projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge tag 'vfs-6.7.misc' of gitolite.kernel.org:pub/scm/linux/kernel/git/vfs/vfs
[linux-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
8c520a59 29#include <linux/rfkill.h>
baf27f6e 30#include <linux/debugfs.h>
99780a7b 31#include <linux/crypto.h>
9f30de9e 32#include <linux/kcov.h>
7a0e5b15 33#include <linux/property.h>
9952d90e
APS		 34#include <linux/suspend.h>
35#include <linux/wait.h>
47219839 36#include <asm/unaligned.h>
1da177e4
LT		 37
38#include <net/bluetooth/bluetooth.h>
39#include <net/bluetooth/hci_core.h>
4bc58f51 40#include <net/bluetooth/l2cap.h>
af58925c 41#include <net/bluetooth/mgmt.h>
1da177e4 42
0857dd3b 43#include "hci_request.h"
60c5f5fb 44#include "hci_debugfs.h"
970c4e46 45#include "smp.h"
6d5d2ee6 46#include "leds.h"
145373cb 47#include "msft.h"
f67743f9 48#include "aosp.h"
8961987f 49#include "hci_codec.h"
970c4e46 50
b78752cc 51static void hci_rx_work(struct work_struct *work);
c347b765 52static void hci_cmd_work(struct work_struct *work);
3eff45ea 53static void hci_tx_work(struct work_struct *work);
1da177e4 54
1da177e4
LT		 55/* HCI device list */
56LIST_HEAD(hci_dev_list);
57DEFINE_RWLOCK(hci_dev_list_lock);
58
59/* HCI callback list */
60LIST_HEAD(hci_cb_list);
fba7ecf0 61DEFINE_MUTEX(hci_cb_list_lock);
1da177e4 62
3df92b31
SL		 63/* HCI ID Numbering */
64static DEFINE_IDA(hci_index_ida);
65
a1d01db1 66static int hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 67{
68 __u8 scan = opt;
69
42c6b129 70 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 71
72 /* Inquiry and Page scans */
42c6b129 73 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
a1d01db1 74 return 0;
1da177e4
LT		 75}
76
a1d01db1 77static int hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 78{
79 __u8 auth = opt;
80
42c6b129 81 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 82
83 /* Authentication */
42c6b129 84 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
a1d01db1 85 return 0;
1da177e4
LT		 86}
87
a1d01db1 88static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 89{
90 __u8 encrypt = opt;
91
42c6b129 92 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 93
e4e8e37c 94 /* Encryption */
42c6b129 95 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
a1d01db1 96 return 0;
1da177e4
LT		 97}
98
a1d01db1 99static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 100{
101 __le16 policy = cpu_to_le16(opt);
102
42c6b129 103 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 104
105 /* Default link policy */
42c6b129 106 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
a1d01db1 107 return 0;
e4e8e37c
MH		 108}
109
8e87d142 110/* Get HCI device by index.
1da177e4
LT		 111 * Device is held on return. */
112struct hci_dev *hci_dev_get(int index)
113{
8035ded4 114 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 115
116 BT_DBG("%d", index);
117
118 if (index < 0)
119 return NULL;
120
121 read_lock(&hci_dev_list_lock);
8035ded4 122 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 123 if (d->id == index) {
124 hdev = hci_dev_hold(d);
125 break;
126 }
127 }
128 read_unlock(&hci_dev_list_lock);
129 return hdev;
130}
1da177e4
LT		 131
132/* ---- Inquiry support ---- */
ff9ef578 133
30dc78e1
JH		 134bool hci_discovery_active(struct hci_dev *hdev)
135{
136 struct discovery_state *discov = &hdev->discovery;
137
6fbe195d 138 switch (discov->state) {
343f935b 139 case DISCOVERY_FINDING:
6fbe195d 140 case DISCOVERY_RESOLVING:
30dc78e1
JH		 141 return true;
142
6fbe195d
AG		 143 default:
144 return false;
145 }
30dc78e1
JH		 146}
147
ff9ef578
JH		 148void hci_discovery_set_state(struct hci_dev *hdev, int state)
149{
bb3e0a33
JH		 150 int old_state = hdev->discovery.state;
151
ff9ef578
JH		 152 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
153
bb3e0a33 154 if (old_state == state)
ff9ef578
JH		 155 return;
156
bb3e0a33
JH		 157 hdev->discovery.state = state;
158
ff9ef578
JH		 159 switch (state) {
160 case DISCOVERY_STOPPED:
5bee2fd6 161 hci_update_passive_scan(hdev);
c54c3860 162
bb3e0a33 163 if (old_state != DISCOVERY_STARTING)
7b99b659 164 mgmt_discovering(hdev, 0);
ff9ef578
JH		 165 break;
166 case DISCOVERY_STARTING:
167 break;
343f935b 168 case DISCOVERY_FINDING:
ff9ef578
JH		 169 mgmt_discovering(hdev, 1);
170 break;
30dc78e1
JH		 171 case DISCOVERY_RESOLVING:
172 break;
ff9ef578
JH		 173 case DISCOVERY_STOPPING:
174 break;
175 }
ff9ef578
JH		 176}
177
1f9b9a5d 178void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 179{
30883512 180 struct discovery_state *cache = &hdev->discovery;
b57c1a56 181 struct inquiry_entry *p, *n;
1da177e4 182
561aafbc
JH		 183 list_for_each_entry_safe(p, n, &cache->all, all) {
184 list_del(&p->all);
b57c1a56 185 kfree(p);
1da177e4 186 }
561aafbc
JH		 187
188 INIT_LIST_HEAD(&cache->unknown);
189 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 190}
191
a8c5fb1a
GP		 192struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
193 bdaddr_t *bdaddr)
1da177e4 194{
30883512 195 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 196 struct inquiry_entry *e;
197
6ed93dc6 198 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 199
561aafbc
JH		 200 list_for_each_entry(e, &cache->all, all) {
201 if (!bacmp(&e->data.bdaddr, bdaddr))
202 return e;
203 }
204
205 return NULL;
206}
207
208struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 209 bdaddr_t *bdaddr)
561aafbc 210{
30883512 211 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 212 struct inquiry_entry *e;
213
6ed93dc6 214 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 215
216 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 217 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 218 return e;
219 }
220
221 return NULL;
1da177e4
LT		 222}
223
30dc78e1 224struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 225 bdaddr_t *bdaddr,
226 int state)
30dc78e1
JH		 227{
228 struct discovery_state *cache = &hdev->discovery;
229 struct inquiry_entry *e;
230
6ed93dc6 231 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 232
233 list_for_each_entry(e, &cache->resolve, list) {
234 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
235 return e;
236 if (!bacmp(&e->data.bdaddr, bdaddr))
237 return e;
238 }
239
240 return NULL;
241}
242
a3d4e20a 243void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 244 struct inquiry_entry *ie)
a3d4e20a
JH		 245{
246 struct discovery_state *cache = &hdev->discovery;
247 struct list_head *pos = &cache->resolve;
248 struct inquiry_entry *p;
249
250 list_del(&ie->list);
251
252 list_for_each_entry(p, &cache->resolve, list) {
253 if (p->name_state != NAME_PENDING &&
a8c5fb1a 254 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 255 break;
256 pos = &p->list;
257 }
258
259 list_add(&ie->list, pos);
260}
261
af58925c
MH		 262u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
263 bool name_known)
1da177e4 264{
30883512 265 struct discovery_state *cache = &hdev->discovery;
70f23020 266 struct inquiry_entry *ie;
af58925c 267 u32 flags = 0;
1da177e4 268
6ed93dc6 269 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 270
6928a924 271 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
2b2fec4d 272
af58925c
MH		 273 if (!data->ssp_mode)
274 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 275
70f23020 276 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 277 if (ie) {
af58925c
MH		 278 if (!ie->data.ssp_mode)
279 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 280
a3d4e20a 281 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 282 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 283 ie->data.rssi = data->rssi;
284 hci_inquiry_cache_update_resolve(hdev, ie);
285 }
286
561aafbc 287 goto update;
a3d4e20a 288 }
561aafbc
JH		 289
290 /* Entry not in the cache. Add new one. */
27f70f3e 291 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
af58925c
MH		 292 if (!ie) {
293 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
294 goto done;
295 }
561aafbc
JH		 296
297 list_add(&ie->all, &cache->all);
298
299 if (name_known) {
300 ie->name_state = NAME_KNOWN;
301 } else {
302 ie->name_state = NAME_NOT_KNOWN;
303 list_add(&ie->list, &cache->unknown);
304 }
70f23020 305
561aafbc
JH		 306update:
307 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 308 ie->name_state != NAME_PENDING) {
561aafbc
JH		 309 ie->name_state = NAME_KNOWN;
310 list_del(&ie->list);
1da177e4
LT		 311 }
312
70f23020
AE		 313 memcpy(&ie->data, data, sizeof(*data));
314 ie->timestamp = jiffies;
1da177e4 315 cache->timestamp = jiffies;
3175405b
JH		 316
317 if (ie->name_state == NAME_NOT_KNOWN)
af58925c 318 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
3175405b 319
af58925c
MH		 320done:
321 return flags;
1da177e4
LT		 322}
323
324static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
325{
30883512 326 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 327 struct inquiry_info *info = (struct inquiry_info *) buf;
328 struct inquiry_entry *e;
329 int copied = 0;
330
561aafbc 331 list_for_each_entry(e, &cache->all, all) {
1da177e4 332 struct inquiry_data *data = &e->data;
b57c1a56
JH		 333
334 if (copied >= num)
335 break;
336
1da177e4
LT		 337 bacpy(&info->bdaddr, &data->bdaddr);
338 info->pscan_rep_mode = data->pscan_rep_mode;
339 info->pscan_period_mode = data->pscan_period_mode;
340 info->pscan_mode = data->pscan_mode;
341 memcpy(info->dev_class, data->dev_class, 3);
342 info->clock_offset = data->clock_offset;
b57c1a56 343
1da177e4 344 info++;
b57c1a56 345 copied++;
1da177e4
LT		 346 }
347
348 BT_DBG("cache %p, copied %d", cache, copied);
349 return copied;
350}
351
a1d01db1 352static int hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 353{
354 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 355 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 356 struct hci_cp_inquiry cp;
357
358 BT_DBG("%s", hdev->name);
359
360 if (test_bit(HCI_INQUIRY, &hdev->flags))
a1d01db1 361 return 0;
1da177e4
LT		 362
363 /* Start Inquiry */
364 memcpy(&cp.lap, &ir->lap, 3);
365 cp.length = ir->length;
366 cp.num_rsp = ir->num_rsp;
42c6b129 367 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
a1d01db1
JH		 368
369 return 0;
1da177e4
LT		 370}
371
372int hci_inquiry(void __user *arg)
373{
374 __u8 __user *ptr = arg;
375 struct hci_inquiry_req ir;
376 struct hci_dev *hdev;
377 int err = 0, do_inquiry = 0, max_rsp;
378 long timeo;
379 __u8 *buf;
380
381 if (copy_from_user(&ir, ptr, sizeof(ir)))
382 return -EFAULT;
383
5a08ecce
AE		 384 hdev = hci_dev_get(ir.dev_id);
385 if (!hdev)
1da177e4
LT		 386 return -ENODEV;
387
d7a5a11d 388 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 389 err = -EBUSY;
390 goto done;
391 }
392
d7a5a11d 393 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 394 err = -EOPNOTSUPP;
395 goto done;
396 }
397
ca8bee5d 398 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 399 err = -EOPNOTSUPP;
400 goto done;
401 }
402
d7a5a11d 403 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 404 err = -EOPNOTSUPP;
405 goto done;
406 }
407
f41a4b2b
PS		 408 /* Restrict maximum inquiry length to 60 seconds */
409 if (ir.length > 60) {
410 err = -EINVAL;
411 goto done;
412 }
413
09fd0de5 414 hci_dev_lock(hdev);
8e87d142 415 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 416 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 417 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 418 do_inquiry = 1;
419 }
09fd0de5 420 hci_dev_unlock(hdev);
1da177e4 421
04837f64 422 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 423
424 if (do_inquiry) {
01178cd4 425 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
4ebeee2d 426 timeo, NULL);
70f23020
AE		 427 if (err < 0)
428 goto done;
3e13fa1e
AG		 429
430 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
431 * cleared). If it is interrupted by a signal, return -EINTR.
432 */
74316201 433 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
28a758c8
PB		 434 TASK_INTERRUPTIBLE)) {
435 err = -EINTR;
436 goto done;
437 }
70f23020 438 }
1da177e4 439
8fc9ced3
GP		 440 /* for unlimited number of responses we will use buffer with
441 * 255 entries
442 */
1da177e4
LT		 443 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
444
445 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
446 * copy it to the user space.
447 */
6da2ec56 448 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
70f23020 449 if (!buf) {
1da177e4
LT		 450 err = -ENOMEM;
451 goto done;
452 }
453
09fd0de5 454 hci_dev_lock(hdev);
1da177e4 455 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 456 hci_dev_unlock(hdev);
1da177e4
LT		 457
458 BT_DBG("num_rsp %d", ir.num_rsp);
459
460 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
461 ptr += sizeof(ir);
462 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 463 ir.num_rsp))
1da177e4 464 err = -EFAULT;
8e87d142 465 } else
1da177e4
LT		 466 err = -EFAULT;
467
468 kfree(buf);
469
470done:
471 hci_dev_put(hdev);
472 return err;
473}
474
cf75ad8b
LAD		 475static int hci_dev_do_open(struct hci_dev *hdev)
476{
477 int ret = 0;
478
479 BT_DBG("%s %p", hdev->name, hdev);
480
481 hci_req_sync_lock(hdev);
482
483 ret = hci_dev_open_sync(hdev);
484
b504430c 485 hci_req_sync_unlock(hdev);
1da177e4
LT		 486 return ret;
487}
488
cbed0ca1
JH		 489/* ---- HCI ioctl helpers ---- */
490
491int hci_dev_open(__u16 dev)
492{
493 struct hci_dev *hdev;
494 int err;
495
496 hdev = hci_dev_get(dev);
497 if (!hdev)
498 return -ENODEV;
499
4a964404 500 /* Devices that are marked as unconfigured can only be powered
fee746b0
MH		 501 * up as user channel. Trying to bring them up as normal devices
502 * will result into a failure. Only user channel operation is
503 * possible.
504 *
505 * When this function is called for a user channel, the flag
506 * HCI_USER_CHANNEL will be set first before attempting to
507 * open the device.
508 */
d7a5a11d
MH		 509 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
510 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
fee746b0
MH		 511 err = -EOPNOTSUPP;
512 goto done;
513 }
514
e1d08f40
JH		 515 /* We need to ensure that no other power on/off work is pending
516 * before proceeding to call hci_dev_do_open. This is
517 * particularly important if the setup procedure has not yet
518 * completed.
519 */
a69d8927 520 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
e1d08f40
JH		 521 cancel_delayed_work(&hdev->power_off);
522
a5c8f270
MH		 523 /* After this call it is guaranteed that the setup procedure
524 * has finished. This means that error conditions like RFKILL
525 * or no valid public or static random address apply.
526 */
e1d08f40
JH		 527 flush_workqueue(hdev->req_workqueue);
528
12aa4f0a 529 /* For controllers not using the management interface and that
b6ae8457 530 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
12aa4f0a
MH		 531 * so that pairing works for them. Once the management interface
532 * is in use this bit will be cleared again and userspace has
533 * to explicitly enable it.
534 */
d7a5a11d
MH		 535 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
536 !hci_dev_test_flag(hdev, HCI_MGMT))
a1536da2 537 hci_dev_set_flag(hdev, HCI_BONDABLE);
12aa4f0a 538
cbed0ca1
JH		 539 err = hci_dev_do_open(hdev);
540
fee746b0 541done:
cbed0ca1 542 hci_dev_put(hdev);
cbed0ca1
JH		 543 return err;
544}
545
cf75ad8b
LAD		 546int hci_dev_do_close(struct hci_dev *hdev)
547{
548 int err;
549
550 BT_DBG("%s %p", hdev->name, hdev);
551
552 hci_req_sync_lock(hdev);
553
554 err = hci_dev_close_sync(hdev);
555
b504430c 556 hci_req_sync_unlock(hdev);
1da177e4 557
61969ef8 558 return err;
1da177e4
LT		 559}
560
561int hci_dev_close(__u16 dev)
562{
563 struct hci_dev *hdev;
564 int err;
565
70f23020
AE		 566 hdev = hci_dev_get(dev);
567 if (!hdev)
1da177e4 568 return -ENODEV;
8ee56540 569
d7a5a11d 570 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 571 err = -EBUSY;
572 goto done;
573 }
574
e36bea6e 575 cancel_work_sync(&hdev->power_on);
a69d8927 576 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
8ee56540
MH		 577 cancel_delayed_work(&hdev->power_off);
578
1da177e4 579 err = hci_dev_do_close(hdev);
8ee56540 580
0736cfa8 581done:
1da177e4
LT		 582 hci_dev_put(hdev);
583 return err;
584}
585
5c912495 586static int hci_dev_do_reset(struct hci_dev *hdev)
1da177e4 587{
5c912495 588 int ret;
1da177e4 589
5c912495 590 BT_DBG("%s %p", hdev->name, hdev);
1da177e4 591
b504430c 592 hci_req_sync_lock(hdev);
1da177e4 593
1da177e4
LT		 594 /* Drop queues */
595 skb_queue_purge(&hdev->rx_q);
596 skb_queue_purge(&hdev->cmd_q);
597
877afada
SS		 598 /* Cancel these to avoid queueing non-chained pending work */
599 hci_dev_set_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
deee93d1
TH		 600 /* Wait for
601 *
602 * if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
603 * queue_delayed_work(&hdev->{cmd,ncmd}_timer)
604 *
605 * inside RCU section to see the flag or complete scheduling.
606 */
607 synchronize_rcu();
608 /* Explicitly cancel works in case scheduled after setting the flag. */
877afada
SS		 609 cancel_delayed_work(&hdev->cmd_timer);
610 cancel_delayed_work(&hdev->ncmd_timer);
611
76727c02
JH		 612 /* Avoid potential lockdep warnings from the *_flush() calls by
613 * ensuring the workqueue is empty up front.
614 */
615 drain_workqueue(hdev->workqueue);
616
09fd0de5 617 hci_dev_lock(hdev);
1f9b9a5d 618 hci_inquiry_cache_flush(hdev);
1da177e4 619 hci_conn_hash_flush(hdev);
09fd0de5 620 hci_dev_unlock(hdev);
1da177e4
LT		 621
622 if (hdev->flush)
623 hdev->flush(hdev);
624
877afada
SS		 625 hci_dev_clear_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
626
8e87d142 627 atomic_set(&hdev->cmd_cnt, 1);
26afbd82
LAD		 628 hdev->acl_cnt = 0;
629 hdev->sco_cnt = 0;
630 hdev->le_cnt = 0;
631 hdev->iso_cnt = 0;
1da177e4 632
d0b13706 633 ret = hci_reset_sync(hdev);
1da177e4 634
b504430c 635 hci_req_sync_unlock(hdev);
1da177e4
LT		 636 return ret;
637}
638
5c912495
MH		 639int hci_dev_reset(__u16 dev)
640{
641 struct hci_dev *hdev;
642 int err;
643
644 hdev = hci_dev_get(dev);
645 if (!hdev)
646 return -ENODEV;
647
648 if (!test_bit(HCI_UP, &hdev->flags)) {
649 err = -ENETDOWN;
650 goto done;
651 }
652
d7a5a11d 653 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
5c912495
MH		 654 err = -EBUSY;
655 goto done;
656 }
657
d7a5a11d 658 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
5c912495
MH		 659 err = -EOPNOTSUPP;
660 goto done;
661 }
662
663 err = hci_dev_do_reset(hdev);
664
665done:
666 hci_dev_put(hdev);
667 return err;
668}
669
1da177e4
LT		 670int hci_dev_reset_stat(__u16 dev)
671{
672 struct hci_dev *hdev;
673 int ret = 0;
674
70f23020
AE		 675 hdev = hci_dev_get(dev);
676 if (!hdev)
1da177e4
LT		 677 return -ENODEV;
678
d7a5a11d 679 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 680 ret = -EBUSY;
681 goto done;
682 }
683
d7a5a11d 684 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 685 ret = -EOPNOTSUPP;
686 goto done;
687 }
688
1da177e4
LT		 689 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
690
0736cfa8 691done:
1da177e4 692 hci_dev_put(hdev);
1da177e4
LT		 693 return ret;
694}
695
5bee2fd6 696static void hci_update_passive_scan_state(struct hci_dev *hdev, u8 scan)
123abc08 697{
bc6d2d04 698 bool conn_changed, discov_changed;
123abc08
JH		 699
700 BT_DBG("%s scan 0x%02x", hdev->name, scan);
701
702 if ((scan & SCAN_PAGE))
238be788
MH		 703 conn_changed = !hci_dev_test_and_set_flag(hdev,
704 HCI_CONNECTABLE);
123abc08 705 else
a69d8927
MH		 706 conn_changed = hci_dev_test_and_clear_flag(hdev,
707 HCI_CONNECTABLE);
123abc08 708
bc6d2d04 709 if ((scan & SCAN_INQUIRY)) {
238be788
MH		 710 discov_changed = !hci_dev_test_and_set_flag(hdev,
711 HCI_DISCOVERABLE);
bc6d2d04 712 } else {
a358dc11 713 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
a69d8927
MH		 714 discov_changed = hci_dev_test_and_clear_flag(hdev,
715 HCI_DISCOVERABLE);
bc6d2d04
JH		 716 }
717
d7a5a11d 718 if (!hci_dev_test_flag(hdev, HCI_MGMT))
123abc08
JH		 719 return;
720
bc6d2d04
JH		 721 if (conn_changed || discov_changed) {
722 /* In case this was disabled through mgmt */
a1536da2 723 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
bc6d2d04 724
d7a5a11d 725 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
651cd3d6 726 hci_update_adv_data(hdev, hdev->cur_adv_instance);
bc6d2d04 727
123abc08 728 mgmt_new_settings(hdev);
bc6d2d04 729 }
123abc08
JH		 730}
731
1da177e4
LT		 732int hci_dev_cmd(unsigned int cmd, void __user *arg)
733{
734 struct hci_dev *hdev;
735 struct hci_dev_req dr;
736 int err = 0;
737
738 if (copy_from_user(&dr, arg, sizeof(dr)))
739 return -EFAULT;
740
70f23020
AE		 741 hdev = hci_dev_get(dr.dev_id);
742 if (!hdev)
1da177e4
LT		 743 return -ENODEV;
744
d7a5a11d 745 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 746 err = -EBUSY;
747 goto done;
748 }
749
d7a5a11d 750 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 751 err = -EOPNOTSUPP;
752 goto done;
753 }
754
ca8bee5d 755 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 756 err = -EOPNOTSUPP;
757 goto done;
758 }
759
d7a5a11d 760 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 761 err = -EOPNOTSUPP;
762 goto done;
763 }
764
1da177e4
LT		 765 switch (cmd) {
766 case HCISETAUTH:
01178cd4 767 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 768 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 769 break;
770
771 case HCISETENCRYPT:
772 if (!lmp_encrypt_capable(hdev)) {
773 err = -EOPNOTSUPP;
774 break;
775 }
776
777 if (!test_bit(HCI_AUTH, &hdev->flags)) {
778 /* Auth must be enabled first */
01178cd4 779 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 780 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 781 if (err)
782 break;
783 }
784
01178cd4 785 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
4ebeee2d 786 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 787 break;
788
789 case HCISETSCAN:
01178cd4 790 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
4ebeee2d 791 HCI_INIT_TIMEOUT, NULL);
91a668b0 792
bc6d2d04
JH		 793 /* Ensure that the connectable and discoverable states
794 * get correctly modified as this was a non-mgmt change.
91a668b0 795 */
123abc08 796 if (!err)
5bee2fd6 797 hci_update_passive_scan_state(hdev, dr.dev_opt);
1da177e4
LT		 798 break;
799
1da177e4 800 case HCISETLINKPOL:
01178cd4 801 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
4ebeee2d 802 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 803 break;
804
805 case HCISETLINKMODE:
e4e8e37c
MH		 806 hdev->link_mode = ((__u16) dr.dev_opt) &
807 (HCI_LM_MASTER | HCI_LM_ACCEPT);
808 break;
809
810 case HCISETPTYPE:
b7c23df8
JK		 811 if (hdev->pkt_type == (__u16) dr.dev_opt)
812 break;
813
e4e8e37c 814 hdev->pkt_type = (__u16) dr.dev_opt;
b7c23df8 815 mgmt_phy_configuration_changed(hdev, NULL);
1da177e4
LT		 816 break;
817
818 case HCISETACLMTU:
e4e8e37c
MH		 819 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
820 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 821 break;
822
823 case HCISETSCOMTU:
e4e8e37c
MH		 824 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
825 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 826 break;
827
828 default:
829 err = -EINVAL;
830 break;
831 }
e4e8e37c 832
0736cfa8 833done:
1da177e4
LT		 834 hci_dev_put(hdev);
835 return err;
836}
837
838int hci_get_dev_list(void __user *arg)
839{
8035ded4 840 struct hci_dev *hdev;
1da177e4
LT		 841 struct hci_dev_list_req *dl;
842 struct hci_dev_req *dr;
1da177e4
LT		 843 int n = 0, size, err;
844 __u16 dev_num;
845
846 if (get_user(dev_num, (__u16 __user *) arg))
847 return -EFAULT;
848
849 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
850 return -EINVAL;
851
852 size = sizeof(*dl) + dev_num * sizeof(*dr);
853
70f23020
AE		 854 dl = kzalloc(size, GFP_KERNEL);
855 if (!dl)
1da177e4
LT		 856 return -ENOMEM;
857
858 dr = dl->dev_req;
859
f20d09d5 860 read_lock(&hci_dev_list_lock);
8035ded4 861 list_for_each_entry(hdev, &hci_dev_list, list) {
2e84d8db 862 unsigned long flags = hdev->flags;
c542a06c 863
2e84d8db
MH		 864 /* When the auto-off is configured it means the transport
865 * is running, but in that case still indicate that the
866 * device is actually down.
867 */
d7a5a11d 868 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db 869 flags &= ~BIT(HCI_UP);
c542a06c 870
1da177e4 871 (dr + n)->dev_id = hdev->id;
2e84d8db 872 (dr + n)->dev_opt = flags;
c542a06c 873
1da177e4
LT		 874 if (++n >= dev_num)
875 break;
876 }
f20d09d5 877 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 878
879 dl->dev_num = n;
880 size = sizeof(*dl) + n * sizeof(*dr);
881
882 err = copy_to_user(arg, dl, size);
883 kfree(dl);
884
885 return err ? -EFAULT : 0;
886}
887
888int hci_get_dev_info(void __user *arg)
889{
890 struct hci_dev *hdev;
891 struct hci_dev_info di;
2e84d8db 892 unsigned long flags;
1da177e4
LT		 893 int err = 0;
894
895 if (copy_from_user(&di, arg, sizeof(di)))
896 return -EFAULT;
897
70f23020
AE		 898 hdev = hci_dev_get(di.dev_id);
899 if (!hdev)
1da177e4
LT		 900 return -ENODEV;
901
2e84d8db
MH		 902 /* When the auto-off is configured it means the transport
903 * is running, but in that case still indicate that the
904 * device is actually down.
905 */
d7a5a11d 906 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db
MH		 907 flags = hdev->flags & ~BIT(HCI_UP);
908 else
909 flags = hdev->flags;
c542a06c 910
1da177e4
LT		 911 strcpy(di.name, hdev->name);
912 di.bdaddr = hdev->bdaddr;
60f2a3ed 913 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2e84d8db 914 di.flags = flags;
1da177e4 915 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 916 if (lmp_bredr_capable(hdev)) {
917 di.acl_mtu = hdev->acl_mtu;
918 di.acl_pkts = hdev->acl_pkts;
919 di.sco_mtu = hdev->sco_mtu;
920 di.sco_pkts = hdev->sco_pkts;
921 } else {
922 di.acl_mtu = hdev->le_mtu;
923 di.acl_pkts = hdev->le_pkts;
924 di.sco_mtu = 0;
925 di.sco_pkts = 0;
926 }
1da177e4
LT		 927 di.link_policy = hdev->link_policy;
928 di.link_mode = hdev->link_mode;
929
930 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
931 memcpy(&di.features, &hdev->features, sizeof(di.features));
932
933 if (copy_to_user(arg, &di, sizeof(di)))
934 err = -EFAULT;
935
936 hci_dev_put(hdev);
937
938 return err;
939}
940
941/* ---- Interface to HCI drivers ---- */
942
611b30f7
MH		 943static int hci_rfkill_set_block(void *data, bool blocked)
944{
945 struct hci_dev *hdev = data;
946
947 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
948
d7a5a11d 949 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
0736cfa8
MH		 950 return -EBUSY;
951
5e130367 952 if (blocked) {
a1536da2 953 hci_dev_set_flag(hdev, HCI_RFKILLED);
d7a5a11d
MH		 954 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
955 !hci_dev_test_flag(hdev, HCI_CONFIG))
bf543036 956 hci_dev_do_close(hdev);
5e130367 957 } else {
a358dc11 958 hci_dev_clear_flag(hdev, HCI_RFKILLED);
1025c04c 959 }
611b30f7
MH		 960
961 return 0;
962}
963
964static const struct rfkill_ops hci_rfkill_ops = {
965 .set_block = hci_rfkill_set_block,
966};
967
ab81cbf9
JH		 968static void hci_power_on(struct work_struct *work)
969{
970 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 971 int err;
ab81cbf9
JH		 972
973 BT_DBG("%s", hdev->name);
974
2ff13894
JH		 975 if (test_bit(HCI_UP, &hdev->flags) &&
976 hci_dev_test_flag(hdev, HCI_MGMT) &&
977 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
d82142a8 978 cancel_delayed_work(&hdev->power_off);
cf75ad8b 979 err = hci_powered_update_sync(hdev);
2ff13894
JH		 980 mgmt_power_on(hdev, err);
981 return;
982 }
983
cbed0ca1 984 err = hci_dev_do_open(hdev);
96570ffc 985 if (err < 0) {
3ad67582 986 hci_dev_lock(hdev);
96570ffc 987 mgmt_set_powered_failed(hdev, err);
3ad67582 988 hci_dev_unlock(hdev);
ab81cbf9 989 return;
96570ffc 990 }
ab81cbf9 991
a5c8f270
MH		 992 /* During the HCI setup phase, a few error conditions are
993 * ignored and they need to be checked now. If they are still
994 * valid, it is important to turn the device back off.
995 */
d7a5a11d
MH		 996 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
997 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
ca8bee5d 998 (hdev->dev_type == HCI_PRIMARY &&
a5c8f270
MH		 999 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1000 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
a358dc11 1001 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
bf543036 1002 hci_dev_do_close(hdev);
d7a5a11d 1003 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
19202573
JH		 1004 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1005 HCI_AUTO_OFF_TIMEOUT);
bf543036 1006 }
ab81cbf9 1007
a69d8927 1008 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
4a964404
MH		 1009 /* For unconfigured devices, set the HCI_RAW flag
1010 * so that userspace can easily identify them.
4a964404 1011 */
d7a5a11d 1012 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4a964404 1013 set_bit(HCI_RAW, &hdev->flags);
0602a8ad
MH		 1014
1015 /* For fully configured devices, this will send
1016 * the Index Added event. For unconfigured devices,
1017 * it will send Unconfigued Index Added event.
1018 *
1019 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
1020 * and no event will be send.
1021 */
1022 mgmt_index_added(hdev);
a69d8927 1023 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
5ea234d3
MH		 1024 /* When the controller is now configured, then it
1025 * is important to clear the HCI_RAW flag.
1026 */
d7a5a11d 1027 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5ea234d3
MH		 1028 clear_bit(HCI_RAW, &hdev->flags);
1029
d603b76b
MH		 1030 /* Powering on the controller with HCI_CONFIG set only
1031 * happens with the transition from unconfigured to
1032 * configured. This will send the Index Added event.
1033 */
744cf19e 1034 mgmt_index_added(hdev);
fee746b0 1035 }
ab81cbf9
JH		 1036}
1037
1038static void hci_power_off(struct work_struct *work)
1039{
3243553f 1040 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 1041 power_off.work);
ab81cbf9
JH		 1042
1043 BT_DBG("%s", hdev->name);
1044
8ee56540 1045 hci_dev_do_close(hdev);
ab81cbf9
JH		 1046}
1047
c7741d16
MH		 1048static void hci_error_reset(struct work_struct *work)
1049{
1050 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
1051
1052 BT_DBG("%s", hdev->name);
1053
1054 if (hdev->hw_error)
1055 hdev->hw_error(hdev, hdev->hw_error_code);
1056 else
2064ee33 1057 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
c7741d16
MH		 1058
1059 if (hci_dev_do_close(hdev))
1060 return;
1061
c7741d16
MH		 1062 hci_dev_do_open(hdev);
1063}
1064
35f7498a 1065void hci_uuids_clear(struct hci_dev *hdev)
2aeb9a1a 1066{
4821002c 1067 struct bt_uuid *uuid, *tmp;
2aeb9a1a 1068
4821002c
JH		 1069 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1070 list_del(&uuid->list);
2aeb9a1a
JH		 1071 kfree(uuid);
1072 }
2aeb9a1a
JH		 1073}
1074
35f7498a 1075void hci_link_keys_clear(struct hci_dev *hdev)
55ed8ca1 1076{
3673952c 1077 struct link_key *key, *tmp;
55ed8ca1 1078
3673952c 1079 list_for_each_entry_safe(key, tmp, &hdev->link_keys, list) {
0378b597
JH		 1080 list_del_rcu(&key->list);
1081 kfree_rcu(key, rcu);
55ed8ca1 1082 }
55ed8ca1
JH		 1083}
1084
35f7498a 1085void hci_smp_ltks_clear(struct hci_dev *hdev)
b899efaf 1086{
3673952c 1087 struct smp_ltk *k, *tmp;
b899efaf 1088
3673952c 1089 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
970d0f1b
JH		 1090 list_del_rcu(&k->list);
1091 kfree_rcu(k, rcu);
b899efaf 1092 }
b899efaf
VCG		 1093}
1094
970c4e46
JH		 1095void hci_smp_irks_clear(struct hci_dev *hdev)
1096{
3673952c 1097 struct smp_irk *k, *tmp;
970c4e46 1098
3673952c 1099 list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
adae20cb
JH		 1100 list_del_rcu(&k->list);
1101 kfree_rcu(k, rcu);
970c4e46
JH		 1102 }
1103}
1104
600a8749
AM		 1105void hci_blocked_keys_clear(struct hci_dev *hdev)
1106{
3673952c 1107 struct blocked_key *b, *tmp;
600a8749 1108
3673952c 1109 list_for_each_entry_safe(b, tmp, &hdev->blocked_keys, list) {
600a8749
AM		 1110 list_del_rcu(&b->list);
1111 kfree_rcu(b, rcu);
1112 }
1113}
1114
1115bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
1116{
1117 bool blocked = false;
1118 struct blocked_key *b;
1119
1120 rcu_read_lock();
0c2ac7d4 1121 list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
600a8749
AM		 1122 if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
1123 blocked = true;
1124 break;
1125 }
1126 }
1127
1128 rcu_read_unlock();
1129 return blocked;
1130}
1131
55ed8ca1
JH		 1132struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1133{
8035ded4 1134 struct link_key *k;
55ed8ca1 1135
0378b597
JH		 1136 rcu_read_lock();
1137 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
1138 if (bacmp(bdaddr, &k->bdaddr) == 0) {
1139 rcu_read_unlock();
600a8749
AM		 1140
1141 if (hci_is_blocked_key(hdev,
1142 HCI_BLOCKED_KEY_TYPE_LINKKEY,
1143 k->val)) {
1144 bt_dev_warn_ratelimited(hdev,
1145 "Link key blocked for %pMR",
1146 &k->bdaddr);
1147 return NULL;
1148 }
1149
55ed8ca1 1150 return k;
0378b597
JH		 1151 }
1152 }
1153 rcu_read_unlock();
55ed8ca1
JH		 1154
1155 return NULL;
1156}
1157
745c0ce3 1158static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 1159 u8 key_type, u8 old_key_type)
d25e28ab
JH		 1160{
1161 /* Legacy key */
1162 if (key_type < 0x03)
745c0ce3 1163 return true;
d25e28ab
JH		 1164
1165 /* Debug keys are insecure so don't store them persistently */
1166 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 1167 return false;
d25e28ab
JH		 1168
1169 /* Changed combination key and there's no previous one */
1170 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 1171 return false;
d25e28ab
JH		 1172
1173 /* Security mode 3 case */
1174 if (!conn)
745c0ce3 1175 return true;
d25e28ab 1176
e3befab9
JH		 1177 /* BR/EDR key derived using SC from an LE link */
1178 if (conn->type == LE_LINK)
1179 return true;
1180
d25e28ab
JH		 1181 /* Neither local nor remote side had no-bonding as requirement */
1182 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 1183 return true;
d25e28ab
JH		 1184
1185 /* Local side had dedicated bonding as requirement */
1186 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 1187 return true;
d25e28ab
JH		 1188
1189 /* Remote side had dedicated bonding as requirement */
1190 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 1191 return true;
d25e28ab
JH		 1192
1193 /* If none of the above criteria match, then don't store the key
1194 * persistently */
745c0ce3 1195 return false;
d25e28ab
JH		 1196}
1197
e804d25d 1198static u8 ltk_role(u8 type)
98a0b845 1199{
e804d25d
JH		 1200 if (type == SMP_LTK)
1201 return HCI_ROLE_MASTER;
98a0b845 1202
e804d25d 1203 return HCI_ROLE_SLAVE;
98a0b845
JH		 1204}
1205
f3a73d97
JH		 1206struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1207 u8 addr_type, u8 role)
75d262c2 1208{
c9839a11 1209 struct smp_ltk *k;
75d262c2 1210
970d0f1b
JH		 1211 rcu_read_lock();
1212 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
5378bc56
JH		 1213 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
1214 continue;
1215
923e2414 1216 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
970d0f1b 1217 rcu_read_unlock();
600a8749
AM		 1218
1219 if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
1220 k->val)) {
1221 bt_dev_warn_ratelimited(hdev,
1222 "LTK blocked for %pMR",
1223 &k->bdaddr);
1224 return NULL;
1225 }
1226
75d262c2 1227 return k;
970d0f1b
JH		 1228 }
1229 }
1230 rcu_read_unlock();
75d262c2
VCG		 1231
1232 return NULL;
1233}
75d262c2 1234
970c4e46
JH		 1235struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
1236{
600a8749 1237 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 1238 struct smp_irk *irk;
1239
adae20cb
JH		 1240 rcu_read_lock();
1241 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
1242 if (!bacmp(&irk->rpa, rpa)) {
600a8749
AM		 1243 irk_to_return = irk;
1244 goto done;
adae20cb 1245 }
970c4e46
JH		 1246 }
1247
adae20cb 1248 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
defce9e8 1249 if (smp_irk_matches(hdev, irk->val, rpa)) {
970c4e46 1250 bacpy(&irk->rpa, rpa);
600a8749
AM		 1251 irk_to_return = irk;
1252 goto done;
970c4e46
JH		 1253 }
1254 }
600a8749
AM		 1255
1256done:
1257 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1258 irk_to_return->val)) {
1259 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1260 &irk_to_return->bdaddr);
1261 irk_to_return = NULL;
1262 }
1263
adae20cb 1264 rcu_read_unlock();
970c4e46 1265
600a8749 1266 return irk_to_return;
970c4e46
JH		 1267}
1268
1269struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1270 u8 addr_type)
1271{
600a8749 1272 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 1273 struct smp_irk *irk;
1274
6cfc9988
JH		 1275 /* Identity Address must be public or static random */
1276 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
1277 return NULL;
1278
adae20cb
JH		 1279 rcu_read_lock();
1280 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
970c4e46 1281 if (addr_type == irk->addr_type &&
adae20cb 1282 bacmp(bdaddr, &irk->bdaddr) == 0) {
600a8749
AM		 1283 irk_to_return = irk;
1284 goto done;
adae20cb 1285 }
970c4e46 1286 }
600a8749
AM		 1287
1288done:
1289
1290 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1291 irk_to_return->val)) {
1292 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1293 &irk_to_return->bdaddr);
1294 irk_to_return = NULL;
1295 }
1296
adae20cb 1297 rcu_read_unlock();
970c4e46 1298
600a8749 1299 return irk_to_return;
970c4e46
JH		 1300}
1301
567fa2aa 1302struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
7652ff6a
JH		 1303 bdaddr_t *bdaddr, u8 *val, u8 type,
1304 u8 pin_len, bool *persistent)
55ed8ca1
JH		 1305{
1306 struct link_key *key, *old_key;
745c0ce3 1307 u8 old_key_type;
55ed8ca1
JH		 1308
1309 old_key = hci_find_link_key(hdev, bdaddr);
1310 if (old_key) {
1311 old_key_type = old_key->type;
1312 key = old_key;
1313 } else {
12adcf3a 1314 old_key_type = conn ? conn->key_type : 0xff;
0a14ab41 1315 key = kzalloc(sizeof(*key), GFP_KERNEL);
55ed8ca1 1316 if (!key)
567fa2aa 1317 return NULL;
0378b597 1318 list_add_rcu(&key->list, &hdev->link_keys);
55ed8ca1
JH		 1319 }
1320
6ed93dc6 1321 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 1322
d25e28ab
JH		 1323 /* Some buggy controller combinations generate a changed
1324 * combination key for legacy pairing even when there's no
1325 * previous key */
1326 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 1327 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 1328 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1329 if (conn)
1330 conn->key_type = type;
1331 }
d25e28ab 1332
55ed8ca1 1333 bacpy(&key->bdaddr, bdaddr);
9b3b4460 1334 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 1335 key->pin_len = pin_len;
1336
b6020ba0 1337 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1338 key->type = old_key_type;
4748fed2
JH		 1339 else
1340 key->type = type;
1341
7652ff6a
JH		 1342 if (persistent)
1343 *persistent = hci_persistent_key(hdev, conn, type,
1344 old_key_type);
4df378a1 1345
567fa2aa 1346 return key;
55ed8ca1
JH		 1347}
1348
ca9142b8 1349struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
35d70271 1350 u8 addr_type, u8 type, u8 authenticated,
fe39c7b2 1351 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
75d262c2 1352{
c9839a11 1353 struct smp_ltk *key, *old_key;
e804d25d 1354 u8 role = ltk_role(type);
75d262c2 1355
f3a73d97 1356 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
c9839a11 1357 if (old_key)
75d262c2 1358 key = old_key;
c9839a11 1359 else {
0a14ab41 1360 key = kzalloc(sizeof(*key), GFP_KERNEL);
75d262c2 1361 if (!key)
ca9142b8 1362 return NULL;
970d0f1b 1363 list_add_rcu(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 1364 }
1365
75d262c2 1366 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 1367 key->bdaddr_type = addr_type;
1368 memcpy(key->val, tk, sizeof(key->val));
1369 key->authenticated = authenticated;
1370 key->ediv = ediv;
fe39c7b2 1371 key->rand = rand;
c9839a11
VCG		 1372 key->enc_size = enc_size;
1373 key->type = type;
75d262c2 1374
ca9142b8 1375 return key;
75d262c2
VCG		 1376}
1377
ca9142b8
JH		 1378struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1379 u8 addr_type, u8 val[16], bdaddr_t *rpa)
970c4e46
JH		 1380{
1381 struct smp_irk *irk;
1382
1383 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
1384 if (!irk) {
1385 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
1386 if (!irk)
ca9142b8 1387 return NULL;
970c4e46
JH		 1388
1389 bacpy(&irk->bdaddr, bdaddr);
1390 irk->addr_type = addr_type;
1391
adae20cb 1392 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
970c4e46
JH		 1393 }
1394
1395 memcpy(irk->val, val, 16);
1396 bacpy(&irk->rpa, rpa);
1397
ca9142b8 1398 return irk;
970c4e46
JH		 1399}
1400
55ed8ca1
JH		 1401int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1402{
1403 struct link_key *key;
1404
1405 key = hci_find_link_key(hdev, bdaddr);
1406 if (!key)
1407 return -ENOENT;
1408
6ed93dc6 1409 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1 1410
0378b597
JH		 1411 list_del_rcu(&key->list);
1412 kfree_rcu(key, rcu);
55ed8ca1
JH		 1413
1414 return 0;
1415}
1416
e0b2b27e 1417int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
b899efaf 1418{
c5d2b6fa 1419 struct smp_ltk *k, *tmp;
c51ffa0b 1420 int removed = 0;
b899efaf 1421
c5d2b6fa 1422 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
e0b2b27e 1423 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
b899efaf
VCG		 1424 continue;
1425
6ed93dc6 1426 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf 1427
970d0f1b
JH		 1428 list_del_rcu(&k->list);
1429 kfree_rcu(k, rcu);
c51ffa0b 1430 removed++;
b899efaf
VCG		 1431 }
1432
c51ffa0b 1433 return removed ? 0 : -ENOENT;
b899efaf
VCG		 1434}
1435
a7ec7338
JH		 1436void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
1437{
c5d2b6fa 1438 struct smp_irk *k, *tmp;
a7ec7338 1439
c5d2b6fa 1440 list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
a7ec7338
JH		 1441 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
1442 continue;
1443
1444 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1445
adae20cb
JH		 1446 list_del_rcu(&k->list);
1447 kfree_rcu(k, rcu);
a7ec7338
JH		 1448 }
1449}
1450
55e76b38
JH		 1451bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1452{
1453 struct smp_ltk *k;
4ba9faf3 1454 struct smp_irk *irk;
55e76b38
JH		 1455 u8 addr_type;
1456
1457 if (type == BDADDR_BREDR) {
1458 if (hci_find_link_key(hdev, bdaddr))
1459 return true;
1460 return false;
1461 }
1462
1463 /* Convert to HCI addr type which struct smp_ltk uses */
1464 if (type == BDADDR_LE_PUBLIC)
1465 addr_type = ADDR_LE_DEV_PUBLIC;
1466 else
1467 addr_type = ADDR_LE_DEV_RANDOM;
1468
4ba9faf3
JH		 1469 irk = hci_get_irk(hdev, bdaddr, addr_type);
1470 if (irk) {
1471 bdaddr = &irk->bdaddr;
1472 addr_type = irk->addr_type;
1473 }
1474
55e76b38
JH		 1475 rcu_read_lock();
1476 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
87c8b28d
JH		 1477 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
1478 rcu_read_unlock();
55e76b38 1479 return true;
87c8b28d 1480 }
55e76b38
JH		 1481 }
1482 rcu_read_unlock();
1483
1484 return false;
1485}
1486
6bd32326 1487/* HCI command timer function */
65cc2b49 1488static void hci_cmd_timeout(struct work_struct *work)
6bd32326 1489{
65cc2b49
MH		 1490 struct hci_dev *hdev = container_of(work, struct hci_dev,
1491 cmd_timer.work);
6bd32326 1492
bda4f23a
AE		 1493 if (hdev->sent_cmd) {
1494 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1495 u16 opcode = __le16_to_cpu(sent->opcode);
1496
2064ee33 1497 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
bda4f23a 1498 } else {
2064ee33 1499 bt_dev_err(hdev, "command tx timeout");
bda4f23a
AE		 1500 }
1501
e2bef384
RJ		 1502 if (hdev->cmd_timeout)
1503 hdev->cmd_timeout(hdev);
1504
6bd32326 1505 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1506 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1507}
1508
de75cd0d
MM		 1509/* HCI ncmd timer function */
1510static void hci_ncmd_timeout(struct work_struct *work)
1511{
1512 struct hci_dev *hdev = container_of(work, struct hci_dev,
1513 ncmd_timer.work);
1514
1515 bt_dev_err(hdev, "Controller not accepting commands anymore: ncmd = 0");
1516
1517 /* During HCI_INIT phase no events can be injected if the ncmd timer
1518 * triggers since the procedure has its own timeout handling.
1519 */
1520 if (test_bit(HCI_INIT, &hdev->flags))
1521 return;
1522
1523 /* This is an irrecoverable state, inject hardware error event */
1524 hci_reset_dev(hdev);
1525}
1526
2763eda6 1527struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
6928a924 1528 bdaddr_t *bdaddr, u8 bdaddr_type)
2763eda6
SJ		 1529{
1530 struct oob_data *data;
1531
6928a924
JH		 1532 list_for_each_entry(data, &hdev->remote_oob_data, list) {
1533 if (bacmp(bdaddr, &data->bdaddr) != 0)
1534 continue;
1535 if (data->bdaddr_type != bdaddr_type)
1536 continue;
1537 return data;
1538 }
2763eda6
SJ		 1539
1540 return NULL;
1541}
1542
6928a924
JH		 1543int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
1544 u8 bdaddr_type)
2763eda6
SJ		 1545{
1546 struct oob_data *data;
1547
6928a924 1548 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6
SJ		 1549 if (!data)
1550 return -ENOENT;
1551
6928a924 1552 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2763eda6
SJ		 1553
1554 list_del(&data->list);
1555 kfree(data);
1556
1557 return 0;
1558}
1559
35f7498a 1560void hci_remote_oob_data_clear(struct hci_dev *hdev)
2763eda6
SJ		 1561{
1562 struct oob_data *data, *n;
1563
1564 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1565 list_del(&data->list);
1566 kfree(data);
1567 }
2763eda6
SJ		 1568}
1569
0798872e 1570int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
6928a924 1571 u8 bdaddr_type, u8 *hash192, u8 *rand192,
81328d5c 1572 u8 *hash256, u8 *rand256)
2763eda6
SJ		 1573{
1574 struct oob_data *data;
1575
6928a924 1576 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6 1577 if (!data) {
0a14ab41 1578 data = kmalloc(sizeof(*data), GFP_KERNEL);
2763eda6
SJ		 1579 if (!data)
1580 return -ENOMEM;
1581
1582 bacpy(&data->bdaddr, bdaddr);
6928a924 1583 data->bdaddr_type = bdaddr_type;
2763eda6
SJ		 1584 list_add(&data->list, &hdev->remote_oob_data);
1585 }
1586
81328d5c
JH		 1587 if (hash192 && rand192) {
1588 memcpy(data->hash192, hash192, sizeof(data->hash192));
1589 memcpy(data->rand192, rand192, sizeof(data->rand192));
f7697b16
MH		 1590 if (hash256 && rand256)
1591 data->present = 0x03;
81328d5c
JH		 1592 } else {
1593 memset(data->hash192, 0, sizeof(data->hash192));
1594 memset(data->rand192, 0, sizeof(data->rand192));
f7697b16
MH		 1595 if (hash256 && rand256)
1596 data->present = 0x02;
1597 else
1598 data->present = 0x00;
0798872e
MH		 1599 }
1600
81328d5c
JH		 1601 if (hash256 && rand256) {
1602 memcpy(data->hash256, hash256, sizeof(data->hash256));
1603 memcpy(data->rand256, rand256, sizeof(data->rand256));
1604 } else {
1605 memset(data->hash256, 0, sizeof(data->hash256));
1606 memset(data->rand256, 0, sizeof(data->rand256));
f7697b16
MH		 1607 if (hash192 && rand192)
1608 data->present = 0x01;
81328d5c 1609 }
0798872e 1610
6ed93dc6 1611 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1612
1613 return 0;
1614}
1615
d2609b34
FG		 1616/* This function requires the caller holds hdev->lock */
1617struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
1618{
1619 struct adv_info *adv_instance;
1620
1621 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
1622 if (adv_instance->instance == instance)
1623 return adv_instance;
1624 }
1625
1626 return NULL;
1627}
1628
1629/* This function requires the caller holds hdev->lock */
74b93e9f
PK		 1630struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
1631{
d2609b34
FG		 1632 struct adv_info *cur_instance;
1633
1634 cur_instance = hci_find_adv_instance(hdev, instance);
1635 if (!cur_instance)
1636 return NULL;
1637
1638 if (cur_instance == list_last_entry(&hdev->adv_instances,
1639 struct adv_info, list))
1640 return list_first_entry(&hdev->adv_instances,
1641 struct adv_info, list);
1642 else
1643 return list_next_entry(cur_instance, list);
1644}
1645
1646/* This function requires the caller holds hdev->lock */
1647int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
1648{
1649 struct adv_info *adv_instance;
1650
1651 adv_instance = hci_find_adv_instance(hdev, instance);
1652 if (!adv_instance)
1653 return -ENOENT;
1654
1655 BT_DBG("%s removing %dMR", hdev->name, instance);
1656
cab054ab
JH		 1657 if (hdev->cur_adv_instance == instance) {
1658 if (hdev->adv_instance_timeout) {
1659 cancel_delayed_work(&hdev->adv_instance_expire);
1660 hdev->adv_instance_timeout = 0;
1661 }
1662 hdev->cur_adv_instance = 0x00;
5d900e46
FG		 1663 }
1664
a73c046a
JK		 1665 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1666
d2609b34
FG		 1667 list_del(&adv_instance->list);
1668 kfree(adv_instance);
1669
1670 hdev->adv_instance_cnt--;
1671
1672 return 0;
1673}
1674
a73c046a
JK		 1675void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
1676{
1677 struct adv_info *adv_instance, *n;
1678
1679 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
1680 adv_instance->rpa_expired = rpa_expired;
1681}
1682
d2609b34
FG		 1683/* This function requires the caller holds hdev->lock */
1684void hci_adv_instances_clear(struct hci_dev *hdev)
1685{
1686 struct adv_info *adv_instance, *n;
1687
5d900e46
FG		 1688 if (hdev->adv_instance_timeout) {
1689 cancel_delayed_work(&hdev->adv_instance_expire);
1690 hdev->adv_instance_timeout = 0;
1691 }
1692
d2609b34 1693 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
a73c046a 1694 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
d2609b34
FG		 1695 list_del(&adv_instance->list);
1696 kfree(adv_instance);
1697 }
1698
1699 hdev->adv_instance_cnt = 0;
cab054ab 1700 hdev->cur_adv_instance = 0x00;
d2609b34
FG		 1701}
1702
a73c046a
JK		 1703static void adv_instance_rpa_expired(struct work_struct *work)
1704{
1705 struct adv_info *adv_instance = container_of(work, struct adv_info,
1706 rpa_expired_cb.work);
1707
1708 BT_DBG("");
1709
1710 adv_instance->rpa_expired = true;
1711}
1712
d2609b34 1713/* This function requires the caller holds hdev->lock */
eca0ae4a
LAD		 1714struct adv_info *hci_add_adv_instance(struct hci_dev *hdev, u8 instance,
1715 u32 flags, u16 adv_data_len, u8 *adv_data,
1716 u16 scan_rsp_len, u8 *scan_rsp_data,
1717 u16 timeout, u16 duration, s8 tx_power,
b338d917
BG		 1718 u32 min_interval, u32 max_interval,
1719 u8 mesh_handle)
d2609b34 1720{
eca0ae4a 1721 struct adv_info *adv;
d2609b34 1722
eca0ae4a
LAD		 1723 adv = hci_find_adv_instance(hdev, instance);
1724 if (adv) {
1725 memset(adv->adv_data, 0, sizeof(adv->adv_data));
1726 memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1727 memset(adv->per_adv_data, 0, sizeof(adv->per_adv_data));
d2609b34 1728 } else {
1d0fac2c 1729 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
b338d917 1730 instance < 1 || instance > hdev->le_num_of_adv_sets + 1)
eca0ae4a 1731 return ERR_PTR(-EOVERFLOW);
d2609b34 1732
eca0ae4a
LAD		 1733 adv = kzalloc(sizeof(*adv), GFP_KERNEL);
1734 if (!adv)
1735 return ERR_PTR(-ENOMEM);
d2609b34 1736
eca0ae4a
LAD		 1737 adv->pending = true;
1738 adv->instance = instance;
1739 list_add(&adv->list, &hdev->adv_instances);
d2609b34
FG		 1740 hdev->adv_instance_cnt++;
1741 }
1742
eca0ae4a
LAD		 1743 adv->flags = flags;
1744 adv->min_interval = min_interval;
1745 adv->max_interval = max_interval;
1746 adv->tx_power = tx_power;
b338d917
BG		 1747 /* Defining a mesh_handle changes the timing units to ms,
1748 * rather than seconds, and ties the instance to the requested
1749 * mesh_tx queue.
1750 */
1751 adv->mesh = mesh_handle;
d2609b34 1752
34a718bc
LAD		 1753 hci_set_adv_instance_data(hdev, instance, adv_data_len, adv_data,
1754 scan_rsp_len, scan_rsp_data);
d2609b34 1755
eca0ae4a
LAD		 1756 adv->timeout = timeout;
1757 adv->remaining_time = timeout;
d2609b34
FG		 1758
1759 if (duration == 0)
eca0ae4a 1760 adv->duration = hdev->def_multi_adv_rotation_duration;
d2609b34 1761 else
eca0ae4a 1762 adv->duration = duration;
d2609b34 1763
eca0ae4a 1764 INIT_DELAYED_WORK(&adv->rpa_expired_cb, adv_instance_rpa_expired);
a73c046a 1765
d2609b34
FG		 1766 BT_DBG("%s for %dMR", hdev->name, instance);
1767
eca0ae4a
LAD		 1768 return adv;
1769}
1770
1771/* This function requires the caller holds hdev->lock */
1772struct adv_info *hci_add_per_instance(struct hci_dev *hdev, u8 instance,
1773 u32 flags, u8 data_len, u8 *data,
1774 u32 min_interval, u32 max_interval)
1775{
1776 struct adv_info *adv;
1777
1778 adv = hci_add_adv_instance(hdev, instance, flags, 0, NULL, 0, NULL,
1779 0, 0, HCI_ADV_TX_POWER_NO_PREFERENCE,
b338d917 1780 min_interval, max_interval, 0);
eca0ae4a
LAD		 1781 if (IS_ERR(adv))
1782 return adv;
1783
1784 adv->periodic = true;
1785 adv->per_adv_data_len = data_len;
1786
1787 if (data)
1788 memcpy(adv->per_adv_data, data, data_len);
1789
1790 return adv;
d2609b34
FG		 1791}
1792
31aab5c2
DW		 1793/* This function requires the caller holds hdev->lock */
1794int hci_set_adv_instance_data(struct hci_dev *hdev, u8 instance,
1795 u16 adv_data_len, u8 *adv_data,
1796 u16 scan_rsp_len, u8 *scan_rsp_data)
1797{
34a718bc 1798 struct adv_info *adv;
31aab5c2 1799
34a718bc 1800 adv = hci_find_adv_instance(hdev, instance);
31aab5c2
DW		 1801
1802 /* If advertisement doesn't exist, we can't modify its data */
34a718bc 1803 if (!adv)
31aab5c2
DW		 1804 return -ENOENT;
1805
34a718bc
LAD		 1806 if (adv_data_len && ADV_DATA_CMP(adv, adv_data, adv_data_len)) {
1807 memset(adv->adv_data, 0, sizeof(adv->adv_data));
1808 memcpy(adv->adv_data, adv_data, adv_data_len);
1809 adv->adv_data_len = adv_data_len;
1810 adv->adv_data_changed = true;
31aab5c2
DW		 1811 }
1812
34a718bc
LAD		 1813 if (scan_rsp_len && SCAN_RSP_CMP(adv, scan_rsp_data, scan_rsp_len)) {
1814 memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1815 memcpy(adv->scan_rsp_data, scan_rsp_data, scan_rsp_len);
1816 adv->scan_rsp_len = scan_rsp_len;
1817 adv->scan_rsp_changed = true;
31aab5c2
DW		 1818 }
1819
34a718bc
LAD		 1820 /* Mark as changed if there are flags which would affect it */
1821 if (((adv->flags & MGMT_ADV_FLAG_APPEARANCE) && hdev->appearance) ||
1822 adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1823 adv->scan_rsp_changed = true;
1824
31aab5c2
DW		 1825 return 0;
1826}
1827
01ce70b0
LAD		 1828/* This function requires the caller holds hdev->lock */
1829u32 hci_adv_instance_flags(struct hci_dev *hdev, u8 instance)
1830{
1831 u32 flags;
1832 struct adv_info *adv;
1833
1834 if (instance == 0x00) {
1835 /* Instance 0 always manages the "Tx Power" and "Flags"
1836 * fields
1837 */
1838 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
1839
1840 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
1841 * corresponds to the "connectable" instance flag.
1842 */
1843 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
1844 flags |= MGMT_ADV_FLAG_CONNECTABLE;
1845
1846 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1847 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
1848 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1849 flags |= MGMT_ADV_FLAG_DISCOV;
1850
1851 return flags;
1852 }
1853
1854 adv = hci_find_adv_instance(hdev, instance);
1855
1856 /* Return 0 when we got an invalid instance identifier. */
1857 if (!adv)
1858 return 0;
1859
1860 return adv->flags;
1861}
1862
1863bool hci_adv_instance_is_scannable(struct hci_dev *hdev, u8 instance)
1864{
1865 struct adv_info *adv;
1866
1867 /* Instance 0x00 always set local name */
1868 if (instance == 0x00)
1869 return true;
1870
1871 adv = hci_find_adv_instance(hdev, instance);
1872 if (!adv)
1873 return false;
1874
1875 if (adv->flags & MGMT_ADV_FLAG_APPEARANCE ||
1876 adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1877 return true;
1878
1879 return adv->scan_rsp_len ? true : false;
1880}
1881
e5e1e7fd
MC		 1882/* This function requires the caller holds hdev->lock */
1883void hci_adv_monitors_clear(struct hci_dev *hdev)
1884{
b139553d
MC		 1885 struct adv_monitor *monitor;
1886 int handle;
1887
1888 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
66bd095a 1889 hci_free_adv_monitor(hdev, monitor);
b139553d 1890
e5e1e7fd
MC		 1891 idr_destroy(&hdev->adv_monitors_idr);
1892}
1893
66bd095a
AP		 1894/* Frees the monitor structure and do some bookkeepings.
1895 * This function requires the caller holds hdev->lock.
1896 */
1897void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
b139553d
MC		 1898{
1899 struct adv_pattern *pattern;
1900 struct adv_pattern *tmp;
1901
1902 if (!monitor)
1903 return;
1904
66bd095a
AP		 1905 list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list) {
1906 list_del(&pattern->list);
b139553d 1907 kfree(pattern);
66bd095a
AP		 1908 }
1909
1910 if (monitor->handle)
1911 idr_remove(&hdev->adv_monitors_idr, monitor->handle);
1912
1913 if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) {
1914 hdev->adv_monitors_cnt--;
1915 mgmt_adv_monitor_removed(hdev, monitor->handle);
1916 }
b139553d
MC		 1917
1918 kfree(monitor);
1919}
1920
a2a4dedf
AP		 1921/* Assigns handle to a monitor, and if offloading is supported and power is on,
1922 * also attempts to forward the request to the controller.
b747a836 1923 * This function requires the caller holds hci_req_sync_lock.
a2a4dedf 1924 */
b747a836 1925int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
b139553d
MC		 1926{
1927 int min, max, handle;
b747a836 1928 int status = 0;
b139553d 1929
b747a836
MM		 1930 if (!monitor)
1931 return -EINVAL;
a2a4dedf 1932
b747a836 1933 hci_dev_lock(hdev);
b139553d
MC		 1934
1935 min = HCI_MIN_ADV_MONITOR_HANDLE;
1936 max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES;
1937 handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max,
1938 GFP_KERNEL);
b747a836
MM		 1939
1940 hci_dev_unlock(hdev);
1941
1942 if (handle < 0)
1943 return handle;
b139553d 1944
b139553d 1945 monitor->handle = handle;
8208f5a9 1946
a2a4dedf 1947 if (!hdev_is_powered(hdev))
b747a836 1948 return status;
8208f5a9 1949
a2a4dedf
AP		 1950 switch (hci_get_adv_monitor_offload_ext(hdev)) {
1951 case HCI_ADV_MONITOR_EXT_NONE:
6f55eea1 1952 bt_dev_dbg(hdev, "add monitor %d status %d",
b747a836 1953 monitor->handle, status);
a2a4dedf 1954 /* Message was not forwarded to controller - not an error */
b747a836
MM		 1955 break;
1956
a2a4dedf 1957 case HCI_ADV_MONITOR_EXT_MSFT:
b747a836 1958 status = msft_add_monitor_pattern(hdev, monitor);
6f55eea1 1959 bt_dev_dbg(hdev, "add monitor %d msft status %d",
a2bcd2b6 1960 handle, status);
a2a4dedf
AP		 1961 break;
1962 }
1963
b747a836 1964 return status;
b139553d
MC		 1965}
1966
66bd095a
AP		 1967/* Attempts to tell the controller and free the monitor. If somehow the
1968 * controller doesn't have a corresponding handle, remove anyway.
7cf5c297 1969 * This function requires the caller holds hci_req_sync_lock.
66bd095a 1970 */
7cf5c297
MM		 1971static int hci_remove_adv_monitor(struct hci_dev *hdev,
1972 struct adv_monitor *monitor)
bd2fbc6c 1973{
7cf5c297 1974 int status = 0;
de6dfcef 1975 int handle;
bd2fbc6c 1976
66bd095a
AP		 1977 switch (hci_get_adv_monitor_offload_ext(hdev)) {
1978 case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */
6f55eea1 1979 bt_dev_dbg(hdev, "remove monitor %d status %d",
7cf5c297 1980 monitor->handle, status);
66bd095a 1981 goto free_monitor;
7cf5c297 1982
66bd095a 1983 case HCI_ADV_MONITOR_EXT_MSFT:
de6dfcef 1984 handle = monitor->handle;
7cf5c297 1985 status = msft_remove_monitor(hdev, monitor);
6f55eea1
DA		 1986 bt_dev_dbg(hdev, "remove monitor %d msft status %d",
1987 handle, status);
66bd095a
AP		 1988 break;
1989 }
bd2fbc6c 1990
66bd095a 1991 /* In case no matching handle registered, just free the monitor */
7cf5c297 1992 if (status == -ENOENT)
66bd095a
AP		 1993 goto free_monitor;
1994
7cf5c297 1995 return status;
66bd095a
AP		 1996
1997free_monitor:
7cf5c297 1998 if (status == -ENOENT)
66bd095a
AP		 1999 bt_dev_warn(hdev, "Removing monitor with no matching handle %d",
2000 monitor->handle);
2001 hci_free_adv_monitor(hdev, monitor);
2002
7cf5c297 2003 return status;
bd2fbc6c
MC		 2004}
2005
7cf5c297
MM		 2006/* This function requires the caller holds hci_req_sync_lock */
2007int hci_remove_single_adv_monitor(struct hci_dev *hdev, u16 handle)
66bd095a
AP		 2008{
2009 struct adv_monitor *monitor = idr_find(&hdev->adv_monitors_idr, handle);
66bd095a 2010
7cf5c297
MM		 2011 if (!monitor)
2012 return -EINVAL;
66bd095a 2013
7cf5c297 2014 return hci_remove_adv_monitor(hdev, monitor);
66bd095a
AP		 2015}
2016
7cf5c297
MM		 2017/* This function requires the caller holds hci_req_sync_lock */
2018int hci_remove_all_adv_monitor(struct hci_dev *hdev)
bd2fbc6c
MC		 2019{
2020 struct adv_monitor *monitor;
66bd095a 2021 int idr_next_id = 0;
7cf5c297 2022 int status = 0;
66bd095a 2023
7cf5c297 2024 while (1) {
66bd095a 2025 monitor = idr_get_next(&hdev->adv_monitors_idr, &idr_next_id);
bd2fbc6c 2026 if (!monitor)
66bd095a 2027 break;
bd2fbc6c 2028
7cf5c297
MM		 2029 status = hci_remove_adv_monitor(hdev, monitor);
2030 if (status)
2031 return status;
66bd095a 2032
7cf5c297 2033 idr_next_id++;
bd2fbc6c
MC		 2034 }
2035
7cf5c297 2036 return status;
bd2fbc6c
MC		 2037}
2038
8208f5a9
MC		 2039/* This function requires the caller holds hdev->lock */
2040bool hci_is_adv_monitoring(struct hci_dev *hdev)
2041{
2042 return !idr_is_empty(&hdev->adv_monitors_idr);
2043}
2044
a2a4dedf
AP		 2045int hci_get_adv_monitor_offload_ext(struct hci_dev *hdev)
2046{
2047 if (msft_monitor_supported(hdev))
2048 return HCI_ADV_MONITOR_EXT_MSFT;
2049
2050 return HCI_ADV_MONITOR_EXT_NONE;
2051}
2052
dcc36c16 2053struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
b9ee0a78 2054 bdaddr_t *bdaddr, u8 type)
b2a66aad 2055{
8035ded4 2056 struct bdaddr_list *b;
b2a66aad 2057
dcc36c16 2058 list_for_each_entry(b, bdaddr_list, list) {
b9ee0a78 2059 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
b2a66aad 2060 return b;
b9ee0a78 2061 }
b2a66aad
AJ		 2062
2063 return NULL;
2064}
2065
b950aa88
AN		 2066struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
2067 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
2068 u8 type)
2069{
2070 struct bdaddr_list_with_irk *b;
2071
2072 list_for_each_entry(b, bdaddr_list, list) {
2073 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2074 return b;
2075 }
2076
2077 return NULL;
2078}
2079
8baaa403
APS		 2080struct bdaddr_list_with_flags *
2081hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list,
2082 bdaddr_t *bdaddr, u8 type)
2083{
2084 struct bdaddr_list_with_flags *b;
2085
2086 list_for_each_entry(b, bdaddr_list, list) {
2087 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2088 return b;
2089 }
2090
2091 return NULL;
2092}
2093
dcc36c16 2094void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
b2a66aad 2095{
7eb7404f 2096 struct bdaddr_list *b, *n;
b2a66aad 2097
7eb7404f
GT		 2098 list_for_each_entry_safe(b, n, bdaddr_list, list) {
2099 list_del(&b->list);
b2a66aad
AJ		 2100 kfree(b);
2101 }
b2a66aad
AJ		 2102}
2103
dcc36c16 2104int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2105{
2106 struct bdaddr_list *entry;
b2a66aad 2107
b9ee0a78 2108 if (!bacmp(bdaddr, BDADDR_ANY))
b2a66aad
AJ		 2109 return -EBADF;
2110
dcc36c16 2111 if (hci_bdaddr_list_lookup(list, bdaddr, type))
5e762444 2112 return -EEXIST;
b2a66aad 2113
27f70f3e 2114 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
5e762444
AJ		 2115 if (!entry)
2116 return -ENOMEM;
b2a66aad
AJ		 2117
2118 bacpy(&entry->bdaddr, bdaddr);
b9ee0a78 2119 entry->bdaddr_type = type;
b2a66aad 2120
dcc36c16 2121 list_add(&entry->list, list);
b2a66aad 2122
2a8357f2 2123 return 0;
b2a66aad
AJ		 2124}
2125
b950aa88
AN		 2126int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2127 u8 type, u8 *peer_irk, u8 *local_irk)
2128{
2129 struct bdaddr_list_with_irk *entry;
2130
2131 if (!bacmp(bdaddr, BDADDR_ANY))
2132 return -EBADF;
2133
2134 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2135 return -EEXIST;
2136
2137 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2138 if (!entry)
2139 return -ENOMEM;
2140
2141 bacpy(&entry->bdaddr, bdaddr);
2142 entry->bdaddr_type = type;
2143
2144 if (peer_irk)
2145 memcpy(entry->peer_irk, peer_irk, 16);
2146
2147 if (local_irk)
2148 memcpy(entry->local_irk, local_irk, 16);
2149
2150 list_add(&entry->list, list);
2151
2152 return 0;
2153}
2154
8baaa403
APS		 2155int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2156 u8 type, u32 flags)
2157{
2158 struct bdaddr_list_with_flags *entry;
2159
2160 if (!bacmp(bdaddr, BDADDR_ANY))
2161 return -EBADF;
2162
2163 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2164 return -EEXIST;
2165
2166 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2167 if (!entry)
2168 return -ENOMEM;
2169
2170 bacpy(&entry->bdaddr, bdaddr);
2171 entry->bdaddr_type = type;
e1cff700 2172 entry->flags = flags;
8baaa403
APS		 2173
2174 list_add(&entry->list, list);
2175
2176 return 0;
2177}
2178
dcc36c16 2179int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2180{
2181 struct bdaddr_list *entry;
b2a66aad 2182
35f7498a 2183 if (!bacmp(bdaddr, BDADDR_ANY)) {
dcc36c16 2184 hci_bdaddr_list_clear(list);
35f7498a
JH		 2185 return 0;
2186 }
b2a66aad 2187
dcc36c16 2188 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
d2ab0ac1
MH		 2189 if (!entry)
2190 return -ENOENT;
2191
2192 list_del(&entry->list);
2193 kfree(entry);
2194
2195 return 0;
2196}
2197
b950aa88
AN		 2198int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2199 u8 type)
2200{
2201 struct bdaddr_list_with_irk *entry;
2202
2203 if (!bacmp(bdaddr, BDADDR_ANY)) {
2204 hci_bdaddr_list_clear(list);
2205 return 0;
2206 }
2207
2208 entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
2209 if (!entry)
2210 return -ENOENT;
2211
2212 list_del(&entry->list);
2213 kfree(entry);
2214
2215 return 0;
2216}
2217
8baaa403
APS		 2218int hci_bdaddr_list_del_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2219 u8 type)
2220{
2221 struct bdaddr_list_with_flags *entry;
2222
2223 if (!bacmp(bdaddr, BDADDR_ANY)) {
2224 hci_bdaddr_list_clear(list);
2225 return 0;
2226 }
2227
2228 entry = hci_bdaddr_list_lookup_with_flags(list, bdaddr, type);
2229 if (!entry)
2230 return -ENOENT;
2231
2232 list_del(&entry->list);
2233 kfree(entry);
2234
2235 return 0;
2236}
2237
15819a70
AG		 2238/* This function requires the caller holds hdev->lock */
2239struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2240 bdaddr_t *addr, u8 addr_type)
2241{
2242 struct hci_conn_params *params;
2243
2244 list_for_each_entry(params, &hdev->le_conn_params, list) {
2245 if (bacmp(&params->addr, addr) == 0 &&
2246 params->addr_type == addr_type) {
2247 return params;
2248 }
2249 }
2250
2251 return NULL;
2252}
2253
195ef75e 2254/* This function requires the caller holds hdev->lock or rcu_read_lock */
501f8827
JH		 2255struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2256 bdaddr_t *addr, u8 addr_type)
a9b0a04c 2257{
912b42ef 2258 struct hci_conn_params *param;
a9b0a04c 2259
195ef75e
PV		 2260 rcu_read_lock();
2261
2262 list_for_each_entry_rcu(param, list, action) {
912b42ef 2263 if (bacmp(&param->addr, addr) == 0 &&
195ef75e
PV		 2264 param->addr_type == addr_type) {
2265 rcu_read_unlock();
912b42ef 2266 return param;
195ef75e 2267 }
4b10966f
MH		 2268 }
2269
195ef75e
PV		 2270 rcu_read_unlock();
2271
4b10966f 2272 return NULL;
a9b0a04c
AG		 2273}
2274
195ef75e
PV		 2275/* This function requires the caller holds hdev->lock */
2276void hci_pend_le_list_del_init(struct hci_conn_params *param)
2277{
2278 if (list_empty(&param->action))
2279 return;
2280
2281 list_del_rcu(&param->action);
2282 synchronize_rcu();
2283 INIT_LIST_HEAD(&param->action);
2284}
2285
2286/* This function requires the caller holds hdev->lock */
2287void hci_pend_le_list_add(struct hci_conn_params *param,
2288 struct list_head *list)
2289{
2290 list_add_rcu(&param->action, list);
2291}
2292
15819a70 2293/* This function requires the caller holds hdev->lock */
51d167c0
MH		 2294struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2295 bdaddr_t *addr, u8 addr_type)
15819a70
AG		 2296{
2297 struct hci_conn_params *params;
2298
2299 params = hci_conn_params_lookup(hdev, addr, addr_type);
cef952ce 2300 if (params)
51d167c0 2301 return params;
15819a70
AG		 2302
2303 params = kzalloc(sizeof(*params), GFP_KERNEL);
2304 if (!params) {
2064ee33 2305 bt_dev_err(hdev, "out of memory");
51d167c0 2306 return NULL;
15819a70
AG		 2307 }
2308
2309 bacpy(&params->addr, addr);
2310 params->addr_type = addr_type;
cef952ce
AG		 2311
2312 list_add(&params->list, &hdev->le_conn_params);
93450c75 2313 INIT_LIST_HEAD(&params->action);
cef952ce 2314
bf5b3c8b
MH		 2315 params->conn_min_interval = hdev->le_conn_min_interval;
2316 params->conn_max_interval = hdev->le_conn_max_interval;
2317 params->conn_latency = hdev->le_conn_latency;
2318 params->supervision_timeout = hdev->le_supv_timeout;
2319 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2320
2321 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2322
51d167c0 2323 return params;
bf5b3c8b
MH		 2324}
2325
195ef75e 2326void hci_conn_params_free(struct hci_conn_params *params)
15819a70 2327{
195ef75e
PV		 2328 hci_pend_le_list_del_init(params);
2329
f8aaf9b6 2330 if (params->conn) {
f161dd41 2331 hci_conn_drop(params->conn);
f8aaf9b6
JH		 2332 hci_conn_put(params->conn);
2333 }
f161dd41 2334
15819a70
AG		 2335 list_del(&params->list);
2336 kfree(params);
f6c63249
JH		 2337}
2338
2339/* This function requires the caller holds hdev->lock */
2340void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2341{
2342 struct hci_conn_params *params;
2343
2344 params = hci_conn_params_lookup(hdev, addr, addr_type);
2345 if (!params)
2346 return;
2347
2348 hci_conn_params_free(params);
15819a70 2349
5bee2fd6 2350 hci_update_passive_scan(hdev);
95305baa 2351
15819a70
AG		 2352 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2353}
2354
2355/* This function requires the caller holds hdev->lock */
55af49a8 2356void hci_conn_params_clear_disabled(struct hci_dev *hdev)
15819a70
AG		 2357{
2358 struct hci_conn_params *params, *tmp;
2359
2360 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
55af49a8
JH		 2361 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2362 continue;
f75113a2 2363
91641b79 2364 /* If trying to establish one time connection to disabled
f75113a2
JP		 2365 * device, leave the params, but mark them as just once.
2366 */
2367 if (params->explicit_connect) {
2368 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2369 continue;
2370 }
2371
195ef75e 2372 hci_conn_params_free(params);
15819a70
AG		 2373 }
2374
55af49a8 2375 BT_DBG("All LE disabled connection parameters were removed");
77a77a30
AG		 2376}
2377
2378/* This function requires the caller holds hdev->lock */
030e7f81 2379static void hci_conn_params_clear_all(struct hci_dev *hdev)
77a77a30 2380{
15819a70 2381 struct hci_conn_params *params, *tmp;
77a77a30 2382
f6c63249
JH		 2383 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2384 hci_conn_params_free(params);
77a77a30 2385
15819a70 2386 BT_DBG("All LE connection parameters were removed");
77a77a30
AG		 2387}
2388
a1f4c318
JH		 2389/* Copy the Identity Address of the controller.
2390 *
2391 * If the controller has a public BD_ADDR, then by default use that one.
2392 * If this is a LE only controller without a public address, default to
2393 * the static random address.
2394 *
2395 * For debugging purposes it is possible to force controllers with a
2396 * public address to use the static random address instead.
50b5b952
MH		 2397 *
2398 * In case BR/EDR has been disabled on a dual-mode controller and
2399 * userspace has configured a static address, then that address
2400 * becomes the identity address instead of the public BR/EDR address.
a1f4c318
JH		 2401 */
2402void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2403 u8 *bdaddr_type)
2404{
b7cb93e5 2405 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
50b5b952 2406 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
d7a5a11d 2407 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
50b5b952 2408 bacmp(&hdev->static_addr, BDADDR_ANY))) {
a1f4c318
JH		 2409 bacpy(bdaddr, &hdev->static_addr);
2410 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2411 } else {
2412 bacpy(bdaddr, &hdev->bdaddr);
2413 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
2414 }
2415}
2416
2f20216c
APS		 2417static void hci_clear_wake_reason(struct hci_dev *hdev)
2418{
2419 hci_dev_lock(hdev);
2420
2421 hdev->wake_reason = 0;
2422 bacpy(&hdev->wake_addr, BDADDR_ANY);
2423 hdev->wake_addr_type = 0;
2424
2425 hci_dev_unlock(hdev);
2426}
2427
9952d90e
APS		 2428static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
2429 void *data)
2430{
2431 struct hci_dev *hdev =
2432 container_of(nb, struct hci_dev, suspend_notifier);
2433 int ret = 0;
9952d90e 2434
4b8af331
APS		 2435 /* Userspace has full control of this device. Do nothing. */
2436 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2437 return NOTIFY_DONE;
2438
573ebae1
YH		 2439 /* To avoid a potential race with hci_unregister_dev. */
2440 hci_dev_hold(hdev);
2441
e1b77d68
LAD		 2442 if (action == PM_SUSPEND_PREPARE)
2443 ret = hci_suspend_dev(hdev);
2444 else if (action == PM_POST_SUSPEND)
2445 ret = hci_resume_dev(hdev);
2f20216c 2446
a9ec8423
APS		 2447 if (ret)
2448 bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
2449 action, ret);
2450
573ebae1 2451 hci_dev_put(hdev);
24b06572 2452 return NOTIFY_DONE;
9952d90e 2453}
8731840a 2454
9be0dab7 2455/* Alloc HCI device */
6ec56613 2456struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
9be0dab7
DH		 2457{
2458 struct hci_dev *hdev;
6ec56613 2459 unsigned int alloc_size;
9be0dab7 2460
6ec56613
THJA		 2461 alloc_size = sizeof(*hdev);
2462 if (sizeof_priv) {
2463 /* Fixme: May need ALIGN-ment? */
2464 alloc_size += sizeof_priv;
2465 }
9be0dab7 2466
6ec56613 2467 hdev = kzalloc(alloc_size, GFP_KERNEL);
9be0dab7
DH		 2468 if (!hdev)
2469 return NULL;
2470
b1b813d4
DH		 2471 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2472 hdev->esco_type = (ESCO_HV1);
2473 hdev->link_mode = (HCI_LM_ACCEPT);
b4cb9fb2
MH		 2474 hdev->num_iac = 0x01; /* One IAC support is mandatory */
2475 hdev->io_capability = 0x03; /* No Input No Output */
96c2103a 2476 hdev->manufacturer = 0xffff; /* Default to internal use */
bbaf444a
JH		 2477 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2478 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
d2609b34
FG		 2479 hdev->adv_instance_cnt = 0;
2480 hdev->cur_adv_instance = 0x00;
5d900e46 2481 hdev->adv_instance_timeout = 0;
b1b813d4 2482
c4f1f408
HC		 2483 hdev->advmon_allowlist_duration = 300;
2484 hdev->advmon_no_filter_duration = 500;
80af16a3 2485 hdev->enable_advmon_interleave_scan = 0x00; /* Default to disable */
c4f1f408 2486
b1b813d4
DH		 2487 hdev->sniff_max_interval = 800;
2488 hdev->sniff_min_interval = 80;
2489
3f959d46 2490 hdev->le_adv_channel_map = 0x07;
628531c9
GL		 2491 hdev->le_adv_min_interval = 0x0800;
2492 hdev->le_adv_max_interval = 0x0800;
bef64738
MH		 2493 hdev->le_scan_interval = 0x0060;
2494 hdev->le_scan_window = 0x0030;
10873f99
AM		 2495 hdev->le_scan_int_suspend = 0x0400;
2496 hdev->le_scan_window_suspend = 0x0012;
2497 hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT;
2498 hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN;
ba29d036
MH		 2499 hdev->le_scan_int_adv_monitor = 0x0060;
2500 hdev->le_scan_window_adv_monitor = 0x0030;
10873f99
AM		 2501 hdev->le_scan_int_connect = 0x0060;
2502 hdev->le_scan_window_connect = 0x0060;
b48c3b59
JH		 2503 hdev->le_conn_min_interval = 0x0018;
2504 hdev->le_conn_max_interval = 0x0028;
04fb7d90
MH		 2505 hdev->le_conn_latency = 0x0000;
2506 hdev->le_supv_timeout = 0x002a;
a8e1bfaa
MH		 2507 hdev->le_def_tx_len = 0x001b;
2508 hdev->le_def_tx_time = 0x0148;
2509 hdev->le_max_tx_len = 0x001b;
2510 hdev->le_max_tx_time = 0x0148;
2511 hdev->le_max_rx_len = 0x001b;
2512 hdev->le_max_rx_time = 0x0148;
30d65e08
MK		 2513 hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
2514 hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
6decb5b4
JK		 2515 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
2516 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
1d0fac2c 2517 hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
10873f99 2518 hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
49b020c1 2519 hdev->def_le_autoconnect_timeout = HCI_LE_AUTOCONN_TIMEOUT;
7c395ea5
DW		 2520 hdev->min_le_tx_power = HCI_TX_POWER_INVALID;
2521 hdev->max_le_tx_power = HCI_TX_POWER_INVALID;
bef64738 2522
d6bfd59c 2523 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
b9a7a61e 2524 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
31ad1691
AK		 2525 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
2526 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
302975cb 2527 hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
58a96fc3 2528 hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
d6bfd59c 2529
10873f99
AM		 2530 /* default 1.28 sec page scan */
2531 hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;
2532 hdev->def_page_scan_int = 0x0800;
2533 hdev->def_page_scan_window = 0x0012;
2534
b1b813d4
DH		 2535 mutex_init(&hdev->lock);
2536 mutex_init(&hdev->req_lock);
2537
b338d917 2538 INIT_LIST_HEAD(&hdev->mesh_pending);
b1b813d4 2539 INIT_LIST_HEAD(&hdev->mgmt_pending);
3d4f9c00
AP		 2540 INIT_LIST_HEAD(&hdev->reject_list);
2541 INIT_LIST_HEAD(&hdev->accept_list);
b1b813d4
DH		 2542 INIT_LIST_HEAD(&hdev->uuids);
2543 INIT_LIST_HEAD(&hdev->link_keys);
2544 INIT_LIST_HEAD(&hdev->long_term_keys);
970c4e46 2545 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
b1b813d4 2546 INIT_LIST_HEAD(&hdev->remote_oob_data);
3d4f9c00 2547 INIT_LIST_HEAD(&hdev->le_accept_list);
cfdb0c2d 2548 INIT_LIST_HEAD(&hdev->le_resolv_list);
15819a70 2549 INIT_LIST_HEAD(&hdev->le_conn_params);
77a77a30 2550 INIT_LIST_HEAD(&hdev->pend_le_conns);
66f8455a 2551 INIT_LIST_HEAD(&hdev->pend_le_reports);
6b536b5e 2552 INIT_LIST_HEAD(&hdev->conn_hash.list);
d2609b34 2553 INIT_LIST_HEAD(&hdev->adv_instances);
600a8749 2554 INIT_LIST_HEAD(&hdev->blocked_keys);
3368aa35 2555 INIT_LIST_HEAD(&hdev->monitored_devices);
b1b813d4 2556
8961987f 2557 INIT_LIST_HEAD(&hdev->local_codecs);
b1b813d4
DH		 2558 INIT_WORK(&hdev->rx_work, hci_rx_work);
2559 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2560 INIT_WORK(&hdev->tx_work, hci_tx_work);
2561 INIT_WORK(&hdev->power_on, hci_power_on);
c7741d16 2562 INIT_WORK(&hdev->error_reset, hci_error_reset);
b1b813d4 2563
6a98e383
MH		 2564 hci_cmd_sync_init(hdev);
2565
b1b813d4 2566 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
b1b813d4 2567
b1b813d4
DH		 2568 skb_queue_head_init(&hdev->rx_q);
2569 skb_queue_head_init(&hdev->cmd_q);
2570 skb_queue_head_init(&hdev->raw_q);
2571
2572 init_waitqueue_head(&hdev->req_wait_q);
2573
65cc2b49 2574 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
de75cd0d 2575 INIT_DELAYED_WORK(&hdev->ncmd_timer, hci_ncmd_timeout);
b1b813d4 2576
9695ef87 2577 hci_devcd_setup(hdev);
5fc16cc4
JH		 2578 hci_request_setup(hdev);
2579
b1b813d4
DH		 2580 hci_init_sysfs(hdev);
2581 discovery_init(hdev);
9be0dab7
DH		 2582
2583 return hdev;
2584}
6ec56613 2585EXPORT_SYMBOL(hci_alloc_dev_priv);
9be0dab7
DH		 2586
2587/* Free HCI device */
2588void hci_free_dev(struct hci_dev *hdev)
2589{
9be0dab7
DH		 2590 /* will free via device release */
2591 put_device(&hdev->dev);
2592}
2593EXPORT_SYMBOL(hci_free_dev);
2594
1da177e4
LT		 2595/* Register HCI device */
2596int hci_register_dev(struct hci_dev *hdev)
2597{
b1b813d4 2598 int id, error;
1da177e4 2599
74292d5a 2600 if (!hdev->open || !hdev->close || !hdev->send)
1da177e4
LT		 2601 return -EINVAL;
2602
08add513
MM		 2603 /* Do not allow HCI_AMP devices to register at index 0,
2604 * so the index can be used as the AMP controller ID.
2605 */
3df92b31 2606 switch (hdev->dev_type) {
ca8bee5d 2607 case HCI_PRIMARY:
103a2f32 2608 id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
3df92b31
SL		 2609 break;
2610 case HCI_AMP:
103a2f32 2611 id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
3df92b31
SL		 2612 break;
2613 default:
2614 return -EINVAL;
1da177e4 2615 }
8e87d142 2616
3df92b31
SL		 2617 if (id < 0)
2618 return id;
2619
dcda1657
LAD		 2620 error = dev_set_name(&hdev->dev, "hci%u", id);
2621 if (error)
2622 return error;
2623
2624 hdev->name = dev_name(&hdev->dev);
1da177e4 2625 hdev->id = id;
2d8b3a11
AE		 2626
2627 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2628
29e2dd0d 2629 hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
33ca954d
DH		 2630 if (!hdev->workqueue) {
2631 error = -ENOMEM;
2632 goto err;
2633 }
f48fd9c8 2634
29e2dd0d
TH		 2635 hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
2636 hdev->name);
6ead1bbc
JH		 2637 if (!hdev->req_workqueue) {
2638 destroy_workqueue(hdev->workqueue);
2639 error = -ENOMEM;
2640 goto err;
2641 }
2642
0153e2ec
MH		 2643 if (!IS_ERR_OR_NULL(bt_debugfs))
2644 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
2645
bdc3e0f1 2646 error = device_add(&hdev->dev);
33ca954d 2647 if (error < 0)
54506918 2648 goto err_wqueue;
1da177e4 2649
6d5d2ee6
HK		 2650 hci_leds_init(hdev);
2651
611b30f7 2652 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 2653 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2654 hdev);
611b30f7
MH		 2655 if (hdev->rfkill) {
2656 if (rfkill_register(hdev->rfkill) < 0) {
2657 rfkill_destroy(hdev->rfkill);
2658 hdev->rfkill = NULL;
2659 }
2660 }
2661
5e130367 2662 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
a1536da2 2663 hci_dev_set_flag(hdev, HCI_RFKILLED);
5e130367 2664
a1536da2
MH		 2665 hci_dev_set_flag(hdev, HCI_SETUP);
2666 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
ce2be9ac 2667
ca8bee5d 2668 if (hdev->dev_type == HCI_PRIMARY) {
56f87901
JH		 2669 /* Assume BR/EDR support until proven otherwise (such as
2670 * through reading supported features during init.
2671 */
a1536da2 2672 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
56f87901 2673 }
ce2be9ac 2674
fcee3377
GP		 2675 write_lock(&hci_dev_list_lock);
2676 list_add(&hdev->list, &hci_dev_list);
2677 write_unlock(&hci_dev_list_lock);
2678
4a964404
MH		 2679 /* Devices that are marked for raw-only usage are unconfigured
2680 * and should not be included in normal operation.
fee746b0
MH		 2681 */
2682 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
a1536da2 2683 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
fee746b0 2684
fe92ee64
LAD		 2685 /* Mark Remote Wakeup connection flag as supported if driver has wakeup
2686 * callback.
2687 */
2688 if (hdev->wakeup)
e1cff700 2689 hdev->conn_flags |= HCI_CONN_FLAG_REMOTE_WAKEUP;
fe92ee64 2690
05fcd4c4 2691 hci_sock_dev_event(hdev, HCI_DEV_REG);
dc946bd8 2692 hci_dev_hold(hdev);
1da177e4 2693
91117864
DC		 2694 error = hci_register_suspend_notifier(hdev);
2695 if (error)
0d75da38 2696 BT_WARN("register suspend notifier failed error:%d\n", error);
9952d90e 2697
19202573 2698 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 2699
e5e1e7fd 2700 idr_init(&hdev->adv_monitors_idr);
5031ffcc 2701 msft_register(hdev);
e5e1e7fd 2702
1da177e4 2703 return id;
f48fd9c8 2704
33ca954d 2705err_wqueue:
5a4bb6a8 2706 debugfs_remove_recursive(hdev->debugfs);
33ca954d 2707 destroy_workqueue(hdev->workqueue);
6ead1bbc 2708 destroy_workqueue(hdev->req_workqueue);
33ca954d 2709err:
3df92b31 2710 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 2711
33ca954d 2712 return error;
1da177e4
LT		 2713}
2714EXPORT_SYMBOL(hci_register_dev);
2715
2716/* Unregister HCI device */
59735631 2717void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 2718{
c13854ce 2719 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 2720
1857c199 2721 mutex_lock(&hdev->unregister_lock);
a1536da2 2722 hci_dev_set_flag(hdev, HCI_UNREGISTER);
1857c199 2723 mutex_unlock(&hdev->unregister_lock);
94324962 2724
f20d09d5 2725 write_lock(&hci_dev_list_lock);
1da177e4 2726 list_del(&hdev->list);
f20d09d5 2727 write_unlock(&hci_dev_list_lock);
1da177e4 2728
e36bea6e
VV		 2729 cancel_work_sync(&hdev->power_on);
2730
6a98e383
MH		 2731 hci_cmd_sync_clear(hdev);
2732
359ee4f8 2733 hci_unregister_suspend_notifier(hdev);
4e8c36c3 2734
5031ffcc
MC		 2735 msft_unregister(hdev);
2736
4e8c36c3 2737 hci_dev_do_close(hdev);
9952d90e 2738
ab81cbf9 2739 if (!test_bit(HCI_INIT, &hdev->flags) &&
d7a5a11d
MH		 2740 !hci_dev_test_flag(hdev, HCI_SETUP) &&
2741 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
09fd0de5 2742 hci_dev_lock(hdev);
744cf19e 2743 mgmt_index_removed(hdev);
09fd0de5 2744 hci_dev_unlock(hdev);
56e5cb86 2745 }
ab81cbf9 2746
2e58ef3e
JH		 2747 /* mgmt_index_removed should take care of emptying the
2748 * pending list */
2749 BUG_ON(!list_empty(&hdev->mgmt_pending));
2750
05fcd4c4 2751 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
1da177e4 2752
611b30f7
MH		 2753 if (hdev->rfkill) {
2754 rfkill_unregister(hdev->rfkill);
2755 rfkill_destroy(hdev->rfkill);
2756 }
2757
bdc3e0f1 2758 device_del(&hdev->dev);
e61fbee7 2759 /* Actual cleanup is deferred until hci_release_dev(). */
e0448092
TH		 2760 hci_dev_put(hdev);
2761}
2762EXPORT_SYMBOL(hci_unregister_dev);
147e2d59 2763
58ce6d5b
TH		 2764/* Release HCI device */
2765void hci_release_dev(struct hci_dev *hdev)
e0448092 2766{
0153e2ec 2767 debugfs_remove_recursive(hdev->debugfs);
5177a838
MH		 2768 kfree_const(hdev->hw_info);
2769 kfree_const(hdev->fw_info);
0153e2ec 2770
f48fd9c8 2771 destroy_workqueue(hdev->workqueue);
6ead1bbc 2772 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 2773
09fd0de5 2774 hci_dev_lock(hdev);
3d4f9c00
AP		 2775 hci_bdaddr_list_clear(&hdev->reject_list);
2776 hci_bdaddr_list_clear(&hdev->accept_list);
2aeb9a1a 2777 hci_uuids_clear(hdev);
55ed8ca1 2778 hci_link_keys_clear(hdev);
b899efaf 2779 hci_smp_ltks_clear(hdev);
970c4e46 2780 hci_smp_irks_clear(hdev);
2763eda6 2781 hci_remote_oob_data_clear(hdev);
d2609b34 2782 hci_adv_instances_clear(hdev);
e5e1e7fd 2783 hci_adv_monitors_clear(hdev);
3d4f9c00 2784 hci_bdaddr_list_clear(&hdev->le_accept_list);
cfdb0c2d 2785 hci_bdaddr_list_clear(&hdev->le_resolv_list);
373110c5 2786 hci_conn_params_clear_all(hdev);
22078800 2787 hci_discovery_filter_clear(hdev);
600a8749 2788 hci_blocked_keys_clear(hdev);
b938790e 2789 hci_codec_list_clear(&hdev->local_codecs);
09fd0de5 2790 hci_dev_unlock(hdev);
e2e0cacb 2791
e0448092 2792 ida_simple_remove(&hci_index_ida, hdev->id);
dd3b1dc3 2793 kfree_skb(hdev->sent_cmd);
dfe6d5c3 2794 kfree_skb(hdev->recv_event);
58ce6d5b 2795 kfree(hdev);
1da177e4 2796}
58ce6d5b 2797EXPORT_SYMBOL(hci_release_dev);
1da177e4 2798
359ee4f8
APS		 2799int hci_register_suspend_notifier(struct hci_dev *hdev)
2800{
2801 int ret = 0;
2802
b5ca3387
LAD		 2803 if (!hdev->suspend_notifier.notifier_call &&
2804 !test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
359ee4f8
APS		 2805 hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
2806 ret = register_pm_notifier(&hdev->suspend_notifier);
2807 }
2808
2809 return ret;
2810}
2811
2812int hci_unregister_suspend_notifier(struct hci_dev *hdev)
2813{
2814 int ret = 0;
2815
b5ca3387 2816 if (hdev->suspend_notifier.notifier_call) {
359ee4f8 2817 ret = unregister_pm_notifier(&hdev->suspend_notifier);
b5ca3387
LAD		 2818 if (!ret)
2819 hdev->suspend_notifier.notifier_call = NULL;
2820 }
359ee4f8
APS		 2821
2822 return ret;
2823}
2824
1da177e4
LT		 2825/* Suspend HCI device */
2826int hci_suspend_dev(struct hci_dev *hdev)
2827{
e1b77d68 2828 int ret;
e1b77d68
LAD		 2829
2830 bt_dev_dbg(hdev, "");
2831
2832 /* Suspend should only act on when powered. */
2833 if (!hdev_is_powered(hdev) ||
2834 hci_dev_test_flag(hdev, HCI_UNREGISTER))
2835 return 0;
2836
182ee45d
LAD		 2837 /* If powering down don't attempt to suspend */
2838 if (mgmt_powering_down(hdev))
2839 return 0;
4539ca67 2840
f4198635
AP		 2841 /* Cancel potentially blocking sync operation before suspend */
2842 __hci_cmd_sync_cancel(hdev, -EHOSTDOWN);
2843
182ee45d
LAD		 2844 hci_req_sync_lock(hdev);
2845 ret = hci_suspend_sync(hdev);
2846 hci_req_sync_unlock(hdev);
e1b77d68
LAD		 2847
2848 hci_clear_wake_reason(hdev);
182ee45d 2849 mgmt_suspending(hdev, hdev->suspend_state);
e1b77d68 2850
05fcd4c4 2851 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
e1b77d68 2852 return ret;
1da177e4
LT		 2853}
2854EXPORT_SYMBOL(hci_suspend_dev);
2855
2856/* Resume HCI device */
2857int hci_resume_dev(struct hci_dev *hdev)
2858{
e1b77d68
LAD		 2859 int ret;
2860
2861 bt_dev_dbg(hdev, "");
2862
2863 /* Resume should only act on when powered. */
2864 if (!hdev_is_powered(hdev) ||
2865 hci_dev_test_flag(hdev, HCI_UNREGISTER))
2866 return 0;
2867
2868 /* If powering down don't attempt to resume */
2869 if (mgmt_powering_down(hdev))
2870 return 0;
2871
182ee45d
LAD		 2872 hci_req_sync_lock(hdev);
2873 ret = hci_resume_sync(hdev);
2874 hci_req_sync_unlock(hdev);
e1b77d68
LAD		 2875
2876 mgmt_resuming(hdev, hdev->wake_reason, &hdev->wake_addr,
182ee45d 2877 hdev->wake_addr_type);
e1b77d68 2878
05fcd4c4 2879 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
e1b77d68 2880 return ret;
1da177e4
LT		 2881}
2882EXPORT_SYMBOL(hci_resume_dev);
2883
75e0569f
MH		 2884/* Reset HCI device */
2885int hci_reset_dev(struct hci_dev *hdev)
2886{
1e4b6e91 2887 static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
75e0569f
MH		 2888 struct sk_buff *skb;
2889
2890 skb = bt_skb_alloc(3, GFP_ATOMIC);
2891 if (!skb)
2892 return -ENOMEM;
2893
d79f34e3 2894 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
59ae1d12 2895 skb_put_data(skb, hw_err, 3);
75e0569f 2896
de75cd0d
MM		 2897 bt_dev_err(hdev, "Injecting HCI hardware error event");
2898
75e0569f
MH		 2899 /* Send Hardware Error to upper stack */
2900 return hci_recv_frame(hdev, skb);
2901}
2902EXPORT_SYMBOL(hci_reset_dev);
2903
76bca880 2904/* Receive frame from HCI drivers */
e1a26170 2905int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
76bca880 2906{
76bca880 2907 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 2908 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 2909 kfree_skb(skb);
2910 return -ENXIO;
2911 }
2912
876e7810
LAD		 2913 switch (hci_skb_pkt_type(skb)) {
2914 case HCI_EVENT_PKT:
2915 break;
2916 case HCI_ACLDATA_PKT:
2917 /* Detect if ISO packet has been sent as ACL */
2918 if (hci_conn_num(hdev, ISO_LINK)) {
2919 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
2920 __u8 type;
2921
2922 type = hci_conn_lookup_type(hdev, hci_handle(handle));
2923 if (type == ISO_LINK)
2924 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
2925 }
2926 break;
2927 case HCI_SCODATA_PKT:
2928 break;
2929 case HCI_ISODATA_PKT:
2930 break;
2931 default:
fe806dce
MH		 2932 kfree_skb(skb);
2933 return -EINVAL;
2934 }
2935
d82603c6 2936 /* Incoming skb */
76bca880
MH		 2937 bt_cb(skb)->incoming = 1;
2938
2939 /* Time stamp */
2940 __net_timestamp(skb);
2941
76bca880 2942 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 2943 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 2944
76bca880
MH		 2945 return 0;
2946}
2947EXPORT_SYMBOL(hci_recv_frame);
2948
e875ff84
MH		 2949/* Receive diagnostic message from HCI drivers */
2950int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
2951{
581d6fd6 2952 /* Mark as diagnostic packet */
d79f34e3 2953 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
581d6fd6 2954
e875ff84
MH		 2955 /* Time stamp */
2956 __net_timestamp(skb);
2957
581d6fd6
MH		 2958 skb_queue_tail(&hdev->rx_q, skb);
2959 queue_work(hdev->workqueue, &hdev->rx_work);
e875ff84 2960
e875ff84
MH		 2961 return 0;
2962}
2963EXPORT_SYMBOL(hci_recv_diag);
2964
5177a838
MH		 2965void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
2966{
2967 va_list vargs;
2968
2969 va_start(vargs, fmt);
2970 kfree_const(hdev->hw_info);
2971 hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2972 va_end(vargs);
2973}
2974EXPORT_SYMBOL(hci_set_hw_info);
2975
2976void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
2977{
2978 va_list vargs;
2979
2980 va_start(vargs, fmt);
2981 kfree_const(hdev->fw_info);
2982 hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2983 va_end(vargs);
2984}
2985EXPORT_SYMBOL(hci_set_fw_info);
2986
1da177e4
LT		 2987/* ---- Interface to upper protocols ---- */
2988
1da177e4
LT		 2989int hci_register_cb(struct hci_cb *cb)
2990{
2991 BT_DBG("%p name %s", cb, cb->name);
2992
fba7ecf0 2993 mutex_lock(&hci_cb_list_lock);
00629e0f 2994 list_add_tail(&cb->list, &hci_cb_list);
fba7ecf0 2995 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 2996
2997 return 0;
2998}
2999EXPORT_SYMBOL(hci_register_cb);
3000
3001int hci_unregister_cb(struct hci_cb *cb)
3002{
3003 BT_DBG("%p name %s", cb, cb->name);
3004
fba7ecf0 3005 mutex_lock(&hci_cb_list_lock);
1da177e4 3006 list_del(&cb->list);
fba7ecf0 3007 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 3008
3009 return 0;
3010}
3011EXPORT_SYMBOL(hci_unregister_cb);
3012
2250abad 3013static int hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3014{
cdc52faa
MH		 3015 int err;
3016
d79f34e3
MH		 3017 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3018 skb->len);
1da177e4 3019
cd82e61c
MH		 3020 /* Time stamp */
3021 __net_timestamp(skb);
1da177e4 3022
cd82e61c
MH		 3023 /* Send copy to monitor */
3024 hci_send_to_monitor(hdev, skb);
3025
3026 if (atomic_read(&hdev->promisc)) {
3027 /* Send copy to the sockets */
470fe1b5 3028 hci_send_to_sock(hdev, skb);
1da177e4
LT		 3029 }
3030
3031 /* Get rid of skb owner, prior to sending to the driver. */
3032 skb_orphan(skb);
3033
73d0d3c8
MH		 3034 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3035 kfree_skb(skb);
2250abad 3036 return -EINVAL;
73d0d3c8
MH		 3037 }
3038
cdc52faa
MH		 3039 err = hdev->send(hdev, skb);
3040 if (err < 0) {
2064ee33 3041 bt_dev_err(hdev, "sending frame failed (%d)", err);
cdc52faa 3042 kfree_skb(skb);
2250abad 3043 return err;
cdc52faa 3044 }
2250abad
BB		 3045
3046 return 0;
1da177e4
LT		 3047}
3048
1ca3a9d0 3049/* Send HCI command */
07dc93dd
JH		 3050int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3051 const void *param)
1ca3a9d0
JH		 3052{
3053 struct sk_buff *skb;
3054
3055 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3056
3057 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3058 if (!skb) {
2064ee33 3059 bt_dev_err(hdev, "no memory for command");
1ca3a9d0
JH		 3060 return -ENOMEM;
3061 }
3062
49c922bb 3063 /* Stand-alone HCI commands must be flagged as
11714b3d
JH		 3064 * single-command requests.
3065 */
44d27137 3066 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
11714b3d 3067
1da177e4 3068 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 3069 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3070
3071 return 0;
3072}
1da177e4 3073
d6ee6ad7
LP		 3074int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
3075 const void *param)
3076{
3077 struct sk_buff *skb;
3078
3079 if (hci_opcode_ogf(opcode) != 0x3f) {
3080 /* A controller receiving a command shall respond with either
3081 * a Command Status Event or a Command Complete Event.
3082 * Therefore, all standard HCI commands must be sent via the
3083 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
3084 * Some vendors do not comply with this rule for vendor-specific
3085 * commands and do not return any event. We want to support
3086 * unresponded commands for such cases only.
3087 */
3088 bt_dev_err(hdev, "unresponded command not supported");
3089 return -EINVAL;
3090 }
3091
3092 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3093 if (!skb) {
3094 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
3095 opcode);
3096 return -ENOMEM;
3097 }
3098
3099 hci_send_frame(hdev, skb);
3100
3101 return 0;
3102}
3103EXPORT_SYMBOL(__hci_cmd_send);
3104
1da177e4 3105/* Get data from the previously sent command */
a9de9248 3106void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 3107{
3108 struct hci_command_hdr *hdr;
3109
3110 if (!hdev->sent_cmd)
3111 return NULL;
3112
3113 hdr = (void *) hdev->sent_cmd->data;
3114
a9de9248 3115 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 3116 return NULL;
3117
f0e09510 3118 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 3119
3120 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3121}
3122
dfe6d5c3
LAD		 3123/* Get data from last received event */
3124void *hci_recv_event_data(struct hci_dev *hdev, __u8 event)
3125{
3126 struct hci_event_hdr *hdr;
3127 int offset;
3128
3129 if (!hdev->recv_event)
3130 return NULL;
3131
3132 hdr = (void *)hdev->recv_event->data;
3133 offset = sizeof(*hdr);
3134
3135 if (hdr->evt != event) {
3136 /* In case of LE metaevent check the subevent match */
3137 if (hdr->evt == HCI_EV_LE_META) {
3138 struct hci_ev_le_meta *ev;
3139
3140 ev = (void *)hdev->recv_event->data + offset;
3141 offset += sizeof(*ev);
3142 if (ev->subevent == event)
3143 goto found;
3144 }
3145 return NULL;
3146 }
3147
3148found:
3149 bt_dev_dbg(hdev, "event 0x%2.2x", event);
3150
3151 return hdev->recv_event->data + offset;
3152}
3153
1da177e4
LT		 3154/* Send ACL data */
3155static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3156{
3157 struct hci_acl_hdr *hdr;
3158 int len = skb->len;
3159
badff6d0
ACM		 3160 skb_push(skb, HCI_ACL_HDR_SIZE);
3161 skb_reset_transport_header(skb);
9c70220b 3162 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 3163 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3164 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 3165}
3166
ee22be7e 3167static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 3168 struct sk_buff *skb, __u16 flags)
1da177e4 3169{
ee22be7e 3170 struct hci_conn *conn = chan->conn;
1da177e4
LT		 3171 struct hci_dev *hdev = conn->hdev;
3172 struct sk_buff *list;
3173
087bfd99
GP		 3174 skb->len = skb_headlen(skb);
3175 skb->data_len = 0;
3176
d79f34e3 3177 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
204a6e54
AE		 3178
3179 switch (hdev->dev_type) {
ca8bee5d 3180 case HCI_PRIMARY:
204a6e54
AE		 3181 hci_add_acl_hdr(skb, conn->handle, flags);
3182 break;
3183 case HCI_AMP:
3184 hci_add_acl_hdr(skb, chan->handle, flags);
3185 break;
3186 default:
2064ee33 3187 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
204a6e54
AE		 3188 return;
3189 }
087bfd99 3190
70f23020
AE		 3191 list = skb_shinfo(skb)->frag_list;
3192 if (!list) {
1da177e4
LT		 3193 /* Non fragmented */
3194 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3195
73d80deb 3196 skb_queue_tail(queue, skb);
1da177e4
LT		 3197 } else {
3198 /* Fragmented */
3199 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3200
3201 skb_shinfo(skb)->frag_list = NULL;
3202
9cfd5a23
JR		 3203 /* Queue all fragments atomically. We need to use spin_lock_bh
3204 * here because of 6LoWPAN links, as there this function is
3205 * called from softirq and using normal spin lock could cause
3206 * deadlocks.
3207 */
3208 spin_lock_bh(&queue->lock);
1da177e4 3209
73d80deb 3210 __skb_queue_tail(queue, skb);
e702112f
AE		 3211
3212 flags &= ~ACL_START;
3213 flags |= ACL_CONT;
1da177e4
LT		 3214 do {
3215 skb = list; list = list->next;
8e87d142 3216
d79f34e3 3217 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
e702112f 3218 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 3219
3220 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3221
73d80deb 3222 __skb_queue_tail(queue, skb);
1da177e4
LT		 3223 } while (list);
3224
9cfd5a23 3225 spin_unlock_bh(&queue->lock);
1da177e4 3226 }
73d80deb
LAD		 3227}
3228
3229void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3230{
ee22be7e 3231 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 3232
f0e09510 3233 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb 3234
ee22be7e 3235 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 3236
3eff45ea 3237 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3238}
1da177e4
LT		 3239
3240/* Send SCO data */
0d861d8b 3241void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 3242{
3243 struct hci_dev *hdev = conn->hdev;
3244 struct hci_sco_hdr hdr;
3245
3246 BT_DBG("%s len %d", hdev->name, skb->len);
3247
aca3192c 3248 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 3249 hdr.dlen = skb->len;
3250
badff6d0
ACM		 3251 skb_push(skb, HCI_SCO_HDR_SIZE);
3252 skb_reset_transport_header(skb);
9c70220b 3253 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4 3254
d79f34e3 3255 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
c78ae283 3256
1da177e4 3257 skb_queue_tail(&conn->data_q, skb);
3eff45ea 3258 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3259}
1da177e4 3260
26afbd82
LAD		 3261/* Send ISO data */
3262static void hci_add_iso_hdr(struct sk_buff *skb, __u16 handle, __u8 flags)
3263{
3264 struct hci_iso_hdr *hdr;
3265 int len = skb->len;
3266
3267 skb_push(skb, HCI_ISO_HDR_SIZE);
3268 skb_reset_transport_header(skb);
3269 hdr = (struct hci_iso_hdr *)skb_transport_header(skb);
3270 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3271 hdr->dlen = cpu_to_le16(len);
3272}
3273
3274static void hci_queue_iso(struct hci_conn *conn, struct sk_buff_head *queue,
3275 struct sk_buff *skb)
3276{
3277 struct hci_dev *hdev = conn->hdev;
3278 struct sk_buff *list;
3279 __u16 flags;
3280
3281 skb->len = skb_headlen(skb);
3282 skb->data_len = 0;
3283
3284 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3285
3286 list = skb_shinfo(skb)->frag_list;
3287
3288 flags = hci_iso_flags_pack(list ? ISO_START : ISO_SINGLE, 0x00);
3289 hci_add_iso_hdr(skb, conn->handle, flags);
3290
3291 if (!list) {
3292 /* Non fragmented */
3293 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3294
3295 skb_queue_tail(queue, skb);
3296 } else {
3297 /* Fragmented */
3298 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3299
3300 skb_shinfo(skb)->frag_list = NULL;
3301
3302 __skb_queue_tail(queue, skb);
3303
3304 do {
3305 skb = list; list = list->next;
3306
3307 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3308 flags = hci_iso_flags_pack(list ? ISO_CONT : ISO_END,
3309 0x00);
3310 hci_add_iso_hdr(skb, conn->handle, flags);
3311
3312 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3313
3314 __skb_queue_tail(queue, skb);
3315 } while (list);
3316 }
3317}
3318
3319void hci_send_iso(struct hci_conn *conn, struct sk_buff *skb)
3320{
3321 struct hci_dev *hdev = conn->hdev;
3322
3323 BT_DBG("%s len %d", hdev->name, skb->len);
3324
3325 hci_queue_iso(conn, &conn->data_q, skb);
3326
3327 queue_work(hdev->workqueue, &hdev->tx_work);
3328}
3329
1da177e4
LT		 3330/* ---- HCI TX task (outgoing data) ---- */
3331
3332/* HCI Connection scheduler */
26afbd82
LAD		 3333static inline void hci_quote_sent(struct hci_conn *conn, int num, int *quote)
3334{
3335 struct hci_dev *hdev;
3336 int cnt, q;
3337
3338 if (!conn) {
3339 *quote = 0;
3340 return;
3341 }
3342
3343 hdev = conn->hdev;
3344
3345 switch (conn->type) {
3346 case ACL_LINK:
3347 cnt = hdev->acl_cnt;
3348 break;
3349 case AMP_LINK:
3350 cnt = hdev->block_cnt;
3351 break;
3352 case SCO_LINK:
3353 case ESCO_LINK:
3354 cnt = hdev->sco_cnt;
3355 break;
3356 case LE_LINK:
3357 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3358 break;
3359 case ISO_LINK:
3360 cnt = hdev->iso_mtu ? hdev->iso_cnt :
3361 hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3362 break;
3363 default:
3364 cnt = 0;
3365 bt_dev_err(hdev, "unknown link type %d", conn->type);
3366 }
3367
3368 q = cnt / num;
3369 *quote = q ? q : 1;
3370}
3371
6039aa73
GP		 3372static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3373 int *quote)
1da177e4
LT		 3374{
3375 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3376 struct hci_conn *conn = NULL, *c;
abc5de8f 3377 unsigned int num = 0, min = ~0;
1da177e4 3378
8e87d142 3379 /* We don't have to lock device here. Connections are always
1da177e4 3380 * added and removed with TX task disabled. */
bf4c6325
GP		 3381
3382 rcu_read_lock();
3383
3384 list_for_each_entry_rcu(c, &h->list, list) {
769be974 3385 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 3386 continue;
769be974
MH		 3387
3388 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3389 continue;
3390
1da177e4
LT		 3391 num++;
3392
3393 if (c->sent < min) {
3394 min = c->sent;
3395 conn = c;
3396 }
52087a79
LAD		 3397
3398 if (hci_conn_num(hdev, type) == num)
3399 break;
1da177e4
LT		 3400 }
3401
bf4c6325
GP		 3402 rcu_read_unlock();
3403
26afbd82 3404 hci_quote_sent(conn, num, quote);
1da177e4
LT		 3405
3406 BT_DBG("conn %p quote %d", conn, *quote);
3407 return conn;
3408}
3409
6039aa73 3410static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 3411{
3412 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3413 struct hci_conn *c;
1da177e4 3414
2064ee33 3415 bt_dev_err(hdev, "link tx timeout");
1da177e4 3416
bf4c6325
GP		 3417 rcu_read_lock();
3418
1da177e4 3419 /* Kill stalled connections */
bf4c6325 3420 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 3421 if (c->type == type && c->sent) {
2064ee33
MH		 3422 bt_dev_err(hdev, "killing stalled connection %pMR",
3423 &c->dst);
c7eaf80b
YH		 3424 /* hci_disconnect might sleep, so, we have to release
3425 * the RCU read lock before calling it.
3426 */
3427 rcu_read_unlock();
bed71748 3428 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
c7eaf80b 3429 rcu_read_lock();
1da177e4
LT		 3430 }
3431 }
bf4c6325
GP		 3432
3433 rcu_read_unlock();
1da177e4
LT		 3434}
3435
6039aa73
GP		 3436static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3437 int *quote)
1da177e4 3438{
73d80deb
LAD		 3439 struct hci_conn_hash *h = &hdev->conn_hash;
3440 struct hci_chan *chan = NULL;
abc5de8f 3441 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 3442 struct hci_conn *conn;
26afbd82 3443 int conn_num = 0;
73d80deb
LAD		 3444
3445 BT_DBG("%s", hdev->name);
3446
bf4c6325
GP		 3447 rcu_read_lock();
3448
3449 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 3450 struct hci_chan *tmp;
3451
3452 if (conn->type != type)
3453 continue;
3454
3455 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3456 continue;
3457
3458 conn_num++;
3459
8192edef 3460 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 3461 struct sk_buff *skb;
3462
3463 if (skb_queue_empty(&tmp->data_q))
3464 continue;
3465
3466 skb = skb_peek(&tmp->data_q);
3467 if (skb->priority < cur_prio)
3468 continue;
3469
3470 if (skb->priority > cur_prio) {
3471 num = 0;
3472 min = ~0;
3473 cur_prio = skb->priority;
3474 }
3475
3476 num++;
3477
3478 if (conn->sent < min) {
3479 min = conn->sent;
3480 chan = tmp;
3481 }
3482 }
3483
3484 if (hci_conn_num(hdev, type) == conn_num)
3485 break;
3486 }
3487
bf4c6325
GP		 3488 rcu_read_unlock();
3489
73d80deb
LAD		 3490 if (!chan)
3491 return NULL;
3492
26afbd82 3493 hci_quote_sent(chan->conn, num, quote);
73d80deb 3494
73d80deb
LAD		 3495 BT_DBG("chan %p quote %d", chan, *quote);
3496 return chan;
3497}
3498
02b20f0b
LAD		 3499static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3500{
3501 struct hci_conn_hash *h = &hdev->conn_hash;
3502 struct hci_conn *conn;
3503 int num = 0;
3504
3505 BT_DBG("%s", hdev->name);
3506
bf4c6325
GP		 3507 rcu_read_lock();
3508
3509 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 3510 struct hci_chan *chan;
3511
3512 if (conn->type != type)
3513 continue;
3514
3515 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3516 continue;
3517
3518 num++;
3519
8192edef 3520 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 3521 struct sk_buff *skb;
3522
3523 if (chan->sent) {
3524 chan->sent = 0;
3525 continue;
3526 }
3527
3528 if (skb_queue_empty(&chan->data_q))
3529 continue;
3530
3531 skb = skb_peek(&chan->data_q);
3532 if (skb->priority >= HCI_PRIO_MAX - 1)
3533 continue;
3534
3535 skb->priority = HCI_PRIO_MAX - 1;
3536
3537 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 3538 skb->priority);
02b20f0b
LAD		 3539 }
3540
3541 if (hci_conn_num(hdev, type) == num)
3542 break;
3543 }
bf4c6325
GP		 3544
3545 rcu_read_unlock();
3546
02b20f0b
LAD		 3547}
3548
b71d385a
AE		 3549static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3550{
3551 /* Calculate count of blocks used by this packet */
3552 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3553}
3554
116523c8 3555static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type)
73d80deb 3556{
116523c8
LAD		 3557 unsigned long last_tx;
3558
3559 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
3560 return;
3561
3562 switch (type) {
3563 case LE_LINK:
3564 last_tx = hdev->le_last_tx;
3565 break;
3566 default:
3567 last_tx = hdev->acl_last_tx;
3568 break;
1da177e4 3569 }
116523c8
LAD		 3570
3571 /* tx timeout must be longer than maximum link supervision timeout
3572 * (40.9 seconds)
3573 */
3574 if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT))
3575 hci_link_tx_to(hdev, type);
63d2bc1b 3576}
1da177e4 3577
7fedd3bb
APS		 3578/* Schedule SCO */
3579static void hci_sched_sco(struct hci_dev *hdev)
3580{
3581 struct hci_conn *conn;
3582 struct sk_buff *skb;
3583 int quote;
3584
3585 BT_DBG("%s", hdev->name);
3586
3587 if (!hci_conn_num(hdev, SCO_LINK))
3588 return;
3589
3590 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3591 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3592 BT_DBG("skb %p len %d", skb, skb->len);
3593 hci_send_frame(hdev, skb);
3594
3595 conn->sent++;
3596 if (conn->sent == ~0)
3597 conn->sent = 0;
3598 }
3599 }
3600}
3601
3602static void hci_sched_esco(struct hci_dev *hdev)
3603{
3604 struct hci_conn *conn;
3605 struct sk_buff *skb;
3606 int quote;
3607
3608 BT_DBG("%s", hdev->name);
3609
3610 if (!hci_conn_num(hdev, ESCO_LINK))
3611 return;
3612
3613 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3614 &quote))) {
3615 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3616 BT_DBG("skb %p len %d", skb, skb->len);
3617 hci_send_frame(hdev, skb);
3618
3619 conn->sent++;
3620 if (conn->sent == ~0)
3621 conn->sent = 0;
3622 }
3623 }
3624}
3625
6039aa73 3626static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 3627{
3628 unsigned int cnt = hdev->acl_cnt;
3629 struct hci_chan *chan;
3630 struct sk_buff *skb;
3631 int quote;
3632
116523c8 3633 __check_timeout(hdev, cnt, ACL_LINK);
04837f64 3634
73d80deb 3635 while (hdev->acl_cnt &&
a8c5fb1a 3636 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 3637 u32 priority = (skb_peek(&chan->data_q))->priority;
3638 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3639 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3640 skb->len, skb->priority);
73d80deb 3641
ec1cce24
LAD		 3642 /* Stop if priority has changed */
3643 if (skb->priority < priority)
3644 break;
3645
3646 skb = skb_dequeue(&chan->data_q);
3647
73d80deb 3648 hci_conn_enter_active_mode(chan->conn,
04124681 3649 bt_cb(skb)->force_active);
04837f64 3650
57d17d70 3651 hci_send_frame(hdev, skb);
1da177e4
LT		 3652 hdev->acl_last_tx = jiffies;
3653
3654 hdev->acl_cnt--;
73d80deb
LAD		 3655 chan->sent++;
3656 chan->conn->sent++;
7fedd3bb
APS		 3657
3658 /* Send pending SCO packets right away */
3659 hci_sched_sco(hdev);
3660 hci_sched_esco(hdev);
1da177e4
LT		 3661 }
3662 }
02b20f0b
LAD		 3663
3664 if (cnt != hdev->acl_cnt)
3665 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 3666}
3667
6039aa73 3668static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 3669{
63d2bc1b 3670 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 3671 struct hci_chan *chan;
3672 struct sk_buff *skb;
3673 int quote;
bd1eb66b 3674 u8 type;
b71d385a 3675
bd1eb66b
AE		 3676 BT_DBG("%s", hdev->name);
3677
3678 if (hdev->dev_type == HCI_AMP)
3679 type = AMP_LINK;
3680 else
3681 type = ACL_LINK;
3682
116523c8
LAD		 3683 __check_timeout(hdev, cnt, type);
3684
b71d385a 3685 while (hdev->block_cnt > 0 &&
bd1eb66b 3686 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 3687 u32 priority = (skb_peek(&chan->data_q))->priority;
3688 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3689 int blocks;
3690
3691 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3692 skb->len, skb->priority);
b71d385a
AE		 3693
3694 /* Stop if priority has changed */
3695 if (skb->priority < priority)
3696 break;
3697
3698 skb = skb_dequeue(&chan->data_q);
3699
3700 blocks = __get_blocks(hdev, skb);
3701 if (blocks > hdev->block_cnt)
3702 return;
3703
3704 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 3705 bt_cb(skb)->force_active);
b71d385a 3706
57d17d70 3707 hci_send_frame(hdev, skb);
b71d385a
AE		 3708 hdev->acl_last_tx = jiffies;
3709
3710 hdev->block_cnt -= blocks;
3711 quote -= blocks;
3712
3713 chan->sent += blocks;
3714 chan->conn->sent += blocks;
3715 }
3716 }
3717
3718 if (cnt != hdev->block_cnt)
bd1eb66b 3719 hci_prio_recalculate(hdev, type);
b71d385a
AE		 3720}
3721
6039aa73 3722static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 3723{
3724 BT_DBG("%s", hdev->name);
3725
bd1eb66b 3726 /* No ACL link over BR/EDR controller */
ca8bee5d 3727 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
bd1eb66b
AE		 3728 return;
3729
3730 /* No AMP link over AMP controller */
3731 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 3732 return;
3733
3734 switch (hdev->flow_ctl_mode) {
3735 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3736 hci_sched_acl_pkt(hdev);
3737 break;
3738
3739 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3740 hci_sched_acl_blk(hdev);
3741 break;
3742 }
3743}
3744
6039aa73 3745static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 3746{
73d80deb 3747 struct hci_chan *chan;
6ed58ec5 3748 struct sk_buff *skb;
02b20f0b 3749 int quote, cnt, tmp;
6ed58ec5
VT		 3750
3751 BT_DBG("%s", hdev->name);
3752
52087a79
LAD		 3753 if (!hci_conn_num(hdev, LE_LINK))
3754 return;
3755
6ed58ec5 3756 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
1b1d29e5 3757
116523c8 3758 __check_timeout(hdev, cnt, LE_LINK);
1b1d29e5 3759
02b20f0b 3760 tmp = cnt;
73d80deb 3761 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 3762 u32 priority = (skb_peek(&chan->data_q))->priority;
3763 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3764 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3765 skb->len, skb->priority);
6ed58ec5 3766
ec1cce24
LAD		 3767 /* Stop if priority has changed */
3768 if (skb->priority < priority)
3769 break;
3770
3771 skb = skb_dequeue(&chan->data_q);
3772
57d17d70 3773 hci_send_frame(hdev, skb);
6ed58ec5
VT		 3774 hdev->le_last_tx = jiffies;
3775
3776 cnt--;
73d80deb
LAD		 3777 chan->sent++;
3778 chan->conn->sent++;
7fedd3bb
APS		 3779
3780 /* Send pending SCO packets right away */
3781 hci_sched_sco(hdev);
3782 hci_sched_esco(hdev);
6ed58ec5
VT		 3783 }
3784 }
73d80deb 3785
6ed58ec5
VT		 3786 if (hdev->le_pkts)
3787 hdev->le_cnt = cnt;
3788 else
3789 hdev->acl_cnt = cnt;
02b20f0b
LAD		 3790
3791 if (cnt != tmp)
3792 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 3793}
3794
26afbd82
LAD		 3795/* Schedule CIS */
3796static void hci_sched_iso(struct hci_dev *hdev)
3797{
3798 struct hci_conn *conn;
3799 struct sk_buff *skb;
3800 int quote, *cnt;
3801
3802 BT_DBG("%s", hdev->name);
3803
3804 if (!hci_conn_num(hdev, ISO_LINK))
3805 return;
3806
3807 cnt = hdev->iso_pkts ? &hdev->iso_cnt :
3808 hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
3809 while (*cnt && (conn = hci_low_sent(hdev, ISO_LINK, &quote))) {
3810 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3811 BT_DBG("skb %p len %d", skb, skb->len);
3812 hci_send_frame(hdev, skb);
3813
3814 conn->sent++;
3815 if (conn->sent == ~0)
3816 conn->sent = 0;
3817 (*cnt)--;
3818 }
3819 }
3820}
3821
3eff45ea 3822static void hci_tx_work(struct work_struct *work)
1da177e4 3823{
3eff45ea 3824 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 3825 struct sk_buff *skb;
3826
26afbd82
LAD		 3827 BT_DBG("%s acl %d sco %d le %d iso %d", hdev->name, hdev->acl_cnt,
3828 hdev->sco_cnt, hdev->le_cnt, hdev->iso_cnt);
1da177e4 3829
d7a5a11d 3830 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
52de599e 3831 /* Schedule queues and send stuff to HCI driver */
52de599e
MH		 3832 hci_sched_sco(hdev);
3833 hci_sched_esco(hdev);
26afbd82 3834 hci_sched_iso(hdev);
7fedd3bb 3835 hci_sched_acl(hdev);
52de599e
MH		 3836 hci_sched_le(hdev);
3837 }
6ed58ec5 3838
1da177e4
LT		 3839 /* Send next queued raw (unknown type) packet */
3840 while ((skb = skb_dequeue(&hdev->raw_q)))
57d17d70 3841 hci_send_frame(hdev, skb);
1da177e4
LT		 3842}
3843
25985edc 3844/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 3845
3846/* ACL data packet */
6039aa73 3847static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3848{
3849 struct hci_acl_hdr *hdr = (void *) skb->data;
3850 struct hci_conn *conn;
3851 __u16 handle, flags;
3852
3853 skb_pull(skb, HCI_ACL_HDR_SIZE);
3854
3855 handle = __le16_to_cpu(hdr->handle);
3856 flags = hci_flags(handle);
3857 handle = hci_handle(handle);
3858
f0e09510 3859 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 3860 handle, flags);
1da177e4
LT		 3861
3862 hdev->stat.acl_rx++;
3863
3864 hci_dev_lock(hdev);
3865 conn = hci_conn_hash_lookup_handle(hdev, handle);
3866 hci_dev_unlock(hdev);
8e87d142 3867
1da177e4 3868 if (conn) {
65983fc7 3869 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 3870
1da177e4 3871 /* Send to upper protocol */
686ebf28
UF		 3872 l2cap_recv_acldata(conn, skb, flags);
3873 return;
1da177e4 3874 } else {
2064ee33
MH		 3875 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
3876 handle);
1da177e4
LT		 3877 }
3878
3879 kfree_skb(skb);
3880}
3881
3882/* SCO data packet */
6039aa73 3883static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3884{
3885 struct hci_sco_hdr *hdr = (void *) skb->data;
3886 struct hci_conn *conn;
debdedf2 3887 __u16 handle, flags;
1da177e4
LT		 3888
3889 skb_pull(skb, HCI_SCO_HDR_SIZE);
3890
3891 handle = __le16_to_cpu(hdr->handle);
debdedf2
MH		 3892 flags = hci_flags(handle);
3893 handle = hci_handle(handle);
1da177e4 3894
debdedf2
MH		 3895 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
3896 handle, flags);
1da177e4
LT		 3897
3898 hdev->stat.sco_rx++;
3899
3900 hci_dev_lock(hdev);
3901 conn = hci_conn_hash_lookup_handle(hdev, handle);
3902 hci_dev_unlock(hdev);
3903
3904 if (conn) {
1da177e4 3905 /* Send to upper protocol */
3f19ffb2 3906 hci_skb_pkt_status(skb) = flags & 0x03;
686ebf28
UF		 3907 sco_recv_scodata(conn, skb);
3908 return;
1da177e4 3909 } else {
2d4b37b6
LAD		 3910 bt_dev_err_ratelimited(hdev, "SCO packet for unknown connection handle %d",
3911 handle);
1da177e4
LT		 3912 }
3913
3914 kfree_skb(skb);
3915}
3916
26afbd82
LAD		 3917static void hci_isodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3918{
3919 struct hci_iso_hdr *hdr;
3920 struct hci_conn *conn;
3921 __u16 handle, flags;
3922
3923 hdr = skb_pull_data(skb, sizeof(*hdr));
3924 if (!hdr) {
3925 bt_dev_err(hdev, "ISO packet too small");
3926 goto drop;
3927 }
3928
3929 handle = __le16_to_cpu(hdr->handle);
3930 flags = hci_flags(handle);
3931 handle = hci_handle(handle);
3932
3933 bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
3934 handle, flags);
3935
3936 hci_dev_lock(hdev);
3937 conn = hci_conn_hash_lookup_handle(hdev, handle);
3938 hci_dev_unlock(hdev);
3939
26afbd82
LAD		 3940 if (!conn) {
3941 bt_dev_err(hdev, "ISO packet for unknown connection handle %d",
3942 handle);
ccf74f23 3943 goto drop;
26afbd82
LAD		 3944 }
3945
ccf74f23
LAD		 3946 /* Send to upper protocol */
3947 iso_recv(conn, skb, flags);
3948 return;
3949
26afbd82
LAD		 3950drop:
3951 kfree_skb(skb);
3952}
3953
9238f36a
JH		 3954static bool hci_req_is_complete(struct hci_dev *hdev)
3955{
3956 struct sk_buff *skb;
3957
3958 skb = skb_peek(&hdev->cmd_q);
3959 if (!skb)
3960 return true;
3961
44d27137 3962 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
9238f36a
JH		 3963}
3964
42c6b129
JH		 3965static void hci_resend_last(struct hci_dev *hdev)
3966{
3967 struct hci_command_hdr *sent;
3968 struct sk_buff *skb;
3969 u16 opcode;
3970
3971 if (!hdev->sent_cmd)
3972 return;
3973
3974 sent = (void *) hdev->sent_cmd->data;
3975 opcode = __le16_to_cpu(sent->opcode);
3976 if (opcode == HCI_OP_RESET)
3977 return;
3978
3979 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3980 if (!skb)
3981 return;
3982
3983 skb_queue_head(&hdev->cmd_q, skb);
3984 queue_work(hdev->workqueue, &hdev->cmd_work);
3985}
3986
e6214487
JH		 3987void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
3988 hci_req_complete_t *req_complete,
3989 hci_req_complete_skb_t *req_complete_skb)
9238f36a 3990{
9238f36a
JH		 3991 struct sk_buff *skb;
3992 unsigned long flags;
3993
3994 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3995
42c6b129
JH		 3996 /* If the completed command doesn't match the last one that was
3997 * sent we need to do special handling of it.
9238f36a 3998 */
42c6b129
JH		 3999 if (!hci_sent_cmd_data(hdev, opcode)) {
4000 /* Some CSR based controllers generate a spontaneous
4001 * reset complete event during init and any pending
4002 * command will never be completed. In such a case we
4003 * need to resend whatever was the last sent
4004 * command.
4005 */
4006 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4007 hci_resend_last(hdev);
4008
9238f36a 4009 return;
42c6b129 4010 }
9238f36a 4011
f80c5dad
JPRV		 4012 /* If we reach this point this event matches the last command sent */
4013 hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
4014
9238f36a
JH		 4015 /* If the command succeeded and there's still more commands in
4016 * this request the request is not yet complete.
4017 */
4018 if (!status && !hci_req_is_complete(hdev))
4019 return;
4020
4021 /* If this was the last command in a request the complete
4022 * callback would be found in hdev->sent_cmd instead of the
4023 * command queue (hdev->cmd_q).
4024 */
44d27137
JH		 4025 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4026 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
e6214487
JH		 4027 return;
4028 }
53e21fbc 4029
44d27137
JH		 4030 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4031 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
e6214487 4032 return;
9238f36a
JH		 4033 }
4034
4035 /* Remove all pending commands belonging to this request */
4036 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4037 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
44d27137 4038 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
9238f36a
JH		 4039 __skb_queue_head(&hdev->cmd_q, skb);
4040 break;
4041 }
4042
3bd7594e
DA		 4043 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4044 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4045 else
4046 *req_complete = bt_cb(skb)->hci.req_complete;
39c1eb6f 4047 dev_kfree_skb_irq(skb);
9238f36a
JH		 4048 }
4049 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
9238f36a
JH		 4050}
4051
b78752cc 4052static void hci_rx_work(struct work_struct *work)
1da177e4 4053{
b78752cc 4054 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 4055 struct sk_buff *skb;
4056
4057 BT_DBG("%s", hdev->name);
4058
9f30de9e
TK		 4059 /* The kcov_remote functions used for collecting packet parsing
4060 * coverage information from this background thread and associate
4061 * the coverage with the syscall's thread which originally injected
4062 * the packet. This helps fuzzing the kernel.
4063 */
4064 for (; (skb = skb_dequeue(&hdev->rx_q)); kcov_remote_stop()) {
4065 kcov_remote_start_common(skb_get_kcov_handle(skb));
4066
cd82e61c
MH		 4067 /* Send copy to monitor */
4068 hci_send_to_monitor(hdev, skb);
4069
1da177e4
LT		 4070 if (atomic_read(&hdev->promisc)) {
4071 /* Send copy to the sockets */
470fe1b5 4072 hci_send_to_sock(hdev, skb);
1da177e4
LT		 4073 }
4074
eb8c101e
MK		 4075 /* If the device has been opened in HCI_USER_CHANNEL,
4076 * the userspace has exclusive access to device.
4077 * When device is HCI_INIT, we still need to process
4078 * the data packets to the driver in order
4079 * to complete its setup().
4080 */
4081 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4082 !test_bit(HCI_INIT, &hdev->flags)) {
1da177e4
LT		 4083 kfree_skb(skb);
4084 continue;
4085 }
4086
4087 if (test_bit(HCI_INIT, &hdev->flags)) {
4088 /* Don't process data packets in this states. */
d79f34e3 4089 switch (hci_skb_pkt_type(skb)) {
1da177e4
LT		 4090 case HCI_ACLDATA_PKT:
4091 case HCI_SCODATA_PKT:
cc974003 4092 case HCI_ISODATA_PKT:
1da177e4
LT		 4093 kfree_skb(skb);
4094 continue;
3ff50b79 4095 }
1da177e4
LT		 4096 }
4097
4098 /* Process frame */
d79f34e3 4099 switch (hci_skb_pkt_type(skb)) {
1da177e4 4100 case HCI_EVENT_PKT:
b78752cc 4101 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 4102 hci_event_packet(hdev, skb);
4103 break;
4104
4105 case HCI_ACLDATA_PKT:
4106 BT_DBG("%s ACL data packet", hdev->name);
4107 hci_acldata_packet(hdev, skb);
4108 break;
4109
4110 case HCI_SCODATA_PKT:
4111 BT_DBG("%s SCO data packet", hdev->name);
4112 hci_scodata_packet(hdev, skb);
4113 break;
4114
26afbd82
LAD		 4115 case HCI_ISODATA_PKT:
4116 BT_DBG("%s ISO data packet", hdev->name);
4117 hci_isodata_packet(hdev, skb);
4118 break;
4119
1da177e4
LT		 4120 default:
4121 kfree_skb(skb);
4122 break;
4123 }
4124 }
1da177e4
LT		 4125}
4126
c347b765 4127static void hci_cmd_work(struct work_struct *work)
1da177e4 4128{
c347b765 4129 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 4130 struct sk_buff *skb;
4131
2104786b
AE		 4132 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4133 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 4134
1da177e4 4135 /* Send queued commands */
5a08ecce
AE		 4136 if (atomic_read(&hdev->cmd_cnt)) {
4137 skb = skb_dequeue(&hdev->cmd_q);
4138 if (!skb)
4139 return;
4140
7585b97a 4141 kfree_skb(hdev->sent_cmd);
1da177e4 4142
a675d7f1 4143 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
70f23020 4144 if (hdev->sent_cmd) {
2250abad 4145 int res;
f80c5dad
JPRV		 4146 if (hci_req_status_pend(hdev))
4147 hci_dev_set_flag(hdev, HCI_CMD_PENDING);
1da177e4 4148 atomic_dec(&hdev->cmd_cnt);
2250abad
BB		 4149
4150 res = hci_send_frame(hdev, skb);
4151 if (res < 0)
744451c1 4152 __hci_cmd_sync_cancel(hdev, -res);
2250abad 4153
deee93d1 4154 rcu_read_lock();
877afada
SS		 4155 if (test_bit(HCI_RESET, &hdev->flags) ||
4156 hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
65cc2b49 4157 cancel_delayed_work(&hdev->cmd_timer);
7bdb8a5c 4158 else
deee93d1
TH		 4159 queue_delayed_work(hdev->workqueue, &hdev->cmd_timer,
4160 HCI_CMD_TIMEOUT);
4161 rcu_read_unlock();
1da177e4
LT		 4162 } else {
4163 skb_queue_head(&hdev->cmd_q, skb);
c347b765 4164 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4165 }
4166 }
4167}
Linux 6.x block layer and io_uring tree(s)