projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: hci_ldisc: check HCI_UART_PROTO_READY flag in HCIUARTGETPROTO
[linux-2.6-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
8c520a59 29#include <linux/rfkill.h>
baf27f6e 30#include <linux/debugfs.h>
99780a7b 31#include <linux/crypto.h>
9f30de9e 32#include <linux/kcov.h>
7a0e5b15 33#include <linux/property.h>
9952d90e
APS		 34#include <linux/suspend.h>
35#include <linux/wait.h>
47219839 36#include <asm/unaligned.h>
1da177e4
LT		 37
38#include <net/bluetooth/bluetooth.h>
39#include <net/bluetooth/hci_core.h>
4bc58f51 40#include <net/bluetooth/l2cap.h>
af58925c 41#include <net/bluetooth/mgmt.h>
1da177e4 42
0857dd3b 43#include "hci_request.h"
60c5f5fb 44#include "hci_debugfs.h"
970c4e46 45#include "smp.h"
6d5d2ee6 46#include "leds.h"
145373cb 47#include "msft.h"
f67743f9 48#include "aosp.h"
8961987f 49#include "hci_codec.h"
970c4e46 50
b78752cc 51static void hci_rx_work(struct work_struct *work);
c347b765 52static void hci_cmd_work(struct work_struct *work);
3eff45ea 53static void hci_tx_work(struct work_struct *work);
1da177e4 54
1da177e4
LT		 55/* HCI device list */
56LIST_HEAD(hci_dev_list);
57DEFINE_RWLOCK(hci_dev_list_lock);
58
59/* HCI callback list */
60LIST_HEAD(hci_cb_list);
fba7ecf0 61DEFINE_MUTEX(hci_cb_list_lock);
1da177e4 62
3df92b31
SL		 63/* HCI ID Numbering */
64static DEFINE_IDA(hci_index_ida);
65
a1d01db1 66static int hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 67{
68 __u8 scan = opt;
69
42c6b129 70 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 71
72 /* Inquiry and Page scans */
42c6b129 73 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
a1d01db1 74 return 0;
1da177e4
LT		 75}
76
a1d01db1 77static int hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 78{
79 __u8 auth = opt;
80
42c6b129 81 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 82
83 /* Authentication */
42c6b129 84 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
a1d01db1 85 return 0;
1da177e4
LT		 86}
87
a1d01db1 88static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 89{
90 __u8 encrypt = opt;
91
42c6b129 92 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 93
e4e8e37c 94 /* Encryption */
42c6b129 95 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
a1d01db1 96 return 0;
1da177e4
LT		 97}
98
a1d01db1 99static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 100{
101 __le16 policy = cpu_to_le16(opt);
102
42c6b129 103 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 104
105 /* Default link policy */
42c6b129 106 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
a1d01db1 107 return 0;
e4e8e37c
MH		 108}
109
8e87d142 110/* Get HCI device by index.
1da177e4
LT		 111 * Device is held on return. */
112struct hci_dev *hci_dev_get(int index)
113{
8035ded4 114 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 115
116 BT_DBG("%d", index);
117
118 if (index < 0)
119 return NULL;
120
121 read_lock(&hci_dev_list_lock);
8035ded4 122 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 123 if (d->id == index) {
124 hdev = hci_dev_hold(d);
125 break;
126 }
127 }
128 read_unlock(&hci_dev_list_lock);
129 return hdev;
130}
1da177e4
LT		 131
132/* ---- Inquiry support ---- */
ff9ef578 133
30dc78e1
JH		 134bool hci_discovery_active(struct hci_dev *hdev)
135{
136 struct discovery_state *discov = &hdev->discovery;
137
6fbe195d 138 switch (discov->state) {
343f935b 139 case DISCOVERY_FINDING:
6fbe195d 140 case DISCOVERY_RESOLVING:
30dc78e1
JH		 141 return true;
142
6fbe195d
AG		 143 default:
144 return false;
145 }
30dc78e1
JH		 146}
147
ff9ef578
JH		 148void hci_discovery_set_state(struct hci_dev *hdev, int state)
149{
bb3e0a33
JH		 150 int old_state = hdev->discovery.state;
151
ff9ef578
JH		 152 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
153
bb3e0a33 154 if (old_state == state)
ff9ef578
JH		 155 return;
156
bb3e0a33
JH		 157 hdev->discovery.state = state;
158
ff9ef578
JH		 159 switch (state) {
160 case DISCOVERY_STOPPED:
5bee2fd6 161 hci_update_passive_scan(hdev);
c54c3860 162
bb3e0a33 163 if (old_state != DISCOVERY_STARTING)
7b99b659 164 mgmt_discovering(hdev, 0);
ff9ef578
JH		 165 break;
166 case DISCOVERY_STARTING:
167 break;
343f935b 168 case DISCOVERY_FINDING:
ff9ef578
JH		 169 mgmt_discovering(hdev, 1);
170 break;
30dc78e1
JH		 171 case DISCOVERY_RESOLVING:
172 break;
ff9ef578
JH		 173 case DISCOVERY_STOPPING:
174 break;
175 }
ff9ef578
JH		 176}
177
1f9b9a5d 178void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 179{
30883512 180 struct discovery_state *cache = &hdev->discovery;
b57c1a56 181 struct inquiry_entry *p, *n;
1da177e4 182
561aafbc
JH		 183 list_for_each_entry_safe(p, n, &cache->all, all) {
184 list_del(&p->all);
b57c1a56 185 kfree(p);
1da177e4 186 }
561aafbc
JH		 187
188 INIT_LIST_HEAD(&cache->unknown);
189 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 190}
191
a8c5fb1a
GP		 192struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
193 bdaddr_t *bdaddr)
1da177e4 194{
30883512 195 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 196 struct inquiry_entry *e;
197
6ed93dc6 198 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 199
561aafbc
JH		 200 list_for_each_entry(e, &cache->all, all) {
201 if (!bacmp(&e->data.bdaddr, bdaddr))
202 return e;
203 }
204
205 return NULL;
206}
207
208struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 209 bdaddr_t *bdaddr)
561aafbc 210{
30883512 211 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 212 struct inquiry_entry *e;
213
6ed93dc6 214 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 215
216 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 217 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 218 return e;
219 }
220
221 return NULL;
1da177e4
LT		 222}
223
30dc78e1 224struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 225 bdaddr_t *bdaddr,
226 int state)
30dc78e1
JH		 227{
228 struct discovery_state *cache = &hdev->discovery;
229 struct inquiry_entry *e;
230
6ed93dc6 231 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 232
233 list_for_each_entry(e, &cache->resolve, list) {
234 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
235 return e;
236 if (!bacmp(&e->data.bdaddr, bdaddr))
237 return e;
238 }
239
240 return NULL;
241}
242
a3d4e20a 243void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 244 struct inquiry_entry *ie)
a3d4e20a
JH		 245{
246 struct discovery_state *cache = &hdev->discovery;
247 struct list_head *pos = &cache->resolve;
248 struct inquiry_entry *p;
249
250 list_del(&ie->list);
251
252 list_for_each_entry(p, &cache->resolve, list) {
253 if (p->name_state != NAME_PENDING &&
a8c5fb1a 254 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 255 break;
256 pos = &p->list;
257 }
258
259 list_add(&ie->list, pos);
260}
261
af58925c
MH		 262u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
263 bool name_known)
1da177e4 264{
30883512 265 struct discovery_state *cache = &hdev->discovery;
70f23020 266 struct inquiry_entry *ie;
af58925c 267 u32 flags = 0;
1da177e4 268
6ed93dc6 269 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 270
6928a924 271 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
2b2fec4d 272
af58925c
MH		 273 if (!data->ssp_mode)
274 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 275
70f23020 276 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 277 if (ie) {
af58925c
MH		 278 if (!ie->data.ssp_mode)
279 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 280
a3d4e20a 281 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 282 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 283 ie->data.rssi = data->rssi;
284 hci_inquiry_cache_update_resolve(hdev, ie);
285 }
286
561aafbc 287 goto update;
a3d4e20a 288 }
561aafbc
JH		 289
290 /* Entry not in the cache. Add new one. */
27f70f3e 291 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
af58925c
MH		 292 if (!ie) {
293 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
294 goto done;
295 }
561aafbc
JH		 296
297 list_add(&ie->all, &cache->all);
298
299 if (name_known) {
300 ie->name_state = NAME_KNOWN;
301 } else {
302 ie->name_state = NAME_NOT_KNOWN;
303 list_add(&ie->list, &cache->unknown);
304 }
70f23020 305
561aafbc
JH		 306update:
307 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 308 ie->name_state != NAME_PENDING) {
561aafbc
JH		 309 ie->name_state = NAME_KNOWN;
310 list_del(&ie->list);
1da177e4
LT		 311 }
312
70f23020
AE		 313 memcpy(&ie->data, data, sizeof(*data));
314 ie->timestamp = jiffies;
1da177e4 315 cache->timestamp = jiffies;
3175405b
JH		 316
317 if (ie->name_state == NAME_NOT_KNOWN)
af58925c 318 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
3175405b 319
af58925c
MH		 320done:
321 return flags;
1da177e4
LT		 322}
323
324static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
325{
30883512 326 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 327 struct inquiry_info *info = (struct inquiry_info *) buf;
328 struct inquiry_entry *e;
329 int copied = 0;
330
561aafbc 331 list_for_each_entry(e, &cache->all, all) {
1da177e4 332 struct inquiry_data *data = &e->data;
b57c1a56
JH		 333
334 if (copied >= num)
335 break;
336
1da177e4
LT		 337 bacpy(&info->bdaddr, &data->bdaddr);
338 info->pscan_rep_mode = data->pscan_rep_mode;
339 info->pscan_period_mode = data->pscan_period_mode;
340 info->pscan_mode = data->pscan_mode;
341 memcpy(info->dev_class, data->dev_class, 3);
342 info->clock_offset = data->clock_offset;
b57c1a56 343
1da177e4 344 info++;
b57c1a56 345 copied++;
1da177e4
LT		 346 }
347
348 BT_DBG("cache %p, copied %d", cache, copied);
349 return copied;
350}
351
a1d01db1 352static int hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 353{
354 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 355 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 356 struct hci_cp_inquiry cp;
357
358 BT_DBG("%s", hdev->name);
359
360 if (test_bit(HCI_INQUIRY, &hdev->flags))
a1d01db1 361 return 0;
1da177e4
LT		 362
363 /* Start Inquiry */
364 memcpy(&cp.lap, &ir->lap, 3);
365 cp.length = ir->length;
366 cp.num_rsp = ir->num_rsp;
42c6b129 367 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
a1d01db1
JH		 368
369 return 0;
1da177e4
LT		 370}
371
372int hci_inquiry(void __user *arg)
373{
374 __u8 __user *ptr = arg;
375 struct hci_inquiry_req ir;
376 struct hci_dev *hdev;
377 int err = 0, do_inquiry = 0, max_rsp;
378 long timeo;
379 __u8 *buf;
380
381 if (copy_from_user(&ir, ptr, sizeof(ir)))
382 return -EFAULT;
383
5a08ecce
AE		 384 hdev = hci_dev_get(ir.dev_id);
385 if (!hdev)
1da177e4
LT		 386 return -ENODEV;
387
d7a5a11d 388 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 389 err = -EBUSY;
390 goto done;
391 }
392
d7a5a11d 393 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 394 err = -EOPNOTSUPP;
395 goto done;
396 }
397
ca8bee5d 398 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 399 err = -EOPNOTSUPP;
400 goto done;
401 }
402
d7a5a11d 403 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 404 err = -EOPNOTSUPP;
405 goto done;
406 }
407
f41a4b2b
PS		 408 /* Restrict maximum inquiry length to 60 seconds */
409 if (ir.length > 60) {
410 err = -EINVAL;
411 goto done;
412 }
413
09fd0de5 414 hci_dev_lock(hdev);
8e87d142 415 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 416 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 417 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 418 do_inquiry = 1;
419 }
09fd0de5 420 hci_dev_unlock(hdev);
1da177e4 421
04837f64 422 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 423
424 if (do_inquiry) {
01178cd4 425 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
4ebeee2d 426 timeo, NULL);
70f23020
AE		 427 if (err < 0)
428 goto done;
3e13fa1e
AG		 429
430 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
431 * cleared). If it is interrupted by a signal, return -EINTR.
432 */
74316201 433 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
28a758c8
PB		 434 TASK_INTERRUPTIBLE)) {
435 err = -EINTR;
436 goto done;
437 }
70f23020 438 }
1da177e4 439
8fc9ced3
GP		 440 /* for unlimited number of responses we will use buffer with
441 * 255 entries
442 */
1da177e4
LT		 443 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
444
445 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
446 * copy it to the user space.
447 */
6da2ec56 448 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
70f23020 449 if (!buf) {
1da177e4
LT		 450 err = -ENOMEM;
451 goto done;
452 }
453
09fd0de5 454 hci_dev_lock(hdev);
1da177e4 455 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 456 hci_dev_unlock(hdev);
1da177e4
LT		 457
458 BT_DBG("num_rsp %d", ir.num_rsp);
459
460 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
461 ptr += sizeof(ir);
462 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 463 ir.num_rsp))
1da177e4 464 err = -EFAULT;
8e87d142 465 } else
1da177e4
LT		 466 err = -EFAULT;
467
468 kfree(buf);
469
470done:
471 hci_dev_put(hdev);
472 return err;
473}
474
cf75ad8b
LAD		 475static int hci_dev_do_open(struct hci_dev *hdev)
476{
477 int ret = 0;
478
479 BT_DBG("%s %p", hdev->name, hdev);
480
481 hci_req_sync_lock(hdev);
482
483 ret = hci_dev_open_sync(hdev);
484
b504430c 485 hci_req_sync_unlock(hdev);
1da177e4
LT		 486 return ret;
487}
488
cbed0ca1
JH		 489/* ---- HCI ioctl helpers ---- */
490
491int hci_dev_open(__u16 dev)
492{
493 struct hci_dev *hdev;
494 int err;
495
496 hdev = hci_dev_get(dev);
497 if (!hdev)
498 return -ENODEV;
499
4a964404 500 /* Devices that are marked as unconfigured can only be powered
fee746b0
MH		 501 * up as user channel. Trying to bring them up as normal devices
502 * will result into a failure. Only user channel operation is
503 * possible.
504 *
505 * When this function is called for a user channel, the flag
506 * HCI_USER_CHANNEL will be set first before attempting to
507 * open the device.
508 */
d7a5a11d
MH		 509 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
510 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
fee746b0
MH		 511 err = -EOPNOTSUPP;
512 goto done;
513 }
514
e1d08f40
JH		 515 /* We need to ensure that no other power on/off work is pending
516 * before proceeding to call hci_dev_do_open. This is
517 * particularly important if the setup procedure has not yet
518 * completed.
519 */
a69d8927 520 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
e1d08f40
JH		 521 cancel_delayed_work(&hdev->power_off);
522
a5c8f270
MH		 523 /* After this call it is guaranteed that the setup procedure
524 * has finished. This means that error conditions like RFKILL
525 * or no valid public or static random address apply.
526 */
e1d08f40
JH		 527 flush_workqueue(hdev->req_workqueue);
528
12aa4f0a 529 /* For controllers not using the management interface and that
b6ae8457 530 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
12aa4f0a
MH		 531 * so that pairing works for them. Once the management interface
532 * is in use this bit will be cleared again and userspace has
533 * to explicitly enable it.
534 */
d7a5a11d
MH		 535 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
536 !hci_dev_test_flag(hdev, HCI_MGMT))
a1536da2 537 hci_dev_set_flag(hdev, HCI_BONDABLE);
12aa4f0a 538
cbed0ca1
JH		 539 err = hci_dev_do_open(hdev);
540
fee746b0 541done:
cbed0ca1 542 hci_dev_put(hdev);
cbed0ca1
JH		 543 return err;
544}
545
cf75ad8b
LAD		 546int hci_dev_do_close(struct hci_dev *hdev)
547{
548 int err;
549
550 BT_DBG("%s %p", hdev->name, hdev);
551
552 hci_req_sync_lock(hdev);
553
554 err = hci_dev_close_sync(hdev);
555
b504430c 556 hci_req_sync_unlock(hdev);
1da177e4 557
61969ef8 558 return err;
1da177e4
LT		 559}
560
561int hci_dev_close(__u16 dev)
562{
563 struct hci_dev *hdev;
564 int err;
565
70f23020
AE		 566 hdev = hci_dev_get(dev);
567 if (!hdev)
1da177e4 568 return -ENODEV;
8ee56540 569
d7a5a11d 570 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 571 err = -EBUSY;
572 goto done;
573 }
574
e36bea6e 575 cancel_work_sync(&hdev->power_on);
a69d8927 576 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
8ee56540
MH		 577 cancel_delayed_work(&hdev->power_off);
578
1da177e4 579 err = hci_dev_do_close(hdev);
8ee56540 580
0736cfa8 581done:
1da177e4
LT		 582 hci_dev_put(hdev);
583 return err;
584}
585
5c912495 586static int hci_dev_do_reset(struct hci_dev *hdev)
1da177e4 587{
5c912495 588 int ret;
1da177e4 589
5c912495 590 BT_DBG("%s %p", hdev->name, hdev);
1da177e4 591
b504430c 592 hci_req_sync_lock(hdev);
1da177e4 593
1da177e4
LT		 594 /* Drop queues */
595 skb_queue_purge(&hdev->rx_q);
596 skb_queue_purge(&hdev->cmd_q);
597
877afada
SS		 598 /* Cancel these to avoid queueing non-chained pending work */
599 hci_dev_set_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
deee93d1
TH		 600 /* Wait for
601 *
602 * if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
603 * queue_delayed_work(&hdev->{cmd,ncmd}_timer)
604 *
605 * inside RCU section to see the flag or complete scheduling.
606 */
607 synchronize_rcu();
608 /* Explicitly cancel works in case scheduled after setting the flag. */
877afada
SS		 609 cancel_delayed_work(&hdev->cmd_timer);
610 cancel_delayed_work(&hdev->ncmd_timer);
611
76727c02
JH		 612 /* Avoid potential lockdep warnings from the *_flush() calls by
613 * ensuring the workqueue is empty up front.
614 */
615 drain_workqueue(hdev->workqueue);
616
09fd0de5 617 hci_dev_lock(hdev);
1f9b9a5d 618 hci_inquiry_cache_flush(hdev);
1da177e4 619 hci_conn_hash_flush(hdev);
09fd0de5 620 hci_dev_unlock(hdev);
1da177e4
LT		 621
622 if (hdev->flush)
623 hdev->flush(hdev);
624
877afada
SS		 625 hci_dev_clear_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
626
8e87d142 627 atomic_set(&hdev->cmd_cnt, 1);
26afbd82
LAD		 628 hdev->acl_cnt = 0;
629 hdev->sco_cnt = 0;
630 hdev->le_cnt = 0;
631 hdev->iso_cnt = 0;
1da177e4 632
d0b13706 633 ret = hci_reset_sync(hdev);
1da177e4 634
b504430c 635 hci_req_sync_unlock(hdev);
1da177e4
LT		 636 return ret;
637}
638
5c912495
MH		 639int hci_dev_reset(__u16 dev)
640{
641 struct hci_dev *hdev;
642 int err;
643
644 hdev = hci_dev_get(dev);
645 if (!hdev)
646 return -ENODEV;
647
648 if (!test_bit(HCI_UP, &hdev->flags)) {
649 err = -ENETDOWN;
650 goto done;
651 }
652
d7a5a11d 653 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
5c912495
MH		 654 err = -EBUSY;
655 goto done;
656 }
657
d7a5a11d 658 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
5c912495
MH		 659 err = -EOPNOTSUPP;
660 goto done;
661 }
662
663 err = hci_dev_do_reset(hdev);
664
665done:
666 hci_dev_put(hdev);
667 return err;
668}
669
1da177e4
LT		 670int hci_dev_reset_stat(__u16 dev)
671{
672 struct hci_dev *hdev;
673 int ret = 0;
674
70f23020
AE		 675 hdev = hci_dev_get(dev);
676 if (!hdev)
1da177e4
LT		 677 return -ENODEV;
678
d7a5a11d 679 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 680 ret = -EBUSY;
681 goto done;
682 }
683
d7a5a11d 684 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 685 ret = -EOPNOTSUPP;
686 goto done;
687 }
688
1da177e4
LT		 689 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
690
0736cfa8 691done:
1da177e4 692 hci_dev_put(hdev);
1da177e4
LT		 693 return ret;
694}
695
5bee2fd6 696static void hci_update_passive_scan_state(struct hci_dev *hdev, u8 scan)
123abc08 697{
bc6d2d04 698 bool conn_changed, discov_changed;
123abc08
JH		 699
700 BT_DBG("%s scan 0x%02x", hdev->name, scan);
701
702 if ((scan & SCAN_PAGE))
238be788
MH		 703 conn_changed = !hci_dev_test_and_set_flag(hdev,
704 HCI_CONNECTABLE);
123abc08 705 else
a69d8927
MH		 706 conn_changed = hci_dev_test_and_clear_flag(hdev,
707 HCI_CONNECTABLE);
123abc08 708
bc6d2d04 709 if ((scan & SCAN_INQUIRY)) {
238be788
MH		 710 discov_changed = !hci_dev_test_and_set_flag(hdev,
711 HCI_DISCOVERABLE);
bc6d2d04 712 } else {
a358dc11 713 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
a69d8927
MH		 714 discov_changed = hci_dev_test_and_clear_flag(hdev,
715 HCI_DISCOVERABLE);
bc6d2d04
JH		 716 }
717
d7a5a11d 718 if (!hci_dev_test_flag(hdev, HCI_MGMT))
123abc08
JH		 719 return;
720
bc6d2d04
JH		 721 if (conn_changed || discov_changed) {
722 /* In case this was disabled through mgmt */
a1536da2 723 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
bc6d2d04 724
d7a5a11d 725 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
651cd3d6 726 hci_update_adv_data(hdev, hdev->cur_adv_instance);
bc6d2d04 727
123abc08 728 mgmt_new_settings(hdev);
bc6d2d04 729 }
123abc08
JH		 730}
731
1da177e4
LT		 732int hci_dev_cmd(unsigned int cmd, void __user *arg)
733{
734 struct hci_dev *hdev;
735 struct hci_dev_req dr;
736 int err = 0;
737
738 if (copy_from_user(&dr, arg, sizeof(dr)))
739 return -EFAULT;
740
70f23020
AE		 741 hdev = hci_dev_get(dr.dev_id);
742 if (!hdev)
1da177e4
LT		 743 return -ENODEV;
744
d7a5a11d 745 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 746 err = -EBUSY;
747 goto done;
748 }
749
d7a5a11d 750 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 751 err = -EOPNOTSUPP;
752 goto done;
753 }
754
ca8bee5d 755 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 756 err = -EOPNOTSUPP;
757 goto done;
758 }
759
d7a5a11d 760 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 761 err = -EOPNOTSUPP;
762 goto done;
763 }
764
1da177e4
LT		 765 switch (cmd) {
766 case HCISETAUTH:
01178cd4 767 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 768 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 769 break;
770
771 case HCISETENCRYPT:
772 if (!lmp_encrypt_capable(hdev)) {
773 err = -EOPNOTSUPP;
774 break;
775 }
776
777 if (!test_bit(HCI_AUTH, &hdev->flags)) {
778 /* Auth must be enabled first */
01178cd4 779 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 780 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 781 if (err)
782 break;
783 }
784
01178cd4 785 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
4ebeee2d 786 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 787 break;
788
789 case HCISETSCAN:
01178cd4 790 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
4ebeee2d 791 HCI_INIT_TIMEOUT, NULL);
91a668b0 792
bc6d2d04
JH		 793 /* Ensure that the connectable and discoverable states
794 * get correctly modified as this was a non-mgmt change.
91a668b0 795 */
123abc08 796 if (!err)
5bee2fd6 797 hci_update_passive_scan_state(hdev, dr.dev_opt);
1da177e4
LT		 798 break;
799
1da177e4 800 case HCISETLINKPOL:
01178cd4 801 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
4ebeee2d 802 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 803 break;
804
805 case HCISETLINKMODE:
e4e8e37c
MH		 806 hdev->link_mode = ((__u16) dr.dev_opt) &
807 (HCI_LM_MASTER | HCI_LM_ACCEPT);
808 break;
809
810 case HCISETPTYPE:
b7c23df8
JK		 811 if (hdev->pkt_type == (__u16) dr.dev_opt)
812 break;
813
e4e8e37c 814 hdev->pkt_type = (__u16) dr.dev_opt;
b7c23df8 815 mgmt_phy_configuration_changed(hdev, NULL);
1da177e4
LT		 816 break;
817
818 case HCISETACLMTU:
e4e8e37c
MH		 819 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
820 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 821 break;
822
823 case HCISETSCOMTU:
e4e8e37c
MH		 824 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
825 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 826 break;
827
828 default:
829 err = -EINVAL;
830 break;
831 }
e4e8e37c 832
0736cfa8 833done:
1da177e4
LT		 834 hci_dev_put(hdev);
835 return err;
836}
837
838int hci_get_dev_list(void __user *arg)
839{
8035ded4 840 struct hci_dev *hdev;
1da177e4
LT		 841 struct hci_dev_list_req *dl;
842 struct hci_dev_req *dr;
1da177e4
LT		 843 int n = 0, size, err;
844 __u16 dev_num;
845
846 if (get_user(dev_num, (__u16 __user *) arg))
847 return -EFAULT;
848
849 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
850 return -EINVAL;
851
852 size = sizeof(*dl) + dev_num * sizeof(*dr);
853
70f23020
AE		 854 dl = kzalloc(size, GFP_KERNEL);
855 if (!dl)
1da177e4
LT		 856 return -ENOMEM;
857
858 dr = dl->dev_req;
859
f20d09d5 860 read_lock(&hci_dev_list_lock);
8035ded4 861 list_for_each_entry(hdev, &hci_dev_list, list) {
2e84d8db 862 unsigned long flags = hdev->flags;
c542a06c 863
2e84d8db
MH		 864 /* When the auto-off is configured it means the transport
865 * is running, but in that case still indicate that the
866 * device is actually down.
867 */
d7a5a11d 868 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db 869 flags &= ~BIT(HCI_UP);
c542a06c 870
1da177e4 871 (dr + n)->dev_id = hdev->id;
2e84d8db 872 (dr + n)->dev_opt = flags;
c542a06c 873
1da177e4
LT		 874 if (++n >= dev_num)
875 break;
876 }
f20d09d5 877 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 878
879 dl->dev_num = n;
880 size = sizeof(*dl) + n * sizeof(*dr);
881
882 err = copy_to_user(arg, dl, size);
883 kfree(dl);
884
885 return err ? -EFAULT : 0;
886}
887
888int hci_get_dev_info(void __user *arg)
889{
890 struct hci_dev *hdev;
891 struct hci_dev_info di;
2e84d8db 892 unsigned long flags;
1da177e4
LT		 893 int err = 0;
894
895 if (copy_from_user(&di, arg, sizeof(di)))
896 return -EFAULT;
897
70f23020
AE		 898 hdev = hci_dev_get(di.dev_id);
899 if (!hdev)
1da177e4
LT		 900 return -ENODEV;
901
2e84d8db
MH		 902 /* When the auto-off is configured it means the transport
903 * is running, but in that case still indicate that the
904 * device is actually down.
905 */
d7a5a11d 906 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db
MH		 907 flags = hdev->flags & ~BIT(HCI_UP);
908 else
909 flags = hdev->flags;
c542a06c 910
1da177e4
LT		 911 strcpy(di.name, hdev->name);
912 di.bdaddr = hdev->bdaddr;
60f2a3ed 913 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2e84d8db 914 di.flags = flags;
1da177e4 915 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 916 if (lmp_bredr_capable(hdev)) {
917 di.acl_mtu = hdev->acl_mtu;
918 di.acl_pkts = hdev->acl_pkts;
919 di.sco_mtu = hdev->sco_mtu;
920 di.sco_pkts = hdev->sco_pkts;
921 } else {
922 di.acl_mtu = hdev->le_mtu;
923 di.acl_pkts = hdev->le_pkts;
924 di.sco_mtu = 0;
925 di.sco_pkts = 0;
926 }
1da177e4
LT		 927 di.link_policy = hdev->link_policy;
928 di.link_mode = hdev->link_mode;
929
930 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
931 memcpy(&di.features, &hdev->features, sizeof(di.features));
932
933 if (copy_to_user(arg, &di, sizeof(di)))
934 err = -EFAULT;
935
936 hci_dev_put(hdev);
937
938 return err;
939}
940
941/* ---- Interface to HCI drivers ---- */
942
611b30f7
MH		 943static int hci_rfkill_set_block(void *data, bool blocked)
944{
945 struct hci_dev *hdev = data;
946
947 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
948
d7a5a11d 949 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
0736cfa8
MH		 950 return -EBUSY;
951
5e130367 952 if (blocked) {
a1536da2 953 hci_dev_set_flag(hdev, HCI_RFKILLED);
d7a5a11d
MH		 954 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
955 !hci_dev_test_flag(hdev, HCI_CONFIG))
bf543036 956 hci_dev_do_close(hdev);
5e130367 957 } else {
a358dc11 958 hci_dev_clear_flag(hdev, HCI_RFKILLED);
1025c04c 959 }
611b30f7
MH		 960
961 return 0;
962}
963
964static const struct rfkill_ops hci_rfkill_ops = {
965 .set_block = hci_rfkill_set_block,
966};
967
ab81cbf9
JH		 968static void hci_power_on(struct work_struct *work)
969{
970 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 971 int err;
ab81cbf9
JH		 972
973 BT_DBG("%s", hdev->name);
974
2ff13894
JH		 975 if (test_bit(HCI_UP, &hdev->flags) &&
976 hci_dev_test_flag(hdev, HCI_MGMT) &&
977 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
d82142a8 978 cancel_delayed_work(&hdev->power_off);
cf75ad8b 979 err = hci_powered_update_sync(hdev);
2ff13894
JH		 980 mgmt_power_on(hdev, err);
981 return;
982 }
983
cbed0ca1 984 err = hci_dev_do_open(hdev);
96570ffc 985 if (err < 0) {
3ad67582 986 hci_dev_lock(hdev);
96570ffc 987 mgmt_set_powered_failed(hdev, err);
3ad67582 988 hci_dev_unlock(hdev);
ab81cbf9 989 return;
96570ffc 990 }
ab81cbf9 991
a5c8f270
MH		 992 /* During the HCI setup phase, a few error conditions are
993 * ignored and they need to be checked now. If they are still
994 * valid, it is important to turn the device back off.
995 */
d7a5a11d
MH		 996 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
997 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
ca8bee5d 998 (hdev->dev_type == HCI_PRIMARY &&
a5c8f270
MH		 999 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1000 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
a358dc11 1001 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
bf543036 1002 hci_dev_do_close(hdev);
d7a5a11d 1003 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
19202573
JH		 1004 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1005 HCI_AUTO_OFF_TIMEOUT);
bf543036 1006 }
ab81cbf9 1007
a69d8927 1008 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
4a964404
MH		 1009 /* For unconfigured devices, set the HCI_RAW flag
1010 * so that userspace can easily identify them.
4a964404 1011 */
d7a5a11d 1012 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4a964404 1013 set_bit(HCI_RAW, &hdev->flags);
0602a8ad
MH		 1014
1015 /* For fully configured devices, this will send
1016 * the Index Added event. For unconfigured devices,
1017 * it will send Unconfigued Index Added event.
1018 *
1019 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
1020 * and no event will be send.
1021 */
1022 mgmt_index_added(hdev);
a69d8927 1023 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
5ea234d3
MH		 1024 /* When the controller is now configured, then it
1025 * is important to clear the HCI_RAW flag.
1026 */
d7a5a11d 1027 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5ea234d3
MH		 1028 clear_bit(HCI_RAW, &hdev->flags);
1029
d603b76b
MH		 1030 /* Powering on the controller with HCI_CONFIG set only
1031 * happens with the transition from unconfigured to
1032 * configured. This will send the Index Added event.
1033 */
744cf19e 1034 mgmt_index_added(hdev);
fee746b0 1035 }
ab81cbf9
JH		 1036}
1037
1038static void hci_power_off(struct work_struct *work)
1039{
3243553f 1040 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 1041 power_off.work);
ab81cbf9
JH		 1042
1043 BT_DBG("%s", hdev->name);
1044
8ee56540 1045 hci_dev_do_close(hdev);
ab81cbf9
JH		 1046}
1047
c7741d16
MH		 1048static void hci_error_reset(struct work_struct *work)
1049{
1050 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
1051
1052 BT_DBG("%s", hdev->name);
1053
1054 if (hdev->hw_error)
1055 hdev->hw_error(hdev, hdev->hw_error_code);
1056 else
2064ee33 1057 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
c7741d16
MH		 1058
1059 if (hci_dev_do_close(hdev))
1060 return;
1061
c7741d16
MH		 1062 hci_dev_do_open(hdev);
1063}
1064
35f7498a 1065void hci_uuids_clear(struct hci_dev *hdev)
2aeb9a1a 1066{
4821002c 1067 struct bt_uuid *uuid, *tmp;
2aeb9a1a 1068
4821002c
JH		 1069 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1070 list_del(&uuid->list);
2aeb9a1a
JH		 1071 kfree(uuid);
1072 }
2aeb9a1a
JH		 1073}
1074
35f7498a 1075void hci_link_keys_clear(struct hci_dev *hdev)
55ed8ca1 1076{
0378b597 1077 struct link_key *key;
55ed8ca1 1078
d7d41682 1079 list_for_each_entry(key, &hdev->link_keys, list) {
0378b597
JH		 1080 list_del_rcu(&key->list);
1081 kfree_rcu(key, rcu);
55ed8ca1 1082 }
55ed8ca1
JH		 1083}
1084
35f7498a 1085void hci_smp_ltks_clear(struct hci_dev *hdev)
b899efaf 1086{
970d0f1b 1087 struct smp_ltk *k;
b899efaf 1088
d7d41682 1089 list_for_each_entry(k, &hdev->long_term_keys, list) {
970d0f1b
JH		 1090 list_del_rcu(&k->list);
1091 kfree_rcu(k, rcu);
b899efaf 1092 }
b899efaf
VCG		 1093}
1094
970c4e46
JH		 1095void hci_smp_irks_clear(struct hci_dev *hdev)
1096{
adae20cb 1097 struct smp_irk *k;
970c4e46 1098
d7d41682 1099 list_for_each_entry(k, &hdev->identity_resolving_keys, list) {
adae20cb
JH		 1100 list_del_rcu(&k->list);
1101 kfree_rcu(k, rcu);
970c4e46
JH		 1102 }
1103}
1104
600a8749
AM		 1105void hci_blocked_keys_clear(struct hci_dev *hdev)
1106{
1107 struct blocked_key *b;
1108
d7d41682 1109 list_for_each_entry(b, &hdev->blocked_keys, list) {
600a8749
AM		 1110 list_del_rcu(&b->list);
1111 kfree_rcu(b, rcu);
1112 }
1113}
1114
1115bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
1116{
1117 bool blocked = false;
1118 struct blocked_key *b;
1119
1120 rcu_read_lock();
0c2ac7d4 1121 list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
600a8749
AM		 1122 if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
1123 blocked = true;
1124 break;
1125 }
1126 }
1127
1128 rcu_read_unlock();
1129 return blocked;
1130}
1131
55ed8ca1
JH		 1132struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1133{
8035ded4 1134 struct link_key *k;
55ed8ca1 1135
0378b597
JH		 1136 rcu_read_lock();
1137 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
1138 if (bacmp(bdaddr, &k->bdaddr) == 0) {
1139 rcu_read_unlock();
600a8749
AM		 1140
1141 if (hci_is_blocked_key(hdev,
1142 HCI_BLOCKED_KEY_TYPE_LINKKEY,
1143 k->val)) {
1144 bt_dev_warn_ratelimited(hdev,
1145 "Link key blocked for %pMR",
1146 &k->bdaddr);
1147 return NULL;
1148 }
1149
55ed8ca1 1150 return k;
0378b597
JH		 1151 }
1152 }
1153 rcu_read_unlock();
55ed8ca1
JH		 1154
1155 return NULL;
1156}
1157
745c0ce3 1158static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 1159 u8 key_type, u8 old_key_type)
d25e28ab
JH		 1160{
1161 /* Legacy key */
1162 if (key_type < 0x03)
745c0ce3 1163 return true;
d25e28ab
JH		 1164
1165 /* Debug keys are insecure so don't store them persistently */
1166 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 1167 return false;
d25e28ab
JH		 1168
1169 /* Changed combination key and there's no previous one */
1170 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 1171 return false;
d25e28ab
JH		 1172
1173 /* Security mode 3 case */
1174 if (!conn)
745c0ce3 1175 return true;
d25e28ab 1176
e3befab9
JH		 1177 /* BR/EDR key derived using SC from an LE link */
1178 if (conn->type == LE_LINK)
1179 return true;
1180
d25e28ab
JH		 1181 /* Neither local nor remote side had no-bonding as requirement */
1182 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 1183 return true;
d25e28ab
JH		 1184
1185 /* Local side had dedicated bonding as requirement */
1186 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 1187 return true;
d25e28ab
JH		 1188
1189 /* Remote side had dedicated bonding as requirement */
1190 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 1191 return true;
d25e28ab
JH		 1192
1193 /* If none of the above criteria match, then don't store the key
1194 * persistently */
745c0ce3 1195 return false;
d25e28ab
JH		 1196}
1197
e804d25d 1198static u8 ltk_role(u8 type)
98a0b845 1199{
e804d25d
JH		 1200 if (type == SMP_LTK)
1201 return HCI_ROLE_MASTER;
98a0b845 1202
e804d25d 1203 return HCI_ROLE_SLAVE;
98a0b845
JH		 1204}
1205
f3a73d97
JH		 1206struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1207 u8 addr_type, u8 role)
75d262c2 1208{
c9839a11 1209 struct smp_ltk *k;
75d262c2 1210
970d0f1b
JH		 1211 rcu_read_lock();
1212 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
5378bc56
JH		 1213 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
1214 continue;
1215
923e2414 1216 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
970d0f1b 1217 rcu_read_unlock();
600a8749
AM		 1218
1219 if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
1220 k->val)) {
1221 bt_dev_warn_ratelimited(hdev,
1222 "LTK blocked for %pMR",
1223 &k->bdaddr);
1224 return NULL;
1225 }
1226
75d262c2 1227 return k;
970d0f1b
JH		 1228 }
1229 }
1230 rcu_read_unlock();
75d262c2
VCG		 1231
1232 return NULL;
1233}
75d262c2 1234
970c4e46
JH		 1235struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
1236{
600a8749 1237 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 1238 struct smp_irk *irk;
1239
adae20cb
JH		 1240 rcu_read_lock();
1241 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
1242 if (!bacmp(&irk->rpa, rpa)) {
600a8749
AM		 1243 irk_to_return = irk;
1244 goto done;
adae20cb 1245 }
970c4e46
JH		 1246 }
1247
adae20cb 1248 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
defce9e8 1249 if (smp_irk_matches(hdev, irk->val, rpa)) {
970c4e46 1250 bacpy(&irk->rpa, rpa);
600a8749
AM		 1251 irk_to_return = irk;
1252 goto done;
970c4e46
JH		 1253 }
1254 }
600a8749
AM		 1255
1256done:
1257 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1258 irk_to_return->val)) {
1259 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1260 &irk_to_return->bdaddr);
1261 irk_to_return = NULL;
1262 }
1263
adae20cb 1264 rcu_read_unlock();
970c4e46 1265
600a8749 1266 return irk_to_return;
970c4e46
JH		 1267}
1268
1269struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1270 u8 addr_type)
1271{
600a8749 1272 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 1273 struct smp_irk *irk;
1274
6cfc9988
JH		 1275 /* Identity Address must be public or static random */
1276 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
1277 return NULL;
1278
adae20cb
JH		 1279 rcu_read_lock();
1280 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
970c4e46 1281 if (addr_type == irk->addr_type &&
adae20cb 1282 bacmp(bdaddr, &irk->bdaddr) == 0) {
600a8749
AM		 1283 irk_to_return = irk;
1284 goto done;
adae20cb 1285 }
970c4e46 1286 }
600a8749
AM		 1287
1288done:
1289
1290 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1291 irk_to_return->val)) {
1292 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1293 &irk_to_return->bdaddr);
1294 irk_to_return = NULL;
1295 }
1296
adae20cb 1297 rcu_read_unlock();
970c4e46 1298
600a8749 1299 return irk_to_return;
970c4e46
JH		 1300}
1301
567fa2aa 1302struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
7652ff6a
JH		 1303 bdaddr_t *bdaddr, u8 *val, u8 type,
1304 u8 pin_len, bool *persistent)
55ed8ca1
JH		 1305{
1306 struct link_key *key, *old_key;
745c0ce3 1307 u8 old_key_type;
55ed8ca1
JH		 1308
1309 old_key = hci_find_link_key(hdev, bdaddr);
1310 if (old_key) {
1311 old_key_type = old_key->type;
1312 key = old_key;
1313 } else {
12adcf3a 1314 old_key_type = conn ? conn->key_type : 0xff;
0a14ab41 1315 key = kzalloc(sizeof(*key), GFP_KERNEL);
55ed8ca1 1316 if (!key)
567fa2aa 1317 return NULL;
0378b597 1318 list_add_rcu(&key->list, &hdev->link_keys);
55ed8ca1
JH		 1319 }
1320
6ed93dc6 1321 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 1322
d25e28ab
JH		 1323 /* Some buggy controller combinations generate a changed
1324 * combination key for legacy pairing even when there's no
1325 * previous key */
1326 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 1327 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 1328 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1329 if (conn)
1330 conn->key_type = type;
1331 }
d25e28ab 1332
55ed8ca1 1333 bacpy(&key->bdaddr, bdaddr);
9b3b4460 1334 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 1335 key->pin_len = pin_len;
1336
b6020ba0 1337 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1338 key->type = old_key_type;
4748fed2
JH		 1339 else
1340 key->type = type;
1341
7652ff6a
JH		 1342 if (persistent)
1343 *persistent = hci_persistent_key(hdev, conn, type,
1344 old_key_type);
4df378a1 1345
567fa2aa 1346 return key;
55ed8ca1
JH		 1347}
1348
ca9142b8 1349struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
35d70271 1350 u8 addr_type, u8 type, u8 authenticated,
fe39c7b2 1351 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
75d262c2 1352{
c9839a11 1353 struct smp_ltk *key, *old_key;
e804d25d 1354 u8 role = ltk_role(type);
75d262c2 1355
f3a73d97 1356 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
c9839a11 1357 if (old_key)
75d262c2 1358 key = old_key;
c9839a11 1359 else {
0a14ab41 1360 key = kzalloc(sizeof(*key), GFP_KERNEL);
75d262c2 1361 if (!key)
ca9142b8 1362 return NULL;
970d0f1b 1363 list_add_rcu(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 1364 }
1365
75d262c2 1366 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 1367 key->bdaddr_type = addr_type;
1368 memcpy(key->val, tk, sizeof(key->val));
1369 key->authenticated = authenticated;
1370 key->ediv = ediv;
fe39c7b2 1371 key->rand = rand;
c9839a11
VCG		 1372 key->enc_size = enc_size;
1373 key->type = type;
75d262c2 1374
ca9142b8 1375 return key;
75d262c2
VCG		 1376}
1377
ca9142b8
JH		 1378struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1379 u8 addr_type, u8 val[16], bdaddr_t *rpa)
970c4e46
JH		 1380{
1381 struct smp_irk *irk;
1382
1383 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
1384 if (!irk) {
1385 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
1386 if (!irk)
ca9142b8 1387 return NULL;
970c4e46
JH		 1388
1389 bacpy(&irk->bdaddr, bdaddr);
1390 irk->addr_type = addr_type;
1391
adae20cb 1392 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
970c4e46
JH		 1393 }
1394
1395 memcpy(irk->val, val, 16);
1396 bacpy(&irk->rpa, rpa);
1397
ca9142b8 1398 return irk;
970c4e46
JH		 1399}
1400
55ed8ca1
JH		 1401int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1402{
1403 struct link_key *key;
1404
1405 key = hci_find_link_key(hdev, bdaddr);
1406 if (!key)
1407 return -ENOENT;
1408
6ed93dc6 1409 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1 1410
0378b597
JH		 1411 list_del_rcu(&key->list);
1412 kfree_rcu(key, rcu);
55ed8ca1
JH		 1413
1414 return 0;
1415}
1416
e0b2b27e 1417int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
b899efaf 1418{
c5d2b6fa 1419 struct smp_ltk *k, *tmp;
c51ffa0b 1420 int removed = 0;
b899efaf 1421
c5d2b6fa 1422 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
e0b2b27e 1423 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
b899efaf
VCG		 1424 continue;
1425
6ed93dc6 1426 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf 1427
970d0f1b
JH		 1428 list_del_rcu(&k->list);
1429 kfree_rcu(k, rcu);
c51ffa0b 1430 removed++;
b899efaf
VCG		 1431 }
1432
c51ffa0b 1433 return removed ? 0 : -ENOENT;
b899efaf
VCG		 1434}
1435
a7ec7338
JH		 1436void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
1437{
c5d2b6fa 1438 struct smp_irk *k, *tmp;
a7ec7338 1439
c5d2b6fa 1440 list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
a7ec7338
JH		 1441 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
1442 continue;
1443
1444 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1445
adae20cb
JH		 1446 list_del_rcu(&k->list);
1447 kfree_rcu(k, rcu);
a7ec7338
JH		 1448 }
1449}
1450
55e76b38
JH		 1451bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1452{
1453 struct smp_ltk *k;
4ba9faf3 1454 struct smp_irk *irk;
55e76b38
JH		 1455 u8 addr_type;
1456
1457 if (type == BDADDR_BREDR) {
1458 if (hci_find_link_key(hdev, bdaddr))
1459 return true;
1460 return false;
1461 }
1462
1463 /* Convert to HCI addr type which struct smp_ltk uses */
1464 if (type == BDADDR_LE_PUBLIC)
1465 addr_type = ADDR_LE_DEV_PUBLIC;
1466 else
1467 addr_type = ADDR_LE_DEV_RANDOM;
1468
4ba9faf3
JH		 1469 irk = hci_get_irk(hdev, bdaddr, addr_type);
1470 if (irk) {
1471 bdaddr = &irk->bdaddr;
1472 addr_type = irk->addr_type;
1473 }
1474
55e76b38
JH		 1475 rcu_read_lock();
1476 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
87c8b28d
JH		 1477 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
1478 rcu_read_unlock();
55e76b38 1479 return true;
87c8b28d 1480 }
55e76b38
JH		 1481 }
1482 rcu_read_unlock();
1483
1484 return false;
1485}
1486
6bd32326 1487/* HCI command timer function */
65cc2b49 1488static void hci_cmd_timeout(struct work_struct *work)
6bd32326 1489{
65cc2b49
MH		 1490 struct hci_dev *hdev = container_of(work, struct hci_dev,
1491 cmd_timer.work);
6bd32326 1492
bda4f23a
AE		 1493 if (hdev->sent_cmd) {
1494 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1495 u16 opcode = __le16_to_cpu(sent->opcode);
1496
2064ee33 1497 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
bda4f23a 1498 } else {
2064ee33 1499 bt_dev_err(hdev, "command tx timeout");
bda4f23a
AE		 1500 }
1501
e2bef384
RJ		 1502 if (hdev->cmd_timeout)
1503 hdev->cmd_timeout(hdev);
1504
6bd32326 1505 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1506 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1507}
1508
de75cd0d
MM		 1509/* HCI ncmd timer function */
1510static void hci_ncmd_timeout(struct work_struct *work)
1511{
1512 struct hci_dev *hdev = container_of(work, struct hci_dev,
1513 ncmd_timer.work);
1514
1515 bt_dev_err(hdev, "Controller not accepting commands anymore: ncmd = 0");
1516
1517 /* During HCI_INIT phase no events can be injected if the ncmd timer
1518 * triggers since the procedure has its own timeout handling.
1519 */
1520 if (test_bit(HCI_INIT, &hdev->flags))
1521 return;
1522
1523 /* This is an irrecoverable state, inject hardware error event */
1524 hci_reset_dev(hdev);
1525}
1526
2763eda6 1527struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
6928a924 1528 bdaddr_t *bdaddr, u8 bdaddr_type)
2763eda6
SJ		 1529{
1530 struct oob_data *data;
1531
6928a924
JH		 1532 list_for_each_entry(data, &hdev->remote_oob_data, list) {
1533 if (bacmp(bdaddr, &data->bdaddr) != 0)
1534 continue;
1535 if (data->bdaddr_type != bdaddr_type)
1536 continue;
1537 return data;
1538 }
2763eda6
SJ		 1539
1540 return NULL;
1541}
1542
6928a924
JH		 1543int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
1544 u8 bdaddr_type)
2763eda6
SJ		 1545{
1546 struct oob_data *data;
1547
6928a924 1548 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6
SJ		 1549 if (!data)
1550 return -ENOENT;
1551
6928a924 1552 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2763eda6
SJ		 1553
1554 list_del(&data->list);
1555 kfree(data);
1556
1557 return 0;
1558}
1559
35f7498a 1560void hci_remote_oob_data_clear(struct hci_dev *hdev)
2763eda6
SJ		 1561{
1562 struct oob_data *data, *n;
1563
1564 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1565 list_del(&data->list);
1566 kfree(data);
1567 }
2763eda6
SJ		 1568}
1569
0798872e 1570int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
6928a924 1571 u8 bdaddr_type, u8 *hash192, u8 *rand192,
81328d5c 1572 u8 *hash256, u8 *rand256)
2763eda6
SJ		 1573{
1574 struct oob_data *data;
1575
6928a924 1576 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6 1577 if (!data) {
0a14ab41 1578 data = kmalloc(sizeof(*data), GFP_KERNEL);
2763eda6
SJ		 1579 if (!data)
1580 return -ENOMEM;
1581
1582 bacpy(&data->bdaddr, bdaddr);
6928a924 1583 data->bdaddr_type = bdaddr_type;
2763eda6
SJ		 1584 list_add(&data->list, &hdev->remote_oob_data);
1585 }
1586
81328d5c
JH		 1587 if (hash192 && rand192) {
1588 memcpy(data->hash192, hash192, sizeof(data->hash192));
1589 memcpy(data->rand192, rand192, sizeof(data->rand192));
f7697b16
MH		 1590 if (hash256 && rand256)
1591 data->present = 0x03;
81328d5c
JH		 1592 } else {
1593 memset(data->hash192, 0, sizeof(data->hash192));
1594 memset(data->rand192, 0, sizeof(data->rand192));
f7697b16
MH		 1595 if (hash256 && rand256)
1596 data->present = 0x02;
1597 else
1598 data->present = 0x00;
0798872e
MH		 1599 }
1600
81328d5c
JH		 1601 if (hash256 && rand256) {
1602 memcpy(data->hash256, hash256, sizeof(data->hash256));
1603 memcpy(data->rand256, rand256, sizeof(data->rand256));
1604 } else {
1605 memset(data->hash256, 0, sizeof(data->hash256));
1606 memset(data->rand256, 0, sizeof(data->rand256));
f7697b16
MH		 1607 if (hash192 && rand192)
1608 data->present = 0x01;
81328d5c 1609 }
0798872e 1610
6ed93dc6 1611 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1612
1613 return 0;
1614}
1615
d2609b34
FG		 1616/* This function requires the caller holds hdev->lock */
1617struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
1618{
1619 struct adv_info *adv_instance;
1620
1621 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
1622 if (adv_instance->instance == instance)
1623 return adv_instance;
1624 }
1625
1626 return NULL;
1627}
1628
1629/* This function requires the caller holds hdev->lock */
74b93e9f
PK		 1630struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
1631{
d2609b34
FG		 1632 struct adv_info *cur_instance;
1633
1634 cur_instance = hci_find_adv_instance(hdev, instance);
1635 if (!cur_instance)
1636 return NULL;
1637
1638 if (cur_instance == list_last_entry(&hdev->adv_instances,
1639 struct adv_info, list))
1640 return list_first_entry(&hdev->adv_instances,
1641 struct adv_info, list);
1642 else
1643 return list_next_entry(cur_instance, list);
1644}
1645
1646/* This function requires the caller holds hdev->lock */
1647int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
1648{
1649 struct adv_info *adv_instance;
1650
1651 adv_instance = hci_find_adv_instance(hdev, instance);
1652 if (!adv_instance)
1653 return -ENOENT;
1654
1655 BT_DBG("%s removing %dMR", hdev->name, instance);
1656
cab054ab
JH		 1657 if (hdev->cur_adv_instance == instance) {
1658 if (hdev->adv_instance_timeout) {
1659 cancel_delayed_work(&hdev->adv_instance_expire);
1660 hdev->adv_instance_timeout = 0;
1661 }
1662 hdev->cur_adv_instance = 0x00;
5d900e46
FG		 1663 }
1664
a73c046a
JK		 1665 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1666
d2609b34
FG		 1667 list_del(&adv_instance->list);
1668 kfree(adv_instance);
1669
1670 hdev->adv_instance_cnt--;
1671
1672 return 0;
1673}
1674
a73c046a
JK		 1675void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
1676{
1677 struct adv_info *adv_instance, *n;
1678
1679 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
1680 adv_instance->rpa_expired = rpa_expired;
1681}
1682
d2609b34
FG		 1683/* This function requires the caller holds hdev->lock */
1684void hci_adv_instances_clear(struct hci_dev *hdev)
1685{
1686 struct adv_info *adv_instance, *n;
1687
5d900e46
FG		 1688 if (hdev->adv_instance_timeout) {
1689 cancel_delayed_work(&hdev->adv_instance_expire);
1690 hdev->adv_instance_timeout = 0;
1691 }
1692
d2609b34 1693 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
a73c046a 1694 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
d2609b34
FG		 1695 list_del(&adv_instance->list);
1696 kfree(adv_instance);
1697 }
1698
1699 hdev->adv_instance_cnt = 0;
cab054ab 1700 hdev->cur_adv_instance = 0x00;
d2609b34
FG		 1701}
1702
a73c046a
JK		 1703static void adv_instance_rpa_expired(struct work_struct *work)
1704{
1705 struct adv_info *adv_instance = container_of(work, struct adv_info,
1706 rpa_expired_cb.work);
1707
1708 BT_DBG("");
1709
1710 adv_instance->rpa_expired = true;
1711}
1712
d2609b34 1713/* This function requires the caller holds hdev->lock */
eca0ae4a
LAD		 1714struct adv_info *hci_add_adv_instance(struct hci_dev *hdev, u8 instance,
1715 u32 flags, u16 adv_data_len, u8 *adv_data,
1716 u16 scan_rsp_len, u8 *scan_rsp_data,
1717 u16 timeout, u16 duration, s8 tx_power,
b338d917
BG		 1718 u32 min_interval, u32 max_interval,
1719 u8 mesh_handle)
d2609b34 1720{
eca0ae4a 1721 struct adv_info *adv;
d2609b34 1722
eca0ae4a
LAD		 1723 adv = hci_find_adv_instance(hdev, instance);
1724 if (adv) {
1725 memset(adv->adv_data, 0, sizeof(adv->adv_data));
1726 memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1727 memset(adv->per_adv_data, 0, sizeof(adv->per_adv_data));
d2609b34 1728 } else {
1d0fac2c 1729 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
b338d917 1730 instance < 1 || instance > hdev->le_num_of_adv_sets + 1)
eca0ae4a 1731 return ERR_PTR(-EOVERFLOW);
d2609b34 1732
eca0ae4a
LAD		 1733 adv = kzalloc(sizeof(*adv), GFP_KERNEL);
1734 if (!adv)
1735 return ERR_PTR(-ENOMEM);
d2609b34 1736
eca0ae4a
LAD		 1737 adv->pending = true;
1738 adv->instance = instance;
1739 list_add(&adv->list, &hdev->adv_instances);
d2609b34
FG		 1740 hdev->adv_instance_cnt++;
1741 }
1742
eca0ae4a
LAD		 1743 adv->flags = flags;
1744 adv->min_interval = min_interval;
1745 adv->max_interval = max_interval;
1746 adv->tx_power = tx_power;
b338d917
BG		 1747 /* Defining a mesh_handle changes the timing units to ms,
1748 * rather than seconds, and ties the instance to the requested
1749 * mesh_tx queue.
1750 */
1751 adv->mesh = mesh_handle;
d2609b34 1752
34a718bc
LAD		 1753 hci_set_adv_instance_data(hdev, instance, adv_data_len, adv_data,
1754 scan_rsp_len, scan_rsp_data);
d2609b34 1755
eca0ae4a
LAD		 1756 adv->timeout = timeout;
1757 adv->remaining_time = timeout;
d2609b34
FG		 1758
1759 if (duration == 0)
eca0ae4a 1760 adv->duration = hdev->def_multi_adv_rotation_duration;
d2609b34 1761 else
eca0ae4a 1762 adv->duration = duration;
d2609b34 1763
eca0ae4a 1764 INIT_DELAYED_WORK(&adv->rpa_expired_cb, adv_instance_rpa_expired);
a73c046a 1765
d2609b34
FG		 1766 BT_DBG("%s for %dMR", hdev->name, instance);
1767
eca0ae4a
LAD		 1768 return adv;
1769}
1770
1771/* This function requires the caller holds hdev->lock */
1772struct adv_info *hci_add_per_instance(struct hci_dev *hdev, u8 instance,
1773 u32 flags, u8 data_len, u8 *data,
1774 u32 min_interval, u32 max_interval)
1775{
1776 struct adv_info *adv;
1777
1778 adv = hci_add_adv_instance(hdev, instance, flags, 0, NULL, 0, NULL,
1779 0, 0, HCI_ADV_TX_POWER_NO_PREFERENCE,
b338d917 1780 min_interval, max_interval, 0);
eca0ae4a
LAD		 1781 if (IS_ERR(adv))
1782 return adv;
1783
1784 adv->periodic = true;
1785 adv->per_adv_data_len = data_len;
1786
1787 if (data)
1788 memcpy(adv->per_adv_data, data, data_len);
1789
1790 return adv;
d2609b34
FG		 1791}
1792
31aab5c2
DW		 1793/* This function requires the caller holds hdev->lock */
1794int hci_set_adv_instance_data(struct hci_dev *hdev, u8 instance,
1795 u16 adv_data_len, u8 *adv_data,
1796 u16 scan_rsp_len, u8 *scan_rsp_data)
1797{
34a718bc 1798 struct adv_info *adv;
31aab5c2 1799
34a718bc 1800 adv = hci_find_adv_instance(hdev, instance);
31aab5c2
DW		 1801
1802 /* If advertisement doesn't exist, we can't modify its data */
34a718bc 1803 if (!adv)
31aab5c2
DW		 1804 return -ENOENT;
1805
34a718bc
LAD		 1806 if (adv_data_len && ADV_DATA_CMP(adv, adv_data, adv_data_len)) {
1807 memset(adv->adv_data, 0, sizeof(adv->adv_data));
1808 memcpy(adv->adv_data, adv_data, adv_data_len);
1809 adv->adv_data_len = adv_data_len;
1810 adv->adv_data_changed = true;
31aab5c2
DW		 1811 }
1812
34a718bc
LAD		 1813 if (scan_rsp_len && SCAN_RSP_CMP(adv, scan_rsp_data, scan_rsp_len)) {
1814 memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1815 memcpy(adv->scan_rsp_data, scan_rsp_data, scan_rsp_len);
1816 adv->scan_rsp_len = scan_rsp_len;
1817 adv->scan_rsp_changed = true;
31aab5c2
DW		 1818 }
1819
34a718bc
LAD		 1820 /* Mark as changed if there are flags which would affect it */
1821 if (((adv->flags & MGMT_ADV_FLAG_APPEARANCE) && hdev->appearance) ||
1822 adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1823 adv->scan_rsp_changed = true;
1824
31aab5c2
DW		 1825 return 0;
1826}
1827
01ce70b0
LAD		 1828/* This function requires the caller holds hdev->lock */
1829u32 hci_adv_instance_flags(struct hci_dev *hdev, u8 instance)
1830{
1831 u32 flags;
1832 struct adv_info *adv;
1833
1834 if (instance == 0x00) {
1835 /* Instance 0 always manages the "Tx Power" and "Flags"
1836 * fields
1837 */
1838 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
1839
1840 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
1841 * corresponds to the "connectable" instance flag.
1842 */
1843 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
1844 flags |= MGMT_ADV_FLAG_CONNECTABLE;
1845
1846 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1847 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
1848 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1849 flags |= MGMT_ADV_FLAG_DISCOV;
1850
1851 return flags;
1852 }
1853
1854 adv = hci_find_adv_instance(hdev, instance);
1855
1856 /* Return 0 when we got an invalid instance identifier. */
1857 if (!adv)
1858 return 0;
1859
1860 return adv->flags;
1861}
1862
1863bool hci_adv_instance_is_scannable(struct hci_dev *hdev, u8 instance)
1864{
1865 struct adv_info *adv;
1866
1867 /* Instance 0x00 always set local name */
1868 if (instance == 0x00)
1869 return true;
1870
1871 adv = hci_find_adv_instance(hdev, instance);
1872 if (!adv)
1873 return false;
1874
1875 if (adv->flags & MGMT_ADV_FLAG_APPEARANCE ||
1876 adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1877 return true;
1878
1879 return adv->scan_rsp_len ? true : false;
1880}
1881
e5e1e7fd
MC		 1882/* This function requires the caller holds hdev->lock */
1883void hci_adv_monitors_clear(struct hci_dev *hdev)
1884{
b139553d
MC		 1885 struct adv_monitor *monitor;
1886 int handle;
1887
1888 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
66bd095a 1889 hci_free_adv_monitor(hdev, monitor);
b139553d 1890
e5e1e7fd
MC		 1891 idr_destroy(&hdev->adv_monitors_idr);
1892}
1893
66bd095a
AP		 1894/* Frees the monitor structure and do some bookkeepings.
1895 * This function requires the caller holds hdev->lock.
1896 */
1897void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
b139553d
MC		 1898{
1899 struct adv_pattern *pattern;
1900 struct adv_pattern *tmp;
1901
1902 if (!monitor)
1903 return;
1904
66bd095a
AP		 1905 list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list) {
1906 list_del(&pattern->list);
b139553d 1907 kfree(pattern);
66bd095a
AP		 1908 }
1909
1910 if (monitor->handle)
1911 idr_remove(&hdev->adv_monitors_idr, monitor->handle);
1912
1913 if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) {
1914 hdev->adv_monitors_cnt--;
1915 mgmt_adv_monitor_removed(hdev, monitor->handle);
1916 }
b139553d
MC		 1917
1918 kfree(monitor);
1919}
1920
a2a4dedf
AP		 1921/* Assigns handle to a monitor, and if offloading is supported and power is on,
1922 * also attempts to forward the request to the controller.
b747a836 1923 * This function requires the caller holds hci_req_sync_lock.
a2a4dedf 1924 */
b747a836 1925int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
b139553d
MC		 1926{
1927 int min, max, handle;
b747a836 1928 int status = 0;
b139553d 1929
b747a836
MM		 1930 if (!monitor)
1931 return -EINVAL;
a2a4dedf 1932
b747a836 1933 hci_dev_lock(hdev);
b139553d
MC		 1934
1935 min = HCI_MIN_ADV_MONITOR_HANDLE;
1936 max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES;
1937 handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max,
1938 GFP_KERNEL);
b747a836
MM		 1939
1940 hci_dev_unlock(hdev);
1941
1942 if (handle < 0)
1943 return handle;
b139553d 1944
b139553d 1945 monitor->handle = handle;
8208f5a9 1946
a2a4dedf 1947 if (!hdev_is_powered(hdev))
b747a836 1948 return status;
8208f5a9 1949
a2a4dedf
AP		 1950 switch (hci_get_adv_monitor_offload_ext(hdev)) {
1951 case HCI_ADV_MONITOR_EXT_NONE:
6f55eea1 1952 bt_dev_dbg(hdev, "add monitor %d status %d",
b747a836 1953 monitor->handle, status);
a2a4dedf 1954 /* Message was not forwarded to controller - not an error */
b747a836
MM		 1955 break;
1956
a2a4dedf 1957 case HCI_ADV_MONITOR_EXT_MSFT:
b747a836 1958 status = msft_add_monitor_pattern(hdev, monitor);
6f55eea1 1959 bt_dev_dbg(hdev, "add monitor %d msft status %d",
b747a836 1960 monitor->handle, status);
a2a4dedf
AP		 1961 break;
1962 }
1963
b747a836 1964 return status;
b139553d
MC		 1965}
1966
66bd095a
AP		 1967/* Attempts to tell the controller and free the monitor. If somehow the
1968 * controller doesn't have a corresponding handle, remove anyway.
7cf5c297 1969 * This function requires the caller holds hci_req_sync_lock.
66bd095a 1970 */
7cf5c297
MM		 1971static int hci_remove_adv_monitor(struct hci_dev *hdev,
1972 struct adv_monitor *monitor)
bd2fbc6c 1973{
7cf5c297 1974 int status = 0;
de6dfcef 1975 int handle;
bd2fbc6c 1976
66bd095a
AP		 1977 switch (hci_get_adv_monitor_offload_ext(hdev)) {
1978 case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */
6f55eea1 1979 bt_dev_dbg(hdev, "remove monitor %d status %d",
7cf5c297 1980 monitor->handle, status);
66bd095a 1981 goto free_monitor;
7cf5c297 1982
66bd095a 1983 case HCI_ADV_MONITOR_EXT_MSFT:
de6dfcef 1984 handle = monitor->handle;
7cf5c297 1985 status = msft_remove_monitor(hdev, monitor);
6f55eea1
DA		 1986 bt_dev_dbg(hdev, "remove monitor %d msft status %d",
1987 handle, status);
66bd095a
AP		 1988 break;
1989 }
bd2fbc6c 1990
66bd095a 1991 /* In case no matching handle registered, just free the monitor */
7cf5c297 1992 if (status == -ENOENT)
66bd095a
AP		 1993 goto free_monitor;
1994
7cf5c297 1995 return status;
66bd095a
AP		 1996
1997free_monitor:
7cf5c297 1998 if (status == -ENOENT)
66bd095a
AP		 1999 bt_dev_warn(hdev, "Removing monitor with no matching handle %d",
2000 monitor->handle);
2001 hci_free_adv_monitor(hdev, monitor);
2002
7cf5c297 2003 return status;
bd2fbc6c
MC		 2004}
2005
7cf5c297
MM		 2006/* This function requires the caller holds hci_req_sync_lock */
2007int hci_remove_single_adv_monitor(struct hci_dev *hdev, u16 handle)
66bd095a
AP		 2008{
2009 struct adv_monitor *monitor = idr_find(&hdev->adv_monitors_idr, handle);
66bd095a 2010
7cf5c297
MM		 2011 if (!monitor)
2012 return -EINVAL;
66bd095a 2013
7cf5c297 2014 return hci_remove_adv_monitor(hdev, monitor);
66bd095a
AP		 2015}
2016
7cf5c297
MM		 2017/* This function requires the caller holds hci_req_sync_lock */
2018int hci_remove_all_adv_monitor(struct hci_dev *hdev)
bd2fbc6c
MC		 2019{
2020 struct adv_monitor *monitor;
66bd095a 2021 int idr_next_id = 0;
7cf5c297 2022 int status = 0;
66bd095a 2023
7cf5c297 2024 while (1) {
66bd095a 2025 monitor = idr_get_next(&hdev->adv_monitors_idr, &idr_next_id);
bd2fbc6c 2026 if (!monitor)
66bd095a 2027 break;
bd2fbc6c 2028
7cf5c297
MM		 2029 status = hci_remove_adv_monitor(hdev, monitor);
2030 if (status)
2031 return status;
66bd095a 2032
7cf5c297 2033 idr_next_id++;
bd2fbc6c
MC		 2034 }
2035
7cf5c297 2036 return status;
bd2fbc6c
MC		 2037}
2038
8208f5a9
MC		 2039/* This function requires the caller holds hdev->lock */
2040bool hci_is_adv_monitoring(struct hci_dev *hdev)
2041{
2042 return !idr_is_empty(&hdev->adv_monitors_idr);
2043}
2044
a2a4dedf
AP		 2045int hci_get_adv_monitor_offload_ext(struct hci_dev *hdev)
2046{
2047 if (msft_monitor_supported(hdev))
2048 return HCI_ADV_MONITOR_EXT_MSFT;
2049
2050 return HCI_ADV_MONITOR_EXT_NONE;
2051}
2052
dcc36c16 2053struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
b9ee0a78 2054 bdaddr_t *bdaddr, u8 type)
b2a66aad 2055{
8035ded4 2056 struct bdaddr_list *b;
b2a66aad 2057
dcc36c16 2058 list_for_each_entry(b, bdaddr_list, list) {
b9ee0a78 2059 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
b2a66aad 2060 return b;
b9ee0a78 2061 }
b2a66aad
AJ		 2062
2063 return NULL;
2064}
2065
b950aa88
AN		 2066struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
2067 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
2068 u8 type)
2069{
2070 struct bdaddr_list_with_irk *b;
2071
2072 list_for_each_entry(b, bdaddr_list, list) {
2073 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2074 return b;
2075 }
2076
2077 return NULL;
2078}
2079
8baaa403
APS		 2080struct bdaddr_list_with_flags *
2081hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list,
2082 bdaddr_t *bdaddr, u8 type)
2083{
2084 struct bdaddr_list_with_flags *b;
2085
2086 list_for_each_entry(b, bdaddr_list, list) {
2087 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2088 return b;
2089 }
2090
2091 return NULL;
2092}
2093
dcc36c16 2094void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
b2a66aad 2095{
7eb7404f 2096 struct bdaddr_list *b, *n;
b2a66aad 2097
7eb7404f
GT		 2098 list_for_each_entry_safe(b, n, bdaddr_list, list) {
2099 list_del(&b->list);
b2a66aad
AJ		 2100 kfree(b);
2101 }
b2a66aad
AJ		 2102}
2103
dcc36c16 2104int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2105{
2106 struct bdaddr_list *entry;
b2a66aad 2107
b9ee0a78 2108 if (!bacmp(bdaddr, BDADDR_ANY))
b2a66aad
AJ		 2109 return -EBADF;
2110
dcc36c16 2111 if (hci_bdaddr_list_lookup(list, bdaddr, type))
5e762444 2112 return -EEXIST;
b2a66aad 2113
27f70f3e 2114 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
5e762444
AJ		 2115 if (!entry)
2116 return -ENOMEM;
b2a66aad
AJ		 2117
2118 bacpy(&entry->bdaddr, bdaddr);
b9ee0a78 2119 entry->bdaddr_type = type;
b2a66aad 2120
dcc36c16 2121 list_add(&entry->list, list);
b2a66aad 2122
2a8357f2 2123 return 0;
b2a66aad
AJ		 2124}
2125
b950aa88
AN		 2126int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2127 u8 type, u8 *peer_irk, u8 *local_irk)
2128{
2129 struct bdaddr_list_with_irk *entry;
2130
2131 if (!bacmp(bdaddr, BDADDR_ANY))
2132 return -EBADF;
2133
2134 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2135 return -EEXIST;
2136
2137 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2138 if (!entry)
2139 return -ENOMEM;
2140
2141 bacpy(&entry->bdaddr, bdaddr);
2142 entry->bdaddr_type = type;
2143
2144 if (peer_irk)
2145 memcpy(entry->peer_irk, peer_irk, 16);
2146
2147 if (local_irk)
2148 memcpy(entry->local_irk, local_irk, 16);
2149
2150 list_add(&entry->list, list);
2151
2152 return 0;
2153}
2154
8baaa403
APS		 2155int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2156 u8 type, u32 flags)
2157{
2158 struct bdaddr_list_with_flags *entry;
2159
2160 if (!bacmp(bdaddr, BDADDR_ANY))
2161 return -EBADF;
2162
2163 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2164 return -EEXIST;
2165
2166 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2167 if (!entry)
2168 return -ENOMEM;
2169
2170 bacpy(&entry->bdaddr, bdaddr);
2171 entry->bdaddr_type = type;
e1cff700 2172 entry->flags = flags;
8baaa403
APS		 2173
2174 list_add(&entry->list, list);
2175
2176 return 0;
2177}
2178
dcc36c16 2179int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2180{
2181 struct bdaddr_list *entry;
b2a66aad 2182
35f7498a 2183 if (!bacmp(bdaddr, BDADDR_ANY)) {
dcc36c16 2184 hci_bdaddr_list_clear(list);
35f7498a
JH		 2185 return 0;
2186 }
b2a66aad 2187
dcc36c16 2188 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
d2ab0ac1
MH		 2189 if (!entry)
2190 return -ENOENT;
2191
2192 list_del(&entry->list);
2193 kfree(entry);
2194
2195 return 0;
2196}
2197
b950aa88
AN		 2198int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2199 u8 type)
2200{
2201 struct bdaddr_list_with_irk *entry;
2202
2203 if (!bacmp(bdaddr, BDADDR_ANY)) {
2204 hci_bdaddr_list_clear(list);
2205 return 0;
2206 }
2207
2208 entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
2209 if (!entry)
2210 return -ENOENT;
2211
2212 list_del(&entry->list);
2213 kfree(entry);
2214
2215 return 0;
2216}
2217
8baaa403
APS		 2218int hci_bdaddr_list_del_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2219 u8 type)
2220{
2221 struct bdaddr_list_with_flags *entry;
2222
2223 if (!bacmp(bdaddr, BDADDR_ANY)) {
2224 hci_bdaddr_list_clear(list);
2225 return 0;
2226 }
2227
2228 entry = hci_bdaddr_list_lookup_with_flags(list, bdaddr, type);
2229 if (!entry)
2230 return -ENOENT;
2231
2232 list_del(&entry->list);
2233 kfree(entry);
2234
2235 return 0;
2236}
2237
15819a70
AG		 2238/* This function requires the caller holds hdev->lock */
2239struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2240 bdaddr_t *addr, u8 addr_type)
2241{
2242 struct hci_conn_params *params;
2243
2244 list_for_each_entry(params, &hdev->le_conn_params, list) {
2245 if (bacmp(&params->addr, addr) == 0 &&
2246 params->addr_type == addr_type) {
2247 return params;
2248 }
2249 }
2250
2251 return NULL;
2252}
2253
195ef75e 2254/* This function requires the caller holds hdev->lock or rcu_read_lock */
501f8827
JH		 2255struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2256 bdaddr_t *addr, u8 addr_type)
a9b0a04c 2257{
912b42ef 2258 struct hci_conn_params *param;
a9b0a04c 2259
195ef75e
PV		 2260 rcu_read_lock();
2261
2262 list_for_each_entry_rcu(param, list, action) {
912b42ef 2263 if (bacmp(&param->addr, addr) == 0 &&
195ef75e
PV		 2264 param->addr_type == addr_type) {
2265 rcu_read_unlock();
912b42ef 2266 return param;
195ef75e 2267 }
4b10966f
MH		 2268 }
2269
195ef75e
PV		 2270 rcu_read_unlock();
2271
4b10966f 2272 return NULL;
a9b0a04c
AG		 2273}
2274
195ef75e
PV		 2275/* This function requires the caller holds hdev->lock */
2276void hci_pend_le_list_del_init(struct hci_conn_params *param)
2277{
2278 if (list_empty(&param->action))
2279 return;
2280
2281 list_del_rcu(&param->action);
2282 synchronize_rcu();
2283 INIT_LIST_HEAD(&param->action);
2284}
2285
2286/* This function requires the caller holds hdev->lock */
2287void hci_pend_le_list_add(struct hci_conn_params *param,
2288 struct list_head *list)
2289{
2290 list_add_rcu(&param->action, list);
2291}
2292
15819a70 2293/* This function requires the caller holds hdev->lock */
51d167c0
MH		 2294struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2295 bdaddr_t *addr, u8 addr_type)
15819a70
AG		 2296{
2297 struct hci_conn_params *params;
2298
2299 params = hci_conn_params_lookup(hdev, addr, addr_type);
cef952ce 2300 if (params)
51d167c0 2301 return params;
15819a70
AG		 2302
2303 params = kzalloc(sizeof(*params), GFP_KERNEL);
2304 if (!params) {
2064ee33 2305 bt_dev_err(hdev, "out of memory");
51d167c0 2306 return NULL;
15819a70
AG		 2307 }
2308
2309 bacpy(&params->addr, addr);
2310 params->addr_type = addr_type;
cef952ce
AG		 2311
2312 list_add(&params->list, &hdev->le_conn_params);
93450c75 2313 INIT_LIST_HEAD(&params->action);
cef952ce 2314
bf5b3c8b
MH		 2315 params->conn_min_interval = hdev->le_conn_min_interval;
2316 params->conn_max_interval = hdev->le_conn_max_interval;
2317 params->conn_latency = hdev->le_conn_latency;
2318 params->supervision_timeout = hdev->le_supv_timeout;
2319 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2320
2321 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2322
51d167c0 2323 return params;
bf5b3c8b
MH		 2324}
2325
195ef75e 2326void hci_conn_params_free(struct hci_conn_params *params)
15819a70 2327{
195ef75e
PV		 2328 hci_pend_le_list_del_init(params);
2329
f8aaf9b6 2330 if (params->conn) {
f161dd41 2331 hci_conn_drop(params->conn);
f8aaf9b6
JH		 2332 hci_conn_put(params->conn);
2333 }
f161dd41 2334
15819a70
AG		 2335 list_del(&params->list);
2336 kfree(params);
f6c63249
JH		 2337}
2338
2339/* This function requires the caller holds hdev->lock */
2340void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2341{
2342 struct hci_conn_params *params;
2343
2344 params = hci_conn_params_lookup(hdev, addr, addr_type);
2345 if (!params)
2346 return;
2347
2348 hci_conn_params_free(params);
15819a70 2349
5bee2fd6 2350 hci_update_passive_scan(hdev);
95305baa 2351
15819a70
AG		 2352 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2353}
2354
2355/* This function requires the caller holds hdev->lock */
55af49a8 2356void hci_conn_params_clear_disabled(struct hci_dev *hdev)
15819a70
AG		 2357{
2358 struct hci_conn_params *params, *tmp;
2359
2360 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
55af49a8
JH		 2361 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2362 continue;
f75113a2 2363
91641b79 2364 /* If trying to establish one time connection to disabled
f75113a2
JP		 2365 * device, leave the params, but mark them as just once.
2366 */
2367 if (params->explicit_connect) {
2368 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2369 continue;
2370 }
2371
195ef75e 2372 hci_conn_params_free(params);
15819a70
AG		 2373 }
2374
55af49a8 2375 BT_DBG("All LE disabled connection parameters were removed");
77a77a30
AG		 2376}
2377
2378/* This function requires the caller holds hdev->lock */
030e7f81 2379static void hci_conn_params_clear_all(struct hci_dev *hdev)
77a77a30 2380{
15819a70 2381 struct hci_conn_params *params, *tmp;
77a77a30 2382
f6c63249
JH		 2383 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2384 hci_conn_params_free(params);
77a77a30 2385
15819a70 2386 BT_DBG("All LE connection parameters were removed");
77a77a30
AG		 2387}
2388
a1f4c318
JH		 2389/* Copy the Identity Address of the controller.
2390 *
2391 * If the controller has a public BD_ADDR, then by default use that one.
2392 * If this is a LE only controller without a public address, default to
2393 * the static random address.
2394 *
2395 * For debugging purposes it is possible to force controllers with a
2396 * public address to use the static random address instead.
50b5b952
MH		 2397 *
2398 * In case BR/EDR has been disabled on a dual-mode controller and
2399 * userspace has configured a static address, then that address
2400 * becomes the identity address instead of the public BR/EDR address.
a1f4c318
JH		 2401 */
2402void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2403 u8 *bdaddr_type)
2404{
b7cb93e5 2405 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
50b5b952 2406 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
d7a5a11d 2407 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
50b5b952 2408 bacmp(&hdev->static_addr, BDADDR_ANY))) {
a1f4c318
JH		 2409 bacpy(bdaddr, &hdev->static_addr);
2410 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2411 } else {
2412 bacpy(bdaddr, &hdev->bdaddr);
2413 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
2414 }
2415}
2416
2f20216c
APS		 2417static void hci_clear_wake_reason(struct hci_dev *hdev)
2418{
2419 hci_dev_lock(hdev);
2420
2421 hdev->wake_reason = 0;
2422 bacpy(&hdev->wake_addr, BDADDR_ANY);
2423 hdev->wake_addr_type = 0;
2424
2425 hci_dev_unlock(hdev);
2426}
2427
9952d90e
APS		 2428static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
2429 void *data)
2430{
2431 struct hci_dev *hdev =
2432 container_of(nb, struct hci_dev, suspend_notifier);
2433 int ret = 0;
9952d90e 2434
4b8af331
APS		 2435 /* Userspace has full control of this device. Do nothing. */
2436 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2437 return NOTIFY_DONE;
2438
e1b77d68
LAD		 2439 if (action == PM_SUSPEND_PREPARE)
2440 ret = hci_suspend_dev(hdev);
2441 else if (action == PM_POST_SUSPEND)
2442 ret = hci_resume_dev(hdev);
2f20216c 2443
a9ec8423
APS		 2444 if (ret)
2445 bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
2446 action, ret);
2447
24b06572 2448 return NOTIFY_DONE;
9952d90e 2449}
8731840a 2450
9be0dab7 2451/* Alloc HCI device */
6ec56613 2452struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
9be0dab7
DH		 2453{
2454 struct hci_dev *hdev;
6ec56613 2455 unsigned int alloc_size;
9be0dab7 2456
6ec56613
THJA		 2457 alloc_size = sizeof(*hdev);
2458 if (sizeof_priv) {
2459 /* Fixme: May need ALIGN-ment? */
2460 alloc_size += sizeof_priv;
2461 }
9be0dab7 2462
6ec56613 2463 hdev = kzalloc(alloc_size, GFP_KERNEL);
9be0dab7
DH		 2464 if (!hdev)
2465 return NULL;
2466
b1b813d4
DH		 2467 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2468 hdev->esco_type = (ESCO_HV1);
2469 hdev->link_mode = (HCI_LM_ACCEPT);
b4cb9fb2
MH		 2470 hdev->num_iac = 0x01; /* One IAC support is mandatory */
2471 hdev->io_capability = 0x03; /* No Input No Output */
96c2103a 2472 hdev->manufacturer = 0xffff; /* Default to internal use */
bbaf444a
JH		 2473 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2474 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
d2609b34
FG		 2475 hdev->adv_instance_cnt = 0;
2476 hdev->cur_adv_instance = 0x00;
5d900e46 2477 hdev->adv_instance_timeout = 0;
b1b813d4 2478
c4f1f408
HC		 2479 hdev->advmon_allowlist_duration = 300;
2480 hdev->advmon_no_filter_duration = 500;
80af16a3 2481 hdev->enable_advmon_interleave_scan = 0x00; /* Default to disable */
c4f1f408 2482
b1b813d4
DH		 2483 hdev->sniff_max_interval = 800;
2484 hdev->sniff_min_interval = 80;
2485
3f959d46 2486 hdev->le_adv_channel_map = 0x07;
628531c9
GL		 2487 hdev->le_adv_min_interval = 0x0800;
2488 hdev->le_adv_max_interval = 0x0800;
bef64738
MH		 2489 hdev->le_scan_interval = 0x0060;
2490 hdev->le_scan_window = 0x0030;
10873f99
AM		 2491 hdev->le_scan_int_suspend = 0x0400;
2492 hdev->le_scan_window_suspend = 0x0012;
2493 hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT;
2494 hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN;
ba29d036
MH		 2495 hdev->le_scan_int_adv_monitor = 0x0060;
2496 hdev->le_scan_window_adv_monitor = 0x0030;
10873f99
AM		 2497 hdev->le_scan_int_connect = 0x0060;
2498 hdev->le_scan_window_connect = 0x0060;
b48c3b59
JH		 2499 hdev->le_conn_min_interval = 0x0018;
2500 hdev->le_conn_max_interval = 0x0028;
04fb7d90
MH		 2501 hdev->le_conn_latency = 0x0000;
2502 hdev->le_supv_timeout = 0x002a;
a8e1bfaa
MH		 2503 hdev->le_def_tx_len = 0x001b;
2504 hdev->le_def_tx_time = 0x0148;
2505 hdev->le_max_tx_len = 0x001b;
2506 hdev->le_max_tx_time = 0x0148;
2507 hdev->le_max_rx_len = 0x001b;
2508 hdev->le_max_rx_time = 0x0148;
30d65e08
MK		 2509 hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
2510 hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
6decb5b4
JK		 2511 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
2512 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
1d0fac2c 2513 hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
10873f99 2514 hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
49b020c1 2515 hdev->def_le_autoconnect_timeout = HCI_LE_AUTOCONN_TIMEOUT;
7c395ea5
DW		 2516 hdev->min_le_tx_power = HCI_TX_POWER_INVALID;
2517 hdev->max_le_tx_power = HCI_TX_POWER_INVALID;
bef64738 2518
d6bfd59c 2519 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
b9a7a61e 2520 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
31ad1691
AK		 2521 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
2522 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
302975cb 2523 hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
58a96fc3 2524 hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
d6bfd59c 2525
10873f99
AM		 2526 /* default 1.28 sec page scan */
2527 hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;
2528 hdev->def_page_scan_int = 0x0800;
2529 hdev->def_page_scan_window = 0x0012;
2530
b1b813d4
DH		 2531 mutex_init(&hdev->lock);
2532 mutex_init(&hdev->req_lock);
2533
b338d917 2534 INIT_LIST_HEAD(&hdev->mesh_pending);
b1b813d4 2535 INIT_LIST_HEAD(&hdev->mgmt_pending);
3d4f9c00
AP		 2536 INIT_LIST_HEAD(&hdev->reject_list);
2537 INIT_LIST_HEAD(&hdev->accept_list);
b1b813d4
DH		 2538 INIT_LIST_HEAD(&hdev->uuids);
2539 INIT_LIST_HEAD(&hdev->link_keys);
2540 INIT_LIST_HEAD(&hdev->long_term_keys);
970c4e46 2541 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
b1b813d4 2542 INIT_LIST_HEAD(&hdev->remote_oob_data);
3d4f9c00 2543 INIT_LIST_HEAD(&hdev->le_accept_list);
cfdb0c2d 2544 INIT_LIST_HEAD(&hdev->le_resolv_list);
15819a70 2545 INIT_LIST_HEAD(&hdev->le_conn_params);
77a77a30 2546 INIT_LIST_HEAD(&hdev->pend_le_conns);
66f8455a 2547 INIT_LIST_HEAD(&hdev->pend_le_reports);
6b536b5e 2548 INIT_LIST_HEAD(&hdev->conn_hash.list);
d2609b34 2549 INIT_LIST_HEAD(&hdev->adv_instances);
600a8749 2550 INIT_LIST_HEAD(&hdev->blocked_keys);
3368aa35 2551 INIT_LIST_HEAD(&hdev->monitored_devices);
b1b813d4 2552
8961987f 2553 INIT_LIST_HEAD(&hdev->local_codecs);
b1b813d4
DH		 2554 INIT_WORK(&hdev->rx_work, hci_rx_work);
2555 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2556 INIT_WORK(&hdev->tx_work, hci_tx_work);
2557 INIT_WORK(&hdev->power_on, hci_power_on);
c7741d16 2558 INIT_WORK(&hdev->error_reset, hci_error_reset);
b1b813d4 2559
6a98e383
MH		 2560 hci_cmd_sync_init(hdev);
2561
b1b813d4 2562 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
b1b813d4 2563
b1b813d4
DH		 2564 skb_queue_head_init(&hdev->rx_q);
2565 skb_queue_head_init(&hdev->cmd_q);
2566 skb_queue_head_init(&hdev->raw_q);
2567
2568 init_waitqueue_head(&hdev->req_wait_q);
2569
65cc2b49 2570 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
de75cd0d 2571 INIT_DELAYED_WORK(&hdev->ncmd_timer, hci_ncmd_timeout);
b1b813d4 2572
9695ef87 2573 hci_devcd_setup(hdev);
5fc16cc4
JH		 2574 hci_request_setup(hdev);
2575
b1b813d4
DH		 2576 hci_init_sysfs(hdev);
2577 discovery_init(hdev);
9be0dab7
DH		 2578
2579 return hdev;
2580}
6ec56613 2581EXPORT_SYMBOL(hci_alloc_dev_priv);
9be0dab7
DH		 2582
2583/* Free HCI device */
2584void hci_free_dev(struct hci_dev *hdev)
2585{
9be0dab7
DH		 2586 /* will free via device release */
2587 put_device(&hdev->dev);
2588}
2589EXPORT_SYMBOL(hci_free_dev);
2590
1da177e4
LT		 2591/* Register HCI device */
2592int hci_register_dev(struct hci_dev *hdev)
2593{
b1b813d4 2594 int id, error;
1da177e4 2595
74292d5a 2596 if (!hdev->open || !hdev->close || !hdev->send)
1da177e4
LT		 2597 return -EINVAL;
2598
08add513
MM		 2599 /* Do not allow HCI_AMP devices to register at index 0,
2600 * so the index can be used as the AMP controller ID.
2601 */
3df92b31 2602 switch (hdev->dev_type) {
ca8bee5d 2603 case HCI_PRIMARY:
103a2f32 2604 id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
3df92b31
SL		 2605 break;
2606 case HCI_AMP:
103a2f32 2607 id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
3df92b31
SL		 2608 break;
2609 default:
2610 return -EINVAL;
1da177e4 2611 }
8e87d142 2612
3df92b31
SL		 2613 if (id < 0)
2614 return id;
2615
103a2f32 2616 snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
1da177e4 2617 hdev->id = id;
2d8b3a11
AE		 2618
2619 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2620
29e2dd0d 2621 hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
33ca954d
DH		 2622 if (!hdev->workqueue) {
2623 error = -ENOMEM;
2624 goto err;
2625 }
f48fd9c8 2626
29e2dd0d
TH		 2627 hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
2628 hdev->name);
6ead1bbc
JH		 2629 if (!hdev->req_workqueue) {
2630 destroy_workqueue(hdev->workqueue);
2631 error = -ENOMEM;
2632 goto err;
2633 }
2634
0153e2ec
MH		 2635 if (!IS_ERR_OR_NULL(bt_debugfs))
2636 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
2637
bdc3e0f1
MH		 2638 dev_set_name(&hdev->dev, "%s", hdev->name);
2639
2640 error = device_add(&hdev->dev);
33ca954d 2641 if (error < 0)
54506918 2642 goto err_wqueue;
1da177e4 2643
6d5d2ee6
HK		 2644 hci_leds_init(hdev);
2645
611b30f7 2646 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 2647 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2648 hdev);
611b30f7
MH		 2649 if (hdev->rfkill) {
2650 if (rfkill_register(hdev->rfkill) < 0) {
2651 rfkill_destroy(hdev->rfkill);
2652 hdev->rfkill = NULL;
2653 }
2654 }
2655
5e130367 2656 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
a1536da2 2657 hci_dev_set_flag(hdev, HCI_RFKILLED);
5e130367 2658
a1536da2
MH		 2659 hci_dev_set_flag(hdev, HCI_SETUP);
2660 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
ce2be9ac 2661
ca8bee5d 2662 if (hdev->dev_type == HCI_PRIMARY) {
56f87901
JH		 2663 /* Assume BR/EDR support until proven otherwise (such as
2664 * through reading supported features during init.
2665 */
a1536da2 2666 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
56f87901 2667 }
ce2be9ac 2668
fcee3377
GP		 2669 write_lock(&hci_dev_list_lock);
2670 list_add(&hdev->list, &hci_dev_list);
2671 write_unlock(&hci_dev_list_lock);
2672
4a964404
MH		 2673 /* Devices that are marked for raw-only usage are unconfigured
2674 * and should not be included in normal operation.
fee746b0
MH		 2675 */
2676 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
a1536da2 2677 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
fee746b0 2678
fe92ee64
LAD		 2679 /* Mark Remote Wakeup connection flag as supported if driver has wakeup
2680 * callback.
2681 */
2682 if (hdev->wakeup)
e1cff700 2683 hdev->conn_flags |= HCI_CONN_FLAG_REMOTE_WAKEUP;
fe92ee64 2684
05fcd4c4 2685 hci_sock_dev_event(hdev, HCI_DEV_REG);
dc946bd8 2686 hci_dev_hold(hdev);
1da177e4 2687
91117864
DC		 2688 error = hci_register_suspend_notifier(hdev);
2689 if (error)
0d75da38 2690 BT_WARN("register suspend notifier failed error:%d\n", error);
9952d90e 2691
19202573 2692 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 2693
e5e1e7fd 2694 idr_init(&hdev->adv_monitors_idr);
5031ffcc 2695 msft_register(hdev);
e5e1e7fd 2696
1da177e4 2697 return id;
f48fd9c8 2698
33ca954d 2699err_wqueue:
5a4bb6a8 2700 debugfs_remove_recursive(hdev->debugfs);
33ca954d 2701 destroy_workqueue(hdev->workqueue);
6ead1bbc 2702 destroy_workqueue(hdev->req_workqueue);
33ca954d 2703err:
3df92b31 2704 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 2705
33ca954d 2706 return error;
1da177e4
LT		 2707}
2708EXPORT_SYMBOL(hci_register_dev);
2709
2710/* Unregister HCI device */
59735631 2711void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 2712{
c13854ce 2713 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 2714
1857c199 2715 mutex_lock(&hdev->unregister_lock);
a1536da2 2716 hci_dev_set_flag(hdev, HCI_UNREGISTER);
1857c199 2717 mutex_unlock(&hdev->unregister_lock);
94324962 2718
f20d09d5 2719 write_lock(&hci_dev_list_lock);
1da177e4 2720 list_del(&hdev->list);
f20d09d5 2721 write_unlock(&hci_dev_list_lock);
1da177e4 2722
e36bea6e
VV		 2723 cancel_work_sync(&hdev->power_on);
2724
6a98e383
MH		 2725 hci_cmd_sync_clear(hdev);
2726
359ee4f8 2727 hci_unregister_suspend_notifier(hdev);
4e8c36c3 2728
5031ffcc
MC		 2729 msft_unregister(hdev);
2730
4e8c36c3 2731 hci_dev_do_close(hdev);
9952d90e 2732
ab81cbf9 2733 if (!test_bit(HCI_INIT, &hdev->flags) &&
d7a5a11d
MH		 2734 !hci_dev_test_flag(hdev, HCI_SETUP) &&
2735 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
09fd0de5 2736 hci_dev_lock(hdev);
744cf19e 2737 mgmt_index_removed(hdev);
09fd0de5 2738 hci_dev_unlock(hdev);
56e5cb86 2739 }
ab81cbf9 2740
2e58ef3e
JH		 2741 /* mgmt_index_removed should take care of emptying the
2742 * pending list */
2743 BUG_ON(!list_empty(&hdev->mgmt_pending));
2744
05fcd4c4 2745 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
1da177e4 2746
611b30f7
MH		 2747 if (hdev->rfkill) {
2748 rfkill_unregister(hdev->rfkill);
2749 rfkill_destroy(hdev->rfkill);
2750 }
2751
bdc3e0f1 2752 device_del(&hdev->dev);
e61fbee7 2753 /* Actual cleanup is deferred until hci_release_dev(). */
e0448092
TH		 2754 hci_dev_put(hdev);
2755}
2756EXPORT_SYMBOL(hci_unregister_dev);
147e2d59 2757
58ce6d5b
TH		 2758/* Release HCI device */
2759void hci_release_dev(struct hci_dev *hdev)
e0448092 2760{
0153e2ec 2761 debugfs_remove_recursive(hdev->debugfs);
5177a838
MH		 2762 kfree_const(hdev->hw_info);
2763 kfree_const(hdev->fw_info);
0153e2ec 2764
f48fd9c8 2765 destroy_workqueue(hdev->workqueue);
6ead1bbc 2766 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 2767
09fd0de5 2768 hci_dev_lock(hdev);
3d4f9c00
AP		 2769 hci_bdaddr_list_clear(&hdev->reject_list);
2770 hci_bdaddr_list_clear(&hdev->accept_list);
2aeb9a1a 2771 hci_uuids_clear(hdev);
55ed8ca1 2772 hci_link_keys_clear(hdev);
b899efaf 2773 hci_smp_ltks_clear(hdev);
970c4e46 2774 hci_smp_irks_clear(hdev);
2763eda6 2775 hci_remote_oob_data_clear(hdev);
d2609b34 2776 hci_adv_instances_clear(hdev);
e5e1e7fd 2777 hci_adv_monitors_clear(hdev);
3d4f9c00 2778 hci_bdaddr_list_clear(&hdev->le_accept_list);
cfdb0c2d 2779 hci_bdaddr_list_clear(&hdev->le_resolv_list);
373110c5 2780 hci_conn_params_clear_all(hdev);
22078800 2781 hci_discovery_filter_clear(hdev);
600a8749 2782 hci_blocked_keys_clear(hdev);
09fd0de5 2783 hci_dev_unlock(hdev);
e2e0cacb 2784
e0448092 2785 ida_simple_remove(&hci_index_ida, hdev->id);
dd3b1dc3 2786 kfree_skb(hdev->sent_cmd);
dfe6d5c3 2787 kfree_skb(hdev->recv_event);
58ce6d5b 2788 kfree(hdev);
1da177e4 2789}
58ce6d5b 2790EXPORT_SYMBOL(hci_release_dev);
1da177e4 2791
359ee4f8
APS		 2792int hci_register_suspend_notifier(struct hci_dev *hdev)
2793{
2794 int ret = 0;
2795
b5ca3387
LAD		 2796 if (!hdev->suspend_notifier.notifier_call &&
2797 !test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
359ee4f8
APS		 2798 hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
2799 ret = register_pm_notifier(&hdev->suspend_notifier);
2800 }
2801
2802 return ret;
2803}
2804
2805int hci_unregister_suspend_notifier(struct hci_dev *hdev)
2806{
2807 int ret = 0;
2808
b5ca3387 2809 if (hdev->suspend_notifier.notifier_call) {
359ee4f8 2810 ret = unregister_pm_notifier(&hdev->suspend_notifier);
b5ca3387
LAD		 2811 if (!ret)
2812 hdev->suspend_notifier.notifier_call = NULL;
2813 }
359ee4f8
APS		 2814
2815 return ret;
2816}
2817
1da177e4
LT		 2818/* Suspend HCI device */
2819int hci_suspend_dev(struct hci_dev *hdev)
2820{
e1b77d68 2821 int ret;
e1b77d68
LAD		 2822
2823 bt_dev_dbg(hdev, "");
2824
2825 /* Suspend should only act on when powered. */
2826 if (!hdev_is_powered(hdev) ||
2827 hci_dev_test_flag(hdev, HCI_UNREGISTER))
2828 return 0;
2829
182ee45d
LAD		 2830 /* If powering down don't attempt to suspend */
2831 if (mgmt_powering_down(hdev))
2832 return 0;
4539ca67 2833
f4198635
AP		 2834 /* Cancel potentially blocking sync operation before suspend */
2835 __hci_cmd_sync_cancel(hdev, -EHOSTDOWN);
2836
182ee45d
LAD		 2837 hci_req_sync_lock(hdev);
2838 ret = hci_suspend_sync(hdev);
2839 hci_req_sync_unlock(hdev);
e1b77d68
LAD		 2840
2841 hci_clear_wake_reason(hdev);
182ee45d 2842 mgmt_suspending(hdev, hdev->suspend_state);
e1b77d68 2843
05fcd4c4 2844 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
e1b77d68 2845 return ret;
1da177e4
LT		 2846}
2847EXPORT_SYMBOL(hci_suspend_dev);
2848
2849/* Resume HCI device */
2850int hci_resume_dev(struct hci_dev *hdev)
2851{
e1b77d68
LAD		 2852 int ret;
2853
2854 bt_dev_dbg(hdev, "");
2855
2856 /* Resume should only act on when powered. */
2857 if (!hdev_is_powered(hdev) ||
2858 hci_dev_test_flag(hdev, HCI_UNREGISTER))
2859 return 0;
2860
2861 /* If powering down don't attempt to resume */
2862 if (mgmt_powering_down(hdev))
2863 return 0;
2864
182ee45d
LAD		 2865 hci_req_sync_lock(hdev);
2866 ret = hci_resume_sync(hdev);
2867 hci_req_sync_unlock(hdev);
e1b77d68
LAD		 2868
2869 mgmt_resuming(hdev, hdev->wake_reason, &hdev->wake_addr,
182ee45d 2870 hdev->wake_addr_type);
e1b77d68 2871
05fcd4c4 2872 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
e1b77d68 2873 return ret;
1da177e4
LT		 2874}
2875EXPORT_SYMBOL(hci_resume_dev);
2876
75e0569f
MH		 2877/* Reset HCI device */
2878int hci_reset_dev(struct hci_dev *hdev)
2879{
1e4b6e91 2880 static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
75e0569f
MH		 2881 struct sk_buff *skb;
2882
2883 skb = bt_skb_alloc(3, GFP_ATOMIC);
2884 if (!skb)
2885 return -ENOMEM;
2886
d79f34e3 2887 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
59ae1d12 2888 skb_put_data(skb, hw_err, 3);
75e0569f 2889
de75cd0d
MM		 2890 bt_dev_err(hdev, "Injecting HCI hardware error event");
2891
75e0569f
MH		 2892 /* Send Hardware Error to upper stack */
2893 return hci_recv_frame(hdev, skb);
2894}
2895EXPORT_SYMBOL(hci_reset_dev);
2896
76bca880 2897/* Receive frame from HCI drivers */
e1a26170 2898int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
76bca880 2899{
76bca880 2900 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 2901 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 2902 kfree_skb(skb);
2903 return -ENXIO;
2904 }
2905
876e7810
LAD		 2906 switch (hci_skb_pkt_type(skb)) {
2907 case HCI_EVENT_PKT:
2908 break;
2909 case HCI_ACLDATA_PKT:
2910 /* Detect if ISO packet has been sent as ACL */
2911 if (hci_conn_num(hdev, ISO_LINK)) {
2912 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
2913 __u8 type;
2914
2915 type = hci_conn_lookup_type(hdev, hci_handle(handle));
2916 if (type == ISO_LINK)
2917 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
2918 }
2919 break;
2920 case HCI_SCODATA_PKT:
2921 break;
2922 case HCI_ISODATA_PKT:
2923 break;
2924 default:
fe806dce
MH		 2925 kfree_skb(skb);
2926 return -EINVAL;
2927 }
2928
d82603c6 2929 /* Incoming skb */
76bca880
MH		 2930 bt_cb(skb)->incoming = 1;
2931
2932 /* Time stamp */
2933 __net_timestamp(skb);
2934
76bca880 2935 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 2936 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 2937
76bca880
MH		 2938 return 0;
2939}
2940EXPORT_SYMBOL(hci_recv_frame);
2941
e875ff84
MH		 2942/* Receive diagnostic message from HCI drivers */
2943int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
2944{
581d6fd6 2945 /* Mark as diagnostic packet */
d79f34e3 2946 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
581d6fd6 2947
e875ff84
MH		 2948 /* Time stamp */
2949 __net_timestamp(skb);
2950
581d6fd6
MH		 2951 skb_queue_tail(&hdev->rx_q, skb);
2952 queue_work(hdev->workqueue, &hdev->rx_work);
e875ff84 2953
e875ff84
MH		 2954 return 0;
2955}
2956EXPORT_SYMBOL(hci_recv_diag);
2957
5177a838
MH		 2958void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
2959{
2960 va_list vargs;
2961
2962 va_start(vargs, fmt);
2963 kfree_const(hdev->hw_info);
2964 hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2965 va_end(vargs);
2966}
2967EXPORT_SYMBOL(hci_set_hw_info);
2968
2969void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
2970{
2971 va_list vargs;
2972
2973 va_start(vargs, fmt);
2974 kfree_const(hdev->fw_info);
2975 hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2976 va_end(vargs);
2977}
2978EXPORT_SYMBOL(hci_set_fw_info);
2979
1da177e4
LT		 2980/* ---- Interface to upper protocols ---- */
2981
1da177e4
LT		 2982int hci_register_cb(struct hci_cb *cb)
2983{
2984 BT_DBG("%p name %s", cb, cb->name);
2985
fba7ecf0 2986 mutex_lock(&hci_cb_list_lock);
00629e0f 2987 list_add_tail(&cb->list, &hci_cb_list);
fba7ecf0 2988 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 2989
2990 return 0;
2991}
2992EXPORT_SYMBOL(hci_register_cb);
2993
2994int hci_unregister_cb(struct hci_cb *cb)
2995{
2996 BT_DBG("%p name %s", cb, cb->name);
2997
fba7ecf0 2998 mutex_lock(&hci_cb_list_lock);
1da177e4 2999 list_del(&cb->list);
fba7ecf0 3000 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 3001
3002 return 0;
3003}
3004EXPORT_SYMBOL(hci_unregister_cb);
3005
2250abad 3006static int hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3007{
cdc52faa
MH		 3008 int err;
3009
d79f34e3
MH		 3010 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3011 skb->len);
1da177e4 3012
cd82e61c
MH		 3013 /* Time stamp */
3014 __net_timestamp(skb);
1da177e4 3015
cd82e61c
MH		 3016 /* Send copy to monitor */
3017 hci_send_to_monitor(hdev, skb);
3018
3019 if (atomic_read(&hdev->promisc)) {
3020 /* Send copy to the sockets */
470fe1b5 3021 hci_send_to_sock(hdev, skb);
1da177e4
LT		 3022 }
3023
3024 /* Get rid of skb owner, prior to sending to the driver. */
3025 skb_orphan(skb);
3026
73d0d3c8
MH		 3027 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3028 kfree_skb(skb);
2250abad 3029 return -EINVAL;
73d0d3c8
MH		 3030 }
3031
cdc52faa
MH		 3032 err = hdev->send(hdev, skb);
3033 if (err < 0) {
2064ee33 3034 bt_dev_err(hdev, "sending frame failed (%d)", err);
cdc52faa 3035 kfree_skb(skb);
2250abad 3036 return err;
cdc52faa 3037 }
2250abad
BB		 3038
3039 return 0;
1da177e4
LT		 3040}
3041
1ca3a9d0 3042/* Send HCI command */
07dc93dd
JH		 3043int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3044 const void *param)
1ca3a9d0
JH		 3045{
3046 struct sk_buff *skb;
3047
3048 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3049
3050 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3051 if (!skb) {
2064ee33 3052 bt_dev_err(hdev, "no memory for command");
1ca3a9d0
JH		 3053 return -ENOMEM;
3054 }
3055
49c922bb 3056 /* Stand-alone HCI commands must be flagged as
11714b3d
JH		 3057 * single-command requests.
3058 */
44d27137 3059 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
11714b3d 3060
1da177e4 3061 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 3062 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3063
3064 return 0;
3065}
1da177e4 3066
d6ee6ad7
LP		 3067int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
3068 const void *param)
3069{
3070 struct sk_buff *skb;
3071
3072 if (hci_opcode_ogf(opcode) != 0x3f) {
3073 /* A controller receiving a command shall respond with either
3074 * a Command Status Event or a Command Complete Event.
3075 * Therefore, all standard HCI commands must be sent via the
3076 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
3077 * Some vendors do not comply with this rule for vendor-specific
3078 * commands and do not return any event. We want to support
3079 * unresponded commands for such cases only.
3080 */
3081 bt_dev_err(hdev, "unresponded command not supported");
3082 return -EINVAL;
3083 }
3084
3085 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3086 if (!skb) {
3087 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
3088 opcode);
3089 return -ENOMEM;
3090 }
3091
3092 hci_send_frame(hdev, skb);
3093
3094 return 0;
3095}
3096EXPORT_SYMBOL(__hci_cmd_send);
3097
1da177e4 3098/* Get data from the previously sent command */
a9de9248 3099void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 3100{
3101 struct hci_command_hdr *hdr;
3102
3103 if (!hdev->sent_cmd)
3104 return NULL;
3105
3106 hdr = (void *) hdev->sent_cmd->data;
3107
a9de9248 3108 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 3109 return NULL;
3110
f0e09510 3111 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 3112
3113 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3114}
3115
dfe6d5c3
LAD		 3116/* Get data from last received event */
3117void *hci_recv_event_data(struct hci_dev *hdev, __u8 event)
3118{
3119 struct hci_event_hdr *hdr;
3120 int offset;
3121
3122 if (!hdev->recv_event)
3123 return NULL;
3124
3125 hdr = (void *)hdev->recv_event->data;
3126 offset = sizeof(*hdr);
3127
3128 if (hdr->evt != event) {
3129 /* In case of LE metaevent check the subevent match */
3130 if (hdr->evt == HCI_EV_LE_META) {
3131 struct hci_ev_le_meta *ev;
3132
3133 ev = (void *)hdev->recv_event->data + offset;
3134 offset += sizeof(*ev);
3135 if (ev->subevent == event)
3136 goto found;
3137 }
3138 return NULL;
3139 }
3140
3141found:
3142 bt_dev_dbg(hdev, "event 0x%2.2x", event);
3143
3144 return hdev->recv_event->data + offset;
3145}
3146
1da177e4
LT		 3147/* Send ACL data */
3148static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3149{
3150 struct hci_acl_hdr *hdr;
3151 int len = skb->len;
3152
badff6d0
ACM		 3153 skb_push(skb, HCI_ACL_HDR_SIZE);
3154 skb_reset_transport_header(skb);
9c70220b 3155 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 3156 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3157 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 3158}
3159
ee22be7e 3160static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 3161 struct sk_buff *skb, __u16 flags)
1da177e4 3162{
ee22be7e 3163 struct hci_conn *conn = chan->conn;
1da177e4
LT		 3164 struct hci_dev *hdev = conn->hdev;
3165 struct sk_buff *list;
3166
087bfd99
GP		 3167 skb->len = skb_headlen(skb);
3168 skb->data_len = 0;
3169
d79f34e3 3170 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
204a6e54
AE		 3171
3172 switch (hdev->dev_type) {
ca8bee5d 3173 case HCI_PRIMARY:
204a6e54
AE		 3174 hci_add_acl_hdr(skb, conn->handle, flags);
3175 break;
3176 case HCI_AMP:
3177 hci_add_acl_hdr(skb, chan->handle, flags);
3178 break;
3179 default:
2064ee33 3180 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
204a6e54
AE		 3181 return;
3182 }
087bfd99 3183
70f23020
AE		 3184 list = skb_shinfo(skb)->frag_list;
3185 if (!list) {
1da177e4
LT		 3186 /* Non fragmented */
3187 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3188
73d80deb 3189 skb_queue_tail(queue, skb);
1da177e4
LT		 3190 } else {
3191 /* Fragmented */
3192 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3193
3194 skb_shinfo(skb)->frag_list = NULL;
3195
9cfd5a23
JR		 3196 /* Queue all fragments atomically. We need to use spin_lock_bh
3197 * here because of 6LoWPAN links, as there this function is
3198 * called from softirq and using normal spin lock could cause
3199 * deadlocks.
3200 */
3201 spin_lock_bh(&queue->lock);
1da177e4 3202
73d80deb 3203 __skb_queue_tail(queue, skb);
e702112f
AE		 3204
3205 flags &= ~ACL_START;
3206 flags |= ACL_CONT;
1da177e4
LT		 3207 do {
3208 skb = list; list = list->next;
8e87d142 3209
d79f34e3 3210 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
e702112f 3211 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 3212
3213 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3214
73d80deb 3215 __skb_queue_tail(queue, skb);
1da177e4
LT		 3216 } while (list);
3217
9cfd5a23 3218 spin_unlock_bh(&queue->lock);
1da177e4 3219 }
73d80deb
LAD		 3220}
3221
3222void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3223{
ee22be7e 3224 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 3225
f0e09510 3226 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb 3227
ee22be7e 3228 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 3229
3eff45ea 3230 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3231}
1da177e4
LT		 3232
3233/* Send SCO data */
0d861d8b 3234void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 3235{
3236 struct hci_dev *hdev = conn->hdev;
3237 struct hci_sco_hdr hdr;
3238
3239 BT_DBG("%s len %d", hdev->name, skb->len);
3240
aca3192c 3241 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 3242 hdr.dlen = skb->len;
3243
badff6d0
ACM		 3244 skb_push(skb, HCI_SCO_HDR_SIZE);
3245 skb_reset_transport_header(skb);
9c70220b 3246 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4 3247
d79f34e3 3248 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
c78ae283 3249
1da177e4 3250 skb_queue_tail(&conn->data_q, skb);
3eff45ea 3251 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3252}
1da177e4 3253
26afbd82
LAD		 3254/* Send ISO data */
3255static void hci_add_iso_hdr(struct sk_buff *skb, __u16 handle, __u8 flags)
3256{
3257 struct hci_iso_hdr *hdr;
3258 int len = skb->len;
3259
3260 skb_push(skb, HCI_ISO_HDR_SIZE);
3261 skb_reset_transport_header(skb);
3262 hdr = (struct hci_iso_hdr *)skb_transport_header(skb);
3263 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3264 hdr->dlen = cpu_to_le16(len);
3265}
3266
3267static void hci_queue_iso(struct hci_conn *conn, struct sk_buff_head *queue,
3268 struct sk_buff *skb)
3269{
3270 struct hci_dev *hdev = conn->hdev;
3271 struct sk_buff *list;
3272 __u16 flags;
3273
3274 skb->len = skb_headlen(skb);
3275 skb->data_len = 0;
3276
3277 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3278
3279 list = skb_shinfo(skb)->frag_list;
3280
3281 flags = hci_iso_flags_pack(list ? ISO_START : ISO_SINGLE, 0x00);
3282 hci_add_iso_hdr(skb, conn->handle, flags);
3283
3284 if (!list) {
3285 /* Non fragmented */
3286 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3287
3288 skb_queue_tail(queue, skb);
3289 } else {
3290 /* Fragmented */
3291 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3292
3293 skb_shinfo(skb)->frag_list = NULL;
3294
3295 __skb_queue_tail(queue, skb);
3296
3297 do {
3298 skb = list; list = list->next;
3299
3300 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3301 flags = hci_iso_flags_pack(list ? ISO_CONT : ISO_END,
3302 0x00);
3303 hci_add_iso_hdr(skb, conn->handle, flags);
3304
3305 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3306
3307 __skb_queue_tail(queue, skb);
3308 } while (list);
3309 }
3310}
3311
3312void hci_send_iso(struct hci_conn *conn, struct sk_buff *skb)
3313{
3314 struct hci_dev *hdev = conn->hdev;
3315
3316 BT_DBG("%s len %d", hdev->name, skb->len);
3317
3318 hci_queue_iso(conn, &conn->data_q, skb);
3319
3320 queue_work(hdev->workqueue, &hdev->tx_work);
3321}
3322
1da177e4
LT		 3323/* ---- HCI TX task (outgoing data) ---- */
3324
3325/* HCI Connection scheduler */
26afbd82
LAD		 3326static inline void hci_quote_sent(struct hci_conn *conn, int num, int *quote)
3327{
3328 struct hci_dev *hdev;
3329 int cnt, q;
3330
3331 if (!conn) {
3332 *quote = 0;
3333 return;
3334 }
3335
3336 hdev = conn->hdev;
3337
3338 switch (conn->type) {
3339 case ACL_LINK:
3340 cnt = hdev->acl_cnt;
3341 break;
3342 case AMP_LINK:
3343 cnt = hdev->block_cnt;
3344 break;
3345 case SCO_LINK:
3346 case ESCO_LINK:
3347 cnt = hdev->sco_cnt;
3348 break;
3349 case LE_LINK:
3350 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3351 break;
3352 case ISO_LINK:
3353 cnt = hdev->iso_mtu ? hdev->iso_cnt :
3354 hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3355 break;
3356 default:
3357 cnt = 0;
3358 bt_dev_err(hdev, "unknown link type %d", conn->type);
3359 }
3360
3361 q = cnt / num;
3362 *quote = q ? q : 1;
3363}
3364
6039aa73
GP		 3365static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3366 int *quote)
1da177e4
LT		 3367{
3368 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3369 struct hci_conn *conn = NULL, *c;
abc5de8f 3370 unsigned int num = 0, min = ~0;
1da177e4 3371
8e87d142 3372 /* We don't have to lock device here. Connections are always
1da177e4 3373 * added and removed with TX task disabled. */
bf4c6325
GP		 3374
3375 rcu_read_lock();
3376
3377 list_for_each_entry_rcu(c, &h->list, list) {
769be974 3378 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 3379 continue;
769be974
MH		 3380
3381 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3382 continue;
3383
1da177e4
LT		 3384 num++;
3385
3386 if (c->sent < min) {
3387 min = c->sent;
3388 conn = c;
3389 }
52087a79
LAD		 3390
3391 if (hci_conn_num(hdev, type) == num)
3392 break;
1da177e4
LT		 3393 }
3394
bf4c6325
GP		 3395 rcu_read_unlock();
3396
26afbd82 3397 hci_quote_sent(conn, num, quote);
1da177e4
LT		 3398
3399 BT_DBG("conn %p quote %d", conn, *quote);
3400 return conn;
3401}
3402
6039aa73 3403static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 3404{
3405 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3406 struct hci_conn *c;
1da177e4 3407
2064ee33 3408 bt_dev_err(hdev, "link tx timeout");
1da177e4 3409
bf4c6325
GP		 3410 rcu_read_lock();
3411
1da177e4 3412 /* Kill stalled connections */
bf4c6325 3413 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 3414 if (c->type == type && c->sent) {
2064ee33
MH		 3415 bt_dev_err(hdev, "killing stalled connection %pMR",
3416 &c->dst);
bed71748 3417 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 3418 }
3419 }
bf4c6325
GP		 3420
3421 rcu_read_unlock();
1da177e4
LT		 3422}
3423
6039aa73
GP		 3424static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3425 int *quote)
1da177e4 3426{
73d80deb
LAD		 3427 struct hci_conn_hash *h = &hdev->conn_hash;
3428 struct hci_chan *chan = NULL;
abc5de8f 3429 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 3430 struct hci_conn *conn;
26afbd82 3431 int conn_num = 0;
73d80deb
LAD		 3432
3433 BT_DBG("%s", hdev->name);
3434
bf4c6325
GP		 3435 rcu_read_lock();
3436
3437 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 3438 struct hci_chan *tmp;
3439
3440 if (conn->type != type)
3441 continue;
3442
3443 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3444 continue;
3445
3446 conn_num++;
3447
8192edef 3448 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 3449 struct sk_buff *skb;
3450
3451 if (skb_queue_empty(&tmp->data_q))
3452 continue;
3453
3454 skb = skb_peek(&tmp->data_q);
3455 if (skb->priority < cur_prio)
3456 continue;
3457
3458 if (skb->priority > cur_prio) {
3459 num = 0;
3460 min = ~0;
3461 cur_prio = skb->priority;
3462 }
3463
3464 num++;
3465
3466 if (conn->sent < min) {
3467 min = conn->sent;
3468 chan = tmp;
3469 }
3470 }
3471
3472 if (hci_conn_num(hdev, type) == conn_num)
3473 break;
3474 }
3475
bf4c6325
GP		 3476 rcu_read_unlock();
3477
73d80deb
LAD		 3478 if (!chan)
3479 return NULL;
3480
26afbd82 3481 hci_quote_sent(chan->conn, num, quote);
73d80deb 3482
73d80deb
LAD		 3483 BT_DBG("chan %p quote %d", chan, *quote);
3484 return chan;
3485}
3486
02b20f0b
LAD		 3487static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3488{
3489 struct hci_conn_hash *h = &hdev->conn_hash;
3490 struct hci_conn *conn;
3491 int num = 0;
3492
3493 BT_DBG("%s", hdev->name);
3494
bf4c6325
GP		 3495 rcu_read_lock();
3496
3497 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 3498 struct hci_chan *chan;
3499
3500 if (conn->type != type)
3501 continue;
3502
3503 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3504 continue;
3505
3506 num++;
3507
8192edef 3508 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 3509 struct sk_buff *skb;
3510
3511 if (chan->sent) {
3512 chan->sent = 0;
3513 continue;
3514 }
3515
3516 if (skb_queue_empty(&chan->data_q))
3517 continue;
3518
3519 skb = skb_peek(&chan->data_q);
3520 if (skb->priority >= HCI_PRIO_MAX - 1)
3521 continue;
3522
3523 skb->priority = HCI_PRIO_MAX - 1;
3524
3525 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 3526 skb->priority);
02b20f0b
LAD		 3527 }
3528
3529 if (hci_conn_num(hdev, type) == num)
3530 break;
3531 }
bf4c6325
GP		 3532
3533 rcu_read_unlock();
3534
02b20f0b
LAD		 3535}
3536
b71d385a
AE		 3537static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3538{
3539 /* Calculate count of blocks used by this packet */
3540 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3541}
3542
116523c8 3543static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type)
73d80deb 3544{
116523c8
LAD		 3545 unsigned long last_tx;
3546
3547 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
3548 return;
3549
3550 switch (type) {
3551 case LE_LINK:
3552 last_tx = hdev->le_last_tx;
3553 break;
3554 default:
3555 last_tx = hdev->acl_last_tx;
3556 break;
1da177e4 3557 }
116523c8
LAD		 3558
3559 /* tx timeout must be longer than maximum link supervision timeout
3560 * (40.9 seconds)
3561 */
3562 if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT))
3563 hci_link_tx_to(hdev, type);
63d2bc1b 3564}
1da177e4 3565
7fedd3bb
APS		 3566/* Schedule SCO */
3567static void hci_sched_sco(struct hci_dev *hdev)
3568{
3569 struct hci_conn *conn;
3570 struct sk_buff *skb;
3571 int quote;
3572
3573 BT_DBG("%s", hdev->name);
3574
3575 if (!hci_conn_num(hdev, SCO_LINK))
3576 return;
3577
3578 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3579 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3580 BT_DBG("skb %p len %d", skb, skb->len);
3581 hci_send_frame(hdev, skb);
3582
3583 conn->sent++;
3584 if (conn->sent == ~0)
3585 conn->sent = 0;
3586 }
3587 }
3588}
3589
3590static void hci_sched_esco(struct hci_dev *hdev)
3591{
3592 struct hci_conn *conn;
3593 struct sk_buff *skb;
3594 int quote;
3595
3596 BT_DBG("%s", hdev->name);
3597
3598 if (!hci_conn_num(hdev, ESCO_LINK))
3599 return;
3600
3601 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3602 &quote))) {
3603 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3604 BT_DBG("skb %p len %d", skb, skb->len);
3605 hci_send_frame(hdev, skb);
3606
3607 conn->sent++;
3608 if (conn->sent == ~0)
3609 conn->sent = 0;
3610 }
3611 }
3612}
3613
6039aa73 3614static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 3615{
3616 unsigned int cnt = hdev->acl_cnt;
3617 struct hci_chan *chan;
3618 struct sk_buff *skb;
3619 int quote;
3620
116523c8 3621 __check_timeout(hdev, cnt, ACL_LINK);
04837f64 3622
73d80deb 3623 while (hdev->acl_cnt &&
a8c5fb1a 3624 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 3625 u32 priority = (skb_peek(&chan->data_q))->priority;
3626 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3627 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3628 skb->len, skb->priority);
73d80deb 3629
ec1cce24
LAD		 3630 /* Stop if priority has changed */
3631 if (skb->priority < priority)
3632 break;
3633
3634 skb = skb_dequeue(&chan->data_q);
3635
73d80deb 3636 hci_conn_enter_active_mode(chan->conn,
04124681 3637 bt_cb(skb)->force_active);
04837f64 3638
57d17d70 3639 hci_send_frame(hdev, skb);
1da177e4
LT		 3640 hdev->acl_last_tx = jiffies;
3641
3642 hdev->acl_cnt--;
73d80deb
LAD		 3643 chan->sent++;
3644 chan->conn->sent++;
7fedd3bb
APS		 3645
3646 /* Send pending SCO packets right away */
3647 hci_sched_sco(hdev);
3648 hci_sched_esco(hdev);
1da177e4
LT		 3649 }
3650 }
02b20f0b
LAD		 3651
3652 if (cnt != hdev->acl_cnt)
3653 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 3654}
3655
6039aa73 3656static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 3657{
63d2bc1b 3658 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 3659 struct hci_chan *chan;
3660 struct sk_buff *skb;
3661 int quote;
bd1eb66b 3662 u8 type;
b71d385a 3663
bd1eb66b
AE		 3664 BT_DBG("%s", hdev->name);
3665
3666 if (hdev->dev_type == HCI_AMP)
3667 type = AMP_LINK;
3668 else
3669 type = ACL_LINK;
3670
116523c8
LAD		 3671 __check_timeout(hdev, cnt, type);
3672
b71d385a 3673 while (hdev->block_cnt > 0 &&
bd1eb66b 3674 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 3675 u32 priority = (skb_peek(&chan->data_q))->priority;
3676 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3677 int blocks;
3678
3679 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3680 skb->len, skb->priority);
b71d385a
AE		 3681
3682 /* Stop if priority has changed */
3683 if (skb->priority < priority)
3684 break;
3685
3686 skb = skb_dequeue(&chan->data_q);
3687
3688 blocks = __get_blocks(hdev, skb);
3689 if (blocks > hdev->block_cnt)
3690 return;
3691
3692 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 3693 bt_cb(skb)->force_active);
b71d385a 3694
57d17d70 3695 hci_send_frame(hdev, skb);
b71d385a
AE		 3696 hdev->acl_last_tx = jiffies;
3697
3698 hdev->block_cnt -= blocks;
3699 quote -= blocks;
3700
3701 chan->sent += blocks;
3702 chan->conn->sent += blocks;
3703 }
3704 }
3705
3706 if (cnt != hdev->block_cnt)
bd1eb66b 3707 hci_prio_recalculate(hdev, type);
b71d385a
AE		 3708}
3709
6039aa73 3710static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 3711{
3712 BT_DBG("%s", hdev->name);
3713
bd1eb66b 3714 /* No ACL link over BR/EDR controller */
ca8bee5d 3715 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
bd1eb66b
AE		 3716 return;
3717
3718 /* No AMP link over AMP controller */
3719 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 3720 return;
3721
3722 switch (hdev->flow_ctl_mode) {
3723 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3724 hci_sched_acl_pkt(hdev);
3725 break;
3726
3727 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3728 hci_sched_acl_blk(hdev);
3729 break;
3730 }
3731}
3732
6039aa73 3733static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 3734{
73d80deb 3735 struct hci_chan *chan;
6ed58ec5 3736 struct sk_buff *skb;
02b20f0b 3737 int quote, cnt, tmp;
6ed58ec5
VT		 3738
3739 BT_DBG("%s", hdev->name);
3740
52087a79
LAD		 3741 if (!hci_conn_num(hdev, LE_LINK))
3742 return;
3743
6ed58ec5 3744 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
1b1d29e5 3745
116523c8 3746 __check_timeout(hdev, cnt, LE_LINK);
1b1d29e5 3747
02b20f0b 3748 tmp = cnt;
73d80deb 3749 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 3750 u32 priority = (skb_peek(&chan->data_q))->priority;
3751 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3752 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3753 skb->len, skb->priority);
6ed58ec5 3754
ec1cce24
LAD		 3755 /* Stop if priority has changed */
3756 if (skb->priority < priority)
3757 break;
3758
3759 skb = skb_dequeue(&chan->data_q);
3760
57d17d70 3761 hci_send_frame(hdev, skb);
6ed58ec5
VT		 3762 hdev->le_last_tx = jiffies;
3763
3764 cnt--;
73d80deb
LAD		 3765 chan->sent++;
3766 chan->conn->sent++;
7fedd3bb
APS		 3767
3768 /* Send pending SCO packets right away */
3769 hci_sched_sco(hdev);
3770 hci_sched_esco(hdev);
6ed58ec5
VT		 3771 }
3772 }
73d80deb 3773
6ed58ec5
VT		 3774 if (hdev->le_pkts)
3775 hdev->le_cnt = cnt;
3776 else
3777 hdev->acl_cnt = cnt;
02b20f0b
LAD		 3778
3779 if (cnt != tmp)
3780 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 3781}
3782
26afbd82
LAD		 3783/* Schedule CIS */
3784static void hci_sched_iso(struct hci_dev *hdev)
3785{
3786 struct hci_conn *conn;
3787 struct sk_buff *skb;
3788 int quote, *cnt;
3789
3790 BT_DBG("%s", hdev->name);
3791
3792 if (!hci_conn_num(hdev, ISO_LINK))
3793 return;
3794
3795 cnt = hdev->iso_pkts ? &hdev->iso_cnt :
3796 hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
3797 while (*cnt && (conn = hci_low_sent(hdev, ISO_LINK, &quote))) {
3798 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3799 BT_DBG("skb %p len %d", skb, skb->len);
3800 hci_send_frame(hdev, skb);
3801
3802 conn->sent++;
3803 if (conn->sent == ~0)
3804 conn->sent = 0;
3805 (*cnt)--;
3806 }
3807 }
3808}
3809
3eff45ea 3810static void hci_tx_work(struct work_struct *work)
1da177e4 3811{
3eff45ea 3812 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 3813 struct sk_buff *skb;
3814
26afbd82
LAD		 3815 BT_DBG("%s acl %d sco %d le %d iso %d", hdev->name, hdev->acl_cnt,
3816 hdev->sco_cnt, hdev->le_cnt, hdev->iso_cnt);
1da177e4 3817
d7a5a11d 3818 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
52de599e 3819 /* Schedule queues and send stuff to HCI driver */
52de599e
MH		 3820 hci_sched_sco(hdev);
3821 hci_sched_esco(hdev);
26afbd82 3822 hci_sched_iso(hdev);
7fedd3bb 3823 hci_sched_acl(hdev);
52de599e
MH		 3824 hci_sched_le(hdev);
3825 }
6ed58ec5 3826
1da177e4
LT		 3827 /* Send next queued raw (unknown type) packet */
3828 while ((skb = skb_dequeue(&hdev->raw_q)))
57d17d70 3829 hci_send_frame(hdev, skb);
1da177e4
LT		 3830}
3831
25985edc 3832/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 3833
3834/* ACL data packet */
6039aa73 3835static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3836{
3837 struct hci_acl_hdr *hdr = (void *) skb->data;
3838 struct hci_conn *conn;
3839 __u16 handle, flags;
3840
3841 skb_pull(skb, HCI_ACL_HDR_SIZE);
3842
3843 handle = __le16_to_cpu(hdr->handle);
3844 flags = hci_flags(handle);
3845 handle = hci_handle(handle);
3846
f0e09510 3847 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 3848 handle, flags);
1da177e4
LT		 3849
3850 hdev->stat.acl_rx++;
3851
3852 hci_dev_lock(hdev);
3853 conn = hci_conn_hash_lookup_handle(hdev, handle);
3854 hci_dev_unlock(hdev);
8e87d142 3855
1da177e4 3856 if (conn) {
65983fc7 3857 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 3858
1da177e4 3859 /* Send to upper protocol */
686ebf28
UF		 3860 l2cap_recv_acldata(conn, skb, flags);
3861 return;
1da177e4 3862 } else {
2064ee33
MH		 3863 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
3864 handle);
1da177e4
LT		 3865 }
3866
3867 kfree_skb(skb);
3868}
3869
3870/* SCO data packet */
6039aa73 3871static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3872{
3873 struct hci_sco_hdr *hdr = (void *) skb->data;
3874 struct hci_conn *conn;
debdedf2 3875 __u16 handle, flags;
1da177e4
LT		 3876
3877 skb_pull(skb, HCI_SCO_HDR_SIZE);
3878
3879 handle = __le16_to_cpu(hdr->handle);
debdedf2
MH		 3880 flags = hci_flags(handle);
3881 handle = hci_handle(handle);
1da177e4 3882
debdedf2
MH		 3883 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
3884 handle, flags);
1da177e4
LT		 3885
3886 hdev->stat.sco_rx++;
3887
3888 hci_dev_lock(hdev);
3889 conn = hci_conn_hash_lookup_handle(hdev, handle);
3890 hci_dev_unlock(hdev);
3891
3892 if (conn) {
1da177e4 3893 /* Send to upper protocol */
00398e1d 3894 bt_cb(skb)->sco.pkt_status = flags & 0x03;
686ebf28
UF		 3895 sco_recv_scodata(conn, skb);
3896 return;
1da177e4 3897 } else {
2d4b37b6
LAD		 3898 bt_dev_err_ratelimited(hdev, "SCO packet for unknown connection handle %d",
3899 handle);
1da177e4
LT		 3900 }
3901
3902 kfree_skb(skb);
3903}
3904
26afbd82
LAD		 3905static void hci_isodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3906{
3907 struct hci_iso_hdr *hdr;
3908 struct hci_conn *conn;
3909 __u16 handle, flags;
3910
3911 hdr = skb_pull_data(skb, sizeof(*hdr));
3912 if (!hdr) {
3913 bt_dev_err(hdev, "ISO packet too small");
3914 goto drop;
3915 }
3916
3917 handle = __le16_to_cpu(hdr->handle);
3918 flags = hci_flags(handle);
3919 handle = hci_handle(handle);
3920
3921 bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
3922 handle, flags);
3923
3924 hci_dev_lock(hdev);
3925 conn = hci_conn_hash_lookup_handle(hdev, handle);
3926 hci_dev_unlock(hdev);
3927
26afbd82
LAD		 3928 if (!conn) {
3929 bt_dev_err(hdev, "ISO packet for unknown connection handle %d",
3930 handle);
ccf74f23 3931 goto drop;
26afbd82
LAD		 3932 }
3933
ccf74f23
LAD		 3934 /* Send to upper protocol */
3935 iso_recv(conn, skb, flags);
3936 return;
3937
26afbd82
LAD		 3938drop:
3939 kfree_skb(skb);
3940}
3941
9238f36a
JH		 3942static bool hci_req_is_complete(struct hci_dev *hdev)
3943{
3944 struct sk_buff *skb;
3945
3946 skb = skb_peek(&hdev->cmd_q);
3947 if (!skb)
3948 return true;
3949
44d27137 3950 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
9238f36a
JH		 3951}
3952
42c6b129
JH		 3953static void hci_resend_last(struct hci_dev *hdev)
3954{
3955 struct hci_command_hdr *sent;
3956 struct sk_buff *skb;
3957 u16 opcode;
3958
3959 if (!hdev->sent_cmd)
3960 return;
3961
3962 sent = (void *) hdev->sent_cmd->data;
3963 opcode = __le16_to_cpu(sent->opcode);
3964 if (opcode == HCI_OP_RESET)
3965 return;
3966
3967 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3968 if (!skb)
3969 return;
3970
3971 skb_queue_head(&hdev->cmd_q, skb);
3972 queue_work(hdev->workqueue, &hdev->cmd_work);
3973}
3974
e6214487
JH		 3975void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
3976 hci_req_complete_t *req_complete,
3977 hci_req_complete_skb_t *req_complete_skb)
9238f36a 3978{
9238f36a
JH		 3979 struct sk_buff *skb;
3980 unsigned long flags;
3981
3982 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3983
42c6b129
JH		 3984 /* If the completed command doesn't match the last one that was
3985 * sent we need to do special handling of it.
9238f36a 3986 */
42c6b129
JH		 3987 if (!hci_sent_cmd_data(hdev, opcode)) {
3988 /* Some CSR based controllers generate a spontaneous
3989 * reset complete event during init and any pending
3990 * command will never be completed. In such a case we
3991 * need to resend whatever was the last sent
3992 * command.
3993 */
3994 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3995 hci_resend_last(hdev);
3996
9238f36a 3997 return;
42c6b129 3998 }
9238f36a 3999
f80c5dad
JPRV		 4000 /* If we reach this point this event matches the last command sent */
4001 hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
4002
9238f36a
JH		 4003 /* If the command succeeded and there's still more commands in
4004 * this request the request is not yet complete.
4005 */
4006 if (!status && !hci_req_is_complete(hdev))
4007 return;
4008
4009 /* If this was the last command in a request the complete
4010 * callback would be found in hdev->sent_cmd instead of the
4011 * command queue (hdev->cmd_q).
4012 */
44d27137
JH		 4013 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4014 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
e6214487
JH		 4015 return;
4016 }
53e21fbc 4017
44d27137
JH		 4018 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4019 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
e6214487 4020 return;
9238f36a
JH		 4021 }
4022
4023 /* Remove all pending commands belonging to this request */
4024 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4025 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
44d27137 4026 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
9238f36a
JH		 4027 __skb_queue_head(&hdev->cmd_q, skb);
4028 break;
4029 }
4030
3bd7594e
DA		 4031 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4032 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4033 else
4034 *req_complete = bt_cb(skb)->hci.req_complete;
39c1eb6f 4035 dev_kfree_skb_irq(skb);
9238f36a
JH		 4036 }
4037 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
9238f36a
JH		 4038}
4039
b78752cc 4040static void hci_rx_work(struct work_struct *work)
1da177e4 4041{
b78752cc 4042 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 4043 struct sk_buff *skb;
4044
4045 BT_DBG("%s", hdev->name);
4046
9f30de9e
TK		 4047 /* The kcov_remote functions used for collecting packet parsing
4048 * coverage information from this background thread and associate
4049 * the coverage with the syscall's thread which originally injected
4050 * the packet. This helps fuzzing the kernel.
4051 */
4052 for (; (skb = skb_dequeue(&hdev->rx_q)); kcov_remote_stop()) {
4053 kcov_remote_start_common(skb_get_kcov_handle(skb));
4054
cd82e61c
MH		 4055 /* Send copy to monitor */
4056 hci_send_to_monitor(hdev, skb);
4057
1da177e4
LT		 4058 if (atomic_read(&hdev->promisc)) {
4059 /* Send copy to the sockets */
470fe1b5 4060 hci_send_to_sock(hdev, skb);
1da177e4
LT		 4061 }
4062
eb8c101e
MK		 4063 /* If the device has been opened in HCI_USER_CHANNEL,
4064 * the userspace has exclusive access to device.
4065 * When device is HCI_INIT, we still need to process
4066 * the data packets to the driver in order
4067 * to complete its setup().
4068 */
4069 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4070 !test_bit(HCI_INIT, &hdev->flags)) {
1da177e4
LT		 4071 kfree_skb(skb);
4072 continue;
4073 }
4074
4075 if (test_bit(HCI_INIT, &hdev->flags)) {
4076 /* Don't process data packets in this states. */
d79f34e3 4077 switch (hci_skb_pkt_type(skb)) {
1da177e4
LT		 4078 case HCI_ACLDATA_PKT:
4079 case HCI_SCODATA_PKT:
cc974003 4080 case HCI_ISODATA_PKT:
1da177e4
LT		 4081 kfree_skb(skb);
4082 continue;
3ff50b79 4083 }
1da177e4
LT		 4084 }
4085
4086 /* Process frame */
d79f34e3 4087 switch (hci_skb_pkt_type(skb)) {
1da177e4 4088 case HCI_EVENT_PKT:
b78752cc 4089 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 4090 hci_event_packet(hdev, skb);
4091 break;
4092
4093 case HCI_ACLDATA_PKT:
4094 BT_DBG("%s ACL data packet", hdev->name);
4095 hci_acldata_packet(hdev, skb);
4096 break;
4097
4098 case HCI_SCODATA_PKT:
4099 BT_DBG("%s SCO data packet", hdev->name);
4100 hci_scodata_packet(hdev, skb);
4101 break;
4102
26afbd82
LAD		 4103 case HCI_ISODATA_PKT:
4104 BT_DBG("%s ISO data packet", hdev->name);
4105 hci_isodata_packet(hdev, skb);
4106 break;
4107
1da177e4
LT		 4108 default:
4109 kfree_skb(skb);
4110 break;
4111 }
4112 }
1da177e4
LT		 4113}
4114
c347b765 4115static void hci_cmd_work(struct work_struct *work)
1da177e4 4116{
c347b765 4117 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 4118 struct sk_buff *skb;
4119
2104786b
AE		 4120 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4121 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 4122
1da177e4 4123 /* Send queued commands */
5a08ecce
AE		 4124 if (atomic_read(&hdev->cmd_cnt)) {
4125 skb = skb_dequeue(&hdev->cmd_q);
4126 if (!skb)
4127 return;
4128
7585b97a 4129 kfree_skb(hdev->sent_cmd);
1da177e4 4130
a675d7f1 4131 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
70f23020 4132 if (hdev->sent_cmd) {
2250abad 4133 int res;
f80c5dad
JPRV		 4134 if (hci_req_status_pend(hdev))
4135 hci_dev_set_flag(hdev, HCI_CMD_PENDING);
1da177e4 4136 atomic_dec(&hdev->cmd_cnt);
2250abad
BB		 4137
4138 res = hci_send_frame(hdev, skb);
4139 if (res < 0)
744451c1 4140 __hci_cmd_sync_cancel(hdev, -res);
2250abad 4141
deee93d1 4142 rcu_read_lock();
877afada
SS		 4143 if (test_bit(HCI_RESET, &hdev->flags) ||
4144 hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
65cc2b49 4145 cancel_delayed_work(&hdev->cmd_timer);
7bdb8a5c 4146 else
deee93d1
TH		 4147 queue_delayed_work(hdev->workqueue, &hdev->cmd_timer,
4148 HCI_CMD_TIMEOUT);
4149 rcu_read_unlock();
1da177e4
LT		 4150 } else {
4151 skb_queue_head(&hdev->cmd_q, skb);
c347b765 4152 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4153 }
4154 }
4155}
Linux 6.x block layer and io_uring tree(s)