projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: Set HCI_QUIRK_STRICT_DUPLICATE_FILTER for Broadcom devices
[linux-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
3df92b31 29#include <linux/idr.h>
8c520a59 30#include <linux/rfkill.h>
baf27f6e 31#include <linux/debugfs.h>
99780a7b 32#include <linux/crypto.h>
47219839 33#include <asm/unaligned.h>
1da177e4
LT		 34
35#include <net/bluetooth/bluetooth.h>
36#include <net/bluetooth/hci_core.h>
4bc58f51 37#include <net/bluetooth/l2cap.h>
af58925c 38#include <net/bluetooth/mgmt.h>
1da177e4 39
970c4e46
JH		 40#include "smp.h"
41
b78752cc 42static void hci_rx_work(struct work_struct *work);
c347b765 43static void hci_cmd_work(struct work_struct *work);
3eff45ea 44static void hci_tx_work(struct work_struct *work);
1da177e4 45
1da177e4
LT		 46/* HCI device list */
47LIST_HEAD(hci_dev_list);
48DEFINE_RWLOCK(hci_dev_list_lock);
49
50/* HCI callback list */
51LIST_HEAD(hci_cb_list);
52DEFINE_RWLOCK(hci_cb_list_lock);
53
3df92b31
SL		 54/* HCI ID Numbering */
55static DEFINE_IDA(hci_index_ida);
56
899de765
MH		 57/* ----- HCI requests ----- */
58
59#define HCI_REQ_DONE 0
60#define HCI_REQ_PEND 1
61#define HCI_REQ_CANCELED 2
62
63#define hci_req_lock(d) mutex_lock(&d->req_lock)
64#define hci_req_unlock(d) mutex_unlock(&d->req_lock)
65
1da177e4
LT		 66/* ---- HCI notifications ---- */
67
6516455d 68static void hci_notify(struct hci_dev *hdev, int event)
1da177e4 69{
040030ef 70 hci_sock_dev_event(hdev, event);
1da177e4
LT		 71}
72
baf27f6e
MH		 73/* ---- HCI debugfs entries ---- */
74
4b4148e9
MH		 75static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
76 size_t count, loff_t *ppos)
77{
78 struct hci_dev *hdev = file->private_data;
79 char buf[3];
80
111902f7 81 buf[0] = test_bit(HCI_DUT_MODE, &hdev->dbg_flags) ? 'Y': 'N';
4b4148e9
MH		 82 buf[1] = '\n';
83 buf[2] = '\0';
84 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
85}
86
87static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
88 size_t count, loff_t *ppos)
89{
90 struct hci_dev *hdev = file->private_data;
91 struct sk_buff *skb;
92 char buf[32];
93 size_t buf_size = min(count, (sizeof(buf)-1));
94 bool enable;
95 int err;
96
97 if (!test_bit(HCI_UP, &hdev->flags))
98 return -ENETDOWN;
99
100 if (copy_from_user(buf, user_buf, buf_size))
101 return -EFAULT;
102
103 buf[buf_size] = '\0';
104 if (strtobool(buf, &enable))
105 return -EINVAL;
106
111902f7 107 if (enable == test_bit(HCI_DUT_MODE, &hdev->dbg_flags))
4b4148e9
MH		 108 return -EALREADY;
109
110 hci_req_lock(hdev);
111 if (enable)
112 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
113 HCI_CMD_TIMEOUT);
114 else
115 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
116 HCI_CMD_TIMEOUT);
117 hci_req_unlock(hdev);
118
119 if (IS_ERR(skb))
120 return PTR_ERR(skb);
121
122 err = -bt_to_errno(skb->data[0]);
123 kfree_skb(skb);
124
125 if (err < 0)
126 return err;
127
111902f7 128 change_bit(HCI_DUT_MODE, &hdev->dbg_flags);
4b4148e9
MH		 129
130 return count;
131}
132
133static const struct file_operations dut_mode_fops = {
134 .open = simple_open,
135 .read = dut_mode_read,
136 .write = dut_mode_write,
137 .llseek = default_llseek,
138};
139
dfb826a8
MH		 140static int features_show(struct seq_file *f, void *ptr)
141{
142 struct hci_dev *hdev = f->private;
143 u8 p;
144
145 hci_dev_lock(hdev);
146 for (p = 0; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
cfbb2b5b 147 seq_printf(f, "%2u: 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x "
dfb826a8
MH		 148 "0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n", p,
149 hdev->features[p][0], hdev->features[p][1],
150 hdev->features[p][2], hdev->features[p][3],
151 hdev->features[p][4], hdev->features[p][5],
152 hdev->features[p][6], hdev->features[p][7]);
153 }
cfbb2b5b
MH		 154 if (lmp_le_capable(hdev))
155 seq_printf(f, "LE: 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x "
156 "0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n",
157 hdev->le_features[0], hdev->le_features[1],
158 hdev->le_features[2], hdev->le_features[3],
159 hdev->le_features[4], hdev->le_features[5],
160 hdev->le_features[6], hdev->le_features[7]);
dfb826a8
MH		 161 hci_dev_unlock(hdev);
162
163 return 0;
164}
165
166static int features_open(struct inode *inode, struct file *file)
167{
168 return single_open(file, features_show, inode->i_private);
169}
170
171static const struct file_operations features_fops = {
172 .open = features_open,
173 .read = seq_read,
174 .llseek = seq_lseek,
175 .release = single_release,
176};
177
70afe0b8
MH		 178static int blacklist_show(struct seq_file *f, void *p)
179{
180 struct hci_dev *hdev = f->private;
181 struct bdaddr_list *b;
182
183 hci_dev_lock(hdev);
184 list_for_each_entry(b, &hdev->blacklist, list)
b25f0785 185 seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
70afe0b8
MH		 186 hci_dev_unlock(hdev);
187
188 return 0;
189}
190
191static int blacklist_open(struct inode *inode, struct file *file)
192{
193 return single_open(file, blacklist_show, inode->i_private);
194}
195
196static const struct file_operations blacklist_fops = {
197 .open = blacklist_open,
198 .read = seq_read,
199 .llseek = seq_lseek,
200 .release = single_release,
201};
202
6659358e
JH		 203static int whitelist_show(struct seq_file *f, void *p)
204{
205 struct hci_dev *hdev = f->private;
206 struct bdaddr_list *b;
207
208 hci_dev_lock(hdev);
209 list_for_each_entry(b, &hdev->whitelist, list)
210 seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
211 hci_dev_unlock(hdev);
212
213 return 0;
214}
215
216static int whitelist_open(struct inode *inode, struct file *file)
217{
218 return single_open(file, whitelist_show, inode->i_private);
219}
220
221static const struct file_operations whitelist_fops = {
222 .open = whitelist_open,
223 .read = seq_read,
224 .llseek = seq_lseek,
225 .release = single_release,
226};
227
47219839
MH		 228static int uuids_show(struct seq_file *f, void *p)
229{
230 struct hci_dev *hdev = f->private;
231 struct bt_uuid *uuid;
232
233 hci_dev_lock(hdev);
234 list_for_each_entry(uuid, &hdev->uuids, list) {
58f01aa9
MH		 235 u8 i, val[16];
236
237 /* The Bluetooth UUID values are stored in big endian,
238 * but with reversed byte order. So convert them into
239 * the right order for the %pUb modifier.
240 */
241 for (i = 0; i < 16; i++)
242 val[i] = uuid->uuid[15 - i];
243
244 seq_printf(f, "%pUb\n", val);
47219839
MH		 245 }
246 hci_dev_unlock(hdev);
247
248 return 0;
249}
250
251static int uuids_open(struct inode *inode, struct file *file)
252{
253 return single_open(file, uuids_show, inode->i_private);
254}
255
256static const struct file_operations uuids_fops = {
257 .open = uuids_open,
258 .read = seq_read,
259 .llseek = seq_lseek,
260 .release = single_release,
261};
262
baf27f6e
MH		 263static int inquiry_cache_show(struct seq_file *f, void *p)
264{
265 struct hci_dev *hdev = f->private;
266 struct discovery_state *cache = &hdev->discovery;
267 struct inquiry_entry *e;
268
269 hci_dev_lock(hdev);
270
271 list_for_each_entry(e, &cache->all, all) {
272 struct inquiry_data *data = &e->data;
273 seq_printf(f, "%pMR %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %d %u\n",
274 &data->bdaddr,
275 data->pscan_rep_mode, data->pscan_period_mode,
276 data->pscan_mode, data->dev_class[2],
277 data->dev_class[1], data->dev_class[0],
278 __le16_to_cpu(data->clock_offset),
279 data->rssi, data->ssp_mode, e->timestamp);
280 }
281
282 hci_dev_unlock(hdev);
283
284 return 0;
285}
286
287static int inquiry_cache_open(struct inode *inode, struct file *file)
288{
289 return single_open(file, inquiry_cache_show, inode->i_private);
290}
291
292static const struct file_operations inquiry_cache_fops = {
293 .open = inquiry_cache_open,
294 .read = seq_read,
295 .llseek = seq_lseek,
296 .release = single_release,
297};
298
02d08d15
MH		 299static int link_keys_show(struct seq_file *f, void *ptr)
300{
301 struct hci_dev *hdev = f->private;
302 struct list_head *p, *n;
303
304 hci_dev_lock(hdev);
305 list_for_each_safe(p, n, &hdev->link_keys) {
306 struct link_key *key = list_entry(p, struct link_key, list);
307 seq_printf(f, "%pMR %u %*phN %u\n", &key->bdaddr, key->type,
308 HCI_LINK_KEY_SIZE, key->val, key->pin_len);
309 }
310 hci_dev_unlock(hdev);
311
312 return 0;
313}
314
315static int link_keys_open(struct inode *inode, struct file *file)
316{
317 return single_open(file, link_keys_show, inode->i_private);
318}
319
320static const struct file_operations link_keys_fops = {
321 .open = link_keys_open,
322 .read = seq_read,
323 .llseek = seq_lseek,
324 .release = single_release,
325};
326
babdbb3c
MH		 327static int dev_class_show(struct seq_file *f, void *ptr)
328{
329 struct hci_dev *hdev = f->private;
330
331 hci_dev_lock(hdev);
332 seq_printf(f, "0x%.2x%.2x%.2x\n", hdev->dev_class[2],
333 hdev->dev_class[1], hdev->dev_class[0]);
334 hci_dev_unlock(hdev);
335
336 return 0;
337}
338
339static int dev_class_open(struct inode *inode, struct file *file)
340{
341 return single_open(file, dev_class_show, inode->i_private);
342}
343
344static const struct file_operations dev_class_fops = {
345 .open = dev_class_open,
346 .read = seq_read,
347 .llseek = seq_lseek,
348 .release = single_release,
349};
350
041000b9
MH		 351static int voice_setting_get(void *data, u64 *val)
352{
353 struct hci_dev *hdev = data;
354
355 hci_dev_lock(hdev);
356 *val = hdev->voice_setting;
357 hci_dev_unlock(hdev);
358
359 return 0;
360}
361
362DEFINE_SIMPLE_ATTRIBUTE(voice_setting_fops, voice_setting_get,
363 NULL, "0x%4.4llx\n");
364
ebd1e33b
MH		 365static int auto_accept_delay_set(void *data, u64 val)
366{
367 struct hci_dev *hdev = data;
368
369 hci_dev_lock(hdev);
370 hdev->auto_accept_delay = val;
371 hci_dev_unlock(hdev);
372
373 return 0;
374}
375
376static int auto_accept_delay_get(void *data, u64 *val)
377{
378 struct hci_dev *hdev = data;
379
380 hci_dev_lock(hdev);
381 *val = hdev->auto_accept_delay;
382 hci_dev_unlock(hdev);
383
384 return 0;
385}
386
387DEFINE_SIMPLE_ATTRIBUTE(auto_accept_delay_fops, auto_accept_delay_get,
388 auto_accept_delay_set, "%llu\n");
389
5afeac14
MH		 390static ssize_t force_sc_support_read(struct file *file, char __user *user_buf,
391 size_t count, loff_t *ppos)
392{
393 struct hci_dev *hdev = file->private_data;
394 char buf[3];
395
111902f7 396 buf[0] = test_bit(HCI_FORCE_SC, &hdev->dbg_flags) ? 'Y': 'N';
5afeac14
MH		 397 buf[1] = '\n';
398 buf[2] = '\0';
399 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
400}
401
402static ssize_t force_sc_support_write(struct file *file,
403 const char __user *user_buf,
404 size_t count, loff_t *ppos)
405{
406 struct hci_dev *hdev = file->private_data;
407 char buf[32];
408 size_t buf_size = min(count, (sizeof(buf)-1));
409 bool enable;
410
411 if (test_bit(HCI_UP, &hdev->flags))
412 return -EBUSY;
413
414 if (copy_from_user(buf, user_buf, buf_size))
415 return -EFAULT;
416
417 buf[buf_size] = '\0';
418 if (strtobool(buf, &enable))
419 return -EINVAL;
420
111902f7 421 if (enable == test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
5afeac14
MH		 422 return -EALREADY;
423
111902f7 424 change_bit(HCI_FORCE_SC, &hdev->dbg_flags);
5afeac14
MH		 425
426 return count;
427}
428
429static const struct file_operations force_sc_support_fops = {
430 .open = simple_open,
431 .read = force_sc_support_read,
432 .write = force_sc_support_write,
433 .llseek = default_llseek,
434};
435
134c2a89
MH		 436static ssize_t sc_only_mode_read(struct file *file, char __user *user_buf,
437 size_t count, loff_t *ppos)
438{
439 struct hci_dev *hdev = file->private_data;
440 char buf[3];
441
442 buf[0] = test_bit(HCI_SC_ONLY, &hdev->dev_flags) ? 'Y': 'N';
443 buf[1] = '\n';
444 buf[2] = '\0';
445 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
446}
447
448static const struct file_operations sc_only_mode_fops = {
449 .open = simple_open,
450 .read = sc_only_mode_read,
451 .llseek = default_llseek,
452};
453
2bfa3531
MH		 454static int idle_timeout_set(void *data, u64 val)
455{
456 struct hci_dev *hdev = data;
457
458 if (val != 0 && (val < 500 || val > 3600000))
459 return -EINVAL;
460
461 hci_dev_lock(hdev);
2be48b65 462 hdev->idle_timeout = val;
2bfa3531
MH		 463 hci_dev_unlock(hdev);
464
465 return 0;
466}
467
468static int idle_timeout_get(void *data, u64 *val)
469{
470 struct hci_dev *hdev = data;
471
472 hci_dev_lock(hdev);
473 *val = hdev->idle_timeout;
474 hci_dev_unlock(hdev);
475
476 return 0;
477}
478
479DEFINE_SIMPLE_ATTRIBUTE(idle_timeout_fops, idle_timeout_get,
480 idle_timeout_set, "%llu\n");
481
c982b2ea
JH		 482static int rpa_timeout_set(void *data, u64 val)
483{
484 struct hci_dev *hdev = data;
485
486 /* Require the RPA timeout to be at least 30 seconds and at most
487 * 24 hours.
488 */
489 if (val < 30 || val > (60 * 60 * 24))
490 return -EINVAL;
491
492 hci_dev_lock(hdev);
493 hdev->rpa_timeout = val;
494 hci_dev_unlock(hdev);
495
496 return 0;
497}
498
499static int rpa_timeout_get(void *data, u64 *val)
500{
501 struct hci_dev *hdev = data;
502
503 hci_dev_lock(hdev);
504 *val = hdev->rpa_timeout;
505 hci_dev_unlock(hdev);
506
507 return 0;
508}
509
510DEFINE_SIMPLE_ATTRIBUTE(rpa_timeout_fops, rpa_timeout_get,
511 rpa_timeout_set, "%llu\n");
512
2bfa3531
MH		 513static int sniff_min_interval_set(void *data, u64 val)
514{
515 struct hci_dev *hdev = data;
516
517 if (val == 0 || val % 2 || val > hdev->sniff_max_interval)
518 return -EINVAL;
519
520 hci_dev_lock(hdev);
2be48b65 521 hdev->sniff_min_interval = val;
2bfa3531
MH		 522 hci_dev_unlock(hdev);
523
524 return 0;
525}
526
527static int sniff_min_interval_get(void *data, u64 *val)
528{
529 struct hci_dev *hdev = data;
530
531 hci_dev_lock(hdev);
532 *val = hdev->sniff_min_interval;
533 hci_dev_unlock(hdev);
534
535 return 0;
536}
537
538DEFINE_SIMPLE_ATTRIBUTE(sniff_min_interval_fops, sniff_min_interval_get,
539 sniff_min_interval_set, "%llu\n");
540
541static int sniff_max_interval_set(void *data, u64 val)
542{
543 struct hci_dev *hdev = data;
544
545 if (val == 0 || val % 2 || val < hdev->sniff_min_interval)
546 return -EINVAL;
547
548 hci_dev_lock(hdev);
2be48b65 549 hdev->sniff_max_interval = val;
2bfa3531
MH		 550 hci_dev_unlock(hdev);
551
552 return 0;
553}
554
555static int sniff_max_interval_get(void *data, u64 *val)
556{
557 struct hci_dev *hdev = data;
558
559 hci_dev_lock(hdev);
560 *val = hdev->sniff_max_interval;
561 hci_dev_unlock(hdev);
562
563 return 0;
564}
565
566DEFINE_SIMPLE_ATTRIBUTE(sniff_max_interval_fops, sniff_max_interval_get,
567 sniff_max_interval_set, "%llu\n");
568
31ad1691
AK		 569static int conn_info_min_age_set(void *data, u64 val)
570{
571 struct hci_dev *hdev = data;
572
573 if (val == 0 || val > hdev->conn_info_max_age)
574 return -EINVAL;
575
576 hci_dev_lock(hdev);
577 hdev->conn_info_min_age = val;
578 hci_dev_unlock(hdev);
579
580 return 0;
581}
582
583static int conn_info_min_age_get(void *data, u64 *val)
584{
585 struct hci_dev *hdev = data;
586
587 hci_dev_lock(hdev);
588 *val = hdev->conn_info_min_age;
589 hci_dev_unlock(hdev);
590
591 return 0;
592}
593
594DEFINE_SIMPLE_ATTRIBUTE(conn_info_min_age_fops, conn_info_min_age_get,
595 conn_info_min_age_set, "%llu\n");
596
597static int conn_info_max_age_set(void *data, u64 val)
598{
599 struct hci_dev *hdev = data;
600
601 if (val == 0 || val < hdev->conn_info_min_age)
602 return -EINVAL;
603
604 hci_dev_lock(hdev);
605 hdev->conn_info_max_age = val;
606 hci_dev_unlock(hdev);
607
608 return 0;
609}
610
611static int conn_info_max_age_get(void *data, u64 *val)
612{
613 struct hci_dev *hdev = data;
614
615 hci_dev_lock(hdev);
616 *val = hdev->conn_info_max_age;
617 hci_dev_unlock(hdev);
618
619 return 0;
620}
621
622DEFINE_SIMPLE_ATTRIBUTE(conn_info_max_age_fops, conn_info_max_age_get,
623 conn_info_max_age_set, "%llu\n");
624
ac345813
MH		 625static int identity_show(struct seq_file *f, void *p)
626{
627 struct hci_dev *hdev = f->private;
a1f4c318 628 bdaddr_t addr;
ac345813
MH		 629 u8 addr_type;
630
631 hci_dev_lock(hdev);
632
a1f4c318 633 hci_copy_identity_address(hdev, &addr, &addr_type);
ac345813 634
a1f4c318 635 seq_printf(f, "%pMR (type %u) %*phN %pMR\n", &addr, addr_type,
473deef2 636 16, hdev->irk, &hdev->rpa);
ac345813
MH		 637
638 hci_dev_unlock(hdev);
639
640 return 0;
641}
642
643static int identity_open(struct inode *inode, struct file *file)
644{
645 return single_open(file, identity_show, inode->i_private);
646}
647
648static const struct file_operations identity_fops = {
649 .open = identity_open,
650 .read = seq_read,
651 .llseek = seq_lseek,
652 .release = single_release,
653};
654
7a4cd51d
MH		 655static int random_address_show(struct seq_file *f, void *p)
656{
657 struct hci_dev *hdev = f->private;
658
659 hci_dev_lock(hdev);
660 seq_printf(f, "%pMR\n", &hdev->random_addr);
661 hci_dev_unlock(hdev);
662
663 return 0;
664}
665
666static int random_address_open(struct inode *inode, struct file *file)
667{
668 return single_open(file, random_address_show, inode->i_private);
669}
670
671static const struct file_operations random_address_fops = {
672 .open = random_address_open,
673 .read = seq_read,
674 .llseek = seq_lseek,
675 .release = single_release,
676};
677
e7b8fc92
MH		 678static int static_address_show(struct seq_file *f, void *p)
679{
680 struct hci_dev *hdev = f->private;
681
682 hci_dev_lock(hdev);
683 seq_printf(f, "%pMR\n", &hdev->static_addr);
684 hci_dev_unlock(hdev);
685
686 return 0;
687}
688
689static int static_address_open(struct inode *inode, struct file *file)
690{
691 return single_open(file, static_address_show, inode->i_private);
692}
693
694static const struct file_operations static_address_fops = {
695 .open = static_address_open,
696 .read = seq_read,
697 .llseek = seq_lseek,
698 .release = single_release,
699};
700
b32bba6c
MH		 701static ssize_t force_static_address_read(struct file *file,
702 char __user *user_buf,
703 size_t count, loff_t *ppos)
92202185 704{
b32bba6c
MH		 705 struct hci_dev *hdev = file->private_data;
706 char buf[3];
92202185 707
111902f7 708 buf[0] = test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ? 'Y': 'N';
b32bba6c
MH		 709 buf[1] = '\n';
710 buf[2] = '\0';
711 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
92202185
MH		 712}
713
b32bba6c
MH		 714static ssize_t force_static_address_write(struct file *file,
715 const char __user *user_buf,
716 size_t count, loff_t *ppos)
92202185 717{
b32bba6c
MH		 718 struct hci_dev *hdev = file->private_data;
719 char buf[32];
720 size_t buf_size = min(count, (sizeof(buf)-1));
721 bool enable;
92202185 722
b32bba6c
MH		 723 if (test_bit(HCI_UP, &hdev->flags))
724 return -EBUSY;
92202185 725
b32bba6c
MH		 726 if (copy_from_user(buf, user_buf, buf_size))
727 return -EFAULT;
728
729 buf[buf_size] = '\0';
730 if (strtobool(buf, &enable))
731 return -EINVAL;
732
111902f7 733 if (enable == test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags))
b32bba6c
MH		 734 return -EALREADY;
735
111902f7 736 change_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags);
b32bba6c
MH		 737
738 return count;
92202185
MH		 739}
740
b32bba6c
MH		 741static const struct file_operations force_static_address_fops = {
742 .open = simple_open,
743 .read = force_static_address_read,
744 .write = force_static_address_write,
745 .llseek = default_llseek,
746};
92202185 747
d2ab0ac1
MH		 748static int white_list_show(struct seq_file *f, void *ptr)
749{
750 struct hci_dev *hdev = f->private;
751 struct bdaddr_list *b;
752
753 hci_dev_lock(hdev);
754 list_for_each_entry(b, &hdev->le_white_list, list)
755 seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
756 hci_dev_unlock(hdev);
757
758 return 0;
759}
760
761static int white_list_open(struct inode *inode, struct file *file)
762{
763 return single_open(file, white_list_show, inode->i_private);
764}
765
766static const struct file_operations white_list_fops = {
767 .open = white_list_open,
768 .read = seq_read,
769 .llseek = seq_lseek,
770 .release = single_release,
771};
772
3698d704
MH		 773static int identity_resolving_keys_show(struct seq_file *f, void *ptr)
774{
775 struct hci_dev *hdev = f->private;
776 struct list_head *p, *n;
777
778 hci_dev_lock(hdev);
779 list_for_each_safe(p, n, &hdev->identity_resolving_keys) {
780 struct smp_irk *irk = list_entry(p, struct smp_irk, list);
781 seq_printf(f, "%pMR (type %u) %*phN %pMR\n",
782 &irk->bdaddr, irk->addr_type,
783 16, irk->val, &irk->rpa);
784 }
785 hci_dev_unlock(hdev);
786
787 return 0;
788}
789
790static int identity_resolving_keys_open(struct inode *inode, struct file *file)
791{
792 return single_open(file, identity_resolving_keys_show,
793 inode->i_private);
794}
795
796static const struct file_operations identity_resolving_keys_fops = {
797 .open = identity_resolving_keys_open,
798 .read = seq_read,
799 .llseek = seq_lseek,
800 .release = single_release,
801};
802
8f8625cd
MH		 803static int long_term_keys_show(struct seq_file *f, void *ptr)
804{
805 struct hci_dev *hdev = f->private;
806 struct list_head *p, *n;
807
808 hci_dev_lock(hdev);
f813f1be 809 list_for_each_safe(p, n, &hdev->long_term_keys) {
8f8625cd 810 struct smp_ltk *ltk = list_entry(p, struct smp_ltk, list);
fe39c7b2 811 seq_printf(f, "%pMR (type %u) %u 0x%02x %u %.4x %.16llx %*phN\n",
8f8625cd
MH		 812 &ltk->bdaddr, ltk->bdaddr_type, ltk->authenticated,
813 ltk->type, ltk->enc_size, __le16_to_cpu(ltk->ediv),
fe39c7b2 814 __le64_to_cpu(ltk->rand), 16, ltk->val);
8f8625cd
MH		 815 }
816 hci_dev_unlock(hdev);
817
818 return 0;
819}
820
821static int long_term_keys_open(struct inode *inode, struct file *file)
822{
823 return single_open(file, long_term_keys_show, inode->i_private);
824}
825
826static const struct file_operations long_term_keys_fops = {
827 .open = long_term_keys_open,
828 .read = seq_read,
829 .llseek = seq_lseek,
830 .release = single_release,
831};
832
4e70c7e7
MH		 833static int conn_min_interval_set(void *data, u64 val)
834{
835 struct hci_dev *hdev = data;
836
837 if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval)
838 return -EINVAL;
839
840 hci_dev_lock(hdev);
2be48b65 841 hdev->le_conn_min_interval = val;
4e70c7e7
MH		 842 hci_dev_unlock(hdev);
843
844 return 0;
845}
846
847static int conn_min_interval_get(void *data, u64 *val)
848{
849 struct hci_dev *hdev = data;
850
851 hci_dev_lock(hdev);
852 *val = hdev->le_conn_min_interval;
853 hci_dev_unlock(hdev);
854
855 return 0;
856}
857
858DEFINE_SIMPLE_ATTRIBUTE(conn_min_interval_fops, conn_min_interval_get,
859 conn_min_interval_set, "%llu\n");
860
861static int conn_max_interval_set(void *data, u64 val)
862{
863 struct hci_dev *hdev = data;
864
865 if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval)
866 return -EINVAL;
867
868 hci_dev_lock(hdev);
2be48b65 869 hdev->le_conn_max_interval = val;
4e70c7e7
MH		 870 hci_dev_unlock(hdev);
871
872 return 0;
873}
874
875static int conn_max_interval_get(void *data, u64 *val)
876{
877 struct hci_dev *hdev = data;
878
879 hci_dev_lock(hdev);
880 *val = hdev->le_conn_max_interval;
881 hci_dev_unlock(hdev);
882
883 return 0;
884}
885
886DEFINE_SIMPLE_ATTRIBUTE(conn_max_interval_fops, conn_max_interval_get,
887 conn_max_interval_set, "%llu\n");
888
816a93d1 889static int conn_latency_set(void *data, u64 val)
3f959d46
MH		 890{
891 struct hci_dev *hdev = data;
892
816a93d1 893 if (val > 0x01f3)
3f959d46
MH		 894 return -EINVAL;
895
896 hci_dev_lock(hdev);
816a93d1 897 hdev->le_conn_latency = val;
3f959d46
MH		 898 hci_dev_unlock(hdev);
899
900 return 0;
901}
902
816a93d1 903static int conn_latency_get(void *data, u64 *val)
3f959d46
MH		 904{
905 struct hci_dev *hdev = data;
906
907 hci_dev_lock(hdev);
816a93d1 908 *val = hdev->le_conn_latency;
3f959d46
MH		 909 hci_dev_unlock(hdev);
910
911 return 0;
912}
913
816a93d1
MH		 914DEFINE_SIMPLE_ATTRIBUTE(conn_latency_fops, conn_latency_get,
915 conn_latency_set, "%llu\n");
3f959d46 916
f1649577 917static int supervision_timeout_set(void *data, u64 val)
89863109 918{
f1649577 919 struct hci_dev *hdev = data;
89863109 920
f1649577
MH		 921 if (val < 0x000a || val > 0x0c80)
922 return -EINVAL;
923
924 hci_dev_lock(hdev);
925 hdev->le_supv_timeout = val;
926 hci_dev_unlock(hdev);
927
928 return 0;
89863109
JR		 929}
930
f1649577 931static int supervision_timeout_get(void *data, u64 *val)
89863109 932{
f1649577 933 struct hci_dev *hdev = data;
89863109 934
f1649577
MH		 935 hci_dev_lock(hdev);
936 *val = hdev->le_supv_timeout;
937 hci_dev_unlock(hdev);
89863109 938
f1649577
MH		 939 return 0;
940}
89863109 941
f1649577
MH		 942DEFINE_SIMPLE_ATTRIBUTE(supervision_timeout_fops, supervision_timeout_get,
943 supervision_timeout_set, "%llu\n");
89863109 944
3f959d46
MH		 945static int adv_channel_map_set(void *data, u64 val)
946{
947 struct hci_dev *hdev = data;
89863109 948
3f959d46
MH		 949 if (val < 0x01 || val > 0x07)
950 return -EINVAL;
89863109 951
3f959d46
MH		 952 hci_dev_lock(hdev);
953 hdev->le_adv_channel_map = val;
954 hci_dev_unlock(hdev);
89863109 955
3f959d46
MH		 956 return 0;
957}
89863109 958
3f959d46 959static int adv_channel_map_get(void *data, u64 *val)
7d474e06 960{
3f959d46 961 struct hci_dev *hdev = data;
7d474e06
AG		 962
963 hci_dev_lock(hdev);
3f959d46
MH		 964 *val = hdev->le_adv_channel_map;
965 hci_dev_unlock(hdev);
7d474e06 966
3f959d46
MH		 967 return 0;
968}
969
970DEFINE_SIMPLE_ATTRIBUTE(adv_channel_map_fops, adv_channel_map_get,
971 adv_channel_map_set, "%llu\n");
7d474e06 972
729a1051
GL		 973static int adv_min_interval_set(void *data, u64 val)
974{
975 struct hci_dev *hdev = data;
976
977 if (val < 0x0020 || val > 0x4000 || val > hdev->le_adv_max_interval)
978 return -EINVAL;
979
980 hci_dev_lock(hdev);
981 hdev->le_adv_min_interval = val;
7d474e06
AG		 982 hci_dev_unlock(hdev);
983
984 return 0;
985}
986
729a1051 987static int adv_min_interval_get(void *data, u64 *val)
7d474e06 988{
729a1051
GL		 989 struct hci_dev *hdev = data;
990
991 hci_dev_lock(hdev);
992 *val = hdev->le_adv_min_interval;
993 hci_dev_unlock(hdev);
994
995 return 0;
7d474e06
AG		 996}
997
729a1051
GL		 998DEFINE_SIMPLE_ATTRIBUTE(adv_min_interval_fops, adv_min_interval_get,
999 adv_min_interval_set, "%llu\n");
1000
1001static int adv_max_interval_set(void *data, u64 val)
7d474e06 1002{
729a1051 1003 struct hci_dev *hdev = data;
7d474e06 1004
729a1051 1005 if (val < 0x0020 || val > 0x4000 || val < hdev->le_adv_min_interval)
7d474e06
AG		 1006 return -EINVAL;
1007
729a1051
GL		 1008 hci_dev_lock(hdev);
1009 hdev->le_adv_max_interval = val;
1010 hci_dev_unlock(hdev);
7d474e06 1011
729a1051
GL		 1012 return 0;
1013}
7d474e06 1014
729a1051
GL		 1015static int adv_max_interval_get(void *data, u64 *val)
1016{
1017 struct hci_dev *hdev = data;
7d474e06 1018
729a1051
GL		 1019 hci_dev_lock(hdev);
1020 *val = hdev->le_adv_max_interval;
1021 hci_dev_unlock(hdev);
7d474e06 1022
729a1051
GL		 1023 return 0;
1024}
7d474e06 1025
729a1051
GL		 1026DEFINE_SIMPLE_ATTRIBUTE(adv_max_interval_fops, adv_max_interval_get,
1027 adv_max_interval_set, "%llu\n");
7d474e06 1028
0b3c7d37 1029static int device_list_show(struct seq_file *f, void *ptr)
7d474e06 1030{
0b3c7d37 1031 struct hci_dev *hdev = f->private;
7d474e06 1032 struct hci_conn_params *p;
7d474e06 1033
7d474e06 1034 hci_dev_lock(hdev);
7d474e06 1035 list_for_each_entry(p, &hdev->le_conn_params, list) {
0b3c7d37 1036 seq_printf(f, "%pMR %u %u\n", &p->addr, p->addr_type,
7d474e06 1037 p->auto_connect);
7d474e06 1038 }
7d474e06 1039 hci_dev_unlock(hdev);
7d474e06 1040
7d474e06
AG		 1041 return 0;
1042}
7d474e06 1043
0b3c7d37 1044static int device_list_open(struct inode *inode, struct file *file)
7d474e06 1045{
0b3c7d37 1046 return single_open(file, device_list_show, inode->i_private);
7d474e06
AG		 1047}
1048
0b3c7d37
MH		 1049static const struct file_operations device_list_fops = {
1050 .open = device_list_open,
7d474e06 1051 .read = seq_read,
7d474e06
AG		 1052 .llseek = seq_lseek,
1053 .release = single_release,
1054};
1055
1da177e4
LT		 1056/* ---- HCI requests ---- */
1057
42c6b129 1058static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
1da177e4 1059{
42c6b129 1060 BT_DBG("%s result 0x%2.2x", hdev->name, result);
1da177e4
LT		 1061
1062 if (hdev->req_status == HCI_REQ_PEND) {
1063 hdev->req_result = result;
1064 hdev->req_status = HCI_REQ_DONE;
1065 wake_up_interruptible(&hdev->req_wait_q);
1066 }
1067}
1068
1069static void hci_req_cancel(struct hci_dev *hdev, int err)
1070{
1071 BT_DBG("%s err 0x%2.2x", hdev->name, err);
1072
1073 if (hdev->req_status == HCI_REQ_PEND) {
1074 hdev->req_result = err;
1075 hdev->req_status = HCI_REQ_CANCELED;
1076 wake_up_interruptible(&hdev->req_wait_q);
1077 }
1078}
1079
77a63e0a
FW		 1080static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
1081 u8 event)
75e84b7c
JH		 1082{
1083 struct hci_ev_cmd_complete *ev;
1084 struct hci_event_hdr *hdr;
1085 struct sk_buff *skb;
1086
1087 hci_dev_lock(hdev);
1088
1089 skb = hdev->recv_evt;
1090 hdev->recv_evt = NULL;
1091
1092 hci_dev_unlock(hdev);
1093
1094 if (!skb)
1095 return ERR_PTR(-ENODATA);
1096
1097 if (skb->len < sizeof(*hdr)) {
1098 BT_ERR("Too short HCI event");
1099 goto failed;
1100 }
1101
1102 hdr = (void *) skb->data;
1103 skb_pull(skb, HCI_EVENT_HDR_SIZE);
1104
7b1abbbe
JH		 1105 if (event) {
1106 if (hdr->evt != event)
1107 goto failed;
1108 return skb;
1109 }
1110
75e84b7c
JH		 1111 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
1112 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
1113 goto failed;
1114 }
1115
1116 if (skb->len < sizeof(*ev)) {
1117 BT_ERR("Too short cmd_complete event");
1118 goto failed;
1119 }
1120
1121 ev = (void *) skb->data;
1122 skb_pull(skb, sizeof(*ev));
1123
1124 if (opcode == __le16_to_cpu(ev->opcode))
1125 return skb;
1126
1127 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
1128 __le16_to_cpu(ev->opcode));
1129
1130failed:
1131 kfree_skb(skb);
1132 return ERR_PTR(-ENODATA);
1133}
1134
7b1abbbe 1135struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
07dc93dd 1136 const void *param, u8 event, u32 timeout)
75e84b7c
JH		 1137{
1138 DECLARE_WAITQUEUE(wait, current);
1139 struct hci_request req;
1140 int err = 0;
1141
1142 BT_DBG("%s", hdev->name);
1143
1144 hci_req_init(&req, hdev);
1145
7b1abbbe 1146 hci_req_add_ev(&req, opcode, plen, param, event);
75e84b7c
JH		 1147
1148 hdev->req_status = HCI_REQ_PEND;
1149
75e84b7c
JH		 1150 add_wait_queue(&hdev->req_wait_q, &wait);
1151 set_current_state(TASK_INTERRUPTIBLE);
1152
039fada5
CP		 1153 err = hci_req_run(&req, hci_req_sync_complete);
1154 if (err < 0) {
1155 remove_wait_queue(&hdev->req_wait_q, &wait);
1156 return ERR_PTR(err);
1157 }
1158
75e84b7c
JH		 1159 schedule_timeout(timeout);
1160
1161 remove_wait_queue(&hdev->req_wait_q, &wait);
1162
1163 if (signal_pending(current))
1164 return ERR_PTR(-EINTR);
1165
1166 switch (hdev->req_status) {
1167 case HCI_REQ_DONE:
1168 err = -bt_to_errno(hdev->req_result);
1169 break;
1170
1171 case HCI_REQ_CANCELED:
1172 err = -hdev->req_result;
1173 break;
1174
1175 default:
1176 err = -ETIMEDOUT;
1177 break;
1178 }
1179
1180 hdev->req_status = hdev->req_result = 0;
1181
1182 BT_DBG("%s end: err %d", hdev->name, err);
1183
1184 if (err < 0)
1185 return ERR_PTR(err);
1186
7b1abbbe
JH		 1187 return hci_get_cmd_complete(hdev, opcode, event);
1188}
1189EXPORT_SYMBOL(__hci_cmd_sync_ev);
1190
1191struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
07dc93dd 1192 const void *param, u32 timeout)
7b1abbbe
JH		 1193{
1194 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
75e84b7c
JH		 1195}
1196EXPORT_SYMBOL(__hci_cmd_sync);
1197
1da177e4 1198/* Execute request and wait for completion. */
01178cd4 1199static int __hci_req_sync(struct hci_dev *hdev,
42c6b129
JH		 1200 void (*func)(struct hci_request *req,
1201 unsigned long opt),
01178cd4 1202 unsigned long opt, __u32 timeout)
1da177e4 1203{
42c6b129 1204 struct hci_request req;
1da177e4
LT		 1205 DECLARE_WAITQUEUE(wait, current);
1206 int err = 0;
1207
1208 BT_DBG("%s start", hdev->name);
1209
42c6b129
JH		 1210 hci_req_init(&req, hdev);
1211
1da177e4
LT		 1212 hdev->req_status = HCI_REQ_PEND;
1213
42c6b129 1214 func(&req, opt);
53cce22d 1215
039fada5
CP		 1216 add_wait_queue(&hdev->req_wait_q, &wait);
1217 set_current_state(TASK_INTERRUPTIBLE);
1218
42c6b129
JH		 1219 err = hci_req_run(&req, hci_req_sync_complete);
1220 if (err < 0) {
53cce22d 1221 hdev->req_status = 0;
920c8300 1222
039fada5
CP		 1223 remove_wait_queue(&hdev->req_wait_q, &wait);
1224
920c8300
AG		 1225 /* ENODATA means the HCI request command queue is empty.
1226 * This can happen when a request with conditionals doesn't
1227 * trigger any commands to be sent. This is normal behavior
1228 * and should not trigger an error return.
42c6b129 1229 */
920c8300
AG		 1230 if (err == -ENODATA)
1231 return 0;
1232
1233 return err;
53cce22d
JH		 1234 }
1235
1da177e4
LT		 1236 schedule_timeout(timeout);
1237
1238 remove_wait_queue(&hdev->req_wait_q, &wait);
1239
1240 if (signal_pending(current))
1241 return -EINTR;
1242
1243 switch (hdev->req_status) {
1244 case HCI_REQ_DONE:
e175072f 1245 err = -bt_to_errno(hdev->req_result);
1da177e4
LT		 1246 break;
1247
1248 case HCI_REQ_CANCELED:
1249 err = -hdev->req_result;
1250 break;
1251
1252 default:
1253 err = -ETIMEDOUT;
1254 break;
3ff50b79 1255 }
1da177e4 1256
a5040efa 1257 hdev->req_status = hdev->req_result = 0;
1da177e4
LT		 1258
1259 BT_DBG("%s end: err %d", hdev->name, err);
1260
1261 return err;
1262}
1263
01178cd4 1264static int hci_req_sync(struct hci_dev *hdev,
42c6b129
JH		 1265 void (*req)(struct hci_request *req,
1266 unsigned long opt),
01178cd4 1267 unsigned long opt, __u32 timeout)
1da177e4
LT		 1268{
1269 int ret;
1270
7c6a329e
MH		 1271 if (!test_bit(HCI_UP, &hdev->flags))
1272 return -ENETDOWN;
1273
1da177e4
LT		 1274 /* Serialize all requests */
1275 hci_req_lock(hdev);
01178cd4 1276 ret = __hci_req_sync(hdev, req, opt, timeout);
1da177e4
LT		 1277 hci_req_unlock(hdev);
1278
1279 return ret;
1280}
1281
42c6b129 1282static void hci_reset_req(struct hci_request *req, unsigned long opt)
1da177e4 1283{
42c6b129 1284 BT_DBG("%s %ld", req->hdev->name, opt);
1da177e4
LT		 1285
1286 /* Reset device */
42c6b129
JH		 1287 set_bit(HCI_RESET, &req->hdev->flags);
1288 hci_req_add(req, HCI_OP_RESET, 0, NULL);
1da177e4
LT		 1289}
1290
42c6b129 1291static void bredr_init(struct hci_request *req)
1da177e4 1292{
42c6b129 1293 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
2455a3ea 1294
1da177e4 1295 /* Read Local Supported Features */
42c6b129 1296 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 1297
1143e5a6 1298 /* Read Local Version */
42c6b129 1299 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
2177bab5
JH		 1300
1301 /* Read BD Address */
42c6b129 1302 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1da177e4
LT		 1303}
1304
42c6b129 1305static void amp_init(struct hci_request *req)
e61ef499 1306{
42c6b129 1307 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
2455a3ea 1308
e61ef499 1309 /* Read Local Version */
42c6b129 1310 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489 1311
f6996cfe
MH		 1312 /* Read Local Supported Commands */
1313 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
1314
1315 /* Read Local Supported Features */
1316 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1317
6bcbc489 1318 /* Read Local AMP Info */
42c6b129 1319 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 1320
1321 /* Read Data Blk size */
42c6b129 1322 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
7528ca1c 1323
f38ba941
MH		 1324 /* Read Flow Control Mode */
1325 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
1326
7528ca1c
MH		 1327 /* Read Location Data */
1328 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
e61ef499
AE		 1329}
1330
42c6b129 1331static void hci_init1_req(struct hci_request *req, unsigned long opt)
e61ef499 1332{
42c6b129 1333 struct hci_dev *hdev = req->hdev;
e61ef499
AE		 1334
1335 BT_DBG("%s %ld", hdev->name, opt);
1336
11778716
AE		 1337 /* Reset */
1338 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
42c6b129 1339 hci_reset_req(req, 0);
11778716 1340
e61ef499
AE		 1341 switch (hdev->dev_type) {
1342 case HCI_BREDR:
42c6b129 1343 bredr_init(req);
e61ef499
AE		 1344 break;
1345
1346 case HCI_AMP:
42c6b129 1347 amp_init(req);
e61ef499
AE		 1348 break;
1349
1350 default:
1351 BT_ERR("Unknown device type %d", hdev->dev_type);
1352 break;
1353 }
e61ef499
AE		 1354}
1355
42c6b129 1356static void bredr_setup(struct hci_request *req)
2177bab5 1357{
4ca048e3
MH		 1358 struct hci_dev *hdev = req->hdev;
1359
2177bab5
JH		 1360 __le16 param;
1361 __u8 flt_type;
1362
1363 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
42c6b129 1364 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 1365
1366 /* Read Class of Device */
42c6b129 1367 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
2177bab5
JH		 1368
1369 /* Read Local Name */
42c6b129 1370 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
2177bab5
JH		 1371
1372 /* Read Voice Setting */
42c6b129 1373 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
2177bab5 1374
b4cb9fb2
MH		 1375 /* Read Number of Supported IAC */
1376 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
1377
4b836f39
MH		 1378 /* Read Current IAC LAP */
1379 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
1380
2177bab5
JH		 1381 /* Clear Event Filters */
1382 flt_type = HCI_FLT_CLEAR_ALL;
42c6b129 1383 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
2177bab5
JH		 1384
1385 /* Connection accept timeout ~20 secs */
dcf4adbf 1386 param = cpu_to_le16(0x7d00);
42c6b129 1387 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
2177bab5 1388
4ca048e3
MH		 1389 /* AVM Berlin (31), aka "BlueFRITZ!", reports version 1.2,
1390 * but it does not support page scan related HCI commands.
1391 */
1392 if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1) {
f332ec66
JH		 1393 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
1394 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
1395 }
2177bab5
JH		 1396}
1397
42c6b129 1398static void le_setup(struct hci_request *req)
2177bab5 1399{
c73eee91
JH		 1400 struct hci_dev *hdev = req->hdev;
1401
2177bab5 1402 /* Read LE Buffer Size */
42c6b129 1403 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 1404
1405 /* Read LE Local Supported Features */
42c6b129 1406 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
2177bab5 1407
747d3f03
MH		 1408 /* Read LE Supported States */
1409 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
1410
2177bab5 1411 /* Read LE White List Size */
42c6b129 1412 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
2177bab5 1413
747d3f03
MH		 1414 /* Clear LE White List */
1415 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
c73eee91
JH		 1416
1417 /* LE-only controllers have LE implicitly enabled */
1418 if (!lmp_bredr_capable(hdev))
1419 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
2177bab5
JH		 1420}
1421
1422static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
1423{
1424 if (lmp_ext_inq_capable(hdev))
1425 return 0x02;
1426
1427 if (lmp_inq_rssi_capable(hdev))
1428 return 0x01;
1429
1430 if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
1431 hdev->lmp_subver == 0x0757)
1432 return 0x01;
1433
1434 if (hdev->manufacturer == 15) {
1435 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
1436 return 0x01;
1437 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
1438 return 0x01;
1439 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
1440 return 0x01;
1441 }
1442
1443 if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
1444 hdev->lmp_subver == 0x1805)
1445 return 0x01;
1446
1447 return 0x00;
1448}
1449
42c6b129 1450static void hci_setup_inquiry_mode(struct hci_request *req)
2177bab5
JH		 1451{
1452 u8 mode;
1453
42c6b129 1454 mode = hci_get_inquiry_mode(req->hdev);
2177bab5 1455
42c6b129 1456 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
2177bab5
JH		 1457}
1458
42c6b129 1459static void hci_setup_event_mask(struct hci_request *req)
2177bab5 1460{
42c6b129
JH		 1461 struct hci_dev *hdev = req->hdev;
1462
2177bab5
JH		 1463 /* The second byte is 0xff instead of 0x9f (two reserved bits
1464 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
1465 * command otherwise.
1466 */
1467 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
1468
1469 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
1470 * any event mask for pre 1.2 devices.
1471 */
1472 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1473 return;
1474
1475 if (lmp_bredr_capable(hdev)) {
1476 events[4] |= 0x01; /* Flow Specification Complete */
1477 events[4] |= 0x02; /* Inquiry Result with RSSI */
1478 events[4] |= 0x04; /* Read Remote Extended Features Complete */
1479 events[5] |= 0x08; /* Synchronous Connection Complete */
1480 events[5] |= 0x10; /* Synchronous Connection Changed */
c7882cbd
MH		 1481 } else {
1482 /* Use a different default for LE-only devices */
1483 memset(events, 0, sizeof(events));
1484 events[0] |= 0x10; /* Disconnection Complete */
c7882cbd
MH		 1485 events[1] |= 0x08; /* Read Remote Version Information Complete */
1486 events[1] |= 0x20; /* Command Complete */
1487 events[1] |= 0x40; /* Command Status */
1488 events[1] |= 0x80; /* Hardware Error */
1489 events[2] |= 0x04; /* Number of Completed Packets */
1490 events[3] |= 0x02; /* Data Buffer Overflow */
0da71f1b
MH		 1491
1492 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
1493 events[0] |= 0x80; /* Encryption Change */
1494 events[5] |= 0x80; /* Encryption Key Refresh Complete */
1495 }
2177bab5
JH		 1496 }
1497
1498 if (lmp_inq_rssi_capable(hdev))
1499 events[4] |= 0x02; /* Inquiry Result with RSSI */
1500
1501 if (lmp_sniffsubr_capable(hdev))
1502 events[5] |= 0x20; /* Sniff Subrating */
1503
1504 if (lmp_pause_enc_capable(hdev))
1505 events[5] |= 0x80; /* Encryption Key Refresh Complete */
1506
1507 if (lmp_ext_inq_capable(hdev))
1508 events[5] |= 0x40; /* Extended Inquiry Result */
1509
1510 if (lmp_no_flush_capable(hdev))
1511 events[7] |= 0x01; /* Enhanced Flush Complete */
1512
1513 if (lmp_lsto_capable(hdev))
1514 events[6] |= 0x80; /* Link Supervision Timeout Changed */
1515
1516 if (lmp_ssp_capable(hdev)) {
1517 events[6] |= 0x01; /* IO Capability Request */
1518 events[6] |= 0x02; /* IO Capability Response */
1519 events[6] |= 0x04; /* User Confirmation Request */
1520 events[6] |= 0x08; /* User Passkey Request */
1521 events[6] |= 0x10; /* Remote OOB Data Request */
1522 events[6] |= 0x20; /* Simple Pairing Complete */
1523 events[7] |= 0x04; /* User Passkey Notification */
1524 events[7] |= 0x08; /* Keypress Notification */
1525 events[7] |= 0x10; /* Remote Host Supported
1526 * Features Notification
1527 */
1528 }
1529
1530 if (lmp_le_capable(hdev))
1531 events[7] |= 0x20; /* LE Meta-Event */
1532
42c6b129 1533 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
2177bab5
JH		 1534}
1535
42c6b129 1536static void hci_init2_req(struct hci_request *req, unsigned long opt)
2177bab5 1537{
42c6b129
JH		 1538 struct hci_dev *hdev = req->hdev;
1539
2177bab5 1540 if (lmp_bredr_capable(hdev))
42c6b129 1541 bredr_setup(req);
56f87901
JH		 1542 else
1543 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
2177bab5
JH		 1544
1545 if (lmp_le_capable(hdev))
42c6b129 1546 le_setup(req);
2177bab5 1547
3f8e2d75
JH		 1548 /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
1549 * local supported commands HCI command.
1550 */
1551 if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
42c6b129 1552 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
2177bab5
JH		 1553
1554 if (lmp_ssp_capable(hdev)) {
57af75a8
MH		 1555 /* When SSP is available, then the host features page
1556 * should also be available as well. However some
1557 * controllers list the max_page as 0 as long as SSP
1558 * has not been enabled. To achieve proper debugging
1559 * output, force the minimum max_page to 1 at least.
1560 */
1561 hdev->max_page = 0x01;
1562
2177bab5
JH		 1563 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1564 u8 mode = 0x01;
42c6b129
JH		 1565 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
1566 sizeof(mode), &mode);
2177bab5
JH		 1567 } else {
1568 struct hci_cp_write_eir cp;
1569
1570 memset(hdev->eir, 0, sizeof(hdev->eir));
1571 memset(&cp, 0, sizeof(cp));
1572
42c6b129 1573 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
2177bab5
JH		 1574 }
1575 }
1576
1577 if (lmp_inq_rssi_capable(hdev))
42c6b129 1578 hci_setup_inquiry_mode(req);
2177bab5
JH		 1579
1580 if (lmp_inq_tx_pwr_capable(hdev))
42c6b129 1581 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
2177bab5
JH		 1582
1583 if (lmp_ext_feat_capable(hdev)) {
1584 struct hci_cp_read_local_ext_features cp;
1585
1586 cp.page = 0x01;
42c6b129
JH		 1587 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
1588 sizeof(cp), &cp);
2177bab5
JH		 1589 }
1590
1591 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
1592 u8 enable = 1;
42c6b129
JH		 1593 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
1594 &enable);
2177bab5
JH		 1595 }
1596}
1597
42c6b129 1598static void hci_setup_link_policy(struct hci_request *req)
2177bab5 1599{
42c6b129 1600 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 1601 struct hci_cp_write_def_link_policy cp;
1602 u16 link_policy = 0;
1603
1604 if (lmp_rswitch_capable(hdev))
1605 link_policy |= HCI_LP_RSWITCH;
1606 if (lmp_hold_capable(hdev))
1607 link_policy |= HCI_LP_HOLD;
1608 if (lmp_sniff_capable(hdev))
1609 link_policy |= HCI_LP_SNIFF;
1610 if (lmp_park_capable(hdev))
1611 link_policy |= HCI_LP_PARK;
1612
1613 cp.policy = cpu_to_le16(link_policy);
42c6b129 1614 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
2177bab5
JH		 1615}
1616
42c6b129 1617static void hci_set_le_support(struct hci_request *req)
2177bab5 1618{
42c6b129 1619 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 1620 struct hci_cp_write_le_host_supported cp;
1621
c73eee91
JH		 1622 /* LE-only devices do not support explicit enablement */
1623 if (!lmp_bredr_capable(hdev))
1624 return;
1625
2177bab5
JH		 1626 memset(&cp, 0, sizeof(cp));
1627
1628 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1629 cp.le = 0x01;
32226e4f 1630 cp.simul = 0x00;
2177bab5
JH		 1631 }
1632
1633 if (cp.le != lmp_host_le_capable(hdev))
42c6b129
JH		 1634 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
1635 &cp);
2177bab5
JH		 1636}
1637
d62e6d67
JH		 1638static void hci_set_event_mask_page_2(struct hci_request *req)
1639{
1640 struct hci_dev *hdev = req->hdev;
1641 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1642
1643 /* If Connectionless Slave Broadcast master role is supported
1644 * enable all necessary events for it.
1645 */
53b834d2 1646 if (lmp_csb_master_capable(hdev)) {
d62e6d67
JH		 1647 events[1] |= 0x40; /* Triggered Clock Capture */
1648 events[1] |= 0x80; /* Synchronization Train Complete */
1649 events[2] |= 0x10; /* Slave Page Response Timeout */
1650 events[2] |= 0x20; /* CSB Channel Map Change */
1651 }
1652
1653 /* If Connectionless Slave Broadcast slave role is supported
1654 * enable all necessary events for it.
1655 */
53b834d2 1656 if (lmp_csb_slave_capable(hdev)) {
d62e6d67
JH		 1657 events[2] |= 0x01; /* Synchronization Train Received */
1658 events[2] |= 0x02; /* CSB Receive */
1659 events[2] |= 0x04; /* CSB Timeout */
1660 events[2] |= 0x08; /* Truncated Page Complete */
1661 }
1662
40c59fcb 1663 /* Enable Authenticated Payload Timeout Expired event if supported */
cd7ca0ec 1664 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
40c59fcb
MH		 1665 events[2] |= 0x80;
1666
d62e6d67
JH		 1667 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
1668}
1669
42c6b129 1670static void hci_init3_req(struct hci_request *req, unsigned long opt)
2177bab5 1671{
42c6b129 1672 struct hci_dev *hdev = req->hdev;
d2c5d77f 1673 u8 p;
42c6b129 1674
0da71f1b
MH		 1675 hci_setup_event_mask(req);
1676
b8f4e068
GP		 1677 /* Some Broadcom based Bluetooth controllers do not support the
1678 * Delete Stored Link Key command. They are clearly indicating its
1679 * absence in the bit mask of supported commands.
1680 *
1681 * Check the supported commands and only if the the command is marked
1682 * as supported send it. If not supported assume that the controller
1683 * does not have actual support for stored link keys which makes this
1684 * command redundant anyway.
f9f462fa
MH		 1685 *
1686 * Some controllers indicate that they support handling deleting
1687 * stored link keys, but they don't. The quirk lets a driver
1688 * just disable this command.
637b4cae 1689 */
f9f462fa
MH		 1690 if (hdev->commands[6] & 0x80 &&
1691 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
59f45d57
JH		 1692 struct hci_cp_delete_stored_link_key cp;
1693
1694 bacpy(&cp.bdaddr, BDADDR_ANY);
1695 cp.delete_all = 0x01;
1696 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
1697 sizeof(cp), &cp);
1698 }
1699
2177bab5 1700 if (hdev->commands[5] & 0x10)
42c6b129 1701 hci_setup_link_policy(req);
2177bab5 1702
9193c6e8
AG		 1703 if (lmp_le_capable(hdev)) {
1704 u8 events[8];
1705
1706 memset(events, 0, sizeof(events));
4d6c705b
MH		 1707 events[0] = 0x0f;
1708
1709 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
1710 events[0] |= 0x10; /* LE Long Term Key Request */
662bc2e6
AG		 1711
1712 /* If controller supports the Connection Parameters Request
1713 * Link Layer Procedure, enable the corresponding event.
1714 */
1715 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
1716 events[0] |= 0x20; /* LE Remote Connection
1717 * Parameter Request
1718 */
1719
9193c6e8
AG		 1720 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
1721 events);
1722
15a49cca
MH		 1723 if (hdev->commands[25] & 0x40) {
1724 /* Read LE Advertising Channel TX Power */
1725 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
1726 }
1727
42c6b129 1728 hci_set_le_support(req);
9193c6e8 1729 }
d2c5d77f
JH		 1730
1731 /* Read features beyond page 1 if available */
1732 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
1733 struct hci_cp_read_local_ext_features cp;
1734
1735 cp.page = p;
1736 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
1737 sizeof(cp), &cp);
1738 }
2177bab5
JH		 1739}
1740
5d4e7e8d
JH		 1741static void hci_init4_req(struct hci_request *req, unsigned long opt)
1742{
1743 struct hci_dev *hdev = req->hdev;
1744
d62e6d67
JH		 1745 /* Set event mask page 2 if the HCI command for it is supported */
1746 if (hdev->commands[22] & 0x04)
1747 hci_set_event_mask_page_2(req);
1748
109e3191
MH		 1749 /* Read local codec list if the HCI command is supported */
1750 if (hdev->commands[29] & 0x20)
1751 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
1752
f4fe73ed
MH		 1753 /* Get MWS transport configuration if the HCI command is supported */
1754 if (hdev->commands[30] & 0x08)
1755 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
1756
5d4e7e8d 1757 /* Check for Synchronization Train support */
53b834d2 1758 if (lmp_sync_train_capable(hdev))
5d4e7e8d 1759 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
a6d0d690
MH		 1760
1761 /* Enable Secure Connections if supported and configured */
5afeac14 1762 if ((lmp_sc_capable(hdev) ||
111902f7 1763 test_bit(HCI_FORCE_SC, &hdev->dbg_flags)) &&
a6d0d690
MH		 1764 test_bit(HCI_SC_ENABLED, &hdev->dev_flags)) {
1765 u8 support = 0x01;
1766 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
1767 sizeof(support), &support);
1768 }
5d4e7e8d
JH		 1769}
1770
2177bab5
JH		 1771static int __hci_init(struct hci_dev *hdev)
1772{
1773 int err;
1774
1775 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
1776 if (err < 0)
1777 return err;
1778
4b4148e9
MH		 1779 /* The Device Under Test (DUT) mode is special and available for
1780 * all controller types. So just create it early on.
1781 */
1782 if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
1783 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
1784 &dut_mode_fops);
1785 }
1786
2177bab5
JH		 1787 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
1788 * BR/EDR/LE type controllers. AMP controllers only need the
1789 * first stage init.
1790 */
1791 if (hdev->dev_type != HCI_BREDR)
1792 return 0;
1793
1794 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
1795 if (err < 0)
1796 return err;
1797
5d4e7e8d
JH		 1798 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
1799 if (err < 0)
1800 return err;
1801
baf27f6e
MH		 1802 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
1803 if (err < 0)
1804 return err;
1805
1806 /* Only create debugfs entries during the initial setup
1807 * phase and not every time the controller gets powered on.
1808 */
1809 if (!test_bit(HCI_SETUP, &hdev->dev_flags))
1810 return 0;
1811
dfb826a8
MH		 1812 debugfs_create_file("features", 0444, hdev->debugfs, hdev,
1813 &features_fops);
ceeb3bc0
MH		 1814 debugfs_create_u16("manufacturer", 0444, hdev->debugfs,
1815 &hdev->manufacturer);
1816 debugfs_create_u8("hci_version", 0444, hdev->debugfs, &hdev->hci_ver);
1817 debugfs_create_u16("hci_revision", 0444, hdev->debugfs, &hdev->hci_rev);
70afe0b8
MH		 1818 debugfs_create_file("blacklist", 0444, hdev->debugfs, hdev,
1819 &blacklist_fops);
6659358e
JH		 1820 debugfs_create_file("whitelist", 0444, hdev->debugfs, hdev,
1821 &whitelist_fops);
47219839
MH		 1822 debugfs_create_file("uuids", 0444, hdev->debugfs, hdev, &uuids_fops);
1823
31ad1691
AK		 1824 debugfs_create_file("conn_info_min_age", 0644, hdev->debugfs, hdev,
1825 &conn_info_min_age_fops);
1826 debugfs_create_file("conn_info_max_age", 0644, hdev->debugfs, hdev,
1827 &conn_info_max_age_fops);
1828
baf27f6e
MH		 1829 if (lmp_bredr_capable(hdev)) {
1830 debugfs_create_file("inquiry_cache", 0444, hdev->debugfs,
1831 hdev, &inquiry_cache_fops);
02d08d15
MH		 1832 debugfs_create_file("link_keys", 0400, hdev->debugfs,
1833 hdev, &link_keys_fops);
babdbb3c
MH		 1834 debugfs_create_file("dev_class", 0444, hdev->debugfs,
1835 hdev, &dev_class_fops);
041000b9
MH		 1836 debugfs_create_file("voice_setting", 0444, hdev->debugfs,
1837 hdev, &voice_setting_fops);
baf27f6e
MH		 1838 }
1839
06f5b778 1840 if (lmp_ssp_capable(hdev)) {
ebd1e33b
MH		 1841 debugfs_create_file("auto_accept_delay", 0644, hdev->debugfs,
1842 hdev, &auto_accept_delay_fops);
5afeac14
MH		 1843 debugfs_create_file("force_sc_support", 0644, hdev->debugfs,
1844 hdev, &force_sc_support_fops);
134c2a89
MH		 1845 debugfs_create_file("sc_only_mode", 0444, hdev->debugfs,
1846 hdev, &sc_only_mode_fops);
06f5b778 1847 }
ebd1e33b 1848
2bfa3531
MH		 1849 if (lmp_sniff_capable(hdev)) {
1850 debugfs_create_file("idle_timeout", 0644, hdev->debugfs,
1851 hdev, &idle_timeout_fops);
1852 debugfs_create_file("sniff_min_interval", 0644, hdev->debugfs,
1853 hdev, &sniff_min_interval_fops);
1854 debugfs_create_file("sniff_max_interval", 0644, hdev->debugfs,
1855 hdev, &sniff_max_interval_fops);
1856 }
1857
d0f729b8 1858 if (lmp_le_capable(hdev)) {
ac345813
MH		 1859 debugfs_create_file("identity", 0400, hdev->debugfs,
1860 hdev, &identity_fops);
1861 debugfs_create_file("rpa_timeout", 0644, hdev->debugfs,
1862 hdev, &rpa_timeout_fops);
7a4cd51d
MH		 1863 debugfs_create_file("random_address", 0444, hdev->debugfs,
1864 hdev, &random_address_fops);
b32bba6c
MH		 1865 debugfs_create_file("static_address", 0444, hdev->debugfs,
1866 hdev, &static_address_fops);
1867
1868 /* For controllers with a public address, provide a debug
1869 * option to force the usage of the configured static
1870 * address. By default the public address is used.
1871 */
1872 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1873 debugfs_create_file("force_static_address", 0644,
1874 hdev->debugfs, hdev,
1875 &force_static_address_fops);
1876
d0f729b8
MH		 1877 debugfs_create_u8("white_list_size", 0444, hdev->debugfs,
1878 &hdev->le_white_list_size);
d2ab0ac1
MH		 1879 debugfs_create_file("white_list", 0444, hdev->debugfs, hdev,
1880 &white_list_fops);
3698d704
MH		 1881 debugfs_create_file("identity_resolving_keys", 0400,
1882 hdev->debugfs, hdev,
1883 &identity_resolving_keys_fops);
8f8625cd
MH		 1884 debugfs_create_file("long_term_keys", 0400, hdev->debugfs,
1885 hdev, &long_term_keys_fops);
4e70c7e7
MH		 1886 debugfs_create_file("conn_min_interval", 0644, hdev->debugfs,
1887 hdev, &conn_min_interval_fops);
1888 debugfs_create_file("conn_max_interval", 0644, hdev->debugfs,
1889 hdev, &conn_max_interval_fops);
816a93d1
MH		 1890 debugfs_create_file("conn_latency", 0644, hdev->debugfs,
1891 hdev, &conn_latency_fops);
f1649577
MH		 1892 debugfs_create_file("supervision_timeout", 0644, hdev->debugfs,
1893 hdev, &supervision_timeout_fops);
3f959d46
MH		 1894 debugfs_create_file("adv_channel_map", 0644, hdev->debugfs,
1895 hdev, &adv_channel_map_fops);
729a1051
GL		 1896 debugfs_create_file("adv_min_interval", 0644, hdev->debugfs,
1897 hdev, &adv_min_interval_fops);
1898 debugfs_create_file("adv_max_interval", 0644, hdev->debugfs,
1899 hdev, &adv_max_interval_fops);
0b3c7d37
MH		 1900 debugfs_create_file("device_list", 0444, hdev->debugfs, hdev,
1901 &device_list_fops);
b9a7a61e
LR		 1902 debugfs_create_u16("discov_interleaved_timeout", 0644,
1903 hdev->debugfs,
1904 &hdev->discov_interleaved_timeout);
54506918 1905
711eafe3 1906 smp_register(hdev);
d0f729b8 1907 }
e7b8fc92 1908
baf27f6e 1909 return 0;
2177bab5
JH		 1910}
1911
0ebca7d6
MH		 1912static void hci_init0_req(struct hci_request *req, unsigned long opt)
1913{
1914 struct hci_dev *hdev = req->hdev;
1915
1916 BT_DBG("%s %ld", hdev->name, opt);
1917
1918 /* Reset */
1919 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
1920 hci_reset_req(req, 0);
1921
1922 /* Read Local Version */
1923 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1924
1925 /* Read BD Address */
1926 if (hdev->set_bdaddr)
1927 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1928}
1929
1930static int __hci_unconf_init(struct hci_dev *hdev)
1931{
1932 int err;
1933
cc78b44b
MH		 1934 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
1935 return 0;
1936
0ebca7d6
MH		 1937 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT);
1938 if (err < 0)
1939 return err;
1940
1941 return 0;
1942}
1943
42c6b129 1944static void hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1945{
1946 __u8 scan = opt;
1947
42c6b129 1948 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 1949
1950 /* Inquiry and Page scans */
42c6b129 1951 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1da177e4
LT		 1952}
1953
42c6b129 1954static void hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1955{
1956 __u8 auth = opt;
1957
42c6b129 1958 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 1959
1960 /* Authentication */
42c6b129 1961 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1da177e4
LT		 1962}
1963
42c6b129 1964static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1965{
1966 __u8 encrypt = opt;
1967
42c6b129 1968 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 1969
e4e8e37c 1970 /* Encryption */
42c6b129 1971 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1da177e4
LT		 1972}
1973
42c6b129 1974static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 1975{
1976 __le16 policy = cpu_to_le16(opt);
1977
42c6b129 1978 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 1979
1980 /* Default link policy */
42c6b129 1981 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
e4e8e37c
MH		 1982}
1983
8e87d142 1984/* Get HCI device by index.
1da177e4
LT		 1985 * Device is held on return. */
1986struct hci_dev *hci_dev_get(int index)
1987{
8035ded4 1988 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 1989
1990 BT_DBG("%d", index);
1991
1992 if (index < 0)
1993 return NULL;
1994
1995 read_lock(&hci_dev_list_lock);
8035ded4 1996 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 1997 if (d->id == index) {
1998 hdev = hci_dev_hold(d);
1999 break;
2000 }
2001 }
2002 read_unlock(&hci_dev_list_lock);
2003 return hdev;
2004}
1da177e4
LT		 2005
2006/* ---- Inquiry support ---- */
ff9ef578 2007
30dc78e1
JH		 2008bool hci_discovery_active(struct hci_dev *hdev)
2009{
2010 struct discovery_state *discov = &hdev->discovery;
2011
6fbe195d 2012 switch (discov->state) {
343f935b 2013 case DISCOVERY_FINDING:
6fbe195d 2014 case DISCOVERY_RESOLVING:
30dc78e1
JH		 2015 return true;
2016
6fbe195d
AG		 2017 default:
2018 return false;
2019 }
30dc78e1
JH		 2020}
2021
ff9ef578
JH		 2022void hci_discovery_set_state(struct hci_dev *hdev, int state)
2023{
bb3e0a33
JH		 2024 int old_state = hdev->discovery.state;
2025
ff9ef578
JH		 2026 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
2027
bb3e0a33 2028 if (old_state == state)
ff9ef578
JH		 2029 return;
2030
bb3e0a33
JH		 2031 hdev->discovery.state = state;
2032
ff9ef578
JH		 2033 switch (state) {
2034 case DISCOVERY_STOPPED:
c54c3860
AG		 2035 hci_update_background_scan(hdev);
2036
bb3e0a33 2037 if (old_state != DISCOVERY_STARTING)
7b99b659 2038 mgmt_discovering(hdev, 0);
ff9ef578
JH		 2039 break;
2040 case DISCOVERY_STARTING:
2041 break;
343f935b 2042 case DISCOVERY_FINDING:
ff9ef578
JH		 2043 mgmt_discovering(hdev, 1);
2044 break;
30dc78e1
JH		 2045 case DISCOVERY_RESOLVING:
2046 break;
ff9ef578
JH		 2047 case DISCOVERY_STOPPING:
2048 break;
2049 }
ff9ef578
JH		 2050}
2051
1f9b9a5d 2052void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 2053{
30883512 2054 struct discovery_state *cache = &hdev->discovery;
b57c1a56 2055 struct inquiry_entry *p, *n;
1da177e4 2056
561aafbc
JH		 2057 list_for_each_entry_safe(p, n, &cache->all, all) {
2058 list_del(&p->all);
b57c1a56 2059 kfree(p);
1da177e4 2060 }
561aafbc
JH		 2061
2062 INIT_LIST_HEAD(&cache->unknown);
2063 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 2064}
2065
a8c5fb1a
GP		 2066struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
2067 bdaddr_t *bdaddr)
1da177e4 2068{
30883512 2069 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 2070 struct inquiry_entry *e;
2071
6ed93dc6 2072 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 2073
561aafbc
JH		 2074 list_for_each_entry(e, &cache->all, all) {
2075 if (!bacmp(&e->data.bdaddr, bdaddr))
2076 return e;
2077 }
2078
2079 return NULL;
2080}
2081
2082struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 2083 bdaddr_t *bdaddr)
561aafbc 2084{
30883512 2085 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 2086 struct inquiry_entry *e;
2087
6ed93dc6 2088 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 2089
2090 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 2091 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 2092 return e;
2093 }
2094
2095 return NULL;
1da177e4
LT		 2096}
2097
30dc78e1 2098struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 2099 bdaddr_t *bdaddr,
2100 int state)
30dc78e1
JH		 2101{
2102 struct discovery_state *cache = &hdev->discovery;
2103 struct inquiry_entry *e;
2104
6ed93dc6 2105 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 2106
2107 list_for_each_entry(e, &cache->resolve, list) {
2108 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
2109 return e;
2110 if (!bacmp(&e->data.bdaddr, bdaddr))
2111 return e;
2112 }
2113
2114 return NULL;
2115}
2116
a3d4e20a 2117void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 2118 struct inquiry_entry *ie)
a3d4e20a
JH		 2119{
2120 struct discovery_state *cache = &hdev->discovery;
2121 struct list_head *pos = &cache->resolve;
2122 struct inquiry_entry *p;
2123
2124 list_del(&ie->list);
2125
2126 list_for_each_entry(p, &cache->resolve, list) {
2127 if (p->name_state != NAME_PENDING &&
a8c5fb1a 2128 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 2129 break;
2130 pos = &p->list;
2131 }
2132
2133 list_add(&ie->list, pos);
2134}
2135
af58925c
MH		 2136u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
2137 bool name_known)
1da177e4 2138{
30883512 2139 struct discovery_state *cache = &hdev->discovery;
70f23020 2140 struct inquiry_entry *ie;
af58925c 2141 u32 flags = 0;
1da177e4 2142
6ed93dc6 2143 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 2144
2b2fec4d
SJ		 2145 hci_remove_remote_oob_data(hdev, &data->bdaddr);
2146
af58925c
MH		 2147 if (!data->ssp_mode)
2148 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 2149
70f23020 2150 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 2151 if (ie) {
af58925c
MH		 2152 if (!ie->data.ssp_mode)
2153 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 2154
a3d4e20a 2155 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 2156 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 2157 ie->data.rssi = data->rssi;
2158 hci_inquiry_cache_update_resolve(hdev, ie);
2159 }
2160
561aafbc 2161 goto update;
a3d4e20a 2162 }
561aafbc
JH		 2163
2164 /* Entry not in the cache. Add new one. */
27f70f3e 2165 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
af58925c
MH		 2166 if (!ie) {
2167 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
2168 goto done;
2169 }
561aafbc
JH		 2170
2171 list_add(&ie->all, &cache->all);
2172
2173 if (name_known) {
2174 ie->name_state = NAME_KNOWN;
2175 } else {
2176 ie->name_state = NAME_NOT_KNOWN;
2177 list_add(&ie->list, &cache->unknown);
2178 }
70f23020 2179
561aafbc
JH		 2180update:
2181 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 2182 ie->name_state != NAME_PENDING) {
561aafbc
JH		 2183 ie->name_state = NAME_KNOWN;
2184 list_del(&ie->list);
1da177e4
LT		 2185 }
2186
70f23020
AE		 2187 memcpy(&ie->data, data, sizeof(*data));
2188 ie->timestamp = jiffies;
1da177e4 2189 cache->timestamp = jiffies;
3175405b
JH		 2190
2191 if (ie->name_state == NAME_NOT_KNOWN)
af58925c 2192 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
3175405b 2193
af58925c
MH		 2194done:
2195 return flags;
1da177e4
LT		 2196}
2197
2198static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
2199{
30883512 2200 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 2201 struct inquiry_info *info = (struct inquiry_info *) buf;
2202 struct inquiry_entry *e;
2203 int copied = 0;
2204
561aafbc 2205 list_for_each_entry(e, &cache->all, all) {
1da177e4 2206 struct inquiry_data *data = &e->data;
b57c1a56
JH		 2207
2208 if (copied >= num)
2209 break;
2210
1da177e4
LT		 2211 bacpy(&info->bdaddr, &data->bdaddr);
2212 info->pscan_rep_mode = data->pscan_rep_mode;
2213 info->pscan_period_mode = data->pscan_period_mode;
2214 info->pscan_mode = data->pscan_mode;
2215 memcpy(info->dev_class, data->dev_class, 3);
2216 info->clock_offset = data->clock_offset;
b57c1a56 2217
1da177e4 2218 info++;
b57c1a56 2219 copied++;
1da177e4
LT		 2220 }
2221
2222 BT_DBG("cache %p, copied %d", cache, copied);
2223 return copied;
2224}
2225
42c6b129 2226static void hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 2227{
2228 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 2229 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 2230 struct hci_cp_inquiry cp;
2231
2232 BT_DBG("%s", hdev->name);
2233
2234 if (test_bit(HCI_INQUIRY, &hdev->flags))
2235 return;
2236
2237 /* Start Inquiry */
2238 memcpy(&cp.lap, &ir->lap, 3);
2239 cp.length = ir->length;
2240 cp.num_rsp = ir->num_rsp;
42c6b129 2241 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1da177e4
LT		 2242}
2243
2244int hci_inquiry(void __user *arg)
2245{
2246 __u8 __user *ptr = arg;
2247 struct hci_inquiry_req ir;
2248 struct hci_dev *hdev;
2249 int err = 0, do_inquiry = 0, max_rsp;
2250 long timeo;
2251 __u8 *buf;
2252
2253 if (copy_from_user(&ir, ptr, sizeof(ir)))
2254 return -EFAULT;
2255
5a08ecce
AE		 2256 hdev = hci_dev_get(ir.dev_id);
2257 if (!hdev)
1da177e4
LT		 2258 return -ENODEV;
2259
0736cfa8
MH		 2260 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2261 err = -EBUSY;
2262 goto done;
2263 }
2264
4a964404 2265 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
fee746b0
MH		 2266 err = -EOPNOTSUPP;
2267 goto done;
2268 }
2269
5b69bef5
MH		 2270 if (hdev->dev_type != HCI_BREDR) {
2271 err = -EOPNOTSUPP;
2272 goto done;
2273 }
2274
56f87901
JH		 2275 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2276 err = -EOPNOTSUPP;
2277 goto done;
2278 }
2279
09fd0de5 2280 hci_dev_lock(hdev);
8e87d142 2281 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 2282 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 2283 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 2284 do_inquiry = 1;
2285 }
09fd0de5 2286 hci_dev_unlock(hdev);
1da177e4 2287
04837f64 2288 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 2289
2290 if (do_inquiry) {
01178cd4
JH		 2291 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
2292 timeo);
70f23020
AE		 2293 if (err < 0)
2294 goto done;
3e13fa1e
AG		 2295
2296 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
2297 * cleared). If it is interrupted by a signal, return -EINTR.
2298 */
74316201 2299 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
3e13fa1e
AG		 2300 TASK_INTERRUPTIBLE))
2301 return -EINTR;
70f23020 2302 }
1da177e4 2303
8fc9ced3
GP		 2304 /* for unlimited number of responses we will use buffer with
2305 * 255 entries
2306 */
1da177e4
LT		 2307 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
2308
2309 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
2310 * copy it to the user space.
2311 */
01df8c31 2312 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 2313 if (!buf) {
1da177e4
LT		 2314 err = -ENOMEM;
2315 goto done;
2316 }
2317
09fd0de5 2318 hci_dev_lock(hdev);
1da177e4 2319 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 2320 hci_dev_unlock(hdev);
1da177e4
LT		 2321
2322 BT_DBG("num_rsp %d", ir.num_rsp);
2323
2324 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
2325 ptr += sizeof(ir);
2326 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 2327 ir.num_rsp))
1da177e4 2328 err = -EFAULT;
8e87d142 2329 } else
1da177e4
LT		 2330 err = -EFAULT;
2331
2332 kfree(buf);
2333
2334done:
2335 hci_dev_put(hdev);
2336 return err;
2337}
2338
cbed0ca1 2339static int hci_dev_do_open(struct hci_dev *hdev)
1da177e4 2340{
1da177e4
LT		 2341 int ret = 0;
2342
1da177e4
LT		 2343 BT_DBG("%s %p", hdev->name, hdev);
2344
2345 hci_req_lock(hdev);
2346
94324962
JH		 2347 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
2348 ret = -ENODEV;
2349 goto done;
2350 }
2351
d603b76b
MH		 2352 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
2353 !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
a5c8f270
MH		 2354 /* Check for rfkill but allow the HCI setup stage to
2355 * proceed (which in itself doesn't cause any RF activity).
2356 */
2357 if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
2358 ret = -ERFKILL;
2359 goto done;
2360 }
2361
2362 /* Check for valid public address or a configured static
2363 * random adddress, but let the HCI setup proceed to
2364 * be able to determine if there is a public address
2365 * or not.
2366 *
c6beca0e
MH		 2367 * In case of user channel usage, it is not important
2368 * if a public address or static random address is
2369 * available.
2370 *
a5c8f270
MH		 2371 * This check is only valid for BR/EDR controllers
2372 * since AMP controllers do not have an address.
2373 */
c6beca0e
MH		 2374 if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
2375 hdev->dev_type == HCI_BREDR &&
a5c8f270
MH		 2376 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2377 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
2378 ret = -EADDRNOTAVAIL;
2379 goto done;
2380 }
611b30f7
MH		 2381 }
2382
1da177e4
LT		 2383 if (test_bit(HCI_UP, &hdev->flags)) {
2384 ret = -EALREADY;
2385 goto done;
2386 }
2387
1da177e4
LT		 2388 if (hdev->open(hdev)) {
2389 ret = -EIO;
2390 goto done;
2391 }
2392
f41c70c4
MH		 2393 atomic_set(&hdev->cmd_cnt, 1);
2394 set_bit(HCI_INIT, &hdev->flags);
2395
af202f84
MH		 2396 if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
2397 if (hdev->setup)
2398 ret = hdev->setup(hdev);
f41c70c4 2399
af202f84
MH		 2400 /* The transport driver can set these quirks before
2401 * creating the HCI device or in its setup callback.
2402 *
2403 * In case any of them is set, the controller has to
2404 * start up as unconfigured.
2405 */
eb1904f4
MH		 2406 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
2407 test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
89bc22d2 2408 set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
f41c70c4 2409
0ebca7d6
MH		 2410 /* For an unconfigured controller it is required to
2411 * read at least the version information provided by
2412 * the Read Local Version Information command.
2413 *
2414 * If the set_bdaddr driver callback is provided, then
2415 * also the original Bluetooth public device address
2416 * will be read using the Read BD Address command.
2417 */
2418 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
2419 ret = __hci_unconf_init(hdev);
89bc22d2
MH		 2420 }
2421
9713c17b
MH		 2422 if (test_bit(HCI_CONFIG, &hdev->dev_flags)) {
2423 /* If public address change is configured, ensure that
2424 * the address gets programmed. If the driver does not
2425 * support changing the public address, fail the power
2426 * on procedure.
2427 */
2428 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
2429 hdev->set_bdaddr)
24c457e2
MH		 2430 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
2431 else
2432 ret = -EADDRNOTAVAIL;
2433 }
2434
f41c70c4 2435 if (!ret) {
4a964404 2436 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
0736cfa8 2437 !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
f41c70c4 2438 ret = __hci_init(hdev);
1da177e4
LT		 2439 }
2440
f41c70c4
MH		 2441 clear_bit(HCI_INIT, &hdev->flags);
2442
1da177e4
LT		 2443 if (!ret) {
2444 hci_dev_hold(hdev);
d6bfd59c 2445 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1da177e4
LT		 2446 set_bit(HCI_UP, &hdev->flags);
2447 hci_notify(hdev, HCI_DEV_UP);
bb4b2a9a 2448 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
d603b76b 2449 !test_bit(HCI_CONFIG, &hdev->dev_flags) &&
4a964404 2450 !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
0736cfa8 2451 !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
1514b892 2452 hdev->dev_type == HCI_BREDR) {
09fd0de5 2453 hci_dev_lock(hdev);
744cf19e 2454 mgmt_powered(hdev, 1);
09fd0de5 2455 hci_dev_unlock(hdev);
56e5cb86 2456 }
8e87d142 2457 } else {
1da177e4 2458 /* Init failed, cleanup */
3eff45ea 2459 flush_work(&hdev->tx_work);
c347b765 2460 flush_work(&hdev->cmd_work);
b78752cc 2461 flush_work(&hdev->rx_work);
1da177e4
LT		 2462
2463 skb_queue_purge(&hdev->cmd_q);
2464 skb_queue_purge(&hdev->rx_q);
2465
2466 if (hdev->flush)
2467 hdev->flush(hdev);
2468
2469 if (hdev->sent_cmd) {
2470 kfree_skb(hdev->sent_cmd);
2471 hdev->sent_cmd = NULL;
2472 }
2473
2474 hdev->close(hdev);
fee746b0 2475 hdev->flags &= BIT(HCI_RAW);
1da177e4
LT		 2476 }
2477
2478done:
2479 hci_req_unlock(hdev);
1da177e4
LT		 2480 return ret;
2481}
2482
cbed0ca1
JH		 2483/* ---- HCI ioctl helpers ---- */
2484
2485int hci_dev_open(__u16 dev)
2486{
2487 struct hci_dev *hdev;
2488 int err;
2489
2490 hdev = hci_dev_get(dev);
2491 if (!hdev)
2492 return -ENODEV;
2493
4a964404 2494 /* Devices that are marked as unconfigured can only be powered
fee746b0
MH		 2495 * up as user channel. Trying to bring them up as normal devices
2496 * will result into a failure. Only user channel operation is
2497 * possible.
2498 *
2499 * When this function is called for a user channel, the flag
2500 * HCI_USER_CHANNEL will be set first before attempting to
2501 * open the device.
2502 */
4a964404 2503 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
fee746b0
MH		 2504 !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2505 err = -EOPNOTSUPP;
2506 goto done;
2507 }
2508
e1d08f40
JH		 2509 /* We need to ensure that no other power on/off work is pending
2510 * before proceeding to call hci_dev_do_open. This is
2511 * particularly important if the setup procedure has not yet
2512 * completed.
2513 */
2514 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2515 cancel_delayed_work(&hdev->power_off);
2516
a5c8f270
MH		 2517 /* After this call it is guaranteed that the setup procedure
2518 * has finished. This means that error conditions like RFKILL
2519 * or no valid public or static random address apply.
2520 */
e1d08f40
JH		 2521 flush_workqueue(hdev->req_workqueue);
2522
12aa4f0a 2523 /* For controllers not using the management interface and that
b6ae8457 2524 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
12aa4f0a
MH		 2525 * so that pairing works for them. Once the management interface
2526 * is in use this bit will be cleared again and userspace has
2527 * to explicitly enable it.
2528 */
2529 if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
2530 !test_bit(HCI_MGMT, &hdev->dev_flags))
b6ae8457 2531 set_bit(HCI_BONDABLE, &hdev->dev_flags);
12aa4f0a 2532
cbed0ca1
JH		 2533 err = hci_dev_do_open(hdev);
2534
fee746b0 2535done:
cbed0ca1 2536 hci_dev_put(hdev);
cbed0ca1
JH		 2537 return err;
2538}
2539
d7347f3c
JH		 2540/* This function requires the caller holds hdev->lock */
2541static void hci_pend_le_actions_clear(struct hci_dev *hdev)
2542{
2543 struct hci_conn_params *p;
2544
f161dd41
JH		 2545 list_for_each_entry(p, &hdev->le_conn_params, list) {
2546 if (p->conn) {
2547 hci_conn_drop(p->conn);
f8aaf9b6 2548 hci_conn_put(p->conn);
f161dd41
JH		 2549 p->conn = NULL;
2550 }
d7347f3c 2551 list_del_init(&p->action);
f161dd41 2552 }
d7347f3c
JH		 2553
2554 BT_DBG("All LE pending actions cleared");
2555}
2556
1da177e4
LT		 2557static int hci_dev_do_close(struct hci_dev *hdev)
2558{
2559 BT_DBG("%s %p", hdev->name, hdev);
2560
78c04c0b
VCG		 2561 cancel_delayed_work(&hdev->power_off);
2562
1da177e4
LT		 2563 hci_req_cancel(hdev, ENODEV);
2564 hci_req_lock(hdev);
2565
2566 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
65cc2b49 2567 cancel_delayed_work_sync(&hdev->cmd_timer);
1da177e4
LT		 2568 hci_req_unlock(hdev);
2569 return 0;
2570 }
2571
3eff45ea
GP		 2572 /* Flush RX and TX works */
2573 flush_work(&hdev->tx_work);
b78752cc 2574 flush_work(&hdev->rx_work);
1da177e4 2575
16ab91ab 2576 if (hdev->discov_timeout > 0) {
e0f9309f 2577 cancel_delayed_work(&hdev->discov_off);
16ab91ab 2578 hdev->discov_timeout = 0;
5e5282bb 2579 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
310a3d48 2580 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
16ab91ab
JH		 2581 }
2582
a8b2d5c2 2583 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
7d78525d
JH		 2584 cancel_delayed_work(&hdev->service_cache);
2585
7ba8b4be 2586 cancel_delayed_work_sync(&hdev->le_scan_disable);
4518bb0f
JH		 2587
2588 if (test_bit(HCI_MGMT, &hdev->dev_flags))
2589 cancel_delayed_work_sync(&hdev->rpa_expired);
7ba8b4be 2590
09fd0de5 2591 hci_dev_lock(hdev);
1f9b9a5d 2592 hci_inquiry_cache_flush(hdev);
d7347f3c 2593 hci_pend_le_actions_clear(hdev);
f161dd41 2594 hci_conn_hash_flush(hdev);
09fd0de5 2595 hci_dev_unlock(hdev);
1da177e4
LT		 2596
2597 hci_notify(hdev, HCI_DEV_DOWN);
2598
2599 if (hdev->flush)
2600 hdev->flush(hdev);
2601
2602 /* Reset device */
2603 skb_queue_purge(&hdev->cmd_q);
2604 atomic_set(&hdev->cmd_cnt, 1);
4a964404
MH		 2605 if (!test_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
2606 !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
a6c511c6 2607 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1da177e4 2608 set_bit(HCI_INIT, &hdev->flags);
01178cd4 2609 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1da177e4
LT		 2610 clear_bit(HCI_INIT, &hdev->flags);
2611 }
2612
c347b765
GP		 2613 /* flush cmd work */
2614 flush_work(&hdev->cmd_work);
1da177e4
LT		 2615
2616 /* Drop queues */
2617 skb_queue_purge(&hdev->rx_q);
2618 skb_queue_purge(&hdev->cmd_q);
2619 skb_queue_purge(&hdev->raw_q);
2620
2621 /* Drop last sent command */
2622 if (hdev->sent_cmd) {
65cc2b49 2623 cancel_delayed_work_sync(&hdev->cmd_timer);
1da177e4
LT		 2624 kfree_skb(hdev->sent_cmd);
2625 hdev->sent_cmd = NULL;
2626 }
2627
b6ddb638
JH		 2628 kfree_skb(hdev->recv_evt);
2629 hdev->recv_evt = NULL;
2630
1da177e4
LT		 2631 /* After this point our queues are empty
2632 * and no tasks are scheduled. */
2633 hdev->close(hdev);
2634
35b973c9 2635 /* Clear flags */
fee746b0 2636 hdev->flags &= BIT(HCI_RAW);
35b973c9
JH		 2637 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
2638
93c311a0
MH		 2639 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
2640 if (hdev->dev_type == HCI_BREDR) {
2641 hci_dev_lock(hdev);
2642 mgmt_powered(hdev, 0);
2643 hci_dev_unlock(hdev);
2644 }
8ee56540 2645 }
5add6af8 2646
ced5c338 2647 /* Controller radio is available but is currently powered down */
536619e8 2648 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
ced5c338 2649
e59fda8d 2650 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 2651 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
7a4cd51d 2652 bacpy(&hdev->random_addr, BDADDR_ANY);
e59fda8d 2653
1da177e4
LT		 2654 hci_req_unlock(hdev);
2655
2656 hci_dev_put(hdev);
2657 return 0;
2658}
2659
2660int hci_dev_close(__u16 dev)
2661{
2662 struct hci_dev *hdev;
2663 int err;
2664
70f23020
AE		 2665 hdev = hci_dev_get(dev);
2666 if (!hdev)
1da177e4 2667 return -ENODEV;
8ee56540 2668
0736cfa8
MH		 2669 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2670 err = -EBUSY;
2671 goto done;
2672 }
2673
8ee56540
MH		 2674 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2675 cancel_delayed_work(&hdev->power_off);
2676
1da177e4 2677 err = hci_dev_do_close(hdev);
8ee56540 2678
0736cfa8 2679done:
1da177e4
LT		 2680 hci_dev_put(hdev);
2681 return err;
2682}
2683
2684int hci_dev_reset(__u16 dev)
2685{
2686 struct hci_dev *hdev;
2687 int ret = 0;
2688
70f23020
AE		 2689 hdev = hci_dev_get(dev);
2690 if (!hdev)
1da177e4
LT		 2691 return -ENODEV;
2692
2693 hci_req_lock(hdev);
1da177e4 2694
808a049e
MH		 2695 if (!test_bit(HCI_UP, &hdev->flags)) {
2696 ret = -ENETDOWN;
1da177e4 2697 goto done;
808a049e 2698 }
1da177e4 2699
0736cfa8
MH		 2700 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2701 ret = -EBUSY;
2702 goto done;
2703 }
2704
4a964404 2705 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
fee746b0
MH		 2706 ret = -EOPNOTSUPP;
2707 goto done;
2708 }
2709
1da177e4
LT		 2710 /* Drop queues */
2711 skb_queue_purge(&hdev->rx_q);
2712 skb_queue_purge(&hdev->cmd_q);
2713
09fd0de5 2714 hci_dev_lock(hdev);
1f9b9a5d 2715 hci_inquiry_cache_flush(hdev);
1da177e4 2716 hci_conn_hash_flush(hdev);
09fd0de5 2717 hci_dev_unlock(hdev);
1da177e4
LT		 2718
2719 if (hdev->flush)
2720 hdev->flush(hdev);
2721
8e87d142 2722 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 2723 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4 2724
fee746b0 2725 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1da177e4
LT		 2726
2727done:
1da177e4
LT		 2728 hci_req_unlock(hdev);
2729 hci_dev_put(hdev);
2730 return ret;
2731}
2732
2733int hci_dev_reset_stat(__u16 dev)
2734{
2735 struct hci_dev *hdev;
2736 int ret = 0;
2737
70f23020
AE		 2738 hdev = hci_dev_get(dev);
2739 if (!hdev)
1da177e4
LT		 2740 return -ENODEV;
2741
0736cfa8
MH		 2742 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2743 ret = -EBUSY;
2744 goto done;
2745 }
2746
4a964404 2747 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
fee746b0
MH		 2748 ret = -EOPNOTSUPP;
2749 goto done;
2750 }
2751
1da177e4
LT		 2752 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
2753
0736cfa8 2754done:
1da177e4 2755 hci_dev_put(hdev);
1da177e4
LT		 2756 return ret;
2757}
2758
123abc08
JH		 2759static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
2760{
bc6d2d04 2761 bool conn_changed, discov_changed;
123abc08
JH		 2762
2763 BT_DBG("%s scan 0x%02x", hdev->name, scan);
2764
2765 if ((scan & SCAN_PAGE))
2766 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
2767 &hdev->dev_flags);
2768 else
2769 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
2770 &hdev->dev_flags);
2771
bc6d2d04
JH		 2772 if ((scan & SCAN_INQUIRY)) {
2773 discov_changed = !test_and_set_bit(HCI_DISCOVERABLE,
2774 &hdev->dev_flags);
2775 } else {
2776 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
2777 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
2778 &hdev->dev_flags);
2779 }
2780
123abc08
JH		 2781 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2782 return;
2783
bc6d2d04
JH		 2784 if (conn_changed || discov_changed) {
2785 /* In case this was disabled through mgmt */
2786 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
2787
2788 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
2789 mgmt_update_adv_data(hdev);
2790
123abc08 2791 mgmt_new_settings(hdev);
bc6d2d04 2792 }
123abc08
JH		 2793}
2794
1da177e4
LT		 2795int hci_dev_cmd(unsigned int cmd, void __user *arg)
2796{
2797 struct hci_dev *hdev;
2798 struct hci_dev_req dr;
2799 int err = 0;
2800
2801 if (copy_from_user(&dr, arg, sizeof(dr)))
2802 return -EFAULT;
2803
70f23020
AE		 2804 hdev = hci_dev_get(dr.dev_id);
2805 if (!hdev)
1da177e4
LT		 2806 return -ENODEV;
2807
0736cfa8
MH		 2808 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2809 err = -EBUSY;
2810 goto done;
2811 }
2812
4a964404 2813 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
fee746b0
MH		 2814 err = -EOPNOTSUPP;
2815 goto done;
2816 }
2817
5b69bef5
MH		 2818 if (hdev->dev_type != HCI_BREDR) {
2819 err = -EOPNOTSUPP;
2820 goto done;
2821 }
2822
56f87901
JH		 2823 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2824 err = -EOPNOTSUPP;
2825 goto done;
2826 }
2827
1da177e4
LT		 2828 switch (cmd) {
2829 case HCISETAUTH:
01178cd4
JH		 2830 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2831 HCI_INIT_TIMEOUT);
1da177e4
LT		 2832 break;
2833
2834 case HCISETENCRYPT:
2835 if (!lmp_encrypt_capable(hdev)) {
2836 err = -EOPNOTSUPP;
2837 break;
2838 }
2839
2840 if (!test_bit(HCI_AUTH, &hdev->flags)) {
2841 /* Auth must be enabled first */
01178cd4
JH		 2842 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2843 HCI_INIT_TIMEOUT);
1da177e4
LT		 2844 if (err)
2845 break;
2846 }
2847
01178cd4
JH		 2848 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
2849 HCI_INIT_TIMEOUT);
1da177e4
LT		 2850 break;
2851
2852 case HCISETSCAN:
01178cd4
JH		 2853 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
2854 HCI_INIT_TIMEOUT);
91a668b0 2855
bc6d2d04
JH		 2856 /* Ensure that the connectable and discoverable states
2857 * get correctly modified as this was a non-mgmt change.
91a668b0 2858 */
123abc08
JH		 2859 if (!err)
2860 hci_update_scan_state(hdev, dr.dev_opt);
1da177e4
LT		 2861 break;
2862
1da177e4 2863 case HCISETLINKPOL:
01178cd4
JH		 2864 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
2865 HCI_INIT_TIMEOUT);
1da177e4
LT		 2866 break;
2867
2868 case HCISETLINKMODE:
e4e8e37c
MH		 2869 hdev->link_mode = ((__u16) dr.dev_opt) &
2870 (HCI_LM_MASTER | HCI_LM_ACCEPT);
2871 break;
2872
2873 case HCISETPTYPE:
2874 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 2875 break;
2876
2877 case HCISETACLMTU:
e4e8e37c
MH		 2878 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
2879 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 2880 break;
2881
2882 case HCISETSCOMTU:
e4e8e37c
MH		 2883 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
2884 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 2885 break;
2886
2887 default:
2888 err = -EINVAL;
2889 break;
2890 }
e4e8e37c 2891
0736cfa8 2892done:
1da177e4
LT		 2893 hci_dev_put(hdev);
2894 return err;
2895}
2896
2897int hci_get_dev_list(void __user *arg)
2898{
8035ded4 2899 struct hci_dev *hdev;
1da177e4
LT		 2900 struct hci_dev_list_req *dl;
2901 struct hci_dev_req *dr;
1da177e4
LT		 2902 int n = 0, size, err;
2903 __u16 dev_num;
2904
2905 if (get_user(dev_num, (__u16 __user *) arg))
2906 return -EFAULT;
2907
2908 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2909 return -EINVAL;
2910
2911 size = sizeof(*dl) + dev_num * sizeof(*dr);
2912
70f23020
AE		 2913 dl = kzalloc(size, GFP_KERNEL);
2914 if (!dl)
1da177e4
LT		 2915 return -ENOMEM;
2916
2917 dr = dl->dev_req;
2918
f20d09d5 2919 read_lock(&hci_dev_list_lock);
8035ded4 2920 list_for_each_entry(hdev, &hci_dev_list, list) {
2e84d8db 2921 unsigned long flags = hdev->flags;
c542a06c 2922
2e84d8db
MH		 2923 /* When the auto-off is configured it means the transport
2924 * is running, but in that case still indicate that the
2925 * device is actually down.
2926 */
2927 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2928 flags &= ~BIT(HCI_UP);
c542a06c 2929
1da177e4 2930 (dr + n)->dev_id = hdev->id;
2e84d8db 2931 (dr + n)->dev_opt = flags;
c542a06c 2932
1da177e4
LT		 2933 if (++n >= dev_num)
2934 break;
2935 }
f20d09d5 2936 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 2937
2938 dl->dev_num = n;
2939 size = sizeof(*dl) + n * sizeof(*dr);
2940
2941 err = copy_to_user(arg, dl, size);
2942 kfree(dl);
2943
2944 return err ? -EFAULT : 0;
2945}
2946
2947int hci_get_dev_info(void __user *arg)
2948{
2949 struct hci_dev *hdev;
2950 struct hci_dev_info di;
2e84d8db 2951 unsigned long flags;
1da177e4
LT		 2952 int err = 0;
2953
2954 if (copy_from_user(&di, arg, sizeof(di)))
2955 return -EFAULT;
2956
70f23020
AE		 2957 hdev = hci_dev_get(di.dev_id);
2958 if (!hdev)
1da177e4
LT		 2959 return -ENODEV;
2960
2e84d8db
MH		 2961 /* When the auto-off is configured it means the transport
2962 * is running, but in that case still indicate that the
2963 * device is actually down.
2964 */
2965 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2966 flags = hdev->flags & ~BIT(HCI_UP);
2967 else
2968 flags = hdev->flags;
c542a06c 2969
1da177e4
LT		 2970 strcpy(di.name, hdev->name);
2971 di.bdaddr = hdev->bdaddr;
60f2a3ed 2972 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2e84d8db 2973 di.flags = flags;
1da177e4 2974 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 2975 if (lmp_bredr_capable(hdev)) {
2976 di.acl_mtu = hdev->acl_mtu;
2977 di.acl_pkts = hdev->acl_pkts;
2978 di.sco_mtu = hdev->sco_mtu;
2979 di.sco_pkts = hdev->sco_pkts;
2980 } else {
2981 di.acl_mtu = hdev->le_mtu;
2982 di.acl_pkts = hdev->le_pkts;
2983 di.sco_mtu = 0;
2984 di.sco_pkts = 0;
2985 }
1da177e4
LT		 2986 di.link_policy = hdev->link_policy;
2987 di.link_mode = hdev->link_mode;
2988
2989 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2990 memcpy(&di.features, &hdev->features, sizeof(di.features));
2991
2992 if (copy_to_user(arg, &di, sizeof(di)))
2993 err = -EFAULT;
2994
2995 hci_dev_put(hdev);
2996
2997 return err;
2998}
2999
3000/* ---- Interface to HCI drivers ---- */
3001
611b30f7
MH		 3002static int hci_rfkill_set_block(void *data, bool blocked)
3003{
3004 struct hci_dev *hdev = data;
3005
3006 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
3007
0736cfa8
MH		 3008 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
3009 return -EBUSY;
3010
5e130367
JH		 3011 if (blocked) {
3012 set_bit(HCI_RFKILLED, &hdev->dev_flags);
d603b76b
MH		 3013 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
3014 !test_bit(HCI_CONFIG, &hdev->dev_flags))
bf543036 3015 hci_dev_do_close(hdev);
5e130367
JH		 3016 } else {
3017 clear_bit(HCI_RFKILLED, &hdev->dev_flags);
1025c04c 3018 }
611b30f7
MH		 3019
3020 return 0;
3021}
3022
3023static const struct rfkill_ops hci_rfkill_ops = {
3024 .set_block = hci_rfkill_set_block,
3025};
3026
ab81cbf9
JH		 3027static void hci_power_on(struct work_struct *work)
3028{
3029 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 3030 int err;
ab81cbf9
JH		 3031
3032 BT_DBG("%s", hdev->name);
3033
cbed0ca1 3034 err = hci_dev_do_open(hdev);
96570ffc
JH		 3035 if (err < 0) {
3036 mgmt_set_powered_failed(hdev, err);
ab81cbf9 3037 return;
96570ffc 3038 }
ab81cbf9 3039
a5c8f270
MH		 3040 /* During the HCI setup phase, a few error conditions are
3041 * ignored and they need to be checked now. If they are still
3042 * valid, it is important to turn the device back off.
3043 */
3044 if (test_bit(HCI_RFKILLED, &hdev->dev_flags) ||
4a964404 3045 test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
a5c8f270
MH		 3046 (hdev->dev_type == HCI_BREDR &&
3047 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
3048 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
bf543036
JH		 3049 clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
3050 hci_dev_do_close(hdev);
3051 } else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
19202573
JH		 3052 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
3053 HCI_AUTO_OFF_TIMEOUT);
bf543036 3054 }
ab81cbf9 3055
fee746b0 3056 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags)) {
4a964404
MH		 3057 /* For unconfigured devices, set the HCI_RAW flag
3058 * so that userspace can easily identify them.
4a964404
MH		 3059 */
3060 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
3061 set_bit(HCI_RAW, &hdev->flags);
0602a8ad
MH		 3062
3063 /* For fully configured devices, this will send
3064 * the Index Added event. For unconfigured devices,
3065 * it will send Unconfigued Index Added event.
3066 *
3067 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
3068 * and no event will be send.
3069 */
3070 mgmt_index_added(hdev);
d603b76b 3071 } else if (test_and_clear_bit(HCI_CONFIG, &hdev->dev_flags)) {
5ea234d3
MH		 3072 /* When the controller is now configured, then it
3073 * is important to clear the HCI_RAW flag.
3074 */
3075 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
3076 clear_bit(HCI_RAW, &hdev->flags);
3077
d603b76b
MH		 3078 /* Powering on the controller with HCI_CONFIG set only
3079 * happens with the transition from unconfigured to
3080 * configured. This will send the Index Added event.
3081 */
744cf19e 3082 mgmt_index_added(hdev);
fee746b0 3083 }
ab81cbf9
JH		 3084}
3085
3086static void hci_power_off(struct work_struct *work)
3087{
3243553f 3088 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 3089 power_off.work);
ab81cbf9
JH		 3090
3091 BT_DBG("%s", hdev->name);
3092
8ee56540 3093 hci_dev_do_close(hdev);
ab81cbf9
JH		 3094}
3095
16ab91ab
JH		 3096static void hci_discov_off(struct work_struct *work)
3097{
3098 struct hci_dev *hdev;
16ab91ab
JH		 3099
3100 hdev = container_of(work, struct hci_dev, discov_off.work);
3101
3102 BT_DBG("%s", hdev->name);
3103
d1967ff8 3104 mgmt_discoverable_timeout(hdev);
16ab91ab
JH		 3105}
3106
35f7498a 3107void hci_uuids_clear(struct hci_dev *hdev)
2aeb9a1a 3108{
4821002c 3109 struct bt_uuid *uuid, *tmp;
2aeb9a1a 3110
4821002c
JH		 3111 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
3112 list_del(&uuid->list);
2aeb9a1a
JH		 3113 kfree(uuid);
3114 }
2aeb9a1a
JH		 3115}
3116
35f7498a 3117void hci_link_keys_clear(struct hci_dev *hdev)
55ed8ca1
JH		 3118{
3119 struct list_head *p, *n;
3120
3121 list_for_each_safe(p, n, &hdev->link_keys) {
3122 struct link_key *key;
3123
3124 key = list_entry(p, struct link_key, list);
3125
3126 list_del(p);
3127 kfree(key);
3128 }
55ed8ca1
JH		 3129}
3130
35f7498a 3131void hci_smp_ltks_clear(struct hci_dev *hdev)
b899efaf
VCG		 3132{
3133 struct smp_ltk *k, *tmp;
3134
3135 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
3136 list_del(&k->list);
3137 kfree(k);
3138 }
b899efaf
VCG		 3139}
3140
970c4e46
JH		 3141void hci_smp_irks_clear(struct hci_dev *hdev)
3142{
3143 struct smp_irk *k, *tmp;
3144
3145 list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
3146 list_del(&k->list);
3147 kfree(k);
3148 }
3149}
3150
55ed8ca1
JH		 3151struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
3152{
8035ded4 3153 struct link_key *k;
55ed8ca1 3154
8035ded4 3155 list_for_each_entry(k, &hdev->link_keys, list)
55ed8ca1
JH		 3156 if (bacmp(bdaddr, &k->bdaddr) == 0)
3157 return k;
55ed8ca1
JH		 3158
3159 return NULL;
3160}
3161
745c0ce3 3162static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 3163 u8 key_type, u8 old_key_type)
d25e28ab
JH		 3164{
3165 /* Legacy key */
3166 if (key_type < 0x03)
745c0ce3 3167 return true;
d25e28ab
JH		 3168
3169 /* Debug keys are insecure so don't store them persistently */
3170 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 3171 return false;
d25e28ab
JH		 3172
3173 /* Changed combination key and there's no previous one */
3174 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 3175 return false;
d25e28ab
JH		 3176
3177 /* Security mode 3 case */
3178 if (!conn)
745c0ce3 3179 return true;
d25e28ab
JH		 3180
3181 /* Neither local nor remote side had no-bonding as requirement */
3182 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 3183 return true;
d25e28ab
JH		 3184
3185 /* Local side had dedicated bonding as requirement */
3186 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 3187 return true;
d25e28ab
JH		 3188
3189 /* Remote side had dedicated bonding as requirement */
3190 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 3191 return true;
d25e28ab
JH		 3192
3193 /* If none of the above criteria match, then don't store the key
3194 * persistently */
745c0ce3 3195 return false;
d25e28ab
JH		 3196}
3197
e804d25d 3198static u8 ltk_role(u8 type)
98a0b845 3199{
e804d25d
JH		 3200 if (type == SMP_LTK)
3201 return HCI_ROLE_MASTER;
98a0b845 3202
e804d25d 3203 return HCI_ROLE_SLAVE;
98a0b845
JH		 3204}
3205
fe39c7b2 3206struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, __le64 rand,
e804d25d 3207 u8 role)
75d262c2 3208{
c9839a11 3209 struct smp_ltk *k;
75d262c2 3210
c9839a11 3211 list_for_each_entry(k, &hdev->long_term_keys, list) {
fe39c7b2 3212 if (k->ediv != ediv || k->rand != rand)
75d262c2
VCG		 3213 continue;
3214
e804d25d 3215 if (ltk_role(k->type) != role)
98a0b845
JH		 3216 continue;
3217
c9839a11 3218 return k;
75d262c2
VCG		 3219 }
3220
3221 return NULL;
3222}
75d262c2 3223
c9839a11 3224struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
e804d25d 3225 u8 addr_type, u8 role)
75d262c2 3226{
c9839a11 3227 struct smp_ltk *k;
75d262c2 3228
c9839a11
VCG		 3229 list_for_each_entry(k, &hdev->long_term_keys, list)
3230 if (addr_type == k->bdaddr_type &&
98a0b845 3231 bacmp(bdaddr, &k->bdaddr) == 0 &&
e804d25d 3232 ltk_role(k->type) == role)
75d262c2
VCG		 3233 return k;
3234
3235 return NULL;
3236}
75d262c2 3237
970c4e46
JH		 3238struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
3239{
3240 struct smp_irk *irk;
3241
3242 list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
3243 if (!bacmp(&irk->rpa, rpa))
3244 return irk;
3245 }
3246
3247 list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
defce9e8 3248 if (smp_irk_matches(hdev, irk->val, rpa)) {
970c4e46
JH		 3249 bacpy(&irk->rpa, rpa);
3250 return irk;
3251 }
3252 }
3253
3254 return NULL;
3255}
3256
3257struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
3258 u8 addr_type)
3259{
3260 struct smp_irk *irk;
3261
6cfc9988
JH		 3262 /* Identity Address must be public or static random */
3263 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
3264 return NULL;
3265
970c4e46
JH		 3266 list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
3267 if (addr_type == irk->addr_type &&
3268 bacmp(bdaddr, &irk->bdaddr) == 0)
3269 return irk;
3270 }
3271
3272 return NULL;
3273}
3274
567fa2aa 3275struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
7652ff6a
JH		 3276 bdaddr_t *bdaddr, u8 *val, u8 type,
3277 u8 pin_len, bool *persistent)
55ed8ca1
JH		 3278{
3279 struct link_key *key, *old_key;
745c0ce3 3280 u8 old_key_type;
55ed8ca1
JH		 3281
3282 old_key = hci_find_link_key(hdev, bdaddr);
3283 if (old_key) {
3284 old_key_type = old_key->type;
3285 key = old_key;
3286 } else {
12adcf3a 3287 old_key_type = conn ? conn->key_type : 0xff;
0a14ab41 3288 key = kzalloc(sizeof(*key), GFP_KERNEL);
55ed8ca1 3289 if (!key)
567fa2aa 3290 return NULL;
55ed8ca1
JH		 3291 list_add(&key->list, &hdev->link_keys);
3292 }
3293
6ed93dc6 3294 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 3295
d25e28ab
JH		 3296 /* Some buggy controller combinations generate a changed
3297 * combination key for legacy pairing even when there's no
3298 * previous key */
3299 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 3300 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 3301 type = HCI_LK_COMBINATION;
655fe6ec
JH		 3302 if (conn)
3303 conn->key_type = type;
3304 }
d25e28ab 3305
55ed8ca1 3306 bacpy(&key->bdaddr, bdaddr);
9b3b4460 3307 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 3308 key->pin_len = pin_len;
3309
b6020ba0 3310 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 3311 key->type = old_key_type;
4748fed2
JH		 3312 else
3313 key->type = type;
3314
7652ff6a
JH		 3315 if (persistent)
3316 *persistent = hci_persistent_key(hdev, conn, type,
3317 old_key_type);
4df378a1 3318
567fa2aa 3319 return key;
55ed8ca1
JH		 3320}
3321
ca9142b8 3322struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
35d70271 3323 u8 addr_type, u8 type, u8 authenticated,
fe39c7b2 3324 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
75d262c2 3325{
c9839a11 3326 struct smp_ltk *key, *old_key;
e804d25d 3327 u8 role = ltk_role(type);
75d262c2 3328
e804d25d 3329 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type, role);
c9839a11 3330 if (old_key)
75d262c2 3331 key = old_key;
c9839a11 3332 else {
0a14ab41 3333 key = kzalloc(sizeof(*key), GFP_KERNEL);
75d262c2 3334 if (!key)
ca9142b8 3335 return NULL;
c9839a11 3336 list_add(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 3337 }
3338
75d262c2 3339 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 3340 key->bdaddr_type = addr_type;
3341 memcpy(key->val, tk, sizeof(key->val));
3342 key->authenticated = authenticated;
3343 key->ediv = ediv;
fe39c7b2 3344 key->rand = rand;
c9839a11
VCG		 3345 key->enc_size = enc_size;
3346 key->type = type;
75d262c2 3347
ca9142b8 3348 return key;
75d262c2
VCG		 3349}
3350
ca9142b8
JH		 3351struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
3352 u8 addr_type, u8 val[16], bdaddr_t *rpa)
970c4e46
JH		 3353{
3354 struct smp_irk *irk;
3355
3356 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
3357 if (!irk) {
3358 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
3359 if (!irk)
ca9142b8 3360 return NULL;
970c4e46
JH		 3361
3362 bacpy(&irk->bdaddr, bdaddr);
3363 irk->addr_type = addr_type;
3364
3365 list_add(&irk->list, &hdev->identity_resolving_keys);
3366 }
3367
3368 memcpy(irk->val, val, 16);
3369 bacpy(&irk->rpa, rpa);
3370
ca9142b8 3371 return irk;
970c4e46
JH		 3372}
3373
55ed8ca1
JH		 3374int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
3375{
3376 struct link_key *key;
3377
3378 key = hci_find_link_key(hdev, bdaddr);
3379 if (!key)
3380 return -ENOENT;
3381
6ed93dc6 3382 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1
JH		 3383
3384 list_del(&key->list);
3385 kfree(key);
3386
3387 return 0;
3388}
3389
e0b2b27e 3390int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
b899efaf
VCG		 3391{
3392 struct smp_ltk *k, *tmp;
c51ffa0b 3393 int removed = 0;
b899efaf
VCG		 3394
3395 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
e0b2b27e 3396 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
b899efaf
VCG		 3397 continue;
3398
6ed93dc6 3399 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf
VCG		 3400
3401 list_del(&k->list);
3402 kfree(k);
c51ffa0b 3403 removed++;
b899efaf
VCG		 3404 }
3405
c51ffa0b 3406 return removed ? 0 : -ENOENT;
b899efaf
VCG		 3407}
3408
a7ec7338
JH		 3409void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
3410{
3411 struct smp_irk *k, *tmp;
3412
668b7b19 3413 list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
a7ec7338
JH		 3414 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
3415 continue;
3416
3417 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3418
3419 list_del(&k->list);
3420 kfree(k);
3421 }
3422}
3423
6bd32326 3424/* HCI command timer function */
65cc2b49 3425static void hci_cmd_timeout(struct work_struct *work)
6bd32326 3426{
65cc2b49
MH		 3427 struct hci_dev *hdev = container_of(work, struct hci_dev,
3428 cmd_timer.work);
6bd32326 3429
bda4f23a
AE		 3430 if (hdev->sent_cmd) {
3431 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
3432 u16 opcode = __le16_to_cpu(sent->opcode);
3433
3434 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
3435 } else {
3436 BT_ERR("%s command tx timeout", hdev->name);
3437 }
3438
6bd32326 3439 atomic_set(&hdev->cmd_cnt, 1);
c347b765 3440 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 3441}
3442
2763eda6 3443struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
04124681 3444 bdaddr_t *bdaddr)
2763eda6
SJ		 3445{
3446 struct oob_data *data;
3447
3448 list_for_each_entry(data, &hdev->remote_oob_data, list)
3449 if (bacmp(bdaddr, &data->bdaddr) == 0)
3450 return data;
3451
3452 return NULL;
3453}
3454
3455int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
3456{
3457 struct oob_data *data;
3458
3459 data = hci_find_remote_oob_data(hdev, bdaddr);
3460 if (!data)
3461 return -ENOENT;
3462
6ed93dc6 3463 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2763eda6
SJ		 3464
3465 list_del(&data->list);
3466 kfree(data);
3467
3468 return 0;
3469}
3470
35f7498a 3471void hci_remote_oob_data_clear(struct hci_dev *hdev)
2763eda6
SJ		 3472{
3473 struct oob_data *data, *n;
3474
3475 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
3476 list_del(&data->list);
3477 kfree(data);
3478 }
2763eda6
SJ		 3479}
3480
0798872e
MH		 3481int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
3482 u8 *hash, u8 *randomizer)
2763eda6
SJ		 3483{
3484 struct oob_data *data;
3485
3486 data = hci_find_remote_oob_data(hdev, bdaddr);
2763eda6 3487 if (!data) {
0a14ab41 3488 data = kmalloc(sizeof(*data), GFP_KERNEL);
2763eda6
SJ		 3489 if (!data)
3490 return -ENOMEM;
3491
3492 bacpy(&data->bdaddr, bdaddr);
3493 list_add(&data->list, &hdev->remote_oob_data);
3494 }
3495
519ca9d0
MH		 3496 memcpy(data->hash192, hash, sizeof(data->hash192));
3497 memcpy(data->randomizer192, randomizer, sizeof(data->randomizer192));
2763eda6 3498
0798872e
MH		 3499 memset(data->hash256, 0, sizeof(data->hash256));
3500 memset(data->randomizer256, 0, sizeof(data->randomizer256));
3501
3502 BT_DBG("%s for %pMR", hdev->name, bdaddr);
3503
3504 return 0;
3505}
3506
3507int hci_add_remote_oob_ext_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
3508 u8 *hash192, u8 *randomizer192,
3509 u8 *hash256, u8 *randomizer256)
3510{
3511 struct oob_data *data;
3512
3513 data = hci_find_remote_oob_data(hdev, bdaddr);
3514 if (!data) {
0a14ab41 3515 data = kmalloc(sizeof(*data), GFP_KERNEL);
0798872e
MH		 3516 if (!data)
3517 return -ENOMEM;
3518
3519 bacpy(&data->bdaddr, bdaddr);
3520 list_add(&data->list, &hdev->remote_oob_data);
3521 }
3522
3523 memcpy(data->hash192, hash192, sizeof(data->hash192));
3524 memcpy(data->randomizer192, randomizer192, sizeof(data->randomizer192));
3525
3526 memcpy(data->hash256, hash256, sizeof(data->hash256));
3527 memcpy(data->randomizer256, randomizer256, sizeof(data->randomizer256));
3528
6ed93dc6 3529 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 3530
3531 return 0;
3532}
3533
dcc36c16 3534struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
b9ee0a78 3535 bdaddr_t *bdaddr, u8 type)
b2a66aad 3536{
8035ded4 3537 struct bdaddr_list *b;
b2a66aad 3538
dcc36c16 3539 list_for_each_entry(b, bdaddr_list, list) {
b9ee0a78 3540 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
b2a66aad 3541 return b;
b9ee0a78 3542 }
b2a66aad
AJ		 3543
3544 return NULL;
3545}
3546
dcc36c16 3547void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
b2a66aad
AJ		 3548{
3549 struct list_head *p, *n;
3550
dcc36c16 3551 list_for_each_safe(p, n, bdaddr_list) {
b9ee0a78 3552 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
b2a66aad
AJ		 3553
3554 list_del(p);
3555 kfree(b);
3556 }
b2a66aad
AJ		 3557}
3558
dcc36c16 3559int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 3560{
3561 struct bdaddr_list *entry;
b2a66aad 3562
b9ee0a78 3563 if (!bacmp(bdaddr, BDADDR_ANY))
b2a66aad
AJ		 3564 return -EBADF;
3565
dcc36c16 3566 if (hci_bdaddr_list_lookup(list, bdaddr, type))
5e762444 3567 return -EEXIST;
b2a66aad 3568
27f70f3e 3569 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
5e762444
AJ		 3570 if (!entry)
3571 return -ENOMEM;
b2a66aad
AJ		 3572
3573 bacpy(&entry->bdaddr, bdaddr);
b9ee0a78 3574 entry->bdaddr_type = type;
b2a66aad 3575
dcc36c16 3576 list_add(&entry->list, list);
b2a66aad 3577
2a8357f2 3578 return 0;
b2a66aad
AJ		 3579}
3580
dcc36c16 3581int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 3582{
3583 struct bdaddr_list *entry;
b2a66aad 3584
35f7498a 3585 if (!bacmp(bdaddr, BDADDR_ANY)) {
dcc36c16 3586 hci_bdaddr_list_clear(list);
35f7498a
JH		 3587 return 0;
3588 }
b2a66aad 3589
dcc36c16 3590 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
d2ab0ac1
MH		 3591 if (!entry)
3592 return -ENOENT;
3593
3594 list_del(&entry->list);
3595 kfree(entry);
3596
3597 return 0;
3598}
3599
15819a70
AG		 3600/* This function requires the caller holds hdev->lock */
3601struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
3602 bdaddr_t *addr, u8 addr_type)
3603{
3604 struct hci_conn_params *params;
3605
738f6185
JH		 3606 /* The conn params list only contains identity addresses */
3607 if (!hci_is_identity_address(addr, addr_type))
3608 return NULL;
3609
15819a70
AG		 3610 list_for_each_entry(params, &hdev->le_conn_params, list) {
3611 if (bacmp(&params->addr, addr) == 0 &&
3612 params->addr_type == addr_type) {
3613 return params;
3614 }
3615 }
3616
3617 return NULL;
3618}
3619
cef952ce
AG		 3620static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
3621{
3622 struct hci_conn *conn;
3623
3624 conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
3625 if (!conn)
3626 return false;
3627
3628 if (conn->dst_type != type)
3629 return false;
3630
3631 if (conn->state != BT_CONNECTED)
3632 return false;
3633
3634 return true;
3635}
3636
4b10966f 3637/* This function requires the caller holds hdev->lock */
501f8827
JH		 3638struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
3639 bdaddr_t *addr, u8 addr_type)
a9b0a04c 3640{
912b42ef 3641 struct hci_conn_params *param;
a9b0a04c 3642
738f6185
JH		 3643 /* The list only contains identity addresses */
3644 if (!hci_is_identity_address(addr, addr_type))
3645 return NULL;
a9b0a04c 3646
501f8827 3647 list_for_each_entry(param, list, action) {
912b42ef
JH		 3648 if (bacmp(&param->addr, addr) == 0 &&
3649 param->addr_type == addr_type)
3650 return param;
4b10966f
MH		 3651 }
3652
3653 return NULL;
a9b0a04c
AG		 3654}
3655
15819a70 3656/* This function requires the caller holds hdev->lock */
51d167c0
MH		 3657struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
3658 bdaddr_t *addr, u8 addr_type)
15819a70
AG		 3659{
3660 struct hci_conn_params *params;
3661
c46245b3 3662 if (!hci_is_identity_address(addr, addr_type))
51d167c0 3663 return NULL;
a9b0a04c 3664
15819a70 3665 params = hci_conn_params_lookup(hdev, addr, addr_type);
cef952ce 3666 if (params)
51d167c0 3667 return params;
15819a70
AG		 3668
3669 params = kzalloc(sizeof(*params), GFP_KERNEL);
3670 if (!params) {
3671 BT_ERR("Out of memory");
51d167c0 3672 return NULL;
15819a70
AG		 3673 }
3674
3675 bacpy(&params->addr, addr);
3676 params->addr_type = addr_type;
cef952ce
AG		 3677
3678 list_add(&params->list, &hdev->le_conn_params);
93450c75 3679 INIT_LIST_HEAD(&params->action);
cef952ce 3680
bf5b3c8b
MH		 3681 params->conn_min_interval = hdev->le_conn_min_interval;
3682 params->conn_max_interval = hdev->le_conn_max_interval;
3683 params->conn_latency = hdev->le_conn_latency;
3684 params->supervision_timeout = hdev->le_supv_timeout;
3685 params->auto_connect = HCI_AUTO_CONN_DISABLED;
3686
3687 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3688
51d167c0 3689 return params;
bf5b3c8b
MH		 3690}
3691
3692/* This function requires the caller holds hdev->lock */
3693int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type,
d06b50ce 3694 u8 auto_connect)
15819a70
AG		 3695{
3696 struct hci_conn_params *params;
3697
8c87aae1
MH		 3698 params = hci_conn_params_add(hdev, addr, addr_type);
3699 if (!params)
3700 return -EIO;
cef952ce 3701
42ce26de
JH		 3702 if (params->auto_connect == auto_connect)
3703 return 0;
3704
95305baa 3705 list_del_init(&params->action);
15819a70 3706
cef952ce
AG		 3707 switch (auto_connect) {
3708 case HCI_AUTO_CONN_DISABLED:
3709 case HCI_AUTO_CONN_LINK_LOSS:
95305baa 3710 hci_update_background_scan(hdev);
cef952ce 3711 break;
851efca8 3712 case HCI_AUTO_CONN_REPORT:
95305baa
JH		 3713 list_add(&params->action, &hdev->pend_le_reports);
3714 hci_update_background_scan(hdev);
cef952ce 3715 break;
4b9e7e75 3716 case HCI_AUTO_CONN_DIRECT:
cef952ce 3717 case HCI_AUTO_CONN_ALWAYS:
95305baa
JH		 3718 if (!is_connected(hdev, addr, addr_type)) {
3719 list_add(&params->action, &hdev->pend_le_conns);
3720 hci_update_background_scan(hdev);
3721 }
cef952ce
AG		 3722 break;
3723 }
15819a70 3724
851efca8
JH		 3725 params->auto_connect = auto_connect;
3726
d06b50ce
MH		 3727 BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
3728 auto_connect);
a9b0a04c
AG		 3729
3730 return 0;
15819a70
AG		 3731}
3732
f6c63249 3733static void hci_conn_params_free(struct hci_conn_params *params)
15819a70 3734{
f8aaf9b6 3735 if (params->conn) {
f161dd41 3736 hci_conn_drop(params->conn);
f8aaf9b6
JH		 3737 hci_conn_put(params->conn);
3738 }
f161dd41 3739
95305baa 3740 list_del(&params->action);
15819a70
AG		 3741 list_del(&params->list);
3742 kfree(params);
f6c63249
JH		 3743}
3744
3745/* This function requires the caller holds hdev->lock */
3746void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3747{
3748 struct hci_conn_params *params;
3749
3750 params = hci_conn_params_lookup(hdev, addr, addr_type);
3751 if (!params)
3752 return;
3753
3754 hci_conn_params_free(params);
15819a70 3755
95305baa
JH		 3756 hci_update_background_scan(hdev);
3757
15819a70
AG		 3758 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3759}
3760
3761/* This function requires the caller holds hdev->lock */
55af49a8 3762void hci_conn_params_clear_disabled(struct hci_dev *hdev)
15819a70
AG		 3763{
3764 struct hci_conn_params *params, *tmp;
3765
3766 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
55af49a8
JH		 3767 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3768 continue;
15819a70
AG		 3769 list_del(&params->list);
3770 kfree(params);
3771 }
3772
55af49a8 3773 BT_DBG("All LE disabled connection parameters were removed");
77a77a30
AG		 3774}
3775
3776/* This function requires the caller holds hdev->lock */
373110c5 3777void hci_conn_params_clear_all(struct hci_dev *hdev)
77a77a30 3778{
15819a70 3779 struct hci_conn_params *params, *tmp;
77a77a30 3780
f6c63249
JH		 3781 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
3782 hci_conn_params_free(params);
77a77a30 3783
a4790dbd 3784 hci_update_background_scan(hdev);
77a77a30 3785
15819a70 3786 BT_DBG("All LE connection parameters were removed");
77a77a30
AG		 3787}
3788
4c87eaab 3789static void inquiry_complete(struct hci_dev *hdev, u8 status)
7ba8b4be 3790{
4c87eaab
AG		 3791 if (status) {
3792 BT_ERR("Failed to start inquiry: status %d", status);
7ba8b4be 3793
4c87eaab
AG		 3794 hci_dev_lock(hdev);
3795 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3796 hci_dev_unlock(hdev);
3797 return;
3798 }
7ba8b4be
AG		 3799}
3800
4c87eaab 3801static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
7ba8b4be 3802{
4c87eaab
AG		 3803 /* General inquiry access code (GIAC) */
3804 u8 lap[3] = { 0x33, 0x8b, 0x9e };
3805 struct hci_request req;
3806 struct hci_cp_inquiry cp;
7ba8b4be
AG		 3807 int err;
3808
4c87eaab
AG		 3809 if (status) {
3810 BT_ERR("Failed to disable LE scanning: status %d", status);
3811 return;
3812 }
7ba8b4be 3813
4c87eaab
AG		 3814 switch (hdev->discovery.type) {
3815 case DISCOV_TYPE_LE:
3816 hci_dev_lock(hdev);
3817 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3818 hci_dev_unlock(hdev);
3819 break;
7ba8b4be 3820
4c87eaab
AG		 3821 case DISCOV_TYPE_INTERLEAVED:
3822 hci_req_init(&req, hdev);
7ba8b4be 3823
4c87eaab
AG		 3824 memset(&cp, 0, sizeof(cp));
3825 memcpy(&cp.lap, lap, sizeof(cp.lap));
3826 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
3827 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
7ba8b4be 3828
4c87eaab 3829 hci_dev_lock(hdev);
7dbfac1d 3830
4c87eaab 3831 hci_inquiry_cache_flush(hdev);
7dbfac1d 3832
4c87eaab
AG		 3833 err = hci_req_run(&req, inquiry_complete);
3834 if (err) {
3835 BT_ERR("Inquiry request failed: err %d", err);
3836 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3837 }
7dbfac1d 3838
4c87eaab
AG		 3839 hci_dev_unlock(hdev);
3840 break;
7dbfac1d 3841 }
7dbfac1d
AG		 3842}
3843
7ba8b4be
AG		 3844static void le_scan_disable_work(struct work_struct *work)
3845{
3846 struct hci_dev *hdev = container_of(work, struct hci_dev,
04124681 3847 le_scan_disable.work);
4c87eaab
AG		 3848 struct hci_request req;
3849 int err;
7ba8b4be
AG		 3850
3851 BT_DBG("%s", hdev->name);
3852
4c87eaab 3853 hci_req_init(&req, hdev);
28b75a89 3854
b1efcc28 3855 hci_req_add_le_scan_disable(&req);
28b75a89 3856
4c87eaab
AG		 3857 err = hci_req_run(&req, le_scan_disable_work_complete);
3858 if (err)
3859 BT_ERR("Disable LE scanning request failed: err %d", err);
28b75a89
AG		 3860}
3861
8d97250e
JH		 3862static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
3863{
3864 struct hci_dev *hdev = req->hdev;
3865
3866 /* If we're advertising or initiating an LE connection we can't
3867 * go ahead and change the random address at this time. This is
3868 * because the eventual initiator address used for the
3869 * subsequently created connection will be undefined (some
3870 * controllers use the new address and others the one we had
3871 * when the operation started).
3872 *
3873 * In this kind of scenario skip the update and let the random
3874 * address be updated at the next cycle.
3875 */
5ce194c4 3876 if (test_bit(HCI_LE_ADV, &hdev->dev_flags) ||
8d97250e
JH		 3877 hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
3878 BT_DBG("Deferring random address update");
9a783a13 3879 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
8d97250e
JH		 3880 return;
3881 }
3882
3883 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
3884}
3885
94b1fc92
MH		 3886int hci_update_random_address(struct hci_request *req, bool require_privacy,
3887 u8 *own_addr_type)
ebd3a747
JH		 3888{
3889 struct hci_dev *hdev = req->hdev;
3890 int err;
3891
3892 /* If privacy is enabled use a resolvable private address. If
2b5224dc
MH		 3893 * current RPA has expired or there is something else than
3894 * the current RPA in use, then generate a new one.
ebd3a747
JH		 3895 */
3896 if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
ebd3a747
JH		 3897 int to;
3898
3899 *own_addr_type = ADDR_LE_DEV_RANDOM;
3900
3901 if (!test_and_clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags) &&
2b5224dc 3902 !bacmp(&hdev->random_addr, &hdev->rpa))
ebd3a747
JH		 3903 return 0;
3904
defce9e8 3905 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
ebd3a747
JH		 3906 if (err < 0) {
3907 BT_ERR("%s failed to generate new RPA", hdev->name);
3908 return err;
3909 }
3910
8d97250e 3911 set_random_addr(req, &hdev->rpa);
ebd3a747
JH		 3912
3913 to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
3914 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
3915
3916 return 0;
94b1fc92
MH		 3917 }
3918
3919 /* In case of required privacy without resolvable private address,
3920 * use an unresolvable private address. This is useful for active
3921 * scanning and non-connectable advertising.
3922 */
3923 if (require_privacy) {
3924 bdaddr_t urpa;
3925
3926 get_random_bytes(&urpa, 6);
3927 urpa.b[5] &= 0x3f; /* Clear two most significant bits */
3928
3929 *own_addr_type = ADDR_LE_DEV_RANDOM;
8d97250e 3930 set_random_addr(req, &urpa);
94b1fc92 3931 return 0;
ebd3a747
JH		 3932 }
3933
3934 /* If forcing static address is in use or there is no public
3935 * address use the static address as random address (but skip
3936 * the HCI command if the current random address is already the
3937 * static one.
3938 */
111902f7 3939 if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
ebd3a747
JH		 3940 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
3941 *own_addr_type = ADDR_LE_DEV_RANDOM;
3942 if (bacmp(&hdev->static_addr, &hdev->random_addr))
3943 hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3944 &hdev->static_addr);
3945 return 0;
3946 }
3947
3948 /* Neither privacy nor static address is being used so use a
3949 * public address.
3950 */
3951 *own_addr_type = ADDR_LE_DEV_PUBLIC;
3952
3953 return 0;
3954}
3955
a1f4c318
JH		 3956/* Copy the Identity Address of the controller.
3957 *
3958 * If the controller has a public BD_ADDR, then by default use that one.
3959 * If this is a LE only controller without a public address, default to
3960 * the static random address.
3961 *
3962 * For debugging purposes it is possible to force controllers with a
3963 * public address to use the static random address instead.
3964 */
3965void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3966 u8 *bdaddr_type)
3967{
111902f7 3968 if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
a1f4c318
JH		 3969 !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
3970 bacpy(bdaddr, &hdev->static_addr);
3971 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3972 } else {
3973 bacpy(bdaddr, &hdev->bdaddr);
3974 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3975 }
3976}
3977
9be0dab7
DH		 3978/* Alloc HCI device */
3979struct hci_dev *hci_alloc_dev(void)
3980{
3981 struct hci_dev *hdev;
3982
27f70f3e 3983 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
9be0dab7
DH		 3984 if (!hdev)
3985 return NULL;
3986
b1b813d4
DH		 3987 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3988 hdev->esco_type = (ESCO_HV1);
3989 hdev->link_mode = (HCI_LM_ACCEPT);
b4cb9fb2
MH		 3990 hdev->num_iac = 0x01; /* One IAC support is mandatory */
3991 hdev->io_capability = 0x03; /* No Input No Output */
96c2103a 3992 hdev->manufacturer = 0xffff; /* Default to internal use */
bbaf444a
JH		 3993 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3994 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
b1b813d4 3995
b1b813d4
DH		 3996 hdev->sniff_max_interval = 800;
3997 hdev->sniff_min_interval = 80;
3998
3f959d46 3999 hdev->le_adv_channel_map = 0x07;
628531c9
GL		 4000 hdev->le_adv_min_interval = 0x0800;
4001 hdev->le_adv_max_interval = 0x0800;
bef64738
MH		 4002 hdev->le_scan_interval = 0x0060;
4003 hdev->le_scan_window = 0x0030;
4e70c7e7
MH		 4004 hdev->le_conn_min_interval = 0x0028;
4005 hdev->le_conn_max_interval = 0x0038;
04fb7d90
MH		 4006 hdev->le_conn_latency = 0x0000;
4007 hdev->le_supv_timeout = 0x002a;
bef64738 4008
d6bfd59c 4009 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
b9a7a61e 4010 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
31ad1691
AK		 4011 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
4012 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
d6bfd59c 4013
b1b813d4
DH		 4014 mutex_init(&hdev->lock);
4015 mutex_init(&hdev->req_lock);
4016
4017 INIT_LIST_HEAD(&hdev->mgmt_pending);
4018 INIT_LIST_HEAD(&hdev->blacklist);
6659358e 4019 INIT_LIST_HEAD(&hdev->whitelist);
b1b813d4
DH		 4020 INIT_LIST_HEAD(&hdev->uuids);
4021 INIT_LIST_HEAD(&hdev->link_keys);
4022 INIT_LIST_HEAD(&hdev->long_term_keys);
970c4e46 4023 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
b1b813d4 4024 INIT_LIST_HEAD(&hdev->remote_oob_data);
d2ab0ac1 4025 INIT_LIST_HEAD(&hdev->le_white_list);
15819a70 4026 INIT_LIST_HEAD(&hdev->le_conn_params);
77a77a30 4027 INIT_LIST_HEAD(&hdev->pend_le_conns);
66f8455a 4028 INIT_LIST_HEAD(&hdev->pend_le_reports);
6b536b5e 4029 INIT_LIST_HEAD(&hdev->conn_hash.list);
b1b813d4
DH		 4030
4031 INIT_WORK(&hdev->rx_work, hci_rx_work);
4032 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
4033 INIT_WORK(&hdev->tx_work, hci_tx_work);
4034 INIT_WORK(&hdev->power_on, hci_power_on);
b1b813d4 4035
b1b813d4
DH		 4036 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
4037 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
4038 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
4039
b1b813d4
DH		 4040 skb_queue_head_init(&hdev->rx_q);
4041 skb_queue_head_init(&hdev->cmd_q);
4042 skb_queue_head_init(&hdev->raw_q);
4043
4044 init_waitqueue_head(&hdev->req_wait_q);
4045
65cc2b49 4046 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
b1b813d4 4047
b1b813d4
DH		 4048 hci_init_sysfs(hdev);
4049 discovery_init(hdev);
9be0dab7
DH		 4050
4051 return hdev;
4052}
4053EXPORT_SYMBOL(hci_alloc_dev);
4054
4055/* Free HCI device */
4056void hci_free_dev(struct hci_dev *hdev)
4057{
9be0dab7
DH		 4058 /* will free via device release */
4059 put_device(&hdev->dev);
4060}
4061EXPORT_SYMBOL(hci_free_dev);
4062
1da177e4
LT		 4063/* Register HCI device */
4064int hci_register_dev(struct hci_dev *hdev)
4065{
b1b813d4 4066 int id, error;
1da177e4 4067
74292d5a 4068 if (!hdev->open || !hdev->close || !hdev->send)
1da177e4
LT		 4069 return -EINVAL;
4070
08add513
MM		 4071 /* Do not allow HCI_AMP devices to register at index 0,
4072 * so the index can be used as the AMP controller ID.
4073 */
3df92b31
SL		 4074 switch (hdev->dev_type) {
4075 case HCI_BREDR:
4076 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
4077 break;
4078 case HCI_AMP:
4079 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
4080 break;
4081 default:
4082 return -EINVAL;
1da177e4 4083 }
8e87d142 4084
3df92b31
SL		 4085 if (id < 0)
4086 return id;
4087
1da177e4
LT		 4088 sprintf(hdev->name, "hci%d", id);
4089 hdev->id = id;
2d8b3a11
AE		 4090
4091 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
4092
d8537548
KC		 4093 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
4094 WQ_MEM_RECLAIM, 1, hdev->name);
33ca954d
DH		 4095 if (!hdev->workqueue) {
4096 error = -ENOMEM;
4097 goto err;
4098 }
f48fd9c8 4099
d8537548
KC		 4100 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
4101 WQ_MEM_RECLAIM, 1, hdev->name);
6ead1bbc
JH		 4102 if (!hdev->req_workqueue) {
4103 destroy_workqueue(hdev->workqueue);
4104 error = -ENOMEM;
4105 goto err;
4106 }
4107
0153e2ec
MH		 4108 if (!IS_ERR_OR_NULL(bt_debugfs))
4109 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
4110
bdc3e0f1
MH		 4111 dev_set_name(&hdev->dev, "%s", hdev->name);
4112
4113 error = device_add(&hdev->dev);
33ca954d 4114 if (error < 0)
54506918 4115 goto err_wqueue;
1da177e4 4116
611b30f7 4117 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 4118 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
4119 hdev);
611b30f7
MH		 4120 if (hdev->rfkill) {
4121 if (rfkill_register(hdev->rfkill) < 0) {
4122 rfkill_destroy(hdev->rfkill);
4123 hdev->rfkill = NULL;
4124 }
4125 }
4126
5e130367
JH		 4127 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
4128 set_bit(HCI_RFKILLED, &hdev->dev_flags);
4129
a8b2d5c2 4130 set_bit(HCI_SETUP, &hdev->dev_flags);
004b0258 4131 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
ce2be9ac 4132
01cd3404 4133 if (hdev->dev_type == HCI_BREDR) {
56f87901
JH		 4134 /* Assume BR/EDR support until proven otherwise (such as
4135 * through reading supported features during init.
4136 */
4137 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4138 }
ce2be9ac 4139
fcee3377
GP		 4140 write_lock(&hci_dev_list_lock);
4141 list_add(&hdev->list, &hci_dev_list);
4142 write_unlock(&hci_dev_list_lock);
4143
4a964404
MH		 4144 /* Devices that are marked for raw-only usage are unconfigured
4145 * and should not be included in normal operation.
fee746b0
MH		 4146 */
4147 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
4a964404 4148 set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
fee746b0 4149
1da177e4 4150 hci_notify(hdev, HCI_DEV_REG);
dc946bd8 4151 hci_dev_hold(hdev);
1da177e4 4152
19202573 4153 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 4154
1da177e4 4155 return id;
f48fd9c8 4156
33ca954d
DH		 4157err_wqueue:
4158 destroy_workqueue(hdev->workqueue);
6ead1bbc 4159 destroy_workqueue(hdev->req_workqueue);
33ca954d 4160err:
3df92b31 4161 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 4162
33ca954d 4163 return error;
1da177e4
LT		 4164}
4165EXPORT_SYMBOL(hci_register_dev);
4166
4167/* Unregister HCI device */
59735631 4168void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 4169{
3df92b31 4170 int i, id;
ef222013 4171
c13854ce 4172 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 4173
94324962
JH		 4174 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
4175
3df92b31
SL		 4176 id = hdev->id;
4177
f20d09d5 4178 write_lock(&hci_dev_list_lock);
1da177e4 4179 list_del(&hdev->list);
f20d09d5 4180 write_unlock(&hci_dev_list_lock);
1da177e4
LT		 4181
4182 hci_dev_do_close(hdev);
4183
cd4c5391 4184 for (i = 0; i < NUM_REASSEMBLY; i++)
ef222013
MH		 4185 kfree_skb(hdev->reassembly[i]);
4186
b9b5ef18
GP		 4187 cancel_work_sync(&hdev->power_on);
4188
ab81cbf9 4189 if (!test_bit(HCI_INIT, &hdev->flags) &&
d603b76b
MH		 4190 !test_bit(HCI_SETUP, &hdev->dev_flags) &&
4191 !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
09fd0de5 4192 hci_dev_lock(hdev);
744cf19e 4193 mgmt_index_removed(hdev);
09fd0de5 4194 hci_dev_unlock(hdev);
56e5cb86 4195 }
ab81cbf9 4196
2e58ef3e
JH		 4197 /* mgmt_index_removed should take care of emptying the
4198 * pending list */
4199 BUG_ON(!list_empty(&hdev->mgmt_pending));
4200
1da177e4
LT		 4201 hci_notify(hdev, HCI_DEV_UNREG);
4202
611b30f7
MH		 4203 if (hdev->rfkill) {
4204 rfkill_unregister(hdev->rfkill);
4205 rfkill_destroy(hdev->rfkill);
4206 }
4207
711eafe3 4208 smp_unregister(hdev);
99780a7b 4209
bdc3e0f1 4210 device_del(&hdev->dev);
147e2d59 4211
0153e2ec
MH		 4212 debugfs_remove_recursive(hdev->debugfs);
4213
f48fd9c8 4214 destroy_workqueue(hdev->workqueue);
6ead1bbc 4215 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 4216
09fd0de5 4217 hci_dev_lock(hdev);
dcc36c16 4218 hci_bdaddr_list_clear(&hdev->blacklist);
6659358e 4219 hci_bdaddr_list_clear(&hdev->whitelist);
2aeb9a1a 4220 hci_uuids_clear(hdev);
55ed8ca1 4221 hci_link_keys_clear(hdev);
b899efaf 4222 hci_smp_ltks_clear(hdev);
970c4e46 4223 hci_smp_irks_clear(hdev);
2763eda6 4224 hci_remote_oob_data_clear(hdev);
dcc36c16 4225 hci_bdaddr_list_clear(&hdev->le_white_list);
373110c5 4226 hci_conn_params_clear_all(hdev);
09fd0de5 4227 hci_dev_unlock(hdev);
e2e0cacb 4228
dc946bd8 4229 hci_dev_put(hdev);
3df92b31
SL		 4230
4231 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 4232}
4233EXPORT_SYMBOL(hci_unregister_dev);
4234
4235/* Suspend HCI device */
4236int hci_suspend_dev(struct hci_dev *hdev)
4237{
4238 hci_notify(hdev, HCI_DEV_SUSPEND);
4239 return 0;
4240}
4241EXPORT_SYMBOL(hci_suspend_dev);
4242
4243/* Resume HCI device */
4244int hci_resume_dev(struct hci_dev *hdev)
4245{
4246 hci_notify(hdev, HCI_DEV_RESUME);
4247 return 0;
4248}
4249EXPORT_SYMBOL(hci_resume_dev);
4250
75e0569f
MH		 4251/* Reset HCI device */
4252int hci_reset_dev(struct hci_dev *hdev)
4253{
4254 const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
4255 struct sk_buff *skb;
4256
4257 skb = bt_skb_alloc(3, GFP_ATOMIC);
4258 if (!skb)
4259 return -ENOMEM;
4260
4261 bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
4262 memcpy(skb_put(skb, 3), hw_err, 3);
4263
4264 /* Send Hardware Error to upper stack */
4265 return hci_recv_frame(hdev, skb);
4266}
4267EXPORT_SYMBOL(hci_reset_dev);
4268
76bca880 4269/* Receive frame from HCI drivers */
e1a26170 4270int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
76bca880 4271{
76bca880 4272 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 4273 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 4274 kfree_skb(skb);
4275 return -ENXIO;
4276 }
4277
d82603c6 4278 /* Incoming skb */
76bca880
MH		 4279 bt_cb(skb)->incoming = 1;
4280
4281 /* Time stamp */
4282 __net_timestamp(skb);
4283
76bca880 4284 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 4285 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 4286
76bca880
MH		 4287 return 0;
4288}
4289EXPORT_SYMBOL(hci_recv_frame);
4290
33e882a5 4291static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
a8c5fb1a 4292 int count, __u8 index)
33e882a5
SS		 4293{
4294 int len = 0;
4295 int hlen = 0;
4296 int remain = count;
4297 struct sk_buff *skb;
4298 struct bt_skb_cb *scb;
4299
4300 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
a8c5fb1a 4301 index >= NUM_REASSEMBLY)
33e882a5
SS		 4302 return -EILSEQ;
4303
4304 skb = hdev->reassembly[index];
4305
4306 if (!skb) {
4307 switch (type) {
4308 case HCI_ACLDATA_PKT:
4309 len = HCI_MAX_FRAME_SIZE;
4310 hlen = HCI_ACL_HDR_SIZE;
4311 break;
4312 case HCI_EVENT_PKT:
4313 len = HCI_MAX_EVENT_SIZE;
4314 hlen = HCI_EVENT_HDR_SIZE;
4315 break;
4316 case HCI_SCODATA_PKT:
4317 len = HCI_MAX_SCO_SIZE;
4318 hlen = HCI_SCO_HDR_SIZE;
4319 break;
4320 }
4321
1e429f38 4322 skb = bt_skb_alloc(len, GFP_ATOMIC);
33e882a5
SS		 4323 if (!skb)
4324 return -ENOMEM;
4325
4326 scb = (void *) skb->cb;
4327 scb->expect = hlen;
4328 scb->pkt_type = type;
4329
33e882a5
SS		 4330 hdev->reassembly[index] = skb;
4331 }
4332
4333 while (count) {
4334 scb = (void *) skb->cb;
89bb46d0 4335 len = min_t(uint, scb->expect, count);
33e882a5
SS		 4336
4337 memcpy(skb_put(skb, len), data, len);
4338
4339 count -= len;
4340 data += len;
4341 scb->expect -= len;
4342 remain = count;
4343
4344 switch (type) {
4345 case HCI_EVENT_PKT:
4346 if (skb->len == HCI_EVENT_HDR_SIZE) {
4347 struct hci_event_hdr *h = hci_event_hdr(skb);
4348 scb->expect = h->plen;
4349
4350 if (skb_tailroom(skb) < scb->expect) {
4351 kfree_skb(skb);
4352 hdev->reassembly[index] = NULL;
4353 return -ENOMEM;
4354 }
4355 }
4356 break;
4357
4358 case HCI_ACLDATA_PKT:
4359 if (skb->len == HCI_ACL_HDR_SIZE) {
4360 struct hci_acl_hdr *h = hci_acl_hdr(skb);
4361 scb->expect = __le16_to_cpu(h->dlen);
4362
4363 if (skb_tailroom(skb) < scb->expect) {
4364 kfree_skb(skb);
4365 hdev->reassembly[index] = NULL;
4366 return -ENOMEM;
4367 }
4368 }
4369 break;
4370
4371 case HCI_SCODATA_PKT:
4372 if (skb->len == HCI_SCO_HDR_SIZE) {
4373 struct hci_sco_hdr *h = hci_sco_hdr(skb);
4374 scb->expect = h->dlen;
4375
4376 if (skb_tailroom(skb) < scb->expect) {
4377 kfree_skb(skb);
4378 hdev->reassembly[index] = NULL;
4379 return -ENOMEM;
4380 }
4381 }
4382 break;
4383 }
4384
4385 if (scb->expect == 0) {
4386 /* Complete frame */
4387
4388 bt_cb(skb)->pkt_type = type;
e1a26170 4389 hci_recv_frame(hdev, skb);
33e882a5
SS		 4390
4391 hdev->reassembly[index] = NULL;
4392 return remain;
4393 }
4394 }
4395
4396 return remain;
4397}
4398
99811510
SS		 4399#define STREAM_REASSEMBLY 0
4400
4401int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
4402{
4403 int type;
4404 int rem = 0;
4405
da5f6c37 4406 while (count) {
99811510
SS		 4407 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
4408
4409 if (!skb) {
4410 struct { char type; } *pkt;
4411
4412 /* Start of the frame */
4413 pkt = data;
4414 type = pkt->type;
4415
4416 data++;
4417 count--;
4418 } else
4419 type = bt_cb(skb)->pkt_type;
4420
1e429f38 4421 rem = hci_reassembly(hdev, type, data, count,
a8c5fb1a 4422 STREAM_REASSEMBLY);
99811510
SS		 4423 if (rem < 0)
4424 return rem;
4425
4426 data += (count - rem);
4427 count = rem;
f81c6224 4428 }
99811510
SS		 4429
4430 return rem;
4431}
4432EXPORT_SYMBOL(hci_recv_stream_fragment);
4433
1da177e4
LT		 4434/* ---- Interface to upper protocols ---- */
4435
1da177e4
LT		 4436int hci_register_cb(struct hci_cb *cb)
4437{
4438 BT_DBG("%p name %s", cb, cb->name);
4439
f20d09d5 4440 write_lock(&hci_cb_list_lock);
1da177e4 4441 list_add(&cb->list, &hci_cb_list);
f20d09d5 4442 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 4443
4444 return 0;
4445}
4446EXPORT_SYMBOL(hci_register_cb);
4447
4448int hci_unregister_cb(struct hci_cb *cb)
4449{
4450 BT_DBG("%p name %s", cb, cb->name);
4451
f20d09d5 4452 write_lock(&hci_cb_list_lock);
1da177e4 4453 list_del(&cb->list);
f20d09d5 4454 write_unlock(&hci_cb_list_lock);
1da177e4
LT		 4455
4456 return 0;
4457}
4458EXPORT_SYMBOL(hci_unregister_cb);
4459
51086991 4460static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 4461{
cdc52faa
MH		 4462 int err;
4463
0d48d939 4464 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
1da177e4 4465
cd82e61c
MH		 4466 /* Time stamp */
4467 __net_timestamp(skb);
1da177e4 4468
cd82e61c
MH		 4469 /* Send copy to monitor */
4470 hci_send_to_monitor(hdev, skb);
4471
4472 if (atomic_read(&hdev->promisc)) {
4473 /* Send copy to the sockets */
470fe1b5 4474 hci_send_to_sock(hdev, skb);
1da177e4
LT		 4475 }
4476
4477 /* Get rid of skb owner, prior to sending to the driver. */
4478 skb_orphan(skb);
4479
cdc52faa
MH		 4480 err = hdev->send(hdev, skb);
4481 if (err < 0) {
4482 BT_ERR("%s sending frame failed (%d)", hdev->name, err);
4483 kfree_skb(skb);
4484 }
1da177e4
LT		 4485}
4486
3119ae95
JH		 4487void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
4488{
4489 skb_queue_head_init(&req->cmd_q);
4490 req->hdev = hdev;
5d73e034 4491 req->err = 0;
3119ae95
JH		 4492}
4493
4494int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
4495{
4496 struct hci_dev *hdev = req->hdev;
4497 struct sk_buff *skb;
4498 unsigned long flags;
4499
4500 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
4501
49c922bb 4502 /* If an error occurred during request building, remove all HCI
5d73e034
AG		 4503 * commands queued on the HCI request queue.
4504 */
4505 if (req->err) {
4506 skb_queue_purge(&req->cmd_q);
4507 return req->err;
4508 }
4509
3119ae95
JH		 4510 /* Do not allow empty requests */
4511 if (skb_queue_empty(&req->cmd_q))
382b0c39 4512 return -ENODATA;
3119ae95
JH		 4513
4514 skb = skb_peek_tail(&req->cmd_q);
4515 bt_cb(skb)->req.complete = complete;
4516
4517 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4518 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
4519 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4520
4521 queue_work(hdev->workqueue, &hdev->cmd_work);
4522
4523 return 0;
4524}
4525
899de765
MH		 4526bool hci_req_pending(struct hci_dev *hdev)
4527{
4528 return (hdev->req_status == HCI_REQ_PEND);
4529}
4530
1ca3a9d0 4531static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
07dc93dd 4532 u32 plen, const void *param)
1da177e4
LT		 4533{
4534 int len = HCI_COMMAND_HDR_SIZE + plen;
4535 struct hci_command_hdr *hdr;
4536 struct sk_buff *skb;
4537
1da177e4 4538 skb = bt_skb_alloc(len, GFP_ATOMIC);
1ca3a9d0
JH		 4539 if (!skb)
4540 return NULL;
1da177e4
LT		 4541
4542 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
a9de9248 4543 hdr->opcode = cpu_to_le16(opcode);
1da177e4
LT		 4544 hdr->plen = plen;
4545
4546 if (plen)
4547 memcpy(skb_put(skb, plen), param, plen);
4548
4549 BT_DBG("skb len %d", skb->len);
4550
0d48d939 4551 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
43e73e4e 4552 bt_cb(skb)->opcode = opcode;
c78ae283 4553
1ca3a9d0
JH		 4554 return skb;
4555}
4556
4557/* Send HCI command */
07dc93dd
JH		 4558int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
4559 const void *param)
1ca3a9d0
JH		 4560{
4561 struct sk_buff *skb;
4562
4563 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
4564
4565 skb = hci_prepare_cmd(hdev, opcode, plen, param);
4566 if (!skb) {
4567 BT_ERR("%s no memory for command", hdev->name);
4568 return -ENOMEM;
4569 }
4570
49c922bb 4571 /* Stand-alone HCI commands must be flagged as
11714b3d
JH		 4572 * single-command requests.
4573 */
4574 bt_cb(skb)->req.start = true;
4575
1da177e4 4576 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 4577 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4578
4579 return 0;
4580}
1da177e4 4581
71c76a17 4582/* Queue a command to an asynchronous HCI request */
07dc93dd
JH		 4583void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
4584 const void *param, u8 event)
71c76a17
JH		 4585{
4586 struct hci_dev *hdev = req->hdev;
4587 struct sk_buff *skb;
4588
4589 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
4590
49c922bb 4591 /* If an error occurred during request building, there is no point in
34739c1e
AG		 4592 * queueing the HCI command. We can simply return.
4593 */
4594 if (req->err)
4595 return;
4596
71c76a17
JH		 4597 skb = hci_prepare_cmd(hdev, opcode, plen, param);
4598 if (!skb) {
5d73e034
AG		 4599 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
4600 hdev->name, opcode);
4601 req->err = -ENOMEM;
e348fe6b 4602 return;
71c76a17
JH		 4603 }
4604
4605 if (skb_queue_empty(&req->cmd_q))
4606 bt_cb(skb)->req.start = true;
4607
02350a72
JH		 4608 bt_cb(skb)->req.event = event;
4609
71c76a17 4610 skb_queue_tail(&req->cmd_q, skb);
71c76a17
JH		 4611}
4612
07dc93dd
JH		 4613void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
4614 const void *param)
02350a72
JH		 4615{
4616 hci_req_add_ev(req, opcode, plen, param, 0);
4617}
4618
1da177e4 4619/* Get data from the previously sent command */
a9de9248 4620void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 4621{
4622 struct hci_command_hdr *hdr;
4623
4624 if (!hdev->sent_cmd)
4625 return NULL;
4626
4627 hdr = (void *) hdev->sent_cmd->data;
4628
a9de9248 4629 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 4630 return NULL;
4631
f0e09510 4632 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 4633
4634 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
4635}
4636
4637/* Send ACL data */
4638static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
4639{
4640 struct hci_acl_hdr *hdr;
4641 int len = skb->len;
4642
badff6d0
ACM		 4643 skb_push(skb, HCI_ACL_HDR_SIZE);
4644 skb_reset_transport_header(skb);
9c70220b 4645 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 4646 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
4647 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 4648}
4649
ee22be7e 4650static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 4651 struct sk_buff *skb, __u16 flags)
1da177e4 4652{
ee22be7e 4653 struct hci_conn *conn = chan->conn;
1da177e4
LT		 4654 struct hci_dev *hdev = conn->hdev;
4655 struct sk_buff *list;
4656
087bfd99
GP		 4657 skb->len = skb_headlen(skb);
4658 skb->data_len = 0;
4659
4660 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
204a6e54
AE		 4661
4662 switch (hdev->dev_type) {
4663 case HCI_BREDR:
4664 hci_add_acl_hdr(skb, conn->handle, flags);
4665 break;
4666 case HCI_AMP:
4667 hci_add_acl_hdr(skb, chan->handle, flags);
4668 break;
4669 default:
4670 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
4671 return;
4672 }
087bfd99 4673
70f23020
AE		 4674 list = skb_shinfo(skb)->frag_list;
4675 if (!list) {
1da177e4
LT		 4676 /* Non fragmented */
4677 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
4678
73d80deb 4679 skb_queue_tail(queue, skb);
1da177e4
LT		 4680 } else {
4681 /* Fragmented */
4682 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4683
4684 skb_shinfo(skb)->frag_list = NULL;
4685
9cfd5a23
JR		 4686 /* Queue all fragments atomically. We need to use spin_lock_bh
4687 * here because of 6LoWPAN links, as there this function is
4688 * called from softirq and using normal spin lock could cause
4689 * deadlocks.
4690 */
4691 spin_lock_bh(&queue->lock);
1da177e4 4692
73d80deb 4693 __skb_queue_tail(queue, skb);
e702112f
AE		 4694
4695 flags &= ~ACL_START;
4696 flags |= ACL_CONT;
1da177e4
LT		 4697 do {
4698 skb = list; list = list->next;
8e87d142 4699
0d48d939 4700 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
e702112f 4701 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 4702
4703 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4704
73d80deb 4705 __skb_queue_tail(queue, skb);
1da177e4
LT		 4706 } while (list);
4707
9cfd5a23 4708 spin_unlock_bh(&queue->lock);
1da177e4 4709 }
73d80deb
LAD		 4710}
4711
4712void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
4713{
ee22be7e 4714 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 4715
f0e09510 4716 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb 4717
ee22be7e 4718 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 4719
3eff45ea 4720 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 4721}
1da177e4
LT		 4722
4723/* Send SCO data */
0d861d8b 4724void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 4725{
4726 struct hci_dev *hdev = conn->hdev;
4727 struct hci_sco_hdr hdr;
4728
4729 BT_DBG("%s len %d", hdev->name, skb->len);
4730
aca3192c 4731 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 4732 hdr.dlen = skb->len;
4733
badff6d0
ACM		 4734 skb_push(skb, HCI_SCO_HDR_SIZE);
4735 skb_reset_transport_header(skb);
9c70220b 4736 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4 4737
0d48d939 4738 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
c78ae283 4739
1da177e4 4740 skb_queue_tail(&conn->data_q, skb);
3eff45ea 4741 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 4742}
1da177e4
LT		 4743
4744/* ---- HCI TX task (outgoing data) ---- */
4745
4746/* HCI Connection scheduler */
6039aa73
GP		 4747static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
4748 int *quote)
1da177e4
LT		 4749{
4750 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 4751 struct hci_conn *conn = NULL, *c;
abc5de8f 4752 unsigned int num = 0, min = ~0;
1da177e4 4753
8e87d142 4754 /* We don't have to lock device here. Connections are always
1da177e4 4755 * added and removed with TX task disabled. */
bf4c6325
GP		 4756
4757 rcu_read_lock();
4758
4759 list_for_each_entry_rcu(c, &h->list, list) {
769be974 4760 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 4761 continue;
769be974
MH		 4762
4763 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
4764 continue;
4765
1da177e4
LT		 4766 num++;
4767
4768 if (c->sent < min) {
4769 min = c->sent;
4770 conn = c;
4771 }
52087a79
LAD		 4772
4773 if (hci_conn_num(hdev, type) == num)
4774 break;
1da177e4
LT		 4775 }
4776
bf4c6325
GP		 4777 rcu_read_unlock();
4778
1da177e4 4779 if (conn) {
6ed58ec5
VT		 4780 int cnt, q;
4781
4782 switch (conn->type) {
4783 case ACL_LINK:
4784 cnt = hdev->acl_cnt;
4785 break;
4786 case SCO_LINK:
4787 case ESCO_LINK:
4788 cnt = hdev->sco_cnt;
4789 break;
4790 case LE_LINK:
4791 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4792 break;
4793 default:
4794 cnt = 0;
4795 BT_ERR("Unknown link type");
4796 }
4797
4798 q = cnt / num;
1da177e4
LT		 4799 *quote = q ? q : 1;
4800 } else
4801 *quote = 0;
4802
4803 BT_DBG("conn %p quote %d", conn, *quote);
4804 return conn;
4805}
4806
6039aa73 4807static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 4808{
4809 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 4810 struct hci_conn *c;
1da177e4 4811
bae1f5d9 4812 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 4813
bf4c6325
GP		 4814 rcu_read_lock();
4815
1da177e4 4816 /* Kill stalled connections */
bf4c6325 4817 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 4818 if (c->type == type && c->sent) {
6ed93dc6
AE		 4819 BT_ERR("%s killing stalled connection %pMR",
4820 hdev->name, &c->dst);
bed71748 4821 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 4822 }
4823 }
bf4c6325
GP		 4824
4825 rcu_read_unlock();
1da177e4
LT		 4826}
4827
6039aa73
GP		 4828static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
4829 int *quote)
1da177e4 4830{
73d80deb
LAD		 4831 struct hci_conn_hash *h = &hdev->conn_hash;
4832 struct hci_chan *chan = NULL;
abc5de8f 4833 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 4834 struct hci_conn *conn;
73d80deb
LAD		 4835 int cnt, q, conn_num = 0;
4836
4837 BT_DBG("%s", hdev->name);
4838
bf4c6325
GP		 4839 rcu_read_lock();
4840
4841 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 4842 struct hci_chan *tmp;
4843
4844 if (conn->type != type)
4845 continue;
4846
4847 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4848 continue;
4849
4850 conn_num++;
4851
8192edef 4852 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 4853 struct sk_buff *skb;
4854
4855 if (skb_queue_empty(&tmp->data_q))
4856 continue;
4857
4858 skb = skb_peek(&tmp->data_q);
4859 if (skb->priority < cur_prio)
4860 continue;
4861
4862 if (skb->priority > cur_prio) {
4863 num = 0;
4864 min = ~0;
4865 cur_prio = skb->priority;
4866 }
4867
4868 num++;
4869
4870 if (conn->sent < min) {
4871 min = conn->sent;
4872 chan = tmp;
4873 }
4874 }
4875
4876 if (hci_conn_num(hdev, type) == conn_num)
4877 break;
4878 }
4879
bf4c6325
GP		 4880 rcu_read_unlock();
4881
73d80deb
LAD		 4882 if (!chan)
4883 return NULL;
4884
4885 switch (chan->conn->type) {
4886 case ACL_LINK:
4887 cnt = hdev->acl_cnt;
4888 break;
bd1eb66b
AE		 4889 case AMP_LINK:
4890 cnt = hdev->block_cnt;
4891 break;
73d80deb
LAD		 4892 case SCO_LINK:
4893 case ESCO_LINK:
4894 cnt = hdev->sco_cnt;
4895 break;
4896 case LE_LINK:
4897 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4898 break;
4899 default:
4900 cnt = 0;
4901 BT_ERR("Unknown link type");
4902 }
4903
4904 q = cnt / num;
4905 *quote = q ? q : 1;
4906 BT_DBG("chan %p quote %d", chan, *quote);
4907 return chan;
4908}
4909
02b20f0b
LAD		 4910static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
4911{
4912 struct hci_conn_hash *h = &hdev->conn_hash;
4913 struct hci_conn *conn;
4914 int num = 0;
4915
4916 BT_DBG("%s", hdev->name);
4917
bf4c6325
GP		 4918 rcu_read_lock();
4919
4920 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 4921 struct hci_chan *chan;
4922
4923 if (conn->type != type)
4924 continue;
4925
4926 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4927 continue;
4928
4929 num++;
4930
8192edef 4931 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 4932 struct sk_buff *skb;
4933
4934 if (chan->sent) {
4935 chan->sent = 0;
4936 continue;
4937 }
4938
4939 if (skb_queue_empty(&chan->data_q))
4940 continue;
4941
4942 skb = skb_peek(&chan->data_q);
4943 if (skb->priority >= HCI_PRIO_MAX - 1)
4944 continue;
4945
4946 skb->priority = HCI_PRIO_MAX - 1;
4947
4948 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 4949 skb->priority);
02b20f0b
LAD		 4950 }
4951
4952 if (hci_conn_num(hdev, type) == num)
4953 break;
4954 }
bf4c6325
GP		 4955
4956 rcu_read_unlock();
4957
02b20f0b
LAD		 4958}
4959
b71d385a
AE		 4960static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
4961{
4962 /* Calculate count of blocks used by this packet */
4963 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
4964}
4965
6039aa73 4966static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 4967{
4a964404 4968 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
1da177e4
LT		 4969 /* ACL tx timeout must be longer than maximum
4970 * link supervision timeout (40.9 seconds) */
63d2bc1b 4971 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 4972 HCI_ACL_TX_TIMEOUT))
bae1f5d9 4973 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 4974 }
63d2bc1b 4975}
1da177e4 4976
6039aa73 4977static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 4978{
4979 unsigned int cnt = hdev->acl_cnt;
4980 struct hci_chan *chan;
4981 struct sk_buff *skb;
4982 int quote;
4983
4984 __check_timeout(hdev, cnt);
04837f64 4985
73d80deb 4986 while (hdev->acl_cnt &&
a8c5fb1a 4987 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 4988 u32 priority = (skb_peek(&chan->data_q))->priority;
4989 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 4990 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 4991 skb->len, skb->priority);
73d80deb 4992
ec1cce24
LAD		 4993 /* Stop if priority has changed */
4994 if (skb->priority < priority)
4995 break;
4996
4997 skb = skb_dequeue(&chan->data_q);
4998
73d80deb 4999 hci_conn_enter_active_mode(chan->conn,
04124681 5000 bt_cb(skb)->force_active);
04837f64 5001
57d17d70 5002 hci_send_frame(hdev, skb);
1da177e4
LT		 5003 hdev->acl_last_tx = jiffies;
5004
5005 hdev->acl_cnt--;
73d80deb
LAD		 5006 chan->sent++;
5007 chan->conn->sent++;
1da177e4
LT		 5008 }
5009 }
02b20f0b
LAD		 5010
5011 if (cnt != hdev->acl_cnt)
5012 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 5013}
5014
6039aa73 5015static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 5016{
63d2bc1b 5017 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 5018 struct hci_chan *chan;
5019 struct sk_buff *skb;
5020 int quote;
bd1eb66b 5021 u8 type;
b71d385a 5022
63d2bc1b 5023 __check_timeout(hdev, cnt);
b71d385a 5024
bd1eb66b
AE		 5025 BT_DBG("%s", hdev->name);
5026
5027 if (hdev->dev_type == HCI_AMP)
5028 type = AMP_LINK;
5029 else
5030 type = ACL_LINK;
5031
b71d385a 5032 while (hdev->block_cnt > 0 &&
bd1eb66b 5033 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 5034 u32 priority = (skb_peek(&chan->data_q))->priority;
5035 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
5036 int blocks;
5037
5038 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 5039 skb->len, skb->priority);
b71d385a
AE		 5040
5041 /* Stop if priority has changed */
5042 if (skb->priority < priority)
5043 break;
5044
5045 skb = skb_dequeue(&chan->data_q);
5046
5047 blocks = __get_blocks(hdev, skb);
5048 if (blocks > hdev->block_cnt)
5049 return;
5050
5051 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 5052 bt_cb(skb)->force_active);
b71d385a 5053
57d17d70 5054 hci_send_frame(hdev, skb);
b71d385a
AE		 5055 hdev->acl_last_tx = jiffies;
5056
5057 hdev->block_cnt -= blocks;
5058 quote -= blocks;
5059
5060 chan->sent += blocks;
5061 chan->conn->sent += blocks;
5062 }
5063 }
5064
5065 if (cnt != hdev->block_cnt)
bd1eb66b 5066 hci_prio_recalculate(hdev, type);
b71d385a
AE		 5067}
5068
6039aa73 5069static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 5070{
5071 BT_DBG("%s", hdev->name);
5072
bd1eb66b
AE		 5073 /* No ACL link over BR/EDR controller */
5074 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
5075 return;
5076
5077 /* No AMP link over AMP controller */
5078 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 5079 return;
5080
5081 switch (hdev->flow_ctl_mode) {
5082 case HCI_FLOW_CTL_MODE_PACKET_BASED:
5083 hci_sched_acl_pkt(hdev);
5084 break;
5085
5086 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
5087 hci_sched_acl_blk(hdev);
5088 break;
5089 }
5090}
5091
1da177e4 5092/* Schedule SCO */
6039aa73 5093static void hci_sched_sco(struct hci_dev *hdev)
1da177e4
LT		 5094{
5095 struct hci_conn *conn;
5096 struct sk_buff *skb;
5097 int quote;
5098
5099 BT_DBG("%s", hdev->name);
5100
52087a79
LAD		 5101 if (!hci_conn_num(hdev, SCO_LINK))
5102 return;
5103
1da177e4
LT		 5104 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
5105 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
5106 BT_DBG("skb %p len %d", skb, skb->len);
57d17d70 5107 hci_send_frame(hdev, skb);
1da177e4
LT		 5108
5109 conn->sent++;
5110 if (conn->sent == ~0)
5111 conn->sent = 0;
5112 }
5113 }
5114}
5115
6039aa73 5116static void hci_sched_esco(struct hci_dev *hdev)
b6a0dc82
MH		 5117{
5118 struct hci_conn *conn;
5119 struct sk_buff *skb;
5120 int quote;
5121
5122 BT_DBG("%s", hdev->name);
5123
52087a79
LAD		 5124 if (!hci_conn_num(hdev, ESCO_LINK))
5125 return;
5126
8fc9ced3
GP		 5127 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
5128 &quote))) {
b6a0dc82
MH		 5129 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
5130 BT_DBG("skb %p len %d", skb, skb->len);
57d17d70 5131 hci_send_frame(hdev, skb);
b6a0dc82
MH		 5132
5133 conn->sent++;
5134 if (conn->sent == ~0)
5135 conn->sent = 0;
5136 }
5137 }
5138}
5139
6039aa73 5140static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 5141{
73d80deb 5142 struct hci_chan *chan;
6ed58ec5 5143 struct sk_buff *skb;
02b20f0b 5144 int quote, cnt, tmp;
6ed58ec5
VT		 5145
5146 BT_DBG("%s", hdev->name);
5147
52087a79
LAD		 5148 if (!hci_conn_num(hdev, LE_LINK))
5149 return;
5150
4a964404 5151 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
6ed58ec5
VT		 5152 /* LE tx timeout must be longer than maximum
5153 * link supervision timeout (40.9 seconds) */
bae1f5d9 5154 if (!hdev->le_cnt && hdev->le_pkts &&
a8c5fb1a 5155 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 5156 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 5157 }
5158
5159 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 5160 tmp = cnt;
73d80deb 5161 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 5162 u32 priority = (skb_peek(&chan->data_q))->priority;
5163 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 5164 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 5165 skb->len, skb->priority);
6ed58ec5 5166
ec1cce24
LAD		 5167 /* Stop if priority has changed */
5168 if (skb->priority < priority)
5169 break;
5170
5171 skb = skb_dequeue(&chan->data_q);
5172
57d17d70 5173 hci_send_frame(hdev, skb);
6ed58ec5
VT		 5174 hdev->le_last_tx = jiffies;
5175
5176 cnt--;
73d80deb
LAD		 5177 chan->sent++;
5178 chan->conn->sent++;
6ed58ec5
VT		 5179 }
5180 }
73d80deb 5181
6ed58ec5
VT		 5182 if (hdev->le_pkts)
5183 hdev->le_cnt = cnt;
5184 else
5185 hdev->acl_cnt = cnt;
02b20f0b
LAD		 5186
5187 if (cnt != tmp)
5188 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 5189}
5190
3eff45ea 5191static void hci_tx_work(struct work_struct *work)
1da177e4 5192{
3eff45ea 5193 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 5194 struct sk_buff *skb;
5195
6ed58ec5 5196 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 5197 hdev->sco_cnt, hdev->le_cnt);
1da177e4 5198
52de599e
MH		 5199 if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5200 /* Schedule queues and send stuff to HCI driver */
5201 hci_sched_acl(hdev);
5202 hci_sched_sco(hdev);
5203 hci_sched_esco(hdev);
5204 hci_sched_le(hdev);
5205 }
6ed58ec5 5206
1da177e4
LT		 5207 /* Send next queued raw (unknown type) packet */
5208 while ((skb = skb_dequeue(&hdev->raw_q)))
57d17d70 5209 hci_send_frame(hdev, skb);
1da177e4
LT		 5210}
5211
25985edc 5212/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 5213
5214/* ACL data packet */
6039aa73 5215static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 5216{
5217 struct hci_acl_hdr *hdr = (void *) skb->data;
5218 struct hci_conn *conn;
5219 __u16 handle, flags;
5220
5221 skb_pull(skb, HCI_ACL_HDR_SIZE);
5222
5223 handle = __le16_to_cpu(hdr->handle);
5224 flags = hci_flags(handle);
5225 handle = hci_handle(handle);
5226
f0e09510 5227 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 5228 handle, flags);
1da177e4
LT		 5229
5230 hdev->stat.acl_rx++;
5231
5232 hci_dev_lock(hdev);
5233 conn = hci_conn_hash_lookup_handle(hdev, handle);
5234 hci_dev_unlock(hdev);
8e87d142 5235
1da177e4 5236 if (conn) {
65983fc7 5237 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 5238
1da177e4 5239 /* Send to upper protocol */
686ebf28
UF		 5240 l2cap_recv_acldata(conn, skb, flags);
5241 return;
1da177e4 5242 } else {
8e87d142 5243 BT_ERR("%s ACL packet for unknown connection handle %d",
a8c5fb1a 5244 hdev->name, handle);
1da177e4
LT		 5245 }
5246
5247 kfree_skb(skb);
5248}
5249
5250/* SCO data packet */
6039aa73 5251static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 5252{
5253 struct hci_sco_hdr *hdr = (void *) skb->data;
5254 struct hci_conn *conn;
5255 __u16 handle;
5256
5257 skb_pull(skb, HCI_SCO_HDR_SIZE);
5258
5259 handle = __le16_to_cpu(hdr->handle);
5260
f0e09510 5261 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
1da177e4
LT		 5262
5263 hdev->stat.sco_rx++;
5264
5265 hci_dev_lock(hdev);
5266 conn = hci_conn_hash_lookup_handle(hdev, handle);
5267 hci_dev_unlock(hdev);
5268
5269 if (conn) {
1da177e4 5270 /* Send to upper protocol */
686ebf28
UF		 5271 sco_recv_scodata(conn, skb);
5272 return;
1da177e4 5273 } else {
8e87d142 5274 BT_ERR("%s SCO packet for unknown connection handle %d",
a8c5fb1a 5275 hdev->name, handle);
1da177e4
LT		 5276 }
5277
5278 kfree_skb(skb);
5279}
5280
9238f36a
JH		 5281static bool hci_req_is_complete(struct hci_dev *hdev)
5282{
5283 struct sk_buff *skb;
5284
5285 skb = skb_peek(&hdev->cmd_q);
5286 if (!skb)
5287 return true;
5288
5289 return bt_cb(skb)->req.start;
5290}
5291
42c6b129
JH		 5292static void hci_resend_last(struct hci_dev *hdev)
5293{
5294 struct hci_command_hdr *sent;
5295 struct sk_buff *skb;
5296 u16 opcode;
5297
5298 if (!hdev->sent_cmd)
5299 return;
5300
5301 sent = (void *) hdev->sent_cmd->data;
5302 opcode = __le16_to_cpu(sent->opcode);
5303 if (opcode == HCI_OP_RESET)
5304 return;
5305
5306 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
5307 if (!skb)
5308 return;
5309
5310 skb_queue_head(&hdev->cmd_q, skb);
5311 queue_work(hdev->workqueue, &hdev->cmd_work);
5312}
5313
9238f36a
JH		 5314void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
5315{
5316 hci_req_complete_t req_complete = NULL;
5317 struct sk_buff *skb;
5318 unsigned long flags;
5319
5320 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
5321
42c6b129
JH		 5322 /* If the completed command doesn't match the last one that was
5323 * sent we need to do special handling of it.
9238f36a 5324 */
42c6b129
JH		 5325 if (!hci_sent_cmd_data(hdev, opcode)) {
5326 /* Some CSR based controllers generate a spontaneous
5327 * reset complete event during init and any pending
5328 * command will never be completed. In such a case we
5329 * need to resend whatever was the last sent
5330 * command.
5331 */
5332 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
5333 hci_resend_last(hdev);
5334
9238f36a 5335 return;
42c6b129 5336 }
9238f36a
JH		 5337
5338 /* If the command succeeded and there's still more commands in
5339 * this request the request is not yet complete.
5340 */
5341 if (!status && !hci_req_is_complete(hdev))
5342 return;
5343
5344 /* If this was the last command in a request the complete
5345 * callback would be found in hdev->sent_cmd instead of the
5346 * command queue (hdev->cmd_q).
5347 */
5348 if (hdev->sent_cmd) {
5349 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
53e21fbc
JH		 5350
5351 if (req_complete) {
5352 /* We must set the complete callback to NULL to
5353 * avoid calling the callback more than once if
5354 * this function gets called again.
5355 */
5356 bt_cb(hdev->sent_cmd)->req.complete = NULL;
5357
9238f36a 5358 goto call_complete;
53e21fbc 5359 }
9238f36a
JH		 5360 }
5361
5362 /* Remove all pending commands belonging to this request */
5363 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
5364 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
5365 if (bt_cb(skb)->req.start) {
5366 __skb_queue_head(&hdev->cmd_q, skb);
5367 break;
5368 }
5369
5370 req_complete = bt_cb(skb)->req.complete;
5371 kfree_skb(skb);
5372 }
5373 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
5374
5375call_complete:
5376 if (req_complete)
5377 req_complete(hdev, status);
5378}
5379
b78752cc 5380static void hci_rx_work(struct work_struct *work)
1da177e4 5381{
b78752cc 5382 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 5383 struct sk_buff *skb;
5384
5385 BT_DBG("%s", hdev->name);
5386
1da177e4 5387 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 5388 /* Send copy to monitor */
5389 hci_send_to_monitor(hdev, skb);
5390
1da177e4
LT		 5391 if (atomic_read(&hdev->promisc)) {
5392 /* Send copy to the sockets */
470fe1b5 5393 hci_send_to_sock(hdev, skb);
1da177e4
LT		 5394 }
5395
fee746b0 5396 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1da177e4
LT		 5397 kfree_skb(skb);
5398 continue;
5399 }
5400
5401 if (test_bit(HCI_INIT, &hdev->flags)) {
5402 /* Don't process data packets in this states. */
0d48d939 5403 switch (bt_cb(skb)->pkt_type) {
1da177e4
LT		 5404 case HCI_ACLDATA_PKT:
5405 case HCI_SCODATA_PKT:
5406 kfree_skb(skb);
5407 continue;
3ff50b79 5408 }
1da177e4
LT		 5409 }
5410
5411 /* Process frame */
0d48d939 5412 switch (bt_cb(skb)->pkt_type) {
1da177e4 5413 case HCI_EVENT_PKT:
b78752cc 5414 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 5415 hci_event_packet(hdev, skb);
5416 break;
5417
5418 case HCI_ACLDATA_PKT:
5419 BT_DBG("%s ACL data packet", hdev->name);
5420 hci_acldata_packet(hdev, skb);
5421 break;
5422
5423 case HCI_SCODATA_PKT:
5424 BT_DBG("%s SCO data packet", hdev->name);
5425 hci_scodata_packet(hdev, skb);
5426 break;
5427
5428 default:
5429 kfree_skb(skb);
5430 break;
5431 }
5432 }
1da177e4
LT		 5433}
5434
c347b765 5435static void hci_cmd_work(struct work_struct *work)
1da177e4 5436{
c347b765 5437 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 5438 struct sk_buff *skb;
5439
2104786b
AE		 5440 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
5441 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 5442
1da177e4 5443 /* Send queued commands */
5a08ecce
AE		 5444 if (atomic_read(&hdev->cmd_cnt)) {
5445 skb = skb_dequeue(&hdev->cmd_q);
5446 if (!skb)
5447 return;
5448
7585b97a 5449 kfree_skb(hdev->sent_cmd);
1da177e4 5450
a675d7f1 5451 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
70f23020 5452 if (hdev->sent_cmd) {
1da177e4 5453 atomic_dec(&hdev->cmd_cnt);
57d17d70 5454 hci_send_frame(hdev, skb);
7bdb8a5c 5455 if (test_bit(HCI_RESET, &hdev->flags))
65cc2b49 5456 cancel_delayed_work(&hdev->cmd_timer);
7bdb8a5c 5457 else
65cc2b49
MH		 5458 schedule_delayed_work(&hdev->cmd_timer,
5459 HCI_CMD_TIMEOUT);
1da177e4
LT		 5460 } else {
5461 skb_queue_head(&hdev->cmd_q, skb);
c347b765 5462 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 5463 }
5464 }
5465}
b1efcc28
AG		 5466
5467void hci_req_add_le_scan_disable(struct hci_request *req)
5468{
5469 struct hci_cp_le_set_scan_enable cp;
5470
5471 memset(&cp, 0, sizeof(cp));
5472 cp.enable = LE_SCAN_DISABLE;
5473 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
5474}
a4790dbd 5475
8540f6c0
MH		 5476static void add_to_white_list(struct hci_request *req,
5477 struct hci_conn_params *params)
5478{
5479 struct hci_cp_le_add_to_white_list cp;
5480
5481 cp.bdaddr_type = params->addr_type;
5482 bacpy(&cp.bdaddr, &params->addr);
5483
5484 hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
5485}
5486
5487static u8 update_white_list(struct hci_request *req)
5488{
5489 struct hci_dev *hdev = req->hdev;
5490 struct hci_conn_params *params;
5491 struct bdaddr_list *b;
5492 uint8_t white_list_entries = 0;
5493
5494 /* Go through the current white list programmed into the
5495 * controller one by one and check if that address is still
5496 * in the list of pending connections or list of devices to
5497 * report. If not present in either list, then queue the
5498 * command to remove it from the controller.
5499 */
5500 list_for_each_entry(b, &hdev->le_white_list, list) {
5501 struct hci_cp_le_del_from_white_list cp;
5502
5503 if (hci_pend_le_action_lookup(&hdev->pend_le_conns,
5504 &b->bdaddr, b->bdaddr_type) ||
5505 hci_pend_le_action_lookup(&hdev->pend_le_reports,
5506 &b->bdaddr, b->bdaddr_type)) {
5507 white_list_entries++;
5508 continue;
5509 }
5510
5511 cp.bdaddr_type = b->bdaddr_type;
5512 bacpy(&cp.bdaddr, &b->bdaddr);
5513
5514 hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
5515 sizeof(cp), &cp);
5516 }
5517
5518 /* Since all no longer valid white list entries have been
5519 * removed, walk through the list of pending connections
5520 * and ensure that any new device gets programmed into
5521 * the controller.
5522 *
5523 * If the list of the devices is larger than the list of
5524 * available white list entries in the controller, then
5525 * just abort and return filer policy value to not use the
5526 * white list.
5527 */
5528 list_for_each_entry(params, &hdev->pend_le_conns, action) {
5529 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
5530 &params->addr, params->addr_type))
5531 continue;
5532
5533 if (white_list_entries >= hdev->le_white_list_size) {
5534 /* Select filter policy to accept all advertising */
5535 return 0x00;
5536 }
5537
66d8e837
MH		 5538 if (hci_find_irk_by_addr(hdev, &params->addr,
5539 params->addr_type)) {
5540 /* White list can not be used with RPAs */
5541 return 0x00;
5542 }
5543
8540f6c0
MH		 5544 white_list_entries++;
5545 add_to_white_list(req, params);
5546 }
5547
5548 /* After adding all new pending connections, walk through
5549 * the list of pending reports and also add these to the
5550 * white list if there is still space.
5551 */
5552 list_for_each_entry(params, &hdev->pend_le_reports, action) {
5553 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
5554 &params->addr, params->addr_type))
5555 continue;
5556
5557 if (white_list_entries >= hdev->le_white_list_size) {
5558 /* Select filter policy to accept all advertising */
5559 return 0x00;
5560 }
5561
66d8e837
MH		 5562 if (hci_find_irk_by_addr(hdev, &params->addr,
5563 params->addr_type)) {
5564 /* White list can not be used with RPAs */
5565 return 0x00;
5566 }
5567
8540f6c0
MH		 5568 white_list_entries++;
5569 add_to_white_list(req, params);
5570 }
5571
5572 /* Select filter policy to use white list */
5573 return 0x01;
5574}
5575
8ef30fd3
AG		 5576void hci_req_add_le_passive_scan(struct hci_request *req)
5577{
5578 struct hci_cp_le_set_scan_param param_cp;
5579 struct hci_cp_le_set_scan_enable enable_cp;
5580 struct hci_dev *hdev = req->hdev;
5581 u8 own_addr_type;
8540f6c0 5582 u8 filter_policy;
8ef30fd3 5583
6ab535a7
MH		 5584 /* Set require_privacy to false since no SCAN_REQ are send
5585 * during passive scanning. Not using an unresolvable address
5586 * here is important so that peer devices using direct
5587 * advertising with our address will be correctly reported
5588 * by the controller.
8ef30fd3 5589 */
6ab535a7 5590 if (hci_update_random_address(req, false, &own_addr_type))
8ef30fd3
AG		 5591 return;
5592
8540f6c0
MH		 5593 /* Adding or removing entries from the white list must
5594 * happen before enabling scanning. The controller does
5595 * not allow white list modification while scanning.
5596 */
5597 filter_policy = update_white_list(req);
5598
8ef30fd3
AG		 5599 memset(&param_cp, 0, sizeof(param_cp));
5600 param_cp.type = LE_SCAN_PASSIVE;
5601 param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
5602 param_cp.window = cpu_to_le16(hdev->le_scan_window);
5603 param_cp.own_address_type = own_addr_type;
8540f6c0 5604 param_cp.filter_policy = filter_policy;
8ef30fd3
AG		 5605 hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
5606 &param_cp);
5607
5608 memset(&enable_cp, 0, sizeof(enable_cp));
5609 enable_cp.enable = LE_SCAN_ENABLE;
4340a124 5610 enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
8ef30fd3
AG		 5611 hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
5612 &enable_cp);
5613}
5614
a4790dbd
AG		 5615static void update_background_scan_complete(struct hci_dev *hdev, u8 status)
5616{
5617 if (status)
5618 BT_DBG("HCI request failed to update background scanning: "
5619 "status 0x%2.2x", status);
5620}
5621
5622/* This function controls the background scanning based on hdev->pend_le_conns
5623 * list. If there are pending LE connection we start the background scanning,
5624 * otherwise we stop it.
5625 *
5626 * This function requires the caller holds hdev->lock.
5627 */
5628void hci_update_background_scan(struct hci_dev *hdev)
5629{
a4790dbd
AG		 5630 struct hci_request req;
5631 struct hci_conn *conn;
5632 int err;
5633
c20c02d5
MH		 5634 if (!test_bit(HCI_UP, &hdev->flags) ||
5635 test_bit(HCI_INIT, &hdev->flags) ||
5636 test_bit(HCI_SETUP, &hdev->dev_flags) ||
d603b76b 5637 test_bit(HCI_CONFIG, &hdev->dev_flags) ||
b8221770 5638 test_bit(HCI_AUTO_OFF, &hdev->dev_flags) ||
c20c02d5 5639 test_bit(HCI_UNREGISTER, &hdev->dev_flags))
1c1697c0
MH		 5640 return;
5641
a70f4b5f
JH		 5642 /* No point in doing scanning if LE support hasn't been enabled */
5643 if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
5644 return;
5645
ae23ada4
JH		 5646 /* If discovery is active don't interfere with it */
5647 if (hdev->discovery.state != DISCOVERY_STOPPED)
5648 return;
5649
a4790dbd
AG		 5650 hci_req_init(&req, hdev);
5651
d1d588c1 5652 if (list_empty(&hdev->pend_le_conns) &&
66f8455a 5653 list_empty(&hdev->pend_le_reports)) {
0d2bf134
JH		 5654 /* If there is no pending LE connections or devices
5655 * to be scanned for, we should stop the background
5656 * scanning.
a4790dbd
AG		 5657 */
5658
5659 /* If controller is not scanning we are done. */
5660 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
5661 return;
5662
5663 hci_req_add_le_scan_disable(&req);
5664
5665 BT_DBG("%s stopping background scanning", hdev->name);
5666 } else {
a4790dbd
AG		 5667 /* If there is at least one pending LE connection, we should
5668 * keep the background scan running.
5669 */
5670
a4790dbd
AG		 5671 /* If controller is connecting, we should not start scanning
5672 * since some controllers are not able to scan and connect at
5673 * the same time.
5674 */
5675 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
5676 if (conn)
5677 return;
5678
4340a124
AG		 5679 /* If controller is currently scanning, we stop it to ensure we
5680 * don't miss any advertising (due to duplicates filter).
5681 */
5682 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
5683 hci_req_add_le_scan_disable(&req);
5684
8ef30fd3 5685 hci_req_add_le_passive_scan(&req);
a4790dbd
AG		 5686
5687 BT_DBG("%s starting background scanning", hdev->name);
5688 }
5689
5690 err = hci_req_run(&req, update_background_scan_complete);
5691 if (err)
5692 BT_ERR("Failed to run HCI request: err %d", err);
5693}
432df05e 5694
22f433dc
JH		 5695static bool disconnected_whitelist_entries(struct hci_dev *hdev)
5696{
5697 struct bdaddr_list *b;
5698
5699 list_for_each_entry(b, &hdev->whitelist, list) {
5700 struct hci_conn *conn;
5701
5702 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
5703 if (!conn)
5704 return true;
5705
5706 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
5707 return true;
5708 }
5709
5710 return false;
5711}
5712
432df05e
JH		 5713void hci_update_page_scan(struct hci_dev *hdev, struct hci_request *req)
5714{
5715 u8 scan;
5716
5717 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags))
5718 return;
5719
5720 if (!hdev_is_powered(hdev))
5721 return;
5722
5723 if (mgmt_powering_down(hdev))
5724 return;
5725
5726 if (test_bit(HCI_CONNECTABLE, &hdev->dev_flags) ||
22f433dc 5727 disconnected_whitelist_entries(hdev))
432df05e
JH		 5728 scan = SCAN_PAGE;
5729 else
5730 scan = SCAN_DISABLED;
5731
5732 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE))
5733 return;
5734
5735 if (test_bit(HCI_DISCOVERABLE, &hdev->dev_flags))
5736 scan |= SCAN_INQUIRY;
5737
5738 if (req)
5739 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
5740 else
5741 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
5742}
Linux 6.x block layer and io_uring tree(s)