]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blame - net/bluetooth/hci_core.c
projects / mirror_ubuntu-bionic-kernel.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Disable upper layer connections when user channel is active
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
3df92b31 29#include <linux/idr.h>
1da177e4 30
8c520a59 31#include <linux/rfkill.h>
1da177e4
LT		 32
33#include <net/bluetooth/bluetooth.h>
34#include <net/bluetooth/hci_core.h>
35
b78752cc 36static void hci_rx_work(struct work_struct *work);
c347b765 37static void hci_cmd_work(struct work_struct *work);
3eff45ea 38static void hci_tx_work(struct work_struct *work);
1da177e4 39
1da177e4
LT		 40/* HCI device list */
41LIST_HEAD(hci_dev_list);
42DEFINE_RWLOCK(hci_dev_list_lock);
43
44/* HCI callback list */
45LIST_HEAD(hci_cb_list);
46DEFINE_RWLOCK(hci_cb_list_lock);
47
3df92b31
SL		 48/* HCI ID Numbering */
49static DEFINE_IDA(hci_index_ida);
50
1da177e4
LT		 51/* ---- HCI notifications ---- */
52
6516455d 53static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 54{
040030ef 55 hci_sock_dev_event(hdev, event);
1da177e4
LT		 56}
57
58/* ---- HCI requests ---- */
59
42c6b129 60static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
1da177e4 61{
42c6b129 62 BT_DBG("%s result 0x%2.2x", hdev->name, result);
1da177e4
LT		 63
64 if (hdev->req_status == HCI_REQ_PEND) {
65 hdev->req_result = result;
66 hdev->req_status = HCI_REQ_DONE;
67 wake_up_interruptible(&hdev->req_wait_q);
68 }
69}
70
71static void hci_req_cancel(struct hci_dev *hdev, int err)
72{
73 BT_DBG("%s err 0x%2.2x", hdev->name, err);
74
75 if (hdev->req_status == HCI_REQ_PEND) {
76 hdev->req_result = err;
77 hdev->req_status = HCI_REQ_CANCELED;
78 wake_up_interruptible(&hdev->req_wait_q);
79 }
80}
81
77a63e0a
FW		 82static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
83 u8 event)
75e84b7c
JH		 84{
85 struct hci_ev_cmd_complete *ev;
86 struct hci_event_hdr *hdr;
87 struct sk_buff *skb;
88
89 hci_dev_lock(hdev);
90
91 skb = hdev->recv_evt;
92 hdev->recv_evt = NULL;
93
94 hci_dev_unlock(hdev);
95
96 if (!skb)
97 return ERR_PTR(-ENODATA);
98
99 if (skb->len < sizeof(*hdr)) {
100 BT_ERR("Too short HCI event");
101 goto failed;
102 }
103
104 hdr = (void *) skb->data;
105 skb_pull(skb, HCI_EVENT_HDR_SIZE);
106
7b1abbbe
JH		 107 if (event) {
108 if (hdr->evt != event)
109 goto failed;
110 return skb;
111 }
112
75e84b7c
JH		 113 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
114 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
115 goto failed;
116 }
117
118 if (skb->len < sizeof(*ev)) {
119 BT_ERR("Too short cmd_complete event");
120 goto failed;
121 }
122
123 ev = (void *) skb->data;
124 skb_pull(skb, sizeof(*ev));
125
126 if (opcode == __le16_to_cpu(ev->opcode))
127 return skb;
128
129 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
130 __le16_to_cpu(ev->opcode));
131
132failed:
133 kfree_skb(skb);
134 return ERR_PTR(-ENODATA);
135}
136
7b1abbbe 137struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
07dc93dd 138 const void *param, u8 event, u32 timeout)
75e84b7c
JH		 139{
140 DECLARE_WAITQUEUE(wait, current);
141 struct hci_request req;
142 int err = 0;
143
144 BT_DBG("%s", hdev->name);
145
146 hci_req_init(&req, hdev);
147
7b1abbbe 148 hci_req_add_ev(&req, opcode, plen, param, event);
75e84b7c
JH		 149
150 hdev->req_status = HCI_REQ_PEND;
151
152 err = hci_req_run(&req, hci_req_sync_complete);
153 if (err < 0)
154 return ERR_PTR(err);
155
156 add_wait_queue(&hdev->req_wait_q, &wait);
157 set_current_state(TASK_INTERRUPTIBLE);
158
159 schedule_timeout(timeout);
160
161 remove_wait_queue(&hdev->req_wait_q, &wait);
162
163 if (signal_pending(current))
164 return ERR_PTR(-EINTR);
165
166 switch (hdev->req_status) {
167 case HCI_REQ_DONE:
168 err = -bt_to_errno(hdev->req_result);
169 break;
170
171 case HCI_REQ_CANCELED:
172 err = -hdev->req_result;
173 break;
174
175 default:
176 err = -ETIMEDOUT;
177 break;
178 }
179
180 hdev->req_status = hdev->req_result = 0;
181
182 BT_DBG("%s end: err %d", hdev->name, err);
183
184 if (err < 0)
185 return ERR_PTR(err);
186
7b1abbbe
JH		 187 return hci_get_cmd_complete(hdev, opcode, event);
188}
189EXPORT_SYMBOL(__hci_cmd_sync_ev);
190
191struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
07dc93dd 192 const void *param, u32 timeout)
7b1abbbe
JH		 193{
194 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
75e84b7c
JH		 195}
196EXPORT_SYMBOL(__hci_cmd_sync);
197
1da177e4 198/* Execute request and wait for completion. */
01178cd4 199static int __hci_req_sync(struct hci_dev *hdev,
42c6b129
JH		 200 void (*func)(struct hci_request *req,
201 unsigned long opt),
01178cd4 202 unsigned long opt, __u32 timeout)
1da177e4 203{
42c6b129 204 struct hci_request req;
1da177e4
LT		 205 DECLARE_WAITQUEUE(wait, current);
206 int err = 0;
207
208 BT_DBG("%s start", hdev->name);
209
42c6b129
JH		 210 hci_req_init(&req, hdev);
211
1da177e4
LT		 212 hdev->req_status = HCI_REQ_PEND;
213
42c6b129 214 func(&req, opt);
53cce22d 215
42c6b129
JH		 216 err = hci_req_run(&req, hci_req_sync_complete);
217 if (err < 0) {
53cce22d 218 hdev->req_status = 0;
920c8300
AG		 219
220 /* ENODATA means the HCI request command queue is empty.
221 * This can happen when a request with conditionals doesn't
222 * trigger any commands to be sent. This is normal behavior
223 * and should not trigger an error return.
42c6b129 224 */
920c8300
AG		 225 if (err == -ENODATA)
226 return 0;
227
228 return err;
53cce22d
JH		 229 }
230
bc4445c7
AG		 231 add_wait_queue(&hdev->req_wait_q, &wait);
232 set_current_state(TASK_INTERRUPTIBLE);
233
1da177e4
LT		 234 schedule_timeout(timeout);
235
236 remove_wait_queue(&hdev->req_wait_q, &wait);
237
238 if (signal_pending(current))
239 return -EINTR;
240
241 switch (hdev->req_status) {
242 case HCI_REQ_DONE:
e175072f 243 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 244 break;
245
246 case HCI_REQ_CANCELED:
247 err = -hdev->req_result;
248 break;
249
250 default:
251 err = -ETIMEDOUT;
252 break;
3ff50b79 253 }
1da177e4 254
a5040efa 255 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 256
257 BT_DBG("%s end: err %d", hdev->name, err);
258
259 return err;
260}
261
01178cd4 262static int hci_req_sync(struct hci_dev *hdev,
42c6b129
JH		 263 void (*req)(struct hci_request *req,
264 unsigned long opt),
01178cd4 265 unsigned long opt, __u32 timeout)
1da177e4
LT		 266{
267 int ret;
268
7c6a329e
MH		 269 if (!test_bit(HCI_UP, &hdev->flags))
270 return -ENETDOWN;
271
1da177e4
LT		 272 /* Serialize all requests */
273 hci_req_lock(hdev);
01178cd4 274 ret = __hci_req_sync(hdev, req, opt, timeout);
1da177e4
LT		 275 hci_req_unlock(hdev);
276
277 return ret;
278}
279
42c6b129 280static void hci_reset_req(struct hci_request *req, unsigned long opt)
1da177e4 281{
42c6b129 282 BT_DBG("%s %ld", req->hdev->name, opt);
1da177e4
LT		 283
284 /* Reset device */
42c6b129
JH		 285 set_bit(HCI_RESET, &req->hdev->flags);
286 hci_req_add(req, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 287}
288
42c6b129 289static void bredr_init(struct hci_request *req)
1da177e4 290{
42c6b129 291 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
2455a3ea 292
1da177e4 293 /* Read Local Supported Features */
42c6b129 294 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 295
1143e5a6 296 /* Read Local Version */
42c6b129 297 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
2177bab5
JH		 298
299 /* Read BD Address */
42c6b129 300 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1da177e4
LT		 301}
302
42c6b129 303static void amp_init(struct hci_request *req)
e61ef499 304{
42c6b129 305 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
2455a3ea 306
e61ef499 307 /* Read Local Version */
42c6b129 308 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489
AE		 309
310 /* Read Local AMP Info */
42c6b129 311 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 312
313 /* Read Data Blk size */
42c6b129 314 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
e61ef499
AE		 315}
316
42c6b129 317static void hci_init1_req(struct hci_request *req, unsigned long opt)
e61ef499 318{
42c6b129 319 struct hci_dev *hdev = req->hdev;
e61ef499
AE		 320
321 BT_DBG("%s %ld", hdev->name, opt);
322
11778716
AE		 323 /* Reset */
324 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
42c6b129 325 hci_reset_req(req, 0);
11778716 326
e61ef499
AE		 327 switch (hdev->dev_type) {
328 case HCI_BREDR:
42c6b129 329 bredr_init(req);
e61ef499
AE		 330 break;
331
332 case HCI_AMP:
42c6b129 333 amp_init(req);
e61ef499
AE		 334 break;
335
336 default:
337 BT_ERR("Unknown device type %d", hdev->dev_type);
338 break;
339 }
e61ef499
AE		 340}
341
42c6b129 342static void bredr_setup(struct hci_request *req)
2177bab5 343{
2177bab5
JH		 344 __le16 param;
345 __u8 flt_type;
346
347 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
42c6b129 348 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 349
350 /* Read Class of Device */
42c6b129 351 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
2177bab5
JH		 352
353 /* Read Local Name */
42c6b129 354 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
2177bab5
JH		 355
356 /* Read Voice Setting */
42c6b129 357 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
2177bab5
JH		 358
359 /* Clear Event Filters */
360 flt_type = HCI_FLT_CLEAR_ALL;
42c6b129 361 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
2177bab5
JH		 362
363 /* Connection accept timeout ~20 secs */
364 param = __constant_cpu_to_le16(0x7d00);
42c6b129 365 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
2177bab5 366
f332ec66
JH		 367 /* Read page scan parameters */
368 if (req->hdev->hci_ver > BLUETOOTH_VER_1_1) {
369 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
370 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
371 }
2177bab5
JH		 372}
373
42c6b129 374static void le_setup(struct hci_request *req)
2177bab5 375{
c73eee91
JH		 376 struct hci_dev *hdev = req->hdev;
377
2177bab5 378 /* Read LE Buffer Size */
42c6b129 379 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 380
381 /* Read LE Local Supported Features */
42c6b129 382 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
2177bab5
JH		 383
384 /* Read LE Advertising Channel TX Power */
42c6b129 385 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
2177bab5
JH		 386
387 /* Read LE White List Size */
42c6b129 388 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
2177bab5
JH		 389
390 /* Read LE Supported States */
42c6b129 391 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
c73eee91
JH		 392
393 /* LE-only controllers have LE implicitly enabled */
394 if (!lmp_bredr_capable(hdev))
395 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2177bab5
JH		 396}
397
398static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
399{
400 if (lmp_ext_inq_capable(hdev))
401 return 0x02;
402
403 if (lmp_inq_rssi_capable(hdev))
404 return 0x01;
405
406 if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
407 hdev->lmp_subver == 0x0757)
408 return 0x01;
409
410 if (hdev->manufacturer == 15) {
411 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
412 return 0x01;
413 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
414 return 0x01;
415 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
416 return 0x01;
417 }
418
419 if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
420 hdev->lmp_subver == 0x1805)
421 return 0x01;
422
423 return 0x00;
424}
425
42c6b129 426static void hci_setup_inquiry_mode(struct hci_request *req)
2177bab5
JH		 427{
428 u8 mode;
429
42c6b129 430 mode = hci_get_inquiry_mode(req->hdev);
2177bab5 431
42c6b129 432 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
2177bab5
JH		 433}
434
42c6b129 435static void hci_setup_event_mask(struct hci_request *req)
2177bab5 436{
42c6b129
JH		 437 struct hci_dev *hdev = req->hdev;
438
2177bab5
JH		 439 /* The second byte is 0xff instead of 0x9f (two reserved bits
440 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
441 * command otherwise.
442 */
443 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
444
445 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
446 * any event mask for pre 1.2 devices.
447 */
448 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
449 return;
450
451 if (lmp_bredr_capable(hdev)) {
452 events[4] |= 0x01; /* Flow Specification Complete */
453 events[4] |= 0x02; /* Inquiry Result with RSSI */
454 events[4] |= 0x04; /* Read Remote Extended Features Complete */
455 events[5] |= 0x08; /* Synchronous Connection Complete */
456 events[5] |= 0x10; /* Synchronous Connection Changed */
c7882cbd
MH		 457 } else {
458 /* Use a different default for LE-only devices */
459 memset(events, 0, sizeof(events));
460 events[0] |= 0x10; /* Disconnection Complete */
461 events[0] |= 0x80; /* Encryption Change */
462 events[1] |= 0x08; /* Read Remote Version Information Complete */
463 events[1] |= 0x20; /* Command Complete */
464 events[1] |= 0x40; /* Command Status */
465 events[1] |= 0x80; /* Hardware Error */
466 events[2] |= 0x04; /* Number of Completed Packets */
467 events[3] |= 0x02; /* Data Buffer Overflow */
468 events[5] |= 0x80; /* Encryption Key Refresh Complete */
2177bab5
JH		 469 }
470
471 if (lmp_inq_rssi_capable(hdev))
472 events[4] |= 0x02; /* Inquiry Result with RSSI */
473
474 if (lmp_sniffsubr_capable(hdev))
475 events[5] |= 0x20; /* Sniff Subrating */
476
477 if (lmp_pause_enc_capable(hdev))
478 events[5] |= 0x80; /* Encryption Key Refresh Complete */
479
480 if (lmp_ext_inq_capable(hdev))
481 events[5] |= 0x40; /* Extended Inquiry Result */
482
483 if (lmp_no_flush_capable(hdev))
484 events[7] |= 0x01; /* Enhanced Flush Complete */
485
486 if (lmp_lsto_capable(hdev))
487 events[6] |= 0x80; /* Link Supervision Timeout Changed */
488
489 if (lmp_ssp_capable(hdev)) {
490 events[6] |= 0x01; /* IO Capability Request */
491 events[6] |= 0x02; /* IO Capability Response */
492 events[6] |= 0x04; /* User Confirmation Request */
493 events[6] |= 0x08; /* User Passkey Request */
494 events[6] |= 0x10; /* Remote OOB Data Request */
495 events[6] |= 0x20; /* Simple Pairing Complete */
496 events[7] |= 0x04; /* User Passkey Notification */
497 events[7] |= 0x08; /* Keypress Notification */
498 events[7] |= 0x10; /* Remote Host Supported
499 * Features Notification
500 */
501 }
502
503 if (lmp_le_capable(hdev))
504 events[7] |= 0x20; /* LE Meta-Event */
505
42c6b129 506 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
2177bab5
JH		 507
508 if (lmp_le_capable(hdev)) {
509 memset(events, 0, sizeof(events));
510 events[0] = 0x1f;
42c6b129
JH		 511 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK,
512 sizeof(events), events);
2177bab5
JH		 513 }
514}
515
42c6b129 516static void hci_init2_req(struct hci_request *req, unsigned long opt)
2177bab5 517{
42c6b129
JH		 518 struct hci_dev *hdev = req->hdev;
519
2177bab5 520 if (lmp_bredr_capable(hdev))
42c6b129 521 bredr_setup(req);
2177bab5
JH		 522
523 if (lmp_le_capable(hdev))
42c6b129 524 le_setup(req);
2177bab5 525
42c6b129 526 hci_setup_event_mask(req);
2177bab5 527
3f8e2d75
JH		 528 /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
529 * local supported commands HCI command.
530 */
531 if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
42c6b129 532 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
2177bab5
JH		 533
534 if (lmp_ssp_capable(hdev)) {
535 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
536 u8 mode = 0x01;
42c6b129
JH		 537 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
538 sizeof(mode), &mode);
2177bab5
JH		 539 } else {
540 struct hci_cp_write_eir cp;
541
542 memset(hdev->eir, 0, sizeof(hdev->eir));
543 memset(&cp, 0, sizeof(cp));
544
42c6b129 545 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
2177bab5
JH		 546 }
547 }
548
549 if (lmp_inq_rssi_capable(hdev))
42c6b129 550 hci_setup_inquiry_mode(req);
2177bab5
JH		 551
552 if (lmp_inq_tx_pwr_capable(hdev))
42c6b129 553 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
2177bab5
JH		 554
555 if (lmp_ext_feat_capable(hdev)) {
556 struct hci_cp_read_local_ext_features cp;
557
558 cp.page = 0x01;
42c6b129
JH		 559 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
560 sizeof(cp), &cp);
2177bab5
JH		 561 }
562
563 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
564 u8 enable = 1;
42c6b129
JH		 565 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
566 &enable);
2177bab5
JH		 567 }
568}
569
42c6b129 570static void hci_setup_link_policy(struct hci_request *req)
2177bab5 571{
42c6b129 572 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 573 struct hci_cp_write_def_link_policy cp;
574 u16 link_policy = 0;
575
576 if (lmp_rswitch_capable(hdev))
577 link_policy |= HCI_LP_RSWITCH;
578 if (lmp_hold_capable(hdev))
579 link_policy |= HCI_LP_HOLD;
580 if (lmp_sniff_capable(hdev))
581 link_policy |= HCI_LP_SNIFF;
582 if (lmp_park_capable(hdev))
583 link_policy |= HCI_LP_PARK;
584
585 cp.policy = cpu_to_le16(link_policy);
42c6b129 586 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
2177bab5
JH		 587}
588
42c6b129 589static void hci_set_le_support(struct hci_request *req)
2177bab5 590{
42c6b129 591 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 592 struct hci_cp_write_le_host_supported cp;
593
c73eee91
JH		 594 /* LE-only devices do not support explicit enablement */
595 if (!lmp_bredr_capable(hdev))
596 return;
597
2177bab5
JH		 598 memset(&cp, 0, sizeof(cp));
599
600 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
601 cp.le = 0x01;
602 cp.simul = lmp_le_br_capable(hdev);
603 }
604
605 if (cp.le != lmp_host_le_capable(hdev))
42c6b129
JH		 606 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
607 &cp);
2177bab5
JH		 608}
609
42c6b129 610static void hci_init3_req(struct hci_request *req, unsigned long opt)
2177bab5 611{
42c6b129 612 struct hci_dev *hdev = req->hdev;
d2c5d77f 613 u8 p;
42c6b129 614
b8f4e068
GP		 615 /* Some Broadcom based Bluetooth controllers do not support the
616 * Delete Stored Link Key command. They are clearly indicating its
617 * absence in the bit mask of supported commands.
618 *
619 * Check the supported commands and only if the the command is marked
620 * as supported send it. If not supported assume that the controller
621 * does not have actual support for stored link keys which makes this
622 * command redundant anyway.
637b4cae 623 */
59f45d57
JH		 624 if (hdev->commands[6] & 0x80) {
625 struct hci_cp_delete_stored_link_key cp;
626
627 bacpy(&cp.bdaddr, BDADDR_ANY);
628 cp.delete_all = 0x01;
629 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
630 sizeof(cp), &cp);
631 }
632
2177bab5 633 if (hdev->commands[5] & 0x10)
42c6b129 634 hci_setup_link_policy(req);
2177bab5 635
04b4edcb 636 if (lmp_le_capable(hdev)) {
42c6b129 637 hci_set_le_support(req);
04b4edcb
JH		 638 hci_update_ad(req);
639 }
d2c5d77f
JH		 640
641 /* Read features beyond page 1 if available */
642 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
643 struct hci_cp_read_local_ext_features cp;
644
645 cp.page = p;
646 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
647 sizeof(cp), &cp);
648 }
2177bab5
JH		 649}
650
651static int __hci_init(struct hci_dev *hdev)
652{
653 int err;
654
655 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
656 if (err < 0)
657 return err;
658
659 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
660 * BR/EDR/LE type controllers. AMP controllers only need the
661 * first stage init.
662 */
663 if (hdev->dev_type != HCI_BREDR)
664 return 0;
665
666 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
667 if (err < 0)
668 return err;
669
670 return __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
671}
672
42c6b129 673static void hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 674{
675 __u8 scan = opt;
676
42c6b129 677 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 678
679 /* Inquiry and Page scans */
42c6b129 680 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 681}
682
42c6b129 683static void hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 684{
685 __u8 auth = opt;
686
42c6b129 687 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 688
689 /* Authentication */
42c6b129 690 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 691}
692
42c6b129 693static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 694{
695 __u8 encrypt = opt;
696
42c6b129 697 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 698
e4e8e37c 699 /* Encryption */
42c6b129 700 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 701}
702
42c6b129 703static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 704{
705 __le16 policy = cpu_to_le16(opt);
706
42c6b129 707 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 708
709 /* Default link policy */
42c6b129 710 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
e4e8e37c
MH		 711}
712
8e87d142 713/* Get HCI device by index.
1da177e4
LT		 714 * Device is held on return. */
715struct hci_dev *hci_dev_get(int index)
716{
8035ded4 717 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 718
719 BT_DBG("%d", index);
720
721 if (index < 0)
722 return NULL;
723
724 read_lock(&hci_dev_list_lock);
8035ded4 725 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 726 if (d->id == index) {
727 hdev = hci_dev_hold(d);
728 break;
729 }
730 }
731 read_unlock(&hci_dev_list_lock);
732 return hdev;
733}
1da177e4
LT		 734
735/* ---- Inquiry support ---- */
ff9ef578 736
30dc78e1
JH		 737bool hci_discovery_active(struct hci_dev *hdev)
738{
739 struct discovery_state *discov = &hdev->discovery;
740
6fbe195d 741 switch (discov->state) {
343f935b 742 case DISCOVERY_FINDING:
6fbe195d 743 case DISCOVERY_RESOLVING:
30dc78e1
JH		 744 return true;
745
6fbe195d
AG		 746 default:
747 return false;
748 }
30dc78e1
JH		 749}
750
ff9ef578
JH		 751void hci_discovery_set_state(struct hci_dev *hdev, int state)
752{
753 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
754
755 if (hdev->discovery.state == state)
756 return;
757
758 switch (state) {
759 case DISCOVERY_STOPPED:
7b99b659
AG		 760 if (hdev->discovery.state != DISCOVERY_STARTING)
761 mgmt_discovering(hdev, 0);
ff9ef578
JH		 762 break;
763 case DISCOVERY_STARTING:
764 break;
343f935b 765 case DISCOVERY_FINDING:
ff9ef578
JH		 766 mgmt_discovering(hdev, 1);
767 break;
30dc78e1
JH		 768 case DISCOVERY_RESOLVING:
769 break;
ff9ef578
JH		 770 case DISCOVERY_STOPPING:
771 break;
772 }
773
774 hdev->discovery.state = state;
775}
776
1f9b9a5d 777void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 778{
30883512 779 struct discovery_state *cache = &hdev->discovery;
b57c1a56 780 struct inquiry_entry *p, *n;
1da177e4 781
561aafbc
JH		 782 list_for_each_entry_safe(p, n, &cache->all, all) {
783 list_del(&p->all);
b57c1a56 784 kfree(p);
1da177e4 785 }
561aafbc
JH		 786
787 INIT_LIST_HEAD(&cache->unknown);
788 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 789}
790
a8c5fb1a
GP		 791struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
792 bdaddr_t *bdaddr)
1da177e4 793{
30883512 794 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 795 struct inquiry_entry *e;
796
6ed93dc6 797 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 798
561aafbc
JH		 799 list_for_each_entry(e, &cache->all, all) {
800 if (!bacmp(&e->data.bdaddr, bdaddr))
801 return e;
802 }
803
804 return NULL;
805}
806
807struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 808 bdaddr_t *bdaddr)
561aafbc 809{
30883512 810 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 811 struct inquiry_entry *e;
812
6ed93dc6 813 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 814
815 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 816 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 817 return e;
818 }
819
820 return NULL;
1da177e4
LT		 821}
822
30dc78e1 823struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 824 bdaddr_t *bdaddr,
825 int state)
30dc78e1
JH		 826{
827 struct discovery_state *cache = &hdev->discovery;
828 struct inquiry_entry *e;
829
6ed93dc6 830 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 831
832 list_for_each_entry(e, &cache->resolve, list) {
833 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
834 return e;
835 if (!bacmp(&e->data.bdaddr, bdaddr))
836 return e;
837 }
838
839 return NULL;
840}
841
a3d4e20a 842void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 843 struct inquiry_entry *ie)
a3d4e20a
JH		 844{
845 struct discovery_state *cache = &hdev->discovery;
846 struct list_head *pos = &cache->resolve;
847 struct inquiry_entry *p;
848
849 list_del(&ie->list);
850
851 list_for_each_entry(p, &cache->resolve, list) {
852 if (p->name_state != NAME_PENDING &&
a8c5fb1a 853 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 854 break;
855 pos = &p->list;
856 }
857
858 list_add(&ie->list, pos);
859}
860
3175405b 861bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
04124681 862 bool name_known, bool *ssp)
1da177e4 863{
30883512 864 struct discovery_state *cache = &hdev->discovery;
70f23020 865 struct inquiry_entry *ie;
1da177e4 866
6ed93dc6 867 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 868
2b2fec4d
SJ		 869 hci_remove_remote_oob_data(hdev, &data->bdaddr);
870
388fc8fa
JH		 871 if (ssp)
872 *ssp = data->ssp_mode;
873
70f23020 874 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 875 if (ie) {
388fc8fa
JH		 876 if (ie->data.ssp_mode && ssp)
877 *ssp = true;
878
a3d4e20a 879 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 880 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 881 ie->data.rssi = data->rssi;
882 hci_inquiry_cache_update_resolve(hdev, ie);
883 }
884
561aafbc 885 goto update;
a3d4e20a 886 }
561aafbc
JH		 887
888 /* Entry not in the cache. Add new one. */
889 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
890 if (!ie)
3175405b 891 return false;
561aafbc
JH		 892
893 list_add(&ie->all, &cache->all);
894
895 if (name_known) {
896 ie->name_state = NAME_KNOWN;
897 } else {
898 ie->name_state = NAME_NOT_KNOWN;
899 list_add(&ie->list, &cache->unknown);
900 }
70f23020 901
561aafbc
JH		 902update:
903 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 904 ie->name_state != NAME_PENDING) {
561aafbc
JH		 905 ie->name_state = NAME_KNOWN;
906 list_del(&ie->list);
1da177e4
LT		 907 }
908
70f23020
AE		 909 memcpy(&ie->data, data, sizeof(*data));
910 ie->timestamp = jiffies;
1da177e4 911 cache->timestamp = jiffies;
3175405b
JH		 912
913 if (ie->name_state == NAME_NOT_KNOWN)
914 return false;
915
916 return true;
1da177e4
LT		 917}
918
919static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
920{
30883512 921 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 922 struct inquiry_info *info = (struct inquiry_info *) buf;
923 struct inquiry_entry *e;
924 int copied = 0;
925
561aafbc 926 list_for_each_entry(e, &cache->all, all) {
1da177e4 927 struct inquiry_data *data = &e->data;
b57c1a56
JH		 928
929 if (copied >= num)
930 break;
931
1da177e4
LT		 932 bacpy(&info->bdaddr, &data->bdaddr);
933 info->pscan_rep_mode = data->pscan_rep_mode;
934 info->pscan_period_mode = data->pscan_period_mode;
935 info->pscan_mode = data->pscan_mode;
936 memcpy(info->dev_class, data->dev_class, 3);
937 info->clock_offset = data->clock_offset;
b57c1a56 938
1da177e4 939 info++;
b57c1a56 940 copied++;
1da177e4
LT		 941 }
942
943 BT_DBG("cache %p, copied %d", cache, copied);
944 return copied;
945}
946
42c6b129 947static void hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 948{
949 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 950 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 951 struct hci_cp_inquiry cp;
952
953 BT_DBG("%s", hdev->name);
954
955 if (test_bit(HCI_INQUIRY, &hdev->flags))
956 return;
957
958 /* Start Inquiry */
959 memcpy(&cp.lap, &ir->lap, 3);
960 cp.length = ir->length;
961 cp.num_rsp = ir->num_rsp;
42c6b129 962 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 963}
964
3e13fa1e
AG		 965static int wait_inquiry(void *word)
966{
967 schedule();
968 return signal_pending(current);
969}
970
1da177e4
LT		 971int hci_inquiry(void __user *arg)
972{
973 __u8 __user *ptr = arg;
974 struct hci_inquiry_req ir;
975 struct hci_dev *hdev;
976 int err = 0, do_inquiry = 0, max_rsp;
977 long timeo;
978 __u8 *buf;
979
980 if (copy_from_user(&ir, ptr, sizeof(ir)))
981 return -EFAULT;
982
5a08ecce
AE		 983 hdev = hci_dev_get(ir.dev_id);
984 if (!hdev)
1da177e4
LT		 985 return -ENODEV;
986
0736cfa8
MH		 987 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
988 err = -EBUSY;
989 goto done;
990 }
991
09fd0de5 992 hci_dev_lock(hdev);
8e87d142 993 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 994 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 995 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 996 do_inquiry = 1;
997 }
09fd0de5 998 hci_dev_unlock(hdev);
1da177e4 999
04837f64 1000 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 1001
1002 if (do_inquiry) {
01178cd4
JH		 1003 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1004 timeo);
70f23020
AE		 1005 if (err < 0)
1006 goto done;
3e13fa1e
AG		 1007
1008 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1009 * cleared). If it is interrupted by a signal, return -EINTR.
1010 */
1011 if (wait_on_bit(&hdev->flags, HCI_INQUIRY, wait_inquiry,
1012 TASK_INTERRUPTIBLE))
1013 return -EINTR;
70f23020 1014 }
1da177e4 1015
8fc9ced3
GP		 1016 /* for unlimited number of responses we will use buffer with
1017 * 255 entries
1018 */
1da177e4
LT		 1019 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1020
1021 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1022 * copy it to the user space.
1023 */
01df8c31 1024 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 1025 if (!buf) {
1da177e4
LT		 1026 err = -ENOMEM;
1027 goto done;
1028 }
1029
09fd0de5 1030 hci_dev_lock(hdev);
1da177e4 1031 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 1032 hci_dev_unlock(hdev);
1da177e4
LT		 1033
1034 BT_DBG("num_rsp %d", ir.num_rsp);
1035
1036 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1037 ptr += sizeof(ir);
1038 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 1039 ir.num_rsp))
1da177e4 1040 err = -EFAULT;
8e87d142 1041 } else
1da177e4
LT		 1042 err = -EFAULT;
1043
1044 kfree(buf);
1045
1046done:
1047 hci_dev_put(hdev);
1048 return err;
1049}
1050
3f0f524b
JH		 1051static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
1052{
1053 u8 ad_len = 0, flags = 0;
1054 size_t name_len;
1055
1056 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
1057 flags |= LE_AD_GENERAL;
1058
1059 if (!lmp_bredr_capable(hdev))
1060 flags |= LE_AD_NO_BREDR;
1061
1062 if (lmp_le_br_capable(hdev))
1063 flags |= LE_AD_SIM_LE_BREDR_CTRL;
1064
1065 if (lmp_host_le_br_capable(hdev))
1066 flags |= LE_AD_SIM_LE_BREDR_HOST;
1067
1068 if (flags) {
1069 BT_DBG("adv flags 0x%02x", flags);
1070
1071 ptr[0] = 2;
1072 ptr[1] = EIR_FLAGS;
1073 ptr[2] = flags;
1074
1075 ad_len += 3;
1076 ptr += 3;
1077 }
1078
1079 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
1080 ptr[0] = 2;
1081 ptr[1] = EIR_TX_POWER;
1082 ptr[2] = (u8) hdev->adv_tx_power;
1083
1084 ad_len += 3;
1085 ptr += 3;
1086 }
1087
1088 name_len = strlen(hdev->dev_name);
1089 if (name_len > 0) {
1090 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
1091
1092 if (name_len > max_len) {
1093 name_len = max_len;
1094 ptr[1] = EIR_NAME_SHORT;
1095 } else
1096 ptr[1] = EIR_NAME_COMPLETE;
1097
1098 ptr[0] = name_len + 1;
1099
1100 memcpy(ptr + 2, hdev->dev_name, name_len);
1101
1102 ad_len += (name_len + 2);
1103 ptr += (name_len + 2);
1104 }
1105
1106 return ad_len;
1107}
1108
04b4edcb 1109void hci_update_ad(struct hci_request *req)
3f0f524b 1110{
04b4edcb 1111 struct hci_dev *hdev = req->hdev;
3f0f524b
JH		 1112 struct hci_cp_le_set_adv_data cp;
1113 u8 len;
3f0f524b 1114
04b4edcb
JH		 1115 if (!lmp_le_capable(hdev))
1116 return;
3f0f524b
JH		 1117
1118 memset(&cp, 0, sizeof(cp));
1119
1120 len = create_ad(hdev, cp.data);
1121
1122 if (hdev->adv_data_len == len &&
04b4edcb
JH		 1123 memcmp(cp.data, hdev->adv_data, len) == 0)
1124 return;
3f0f524b
JH		 1125
1126 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1127 hdev->adv_data_len = len;
1128
1129 cp.length = len;
3f0f524b 1130
04b4edcb 1131 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
3f0f524b
JH		 1132}
1133
1da177e4
LT		 1134/* ---- HCI ioctl helpers ---- */
1135
1136int hci_dev_open(__u16 dev)
1137{
1138 struct hci_dev *hdev;
1139 int ret = 0;
1140
5a08ecce
AE		 1141 hdev = hci_dev_get(dev);
1142 if (!hdev)
1da177e4
LT		 1143 return -ENODEV;
1144
1145 BT_DBG("%s %p", hdev->name, hdev);
1146
1147 hci_req_lock(hdev);
1148
94324962
JH		 1149 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
1150 ret = -ENODEV;
1151 goto done;
1152 }
1153
611b30f7
MH		 1154 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
1155 ret = -ERFKILL;
1156 goto done;
1157 }
1158
1da177e4
LT		 1159 if (test_bit(HCI_UP, &hdev->flags)) {
1160 ret = -EALREADY;
1161 goto done;
1162 }
1163
1da177e4
LT		 1164 if (hdev->open(hdev)) {
1165 ret = -EIO;
1166 goto done;
1167 }
1168
f41c70c4
MH		 1169 atomic_set(&hdev->cmd_cnt, 1);
1170 set_bit(HCI_INIT, &hdev->flags);
1171
1172 if (hdev->setup && test_bit(HCI_SETUP, &hdev->dev_flags))
1173 ret = hdev->setup(hdev);
1174
1175 if (!ret) {
1176 /* Treat all non BR/EDR controllers as raw devices if
1177 * enable_hs is not set.
1178 */
1179 if (hdev->dev_type != HCI_BREDR && !enable_hs)
1180 set_bit(HCI_RAW, &hdev->flags);
1181
1182 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
1183 set_bit(HCI_RAW, &hdev->flags);
1184
0736cfa8
MH		 1185 if (!test_bit(HCI_RAW, &hdev->flags) &&
1186 !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
f41c70c4 1187 ret = __hci_init(hdev);
1da177e4
LT		 1188 }
1189
f41c70c4
MH		 1190 clear_bit(HCI_INIT, &hdev->flags);
1191
1da177e4
LT		 1192 if (!ret) {
1193 hci_dev_hold(hdev);
1194 set_bit(HCI_UP, &hdev->flags);
1195 hci_notify(hdev, HCI_DEV_UP);
bb4b2a9a 1196 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
0736cfa8 1197 !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
bb4b2a9a 1198 mgmt_valid_hdev(hdev)) {
09fd0de5 1199 hci_dev_lock(hdev);
744cf19e 1200 mgmt_powered(hdev, 1);
09fd0de5 1201 hci_dev_unlock(hdev);
56e5cb86 1202 }
8e87d142 1203 } else {
1da177e4 1204 /* Init failed, cleanup */
3eff45ea 1205 flush_work(&hdev->tx_work);
c347b765 1206 flush_work(&hdev->cmd_work);
b78752cc 1207 flush_work(&hdev->rx_work);
1da177e4
LT		 1208
1209 skb_queue_purge(&hdev->cmd_q);
1210 skb_queue_purge(&hdev->rx_q);
1211
1212 if (hdev->flush)
1213 hdev->flush(hdev);
1214
1215 if (hdev->sent_cmd) {
1216 kfree_skb(hdev->sent_cmd);
1217 hdev->sent_cmd = NULL;
1218 }
1219
1220 hdev->close(hdev);
1221 hdev->flags = 0;
1222 }
1223
1224done:
1225 hci_req_unlock(hdev);
1226 hci_dev_put(hdev);
1227 return ret;
1228}
1229
1230static int hci_dev_do_close(struct hci_dev *hdev)
1231{
1232 BT_DBG("%s %p", hdev->name, hdev);
1233
78c04c0b
VCG		 1234 cancel_delayed_work(&hdev->power_off);
1235
1da177e4
LT		 1236 hci_req_cancel(hdev, ENODEV);
1237 hci_req_lock(hdev);
1238
1239 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
b79f44c1 1240 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 1241 hci_req_unlock(hdev);
1242 return 0;
1243 }
1244
3eff45ea
GP		 1245 /* Flush RX and TX works */
1246 flush_work(&hdev->tx_work);
b78752cc 1247 flush_work(&hdev->rx_work);
1da177e4 1248
16ab91ab 1249 if (hdev->discov_timeout > 0) {
e0f9309f 1250 cancel_delayed_work(&hdev->discov_off);
16ab91ab 1251 hdev->discov_timeout = 0;
5e5282bb 1252 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
16ab91ab
JH		 1253 }
1254
a8b2d5c2 1255 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 1256 cancel_delayed_work(&hdev->service_cache);
1257
7ba8b4be
AG		 1258 cancel_delayed_work_sync(&hdev->le_scan_disable);
1259
09fd0de5 1260 hci_dev_lock(hdev);
1f9b9a5d 1261 hci_inquiry_cache_flush(hdev);
1da177e4 1262 hci_conn_hash_flush(hdev);
09fd0de5 1263 hci_dev_unlock(hdev);
1da177e4
LT		 1264
1265 hci_notify(hdev, HCI_DEV_DOWN);
1266
1267 if (hdev->flush)
1268 hdev->flush(hdev);
1269
1270 /* Reset device */
1271 skb_queue_purge(&hdev->cmd_q);
1272 atomic_set(&hdev->cmd_cnt, 1);
8af59467 1273 if (!test_bit(HCI_RAW, &hdev->flags) &&
a6c511c6 1274 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1da177e4 1275 set_bit(HCI_INIT, &hdev->flags);
01178cd4 1276 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1da177e4
LT		 1277 clear_bit(HCI_INIT, &hdev->flags);
1278 }
1279
c347b765
GP		 1280 /* flush cmd work */
1281 flush_work(&hdev->cmd_work);
1da177e4
LT		 1282
1283 /* Drop queues */
1284 skb_queue_purge(&hdev->rx_q);
1285 skb_queue_purge(&hdev->cmd_q);
1286 skb_queue_purge(&hdev->raw_q);
1287
1288 /* Drop last sent command */
1289 if (hdev->sent_cmd) {
b79f44c1 1290 del_timer_sync(&hdev->cmd_timer);
1da177e4
LT		 1291 kfree_skb(hdev->sent_cmd);
1292 hdev->sent_cmd = NULL;
1293 }
1294
b6ddb638
JH		 1295 kfree_skb(hdev->recv_evt);
1296 hdev->recv_evt = NULL;
1297
1da177e4
LT		 1298 /* After this point our queues are empty
1299 * and no tasks are scheduled. */
1300 hdev->close(hdev);
1301
35b973c9
JH		 1302 /* Clear flags */
1303 hdev->flags = 0;
1304 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
1305
bb4b2a9a
AE		 1306 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
1307 mgmt_valid_hdev(hdev)) {
8ee56540
MH		 1308 hci_dev_lock(hdev);
1309 mgmt_powered(hdev, 0);
1310 hci_dev_unlock(hdev);
1311 }
5add6af8 1312
ced5c338
AE		 1313 /* Controller radio is available but is currently powered down */
1314 hdev->amp_status = 0;
1315
e59fda8d 1316 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 1317 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
e59fda8d 1318
1da177e4
LT		 1319 hci_req_unlock(hdev);
1320
1321 hci_dev_put(hdev);
1322 return 0;
1323}
1324
1325int hci_dev_close(__u16 dev)
1326{
1327 struct hci_dev *hdev;
1328 int err;
1329
70f23020
AE		 1330 hdev = hci_dev_get(dev);
1331 if (!hdev)
1da177e4 1332 return -ENODEV;
8ee56540 1333
0736cfa8
MH		 1334 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1335 err = -EBUSY;
1336 goto done;
1337 }
1338
8ee56540
MH		 1339 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1340 cancel_delayed_work(&hdev->power_off);
1341
1da177e4 1342 err = hci_dev_do_close(hdev);
8ee56540 1343
0736cfa8 1344done:
1da177e4
LT		 1345 hci_dev_put(hdev);
1346 return err;
1347}
1348
1349int hci_dev_reset(__u16 dev)
1350{
1351 struct hci_dev *hdev;
1352 int ret = 0;
1353
70f23020
AE		 1354 hdev = hci_dev_get(dev);
1355 if (!hdev)
1da177e4
LT		 1356 return -ENODEV;
1357
1358 hci_req_lock(hdev);
1da177e4 1359
808a049e
MH		 1360 if (!test_bit(HCI_UP, &hdev->flags)) {
1361 ret = -ENETDOWN;
1da177e4 1362 goto done;
808a049e 1363 }
1da177e4 1364
0736cfa8
MH		 1365 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1366 ret = -EBUSY;
1367 goto done;
1368 }
1369
1da177e4
LT		 1370 /* Drop queues */
1371 skb_queue_purge(&hdev->rx_q);
1372 skb_queue_purge(&hdev->cmd_q);
1373
09fd0de5 1374 hci_dev_lock(hdev);
1f9b9a5d 1375 hci_inquiry_cache_flush(hdev);
1da177e4 1376 hci_conn_hash_flush(hdev);
09fd0de5 1377 hci_dev_unlock(hdev);
1da177e4
LT		 1378
1379 if (hdev->flush)
1380 hdev->flush(hdev);
1381
8e87d142 1382 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 1383 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4
LT		 1384
1385 if (!test_bit(HCI_RAW, &hdev->flags))
01178cd4 1386 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1da177e4
LT		 1387
1388done:
1da177e4
LT		 1389 hci_req_unlock(hdev);
1390 hci_dev_put(hdev);
1391 return ret;
1392}
1393
1394int hci_dev_reset_stat(__u16 dev)
1395{
1396 struct hci_dev *hdev;
1397 int ret = 0;
1398
70f23020
AE		 1399 hdev = hci_dev_get(dev);
1400 if (!hdev)
1da177e4
LT		 1401 return -ENODEV;
1402
0736cfa8
MH		 1403 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1404 ret = -EBUSY;
1405 goto done;
1406 }
1407
1da177e4
LT		 1408 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1409
0736cfa8 1410done:
1da177e4 1411 hci_dev_put(hdev);
1da177e4
LT		 1412 return ret;
1413}
1414
1415int hci_dev_cmd(unsigned int cmd, void __user *arg)
1416{
1417 struct hci_dev *hdev;
1418 struct hci_dev_req dr;
1419 int err = 0;
1420
1421 if (copy_from_user(&dr, arg, sizeof(dr)))
1422 return -EFAULT;
1423
70f23020
AE		 1424 hdev = hci_dev_get(dr.dev_id);
1425 if (!hdev)
1da177e4
LT		 1426 return -ENODEV;
1427
0736cfa8
MH		 1428 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1429 err = -EBUSY;
1430 goto done;
1431 }
1432
1da177e4
LT		 1433 switch (cmd) {
1434 case HCISETAUTH:
01178cd4
JH		 1435 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1436 HCI_INIT_TIMEOUT);
1da177e4
LT		 1437 break;
1438
1439 case HCISETENCRYPT:
1440 if (!lmp_encrypt_capable(hdev)) {
1441 err = -EOPNOTSUPP;
1442 break;
1443 }
1444
1445 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1446 /* Auth must be enabled first */
01178cd4
JH		 1447 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1448 HCI_INIT_TIMEOUT);
1da177e4
LT		 1449 if (err)
1450 break;
1451 }
1452
01178cd4
JH		 1453 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1454 HCI_INIT_TIMEOUT);
1da177e4
LT		 1455 break;
1456
1457 case HCISETSCAN:
01178cd4
JH		 1458 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1459 HCI_INIT_TIMEOUT);
1da177e4
LT		 1460 break;
1461
1da177e4 1462 case HCISETLINKPOL:
01178cd4
JH		 1463 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1464 HCI_INIT_TIMEOUT);
1da177e4
LT		 1465 break;
1466
1467 case HCISETLINKMODE:
e4e8e37c
MH		 1468 hdev->link_mode = ((__u16) dr.dev_opt) &
1469 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1470 break;
1471
1472 case HCISETPTYPE:
1473 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 1474 break;
1475
1476 case HCISETACLMTU:
e4e8e37c
MH		 1477 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1478 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1479 break;
1480
1481 case HCISETSCOMTU:
e4e8e37c
MH		 1482 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1483 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1484 break;
1485
1486 default:
1487 err = -EINVAL;
1488 break;
1489 }
e4e8e37c 1490
0736cfa8 1491done:
1da177e4
LT		 1492 hci_dev_put(hdev);
1493 return err;
1494}
1495
1496int hci_get_dev_list(void __user *arg)
1497{
8035ded4 1498 struct hci_dev *hdev;
1da177e4
LT		 1499 struct hci_dev_list_req *dl;
1500 struct hci_dev_req *dr;
1da177e4
LT		 1501 int n = 0, size, err;
1502 __u16 dev_num;
1503
1504 if (get_user(dev_num, (__u16 __user *) arg))
1505 return -EFAULT;
1506
1507 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1508 return -EINVAL;
1509
1510 size = sizeof(*dl) + dev_num * sizeof(*dr);
1511
70f23020
AE		 1512 dl = kzalloc(size, GFP_KERNEL);
1513 if (!dl)
1da177e4
LT		 1514 return -ENOMEM;
1515
1516 dr = dl->dev_req;
1517
f20d09d5 1518 read_lock(&hci_dev_list_lock);
8035ded4 1519 list_for_each_entry(hdev, &hci_dev_list, list) {
a8b2d5c2 1520 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
e0f9309f 1521 cancel_delayed_work(&hdev->power_off);
c542a06c 1522
a8b2d5c2
JH		 1523 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1524 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1525
1da177e4
LT		 1526 (dr + n)->dev_id = hdev->id;
1527 (dr + n)->dev_opt = hdev->flags;
c542a06c 1528
1da177e4
LT		 1529 if (++n >= dev_num)
1530 break;
1531 }
f20d09d5 1532 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 1533
1534 dl->dev_num = n;
1535 size = sizeof(*dl) + n * sizeof(*dr);
1536
1537 err = copy_to_user(arg, dl, size);
1538 kfree(dl);
1539
1540 return err ? -EFAULT : 0;
1541}
1542
1543int hci_get_dev_info(void __user *arg)
1544{
1545 struct hci_dev *hdev;
1546 struct hci_dev_info di;
1547 int err = 0;
1548
1549 if (copy_from_user(&di, arg, sizeof(di)))
1550 return -EFAULT;
1551
70f23020
AE		 1552 hdev = hci_dev_get(di.dev_id);
1553 if (!hdev)
1da177e4
LT		 1554 return -ENODEV;
1555
a8b2d5c2 1556 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
3243553f 1557 cancel_delayed_work_sync(&hdev->power_off);
ab81cbf9 1558
a8b2d5c2
JH		 1559 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1560 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
c542a06c 1561
1da177e4
LT		 1562 strcpy(di.name, hdev->name);
1563 di.bdaddr = hdev->bdaddr;
943da25d 1564 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1da177e4
LT		 1565 di.flags = hdev->flags;
1566 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 1567 if (lmp_bredr_capable(hdev)) {
1568 di.acl_mtu = hdev->acl_mtu;
1569 di.acl_pkts = hdev->acl_pkts;
1570 di.sco_mtu = hdev->sco_mtu;
1571 di.sco_pkts = hdev->sco_pkts;
1572 } else {
1573 di.acl_mtu = hdev->le_mtu;
1574 di.acl_pkts = hdev->le_pkts;
1575 di.sco_mtu = 0;
1576 di.sco_pkts = 0;
1577 }
1da177e4
LT		 1578 di.link_policy = hdev->link_policy;
1579 di.link_mode = hdev->link_mode;
1580
1581 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1582 memcpy(&di.features, &hdev->features, sizeof(di.features));
1583
1584 if (copy_to_user(arg, &di, sizeof(di)))
1585 err = -EFAULT;
1586
1587 hci_dev_put(hdev);
1588
1589 return err;
1590}
1591
1592/* ---- Interface to HCI drivers ---- */
1593
611b30f7
MH		 1594static int hci_rfkill_set_block(void *data, bool blocked)
1595{
1596 struct hci_dev *hdev = data;
1597
1598 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1599
0736cfa8
MH		 1600 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
1601 return -EBUSY;
1602
611b30f7
MH		 1603 if (!blocked)
1604 return 0;
1605
1606 hci_dev_do_close(hdev);
1607
1608 return 0;
1609}
1610
1611static const struct rfkill_ops hci_rfkill_ops = {
1612 .set_block = hci_rfkill_set_block,
1613};
1614
ab81cbf9
JH		 1615static void hci_power_on(struct work_struct *work)
1616{
1617 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 1618 int err;
ab81cbf9
JH		 1619
1620 BT_DBG("%s", hdev->name);
1621
96570ffc
JH		 1622 err = hci_dev_open(hdev->id);
1623 if (err < 0) {
1624 mgmt_set_powered_failed(hdev, err);
ab81cbf9 1625 return;
96570ffc 1626 }
ab81cbf9 1627
a8b2d5c2 1628 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
19202573
JH		 1629 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1630 HCI_AUTO_OFF_TIMEOUT);
ab81cbf9 1631
a8b2d5c2 1632 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
744cf19e 1633 mgmt_index_added(hdev);
ab81cbf9
JH		 1634}
1635
1636static void hci_power_off(struct work_struct *work)
1637{
3243553f 1638 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 1639 power_off.work);
ab81cbf9
JH		 1640
1641 BT_DBG("%s", hdev->name);
1642
8ee56540 1643 hci_dev_do_close(hdev);
ab81cbf9
JH		 1644}
1645
16ab91ab
JH		 1646static void hci_discov_off(struct work_struct *work)
1647{
1648 struct hci_dev *hdev;
1649 u8 scan = SCAN_PAGE;
1650
1651 hdev = container_of(work, struct hci_dev, discov_off.work);
1652
1653 BT_DBG("%s", hdev->name);
1654
09fd0de5 1655 hci_dev_lock(hdev);
16ab91ab
JH		 1656
1657 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1658
1659 hdev->discov_timeout = 0;
1660
09fd0de5 1661 hci_dev_unlock(hdev);
16ab91ab
JH		 1662}
1663
2aeb9a1a
JH		 1664int hci_uuids_clear(struct hci_dev *hdev)
1665{
4821002c 1666 struct bt_uuid *uuid, *tmp;
2aeb9a1a 1667
4821002c
JH		 1668 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1669 list_del(&uuid->list);
2aeb9a1a
JH		 1670 kfree(uuid);
1671 }
1672
1673 return 0;
1674}
1675
55ed8ca1
JH		 1676int hci_link_keys_clear(struct hci_dev *hdev)
1677{
1678 struct list_head *p, *n;
1679
1680 list_for_each_safe(p, n, &hdev->link_keys) {
1681 struct link_key *key;
1682
1683 key = list_entry(p, struct link_key, list);
1684
1685 list_del(p);
1686 kfree(key);
1687 }
1688
1689 return 0;
1690}
1691
b899efaf
VCG		 1692int hci_smp_ltks_clear(struct hci_dev *hdev)
1693{
1694 struct smp_ltk *k, *tmp;
1695
1696 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1697 list_del(&k->list);
1698 kfree(k);
1699 }
1700
1701 return 0;
1702}
1703
55ed8ca1
JH		 1704struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1705{
8035ded4 1706 struct link_key *k;
55ed8ca1 1707
8035ded4 1708 list_for_each_entry(k, &hdev->link_keys, list)
55ed8ca1
JH		 1709 if (bacmp(bdaddr, &k->bdaddr) == 0)
1710 return k;
55ed8ca1
JH		 1711
1712 return NULL;
1713}
1714
745c0ce3 1715static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 1716 u8 key_type, u8 old_key_type)
d25e28ab
JH		 1717{
1718 /* Legacy key */
1719 if (key_type < 0x03)
745c0ce3 1720 return true;
d25e28ab
JH		 1721
1722 /* Debug keys are insecure so don't store them persistently */
1723 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 1724 return false;
d25e28ab
JH		 1725
1726 /* Changed combination key and there's no previous one */
1727 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 1728 return false;
d25e28ab
JH		 1729
1730 /* Security mode 3 case */
1731 if (!conn)
745c0ce3 1732 return true;
d25e28ab
JH		 1733
1734 /* Neither local nor remote side had no-bonding as requirement */
1735 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 1736 return true;
d25e28ab
JH		 1737
1738 /* Local side had dedicated bonding as requirement */
1739 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 1740 return true;
d25e28ab
JH		 1741
1742 /* Remote side had dedicated bonding as requirement */
1743 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 1744 return true;
d25e28ab
JH		 1745
1746 /* If none of the above criteria match, then don't store the key
1747 * persistently */
745c0ce3 1748 return false;
d25e28ab
JH		 1749}
1750
c9839a11 1751struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
75d262c2 1752{
c9839a11 1753 struct smp_ltk *k;
75d262c2 1754
c9839a11
VCG		 1755 list_for_each_entry(k, &hdev->long_term_keys, list) {
1756 if (k->ediv != ediv ||
a8c5fb1a 1757 memcmp(rand, k->rand, sizeof(k->rand)))
75d262c2
VCG		 1758 continue;
1759
c9839a11 1760 return k;
75d262c2
VCG		 1761 }
1762
1763 return NULL;
1764}
75d262c2 1765
c9839a11 1766struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
04124681 1767 u8 addr_type)
75d262c2 1768{
c9839a11 1769 struct smp_ltk *k;
75d262c2 1770
c9839a11
VCG		 1771 list_for_each_entry(k, &hdev->long_term_keys, list)
1772 if (addr_type == k->bdaddr_type &&
a8c5fb1a 1773 bacmp(bdaddr, &k->bdaddr) == 0)
75d262c2
VCG		 1774 return k;
1775
1776 return NULL;
1777}
75d262c2 1778
d25e28ab 1779int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
04124681 1780 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
55ed8ca1
JH		 1781{
1782 struct link_key *key, *old_key;
745c0ce3
VA		 1783 u8 old_key_type;
1784 bool persistent;
55ed8ca1
JH		 1785
1786 old_key = hci_find_link_key(hdev, bdaddr);
1787 if (old_key) {
1788 old_key_type = old_key->type;
1789 key = old_key;
1790 } else {
12adcf3a 1791 old_key_type = conn ? conn->key_type : 0xff;
55ed8ca1
JH		 1792 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1793 if (!key)
1794 return -ENOMEM;
1795 list_add(&key->list, &hdev->link_keys);
1796 }
1797
6ed93dc6 1798 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 1799
d25e28ab
JH		 1800 /* Some buggy controller combinations generate a changed
1801 * combination key for legacy pairing even when there's no
1802 * previous key */
1803 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 1804 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 1805 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1806 if (conn)
1807 conn->key_type = type;
1808 }
d25e28ab 1809
55ed8ca1 1810 bacpy(&key->bdaddr, bdaddr);
9b3b4460 1811 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 1812 key->pin_len = pin_len;
1813
b6020ba0 1814 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1815 key->type = old_key_type;
4748fed2
JH		 1816 else
1817 key->type = type;
1818
4df378a1
JH		 1819 if (!new_key)
1820 return 0;
1821
1822 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1823
744cf19e 1824 mgmt_new_link_key(hdev, key, persistent);
4df378a1 1825
6ec5bcad
VA		 1826 if (conn)
1827 conn->flush_key = !persistent;
55ed8ca1
JH		 1828
1829 return 0;
1830}
1831
c9839a11 1832int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
9a006657 1833 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
04124681 1834 ediv, u8 rand[8])
75d262c2 1835{
c9839a11 1836 struct smp_ltk *key, *old_key;
75d262c2 1837
c9839a11
VCG		 1838 if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1839 return 0;
75d262c2 1840
c9839a11
VCG		 1841 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1842 if (old_key)
75d262c2 1843 key = old_key;
c9839a11
VCG		 1844 else {
1845 key = kzalloc(sizeof(*key), GFP_ATOMIC);
75d262c2
VCG		 1846 if (!key)
1847 return -ENOMEM;
c9839a11 1848 list_add(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 1849 }
1850
75d262c2 1851 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 1852 key->bdaddr_type = addr_type;
1853 memcpy(key->val, tk, sizeof(key->val));
1854 key->authenticated = authenticated;
1855 key->ediv = ediv;
1856 key->enc_size = enc_size;
1857 key->type = type;
1858 memcpy(key->rand, rand, sizeof(key->rand));
75d262c2 1859
c9839a11
VCG		 1860 if (!new_key)
1861 return 0;
75d262c2 1862
261cc5aa
VCG		 1863 if (type & HCI_SMP_LTK)
1864 mgmt_new_ltk(hdev, key, 1);
1865
75d262c2
VCG		 1866 return 0;
1867}
1868
55ed8ca1
JH		 1869int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1870{
1871 struct link_key *key;
1872
1873 key = hci_find_link_key(hdev, bdaddr);
1874 if (!key)
1875 return -ENOENT;
1876
6ed93dc6 1877 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1
JH		 1878
1879 list_del(&key->list);
1880 kfree(key);
1881
1882 return 0;
1883}
1884
b899efaf
VCG		 1885int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1886{
1887 struct smp_ltk *k, *tmp;
1888
1889 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1890 if (bacmp(bdaddr, &k->bdaddr))
1891 continue;
1892
6ed93dc6 1893 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf
VCG		 1894
1895 list_del(&k->list);
1896 kfree(k);
1897 }
1898
1899 return 0;
1900}
1901
6bd32326 1902/* HCI command timer function */
bda4f23a 1903static void hci_cmd_timeout(unsigned long arg)
6bd32326
VT		 1904{
1905 struct hci_dev *hdev = (void *) arg;
1906
bda4f23a
AE		 1907 if (hdev->sent_cmd) {
1908 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1909 u16 opcode = __le16_to_cpu(sent->opcode);
1910
1911 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
1912 } else {
1913 BT_ERR("%s command tx timeout", hdev->name);
1914 }
1915
6bd32326 1916 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1917 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1918}
1919
2763eda6 1920struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
04124681 1921 bdaddr_t *bdaddr)
2763eda6
SJ		 1922{
1923 struct oob_data *data;
1924
1925 list_for_each_entry(data, &hdev->remote_oob_data, list)
1926 if (bacmp(bdaddr, &data->bdaddr) == 0)
1927 return data;
1928
1929 return NULL;
1930}
1931
1932int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1933{
1934 struct oob_data *data;
1935
1936 data = hci_find_remote_oob_data(hdev, bdaddr);
1937 if (!data)
1938 return -ENOENT;
1939
6ed93dc6 1940 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1941
1942 list_del(&data->list);
1943 kfree(data);
1944
1945 return 0;
1946}
1947
1948int hci_remote_oob_data_clear(struct hci_dev *hdev)
1949{
1950 struct oob_data *data, *n;
1951
1952 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1953 list_del(&data->list);
1954 kfree(data);
1955 }
1956
1957 return 0;
1958}
1959
1960int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
04124681 1961 u8 *randomizer)
2763eda6
SJ		 1962{
1963 struct oob_data *data;
1964
1965 data = hci_find_remote_oob_data(hdev, bdaddr);
1966
1967 if (!data) {
1968 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1969 if (!data)
1970 return -ENOMEM;
1971
1972 bacpy(&data->bdaddr, bdaddr);
1973 list_add(&data->list, &hdev->remote_oob_data);
1974 }
1975
1976 memcpy(data->hash, hash, sizeof(data->hash));
1977 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1978
6ed93dc6 1979 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1980
1981 return 0;
1982}
1983
04124681 1984struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
b2a66aad 1985{
8035ded4 1986 struct bdaddr_list *b;
b2a66aad 1987
8035ded4 1988 list_for_each_entry(b, &hdev->blacklist, list)
b2a66aad
AJ		 1989 if (bacmp(bdaddr, &b->bdaddr) == 0)
1990 return b;
b2a66aad
AJ		 1991
1992 return NULL;
1993}
1994
1995int hci_blacklist_clear(struct hci_dev *hdev)
1996{
1997 struct list_head *p, *n;
1998
1999 list_for_each_safe(p, n, &hdev->blacklist) {
2000 struct bdaddr_list *b;
2001
2002 b = list_entry(p, struct bdaddr_list, list);
2003
2004 list_del(p);
2005 kfree(b);
2006 }
2007
2008 return 0;
2009}
2010
88c1fe4b 2011int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2012{
2013 struct bdaddr_list *entry;
b2a66aad
AJ		 2014
2015 if (bacmp(bdaddr, BDADDR_ANY) == 0)
2016 return -EBADF;
2017
5e762444
AJ		 2018 if (hci_blacklist_lookup(hdev, bdaddr))
2019 return -EEXIST;
b2a66aad
AJ		 2020
2021 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
5e762444
AJ		 2022 if (!entry)
2023 return -ENOMEM;
b2a66aad
AJ		 2024
2025 bacpy(&entry->bdaddr, bdaddr);
2026
2027 list_add(&entry->list, &hdev->blacklist);
2028
88c1fe4b 2029 return mgmt_device_blocked(hdev, bdaddr, type);
b2a66aad
AJ		 2030}
2031
88c1fe4b 2032int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2033{
2034 struct bdaddr_list *entry;
b2a66aad 2035
1ec918ce 2036 if (bacmp(bdaddr, BDADDR_ANY) == 0)
5e762444 2037 return hci_blacklist_clear(hdev);
b2a66aad
AJ		 2038
2039 entry = hci_blacklist_lookup(hdev, bdaddr);
1ec918ce 2040 if (!entry)
5e762444 2041 return -ENOENT;
b2a66aad
AJ		 2042
2043 list_del(&entry->list);
2044 kfree(entry);
2045
88c1fe4b 2046 return mgmt_device_unblocked(hdev, bdaddr, type);
b2a66aad
AJ		 2047}
2048
4c87eaab 2049static void inquiry_complete(struct hci_dev *hdev, u8 status)
7ba8b4be 2050{
4c87eaab
AG		 2051 if (status) {
2052 BT_ERR("Failed to start inquiry: status %d", status);
7ba8b4be 2053
4c87eaab
AG		 2054 hci_dev_lock(hdev);
2055 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2056 hci_dev_unlock(hdev);
2057 return;
2058 }
7ba8b4be
AG		 2059}
2060
4c87eaab 2061static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
7ba8b4be 2062{
4c87eaab
AG		 2063 /* General inquiry access code (GIAC) */
2064 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2065 struct hci_request req;
2066 struct hci_cp_inquiry cp;
7ba8b4be
AG		 2067 int err;
2068
4c87eaab
AG		 2069 if (status) {
2070 BT_ERR("Failed to disable LE scanning: status %d", status);
2071 return;
2072 }
7ba8b4be 2073
4c87eaab
AG		 2074 switch (hdev->discovery.type) {
2075 case DISCOV_TYPE_LE:
2076 hci_dev_lock(hdev);
2077 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2078 hci_dev_unlock(hdev);
2079 break;
7ba8b4be 2080
4c87eaab
AG		 2081 case DISCOV_TYPE_INTERLEAVED:
2082 hci_req_init(&req, hdev);
7ba8b4be 2083
4c87eaab
AG		 2084 memset(&cp, 0, sizeof(cp));
2085 memcpy(&cp.lap, lap, sizeof(cp.lap));
2086 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
2087 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
7ba8b4be 2088
4c87eaab 2089 hci_dev_lock(hdev);
7dbfac1d 2090
4c87eaab 2091 hci_inquiry_cache_flush(hdev);
7dbfac1d 2092
4c87eaab
AG		 2093 err = hci_req_run(&req, inquiry_complete);
2094 if (err) {
2095 BT_ERR("Inquiry request failed: err %d", err);
2096 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2097 }
7dbfac1d 2098
4c87eaab
AG		 2099 hci_dev_unlock(hdev);
2100 break;
7dbfac1d 2101 }
7dbfac1d
AG		 2102}
2103
7ba8b4be
AG		 2104static void le_scan_disable_work(struct work_struct *work)
2105{
2106 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 2107 le_scan_disable.work);
7ba8b4be 2108 struct hci_cp_le_set_scan_enable cp;
4c87eaab
AG		 2109 struct hci_request req;
2110 int err;
7ba8b4be
AG		 2111
2112 BT_DBG("%s", hdev->name);
2113
4c87eaab 2114 hci_req_init(&req, hdev);
28b75a89 2115
7ba8b4be 2116 memset(&cp, 0, sizeof(cp));
4c87eaab
AG		 2117 cp.enable = LE_SCAN_DISABLE;
2118 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
28b75a89 2119
4c87eaab
AG		 2120 err = hci_req_run(&req, le_scan_disable_work_complete);
2121 if (err)
2122 BT_ERR("Disable LE scanning request failed: err %d", err);
28b75a89
AG		 2123}
2124
9be0dab7
DH		 2125/* Alloc HCI device */
2126struct hci_dev *hci_alloc_dev(void)
2127{
2128 struct hci_dev *hdev;
2129
2130 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
2131 if (!hdev)
2132 return NULL;
2133
b1b813d4
DH		 2134 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2135 hdev->esco_type = (ESCO_HV1);
2136 hdev->link_mode = (HCI_LM_ACCEPT);
2137 hdev->io_capability = 0x03; /* No Input No Output */
bbaf444a
JH		 2138 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2139 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
b1b813d4 2140
b1b813d4
DH		 2141 hdev->sniff_max_interval = 800;
2142 hdev->sniff_min_interval = 80;
2143
2144 mutex_init(&hdev->lock);
2145 mutex_init(&hdev->req_lock);
2146
2147 INIT_LIST_HEAD(&hdev->mgmt_pending);
2148 INIT_LIST_HEAD(&hdev->blacklist);
2149 INIT_LIST_HEAD(&hdev->uuids);
2150 INIT_LIST_HEAD(&hdev->link_keys);
2151 INIT_LIST_HEAD(&hdev->long_term_keys);
2152 INIT_LIST_HEAD(&hdev->remote_oob_data);
6b536b5e 2153 INIT_LIST_HEAD(&hdev->conn_hash.list);
b1b813d4
DH		 2154
2155 INIT_WORK(&hdev->rx_work, hci_rx_work);
2156 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2157 INIT_WORK(&hdev->tx_work, hci_tx_work);
2158 INIT_WORK(&hdev->power_on, hci_power_on);
b1b813d4 2159
b1b813d4
DH		 2160 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
2161 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
2162 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2163
b1b813d4
DH		 2164 skb_queue_head_init(&hdev->rx_q);
2165 skb_queue_head_init(&hdev->cmd_q);
2166 skb_queue_head_init(&hdev->raw_q);
2167
2168 init_waitqueue_head(&hdev->req_wait_q);
2169
bda4f23a 2170 setup_timer(&hdev->cmd_timer, hci_cmd_timeout, (unsigned long) hdev);
b1b813d4 2171
b1b813d4
DH		 2172 hci_init_sysfs(hdev);
2173 discovery_init(hdev);
9be0dab7
DH		 2174
2175 return hdev;
2176}
2177EXPORT_SYMBOL(hci_alloc_dev);
2178
2179/* Free HCI device */
2180void hci_free_dev(struct hci_dev *hdev)
2181{
9be0dab7
DH		 2182 /* will free via device release */
2183 put_device(&hdev->dev);
2184}
2185EXPORT_SYMBOL(hci_free_dev);
2186
1da177e4
LT		 2187/* Register HCI device */
2188int hci_register_dev(struct hci_dev *hdev)
2189{
b1b813d4 2190 int id, error;
1da177e4 2191
010666a1 2192 if (!hdev->open || !hdev->close)
1da177e4
LT		 2193 return -EINVAL;
2194
08add513
MM		 2195 /* Do not allow HCI_AMP devices to register at index 0,
2196 * so the index can be used as the AMP controller ID.
2197 */
3df92b31
SL		 2198 switch (hdev->dev_type) {
2199 case HCI_BREDR:
2200 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
2201 break;
2202 case HCI_AMP:
2203 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
2204 break;
2205 default:
2206 return -EINVAL;
1da177e4 2207 }
8e87d142 2208
3df92b31
SL		 2209 if (id < 0)
2210 return id;
2211
1da177e4
LT		 2212 sprintf(hdev->name, "hci%d", id);
2213 hdev->id = id;
2d8b3a11
AE		 2214
2215 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2216
d8537548
KC		 2217 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
2218 WQ_MEM_RECLAIM, 1, hdev->name);
33ca954d
DH		 2219 if (!hdev->workqueue) {
2220 error = -ENOMEM;
2221 goto err;
2222 }
f48fd9c8 2223
d8537548
KC		 2224 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
2225 WQ_MEM_RECLAIM, 1, hdev->name);
6ead1bbc
JH		 2226 if (!hdev->req_workqueue) {
2227 destroy_workqueue(hdev->workqueue);
2228 error = -ENOMEM;
2229 goto err;
2230 }
2231
33ca954d
DH		 2232 error = hci_add_sysfs(hdev);
2233 if (error < 0)
2234 goto err_wqueue;
1da177e4 2235
611b30f7 2236 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 2237 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2238 hdev);
611b30f7
MH		 2239 if (hdev->rfkill) {
2240 if (rfkill_register(hdev->rfkill) < 0) {
2241 rfkill_destroy(hdev->rfkill);
2242 hdev->rfkill = NULL;
2243 }
2244 }
2245
a8b2d5c2 2246 set_bit(HCI_SETUP, &hdev->dev_flags);
ce2be9ac
AE		 2247
2248 if (hdev->dev_type != HCI_AMP)
2249 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
2250
fcee3377
GP		 2251 write_lock(&hci_dev_list_lock);
2252 list_add(&hdev->list, &hci_dev_list);
2253 write_unlock(&hci_dev_list_lock);
2254
1da177e4 2255 hci_notify(hdev, HCI_DEV_REG);
dc946bd8 2256 hci_dev_hold(hdev);
1da177e4 2257
19202573 2258 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 2259
1da177e4 2260 return id;
f48fd9c8 2261
33ca954d
DH		 2262err_wqueue:
2263 destroy_workqueue(hdev->workqueue);
6ead1bbc 2264 destroy_workqueue(hdev->req_workqueue);
33ca954d 2265err:
3df92b31 2266 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 2267
33ca954d 2268 return error;
1da177e4
LT		 2269}
2270EXPORT_SYMBOL(hci_register_dev);
2271
2272/* Unregister HCI device */
59735631 2273void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 2274{
3df92b31 2275 int i, id;
ef222013 2276
c13854ce 2277 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 2278
94324962
JH		 2279 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
2280
3df92b31
SL		 2281 id = hdev->id;
2282
f20d09d5 2283 write_lock(&hci_dev_list_lock);
1da177e4 2284 list_del(&hdev->list);
f20d09d5 2285 write_unlock(&hci_dev_list_lock);
1da177e4
LT		 2286
2287 hci_dev_do_close(hdev);
2288
cd4c5391 2289 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 2290 kfree_skb(hdev->reassembly[i]);
2291
b9b5ef18
GP		 2292 cancel_work_sync(&hdev->power_on);
2293
ab81cbf9 2294 if (!test_bit(HCI_INIT, &hdev->flags) &&
a8c5fb1a 2295 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
09fd0de5 2296 hci_dev_lock(hdev);
744cf19e 2297 mgmt_index_removed(hdev);
09fd0de5 2298 hci_dev_unlock(hdev);
56e5cb86 2299 }
ab81cbf9 2300
2e58ef3e
JH		 2301 /* mgmt_index_removed should take care of emptying the
2302 * pending list */
2303 BUG_ON(!list_empty(&hdev->mgmt_pending));
2304
1da177e4
LT		 2305 hci_notify(hdev, HCI_DEV_UNREG);
2306
611b30f7
MH		 2307 if (hdev->rfkill) {
2308 rfkill_unregister(hdev->rfkill);
2309 rfkill_destroy(hdev->rfkill);
2310 }
2311
ce242970 2312 hci_del_sysfs(hdev);
147e2d59 2313
f48fd9c8 2314 destroy_workqueue(hdev->workqueue);
6ead1bbc 2315 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 2316
09fd0de5 2317 hci_dev_lock(hdev);
e2e0cacb 2318 hci_blacklist_clear(hdev);
2aeb9a1a 2319 hci_uuids_clear(hdev);
55ed8ca1 2320 hci_link_keys_clear(hdev);
b899efaf 2321 hci_smp_ltks_clear(hdev);
2763eda6 2322 hci_remote_oob_data_clear(hdev);
09fd0de5 2323 hci_dev_unlock(hdev);
e2e0cacb 2324
dc946bd8 2325 hci_dev_put(hdev);
3df92b31
SL		 2326
2327 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 2328}
2329EXPORT_SYMBOL(hci_unregister_dev);
2330
2331/* Suspend HCI device */
2332int hci_suspend_dev(struct hci_dev *hdev)
2333{
2334 hci_notify(hdev, HCI_DEV_SUSPEND);
2335 return 0;
2336}
2337EXPORT_SYMBOL(hci_suspend_dev);
2338
2339/* Resume HCI device */
2340int hci_resume_dev(struct hci_dev *hdev)
2341{
2342 hci_notify(hdev, HCI_DEV_RESUME);
2343 return 0;
2344}
2345EXPORT_SYMBOL(hci_resume_dev);
2346
76bca880
MH		 2347/* Receive frame from HCI drivers */
2348int hci_recv_frame(struct sk_buff *skb)
2349{
2350 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2351 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 2352 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 2353 kfree_skb(skb);
2354 return -ENXIO;
2355 }
2356
d82603c6 2357 /* Incoming skb */
76bca880
MH		 2358 bt_cb(skb)->incoming = 1;
2359
2360 /* Time stamp */
2361 __net_timestamp(skb);
2362
76bca880 2363 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 2364 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 2365
76bca880
MH		 2366 return 0;
2367}
2368EXPORT_SYMBOL(hci_recv_frame);
2369
33e882a5 2370static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
a8c5fb1a 2371 int count, __u8 index)
33e882a5
SS		 2372{
2373 int len = 0;
2374 int hlen = 0;
2375 int remain = count;
2376 struct sk_buff *skb;
2377 struct bt_skb_cb *scb;
2378
2379 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
a8c5fb1a 2380 index >= NUM_REASSEMBLY)
33e882a5
SS		 2381 return -EILSEQ;
2382
2383 skb = hdev->reassembly[index];
2384
2385 if (!skb) {
2386 switch (type) {
2387 case HCI_ACLDATA_PKT:
2388 len = HCI_MAX_FRAME_SIZE;
2389 hlen = HCI_ACL_HDR_SIZE;
2390 break;
2391 case HCI_EVENT_PKT:
2392 len = HCI_MAX_EVENT_SIZE;
2393 hlen = HCI_EVENT_HDR_SIZE;
2394 break;
2395 case HCI_SCODATA_PKT:
2396 len = HCI_MAX_SCO_SIZE;
2397 hlen = HCI_SCO_HDR_SIZE;
2398 break;
2399 }
2400
1e429f38 2401 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 2402 if (!skb)
2403 return -ENOMEM;
2404
2405 scb = (void *) skb->cb;
2406 scb->expect = hlen;
2407 scb->pkt_type = type;
2408
2409 skb->dev = (void *) hdev;
2410 hdev->reassembly[index] = skb;
2411 }
2412
2413 while (count) {
2414 scb = (void *) skb->cb;
89bb46d0 2415 len = min_t(uint, scb->expect, count);
33e882a5
SS		 2416
2417 memcpy(skb_put(skb, len), data, len);
2418
2419 count -= len;
2420 data += len;
2421 scb->expect -= len;
2422 remain = count;
2423
2424 switch (type) {
2425 case HCI_EVENT_PKT:
2426 if (skb->len == HCI_EVENT_HDR_SIZE) {
2427 struct hci_event_hdr *h = hci_event_hdr(skb);
2428 scb->expect = h->plen;
2429
2430 if (skb_tailroom(skb) < scb->expect) {
2431 kfree_skb(skb);
2432 hdev->reassembly[index] = NULL;
2433 return -ENOMEM;
2434 }
2435 }
2436 break;
2437
2438 case HCI_ACLDATA_PKT:
2439 if (skb->len == HCI_ACL_HDR_SIZE) {
2440 struct hci_acl_hdr *h = hci_acl_hdr(skb);
2441 scb->expect = __le16_to_cpu(h->dlen);
2442
2443 if (skb_tailroom(skb) < scb->expect) {
2444 kfree_skb(skb);
2445 hdev->reassembly[index] = NULL;
2446 return -ENOMEM;
2447 }
2448 }
2449 break;
2450
2451 case HCI_SCODATA_PKT:
2452 if (skb->len == HCI_SCO_HDR_SIZE) {
2453 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2454 scb->expect = h->dlen;
2455
2456 if (skb_tailroom(skb) < scb->expect) {
2457 kfree_skb(skb);
2458 hdev->reassembly[index] = NULL;
2459 return -ENOMEM;
2460 }
2461 }
2462 break;
2463 }
2464
2465 if (scb->expect == 0) {
2466 /* Complete frame */
2467
2468 bt_cb(skb)->pkt_type = type;
2469 hci_recv_frame(skb);
2470
2471 hdev->reassembly[index] = NULL;
2472 return remain;
2473 }
2474 }
2475
2476 return remain;
2477}
2478
ef222013
MH		 2479int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2480{
f39a3c06
SS		 2481 int rem = 0;
2482
ef222013
MH		 2483 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2484 return -EILSEQ;
2485
da5f6c37 2486 while (count) {
1e429f38 2487 rem = hci_reassembly(hdev, type, data, count, type - 1);
f39a3c06
SS		 2488 if (rem < 0)
2489 return rem;
ef222013 2490
f39a3c06
SS		 2491 data += (count - rem);
2492 count = rem;
f81c6224 2493 }
ef222013 2494
f39a3c06 2495 return rem;
ef222013
MH		 2496}
2497EXPORT_SYMBOL(hci_recv_fragment);
2498
99811510
SS		 2499#define STREAM_REASSEMBLY 0
2500
2501int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2502{
2503 int type;
2504 int rem = 0;
2505
da5f6c37 2506 while (count) {
99811510
SS		 2507 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2508
2509 if (!skb) {
2510 struct { char type; } *pkt;
2511
2512 /* Start of the frame */
2513 pkt = data;
2514 type = pkt->type;
2515
2516 data++;
2517 count--;
2518 } else
2519 type = bt_cb(skb)->pkt_type;
2520
1e429f38 2521 rem = hci_reassembly(hdev, type, data, count,
a8c5fb1a 2522 STREAM_REASSEMBLY);
99811510
SS		 2523 if (rem < 0)
2524 return rem;
2525
2526 data += (count - rem);
2527 count = rem;
f81c6224 2528 }
99811510
SS		 2529
2530 return rem;
2531}
2532EXPORT_SYMBOL(hci_recv_stream_fragment);
2533
1da177e4
LT		 2534/* ---- Interface to upper protocols ---- */
2535
1da177e4
LT		 2536int hci_register_cb(struct hci_cb *cb)
2537{
2538 BT_DBG("%p name %s", cb, cb->name);
2539
f20d09d5 2540 write_lock(&hci_cb_list_lock);
1da177e4 2541 list_add(&cb->list, &hci_cb_list);
f20d09d5 2542 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2543
2544 return 0;
2545}
2546EXPORT_SYMBOL(hci_register_cb);
2547
2548int hci_unregister_cb(struct hci_cb *cb)
2549{
2550 BT_DBG("%p name %s", cb, cb->name);
2551
f20d09d5 2552 write_lock(&hci_cb_list_lock);
1da177e4 2553 list_del(&cb->list);
f20d09d5 2554 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 2555
2556 return 0;
2557}
2558EXPORT_SYMBOL(hci_unregister_cb);
2559
2560static int hci_send_frame(struct sk_buff *skb)
2561{
2562 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2563
2564 if (!hdev) {
2565 kfree_skb(skb);
2566 return -ENODEV;
2567 }
2568
0d48d939 2569 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4 2570
cd82e61c
MH		 2571 /* Time stamp */
2572 __net_timestamp(skb);
1da177e4 2573
cd82e61c
MH		 2574 /* Send copy to monitor */
2575 hci_send_to_monitor(hdev, skb);
2576
2577 if (atomic_read(&hdev->promisc)) {
2578 /* Send copy to the sockets */
470fe1b5 2579 hci_send_to_sock(hdev, skb);
1da177e4
LT		 2580 }
2581
2582 /* Get rid of skb owner, prior to sending to the driver. */
2583 skb_orphan(skb);
2584
2585 return hdev->send(skb);
2586}
2587
3119ae95
JH		 2588void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
2589{
2590 skb_queue_head_init(&req->cmd_q);
2591 req->hdev = hdev;
5d73e034 2592 req->err = 0;
3119ae95
JH		 2593}
2594
2595int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
2596{
2597 struct hci_dev *hdev = req->hdev;
2598 struct sk_buff *skb;
2599 unsigned long flags;
2600
2601 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
2602
5d73e034
AG		 2603 /* If an error occured during request building, remove all HCI
2604 * commands queued on the HCI request queue.
2605 */
2606 if (req->err) {
2607 skb_queue_purge(&req->cmd_q);
2608 return req->err;
2609 }
2610
3119ae95
JH		 2611 /* Do not allow empty requests */
2612 if (skb_queue_empty(&req->cmd_q))
382b0c39 2613 return -ENODATA;
3119ae95
JH		 2614
2615 skb = skb_peek_tail(&req->cmd_q);
2616 bt_cb(skb)->req.complete = complete;
2617
2618 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
2619 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
2620 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
2621
2622 queue_work(hdev->workqueue, &hdev->cmd_work);
2623
2624 return 0;
2625}
2626
1ca3a9d0 2627static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
07dc93dd 2628 u32 plen, const void *param)
1da177e4
LT		 2629{
2630 int len = HCI_COMMAND_HDR_SIZE + plen;
2631 struct hci_command_hdr *hdr;
2632 struct sk_buff *skb;
2633
1da177e4 2634 skb = bt_skb_alloc(len, GFP_ATOMIC);
1ca3a9d0
JH		 2635 if (!skb)
2636 return NULL;
1da177e4
LT		 2637
2638 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 2639 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 2640 hdr->plen = plen;
2641
2642 if (plen)
2643 memcpy(skb_put(skb, plen), param, plen);
2644
2645 BT_DBG("skb len %d", skb->len);
2646
0d48d939 2647 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
1da177e4 2648 skb->dev = (void *) hdev;
c78ae283 2649
1ca3a9d0
JH		 2650 return skb;
2651}
2652
2653/* Send HCI command */
07dc93dd
JH		 2654int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
2655 const void *param)
1ca3a9d0
JH		 2656{
2657 struct sk_buff *skb;
2658
2659 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2660
2661 skb = hci_prepare_cmd(hdev, opcode, plen, param);
2662 if (!skb) {
2663 BT_ERR("%s no memory for command", hdev->name);
2664 return -ENOMEM;
2665 }
2666
11714b3d
JH		 2667 /* Stand-alone HCI commands must be flaged as
2668 * single-command requests.
2669 */
2670 bt_cb(skb)->req.start = true;
2671
1da177e4 2672 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 2673 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 2674
2675 return 0;
2676}
1da177e4 2677
71c76a17 2678/* Queue a command to an asynchronous HCI request */
07dc93dd
JH		 2679void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
2680 const void *param, u8 event)
71c76a17
JH		 2681{
2682 struct hci_dev *hdev = req->hdev;
2683 struct sk_buff *skb;
2684
2685 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2686
34739c1e
AG		 2687 /* If an error occured during request building, there is no point in
2688 * queueing the HCI command. We can simply return.
2689 */
2690 if (req->err)
2691 return;
2692
71c76a17
JH		 2693 skb = hci_prepare_cmd(hdev, opcode, plen, param);
2694 if (!skb) {
5d73e034
AG		 2695 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
2696 hdev->name, opcode);
2697 req->err = -ENOMEM;
e348fe6b 2698 return;
71c76a17
JH		 2699 }
2700
2701 if (skb_queue_empty(&req->cmd_q))
2702 bt_cb(skb)->req.start = true;
2703
02350a72
JH		 2704 bt_cb(skb)->req.event = event;
2705
71c76a17 2706 skb_queue_tail(&req->cmd_q, skb);
71c76a17
JH		 2707}
2708
07dc93dd
JH		 2709void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
2710 const void *param)
02350a72
JH		 2711{
2712 hci_req_add_ev(req, opcode, plen, param, 0);
2713}
2714
1da177e4 2715/* Get data from the previously sent command */
a9de9248 2716void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 2717{
2718 struct hci_command_hdr *hdr;
2719
2720 if (!hdev->sent_cmd)
2721 return NULL;
2722
2723 hdr = (void *) hdev->sent_cmd->data;
2724
a9de9248 2725 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 2726 return NULL;
2727
f0e09510 2728 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 2729
2730 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2731}
2732
2733/* Send ACL data */
2734static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2735{
2736 struct hci_acl_hdr *hdr;
2737 int len = skb->len;
2738
badff6d0
ACM		 2739 skb_push(skb, HCI_ACL_HDR_SIZE);
2740 skb_reset_transport_header(skb);
9c70220b 2741 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 2742 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2743 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 2744}
2745
ee22be7e 2746static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 2747 struct sk_buff *skb, __u16 flags)
1da177e4 2748{
ee22be7e 2749 struct hci_conn *conn = chan->conn;
1da177e4
LT		 2750 struct hci_dev *hdev = conn->hdev;
2751 struct sk_buff *list;
2752
087bfd99
GP		 2753 skb->len = skb_headlen(skb);
2754 skb->data_len = 0;
2755
2756 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
204a6e54
AE		 2757
2758 switch (hdev->dev_type) {
2759 case HCI_BREDR:
2760 hci_add_acl_hdr(skb, conn->handle, flags);
2761 break;
2762 case HCI_AMP:
2763 hci_add_acl_hdr(skb, chan->handle, flags);
2764 break;
2765 default:
2766 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2767 return;
2768 }
087bfd99 2769
70f23020
AE		 2770 list = skb_shinfo(skb)->frag_list;
2771 if (!list) {
1da177e4
LT		 2772 /* Non fragmented */
2773 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2774
73d80deb 2775 skb_queue_tail(queue, skb);
1da177e4
LT		 2776 } else {
2777 /* Fragmented */
2778 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2779
2780 skb_shinfo(skb)->frag_list = NULL;
2781
2782 /* Queue all fragments atomically */
af3e6359 2783 spin_lock(&queue->lock);
1da177e4 2784
73d80deb 2785 __skb_queue_tail(queue, skb);
e702112f
AE		 2786
2787 flags &= ~ACL_START;
2788 flags |= ACL_CONT;
1da177e4
LT		 2789 do {
2790 skb = list; list = list->next;
8e87d142 2791
1da177e4 2792 skb->dev = (void *) hdev;
0d48d939 2793 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 2794 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 2795
2796 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2797
73d80deb 2798 __skb_queue_tail(queue, skb);
1da177e4
LT		 2799 } while (list);
2800
af3e6359 2801 spin_unlock(&queue->lock);
1da177e4 2802 }
73d80deb
LAD		 2803}
2804
2805void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2806{
ee22be7e 2807 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 2808
f0e09510 2809 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb
LAD		 2810
2811 skb->dev = (void *) hdev;
73d80deb 2812
ee22be7e 2813 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 2814
3eff45ea 2815 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 2816}
1da177e4
LT		 2817
2818/* Send SCO data */
0d861d8b 2819void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 2820{
2821 struct hci_dev *hdev = conn->hdev;
2822 struct hci_sco_hdr hdr;
2823
2824 BT_DBG("%s len %d", hdev->name, skb->len);
2825
aca3192c 2826 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 2827 hdr.dlen = skb->len;
2828
badff6d0
ACM		 2829 skb_push(skb, HCI_SCO_HDR_SIZE);
2830 skb_reset_transport_header(skb);
9c70220b 2831 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4
LT		 2832
2833 skb->dev = (void *) hdev;
0d48d939 2834 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 2835
1da177e4 2836 skb_queue_tail(&conn->data_q, skb);
3eff45ea 2837 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 2838}
1da177e4
LT		 2839
2840/* ---- HCI TX task (outgoing data) ---- */
2841
2842/* HCI Connection scheduler */
6039aa73
GP		 2843static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
2844 int *quote)
1da177e4
LT		 2845{
2846 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2847 struct hci_conn *conn = NULL, *c;
abc5de8f 2848 unsigned int num = 0, min = ~0;
1da177e4 2849
8e87d142 2850 /* We don't have to lock device here. Connections are always
1da177e4 2851 * added and removed with TX task disabled. */
bf4c6325
GP		 2852
2853 rcu_read_lock();
2854
2855 list_for_each_entry_rcu(c, &h->list, list) {
769be974 2856 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 2857 continue;
769be974
MH		 2858
2859 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2860 continue;
2861
1da177e4
LT		 2862 num++;
2863
2864 if (c->sent < min) {
2865 min = c->sent;
2866 conn = c;
2867 }
52087a79
LAD		 2868
2869 if (hci_conn_num(hdev, type) == num)
2870 break;
1da177e4
LT		 2871 }
2872
bf4c6325
GP		 2873 rcu_read_unlock();
2874
1da177e4 2875 if (conn) {
6ed58ec5
VT		 2876 int cnt, q;
2877
2878 switch (conn->type) {
2879 case ACL_LINK:
2880 cnt = hdev->acl_cnt;
2881 break;
2882 case SCO_LINK:
2883 case ESCO_LINK:
2884 cnt = hdev->sco_cnt;
2885 break;
2886 case LE_LINK:
2887 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2888 break;
2889 default:
2890 cnt = 0;
2891 BT_ERR("Unknown link type");
2892 }
2893
2894 q = cnt / num;
1da177e4
LT		 2895 *quote = q ? q : 1;
2896 } else
2897 *quote = 0;
2898
2899 BT_DBG("conn %p quote %d", conn, *quote);
2900 return conn;
2901}
2902
6039aa73 2903static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 2904{
2905 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 2906 struct hci_conn *c;
1da177e4 2907
bae1f5d9 2908 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 2909
bf4c6325
GP		 2910 rcu_read_lock();
2911
1da177e4 2912 /* Kill stalled connections */
bf4c6325 2913 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 2914 if (c->type == type && c->sent) {
6ed93dc6
AE		 2915 BT_ERR("%s killing stalled connection %pMR",
2916 hdev->name, &c->dst);
bed71748 2917 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 2918 }
2919 }
bf4c6325
GP		 2920
2921 rcu_read_unlock();
1da177e4
LT		 2922}
2923
6039aa73
GP		 2924static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2925 int *quote)
1da177e4 2926{
73d80deb
LAD		 2927 struct hci_conn_hash *h = &hdev->conn_hash;
2928 struct hci_chan *chan = NULL;
abc5de8f 2929 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 2930 struct hci_conn *conn;
73d80deb
LAD		 2931 int cnt, q, conn_num = 0;
2932
2933 BT_DBG("%s", hdev->name);
2934
bf4c6325
GP		 2935 rcu_read_lock();
2936
2937 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 2938 struct hci_chan *tmp;
2939
2940 if (conn->type != type)
2941 continue;
2942
2943 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2944 continue;
2945
2946 conn_num++;
2947
8192edef 2948 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 2949 struct sk_buff *skb;
2950
2951 if (skb_queue_empty(&tmp->data_q))
2952 continue;
2953
2954 skb = skb_peek(&tmp->data_q);
2955 if (skb->priority < cur_prio)
2956 continue;
2957
2958 if (skb->priority > cur_prio) {
2959 num = 0;
2960 min = ~0;
2961 cur_prio = skb->priority;
2962 }
2963
2964 num++;
2965
2966 if (conn->sent < min) {
2967 min = conn->sent;
2968 chan = tmp;
2969 }
2970 }
2971
2972 if (hci_conn_num(hdev, type) == conn_num)
2973 break;
2974 }
2975
bf4c6325
GP		 2976 rcu_read_unlock();
2977
73d80deb
LAD		 2978 if (!chan)
2979 return NULL;
2980
2981 switch (chan->conn->type) {
2982 case ACL_LINK:
2983 cnt = hdev->acl_cnt;
2984 break;
bd1eb66b
AE		 2985 case AMP_LINK:
2986 cnt = hdev->block_cnt;
2987 break;
73d80deb
LAD		 2988 case SCO_LINK:
2989 case ESCO_LINK:
2990 cnt = hdev->sco_cnt;
2991 break;
2992 case LE_LINK:
2993 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2994 break;
2995 default:
2996 cnt = 0;
2997 BT_ERR("Unknown link type");
2998 }
2999
3000 q = cnt / num;
3001 *quote = q ? q : 1;
3002 BT_DBG("chan %p quote %d", chan, *quote);
3003 return chan;
3004}
3005
02b20f0b
LAD		 3006static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3007{
3008 struct hci_conn_hash *h = &hdev->conn_hash;
3009 struct hci_conn *conn;
3010 int num = 0;
3011
3012 BT_DBG("%s", hdev->name);
3013
bf4c6325
GP		 3014 rcu_read_lock();
3015
3016 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 3017 struct hci_chan *chan;
3018
3019 if (conn->type != type)
3020 continue;
3021
3022 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3023 continue;
3024
3025 num++;
3026
8192edef 3027 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 3028 struct sk_buff *skb;
3029
3030 if (chan->sent) {
3031 chan->sent = 0;
3032 continue;
3033 }
3034
3035 if (skb_queue_empty(&chan->data_q))
3036 continue;
3037
3038 skb = skb_peek(&chan->data_q);
3039 if (skb->priority >= HCI_PRIO_MAX - 1)
3040 continue;
3041
3042 skb->priority = HCI_PRIO_MAX - 1;
3043
3044 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 3045 skb->priority);
02b20f0b
LAD		 3046 }
3047
3048 if (hci_conn_num(hdev, type) == num)
3049 break;
3050 }
bf4c6325
GP		 3051
3052 rcu_read_unlock();
3053
02b20f0b
LAD		 3054}
3055
b71d385a
AE		 3056static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3057{
3058 /* Calculate count of blocks used by this packet */
3059 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3060}
3061
6039aa73 3062static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 3063{
1da177e4
LT		 3064 if (!test_bit(HCI_RAW, &hdev->flags)) {
3065 /* ACL tx timeout must be longer than maximum
3066 * link supervision timeout (40.9 seconds) */
63d2bc1b 3067 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 3068 HCI_ACL_TX_TIMEOUT))
bae1f5d9 3069 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 3070 }
63d2bc1b 3071}
1da177e4 3072
6039aa73 3073static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 3074{
3075 unsigned int cnt = hdev->acl_cnt;
3076 struct hci_chan *chan;
3077 struct sk_buff *skb;
3078 int quote;
3079
3080 __check_timeout(hdev, cnt);
04837f64 3081
73d80deb 3082 while (hdev->acl_cnt &&
a8c5fb1a 3083 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 3084 u32 priority = (skb_peek(&chan->data_q))->priority;
3085 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3086 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3087 skb->len, skb->priority);
73d80deb 3088
ec1cce24
LAD		 3089 /* Stop if priority has changed */
3090 if (skb->priority < priority)
3091 break;
3092
3093 skb = skb_dequeue(&chan->data_q);
3094
73d80deb 3095 hci_conn_enter_active_mode(chan->conn,
04124681 3096 bt_cb(skb)->force_active);
04837f64 3097
1da177e4
LT		 3098 hci_send_frame(skb);
3099 hdev->acl_last_tx = jiffies;
3100
3101 hdev->acl_cnt--;
73d80deb
LAD		 3102 chan->sent++;
3103 chan->conn->sent++;
1da177e4
LT		 3104 }
3105 }
02b20f0b
LAD		 3106
3107 if (cnt != hdev->acl_cnt)
3108 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 3109}
3110
6039aa73 3111static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 3112{
63d2bc1b 3113 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 3114 struct hci_chan *chan;
3115 struct sk_buff *skb;
3116 int quote;
bd1eb66b 3117 u8 type;
b71d385a 3118
63d2bc1b 3119 __check_timeout(hdev, cnt);
b71d385a 3120
bd1eb66b
AE		 3121 BT_DBG("%s", hdev->name);
3122
3123 if (hdev->dev_type == HCI_AMP)
3124 type = AMP_LINK;
3125 else
3126 type = ACL_LINK;
3127
b71d385a 3128 while (hdev->block_cnt > 0 &&
bd1eb66b 3129 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 3130 u32 priority = (skb_peek(&chan->data_q))->priority;
3131 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3132 int blocks;
3133
3134 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3135 skb->len, skb->priority);
b71d385a
AE		 3136
3137 /* Stop if priority has changed */
3138 if (skb->priority < priority)
3139 break;
3140
3141 skb = skb_dequeue(&chan->data_q);
3142
3143 blocks = __get_blocks(hdev, skb);
3144 if (blocks > hdev->block_cnt)
3145 return;
3146
3147 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 3148 bt_cb(skb)->force_active);
b71d385a
AE		 3149
3150 hci_send_frame(skb);
3151 hdev->acl_last_tx = jiffies;
3152
3153 hdev->block_cnt -= blocks;
3154 quote -= blocks;
3155
3156 chan->sent += blocks;
3157 chan->conn->sent += blocks;
3158 }
3159 }
3160
3161 if (cnt != hdev->block_cnt)
bd1eb66b 3162 hci_prio_recalculate(hdev, type);
b71d385a
AE		 3163}
3164
6039aa73 3165static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 3166{
3167 BT_DBG("%s", hdev->name);
3168
bd1eb66b
AE		 3169 /* No ACL link over BR/EDR controller */
3170 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3171 return;
3172
3173 /* No AMP link over AMP controller */
3174 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 3175 return;
3176
3177 switch (hdev->flow_ctl_mode) {
3178 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3179 hci_sched_acl_pkt(hdev);
3180 break;
3181
3182 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3183 hci_sched_acl_blk(hdev);
3184 break;
3185 }
3186}
3187
1da177e4 3188/* Schedule SCO */
6039aa73 3189static void hci_sched_sco(struct hci_dev *hdev)
1da177e4
LT		 3190{
3191 struct hci_conn *conn;
3192 struct sk_buff *skb;
3193 int quote;
3194
3195 BT_DBG("%s", hdev->name);
3196
52087a79
LAD		 3197 if (!hci_conn_num(hdev, SCO_LINK))
3198 return;
3199
1da177e4
LT		 3200 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3201 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3202 BT_DBG("skb %p len %d", skb, skb->len);
3203 hci_send_frame(skb);
3204
3205 conn->sent++;
3206 if (conn->sent == ~0)
3207 conn->sent = 0;
3208 }
3209 }
3210}
3211
6039aa73 3212static void hci_sched_esco(struct hci_dev *hdev)
b6a0dc82
MH		 3213{
3214 struct hci_conn *conn;
3215 struct sk_buff *skb;
3216 int quote;
3217
3218 BT_DBG("%s", hdev->name);
3219
52087a79
LAD		 3220 if (!hci_conn_num(hdev, ESCO_LINK))
3221 return;
3222
8fc9ced3
GP		 3223 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3224 &quote))) {
b6a0dc82
MH		 3225 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3226 BT_DBG("skb %p len %d", skb, skb->len);
3227 hci_send_frame(skb);
3228
3229 conn->sent++;
3230 if (conn->sent == ~0)
3231 conn->sent = 0;
3232 }
3233 }
3234}
3235
6039aa73 3236static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 3237{
73d80deb 3238 struct hci_chan *chan;
6ed58ec5 3239 struct sk_buff *skb;
02b20f0b 3240 int quote, cnt, tmp;
6ed58ec5
VT		 3241
3242 BT_DBG("%s", hdev->name);
3243
52087a79
LAD		 3244 if (!hci_conn_num(hdev, LE_LINK))
3245 return;
3246
6ed58ec5
VT		 3247 if (!test_bit(HCI_RAW, &hdev->flags)) {
3248 /* LE tx timeout must be longer than maximum
3249 * link supervision timeout (40.9 seconds) */
bae1f5d9 3250 if (!hdev->le_cnt && hdev->le_pkts &&
a8c5fb1a 3251 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 3252 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 3253 }
3254
3255 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 3256 tmp = cnt;
73d80deb 3257 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 3258 u32 priority = (skb_peek(&chan->data_q))->priority;
3259 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3260 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3261 skb->len, skb->priority);
6ed58ec5 3262
ec1cce24
LAD		 3263 /* Stop if priority has changed */
3264 if (skb->priority < priority)
3265 break;
3266
3267 skb = skb_dequeue(&chan->data_q);
3268
6ed58ec5
VT		 3269 hci_send_frame(skb);
3270 hdev->le_last_tx = jiffies;
3271
3272 cnt--;
73d80deb
LAD		 3273 chan->sent++;
3274 chan->conn->sent++;
6ed58ec5
VT		 3275 }
3276 }
73d80deb 3277
6ed58ec5
VT		 3278 if (hdev->le_pkts)
3279 hdev->le_cnt = cnt;
3280 else
3281 hdev->acl_cnt = cnt;
02b20f0b
LAD		 3282
3283 if (cnt != tmp)
3284 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 3285}
3286
3eff45ea 3287static void hci_tx_work(struct work_struct *work)
1da177e4 3288{
3eff45ea 3289 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 3290 struct sk_buff *skb;
3291
6ed58ec5 3292 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 3293 hdev->sco_cnt, hdev->le_cnt);
1da177e4
LT		 3294
3295 /* Schedule queues and send stuff to HCI driver */
3296
3297 hci_sched_acl(hdev);
3298
3299 hci_sched_sco(hdev);
3300
b6a0dc82
MH		 3301 hci_sched_esco(hdev);
3302
6ed58ec5
VT		 3303 hci_sched_le(hdev);
3304
1da177e4
LT		 3305 /* Send next queued raw (unknown type) packet */
3306 while ((skb = skb_dequeue(&hdev->raw_q)))
3307 hci_send_frame(skb);
1da177e4
LT		 3308}
3309
25985edc 3310/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 3311
3312/* ACL data packet */
6039aa73 3313static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3314{
3315 struct hci_acl_hdr *hdr = (void *) skb->data;
3316 struct hci_conn *conn;
3317 __u16 handle, flags;
3318
3319 skb_pull(skb, HCI_ACL_HDR_SIZE);
3320
3321 handle = __le16_to_cpu(hdr->handle);
3322 flags = hci_flags(handle);
3323 handle = hci_handle(handle);
3324
f0e09510 3325 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 3326 handle, flags);
1da177e4
LT		 3327
3328 hdev->stat.acl_rx++;
3329
3330 hci_dev_lock(hdev);
3331 conn = hci_conn_hash_lookup_handle(hdev, handle);
3332 hci_dev_unlock(hdev);
8e87d142 3333
1da177e4 3334 if (conn) {
65983fc7 3335 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 3336
1da177e4 3337 /* Send to upper protocol */
686ebf28
UF		 3338 l2cap_recv_acldata(conn, skb, flags);
3339 return;
1da177e4 3340 } else {
8e87d142 3341 BT_ERR("%s ACL packet for unknown connection handle %d",
a8c5fb1a 3342 hdev->name, handle);
1da177e4
LT		 3343 }
3344
3345 kfree_skb(skb);
3346}
3347
3348/* SCO data packet */
6039aa73 3349static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3350{
3351 struct hci_sco_hdr *hdr = (void *) skb->data;
3352 struct hci_conn *conn;
3353 __u16 handle;
3354
3355 skb_pull(skb, HCI_SCO_HDR_SIZE);
3356
3357 handle = __le16_to_cpu(hdr->handle);
3358
f0e09510 3359 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
1da177e4
LT		 3360
3361 hdev->stat.sco_rx++;
3362
3363 hci_dev_lock(hdev);
3364 conn = hci_conn_hash_lookup_handle(hdev, handle);
3365 hci_dev_unlock(hdev);
3366
3367 if (conn) {
1da177e4 3368 /* Send to upper protocol */
686ebf28
UF		 3369 sco_recv_scodata(conn, skb);
3370 return;
1da177e4 3371 } else {
8e87d142 3372 BT_ERR("%s SCO packet for unknown connection handle %d",
a8c5fb1a 3373 hdev->name, handle);
1da177e4
LT		 3374 }
3375
3376 kfree_skb(skb);
3377}
3378
9238f36a
JH		 3379static bool hci_req_is_complete(struct hci_dev *hdev)
3380{
3381 struct sk_buff *skb;
3382
3383 skb = skb_peek(&hdev->cmd_q);
3384 if (!skb)
3385 return true;
3386
3387 return bt_cb(skb)->req.start;
3388}
3389
42c6b129
JH		 3390static void hci_resend_last(struct hci_dev *hdev)
3391{
3392 struct hci_command_hdr *sent;
3393 struct sk_buff *skb;
3394 u16 opcode;
3395
3396 if (!hdev->sent_cmd)
3397 return;
3398
3399 sent = (void *) hdev->sent_cmd->data;
3400 opcode = __le16_to_cpu(sent->opcode);
3401 if (opcode == HCI_OP_RESET)
3402 return;
3403
3404 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3405 if (!skb)
3406 return;
3407
3408 skb_queue_head(&hdev->cmd_q, skb);
3409 queue_work(hdev->workqueue, &hdev->cmd_work);
3410}
3411
9238f36a
JH		 3412void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
3413{
3414 hci_req_complete_t req_complete = NULL;
3415 struct sk_buff *skb;
3416 unsigned long flags;
3417
3418 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3419
42c6b129
JH		 3420 /* If the completed command doesn't match the last one that was
3421 * sent we need to do special handling of it.
9238f36a 3422 */
42c6b129
JH		 3423 if (!hci_sent_cmd_data(hdev, opcode)) {
3424 /* Some CSR based controllers generate a spontaneous
3425 * reset complete event during init and any pending
3426 * command will never be completed. In such a case we
3427 * need to resend whatever was the last sent
3428 * command.
3429 */
3430 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3431 hci_resend_last(hdev);
3432
9238f36a 3433 return;
42c6b129 3434 }
9238f36a
JH		 3435
3436 /* If the command succeeded and there's still more commands in
3437 * this request the request is not yet complete.
3438 */
3439 if (!status && !hci_req_is_complete(hdev))
3440 return;
3441
3442 /* If this was the last command in a request the complete
3443 * callback would be found in hdev->sent_cmd instead of the
3444 * command queue (hdev->cmd_q).
3445 */
3446 if (hdev->sent_cmd) {
3447 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
53e21fbc
JH		 3448
3449 if (req_complete) {
3450 /* We must set the complete callback to NULL to
3451 * avoid calling the callback more than once if
3452 * this function gets called again.
3453 */
3454 bt_cb(hdev->sent_cmd)->req.complete = NULL;
3455
9238f36a 3456 goto call_complete;
53e21fbc 3457 }
9238f36a
JH		 3458 }
3459
3460 /* Remove all pending commands belonging to this request */
3461 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
3462 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
3463 if (bt_cb(skb)->req.start) {
3464 __skb_queue_head(&hdev->cmd_q, skb);
3465 break;
3466 }
3467
3468 req_complete = bt_cb(skb)->req.complete;
3469 kfree_skb(skb);
3470 }
3471 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
3472
3473call_complete:
3474 if (req_complete)
3475 req_complete(hdev, status);
3476}
3477
b78752cc 3478static void hci_rx_work(struct work_struct *work)
1da177e4 3479{
b78752cc 3480 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 3481 struct sk_buff *skb;
3482
3483 BT_DBG("%s", hdev->name);
3484
1da177e4 3485 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 3486 /* Send copy to monitor */
3487 hci_send_to_monitor(hdev, skb);
3488
1da177e4
LT		 3489 if (atomic_read(&hdev->promisc)) {
3490 /* Send copy to the sockets */
470fe1b5 3491 hci_send_to_sock(hdev, skb);
1da177e4
LT		 3492 }
3493
0736cfa8
MH		 3494 if (test_bit(HCI_RAW, &hdev->flags) ||
3495 test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1da177e4
LT		 3496 kfree_skb(skb);
3497 continue;
3498 }
3499
3500 if (test_bit(HCI_INIT, &hdev->flags)) {
3501 /* Don't process data packets in this states. */
0d48d939 3502 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 3503 case HCI_ACLDATA_PKT:
3504 case HCI_SCODATA_PKT:
3505 kfree_skb(skb);
3506 continue;
3ff50b79 3507 }
1da177e4
LT		 3508 }
3509
3510 /* Process frame */
0d48d939 3511 switch (bt_cb(skb)->pkt_type) {
1da177e4 3512 case HCI_EVENT_PKT:
b78752cc 3513 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 3514 hci_event_packet(hdev, skb);
3515 break;
3516
3517 case HCI_ACLDATA_PKT:
3518 BT_DBG("%s ACL data packet", hdev->name);
3519 hci_acldata_packet(hdev, skb);
3520 break;
3521
3522 case HCI_SCODATA_PKT:
3523 BT_DBG("%s SCO data packet", hdev->name);
3524 hci_scodata_packet(hdev, skb);
3525 break;
3526
3527 default:
3528 kfree_skb(skb);
3529 break;
3530 }
3531 }
1da177e4
LT		 3532}
3533
c347b765 3534static void hci_cmd_work(struct work_struct *work)
1da177e4 3535{
c347b765 3536 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 3537 struct sk_buff *skb;
3538
2104786b
AE		 3539 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
3540 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 3541
1da177e4 3542 /* Send queued commands */
5a08ecce
AE		 3543 if (atomic_read(&hdev->cmd_cnt)) {
3544 skb = skb_dequeue(&hdev->cmd_q);
3545 if (!skb)
3546 return;
3547
7585b97a 3548 kfree_skb(hdev->sent_cmd);
1da177e4 3549
70f23020
AE		 3550 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
3551 if (hdev->sent_cmd) {
1da177e4
LT		 3552 atomic_dec(&hdev->cmd_cnt);
3553 hci_send_frame(skb);
7bdb8a5c
SJ		 3554 if (test_bit(HCI_RESET, &hdev->flags))
3555 del_timer(&hdev->cmd_timer);
3556 else
3557 mod_timer(&hdev->cmd_timer,
5f246e89 3558 jiffies + HCI_CMD_TIMEOUT);
1da177e4
LT		 3559 } else {
3560 skb_queue_head(&hdev->cmd_q, skb);
c347b765 3561 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3562 }
3563 }
3564}
2519a1fc 3565
31f7956c
AG		 3566u8 bdaddr_to_le(u8 bdaddr_type)
3567{
3568 switch (bdaddr_type) {
3569 case BDADDR_LE_PUBLIC:
3570 return ADDR_LE_DEV_PUBLIC;
3571
3572 default:
3573 /* Fallback to LE Random address type */
3574 return ADDR_LE_DEV_RANDOM;
3575 }
3576}
ubuntu-bionic-kernel mirror