net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4
   5    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   6
   7    This program is free software; you can redistribute it and/or modify
   8    it under the terms of the GNU General Public License version 2 as
   9    published by the Free Software Foundation;
  10
  11    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  12    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  13    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  14    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  15    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  16    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  17    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  18    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  19
  20    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  21    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  22    SOFTWARE IS DISCLAIMED.
  23 */
  24
  25 /* Bluetooth HCI core. */
  26
  27 #include <linux/jiffies.h>
  28 #include <linux/module.h>
  29 #include <linux/kmod.h>
  30
  31 #include <linux/types.h>
  32 #include <linux/errno.h>
  33 #include <linux/kernel.h>
  34 #include <linux/sched.h>
  35 #include <linux/slab.h>
  36 #include <linux/poll.h>
  37 #include <linux/fcntl.h>
  38 #include <linux/init.h>
  39 #include <linux/skbuff.h>
  40 #include <linux/workqueue.h>
  41 #include <linux/interrupt.h>
  42 #include <linux/notifier.h>
  43 #include <linux/rfkill.h>
  44 #include <linux/timer.h>
  45 #include <linux/crypto.h>
  46 #include <net/sock.h>
  47
  48 #include <asm/system.h>
  49 #include <linux/uaccess.h>
  50 #include <asm/unaligned.h>
  51
  52 #include <net/bluetooth/bluetooth.h>
  53 #include <net/bluetooth/hci_core.h>
  54
  55 #define AUTO_OFF_TIMEOUT 2000
  56
  57 static void hci_cmd_task(unsigned long arg);
  58 static void hci_rx_task(unsigned long arg);
  59 static void hci_tx_task(unsigned long arg);
  60
  61 static DEFINE_RWLOCK(hci_task_lock);
  62
  63 static int enable_smp;
  64
  65 /* HCI device list */
  66 LIST_HEAD(hci_dev_list);
  67 DEFINE_RWLOCK(hci_dev_list_lock);
  68
  69 /* HCI callback list */
  70 LIST_HEAD(hci_cb_list);
  71 DEFINE_RWLOCK(hci_cb_list_lock);
  72
  73 /* HCI protocols */
  74 #define HCI_MAX_PROTO   2
  75 struct hci_proto *hci_proto[HCI_MAX_PROTO];
  76
  77 /* HCI notifiers list */
  78 static ATOMIC_NOTIFIER_HEAD(hci_notifier);
  79
  80 /* ---- HCI notifications ---- */
  81
  82 int hci_register_notifier(struct notifier_block *nb)
  83 {
  84         return atomic_notifier_chain_register(&hci_notifier, nb);
  85 }
  86
  87 int hci_unregister_notifier(struct notifier_block *nb)
  88 {
  89         return atomic_notifier_chain_unregister(&hci_notifier, nb);
  90 }
  91
  92 static void hci_notify(struct hci_dev *hdev, int event)
  93 {
  94         atomic_notifier_call_chain(&hci_notifier, event, hdev);
  95 }
  96
  97 /* ---- HCI requests ---- */
  98
  99 void hci_req_complete(struct hci_dev *hdev, __u16 cmd, int result)
 100 {
 101         BT_DBG("%s command 0x%04x result 0x%2.2x", hdev->name, cmd, result);
 102
 103         /* If this is the init phase check if the completed command matches
 104          * the last init command, and if not just return.
 105          */
 106         if (test_bit(HCI_INIT, &hdev->flags) && hdev->init_last_cmd != cmd)
 107                 return;
 108
 109         if (hdev->req_status == HCI_REQ_PEND) {
 110                 hdev->req_result = result;
 111                 hdev->req_status = HCI_REQ_DONE;
 112                 wake_up_interruptible(&hdev->req_wait_q);
 113         }
 114 }
 115
 116 static void hci_req_cancel(struct hci_dev *hdev, int err)
 117 {
 118         BT_DBG("%s err 0x%2.2x", hdev->name, err);
 119
 120         if (hdev->req_status == HCI_REQ_PEND) {
 121                 hdev->req_result = err;
 122                 hdev->req_status = HCI_REQ_CANCELED;
 123                 wake_up_interruptible(&hdev->req_wait_q);
 124         }
 125 }
 126
 127 /* Execute request and wait for completion. */
 128 static int __hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 129                                         unsigned long opt, __u32 timeout)
 130 {
 131         DECLARE_WAITQUEUE(wait, current);
 132         int err = 0;
 133
 134         BT_DBG("%s start", hdev->name);
 135
 136         hdev->req_status = HCI_REQ_PEND;
 137
 138         add_wait_queue(&hdev->req_wait_q, &wait);
 139         set_current_state(TASK_INTERRUPTIBLE);
 140
 141         req(hdev, opt);
 142         schedule_timeout(timeout);
 143
 144         remove_wait_queue(&hdev->req_wait_q, &wait);
 145
 146         if (signal_pending(current))
 147                 return -EINTR;
 148
 149         switch (hdev->req_status) {
 150         case HCI_REQ_DONE:
 151                 err = -bt_err(hdev->req_result);
 152                 break;
 153
 154         case HCI_REQ_CANCELED:
 155                 err = -hdev->req_result;
 156                 break;
 157
 158         default:
 159                 err = -ETIMEDOUT;
 160                 break;
 161         }
 162
 163         hdev->req_status = hdev->req_result = 0;
 164
 165         BT_DBG("%s end: err %d", hdev->name, err);
 166
 167         return err;
 168 }
 169
 170 static inline int hci_request(struct hci_dev *hdev, void (*req)(struct hci_dev *hdev, unsigned long opt),
 171                                         unsigned long opt, __u32 timeout)
 172 {
 173         int ret;
 174
 175         if (!test_bit(HCI_UP, &hdev->flags))
 176                 return -ENETDOWN;
 177
 178         /* Serialize all requests */
 179         hci_req_lock(hdev);
 180         ret = __hci_request(hdev, req, opt, timeout);
 181         hci_req_unlock(hdev);
 182
 183         return ret;
 184 }
 185
 186 static void hci_reset_req(struct hci_dev *hdev, unsigned long opt)
 187 {
 188         BT_DBG("%s %ld", hdev->name, opt);
 189
 190         /* Reset device */
 191         set_bit(HCI_RESET, &hdev->flags);
 192         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 193 }
 194
 195 static void hci_init_req(struct hci_dev *hdev, unsigned long opt)
 196 {
 197         struct hci_cp_delete_stored_link_key cp;
 198         struct sk_buff *skb;
 199         __le16 param;
 200         __u8 flt_type;
 201
 202         BT_DBG("%s %ld", hdev->name, opt);
 203
 204         /* Driver initialization */
 205
 206         /* Special commands */
 207         while ((skb = skb_dequeue(&hdev->driver_init))) {
 208                 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
 209                 skb->dev = (void *) hdev;
 210
 211                 skb_queue_tail(&hdev->cmd_q, skb);
 212                 tasklet_schedule(&hdev->cmd_task);
 213         }
 214         skb_queue_purge(&hdev->driver_init);
 215
 216         /* Mandatory initialization */
 217
 218         /* Reset */
 219         if (!test_bit(HCI_QUIRK_NO_RESET, &hdev->quirks)) {
 220                         set_bit(HCI_RESET, &hdev->flags);
 221                         hci_send_cmd(hdev, HCI_OP_RESET, 0, NULL);
 222         }
 223
 224         /* Read Local Supported Features */
 225         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 226
 227         /* Read Local Version */
 228         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 229
 230         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 231         hci_send_cmd(hdev, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 232
 233 #if 0
 234         /* Host buffer size */
 235         {
 236                 struct hci_cp_host_buffer_size cp;
 237                 cp.acl_mtu = cpu_to_le16(HCI_MAX_ACL_SIZE);
 238                 cp.sco_mtu = HCI_MAX_SCO_SIZE;
 239                 cp.acl_max_pkt = cpu_to_le16(0xffff);
 240                 cp.sco_max_pkt = cpu_to_le16(0xffff);
 241                 hci_send_cmd(hdev, HCI_OP_HOST_BUFFER_SIZE, sizeof(cp), &cp);
 242         }
 243 #endif
 244
 245         /* Read BD Address */
 246         hci_send_cmd(hdev, HCI_OP_READ_BD_ADDR, 0, NULL);
 247
 248         /* Read Class of Device */
 249         hci_send_cmd(hdev, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 250
 251         /* Read Local Name */
 252         hci_send_cmd(hdev, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 253
 254         /* Read Voice Setting */
 255         hci_send_cmd(hdev, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 256
 257         /* Optional initialization */
 258
 259         /* Clear Event Filters */
 260         flt_type = HCI_FLT_CLEAR_ALL;
 261         hci_send_cmd(hdev, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 262
 263         /* Connection accept timeout ~20 secs */
 264         param = cpu_to_le16(0x7d00);
 265         hci_send_cmd(hdev, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 266
 267         bacpy(&cp.bdaddr, BDADDR_ANY);
 268         cp.delete_all = 1;
 269         hci_send_cmd(hdev, HCI_OP_DELETE_STORED_LINK_KEY, sizeof(cp), &cp);
 270 }
 271
 272 static void hci_le_init_req(struct hci_dev *hdev, unsigned long opt)
 273 {
 274         BT_DBG("%s", hdev->name);
 275
 276         /* Read LE buffer size */
 277         hci_send_cmd(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 278 }
 279
 280 static void hci_scan_req(struct hci_dev *hdev, unsigned long opt)
 281 {
 282         __u8 scan = opt;
 283
 284         BT_DBG("%s %x", hdev->name, scan);
 285
 286         /* Inquiry and Page scans */
 287         hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 288 }
 289
 290 static void hci_auth_req(struct hci_dev *hdev, unsigned long opt)
 291 {
 292         __u8 auth = opt;
 293
 294         BT_DBG("%s %x", hdev->name, auth);
 295
 296         /* Authentication */
 297         hci_send_cmd(hdev, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 298 }
 299
 300 static void hci_encrypt_req(struct hci_dev *hdev, unsigned long opt)
 301 {
 302         __u8 encrypt = opt;
 303
 304         BT_DBG("%s %x", hdev->name, encrypt);
 305
 306         /* Encryption */
 307         hci_send_cmd(hdev, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 308 }
 309
 310 static void hci_linkpol_req(struct hci_dev *hdev, unsigned long opt)
 311 {
 312         __le16 policy = cpu_to_le16(opt);
 313
 314         BT_DBG("%s %x", hdev->name, policy);
 315
 316         /* Default link policy */
 317         hci_send_cmd(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 318 }
 319
 320 /* Get HCI device by index.
 321  * Device is held on return. */
 322 struct hci_dev *hci_dev_get(int index)
 323 {
 324         struct hci_dev *hdev = NULL;
 325         struct list_head *p;
 326
 327         BT_DBG("%d", index);
 328
 329         if (index < 0)
 330                 return NULL;
 331
 332         read_lock(&hci_dev_list_lock);
 333         list_for_each(p, &hci_dev_list) {
 334                 struct hci_dev *d = list_entry(p, struct hci_dev, list);
 335                 if (d->id == index) {
 336                         hdev = hci_dev_hold(d);
 337                         break;
 338                 }
 339         }
 340         read_unlock(&hci_dev_list_lock);
 341         return hdev;
 342 }
 343
 344 /* ---- Inquiry support ---- */
 345 static void inquiry_cache_flush(struct hci_dev *hdev)
 346 {
 347         struct inquiry_cache *cache = &hdev->inq_cache;
 348         struct inquiry_entry *next  = cache->list, *e;
 349
 350         BT_DBG("cache %p", cache);
 351
 352         cache->list = NULL;
 353         while ((e = next)) {
 354                 next = e->next;
 355                 kfree(e);
 356         }
 357 }
 358
 359 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
 360 {
 361         struct inquiry_cache *cache = &hdev->inq_cache;
 362         struct inquiry_entry *e;
 363
 364         BT_DBG("cache %p, %s", cache, batostr(bdaddr));
 365
 366         for (e = cache->list; e; e = e->next)
 367                 if (!bacmp(&e->data.bdaddr, bdaddr))
 368                         break;
 369         return e;
 370 }
 371
 372 void hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data)
 373 {
 374         struct inquiry_cache *cache = &hdev->inq_cache;
 375         struct inquiry_entry *ie;
 376
 377         BT_DBG("cache %p, %s", cache, batostr(&data->bdaddr));
 378
 379         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
 380         if (!ie) {
 381                 /* Entry not in the cache. Add new one. */
 382                 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
 383                 if (!ie)
 384                         return;
 385
 386                 ie->next = cache->list;
 387                 cache->list = ie;
 388         }
 389
 390         memcpy(&ie->data, data, sizeof(*data));
 391         ie->timestamp = jiffies;
 392         cache->timestamp = jiffies;
 393 }
 394
 395 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
 396 {
 397         struct inquiry_cache *cache = &hdev->inq_cache;
 398         struct inquiry_info *info = (struct inquiry_info *) buf;
 399         struct inquiry_entry *e;
 400         int copied = 0;
 401
 402         for (e = cache->list; e && copied < num; e = e->next, copied++) {
 403                 struct inquiry_data *data = &e->data;
 404                 bacpy(&info->bdaddr, &data->bdaddr);
 405                 info->pscan_rep_mode    = data->pscan_rep_mode;
 406                 info->pscan_period_mode = data->pscan_period_mode;
 407                 info->pscan_mode        = data->pscan_mode;
 408                 memcpy(info->dev_class, data->dev_class, 3);
 409                 info->clock_offset      = data->clock_offset;
 410                 info++;
 411         }
 412
 413         BT_DBG("cache %p, copied %d", cache, copied);
 414         return copied;
 415 }
 416
 417 static void hci_inq_req(struct hci_dev *hdev, unsigned long opt)
 418 {
 419         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
 420         struct hci_cp_inquiry cp;
 421
 422         BT_DBG("%s", hdev->name);
 423
 424         if (test_bit(HCI_INQUIRY, &hdev->flags))
 425                 return;
 426
 427         /* Start Inquiry */
 428         memcpy(&cp.lap, &ir->lap, 3);
 429         cp.length  = ir->length;
 430         cp.num_rsp = ir->num_rsp;
 431         hci_send_cmd(hdev, HCI_OP_INQUIRY, sizeof(cp), &cp);
 432 }
 433
 434 int hci_inquiry(void __user *arg)
 435 {
 436         __u8 __user *ptr = arg;
 437         struct hci_inquiry_req ir;
 438         struct hci_dev *hdev;
 439         int err = 0, do_inquiry = 0, max_rsp;
 440         long timeo;
 441         __u8 *buf;
 442
 443         if (copy_from_user(&ir, ptr, sizeof(ir)))
 444                 return -EFAULT;
 445
 446         hdev = hci_dev_get(ir.dev_id);
 447         if (!hdev)
 448                 return -ENODEV;
 449
 450         hci_dev_lock_bh(hdev);
 451         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
 452                                 inquiry_cache_empty(hdev) ||
 453                                 ir.flags & IREQ_CACHE_FLUSH) {
 454                 inquiry_cache_flush(hdev);
 455                 do_inquiry = 1;
 456         }
 457         hci_dev_unlock_bh(hdev);
 458
 459         timeo = ir.length * msecs_to_jiffies(2000);
 460
 461         if (do_inquiry) {
 462                 err = hci_request(hdev, hci_inq_req, (unsigned long)&ir, timeo);
 463                 if (err < 0)
 464                         goto done;
 465         }
 466
 467         /* for unlimited number of responses we will use buffer with 255 entries */
 468         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
 469
 470         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
 471          * copy it to the user space.
 472          */
 473         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
 474         if (!buf) {
 475                 err = -ENOMEM;
 476                 goto done;
 477         }
 478
 479         hci_dev_lock_bh(hdev);
 480         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
 481         hci_dev_unlock_bh(hdev);
 482
 483         BT_DBG("num_rsp %d", ir.num_rsp);
 484
 485         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
 486                 ptr += sizeof(ir);
 487                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
 488                                         ir.num_rsp))
 489                         err = -EFAULT;
 490         } else
 491                 err = -EFAULT;
 492
 493         kfree(buf);
 494
 495 done:
 496         hci_dev_put(hdev);
 497         return err;
 498 }
 499
 500 /* ---- HCI ioctl helpers ---- */
 501
 502 int hci_dev_open(__u16 dev)
 503 {
 504         struct hci_dev *hdev;
 505         int ret = 0;
 506
 507         hdev = hci_dev_get(dev);
 508         if (!hdev)
 509                 return -ENODEV;
 510
 511         BT_DBG("%s %p", hdev->name, hdev);
 512
 513         hci_req_lock(hdev);
 514
 515         if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
 516                 ret = -ERFKILL;
 517                 goto done;
 518         }
 519
 520         if (test_bit(HCI_UP, &hdev->flags)) {
 521                 ret = -EALREADY;
 522                 goto done;
 523         }
 524
 525         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 526                 set_bit(HCI_RAW, &hdev->flags);
 527
 528         /* Treat all non BR/EDR controllers as raw devices for now */
 529         if (hdev->dev_type != HCI_BREDR)
 530                 set_bit(HCI_RAW, &hdev->flags);
 531
 532         if (hdev->open(hdev)) {
 533                 ret = -EIO;
 534                 goto done;
 535         }
 536
 537         if (!test_bit(HCI_RAW, &hdev->flags)) {
 538                 atomic_set(&hdev->cmd_cnt, 1);
 539                 set_bit(HCI_INIT, &hdev->flags);
 540                 hdev->init_last_cmd = 0;
 541
 542                 ret = __hci_request(hdev, hci_init_req, 0,
 543                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 544
 545                 if (lmp_le_capable(hdev))
 546                         ret = __hci_request(hdev, hci_le_init_req, 0,
 547                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 548
 549                 clear_bit(HCI_INIT, &hdev->flags);
 550         }
 551
 552         if (!ret) {
 553                 hci_dev_hold(hdev);
 554                 set_bit(HCI_UP, &hdev->flags);
 555                 hci_notify(hdev, HCI_DEV_UP);
 556                 if (!test_bit(HCI_SETUP, &hdev->flags))
 557                         mgmt_powered(hdev->id, 1);
 558         } else {
 559                 /* Init failed, cleanup */
 560                 tasklet_kill(&hdev->rx_task);
 561                 tasklet_kill(&hdev->tx_task);
 562                 tasklet_kill(&hdev->cmd_task);
 563
 564                 skb_queue_purge(&hdev->cmd_q);
 565                 skb_queue_purge(&hdev->rx_q);
 566
 567                 if (hdev->flush)
 568                         hdev->flush(hdev);
 569
 570                 if (hdev->sent_cmd) {
 571                         kfree_skb(hdev->sent_cmd);
 572                         hdev->sent_cmd = NULL;
 573                 }
 574
 575                 hdev->close(hdev);
 576                 hdev->flags = 0;
 577         }
 578
 579 done:
 580         hci_req_unlock(hdev);
 581         hci_dev_put(hdev);
 582         return ret;
 583 }
 584
 585 static int hci_dev_do_close(struct hci_dev *hdev)
 586 {
 587         BT_DBG("%s %p", hdev->name, hdev);
 588
 589         hci_req_cancel(hdev, ENODEV);
 590         hci_req_lock(hdev);
 591
 592         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
 593                 del_timer_sync(&hdev->cmd_timer);
 594                 hci_req_unlock(hdev);
 595                 return 0;
 596         }
 597
 598         /* Kill RX and TX tasks */
 599         tasklet_kill(&hdev->rx_task);
 600         tasklet_kill(&hdev->tx_task);
 601
 602         hci_dev_lock_bh(hdev);
 603         inquiry_cache_flush(hdev);
 604         hci_conn_hash_flush(hdev);
 605         hci_dev_unlock_bh(hdev);
 606
 607         hci_notify(hdev, HCI_DEV_DOWN);
 608
 609         if (hdev->flush)
 610                 hdev->flush(hdev);
 611
 612         /* Reset device */
 613         skb_queue_purge(&hdev->cmd_q);
 614         atomic_set(&hdev->cmd_cnt, 1);
 615         if (!test_bit(HCI_RAW, &hdev->flags)) {
 616                 set_bit(HCI_INIT, &hdev->flags);
 617                 __hci_request(hdev, hci_reset_req, 0,
 618                                         msecs_to_jiffies(250));
 619                 clear_bit(HCI_INIT, &hdev->flags);
 620         }
 621
 622         /* Kill cmd task */
 623         tasklet_kill(&hdev->cmd_task);
 624
 625         /* Drop queues */
 626         skb_queue_purge(&hdev->rx_q);
 627         skb_queue_purge(&hdev->cmd_q);
 628         skb_queue_purge(&hdev->raw_q);
 629
 630         /* Drop last sent command */
 631         if (hdev->sent_cmd) {
 632                 del_timer_sync(&hdev->cmd_timer);
 633                 kfree_skb(hdev->sent_cmd);
 634                 hdev->sent_cmd = NULL;
 635         }
 636
 637         /* After this point our queues are empty
 638          * and no tasks are scheduled. */
 639         hdev->close(hdev);
 640
 641         mgmt_powered(hdev->id, 0);
 642
 643         /* Clear flags */
 644         hdev->flags = 0;
 645
 646         hci_req_unlock(hdev);
 647
 648         hci_dev_put(hdev);
 649         return 0;
 650 }
 651
 652 int hci_dev_close(__u16 dev)
 653 {
 654         struct hci_dev *hdev;
 655         int err;
 656
 657         hdev = hci_dev_get(dev);
 658         if (!hdev)
 659                 return -ENODEV;
 660         err = hci_dev_do_close(hdev);
 661         hci_dev_put(hdev);
 662         return err;
 663 }
 664
 665 int hci_dev_reset(__u16 dev)
 666 {
 667         struct hci_dev *hdev;
 668         int ret = 0;
 669
 670         hdev = hci_dev_get(dev);
 671         if (!hdev)
 672                 return -ENODEV;
 673
 674         hci_req_lock(hdev);
 675         tasklet_disable(&hdev->tx_task);
 676
 677         if (!test_bit(HCI_UP, &hdev->flags))
 678                 goto done;
 679
 680         /* Drop queues */
 681         skb_queue_purge(&hdev->rx_q);
 682         skb_queue_purge(&hdev->cmd_q);
 683
 684         hci_dev_lock_bh(hdev);
 685         inquiry_cache_flush(hdev);
 686         hci_conn_hash_flush(hdev);
 687         hci_dev_unlock_bh(hdev);
 688
 689         if (hdev->flush)
 690                 hdev->flush(hdev);
 691
 692         atomic_set(&hdev->cmd_cnt, 1);
 693         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
 694
 695         if (!test_bit(HCI_RAW, &hdev->flags))
 696                 ret = __hci_request(hdev, hci_reset_req, 0,
 697                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 698
 699 done:
 700         tasklet_enable(&hdev->tx_task);
 701         hci_req_unlock(hdev);
 702         hci_dev_put(hdev);
 703         return ret;
 704 }
 705
 706 int hci_dev_reset_stat(__u16 dev)
 707 {
 708         struct hci_dev *hdev;
 709         int ret = 0;
 710
 711         hdev = hci_dev_get(dev);
 712         if (!hdev)
 713                 return -ENODEV;
 714
 715         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
 716
 717         hci_dev_put(hdev);
 718
 719         return ret;
 720 }
 721
 722 int hci_dev_cmd(unsigned int cmd, void __user *arg)
 723 {
 724         struct hci_dev *hdev;
 725         struct hci_dev_req dr;
 726         int err = 0;
 727
 728         if (copy_from_user(&dr, arg, sizeof(dr)))
 729                 return -EFAULT;
 730
 731         hdev = hci_dev_get(dr.dev_id);
 732         if (!hdev)
 733                 return -ENODEV;
 734
 735         switch (cmd) {
 736         case HCISETAUTH:
 737                 err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 738                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 739                 break;
 740
 741         case HCISETENCRYPT:
 742                 if (!lmp_encrypt_capable(hdev)) {
 743                         err = -EOPNOTSUPP;
 744                         break;
 745                 }
 746
 747                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
 748                         /* Auth must be enabled first */
 749                         err = hci_request(hdev, hci_auth_req, dr.dev_opt,
 750                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 751                         if (err)
 752                                 break;
 753                 }
 754
 755                 err = hci_request(hdev, hci_encrypt_req, dr.dev_opt,
 756                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 757                 break;
 758
 759         case HCISETSCAN:
 760                 err = hci_request(hdev, hci_scan_req, dr.dev_opt,
 761                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 762                 break;
 763
 764         case HCISETLINKPOL:
 765                 err = hci_request(hdev, hci_linkpol_req, dr.dev_opt,
 766                                         msecs_to_jiffies(HCI_INIT_TIMEOUT));
 767                 break;
 768
 769         case HCISETLINKMODE:
 770                 hdev->link_mode = ((__u16) dr.dev_opt) &
 771                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
 772                 break;
 773
 774         case HCISETPTYPE:
 775                 hdev->pkt_type = (__u16) dr.dev_opt;
 776                 break;
 777
 778         case HCISETACLMTU:
 779                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
 780                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
 781                 break;
 782
 783         case HCISETSCOMTU:
 784                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
 785                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
 786                 break;
 787
 788         default:
 789                 err = -EINVAL;
 790                 break;
 791         }
 792
 793         hci_dev_put(hdev);
 794         return err;
 795 }
 796
 797 int hci_get_dev_list(void __user *arg)
 798 {
 799         struct hci_dev_list_req *dl;
 800         struct hci_dev_req *dr;
 801         struct list_head *p;
 802         int n = 0, size, err;
 803         __u16 dev_num;
 804
 805         if (get_user(dev_num, (__u16 __user *) arg))
 806                 return -EFAULT;
 807
 808         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
 809                 return -EINVAL;
 810
 811         size = sizeof(*dl) + dev_num * sizeof(*dr);
 812
 813         dl = kzalloc(size, GFP_KERNEL);
 814         if (!dl)
 815                 return -ENOMEM;
 816
 817         dr = dl->dev_req;
 818
 819         read_lock_bh(&hci_dev_list_lock);
 820         list_for_each(p, &hci_dev_list) {
 821                 struct hci_dev *hdev;
 822
 823                 hdev = list_entry(p, struct hci_dev, list);
 824
 825                 hci_del_off_timer(hdev);
 826
 827                 if (!test_bit(HCI_MGMT, &hdev->flags))
 828                         set_bit(HCI_PAIRABLE, &hdev->flags);
 829
 830                 (dr + n)->dev_id  = hdev->id;
 831                 (dr + n)->dev_opt = hdev->flags;
 832
 833                 if (++n >= dev_num)
 834                         break;
 835         }
 836         read_unlock_bh(&hci_dev_list_lock);
 837
 838         dl->dev_num = n;
 839         size = sizeof(*dl) + n * sizeof(*dr);
 840
 841         err = copy_to_user(arg, dl, size);
 842         kfree(dl);
 843
 844         return err ? -EFAULT : 0;
 845 }
 846
 847 int hci_get_dev_info(void __user *arg)
 848 {
 849         struct hci_dev *hdev;
 850         struct hci_dev_info di;
 851         int err = 0;
 852
 853         if (copy_from_user(&di, arg, sizeof(di)))
 854                 return -EFAULT;
 855
 856         hdev = hci_dev_get(di.dev_id);
 857         if (!hdev)
 858                 return -ENODEV;
 859
 860         hci_del_off_timer(hdev);
 861
 862         if (!test_bit(HCI_MGMT, &hdev->flags))
 863                 set_bit(HCI_PAIRABLE, &hdev->flags);
 864
 865         strcpy(di.name, hdev->name);
 866         di.bdaddr   = hdev->bdaddr;
 867         di.type     = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
 868         di.flags    = hdev->flags;
 869         di.pkt_type = hdev->pkt_type;
 870         di.acl_mtu  = hdev->acl_mtu;
 871         di.acl_pkts = hdev->acl_pkts;
 872         di.sco_mtu  = hdev->sco_mtu;
 873         di.sco_pkts = hdev->sco_pkts;
 874         di.link_policy = hdev->link_policy;
 875         di.link_mode   = hdev->link_mode;
 876
 877         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
 878         memcpy(&di.features, &hdev->features, sizeof(di.features));
 879
 880         if (copy_to_user(arg, &di, sizeof(di)))
 881                 err = -EFAULT;
 882
 883         hci_dev_put(hdev);
 884
 885         return err;
 886 }
 887
 888 /* ---- Interface to HCI drivers ---- */
 889
 890 static int hci_rfkill_set_block(void *data, bool blocked)
 891 {
 892         struct hci_dev *hdev = data;
 893
 894         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
 895
 896         if (!blocked)
 897                 return 0;
 898
 899         hci_dev_do_close(hdev);
 900
 901         return 0;
 902 }
 903
 904 static const struct rfkill_ops hci_rfkill_ops = {
 905         .set_block = hci_rfkill_set_block,
 906 };
 907
 908 /* Alloc HCI device */
 909 struct hci_dev *hci_alloc_dev(void)
 910 {
 911         struct hci_dev *hdev;
 912
 913         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
 914         if (!hdev)
 915                 return NULL;
 916
 917         skb_queue_head_init(&hdev->driver_init);
 918
 919         return hdev;
 920 }
 921 EXPORT_SYMBOL(hci_alloc_dev);
 922
 923 /* Free HCI device */
 924 void hci_free_dev(struct hci_dev *hdev)
 925 {
 926         skb_queue_purge(&hdev->driver_init);
 927
 928         /* will free via device release */
 929         put_device(&hdev->dev);
 930 }
 931 EXPORT_SYMBOL(hci_free_dev);
 932
 933 static void hci_power_on(struct work_struct *work)
 934 {
 935         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
 936
 937         BT_DBG("%s", hdev->name);
 938
 939         if (hci_dev_open(hdev->id) < 0)
 940                 return;
 941
 942         if (test_bit(HCI_AUTO_OFF, &hdev->flags))
 943                 mod_timer(&hdev->off_timer,
 944                                 jiffies + msecs_to_jiffies(AUTO_OFF_TIMEOUT));
 945
 946         if (test_and_clear_bit(HCI_SETUP, &hdev->flags))
 947                 mgmt_index_added(hdev->id);
 948 }
 949
 950 static void hci_power_off(struct work_struct *work)
 951 {
 952         struct hci_dev *hdev = container_of(work, struct hci_dev, power_off);
 953
 954         BT_DBG("%s", hdev->name);
 955
 956         hci_dev_close(hdev->id);
 957 }
 958
 959 static void hci_auto_off(unsigned long data)
 960 {
 961         struct hci_dev *hdev = (struct hci_dev *) data;
 962
 963         BT_DBG("%s", hdev->name);
 964
 965         clear_bit(HCI_AUTO_OFF, &hdev->flags);
 966
 967         queue_work(hdev->workqueue, &hdev->power_off);
 968 }
 969
 970 void hci_del_off_timer(struct hci_dev *hdev)
 971 {
 972         BT_DBG("%s", hdev->name);
 973
 974         clear_bit(HCI_AUTO_OFF, &hdev->flags);
 975         del_timer(&hdev->off_timer);
 976 }
 977
 978 int hci_uuids_clear(struct hci_dev *hdev)
 979 {
 980         struct list_head *p, *n;
 981
 982         list_for_each_safe(p, n, &hdev->uuids) {
 983                 struct bt_uuid *uuid;
 984
 985                 uuid = list_entry(p, struct bt_uuid, list);
 986
 987                 list_del(p);
 988                 kfree(uuid);
 989         }
 990
 991         return 0;
 992 }
 993
 994 int hci_link_keys_clear(struct hci_dev *hdev)
 995 {
 996         struct list_head *p, *n;
 997
 998         list_for_each_safe(p, n, &hdev->link_keys) {
 999                 struct link_key *key;
1000
1001                 key = list_entry(p, struct link_key, list);
1002
1003                 list_del(p);
1004                 kfree(key);
1005         }
1006
1007         return 0;
1008 }
1009
1010 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1011 {
1012         struct list_head *p;
1013
1014         list_for_each(p, &hdev->link_keys) {
1015                 struct link_key *k;
1016
1017                 k = list_entry(p, struct link_key, list);
1018
1019                 if (bacmp(bdaddr, &k->bdaddr) == 0)
1020                         return k;
1021         }
1022
1023         return NULL;
1024 }
1025
1026 static int hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1027                                                 u8 key_type, u8 old_key_type)
1028 {
1029         /* Legacy key */
1030         if (key_type < 0x03)
1031                 return 1;
1032
1033         /* Debug keys are insecure so don't store them persistently */
1034         if (key_type == HCI_LK_DEBUG_COMBINATION)
1035                 return 0;
1036
1037         /* Changed combination key and there's no previous one */
1038         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1039                 return 0;
1040
1041         /* Security mode 3 case */
1042         if (!conn)
1043                 return 1;
1044
1045         /* Neither local nor remote side had no-bonding as requirement */
1046         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1047                 return 1;
1048
1049         /* Local side had dedicated bonding as requirement */
1050         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1051                 return 1;
1052
1053         /* Remote side had dedicated bonding as requirement */
1054         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1055                 return 1;
1056
1057         /* If none of the above criteria match, then don't store the key
1058          * persistently */
1059         return 0;
1060 }
1061
1062 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1063                                 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1064 {
1065         struct link_key *key, *old_key;
1066         u8 old_key_type, persistent;
1067
1068         old_key = hci_find_link_key(hdev, bdaddr);
1069         if (old_key) {
1070                 old_key_type = old_key->type;
1071                 key = old_key;
1072         } else {
1073                 old_key_type = conn ? conn->key_type : 0xff;
1074                 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1075                 if (!key)
1076                         return -ENOMEM;
1077                 list_add(&key->list, &hdev->link_keys);
1078         }
1079
1080         BT_DBG("%s key for %s type %u", hdev->name, batostr(bdaddr), type);
1081
1082         /* Some buggy controller combinations generate a changed
1083          * combination key for legacy pairing even when there's no
1084          * previous key */
1085         if (type == HCI_LK_CHANGED_COMBINATION &&
1086                                         (!conn || conn->remote_auth == 0xff) &&
1087                                         old_key_type == 0xff) {
1088                 type = HCI_LK_COMBINATION;
1089                 if (conn)
1090                         conn->key_type = type;
1091         }
1092
1093         bacpy(&key->bdaddr, bdaddr);
1094         memcpy(key->val, val, 16);
1095         key->pin_len = pin_len;
1096
1097         if (type == HCI_LK_CHANGED_COMBINATION)
1098                 key->type = old_key_type;
1099         else
1100                 key->type = type;
1101
1102         if (!new_key)
1103                 return 0;
1104
1105         persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1106
1107         mgmt_new_key(hdev->id, key, persistent);
1108
1109         if (!persistent) {
1110                 list_del(&key->list);
1111                 kfree(key);
1112         }
1113
1114         return 0;
1115 }
1116
1117 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1118 {
1119         struct link_key *key;
1120
1121         key = hci_find_link_key(hdev, bdaddr);
1122         if (!key)
1123                 return -ENOENT;
1124
1125         BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1126
1127         list_del(&key->list);
1128         kfree(key);
1129
1130         return 0;
1131 }
1132
1133 /* HCI command timer function */
1134 static void hci_cmd_timer(unsigned long arg)
1135 {
1136         struct hci_dev *hdev = (void *) arg;
1137
1138         BT_ERR("%s command tx timeout", hdev->name);
1139         atomic_set(&hdev->cmd_cnt, 1);
1140         clear_bit(HCI_RESET, &hdev->flags);
1141         tasklet_schedule(&hdev->cmd_task);
1142 }
1143
1144 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1145                                                         bdaddr_t *bdaddr)
1146 {
1147         struct oob_data *data;
1148
1149         list_for_each_entry(data, &hdev->remote_oob_data, list)
1150                 if (bacmp(bdaddr, &data->bdaddr) == 0)
1151                         return data;
1152
1153         return NULL;
1154 }
1155
1156 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1157 {
1158         struct oob_data *data;
1159
1160         data = hci_find_remote_oob_data(hdev, bdaddr);
1161         if (!data)
1162                 return -ENOENT;
1163
1164         BT_DBG("%s removing %s", hdev->name, batostr(bdaddr));
1165
1166         list_del(&data->list);
1167         kfree(data);
1168
1169         return 0;
1170 }
1171
1172 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1173 {
1174         struct oob_data *data, *n;
1175
1176         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1177                 list_del(&data->list);
1178                 kfree(data);
1179         }
1180
1181         return 0;
1182 }
1183
1184 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1185                                                                 u8 *randomizer)
1186 {
1187         struct oob_data *data;
1188
1189         data = hci_find_remote_oob_data(hdev, bdaddr);
1190
1191         if (!data) {
1192                 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1193                 if (!data)
1194                         return -ENOMEM;
1195
1196                 bacpy(&data->bdaddr, bdaddr);
1197                 list_add(&data->list, &hdev->remote_oob_data);
1198         }
1199
1200         memcpy(data->hash, hash, sizeof(data->hash));
1201         memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1202
1203         BT_DBG("%s for %s", hdev->name, batostr(bdaddr));
1204
1205         return 0;
1206 }
1207
1208 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
1209                                                 bdaddr_t *bdaddr)
1210 {
1211         struct list_head *p;
1212
1213         list_for_each(p, &hdev->blacklist) {
1214                 struct bdaddr_list *b;
1215
1216                 b = list_entry(p, struct bdaddr_list, list);
1217
1218                 if (bacmp(bdaddr, &b->bdaddr) == 0)
1219                         return b;
1220         }
1221
1222         return NULL;
1223 }
1224
1225 int hci_blacklist_clear(struct hci_dev *hdev)
1226 {
1227         struct list_head *p, *n;
1228
1229         list_for_each_safe(p, n, &hdev->blacklist) {
1230                 struct bdaddr_list *b;
1231
1232                 b = list_entry(p, struct bdaddr_list, list);
1233
1234                 list_del(p);
1235                 kfree(b);
1236         }
1237
1238         return 0;
1239 }
1240
1241 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr)
1242 {
1243         struct bdaddr_list *entry;
1244         int err;
1245
1246         if (bacmp(bdaddr, BDADDR_ANY) == 0)
1247                 return -EBADF;
1248
1249         hci_dev_lock(hdev);
1250
1251         if (hci_blacklist_lookup(hdev, bdaddr)) {
1252                 err = -EEXIST;
1253                 goto err;
1254         }
1255
1256         entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1257         if (!entry) {
1258                 return -ENOMEM;
1259                 goto err;
1260         }
1261
1262         bacpy(&entry->bdaddr, bdaddr);
1263
1264         list_add(&entry->list, &hdev->blacklist);
1265
1266         err = 0;
1267
1268 err:
1269         hci_dev_unlock(hdev);
1270         return err;
1271 }
1272
1273 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr)
1274 {
1275         struct bdaddr_list *entry;
1276         int err = 0;
1277
1278         hci_dev_lock(hdev);
1279
1280         if (bacmp(bdaddr, BDADDR_ANY) == 0) {
1281                 hci_blacklist_clear(hdev);
1282                 goto done;
1283         }
1284
1285         entry = hci_blacklist_lookup(hdev, bdaddr);
1286         if (!entry) {
1287                 err = -ENOENT;
1288                 goto done;
1289         }
1290
1291         list_del(&entry->list);
1292         kfree(entry);
1293
1294 done:
1295         hci_dev_unlock(hdev);
1296         return err;
1297 }
1298
1299 static void hci_clear_adv_cache(unsigned long arg)
1300 {
1301         struct hci_dev *hdev = (void *) arg;
1302
1303         hci_dev_lock(hdev);
1304
1305         hci_adv_entries_clear(hdev);
1306
1307         hci_dev_unlock(hdev);
1308 }
1309
1310 int hci_adv_entries_clear(struct hci_dev *hdev)
1311 {
1312         struct adv_entry *entry, *tmp;
1313
1314         list_for_each_entry_safe(entry, tmp, &hdev->adv_entries, list) {
1315                 list_del(&entry->list);
1316                 kfree(entry);
1317         }
1318
1319         BT_DBG("%s adv cache cleared", hdev->name);
1320
1321         return 0;
1322 }
1323
1324 struct adv_entry *hci_find_adv_entry(struct hci_dev *hdev, bdaddr_t *bdaddr)
1325 {
1326         struct adv_entry *entry;
1327
1328         list_for_each_entry(entry, &hdev->adv_entries, list)
1329                 if (bacmp(bdaddr, &entry->bdaddr) == 0)
1330                         return entry;
1331
1332         return NULL;
1333 }
1334
1335 static inline int is_connectable_adv(u8 evt_type)
1336 {
1337         if (evt_type == ADV_IND || evt_type == ADV_DIRECT_IND)
1338                 return 1;
1339
1340         return 0;
1341 }
1342
1343 int hci_add_adv_entry(struct hci_dev *hdev,
1344                                         struct hci_ev_le_advertising_info *ev)
1345 {
1346         struct adv_entry *entry;
1347
1348         if (!is_connectable_adv(ev->evt_type))
1349                 return -EINVAL;
1350
1351         /* Only new entries should be added to adv_entries. So, if
1352          * bdaddr was found, don't add it. */
1353         if (hci_find_adv_entry(hdev, &ev->bdaddr))
1354                 return 0;
1355
1356         entry = kzalloc(sizeof(*entry), GFP_ATOMIC);
1357         if (!entry)
1358                 return -ENOMEM;
1359
1360         bacpy(&entry->bdaddr, &ev->bdaddr);
1361         entry->bdaddr_type = ev->bdaddr_type;
1362
1363         list_add(&entry->list, &hdev->adv_entries);
1364
1365         BT_DBG("%s adv entry added: address %s type %u", hdev->name,
1366                                 batostr(&entry->bdaddr), entry->bdaddr_type);
1367
1368         return 0;
1369 }
1370
1371 static struct crypto_blkcipher *alloc_cypher(void)
1372 {
1373         if (enable_smp)
1374                 return crypto_alloc_blkcipher("ecb(aes)", 0, CRYPTO_ALG_ASYNC);
1375
1376         return ERR_PTR(-ENOTSUPP);
1377 }
1378
1379 /* Register HCI device */
1380 int hci_register_dev(struct hci_dev *hdev)
1381 {
1382         struct list_head *head = &hci_dev_list, *p;
1383         int i, id = 0;
1384
1385         BT_DBG("%p name %s bus %d owner %p", hdev, hdev->name,
1386                                                 hdev->bus, hdev->owner);
1387
1388         if (!hdev->open || !hdev->close || !hdev->destruct)
1389                 return -EINVAL;
1390
1391         write_lock_bh(&hci_dev_list_lock);
1392
1393         /* Find first available device id */
1394         list_for_each(p, &hci_dev_list) {
1395                 if (list_entry(p, struct hci_dev, list)->id != id)
1396                         break;
1397                 head = p; id++;
1398         }
1399
1400         sprintf(hdev->name, "hci%d", id);
1401         hdev->id = id;
1402         list_add(&hdev->list, head);
1403
1404         atomic_set(&hdev->refcnt, 1);
1405         spin_lock_init(&hdev->lock);
1406
1407         hdev->flags = 0;
1408         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
1409         hdev->esco_type = (ESCO_HV1);
1410         hdev->link_mode = (HCI_LM_ACCEPT);
1411         hdev->io_capability = 0x03; /* No Input No Output */
1412
1413         hdev->idle_timeout = 0;
1414         hdev->sniff_max_interval = 800;
1415         hdev->sniff_min_interval = 80;
1416
1417         tasklet_init(&hdev->cmd_task, hci_cmd_task, (unsigned long) hdev);
1418         tasklet_init(&hdev->rx_task, hci_rx_task, (unsigned long) hdev);
1419         tasklet_init(&hdev->tx_task, hci_tx_task, (unsigned long) hdev);
1420
1421         skb_queue_head_init(&hdev->rx_q);
1422         skb_queue_head_init(&hdev->cmd_q);
1423         skb_queue_head_init(&hdev->raw_q);
1424
1425         setup_timer(&hdev->cmd_timer, hci_cmd_timer, (unsigned long) hdev);
1426
1427         for (i = 0; i < NUM_REASSEMBLY; i++)
1428                 hdev->reassembly[i] = NULL;
1429
1430         init_waitqueue_head(&hdev->req_wait_q);
1431         mutex_init(&hdev->req_lock);
1432
1433         inquiry_cache_init(hdev);
1434
1435         hci_conn_hash_init(hdev);
1436
1437         INIT_LIST_HEAD(&hdev->blacklist);
1438
1439         INIT_LIST_HEAD(&hdev->uuids);
1440
1441         INIT_LIST_HEAD(&hdev->link_keys);
1442
1443         INIT_LIST_HEAD(&hdev->remote_oob_data);
1444
1445         INIT_LIST_HEAD(&hdev->adv_entries);
1446         setup_timer(&hdev->adv_timer, hci_clear_adv_cache,
1447                                                 (unsigned long) hdev);
1448
1449         INIT_WORK(&hdev->power_on, hci_power_on);
1450         INIT_WORK(&hdev->power_off, hci_power_off);
1451         setup_timer(&hdev->off_timer, hci_auto_off, (unsigned long) hdev);
1452
1453         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1454
1455         atomic_set(&hdev->promisc, 0);
1456
1457         write_unlock_bh(&hci_dev_list_lock);
1458
1459         hdev->workqueue = create_singlethread_workqueue(hdev->name);
1460         if (!hdev->workqueue)
1461                 goto nomem;
1462
1463         hdev->tfm = alloc_cypher();
1464         if (IS_ERR(hdev->tfm))
1465                 BT_INFO("Failed to load transform for ecb(aes): %ld",
1466                                                         PTR_ERR(hdev->tfm));
1467
1468         hci_register_sysfs(hdev);
1469
1470         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
1471                                 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, hdev);
1472         if (hdev->rfkill) {
1473                 if (rfkill_register(hdev->rfkill) < 0) {
1474                         rfkill_destroy(hdev->rfkill);
1475                         hdev->rfkill = NULL;
1476                 }
1477         }
1478
1479         set_bit(HCI_AUTO_OFF, &hdev->flags);
1480         set_bit(HCI_SETUP, &hdev->flags);
1481         queue_work(hdev->workqueue, &hdev->power_on);
1482
1483         hci_notify(hdev, HCI_DEV_REG);
1484
1485         return id;
1486
1487 nomem:
1488         write_lock_bh(&hci_dev_list_lock);
1489         list_del(&hdev->list);
1490         write_unlock_bh(&hci_dev_list_lock);
1491
1492         return -ENOMEM;
1493 }
1494 EXPORT_SYMBOL(hci_register_dev);
1495
1496 /* Unregister HCI device */
1497 int hci_unregister_dev(struct hci_dev *hdev)
1498 {
1499         int i;
1500
1501         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1502
1503         write_lock_bh(&hci_dev_list_lock);
1504         list_del(&hdev->list);
1505         write_unlock_bh(&hci_dev_list_lock);
1506
1507         hci_dev_do_close(hdev);
1508
1509         for (i = 0; i < NUM_REASSEMBLY; i++)
1510                 kfree_skb(hdev->reassembly[i]);
1511
1512         if (!test_bit(HCI_INIT, &hdev->flags) &&
1513                                         !test_bit(HCI_SETUP, &hdev->flags))
1514                 mgmt_index_removed(hdev->id);
1515
1516         if (!IS_ERR(hdev->tfm))
1517                 crypto_free_blkcipher(hdev->tfm);
1518
1519         hci_notify(hdev, HCI_DEV_UNREG);
1520
1521         if (hdev->rfkill) {
1522                 rfkill_unregister(hdev->rfkill);
1523                 rfkill_destroy(hdev->rfkill);
1524         }
1525
1526         hci_unregister_sysfs(hdev);
1527
1528         hci_del_off_timer(hdev);
1529         del_timer(&hdev->adv_timer);
1530
1531         destroy_workqueue(hdev->workqueue);
1532
1533         hci_dev_lock_bh(hdev);
1534         hci_blacklist_clear(hdev);
1535         hci_uuids_clear(hdev);
1536         hci_link_keys_clear(hdev);
1537         hci_remote_oob_data_clear(hdev);
1538         hci_adv_entries_clear(hdev);
1539         hci_dev_unlock_bh(hdev);
1540
1541         __hci_dev_put(hdev);
1542
1543         return 0;
1544 }
1545 EXPORT_SYMBOL(hci_unregister_dev);
1546
1547 /* Suspend HCI device */
1548 int hci_suspend_dev(struct hci_dev *hdev)
1549 {
1550         hci_notify(hdev, HCI_DEV_SUSPEND);
1551         return 0;
1552 }
1553 EXPORT_SYMBOL(hci_suspend_dev);
1554
1555 /* Resume HCI device */
1556 int hci_resume_dev(struct hci_dev *hdev)
1557 {
1558         hci_notify(hdev, HCI_DEV_RESUME);
1559         return 0;
1560 }
1561 EXPORT_SYMBOL(hci_resume_dev);
1562
1563 /* Receive frame from HCI drivers */
1564 int hci_recv_frame(struct sk_buff *skb)
1565 {
1566         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1567         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
1568                                 && !test_bit(HCI_INIT, &hdev->flags))) {
1569                 kfree_skb(skb);
1570                 return -ENXIO;
1571         }
1572
1573         /* Incomming skb */
1574         bt_cb(skb)->incoming = 1;
1575
1576         /* Time stamp */
1577         __net_timestamp(skb);
1578
1579         /* Queue frame for rx task */
1580         skb_queue_tail(&hdev->rx_q, skb);
1581         tasklet_schedule(&hdev->rx_task);
1582
1583         return 0;
1584 }
1585 EXPORT_SYMBOL(hci_recv_frame);
1586
1587 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
1588                                                   int count, __u8 index)
1589 {
1590         int len = 0;
1591         int hlen = 0;
1592         int remain = count;
1593         struct sk_buff *skb;
1594         struct bt_skb_cb *scb;
1595
1596         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
1597                                 index >= NUM_REASSEMBLY)
1598                 return -EILSEQ;
1599
1600         skb = hdev->reassembly[index];
1601
1602         if (!skb) {
1603                 switch (type) {
1604                 case HCI_ACLDATA_PKT:
1605                         len = HCI_MAX_FRAME_SIZE;
1606                         hlen = HCI_ACL_HDR_SIZE;
1607                         break;
1608                 case HCI_EVENT_PKT:
1609                         len = HCI_MAX_EVENT_SIZE;
1610                         hlen = HCI_EVENT_HDR_SIZE;
1611                         break;
1612                 case HCI_SCODATA_PKT:
1613                         len = HCI_MAX_SCO_SIZE;
1614                         hlen = HCI_SCO_HDR_SIZE;
1615                         break;
1616                 }
1617
1618                 skb = bt_skb_alloc(len, GFP_ATOMIC);
1619                 if (!skb)
1620                         return -ENOMEM;
1621
1622                 scb = (void *) skb->cb;
1623                 scb->expect = hlen;
1624                 scb->pkt_type = type;
1625
1626                 skb->dev = (void *) hdev;
1627                 hdev->reassembly[index] = skb;
1628         }
1629
1630         while (count) {
1631                 scb = (void *) skb->cb;
1632                 len = min(scb->expect, (__u16)count);
1633
1634                 memcpy(skb_put(skb, len), data, len);
1635
1636                 count -= len;
1637                 data += len;
1638                 scb->expect -= len;
1639                 remain = count;
1640
1641                 switch (type) {
1642                 case HCI_EVENT_PKT:
1643                         if (skb->len == HCI_EVENT_HDR_SIZE) {
1644                                 struct hci_event_hdr *h = hci_event_hdr(skb);
1645                                 scb->expect = h->plen;
1646
1647                                 if (skb_tailroom(skb) < scb->expect) {
1648                                         kfree_skb(skb);
1649                                         hdev->reassembly[index] = NULL;
1650                                         return -ENOMEM;
1651                                 }
1652                         }
1653                         break;
1654
1655                 case HCI_ACLDATA_PKT:
1656                         if (skb->len  == HCI_ACL_HDR_SIZE) {
1657                                 struct hci_acl_hdr *h = hci_acl_hdr(skb);
1658                                 scb->expect = __le16_to_cpu(h->dlen);
1659
1660                                 if (skb_tailroom(skb) < scb->expect) {
1661                                         kfree_skb(skb);
1662                                         hdev->reassembly[index] = NULL;
1663                                         return -ENOMEM;
1664                                 }
1665                         }
1666                         break;
1667
1668                 case HCI_SCODATA_PKT:
1669                         if (skb->len == HCI_SCO_HDR_SIZE) {
1670                                 struct hci_sco_hdr *h = hci_sco_hdr(skb);
1671                                 scb->expect = h->dlen;
1672
1673                                 if (skb_tailroom(skb) < scb->expect) {
1674                                         kfree_skb(skb);
1675                                         hdev->reassembly[index] = NULL;
1676                                         return -ENOMEM;
1677                                 }
1678                         }
1679                         break;
1680                 }
1681
1682                 if (scb->expect == 0) {
1683                         /* Complete frame */
1684
1685                         bt_cb(skb)->pkt_type = type;
1686                         hci_recv_frame(skb);
1687
1688                         hdev->reassembly[index] = NULL;
1689                         return remain;
1690                 }
1691         }
1692
1693         return remain;
1694 }
1695
1696 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
1697 {
1698         int rem = 0;
1699
1700         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
1701                 return -EILSEQ;
1702
1703         while (count) {
1704                 rem = hci_reassembly(hdev, type, data, count, type - 1);
1705                 if (rem < 0)
1706                         return rem;
1707
1708                 data += (count - rem);
1709                 count = rem;
1710         }
1711
1712         return rem;
1713 }
1714 EXPORT_SYMBOL(hci_recv_fragment);
1715
1716 #define STREAM_REASSEMBLY 0
1717
1718 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
1719 {
1720         int type;
1721         int rem = 0;
1722
1723         while (count) {
1724                 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
1725
1726                 if (!skb) {
1727                         struct { char type; } *pkt;
1728
1729                         /* Start of the frame */
1730                         pkt = data;
1731                         type = pkt->type;
1732
1733                         data++;
1734                         count--;
1735                 } else
1736                         type = bt_cb(skb)->pkt_type;
1737
1738                 rem = hci_reassembly(hdev, type, data, count,
1739                                                         STREAM_REASSEMBLY);
1740                 if (rem < 0)
1741                         return rem;
1742
1743                 data += (count - rem);
1744                 count = rem;
1745         }
1746
1747         return rem;
1748 }
1749 EXPORT_SYMBOL(hci_recv_stream_fragment);
1750
1751 /* ---- Interface to upper protocols ---- */
1752
1753 /* Register/Unregister protocols.
1754  * hci_task_lock is used to ensure that no tasks are running. */
1755 int hci_register_proto(struct hci_proto *hp)
1756 {
1757         int err = 0;
1758
1759         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1760
1761         if (hp->id >= HCI_MAX_PROTO)
1762                 return -EINVAL;
1763
1764         write_lock_bh(&hci_task_lock);
1765
1766         if (!hci_proto[hp->id])
1767                 hci_proto[hp->id] = hp;
1768         else
1769                 err = -EEXIST;
1770
1771         write_unlock_bh(&hci_task_lock);
1772
1773         return err;
1774 }
1775 EXPORT_SYMBOL(hci_register_proto);
1776
1777 int hci_unregister_proto(struct hci_proto *hp)
1778 {
1779         int err = 0;
1780
1781         BT_DBG("%p name %s id %d", hp, hp->name, hp->id);
1782
1783         if (hp->id >= HCI_MAX_PROTO)
1784                 return -EINVAL;
1785
1786         write_lock_bh(&hci_task_lock);
1787
1788         if (hci_proto[hp->id])
1789                 hci_proto[hp->id] = NULL;
1790         else
1791                 err = -ENOENT;
1792
1793         write_unlock_bh(&hci_task_lock);
1794
1795         return err;
1796 }
1797 EXPORT_SYMBOL(hci_unregister_proto);
1798
1799 int hci_register_cb(struct hci_cb *cb)
1800 {
1801         BT_DBG("%p name %s", cb, cb->name);
1802
1803         write_lock_bh(&hci_cb_list_lock);
1804         list_add(&cb->list, &hci_cb_list);
1805         write_unlock_bh(&hci_cb_list_lock);
1806
1807         return 0;
1808 }
1809 EXPORT_SYMBOL(hci_register_cb);
1810
1811 int hci_unregister_cb(struct hci_cb *cb)
1812 {
1813         BT_DBG("%p name %s", cb, cb->name);
1814
1815         write_lock_bh(&hci_cb_list_lock);
1816         list_del(&cb->list);
1817         write_unlock_bh(&hci_cb_list_lock);
1818
1819         return 0;
1820 }
1821 EXPORT_SYMBOL(hci_unregister_cb);
1822
1823 static int hci_send_frame(struct sk_buff *skb)
1824 {
1825         struct hci_dev *hdev = (struct hci_dev *) skb->dev;
1826
1827         if (!hdev) {
1828                 kfree_skb(skb);
1829                 return -ENODEV;
1830         }
1831
1832         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1833
1834         if (atomic_read(&hdev->promisc)) {
1835                 /* Time stamp */
1836                 __net_timestamp(skb);
1837
1838                 hci_send_to_sock(hdev, skb, NULL);
1839         }
1840
1841         /* Get rid of skb owner, prior to sending to the driver. */
1842         skb_orphan(skb);
1843
1844         return hdev->send(skb);
1845 }
1846
1847 /* Send HCI command */
1848 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, void *param)
1849 {
1850         int len = HCI_COMMAND_HDR_SIZE + plen;
1851         struct hci_command_hdr *hdr;
1852         struct sk_buff *skb;
1853
1854         BT_DBG("%s opcode 0x%x plen %d", hdev->name, opcode, plen);
1855
1856         skb = bt_skb_alloc(len, GFP_ATOMIC);
1857         if (!skb) {
1858                 BT_ERR("%s no memory for command", hdev->name);
1859                 return -ENOMEM;
1860         }
1861
1862         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
1863         hdr->opcode = cpu_to_le16(opcode);
1864         hdr->plen   = plen;
1865
1866         if (plen)
1867                 memcpy(skb_put(skb, plen), param, plen);
1868
1869         BT_DBG("skb len %d", skb->len);
1870
1871         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1872         skb->dev = (void *) hdev;
1873
1874         if (test_bit(HCI_INIT, &hdev->flags))
1875                 hdev->init_last_cmd = opcode;
1876
1877         skb_queue_tail(&hdev->cmd_q, skb);
1878         tasklet_schedule(&hdev->cmd_task);
1879
1880         return 0;
1881 }
1882
1883 /* Get data from the previously sent command */
1884 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1885 {
1886         struct hci_command_hdr *hdr;
1887
1888         if (!hdev->sent_cmd)
1889                 return NULL;
1890
1891         hdr = (void *) hdev->sent_cmd->data;
1892
1893         if (hdr->opcode != cpu_to_le16(opcode))
1894                 return NULL;
1895
1896         BT_DBG("%s opcode 0x%x", hdev->name, opcode);
1897
1898         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
1899 }
1900
1901 /* Send ACL data */
1902 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
1903 {
1904         struct hci_acl_hdr *hdr;
1905         int len = skb->len;
1906
1907         skb_push(skb, HCI_ACL_HDR_SIZE);
1908         skb_reset_transport_header(skb);
1909         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
1910         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
1911         hdr->dlen   = cpu_to_le16(len);
1912 }
1913
1914 void hci_send_acl(struct hci_conn *conn, struct sk_buff *skb, __u16 flags)
1915 {
1916         struct hci_dev *hdev = conn->hdev;
1917         struct sk_buff *list;
1918
1919         BT_DBG("%s conn %p flags 0x%x", hdev->name, conn, flags);
1920
1921         skb->dev = (void *) hdev;
1922         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1923         hci_add_acl_hdr(skb, conn->handle, flags);
1924
1925         list = skb_shinfo(skb)->frag_list;
1926         if (!list) {
1927                 /* Non fragmented */
1928                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
1929
1930                 skb_queue_tail(&conn->data_q, skb);
1931         } else {
1932                 /* Fragmented */
1933                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1934
1935                 skb_shinfo(skb)->frag_list = NULL;
1936
1937                 /* Queue all fragments atomically */
1938                 spin_lock_bh(&conn->data_q.lock);
1939
1940                 __skb_queue_tail(&conn->data_q, skb);
1941
1942                 flags &= ~ACL_START;
1943                 flags |= ACL_CONT;
1944                 do {
1945                         skb = list; list = list->next;
1946
1947                         skb->dev = (void *) hdev;
1948                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
1949                         hci_add_acl_hdr(skb, conn->handle, flags);
1950
1951                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
1952
1953                         __skb_queue_tail(&conn->data_q, skb);
1954                 } while (list);
1955
1956                 spin_unlock_bh(&conn->data_q.lock);
1957         }
1958
1959         tasklet_schedule(&hdev->tx_task);
1960 }
1961 EXPORT_SYMBOL(hci_send_acl);
1962
1963 /* Send SCO data */
1964 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1965 {
1966         struct hci_dev *hdev = conn->hdev;
1967         struct hci_sco_hdr hdr;
1968
1969         BT_DBG("%s len %d", hdev->name, skb->len);
1970
1971         hdr.handle = cpu_to_le16(conn->handle);
1972         hdr.dlen   = skb->len;
1973
1974         skb_push(skb, HCI_SCO_HDR_SIZE);
1975         skb_reset_transport_header(skb);
1976         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1977
1978         skb->dev = (void *) hdev;
1979         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
1980
1981         skb_queue_tail(&conn->data_q, skb);
1982         tasklet_schedule(&hdev->tx_task);
1983 }
1984 EXPORT_SYMBOL(hci_send_sco);
1985
1986 /* ---- HCI TX task (outgoing data) ---- */
1987
1988 /* HCI Connection scheduler */
1989 static inline struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, int *quote)
1990 {
1991         struct hci_conn_hash *h = &hdev->conn_hash;
1992         struct hci_conn *conn = NULL;
1993         int num = 0, min = ~0;
1994         struct list_head *p;
1995
1996         /* We don't have to lock device here. Connections are always
1997          * added and removed with TX task disabled. */
1998         list_for_each(p, &h->list) {
1999                 struct hci_conn *c;
2000                 c = list_entry(p, struct hci_conn, list);
2001
2002                 if (c->type != type || skb_queue_empty(&c->data_q))
2003                         continue;
2004
2005                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2006                         continue;
2007
2008                 num++;
2009
2010                 if (c->sent < min) {
2011                         min  = c->sent;
2012                         conn = c;
2013                 }
2014         }
2015
2016         if (conn) {
2017                 int cnt, q;
2018
2019                 switch (conn->type) {
2020                 case ACL_LINK:
2021                         cnt = hdev->acl_cnt;
2022                         break;
2023                 case SCO_LINK:
2024                 case ESCO_LINK:
2025                         cnt = hdev->sco_cnt;
2026                         break;
2027                 case LE_LINK:
2028                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2029                         break;
2030                 default:
2031                         cnt = 0;
2032                         BT_ERR("Unknown link type");
2033                 }
2034
2035                 q = cnt / num;
2036                 *quote = q ? q : 1;
2037         } else
2038                 *quote = 0;
2039
2040         BT_DBG("conn %p quote %d", conn, *quote);
2041         return conn;
2042 }
2043
2044 static inline void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2045 {
2046         struct hci_conn_hash *h = &hdev->conn_hash;
2047         struct list_head *p;
2048         struct hci_conn  *c;
2049
2050         BT_ERR("%s link tx timeout", hdev->name);
2051
2052         /* Kill stalled connections */
2053         list_for_each(p, &h->list) {
2054                 c = list_entry(p, struct hci_conn, list);
2055                 if (c->type == type && c->sent) {
2056                         BT_ERR("%s killing stalled connection %s",
2057                                 hdev->name, batostr(&c->dst));
2058                         hci_acl_disconn(c, 0x13);
2059                 }
2060         }
2061 }
2062
2063 static inline void hci_sched_acl(struct hci_dev *hdev)
2064 {
2065         struct hci_conn *conn;
2066         struct sk_buff *skb;
2067         int quote;
2068
2069         BT_DBG("%s", hdev->name);
2070
2071         if (!test_bit(HCI_RAW, &hdev->flags)) {
2072                 /* ACL tx timeout must be longer than maximum
2073                  * link supervision timeout (40.9 seconds) */
2074                 if (!hdev->acl_cnt && time_after(jiffies, hdev->acl_last_tx + HZ * 45))
2075                         hci_link_tx_to(hdev, ACL_LINK);
2076         }
2077
2078         while (hdev->acl_cnt && (conn = hci_low_sent(hdev, ACL_LINK, &quote))) {
2079                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2080                         BT_DBG("skb %p len %d", skb, skb->len);
2081
2082                         hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
2083
2084                         hci_send_frame(skb);
2085                         hdev->acl_last_tx = jiffies;
2086
2087                         hdev->acl_cnt--;
2088                         conn->sent++;
2089                 }
2090         }
2091 }
2092
2093 /* Schedule SCO */
2094 static inline void hci_sched_sco(struct hci_dev *hdev)
2095 {
2096         struct hci_conn *conn;
2097         struct sk_buff *skb;
2098         int quote;
2099
2100         BT_DBG("%s", hdev->name);
2101
2102         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
2103                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2104                         BT_DBG("skb %p len %d", skb, skb->len);
2105                         hci_send_frame(skb);
2106
2107                         conn->sent++;
2108                         if (conn->sent == ~0)
2109                                 conn->sent = 0;
2110                 }
2111         }
2112 }
2113
2114 static inline void hci_sched_esco(struct hci_dev *hdev)
2115 {
2116         struct hci_conn *conn;
2117         struct sk_buff *skb;
2118         int quote;
2119
2120         BT_DBG("%s", hdev->name);
2121
2122         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, &quote))) {
2123                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2124                         BT_DBG("skb %p len %d", skb, skb->len);
2125                         hci_send_frame(skb);
2126
2127                         conn->sent++;
2128                         if (conn->sent == ~0)
2129                                 conn->sent = 0;
2130                 }
2131         }
2132 }
2133
2134 static inline void hci_sched_le(struct hci_dev *hdev)
2135 {
2136         struct hci_conn *conn;
2137         struct sk_buff *skb;
2138         int quote, cnt;
2139
2140         BT_DBG("%s", hdev->name);
2141
2142         if (!test_bit(HCI_RAW, &hdev->flags)) {
2143                 /* LE tx timeout must be longer than maximum
2144                  * link supervision timeout (40.9 seconds) */
2145                 if (!hdev->le_cnt && hdev->le_pkts &&
2146                                 time_after(jiffies, hdev->le_last_tx + HZ * 45))
2147                         hci_link_tx_to(hdev, LE_LINK);
2148         }
2149
2150         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
2151         while (cnt && (conn = hci_low_sent(hdev, LE_LINK, &quote))) {
2152                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
2153                         BT_DBG("skb %p len %d", skb, skb->len);
2154
2155                         hci_send_frame(skb);
2156                         hdev->le_last_tx = jiffies;
2157
2158                         cnt--;
2159                         conn->sent++;
2160                 }
2161         }
2162         if (hdev->le_pkts)
2163                 hdev->le_cnt = cnt;
2164         else
2165                 hdev->acl_cnt = cnt;
2166 }
2167
2168 static void hci_tx_task(unsigned long arg)
2169 {
2170         struct hci_dev *hdev = (struct hci_dev *) arg;
2171         struct sk_buff *skb;
2172
2173         read_lock(&hci_task_lock);
2174
2175         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
2176                 hdev->sco_cnt, hdev->le_cnt);
2177
2178         /* Schedule queues and send stuff to HCI driver */
2179
2180         hci_sched_acl(hdev);
2181
2182         hci_sched_sco(hdev);
2183
2184         hci_sched_esco(hdev);
2185
2186         hci_sched_le(hdev);
2187
2188         /* Send next queued raw (unknown type) packet */
2189         while ((skb = skb_dequeue(&hdev->raw_q)))
2190                 hci_send_frame(skb);
2191
2192         read_unlock(&hci_task_lock);
2193 }
2194
2195 /* ----- HCI RX task (incoming data processing) ----- */
2196
2197 /* ACL data packet */
2198 static inline void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2199 {
2200         struct hci_acl_hdr *hdr = (void *) skb->data;
2201         struct hci_conn *conn;
2202         __u16 handle, flags;
2203
2204         skb_pull(skb, HCI_ACL_HDR_SIZE);
2205
2206         handle = __le16_to_cpu(hdr->handle);
2207         flags  = hci_flags(handle);
2208         handle = hci_handle(handle);
2209
2210         BT_DBG("%s len %d handle 0x%x flags 0x%x", hdev->name, skb->len, handle, flags);
2211
2212         hdev->stat.acl_rx++;
2213
2214         hci_dev_lock(hdev);
2215         conn = hci_conn_hash_lookup_handle(hdev, handle);
2216         hci_dev_unlock(hdev);
2217
2218         if (conn) {
2219                 register struct hci_proto *hp;
2220
2221                 hci_conn_enter_active_mode(conn, bt_cb(skb)->force_active);
2222
2223                 /* Send to upper protocol */
2224                 hp = hci_proto[HCI_PROTO_L2CAP];
2225                 if (hp && hp->recv_acldata) {
2226                         hp->recv_acldata(conn, skb, flags);
2227                         return;
2228                 }
2229         } else {
2230                 BT_ERR("%s ACL packet for unknown connection handle %d",
2231                         hdev->name, handle);
2232         }
2233
2234         kfree_skb(skb);
2235 }
2236
2237 /* SCO data packet */
2238 static inline void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
2239 {
2240         struct hci_sco_hdr *hdr = (void *) skb->data;
2241         struct hci_conn *conn;
2242         __u16 handle;
2243
2244         skb_pull(skb, HCI_SCO_HDR_SIZE);
2245
2246         handle = __le16_to_cpu(hdr->handle);
2247
2248         BT_DBG("%s len %d handle 0x%x", hdev->name, skb->len, handle);
2249
2250         hdev->stat.sco_rx++;
2251
2252         hci_dev_lock(hdev);
2253         conn = hci_conn_hash_lookup_handle(hdev, handle);
2254         hci_dev_unlock(hdev);
2255
2256         if (conn) {
2257                 register struct hci_proto *hp;
2258
2259                 /* Send to upper protocol */
2260                 hp = hci_proto[HCI_PROTO_SCO];
2261                 if (hp && hp->recv_scodata) {
2262                         hp->recv_scodata(conn, skb);
2263                         return;
2264                 }
2265         } else {
2266                 BT_ERR("%s SCO packet for unknown connection handle %d",
2267                         hdev->name, handle);
2268         }
2269
2270         kfree_skb(skb);
2271 }
2272
2273 static void hci_rx_task(unsigned long arg)
2274 {
2275         struct hci_dev *hdev = (struct hci_dev *) arg;
2276         struct sk_buff *skb;
2277
2278         BT_DBG("%s", hdev->name);
2279
2280         read_lock(&hci_task_lock);
2281
2282         while ((skb = skb_dequeue(&hdev->rx_q))) {
2283                 if (atomic_read(&hdev->promisc)) {
2284                         /* Send copy to the sockets */
2285                         hci_send_to_sock(hdev, skb, NULL);
2286                 }
2287
2288                 if (test_bit(HCI_RAW, &hdev->flags)) {
2289                         kfree_skb(skb);
2290                         continue;
2291                 }
2292
2293                 if (test_bit(HCI_INIT, &hdev->flags)) {
2294                         /* Don't process data packets in this states. */
2295                         switch (bt_cb(skb)->pkt_type) {
2296                         case HCI_ACLDATA_PKT:
2297                         case HCI_SCODATA_PKT:
2298                                 kfree_skb(skb);
2299                                 continue;
2300                         }
2301                 }
2302
2303                 /* Process frame */
2304                 switch (bt_cb(skb)->pkt_type) {
2305                 case HCI_EVENT_PKT:
2306                         hci_event_packet(hdev, skb);
2307                         break;
2308
2309                 case HCI_ACLDATA_PKT:
2310                         BT_DBG("%s ACL data packet", hdev->name);
2311                         hci_acldata_packet(hdev, skb);
2312                         break;
2313
2314                 case HCI_SCODATA_PKT:
2315                         BT_DBG("%s SCO data packet", hdev->name);
2316                         hci_scodata_packet(hdev, skb);
2317                         break;
2318
2319                 default:
2320                         kfree_skb(skb);
2321                         break;
2322                 }
2323         }
2324
2325         read_unlock(&hci_task_lock);
2326 }
2327
2328 static void hci_cmd_task(unsigned long arg)
2329 {
2330         struct hci_dev *hdev = (struct hci_dev *) arg;
2331         struct sk_buff *skb;
2332
2333         BT_DBG("%s cmd %d", hdev->name, atomic_read(&hdev->cmd_cnt));
2334
2335         /* Send queued commands */
2336         if (atomic_read(&hdev->cmd_cnt)) {
2337                 skb = skb_dequeue(&hdev->cmd_q);
2338                 if (!skb)
2339                         return;
2340
2341                 kfree_skb(hdev->sent_cmd);
2342
2343                 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
2344                 if (hdev->sent_cmd) {
2345                         atomic_dec(&hdev->cmd_cnt);
2346                         hci_send_frame(skb);
2347                         mod_timer(&hdev->cmd_timer,
2348                                   jiffies + msecs_to_jiffies(HCI_CMD_TIMEOUT));
2349                 } else {
2350                         skb_queue_head(&hdev->cmd_q, skb);
2351                         tasklet_schedule(&hdev->cmd_task);
2352                 }
2353         }
2354 }
2355
2356 module_param(enable_smp, bool, 0644);
2357 MODULE_PARM_DESC(enable_smp, "Enable SMP support (LE only)");