projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge branch 'for-6.2/hyperv' into for-linus
[linux-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
8c520a59 29#include <linux/rfkill.h>
baf27f6e 30#include <linux/debugfs.h>
99780a7b 31#include <linux/crypto.h>
9f30de9e 32#include <linux/kcov.h>
7a0e5b15 33#include <linux/property.h>
9952d90e
APS		 34#include <linux/suspend.h>
35#include <linux/wait.h>
47219839 36#include <asm/unaligned.h>
1da177e4
LT		 37
38#include <net/bluetooth/bluetooth.h>
39#include <net/bluetooth/hci_core.h>
4bc58f51 40#include <net/bluetooth/l2cap.h>
af58925c 41#include <net/bluetooth/mgmt.h>
1da177e4 42
0857dd3b 43#include "hci_request.h"
60c5f5fb 44#include "hci_debugfs.h"
970c4e46 45#include "smp.h"
6d5d2ee6 46#include "leds.h"
145373cb 47#include "msft.h"
f67743f9 48#include "aosp.h"
8961987f 49#include "hci_codec.h"
970c4e46 50
b78752cc 51static void hci_rx_work(struct work_struct *work);
c347b765 52static void hci_cmd_work(struct work_struct *work);
3eff45ea 53static void hci_tx_work(struct work_struct *work);
1da177e4 54
1da177e4
LT		 55/* HCI device list */
56LIST_HEAD(hci_dev_list);
57DEFINE_RWLOCK(hci_dev_list_lock);
58
59/* HCI callback list */
60LIST_HEAD(hci_cb_list);
fba7ecf0 61DEFINE_MUTEX(hci_cb_list_lock);
1da177e4 62
3df92b31
SL		 63/* HCI ID Numbering */
64static DEFINE_IDA(hci_index_ida);
65
a1d01db1 66static int hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 67{
68 __u8 scan = opt;
69
42c6b129 70 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 71
72 /* Inquiry and Page scans */
42c6b129 73 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
a1d01db1 74 return 0;
1da177e4
LT		 75}
76
a1d01db1 77static int hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 78{
79 __u8 auth = opt;
80
42c6b129 81 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 82
83 /* Authentication */
42c6b129 84 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
a1d01db1 85 return 0;
1da177e4
LT		 86}
87
a1d01db1 88static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 89{
90 __u8 encrypt = opt;
91
42c6b129 92 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 93
e4e8e37c 94 /* Encryption */
42c6b129 95 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
a1d01db1 96 return 0;
1da177e4
LT		 97}
98
a1d01db1 99static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 100{
101 __le16 policy = cpu_to_le16(opt);
102
42c6b129 103 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 104
105 /* Default link policy */
42c6b129 106 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
a1d01db1 107 return 0;
e4e8e37c
MH		 108}
109
8e87d142 110/* Get HCI device by index.
1da177e4
LT		 111 * Device is held on return. */
112struct hci_dev *hci_dev_get(int index)
113{
8035ded4 114 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 115
116 BT_DBG("%d", index);
117
118 if (index < 0)
119 return NULL;
120
121 read_lock(&hci_dev_list_lock);
8035ded4 122 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 123 if (d->id == index) {
124 hdev = hci_dev_hold(d);
125 break;
126 }
127 }
128 read_unlock(&hci_dev_list_lock);
129 return hdev;
130}
1da177e4
LT		 131
132/* ---- Inquiry support ---- */
ff9ef578 133
30dc78e1
JH		 134bool hci_discovery_active(struct hci_dev *hdev)
135{
136 struct discovery_state *discov = &hdev->discovery;
137
6fbe195d 138 switch (discov->state) {
343f935b 139 case DISCOVERY_FINDING:
6fbe195d 140 case DISCOVERY_RESOLVING:
30dc78e1
JH		 141 return true;
142
6fbe195d
AG		 143 default:
144 return false;
145 }
30dc78e1
JH		 146}
147
ff9ef578
JH		 148void hci_discovery_set_state(struct hci_dev *hdev, int state)
149{
bb3e0a33
JH		 150 int old_state = hdev->discovery.state;
151
ff9ef578
JH		 152 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
153
bb3e0a33 154 if (old_state == state)
ff9ef578
JH		 155 return;
156
bb3e0a33
JH		 157 hdev->discovery.state = state;
158
ff9ef578
JH		 159 switch (state) {
160 case DISCOVERY_STOPPED:
5bee2fd6 161 hci_update_passive_scan(hdev);
c54c3860 162
bb3e0a33 163 if (old_state != DISCOVERY_STARTING)
7b99b659 164 mgmt_discovering(hdev, 0);
ff9ef578
JH		 165 break;
166 case DISCOVERY_STARTING:
167 break;
343f935b 168 case DISCOVERY_FINDING:
ff9ef578
JH		 169 mgmt_discovering(hdev, 1);
170 break;
30dc78e1
JH		 171 case DISCOVERY_RESOLVING:
172 break;
ff9ef578
JH		 173 case DISCOVERY_STOPPING:
174 break;
175 }
ff9ef578
JH		 176}
177
1f9b9a5d 178void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 179{
30883512 180 struct discovery_state *cache = &hdev->discovery;
b57c1a56 181 struct inquiry_entry *p, *n;
1da177e4 182
561aafbc
JH		 183 list_for_each_entry_safe(p, n, &cache->all, all) {
184 list_del(&p->all);
b57c1a56 185 kfree(p);
1da177e4 186 }
561aafbc
JH		 187
188 INIT_LIST_HEAD(&cache->unknown);
189 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 190}
191
a8c5fb1a
GP		 192struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
193 bdaddr_t *bdaddr)
1da177e4 194{
30883512 195 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 196 struct inquiry_entry *e;
197
6ed93dc6 198 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 199
561aafbc
JH		 200 list_for_each_entry(e, &cache->all, all) {
201 if (!bacmp(&e->data.bdaddr, bdaddr))
202 return e;
203 }
204
205 return NULL;
206}
207
208struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 209 bdaddr_t *bdaddr)
561aafbc 210{
30883512 211 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 212 struct inquiry_entry *e;
213
6ed93dc6 214 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 215
216 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 217 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 218 return e;
219 }
220
221 return NULL;
1da177e4
LT		 222}
223
30dc78e1 224struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 225 bdaddr_t *bdaddr,
226 int state)
30dc78e1
JH		 227{
228 struct discovery_state *cache = &hdev->discovery;
229 struct inquiry_entry *e;
230
6ed93dc6 231 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 232
233 list_for_each_entry(e, &cache->resolve, list) {
234 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
235 return e;
236 if (!bacmp(&e->data.bdaddr, bdaddr))
237 return e;
238 }
239
240 return NULL;
241}
242
a3d4e20a 243void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 244 struct inquiry_entry *ie)
a3d4e20a
JH		 245{
246 struct discovery_state *cache = &hdev->discovery;
247 struct list_head *pos = &cache->resolve;
248 struct inquiry_entry *p;
249
250 list_del(&ie->list);
251
252 list_for_each_entry(p, &cache->resolve, list) {
253 if (p->name_state != NAME_PENDING &&
a8c5fb1a 254 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 255 break;
256 pos = &p->list;
257 }
258
259 list_add(&ie->list, pos);
260}
261
af58925c
MH		 262u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
263 bool name_known)
1da177e4 264{
30883512 265 struct discovery_state *cache = &hdev->discovery;
70f23020 266 struct inquiry_entry *ie;
af58925c 267 u32 flags = 0;
1da177e4 268
6ed93dc6 269 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 270
6928a924 271 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
2b2fec4d 272
af58925c
MH		 273 if (!data->ssp_mode)
274 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 275
70f23020 276 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 277 if (ie) {
af58925c
MH		 278 if (!ie->data.ssp_mode)
279 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 280
a3d4e20a 281 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 282 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 283 ie->data.rssi = data->rssi;
284 hci_inquiry_cache_update_resolve(hdev, ie);
285 }
286
561aafbc 287 goto update;
a3d4e20a 288 }
561aafbc
JH		 289
290 /* Entry not in the cache. Add new one. */
27f70f3e 291 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
af58925c
MH		 292 if (!ie) {
293 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
294 goto done;
295 }
561aafbc
JH		 296
297 list_add(&ie->all, &cache->all);
298
299 if (name_known) {
300 ie->name_state = NAME_KNOWN;
301 } else {
302 ie->name_state = NAME_NOT_KNOWN;
303 list_add(&ie->list, &cache->unknown);
304 }
70f23020 305
561aafbc
JH		 306update:
307 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 308 ie->name_state != NAME_PENDING) {
561aafbc
JH		 309 ie->name_state = NAME_KNOWN;
310 list_del(&ie->list);
1da177e4
LT		 311 }
312
70f23020
AE		 313 memcpy(&ie->data, data, sizeof(*data));
314 ie->timestamp = jiffies;
1da177e4 315 cache->timestamp = jiffies;
3175405b
JH		 316
317 if (ie->name_state == NAME_NOT_KNOWN)
af58925c 318 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
3175405b 319
af58925c
MH		 320done:
321 return flags;
1da177e4
LT		 322}
323
324static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
325{
30883512 326 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 327 struct inquiry_info *info = (struct inquiry_info *) buf;
328 struct inquiry_entry *e;
329 int copied = 0;
330
561aafbc 331 list_for_each_entry(e, &cache->all, all) {
1da177e4 332 struct inquiry_data *data = &e->data;
b57c1a56
JH		 333
334 if (copied >= num)
335 break;
336
1da177e4
LT		 337 bacpy(&info->bdaddr, &data->bdaddr);
338 info->pscan_rep_mode = data->pscan_rep_mode;
339 info->pscan_period_mode = data->pscan_period_mode;
340 info->pscan_mode = data->pscan_mode;
341 memcpy(info->dev_class, data->dev_class, 3);
342 info->clock_offset = data->clock_offset;
b57c1a56 343
1da177e4 344 info++;
b57c1a56 345 copied++;
1da177e4
LT		 346 }
347
348 BT_DBG("cache %p, copied %d", cache, copied);
349 return copied;
350}
351
a1d01db1 352static int hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 353{
354 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 355 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 356 struct hci_cp_inquiry cp;
357
358 BT_DBG("%s", hdev->name);
359
360 if (test_bit(HCI_INQUIRY, &hdev->flags))
a1d01db1 361 return 0;
1da177e4
LT		 362
363 /* Start Inquiry */
364 memcpy(&cp.lap, &ir->lap, 3);
365 cp.length = ir->length;
366 cp.num_rsp = ir->num_rsp;
42c6b129 367 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
a1d01db1
JH		 368
369 return 0;
1da177e4
LT		 370}
371
372int hci_inquiry(void __user *arg)
373{
374 __u8 __user *ptr = arg;
375 struct hci_inquiry_req ir;
376 struct hci_dev *hdev;
377 int err = 0, do_inquiry = 0, max_rsp;
378 long timeo;
379 __u8 *buf;
380
381 if (copy_from_user(&ir, ptr, sizeof(ir)))
382 return -EFAULT;
383
5a08ecce
AE		 384 hdev = hci_dev_get(ir.dev_id);
385 if (!hdev)
1da177e4
LT		 386 return -ENODEV;
387
d7a5a11d 388 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 389 err = -EBUSY;
390 goto done;
391 }
392
d7a5a11d 393 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 394 err = -EOPNOTSUPP;
395 goto done;
396 }
397
ca8bee5d 398 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 399 err = -EOPNOTSUPP;
400 goto done;
401 }
402
d7a5a11d 403 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 404 err = -EOPNOTSUPP;
405 goto done;
406 }
407
f41a4b2b
PS		 408 /* Restrict maximum inquiry length to 60 seconds */
409 if (ir.length > 60) {
410 err = -EINVAL;
411 goto done;
412 }
413
09fd0de5 414 hci_dev_lock(hdev);
8e87d142 415 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 416 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 417 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 418 do_inquiry = 1;
419 }
09fd0de5 420 hci_dev_unlock(hdev);
1da177e4 421
04837f64 422 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 423
424 if (do_inquiry) {
01178cd4 425 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
4ebeee2d 426 timeo, NULL);
70f23020
AE		 427 if (err < 0)
428 goto done;
3e13fa1e
AG		 429
430 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
431 * cleared). If it is interrupted by a signal, return -EINTR.
432 */
74316201 433 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
28a758c8
PB		 434 TASK_INTERRUPTIBLE)) {
435 err = -EINTR;
436 goto done;
437 }
70f23020 438 }
1da177e4 439
8fc9ced3
GP		 440 /* for unlimited number of responses we will use buffer with
441 * 255 entries
442 */
1da177e4
LT		 443 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
444
445 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
446 * copy it to the user space.
447 */
6da2ec56 448 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
70f23020 449 if (!buf) {
1da177e4
LT		 450 err = -ENOMEM;
451 goto done;
452 }
453
09fd0de5 454 hci_dev_lock(hdev);
1da177e4 455 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 456 hci_dev_unlock(hdev);
1da177e4
LT		 457
458 BT_DBG("num_rsp %d", ir.num_rsp);
459
460 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
461 ptr += sizeof(ir);
462 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 463 ir.num_rsp))
1da177e4 464 err = -EFAULT;
8e87d142 465 } else
1da177e4
LT		 466 err = -EFAULT;
467
468 kfree(buf);
469
470done:
471 hci_dev_put(hdev);
472 return err;
473}
474
cf75ad8b
LAD		 475static int hci_dev_do_open(struct hci_dev *hdev)
476{
477 int ret = 0;
478
479 BT_DBG("%s %p", hdev->name, hdev);
480
481 hci_req_sync_lock(hdev);
482
483 ret = hci_dev_open_sync(hdev);
484
b504430c 485 hci_req_sync_unlock(hdev);
1da177e4
LT		 486 return ret;
487}
488
cbed0ca1
JH		 489/* ---- HCI ioctl helpers ---- */
490
491int hci_dev_open(__u16 dev)
492{
493 struct hci_dev *hdev;
494 int err;
495
496 hdev = hci_dev_get(dev);
497 if (!hdev)
498 return -ENODEV;
499
4a964404 500 /* Devices that are marked as unconfigured can only be powered
fee746b0
MH		 501 * up as user channel. Trying to bring them up as normal devices
502 * will result into a failure. Only user channel operation is
503 * possible.
504 *
505 * When this function is called for a user channel, the flag
506 * HCI_USER_CHANNEL will be set first before attempting to
507 * open the device.
508 */
d7a5a11d
MH		 509 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
510 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
fee746b0
MH		 511 err = -EOPNOTSUPP;
512 goto done;
513 }
514
e1d08f40
JH		 515 /* We need to ensure that no other power on/off work is pending
516 * before proceeding to call hci_dev_do_open. This is
517 * particularly important if the setup procedure has not yet
518 * completed.
519 */
a69d8927 520 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
e1d08f40
JH		 521 cancel_delayed_work(&hdev->power_off);
522
a5c8f270
MH		 523 /* After this call it is guaranteed that the setup procedure
524 * has finished. This means that error conditions like RFKILL
525 * or no valid public or static random address apply.
526 */
e1d08f40
JH		 527 flush_workqueue(hdev->req_workqueue);
528
12aa4f0a 529 /* For controllers not using the management interface and that
b6ae8457 530 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
12aa4f0a
MH		 531 * so that pairing works for them. Once the management interface
532 * is in use this bit will be cleared again and userspace has
533 * to explicitly enable it.
534 */
d7a5a11d
MH		 535 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
536 !hci_dev_test_flag(hdev, HCI_MGMT))
a1536da2 537 hci_dev_set_flag(hdev, HCI_BONDABLE);
12aa4f0a 538
cbed0ca1
JH		 539 err = hci_dev_do_open(hdev);
540
fee746b0 541done:
cbed0ca1 542 hci_dev_put(hdev);
cbed0ca1
JH		 543 return err;
544}
545
cf75ad8b
LAD		 546int hci_dev_do_close(struct hci_dev *hdev)
547{
548 int err;
549
550 BT_DBG("%s %p", hdev->name, hdev);
551
552 hci_req_sync_lock(hdev);
553
554 err = hci_dev_close_sync(hdev);
555
b504430c 556 hci_req_sync_unlock(hdev);
1da177e4 557
61969ef8 558 return err;
1da177e4
LT		 559}
560
561int hci_dev_close(__u16 dev)
562{
563 struct hci_dev *hdev;
564 int err;
565
70f23020
AE		 566 hdev = hci_dev_get(dev);
567 if (!hdev)
1da177e4 568 return -ENODEV;
8ee56540 569
d7a5a11d 570 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 571 err = -EBUSY;
572 goto done;
573 }
574
e36bea6e 575 cancel_work_sync(&hdev->power_on);
a69d8927 576 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
8ee56540
MH		 577 cancel_delayed_work(&hdev->power_off);
578
1da177e4 579 err = hci_dev_do_close(hdev);
8ee56540 580
0736cfa8 581done:
1da177e4
LT		 582 hci_dev_put(hdev);
583 return err;
584}
585
5c912495 586static int hci_dev_do_reset(struct hci_dev *hdev)
1da177e4 587{
5c912495 588 int ret;
1da177e4 589
5c912495 590 BT_DBG("%s %p", hdev->name, hdev);
1da177e4 591
b504430c 592 hci_req_sync_lock(hdev);
1da177e4 593
1da177e4
LT		 594 /* Drop queues */
595 skb_queue_purge(&hdev->rx_q);
596 skb_queue_purge(&hdev->cmd_q);
597
877afada
SS		 598 /* Cancel these to avoid queueing non-chained pending work */
599 hci_dev_set_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
deee93d1
TH		 600 /* Wait for
601 *
602 * if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
603 * queue_delayed_work(&hdev->{cmd,ncmd}_timer)
604 *
605 * inside RCU section to see the flag or complete scheduling.
606 */
607 synchronize_rcu();
608 /* Explicitly cancel works in case scheduled after setting the flag. */
877afada
SS		 609 cancel_delayed_work(&hdev->cmd_timer);
610 cancel_delayed_work(&hdev->ncmd_timer);
611
76727c02
JH		 612 /* Avoid potential lockdep warnings from the *_flush() calls by
613 * ensuring the workqueue is empty up front.
614 */
615 drain_workqueue(hdev->workqueue);
616
09fd0de5 617 hci_dev_lock(hdev);
1f9b9a5d 618 hci_inquiry_cache_flush(hdev);
1da177e4 619 hci_conn_hash_flush(hdev);
09fd0de5 620 hci_dev_unlock(hdev);
1da177e4
LT		 621
622 if (hdev->flush)
623 hdev->flush(hdev);
624
877afada
SS		 625 hci_dev_clear_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
626
8e87d142 627 atomic_set(&hdev->cmd_cnt, 1);
26afbd82
LAD		 628 hdev->acl_cnt = 0;
629 hdev->sco_cnt = 0;
630 hdev->le_cnt = 0;
631 hdev->iso_cnt = 0;
1da177e4 632
d0b13706 633 ret = hci_reset_sync(hdev);
1da177e4 634
b504430c 635 hci_req_sync_unlock(hdev);
1da177e4
LT		 636 return ret;
637}
638
5c912495
MH		 639int hci_dev_reset(__u16 dev)
640{
641 struct hci_dev *hdev;
642 int err;
643
644 hdev = hci_dev_get(dev);
645 if (!hdev)
646 return -ENODEV;
647
648 if (!test_bit(HCI_UP, &hdev->flags)) {
649 err = -ENETDOWN;
650 goto done;
651 }
652
d7a5a11d 653 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
5c912495
MH		 654 err = -EBUSY;
655 goto done;
656 }
657
d7a5a11d 658 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
5c912495
MH		 659 err = -EOPNOTSUPP;
660 goto done;
661 }
662
663 err = hci_dev_do_reset(hdev);
664
665done:
666 hci_dev_put(hdev);
667 return err;
668}
669
1da177e4
LT		 670int hci_dev_reset_stat(__u16 dev)
671{
672 struct hci_dev *hdev;
673 int ret = 0;
674
70f23020
AE		 675 hdev = hci_dev_get(dev);
676 if (!hdev)
1da177e4
LT		 677 return -ENODEV;
678
d7a5a11d 679 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 680 ret = -EBUSY;
681 goto done;
682 }
683
d7a5a11d 684 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 685 ret = -EOPNOTSUPP;
686 goto done;
687 }
688
1da177e4
LT		 689 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
690
0736cfa8 691done:
1da177e4 692 hci_dev_put(hdev);
1da177e4
LT		 693 return ret;
694}
695
5bee2fd6 696static void hci_update_passive_scan_state(struct hci_dev *hdev, u8 scan)
123abc08 697{
bc6d2d04 698 bool conn_changed, discov_changed;
123abc08
JH		 699
700 BT_DBG("%s scan 0x%02x", hdev->name, scan);
701
702 if ((scan & SCAN_PAGE))
238be788
MH		 703 conn_changed = !hci_dev_test_and_set_flag(hdev,
704 HCI_CONNECTABLE);
123abc08 705 else
a69d8927
MH		 706 conn_changed = hci_dev_test_and_clear_flag(hdev,
707 HCI_CONNECTABLE);
123abc08 708
bc6d2d04 709 if ((scan & SCAN_INQUIRY)) {
238be788
MH		 710 discov_changed = !hci_dev_test_and_set_flag(hdev,
711 HCI_DISCOVERABLE);
bc6d2d04 712 } else {
a358dc11 713 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
a69d8927
MH		 714 discov_changed = hci_dev_test_and_clear_flag(hdev,
715 HCI_DISCOVERABLE);
bc6d2d04
JH		 716 }
717
d7a5a11d 718 if (!hci_dev_test_flag(hdev, HCI_MGMT))
123abc08
JH		 719 return;
720
bc6d2d04
JH		 721 if (conn_changed || discov_changed) {
722 /* In case this was disabled through mgmt */
a1536da2 723 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
bc6d2d04 724
d7a5a11d 725 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
651cd3d6 726 hci_update_adv_data(hdev, hdev->cur_adv_instance);
bc6d2d04 727
123abc08 728 mgmt_new_settings(hdev);
bc6d2d04 729 }
123abc08
JH		 730}
731
1da177e4
LT		 732int hci_dev_cmd(unsigned int cmd, void __user *arg)
733{
734 struct hci_dev *hdev;
735 struct hci_dev_req dr;
736 int err = 0;
737
738 if (copy_from_user(&dr, arg, sizeof(dr)))
739 return -EFAULT;
740
70f23020
AE		 741 hdev = hci_dev_get(dr.dev_id);
742 if (!hdev)
1da177e4
LT		 743 return -ENODEV;
744
d7a5a11d 745 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 746 err = -EBUSY;
747 goto done;
748 }
749
d7a5a11d 750 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 751 err = -EOPNOTSUPP;
752 goto done;
753 }
754
ca8bee5d 755 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 756 err = -EOPNOTSUPP;
757 goto done;
758 }
759
d7a5a11d 760 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 761 err = -EOPNOTSUPP;
762 goto done;
763 }
764
1da177e4
LT		 765 switch (cmd) {
766 case HCISETAUTH:
01178cd4 767 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 768 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 769 break;
770
771 case HCISETENCRYPT:
772 if (!lmp_encrypt_capable(hdev)) {
773 err = -EOPNOTSUPP;
774 break;
775 }
776
777 if (!test_bit(HCI_AUTH, &hdev->flags)) {
778 /* Auth must be enabled first */
01178cd4 779 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 780 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 781 if (err)
782 break;
783 }
784
01178cd4 785 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
4ebeee2d 786 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 787 break;
788
789 case HCISETSCAN:
01178cd4 790 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
4ebeee2d 791 HCI_INIT_TIMEOUT, NULL);
91a668b0 792
bc6d2d04
JH		 793 /* Ensure that the connectable and discoverable states
794 * get correctly modified as this was a non-mgmt change.
91a668b0 795 */
123abc08 796 if (!err)
5bee2fd6 797 hci_update_passive_scan_state(hdev, dr.dev_opt);
1da177e4
LT		 798 break;
799
1da177e4 800 case HCISETLINKPOL:
01178cd4 801 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
4ebeee2d 802 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 803 break;
804
805 case HCISETLINKMODE:
e4e8e37c
MH		 806 hdev->link_mode = ((__u16) dr.dev_opt) &
807 (HCI_LM_MASTER | HCI_LM_ACCEPT);
808 break;
809
810 case HCISETPTYPE:
b7c23df8
JK		 811 if (hdev->pkt_type == (__u16) dr.dev_opt)
812 break;
813
e4e8e37c 814 hdev->pkt_type = (__u16) dr.dev_opt;
b7c23df8 815 mgmt_phy_configuration_changed(hdev, NULL);
1da177e4
LT		 816 break;
817
818 case HCISETACLMTU:
e4e8e37c
MH		 819 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
820 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 821 break;
822
823 case HCISETSCOMTU:
e4e8e37c
MH		 824 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
825 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 826 break;
827
828 default:
829 err = -EINVAL;
830 break;
831 }
e4e8e37c 832
0736cfa8 833done:
1da177e4
LT		 834 hci_dev_put(hdev);
835 return err;
836}
837
838int hci_get_dev_list(void __user *arg)
839{
8035ded4 840 struct hci_dev *hdev;
1da177e4
LT		 841 struct hci_dev_list_req *dl;
842 struct hci_dev_req *dr;
1da177e4
LT		 843 int n = 0, size, err;
844 __u16 dev_num;
845
846 if (get_user(dev_num, (__u16 __user *) arg))
847 return -EFAULT;
848
849 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
850 return -EINVAL;
851
852 size = sizeof(*dl) + dev_num * sizeof(*dr);
853
70f23020
AE		 854 dl = kzalloc(size, GFP_KERNEL);
855 if (!dl)
1da177e4
LT		 856 return -ENOMEM;
857
858 dr = dl->dev_req;
859
f20d09d5 860 read_lock(&hci_dev_list_lock);
8035ded4 861 list_for_each_entry(hdev, &hci_dev_list, list) {
2e84d8db 862 unsigned long flags = hdev->flags;
c542a06c 863
2e84d8db
MH		 864 /* When the auto-off is configured it means the transport
865 * is running, but in that case still indicate that the
866 * device is actually down.
867 */
d7a5a11d 868 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db 869 flags &= ~BIT(HCI_UP);
c542a06c 870
1da177e4 871 (dr + n)->dev_id = hdev->id;
2e84d8db 872 (dr + n)->dev_opt = flags;
c542a06c 873
1da177e4
LT		 874 if (++n >= dev_num)
875 break;
876 }
f20d09d5 877 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 878
879 dl->dev_num = n;
880 size = sizeof(*dl) + n * sizeof(*dr);
881
882 err = copy_to_user(arg, dl, size);
883 kfree(dl);
884
885 return err ? -EFAULT : 0;
886}
887
888int hci_get_dev_info(void __user *arg)
889{
890 struct hci_dev *hdev;
891 struct hci_dev_info di;
2e84d8db 892 unsigned long flags;
1da177e4
LT		 893 int err = 0;
894
895 if (copy_from_user(&di, arg, sizeof(di)))
896 return -EFAULT;
897
70f23020
AE		 898 hdev = hci_dev_get(di.dev_id);
899 if (!hdev)
1da177e4
LT		 900 return -ENODEV;
901
2e84d8db
MH		 902 /* When the auto-off is configured it means the transport
903 * is running, but in that case still indicate that the
904 * device is actually down.
905 */
d7a5a11d 906 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db
MH		 907 flags = hdev->flags & ~BIT(HCI_UP);
908 else
909 flags = hdev->flags;
c542a06c 910
1da177e4
LT		 911 strcpy(di.name, hdev->name);
912 di.bdaddr = hdev->bdaddr;
60f2a3ed 913 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2e84d8db 914 di.flags = flags;
1da177e4 915 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 916 if (lmp_bredr_capable(hdev)) {
917 di.acl_mtu = hdev->acl_mtu;
918 di.acl_pkts = hdev->acl_pkts;
919 di.sco_mtu = hdev->sco_mtu;
920 di.sco_pkts = hdev->sco_pkts;
921 } else {
922 di.acl_mtu = hdev->le_mtu;
923 di.acl_pkts = hdev->le_pkts;
924 di.sco_mtu = 0;
925 di.sco_pkts = 0;
926 }
1da177e4
LT		 927 di.link_policy = hdev->link_policy;
928 di.link_mode = hdev->link_mode;
929
930 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
931 memcpy(&di.features, &hdev->features, sizeof(di.features));
932
933 if (copy_to_user(arg, &di, sizeof(di)))
934 err = -EFAULT;
935
936 hci_dev_put(hdev);
937
938 return err;
939}
940
941/* ---- Interface to HCI drivers ---- */
942
611b30f7
MH		 943static int hci_rfkill_set_block(void *data, bool blocked)
944{
945 struct hci_dev *hdev = data;
946
947 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
948
d7a5a11d 949 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
0736cfa8
MH		 950 return -EBUSY;
951
5e130367 952 if (blocked) {
a1536da2 953 hci_dev_set_flag(hdev, HCI_RFKILLED);
d7a5a11d
MH		 954 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
955 !hci_dev_test_flag(hdev, HCI_CONFIG))
bf543036 956 hci_dev_do_close(hdev);
5e130367 957 } else {
a358dc11 958 hci_dev_clear_flag(hdev, HCI_RFKILLED);
1025c04c 959 }
611b30f7
MH		 960
961 return 0;
962}
963
964static const struct rfkill_ops hci_rfkill_ops = {
965 .set_block = hci_rfkill_set_block,
966};
967
ab81cbf9
JH		 968static void hci_power_on(struct work_struct *work)
969{
970 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 971 int err;
ab81cbf9
JH		 972
973 BT_DBG("%s", hdev->name);
974
2ff13894
JH		 975 if (test_bit(HCI_UP, &hdev->flags) &&
976 hci_dev_test_flag(hdev, HCI_MGMT) &&
977 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
d82142a8 978 cancel_delayed_work(&hdev->power_off);
cf75ad8b 979 err = hci_powered_update_sync(hdev);
2ff13894
JH		 980 mgmt_power_on(hdev, err);
981 return;
982 }
983
cbed0ca1 984 err = hci_dev_do_open(hdev);
96570ffc 985 if (err < 0) {
3ad67582 986 hci_dev_lock(hdev);
96570ffc 987 mgmt_set_powered_failed(hdev, err);
3ad67582 988 hci_dev_unlock(hdev);
ab81cbf9 989 return;
96570ffc 990 }
ab81cbf9 991
a5c8f270
MH		 992 /* During the HCI setup phase, a few error conditions are
993 * ignored and they need to be checked now. If they are still
994 * valid, it is important to turn the device back off.
995 */
d7a5a11d
MH		 996 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
997 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
ca8bee5d 998 (hdev->dev_type == HCI_PRIMARY &&
a5c8f270
MH		 999 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1000 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
a358dc11 1001 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
bf543036 1002 hci_dev_do_close(hdev);
d7a5a11d 1003 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
19202573
JH		 1004 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1005 HCI_AUTO_OFF_TIMEOUT);
bf543036 1006 }
ab81cbf9 1007
a69d8927 1008 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
4a964404
MH		 1009 /* For unconfigured devices, set the HCI_RAW flag
1010 * so that userspace can easily identify them.
4a964404 1011 */
d7a5a11d 1012 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4a964404 1013 set_bit(HCI_RAW, &hdev->flags);
0602a8ad
MH		 1014
1015 /* For fully configured devices, this will send
1016 * the Index Added event. For unconfigured devices,
1017 * it will send Unconfigued Index Added event.
1018 *
1019 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
1020 * and no event will be send.
1021 */
1022 mgmt_index_added(hdev);
a69d8927 1023 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
5ea234d3
MH		 1024 /* When the controller is now configured, then it
1025 * is important to clear the HCI_RAW flag.
1026 */
d7a5a11d 1027 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5ea234d3
MH		 1028 clear_bit(HCI_RAW, &hdev->flags);
1029
d603b76b
MH		 1030 /* Powering on the controller with HCI_CONFIG set only
1031 * happens with the transition from unconfigured to
1032 * configured. This will send the Index Added event.
1033 */
744cf19e 1034 mgmt_index_added(hdev);
fee746b0 1035 }
ab81cbf9
JH		 1036}
1037
1038static void hci_power_off(struct work_struct *work)
1039{
3243553f 1040 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 1041 power_off.work);
ab81cbf9
JH		 1042
1043 BT_DBG("%s", hdev->name);
1044
8ee56540 1045 hci_dev_do_close(hdev);
ab81cbf9
JH		 1046}
1047
c7741d16
MH		 1048static void hci_error_reset(struct work_struct *work)
1049{
1050 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
1051
1052 BT_DBG("%s", hdev->name);
1053
1054 if (hdev->hw_error)
1055 hdev->hw_error(hdev, hdev->hw_error_code);
1056 else
2064ee33 1057 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
c7741d16
MH		 1058
1059 if (hci_dev_do_close(hdev))
1060 return;
1061
c7741d16
MH		 1062 hci_dev_do_open(hdev);
1063}
1064
35f7498a 1065void hci_uuids_clear(struct hci_dev *hdev)
2aeb9a1a 1066{
4821002c 1067 struct bt_uuid *uuid, *tmp;
2aeb9a1a 1068
4821002c
JH		 1069 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1070 list_del(&uuid->list);
2aeb9a1a
JH		 1071 kfree(uuid);
1072 }
2aeb9a1a
JH		 1073}
1074
35f7498a 1075void hci_link_keys_clear(struct hci_dev *hdev)
55ed8ca1 1076{
0378b597 1077 struct link_key *key;
55ed8ca1 1078
d7d41682 1079 list_for_each_entry(key, &hdev->link_keys, list) {
0378b597
JH		 1080 list_del_rcu(&key->list);
1081 kfree_rcu(key, rcu);
55ed8ca1 1082 }
55ed8ca1
JH		 1083}
1084
35f7498a 1085void hci_smp_ltks_clear(struct hci_dev *hdev)
b899efaf 1086{
970d0f1b 1087 struct smp_ltk *k;
b899efaf 1088
d7d41682 1089 list_for_each_entry(k, &hdev->long_term_keys, list) {
970d0f1b
JH		 1090 list_del_rcu(&k->list);
1091 kfree_rcu(k, rcu);
b899efaf 1092 }
b899efaf
VCG		 1093}
1094
970c4e46
JH		 1095void hci_smp_irks_clear(struct hci_dev *hdev)
1096{
adae20cb 1097 struct smp_irk *k;
970c4e46 1098
d7d41682 1099 list_for_each_entry(k, &hdev->identity_resolving_keys, list) {
adae20cb
JH		 1100 list_del_rcu(&k->list);
1101 kfree_rcu(k, rcu);
970c4e46
JH		 1102 }
1103}
1104
600a8749
AM		 1105void hci_blocked_keys_clear(struct hci_dev *hdev)
1106{
1107 struct blocked_key *b;
1108
d7d41682 1109 list_for_each_entry(b, &hdev->blocked_keys, list) {
600a8749
AM		 1110 list_del_rcu(&b->list);
1111 kfree_rcu(b, rcu);
1112 }
1113}
1114
1115bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
1116{
1117 bool blocked = false;
1118 struct blocked_key *b;
1119
1120 rcu_read_lock();
0c2ac7d4 1121 list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
600a8749
AM		 1122 if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
1123 blocked = true;
1124 break;
1125 }
1126 }
1127
1128 rcu_read_unlock();
1129 return blocked;
1130}
1131
55ed8ca1
JH		 1132struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1133{
8035ded4 1134 struct link_key *k;
55ed8ca1 1135
0378b597
JH		 1136 rcu_read_lock();
1137 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
1138 if (bacmp(bdaddr, &k->bdaddr) == 0) {
1139 rcu_read_unlock();
600a8749
AM		 1140
1141 if (hci_is_blocked_key(hdev,
1142 HCI_BLOCKED_KEY_TYPE_LINKKEY,
1143 k->val)) {
1144 bt_dev_warn_ratelimited(hdev,
1145 "Link key blocked for %pMR",
1146 &k->bdaddr);
1147 return NULL;
1148 }
1149
55ed8ca1 1150 return k;
0378b597
JH		 1151 }
1152 }
1153 rcu_read_unlock();
55ed8ca1
JH		 1154
1155 return NULL;
1156}
1157
745c0ce3 1158static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 1159 u8 key_type, u8 old_key_type)
d25e28ab
JH		 1160{
1161 /* Legacy key */
1162 if (key_type < 0x03)
745c0ce3 1163 return true;
d25e28ab
JH		 1164
1165 /* Debug keys are insecure so don't store them persistently */
1166 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 1167 return false;
d25e28ab
JH		 1168
1169 /* Changed combination key and there's no previous one */
1170 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 1171 return false;
d25e28ab
JH		 1172
1173 /* Security mode 3 case */
1174 if (!conn)
745c0ce3 1175 return true;
d25e28ab 1176
e3befab9
JH		 1177 /* BR/EDR key derived using SC from an LE link */
1178 if (conn->type == LE_LINK)
1179 return true;
1180
d25e28ab
JH		 1181 /* Neither local nor remote side had no-bonding as requirement */
1182 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 1183 return true;
d25e28ab
JH		 1184
1185 /* Local side had dedicated bonding as requirement */
1186 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 1187 return true;
d25e28ab
JH		 1188
1189 /* Remote side had dedicated bonding as requirement */
1190 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 1191 return true;
d25e28ab
JH		 1192
1193 /* If none of the above criteria match, then don't store the key
1194 * persistently */
745c0ce3 1195 return false;
d25e28ab
JH		 1196}
1197
e804d25d 1198static u8 ltk_role(u8 type)
98a0b845 1199{
e804d25d
JH		 1200 if (type == SMP_LTK)
1201 return HCI_ROLE_MASTER;
98a0b845 1202
e804d25d 1203 return HCI_ROLE_SLAVE;
98a0b845
JH		 1204}
1205
f3a73d97
JH		 1206struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1207 u8 addr_type, u8 role)
75d262c2 1208{
c9839a11 1209 struct smp_ltk *k;
75d262c2 1210
970d0f1b
JH		 1211 rcu_read_lock();
1212 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
5378bc56
JH		 1213 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
1214 continue;
1215
923e2414 1216 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
970d0f1b 1217 rcu_read_unlock();
600a8749
AM		 1218
1219 if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
1220 k->val)) {
1221 bt_dev_warn_ratelimited(hdev,
1222 "LTK blocked for %pMR",
1223 &k->bdaddr);
1224 return NULL;
1225 }
1226
75d262c2 1227 return k;
970d0f1b
JH		 1228 }
1229 }
1230 rcu_read_unlock();
75d262c2
VCG		 1231
1232 return NULL;
1233}
75d262c2 1234
970c4e46
JH		 1235struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
1236{
600a8749 1237 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 1238 struct smp_irk *irk;
1239
adae20cb
JH		 1240 rcu_read_lock();
1241 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
1242 if (!bacmp(&irk->rpa, rpa)) {
600a8749
AM		 1243 irk_to_return = irk;
1244 goto done;
adae20cb 1245 }
970c4e46
JH		 1246 }
1247
adae20cb 1248 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
defce9e8 1249 if (smp_irk_matches(hdev, irk->val, rpa)) {
970c4e46 1250 bacpy(&irk->rpa, rpa);
600a8749
AM		 1251 irk_to_return = irk;
1252 goto done;
970c4e46
JH		 1253 }
1254 }
600a8749
AM		 1255
1256done:
1257 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1258 irk_to_return->val)) {
1259 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1260 &irk_to_return->bdaddr);
1261 irk_to_return = NULL;
1262 }
1263
adae20cb 1264 rcu_read_unlock();
970c4e46 1265
600a8749 1266 return irk_to_return;
970c4e46
JH		 1267}
1268
1269struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1270 u8 addr_type)
1271{
600a8749 1272 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 1273 struct smp_irk *irk;
1274
6cfc9988
JH		 1275 /* Identity Address must be public or static random */
1276 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
1277 return NULL;
1278
adae20cb
JH		 1279 rcu_read_lock();
1280 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
970c4e46 1281 if (addr_type == irk->addr_type &&
adae20cb 1282 bacmp(bdaddr, &irk->bdaddr) == 0) {
600a8749
AM		 1283 irk_to_return = irk;
1284 goto done;
adae20cb 1285 }
970c4e46 1286 }
600a8749
AM		 1287
1288done:
1289
1290 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1291 irk_to_return->val)) {
1292 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1293 &irk_to_return->bdaddr);
1294 irk_to_return = NULL;
1295 }
1296
adae20cb 1297 rcu_read_unlock();
970c4e46 1298
600a8749 1299 return irk_to_return;
970c4e46
JH		 1300}
1301
567fa2aa 1302struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
7652ff6a
JH		 1303 bdaddr_t *bdaddr, u8 *val, u8 type,
1304 u8 pin_len, bool *persistent)
55ed8ca1
JH		 1305{
1306 struct link_key *key, *old_key;
745c0ce3 1307 u8 old_key_type;
55ed8ca1
JH		 1308
1309 old_key = hci_find_link_key(hdev, bdaddr);
1310 if (old_key) {
1311 old_key_type = old_key->type;
1312 key = old_key;
1313 } else {
12adcf3a 1314 old_key_type = conn ? conn->key_type : 0xff;
0a14ab41 1315 key = kzalloc(sizeof(*key), GFP_KERNEL);
55ed8ca1 1316 if (!key)
567fa2aa 1317 return NULL;
0378b597 1318 list_add_rcu(&key->list, &hdev->link_keys);
55ed8ca1
JH		 1319 }
1320
6ed93dc6 1321 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 1322
d25e28ab
JH		 1323 /* Some buggy controller combinations generate a changed
1324 * combination key for legacy pairing even when there's no
1325 * previous key */
1326 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 1327 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 1328 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1329 if (conn)
1330 conn->key_type = type;
1331 }
d25e28ab 1332
55ed8ca1 1333 bacpy(&key->bdaddr, bdaddr);
9b3b4460 1334 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 1335 key->pin_len = pin_len;
1336
b6020ba0 1337 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1338 key->type = old_key_type;
4748fed2
JH		 1339 else
1340 key->type = type;
1341
7652ff6a
JH		 1342 if (persistent)
1343 *persistent = hci_persistent_key(hdev, conn, type,
1344 old_key_type);
4df378a1 1345
567fa2aa 1346 return key;
55ed8ca1
JH		 1347}
1348
ca9142b8 1349struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
35d70271 1350 u8 addr_type, u8 type, u8 authenticated,
fe39c7b2 1351 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
75d262c2 1352{
c9839a11 1353 struct smp_ltk *key, *old_key;
e804d25d 1354 u8 role = ltk_role(type);
75d262c2 1355
f3a73d97 1356 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
c9839a11 1357 if (old_key)
75d262c2 1358 key = old_key;
c9839a11 1359 else {
0a14ab41 1360 key = kzalloc(sizeof(*key), GFP_KERNEL);
75d262c2 1361 if (!key)
ca9142b8 1362 return NULL;
970d0f1b 1363 list_add_rcu(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 1364 }
1365
75d262c2 1366 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 1367 key->bdaddr_type = addr_type;
1368 memcpy(key->val, tk, sizeof(key->val));
1369 key->authenticated = authenticated;
1370 key->ediv = ediv;
fe39c7b2 1371 key->rand = rand;
c9839a11
VCG		 1372 key->enc_size = enc_size;
1373 key->type = type;
75d262c2 1374
ca9142b8 1375 return key;
75d262c2
VCG		 1376}
1377
ca9142b8
JH		 1378struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1379 u8 addr_type, u8 val[16], bdaddr_t *rpa)
970c4e46
JH		 1380{
1381 struct smp_irk *irk;
1382
1383 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
1384 if (!irk) {
1385 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
1386 if (!irk)
ca9142b8 1387 return NULL;
970c4e46
JH		 1388
1389 bacpy(&irk->bdaddr, bdaddr);
1390 irk->addr_type = addr_type;
1391
adae20cb 1392 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
970c4e46
JH		 1393 }
1394
1395 memcpy(irk->val, val, 16);
1396 bacpy(&irk->rpa, rpa);
1397
ca9142b8 1398 return irk;
970c4e46
JH		 1399}
1400
55ed8ca1
JH		 1401int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1402{
1403 struct link_key *key;
1404
1405 key = hci_find_link_key(hdev, bdaddr);
1406 if (!key)
1407 return -ENOENT;
1408
6ed93dc6 1409 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1 1410
0378b597
JH		 1411 list_del_rcu(&key->list);
1412 kfree_rcu(key, rcu);
55ed8ca1
JH		 1413
1414 return 0;
1415}
1416
e0b2b27e 1417int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
b899efaf 1418{
970d0f1b 1419 struct smp_ltk *k;
c51ffa0b 1420 int removed = 0;
b899efaf 1421
970d0f1b 1422 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
e0b2b27e 1423 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
b899efaf
VCG		 1424 continue;
1425
6ed93dc6 1426 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf 1427
970d0f1b
JH		 1428 list_del_rcu(&k->list);
1429 kfree_rcu(k, rcu);
c51ffa0b 1430 removed++;
b899efaf
VCG		 1431 }
1432
c51ffa0b 1433 return removed ? 0 : -ENOENT;
b899efaf
VCG		 1434}
1435
a7ec7338
JH		 1436void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
1437{
adae20cb 1438 struct smp_irk *k;
a7ec7338 1439
adae20cb 1440 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
a7ec7338
JH		 1441 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
1442 continue;
1443
1444 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1445
adae20cb
JH		 1446 list_del_rcu(&k->list);
1447 kfree_rcu(k, rcu);
a7ec7338
JH		 1448 }
1449}
1450
55e76b38
JH		 1451bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1452{
1453 struct smp_ltk *k;
4ba9faf3 1454 struct smp_irk *irk;
55e76b38
JH		 1455 u8 addr_type;
1456
1457 if (type == BDADDR_BREDR) {
1458 if (hci_find_link_key(hdev, bdaddr))
1459 return true;
1460 return false;
1461 }
1462
1463 /* Convert to HCI addr type which struct smp_ltk uses */
1464 if (type == BDADDR_LE_PUBLIC)
1465 addr_type = ADDR_LE_DEV_PUBLIC;
1466 else
1467 addr_type = ADDR_LE_DEV_RANDOM;
1468
4ba9faf3
JH		 1469 irk = hci_get_irk(hdev, bdaddr, addr_type);
1470 if (irk) {
1471 bdaddr = &irk->bdaddr;
1472 addr_type = irk->addr_type;
1473 }
1474
55e76b38
JH		 1475 rcu_read_lock();
1476 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
87c8b28d
JH		 1477 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
1478 rcu_read_unlock();
55e76b38 1479 return true;
87c8b28d 1480 }
55e76b38
JH		 1481 }
1482 rcu_read_unlock();
1483
1484 return false;
1485}
1486
6bd32326 1487/* HCI command timer function */
65cc2b49 1488static void hci_cmd_timeout(struct work_struct *work)
6bd32326 1489{
65cc2b49
MH		 1490 struct hci_dev *hdev = container_of(work, struct hci_dev,
1491 cmd_timer.work);
6bd32326 1492
bda4f23a
AE		 1493 if (hdev->sent_cmd) {
1494 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1495 u16 opcode = __le16_to_cpu(sent->opcode);
1496
2064ee33 1497 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
bda4f23a 1498 } else {
2064ee33 1499 bt_dev_err(hdev, "command tx timeout");
bda4f23a
AE		 1500 }
1501
e2bef384
RJ		 1502 if (hdev->cmd_timeout)
1503 hdev->cmd_timeout(hdev);
1504
6bd32326 1505 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1506 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1507}
1508
de75cd0d
MM		 1509/* HCI ncmd timer function */
1510static void hci_ncmd_timeout(struct work_struct *work)
1511{
1512 struct hci_dev *hdev = container_of(work, struct hci_dev,
1513 ncmd_timer.work);
1514
1515 bt_dev_err(hdev, "Controller not accepting commands anymore: ncmd = 0");
1516
1517 /* During HCI_INIT phase no events can be injected if the ncmd timer
1518 * triggers since the procedure has its own timeout handling.
1519 */
1520 if (test_bit(HCI_INIT, &hdev->flags))
1521 return;
1522
1523 /* This is an irrecoverable state, inject hardware error event */
1524 hci_reset_dev(hdev);
1525}
1526
2763eda6 1527struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
6928a924 1528 bdaddr_t *bdaddr, u8 bdaddr_type)
2763eda6
SJ		 1529{
1530 struct oob_data *data;
1531
6928a924
JH		 1532 list_for_each_entry(data, &hdev->remote_oob_data, list) {
1533 if (bacmp(bdaddr, &data->bdaddr) != 0)
1534 continue;
1535 if (data->bdaddr_type != bdaddr_type)
1536 continue;
1537 return data;
1538 }
2763eda6
SJ		 1539
1540 return NULL;
1541}
1542
6928a924
JH		 1543int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
1544 u8 bdaddr_type)
2763eda6
SJ		 1545{
1546 struct oob_data *data;
1547
6928a924 1548 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6
SJ		 1549 if (!data)
1550 return -ENOENT;
1551
6928a924 1552 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2763eda6
SJ		 1553
1554 list_del(&data->list);
1555 kfree(data);
1556
1557 return 0;
1558}
1559
35f7498a 1560void hci_remote_oob_data_clear(struct hci_dev *hdev)
2763eda6
SJ		 1561{
1562 struct oob_data *data, *n;
1563
1564 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1565 list_del(&data->list);
1566 kfree(data);
1567 }
2763eda6
SJ		 1568}
1569
0798872e 1570int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
6928a924 1571 u8 bdaddr_type, u8 *hash192, u8 *rand192,
81328d5c 1572 u8 *hash256, u8 *rand256)
2763eda6
SJ		 1573{
1574 struct oob_data *data;
1575
6928a924 1576 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6 1577 if (!data) {
0a14ab41 1578 data = kmalloc(sizeof(*data), GFP_KERNEL);
2763eda6
SJ		 1579 if (!data)
1580 return -ENOMEM;
1581
1582 bacpy(&data->bdaddr, bdaddr);
6928a924 1583 data->bdaddr_type = bdaddr_type;
2763eda6
SJ		 1584 list_add(&data->list, &hdev->remote_oob_data);
1585 }
1586
81328d5c
JH		 1587 if (hash192 && rand192) {
1588 memcpy(data->hash192, hash192, sizeof(data->hash192));
1589 memcpy(data->rand192, rand192, sizeof(data->rand192));
f7697b16
MH		 1590 if (hash256 && rand256)
1591 data->present = 0x03;
81328d5c
JH		 1592 } else {
1593 memset(data->hash192, 0, sizeof(data->hash192));
1594 memset(data->rand192, 0, sizeof(data->rand192));
f7697b16
MH		 1595 if (hash256 && rand256)
1596 data->present = 0x02;
1597 else
1598 data->present = 0x00;
0798872e
MH		 1599 }
1600
81328d5c
JH		 1601 if (hash256 && rand256) {
1602 memcpy(data->hash256, hash256, sizeof(data->hash256));
1603 memcpy(data->rand256, rand256, sizeof(data->rand256));
1604 } else {
1605 memset(data->hash256, 0, sizeof(data->hash256));
1606 memset(data->rand256, 0, sizeof(data->rand256));
f7697b16
MH		 1607 if (hash192 && rand192)
1608 data->present = 0x01;
81328d5c 1609 }
0798872e 1610
6ed93dc6 1611 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1612
1613 return 0;
1614}
1615
d2609b34
FG		 1616/* This function requires the caller holds hdev->lock */
1617struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
1618{
1619 struct adv_info *adv_instance;
1620
1621 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
1622 if (adv_instance->instance == instance)
1623 return adv_instance;
1624 }
1625
1626 return NULL;
1627}
1628
1629/* This function requires the caller holds hdev->lock */
74b93e9f
PK		 1630struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
1631{
d2609b34
FG		 1632 struct adv_info *cur_instance;
1633
1634 cur_instance = hci_find_adv_instance(hdev, instance);
1635 if (!cur_instance)
1636 return NULL;
1637
1638 if (cur_instance == list_last_entry(&hdev->adv_instances,
1639 struct adv_info, list))
1640 return list_first_entry(&hdev->adv_instances,
1641 struct adv_info, list);
1642 else
1643 return list_next_entry(cur_instance, list);
1644}
1645
1646/* This function requires the caller holds hdev->lock */
1647int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
1648{
1649 struct adv_info *adv_instance;
1650
1651 adv_instance = hci_find_adv_instance(hdev, instance);
1652 if (!adv_instance)
1653 return -ENOENT;
1654
1655 BT_DBG("%s removing %dMR", hdev->name, instance);
1656
cab054ab
JH		 1657 if (hdev->cur_adv_instance == instance) {
1658 if (hdev->adv_instance_timeout) {
1659 cancel_delayed_work(&hdev->adv_instance_expire);
1660 hdev->adv_instance_timeout = 0;
1661 }
1662 hdev->cur_adv_instance = 0x00;
5d900e46
FG		 1663 }
1664
a73c046a
JK		 1665 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1666
d2609b34
FG		 1667 list_del(&adv_instance->list);
1668 kfree(adv_instance);
1669
1670 hdev->adv_instance_cnt--;
1671
1672 return 0;
1673}
1674
a73c046a
JK		 1675void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
1676{
1677 struct adv_info *adv_instance, *n;
1678
1679 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
1680 adv_instance->rpa_expired = rpa_expired;
1681}
1682
d2609b34
FG		 1683/* This function requires the caller holds hdev->lock */
1684void hci_adv_instances_clear(struct hci_dev *hdev)
1685{
1686 struct adv_info *adv_instance, *n;
1687
5d900e46
FG		 1688 if (hdev->adv_instance_timeout) {
1689 cancel_delayed_work(&hdev->adv_instance_expire);
1690 hdev->adv_instance_timeout = 0;
1691 }
1692
d2609b34 1693 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
a73c046a 1694 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
d2609b34
FG		 1695 list_del(&adv_instance->list);
1696 kfree(adv_instance);
1697 }
1698
1699 hdev->adv_instance_cnt = 0;
cab054ab 1700 hdev->cur_adv_instance = 0x00;
d2609b34
FG		 1701}
1702
a73c046a
JK		 1703static void adv_instance_rpa_expired(struct work_struct *work)
1704{
1705 struct adv_info *adv_instance = container_of(work, struct adv_info,
1706 rpa_expired_cb.work);
1707
1708 BT_DBG("");
1709
1710 adv_instance->rpa_expired = true;
1711}
1712
d2609b34 1713/* This function requires the caller holds hdev->lock */
eca0ae4a
LAD		 1714struct adv_info *hci_add_adv_instance(struct hci_dev *hdev, u8 instance,
1715 u32 flags, u16 adv_data_len, u8 *adv_data,
1716 u16 scan_rsp_len, u8 *scan_rsp_data,
1717 u16 timeout, u16 duration, s8 tx_power,
b338d917
BG		 1718 u32 min_interval, u32 max_interval,
1719 u8 mesh_handle)
d2609b34 1720{
eca0ae4a 1721 struct adv_info *adv;
d2609b34 1722
eca0ae4a
LAD		 1723 adv = hci_find_adv_instance(hdev, instance);
1724 if (adv) {
1725 memset(adv->adv_data, 0, sizeof(adv->adv_data));
1726 memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1727 memset(adv->per_adv_data, 0, sizeof(adv->per_adv_data));
d2609b34 1728 } else {
1d0fac2c 1729 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
b338d917 1730 instance < 1 || instance > hdev->le_num_of_adv_sets + 1)
eca0ae4a 1731 return ERR_PTR(-EOVERFLOW);
d2609b34 1732
eca0ae4a
LAD		 1733 adv = kzalloc(sizeof(*adv), GFP_KERNEL);
1734 if (!adv)
1735 return ERR_PTR(-ENOMEM);
d2609b34 1736
eca0ae4a
LAD		 1737 adv->pending = true;
1738 adv->instance = instance;
1739 list_add(&adv->list, &hdev->adv_instances);
d2609b34
FG		 1740 hdev->adv_instance_cnt++;
1741 }
1742
eca0ae4a
LAD		 1743 adv->flags = flags;
1744 adv->min_interval = min_interval;
1745 adv->max_interval = max_interval;
1746 adv->tx_power = tx_power;
b338d917
BG		 1747 /* Defining a mesh_handle changes the timing units to ms,
1748 * rather than seconds, and ties the instance to the requested
1749 * mesh_tx queue.
1750 */
1751 adv->mesh = mesh_handle;
d2609b34 1752
34a718bc
LAD		 1753 hci_set_adv_instance_data(hdev, instance, adv_data_len, adv_data,
1754 scan_rsp_len, scan_rsp_data);
d2609b34 1755
eca0ae4a
LAD		 1756 adv->timeout = timeout;
1757 adv->remaining_time = timeout;
d2609b34
FG		 1758
1759 if (duration == 0)
eca0ae4a 1760 adv->duration = hdev->def_multi_adv_rotation_duration;
d2609b34 1761 else
eca0ae4a 1762 adv->duration = duration;
d2609b34 1763
eca0ae4a 1764 INIT_DELAYED_WORK(&adv->rpa_expired_cb, adv_instance_rpa_expired);
a73c046a 1765
d2609b34
FG		 1766 BT_DBG("%s for %dMR", hdev->name, instance);
1767
eca0ae4a
LAD		 1768 return adv;
1769}
1770
1771/* This function requires the caller holds hdev->lock */
1772struct adv_info *hci_add_per_instance(struct hci_dev *hdev, u8 instance,
1773 u32 flags, u8 data_len, u8 *data,
1774 u32 min_interval, u32 max_interval)
1775{
1776 struct adv_info *adv;
1777
1778 adv = hci_add_adv_instance(hdev, instance, flags, 0, NULL, 0, NULL,
1779 0, 0, HCI_ADV_TX_POWER_NO_PREFERENCE,
b338d917 1780 min_interval, max_interval, 0);
eca0ae4a
LAD		 1781 if (IS_ERR(adv))
1782 return adv;
1783
1784 adv->periodic = true;
1785 adv->per_adv_data_len = data_len;
1786
1787 if (data)
1788 memcpy(adv->per_adv_data, data, data_len);
1789
1790 return adv;
d2609b34
FG		 1791}
1792
31aab5c2
DW		 1793/* This function requires the caller holds hdev->lock */
1794int hci_set_adv_instance_data(struct hci_dev *hdev, u8 instance,
1795 u16 adv_data_len, u8 *adv_data,
1796 u16 scan_rsp_len, u8 *scan_rsp_data)
1797{
34a718bc 1798 struct adv_info *adv;
31aab5c2 1799
34a718bc 1800 adv = hci_find_adv_instance(hdev, instance);
31aab5c2
DW		 1801
1802 /* If advertisement doesn't exist, we can't modify its data */
34a718bc 1803 if (!adv)
31aab5c2
DW		 1804 return -ENOENT;
1805
34a718bc
LAD		 1806 if (adv_data_len && ADV_DATA_CMP(adv, adv_data, adv_data_len)) {
1807 memset(adv->adv_data, 0, sizeof(adv->adv_data));
1808 memcpy(adv->adv_data, adv_data, adv_data_len);
1809 adv->adv_data_len = adv_data_len;
1810 adv->adv_data_changed = true;
31aab5c2
DW		 1811 }
1812
34a718bc
LAD		 1813 if (scan_rsp_len && SCAN_RSP_CMP(adv, scan_rsp_data, scan_rsp_len)) {
1814 memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1815 memcpy(adv->scan_rsp_data, scan_rsp_data, scan_rsp_len);
1816 adv->scan_rsp_len = scan_rsp_len;
1817 adv->scan_rsp_changed = true;
31aab5c2
DW		 1818 }
1819
34a718bc
LAD		 1820 /* Mark as changed if there are flags which would affect it */
1821 if (((adv->flags & MGMT_ADV_FLAG_APPEARANCE) && hdev->appearance) ||
1822 adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1823 adv->scan_rsp_changed = true;
1824
31aab5c2
DW		 1825 return 0;
1826}
1827
01ce70b0
LAD		 1828/* This function requires the caller holds hdev->lock */
1829u32 hci_adv_instance_flags(struct hci_dev *hdev, u8 instance)
1830{
1831 u32 flags;
1832 struct adv_info *adv;
1833
1834 if (instance == 0x00) {
1835 /* Instance 0 always manages the "Tx Power" and "Flags"
1836 * fields
1837 */
1838 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
1839
1840 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
1841 * corresponds to the "connectable" instance flag.
1842 */
1843 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
1844 flags |= MGMT_ADV_FLAG_CONNECTABLE;
1845
1846 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1847 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
1848 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1849 flags |= MGMT_ADV_FLAG_DISCOV;
1850
1851 return flags;
1852 }
1853
1854 adv = hci_find_adv_instance(hdev, instance);
1855
1856 /* Return 0 when we got an invalid instance identifier. */
1857 if (!adv)
1858 return 0;
1859
1860 return adv->flags;
1861}
1862
1863bool hci_adv_instance_is_scannable(struct hci_dev *hdev, u8 instance)
1864{
1865 struct adv_info *adv;
1866
1867 /* Instance 0x00 always set local name */
1868 if (instance == 0x00)
1869 return true;
1870
1871 adv = hci_find_adv_instance(hdev, instance);
1872 if (!adv)
1873 return false;
1874
1875 if (adv->flags & MGMT_ADV_FLAG_APPEARANCE ||
1876 adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1877 return true;
1878
1879 return adv->scan_rsp_len ? true : false;
1880}
1881
e5e1e7fd
MC		 1882/* This function requires the caller holds hdev->lock */
1883void hci_adv_monitors_clear(struct hci_dev *hdev)
1884{
b139553d
MC		 1885 struct adv_monitor *monitor;
1886 int handle;
1887
1888 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
66bd095a 1889 hci_free_adv_monitor(hdev, monitor);
b139553d 1890
e5e1e7fd
MC		 1891 idr_destroy(&hdev->adv_monitors_idr);
1892}
1893
66bd095a
AP		 1894/* Frees the monitor structure and do some bookkeepings.
1895 * This function requires the caller holds hdev->lock.
1896 */
1897void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
b139553d
MC		 1898{
1899 struct adv_pattern *pattern;
1900 struct adv_pattern *tmp;
1901
1902 if (!monitor)
1903 return;
1904
66bd095a
AP		 1905 list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list) {
1906 list_del(&pattern->list);
b139553d 1907 kfree(pattern);
66bd095a
AP		 1908 }
1909
1910 if (monitor->handle)
1911 idr_remove(&hdev->adv_monitors_idr, monitor->handle);
1912
1913 if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) {
1914 hdev->adv_monitors_cnt--;
1915 mgmt_adv_monitor_removed(hdev, monitor->handle);
1916 }
b139553d
MC		 1917
1918 kfree(monitor);
1919}
1920
a2a4dedf
AP		 1921/* Assigns handle to a monitor, and if offloading is supported and power is on,
1922 * also attempts to forward the request to the controller.
b747a836 1923 * This function requires the caller holds hci_req_sync_lock.
a2a4dedf 1924 */
b747a836 1925int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
b139553d
MC		 1926{
1927 int min, max, handle;
b747a836 1928 int status = 0;
b139553d 1929
b747a836
MM		 1930 if (!monitor)
1931 return -EINVAL;
a2a4dedf 1932
b747a836 1933 hci_dev_lock(hdev);
b139553d
MC		 1934
1935 min = HCI_MIN_ADV_MONITOR_HANDLE;
1936 max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES;
1937 handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max,
1938 GFP_KERNEL);
b747a836
MM		 1939
1940 hci_dev_unlock(hdev);
1941
1942 if (handle < 0)
1943 return handle;
b139553d 1944
b139553d 1945 monitor->handle = handle;
8208f5a9 1946
a2a4dedf 1947 if (!hdev_is_powered(hdev))
b747a836 1948 return status;
8208f5a9 1949
a2a4dedf
AP		 1950 switch (hci_get_adv_monitor_offload_ext(hdev)) {
1951 case HCI_ADV_MONITOR_EXT_NONE:
b747a836
MM		 1952 bt_dev_dbg(hdev, "%s add monitor %d status %d", hdev->name,
1953 monitor->handle, status);
a2a4dedf 1954 /* Message was not forwarded to controller - not an error */
b747a836
MM		 1955 break;
1956
a2a4dedf 1957 case HCI_ADV_MONITOR_EXT_MSFT:
b747a836
MM		 1958 status = msft_add_monitor_pattern(hdev, monitor);
1959 bt_dev_dbg(hdev, "%s add monitor %d msft status %d", hdev->name,
1960 monitor->handle, status);
a2a4dedf
AP		 1961 break;
1962 }
1963
b747a836 1964 return status;
b139553d
MC		 1965}
1966
66bd095a
AP		 1967/* Attempts to tell the controller and free the monitor. If somehow the
1968 * controller doesn't have a corresponding handle, remove anyway.
7cf5c297 1969 * This function requires the caller holds hci_req_sync_lock.
66bd095a 1970 */
7cf5c297
MM		 1971static int hci_remove_adv_monitor(struct hci_dev *hdev,
1972 struct adv_monitor *monitor)
bd2fbc6c 1973{
7cf5c297 1974 int status = 0;
bd2fbc6c 1975
66bd095a
AP		 1976 switch (hci_get_adv_monitor_offload_ext(hdev)) {
1977 case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */
7cf5c297
MM		 1978 bt_dev_dbg(hdev, "%s remove monitor %d status %d", hdev->name,
1979 monitor->handle, status);
66bd095a 1980 goto free_monitor;
7cf5c297 1981
66bd095a 1982 case HCI_ADV_MONITOR_EXT_MSFT:
7cf5c297
MM		 1983 status = msft_remove_monitor(hdev, monitor);
1984 bt_dev_dbg(hdev, "%s remove monitor %d msft status %d",
1985 hdev->name, monitor->handle, status);
66bd095a
AP		 1986 break;
1987 }
bd2fbc6c 1988
66bd095a 1989 /* In case no matching handle registered, just free the monitor */
7cf5c297 1990 if (status == -ENOENT)
66bd095a
AP		 1991 goto free_monitor;
1992
7cf5c297 1993 return status;
66bd095a
AP		 1994
1995free_monitor:
7cf5c297 1996 if (status == -ENOENT)
66bd095a
AP		 1997 bt_dev_warn(hdev, "Removing monitor with no matching handle %d",
1998 monitor->handle);
1999 hci_free_adv_monitor(hdev, monitor);
2000
7cf5c297 2001 return status;
bd2fbc6c
MC		 2002}
2003
7cf5c297
MM		 2004/* This function requires the caller holds hci_req_sync_lock */
2005int hci_remove_single_adv_monitor(struct hci_dev *hdev, u16 handle)
66bd095a
AP		 2006{
2007 struct adv_monitor *monitor = idr_find(&hdev->adv_monitors_idr, handle);
66bd095a 2008
7cf5c297
MM		 2009 if (!monitor)
2010 return -EINVAL;
66bd095a 2011
7cf5c297 2012 return hci_remove_adv_monitor(hdev, monitor);
66bd095a
AP		 2013}
2014
7cf5c297
MM		 2015/* This function requires the caller holds hci_req_sync_lock */
2016int hci_remove_all_adv_monitor(struct hci_dev *hdev)
bd2fbc6c
MC		 2017{
2018 struct adv_monitor *monitor;
66bd095a 2019 int idr_next_id = 0;
7cf5c297 2020 int status = 0;
66bd095a 2021
7cf5c297 2022 while (1) {
66bd095a 2023 monitor = idr_get_next(&hdev->adv_monitors_idr, &idr_next_id);
bd2fbc6c 2024 if (!monitor)
66bd095a 2025 break;
bd2fbc6c 2026
7cf5c297
MM		 2027 status = hci_remove_adv_monitor(hdev, monitor);
2028 if (status)
2029 return status;
66bd095a 2030
7cf5c297 2031 idr_next_id++;
bd2fbc6c
MC		 2032 }
2033
7cf5c297 2034 return status;
bd2fbc6c
MC		 2035}
2036
8208f5a9
MC		 2037/* This function requires the caller holds hdev->lock */
2038bool hci_is_adv_monitoring(struct hci_dev *hdev)
2039{
2040 return !idr_is_empty(&hdev->adv_monitors_idr);
2041}
2042
a2a4dedf
AP		 2043int hci_get_adv_monitor_offload_ext(struct hci_dev *hdev)
2044{
2045 if (msft_monitor_supported(hdev))
2046 return HCI_ADV_MONITOR_EXT_MSFT;
2047
2048 return HCI_ADV_MONITOR_EXT_NONE;
2049}
2050
dcc36c16 2051struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
b9ee0a78 2052 bdaddr_t *bdaddr, u8 type)
b2a66aad 2053{
8035ded4 2054 struct bdaddr_list *b;
b2a66aad 2055
dcc36c16 2056 list_for_each_entry(b, bdaddr_list, list) {
b9ee0a78 2057 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
b2a66aad 2058 return b;
b9ee0a78 2059 }
b2a66aad
AJ		 2060
2061 return NULL;
2062}
2063
b950aa88
AN		 2064struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
2065 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
2066 u8 type)
2067{
2068 struct bdaddr_list_with_irk *b;
2069
2070 list_for_each_entry(b, bdaddr_list, list) {
2071 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2072 return b;
2073 }
2074
2075 return NULL;
2076}
2077
8baaa403
APS		 2078struct bdaddr_list_with_flags *
2079hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list,
2080 bdaddr_t *bdaddr, u8 type)
2081{
2082 struct bdaddr_list_with_flags *b;
2083
2084 list_for_each_entry(b, bdaddr_list, list) {
2085 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2086 return b;
2087 }
2088
2089 return NULL;
2090}
2091
dcc36c16 2092void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
b2a66aad 2093{
7eb7404f 2094 struct bdaddr_list *b, *n;
b2a66aad 2095
7eb7404f
GT		 2096 list_for_each_entry_safe(b, n, bdaddr_list, list) {
2097 list_del(&b->list);
b2a66aad
AJ		 2098 kfree(b);
2099 }
b2a66aad
AJ		 2100}
2101
dcc36c16 2102int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2103{
2104 struct bdaddr_list *entry;
b2a66aad 2105
b9ee0a78 2106 if (!bacmp(bdaddr, BDADDR_ANY))
b2a66aad
AJ		 2107 return -EBADF;
2108
dcc36c16 2109 if (hci_bdaddr_list_lookup(list, bdaddr, type))
5e762444 2110 return -EEXIST;
b2a66aad 2111
27f70f3e 2112 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
5e762444
AJ		 2113 if (!entry)
2114 return -ENOMEM;
b2a66aad
AJ		 2115
2116 bacpy(&entry->bdaddr, bdaddr);
b9ee0a78 2117 entry->bdaddr_type = type;
b2a66aad 2118
dcc36c16 2119 list_add(&entry->list, list);
b2a66aad 2120
2a8357f2 2121 return 0;
b2a66aad
AJ		 2122}
2123
b950aa88
AN		 2124int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2125 u8 type, u8 *peer_irk, u8 *local_irk)
2126{
2127 struct bdaddr_list_with_irk *entry;
2128
2129 if (!bacmp(bdaddr, BDADDR_ANY))
2130 return -EBADF;
2131
2132 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2133 return -EEXIST;
2134
2135 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2136 if (!entry)
2137 return -ENOMEM;
2138
2139 bacpy(&entry->bdaddr, bdaddr);
2140 entry->bdaddr_type = type;
2141
2142 if (peer_irk)
2143 memcpy(entry->peer_irk, peer_irk, 16);
2144
2145 if (local_irk)
2146 memcpy(entry->local_irk, local_irk, 16);
2147
2148 list_add(&entry->list, list);
2149
2150 return 0;
2151}
2152
8baaa403
APS		 2153int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2154 u8 type, u32 flags)
2155{
2156 struct bdaddr_list_with_flags *entry;
2157
2158 if (!bacmp(bdaddr, BDADDR_ANY))
2159 return -EBADF;
2160
2161 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2162 return -EEXIST;
2163
2164 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2165 if (!entry)
2166 return -ENOMEM;
2167
2168 bacpy(&entry->bdaddr, bdaddr);
2169 entry->bdaddr_type = type;
e1cff700 2170 entry->flags = flags;
8baaa403
APS		 2171
2172 list_add(&entry->list, list);
2173
2174 return 0;
2175}
2176
dcc36c16 2177int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2178{
2179 struct bdaddr_list *entry;
b2a66aad 2180
35f7498a 2181 if (!bacmp(bdaddr, BDADDR_ANY)) {
dcc36c16 2182 hci_bdaddr_list_clear(list);
35f7498a
JH		 2183 return 0;
2184 }
b2a66aad 2185
dcc36c16 2186 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
d2ab0ac1
MH		 2187 if (!entry)
2188 return -ENOENT;
2189
2190 list_del(&entry->list);
2191 kfree(entry);
2192
2193 return 0;
2194}
2195
b950aa88
AN		 2196int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2197 u8 type)
2198{
2199 struct bdaddr_list_with_irk *entry;
2200
2201 if (!bacmp(bdaddr, BDADDR_ANY)) {
2202 hci_bdaddr_list_clear(list);
2203 return 0;
2204 }
2205
2206 entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
2207 if (!entry)
2208 return -ENOENT;
2209
2210 list_del(&entry->list);
2211 kfree(entry);
2212
2213 return 0;
2214}
2215
8baaa403
APS		 2216int hci_bdaddr_list_del_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2217 u8 type)
2218{
2219 struct bdaddr_list_with_flags *entry;
2220
2221 if (!bacmp(bdaddr, BDADDR_ANY)) {
2222 hci_bdaddr_list_clear(list);
2223 return 0;
2224 }
2225
2226 entry = hci_bdaddr_list_lookup_with_flags(list, bdaddr, type);
2227 if (!entry)
2228 return -ENOENT;
2229
2230 list_del(&entry->list);
2231 kfree(entry);
2232
2233 return 0;
2234}
2235
15819a70
AG		 2236/* This function requires the caller holds hdev->lock */
2237struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2238 bdaddr_t *addr, u8 addr_type)
2239{
2240 struct hci_conn_params *params;
2241
2242 list_for_each_entry(params, &hdev->le_conn_params, list) {
2243 if (bacmp(&params->addr, addr) == 0 &&
2244 params->addr_type == addr_type) {
2245 return params;
2246 }
2247 }
2248
2249 return NULL;
2250}
2251
4b10966f 2252/* This function requires the caller holds hdev->lock */
501f8827
JH		 2253struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2254 bdaddr_t *addr, u8 addr_type)
a9b0a04c 2255{
912b42ef 2256 struct hci_conn_params *param;
a9b0a04c 2257
501f8827 2258 list_for_each_entry(param, list, action) {
912b42ef
JH		 2259 if (bacmp(&param->addr, addr) == 0 &&
2260 param->addr_type == addr_type)
2261 return param;
4b10966f
MH		 2262 }
2263
2264 return NULL;
a9b0a04c
AG		 2265}
2266
15819a70 2267/* This function requires the caller holds hdev->lock */
51d167c0
MH		 2268struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2269 bdaddr_t *addr, u8 addr_type)
15819a70
AG		 2270{
2271 struct hci_conn_params *params;
2272
2273 params = hci_conn_params_lookup(hdev, addr, addr_type);
cef952ce 2274 if (params)
51d167c0 2275 return params;
15819a70
AG		 2276
2277 params = kzalloc(sizeof(*params), GFP_KERNEL);
2278 if (!params) {
2064ee33 2279 bt_dev_err(hdev, "out of memory");
51d167c0 2280 return NULL;
15819a70
AG		 2281 }
2282
2283 bacpy(&params->addr, addr);
2284 params->addr_type = addr_type;
cef952ce
AG		 2285
2286 list_add(&params->list, &hdev->le_conn_params);
93450c75 2287 INIT_LIST_HEAD(&params->action);
cef952ce 2288
bf5b3c8b
MH		 2289 params->conn_min_interval = hdev->le_conn_min_interval;
2290 params->conn_max_interval = hdev->le_conn_max_interval;
2291 params->conn_latency = hdev->le_conn_latency;
2292 params->supervision_timeout = hdev->le_supv_timeout;
2293 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2294
2295 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2296
51d167c0 2297 return params;
bf5b3c8b
MH		 2298}
2299
f6c63249 2300static void hci_conn_params_free(struct hci_conn_params *params)
15819a70 2301{
f8aaf9b6 2302 if (params->conn) {
f161dd41 2303 hci_conn_drop(params->conn);
f8aaf9b6
JH		 2304 hci_conn_put(params->conn);
2305 }
f161dd41 2306
95305baa 2307 list_del(&params->action);
15819a70
AG		 2308 list_del(&params->list);
2309 kfree(params);
f6c63249
JH		 2310}
2311
2312/* This function requires the caller holds hdev->lock */
2313void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2314{
2315 struct hci_conn_params *params;
2316
2317 params = hci_conn_params_lookup(hdev, addr, addr_type);
2318 if (!params)
2319 return;
2320
2321 hci_conn_params_free(params);
15819a70 2322
5bee2fd6 2323 hci_update_passive_scan(hdev);
95305baa 2324
15819a70
AG		 2325 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2326}
2327
2328/* This function requires the caller holds hdev->lock */
55af49a8 2329void hci_conn_params_clear_disabled(struct hci_dev *hdev)
15819a70
AG		 2330{
2331 struct hci_conn_params *params, *tmp;
2332
2333 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
55af49a8
JH		 2334 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2335 continue;
f75113a2 2336
91641b79 2337 /* If trying to establish one time connection to disabled
f75113a2
JP		 2338 * device, leave the params, but mark them as just once.
2339 */
2340 if (params->explicit_connect) {
2341 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2342 continue;
2343 }
2344
15819a70
AG		 2345 list_del(&params->list);
2346 kfree(params);
2347 }
2348
55af49a8 2349 BT_DBG("All LE disabled connection parameters were removed");
77a77a30
AG		 2350}
2351
2352/* This function requires the caller holds hdev->lock */
030e7f81 2353static void hci_conn_params_clear_all(struct hci_dev *hdev)
77a77a30 2354{
15819a70 2355 struct hci_conn_params *params, *tmp;
77a77a30 2356
f6c63249
JH		 2357 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2358 hci_conn_params_free(params);
77a77a30 2359
15819a70 2360 BT_DBG("All LE connection parameters were removed");
77a77a30
AG		 2361}
2362
a1f4c318
JH		 2363/* Copy the Identity Address of the controller.
2364 *
2365 * If the controller has a public BD_ADDR, then by default use that one.
2366 * If this is a LE only controller without a public address, default to
2367 * the static random address.
2368 *
2369 * For debugging purposes it is possible to force controllers with a
2370 * public address to use the static random address instead.
50b5b952
MH		 2371 *
2372 * In case BR/EDR has been disabled on a dual-mode controller and
2373 * userspace has configured a static address, then that address
2374 * becomes the identity address instead of the public BR/EDR address.
a1f4c318
JH		 2375 */
2376void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2377 u8 *bdaddr_type)
2378{
b7cb93e5 2379 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
50b5b952 2380 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
d7a5a11d 2381 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
50b5b952 2382 bacmp(&hdev->static_addr, BDADDR_ANY))) {
a1f4c318
JH		 2383 bacpy(bdaddr, &hdev->static_addr);
2384 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2385 } else {
2386 bacpy(bdaddr, &hdev->bdaddr);
2387 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
2388 }
2389}
2390
2f20216c
APS		 2391static void hci_clear_wake_reason(struct hci_dev *hdev)
2392{
2393 hci_dev_lock(hdev);
2394
2395 hdev->wake_reason = 0;
2396 bacpy(&hdev->wake_addr, BDADDR_ANY);
2397 hdev->wake_addr_type = 0;
2398
2399 hci_dev_unlock(hdev);
2400}
2401
9952d90e
APS		 2402static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
2403 void *data)
2404{
2405 struct hci_dev *hdev =
2406 container_of(nb, struct hci_dev, suspend_notifier);
2407 int ret = 0;
9952d90e 2408
4b8af331
APS		 2409 /* Userspace has full control of this device. Do nothing. */
2410 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2411 return NOTIFY_DONE;
2412
e1b77d68
LAD		 2413 if (action == PM_SUSPEND_PREPARE)
2414 ret = hci_suspend_dev(hdev);
2415 else if (action == PM_POST_SUSPEND)
2416 ret = hci_resume_dev(hdev);
2f20216c 2417
a9ec8423
APS		 2418 if (ret)
2419 bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
2420 action, ret);
2421
24b06572 2422 return NOTIFY_DONE;
9952d90e 2423}
8731840a 2424
9be0dab7 2425/* Alloc HCI device */
6ec56613 2426struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
9be0dab7
DH		 2427{
2428 struct hci_dev *hdev;
6ec56613 2429 unsigned int alloc_size;
9be0dab7 2430
6ec56613
THJA		 2431 alloc_size = sizeof(*hdev);
2432 if (sizeof_priv) {
2433 /* Fixme: May need ALIGN-ment? */
2434 alloc_size += sizeof_priv;
2435 }
9be0dab7 2436
6ec56613 2437 hdev = kzalloc(alloc_size, GFP_KERNEL);
9be0dab7
DH		 2438 if (!hdev)
2439 return NULL;
2440
b1b813d4
DH		 2441 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2442 hdev->esco_type = (ESCO_HV1);
2443 hdev->link_mode = (HCI_LM_ACCEPT);
b4cb9fb2
MH		 2444 hdev->num_iac = 0x01; /* One IAC support is mandatory */
2445 hdev->io_capability = 0x03; /* No Input No Output */
96c2103a 2446 hdev->manufacturer = 0xffff; /* Default to internal use */
bbaf444a
JH		 2447 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2448 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
d2609b34
FG		 2449 hdev->adv_instance_cnt = 0;
2450 hdev->cur_adv_instance = 0x00;
5d900e46 2451 hdev->adv_instance_timeout = 0;
b1b813d4 2452
c4f1f408
HC		 2453 hdev->advmon_allowlist_duration = 300;
2454 hdev->advmon_no_filter_duration = 500;
80af16a3 2455 hdev->enable_advmon_interleave_scan = 0x00; /* Default to disable */
c4f1f408 2456
b1b813d4
DH		 2457 hdev->sniff_max_interval = 800;
2458 hdev->sniff_min_interval = 80;
2459
3f959d46 2460 hdev->le_adv_channel_map = 0x07;
628531c9
GL		 2461 hdev->le_adv_min_interval = 0x0800;
2462 hdev->le_adv_max_interval = 0x0800;
bef64738
MH		 2463 hdev->le_scan_interval = 0x0060;
2464 hdev->le_scan_window = 0x0030;
10873f99
AM		 2465 hdev->le_scan_int_suspend = 0x0400;
2466 hdev->le_scan_window_suspend = 0x0012;
2467 hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT;
2468 hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN;
ba29d036
MH		 2469 hdev->le_scan_int_adv_monitor = 0x0060;
2470 hdev->le_scan_window_adv_monitor = 0x0030;
10873f99
AM		 2471 hdev->le_scan_int_connect = 0x0060;
2472 hdev->le_scan_window_connect = 0x0060;
b48c3b59
JH		 2473 hdev->le_conn_min_interval = 0x0018;
2474 hdev->le_conn_max_interval = 0x0028;
04fb7d90
MH		 2475 hdev->le_conn_latency = 0x0000;
2476 hdev->le_supv_timeout = 0x002a;
a8e1bfaa
MH		 2477 hdev->le_def_tx_len = 0x001b;
2478 hdev->le_def_tx_time = 0x0148;
2479 hdev->le_max_tx_len = 0x001b;
2480 hdev->le_max_tx_time = 0x0148;
2481 hdev->le_max_rx_len = 0x001b;
2482 hdev->le_max_rx_time = 0x0148;
30d65e08
MK		 2483 hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
2484 hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
6decb5b4
JK		 2485 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
2486 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
1d0fac2c 2487 hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
10873f99 2488 hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
49b020c1 2489 hdev->def_le_autoconnect_timeout = HCI_LE_AUTOCONN_TIMEOUT;
7c395ea5
DW		 2490 hdev->min_le_tx_power = HCI_TX_POWER_INVALID;
2491 hdev->max_le_tx_power = HCI_TX_POWER_INVALID;
bef64738 2492
d6bfd59c 2493 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
b9a7a61e 2494 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
31ad1691
AK		 2495 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
2496 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
302975cb 2497 hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
58a96fc3 2498 hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
d6bfd59c 2499
10873f99
AM		 2500 /* default 1.28 sec page scan */
2501 hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;
2502 hdev->def_page_scan_int = 0x0800;
2503 hdev->def_page_scan_window = 0x0012;
2504
b1b813d4
DH		 2505 mutex_init(&hdev->lock);
2506 mutex_init(&hdev->req_lock);
2507
b338d917 2508 INIT_LIST_HEAD(&hdev->mesh_pending);
b1b813d4 2509 INIT_LIST_HEAD(&hdev->mgmt_pending);
3d4f9c00
AP		 2510 INIT_LIST_HEAD(&hdev->reject_list);
2511 INIT_LIST_HEAD(&hdev->accept_list);
b1b813d4
DH		 2512 INIT_LIST_HEAD(&hdev->uuids);
2513 INIT_LIST_HEAD(&hdev->link_keys);
2514 INIT_LIST_HEAD(&hdev->long_term_keys);
970c4e46 2515 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
b1b813d4 2516 INIT_LIST_HEAD(&hdev->remote_oob_data);
3d4f9c00 2517 INIT_LIST_HEAD(&hdev->le_accept_list);
cfdb0c2d 2518 INIT_LIST_HEAD(&hdev->le_resolv_list);
15819a70 2519 INIT_LIST_HEAD(&hdev->le_conn_params);
77a77a30 2520 INIT_LIST_HEAD(&hdev->pend_le_conns);
66f8455a 2521 INIT_LIST_HEAD(&hdev->pend_le_reports);
6b536b5e 2522 INIT_LIST_HEAD(&hdev->conn_hash.list);
d2609b34 2523 INIT_LIST_HEAD(&hdev->adv_instances);
600a8749 2524 INIT_LIST_HEAD(&hdev->blocked_keys);
3368aa35 2525 INIT_LIST_HEAD(&hdev->monitored_devices);
b1b813d4 2526
8961987f 2527 INIT_LIST_HEAD(&hdev->local_codecs);
b1b813d4
DH		 2528 INIT_WORK(&hdev->rx_work, hci_rx_work);
2529 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2530 INIT_WORK(&hdev->tx_work, hci_tx_work);
2531 INIT_WORK(&hdev->power_on, hci_power_on);
c7741d16 2532 INIT_WORK(&hdev->error_reset, hci_error_reset);
b1b813d4 2533
6a98e383
MH		 2534 hci_cmd_sync_init(hdev);
2535
b1b813d4 2536 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
b1b813d4 2537
b1b813d4
DH		 2538 skb_queue_head_init(&hdev->rx_q);
2539 skb_queue_head_init(&hdev->cmd_q);
2540 skb_queue_head_init(&hdev->raw_q);
2541
2542 init_waitqueue_head(&hdev->req_wait_q);
2543
65cc2b49 2544 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
de75cd0d 2545 INIT_DELAYED_WORK(&hdev->ncmd_timer, hci_ncmd_timeout);
b1b813d4 2546
5fc16cc4
JH		 2547 hci_request_setup(hdev);
2548
b1b813d4
DH		 2549 hci_init_sysfs(hdev);
2550 discovery_init(hdev);
9be0dab7
DH		 2551
2552 return hdev;
2553}
6ec56613 2554EXPORT_SYMBOL(hci_alloc_dev_priv);
9be0dab7
DH		 2555
2556/* Free HCI device */
2557void hci_free_dev(struct hci_dev *hdev)
2558{
9be0dab7
DH		 2559 /* will free via device release */
2560 put_device(&hdev->dev);
2561}
2562EXPORT_SYMBOL(hci_free_dev);
2563
1da177e4
LT		 2564/* Register HCI device */
2565int hci_register_dev(struct hci_dev *hdev)
2566{
b1b813d4 2567 int id, error;
1da177e4 2568
74292d5a 2569 if (!hdev->open || !hdev->close || !hdev->send)
1da177e4
LT		 2570 return -EINVAL;
2571
08add513
MM		 2572 /* Do not allow HCI_AMP devices to register at index 0,
2573 * so the index can be used as the AMP controller ID.
2574 */
3df92b31 2575 switch (hdev->dev_type) {
ca8bee5d 2576 case HCI_PRIMARY:
103a2f32 2577 id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
3df92b31
SL		 2578 break;
2579 case HCI_AMP:
103a2f32 2580 id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
3df92b31
SL		 2581 break;
2582 default:
2583 return -EINVAL;
1da177e4 2584 }
8e87d142 2585
3df92b31
SL		 2586 if (id < 0)
2587 return id;
2588
103a2f32 2589 snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
1da177e4 2590 hdev->id = id;
2d8b3a11
AE		 2591
2592 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2593
29e2dd0d 2594 hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
33ca954d
DH		 2595 if (!hdev->workqueue) {
2596 error = -ENOMEM;
2597 goto err;
2598 }
f48fd9c8 2599
29e2dd0d
TH		 2600 hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
2601 hdev->name);
6ead1bbc
JH		 2602 if (!hdev->req_workqueue) {
2603 destroy_workqueue(hdev->workqueue);
2604 error = -ENOMEM;
2605 goto err;
2606 }
2607
0153e2ec
MH		 2608 if (!IS_ERR_OR_NULL(bt_debugfs))
2609 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
2610
bdc3e0f1
MH		 2611 dev_set_name(&hdev->dev, "%s", hdev->name);
2612
2613 error = device_add(&hdev->dev);
33ca954d 2614 if (error < 0)
54506918 2615 goto err_wqueue;
1da177e4 2616
6d5d2ee6
HK		 2617 hci_leds_init(hdev);
2618
611b30f7 2619 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 2620 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2621 hdev);
611b30f7
MH		 2622 if (hdev->rfkill) {
2623 if (rfkill_register(hdev->rfkill) < 0) {
2624 rfkill_destroy(hdev->rfkill);
2625 hdev->rfkill = NULL;
2626 }
2627 }
2628
5e130367 2629 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
a1536da2 2630 hci_dev_set_flag(hdev, HCI_RFKILLED);
5e130367 2631
a1536da2
MH		 2632 hci_dev_set_flag(hdev, HCI_SETUP);
2633 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
ce2be9ac 2634
ca8bee5d 2635 if (hdev->dev_type == HCI_PRIMARY) {
56f87901
JH		 2636 /* Assume BR/EDR support until proven otherwise (such as
2637 * through reading supported features during init.
2638 */
a1536da2 2639 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
56f87901 2640 }
ce2be9ac 2641
fcee3377
GP		 2642 write_lock(&hci_dev_list_lock);
2643 list_add(&hdev->list, &hci_dev_list);
2644 write_unlock(&hci_dev_list_lock);
2645
4a964404
MH		 2646 /* Devices that are marked for raw-only usage are unconfigured
2647 * and should not be included in normal operation.
fee746b0
MH		 2648 */
2649 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
a1536da2 2650 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
fee746b0 2651
fe92ee64
LAD		 2652 /* Mark Remote Wakeup connection flag as supported if driver has wakeup
2653 * callback.
2654 */
2655 if (hdev->wakeup)
e1cff700 2656 hdev->conn_flags |= HCI_CONN_FLAG_REMOTE_WAKEUP;
fe92ee64 2657
05fcd4c4 2658 hci_sock_dev_event(hdev, HCI_DEV_REG);
dc946bd8 2659 hci_dev_hold(hdev);
1da177e4 2660
91117864
DC		 2661 error = hci_register_suspend_notifier(hdev);
2662 if (error)
359ee4f8 2663 goto err_wqueue;
9952d90e 2664
19202573 2665 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 2666
e5e1e7fd 2667 idr_init(&hdev->adv_monitors_idr);
5031ffcc 2668 msft_register(hdev);
e5e1e7fd 2669
1da177e4 2670 return id;
f48fd9c8 2671
33ca954d 2672err_wqueue:
5a4bb6a8 2673 debugfs_remove_recursive(hdev->debugfs);
33ca954d 2674 destroy_workqueue(hdev->workqueue);
6ead1bbc 2675 destroy_workqueue(hdev->req_workqueue);
33ca954d 2676err:
3df92b31 2677 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 2678
33ca954d 2679 return error;
1da177e4
LT		 2680}
2681EXPORT_SYMBOL(hci_register_dev);
2682
2683/* Unregister HCI device */
59735631 2684void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 2685{
c13854ce 2686 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 2687
a1536da2 2688 hci_dev_set_flag(hdev, HCI_UNREGISTER);
94324962 2689
f20d09d5 2690 write_lock(&hci_dev_list_lock);
1da177e4 2691 list_del(&hdev->list);
f20d09d5 2692 write_unlock(&hci_dev_list_lock);
1da177e4 2693
e36bea6e
VV		 2694 cancel_work_sync(&hdev->power_on);
2695
6a98e383
MH		 2696 hci_cmd_sync_clear(hdev);
2697
359ee4f8 2698 hci_unregister_suspend_notifier(hdev);
4e8c36c3 2699
5031ffcc
MC		 2700 msft_unregister(hdev);
2701
4e8c36c3 2702 hci_dev_do_close(hdev);
9952d90e 2703
ab81cbf9 2704 if (!test_bit(HCI_INIT, &hdev->flags) &&
d7a5a11d
MH		 2705 !hci_dev_test_flag(hdev, HCI_SETUP) &&
2706 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
09fd0de5 2707 hci_dev_lock(hdev);
744cf19e 2708 mgmt_index_removed(hdev);
09fd0de5 2709 hci_dev_unlock(hdev);
56e5cb86 2710 }
ab81cbf9 2711
2e58ef3e
JH		 2712 /* mgmt_index_removed should take care of emptying the
2713 * pending list */
2714 BUG_ON(!list_empty(&hdev->mgmt_pending));
2715
05fcd4c4 2716 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
1da177e4 2717
611b30f7
MH		 2718 if (hdev->rfkill) {
2719 rfkill_unregister(hdev->rfkill);
2720 rfkill_destroy(hdev->rfkill);
2721 }
2722
bdc3e0f1 2723 device_del(&hdev->dev);
e61fbee7 2724 /* Actual cleanup is deferred until hci_release_dev(). */
e0448092
TH		 2725 hci_dev_put(hdev);
2726}
2727EXPORT_SYMBOL(hci_unregister_dev);
147e2d59 2728
58ce6d5b
TH		 2729/* Release HCI device */
2730void hci_release_dev(struct hci_dev *hdev)
e0448092 2731{
0153e2ec 2732 debugfs_remove_recursive(hdev->debugfs);
5177a838
MH		 2733 kfree_const(hdev->hw_info);
2734 kfree_const(hdev->fw_info);
0153e2ec 2735
f48fd9c8 2736 destroy_workqueue(hdev->workqueue);
6ead1bbc 2737 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 2738
09fd0de5 2739 hci_dev_lock(hdev);
3d4f9c00
AP		 2740 hci_bdaddr_list_clear(&hdev->reject_list);
2741 hci_bdaddr_list_clear(&hdev->accept_list);
2aeb9a1a 2742 hci_uuids_clear(hdev);
55ed8ca1 2743 hci_link_keys_clear(hdev);
b899efaf 2744 hci_smp_ltks_clear(hdev);
970c4e46 2745 hci_smp_irks_clear(hdev);
2763eda6 2746 hci_remote_oob_data_clear(hdev);
d2609b34 2747 hci_adv_instances_clear(hdev);
e5e1e7fd 2748 hci_adv_monitors_clear(hdev);
3d4f9c00 2749 hci_bdaddr_list_clear(&hdev->le_accept_list);
cfdb0c2d 2750 hci_bdaddr_list_clear(&hdev->le_resolv_list);
373110c5 2751 hci_conn_params_clear_all(hdev);
22078800 2752 hci_discovery_filter_clear(hdev);
600a8749 2753 hci_blocked_keys_clear(hdev);
09fd0de5 2754 hci_dev_unlock(hdev);
e2e0cacb 2755
e0448092 2756 ida_simple_remove(&hci_index_ida, hdev->id);
dd3b1dc3 2757 kfree_skb(hdev->sent_cmd);
dfe6d5c3 2758 kfree_skb(hdev->recv_event);
58ce6d5b 2759 kfree(hdev);
1da177e4 2760}
58ce6d5b 2761EXPORT_SYMBOL(hci_release_dev);
1da177e4 2762
359ee4f8
APS		 2763int hci_register_suspend_notifier(struct hci_dev *hdev)
2764{
2765 int ret = 0;
2766
2767 if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
2768 hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
2769 ret = register_pm_notifier(&hdev->suspend_notifier);
2770 }
2771
2772 return ret;
2773}
2774
2775int hci_unregister_suspend_notifier(struct hci_dev *hdev)
2776{
2777 int ret = 0;
2778
2779 if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks))
2780 ret = unregister_pm_notifier(&hdev->suspend_notifier);
2781
2782 return ret;
2783}
2784
1da177e4
LT		 2785/* Suspend HCI device */
2786int hci_suspend_dev(struct hci_dev *hdev)
2787{
e1b77d68 2788 int ret;
e1b77d68
LAD		 2789
2790 bt_dev_dbg(hdev, "");
2791
2792 /* Suspend should only act on when powered. */
2793 if (!hdev_is_powered(hdev) ||
2794 hci_dev_test_flag(hdev, HCI_UNREGISTER))
2795 return 0;
2796
182ee45d
LAD		 2797 /* If powering down don't attempt to suspend */
2798 if (mgmt_powering_down(hdev))
2799 return 0;
4539ca67 2800
182ee45d
LAD		 2801 hci_req_sync_lock(hdev);
2802 ret = hci_suspend_sync(hdev);
2803 hci_req_sync_unlock(hdev);
e1b77d68
LAD		 2804
2805 hci_clear_wake_reason(hdev);
182ee45d 2806 mgmt_suspending(hdev, hdev->suspend_state);
e1b77d68 2807
05fcd4c4 2808 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
e1b77d68 2809 return ret;
1da177e4
LT		 2810}
2811EXPORT_SYMBOL(hci_suspend_dev);
2812
2813/* Resume HCI device */
2814int hci_resume_dev(struct hci_dev *hdev)
2815{
e1b77d68
LAD		 2816 int ret;
2817
2818 bt_dev_dbg(hdev, "");
2819
2820 /* Resume should only act on when powered. */
2821 if (!hdev_is_powered(hdev) ||
2822 hci_dev_test_flag(hdev, HCI_UNREGISTER))
2823 return 0;
2824
2825 /* If powering down don't attempt to resume */
2826 if (mgmt_powering_down(hdev))
2827 return 0;
2828
182ee45d
LAD		 2829 hci_req_sync_lock(hdev);
2830 ret = hci_resume_sync(hdev);
2831 hci_req_sync_unlock(hdev);
e1b77d68
LAD		 2832
2833 mgmt_resuming(hdev, hdev->wake_reason, &hdev->wake_addr,
182ee45d 2834 hdev->wake_addr_type);
e1b77d68 2835
05fcd4c4 2836 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
e1b77d68 2837 return ret;
1da177e4
LT		 2838}
2839EXPORT_SYMBOL(hci_resume_dev);
2840
75e0569f
MH		 2841/* Reset HCI device */
2842int hci_reset_dev(struct hci_dev *hdev)
2843{
1e4b6e91 2844 static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
75e0569f
MH		 2845 struct sk_buff *skb;
2846
2847 skb = bt_skb_alloc(3, GFP_ATOMIC);
2848 if (!skb)
2849 return -ENOMEM;
2850
d79f34e3 2851 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
59ae1d12 2852 skb_put_data(skb, hw_err, 3);
75e0569f 2853
de75cd0d
MM		 2854 bt_dev_err(hdev, "Injecting HCI hardware error event");
2855
75e0569f
MH		 2856 /* Send Hardware Error to upper stack */
2857 return hci_recv_frame(hdev, skb);
2858}
2859EXPORT_SYMBOL(hci_reset_dev);
2860
76bca880 2861/* Receive frame from HCI drivers */
e1a26170 2862int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
76bca880 2863{
76bca880 2864 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 2865 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 2866 kfree_skb(skb);
2867 return -ENXIO;
2868 }
2869
d79f34e3
MH		 2870 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
2871 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
cc974003
MH		 2872 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
2873 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) {
fe806dce
MH		 2874 kfree_skb(skb);
2875 return -EINVAL;
2876 }
2877
d82603c6 2878 /* Incoming skb */
76bca880
MH		 2879 bt_cb(skb)->incoming = 1;
2880
2881 /* Time stamp */
2882 __net_timestamp(skb);
2883
76bca880 2884 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 2885 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 2886
76bca880
MH		 2887 return 0;
2888}
2889EXPORT_SYMBOL(hci_recv_frame);
2890
e875ff84
MH		 2891/* Receive diagnostic message from HCI drivers */
2892int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
2893{
581d6fd6 2894 /* Mark as diagnostic packet */
d79f34e3 2895 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
581d6fd6 2896
e875ff84
MH		 2897 /* Time stamp */
2898 __net_timestamp(skb);
2899
581d6fd6
MH		 2900 skb_queue_tail(&hdev->rx_q, skb);
2901 queue_work(hdev->workqueue, &hdev->rx_work);
e875ff84 2902
e875ff84
MH		 2903 return 0;
2904}
2905EXPORT_SYMBOL(hci_recv_diag);
2906
5177a838
MH		 2907void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
2908{
2909 va_list vargs;
2910
2911 va_start(vargs, fmt);
2912 kfree_const(hdev->hw_info);
2913 hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2914 va_end(vargs);
2915}
2916EXPORT_SYMBOL(hci_set_hw_info);
2917
2918void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
2919{
2920 va_list vargs;
2921
2922 va_start(vargs, fmt);
2923 kfree_const(hdev->fw_info);
2924 hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2925 va_end(vargs);
2926}
2927EXPORT_SYMBOL(hci_set_fw_info);
2928
1da177e4
LT		 2929/* ---- Interface to upper protocols ---- */
2930
1da177e4
LT		 2931int hci_register_cb(struct hci_cb *cb)
2932{
2933 BT_DBG("%p name %s", cb, cb->name);
2934
fba7ecf0 2935 mutex_lock(&hci_cb_list_lock);
00629e0f 2936 list_add_tail(&cb->list, &hci_cb_list);
fba7ecf0 2937 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 2938
2939 return 0;
2940}
2941EXPORT_SYMBOL(hci_register_cb);
2942
2943int hci_unregister_cb(struct hci_cb *cb)
2944{
2945 BT_DBG("%p name %s", cb, cb->name);
2946
fba7ecf0 2947 mutex_lock(&hci_cb_list_lock);
1da177e4 2948 list_del(&cb->list);
fba7ecf0 2949 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 2950
2951 return 0;
2952}
2953EXPORT_SYMBOL(hci_unregister_cb);
2954
2250abad 2955static int hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2956{
cdc52faa
MH		 2957 int err;
2958
d79f34e3
MH		 2959 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
2960 skb->len);
1da177e4 2961
cd82e61c
MH		 2962 /* Time stamp */
2963 __net_timestamp(skb);
1da177e4 2964
cd82e61c
MH		 2965 /* Send copy to monitor */
2966 hci_send_to_monitor(hdev, skb);
2967
2968 if (atomic_read(&hdev->promisc)) {
2969 /* Send copy to the sockets */
470fe1b5 2970 hci_send_to_sock(hdev, skb);
1da177e4
LT		 2971 }
2972
2973 /* Get rid of skb owner, prior to sending to the driver. */
2974 skb_orphan(skb);
2975
73d0d3c8
MH		 2976 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
2977 kfree_skb(skb);
2250abad 2978 return -EINVAL;
73d0d3c8
MH		 2979 }
2980
cdc52faa
MH		 2981 err = hdev->send(hdev, skb);
2982 if (err < 0) {
2064ee33 2983 bt_dev_err(hdev, "sending frame failed (%d)", err);
cdc52faa 2984 kfree_skb(skb);
2250abad 2985 return err;
cdc52faa 2986 }
2250abad
BB		 2987
2988 return 0;
1da177e4
LT		 2989}
2990
1ca3a9d0 2991/* Send HCI command */
07dc93dd
JH		 2992int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
2993 const void *param)
1ca3a9d0
JH		 2994{
2995 struct sk_buff *skb;
2996
2997 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2998
2999 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3000 if (!skb) {
2064ee33 3001 bt_dev_err(hdev, "no memory for command");
1ca3a9d0
JH		 3002 return -ENOMEM;
3003 }
3004
49c922bb 3005 /* Stand-alone HCI commands must be flagged as
11714b3d
JH		 3006 * single-command requests.
3007 */
44d27137 3008 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
11714b3d 3009
1da177e4 3010 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 3011 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3012
3013 return 0;
3014}
1da177e4 3015
d6ee6ad7
LP		 3016int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
3017 const void *param)
3018{
3019 struct sk_buff *skb;
3020
3021 if (hci_opcode_ogf(opcode) != 0x3f) {
3022 /* A controller receiving a command shall respond with either
3023 * a Command Status Event or a Command Complete Event.
3024 * Therefore, all standard HCI commands must be sent via the
3025 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
3026 * Some vendors do not comply with this rule for vendor-specific
3027 * commands and do not return any event. We want to support
3028 * unresponded commands for such cases only.
3029 */
3030 bt_dev_err(hdev, "unresponded command not supported");
3031 return -EINVAL;
3032 }
3033
3034 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3035 if (!skb) {
3036 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
3037 opcode);
3038 return -ENOMEM;
3039 }
3040
3041 hci_send_frame(hdev, skb);
3042
3043 return 0;
3044}
3045EXPORT_SYMBOL(__hci_cmd_send);
3046
1da177e4 3047/* Get data from the previously sent command */
a9de9248 3048void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 3049{
3050 struct hci_command_hdr *hdr;
3051
3052 if (!hdev->sent_cmd)
3053 return NULL;
3054
3055 hdr = (void *) hdev->sent_cmd->data;
3056
a9de9248 3057 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 3058 return NULL;
3059
f0e09510 3060 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 3061
3062 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3063}
3064
dfe6d5c3
LAD		 3065/* Get data from last received event */
3066void *hci_recv_event_data(struct hci_dev *hdev, __u8 event)
3067{
3068 struct hci_event_hdr *hdr;
3069 int offset;
3070
3071 if (!hdev->recv_event)
3072 return NULL;
3073
3074 hdr = (void *)hdev->recv_event->data;
3075 offset = sizeof(*hdr);
3076
3077 if (hdr->evt != event) {
3078 /* In case of LE metaevent check the subevent match */
3079 if (hdr->evt == HCI_EV_LE_META) {
3080 struct hci_ev_le_meta *ev;
3081
3082 ev = (void *)hdev->recv_event->data + offset;
3083 offset += sizeof(*ev);
3084 if (ev->subevent == event)
3085 goto found;
3086 }
3087 return NULL;
3088 }
3089
3090found:
3091 bt_dev_dbg(hdev, "event 0x%2.2x", event);
3092
3093 return hdev->recv_event->data + offset;
3094}
3095
1da177e4
LT		 3096/* Send ACL data */
3097static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3098{
3099 struct hci_acl_hdr *hdr;
3100 int len = skb->len;
3101
badff6d0
ACM		 3102 skb_push(skb, HCI_ACL_HDR_SIZE);
3103 skb_reset_transport_header(skb);
9c70220b 3104 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 3105 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3106 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 3107}
3108
ee22be7e 3109static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 3110 struct sk_buff *skb, __u16 flags)
1da177e4 3111{
ee22be7e 3112 struct hci_conn *conn = chan->conn;
1da177e4
LT		 3113 struct hci_dev *hdev = conn->hdev;
3114 struct sk_buff *list;
3115
087bfd99
GP		 3116 skb->len = skb_headlen(skb);
3117 skb->data_len = 0;
3118
d79f34e3 3119 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
204a6e54
AE		 3120
3121 switch (hdev->dev_type) {
ca8bee5d 3122 case HCI_PRIMARY:
204a6e54
AE		 3123 hci_add_acl_hdr(skb, conn->handle, flags);
3124 break;
3125 case HCI_AMP:
3126 hci_add_acl_hdr(skb, chan->handle, flags);
3127 break;
3128 default:
2064ee33 3129 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
204a6e54
AE		 3130 return;
3131 }
087bfd99 3132
70f23020
AE		 3133 list = skb_shinfo(skb)->frag_list;
3134 if (!list) {
1da177e4
LT		 3135 /* Non fragmented */
3136 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3137
73d80deb 3138 skb_queue_tail(queue, skb);
1da177e4
LT		 3139 } else {
3140 /* Fragmented */
3141 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3142
3143 skb_shinfo(skb)->frag_list = NULL;
3144
9cfd5a23
JR		 3145 /* Queue all fragments atomically. We need to use spin_lock_bh
3146 * here because of 6LoWPAN links, as there this function is
3147 * called from softirq and using normal spin lock could cause
3148 * deadlocks.
3149 */
3150 spin_lock_bh(&queue->lock);
1da177e4 3151
73d80deb 3152 __skb_queue_tail(queue, skb);
e702112f
AE		 3153
3154 flags &= ~ACL_START;
3155 flags |= ACL_CONT;
1da177e4
LT		 3156 do {
3157 skb = list; list = list->next;
8e87d142 3158
d79f34e3 3159 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
e702112f 3160 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 3161
3162 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3163
73d80deb 3164 __skb_queue_tail(queue, skb);
1da177e4
LT		 3165 } while (list);
3166
9cfd5a23 3167 spin_unlock_bh(&queue->lock);
1da177e4 3168 }
73d80deb
LAD		 3169}
3170
3171void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3172{
ee22be7e 3173 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 3174
f0e09510 3175 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb 3176
ee22be7e 3177 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 3178
3eff45ea 3179 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3180}
1da177e4
LT		 3181
3182/* Send SCO data */
0d861d8b 3183void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 3184{
3185 struct hci_dev *hdev = conn->hdev;
3186 struct hci_sco_hdr hdr;
3187
3188 BT_DBG("%s len %d", hdev->name, skb->len);
3189
aca3192c 3190 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 3191 hdr.dlen = skb->len;
3192
badff6d0
ACM		 3193 skb_push(skb, HCI_SCO_HDR_SIZE);
3194 skb_reset_transport_header(skb);
9c70220b 3195 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4 3196
d79f34e3 3197 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
c78ae283 3198
1da177e4 3199 skb_queue_tail(&conn->data_q, skb);
3eff45ea 3200 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3201}
1da177e4 3202
26afbd82
LAD		 3203/* Send ISO data */
3204static void hci_add_iso_hdr(struct sk_buff *skb, __u16 handle, __u8 flags)
3205{
3206 struct hci_iso_hdr *hdr;
3207 int len = skb->len;
3208
3209 skb_push(skb, HCI_ISO_HDR_SIZE);
3210 skb_reset_transport_header(skb);
3211 hdr = (struct hci_iso_hdr *)skb_transport_header(skb);
3212 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3213 hdr->dlen = cpu_to_le16(len);
3214}
3215
3216static void hci_queue_iso(struct hci_conn *conn, struct sk_buff_head *queue,
3217 struct sk_buff *skb)
3218{
3219 struct hci_dev *hdev = conn->hdev;
3220 struct sk_buff *list;
3221 __u16 flags;
3222
3223 skb->len = skb_headlen(skb);
3224 skb->data_len = 0;
3225
3226 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3227
3228 list = skb_shinfo(skb)->frag_list;
3229
3230 flags = hci_iso_flags_pack(list ? ISO_START : ISO_SINGLE, 0x00);
3231 hci_add_iso_hdr(skb, conn->handle, flags);
3232
3233 if (!list) {
3234 /* Non fragmented */
3235 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3236
3237 skb_queue_tail(queue, skb);
3238 } else {
3239 /* Fragmented */
3240 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3241
3242 skb_shinfo(skb)->frag_list = NULL;
3243
3244 __skb_queue_tail(queue, skb);
3245
3246 do {
3247 skb = list; list = list->next;
3248
3249 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3250 flags = hci_iso_flags_pack(list ? ISO_CONT : ISO_END,
3251 0x00);
3252 hci_add_iso_hdr(skb, conn->handle, flags);
3253
3254 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3255
3256 __skb_queue_tail(queue, skb);
3257 } while (list);
3258 }
3259}
3260
3261void hci_send_iso(struct hci_conn *conn, struct sk_buff *skb)
3262{
3263 struct hci_dev *hdev = conn->hdev;
3264
3265 BT_DBG("%s len %d", hdev->name, skb->len);
3266
3267 hci_queue_iso(conn, &conn->data_q, skb);
3268
3269 queue_work(hdev->workqueue, &hdev->tx_work);
3270}
3271
1da177e4
LT		 3272/* ---- HCI TX task (outgoing data) ---- */
3273
3274/* HCI Connection scheduler */
26afbd82
LAD		 3275static inline void hci_quote_sent(struct hci_conn *conn, int num, int *quote)
3276{
3277 struct hci_dev *hdev;
3278 int cnt, q;
3279
3280 if (!conn) {
3281 *quote = 0;
3282 return;
3283 }
3284
3285 hdev = conn->hdev;
3286
3287 switch (conn->type) {
3288 case ACL_LINK:
3289 cnt = hdev->acl_cnt;
3290 break;
3291 case AMP_LINK:
3292 cnt = hdev->block_cnt;
3293 break;
3294 case SCO_LINK:
3295 case ESCO_LINK:
3296 cnt = hdev->sco_cnt;
3297 break;
3298 case LE_LINK:
3299 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3300 break;
3301 case ISO_LINK:
3302 cnt = hdev->iso_mtu ? hdev->iso_cnt :
3303 hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3304 break;
3305 default:
3306 cnt = 0;
3307 bt_dev_err(hdev, "unknown link type %d", conn->type);
3308 }
3309
3310 q = cnt / num;
3311 *quote = q ? q : 1;
3312}
3313
6039aa73
GP		 3314static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3315 int *quote)
1da177e4
LT		 3316{
3317 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3318 struct hci_conn *conn = NULL, *c;
abc5de8f 3319 unsigned int num = 0, min = ~0;
1da177e4 3320
8e87d142 3321 /* We don't have to lock device here. Connections are always
1da177e4 3322 * added and removed with TX task disabled. */
bf4c6325
GP		 3323
3324 rcu_read_lock();
3325
3326 list_for_each_entry_rcu(c, &h->list, list) {
769be974 3327 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 3328 continue;
769be974
MH		 3329
3330 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3331 continue;
3332
1da177e4
LT		 3333 num++;
3334
3335 if (c->sent < min) {
3336 min = c->sent;
3337 conn = c;
3338 }
52087a79
LAD		 3339
3340 if (hci_conn_num(hdev, type) == num)
3341 break;
1da177e4
LT		 3342 }
3343
bf4c6325
GP		 3344 rcu_read_unlock();
3345
26afbd82 3346 hci_quote_sent(conn, num, quote);
1da177e4
LT		 3347
3348 BT_DBG("conn %p quote %d", conn, *quote);
3349 return conn;
3350}
3351
6039aa73 3352static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 3353{
3354 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3355 struct hci_conn *c;
1da177e4 3356
2064ee33 3357 bt_dev_err(hdev, "link tx timeout");
1da177e4 3358
bf4c6325
GP		 3359 rcu_read_lock();
3360
1da177e4 3361 /* Kill stalled connections */
bf4c6325 3362 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 3363 if (c->type == type && c->sent) {
2064ee33
MH		 3364 bt_dev_err(hdev, "killing stalled connection %pMR",
3365 &c->dst);
bed71748 3366 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 3367 }
3368 }
bf4c6325
GP		 3369
3370 rcu_read_unlock();
1da177e4
LT		 3371}
3372
6039aa73
GP		 3373static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3374 int *quote)
1da177e4 3375{
73d80deb
LAD		 3376 struct hci_conn_hash *h = &hdev->conn_hash;
3377 struct hci_chan *chan = NULL;
abc5de8f 3378 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 3379 struct hci_conn *conn;
26afbd82 3380 int conn_num = 0;
73d80deb
LAD		 3381
3382 BT_DBG("%s", hdev->name);
3383
bf4c6325
GP		 3384 rcu_read_lock();
3385
3386 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 3387 struct hci_chan *tmp;
3388
3389 if (conn->type != type)
3390 continue;
3391
3392 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3393 continue;
3394
3395 conn_num++;
3396
8192edef 3397 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 3398 struct sk_buff *skb;
3399
3400 if (skb_queue_empty(&tmp->data_q))
3401 continue;
3402
3403 skb = skb_peek(&tmp->data_q);
3404 if (skb->priority < cur_prio)
3405 continue;
3406
3407 if (skb->priority > cur_prio) {
3408 num = 0;
3409 min = ~0;
3410 cur_prio = skb->priority;
3411 }
3412
3413 num++;
3414
3415 if (conn->sent < min) {
3416 min = conn->sent;
3417 chan = tmp;
3418 }
3419 }
3420
3421 if (hci_conn_num(hdev, type) == conn_num)
3422 break;
3423 }
3424
bf4c6325
GP		 3425 rcu_read_unlock();
3426
73d80deb
LAD		 3427 if (!chan)
3428 return NULL;
3429
26afbd82 3430 hci_quote_sent(chan->conn, num, quote);
73d80deb 3431
73d80deb
LAD		 3432 BT_DBG("chan %p quote %d", chan, *quote);
3433 return chan;
3434}
3435
02b20f0b
LAD		 3436static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3437{
3438 struct hci_conn_hash *h = &hdev->conn_hash;
3439 struct hci_conn *conn;
3440 int num = 0;
3441
3442 BT_DBG("%s", hdev->name);
3443
bf4c6325
GP		 3444 rcu_read_lock();
3445
3446 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 3447 struct hci_chan *chan;
3448
3449 if (conn->type != type)
3450 continue;
3451
3452 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3453 continue;
3454
3455 num++;
3456
8192edef 3457 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 3458 struct sk_buff *skb;
3459
3460 if (chan->sent) {
3461 chan->sent = 0;
3462 continue;
3463 }
3464
3465 if (skb_queue_empty(&chan->data_q))
3466 continue;
3467
3468 skb = skb_peek(&chan->data_q);
3469 if (skb->priority >= HCI_PRIO_MAX - 1)
3470 continue;
3471
3472 skb->priority = HCI_PRIO_MAX - 1;
3473
3474 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 3475 skb->priority);
02b20f0b
LAD		 3476 }
3477
3478 if (hci_conn_num(hdev, type) == num)
3479 break;
3480 }
bf4c6325
GP		 3481
3482 rcu_read_unlock();
3483
02b20f0b
LAD		 3484}
3485
b71d385a
AE		 3486static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3487{
3488 /* Calculate count of blocks used by this packet */
3489 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3490}
3491
116523c8 3492static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type)
73d80deb 3493{
116523c8
LAD		 3494 unsigned long last_tx;
3495
3496 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
3497 return;
3498
3499 switch (type) {
3500 case LE_LINK:
3501 last_tx = hdev->le_last_tx;
3502 break;
3503 default:
3504 last_tx = hdev->acl_last_tx;
3505 break;
1da177e4 3506 }
116523c8
LAD		 3507
3508 /* tx timeout must be longer than maximum link supervision timeout
3509 * (40.9 seconds)
3510 */
3511 if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT))
3512 hci_link_tx_to(hdev, type);
63d2bc1b 3513}
1da177e4 3514
7fedd3bb
APS		 3515/* Schedule SCO */
3516static void hci_sched_sco(struct hci_dev *hdev)
3517{
3518 struct hci_conn *conn;
3519 struct sk_buff *skb;
3520 int quote;
3521
3522 BT_DBG("%s", hdev->name);
3523
3524 if (!hci_conn_num(hdev, SCO_LINK))
3525 return;
3526
3527 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3528 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3529 BT_DBG("skb %p len %d", skb, skb->len);
3530 hci_send_frame(hdev, skb);
3531
3532 conn->sent++;
3533 if (conn->sent == ~0)
3534 conn->sent = 0;
3535 }
3536 }
3537}
3538
3539static void hci_sched_esco(struct hci_dev *hdev)
3540{
3541 struct hci_conn *conn;
3542 struct sk_buff *skb;
3543 int quote;
3544
3545 BT_DBG("%s", hdev->name);
3546
3547 if (!hci_conn_num(hdev, ESCO_LINK))
3548 return;
3549
3550 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3551 &quote))) {
3552 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3553 BT_DBG("skb %p len %d", skb, skb->len);
3554 hci_send_frame(hdev, skb);
3555
3556 conn->sent++;
3557 if (conn->sent == ~0)
3558 conn->sent = 0;
3559 }
3560 }
3561}
3562
6039aa73 3563static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 3564{
3565 unsigned int cnt = hdev->acl_cnt;
3566 struct hci_chan *chan;
3567 struct sk_buff *skb;
3568 int quote;
3569
116523c8 3570 __check_timeout(hdev, cnt, ACL_LINK);
04837f64 3571
73d80deb 3572 while (hdev->acl_cnt &&
a8c5fb1a 3573 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 3574 u32 priority = (skb_peek(&chan->data_q))->priority;
3575 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3576 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3577 skb->len, skb->priority);
73d80deb 3578
ec1cce24
LAD		 3579 /* Stop if priority has changed */
3580 if (skb->priority < priority)
3581 break;
3582
3583 skb = skb_dequeue(&chan->data_q);
3584
73d80deb 3585 hci_conn_enter_active_mode(chan->conn,
04124681 3586 bt_cb(skb)->force_active);
04837f64 3587
57d17d70 3588 hci_send_frame(hdev, skb);
1da177e4
LT		 3589 hdev->acl_last_tx = jiffies;
3590
3591 hdev->acl_cnt--;
73d80deb
LAD		 3592 chan->sent++;
3593 chan->conn->sent++;
7fedd3bb
APS		 3594
3595 /* Send pending SCO packets right away */
3596 hci_sched_sco(hdev);
3597 hci_sched_esco(hdev);
1da177e4
LT		 3598 }
3599 }
02b20f0b
LAD		 3600
3601 if (cnt != hdev->acl_cnt)
3602 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 3603}
3604
6039aa73 3605static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 3606{
63d2bc1b 3607 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 3608 struct hci_chan *chan;
3609 struct sk_buff *skb;
3610 int quote;
bd1eb66b 3611 u8 type;
b71d385a 3612
bd1eb66b
AE		 3613 BT_DBG("%s", hdev->name);
3614
3615 if (hdev->dev_type == HCI_AMP)
3616 type = AMP_LINK;
3617 else
3618 type = ACL_LINK;
3619
116523c8
LAD		 3620 __check_timeout(hdev, cnt, type);
3621
b71d385a 3622 while (hdev->block_cnt > 0 &&
bd1eb66b 3623 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 3624 u32 priority = (skb_peek(&chan->data_q))->priority;
3625 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3626 int blocks;
3627
3628 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3629 skb->len, skb->priority);
b71d385a
AE		 3630
3631 /* Stop if priority has changed */
3632 if (skb->priority < priority)
3633 break;
3634
3635 skb = skb_dequeue(&chan->data_q);
3636
3637 blocks = __get_blocks(hdev, skb);
3638 if (blocks > hdev->block_cnt)
3639 return;
3640
3641 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 3642 bt_cb(skb)->force_active);
b71d385a 3643
57d17d70 3644 hci_send_frame(hdev, skb);
b71d385a
AE		 3645 hdev->acl_last_tx = jiffies;
3646
3647 hdev->block_cnt -= blocks;
3648 quote -= blocks;
3649
3650 chan->sent += blocks;
3651 chan->conn->sent += blocks;
3652 }
3653 }
3654
3655 if (cnt != hdev->block_cnt)
bd1eb66b 3656 hci_prio_recalculate(hdev, type);
b71d385a
AE		 3657}
3658
6039aa73 3659static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 3660{
3661 BT_DBG("%s", hdev->name);
3662
bd1eb66b 3663 /* No ACL link over BR/EDR controller */
ca8bee5d 3664 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
bd1eb66b
AE		 3665 return;
3666
3667 /* No AMP link over AMP controller */
3668 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 3669 return;
3670
3671 switch (hdev->flow_ctl_mode) {
3672 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3673 hci_sched_acl_pkt(hdev);
3674 break;
3675
3676 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3677 hci_sched_acl_blk(hdev);
3678 break;
3679 }
3680}
3681
6039aa73 3682static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 3683{
73d80deb 3684 struct hci_chan *chan;
6ed58ec5 3685 struct sk_buff *skb;
02b20f0b 3686 int quote, cnt, tmp;
6ed58ec5
VT		 3687
3688 BT_DBG("%s", hdev->name);
3689
52087a79
LAD		 3690 if (!hci_conn_num(hdev, LE_LINK))
3691 return;
3692
6ed58ec5 3693 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
1b1d29e5 3694
116523c8 3695 __check_timeout(hdev, cnt, LE_LINK);
1b1d29e5 3696
02b20f0b 3697 tmp = cnt;
73d80deb 3698 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 3699 u32 priority = (skb_peek(&chan->data_q))->priority;
3700 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3701 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3702 skb->len, skb->priority);
6ed58ec5 3703
ec1cce24
LAD		 3704 /* Stop if priority has changed */
3705 if (skb->priority < priority)
3706 break;
3707
3708 skb = skb_dequeue(&chan->data_q);
3709
57d17d70 3710 hci_send_frame(hdev, skb);
6ed58ec5
VT		 3711 hdev->le_last_tx = jiffies;
3712
3713 cnt--;
73d80deb
LAD		 3714 chan->sent++;
3715 chan->conn->sent++;
7fedd3bb
APS		 3716
3717 /* Send pending SCO packets right away */
3718 hci_sched_sco(hdev);
3719 hci_sched_esco(hdev);
6ed58ec5
VT		 3720 }
3721 }
73d80deb 3722
6ed58ec5
VT		 3723 if (hdev->le_pkts)
3724 hdev->le_cnt = cnt;
3725 else
3726 hdev->acl_cnt = cnt;
02b20f0b
LAD		 3727
3728 if (cnt != tmp)
3729 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 3730}
3731
26afbd82
LAD		 3732/* Schedule CIS */
3733static void hci_sched_iso(struct hci_dev *hdev)
3734{
3735 struct hci_conn *conn;
3736 struct sk_buff *skb;
3737 int quote, *cnt;
3738
3739 BT_DBG("%s", hdev->name);
3740
3741 if (!hci_conn_num(hdev, ISO_LINK))
3742 return;
3743
3744 cnt = hdev->iso_pkts ? &hdev->iso_cnt :
3745 hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
3746 while (*cnt && (conn = hci_low_sent(hdev, ISO_LINK, &quote))) {
3747 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3748 BT_DBG("skb %p len %d", skb, skb->len);
3749 hci_send_frame(hdev, skb);
3750
3751 conn->sent++;
3752 if (conn->sent == ~0)
3753 conn->sent = 0;
3754 (*cnt)--;
3755 }
3756 }
3757}
3758
3eff45ea 3759static void hci_tx_work(struct work_struct *work)
1da177e4 3760{
3eff45ea 3761 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 3762 struct sk_buff *skb;
3763
26afbd82
LAD		 3764 BT_DBG("%s acl %d sco %d le %d iso %d", hdev->name, hdev->acl_cnt,
3765 hdev->sco_cnt, hdev->le_cnt, hdev->iso_cnt);
1da177e4 3766
d7a5a11d 3767 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
52de599e 3768 /* Schedule queues and send stuff to HCI driver */
52de599e
MH		 3769 hci_sched_sco(hdev);
3770 hci_sched_esco(hdev);
26afbd82 3771 hci_sched_iso(hdev);
7fedd3bb 3772 hci_sched_acl(hdev);
52de599e
MH		 3773 hci_sched_le(hdev);
3774 }
6ed58ec5 3775
1da177e4
LT		 3776 /* Send next queued raw (unknown type) packet */
3777 while ((skb = skb_dequeue(&hdev->raw_q)))
57d17d70 3778 hci_send_frame(hdev, skb);
1da177e4
LT		 3779}
3780
25985edc 3781/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 3782
3783/* ACL data packet */
6039aa73 3784static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3785{
3786 struct hci_acl_hdr *hdr = (void *) skb->data;
3787 struct hci_conn *conn;
3788 __u16 handle, flags;
3789
3790 skb_pull(skb, HCI_ACL_HDR_SIZE);
3791
3792 handle = __le16_to_cpu(hdr->handle);
3793 flags = hci_flags(handle);
3794 handle = hci_handle(handle);
3795
f0e09510 3796 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 3797 handle, flags);
1da177e4
LT		 3798
3799 hdev->stat.acl_rx++;
3800
3801 hci_dev_lock(hdev);
3802 conn = hci_conn_hash_lookup_handle(hdev, handle);
3803 hci_dev_unlock(hdev);
8e87d142 3804
1da177e4 3805 if (conn) {
65983fc7 3806 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 3807
1da177e4 3808 /* Send to upper protocol */
686ebf28
UF		 3809 l2cap_recv_acldata(conn, skb, flags);
3810 return;
1da177e4 3811 } else {
2064ee33
MH		 3812 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
3813 handle);
1da177e4
LT		 3814 }
3815
3816 kfree_skb(skb);
3817}
3818
3819/* SCO data packet */
6039aa73 3820static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3821{
3822 struct hci_sco_hdr *hdr = (void *) skb->data;
3823 struct hci_conn *conn;
debdedf2 3824 __u16 handle, flags;
1da177e4
LT		 3825
3826 skb_pull(skb, HCI_SCO_HDR_SIZE);
3827
3828 handle = __le16_to_cpu(hdr->handle);
debdedf2
MH		 3829 flags = hci_flags(handle);
3830 handle = hci_handle(handle);
1da177e4 3831
debdedf2
MH		 3832 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
3833 handle, flags);
1da177e4
LT		 3834
3835 hdev->stat.sco_rx++;
3836
3837 hci_dev_lock(hdev);
3838 conn = hci_conn_hash_lookup_handle(hdev, handle);
3839 hci_dev_unlock(hdev);
3840
3841 if (conn) {
1da177e4 3842 /* Send to upper protocol */
00398e1d 3843 bt_cb(skb)->sco.pkt_status = flags & 0x03;
686ebf28
UF		 3844 sco_recv_scodata(conn, skb);
3845 return;
1da177e4 3846 } else {
2d4b37b6
LAD		 3847 bt_dev_err_ratelimited(hdev, "SCO packet for unknown connection handle %d",
3848 handle);
1da177e4
LT		 3849 }
3850
3851 kfree_skb(skb);
3852}
3853
26afbd82
LAD		 3854static void hci_isodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3855{
3856 struct hci_iso_hdr *hdr;
3857 struct hci_conn *conn;
3858 __u16 handle, flags;
3859
3860 hdr = skb_pull_data(skb, sizeof(*hdr));
3861 if (!hdr) {
3862 bt_dev_err(hdev, "ISO packet too small");
3863 goto drop;
3864 }
3865
3866 handle = __le16_to_cpu(hdr->handle);
3867 flags = hci_flags(handle);
3868 handle = hci_handle(handle);
3869
3870 bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
3871 handle, flags);
3872
3873 hci_dev_lock(hdev);
3874 conn = hci_conn_hash_lookup_handle(hdev, handle);
3875 hci_dev_unlock(hdev);
3876
26afbd82
LAD		 3877 if (!conn) {
3878 bt_dev_err(hdev, "ISO packet for unknown connection handle %d",
3879 handle);
ccf74f23 3880 goto drop;
26afbd82
LAD		 3881 }
3882
ccf74f23
LAD		 3883 /* Send to upper protocol */
3884 iso_recv(conn, skb, flags);
3885 return;
3886
26afbd82
LAD		 3887drop:
3888 kfree_skb(skb);
3889}
3890
9238f36a
JH		 3891static bool hci_req_is_complete(struct hci_dev *hdev)
3892{
3893 struct sk_buff *skb;
3894
3895 skb = skb_peek(&hdev->cmd_q);
3896 if (!skb)
3897 return true;
3898
44d27137 3899 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
9238f36a
JH		 3900}
3901
42c6b129
JH		 3902static void hci_resend_last(struct hci_dev *hdev)
3903{
3904 struct hci_command_hdr *sent;
3905 struct sk_buff *skb;
3906 u16 opcode;
3907
3908 if (!hdev->sent_cmd)
3909 return;
3910
3911 sent = (void *) hdev->sent_cmd->data;
3912 opcode = __le16_to_cpu(sent->opcode);
3913 if (opcode == HCI_OP_RESET)
3914 return;
3915
3916 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3917 if (!skb)
3918 return;
3919
3920 skb_queue_head(&hdev->cmd_q, skb);
3921 queue_work(hdev->workqueue, &hdev->cmd_work);
3922}
3923
e6214487
JH		 3924void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
3925 hci_req_complete_t *req_complete,
3926 hci_req_complete_skb_t *req_complete_skb)
9238f36a 3927{
9238f36a
JH		 3928 struct sk_buff *skb;
3929 unsigned long flags;
3930
3931 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3932
42c6b129
JH		 3933 /* If the completed command doesn't match the last one that was
3934 * sent we need to do special handling of it.
9238f36a 3935 */
42c6b129
JH		 3936 if (!hci_sent_cmd_data(hdev, opcode)) {
3937 /* Some CSR based controllers generate a spontaneous
3938 * reset complete event during init and any pending
3939 * command will never be completed. In such a case we
3940 * need to resend whatever was the last sent
3941 * command.
3942 */
3943 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3944 hci_resend_last(hdev);
3945
9238f36a 3946 return;
42c6b129 3947 }
9238f36a 3948
f80c5dad
JPRV		 3949 /* If we reach this point this event matches the last command sent */
3950 hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
3951
9238f36a
JH		 3952 /* If the command succeeded and there's still more commands in
3953 * this request the request is not yet complete.
3954 */
3955 if (!status && !hci_req_is_complete(hdev))
3956 return;
3957
3958 /* If this was the last command in a request the complete
3959 * callback would be found in hdev->sent_cmd instead of the
3960 * command queue (hdev->cmd_q).
3961 */
44d27137
JH		 3962 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
3963 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
e6214487
JH		 3964 return;
3965 }
53e21fbc 3966
44d27137
JH		 3967 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
3968 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
e6214487 3969 return;
9238f36a
JH		 3970 }
3971
3972 /* Remove all pending commands belonging to this request */
3973 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
3974 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
44d27137 3975 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
9238f36a
JH		 3976 __skb_queue_head(&hdev->cmd_q, skb);
3977 break;
3978 }
3979
3bd7594e
DA		 3980 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
3981 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
3982 else
3983 *req_complete = bt_cb(skb)->hci.req_complete;
9238f36a
JH		 3984 kfree_skb(skb);
3985 }
3986 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
9238f36a
JH		 3987}
3988
b78752cc 3989static void hci_rx_work(struct work_struct *work)
1da177e4 3990{
b78752cc 3991 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 3992 struct sk_buff *skb;
3993
3994 BT_DBG("%s", hdev->name);
3995
9f30de9e
TK		 3996 /* The kcov_remote functions used for collecting packet parsing
3997 * coverage information from this background thread and associate
3998 * the coverage with the syscall's thread which originally injected
3999 * the packet. This helps fuzzing the kernel.
4000 */
4001 for (; (skb = skb_dequeue(&hdev->rx_q)); kcov_remote_stop()) {
4002 kcov_remote_start_common(skb_get_kcov_handle(skb));
4003
cd82e61c
MH		 4004 /* Send copy to monitor */
4005 hci_send_to_monitor(hdev, skb);
4006
1da177e4
LT		 4007 if (atomic_read(&hdev->promisc)) {
4008 /* Send copy to the sockets */
470fe1b5 4009 hci_send_to_sock(hdev, skb);
1da177e4
LT		 4010 }
4011
eb8c101e
MK		 4012 /* If the device has been opened in HCI_USER_CHANNEL,
4013 * the userspace has exclusive access to device.
4014 * When device is HCI_INIT, we still need to process
4015 * the data packets to the driver in order
4016 * to complete its setup().
4017 */
4018 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4019 !test_bit(HCI_INIT, &hdev->flags)) {
1da177e4
LT		 4020 kfree_skb(skb);
4021 continue;
4022 }
4023
4024 if (test_bit(HCI_INIT, &hdev->flags)) {
4025 /* Don't process data packets in this states. */
d79f34e3 4026 switch (hci_skb_pkt_type(skb)) {
1da177e4
LT		 4027 case HCI_ACLDATA_PKT:
4028 case HCI_SCODATA_PKT:
cc974003 4029 case HCI_ISODATA_PKT:
1da177e4
LT		 4030 kfree_skb(skb);
4031 continue;
3ff50b79 4032 }
1da177e4
LT		 4033 }
4034
4035 /* Process frame */
d79f34e3 4036 switch (hci_skb_pkt_type(skb)) {
1da177e4 4037 case HCI_EVENT_PKT:
b78752cc 4038 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 4039 hci_event_packet(hdev, skb);
4040 break;
4041
4042 case HCI_ACLDATA_PKT:
4043 BT_DBG("%s ACL data packet", hdev->name);
4044 hci_acldata_packet(hdev, skb);
4045 break;
4046
4047 case HCI_SCODATA_PKT:
4048 BT_DBG("%s SCO data packet", hdev->name);
4049 hci_scodata_packet(hdev, skb);
4050 break;
4051
26afbd82
LAD		 4052 case HCI_ISODATA_PKT:
4053 BT_DBG("%s ISO data packet", hdev->name);
4054 hci_isodata_packet(hdev, skb);
4055 break;
4056
1da177e4
LT		 4057 default:
4058 kfree_skb(skb);
4059 break;
4060 }
4061 }
1da177e4
LT		 4062}
4063
c347b765 4064static void hci_cmd_work(struct work_struct *work)
1da177e4 4065{
c347b765 4066 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 4067 struct sk_buff *skb;
4068
2104786b
AE		 4069 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4070 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 4071
1da177e4 4072 /* Send queued commands */
5a08ecce
AE		 4073 if (atomic_read(&hdev->cmd_cnt)) {
4074 skb = skb_dequeue(&hdev->cmd_q);
4075 if (!skb)
4076 return;
4077
7585b97a 4078 kfree_skb(hdev->sent_cmd);
1da177e4 4079
a675d7f1 4080 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
70f23020 4081 if (hdev->sent_cmd) {
2250abad 4082 int res;
f80c5dad
JPRV		 4083 if (hci_req_status_pend(hdev))
4084 hci_dev_set_flag(hdev, HCI_CMD_PENDING);
1da177e4 4085 atomic_dec(&hdev->cmd_cnt);
2250abad
BB		 4086
4087 res = hci_send_frame(hdev, skb);
4088 if (res < 0)
744451c1 4089 __hci_cmd_sync_cancel(hdev, -res);
2250abad 4090
deee93d1 4091 rcu_read_lock();
877afada
SS		 4092 if (test_bit(HCI_RESET, &hdev->flags) ||
4093 hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
65cc2b49 4094 cancel_delayed_work(&hdev->cmd_timer);
7bdb8a5c 4095 else
deee93d1
TH		 4096 queue_delayed_work(hdev->workqueue, &hdev->cmd_timer,
4097 HCI_CMD_TIMEOUT);
4098 rcu_read_unlock();
1da177e4
LT		 4099 } else {
4100 skb_queue_head(&hdev->cmd_q, skb);
c347b765 4101 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4102 }
4103 }
4104}
Linux 6.x block layer and io_uring tree(s)