?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
Merge branch 'perf-core-for-linus' of git://git.kernel.org/pub/scm/linux/kernel/git...
[linux-2.6.git] / net / bluetooth / hci_core.c
blobfb7356fcfe51e03664d7aed6458eafd3015634e5
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2011 ProFUSION Embedded Systems
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth HCI core. */
27
28 #include <linux/export.h>
29 #include <linux/idr.h>
30
31 #include <linux/rfkill.h>
32
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35
36 static void hci_rx_work(struct work_struct *work);
37 static void hci_cmd_work(struct work_struct *work);
38 static void hci_tx_work(struct work_struct *work);
39
40 /* HCI device list */
41 LIST_HEAD(hci_dev_list);
42 DEFINE_RWLOCK(hci_dev_list_lock);
43
44 /* HCI callback list */
45 LIST_HEAD(hci_cb_list);
46 DEFINE_RWLOCK(hci_cb_list_lock);
47
48 /* HCI ID Numbering */
49 static DEFINE_IDA(hci_index_ida);
50
51 /* ---- HCI notifications ---- */
52
53 static void hci_notify(struct hci_dev *hdev, int event)
54 {
55 hci_sock_dev_event(hdev, event);
56 }
57
58 /* ---- HCI requests ---- */
59
60 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
61 {
62 BT_DBG("%s result 0x%2.2x", hdev->name, result);
63
64 if (hdev->req_status == HCI_REQ_PEND) {
65 hdev->req_result = result;
66 hdev->req_status = HCI_REQ_DONE;
67 wake_up_interruptible(&hdev->req_wait_q);
68 }
69 }
70
71 static void hci_req_cancel(struct hci_dev *hdev, int err)
72 {
73 BT_DBG("%s err 0x%2.2x", hdev->name, err);
74
75 if (hdev->req_status == HCI_REQ_PEND) {
76 hdev->req_result = err;
77 hdev->req_status = HCI_REQ_CANCELED;
78 wake_up_interruptible(&hdev->req_wait_q);
79 }
80 }
81
82 static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
83 u8 event)
84 {
85 struct hci_ev_cmd_complete *ev;
86 struct hci_event_hdr *hdr;
87 struct sk_buff *skb;
88
89 hci_dev_lock(hdev);
90
91 skb = hdev->recv_evt;
92 hdev->recv_evt = NULL;
93
94 hci_dev_unlock(hdev);
95
96 if (!skb)
97 return ERR_PTR(-ENODATA);
98
99 if (skb->len < sizeof(*hdr)) {
100 BT_ERR("Too short HCI event");
101 goto failed;
102 }
103
104 hdr = (void *) skb->data;
105 skb_pull(skb, HCI_EVENT_HDR_SIZE);
106
107 if (event) {
108 if (hdr->evt != event)
109 goto failed;
110 return skb;
111 }
112
113 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
114 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
115 goto failed;
116 }
117
118 if (skb->len < sizeof(*ev)) {
119 BT_ERR("Too short cmd_complete event");
120 goto failed;
121 }
122
123 ev = (void *) skb->data;
124 skb_pull(skb, sizeof(*ev));
125
126 if (opcode == __le16_to_cpu(ev->opcode))
127 return skb;
128
129 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
130 __le16_to_cpu(ev->opcode));
131
132 failed:
133 kfree_skb(skb);
134 return ERR_PTR(-ENODATA);
135 }
136
137 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
138 const void *param, u8 event, u32 timeout)
139 {
140 DECLARE_WAITQUEUE(wait, current);
141 struct hci_request req;
142 int err = 0;
143
144 BT_DBG("%s", hdev->name);
145
146 hci_req_init(&req, hdev);
147
148 hci_req_add_ev(&req, opcode, plen, param, event);
149
150 hdev->req_status = HCI_REQ_PEND;
151
152 err = hci_req_run(&req, hci_req_sync_complete);
153 if (err < 0)
154 return ERR_PTR(err);
155
156 add_wait_queue(&hdev->req_wait_q, &wait);
157 set_current_state(TASK_INTERRUPTIBLE);
158
159 schedule_timeout(timeout);
160
161 remove_wait_queue(&hdev->req_wait_q, &wait);
162
163 if (signal_pending(current))
164 return ERR_PTR(-EINTR);
165
166 switch (hdev->req_status) {
167 case HCI_REQ_DONE:
168 err = -bt_to_errno(hdev->req_result);
169 break;
170
171 case HCI_REQ_CANCELED:
172 err = -hdev->req_result;
173 break;
174
175 default:
176 err = -ETIMEDOUT;
177 break;
178 }
179
180 hdev->req_status = hdev->req_result = 0;
181
182 BT_DBG("%s end: err %d", hdev->name, err);
183
184 if (err < 0)
185 return ERR_PTR(err);
186
187 return hci_get_cmd_complete(hdev, opcode, event);
188 }
189 EXPORT_SYMBOL(__hci_cmd_sync_ev);
190
191 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
192 const void *param, u32 timeout)
193 {
194 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
195 }
196 EXPORT_SYMBOL(__hci_cmd_sync);
197
198 /* Execute request and wait for completion. */
199 static int __hci_req_sync(struct hci_dev *hdev,
200 void (*func)(struct hci_request *req,
201 unsigned long opt),
202 unsigned long opt, __u32 timeout)
203 {
204 struct hci_request req;
205 DECLARE_WAITQUEUE(wait, current);
206 int err = 0;
207
208 BT_DBG("%s start", hdev->name);
209
210 hci_req_init(&req, hdev);
211
212 hdev->req_status = HCI_REQ_PEND;
213
214 func(&req, opt);
215
216 err = hci_req_run(&req, hci_req_sync_complete);
217 if (err < 0) {
218 hdev->req_status = 0;
219
220 /* ENODATA means the HCI request command queue is empty.
221 * This can happen when a request with conditionals doesn't
222 * trigger any commands to be sent. This is normal behavior
223 * and should not trigger an error return.
224 */
225 if (err == -ENODATA)
226 return 0;
227
228 return err;
229 }
230
231 add_wait_queue(&hdev->req_wait_q, &wait);
232 set_current_state(TASK_INTERRUPTIBLE);
233
234 schedule_timeout(timeout);
235
236 remove_wait_queue(&hdev->req_wait_q, &wait);
237
238 if (signal_pending(current))
239 return -EINTR;
240
241 switch (hdev->req_status) {
242 case HCI_REQ_DONE:
243 err = -bt_to_errno(hdev->req_result);
244 break;
245
246 case HCI_REQ_CANCELED:
247 err = -hdev->req_result;
248 break;
249
250 default:
251 err = -ETIMEDOUT;
252 break;
253 }
254
255 hdev->req_status = hdev->req_result = 0;
256
257 BT_DBG("%s end: err %d", hdev->name, err);
258
259 return err;
260 }
261
262 static int hci_req_sync(struct hci_dev *hdev,
263 void (*req)(struct hci_request *req,
264 unsigned long opt),
265 unsigned long opt, __u32 timeout)
266 {
267 int ret;
268
269 if (!test_bit(HCI_UP, &hdev->flags))
270 return -ENETDOWN;
271
272 /* Serialize all requests */
273 hci_req_lock(hdev);
274 ret = __hci_req_sync(hdev, req, opt, timeout);
275 hci_req_unlock(hdev);
276
277 return ret;
278 }
279
280 static void hci_reset_req(struct hci_request *req, unsigned long opt)
281 {
282 BT_DBG("%s %ld", req->hdev->name, opt);
283
284 /* Reset device */
285 set_bit(HCI_RESET, &req->hdev->flags);
286 hci_req_add(req, HCI_OP_RESET, 0, NULL);
287 }
288
289 static void bredr_init(struct hci_request *req)
290 {
291 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
292
293 /* Read Local Supported Features */
294 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
295
296 /* Read Local Version */
297 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
298
299 /* Read BD Address */
300 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
301 }
302
303 static void amp_init(struct hci_request *req)
304 {
305 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
306
307 /* Read Local Version */
308 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
309
310 /* Read Local AMP Info */
311 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
312
313 /* Read Data Blk size */
314 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
315 }
316
317 static void hci_init1_req(struct hci_request *req, unsigned long opt)
318 {
319 struct hci_dev *hdev = req->hdev;
320
321 BT_DBG("%s %ld", hdev->name, opt);
322
323 /* Reset */
324 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
325 hci_reset_req(req, 0);
326
327 switch (hdev->dev_type) {
328 case HCI_BREDR:
329 bredr_init(req);
330 break;
331
332 case HCI_AMP:
333 amp_init(req);
334 break;
335
336 default:
337 BT_ERR("Unknown device type %d", hdev->dev_type);
338 break;
339 }
340 }
341
342 static void bredr_setup(struct hci_request *req)
343 {
344 __le16 param;
345 __u8 flt_type;
346
347 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
348 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
349
350 /* Read Class of Device */
351 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
352
353 /* Read Local Name */
354 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
355
356 /* Read Voice Setting */
357 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
358
359 /* Clear Event Filters */
360 flt_type = HCI_FLT_CLEAR_ALL;
361 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
362
363 /* Connection accept timeout ~20 secs */
364 param = __constant_cpu_to_le16(0x7d00);
365 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
366
367 /* Read page scan parameters */
368 if (req->hdev->hci_ver > BLUETOOTH_VER_1_1) {
369 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
370 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
371 }
372 }
373
374 static void le_setup(struct hci_request *req)
375 {
376 struct hci_dev *hdev = req->hdev;
377
378 /* Read LE Buffer Size */
379 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
380
381 /* Read LE Local Supported Features */
382 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
383
384 /* Read LE Advertising Channel TX Power */
385 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
386
387 /* Read LE White List Size */
388 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
389
390 /* Read LE Supported States */
391 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
392
393 /* LE-only controllers have LE implicitly enabled */
394 if (!lmp_bredr_capable(hdev))
395 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
396 }
397
398 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
399 {
400 if (lmp_ext_inq_capable(hdev))
401 return 0x02;
402
403 if (lmp_inq_rssi_capable(hdev))
404 return 0x01;
405
406 if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
407 hdev->lmp_subver == 0x0757)
408 return 0x01;
409
410 if (hdev->manufacturer == 15) {
411 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
412 return 0x01;
413 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
414 return 0x01;
415 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
416 return 0x01;
417 }
418
419 if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
420 hdev->lmp_subver == 0x1805)
421 return 0x01;
422
423 return 0x00;
424 }
425
426 static void hci_setup_inquiry_mode(struct hci_request *req)
427 {
428 u8 mode;
429
430 mode = hci_get_inquiry_mode(req->hdev);
431
432 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
433 }
434
435 static void hci_setup_event_mask(struct hci_request *req)
436 {
437 struct hci_dev *hdev = req->hdev;
438
439 /* The second byte is 0xff instead of 0x9f (two reserved bits
440 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
441 * command otherwise.
442 */
443 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
444
445 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
446 * any event mask for pre 1.2 devices.
447 */
448 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
449 return;
450
451 if (lmp_bredr_capable(hdev)) {
452 events[4] |= 0x01; /* Flow Specification Complete */
453 events[4] |= 0x02; /* Inquiry Result with RSSI */
454 events[4] |= 0x04; /* Read Remote Extended Features Complete */
455 events[5] |= 0x08; /* Synchronous Connection Complete */
456 events[5] |= 0x10; /* Synchronous Connection Changed */
457 } else {
458 /* Use a different default for LE-only devices */
459 memset(events, 0, sizeof(events));
460 events[0] |= 0x10; /* Disconnection Complete */
461 events[0] |= 0x80; /* Encryption Change */
462 events[1] |= 0x08; /* Read Remote Version Information Complete */
463 events[1] |= 0x20; /* Command Complete */
464 events[1] |= 0x40; /* Command Status */
465 events[1] |= 0x80; /* Hardware Error */
466 events[2] |= 0x04; /* Number of Completed Packets */
467 events[3] |= 0x02; /* Data Buffer Overflow */
468 events[5] |= 0x80; /* Encryption Key Refresh Complete */
469 }
470
471 if (lmp_inq_rssi_capable(hdev))
472 events[4] |= 0x02; /* Inquiry Result with RSSI */
473
474 if (lmp_sniffsubr_capable(hdev))
475 events[5] |= 0x20; /* Sniff Subrating */
476
477 if (lmp_pause_enc_capable(hdev))
478 events[5] |= 0x80; /* Encryption Key Refresh Complete */
479
480 if (lmp_ext_inq_capable(hdev))
481 events[5] |= 0x40; /* Extended Inquiry Result */
482
483 if (lmp_no_flush_capable(hdev))
484 events[7] |= 0x01; /* Enhanced Flush Complete */
485
486 if (lmp_lsto_capable(hdev))
487 events[6] |= 0x80; /* Link Supervision Timeout Changed */
488
489 if (lmp_ssp_capable(hdev)) {
490 events[6] |= 0x01; /* IO Capability Request */
491 events[6] |= 0x02; /* IO Capability Response */
492 events[6] |= 0x04; /* User Confirmation Request */
493 events[6] |= 0x08; /* User Passkey Request */
494 events[6] |= 0x10; /* Remote OOB Data Request */
495 events[6] |= 0x20; /* Simple Pairing Complete */
496 events[7] |= 0x04; /* User Passkey Notification */
497 events[7] |= 0x08; /* Keypress Notification */
498 events[7] |= 0x10; /* Remote Host Supported
499 * Features Notification
500 */
501 }
502
503 if (lmp_le_capable(hdev))
504 events[7] |= 0x20; /* LE Meta-Event */
505
506 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
507
508 if (lmp_le_capable(hdev)) {
509 memset(events, 0, sizeof(events));
510 events[0] = 0x1f;
511 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK,
512 sizeof(events), events);
513 }
514 }
515
516 static void hci_init2_req(struct hci_request *req, unsigned long opt)
517 {
518 struct hci_dev *hdev = req->hdev;
519
520 if (lmp_bredr_capable(hdev))
521 bredr_setup(req);
522
523 if (lmp_le_capable(hdev))
524 le_setup(req);
525
526 hci_setup_event_mask(req);
527
528 /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
529 * local supported commands HCI command.
530 */
531 if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
532 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
533
534 if (lmp_ssp_capable(hdev)) {
535 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
536 u8 mode = 0x01;
537 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
538 sizeof(mode), &mode);
539 } else {
540 struct hci_cp_write_eir cp;
541
542 memset(hdev->eir, 0, sizeof(hdev->eir));
543 memset(&cp, 0, sizeof(cp));
544
545 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
546 }
547 }
548
549 if (lmp_inq_rssi_capable(hdev))
550 hci_setup_inquiry_mode(req);
551
552 if (lmp_inq_tx_pwr_capable(hdev))
553 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
554
555 if (lmp_ext_feat_capable(hdev)) {
556 struct hci_cp_read_local_ext_features cp;
557
558 cp.page = 0x01;
559 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
560 sizeof(cp), &cp);
561 }
562
563 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
564 u8 enable = 1;
565 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
566 &enable);
567 }
568 }
569
570 static void hci_setup_link_policy(struct hci_request *req)
571 {
572 struct hci_dev *hdev = req->hdev;
573 struct hci_cp_write_def_link_policy cp;
574 u16 link_policy = 0;
575
576 if (lmp_rswitch_capable(hdev))
577 link_policy |= HCI_LP_RSWITCH;
578 if (lmp_hold_capable(hdev))
579 link_policy |= HCI_LP_HOLD;
580 if (lmp_sniff_capable(hdev))
581 link_policy |= HCI_LP_SNIFF;
582 if (lmp_park_capable(hdev))
583 link_policy |= HCI_LP_PARK;
584
585 cp.policy = cpu_to_le16(link_policy);
586 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
587 }
588
589 static void hci_set_le_support(struct hci_request *req)
590 {
591 struct hci_dev *hdev = req->hdev;
592 struct hci_cp_write_le_host_supported cp;
593
594 /* LE-only devices do not support explicit enablement */
595 if (!lmp_bredr_capable(hdev))
596 return;
597
598 memset(&cp, 0, sizeof(cp));
599
600 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
601 cp.le = 0x01;
602 cp.simul = lmp_le_br_capable(hdev);
603 }
604
605 if (cp.le != lmp_host_le_capable(hdev))
606 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
607 &cp);
608 }
609
610 static void hci_init3_req(struct hci_request *req, unsigned long opt)
611 {
612 struct hci_dev *hdev = req->hdev;
613 u8 p;
614
615 /* Some Broadcom based Bluetooth controllers do not support the
616 * Delete Stored Link Key command. They are clearly indicating its
617 * absence in the bit mask of supported commands.
618 *
619 * Check the supported commands and only if the the command is marked
620 * as supported send it. If not supported assume that the controller
621 * does not have actual support for stored link keys which makes this
622 * command redundant anyway.
623 */
624 if (hdev->commands[6] & 0x80) {
625 struct hci_cp_delete_stored_link_key cp;
626
627 bacpy(&cp.bdaddr, BDADDR_ANY);
628 cp.delete_all = 0x01;
629 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
630 sizeof(cp), &cp);
631 }
632
633 if (hdev->commands[5] & 0x10)
634 hci_setup_link_policy(req);
635
636 if (lmp_le_capable(hdev)) {
637 hci_set_le_support(req);
638 hci_update_ad(req);
639 }
640
641 /* Read features beyond page 1 if available */
642 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
643 struct hci_cp_read_local_ext_features cp;
644
645 cp.page = p;
646 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
647 sizeof(cp), &cp);
648 }
649 }
650
651 static int __hci_init(struct hci_dev *hdev)
652 {
653 int err;
654
655 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
656 if (err < 0)
657 return err;
658
659 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
660 * BR/EDR/LE type controllers. AMP controllers only need the
661 * first stage init.
662 */
663 if (hdev->dev_type != HCI_BREDR)
664 return 0;
665
666 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
667 if (err < 0)
668 return err;
669
670 return __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
671 }
672
673 static void hci_scan_req(struct hci_request *req, unsigned long opt)
674 {
675 __u8 scan = opt;
676
677 BT_DBG("%s %x", req->hdev->name, scan);
678
679 /* Inquiry and Page scans */
680 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
681 }
682
683 static void hci_auth_req(struct hci_request *req, unsigned long opt)
684 {
685 __u8 auth = opt;
686
687 BT_DBG("%s %x", req->hdev->name, auth);
688
689 /* Authentication */
690 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
691 }
692
693 static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
694 {
695 __u8 encrypt = opt;
696
697 BT_DBG("%s %x", req->hdev->name, encrypt);
698
699 /* Encryption */
700 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
701 }
702
703 static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
704 {
705 __le16 policy = cpu_to_le16(opt);
706
707 BT_DBG("%s %x", req->hdev->name, policy);
708
709 /* Default link policy */
710 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
711 }
712
713 /* Get HCI device by index.
714 * Device is held on return. */
715 struct hci_dev *hci_dev_get(int index)
716 {
717 struct hci_dev *hdev = NULL, *d;
718
719 BT_DBG("%d", index);
720
721 if (index < 0)
722 return NULL;
723
724 read_lock(&hci_dev_list_lock);
725 list_for_each_entry(d, &hci_dev_list, list) {
726 if (d->id == index) {
727 hdev = hci_dev_hold(d);
728 break;
729 }
730 }
731 read_unlock(&hci_dev_list_lock);
732 return hdev;
733 }
734
735 /* ---- Inquiry support ---- */
736
737 bool hci_discovery_active(struct hci_dev *hdev)
738 {
739 struct discovery_state *discov = &hdev->discovery;
740
741 switch (discov->state) {
742 case DISCOVERY_FINDING:
743 case DISCOVERY_RESOLVING:
744 return true;
745
746 default:
747 return false;
748 }
749 }
750
751 void hci_discovery_set_state(struct hci_dev *hdev, int state)
752 {
753 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
754
755 if (hdev->discovery.state == state)
756 return;
757
758 switch (state) {
759 case DISCOVERY_STOPPED:
760 if (hdev->discovery.state != DISCOVERY_STARTING)
761 mgmt_discovering(hdev, 0);
762 break;
763 case DISCOVERY_STARTING:
764 break;
765 case DISCOVERY_FINDING:
766 mgmt_discovering(hdev, 1);
767 break;
768 case DISCOVERY_RESOLVING:
769 break;
770 case DISCOVERY_STOPPING:
771 break;
772 }
773
774 hdev->discovery.state = state;
775 }
776
777 void hci_inquiry_cache_flush(struct hci_dev *hdev)
778 {
779 struct discovery_state *cache = &hdev->discovery;
780 struct inquiry_entry *p, *n;
781
782 list_for_each_entry_safe(p, n, &cache->all, all) {
783 list_del(&p->all);
784 kfree(p);
785 }
786
787 INIT_LIST_HEAD(&cache->unknown);
788 INIT_LIST_HEAD(&cache->resolve);
789 }
790
791 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
792 bdaddr_t *bdaddr)
793 {
794 struct discovery_state *cache = &hdev->discovery;
795 struct inquiry_entry *e;
796
797 BT_DBG("cache %p, %pMR", cache, bdaddr);
798
799 list_for_each_entry(e, &cache->all, all) {
800 if (!bacmp(&e->data.bdaddr, bdaddr))
801 return e;
802 }
803
804 return NULL;
805 }
806
807 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
808 bdaddr_t *bdaddr)
809 {
810 struct discovery_state *cache = &hdev->discovery;
811 struct inquiry_entry *e;
812
813 BT_DBG("cache %p, %pMR", cache, bdaddr);
814
815 list_for_each_entry(e, &cache->unknown, list) {
816 if (!bacmp(&e->data.bdaddr, bdaddr))
817 return e;
818 }
819
820 return NULL;
821 }
822
823 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
824 bdaddr_t *bdaddr,
825 int state)
826 {
827 struct discovery_state *cache = &hdev->discovery;
828 struct inquiry_entry *e;
829
830 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
831
832 list_for_each_entry(e, &cache->resolve, list) {
833 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
834 return e;
835 if (!bacmp(&e->data.bdaddr, bdaddr))
836 return e;
837 }
838
839 return NULL;
840 }
841
842 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
843 struct inquiry_entry *ie)
844 {
845 struct discovery_state *cache = &hdev->discovery;
846 struct list_head *pos = &cache->resolve;
847 struct inquiry_entry *p;
848
849 list_del(&ie->list);
850
851 list_for_each_entry(p, &cache->resolve, list) {
852 if (p->name_state != NAME_PENDING &&
853 abs(p->data.rssi) >= abs(ie->data.rssi))
854 break;
855 pos = &p->list;
856 }
857
858 list_add(&ie->list, pos);
859 }
860
861 bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
862 bool name_known, bool *ssp)
863 {
864 struct discovery_state *cache = &hdev->discovery;
865 struct inquiry_entry *ie;
866
867 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
868
869 hci_remove_remote_oob_data(hdev, &data->bdaddr);
870
871 if (ssp)
872 *ssp = data->ssp_mode;
873
874 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
875 if (ie) {
876 if (ie->data.ssp_mode && ssp)
877 *ssp = true;
878
879 if (ie->name_state == NAME_NEEDED &&
880 data->rssi != ie->data.rssi) {
881 ie->data.rssi = data->rssi;
882 hci_inquiry_cache_update_resolve(hdev, ie);
883 }
884
885 goto update;
886 }
887
888 /* Entry not in the cache. Add new one. */
889 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
890 if (!ie)
891 return false;
892
893 list_add(&ie->all, &cache->all);
894
895 if (name_known) {
896 ie->name_state = NAME_KNOWN;
897 } else {
898 ie->name_state = NAME_NOT_KNOWN;
899 list_add(&ie->list, &cache->unknown);
900 }
901
902 update:
903 if (name_known && ie->name_state != NAME_KNOWN &&
904 ie->name_state != NAME_PENDING) {
905 ie->name_state = NAME_KNOWN;
906 list_del(&ie->list);
907 }
908
909 memcpy(&ie->data, data, sizeof(*data));
910 ie->timestamp = jiffies;
911 cache->timestamp = jiffies;
912
913 if (ie->name_state == NAME_NOT_KNOWN)
914 return false;
915
916 return true;
917 }
918
919 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
920 {
921 struct discovery_state *cache = &hdev->discovery;
922 struct inquiry_info *info = (struct inquiry_info *) buf;
923 struct inquiry_entry *e;
924 int copied = 0;
925
926 list_for_each_entry(e, &cache->all, all) {
927 struct inquiry_data *data = &e->data;
928
929 if (copied >= num)
930 break;
931
932 bacpy(&info->bdaddr, &data->bdaddr);
933 info->pscan_rep_mode = data->pscan_rep_mode;
934 info->pscan_period_mode = data->pscan_period_mode;
935 info->pscan_mode = data->pscan_mode;
936 memcpy(info->dev_class, data->dev_class, 3);
937 info->clock_offset = data->clock_offset;
938
939 info++;
940 copied++;
941 }
942
943 BT_DBG("cache %p, copied %d", cache, copied);
944 return copied;
945 }
946
947 static void hci_inq_req(struct hci_request *req, unsigned long opt)
948 {
949 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
950 struct hci_dev *hdev = req->hdev;
951 struct hci_cp_inquiry cp;
952
953 BT_DBG("%s", hdev->name);
954
955 if (test_bit(HCI_INQUIRY, &hdev->flags))
956 return;
957
958 /* Start Inquiry */
959 memcpy(&cp.lap, &ir->lap, 3);
960 cp.length = ir->length;
961 cp.num_rsp = ir->num_rsp;
962 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
963 }
964
965 static int wait_inquiry(void *word)
966 {
967 schedule();
968 return signal_pending(current);
969 }
970
971 int hci_inquiry(void __user *arg)
972 {
973 __u8 __user *ptr = arg;
974 struct hci_inquiry_req ir;
975 struct hci_dev *hdev;
976 int err = 0, do_inquiry = 0, max_rsp;
977 long timeo;
978 __u8 *buf;
979
980 if (copy_from_user(&ir, ptr, sizeof(ir)))
981 return -EFAULT;
982
983 hdev = hci_dev_get(ir.dev_id);
984 if (!hdev)
985 return -ENODEV;
986
987 hci_dev_lock(hdev);
988 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
989 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
990 hci_inquiry_cache_flush(hdev);
991 do_inquiry = 1;
992 }
993 hci_dev_unlock(hdev);
994
995 timeo = ir.length * msecs_to_jiffies(2000);
996
997 if (do_inquiry) {
998 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
999 timeo);
1000 if (err < 0)
1001 goto done;
1002
1003 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1004 * cleared). If it is interrupted by a signal, return -EINTR.
1005 */
1006 if (wait_on_bit(&hdev->flags, HCI_INQUIRY, wait_inquiry,
1007 TASK_INTERRUPTIBLE))
1008 return -EINTR;
1009 }
1010
1011 /* for unlimited number of responses we will use buffer with
1012 * 255 entries
1013 */
1014 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1015
1016 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1017 * copy it to the user space.
1018 */
1019 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
1020 if (!buf) {
1021 err = -ENOMEM;
1022 goto done;
1023 }
1024
1025 hci_dev_lock(hdev);
1026 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1027 hci_dev_unlock(hdev);
1028
1029 BT_DBG("num_rsp %d", ir.num_rsp);
1030
1031 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1032 ptr += sizeof(ir);
1033 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1034 ir.num_rsp))
1035 err = -EFAULT;
1036 } else
1037 err = -EFAULT;
1038
1039 kfree(buf);
1040
1041 done:
1042 hci_dev_put(hdev);
1043 return err;
1044 }
1045
1046 static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
1047 {
1048 u8 ad_len = 0, flags = 0;
1049 size_t name_len;
1050
1051 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
1052 flags |= LE_AD_GENERAL;
1053
1054 if (!lmp_bredr_capable(hdev))
1055 flags |= LE_AD_NO_BREDR;
1056
1057 if (lmp_le_br_capable(hdev))
1058 flags |= LE_AD_SIM_LE_BREDR_CTRL;
1059
1060 if (lmp_host_le_br_capable(hdev))
1061 flags |= LE_AD_SIM_LE_BREDR_HOST;
1062
1063 if (flags) {
1064 BT_DBG("adv flags 0x%02x", flags);
1065
1066 ptr[0] = 2;
1067 ptr[1] = EIR_FLAGS;
1068 ptr[2] = flags;
1069
1070 ad_len += 3;
1071 ptr += 3;
1072 }
1073
1074 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
1075 ptr[0] = 2;
1076 ptr[1] = EIR_TX_POWER;
1077 ptr[2] = (u8) hdev->adv_tx_power;
1078
1079 ad_len += 3;
1080 ptr += 3;
1081 }
1082
1083 name_len = strlen(hdev->dev_name);
1084 if (name_len > 0) {
1085 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
1086
1087 if (name_len > max_len) {
1088 name_len = max_len;
1089 ptr[1] = EIR_NAME_SHORT;
1090 } else
1091 ptr[1] = EIR_NAME_COMPLETE;
1092
1093 ptr[0] = name_len + 1;
1094
1095 memcpy(ptr + 2, hdev->dev_name, name_len);
1096
1097 ad_len += (name_len + 2);
1098 ptr += (name_len + 2);
1099 }
1100
1101 return ad_len;
1102 }
1103
1104 void hci_update_ad(struct hci_request *req)
1105 {
1106 struct hci_dev *hdev = req->hdev;
1107 struct hci_cp_le_set_adv_data cp;
1108 u8 len;
1109
1110 if (!lmp_le_capable(hdev))
1111 return;
1112
1113 memset(&cp, 0, sizeof(cp));
1114
1115 len = create_ad(hdev, cp.data);
1116
1117 if (hdev->adv_data_len == len &&
1118 memcmp(cp.data, hdev->adv_data, len) == 0)
1119 return;
1120
1121 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1122 hdev->adv_data_len = len;
1123
1124 cp.length = len;
1125
1126 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1127 }
1128
1129 /* ---- HCI ioctl helpers ---- */
1130
1131 int hci_dev_open(__u16 dev)
1132 {
1133 struct hci_dev *hdev;
1134 int ret = 0;
1135
1136 hdev = hci_dev_get(dev);
1137 if (!hdev)
1138 return -ENODEV;
1139
1140 BT_DBG("%s %p", hdev->name, hdev);
1141
1142 hci_req_lock(hdev);
1143
1144 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
1145 ret = -ENODEV;
1146 goto done;
1147 }
1148
1149 /* Check for rfkill but allow the HCI setup stage to proceed
1150 * (which in itself doesn't cause any RF activity).
1151 */
1152 if (test_bit(HCI_RFKILLED, &hdev->dev_flags) &&
1153 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
1154 ret = -ERFKILL;
1155 goto done;
1156 }
1157
1158 if (test_bit(HCI_UP, &hdev->flags)) {
1159 ret = -EALREADY;
1160 goto done;
1161 }
1162
1163 if (hdev->open(hdev)) {
1164 ret = -EIO;
1165 goto done;
1166 }
1167
1168 atomic_set(&hdev->cmd_cnt, 1);
1169 set_bit(HCI_INIT, &hdev->flags);
1170
1171 if (hdev->setup && test_bit(HCI_SETUP, &hdev->dev_flags))
1172 ret = hdev->setup(hdev);
1173
1174 if (!ret) {
1175 /* Treat all non BR/EDR controllers as raw devices if
1176 * enable_hs is not set.
1177 */
1178 if (hdev->dev_type != HCI_BREDR && !enable_hs)
1179 set_bit(HCI_RAW, &hdev->flags);
1180
1181 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
1182 set_bit(HCI_RAW, &hdev->flags);
1183
1184 if (!test_bit(HCI_RAW, &hdev->flags))
1185 ret = __hci_init(hdev);
1186 }
1187
1188 clear_bit(HCI_INIT, &hdev->flags);
1189
1190 if (!ret) {
1191 hci_dev_hold(hdev);
1192 set_bit(HCI_UP, &hdev->flags);
1193 hci_notify(hdev, HCI_DEV_UP);
1194 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
1195 mgmt_valid_hdev(hdev)) {
1196 hci_dev_lock(hdev);
1197 mgmt_powered(hdev, 1);
1198 hci_dev_unlock(hdev);
1199 }
1200 } else {
1201 /* Init failed, cleanup */
1202 flush_work(&hdev->tx_work);
1203 flush_work(&hdev->cmd_work);
1204 flush_work(&hdev->rx_work);
1205
1206 skb_queue_purge(&hdev->cmd_q);
1207 skb_queue_purge(&hdev->rx_q);
1208
1209 if (hdev->flush)
1210 hdev->flush(hdev);
1211
1212 if (hdev->sent_cmd) {
1213 kfree_skb(hdev->sent_cmd);
1214 hdev->sent_cmd = NULL;
1215 }
1216
1217 hdev->close(hdev);
1218 hdev->flags = 0;
1219 }
1220
1221 done:
1222 hci_req_unlock(hdev);
1223 hci_dev_put(hdev);
1224 return ret;
1225 }
1226
1227 static int hci_dev_do_close(struct hci_dev *hdev)
1228 {
1229 BT_DBG("%s %p", hdev->name, hdev);
1230
1231 cancel_delayed_work(&hdev->power_off);
1232
1233 hci_req_cancel(hdev, ENODEV);
1234 hci_req_lock(hdev);
1235
1236 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1237 del_timer_sync(&hdev->cmd_timer);
1238 hci_req_unlock(hdev);
1239 return 0;
1240 }
1241
1242 /* Flush RX and TX works */
1243 flush_work(&hdev->tx_work);
1244 flush_work(&hdev->rx_work);
1245
1246 if (hdev->discov_timeout > 0) {
1247 cancel_delayed_work(&hdev->discov_off);
1248 hdev->discov_timeout = 0;
1249 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1250 }
1251
1252 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1253 cancel_delayed_work(&hdev->service_cache);
1254
1255 cancel_delayed_work_sync(&hdev->le_scan_disable);
1256
1257 hci_dev_lock(hdev);
1258 hci_inquiry_cache_flush(hdev);
1259 hci_conn_hash_flush(hdev);
1260 hci_dev_unlock(hdev);
1261
1262 hci_notify(hdev, HCI_DEV_DOWN);
1263
1264 if (hdev->flush)
1265 hdev->flush(hdev);
1266
1267 /* Reset device */
1268 skb_queue_purge(&hdev->cmd_q);
1269 atomic_set(&hdev->cmd_cnt, 1);
1270 if (!test_bit(HCI_RAW, &hdev->flags) &&
1271 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1272 set_bit(HCI_INIT, &hdev->flags);
1273 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1274 clear_bit(HCI_INIT, &hdev->flags);
1275 }
1276
1277 /* flush cmd work */
1278 flush_work(&hdev->cmd_work);
1279
1280 /* Drop queues */
1281 skb_queue_purge(&hdev->rx_q);
1282 skb_queue_purge(&hdev->cmd_q);
1283 skb_queue_purge(&hdev->raw_q);
1284
1285 /* Drop last sent command */
1286 if (hdev->sent_cmd) {
1287 del_timer_sync(&hdev->cmd_timer);
1288 kfree_skb(hdev->sent_cmd);
1289 hdev->sent_cmd = NULL;
1290 }
1291
1292 kfree_skb(hdev->recv_evt);
1293 hdev->recv_evt = NULL;
1294
1295 /* After this point our queues are empty
1296 * and no tasks are scheduled. */
1297 hdev->close(hdev);
1298
1299 /* Clear flags */
1300 hdev->flags = 0;
1301 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
1302
1303 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
1304 mgmt_valid_hdev(hdev)) {
1305 hci_dev_lock(hdev);
1306 mgmt_powered(hdev, 0);
1307 hci_dev_unlock(hdev);
1308 }
1309
1310 /* Controller radio is available but is currently powered down */
1311 hdev->amp_status = 0;
1312
1313 memset(hdev->eir, 0, sizeof(hdev->eir));
1314 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1315
1316 hci_req_unlock(hdev);
1317
1318 hci_dev_put(hdev);
1319 return 0;
1320 }
1321
1322 int hci_dev_close(__u16 dev)
1323 {
1324 struct hci_dev *hdev;
1325 int err;
1326
1327 hdev = hci_dev_get(dev);
1328 if (!hdev)
1329 return -ENODEV;
1330
1331 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1332 cancel_delayed_work(&hdev->power_off);
1333
1334 err = hci_dev_do_close(hdev);
1335
1336 hci_dev_put(hdev);
1337 return err;
1338 }
1339
1340 int hci_dev_reset(__u16 dev)
1341 {
1342 struct hci_dev *hdev;
1343 int ret = 0;
1344
1345 hdev = hci_dev_get(dev);
1346 if (!hdev)
1347 return -ENODEV;
1348
1349 hci_req_lock(hdev);
1350
1351 if (!test_bit(HCI_UP, &hdev->flags))
1352 goto done;
1353
1354 /* Drop queues */
1355 skb_queue_purge(&hdev->rx_q);
1356 skb_queue_purge(&hdev->cmd_q);
1357
1358 hci_dev_lock(hdev);
1359 hci_inquiry_cache_flush(hdev);
1360 hci_conn_hash_flush(hdev);
1361 hci_dev_unlock(hdev);
1362
1363 if (hdev->flush)
1364 hdev->flush(hdev);
1365
1366 atomic_set(&hdev->cmd_cnt, 1);
1367 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1368
1369 if (!test_bit(HCI_RAW, &hdev->flags))
1370 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1371
1372 done:
1373 hci_req_unlock(hdev);
1374 hci_dev_put(hdev);
1375 return ret;
1376 }
1377
1378 int hci_dev_reset_stat(__u16 dev)
1379 {
1380 struct hci_dev *hdev;
1381 int ret = 0;
1382
1383 hdev = hci_dev_get(dev);
1384 if (!hdev)
1385 return -ENODEV;
1386
1387 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1388
1389 hci_dev_put(hdev);
1390
1391 return ret;
1392 }
1393
1394 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1395 {
1396 struct hci_dev *hdev;
1397 struct hci_dev_req dr;
1398 int err = 0;
1399
1400 if (copy_from_user(&dr, arg, sizeof(dr)))
1401 return -EFAULT;
1402
1403 hdev = hci_dev_get(dr.dev_id);
1404 if (!hdev)
1405 return -ENODEV;
1406
1407 switch (cmd) {
1408 case HCISETAUTH:
1409 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1410 HCI_INIT_TIMEOUT);
1411 break;
1412
1413 case HCISETENCRYPT:
1414 if (!lmp_encrypt_capable(hdev)) {
1415 err = -EOPNOTSUPP;
1416 break;
1417 }
1418
1419 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1420 /* Auth must be enabled first */
1421 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1422 HCI_INIT_TIMEOUT);
1423 if (err)
1424 break;
1425 }
1426
1427 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1428 HCI_INIT_TIMEOUT);
1429 break;
1430
1431 case HCISETSCAN:
1432 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1433 HCI_INIT_TIMEOUT);
1434 break;
1435
1436 case HCISETLINKPOL:
1437 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1438 HCI_INIT_TIMEOUT);
1439 break;
1440
1441 case HCISETLINKMODE:
1442 hdev->link_mode = ((__u16) dr.dev_opt) &
1443 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1444 break;
1445
1446 case HCISETPTYPE:
1447 hdev->pkt_type = (__u16) dr.dev_opt;
1448 break;
1449
1450 case HCISETACLMTU:
1451 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1452 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1453 break;
1454
1455 case HCISETSCOMTU:
1456 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1457 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1458 break;
1459
1460 default:
1461 err = -EINVAL;
1462 break;
1463 }
1464
1465 hci_dev_put(hdev);
1466 return err;
1467 }
1468
1469 int hci_get_dev_list(void __user *arg)
1470 {
1471 struct hci_dev *hdev;
1472 struct hci_dev_list_req *dl;
1473 struct hci_dev_req *dr;
1474 int n = 0, size, err;
1475 __u16 dev_num;
1476
1477 if (get_user(dev_num, (__u16 __user *) arg))
1478 return -EFAULT;
1479
1480 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1481 return -EINVAL;
1482
1483 size = sizeof(*dl) + dev_num * sizeof(*dr);
1484
1485 dl = kzalloc(size, GFP_KERNEL);
1486 if (!dl)
1487 return -ENOMEM;
1488
1489 dr = dl->dev_req;
1490
1491 read_lock(&hci_dev_list_lock);
1492 list_for_each_entry(hdev, &hci_dev_list, list) {
1493 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1494 cancel_delayed_work(&hdev->power_off);
1495
1496 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1497 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1498
1499 (dr + n)->dev_id = hdev->id;
1500 (dr + n)->dev_opt = hdev->flags;
1501
1502 if (++n >= dev_num)
1503 break;
1504 }
1505 read_unlock(&hci_dev_list_lock);
1506
1507 dl->dev_num = n;
1508 size = sizeof(*dl) + n * sizeof(*dr);
1509
1510 err = copy_to_user(arg, dl, size);
1511 kfree(dl);
1512
1513 return err ? -EFAULT : 0;
1514 }
1515
1516 int hci_get_dev_info(void __user *arg)
1517 {
1518 struct hci_dev *hdev;
1519 struct hci_dev_info di;
1520 int err = 0;
1521
1522 if (copy_from_user(&di, arg, sizeof(di)))
1523 return -EFAULT;
1524
1525 hdev = hci_dev_get(di.dev_id);
1526 if (!hdev)
1527 return -ENODEV;
1528
1529 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1530 cancel_delayed_work_sync(&hdev->power_off);
1531
1532 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1533 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1534
1535 strcpy(di.name, hdev->name);
1536 di.bdaddr = hdev->bdaddr;
1537 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1538 di.flags = hdev->flags;
1539 di.pkt_type = hdev->pkt_type;
1540 if (lmp_bredr_capable(hdev)) {
1541 di.acl_mtu = hdev->acl_mtu;
1542 di.acl_pkts = hdev->acl_pkts;
1543 di.sco_mtu = hdev->sco_mtu;
1544 di.sco_pkts = hdev->sco_pkts;
1545 } else {
1546 di.acl_mtu = hdev->le_mtu;
1547 di.acl_pkts = hdev->le_pkts;
1548 di.sco_mtu = 0;
1549 di.sco_pkts = 0;
1550 }
1551 di.link_policy = hdev->link_policy;
1552 di.link_mode = hdev->link_mode;
1553
1554 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1555 memcpy(&di.features, &hdev->features, sizeof(di.features));
1556
1557 if (copy_to_user(arg, &di, sizeof(di)))
1558 err = -EFAULT;
1559
1560 hci_dev_put(hdev);
1561
1562 return err;
1563 }
1564
1565 /* ---- Interface to HCI drivers ---- */
1566
1567 static int hci_rfkill_set_block(void *data, bool blocked)
1568 {
1569 struct hci_dev *hdev = data;
1570
1571 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1572
1573 if (blocked) {
1574 set_bit(HCI_RFKILLED, &hdev->dev_flags);
1575 if (!test_bit(HCI_SETUP, &hdev->dev_flags))
1576 hci_dev_do_close(hdev);
1577 } else {
1578 clear_bit(HCI_RFKILLED, &hdev->dev_flags);
1579 }
1580
1581 return 0;
1582 }
1583
1584 static const struct rfkill_ops hci_rfkill_ops = {
1585 .set_block = hci_rfkill_set_block,
1586 };
1587
1588 static void hci_power_on(struct work_struct *work)
1589 {
1590 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1591 int err;
1592
1593 BT_DBG("%s", hdev->name);
1594
1595 err = hci_dev_open(hdev->id);
1596 if (err < 0) {
1597 mgmt_set_powered_failed(hdev, err);
1598 return;
1599 }
1600
1601 if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
1602 clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
1603 hci_dev_do_close(hdev);
1604 } else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1605 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1606 HCI_AUTO_OFF_TIMEOUT);
1607 }
1608
1609 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
1610 mgmt_index_added(hdev);
1611 }
1612
1613 static void hci_power_off(struct work_struct *work)
1614 {
1615 struct hci_dev *hdev = container_of(work, struct hci_dev,
1616 power_off.work);
1617
1618 BT_DBG("%s", hdev->name);
1619
1620 hci_dev_do_close(hdev);
1621 }
1622
1623 static void hci_discov_off(struct work_struct *work)
1624 {
1625 struct hci_dev *hdev;
1626 u8 scan = SCAN_PAGE;
1627
1628 hdev = container_of(work, struct hci_dev, discov_off.work);
1629
1630 BT_DBG("%s", hdev->name);
1631
1632 hci_dev_lock(hdev);
1633
1634 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1635
1636 hdev->discov_timeout = 0;
1637
1638 hci_dev_unlock(hdev);
1639 }
1640
1641 int hci_uuids_clear(struct hci_dev *hdev)
1642 {
1643 struct bt_uuid *uuid, *tmp;
1644
1645 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1646 list_del(&uuid->list);
1647 kfree(uuid);
1648 }
1649
1650 return 0;
1651 }
1652
1653 int hci_link_keys_clear(struct hci_dev *hdev)
1654 {
1655 struct list_head *p, *n;
1656
1657 list_for_each_safe(p, n, &hdev->link_keys) {
1658 struct link_key *key;
1659
1660 key = list_entry(p, struct link_key, list);
1661
1662 list_del(p);
1663 kfree(key);
1664 }
1665
1666 return 0;
1667 }
1668
1669 int hci_smp_ltks_clear(struct hci_dev *hdev)
1670 {
1671 struct smp_ltk *k, *tmp;
1672
1673 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1674 list_del(&k->list);
1675 kfree(k);
1676 }
1677
1678 return 0;
1679 }
1680
1681 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1682 {
1683 struct link_key *k;
1684
1685 list_for_each_entry(k, &hdev->link_keys, list)
1686 if (bacmp(bdaddr, &k->bdaddr) == 0)
1687 return k;
1688
1689 return NULL;
1690 }
1691
1692 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1693 u8 key_type, u8 old_key_type)
1694 {
1695 /* Legacy key */
1696 if (key_type < 0x03)
1697 return true;
1698
1699 /* Debug keys are insecure so don't store them persistently */
1700 if (key_type == HCI_LK_DEBUG_COMBINATION)
1701 return false;
1702
1703 /* Changed combination key and there's no previous one */
1704 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1705 return false;
1706
1707 /* Security mode 3 case */
1708 if (!conn)
1709 return true;
1710
1711 /* Neither local nor remote side had no-bonding as requirement */
1712 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1713 return true;
1714
1715 /* Local side had dedicated bonding as requirement */
1716 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1717 return true;
1718
1719 /* Remote side had dedicated bonding as requirement */
1720 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1721 return true;
1722
1723 /* If none of the above criteria match, then don't store the key
1724 * persistently */
1725 return false;
1726 }
1727
1728 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1729 {
1730 struct smp_ltk *k;
1731
1732 list_for_each_entry(k, &hdev->long_term_keys, list) {
1733 if (k->ediv != ediv ||
1734 memcmp(rand, k->rand, sizeof(k->rand)))
1735 continue;
1736
1737 return k;
1738 }
1739
1740 return NULL;
1741 }
1742
1743 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1744 u8 addr_type)
1745 {
1746 struct smp_ltk *k;
1747
1748 list_for_each_entry(k, &hdev->long_term_keys, list)
1749 if (addr_type == k->bdaddr_type &&
1750 bacmp(bdaddr, &k->bdaddr) == 0)
1751 return k;
1752
1753 return NULL;
1754 }
1755
1756 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1757 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1758 {
1759 struct link_key *key, *old_key;
1760 u8 old_key_type;
1761 bool persistent;
1762
1763 old_key = hci_find_link_key(hdev, bdaddr);
1764 if (old_key) {
1765 old_key_type = old_key->type;
1766 key = old_key;
1767 } else {
1768 old_key_type = conn ? conn->key_type : 0xff;
1769 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1770 if (!key)
1771 return -ENOMEM;
1772 list_add(&key->list, &hdev->link_keys);
1773 }
1774
1775 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
1776
1777 /* Some buggy controller combinations generate a changed
1778 * combination key for legacy pairing even when there's no
1779 * previous key */
1780 if (type == HCI_LK_CHANGED_COMBINATION &&
1781 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
1782 type = HCI_LK_COMBINATION;
1783 if (conn)
1784 conn->key_type = type;
1785 }
1786
1787 bacpy(&key->bdaddr, bdaddr);
1788 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
1789 key->pin_len = pin_len;
1790
1791 if (type == HCI_LK_CHANGED_COMBINATION)
1792 key->type = old_key_type;
1793 else
1794 key->type = type;
1795
1796 if (!new_key)
1797 return 0;
1798
1799 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1800
1801 mgmt_new_link_key(hdev, key, persistent);
1802
1803 if (conn)
1804 conn->flush_key = !persistent;
1805
1806 return 0;
1807 }
1808
1809 int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
1810 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
1811 ediv, u8 rand[8])
1812 {
1813 struct smp_ltk *key, *old_key;
1814
1815 if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1816 return 0;
1817
1818 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1819 if (old_key)
1820 key = old_key;
1821 else {
1822 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1823 if (!key)
1824 return -ENOMEM;
1825 list_add(&key->list, &hdev->long_term_keys);
1826 }
1827
1828 bacpy(&key->bdaddr, bdaddr);
1829 key->bdaddr_type = addr_type;
1830 memcpy(key->val, tk, sizeof(key->val));
1831 key->authenticated = authenticated;
1832 key->ediv = ediv;
1833 key->enc_size = enc_size;
1834 key->type = type;
1835 memcpy(key->rand, rand, sizeof(key->rand));
1836
1837 if (!new_key)
1838 return 0;
1839
1840 if (type & HCI_SMP_LTK)
1841 mgmt_new_ltk(hdev, key, 1);
1842
1843 return 0;
1844 }
1845
1846 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1847 {
1848 struct link_key *key;
1849
1850 key = hci_find_link_key(hdev, bdaddr);
1851 if (!key)
1852 return -ENOENT;
1853
1854 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1855
1856 list_del(&key->list);
1857 kfree(key);
1858
1859 return 0;
1860 }
1861
1862 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1863 {
1864 struct smp_ltk *k, *tmp;
1865
1866 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1867 if (bacmp(bdaddr, &k->bdaddr))
1868 continue;
1869
1870 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1871
1872 list_del(&k->list);
1873 kfree(k);
1874 }
1875
1876 return 0;
1877 }
1878
1879 /* HCI command timer function */
1880 static void hci_cmd_timeout(unsigned long arg)
1881 {
1882 struct hci_dev *hdev = (void *) arg;
1883
1884 if (hdev->sent_cmd) {
1885 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1886 u16 opcode = __le16_to_cpu(sent->opcode);
1887
1888 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
1889 } else {
1890 BT_ERR("%s command tx timeout", hdev->name);
1891 }
1892
1893 atomic_set(&hdev->cmd_cnt, 1);
1894 queue_work(hdev->workqueue, &hdev->cmd_work);
1895 }
1896
1897 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1898 bdaddr_t *bdaddr)
1899 {
1900 struct oob_data *data;
1901
1902 list_for_each_entry(data, &hdev->remote_oob_data, list)
1903 if (bacmp(bdaddr, &data->bdaddr) == 0)
1904 return data;
1905
1906 return NULL;
1907 }
1908
1909 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1910 {
1911 struct oob_data *data;
1912
1913 data = hci_find_remote_oob_data(hdev, bdaddr);
1914 if (!data)
1915 return -ENOENT;
1916
1917 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1918
1919 list_del(&data->list);
1920 kfree(data);
1921
1922 return 0;
1923 }
1924
1925 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1926 {
1927 struct oob_data *data, *n;
1928
1929 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1930 list_del(&data->list);
1931 kfree(data);
1932 }
1933
1934 return 0;
1935 }
1936
1937 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1938 u8 *randomizer)
1939 {
1940 struct oob_data *data;
1941
1942 data = hci_find_remote_oob_data(hdev, bdaddr);
1943
1944 if (!data) {
1945 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1946 if (!data)
1947 return -ENOMEM;
1948
1949 bacpy(&data->bdaddr, bdaddr);
1950 list_add(&data->list, &hdev->remote_oob_data);
1951 }
1952
1953 memcpy(data->hash, hash, sizeof(data->hash));
1954 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1955
1956 BT_DBG("%s for %pMR", hdev->name, bdaddr);
1957
1958 return 0;
1959 }
1960
1961 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
1962 {
1963 struct bdaddr_list *b;
1964
1965 list_for_each_entry(b, &hdev->blacklist, list)
1966 if (bacmp(bdaddr, &b->bdaddr) == 0)
1967 return b;
1968
1969 return NULL;
1970 }
1971
1972 int hci_blacklist_clear(struct hci_dev *hdev)
1973 {
1974 struct list_head *p, *n;
1975
1976 list_for_each_safe(p, n, &hdev->blacklist) {
1977 struct bdaddr_list *b;
1978
1979 b = list_entry(p, struct bdaddr_list, list);
1980
1981 list_del(p);
1982 kfree(b);
1983 }
1984
1985 return 0;
1986 }
1987
1988 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1989 {
1990 struct bdaddr_list *entry;
1991
1992 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1993 return -EBADF;
1994
1995 if (hci_blacklist_lookup(hdev, bdaddr))
1996 return -EEXIST;
1997
1998 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1999 if (!entry)
2000 return -ENOMEM;
2001
2002 bacpy(&entry->bdaddr, bdaddr);
2003
2004 list_add(&entry->list, &hdev->blacklist);
2005
2006 return mgmt_device_blocked(hdev, bdaddr, type);
2007 }
2008
2009 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2010 {
2011 struct bdaddr_list *entry;
2012
2013 if (bacmp(bdaddr, BDADDR_ANY) == 0)
2014 return hci_blacklist_clear(hdev);
2015
2016 entry = hci_blacklist_lookup(hdev, bdaddr);
2017 if (!entry)
2018 return -ENOENT;
2019
2020 list_del(&entry->list);
2021 kfree(entry);
2022
2023 return mgmt_device_unblocked(hdev, bdaddr, type);
2024 }
2025
2026 static void inquiry_complete(struct hci_dev *hdev, u8 status)
2027 {
2028 if (status) {
2029 BT_ERR("Failed to start inquiry: status %d", status);
2030
2031 hci_dev_lock(hdev);
2032 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2033 hci_dev_unlock(hdev);
2034 return;
2035 }
2036 }
2037
2038 static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
2039 {
2040 /* General inquiry access code (GIAC) */
2041 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2042 struct hci_request req;
2043 struct hci_cp_inquiry cp;
2044 int err;
2045
2046 if (status) {
2047 BT_ERR("Failed to disable LE scanning: status %d", status);
2048 return;
2049 }
2050
2051 switch (hdev->discovery.type) {
2052 case DISCOV_TYPE_LE:
2053 hci_dev_lock(hdev);
2054 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2055 hci_dev_unlock(hdev);
2056 break;
2057
2058 case DISCOV_TYPE_INTERLEAVED:
2059 hci_req_init(&req, hdev);
2060
2061 memset(&cp, 0, sizeof(cp));
2062 memcpy(&cp.lap, lap, sizeof(cp.lap));
2063 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
2064 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
2065
2066 hci_dev_lock(hdev);
2067
2068 hci_inquiry_cache_flush(hdev);
2069
2070 err = hci_req_run(&req, inquiry_complete);
2071 if (err) {
2072 BT_ERR("Inquiry request failed: err %d", err);
2073 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2074 }
2075
2076 hci_dev_unlock(hdev);
2077 break;
2078 }
2079 }
2080
2081 static void le_scan_disable_work(struct work_struct *work)
2082 {
2083 struct hci_dev *hdev = container_of(work, struct hci_dev,
2084 le_scan_disable.work);
2085 struct hci_cp_le_set_scan_enable cp;
2086 struct hci_request req;
2087 int err;
2088
2089 BT_DBG("%s", hdev->name);
2090
2091 hci_req_init(&req, hdev);
2092
2093 memset(&cp, 0, sizeof(cp));
2094 cp.enable = LE_SCAN_DISABLE;
2095 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2096
2097 err = hci_req_run(&req, le_scan_disable_work_complete);
2098 if (err)
2099 BT_ERR("Disable LE scanning request failed: err %d", err);
2100 }
2101
2102 /* Alloc HCI device */
2103 struct hci_dev *hci_alloc_dev(void)
2104 {
2105 struct hci_dev *hdev;
2106
2107 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
2108 if (!hdev)
2109 return NULL;
2110
2111 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2112 hdev->esco_type = (ESCO_HV1);
2113 hdev->link_mode = (HCI_LM_ACCEPT);
2114 hdev->io_capability = 0x03; /* No Input No Output */
2115 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2116 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
2117
2118 hdev->sniff_max_interval = 800;
2119 hdev->sniff_min_interval = 80;
2120
2121 mutex_init(&hdev->lock);
2122 mutex_init(&hdev->req_lock);
2123
2124 INIT_LIST_HEAD(&hdev->mgmt_pending);
2125 INIT_LIST_HEAD(&hdev->blacklist);
2126 INIT_LIST_HEAD(&hdev->uuids);
2127 INIT_LIST_HEAD(&hdev->link_keys);
2128 INIT_LIST_HEAD(&hdev->long_term_keys);
2129 INIT_LIST_HEAD(&hdev->remote_oob_data);
2130 INIT_LIST_HEAD(&hdev->conn_hash.list);
2131
2132 INIT_WORK(&hdev->rx_work, hci_rx_work);
2133 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2134 INIT_WORK(&hdev->tx_work, hci_tx_work);
2135 INIT_WORK(&hdev->power_on, hci_power_on);
2136
2137 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
2138 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
2139 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2140
2141 skb_queue_head_init(&hdev->rx_q);
2142 skb_queue_head_init(&hdev->cmd_q);
2143 skb_queue_head_init(&hdev->raw_q);
2144
2145 init_waitqueue_head(&hdev->req_wait_q);
2146
2147 setup_timer(&hdev->cmd_timer, hci_cmd_timeout, (unsigned long) hdev);
2148
2149 hci_init_sysfs(hdev);
2150 discovery_init(hdev);
2151
2152 return hdev;
2153 }
2154 EXPORT_SYMBOL(hci_alloc_dev);
2155
2156 /* Free HCI device */
2157 void hci_free_dev(struct hci_dev *hdev)
2158 {
2159 /* will free via device release */
2160 put_device(&hdev->dev);
2161 }
2162 EXPORT_SYMBOL(hci_free_dev);
2163
2164 /* Register HCI device */
2165 int hci_register_dev(struct hci_dev *hdev)
2166 {
2167 int id, error;
2168
2169 if (!hdev->open || !hdev->close)
2170 return -EINVAL;
2171
2172 /* Do not allow HCI_AMP devices to register at index 0,
2173 * so the index can be used as the AMP controller ID.
2174 */
2175 switch (hdev->dev_type) {
2176 case HCI_BREDR:
2177 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
2178 break;
2179 case HCI_AMP:
2180 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
2181 break;
2182 default:
2183 return -EINVAL;
2184 }
2185
2186 if (id < 0)
2187 return id;
2188
2189 sprintf(hdev->name, "hci%d", id);
2190 hdev->id = id;
2191
2192 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2193
2194 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
2195 WQ_MEM_RECLAIM, 1, hdev->name);
2196 if (!hdev->workqueue) {
2197 error = -ENOMEM;
2198 goto err;
2199 }
2200
2201 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
2202 WQ_MEM_RECLAIM, 1, hdev->name);
2203 if (!hdev->req_workqueue) {
2204 destroy_workqueue(hdev->workqueue);
2205 error = -ENOMEM;
2206 goto err;
2207 }
2208
2209 error = hci_add_sysfs(hdev);
2210 if (error < 0)
2211 goto err_wqueue;
2212
2213 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
2214 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2215 hdev);
2216 if (hdev->rfkill) {
2217 if (rfkill_register(hdev->rfkill) < 0) {
2218 rfkill_destroy(hdev->rfkill);
2219 hdev->rfkill = NULL;
2220 }
2221 }
2222
2223 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
2224 set_bit(HCI_RFKILLED, &hdev->dev_flags);
2225
2226 set_bit(HCI_SETUP, &hdev->dev_flags);
2227
2228 if (hdev->dev_type != HCI_AMP)
2229 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
2230
2231 write_lock(&hci_dev_list_lock);
2232 list_add(&hdev->list, &hci_dev_list);
2233 write_unlock(&hci_dev_list_lock);
2234
2235 hci_notify(hdev, HCI_DEV_REG);
2236 hci_dev_hold(hdev);
2237
2238 queue_work(hdev->req_workqueue, &hdev->power_on);
2239
2240 return id;
2241
2242 err_wqueue:
2243 destroy_workqueue(hdev->workqueue);
2244 destroy_workqueue(hdev->req_workqueue);
2245 err:
2246 ida_simple_remove(&hci_index_ida, hdev->id);
2247
2248 return error;
2249 }
2250 EXPORT_SYMBOL(hci_register_dev);
2251
2252 /* Unregister HCI device */
2253 void hci_unregister_dev(struct hci_dev *hdev)
2254 {
2255 int i, id;
2256
2257 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2258
2259 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
2260
2261 id = hdev->id;
2262
2263 write_lock(&hci_dev_list_lock);
2264 list_del(&hdev->list);
2265 write_unlock(&hci_dev_list_lock);
2266
2267 hci_dev_do_close(hdev);
2268
2269 for (i = 0; i < NUM_REASSEMBLY; i++)
2270 kfree_skb(hdev->reassembly[i]);
2271
2272 cancel_work_sync(&hdev->power_on);
2273
2274 if (!test_bit(HCI_INIT, &hdev->flags) &&
2275 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
2276 hci_dev_lock(hdev);
2277 mgmt_index_removed(hdev);
2278 hci_dev_unlock(hdev);
2279 }
2280
2281 /* mgmt_index_removed should take care of emptying the
2282 * pending list */
2283 BUG_ON(!list_empty(&hdev->mgmt_pending));
2284
2285 hci_notify(hdev, HCI_DEV_UNREG);
2286
2287 if (hdev->rfkill) {
2288 rfkill_unregister(hdev->rfkill);
2289 rfkill_destroy(hdev->rfkill);
2290 }
2291
2292 hci_del_sysfs(hdev);
2293
2294 destroy_workqueue(hdev->workqueue);
2295 destroy_workqueue(hdev->req_workqueue);
2296
2297 hci_dev_lock(hdev);
2298 hci_blacklist_clear(hdev);
2299 hci_uuids_clear(hdev);
2300 hci_link_keys_clear(hdev);
2301 hci_smp_ltks_clear(hdev);
2302 hci_remote_oob_data_clear(hdev);
2303 hci_dev_unlock(hdev);
2304
2305 hci_dev_put(hdev);
2306
2307 ida_simple_remove(&hci_index_ida, id);
2308 }
2309 EXPORT_SYMBOL(hci_unregister_dev);
2310
2311 /* Suspend HCI device */
2312 int hci_suspend_dev(struct hci_dev *hdev)
2313 {
2314 hci_notify(hdev, HCI_DEV_SUSPEND);
2315 return 0;
2316 }
2317 EXPORT_SYMBOL(hci_suspend_dev);
2318
2319 /* Resume HCI device */
2320 int hci_resume_dev(struct hci_dev *hdev)
2321 {
2322 hci_notify(hdev, HCI_DEV_RESUME);
2323 return 0;
2324 }
2325 EXPORT_SYMBOL(hci_resume_dev);
2326
2327 /* Receive frame from HCI drivers */
2328 int hci_recv_frame(struct sk_buff *skb)
2329 {
2330 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2331 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
2332 && !test_bit(HCI_INIT, &hdev->flags))) {
2333 kfree_skb(skb);
2334 return -ENXIO;
2335 }
2336
2337 /* Incoming skb */
2338 bt_cb(skb)->incoming = 1;
2339
2340 /* Time stamp */
2341 __net_timestamp(skb);
2342
2343 skb_queue_tail(&hdev->rx_q, skb);
2344 queue_work(hdev->workqueue, &hdev->rx_work);
2345
2346 return 0;
2347 }
2348 EXPORT_SYMBOL(hci_recv_frame);
2349
2350 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
2351 int count, __u8 index)
2352 {
2353 int len = 0;
2354 int hlen = 0;
2355 int remain = count;
2356 struct sk_buff *skb;
2357 struct bt_skb_cb *scb;
2358
2359 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
2360 index >= NUM_REASSEMBLY)
2361 return -EILSEQ;
2362
2363 skb = hdev->reassembly[index];
2364
2365 if (!skb) {
2366 switch (type) {
2367 case HCI_ACLDATA_PKT:
2368 len = HCI_MAX_FRAME_SIZE;
2369 hlen = HCI_ACL_HDR_SIZE;
2370 break;
2371 case HCI_EVENT_PKT:
2372 len = HCI_MAX_EVENT_SIZE;
2373 hlen = HCI_EVENT_HDR_SIZE;
2374 break;
2375 case HCI_SCODATA_PKT:
2376 len = HCI_MAX_SCO_SIZE;
2377 hlen = HCI_SCO_HDR_SIZE;
2378 break;
2379 }
2380
2381 skb = bt_skb_alloc(len, GFP_ATOMIC);
2382 if (!skb)
2383 return -ENOMEM;
2384
2385 scb = (void *) skb->cb;
2386 scb->expect = hlen;
2387 scb->pkt_type = type;
2388
2389 skb->dev = (void *) hdev;
2390 hdev->reassembly[index] = skb;
2391 }
2392
2393 while (count) {
2394 scb = (void *) skb->cb;
2395 len = min_t(uint, scb->expect, count);
2396
2397 memcpy(skb_put(skb, len), data, len);
2398
2399 count -= len;
2400 data += len;
2401 scb->expect -= len;
2402 remain = count;
2403
2404 switch (type) {
2405 case HCI_EVENT_PKT:
2406 if (skb->len == HCI_EVENT_HDR_SIZE) {
2407 struct hci_event_hdr *h = hci_event_hdr(skb);
2408 scb->expect = h->plen;
2409
2410 if (skb_tailroom(skb) < scb->expect) {
2411 kfree_skb(skb);
2412 hdev->reassembly[index] = NULL;
2413 return -ENOMEM;
2414 }
2415 }
2416 break;
2417
2418 case HCI_ACLDATA_PKT:
2419 if (skb->len == HCI_ACL_HDR_SIZE) {
2420 struct hci_acl_hdr *h = hci_acl_hdr(skb);
2421 scb->expect = __le16_to_cpu(h->dlen);
2422
2423 if (skb_tailroom(skb) < scb->expect) {
2424 kfree_skb(skb);
2425 hdev->reassembly[index] = NULL;
2426 return -ENOMEM;
2427 }
2428 }
2429 break;
2430
2431 case HCI_SCODATA_PKT:
2432 if (skb->len == HCI_SCO_HDR_SIZE) {
2433 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2434 scb->expect = h->dlen;
2435
2436 if (skb_tailroom(skb) < scb->expect) {
2437 kfree_skb(skb);
2438 hdev->reassembly[index] = NULL;
2439 return -ENOMEM;
2440 }
2441 }
2442 break;
2443 }
2444
2445 if (scb->expect == 0) {
2446 /* Complete frame */
2447
2448 bt_cb(skb)->pkt_type = type;
2449 hci_recv_frame(skb);
2450
2451 hdev->reassembly[index] = NULL;
2452 return remain;
2453 }
2454 }
2455
2456 return remain;
2457 }
2458
2459 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2460 {
2461 int rem = 0;
2462
2463 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2464 return -EILSEQ;
2465
2466 while (count) {
2467 rem = hci_reassembly(hdev, type, data, count, type - 1);
2468 if (rem < 0)
2469 return rem;
2470
2471 data += (count - rem);
2472 count = rem;
2473 }
2474
2475 return rem;
2476 }
2477 EXPORT_SYMBOL(hci_recv_fragment);
2478
2479 #define STREAM_REASSEMBLY 0
2480
2481 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2482 {
2483 int type;
2484 int rem = 0;
2485
2486 while (count) {
2487 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2488
2489 if (!skb) {
2490 struct { char type; } *pkt;
2491
2492 /* Start of the frame */
2493 pkt = data;
2494 type = pkt->type;
2495
2496 data++;
2497 count--;
2498 } else
2499 type = bt_cb(skb)->pkt_type;
2500
2501 rem = hci_reassembly(hdev, type, data, count,
2502 STREAM_REASSEMBLY);
2503 if (rem < 0)
2504 return rem;
2505
2506 data += (count - rem);
2507 count = rem;
2508 }
2509
2510 return rem;
2511 }
2512 EXPORT_SYMBOL(hci_recv_stream_fragment);
2513
2514 /* ---- Interface to upper protocols ---- */
2515
2516 int hci_register_cb(struct hci_cb *cb)
2517 {
2518 BT_DBG("%p name %s", cb, cb->name);
2519
2520 write_lock(&hci_cb_list_lock);
2521 list_add(&cb->list, &hci_cb_list);
2522 write_unlock(&hci_cb_list_lock);
2523
2524 return 0;
2525 }
2526 EXPORT_SYMBOL(hci_register_cb);
2527
2528 int hci_unregister_cb(struct hci_cb *cb)
2529 {
2530 BT_DBG("%p name %s", cb, cb->name);
2531
2532 write_lock(&hci_cb_list_lock);
2533 list_del(&cb->list);
2534 write_unlock(&hci_cb_list_lock);
2535
2536 return 0;
2537 }
2538 EXPORT_SYMBOL(hci_unregister_cb);
2539
2540 static int hci_send_frame(struct sk_buff *skb)
2541 {
2542 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2543
2544 if (!hdev) {
2545 kfree_skb(skb);
2546 return -ENODEV;
2547 }
2548
2549 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
2550
2551 /* Time stamp */
2552 __net_timestamp(skb);
2553
2554 /* Send copy to monitor */
2555 hci_send_to_monitor(hdev, skb);
2556
2557 if (atomic_read(&hdev->promisc)) {
2558 /* Send copy to the sockets */
2559 hci_send_to_sock(hdev, skb);
2560 }
2561
2562 /* Get rid of skb owner, prior to sending to the driver. */
2563 skb_orphan(skb);
2564
2565 return hdev->send(skb);
2566 }
2567
2568 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
2569 {
2570 skb_queue_head_init(&req->cmd_q);
2571 req->hdev = hdev;
2572 req->err = 0;
2573 }
2574
2575 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
2576 {
2577 struct hci_dev *hdev = req->hdev;
2578 struct sk_buff *skb;
2579 unsigned long flags;
2580
2581 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
2582
2583 /* If an error occured during request building, remove all HCI
2584 * commands queued on the HCI request queue.
2585 */
2586 if (req->err) {
2587 skb_queue_purge(&req->cmd_q);
2588 return req->err;
2589 }
2590
2591 /* Do not allow empty requests */
2592 if (skb_queue_empty(&req->cmd_q))
2593 return -ENODATA;
2594
2595 skb = skb_peek_tail(&req->cmd_q);
2596 bt_cb(skb)->req.complete = complete;
2597
2598 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
2599 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
2600 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
2601
2602 queue_work(hdev->workqueue, &hdev->cmd_work);
2603
2604 return 0;
2605 }
2606
2607 static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
2608 u32 plen, const void *param)
2609 {
2610 int len = HCI_COMMAND_HDR_SIZE + plen;
2611 struct hci_command_hdr *hdr;
2612 struct sk_buff *skb;
2613
2614 skb = bt_skb_alloc(len, GFP_ATOMIC);
2615 if (!skb)
2616 return NULL;
2617
2618 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
2619 hdr->opcode = cpu_to_le16(opcode);
2620 hdr->plen = plen;
2621
2622 if (plen)
2623 memcpy(skb_put(skb, plen), param, plen);
2624
2625 BT_DBG("skb len %d", skb->len);
2626
2627 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
2628 skb->dev = (void *) hdev;
2629
2630 return skb;
2631 }
2632
2633 /* Send HCI command */
2634 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
2635 const void *param)
2636 {
2637 struct sk_buff *skb;
2638
2639 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2640
2641 skb = hci_prepare_cmd(hdev, opcode, plen, param);
2642 if (!skb) {
2643 BT_ERR("%s no memory for command", hdev->name);
2644 return -ENOMEM;
2645 }
2646
2647 /* Stand-alone HCI commands must be flaged as
2648 * single-command requests.
2649 */
2650 bt_cb(skb)->req.start = true;
2651
2652 skb_queue_tail(&hdev->cmd_q, skb);
2653 queue_work(hdev->workqueue, &hdev->cmd_work);
2654
2655 return 0;
2656 }
2657
2658 /* Queue a command to an asynchronous HCI request */
2659 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
2660 const void *param, u8 event)
2661 {
2662 struct hci_dev *hdev = req->hdev;
2663 struct sk_buff *skb;
2664
2665 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2666
2667 /* If an error occured during request building, there is no point in
2668 * queueing the HCI command. We can simply return.
2669 */
2670 if (req->err)
2671 return;
2672
2673 skb = hci_prepare_cmd(hdev, opcode, plen, param);
2674 if (!skb) {
2675 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
2676 hdev->name, opcode);
2677 req->err = -ENOMEM;
2678 return;
2679 }
2680
2681 if (skb_queue_empty(&req->cmd_q))
2682 bt_cb(skb)->req.start = true;
2683
2684 bt_cb(skb)->req.event = event;
2685
2686 skb_queue_tail(&req->cmd_q, skb);
2687 }
2688
2689 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
2690 const void *param)
2691 {
2692 hci_req_add_ev(req, opcode, plen, param, 0);
2693 }
2694
2695 /* Get data from the previously sent command */
2696 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
2697 {
2698 struct hci_command_hdr *hdr;
2699
2700 if (!hdev->sent_cmd)
2701 return NULL;
2702
2703 hdr = (void *) hdev->sent_cmd->data;
2704
2705 if (hdr->opcode != cpu_to_le16(opcode))
2706 return NULL;
2707
2708 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2709
2710 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2711 }
2712
2713 /* Send ACL data */
2714 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2715 {
2716 struct hci_acl_hdr *hdr;
2717 int len = skb->len;
2718
2719 skb_push(skb, HCI_ACL_HDR_SIZE);
2720 skb_reset_transport_header(skb);
2721 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
2722 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2723 hdr->dlen = cpu_to_le16(len);
2724 }
2725
2726 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
2727 struct sk_buff *skb, __u16 flags)
2728 {
2729 struct hci_conn *conn = chan->conn;
2730 struct hci_dev *hdev = conn->hdev;
2731 struct sk_buff *list;
2732
2733 skb->len = skb_headlen(skb);
2734 skb->data_len = 0;
2735
2736 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2737
2738 switch (hdev->dev_type) {
2739 case HCI_BREDR:
2740 hci_add_acl_hdr(skb, conn->handle, flags);
2741 break;
2742 case HCI_AMP:
2743 hci_add_acl_hdr(skb, chan->handle, flags);
2744 break;
2745 default:
2746 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2747 return;
2748 }
2749
2750 list = skb_shinfo(skb)->frag_list;
2751 if (!list) {
2752 /* Non fragmented */
2753 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2754
2755 skb_queue_tail(queue, skb);
2756 } else {
2757 /* Fragmented */
2758 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2759
2760 skb_shinfo(skb)->frag_list = NULL;
2761
2762 /* Queue all fragments atomically */
2763 spin_lock(&queue->lock);
2764
2765 __skb_queue_tail(queue, skb);
2766
2767 flags &= ~ACL_START;
2768 flags |= ACL_CONT;
2769 do {
2770 skb = list; list = list->next;
2771
2772 skb->dev = (void *) hdev;
2773 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2774 hci_add_acl_hdr(skb, conn->handle, flags);
2775
2776 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2777
2778 __skb_queue_tail(queue, skb);
2779 } while (list);
2780
2781 spin_unlock(&queue->lock);
2782 }
2783 }
2784
2785 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2786 {
2787 struct hci_dev *hdev = chan->conn->hdev;
2788
2789 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
2790
2791 skb->dev = (void *) hdev;
2792
2793 hci_queue_acl(chan, &chan->data_q, skb, flags);
2794
2795 queue_work(hdev->workqueue, &hdev->tx_work);
2796 }
2797
2798 /* Send SCO data */
2799 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2800 {
2801 struct hci_dev *hdev = conn->hdev;
2802 struct hci_sco_hdr hdr;
2803
2804 BT_DBG("%s len %d", hdev->name, skb->len);
2805
2806 hdr.handle = cpu_to_le16(conn->handle);
2807 hdr.dlen = skb->len;
2808
2809 skb_push(skb, HCI_SCO_HDR_SIZE);
2810 skb_reset_transport_header(skb);
2811 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2812
2813 skb->dev = (void *) hdev;
2814 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2815
2816 skb_queue_tail(&conn->data_q, skb);
2817 queue_work(hdev->workqueue, &hdev->tx_work);
2818 }
2819
2820 /* ---- HCI TX task (outgoing data) ---- */
2821
2822 /* HCI Connection scheduler */
2823 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
2824 int *quote)
2825 {
2826 struct hci_conn_hash *h = &hdev->conn_hash;
2827 struct hci_conn *conn = NULL, *c;
2828 unsigned int num = 0, min = ~0;
2829
2830 /* We don't have to lock device here. Connections are always
2831 * added and removed with TX task disabled. */
2832
2833 rcu_read_lock();
2834
2835 list_for_each_entry_rcu(c, &h->list, list) {
2836 if (c->type != type || skb_queue_empty(&c->data_q))
2837 continue;
2838
2839 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2840 continue;
2841
2842 num++;
2843
2844 if (c->sent < min) {
2845 min = c->sent;
2846 conn = c;
2847 }
2848
2849 if (hci_conn_num(hdev, type) == num)
2850 break;
2851 }
2852
2853 rcu_read_unlock();
2854
2855 if (conn) {
2856 int cnt, q;
2857
2858 switch (conn->type) {
2859 case ACL_LINK:
2860 cnt = hdev->acl_cnt;
2861 break;
2862 case SCO_LINK:
2863 case ESCO_LINK:
2864 cnt = hdev->sco_cnt;
2865 break;
2866 case LE_LINK:
2867 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2868 break;
2869 default:
2870 cnt = 0;
2871 BT_ERR("Unknown link type");
2872 }
2873
2874 q = cnt / num;
2875 *quote = q ? q : 1;
2876 } else
2877 *quote = 0;
2878
2879 BT_DBG("conn %p quote %d", conn, *quote);
2880 return conn;
2881 }
2882
2883 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2884 {
2885 struct hci_conn_hash *h = &hdev->conn_hash;
2886 struct hci_conn *c;
2887
2888 BT_ERR("%s link tx timeout", hdev->name);
2889
2890 rcu_read_lock();
2891
2892 /* Kill stalled connections */
2893 list_for_each_entry_rcu(c, &h->list, list) {
2894 if (c->type == type && c->sent) {
2895 BT_ERR("%s killing stalled connection %pMR",
2896 hdev->name, &c->dst);
2897 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
2898 }
2899 }
2900
2901 rcu_read_unlock();
2902 }
2903
2904 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2905 int *quote)
2906 {
2907 struct hci_conn_hash *h = &hdev->conn_hash;
2908 struct hci_chan *chan = NULL;
2909 unsigned int num = 0, min = ~0, cur_prio = 0;
2910 struct hci_conn *conn;
2911 int cnt, q, conn_num = 0;
2912
2913 BT_DBG("%s", hdev->name);
2914
2915 rcu_read_lock();
2916
2917 list_for_each_entry_rcu(conn, &h->list, list) {
2918 struct hci_chan *tmp;
2919
2920 if (conn->type != type)
2921 continue;
2922
2923 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2924 continue;
2925
2926 conn_num++;
2927
2928 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2929 struct sk_buff *skb;
2930
2931 if (skb_queue_empty(&tmp->data_q))
2932 continue;
2933
2934 skb = skb_peek(&tmp->data_q);
2935 if (skb->priority < cur_prio)
2936 continue;
2937
2938 if (skb->priority > cur_prio) {
2939 num = 0;
2940 min = ~0;
2941 cur_prio = skb->priority;
2942 }
2943
2944 num++;
2945
2946 if (conn->sent < min) {
2947 min = conn->sent;
2948 chan = tmp;
2949 }
2950 }
2951
2952 if (hci_conn_num(hdev, type) == conn_num)
2953 break;
2954 }
2955
2956 rcu_read_unlock();
2957
2958 if (!chan)
2959 return NULL;
2960
2961 switch (chan->conn->type) {
2962 case ACL_LINK:
2963 cnt = hdev->acl_cnt;
2964 break;
2965 case AMP_LINK:
2966 cnt = hdev->block_cnt;
2967 break;
2968 case SCO_LINK:
2969 case ESCO_LINK:
2970 cnt = hdev->sco_cnt;
2971 break;
2972 case LE_LINK:
2973 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2974 break;
2975 default:
2976 cnt = 0;
2977 BT_ERR("Unknown link type");
2978 }
2979
2980 q = cnt / num;
2981 *quote = q ? q : 1;
2982 BT_DBG("chan %p quote %d", chan, *quote);
2983 return chan;
2984 }
2985
2986 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2987 {
2988 struct hci_conn_hash *h = &hdev->conn_hash;
2989 struct hci_conn *conn;
2990 int num = 0;
2991
2992 BT_DBG("%s", hdev->name);
2993
2994 rcu_read_lock();
2995
2996 list_for_each_entry_rcu(conn, &h->list, list) {
2997 struct hci_chan *chan;
2998
2999 if (conn->type != type)
3000 continue;
3001
3002 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3003 continue;
3004
3005 num++;
3006
3007 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
3008 struct sk_buff *skb;
3009
3010 if (chan->sent) {
3011 chan->sent = 0;
3012 continue;
3013 }
3014
3015 if (skb_queue_empty(&chan->data_q))
3016 continue;
3017
3018 skb = skb_peek(&chan->data_q);
3019 if (skb->priority >= HCI_PRIO_MAX - 1)
3020 continue;
3021
3022 skb->priority = HCI_PRIO_MAX - 1;
3023
3024 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
3025 skb->priority);
3026 }
3027
3028 if (hci_conn_num(hdev, type) == num)
3029 break;
3030 }
3031
3032 rcu_read_unlock();
3033
3034 }
3035
3036 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3037 {
3038 /* Calculate count of blocks used by this packet */
3039 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3040 }
3041
3042 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
3043 {
3044 if (!test_bit(HCI_RAW, &hdev->flags)) {
3045 /* ACL tx timeout must be longer than maximum
3046 * link supervision timeout (40.9 seconds) */
3047 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
3048 HCI_ACL_TX_TIMEOUT))
3049 hci_link_tx_to(hdev, ACL_LINK);
3050 }
3051 }
3052
3053 static void hci_sched_acl_pkt(struct hci_dev *hdev)
3054 {
3055 unsigned int cnt = hdev->acl_cnt;
3056 struct hci_chan *chan;
3057 struct sk_buff *skb;
3058 int quote;
3059
3060 __check_timeout(hdev, cnt);
3061
3062 while (hdev->acl_cnt &&
3063 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3064 u32 priority = (skb_peek(&chan->data_q))->priority;
3065 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3066 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3067 skb->len, skb->priority);
3068
3069 /* Stop if priority has changed */
3070 if (skb->priority < priority)
3071 break;
3072
3073 skb = skb_dequeue(&chan->data_q);
3074
3075 hci_conn_enter_active_mode(chan->conn,
3076 bt_cb(skb)->force_active);
3077
3078 hci_send_frame(skb);
3079 hdev->acl_last_tx = jiffies;
3080
3081 hdev->acl_cnt--;
3082 chan->sent++;
3083 chan->conn->sent++;
3084 }
3085 }
3086
3087 if (cnt != hdev->acl_cnt)
3088 hci_prio_recalculate(hdev, ACL_LINK);
3089 }
3090
3091 static void hci_sched_acl_blk(struct hci_dev *hdev)
3092 {
3093 unsigned int cnt = hdev->block_cnt;
3094 struct hci_chan *chan;
3095 struct sk_buff *skb;
3096 int quote;
3097 u8 type;
3098
3099 __check_timeout(hdev, cnt);
3100
3101 BT_DBG("%s", hdev->name);
3102
3103 if (hdev->dev_type == HCI_AMP)
3104 type = AMP_LINK;
3105 else
3106 type = ACL_LINK;
3107
3108 while (hdev->block_cnt > 0 &&
3109 (chan = hci_chan_sent(hdev, type, &quote))) {
3110 u32 priority = (skb_peek(&chan->data_q))->priority;
3111 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3112 int blocks;
3113
3114 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3115 skb->len, skb->priority);
3116
3117 /* Stop if priority has changed */
3118 if (skb->priority < priority)
3119 break;
3120
3121 skb = skb_dequeue(&chan->data_q);
3122
3123 blocks = __get_blocks(hdev, skb);
3124 if (blocks > hdev->block_cnt)
3125 return;
3126
3127 hci_conn_enter_active_mode(chan->conn,
3128 bt_cb(skb)->force_active);
3129
3130 hci_send_frame(skb);
3131 hdev->acl_last_tx = jiffies;
3132
3133 hdev->block_cnt -= blocks;
3134 quote -= blocks;
3135
3136 chan->sent += blocks;
3137 chan->conn->sent += blocks;
3138 }
3139 }
3140
3141 if (cnt != hdev->block_cnt)
3142 hci_prio_recalculate(hdev, type);
3143 }
3144
3145 static void hci_sched_acl(struct hci_dev *hdev)
3146 {
3147 BT_DBG("%s", hdev->name);
3148
3149 /* No ACL link over BR/EDR controller */
3150 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3151 return;
3152
3153 /* No AMP link over AMP controller */
3154 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
3155 return;
3156
3157 switch (hdev->flow_ctl_mode) {
3158 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3159 hci_sched_acl_pkt(hdev);
3160 break;
3161
3162 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3163 hci_sched_acl_blk(hdev);
3164 break;
3165 }
3166 }
3167
3168 /* Schedule SCO */
3169 static void hci_sched_sco(struct hci_dev *hdev)
3170 {
3171 struct hci_conn *conn;
3172 struct sk_buff *skb;
3173 int quote;
3174
3175 BT_DBG("%s", hdev->name);
3176
3177 if (!hci_conn_num(hdev, SCO_LINK))
3178 return;
3179
3180 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3181 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3182 BT_DBG("skb %p len %d", skb, skb->len);
3183 hci_send_frame(skb);
3184
3185 conn->sent++;
3186 if (conn->sent == ~0)
3187 conn->sent = 0;
3188 }
3189 }
3190 }
3191
3192 static void hci_sched_esco(struct hci_dev *hdev)
3193 {
3194 struct hci_conn *conn;
3195 struct sk_buff *skb;
3196 int quote;
3197
3198 BT_DBG("%s", hdev->name);
3199
3200 if (!hci_conn_num(hdev, ESCO_LINK))
3201 return;
3202
3203 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3204 &quote))) {
3205 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3206 BT_DBG("skb %p len %d", skb, skb->len);
3207 hci_send_frame(skb);
3208
3209 conn->sent++;
3210 if (conn->sent == ~0)
3211 conn->sent = 0;
3212 }
3213 }
3214 }
3215
3216 static void hci_sched_le(struct hci_dev *hdev)
3217 {
3218 struct hci_chan *chan;
3219 struct sk_buff *skb;
3220 int quote, cnt, tmp;
3221
3222 BT_DBG("%s", hdev->name);
3223
3224 if (!hci_conn_num(hdev, LE_LINK))
3225 return;
3226
3227 if (!test_bit(HCI_RAW, &hdev->flags)) {
3228 /* LE tx timeout must be longer than maximum
3229 * link supervision timeout (40.9 seconds) */
3230 if (!hdev->le_cnt && hdev->le_pkts &&
3231 time_after(jiffies, hdev->le_last_tx + HZ * 45))
3232 hci_link_tx_to(hdev, LE_LINK);
3233 }
3234
3235 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
3236 tmp = cnt;
3237 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
3238 u32 priority = (skb_peek(&chan->data_q))->priority;
3239 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3240 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3241 skb->len, skb->priority);
3242
3243 /* Stop if priority has changed */
3244 if (skb->priority < priority)
3245 break;
3246
3247 skb = skb_dequeue(&chan->data_q);
3248
3249 hci_send_frame(skb);
3250 hdev->le_last_tx = jiffies;
3251
3252 cnt--;
3253 chan->sent++;
3254 chan->conn->sent++;
3255 }
3256 }
3257
3258 if (hdev->le_pkts)
3259 hdev->le_cnt = cnt;
3260 else
3261 hdev->acl_cnt = cnt;
3262
3263 if (cnt != tmp)
3264 hci_prio_recalculate(hdev, LE_LINK);
3265 }
3266
3267 static void hci_tx_work(struct work_struct *work)
3268 {
3269 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
3270 struct sk_buff *skb;
3271
3272 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
3273 hdev->sco_cnt, hdev->le_cnt);
3274
3275 /* Schedule queues and send stuff to HCI driver */
3276
3277 hci_sched_acl(hdev);
3278
3279 hci_sched_sco(hdev);
3280
3281 hci_sched_esco(hdev);
3282
3283 hci_sched_le(hdev);
3284
3285 /* Send next queued raw (unknown type) packet */
3286 while ((skb = skb_dequeue(&hdev->raw_q)))
3287 hci_send_frame(skb);
3288 }
3289
3290 /* ----- HCI RX task (incoming data processing) ----- */
3291
3292 /* ACL data packet */
3293 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3294 {
3295 struct hci_acl_hdr *hdr = (void *) skb->data;
3296 struct hci_conn *conn;
3297 __u16 handle, flags;
3298
3299 skb_pull(skb, HCI_ACL_HDR_SIZE);
3300
3301 handle = __le16_to_cpu(hdr->handle);
3302 flags = hci_flags(handle);
3303 handle = hci_handle(handle);
3304
3305 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
3306 handle, flags);
3307
3308 hdev->stat.acl_rx++;
3309
3310 hci_dev_lock(hdev);
3311 conn = hci_conn_hash_lookup_handle(hdev, handle);
3312 hci_dev_unlock(hdev);
3313
3314 if (conn) {
3315 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
3316
3317 /* Send to upper protocol */
3318 l2cap_recv_acldata(conn, skb, flags);
3319 return;
3320 } else {
3321 BT_ERR("%s ACL packet for unknown connection handle %d",
3322 hdev->name, handle);
3323 }
3324
3325 kfree_skb(skb);
3326 }
3327
3328 /* SCO data packet */
3329 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3330 {
3331 struct hci_sco_hdr *hdr = (void *) skb->data;
3332 struct hci_conn *conn;
3333 __u16 handle;
3334
3335 skb_pull(skb, HCI_SCO_HDR_SIZE);
3336
3337 handle = __le16_to_cpu(hdr->handle);
3338
3339 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
3340
3341 hdev->stat.sco_rx++;
3342
3343 hci_dev_lock(hdev);
3344 conn = hci_conn_hash_lookup_handle(hdev, handle);
3345 hci_dev_unlock(hdev);
3346
3347 if (conn) {
3348 /* Send to upper protocol */
3349 sco_recv_scodata(conn, skb);
3350 return;
3351 } else {
3352 BT_ERR("%s SCO packet for unknown connection handle %d",
3353 hdev->name, handle);
3354 }
3355
3356 kfree_skb(skb);
3357 }
3358
3359 static bool hci_req_is_complete(struct hci_dev *hdev)
3360 {
3361 struct sk_buff *skb;
3362
3363 skb = skb_peek(&hdev->cmd_q);
3364 if (!skb)
3365 return true;
3366
3367 return bt_cb(skb)->req.start;
3368 }
3369
3370 static void hci_resend_last(struct hci_dev *hdev)
3371 {
3372 struct hci_command_hdr *sent;
3373 struct sk_buff *skb;
3374 u16 opcode;
3375
3376 if (!hdev->sent_cmd)
3377 return;
3378
3379 sent = (void *) hdev->sent_cmd->data;
3380 opcode = __le16_to_cpu(sent->opcode);
3381 if (opcode == HCI_OP_RESET)
3382 return;
3383
3384 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3385 if (!skb)
3386 return;
3387
3388 skb_queue_head(&hdev->cmd_q, skb);
3389 queue_work(hdev->workqueue, &hdev->cmd_work);
3390 }
3391
3392 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
3393 {
3394 hci_req_complete_t req_complete = NULL;
3395 struct sk_buff *skb;
3396 unsigned long flags;
3397
3398 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3399
3400 /* If the completed command doesn't match the last one that was
3401 * sent we need to do special handling of it.
3402 */
3403 if (!hci_sent_cmd_data(hdev, opcode)) {
3404 /* Some CSR based controllers generate a spontaneous
3405 * reset complete event during init and any pending
3406 * command will never be completed. In such a case we
3407 * need to resend whatever was the last sent
3408 * command.
3409 */
3410 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3411 hci_resend_last(hdev);
3412
3413 return;
3414 }
3415
3416 /* If the command succeeded and there's still more commands in
3417 * this request the request is not yet complete.
3418 */
3419 if (!status && !hci_req_is_complete(hdev))
3420 return;
3421
3422 /* If this was the last command in a request the complete
3423 * callback would be found in hdev->sent_cmd instead of the
3424 * command queue (hdev->cmd_q).
3425 */
3426 if (hdev->sent_cmd) {
3427 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
3428
3429 if (req_complete) {
3430 /* We must set the complete callback to NULL to
3431 * avoid calling the callback more than once if
3432 * this function gets called again.
3433 */
3434 bt_cb(hdev->sent_cmd)->req.complete = NULL;
3435
3436 goto call_complete;
3437 }
3438 }
3439
3440 /* Remove all pending commands belonging to this request */
3441 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
3442 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
3443 if (bt_cb(skb)->req.start) {
3444 __skb_queue_head(&hdev->cmd_q, skb);
3445 break;
3446 }
3447
3448 req_complete = bt_cb(skb)->req.complete;
3449 kfree_skb(skb);
3450 }
3451 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
3452
3453 call_complete:
3454 if (req_complete)
3455 req_complete(hdev, status);
3456 }
3457
3458 static void hci_rx_work(struct work_struct *work)
3459 {
3460 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
3461 struct sk_buff *skb;
3462
3463 BT_DBG("%s", hdev->name);
3464
3465 while ((skb = skb_dequeue(&hdev->rx_q))) {
3466 /* Send copy to monitor */
3467 hci_send_to_monitor(hdev, skb);
3468
3469 if (atomic_read(&hdev->promisc)) {
3470 /* Send copy to the sockets */
3471 hci_send_to_sock(hdev, skb);
3472 }
3473
3474 if (test_bit(HCI_RAW, &hdev->flags)) {
3475 kfree_skb(skb);
3476 continue;
3477 }
3478
3479 if (test_bit(HCI_INIT, &hdev->flags)) {
3480 /* Don't process data packets in this states. */
3481 switch (bt_cb(skb)->pkt_type) {
3482 case HCI_ACLDATA_PKT:
3483 case HCI_SCODATA_PKT:
3484 kfree_skb(skb);
3485 continue;
3486 }
3487 }
3488
3489 /* Process frame */
3490 switch (bt_cb(skb)->pkt_type) {
3491 case HCI_EVENT_PKT:
3492 BT_DBG("%s Event packet", hdev->name);
3493 hci_event_packet(hdev, skb);
3494 break;
3495
3496 case HCI_ACLDATA_PKT:
3497 BT_DBG("%s ACL data packet", hdev->name);
3498 hci_acldata_packet(hdev, skb);
3499 break;
3500
3501 case HCI_SCODATA_PKT:
3502 BT_DBG("%s SCO data packet", hdev->name);
3503 hci_scodata_packet(hdev, skb);
3504 break;
3505
3506 default:
3507 kfree_skb(skb);
3508 break;
3509 }
3510 }
3511 }
3512
3513 static void hci_cmd_work(struct work_struct *work)
3514 {
3515 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
3516 struct sk_buff *skb;
3517
3518 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
3519 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
3520
3521 /* Send queued commands */
3522 if (atomic_read(&hdev->cmd_cnt)) {
3523 skb = skb_dequeue(&hdev->cmd_q);
3524 if (!skb)
3525 return;
3526
3527 kfree_skb(hdev->sent_cmd);
3528
3529 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
3530 if (hdev->sent_cmd) {
3531 atomic_dec(&hdev->cmd_cnt);
3532 hci_send_frame(skb);
3533 if (test_bit(HCI_RESET, &hdev->flags))
3534 del_timer(&hdev->cmd_timer);
3535 else
3536 mod_timer(&hdev->cmd_timer,
3537 jiffies + HCI_CMD_TIMEOUT);
3538 } else {
3539 skb_queue_head(&hdev->cmd_q, skb);
3540 queue_work(hdev->workqueue, &hdev->cmd_work);
3541 }
3542 }
3543 }
3544
3545 u8 bdaddr_to_le(u8 bdaddr_type)
3546 {
3547 switch (bdaddr_type) {
3548 case BDADDR_LE_PUBLIC:
3549 return ADDR_LE_DEV_PUBLIC;
3550
3551 default:
3552 /* Fallback to LE Random address type */
3553 return ADDR_LE_DEV_RANDOM;
3554 }
3555 }
Linus' kernel tree