num = 0;
2952                                 min = ~0;
2953                                 cur_prio = skb->priority;
2954                         }
2955
2956                         num++;
2957
2958                         if (conn->sent < min) {
2959                                 min  = conn->sent;
2960                                 chan = tmp;
2961                         }
2962                 }
2963
2964                 if (hci_conn_num(hdev, type) == conn_num)
2965                         break;
2966         }
2967
2968         rcu_read_unlock();
2969
2970         if (!chan)
2971                 return NULL;
2972
2973         switch (chan->conn->type) {
2974         case ACL_LINK:
2975                 cnt = hdev->acl_cnt;
2976                 break;
2977         case AMP_LINK:
2978                 cnt = hdev->block_cnt;
2979                 break;
2980         case SCO_LINK:
2981         case ESCO_LINK:
2982                 cnt = hdev->sco_cnt;
2983                 break;
2984         case LE_LINK:
2985                 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2986                 break;
2987         default:
2988                 cnt = 0;
2989                 BT_ERR("Unknown link type");
2990         }
2991
2992         q = cnt / num;
2993         *quote = q ? q : 1;
2994         BT_DBG("chan %p quote %d", chan, *quote);
2995         return chan;
2996 }
2997
2998 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2999 {
3000         struct hci_conn_hash *h = &hdev->conn_hash;
3001         struct hci_conn *conn;
3002         int num = 0;
3003
3004         BT_DBG("%s", hdev->name);
3005
3006         rcu_read_lock();
3007
3008         list_for_each_entry_rcu(conn, &h->list, list) {
3009                 struct hci_chan *chan;
3010
3011                 if (conn->type != type)
3012                         continue;
3013
3014                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3015                         continue;
3016
3017                 num++;
3018
3019                 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
3020                         struct sk_buff *skb;
3021
3022                         if (chan->sent) {
3023                                 chan->sent = 0;
3024                                 continue;
3025                         }
3026
3027                         if (skb_queue_empty(&chan->data_q))
3028                                 continue;
3029
3030                         skb = skb_peek(&chan->data_q);
3031                         if (skb->priority >= HCI_PRIO_MAX - 1)
3032                                 continue;
3033
3034                         skb->priority = HCI_PRIO_MAX - 1;
3035
3036                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
3037                                skb->priority);
3038                 }
3039
3040                 if (hci_conn_num(hdev, type) == num)
3041                         break;
3042         }
3043
3044         rcu_read_unlock();
3045
3046 }
3047
3048 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3049 {
3050         /* Calculate count of blocks used by this packet */
3051         return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3052 }
3053
3054 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
3055 {
3056         if (!test_bit(HCI_RAW, &hdev->flags)) {
3057                 /* ACL tx timeout must be longer than maximum
3058                  * link supervision timeout (40.9 seconds) */
3059                 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
3060                                        HCI_ACL_TX_TIMEOUT))
3061                         hci_link_tx_to(hdev, ACL_LINK);
3062         }
3063 }
3064
3065 static void hci_sched_acl_pkt(struct hci_dev *hdev)
3066 {
3067         unsigned int cnt = hdev->acl_cnt;
3068         struct hci_chan *chan;
3069         struct sk_buff *skb;
3070         int quote;
3071
3072         __check_timeout(hdev, cnt);
3073
3074         while (hdev->acl_cnt &&
3075                (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3076                 u32 priority = (skb_peek(&chan->data_q))->priority;
3077                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3078                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3079                                skb->len, skb->priority);
3080
3081                         /* Stop if priority has changed */
3082                         if (skb->priority < priority)
3083                                 break;
3084
3085                         skb = skb_dequeue(&chan->data_q);
3086
3087                         hci_conn_enter_active_mode(chan->conn,
3088                                                    bt_cb(skb)->force_active);
3089
3090                         hci_send_frame(skb);
3091                         hdev->acl_last_tx = jiffies;
3092
3093                         hdev->acl_cnt--;
3094                         chan->sent++;
3095                         chan->conn->sent++;
3096                 }
3097         }
3098
3099         if (cnt != hdev->acl_cnt)
3100                 hci_prio_recalculate(hdev, ACL_LINK);
3101 }
3102
3103 static void hci_sched_acl_blk(struct hci_dev *hdev)
3104 {
3105         unsigned int cnt = hdev->block_cnt;
3106         struct hci_chan *chan;
3107         struct sk_buff *skb;
3108         int quote;
3109         u8 type;
3110
3111         __check_timeout(hdev, cnt);
3112
3113         BT_DBG("%s", hdev->name);
3114
3115         if (hdev->dev_type == HCI_AMP)
3116                 type = AMP_LINK;
3117         else
3118                 type = ACL_LINK;
3119
3120         while (hdev->block_cnt > 0 &&
3121                (chan = hci_chan_sent(hdev, type, &quote))) {
3122                 u32 priority = (skb_peek(&chan->data_q))->priority;
3123                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3124                         int blocks;
3125
3126                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3127                                skb->len, skb->priority);
3128
3129                         /* Stop if priority has changed */
3130                         if (skb->priority < priority)
3131                                 break;
3132
3133                         skb = skb_dequeue(&chan->data_q);
3134
3135                         blocks = __get_blocks(hdev, skb);
3136                         if (blocks > hdev->block_cnt)
3137                                 return;
3138
3139                         hci_conn_enter_active_mode(chan->conn,
3140                                                    bt_cb(skb)->force_active);
3141
3142                         hci_send_frame(skb);
3143                         hdev->acl_last_tx = jiffies;
3144
3145                         hdev->block_cnt -= blocks;
3146                         quote -= blocks;
3147
3148                         chan->sent += blocks;
3149                         chan->conn->sent += blocks;
3150                 }
3151         }
3152
3153         if (cnt != hdev->block_cnt)
3154                 hci_prio_recalculate(hdev, type);
3155 }
3156
3157 static void hci_sched_acl(struct hci_dev *hdev)
3158 {
3159         BT_DBG("%s", hdev->name);
3160
3161         /* No ACL link over BR/EDR controller */
3162         if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3163                 return;
3164
3165         /* No AMP link over AMP controller */
3166         if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
3167                 return;
3168
3169         switch (hdev->flow_ctl_mode) {
3170         case HCI_FLOW_CTL_MODE_PACKET_BASED:
3171                 hci_sched_acl_pkt(hdev);
3172                 break;
3173
3174         case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3175                 hci_sched_acl_blk(hdev);
3176                 break;
3177         }
3178 }
3179
3180 /* Schedule SCO */
3181 static void hci_sched_sco(struct hci_dev *hdev)
3182 {
3183         struct hci_conn *conn;
3184         struct sk_buff *skb;
3185         int quote;
3186
3187         BT_DBG("%s", hdev->name);
3188
3189         if (!hci_conn_num(hdev, SCO_LINK))
3190                 return;
3191
3192         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3193                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3194                         BT_DBG("skb %p len %d", skb, skb->len);
3195                         hci_send_frame(skb);
3196
3197                         conn->sent++;
3198                         if (conn->sent == ~0)
3199                                 conn->sent = 0;
3200                 }
3201         }
3202 }
3203
3204 static void hci_sched_esco(struct hci_dev *hdev)
3205 {
3206         struct hci_conn *conn;
3207         struct sk_buff *skb;
3208         int quote;
3209
3210         BT_DBG("%s", hdev->name);
3211
3212         if (!hci_conn_num(hdev, ESCO_LINK))
3213                 return;
3214
3215         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3216                                                      &quote))) {
3217                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3218                         BT_DBG("skb %p len %d", skb, skb->len);
3219                         hci_send_frame(skb);
3220
3221                         conn->sent++;
3222                         if (conn->sent == ~0)
3223                                 conn->sent = 0;
3224                 }
3225         }
3226 }
3227
3228 static void hci_sched_le(struct hci_dev *hdev)
3229 {
3230         struct hci_chan *chan;
3231         struct sk_buff *skb;
3232         int quote, cnt, tmp;
3233
3234         BT_DBG("%s", hdev->name);
3235
3236         if (!hci_conn_num(hdev, LE_LINK))
3237                 return;
3238
3239         if (!test_bit(HCI_RAW, &hdev->flags)) {
3240                 /* LE tx timeout must be longer than maximum
3241                  * link supervision timeout (40.9 seconds) */
3242                 if (!hdev->le_cnt && hdev->le_pkts &&
3243                     time_after(jiffies, hdev->le_last_tx + HZ * 45))
3244                         hci_link_tx_to(hdev, LE_LINK);
3245         }
3246
3247         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
3248         tmp = cnt;
3249         while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
3250                 u32 priority = (skb_peek(&chan->data_q))->priority;
3251                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3252                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3253                                skb->len, skb->priority);
3254
3255                         /* Stop if priority has changed */
3256                         if (skb->priority < priority)
3257                                 break;
3258
3259                         skb = skb_dequeue(&chan->data_q);
3260
3261                         hci_send_frame(skb);
3262                         hdev->le_last_tx = jiffies;
3263
3264                         cnt--;
3265                         chan->sent++;
3266                         chan->conn->sent++;
3267                 }
3268         }
3269
3270         if (hdev->le_pkts)
3271                 hdev->le_cnt = cnt;
3272         else
3273                 hdev->acl_cnt = cnt;
3274
3275         if (cnt != tmp)
3276                 hci_prio_recalculate(hdev, LE_LINK);
3277 }
3278
3279 static void hci_tx_work(struct work_struct *work)
3280 {
3281         struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
3282         struct sk_buff *skb;
3283
3284         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
3285                hdev->sco_cnt, hdev->le_cnt);
3286
3287         /* Schedule queues and send stuff to HCI driver */
3288
3289         hci_sched_acl(hdev);
3290
3291         hci_sched_sco(hdev);
3292
3293         hci_sched_esco(hdev);
3294
3295         hci_sched_le(hdev);
3296
3297         /* Send next queued raw (unknown type) packet */
3298         while ((skb = skb_dequeue(&hdev->raw_q)))
3299                 hci_send_frame(skb);
3300 }
3301
3302 /* ----- HCI RX task (incoming data processing) ----- */
3303
3304 /* ACL data packet */
3305 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3306 {
3307         struct hci_acl_hdr *hdr = (void *) skb->data;
3308         struct hci_conn *conn;
3309         __u16 handle, flags;
3310
3311         skb_pull(skb, HCI_ACL_HDR_SIZE);
3312
3313         handle = __le16_to_cpu(hdr->handle);
3314         flags  = hci_flags(handle);
3315         handle = hci_handle(handle);
3316
3317         BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
3318                handle, flags);
3319
3320         hdev->stat.acl_rx++;
3321
3322         hci_dev_lock(hdev);
3323         conn = hci_conn_hash_lookup_handle(hdev, handle);
3324         hci_dev_unlock(hdev);
3325
3326         if (conn) {
3327                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
3328
3329                 /* Send to upper protocol */
3330                 l2cap_recv_acldata(conn, skb, flags);
3331                 return;
3332         } else {
3333                 BT_ERR("%s ACL packet for unknown connection handle %d",
3334                        hdev->name, handle);
3335         }
3336
3337         kfree_skb(skb);
3338 }
3339
3340 /* SCO data packet */
3341 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3342 {
3343         struct hci_sco_hdr *hdr = (void *) skb->data;
3344         struct hci_conn *conn;
3345         __u16 handle;
3346
3347         skb_pull(skb, HCI_SCO_HDR_SIZE);
3348
3349         handle = __le16_to_cpu(hdr->handle);
3350
3351         BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
3352
3353         hdev->stat.sco_rx++;
3354
3355         hci_dev_lock(hdev);
3356         conn = hci_conn_hash_lookup_handle(hdev, handle);
3357         hci_dev_unlock(hdev);
3358
3359         if (conn) {
3360                 /* Send to upper protocol */
3361                 sco_recv_scodata(conn, skb);
3362                 return;
3363         } else {
3364                 BT_ERR("%s SCO packet for unknown connection handle %d",
3365                        hdev->name, handle);
3366         }
3367
3368         kfree_skb(skb);
3369 }
3370
3371 static bool hci_req_is_complete(struct hci_dev *hdev)
3372 {
3373         struct sk_buff *skb;
3374
3375         skb = skb_peek(&hdev->cmd_q);
3376         if (!skb)
3377                 return true;
3378
3379         return bt_cb(skb)->req.start;
3380 }
3381
3382 static void hci_resend_last(struct hci_dev *hdev)
3383 {
3384         struct hci_command_hdr *sent;
3385         struct sk_buff *skb;
3386         u16 opcode;
3387
3388         if (!hdev->sent_cmd)
3389                 return;
3390
3391         sent = (void *) hdev->sent_cmd->data;
3392         opcode = __le16_to_cpu(sent->opcode);
3393         if (opcode == HCI_OP_RESET)
3394                 return;
3395
3396         skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3397         if (!skb)
3398                 return;
3399
3400         skb_queue_head(&hdev->cmd_q, skb);
3401         queue_work(hdev->workqueue, &hdev->cmd_work);
3402 }
3403
3404 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
3405 {
3406         hci_req_complete_t req_complete = NULL;
3407         struct sk_buff *skb;
3408         unsigned long flags;
3409
3410         BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3411
3412         /* If the completed command doesn't match the last one that was
3413          * sent we need to do special handling of it.
3414          */
3415         if (!hci_sent_cmd_data(hdev, opcode)) {
3416                 /* Some CSR based controllers generate a spontaneous
3417                  * reset complete event during init and any pending
3418                  * command will never be completed. In such a case we
3419                  * need to resend whatever was the last sent
3420                  * command.
3421                  */
3422                 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3423                         hci_resend_last(hdev);
3424
3425                 return;
3426         }
3427
3428         /* If the command succeeded and there's still more commands in
3429          * this request the request is not yet complete.
3430          */
3431         if (!status && !hci_req_is_complete(hdev))
3432                 return;
3433
3434         /* If this was the last command in a request the complete
3435          * callback would be found in hdev->sent_cmd instead of the
3436          * command queue (hdev->cmd_q).
3437          */
3438         if (hdev->sent_cmd) {
3439                 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
3440                 if (req_complete)
3441                         goto call_complete;
3442         }
3443
3444         /* Remove all pending commands belonging to this request */
3445         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
3446         while ((skb = __skb_dequeue(&hdev->cmd_q))) {
3447                 if (bt_cb(skb)->req.start) {
3448                         __skb_queue_head(&hdev->cmd_q, skb);
3449                         break;
3450                 }
3451
3452                 req_complete = bt_cb(skb)->req.complete;
3453                 kfree_skb(skb);
3454         }
3455         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
3456
3457 call_complete:
3458         if (req_complete)
3459                 req_complete(hdev, status);
3460 }
3461
3462 static void hci_rx_work(struct work_struct *work)
3463 {
3464         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
3465         struct sk_buff *skb;
3466
3467         BT_DBG("%s", hdev->name);
3468
3469         while ((skb = skb_dequeue(&hdev->rx_q))) {
3470                 /* Send copy to monitor */
3471                 hci_send_to_monitor(hdev, skb);
3472
3473                 if (atomic_read(&hdev->promisc)) {
3474                         /* Send copy to the sockets */
3475                         hci_send_to_sock(hdev, skb);
3476                 }
3477
3478                 if (test_bit(HCI_RAW, &hdev->flags)) {
3479                         kfree_skb(skb);
3480                         continue;
3481                 }
3482
3483                 if (test_bit(HCI_INIT, &hdev->flags)) {
3484                         /* Don't process data packets in this states. */
3485                         switch (bt_cb(skb)->pkt_type) {
3486                         case HCI_ACLDATA_PKT:
3487                         case HCI_SCODATA_PKT:
3488                                 kfree_skb(skb);
3489                                 continue;
3490                         }
3491                 }
3492
3493                 /* Process frame */
3494                 switch (bt_cb(skb)->pkt_type) {
3495                 case HCI_EVENT_PKT:
3496                         BT_DBG("%s Event packet", hdev->name);
3497                         hci_event_packet(hdev, skb);
3498                         break;
3499
3500                 case HCI_ACLDATA_PKT:
3501                         BT_DBG("%s ACL data packet", hdev->name);
3502                         hci_acldata_packet(hdev, skb);
3503                         break;
3504
3505                 case HCI_SCODATA_PKT:
3506                         BT_DBG("%s SCO data packet", hdev->name);
3507                         hci_scodata_packet(hdev, skb);
3508                         break;
3509
3510                 default:
3511                         kfree_skb(skb);
3512                         break;
3513                 }
3514         }
3515 }
3516
3517 static void hci_cmd_work(struct work_struct *work)
3518 {
3519         struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
3520         struct sk_buff *skb;
3521
3522         BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
3523                atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
3524
3525         /* Send queued commands */
3526         if (atomic_read(&hdev->cmd_cnt)) {
3527                 skb = skb_dequeue(&hdev->cmd_q);
3528                 if (!skb)
3529                         return;
3530
3531                 kfree_skb(hdev->sent_cmd);
3532
3533                 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
3534                 if (hdev->sent_cmd) {
3535                         atomic_dec(&hdev->cmd_cnt);
3536                         hci_send_frame(skb);
3537                         if (test_bit(HCI_RESET, &hdev->flags))
3538                                 del_timer(&hdev->cmd_timer);
3539                         else
3540                                 mod_timer(&hdev->cmd_timer,
3541                                           jiffies + HCI_CMD_TIMEOUT);
3542                 } else {
3543                         skb_queue_head(&hdev->cmd_q, skb);
3544                         queue_work(hdev->workqueue, &hdev->cmd_work);
3545                 }
3546         }
3547 }
3548
3549 int hci_do_inquiry(struct hci_dev *hdev, u8 length)
3550 {
3551         /* General inquiry access code (GIAC) */
3552         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3553         struct hci_cp_inquiry cp;
3554
3555         BT_DBG("%s", hdev->name);
3556
3557         if (test_bit(HCI_INQUIRY, &hdev->flags))
3558                 return -EINPROGRESS;
3559
3560         inquiry_cache_flush(hdev);
3561
3562         memset(&cp, 0, sizeof(cp));
3563         memcpy(&cp.lap, lap, sizeof(cp.lap));
3564         cp.length  = length;
3565
3566         return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
3567 }
3568
3569 int hci_cancel_inquiry(struct hci_dev *hdev)
3570 {
3571         BT_DBG("%s", hdev->name);
3572
3573         if (!test_bit(HCI_INQUIRY, &hdev->flags))
3574                 return -EALREADY;
3575
3576         return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
3577 }
3578
3579 u8 bdaddr_to_le(u8 bdaddr_type)
3580 {
3581         switch (bdaddr_type) {
3582         case BDADDR_LE_PUBLIC:
3583                 return ADDR_LE_DEV_PUBLIC;
3584
3585         default:
3586                 /* Fallback to LE Random address type */
3587                 return ADDR_LE_DEV_RANDOM;
3588         }
3589 }