net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2011 ProFUSION Embedded Systems
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI core. */
  27
  28 #include <linux/export.h>
  29
  30 #include <linux/rfkill.h>
  31
  32 #include <net/bluetooth/bluetooth.h>
  33 #include <net/bluetooth/hci_core.h>
  34
  35 #define AUTO_OFF_TIMEOUT 2000
  36
  37 static void hci_rx_work(struct work_struct *work);
  38 static void hci_cmd_work(struct work_struct *work);
  39 static void hci_tx_work(struct work_struct *work);
  40
  41 /* HCI device list */
  42 LIST_HEAD(hci_dev_list);
  43 DEFINE_RWLOCK(hci_dev_list_lock);
  44
  45 /* HCI callback list */
  46 LIST_HEAD(hci_cb_list);
  47 DEFINE_RWLOCK(hci_cb_list_lock);
  48
  49 /* ---- HCI notifications ---- */
  50
  51 static void hci_notify(struct hci_dev *hdev, int event)
  52 {
  53         hci_sock_dev_event(hdev, event);
  54 }
  55
  56 /* ---- HCI requests ---- */
  57
  58 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
  59 {
  60         BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
  61
  62         /* If this is the init phase check if the completed command matches
  63          * the last init command, and if not just return.
  64          */
  65         if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd) {
  66                 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
  67                 u16 opcode = __le16_to_cpu(sent->opcode);
  68                 struct sk_buff *skb;
  69
  70                 /* Some CSR based controllers generate a spontaneous
  71                  * reset complete event during init and any pending
  72                  * command will never be completed. In such a case we
  73                  * need to resend whatever was the last sent
  74                  * command.
  75                  */
  76
  77                 if (cmd != HCI_OP_RESET || opcode == HCI_OP_RESET)
  78                         return;
  79
  80                 skb = skb_clone(hdev->sent_cmd, GFP_ATOMIC);
  81                 if (skb) {
  82                         skb_queue_head(&hdev->cmd_q, skb);
  83                         queue_work(hdev->workqueue, &hdev->cmd_work);
  84                 }
  85
  86                 return;
  87         }
  88
  89         if (hdev->req_status == HCI_REQ_PEND) {
  90                 hdev->req_result = result;
  91                 hdev->req_status = HCI_REQ_DONE;
  92                 wake_up_interruptible(&hdev->req_wait_q);
  93         }
  94 }
  95
  96 static void hci_req_cancel(struct hci_dev *hdev, int err)
  97 {
  98         BT_DBG("%s err 0x%2.2x", hdev->name, err);
  99
 100         if (hdev->req_status == HCI_REQ_PEND) {
 101                 hdev->req_result = err;
 102                 hdev->req_status = HCI_REQ_CANCELED;
 103                 wake_up_interruptible(&hdev->req_wait_q);
 104         }
 105 }
 106
 107 /* Execute request and wait for completion. */
 108 static int __hci_request(struct hci_dev *hdev,
 109                          void (*req)(struct hci_dev *hdev, unsigned long opt),
 110                          unsigned long opt, __u32 timeout)
 111 {
 112         DECLARE_WAITQUEUE(wait, current);
 113         int err = 0;
 114
 115         BT_DBG("%s start", hdev->name);
 116
 117         hdev->req_status = HCI_REQ_PEND;
 118
 119         add_wait_queue(&hdev->req_wait_q, &wait);
 120         set_current_state(TASK_INTERRUPTIBLE);
 121
 122         req(hdev, opt);
 123         schedule_timeout(timeout);
 124
 125         remove_wait_queue(&hdev->req_wait_q, &wait);
 126
 127         if (signal_pending(current))
 128                 return -EINTR;
 129
 130         switch (hdev->req_status) {
 131         case HCI_REQ_DONE:
 132                 err = -bt_to_errno(hdev->req_result);
 133                 break;
 134
 135         case HCI_REQ_CANCELED:
 136                 err = -hdev->req_result;
 137                 break;
 138
 139         default:
 140                 err = -ETIMEDOUT;
 141                 break;
 142         }
 143
 144         hdev->req_status = hdev->req_result = 0;
 145
 146         BT_DBG("%s end: err %d", hdev->name, err);
 147
 148         return err;
 149 }
 150
 151 static int hci_request(struct hci_dev *hdev,
 152                        void (*req)(struct hci_dev *hdev, unsigned long opt),
 153                        unsigned long opt, __u32 timeout)
 154 {
 155         int ret;
 156
 157         if (!test_bit(HCI_UP, &hdev->flags))
 158                 return -ENETDOWN;
 159
 160         /* Serialize all requests */
 161         hci_req_lock(hdev);
 162         ret = __hci_request(hdev, req, opt, timeout);
 163         hci_req_unlock(hdev);
 164
 165         return ret;
 166 }
 167
 168 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
 169 {
 170         BT_DBG("%s %ld", hdev->name, opt);
 171
 172         /* Reset device */
 173         set_bit(HCI_RESET, &hdev->flags);
 174         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 175 }
 176
 177 static void bredr_init(struct hci_dev *hdev)
 178 {
 179         struct hci_cp_delete_stored_link_key cp;
 180         __le16 param;
 181         __u8 flt_type;
 182
 183         hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
 184
 185         /* Mandatory initialization */
 186
 187         /* Reset */
 188         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
 189                 set_bit(HCI_RESET, &hdev->flags);
 190                 hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 191         }
 192
 193         /* Read Local Supported Features */
 194         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 195
 196         /* Read Local Version */
 197         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 198
 199         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 200         hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 201
 202         /* Read BD Address */
 203         hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
 204
 205         /* Read Class of Device */
 206         hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 207
 208         /* Read Local Name */
 209         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 210
 211         /* Read Voice Setting */
 212         hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 213
 214         /* Optional initialization */
 215
 216         /* Clear Event Filters */
 217         flt_type = HCI_FLT_CLEAR_ALL;
 218         hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 219
 220         /* Connection accept timeout ~20 secs */
 221         param = cpu_to_le16(0x7d00);
 222         hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 223
 224         bacpy(&cp.bdaddr, BDADDR_ANY);
 225         cp.delete_all = 1;
 226         hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
 227 }
 228
 229 static void amp_init(struct hci_dev *hdev)
 230 {
 231         hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
 232
 233         /* Reset */
 234         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 235
 236         /* Read Local Version */
 237         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 238
 239         /* Read Local AMP Info */
 240         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 241 }
 242
 243 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 244 {
 245         struct sk_buff *skb;
 246
 247         BT_DBG("%s %ld", hdev->name, opt);
 248
 249         /* Driver initialization */
 250
 251         /* Special commands */
 252         while ((skb = skb_dequeue(&hdev->driver_init))) {
 253                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
 254                 skb->dev = (void *) hdev;
 255
 256                 skb_queue_tail(&hdev->cmd_q, skb);
 257                 queue_work(hdev->workqueue, &hdev->cmd_work);
 258         }
 259         skb_queue_purge(&hdev->driver_init);
 260
 261         switch (hdev->dev_type) {
 262         case HCI_BREDR:
 263                 bredr_init(hdev);
 264                 break;
 265
 266         case HCI_AMP:
 267                 amp_init(hdev);
 268                 break;
 269
 270         default:
 271                 BT_ERR("Unknown device type %d", hdev->dev_type);
 272                 break;
 273         }
 274
 275 }
 276
 277 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
 278 {
 279         BT_DBG("%s", hdev->name);
 280
 281         /* Read LE buffer size */
 282         hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 283 }
 284
 285 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
 286 {
 287         __u8 scan = opt;
 288
 289         BT_DBG("%s %x", hdev->name, scan);
 290
 291         /* Inquiry and Page scans */
 292         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 293 }
 294
 295 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
 296 {
 297         __u8 auth = opt;
 298
 299         BT_DBG("%s %x", hdev->name, auth);
 300
 301         /* Authentication */
 302         hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 303 }
 304
 305 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
 306 {
 307         __u8 encrypt = opt;
 308
 309         BT_DBG("%s %x", hdev->name, encrypt);
 310
 311         /* Encryption */
 312         hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 313 }
 314
 315 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
 316 {
 317         __le16 policy = cpu_to_le16(opt);
 318
 319         BT_DBG("%s %x", hdev->name, policy);
 320
 321         /* Default link policy */
 322         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 323 }
 324
 325 /* Get HCI device by index.
 326  * Device is held on return. */
 327 struct hci_dev *hci_dev_get(int index)
 328 {
 329         struct hci_dev *hdev = NULL, *d;
 330
 331         BT_DBG("%d", index);
 332
 333         if (index < 0)
 334                 return NULL;
 335
 336         read_lock(&hci_dev_list_lock);
 337         list_for_each_entry(d, &hci_dev_list, list) {
 338                 if (d->id == index) {
 339                         hdev = hci_dev_hold(d);
 340                         break;
 341                 }
 342         }
 343         read_unlock(&hci_dev_list_lock);
 344         return hdev;
 345 }
 346
 347 /* ---- Inquiry support ---- */
 348
 349 bool hci_discovery_active(struct hci_dev *hdev)
 350 {
 351         struct discovery_state *discov = &hdev->discovery;
 352
 353         switch (discov->state) {
 354         case DISCOVERY_FINDING:
 355         case DISCOVERY_RESOLVING:
 356                 return true;
 357
 358         default:
 359                 return false;
 360         }
 361 }
 362
 363 void hci_discovery_set_state(struct hci_dev *hdev, int state)
 364 {
 365         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
 366
 367         if (hdev->discovery.state == state)
 368                 return;
 369
 370         switch (state) {
 371         case DISCOVERY_STOPPED:
 372                 if (hdev->discovery.state != DISCOVERY_STARTING)
 373                         mgmt_discovering(hdev, 0);
 374                 break;
 375         case DISCOVERY_STARTING:
 376                 break;
 377         case DISCOVERY_FINDING:
 378                 mgmt_discovering(hdev, 1);
 379                 break;
 380         case DISCOVERY_RESOLVING:
 381                 break;
 382         case DISCOVERY_STOPPING:
 383                 break;
 384         }
 385
 386         hdev->discovery.state = state;
 387 }
 388
 389 static void inquiry_cache_flush(struct hci_dev *hdev)
 390 {
 391         struct discovery_state *cache = &hdev->discovery;
 392         struct inquiry_entry *p, *n;
 393
 394         list_for_each_entry_safe(p, n, &cache->all, all) {
 395                 list_del(&p->all);
 396                 kfree(p);
 397         }
 398
 399         INIT_LIST_HEAD(&cache->unknown);
 400         INIT_LIST_HEAD(&cache->resolve);
 401 }
 402
 403 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
 404                                                bdaddr_t *bdaddr)
 405 {
 406         struct discovery_state *cache = &hdev->discovery;
 407         struct inquiry_entry *e;
 408
 409         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 410
 411         list_for_each_entry(e, &cache->all, all) {
 412                 if (!bacmp(&e->data.bdaddr, bdaddr))
 413                         return e;
 414         }
 415
 416         return NULL;
 417 }
 418
 419 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
 420                                                        bdaddr_t *bdaddr)
 421 {
 422         struct discovery_state *cache = &hdev->discovery;
 423         struct inquiry_entry *e;
 424
 425         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 426
 427         list_for_each_entry(e, &cache->unknown, list) {
 428                 if (!bacmp(&e->data.bdaddr, bdaddr))
 429                         return e;
 430         }
 431
 432         return NULL;
 433 }
 434
 435 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
 436                                                        bdaddr_t *bdaddr,
 437                                                        int state)
 438 {
 439         struct discovery_state *cache = &hdev->discovery;
 440         struct inquiry_entry *e;
 441
 442         BT_DBG("cache %p bdaddr %s state %d", cache, batostr(bdaddr), state);
 443
 444         list_for_each_entry(e, &cache->resolve, list) {
 445                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
 446                         return e;
 447                 if (!bacmp(&e->data.bdaddr, bdaddr))
 448                         return e;
 449         }
 450
 451         return NULL;
 452 }
 453
 454 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
 455                                       struct inquiry_entry *ie)
 456 {
 457         struct discovery_state *cache = &hdev->discovery;
 458         struct list_head *pos = &cache->resolve;
 459         struct inquiry_entry *p;
 460
 461         list_del(&ie->list);
 462
 463         list_for_each_entry(p, &cache->resolve, list) {
 464                 if (p->name_state != NAME_PENDING &&
 465                     abs(p->data.rssi) >= abs(ie->data.rssi))
 466                         break;
 467                 pos = &p->list;
 468         }
 469
 470         list_add(&ie->list, pos);
 471 }
 472
 473 bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
 474                               bool name_known, bool *ssp)
 475 {
 476         struct discovery_state *cache = &hdev->discovery;
 477         struct inquiry_entry *ie;
 478
 479         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 480
 481         if (ssp)
 482                 *ssp = data->ssp_mode;
 483
 484         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
 485         if (ie) {
 486                 if (ie->data.ssp_mode && ssp)
 487                         *ssp = true;
 488
 489                 if (ie->name_state == NAME_NEEDED &&
 490                     data->rssi != ie->data.rssi) {
 491                         ie->data.rssi = data->rssi;
 492                         hci_inquiry_cache_update_resolve(hdev, ie);
 493                 }
 494
 495                 goto update;
 496         }
 497
 498         /* Entry not in the cache. Add new one. */
 499         ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
 500         if (!ie)
 501                 return false;
 502
 503         list_add(&ie->all, &cache->all);
 504
 505         if (name_known) {
 506                 ie->name_state = NAME_KNOWN;
 507         } else {
 508                 ie->name_state = NAME_NOT_KNOWN;
 509                 list_add(&ie->list, &cache->unknown);
 510         }
 511
 512 update:
 513         if (name_known && ie->name_state != NAME_KNOWN &&
 514             ie->name_state != NAME_PENDING) {
 515                 ie->name_state = NAME_KNOWN;
 516                 list_del(&ie->list);
 517         }
 518
 519         memcpy(&ie->data, data, sizeof(*data));
 520         ie->timestamp = jiffies;
 521         cache->timestamp = jiffies;
 522
 523         if (ie->name_state == NAME_NOT_KNOWN)
 524                 return false;
 525
 526         return true;
 527 }
 528
 529 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 530 {
 531         struct discovery_state *cache = &hdev->discovery;
 532         struct inquiry_info *info = (struct inquiry_info *) buf;
 533         struct inquiry_entry *e;
 534         int copied = 0;
 535
 536         list_for_each_entry(e, &cache->all, all) {
 537                 struct inquiry_data *data = &e->data;
 538
 539                 if (copied >= num)
 540                         break;
 541
 542                 bacpy(&info->bdaddr, &data->bdaddr);
 543                 info->pscan_rep_mode    = data->pscan_rep_mode;
 544                 info->pscan_period_mode = data->pscan_period_mode;
 545                 info->pscan_mode        = data->pscan_mode;
 546                 memcpy(info->dev_class, data->dev_class, 3);
 547                 info->clock_offset      = data->clock_offset;
 548
 549                 info++;
 550                 copied++;
 551         }
 552
 553         BT_DBG("cache %p, copied %d", cache, copied);
 554         return copied;
 555 }
 556
 557 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
 558 {
 559         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
 560         struct hci_cp_inquiry cp;
 561
 562         BT_DBG("%s", hdev->name);
 563
 564         if (test_bit(HCI_INQUIRY, &hdev->flags))
 565                 return;
 566
 567         /* Start Inquiry */
 568         memcpy(&cp.lap, &ir->lap, 3);
 569         cp.length  = ir->length;
 570         cp.num_rsp = ir->num_rsp;
 571         hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
 572 }
 573
 574 int hci_inquiry(void __user *arg)
 575 {
 576         __u8 __user *ptr = arg;
 577         struct hci_inquiry_req ir;
 578         struct hci_dev *hdev;
 579         int err = 0, do_inquiry = 0, max_rsp;
 580         long timeo;
 581         __u8 *buf;
 582
 583         if (copy_from_user(&ir, ptr, sizeof(ir)))
 584                 return -EFAULT;
 585
 586         hdev = hci_dev_get(ir.dev_id);
 587         if (!hdev)
 588                 return -ENODEV;
 589
 590         hci_dev_lock(hdev);
 591         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 592             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
 593                 inquiry_cache_flush(hdev);
 594                 do_inquiry = 1;
 595         }
 596         hci_dev_unlock(hdev);
 597
 598         timeo = ir.length * msecs_to_jiffies(2000);
 599
 600         if (do_inquiry) {
 601                 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
 602                 if (err < 0)
 603                         goto done;
 604         }
 605
 606         /* for unlimited number of responses we will use buffer with
 607          * 255 entries
 608          */
 609         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 610
 611         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
 612          * copy it to the user space.
 613          */
 614         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
 615         if (!buf) {
 616                 err = -ENOMEM;
 617                 goto done;
 618         }
 619
 620         hci_dev_lock(hdev);
 621         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
 622         hci_dev_unlock(hdev);
 623
 624         BT_DBG("num_rsp %d", ir.num_rsp);
 625
 626         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
 627                 ptr += sizeof(ir);
 628                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
 629                                  ir.num_rsp))
 630                         err = -EFAULT;
 631         } else
 632                 err = -EFAULT;
 633
 634         kfree(buf);
 635
 636 done:
 637         hci_dev_put(hdev);
 638         return err;
 639 }
 640
 641 /* ---- HCI ioctl helpers ---- */
 642
 643 int hci_dev_open(__u16 dev)
 644 {
 645         struct hci_dev *hdev;
 646         int ret = 0;
 647
 648         hdev = hci_dev_get(dev);
 649         if (!hdev)
 650                 return -ENODEV;
 651
 652         BT_DBG("%s %p", hdev->name, hdev);
 653
 654         hci_req_lock(hdev);
 655
 656         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
 657                 ret = -ENODEV;
 658                 goto done;
 659         }
 660
 661         if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
 662                 ret = -ERFKILL;
 663                 goto done;
 664         }
 665
 666         if (test_bit(HCI_UP, &hdev->flags)) {
 667                 ret = -EALREADY;
 668                 goto done;
 669         }
 670
 671         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 672                 set_bit(HCI_RAW, &hdev->flags);
 673
 674         /* Treat all non BR/EDR controllers as raw devices if
 675            enable_hs is not set */
 676         if (hdev->dev_type != HCI_BREDR && !enable_hs)
 677                 set_bit(HCI_RAW, &hdev->flags);
 678
 679         if (hdev->open(hdev)) {
 680                 ret = -EIO;
 681                 goto done;
 682         }
 683
 684         if (!test_bit(HCI_RAW, &hdev->flags)) {
 685                 atomic_set(&hdev->cmd_cnt, 1);
 686                 set_bit(HCI_INIT, &hdev->flags);
 687                 hdev->init_last_cmd = 0;
 688
 689                 ret = __hci_request(hdev, hci_init_req, 0,
 690                                     msecs_to_jiffies(HCI_INIT_TIMEOUT));
 691
 692                 if (lmp_host_le_capable(hdev))
 693                         ret = __hci_request(hdev, hci_le_init_req, 0,
 694                                             msecs_to_jiffies(HCI_INIT_TIMEOUT));
 695
 696                 clear_bit(HCI_INIT, &hdev->flags);
 697         }
 698
 699         if (!ret) {
 700                 hci_dev_hold(hdev);
 701                 set_bit(HCI_UP, &hdev->flags);
 702                 hci_notify(hdev, HCI_DEV_UP);
 703                 if (!test_bit(HCI_SETUP, &hdev->dev_flags)) {
 704                         hci_dev_lock(hdev);
 705                         mgmt_powered(hdev, 1);
 706                         hci_dev_unlock(hdev);
 707                 }
 708         } else {
 709                 /* Init failed, cleanup */
 710                 flush_work(&hdev->tx_work);
 711                 flush_work(&hdev->cmd_work);
 712                 flush_work(&hdev->rx_work);
 713
 714                 skb_queue_purge(&hdev->cmd_q);
 715                 skb_queue_purge(&hdev->rx_q);
 716
 717                 if (hdev->flush)
 718                         hdev->flush(hdev);
 719
 720                 if (hdev->sent_cmd) {
 721                         kfree_skb(hdev->sent_cmd);
 722                         hdev->sent_cmd = NULL;
 723                 }
 724
 725                 hdev->close(hdev);
 726                 hdev->flags = 0;
 727         }
 728
 729 done:
 730         hci_req_unlock(hdev);
 731         hci_dev_put(hdev);
 732         return ret;
 733 }
 734
 735 static int hci_dev_do_close(struct hci_dev *hdev)
 736 {
 737         BT_DBG("%s %p", hdev->name, hdev);
 738
 739         cancel_work_sync(&hdev->le_scan);
 740
 741         hci_req_cancel(hdev, ENODEV);
 742         hci_req_lock(hdev);
 743
 744         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 745                 del_timer_sync(&hdev->cmd_timer);
 746                 hci_req_unlock(hdev);
 747                 return 0;
 748         }
 749
 750         /* Flush RX and TX works */
 751         flush_work(&hdev->tx_work);
 752         flush_work(&hdev->rx_work);
 753
 754         if (hdev->discov_timeout > 0) {
 755                 cancel_delayed_work(&hdev->discov_off);
 756                 hdev->discov_timeout = 0;
 757                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
 758         }
 759
 760         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
 761                 cancel_delayed_work(&hdev->service_cache);
 762
 763         cancel_delayed_work_sync(&hdev->le_scan_disable);
 764
 765         hci_dev_lock(hdev);
 766         inquiry_cache_flush(hdev);
 767         hci_conn_hash_flush(hdev);
 768         hci_dev_unlock(hdev);
 769
 770         hci_notify(hdev, HCI_DEV_DOWN);
 771
 772         if (hdev->flush)
 773                 hdev->flush(hdev);
 774
 775         /* Reset device */
 776         skb_queue_purge(&hdev->cmd_q);
 777         atomic_set(&hdev->cmd_cnt, 1);
 778         if (!test_bit(HCI_RAW, &hdev->flags) &&
 779             test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
 780                 set_bit(HCI_INIT, &hdev->flags);
 781                 __hci_request(hdev, hci_reset_req, 0,
 782                               msecs_to_jiffies(250));
 783                 clear_bit(HCI_INIT, &hdev->flags);
 784         }
 785
 786         /* flush cmd  work */
 787         flush_work(&hdev->cmd_work);
 788
 789         /* Drop queues */
 790         skb_queue_purge(&hdev->rx_q);
 791         skb_queue_purge(&hdev->cmd_q);
 792         skb_queue_purge(&hdev->raw_q);
 793
 794         /* Drop last sent command */
 795         if (hdev->sent_cmd) {
 796                 del_timer_sync(&hdev->cmd_timer);
 797                 kfree_skb(hdev->sent_cmd);
 798                 hdev->sent_cmd = NULL;
 799         }
 800
 801         /* After this point our queues are empty
 802          * and no tasks are scheduled. */
 803         hdev->close(hdev);
 804
 805         if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
 806                 hci_dev_lock(hdev);
 807                 mgmt_powered(hdev, 0);
 808                 hci_dev_unlock(hdev);
 809         }
 810
 811         /* Clear flags */
 812         hdev->flags = 0;
 813
 814         memset(hdev->eir, 0, sizeof(hdev->eir));
 815         memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
 816
 817         hci_req_unlock(hdev);
 818
 819         hci_dev_put(hdev);
 820         return 0;
 821 }
 822
 823 int hci_dev_close(__u16 dev)
 824 {
 825         struct hci_dev *hdev;
 826         int err;
 827
 828         hdev = hci_dev_get(dev);
 829         if (!hdev)
 830                 return -ENODEV;
 831
 832         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 833                 cancel_delayed_work(&hdev->power_off);
 834
 835         err = hci_dev_do_close(hdev);
 836
 837         hci_dev_put(hdev);
 838         return err;
 839 }
 840
 841 int hci_dev_reset(__u16 dev)
 842 {
 843         struct hci_dev *hdev;
 844         int ret = 0;
 845
 846         hdev = hci_dev_get(dev);
 847         if (!hdev)
 848                 return -ENODEV;
 849
 850         hci_req_lock(hdev);
 851
 852         if (!test_bit(HCI_UP, &hdev->flags))
 853                 goto done;
 854
 855         /* Drop queues */
 856         skb_queue_purge(&hdev->rx_q);
 857         skb_queue_purge(&hdev->cmd_q);
 858
 859         hci_dev_lock(hdev);
 860         inquiry_cache_flush(hdev);
 861         hci_conn_hash_flush(hdev);
 862         hci_dev_unlock(hdev);
 863
 864         if (hdev->flush)
 865                 hdev->flush(hdev);
 866
 867         atomic_set(&hdev->cmd_cnt, 1);
 868         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
 869
 870         if (!test_bit(HCI_RAW, &hdev->flags))
 871                 ret = __hci_request(hdev, hci_reset_req, 0,
 872                                     msecs_to_jiffies(HCI_INIT_TIMEOUT));
 873
 874 done:
 875         hci_req_unlock(hdev);
 876         hci_dev_put(hdev);
 877         return ret;
 878 }
 879
 880 int hci_dev_reset_stat(__u16 dev)
 881 {
 882         struct hci_dev *hdev;
 883         int ret = 0;
 884
 885         hdev = hci_dev_get(dev);
 886         if (!hdev)
 887                 return -ENODEV;
 888
 889         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 890
 891         hci_dev_put(hdev);
 892
 893         return ret;
 894 }
 895
 896 int hci_dev_cmd(unsigned int cmd, void __user *arg)
 897 {
 898         struct hci_dev *hdev;
 899         struct hci_dev_req dr;
 900         int err = 0;
 901
 902         if (copy_from_user(&dr, arg, sizeof(dr)))
 903                 return -EFAULT;
 904
 905         hdev = hci_dev_get(dr.dev_id);
 906         if (!hdev)
 907                 return -ENODEV;
 908
 909         switch (cmd) {
 910         case HCISETAUTH:
 911                 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 912                                   msecs_to_jiffies(HCI_INIT_TIMEOUT));
 913                 break;
 914
 915         case HCISETENCRYPT:
 916                 if (!lmp_encrypt_capable(hdev)) {
 917                         err = -EOPNOTSUPP;
 918                         break;
 919                 }
 920
 921                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
 922                         /* Auth must be enabled first */
 923                         err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 924                                           msecs_to_jiffies(HCI_INIT_TIMEOUT));
 925                         if (err)
 926                                 break;
 927                 }
 928
 929                 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
 930                                   msecs_to_jiffies(HCI_INIT_TIMEOUT));
 931                 break;
 932
 933         case HCISETSCAN:
 934                 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
 935                                   msecs_to_jiffies(HCI_INIT_TIMEOUT));
 936                 break;
 937
 938         case HCISETLINKPOL:
 939                 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
 940                                   msecs_to_jiffies(HCI_INIT_TIMEOUT));
 941                 break;
 942
 943         case HCISETLINKMODE:
 944                 hdev->link_mode = ((__u16) dr.dev_opt) &
 945                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
 946                 break;
 947
 948         case HCISETPTYPE:
 949                 hdev->pkt_type = (__u16) dr.dev_opt;
 950                 break;
 951
 952         case HCISETACLMTU:
 953                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
 954                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
 955                 break;
 956
 957         case HCISETSCOMTU:
 958                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
 959                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
 960                 break;
 961
 962         default:
 963                 err = -EINVAL;
 964                 break;
 965         }
 966
 967         hci_dev_put(hdev);
 968         return err;
 969 }
 970
 971 int hci_get_dev_list(void __user *arg)
 972 {
 973         struct hci_dev *hdev;
 974         struct hci_dev_list_req *dl;
 975         struct hci_dev_req *dr;
 976         int n = 0, size, err;
 977         __u16 dev_num;
 978
 979         if (get_user(dev_num, (__u16 __user *) arg))
 980                 return -EFAULT;
 981
 982         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
 983                 return -EINVAL;
 984
 985         size = sizeof(*dl) + dev_num * sizeof(*dr);
 986
 987         dl = kzalloc(size, GFP_KERNEL);
 988         if (!dl)
 989                 return -ENOMEM;
 990
 991         dr = dl->dev_req;
 992
 993         read_lock(&hci_dev_list_lock);
 994         list_for_each_entry(hdev, &hci_dev_list, list) {
 995                 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
 996                         cancel_delayed_work(&hdev->power_off);
 997
 998                 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
 999                         set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1000
1001                 (dr + n)->dev_id  = hdev->id;
1002                 (dr + n)->dev_opt = hdev->flags;
1003
1004                 if (++n >= dev_num)
1005                         break;
1006         }
1007         read_unlock(&hci_dev_list_lock);
1008
1009         dl->dev_num = n;
1010         size = sizeof(*dl) + n * sizeof(*dr);
1011
1012         err = copy_to_user(arg, dl, size);
1013         kfree(dl);
1014
1015         return err ? -EFAULT : 0;
1016 }
1017
1018 int hci_get_dev_info(void __user *arg)
1019 {
1020         struct hci_dev *hdev;
1021         struct hci_dev_info di;
1022         int err = 0;
1023
1024         if (copy_from_user(&di, arg, sizeof(di)))
1025                 return -EFAULT;
1026
1027         hdev = hci_dev_get(di.dev_id);
1028         if (!hdev)
1029                 return -ENODEV;
1030
1031         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1032                 cancel_delayed_work_sync(&hdev->power_off);
1033
1034         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1035                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1036
1037         strcpy(di.name, hdev->name);
1038         di.bdaddr   = hdev->bdaddr;
1039         di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1040         di.flags    = hdev->flags;
1041         di.pkt_type = hdev->pkt_type;
1042         di.acl_mtu  = hdev->acl_mtu;
1043         di.acl_pkts = hdev->acl_pkts;
1044         di.sco_mtu  = hdev->sco_mtu;
1045         di.sco_pkts = hdev->sco_pkts;
1046         di.link_policy = hdev->link_policy;
1047         di.link_mode   = hdev->link_mode;
1048
1049         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1050         memcpy(&di.features, &hdev->features, sizeof(di.features));
1051
1052         if (copy_to_user(arg, &di, sizeof(di)))
1053                 err = -EFAULT;
1054
1055         hci_dev_put(hdev);
1056
1057         return err;
1058 }
1059
1060 /* ---- Interface to HCI drivers ---- */
1061
1062 static int hci_rfkill_set_block(void *data, bool blocked)
1063 {
1064         struct hci_dev *hdev = data;
1065
1066         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1067
1068         if (!blocked)
1069                 return 0;
1070
1071         hci_dev_do_close(hdev);
1072
1073         return 0;
1074 }
1075
1076 static const struct rfkill_ops hci_rfkill_ops = {
1077         .set_block = hci_rfkill_set_block,
1078 };
1079
1080 static void hci_power_on(struct work_struct *work)
1081 {
1082         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1083
1084         BT_DBG("%s", hdev->name);
1085
1086         if (hci_dev_open(hdev->id) < 0)
1087                 return;
1088
1089         if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1090                 schedule_delayed_work(&hdev->power_off,
1091                                       msecs_to_jiffies(AUTO_OFF_TIMEOUT));
1092
1093         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
1094                 mgmt_index_added(hdev);
1095 }
1096
1097 static void hci_power_off(struct work_struct *work)
1098 {
1099         struct hci_dev *hdev = container_of(work, struct hci_dev,
1100                                             power_off.work);
1101
1102         BT_DBG("%s", hdev->name);
1103
1104         hci_dev_do_close(hdev);
1105 }
1106
1107 static void hci_discov_off(struct work_struct *work)
1108 {
1109         struct hci_dev *hdev;
1110         u8 scan = SCAN_PAGE;
1111
1112         hdev = container_of(work, struct hci_dev, discov_off.work);
1113
1114         BT_DBG("%s", hdev->name);
1115
1116         hci_dev_lock(hdev);
1117
1118         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1119
1120         hdev->discov_timeout = 0;
1121
1122         hci_dev_unlock(hdev);
1123 }
1124
1125 int hci_uuids_clear(struct hci_dev *hdev)
1126 {
1127         struct list_head *p, *n;
1128
1129         list_for_each_safe(p, n, &hdev->uuids) {
1130                 struct bt_uuid *uuid;
1131
1132                 uuid = list_entry(p, struct bt_uuid, list);
1133
1134                 list_del(p);
1135                 kfree(uuid);
1136         }
1137
1138         return 0;
1139 }
1140
1141 int hci_link_keys_clear(struct hci_dev *hdev)
1142 {
1143         struct list_head *p, *n;
1144
1145         list_for_each_safe(p, n, &hdev->link_keys) {
1146                 struct link_key *key;
1147
1148                 key = list_entry(p, struct link_key, list);
1149
1150                 list_del(p);
1151                 kfree(key);
1152         }
1153
1154         return 0;
1155 }
1156
1157 int hci_smp_ltks_clear(struct hci_dev *hdev)
1158 {
1159         struct smp_ltk *k, *tmp;
1160
1161         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1162                 list_del(&k->list);
1163                 kfree(k);
1164         }
1165
1166         return 0;
1167 }
1168
1169 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1170 {
1171         struct link_key *k;
1172
1173         list_for_each_entry(k, &hdev->link_keys, list)
1174                 if (bacmp(bdaddr, &k->bdaddr) == 0)
1175                         return k;
1176
1177         return NULL;
1178 }
1179
1180 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1181                                u8 key_type, u8 old_key_type)
1182 {
1183         /* Legacy key */
1184         if (key_type < 0x03)
1185                 return true;
1186
1187         /* Debug keys are insecure so don't store them persistently */
1188         if (key_type == HCI_LK_DEBUG_COMBINATION)
1189                 return false;
1190
1191         /* Changed combination key and there's no previous one */
1192         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1193                 return false;
1194
1195         /* Security mode 3 case */
1196         if (!conn)
1197                 return true;
1198
1199         /* Neither local nor remote side had no-bonding as requirement */
1200         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1201                 return true;
1202
1203         /* Local side had dedicated bonding as requirement */
1204         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1205                 return true;
1206
1207         /* Remote side had dedicated bonding as requirement */
1208         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1209                 return true;
1210
1211         /* If none of the above criteria match, then don't store the key
1212          * persistently */
1213         return false;
1214 }
1215
1216 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1217 {
1218         struct smp_ltk *k;
1219
1220         list_for_each_entry(k, &hdev->long_term_keys, list) {
1221                 if (k->ediv != ediv ||
1222                     memcmp(rand, k->rand, sizeof(k->rand)))
1223                         continue;
1224
1225                 return k;
1226         }
1227
1228         return NULL;
1229 }
1230 EXPORT_SYMBOL(hci_find_ltk);
1231
1232 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1233                                      u8 addr_type)
1234 {
1235         struct smp_ltk *k;
1236
1237         list_for_each_entry(k, &hdev->long_term_keys, list)
1238                 if (addr_type == k->bdaddr_type &&
1239                     bacmp(bdaddr, &k->bdaddr) == 0)
1240                         return k;
1241
1242         return NULL;
1243 }
1244 EXPORT_SYMBOL(hci_find_ltk_by_addr);
1245
1246 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1247                      bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1248 {
1249         struct link_key *key, *old_key;
1250         u8 old_key_type;
1251         bool persistent;
1252
1253         old_key = hci_find_link_key(hdev, bdaddr);
1254         if (old_key) {
1255                 old_key_type = old_key->type;
1256                 key = old_key;
1257         } else {
1258                 old_key_type = conn ? conn->key_type : 0xff;
1259                 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1260                 if (!key)
1261                         return -ENOMEM;
1262                 list_add(&key->list, &hdev->link_keys);
1263         }
1264
1265         BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1266
1267         /* Some buggy controller combinations generate a changed
1268          * combination key for legacy pairing even when there's no
1269          * previous key */
1270         if (type == HCI_LK_CHANGED_COMBINATION &&
1271             (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
1272                 type = HCI_LK_COMBINATION;
1273                 if (conn)
1274                         conn->key_type = type;
1275         }
1276
1277         bacpy(&key->bdaddr, bdaddr);
1278         memcpy(key->val, val, HCI_LINK_KEY_SIZE);
1279         key->pin_len = pin_len;
1280
1281         if (type == HCI_LK_CHANGED_COMBINATION)
1282                 key->type = old_key_type;
1283         else
1284                 key->type = type;
1285
1286         if (!new_key)
1287                 return 0;
1288
1289         persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1290
1291         mgmt_new_link_key(hdev, key, persistent);
1292
1293         if (conn)
1294                 conn->flush_key = !persistent;
1295
1296         return 0;
1297 }
1298
1299 int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
1300                 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
1301                 ediv, u8 rand[8])
1302 {
1303         struct smp_ltk *key, *old_key;
1304
1305         if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1306                 return 0;
1307
1308         old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1309         if (old_key)
1310                 key = old_key;
1311         else {
1312                 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1313                 if (!key)
1314                         return -ENOMEM;
1315                 list_add(&key->list, &hdev->long_term_keys);
1316         }
1317
1318         bacpy(&key->bdaddr, bdaddr);
1319         key->bdaddr_type = addr_type;
1320         memcpy(key->val, tk, sizeof(key->val));
1321         key->authenticated = authenticated;
1322         key->ediv = ediv;
1323         key->enc_size = enc_size;
1324         key->type = type;
1325         memcpy(key->rand, rand, sizeof(key->rand));
1326
1327         if (!new_key)
1328                 return 0;
1329
1330         if (type & HCI_SMP_LTK)
1331                 mgmt_new_ltk(hdev, key, 1);
1332
1333         return 0;
1334 }
1335
1336 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1337 {
1338         struct link_key *key;
1339
1340         key = hci_find_link_key(hdev, bdaddr);
1341         if (!key)
1342                 return -ENOENT;
1343
1344         BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1345
1346         list_del(&key->list);
1347         kfree(key);
1348
1349         return 0;
1350 }
1351
1352 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1353 {
1354         struct smp_ltk *k, *tmp;
1355
1356         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1357                 if (bacmp(bdaddr, &k->bdaddr))
1358                         continue;
1359
1360                 BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1361
1362                 list_del(&k->list);
1363                 kfree(k);
1364         }
1365
1366         return 0;
1367 }
1368
1369 /* HCI command timer function */
1370 static void hci_cmd_timer(unsigned long arg)
1371 {
1372         struct hci_dev *hdev = (void *) arg;
1373
1374         BT_ERR("%s command tx timeout", hdev->name);
1375         atomic_set(&hdev->cmd_cnt, 1);
1376         queue_work(hdev->workqueue, &hdev->cmd_work);
1377 }
1378
1379 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1380                                           bdaddr_t *bdaddr)
1381 {
1382         struct oob_data *data;
1383
1384         list_for_each_entry(data, &hdev->remote_oob_data, list)
1385                 if (bacmp(bdaddr, &data->bdaddr) == 0)
1386                         return data;
1387
1388         return NULL;
1389 }
1390
1391 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1392 {
1393         struct oob_data *data;
1394
1395         data = hci_find_remote_oob_data(hdev, bdaddr);
1396         if (!data)
1397                 return -ENOENT;
1398
1399         BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1400
1401         list_del(&data->list);
1402         kfree(data);
1403
1404         return 0;
1405 }
1406
1407 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1408 {
1409         struct oob_data *data, *n;
1410
1411         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1412                 list_del(&data->list);
1413                 kfree(data);
1414         }
1415
1416         return 0;
1417 }
1418
1419 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1420                             u8 *randomizer)
1421 {
1422         struct oob_data *data;
1423
1424         data = hci_find_remote_oob_data(hdev, bdaddr);
1425
1426         if (!data) {
1427                 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1428                 if (!data)
1429                         return -ENOMEM;
1430
1431                 bacpy(&data->bdaddr, bdaddr);
1432                 list_add(&data->list, &hdev->remote_oob_data);
1433         }
1434
1435         memcpy(data->hash, hash, sizeof(data->hash));
1436         memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1437
1438         BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1439
1440         return 0;
1441 }
1442
1443 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
1444 {
1445         struct bdaddr_list *b;
1446
1447         list_for_each_entry(b, &hdev->blacklist, list)
1448                 if (bacmp(bdaddr, &b->bdaddr) == 0)
1449                         return b;
1450
1451         return NULL;
1452 }
1453
1454 int hci_blacklist_clear(struct hci_dev *hdev)
1455 {
1456         struct list_head *p, *n;
1457
1458         list_for_each_safe(p, n, &hdev->blacklist) {
1459                 struct bdaddr_list *b;
1460
1461                 b = list_entry(p, struct bdaddr_list, list);
1462
1463                 list_del(p);
1464                 kfree(b);
1465         }
1466
1467         return 0;
1468 }
1469
1470 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1471 {
1472         struct bdaddr_list *entry;
1473
1474         if (bacmp(bdaddr, BDADDR_ANY) == 0)
1475                 return -EBADF;
1476
1477         if (hci_blacklist_lookup(hdev, bdaddr))
1478                 return -EEXIST;
1479
1480         entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1481         if (!entry)
1482                 return -ENOMEM;
1483
1484         bacpy(&entry->bdaddr, bdaddr);
1485
1486         list_add(&entry->list, &hdev->blacklist);
1487
1488         return mgmt_device_blocked(hdev, bdaddr, type);
1489 }
1490
1491 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1492 {
1493         struct bdaddr_list *entry;
1494
1495         if (bacmp(bdaddr, BDADDR_ANY) == 0)
1496                 return hci_blacklist_clear(hdev);
1497
1498         entry = hci_blacklist_lookup(hdev, bdaddr);
1499         if (!entry)
1500                 return -ENOENT;
1501
1502         list_del(&entry->list);
1503         kfree(entry);
1504
1505         return mgmt_device_unblocked(hdev, bdaddr, type);
1506 }
1507
1508 static void le_scan_param_req(struct hci_dev *hdev, unsigned long opt)
1509 {
1510         struct le_scan_params *param =  (struct le_scan_params *) opt;
1511         struct hci_cp_le_set_scan_param cp;
1512
1513         memset(&cp, 0, sizeof(cp));
1514         cp.type = param->type;
1515         cp.interval = cpu_to_le16(param->interval);
1516         cp.window = cpu_to_le16(param->window);
1517
1518         hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_PARAM, sizeof(cp), &cp);
1519 }
1520
1521 static void le_scan_enable_req(struct hci_dev *hdev, unsigned long opt)
1522 {
1523         struct hci_cp_le_set_scan_enable cp;
1524
1525         memset(&cp, 0, sizeof(cp));
1526         cp.enable = 1;
1527
1528         hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1529 }
1530
1531 static int hci_do_le_scan(struct hci_dev *hdev, u8 type, u16 interval,
1532                           u16 window, int timeout)
1533 {
1534         long timeo = msecs_to_jiffies(3000);
1535         struct le_scan_params param;
1536         int err;
1537
1538         BT_DBG("%s", hdev->name);
1539
1540         if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1541                 return -EINPROGRESS;
1542
1543         param.type = type;
1544         param.interval = interval;
1545         param.window = window;
1546
1547         hci_req_lock(hdev);
1548
1549         err = __hci_request(hdev, le_scan_param_req, (unsigned long) &param,
1550                             timeo);
1551         if (!err)
1552                 err = __hci_request(hdev, le_scan_enable_req, 0, timeo);
1553
1554         hci_req_unlock(hdev);
1555
1556         if (err < 0)
1557                 return err;
1558
1559         schedule_delayed_work(&hdev->le_scan_disable,
1560                               msecs_to_jiffies(timeout));
1561
1562         return 0;
1563 }
1564
1565 int hci_cancel_le_scan(struct hci_dev *hdev)
1566 {
1567         BT_DBG("%s", hdev->name);
1568
1569         if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
1570                 return -EALREADY;
1571
1572         if (cancel_delayed_work(&hdev->le_scan_disable)) {
1573                 struct hci_cp_le_set_scan_enable cp;
1574
1575                 /* Send HCI command to disable LE Scan */
1576                 memset(&cp, 0, sizeof(cp));
1577                 hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1578         }
1579
1580         return 0;
1581 }
1582
1583 static void le_scan_disable_work(struct work_struct *work)
1584 {
1585         struct hci_dev *hdev = container_of(work, struct hci_dev,
1586                                             le_scan_disable.work);
1587         struct hci_cp_le_set_scan_enable cp;
1588
1589         BT_DBG("%s", hdev->name);
1590
1591         memset(&cp, 0, sizeof(cp));
1592
1593         hci_send_cmd(hdev, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
1594 }
1595
1596 static void le_scan_work(struct work_struct *work)
1597 {
1598         struct hci_dev *hdev = container_of(work, struct hci_dev, le_scan);
1599         struct le_scan_params *param = &hdev->le_scan_params;
1600
1601         BT_DBG("%s", hdev->name);
1602
1603         hci_do_le_scan(hdev, param->type, param->interval, param->window,
1604                        param->timeout);
1605 }
1606
1607 int hci_le_scan(struct hci_dev *hdev, u8 type, u16 interval, u16 window,
1608                 int timeout)
1609 {
1610         struct le_scan_params *param = &hdev->le_scan_params;
1611
1612         BT_DBG("%s", hdev->name);
1613
1614         if (work_busy(&hdev->le_scan))
1615                 return -EINPROGRESS;
1616
1617         param->type = type;
1618         param->interval = interval;
1619         param->window = window;
1620         param->timeout = timeout;
1621
1622         queue_work(system_long_wq, &hdev->le_scan);
1623
1624         return 0;
1625 }
1626
1627 /* Alloc HCI device */
1628 struct hci_dev *hci_alloc_dev(void)
1629 {
1630         struct hci_dev *hdev;
1631
1632         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
1633         if (!hdev)
1634                 return NULL;
1635
1636         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1637         hdev->esco_type = (ESCO_HV1);
1638         hdev->link_mode = (HCI_LM_ACCEPT);
1639         hdev->io_capability = 0x03; /* No Input No Output */
1640
1641         hdev->sniff_max_interval = 800;
1642         hdev->sniff_min_interval = 80;
1643
1644         mutex_init(&hdev->lock);
1645         mutex_init(&hdev->req_lock);
1646
1647         INIT_LIST_HEAD(&hdev->mgmt_pending);
1648         INIT_LIST_HEAD(&hdev->blacklist);
1649         INIT_LIST_HEAD(&hdev->uuids);
1650         INIT_LIST_HEAD(&hdev->link_keys);
1651         INIT_LIST_HEAD(&hdev->long_term_keys);
1652         INIT_LIST_HEAD(&hdev->remote_oob_data);
1653
1654         INIT_WORK(&hdev->rx_work, hci_rx_work);
1655         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
1656         INIT_WORK(&hdev->tx_work, hci_tx_work);
1657         INIT_WORK(&hdev->power_on, hci_power_on);
1658         INIT_WORK(&hdev->le_scan, le_scan_work);
1659
1660         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
1661         INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
1662         INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
1663
1664         skb_queue_head_init(&hdev->driver_init);
1665         skb_queue_head_init(&hdev->rx_q);
1666         skb_queue_head_init(&hdev->cmd_q);
1667         skb_queue_head_init(&hdev->raw_q);
1668
1669         init_waitqueue_head(&hdev->req_wait_q);
1670
1671         setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1672
1673         hci_init_sysfs(hdev);
1674         discovery_init(hdev);
1675         hci_conn_hash_init(hdev);
1676
1677         return hdev;
1678 }
1679 EXPORT_SYMBOL(hci_alloc_dev);
1680
1681 /* Free HCI device */
1682 void hci_free_dev(struct hci_dev *hdev)
1683 {
1684         skb_queue_purge(&hdev->driver_init);
1685
1686         /* will free via device release */
1687         put_device(&hdev->dev);
1688 }
1689 EXPORT_SYMBOL(hci_free_dev);
1690
1691 /* Register HCI device */
1692 int hci_register_dev(struct hci_dev *hdev)
1693 {
1694         struct list_head *head, *p;
1695         int id, error;
1696
1697         if (!hdev->open || !hdev->close)
1698                 return -EINVAL;
1699
1700         write_lock(&hci_dev_list_lock);
1701
1702         /* Do not allow HCI_AMP devices to register at index 0,
1703          * so the index can be used as the AMP controller ID.
1704          */
1705         id = (hdev->dev_type == HCI_BREDR) ? 0 : 1;
1706         head = &hci_dev_list;
1707
1708         /* Find first available device id */
1709         list_for_each(p, &hci_dev_list) {
1710                 int nid = list_entry(p, struct hci_dev, list)->id;
1711                 if (nid > id)
1712                         break;
1713                 if (nid == id)
1714                         id++;
1715                 head = p;
1716         }
1717
1718         sprintf(hdev->name, "hci%d", id);
1719         hdev->id = id;
1720
1721         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1722
1723         list_add(&hdev->list, head);
1724
1725         write_unlock(&hci_dev_list_lock);
1726
1727         hdev->workqueue = alloc_workqueue(hdev->name, WQ_HIGHPRI | WQ_UNBOUND |
1728                                           WQ_MEM_RECLAIM, 1);
1729         if (!hdev->workqueue) {
1730                 error = -ENOMEM;
1731                 goto err;
1732         }
1733
1734         error = hci_add_sysfs(hdev);
1735         if (error < 0)
1736                 goto err_wqueue;
1737
1738         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1739                                     RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
1740                                     hdev);
1741         if (hdev->rfkill) {
1742                 if (rfkill_register(hdev->rfkill) < 0) {
1743                         rfkill_destroy(hdev->rfkill);
1744                         hdev->rfkill = NULL;
1745                 }
1746         }
1747
1748         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
1749         set_bit(HCI_SETUP, &hdev->dev_flags);
1750         schedule_work(&hdev->power_on);
1751
1752         hci_notify(hdev, HCI_DEV_REG);
1753         hci_dev_hold(hdev);
1754
1755         return id;
1756
1757 err_wqueue:
1758         destroy_workqueue(hdev->workqueue);
1759 err:
1760         write_lock(&hci_dev_list_lock);
1761         list_del(&hdev->list);
1762         write_unlock(&hci_dev_list_lock);
1763
1764         return error;
1765 }
1766 EXPORT_SYMBOL(hci_register_dev);
1767
1768 /* Unregister HCI device */
1769 void hci_unregister_dev(struct hci_dev *hdev)
1770 {
1771         int i;
1772
1773         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1774
1775         set_bit(HCI_UNREGISTER, &hdev->dev_flags);
1776
1777         write_lock(&hci_dev_list_lock);
1778         list_del(&hdev->list);
1779         write_unlock(&hci_dev_list_lock);
1780
1781         hci_dev_do_close(hdev);
1782
1783         for (i = 0; i < NUM_REASSEMBLY; i++)
1784                 kfree_skb(hdev->reassembly[i]);
1785
1786         if (!test_bit(HCI_INIT, &hdev->flags) &&
1787             !test_bit(HCI_SETUP, &hdev->dev_flags)) {
1788                 hci_dev_lock(hdev);
1789                 mgmt_index_removed(hdev);
1790                 hci_dev_unlock(hdev);
1791         }
1792
1793         /* mgmt_index_removed should take care of emptying the
1794          * pending list */
1795         BUG_ON(!list_empty(&hdev->mgmt_pending));
1796
1797         hci_notify(hdev, HCI_DEV_UNREG);
1798
1799         if (hdev->rfkill) {
1800                 rfkill_unregister(hdev->rfkill);
1801                 rfkill_destroy(hdev->rfkill);
1802         }
1803
1804         hci_del_sysfs(hdev);
1805
1806         destroy_workqueue(hdev->workqueue);
1807
1808         hci_dev_lock(hdev);
1809         hci_blacklist_clear(hdev);
1810         hci_uuids_clear(hdev);
1811         hci_link_keys_clear(hdev);
1812         hci_smp_ltks_clear(hdev);
1813         hci_remote_oob_data_clear(hdev);
1814         hci_dev_unlock(hdev);
1815
1816         hci_dev_put(hdev);
1817 }
1818 EXPORT_SYMBOL(hci_unregister_dev);
1819
1820 /* Suspend HCI device */
1821 int hci_suspend_dev(struct hci_dev *hdev)
1822 {
1823         hci_notify(hdev, HCI_DEV_SUSPEND);
1824         return 0;
1825 }
1826 EXPORT_SYMBOL(hci_suspend_dev);
1827
1828 /* Resume HCI device */
1829 int hci_resume_dev(struct hci_dev *hdev)
1830 {
1831         hci_notify(hdev, HCI_DEV_RESUME);
1832         return 0;
1833 }
1834 EXPORT_SYMBOL(hci_resume_dev);
1835
1836 /* Receive frame from HCI drivers */
1837 int hci_recv_frame(struct sk_buff *skb)
1838 {
1839         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1840         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1841                       && !test_bit(HCI_INIT, &hdev->flags))) {
1842                 kfree_skb(skb);
1843                 return -ENXIO;
1844         }
1845
1846         /* Incomming skb */
1847         bt_cb(skb)->incoming = 1;
1848
1849         /* Time stamp */
1850         __net_timestamp(skb);
1851
1852         skb_queue_tail(&hdev->rx_q, skb);
1853         queue_work(hdev->workqueue, &hdev->rx_work);
1854
1855         return 0;
1856 }
1857 EXPORT_SYMBOL(hci_recv_frame);
1858
1859 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1860                           int count, __u8 index)
1861 {
1862         int len = 0;
1863         int hlen = 0;
1864         int remain = count;
1865         struct sk_buff *skb;
1866         struct bt_skb_cb *scb;
1867
1868         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1869             index >= NUM_REASSEMBLY)
1870                 return -EILSEQ;
1871
1872         skb = hdev->reassembly[index];
1873
1874         if (!skb) {
1875                 switch (type) {
1876                 case HCI_ACLDATA_PKT:
1877                         len = HCI_MAX_FRAME_SIZE;
1878                         hlen = HCI_ACL_HDR_SIZE;
1879                         break;
1880                 case HCI_EVENT_PKT:
1881                         len = HCI_MAX_EVENT_SIZE;
1882                         hlen = HCI_EVENT_HDR_SIZE;
1883                         break;
1884                 case HCI_SCODATA_PKT:
1885                         len = HCI_MAX_SCO_SIZE;
1886                         hlen = HCI_SCO_HDR_SIZE;
1887                         break;
1888                 }
1889
1890                 skb = bt_skb_alloc(len, GFP_ATOMIC);
1891                 if (!skb)
1892                         return -ENOMEM;
1893
1894                 scb = (void *) skb->cb;
1895                 scb->expect = hlen;
1896                 scb->pkt_type = type;
1897
1898                 skb->dev = (void *) hdev;
1899                 hdev->reassembly[index] = skb;
1900         }
1901
1902         while (count) {
1903                 scb = (void *) skb->cb;
1904                 len = min_t(uint, scb->expect, count);
1905
1906                 memcpy(skb_put(skb, len), data, len);
1907
1908                 count -= len;
1909                 data += len;
1910                 scb->expect -= len;
1911                 remain = count;
1912
1913                 switch (type) {
1914                 case HCI_EVENT_PKT:
1915                         if (skb->len == HCI_EVENT_HDR_SIZE) {
1916                                 struct hci_event_hdr *h = hci_event_hdr(skb);
1917                                 scb->expect = h->plen;
1918
1919                                 if (skb_tailroom(skb) < scb->expect) {
1920                                         kfree_skb(skb);
1921                                         hdev->reassembly[index] = NULL;
1922                                         return -ENOMEM;
1923                                 }
1924                         }
1925                         break;
1926
1927                 case HCI_ACLDATA_PKT:
1928                         if (skb->len  == HCI_ACL_HDR_SIZE) {
1929                                 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1930                                 scb->expect = __le16_to_cpu(h->dlen);
1931
1932                                 if (skb_tailroom(skb) < scb->expect) {
1933                                         kfree_skb(skb);
1934                                         hdev->reassembly[index] = NULL;
1935                                         return -ENOMEM;
1936                                 }
1937                         }
1938                         break;
1939
1940                 case HCI_SCODATA_PKT:
1941                         if (skb->len == HCI_SCO_HDR_SIZE) {
1942                                 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1943                                 scb->expect = h->dlen;
1944
1945                                 if (skb_tailroom(skb) < scb->expect) {
1946                                         kfree_skb(skb);
1947                                         hdev->reassembly[index] = NULL;
1948                                         return -ENOMEM;
1949                                 }
1950                         }
1951                         break;
1952                 }
1953
1954                 if (scb->expect == 0) {
1955                         /* Complete frame */
1956
1957                         bt_cb(skb)->pkt_type = type;
1958                         hci_recv_frame(skb);
1959
1960                         hdev->reassembly[index] = NULL;
1961                         return remain;
1962                 }
1963         }
1964
1965         return remain;
1966 }
1967
1968 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1969 {
1970         int rem = 0;
1971
1972         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1973                 return -EILSEQ;
1974
1975         while (count) {
1976                 rem = hci_reassembly(hdev, type, data, count, type - 1);
1977                 if (rem < 0)
1978                         return rem;
1979
1980                 data += (count - rem);
1981                 count = rem;
1982         }
1983
1984         return rem;
1985 }
1986 EXPORT_SYMBOL(hci_recv_fragment);
1987
1988 #define STREAM_REASSEMBLY 0
1989
1990 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1991 {
1992         int type;
1993         int rem = 0;
1994
1995         while (count) {
1996                 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1997
1998                 if (!skb) {
1999                         struct { char type; } *pkt;
2000
2001                         /* Start of the frame */
2002                         pkt = data;
2003                         type = pkt->type;
2004
2005                         data++;
2006                         count--;
2007                 } else
2008                         type = bt_cb(skb)->pkt_type;
2009
2010                 rem = hci_reassembly(hdev, type, data, count,
2011                                      STREAM_REASSEMBLY);
2012                 if (rem < 0)
2013                         return rem;
2014
2015                 data += (count - rem);
2016                 count = rem;
2017         }
2018
2019         return rem;
2020 }
2021 EXPORT_SYMBOL(hci_recv_stream_fragment);
2022
2023 /* ---- Interface to upper protocols ---- */
2024
2025 int hci_register_cb(struct hci_cb *cb)
2026 {
2027         BT_DBG("%p name %s", cb, cb->name);
2028
2029         write_lock(&hci_cb_list_lock);
2030         list_add(&cb->list, &hci_cb_list);
2031         write_unlock(&hci_cb_list_lock);
2032
2033         return 0;
2034 }
2035 EXPORT_SYMBOL(hci_register_cb);
2036
2037 int hci_unregister_cb(struct hci_cb *cb)
2038 {
2039         BT_DBG("%p name %s", cb, cb->name);
2040
2041         write_lock(&hci_cb_list_lock);
2042         list_del(&cb->list);
2043         write_unlock(&hci_cb_list_lock);
2044
2045         return 0;
2046 }
2047 EXPORT_SYMBOL(hci_unregister_cb);
2048
2049 static int hci_send_frame(struct sk_buff *skb)
2050 {
2051         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2052
2053         if (!hdev) {
2054                 kfree_skb(skb);
2055                 return -ENODEV;
2056         }
2057
2058         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
2059
2060         /* Time stamp */
2061         __net_timestamp(skb);
2062
2063         /* Send copy to monitor */
2064         hci_send_to_monitor(hdev, skb);
2065
2066         if (atomic_read(&hdev->promisc)) {
2067                 /* Send copy to the sockets */
2068                 hci_send_to_sock(hdev, skb);
2069         }
2070
2071         /* Get rid of skb owner, prior to sending to the driver. */
2072         skb_orphan(skb);
2073
2074         return hdev->send(skb);
2075 }
2076
2077 /* Send HCI command */
2078 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
2079 {
2080         int len = HCI_COMMAND_HDR_SIZE + plen;
2081         struct hci_command_hdr *hdr;
2082         struct sk_buff *skb;
2083
2084         BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
2085
2086         skb = bt_skb_alloc(len, GFP_ATOMIC);
2087         if (!skb) {
2088                 BT_ERR("%s no memory for command", hdev->name);
2089                 return -ENOMEM;
2090         }
2091
2092         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
2093         hdr->opcode = cpu_to_le16(opcode);
2094         hdr->plen   = plen;
2095
2096         if (plen)
2097                 memcpy(skb_put(skb, plen), param, plen);
2098
2099         BT_DBG("skb len %d", skb->len);
2100
2101         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
2102         skb->dev = (void *) hdev;
2103
2104         if (test_bit(HCI_INIT, &hdev->flags))
2105                 hdev->init_last_cmd = opcode;
2106
2107         skb_queue_tail(&hdev->cmd_q, skb);
2108         queue_work(hdev->workqueue, &hdev->cmd_work);
2109
2110         return 0;
2111 }
2112
2113 /* Get data from the previously sent command */
2114 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
2115 {
2116         struct hci_command_hdr *hdr;
2117
2118         if (!hdev->sent_cmd)
2119                 return NULL;
2120
2121         hdr = (void *) hdev->sent_cmd->data;
2122
2123         if (hdr->opcode != cpu_to_le16(opcode))
2124                 return NULL;
2125
2126         BT_DBG("%s opcode 0x%x", hdev->name, opcode);
2127
2128         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2129 }
2130
2131 /* Send ACL data */
2132 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2133 {
2134         struct hci_acl_hdr *hdr;
2135         int len = skb->len;
2136
2137         skb_push(skb, HCI_ACL_HDR_SIZE);
2138         skb_reset_transport_header(skb);
2139         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
2140         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2141         hdr->dlen   = cpu_to_le16(len);
2142 }
2143
2144 static void hci_queue_acl(struct hci_conn *conn, struct sk_buff_head *queue,
2145                           struct sk_buff *skb, __u16 flags)
2146 {
2147         struct hci_dev *hdev = conn->hdev;
2148         struct sk_buff *list;
2149
2150         skb->len = skb_headlen(skb);
2151         skb->data_len = 0;
2152
2153         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2154         hci_add_acl_hdr(skb, conn->handle, flags);
2155
2156         list = skb_shinfo(skb)->frag_list;
2157         if (!list) {
2158                 /* Non fragmented */
2159                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2160
2161                 skb_queue_tail(queue, skb);
2162         } else {
2163                 /* Fragmented */
2164                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2165
2166                 skb_shinfo(skb)->frag_list = NULL;
2167
2168                 /* Queue all fragments atomically */
2169                 spin_lock(&queue->lock);
2170
2171                 __skb_queue_tail(queue, skb);
2172
2173                 flags &= ~ACL_START;
2174                 flags |= ACL_CONT;
2175                 do {
2176                         skb = list; list = list->next;
2177
2178                         skb->dev = (void *) hdev;
2179                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2180                         hci_add_acl_hdr(skb, conn->handle, flags);
2181
2182                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2183
2184                         __skb_queue_tail(queue, skb);
2185                 } while (list);
2186
2187                 spin_unlock(&queue->lock);
2188         }
2189 }
2190
2191 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2192 {
2193         struct hci_conn *conn = chan->conn;
2194         struct hci_dev *hdev = conn->hdev;
2195
2196         BT_DBG("%s chan %p flags 0x%x", hdev->name, chan, flags);
2197
2198         skb->dev = (void *) hdev;
2199
2200         hci_queue_acl(conn, &chan->data_q, skb, flags);
2201
2202         queue_work(hdev->workqueue, &hdev->tx_work);
2203 }
2204 EXPORT_SYMBOL(hci_send_acl);
2205
2206 /* Send SCO data */
2207 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2208 {
2209         struct hci_dev *hdev = conn->hdev;
2210         struct hci_sco_hdr hdr;
2211
2212         BT_DBG("%s len %d", hdev->name, skb->len);
2213
2214         hdr.handle = cpu_to_le16(conn->handle);
2215         hdr.dlen   = skb->len;
2216
2217         skb_push(skb, HCI_SCO_HDR_SIZE);
2218         skb_reset_transport_header(skb);
2219         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2220
2221         skb->dev = (void *) hdev;
2222         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2223
2224         skb_queue_tail(&conn->data_q, skb);
2225         queue_work(hdev->workqueue, &hdev->tx_work);
2226 }
2227 EXPORT_SYMBOL(hci_send_sco);
2228
2229 /* ---- HCI TX task (outgoing data) ---- */
2230
2231 /* HCI Connection scheduler */
2232 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
2233                                      int *quote)
2234 {
2235         struct hci_conn_hash *h = &hdev->conn_hash;
2236         struct hci_conn *conn = NULL, *c;
2237         unsigned int num = 0, min = ~0;
2238
2239         /* We don't have to lock device here. Connections are always
2240          * added and removed with TX task disabled. */
2241
2242         rcu_read_lock();
2243
2244         list_for_each_entry_rcu(c, &h->list, list) {
2245                 if (c->type != type || skb_queue_empty(&c->data_q))
2246                         continue;
2247
2248                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2249                         continue;
2250
2251                 num++;
2252
2253                 if (c->sent < min) {
2254                         min  = c->sent;
2255                         conn = c;
2256                 }
2257
2258                 if (hci_conn_num(hdev, type) == num)
2259                         break;
2260         }
2261
2262         rcu_read_unlock();
2263
2264         if (conn) {
2265                 int cnt, q;
2266
2267                 switch (conn->type) {
2268                 case ACL_LINK:
2269                         cnt = hdev->acl_cnt;
2270                         break;
2271                 case SCO_LINK:
2272                 case ESCO_LINK:
2273                         cnt = hdev->sco_cnt;
2274                         break;
2275                 case LE_LINK:
2276                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2277                         break;
2278                 default:
2279                         cnt = 0;
2280                         BT_ERR("Unknown link type");
2281                 }
2282
2283                 q = cnt / num;
2284                 *quote = q ? q : 1;
2285         } else
2286                 *quote = 0;
2287
2288         BT_DBG("conn %p quote %d", conn, *quote);
2289         return conn;
2290 }
2291
2292 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2293 {
2294         struct hci_conn_hash *h = &hdev->conn_hash;
2295         struct hci_conn *c;
2296
2297         BT_ERR("%s link tx timeout", hdev->name);
2298
2299         rcu_read_lock();
2300
2301         /* Kill stalled connections */
2302         list_for_each_entry_rcu(c, &h->list, list) {
2303                 if (c->type == type && c->sent) {
2304                         BT_ERR("%s killing stalled connection %s",
2305                                hdev->name, batostr(&c->dst));
2306                         hci_acl_disconn(c, 0x13);
2307                 }
2308         }
2309
2310         rcu_read_unlock();
2311 }
2312
2313 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2314                                       int *quote)
2315 {
2316         struct hci_conn_hash *h = &hdev->conn_hash;
2317         struct hci_chan *chan = NULL;
2318         unsigned int num = 0, min = ~0, cur_prio = 0;
2319         struct hci_conn *conn;
2320         int cnt, q, conn_num = 0;
2321
2322         BT_DBG("%s", hdev->name);
2323
2324         rcu_read_lock();
2325
2326         list_for_each_entry_rcu(conn, &h->list, list) {
2327                 struct hci_chan *tmp;
2328
2329                 if (conn->type != type)
2330                         continue;
2331
2332                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2333                         continue;
2334
2335                 conn_num++;
2336
2337                 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2338                         struct sk_buff *skb;
2339
2340                         if (skb_queue_empty(&tmp->data_q))
2341                                 continue;
2342
2343                         skb = skb_peek(&tmp->data_q);
2344                         if (skb->priority < cur_prio)
2345                                 continue;
2346
2347                         if (skb->priority > cur_prio) {
2348                                 num = 0;
2349                                 min = ~0;
2350                                 cur_prio = skb->priority;
2351                         }
2352
2353                         num++;
2354
2355                         if (conn->sent < min) {
2356                                 min  = conn->sent;
2357                                 chan = tmp;
2358                         }
2359                 }
2360
2361                 if (hci_conn_num(hdev, type) == conn_num)
2362                         break;
2363         }
2364
2365         rcu_read_unlock();
2366
2367         if (!chan)
2368                 return NULL;
2369
2370         switch (chan->conn->type) {
2371         case ACL_LINK:
2372                 cnt = hdev->acl_cnt;
2373                 break;
2374         case SCO_LINK:
2375         case ESCO_LINK:
2376                 cnt = hdev->sco_cnt;
2377                 break;
2378         case LE_LINK:
2379                 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2380                 break;
2381         default:
2382                 cnt = 0;
2383                 BT_ERR("Unknown link type");
2384         }
2385
2386         q = cnt / num;
2387         *quote = q ? q : 1;
2388         BT_DBG("chan %p quote %d", chan, *quote);
2389         return chan;
2390 }
2391
2392 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2393 {
2394         struct hci_conn_hash *h = &hdev->conn_hash;
2395         struct hci_conn *conn;
2396         int num = 0;
2397
2398         BT_DBG("%s", hdev->name);
2399
2400         rcu_read_lock();
2401
2402         list_for_each_entry_rcu(conn, &h->list, list) {
2403                 struct hci_chan *chan;
2404
2405                 if (conn->type != type)
2406                         continue;
2407
2408                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2409                         continue;
2410
2411                 num++;
2412
2413                 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
2414                         struct sk_buff *skb;
2415
2416                         if (chan->sent) {
2417                                 chan->sent = 0;
2418                                 continue;
2419                         }
2420
2421                         if (skb_queue_empty(&chan->data_q))
2422                                 continue;
2423
2424                         skb = skb_peek(&chan->data_q);
2425                         if (skb->priority >= HCI_PRIO_MAX - 1)
2426                                 continue;
2427
2428                         skb->priority = HCI_PRIO_MAX - 1;
2429
2430                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
2431                                skb->priority);
2432                 }
2433
2434                 if (hci_conn_num(hdev, type) == num)
2435                         break;
2436         }
2437
2438         rcu_read_unlock();
2439
2440 }
2441
2442 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
2443 {
2444         /* Calculate count of blocks used by this packet */
2445         return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
2446 }
2447
2448 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
2449 {
2450         if (!test_bit(HCI_RAW, &hdev->flags)) {
2451                 /* ACL tx timeout must be longer than maximum
2452                  * link supervision timeout (40.9 seconds) */
2453                 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
2454                                        msecs_to_jiffies(HCI_ACL_TX_TIMEOUT)))
2455                         hci_link_tx_to(hdev, ACL_LINK);
2456         }
2457 }
2458
2459 static void hci_sched_acl_pkt(struct hci_dev *hdev)
2460 {
2461         unsigned int cnt = hdev->acl_cnt;
2462         struct hci_chan *chan;
2463         struct sk_buff *skb;
2464         int quote;
2465
2466         __check_timeout(hdev, cnt);
2467
2468         while (hdev->acl_cnt &&
2469                (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2470                 u32 priority = (skb_peek(&chan->data_q))->priority;
2471                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2472                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2473                                skb->len, skb->priority);
2474
2475                         /* Stop if priority has changed */
2476                         if (skb->priority < priority)
2477                                 break;
2478
2479                         skb = skb_dequeue(&chan->data_q);
2480
2481                         hci_conn_enter_active_mode(chan->conn,
2482                                                    bt_cb(skb)->force_active);
2483
2484                         hci_send_frame(skb);
2485                         hdev->acl_last_tx = jiffies;
2486
2487                         hdev->acl_cnt--;
2488                         chan->sent++;
2489                         chan->conn->sent++;
2490                 }
2491         }
2492
2493         if (cnt != hdev->acl_cnt)
2494                 hci_prio_recalculate(hdev, ACL_LINK);
2495 }
2496
2497 static void hci_sched_acl_blk(struct hci_dev *hdev)
2498 {
2499         unsigned int cnt = hdev->block_cnt;
2500         struct hci_chan *chan;
2501         struct sk_buff *skb;
2502         int quote;
2503
2504         __check_timeout(hdev, cnt);
2505
2506         while (hdev->block_cnt > 0 &&
2507                (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
2508                 u32 priority = (skb_peek(&chan->data_q))->priority;
2509                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
2510                         int blocks;
2511
2512                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2513                                skb->len, skb->priority);
2514
2515                         /* Stop if priority has changed */
2516                         if (skb->priority < priority)
2517                                 break;
2518
2519                         skb = skb_dequeue(&chan->data_q);
2520
2521                         blocks = __get_blocks(hdev, skb);
2522                         if (blocks > hdev->block_cnt)
2523                                 return;
2524
2525                         hci_conn_enter_active_mode(chan->conn,
2526                                                    bt_cb(skb)->force_active);
2527
2528                         hci_send_frame(skb);
2529                         hdev->acl_last_tx = jiffies;
2530
2531                         hdev->block_cnt -= blocks;
2532                         quote -= blocks;
2533
2534                         chan->sent += blocks;
2535                         chan->conn->sent += blocks;
2536                 }
2537         }
2538
2539         if (cnt != hdev->block_cnt)
2540                 hci_prio_recalculate(hdev, ACL_LINK);
2541 }
2542
2543 static void hci_sched_acl(struct hci_dev *hdev)
2544 {
2545         BT_DBG("%s", hdev->name);
2546
2547         if (!hci_conn_num(hdev, ACL_LINK))
2548                 return;
2549
2550         switch (hdev->flow_ctl_mode) {
2551         case HCI_FLOW_CTL_MODE_PACKET_BASED:
2552                 hci_sched_acl_pkt(hdev);
2553                 break;
2554
2555         case HCI_FLOW_CTL_MODE_BLOCK_BASED:
2556                 hci_sched_acl_blk(hdev);
2557                 break;
2558         }
2559 }
2560
2561 /* Schedule SCO */
2562 static void hci_sched_sco(struct hci_dev *hdev)
2563 {
2564         struct hci_conn *conn;
2565         struct sk_buff *skb;
2566         int quote;
2567
2568         BT_DBG("%s", hdev->name);
2569
2570         if (!hci_conn_num(hdev, SCO_LINK))
2571                 return;
2572
2573         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2574                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2575                         BT_DBG("skb %p len %d", skb, skb->len);
2576                         hci_send_frame(skb);
2577
2578                         conn->sent++;
2579                         if (conn->sent == ~0)
2580                                 conn->sent = 0;
2581                 }
2582         }
2583 }
2584
2585 static void hci_sched_esco(struct hci_dev *hdev)
2586 {
2587         struct hci_conn *conn;
2588         struct sk_buff *skb;
2589         int quote;
2590
2591         BT_DBG("%s", hdev->name);
2592
2593         if (!hci_conn_num(hdev, ESCO_LINK))
2594                 return;
2595
2596         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
2597                                                      &quote))) {
2598                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2599                         BT_DBG("skb %p len %d", skb, skb->len);
2600                         hci_send_frame(skb);
2601
2602                         conn->sent++;
2603                         if (conn->sent == ~0)
2604                                 conn->sent = 0;
2605                 }
2606         }
2607 }
2608
2609 static void hci_sched_le(struct hci_dev *hdev)
2610 {
2611         struct hci_chan *chan;
2612         struct sk_buff *skb;
2613         int quote, cnt, tmp;
2614
2615         BT_DBG("%s", hdev->name);
2616
2617         if (!hci_conn_num(hdev, LE_LINK))
2618                 return;
2619
2620         if (!test_bit(HCI_RAW, &hdev->flags)) {
2621                 /* LE tx timeout must be longer than maximum
2622                  * link supervision timeout (40.9 seconds) */
2623                 if (!hdev->le_cnt && hdev->le_pkts &&
2624                     time_after(jiffies, hdev->le_last_tx + HZ * 45))
2625                         hci_link_tx_to(hdev, LE_LINK);
2626         }
2627
2628         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2629         tmp = cnt;
2630         while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
2631                 u32 priority = (skb_peek(&chan->data_q))->priority;
2632                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
2633                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
2634                                skb->len, skb->priority);
2635
2636                         /* Stop if priority has changed */
2637                         if (skb->priority < priority)
2638                                 break;
2639
2640                         skb = skb_dequeue(&chan->data_q);
2641
2642                         hci_send_frame(skb);
2643                         hdev->le_last_tx = jiffies;
2644
2645                         cnt--;
2646                         chan->sent++;
2647                         chan->conn->sent++;
2648                 }
2649         }
2650
2651         if (hdev->le_pkts)
2652                 hdev->le_cnt = cnt;
2653         else
2654                 hdev->acl_cnt = cnt;
2655
2656         if (cnt != tmp)
2657                 hci_prio_recalculate(hdev, LE_LINK);
2658 }
2659
2660 static void hci_tx_work(struct work_struct *work)
2661 {
2662         struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
2663         struct sk_buff *skb;
2664
2665         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2666                hdev->sco_cnt, hdev->le_cnt);
2667
2668         /* Schedule queues and send stuff to HCI driver */
2669
2670         hci_sched_acl(hdev);
2671
2672         hci_sched_sco(hdev);
2673
2674         hci_sched_esco(hdev);
2675
2676         hci_sched_le(hdev);
2677
2678         /* Send next queued raw (unknown type) packet */
2679         while ((skb = skb_dequeue(&hdev->raw_q)))
2680                 hci_send_frame(skb);
2681 }
2682
2683 /* ----- HCI RX task (incoming data processing) ----- */
2684
2685 /* ACL data packet */
2686 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2687 {
2688         struct hci_acl_hdr *hdr = (void *) skb->data;
2689         struct hci_conn *conn;
2690         __u16 handle, flags;
2691
2692         skb_pull(skb, HCI_ACL_HDR_SIZE);
2693
2694         handle = __le16_to_cpu(hdr->handle);
2695         flags  = hci_flags(handle);
2696         handle = hci_handle(handle);
2697
2698         BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len,
2699                handle, flags);
2700
2701         hdev->stat.acl_rx++;
2702
2703         hci_dev_lock(hdev);
2704         conn = hci_conn_hash_lookup_handle(hdev, handle);
2705         hci_dev_unlock(hdev);
2706
2707         if (conn) {
2708                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
2709
2710                 hci_dev_lock(hdev);
2711                 if (test_bit(HCI_MGMT, &hdev->dev_flags) &&
2712                     !test_and_set_bit(HCI_CONN_MGMT_CONNECTED, &conn->flags))
2713                         mgmt_device_connected(hdev, &conn->dst, conn->type,
2714                                               conn->dst_type, 0, NULL, 0,
2715                                               conn->dev_class);
2716                 hci_dev_unlock(hdev);
2717
2718                 /* Send to upper protocol */
2719                 l2cap_recv_acldata(conn, skb, flags);
2720                 return;
2721         } else {
2722                 BT_ERR("%s ACL packet for unknown connection handle %d",
2723                        hdev->name, handle);
2724         }
2725
2726         kfree_skb(skb);
2727 }
2728
2729 /* SCO data packet */
2730 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2731 {
2732         struct hci_sco_hdr *hdr = (void *) skb->data;
2733         struct hci_conn *conn;
2734         __u16 handle;
2735
2736         skb_pull(skb, HCI_SCO_HDR_SIZE);
2737
2738         handle = __le16_to_cpu(hdr->handle);
2739
2740         BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2741
2742         hdev->stat.sco_rx++;
2743
2744         hci_dev_lock(hdev);
2745         conn = hci_conn_hash_lookup_handle(hdev, handle);
2746         hci_dev_unlock(hdev);
2747
2748         if (conn) {
2749                 /* Send to upper protocol */
2750                 sco_recv_scodata(conn, skb);
2751                 return;
2752         } else {
2753                 BT_ERR("%s SCO packet for unknown connection handle %d",
2754                        hdev->name, handle);
2755         }
2756
2757         kfree_skb(skb);
2758 }
2759
2760 static void hci_rx_work(struct work_struct *work)
2761 {
2762         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
2763         struct sk_buff *skb;
2764
2765         BT_DBG("%s", hdev->name);
2766
2767         while ((skb = skb_dequeue(&hdev->rx_q))) {
2768                 /* Send copy to monitor */
2769                 hci_send_to_monitor(hdev, skb);
2770
2771                 if (atomic_read(&hdev->promisc)) {
2772                         /* Send copy to the sockets */
2773                         hci_send_to_sock(hdev, skb);
2774                 }
2775
2776                 if (test_bit(HCI_RAW, &hdev->flags)) {
2777                         kfree_skb(skb);
2778                         continue;
2779                 }
2780
2781                 if (test_bit(HCI_INIT, &hdev->flags)) {
2782                         /* Don't process data packets in this states. */
2783                         switch (bt_cb(skb)->pkt_type) {
2784                         case HCI_ACLDATA_PKT:
2785                         case HCI_SCODATA_PKT:
2786                                 kfree_skb(skb);
2787                                 continue;
2788                         }
2789                 }
2790
2791                 /* Process frame */
2792                 switch (bt_cb(skb)->pkt_type) {
2793                 case HCI_EVENT_PKT:
2794                         BT_DBG("%s Event packet", hdev->name);
2795                         hci_event_packet(hdev, skb);
2796                         break;
2797
2798                 case HCI_ACLDATA_PKT:
2799                         BT_DBG("%s ACL data packet", hdev->name);
2800                         hci_acldata_packet(hdev, skb);
2801                         break;
2802
2803                 case HCI_SCODATA_PKT:
2804                         BT_DBG("%s SCO data packet", hdev->name);
2805                         hci_scodata_packet(hdev, skb);
2806                         break;
2807
2808                 default:
2809                         kfree_skb(skb);
2810                         break;
2811                 }
2812         }
2813 }
2814
2815 static void hci_cmd_work(struct work_struct *work)
2816 {
2817         struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
2818         struct sk_buff *skb;
2819
2820         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2821
2822         /* Send queued commands */
2823         if (atomic_read(&hdev->cmd_cnt)) {
2824                 skb = skb_dequeue(&hdev->cmd_q);
2825                 if (!skb)
2826                         return;
2827
2828                 kfree_skb(hdev->sent_cmd);
2829
2830                 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2831                 if (hdev->sent_cmd) {
2832                         atomic_dec(&hdev->cmd_cnt);
2833                         hci_send_frame(skb);
2834                         if (test_bit(HCI_RESET, &hdev->flags))
2835                                 del_timer(&hdev->cmd_timer);
2836                         else
2837                                 mod_timer(&hdev->cmd_timer,
2838                                   jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2839                 } else {
2840                         skb_queue_head(&hdev->cmd_q, skb);
2841                         queue_work(hdev->workqueue, &hdev->cmd_work);
2842                 }
2843         }
2844 }
2845
2846 int hci_do_inquiry(struct hci_dev *hdev, u8 length)
2847 {
2848         /* General inquiry access code (GIAC) */
2849         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2850         struct hci_cp_inquiry cp;
2851
2852         BT_DBG("%s", hdev->name);
2853
2854         if (test_bit(HCI_INQUIRY, &hdev->flags))
2855                 return -EINPROGRESS;
2856
2857         inquiry_cache_flush(hdev);
2858
2859         memset(&cp, 0, sizeof(cp));
2860         memcpy(&cp.lap, lap, sizeof(cp.lap));
2861         cp.length  = length;
2862
2863         return hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
2864 }
2865
2866 int hci_cancel_inquiry(struct hci_dev *hdev)
2867 {
2868         BT_DBG("%s", hdev->name);
2869
2870         if (!test_bit(HCI_INQUIRY, &hdev->flags))
2871                 return -EALREADY;
2872
2873         return hci_send_cmd(hdev, HCI_OP_INQUIRY_CANCEL, 0, NULL);
2874 }
2875
2876 u8 bdaddr_to_le(u8 bdaddr_type)
2877 {
2878         switch (bdaddr_type) {
2879         case BDADDR_LE_PUBLIC:
2880                 return ADDR_LE_DEV_PUBLIC;
2881
2882         default:
2883                 /* Fallback to LE Random address type */
2884                 return ADDR_LE_DEV_RANDOM;
2885         }
2886 }