projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: hci_h5: Set HCI_UART_RESET_ON_INIT to correct flags
[linux-2.6-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
8c520a59 29#include <linux/rfkill.h>
baf27f6e 30#include <linux/debugfs.h>
99780a7b 31#include <linux/crypto.h>
7a0e5b15 32#include <linux/property.h>
9952d90e
APS		 33#include <linux/suspend.h>
34#include <linux/wait.h>
47219839 35#include <asm/unaligned.h>
1da177e4
LT		 36
37#include <net/bluetooth/bluetooth.h>
38#include <net/bluetooth/hci_core.h>
4bc58f51 39#include <net/bluetooth/l2cap.h>
af58925c 40#include <net/bluetooth/mgmt.h>
1da177e4 41
0857dd3b 42#include "hci_request.h"
60c5f5fb 43#include "hci_debugfs.h"
970c4e46 44#include "smp.h"
6d5d2ee6 45#include "leds.h"
145373cb 46#include "msft.h"
970c4e46 47
b78752cc 48static void hci_rx_work(struct work_struct *work);
c347b765 49static void hci_cmd_work(struct work_struct *work);
3eff45ea 50static void hci_tx_work(struct work_struct *work);
1da177e4 51
1da177e4
LT		 52/* HCI device list */
53LIST_HEAD(hci_dev_list);
54DEFINE_RWLOCK(hci_dev_list_lock);
55
56/* HCI callback list */
57LIST_HEAD(hci_cb_list);
fba7ecf0 58DEFINE_MUTEX(hci_cb_list_lock);
1da177e4 59
3df92b31
SL		 60/* HCI ID Numbering */
61static DEFINE_IDA(hci_index_ida);
62
baf27f6e
MH		 63/* ---- HCI debugfs entries ---- */
64
4b4148e9
MH		 65static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
66 size_t count, loff_t *ppos)
67{
68 struct hci_dev *hdev = file->private_data;
69 char buf[3];
70
74b93e9f 71 buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
4b4148e9
MH		 72 buf[1] = '\n';
73 buf[2] = '\0';
74 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
75}
76
77static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
78 size_t count, loff_t *ppos)
79{
80 struct hci_dev *hdev = file->private_data;
81 struct sk_buff *skb;
4b4148e9 82 bool enable;
3bf5e97d 83 int err;
4b4148e9
MH		 84
85 if (!test_bit(HCI_UP, &hdev->flags))
86 return -ENETDOWN;
87
3bf5e97d
AS		 88 err = kstrtobool_from_user(user_buf, count, &enable);
89 if (err)
90 return err;
4b4148e9 91
b7cb93e5 92 if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
4b4148e9
MH		 93 return -EALREADY;
94
b504430c 95 hci_req_sync_lock(hdev);
4b4148e9
MH		 96 if (enable)
97 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
98 HCI_CMD_TIMEOUT);
99 else
100 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
101 HCI_CMD_TIMEOUT);
b504430c 102 hci_req_sync_unlock(hdev);
4b4148e9
MH		 103
104 if (IS_ERR(skb))
105 return PTR_ERR(skb);
106
4b4148e9
MH		 107 kfree_skb(skb);
108
b7cb93e5 109 hci_dev_change_flag(hdev, HCI_DUT_MODE);
4b4148e9
MH		 110
111 return count;
112}
113
114static const struct file_operations dut_mode_fops = {
115 .open = simple_open,
116 .read = dut_mode_read,
117 .write = dut_mode_write,
118 .llseek = default_llseek,
119};
120
4b4113d6
MH		 121static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
122 size_t count, loff_t *ppos)
123{
124 struct hci_dev *hdev = file->private_data;
125 char buf[3];
126
74b93e9f 127 buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
4b4113d6
MH		 128 buf[1] = '\n';
129 buf[2] = '\0';
130 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
131}
132
133static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
134 size_t count, loff_t *ppos)
135{
136 struct hci_dev *hdev = file->private_data;
4b4113d6
MH		 137 bool enable;
138 int err;
139
3bf5e97d
AS		 140 err = kstrtobool_from_user(user_buf, count, &enable);
141 if (err)
142 return err;
4b4113d6 143
7e995b9e 144 /* When the diagnostic flags are not persistent and the transport
b56c7b25
MH		 145 * is not active or in user channel operation, then there is no need
146 * for the vendor callback. Instead just store the desired value and
147 * the setting will be programmed when the controller gets powered on.
7e995b9e
MH		 148 */
149 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
b56c7b25
MH		 150 (!test_bit(HCI_RUNNING, &hdev->flags) ||
151 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)))
7e995b9e
MH		 152 goto done;
153
b504430c 154 hci_req_sync_lock(hdev);
4b4113d6 155 err = hdev->set_diag(hdev, enable);
b504430c 156 hci_req_sync_unlock(hdev);
4b4113d6
MH		 157
158 if (err < 0)
159 return err;
160
7e995b9e 161done:
4b4113d6
MH		 162 if (enable)
163 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
164 else
165 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
166
167 return count;
168}
169
170static const struct file_operations vendor_diag_fops = {
171 .open = simple_open,
172 .read = vendor_diag_read,
173 .write = vendor_diag_write,
174 .llseek = default_llseek,
175};
176
f640ee98
MH		 177static void hci_debugfs_create_basic(struct hci_dev *hdev)
178{
179 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
180 &dut_mode_fops);
181
182 if (hdev->set_diag)
183 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
184 &vendor_diag_fops);
185}
186
a1d01db1 187static int hci_reset_req(struct hci_request *req, unsigned long opt)
1da177e4 188{
42c6b129 189 BT_DBG("%s %ld", req->hdev->name, opt);
1da177e4
LT		 190
191 /* Reset device */
42c6b129
JH		 192 set_bit(HCI_RESET, &req->hdev->flags);
193 hci_req_add(req, HCI_OP_RESET, 0, NULL);
a1d01db1 194 return 0;
1da177e4
LT		 195}
196
42c6b129 197static void bredr_init(struct hci_request *req)
1da177e4 198{
42c6b129 199 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
2455a3ea 200
1da177e4 201 /* Read Local Supported Features */
42c6b129 202 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 203
1143e5a6 204 /* Read Local Version */
42c6b129 205 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
2177bab5
JH		 206
207 /* Read BD Address */
42c6b129 208 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1da177e4
LT		 209}
210
0af801b9 211static void amp_init1(struct hci_request *req)
e61ef499 212{
42c6b129 213 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
2455a3ea 214
e61ef499 215 /* Read Local Version */
42c6b129 216 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489 217
f6996cfe
MH		 218 /* Read Local Supported Commands */
219 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
220
6bcbc489 221 /* Read Local AMP Info */
42c6b129 222 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 223
224 /* Read Data Blk size */
42c6b129 225 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
7528ca1c 226
f38ba941
MH		 227 /* Read Flow Control Mode */
228 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
229
7528ca1c
MH		 230 /* Read Location Data */
231 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
e61ef499
AE		 232}
233
a1d01db1 234static int amp_init2(struct hci_request *req)
0af801b9
JH		 235{
236 /* Read Local Supported Features. Not all AMP controllers
237 * support this so it's placed conditionally in the second
238 * stage init.
239 */
240 if (req->hdev->commands[14] & 0x20)
241 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
a1d01db1
JH		 242
243 return 0;
0af801b9
JH		 244}
245
a1d01db1 246static int hci_init1_req(struct hci_request *req, unsigned long opt)
e61ef499 247{
42c6b129 248 struct hci_dev *hdev = req->hdev;
e61ef499
AE		 249
250 BT_DBG("%s %ld", hdev->name, opt);
251
11778716
AE		 252 /* Reset */
253 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
42c6b129 254 hci_reset_req(req, 0);
11778716 255
e61ef499 256 switch (hdev->dev_type) {
ca8bee5d 257 case HCI_PRIMARY:
42c6b129 258 bredr_init(req);
e61ef499 259 break;
e61ef499 260 case HCI_AMP:
0af801b9 261 amp_init1(req);
e61ef499 262 break;
e61ef499 263 default:
2064ee33 264 bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
e61ef499
AE		 265 break;
266 }
a1d01db1
JH		 267
268 return 0;
e61ef499
AE		 269}
270
42c6b129 271static void bredr_setup(struct hci_request *req)
2177bab5 272{
2177bab5
JH		 273 __le16 param;
274 __u8 flt_type;
275
276 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
42c6b129 277 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 278
279 /* Read Class of Device */
42c6b129 280 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
2177bab5
JH		 281
282 /* Read Local Name */
42c6b129 283 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
2177bab5
JH		 284
285 /* Read Voice Setting */
42c6b129 286 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
2177bab5 287
b4cb9fb2
MH		 288 /* Read Number of Supported IAC */
289 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
290
4b836f39
MH		 291 /* Read Current IAC LAP */
292 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
293
2177bab5
JH		 294 /* Clear Event Filters */
295 flt_type = HCI_FLT_CLEAR_ALL;
42c6b129 296 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
2177bab5
JH		 297
298 /* Connection accept timeout ~20 secs */
dcf4adbf 299 param = cpu_to_le16(0x7d00);
42c6b129 300 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
2177bab5
JH		 301}
302
42c6b129 303static void le_setup(struct hci_request *req)
2177bab5 304{
c73eee91
JH		 305 struct hci_dev *hdev = req->hdev;
306
2177bab5 307 /* Read LE Buffer Size */
42c6b129 308 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 309
310 /* Read LE Local Supported Features */
42c6b129 311 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
2177bab5 312
747d3f03
MH		 313 /* Read LE Supported States */
314 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
315
c73eee91
JH		 316 /* LE-only controllers have LE implicitly enabled */
317 if (!lmp_bredr_capable(hdev))
a1536da2 318 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2177bab5
JH		 319}
320
42c6b129 321static void hci_setup_event_mask(struct hci_request *req)
2177bab5 322{
42c6b129
JH		 323 struct hci_dev *hdev = req->hdev;
324
2177bab5
JH		 325 /* The second byte is 0xff instead of 0x9f (two reserved bits
326 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
327 * command otherwise.
328 */
329 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
330
331 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
332 * any event mask for pre 1.2 devices.
333 */
334 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
335 return;
336
337 if (lmp_bredr_capable(hdev)) {
338 events[4] |= 0x01; /* Flow Specification Complete */
c7882cbd
MH		 339 } else {
340 /* Use a different default for LE-only devices */
341 memset(events, 0, sizeof(events));
c7882cbd
MH		 342 events[1] |= 0x20; /* Command Complete */
343 events[1] |= 0x40; /* Command Status */
344 events[1] |= 0x80; /* Hardware Error */
5c3d3b4c
MH		 345
346 /* If the controller supports the Disconnect command, enable
347 * the corresponding event. In addition enable packet flow
348 * control related events.
349 */
350 if (hdev->commands[0] & 0x20) {
351 events[0] |= 0x10; /* Disconnection Complete */
352 events[2] |= 0x04; /* Number of Completed Packets */
353 events[3] |= 0x02; /* Data Buffer Overflow */
354 }
355
356 /* If the controller supports the Read Remote Version
357 * Information command, enable the corresponding event.
358 */
359 if (hdev->commands[2] & 0x80)
360 events[1] |= 0x08; /* Read Remote Version Information
361 * Complete
362 */
0da71f1b
MH		 363
364 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
365 events[0] |= 0x80; /* Encryption Change */
366 events[5] |= 0x80; /* Encryption Key Refresh Complete */
367 }
2177bab5
JH		 368 }
369
9fe759ce
MH		 370 if (lmp_inq_rssi_capable(hdev) ||
371 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
2177bab5
JH		 372 events[4] |= 0x02; /* Inquiry Result with RSSI */
373
70f56aa2
MH		 374 if (lmp_ext_feat_capable(hdev))
375 events[4] |= 0x04; /* Read Remote Extended Features Complete */
376
377 if (lmp_esco_capable(hdev)) {
378 events[5] |= 0x08; /* Synchronous Connection Complete */
379 events[5] |= 0x10; /* Synchronous Connection Changed */
380 }
381
2177bab5
JH		 382 if (lmp_sniffsubr_capable(hdev))
383 events[5] |= 0x20; /* Sniff Subrating */
384
385 if (lmp_pause_enc_capable(hdev))
386 events[5] |= 0x80; /* Encryption Key Refresh Complete */
387
388 if (lmp_ext_inq_capable(hdev))
389 events[5] |= 0x40; /* Extended Inquiry Result */
390
391 if (lmp_no_flush_capable(hdev))
392 events[7] |= 0x01; /* Enhanced Flush Complete */
393
394 if (lmp_lsto_capable(hdev))
395 events[6] |= 0x80; /* Link Supervision Timeout Changed */
396
397 if (lmp_ssp_capable(hdev)) {
398 events[6] |= 0x01; /* IO Capability Request */
399 events[6] |= 0x02; /* IO Capability Response */
400 events[6] |= 0x04; /* User Confirmation Request */
401 events[6] |= 0x08; /* User Passkey Request */
402 events[6] |= 0x10; /* Remote OOB Data Request */
403 events[6] |= 0x20; /* Simple Pairing Complete */
404 events[7] |= 0x04; /* User Passkey Notification */
405 events[7] |= 0x08; /* Keypress Notification */
406 events[7] |= 0x10; /* Remote Host Supported
407 * Features Notification
408 */
409 }
410
411 if (lmp_le_capable(hdev))
412 events[7] |= 0x20; /* LE Meta-Event */
413
42c6b129 414 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
2177bab5
JH		 415}
416
a1d01db1 417static int hci_init2_req(struct hci_request *req, unsigned long opt)
2177bab5 418{
42c6b129
JH		 419 struct hci_dev *hdev = req->hdev;
420
0af801b9
JH		 421 if (hdev->dev_type == HCI_AMP)
422 return amp_init2(req);
423
2177bab5 424 if (lmp_bredr_capable(hdev))
42c6b129 425 bredr_setup(req);
56f87901 426 else
a358dc11 427 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
2177bab5
JH		 428
429 if (lmp_le_capable(hdev))
42c6b129 430 le_setup(req);
2177bab5 431
0f3adeae
MH		 432 /* All Bluetooth 1.2 and later controllers should support the
433 * HCI command for reading the local supported commands.
434 *
435 * Unfortunately some controllers indicate Bluetooth 1.2 support,
436 * but do not have support for this command. If that is the case,
437 * the driver can quirk the behavior and skip reading the local
438 * supported commands.
3f8e2d75 439 */
0f3adeae
MH		 440 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
441 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
42c6b129 442 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
2177bab5
JH		 443
444 if (lmp_ssp_capable(hdev)) {
57af75a8
MH		 445 /* When SSP is available, then the host features page
446 * should also be available as well. However some
447 * controllers list the max_page as 0 as long as SSP
448 * has not been enabled. To achieve proper debugging
449 * output, force the minimum max_page to 1 at least.
450 */
451 hdev->max_page = 0x01;
452
d7a5a11d 453 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2177bab5 454 u8 mode = 0x01;
574ea3c7 455
42c6b129
JH		 456 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
457 sizeof(mode), &mode);
2177bab5
JH		 458 } else {
459 struct hci_cp_write_eir cp;
460
461 memset(hdev->eir, 0, sizeof(hdev->eir));
462 memset(&cp, 0, sizeof(cp));
463
42c6b129 464 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
2177bab5
JH		 465 }
466 }
467
043ec9bf
MH		 468 if (lmp_inq_rssi_capable(hdev) ||
469 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
04422da9
MH		 470 u8 mode;
471
472 /* If Extended Inquiry Result events are supported, then
473 * they are clearly preferred over Inquiry Result with RSSI
474 * events.
475 */
476 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
477
478 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
479 }
2177bab5
JH		 480
481 if (lmp_inq_tx_pwr_capable(hdev))
42c6b129 482 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
2177bab5
JH		 483
484 if (lmp_ext_feat_capable(hdev)) {
485 struct hci_cp_read_local_ext_features cp;
486
487 cp.page = 0x01;
42c6b129
JH		 488 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
489 sizeof(cp), &cp);
2177bab5
JH		 490 }
491
d7a5a11d 492 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2177bab5 493 u8 enable = 1;
42c6b129
JH		 494 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
495 &enable);
2177bab5 496 }
a1d01db1
JH		 497
498 return 0;
2177bab5
JH		 499}
500
42c6b129 501static void hci_setup_link_policy(struct hci_request *req)
2177bab5 502{
42c6b129 503 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 504 struct hci_cp_write_def_link_policy cp;
505 u16 link_policy = 0;
506
507 if (lmp_rswitch_capable(hdev))
508 link_policy |= HCI_LP_RSWITCH;
509 if (lmp_hold_capable(hdev))
510 link_policy |= HCI_LP_HOLD;
511 if (lmp_sniff_capable(hdev))
512 link_policy |= HCI_LP_SNIFF;
513 if (lmp_park_capable(hdev))
514 link_policy |= HCI_LP_PARK;
515
516 cp.policy = cpu_to_le16(link_policy);
42c6b129 517 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
2177bab5
JH		 518}
519
42c6b129 520static void hci_set_le_support(struct hci_request *req)
2177bab5 521{
42c6b129 522 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 523 struct hci_cp_write_le_host_supported cp;
524
c73eee91
JH		 525 /* LE-only devices do not support explicit enablement */
526 if (!lmp_bredr_capable(hdev))
527 return;
528
2177bab5
JH		 529 memset(&cp, 0, sizeof(cp));
530
d7a5a11d 531 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2177bab5 532 cp.le = 0x01;
32226e4f 533 cp.simul = 0x00;
2177bab5
JH		 534 }
535
536 if (cp.le != lmp_host_le_capable(hdev))
42c6b129
JH		 537 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
538 &cp);
2177bab5
JH		 539}
540
d62e6d67
JH		 541static void hci_set_event_mask_page_2(struct hci_request *req)
542{
543 struct hci_dev *hdev = req->hdev;
544 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
313f6888 545 bool changed = false;
d62e6d67
JH		 546
547 /* If Connectionless Slave Broadcast master role is supported
548 * enable all necessary events for it.
549 */
53b834d2 550 if (lmp_csb_master_capable(hdev)) {
d62e6d67
JH		 551 events[1] |= 0x40; /* Triggered Clock Capture */
552 events[1] |= 0x80; /* Synchronization Train Complete */
553 events[2] |= 0x10; /* Slave Page Response Timeout */
554 events[2] |= 0x20; /* CSB Channel Map Change */
313f6888 555 changed = true;
d62e6d67
JH		 556 }
557
558 /* If Connectionless Slave Broadcast slave role is supported
559 * enable all necessary events for it.
560 */
53b834d2 561 if (lmp_csb_slave_capable(hdev)) {
d62e6d67
JH		 562 events[2] |= 0x01; /* Synchronization Train Received */
563 events[2] |= 0x02; /* CSB Receive */
564 events[2] |= 0x04; /* CSB Timeout */
565 events[2] |= 0x08; /* Truncated Page Complete */
313f6888 566 changed = true;
d62e6d67
JH		 567 }
568
40c59fcb 569 /* Enable Authenticated Payload Timeout Expired event if supported */
313f6888 570 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
40c59fcb 571 events[2] |= 0x80;
313f6888
MH		 572 changed = true;
573 }
40c59fcb 574
313f6888
MH		 575 /* Some Broadcom based controllers indicate support for Set Event
576 * Mask Page 2 command, but then actually do not support it. Since
577 * the default value is all bits set to zero, the command is only
578 * required if the event mask has to be changed. In case no change
579 * to the event mask is needed, skip this command.
580 */
581 if (changed)
582 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
583 sizeof(events), events);
d62e6d67
JH		 584}
585
a1d01db1 586static int hci_init3_req(struct hci_request *req, unsigned long opt)
2177bab5 587{
42c6b129 588 struct hci_dev *hdev = req->hdev;
d2c5d77f 589 u8 p;
42c6b129 590
0da71f1b
MH		 591 hci_setup_event_mask(req);
592
e81be90b
JH		 593 if (hdev->commands[6] & 0x20 &&
594 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
48ce62c4
MH		 595 struct hci_cp_read_stored_link_key cp;
596
597 bacpy(&cp.bdaddr, BDADDR_ANY);
598 cp.read_all = 0x01;
599 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
600 }
601
2177bab5 602 if (hdev->commands[5] & 0x10)
42c6b129 603 hci_setup_link_policy(req);
2177bab5 604
417287de
MH		 605 if (hdev->commands[8] & 0x01)
606 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
607
cde1a8a9
IFM		 608 if (hdev->commands[18] & 0x04 &&
609 !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
00bce3fb
AM		 610 hci_req_add(req, HCI_OP_READ_DEF_ERR_DATA_REPORTING, 0, NULL);
611
417287de
MH		 612 /* Some older Broadcom based Bluetooth 1.2 controllers do not
613 * support the Read Page Scan Type command. Check support for
614 * this command in the bit mask of supported commands.
615 */
616 if (hdev->commands[13] & 0x01)
617 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
618
9193c6e8
AG		 619 if (lmp_le_capable(hdev)) {
620 u8 events[8];
621
622 memset(events, 0, sizeof(events));
4d6c705b
MH		 623
624 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
625 events[0] |= 0x10; /* LE Long Term Key Request */
662bc2e6
AG		 626
627 /* If controller supports the Connection Parameters Request
628 * Link Layer Procedure, enable the corresponding event.
629 */
630 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
631 events[0] |= 0x20; /* LE Remote Connection
632 * Parameter Request
633 */
634
a9f6068e
MH		 635 /* If the controller supports the Data Length Extension
636 * feature, enable the corresponding event.
637 */
638 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
639 events[0] |= 0x40; /* LE Data Length Change */
640
ff3b8df2
MH		 641 /* If the controller supports LL Privacy feature, enable
642 * the corresponding event.
643 */
644 if (hdev->le_features[0] & HCI_LE_LL_PRIVACY)
645 events[1] |= 0x02; /* LE Enhanced Connection
646 * Complete
647 */
648
4b71bba4
MH		 649 /* If the controller supports Extended Scanner Filter
650 * Policies, enable the correspondig event.
651 */
652 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
653 events[1] |= 0x04; /* LE Direct Advertising
654 * Report
655 */
656
9756d33b
MH		 657 /* If the controller supports Channel Selection Algorithm #2
658 * feature, enable the corresponding event.
659 */
660 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
661 events[2] |= 0x08; /* LE Channel Selection
662 * Algorithm
663 */
664
7d26f5c4
MH		 665 /* If the controller supports the LE Set Scan Enable command,
666 * enable the corresponding advertising report event.
667 */
668 if (hdev->commands[26] & 0x08)
669 events[0] |= 0x02; /* LE Advertising Report */
670
671 /* If the controller supports the LE Create Connection
672 * command, enable the corresponding event.
673 */
674 if (hdev->commands[26] & 0x10)
675 events[0] |= 0x01; /* LE Connection Complete */
676
677 /* If the controller supports the LE Connection Update
678 * command, enable the corresponding event.
679 */
680 if (hdev->commands[27] & 0x04)
681 events[0] |= 0x04; /* LE Connection Update
682 * Complete
683 */
684
685 /* If the controller supports the LE Read Remote Used Features
686 * command, enable the corresponding event.
687 */
688 if (hdev->commands[27] & 0x20)
689 events[0] |= 0x08; /* LE Read Remote Used
690 * Features Complete
691 */
692
5a34bd5f
MH		 693 /* If the controller supports the LE Read Local P-256
694 * Public Key command, enable the corresponding event.
695 */
696 if (hdev->commands[34] & 0x02)
697 events[0] |= 0x80; /* LE Read Local P-256
698 * Public Key Complete
699 */
700
701 /* If the controller supports the LE Generate DHKey
702 * command, enable the corresponding event.
703 */
704 if (hdev->commands[34] & 0x04)
705 events[1] |= 0x01; /* LE Generate DHKey Complete */
706
27bbca44
MH		 707 /* If the controller supports the LE Set Default PHY or
708 * LE Set PHY commands, enable the corresponding event.
709 */
710 if (hdev->commands[35] & (0x20 | 0x40))
711 events[1] |= 0x08; /* LE PHY Update Complete */
712
c215e939
JK		 713 /* If the controller supports LE Set Extended Scan Parameters
714 * and LE Set Extended Scan Enable commands, enable the
715 * corresponding event.
716 */
717 if (use_ext_scan(hdev))
718 events[1] |= 0x10; /* LE Extended Advertising
719 * Report
720 */
721
acf0aeae
JK		 722 /* If the controller supports the LE Extended Advertising
723 * command, enable the corresponding event.
724 */
725 if (ext_adv_capable(hdev))
726 events[2] |= 0x02; /* LE Advertising Set
727 * Terminated
728 */
729
9193c6e8
AG		 730 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
731 events);
732
6b49bcb4
JK		 733 /* Read LE Advertising Channel TX Power */
734 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
735 /* HCI TS spec forbids mixing of legacy and extended
736 * advertising commands wherein READ_ADV_TX_POWER is
737 * also included. So do not call it if extended adv
738 * is supported otherwise controller will return
739 * COMMAND_DISALLOWED for extended commands.
740 */
15a49cca
MH		 741 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
742 }
743
2ab216a7
MH		 744 if (hdev->commands[26] & 0x40) {
745 /* Read LE White List Size */
746 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE,
747 0, NULL);
748 }
749
750 if (hdev->commands[26] & 0x80) {
751 /* Clear LE White List */
752 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
753 }
754
cfdb0c2d
AN		 755 if (hdev->commands[34] & 0x40) {
756 /* Read LE Resolving List Size */
757 hci_req_add(req, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
758 0, NULL);
759 }
760
545f2596
AN		 761 if (hdev->commands[34] & 0x20) {
762 /* Clear LE Resolving List */
763 hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL);
764 }
765
a9f6068e
MH		 766 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
767 /* Read LE Maximum Data Length */
768 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
769
770 /* Read LE Suggested Default Data Length */
771 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
772 }
773
6b49bcb4
JK		 774 if (ext_adv_capable(hdev)) {
775 /* Read LE Number of Supported Advertising Sets */
776 hci_req_add(req, HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
777 0, NULL);
778 }
779
42c6b129 780 hci_set_le_support(req);
9193c6e8 781 }
d2c5d77f
JH		 782
783 /* Read features beyond page 1 if available */
784 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
785 struct hci_cp_read_local_ext_features cp;
786
787 cp.page = p;
788 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
789 sizeof(cp), &cp);
790 }
a1d01db1
JH		 791
792 return 0;
2177bab5
JH		 793}
794
a1d01db1 795static int hci_init4_req(struct hci_request *req, unsigned long opt)
5d4e7e8d
JH		 796{
797 struct hci_dev *hdev = req->hdev;
798
36f260ce
MH		 799 /* Some Broadcom based Bluetooth controllers do not support the
800 * Delete Stored Link Key command. They are clearly indicating its
801 * absence in the bit mask of supported commands.
802 *
803 * Check the supported commands and only if the the command is marked
804 * as supported send it. If not supported assume that the controller
805 * does not have actual support for stored link keys which makes this
806 * command redundant anyway.
807 *
808 * Some controllers indicate that they support handling deleting
809 * stored link keys, but they don't. The quirk lets a driver
810 * just disable this command.
811 */
812 if (hdev->commands[6] & 0x80 &&
813 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
814 struct hci_cp_delete_stored_link_key cp;
815
816 bacpy(&cp.bdaddr, BDADDR_ANY);
817 cp.delete_all = 0x01;
818 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
819 sizeof(cp), &cp);
820 }
821
d62e6d67
JH		 822 /* Set event mask page 2 if the HCI command for it is supported */
823 if (hdev->commands[22] & 0x04)
824 hci_set_event_mask_page_2(req);
825
109e3191
MH		 826 /* Read local codec list if the HCI command is supported */
827 if (hdev->commands[29] & 0x20)
828 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
829
a4790360
MH		 830 /* Read local pairing options if the HCI command is supported */
831 if (hdev->commands[41] & 0x08)
832 hci_req_add(req, HCI_OP_READ_LOCAL_PAIRING_OPTS, 0, NULL);
833
f4fe73ed
MH		 834 /* Get MWS transport configuration if the HCI command is supported */
835 if (hdev->commands[30] & 0x08)
836 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
837
5d4e7e8d 838 /* Check for Synchronization Train support */
53b834d2 839 if (lmp_sync_train_capable(hdev))
5d4e7e8d 840 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
a6d0d690
MH		 841
842 /* Enable Secure Connections if supported and configured */
d7a5a11d 843 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
574ea3c7 844 bredr_sc_enabled(hdev)) {
a6d0d690 845 u8 support = 0x01;
574ea3c7 846
a6d0d690
MH		 847 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
848 sizeof(support), &support);
849 }
a1d01db1 850
00bce3fb
AM		 851 /* Set erroneous data reporting if supported to the wideband speech
852 * setting value
853 */
cde1a8a9
IFM		 854 if (hdev->commands[18] & 0x08 &&
855 !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks)) {
00bce3fb
AM		 856 bool enabled = hci_dev_test_flag(hdev,
857 HCI_WIDEBAND_SPEECH_ENABLED);
858
859 if (enabled !=
860 (hdev->err_data_reporting == ERR_DATA_REPORTING_ENABLED)) {
861 struct hci_cp_write_def_err_data_reporting cp;
862
863 cp.err_data_reporting = enabled ?
864 ERR_DATA_REPORTING_ENABLED :
865 ERR_DATA_REPORTING_DISABLED;
866
867 hci_req_add(req, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
868 sizeof(cp), &cp);
869 }
870 }
871
12204875
MH		 872 /* Set Suggested Default Data Length to maximum if supported */
873 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
874 struct hci_cp_le_write_def_data_len cp;
875
727ea61a
BDC		 876 cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
877 cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
12204875
MH		 878 hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
879 }
880
de2ba303
MH		 881 /* Set Default PHY parameters if command is supported */
882 if (hdev->commands[35] & 0x20) {
883 struct hci_cp_le_set_default_phy cp;
884
6decb5b4
JK		 885 cp.all_phys = 0x00;
886 cp.tx_phys = hdev->le_tx_def_phys;
887 cp.rx_phys = hdev->le_rx_def_phys;
de2ba303
MH		 888
889 hci_req_add(req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp), &cp);
890 }
891
a1d01db1 892 return 0;
5d4e7e8d
JH		 893}
894
2177bab5
JH		 895static int __hci_init(struct hci_dev *hdev)
896{
897 int err;
898
4ebeee2d 899 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
2177bab5
JH		 900 if (err < 0)
901 return err;
902
f640ee98
MH		 903 if (hci_dev_test_flag(hdev, HCI_SETUP))
904 hci_debugfs_create_basic(hdev);
4b4148e9 905
4ebeee2d 906 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
0af801b9
JH		 907 if (err < 0)
908 return err;
909
ca8bee5d 910 /* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
2177bab5 911 * BR/EDR/LE type controllers. AMP controllers only need the
0af801b9 912 * first two stages of init.
2177bab5 913 */
ca8bee5d 914 if (hdev->dev_type != HCI_PRIMARY)
2177bab5
JH		 915 return 0;
916
4ebeee2d 917 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
5d4e7e8d
JH		 918 if (err < 0)
919 return err;
920
4ebeee2d 921 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
baf27f6e
MH		 922 if (err < 0)
923 return err;
924
ec6cef9c
MH		 925 /* This function is only called when the controller is actually in
926 * configured state. When the controller is marked as unconfigured,
927 * this initialization procedure is not run.
928 *
929 * It means that it is possible that a controller runs through its
930 * setup phase and then discovers missing settings. If that is the
931 * case, then this function will not be called. It then will only
932 * be called during the config phase.
933 *
934 * So only when in setup phase or config phase, create the debugfs
935 * entries and register the SMP channels.
baf27f6e 936 */
d7a5a11d
MH		 937 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
938 !hci_dev_test_flag(hdev, HCI_CONFIG))
baf27f6e
MH		 939 return 0;
940
60c5f5fb
MH		 941 hci_debugfs_create_common(hdev);
942
71c3b60e 943 if (lmp_bredr_capable(hdev))
60c5f5fb 944 hci_debugfs_create_bredr(hdev);
2bfa3531 945
162a3bac 946 if (lmp_le_capable(hdev))
60c5f5fb 947 hci_debugfs_create_le(hdev);
e7b8fc92 948
baf27f6e 949 return 0;
2177bab5
JH		 950}
951
a1d01db1 952static int hci_init0_req(struct hci_request *req, unsigned long opt)
0ebca7d6
MH		 953{
954 struct hci_dev *hdev = req->hdev;
955
956 BT_DBG("%s %ld", hdev->name, opt);
957
958 /* Reset */
959 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
960 hci_reset_req(req, 0);
961
962 /* Read Local Version */
963 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
964
965 /* Read BD Address */
966 if (hdev->set_bdaddr)
967 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
a1d01db1
JH		 968
969 return 0;
0ebca7d6
MH		 970}
971
972static int __hci_unconf_init(struct hci_dev *hdev)
973{
974 int err;
975
cc78b44b
MH		 976 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
977 return 0;
978
4ebeee2d 979 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
0ebca7d6
MH		 980 if (err < 0)
981 return err;
982
f640ee98
MH		 983 if (hci_dev_test_flag(hdev, HCI_SETUP))
984 hci_debugfs_create_basic(hdev);
985
0ebca7d6
MH		 986 return 0;
987}
988
a1d01db1 989static int hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 990{
991 __u8 scan = opt;
992
42c6b129 993 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 994
995 /* Inquiry and Page scans */
42c6b129 996 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
a1d01db1 997 return 0;
1da177e4
LT		 998}
999
a1d01db1 1000static int hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1001{
1002 __u8 auth = opt;
1003
42c6b129 1004 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 1005
1006 /* Authentication */
42c6b129 1007 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
a1d01db1 1008 return 0;
1da177e4
LT		 1009}
1010
a1d01db1 1011static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1012{
1013 __u8 encrypt = opt;
1014
42c6b129 1015 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 1016
e4e8e37c 1017 /* Encryption */
42c6b129 1018 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
a1d01db1 1019 return 0;
1da177e4
LT		 1020}
1021
a1d01db1 1022static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 1023{
1024 __le16 policy = cpu_to_le16(opt);
1025
42c6b129 1026 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 1027
1028 /* Default link policy */
42c6b129 1029 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
a1d01db1 1030 return 0;
e4e8e37c
MH		 1031}
1032
8e87d142 1033/* Get HCI device by index.
1da177e4
LT		 1034 * Device is held on return. */
1035struct hci_dev *hci_dev_get(int index)
1036{
8035ded4 1037 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 1038
1039 BT_DBG("%d", index);
1040
1041 if (index < 0)
1042 return NULL;
1043
1044 read_lock(&hci_dev_list_lock);
8035ded4 1045 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 1046 if (d->id == index) {
1047 hdev = hci_dev_hold(d);
1048 break;
1049 }
1050 }
1051 read_unlock(&hci_dev_list_lock);
1052 return hdev;
1053}
1da177e4
LT		 1054
1055/* ---- Inquiry support ---- */
ff9ef578 1056
30dc78e1
JH		 1057bool hci_discovery_active(struct hci_dev *hdev)
1058{
1059 struct discovery_state *discov = &hdev->discovery;
1060
6fbe195d 1061 switch (discov->state) {
343f935b 1062 case DISCOVERY_FINDING:
6fbe195d 1063 case DISCOVERY_RESOLVING:
30dc78e1
JH		 1064 return true;
1065
6fbe195d
AG		 1066 default:
1067 return false;
1068 }
30dc78e1
JH		 1069}
1070
ff9ef578
JH		 1071void hci_discovery_set_state(struct hci_dev *hdev, int state)
1072{
bb3e0a33
JH		 1073 int old_state = hdev->discovery.state;
1074
ff9ef578
JH		 1075 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1076
bb3e0a33 1077 if (old_state == state)
ff9ef578
JH		 1078 return;
1079
bb3e0a33
JH		 1080 hdev->discovery.state = state;
1081
ff9ef578
JH		 1082 switch (state) {
1083 case DISCOVERY_STOPPED:
c54c3860
AG		 1084 hci_update_background_scan(hdev);
1085
bb3e0a33 1086 if (old_state != DISCOVERY_STARTING)
7b99b659 1087 mgmt_discovering(hdev, 0);
ff9ef578
JH		 1088 break;
1089 case DISCOVERY_STARTING:
1090 break;
343f935b 1091 case DISCOVERY_FINDING:
ff9ef578
JH		 1092 mgmt_discovering(hdev, 1);
1093 break;
30dc78e1
JH		 1094 case DISCOVERY_RESOLVING:
1095 break;
ff9ef578
JH		 1096 case DISCOVERY_STOPPING:
1097 break;
1098 }
ff9ef578
JH		 1099}
1100
1f9b9a5d 1101void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 1102{
30883512 1103 struct discovery_state *cache = &hdev->discovery;
b57c1a56 1104 struct inquiry_entry *p, *n;
1da177e4 1105
561aafbc
JH		 1106 list_for_each_entry_safe(p, n, &cache->all, all) {
1107 list_del(&p->all);
b57c1a56 1108 kfree(p);
1da177e4 1109 }
561aafbc
JH		 1110
1111 INIT_LIST_HEAD(&cache->unknown);
1112 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 1113}
1114
a8c5fb1a
GP		 1115struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1116 bdaddr_t *bdaddr)
1da177e4 1117{
30883512 1118 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 1119 struct inquiry_entry *e;
1120
6ed93dc6 1121 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 1122
561aafbc
JH		 1123 list_for_each_entry(e, &cache->all, all) {
1124 if (!bacmp(&e->data.bdaddr, bdaddr))
1125 return e;
1126 }
1127
1128 return NULL;
1129}
1130
1131struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 1132 bdaddr_t *bdaddr)
561aafbc 1133{
30883512 1134 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 1135 struct inquiry_entry *e;
1136
6ed93dc6 1137 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 1138
1139 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 1140 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 1141 return e;
1142 }
1143
1144 return NULL;
1da177e4
LT		 1145}
1146
30dc78e1 1147struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 1148 bdaddr_t *bdaddr,
1149 int state)
30dc78e1
JH		 1150{
1151 struct discovery_state *cache = &hdev->discovery;
1152 struct inquiry_entry *e;
1153
6ed93dc6 1154 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 1155
1156 list_for_each_entry(e, &cache->resolve, list) {
1157 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1158 return e;
1159 if (!bacmp(&e->data.bdaddr, bdaddr))
1160 return e;
1161 }
1162
1163 return NULL;
1164}
1165
a3d4e20a 1166void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 1167 struct inquiry_entry *ie)
a3d4e20a
JH		 1168{
1169 struct discovery_state *cache = &hdev->discovery;
1170 struct list_head *pos = &cache->resolve;
1171 struct inquiry_entry *p;
1172
1173 list_del(&ie->list);
1174
1175 list_for_each_entry(p, &cache->resolve, list) {
1176 if (p->name_state != NAME_PENDING &&
a8c5fb1a 1177 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 1178 break;
1179 pos = &p->list;
1180 }
1181
1182 list_add(&ie->list, pos);
1183}
1184
af58925c
MH		 1185u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1186 bool name_known)
1da177e4 1187{
30883512 1188 struct discovery_state *cache = &hdev->discovery;
70f23020 1189 struct inquiry_entry *ie;
af58925c 1190 u32 flags = 0;
1da177e4 1191
6ed93dc6 1192 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 1193
6928a924 1194 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
2b2fec4d 1195
af58925c
MH		 1196 if (!data->ssp_mode)
1197 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 1198
70f23020 1199 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 1200 if (ie) {
af58925c
MH		 1201 if (!ie->data.ssp_mode)
1202 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 1203
a3d4e20a 1204 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 1205 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 1206 ie->data.rssi = data->rssi;
1207 hci_inquiry_cache_update_resolve(hdev, ie);
1208 }
1209
561aafbc 1210 goto update;
a3d4e20a 1211 }
561aafbc
JH		 1212
1213 /* Entry not in the cache. Add new one. */
27f70f3e 1214 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
af58925c
MH		 1215 if (!ie) {
1216 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1217 goto done;
1218 }
561aafbc
JH		 1219
1220 list_add(&ie->all, &cache->all);
1221
1222 if (name_known) {
1223 ie->name_state = NAME_KNOWN;
1224 } else {
1225 ie->name_state = NAME_NOT_KNOWN;
1226 list_add(&ie->list, &cache->unknown);
1227 }
70f23020 1228
561aafbc
JH		 1229update:
1230 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 1231 ie->name_state != NAME_PENDING) {
561aafbc
JH		 1232 ie->name_state = NAME_KNOWN;
1233 list_del(&ie->list);
1da177e4
LT		 1234 }
1235
70f23020
AE		 1236 memcpy(&ie->data, data, sizeof(*data));
1237 ie->timestamp = jiffies;
1da177e4 1238 cache->timestamp = jiffies;
3175405b
JH		 1239
1240 if (ie->name_state == NAME_NOT_KNOWN)
af58925c 1241 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
3175405b 1242
af58925c
MH		 1243done:
1244 return flags;
1da177e4
LT		 1245}
1246
1247static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1248{
30883512 1249 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 1250 struct inquiry_info *info = (struct inquiry_info *) buf;
1251 struct inquiry_entry *e;
1252 int copied = 0;
1253
561aafbc 1254 list_for_each_entry(e, &cache->all, all) {
1da177e4 1255 struct inquiry_data *data = &e->data;
b57c1a56
JH		 1256
1257 if (copied >= num)
1258 break;
1259
1da177e4
LT		 1260 bacpy(&info->bdaddr, &data->bdaddr);
1261 info->pscan_rep_mode = data->pscan_rep_mode;
1262 info->pscan_period_mode = data->pscan_period_mode;
1263 info->pscan_mode = data->pscan_mode;
1264 memcpy(info->dev_class, data->dev_class, 3);
1265 info->clock_offset = data->clock_offset;
b57c1a56 1266
1da177e4 1267 info++;
b57c1a56 1268 copied++;
1da177e4
LT		 1269 }
1270
1271 BT_DBG("cache %p, copied %d", cache, copied);
1272 return copied;
1273}
1274
a1d01db1 1275static int hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1276{
1277 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 1278 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 1279 struct hci_cp_inquiry cp;
1280
1281 BT_DBG("%s", hdev->name);
1282
1283 if (test_bit(HCI_INQUIRY, &hdev->flags))
a1d01db1 1284 return 0;
1da177e4
LT		 1285
1286 /* Start Inquiry */
1287 memcpy(&cp.lap, &ir->lap, 3);
1288 cp.length = ir->length;
1289 cp.num_rsp = ir->num_rsp;
42c6b129 1290 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
a1d01db1
JH		 1291
1292 return 0;
1da177e4
LT		 1293}
1294
1295int hci_inquiry(void __user *arg)
1296{
1297 __u8 __user *ptr = arg;
1298 struct hci_inquiry_req ir;
1299 struct hci_dev *hdev;
1300 int err = 0, do_inquiry = 0, max_rsp;
1301 long timeo;
1302 __u8 *buf;
1303
1304 if (copy_from_user(&ir, ptr, sizeof(ir)))
1305 return -EFAULT;
1306
5a08ecce
AE		 1307 hdev = hci_dev_get(ir.dev_id);
1308 if (!hdev)
1da177e4
LT		 1309 return -ENODEV;
1310
d7a5a11d 1311 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1312 err = -EBUSY;
1313 goto done;
1314 }
1315
d7a5a11d 1316 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1317 err = -EOPNOTSUPP;
1318 goto done;
1319 }
1320
ca8bee5d 1321 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 1322 err = -EOPNOTSUPP;
1323 goto done;
1324 }
1325
d7a5a11d 1326 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 1327 err = -EOPNOTSUPP;
1328 goto done;
1329 }
1330
09fd0de5 1331 hci_dev_lock(hdev);
8e87d142 1332 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 1333 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 1334 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 1335 do_inquiry = 1;
1336 }
09fd0de5 1337 hci_dev_unlock(hdev);
1da177e4 1338
04837f64 1339 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 1340
1341 if (do_inquiry) {
01178cd4 1342 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
4ebeee2d 1343 timeo, NULL);
70f23020
AE		 1344 if (err < 0)
1345 goto done;
3e13fa1e
AG		 1346
1347 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1348 * cleared). If it is interrupted by a signal, return -EINTR.
1349 */
74316201 1350 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
3e13fa1e
AG		 1351 TASK_INTERRUPTIBLE))
1352 return -EINTR;
70f23020 1353 }
1da177e4 1354
8fc9ced3
GP		 1355 /* for unlimited number of responses we will use buffer with
1356 * 255 entries
1357 */
1da177e4
LT		 1358 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1359
1360 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1361 * copy it to the user space.
1362 */
6da2ec56 1363 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
70f23020 1364 if (!buf) {
1da177e4
LT		 1365 err = -ENOMEM;
1366 goto done;
1367 }
1368
09fd0de5 1369 hci_dev_lock(hdev);
1da177e4 1370 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 1371 hci_dev_unlock(hdev);
1da177e4
LT		 1372
1373 BT_DBG("num_rsp %d", ir.num_rsp);
1374
1375 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1376 ptr += sizeof(ir);
1377 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 1378 ir.num_rsp))
1da177e4 1379 err = -EFAULT;
8e87d142 1380 } else
1da177e4
LT		 1381 err = -EFAULT;
1382
1383 kfree(buf);
1384
1385done:
1386 hci_dev_put(hdev);
1387 return err;
1388}
1389
7a0e5b15
MK		 1390/**
1391 * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address
1392 * (BD_ADDR) for a HCI device from
1393 * a firmware node property.
1394 * @hdev: The HCI device
1395 *
1396 * Search the firmware node for 'local-bd-address'.
1397 *
1398 * All-zero BD addresses are rejected, because those could be properties
1399 * that exist in the firmware tables, but were not updated by the firmware. For
1400 * example, the DTS could define 'local-bd-address', with zero BD addresses.
1401 */
1402static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev)
1403{
1404 struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
1405 bdaddr_t ba;
1406 int ret;
1407
1408 ret = fwnode_property_read_u8_array(fwnode, "local-bd-address",
1409 (u8 *)&ba, sizeof(ba));
1410 if (ret < 0 || !bacmp(&ba, BDADDR_ANY))
1411 return;
1412
1413 bacpy(&hdev->public_addr, &ba);
1414}
1415
cbed0ca1 1416static int hci_dev_do_open(struct hci_dev *hdev)
1da177e4 1417{
1da177e4
LT		 1418 int ret = 0;
1419
1da177e4
LT		 1420 BT_DBG("%s %p", hdev->name, hdev);
1421
b504430c 1422 hci_req_sync_lock(hdev);
1da177e4 1423
d7a5a11d 1424 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
94324962
JH		 1425 ret = -ENODEV;
1426 goto done;
1427 }
1428
d7a5a11d
MH		 1429 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1430 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
a5c8f270
MH		 1431 /* Check for rfkill but allow the HCI setup stage to
1432 * proceed (which in itself doesn't cause any RF activity).
1433 */
d7a5a11d 1434 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
a5c8f270
MH		 1435 ret = -ERFKILL;
1436 goto done;
1437 }
1438
1439 /* Check for valid public address or a configured static
1440 * random adddress, but let the HCI setup proceed to
1441 * be able to determine if there is a public address
1442 * or not.
1443 *
c6beca0e
MH		 1444 * In case of user channel usage, it is not important
1445 * if a public address or static random address is
1446 * available.
1447 *
a5c8f270
MH		 1448 * This check is only valid for BR/EDR controllers
1449 * since AMP controllers do not have an address.
1450 */
d7a5a11d 1451 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
ca8bee5d 1452 hdev->dev_type == HCI_PRIMARY &&
a5c8f270
MH		 1453 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1454 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1455 ret = -EADDRNOTAVAIL;
1456 goto done;
1457 }
611b30f7
MH		 1458 }
1459
1da177e4
LT		 1460 if (test_bit(HCI_UP, &hdev->flags)) {
1461 ret = -EALREADY;
1462 goto done;
1463 }
1464
1da177e4
LT		 1465 if (hdev->open(hdev)) {
1466 ret = -EIO;
1467 goto done;
1468 }
1469
e9ca8bf1 1470 set_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1471 hci_sock_dev_event(hdev, HCI_DEV_OPEN);
4a3f95b7 1472
f41c70c4
MH		 1473 atomic_set(&hdev->cmd_cnt, 1);
1474 set_bit(HCI_INIT, &hdev->flags);
1475
740011cf
SW		 1476 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1477 test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
7fdf6c6a
MH		 1478 bool invalid_bdaddr;
1479
e131d74a
MH		 1480 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1481
af202f84
MH		 1482 if (hdev->setup)
1483 ret = hdev->setup(hdev);
f41c70c4 1484
7fdf6c6a
MH		 1485 /* The transport driver can set the quirk to mark the
1486 * BD_ADDR invalid before creating the HCI device or in
1487 * its setup callback.
1488 */
1489 invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR,
1490 &hdev->quirks);
1491
7a0e5b15
MK		 1492 if (ret)
1493 goto setup_failed;
1494
1495 if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
1496 if (!bacmp(&hdev->public_addr, BDADDR_ANY))
1497 hci_dev_get_bd_addr_from_property(hdev);
1498
1499 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
7fdf6c6a 1500 hdev->set_bdaddr) {
7a0e5b15
MK		 1501 ret = hdev->set_bdaddr(hdev,
1502 &hdev->public_addr);
7fdf6c6a
MH		 1503
1504 /* If setting of the BD_ADDR from the device
1505 * property succeeds, then treat the address
1506 * as valid even if the invalid BD_ADDR
1507 * quirk indicates otherwise.
1508 */
1509 if (!ret)
1510 invalid_bdaddr = false;
1511 }
7a0e5b15
MK		 1512 }
1513
1514setup_failed:
af202f84
MH		 1515 /* The transport driver can set these quirks before
1516 * creating the HCI device or in its setup callback.
1517 *
7fdf6c6a
MH		 1518 * For the invalid BD_ADDR quirk it is possible that
1519 * it becomes a valid address if the bootloader does
1520 * provide it (see above).
1521 *
af202f84
MH		 1522 * In case any of them is set, the controller has to
1523 * start up as unconfigured.
1524 */
eb1904f4 1525 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
7fdf6c6a 1526 invalid_bdaddr)
a1536da2 1527 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
f41c70c4 1528
0ebca7d6
MH		 1529 /* For an unconfigured controller it is required to
1530 * read at least the version information provided by
1531 * the Read Local Version Information command.
1532 *
1533 * If the set_bdaddr driver callback is provided, then
1534 * also the original Bluetooth public device address
1535 * will be read using the Read BD Address command.
1536 */
d7a5a11d 1537 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
0ebca7d6 1538 ret = __hci_unconf_init(hdev);
89bc22d2
MH		 1539 }
1540
d7a5a11d 1541 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
9713c17b
MH		 1542 /* If public address change is configured, ensure that
1543 * the address gets programmed. If the driver does not
1544 * support changing the public address, fail the power
1545 * on procedure.
1546 */
1547 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1548 hdev->set_bdaddr)
24c457e2
MH		 1549 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1550 else
1551 ret = -EADDRNOTAVAIL;
1552 }
1553
f41c70c4 1554 if (!ret) {
d7a5a11d 1555 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
98a63aaf 1556 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
f41c70c4 1557 ret = __hci_init(hdev);
98a63aaf
MH		 1558 if (!ret && hdev->post_init)
1559 ret = hdev->post_init(hdev);
1560 }
1da177e4
LT		 1561 }
1562
7e995b9e
MH		 1563 /* If the HCI Reset command is clearing all diagnostic settings,
1564 * then they need to be reprogrammed after the init procedure
1565 * completed.
1566 */
1567 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
b56c7b25 1568 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
7e995b9e
MH		 1569 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1570 ret = hdev->set_diag(hdev, true);
1571
145373cb
MC		 1572 msft_do_open(hdev);
1573
f41c70c4
MH		 1574 clear_bit(HCI_INIT, &hdev->flags);
1575
1da177e4
LT		 1576 if (!ret) {
1577 hci_dev_hold(hdev);
a1536da2 1578 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
a73c046a 1579 hci_adv_instances_set_rpa_expired(hdev, true);
1da177e4 1580 set_bit(HCI_UP, &hdev->flags);
05fcd4c4 1581 hci_sock_dev_event(hdev, HCI_DEV_UP);
6d5d2ee6 1582 hci_leds_update_powered(hdev, true);
d7a5a11d
MH		 1583 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1584 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1585 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1586 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
2ff13894 1587 hci_dev_test_flag(hdev, HCI_MGMT) &&
ca8bee5d 1588 hdev->dev_type == HCI_PRIMARY) {
2ff13894
JH		 1589 ret = __hci_req_hci_power_on(hdev);
1590 mgmt_power_on(hdev, ret);
56e5cb86 1591 }
8e87d142 1592 } else {
1da177e4 1593 /* Init failed, cleanup */
3eff45ea 1594 flush_work(&hdev->tx_work);
c347b765 1595 flush_work(&hdev->cmd_work);
b78752cc 1596 flush_work(&hdev->rx_work);
1da177e4
LT		 1597
1598 skb_queue_purge(&hdev->cmd_q);
1599 skb_queue_purge(&hdev->rx_q);
1600
1601 if (hdev->flush)
1602 hdev->flush(hdev);
1603
1604 if (hdev->sent_cmd) {
1605 kfree_skb(hdev->sent_cmd);
1606 hdev->sent_cmd = NULL;
1607 }
1608
e9ca8bf1 1609 clear_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1610 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
4a3f95b7 1611
1da177e4 1612 hdev->close(hdev);
fee746b0 1613 hdev->flags &= BIT(HCI_RAW);
1da177e4
LT		 1614 }
1615
1616done:
b504430c 1617 hci_req_sync_unlock(hdev);
1da177e4
LT		 1618 return ret;
1619}
1620
cbed0ca1
JH		 1621/* ---- HCI ioctl helpers ---- */
1622
1623int hci_dev_open(__u16 dev)
1624{
1625 struct hci_dev *hdev;
1626 int err;
1627
1628 hdev = hci_dev_get(dev);
1629 if (!hdev)
1630 return -ENODEV;
1631
4a964404 1632 /* Devices that are marked as unconfigured can only be powered
fee746b0
MH		 1633 * up as user channel. Trying to bring them up as normal devices
1634 * will result into a failure. Only user channel operation is
1635 * possible.
1636 *
1637 * When this function is called for a user channel, the flag
1638 * HCI_USER_CHANNEL will be set first before attempting to
1639 * open the device.
1640 */
d7a5a11d
MH		 1641 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1642 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
fee746b0
MH		 1643 err = -EOPNOTSUPP;
1644 goto done;
1645 }
1646
e1d08f40
JH		 1647 /* We need to ensure that no other power on/off work is pending
1648 * before proceeding to call hci_dev_do_open. This is
1649 * particularly important if the setup procedure has not yet
1650 * completed.
1651 */
a69d8927 1652 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
e1d08f40
JH		 1653 cancel_delayed_work(&hdev->power_off);
1654
a5c8f270
MH		 1655 /* After this call it is guaranteed that the setup procedure
1656 * has finished. This means that error conditions like RFKILL
1657 * or no valid public or static random address apply.
1658 */
e1d08f40
JH		 1659 flush_workqueue(hdev->req_workqueue);
1660
12aa4f0a 1661 /* For controllers not using the management interface and that
b6ae8457 1662 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
12aa4f0a
MH		 1663 * so that pairing works for them. Once the management interface
1664 * is in use this bit will be cleared again and userspace has
1665 * to explicitly enable it.
1666 */
d7a5a11d
MH		 1667 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1668 !hci_dev_test_flag(hdev, HCI_MGMT))
a1536da2 1669 hci_dev_set_flag(hdev, HCI_BONDABLE);
12aa4f0a 1670
cbed0ca1
JH		 1671 err = hci_dev_do_open(hdev);
1672
fee746b0 1673done:
cbed0ca1 1674 hci_dev_put(hdev);
cbed0ca1
JH		 1675 return err;
1676}
1677
d7347f3c
JH		 1678/* This function requires the caller holds hdev->lock */
1679static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1680{
1681 struct hci_conn_params *p;
1682
f161dd41
JH		 1683 list_for_each_entry(p, &hdev->le_conn_params, list) {
1684 if (p->conn) {
1685 hci_conn_drop(p->conn);
f8aaf9b6 1686 hci_conn_put(p->conn);
f161dd41
JH		 1687 p->conn = NULL;
1688 }
d7347f3c 1689 list_del_init(&p->action);
f161dd41 1690 }
d7347f3c
JH		 1691
1692 BT_DBG("All LE pending actions cleared");
1693}
1694
6b3cc1db 1695int hci_dev_do_close(struct hci_dev *hdev)
1da177e4 1696{
acc649c6
MH		 1697 bool auto_off;
1698
1da177e4
LT		 1699 BT_DBG("%s %p", hdev->name, hdev);
1700
d24d8144 1701 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
867146a0 1702 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
d24d8144 1703 test_bit(HCI_UP, &hdev->flags)) {
a44fecbd
THJA		 1704 /* Execute vendor specific shutdown routine */
1705 if (hdev->shutdown)
1706 hdev->shutdown(hdev);
1707 }
1708
78c04c0b
VCG		 1709 cancel_delayed_work(&hdev->power_off);
1710
7df0f73e 1711 hci_request_cancel_all(hdev);
b504430c 1712 hci_req_sync_lock(hdev);
1da177e4
LT		 1713
1714 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
65cc2b49 1715 cancel_delayed_work_sync(&hdev->cmd_timer);
b504430c 1716 hci_req_sync_unlock(hdev);
1da177e4
LT		 1717 return 0;
1718 }
1719
6d5d2ee6
HK		 1720 hci_leds_update_powered(hdev, false);
1721
3eff45ea
GP		 1722 /* Flush RX and TX works */
1723 flush_work(&hdev->tx_work);
b78752cc 1724 flush_work(&hdev->rx_work);
1da177e4 1725
16ab91ab 1726 if (hdev->discov_timeout > 0) {
16ab91ab 1727 hdev->discov_timeout = 0;
a358dc11
MH		 1728 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1729 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
16ab91ab
JH		 1730 }
1731
a69d8927 1732 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1733 cancel_delayed_work(&hdev->service_cache);
1734
a73c046a
JK		 1735 if (hci_dev_test_flag(hdev, HCI_MGMT)) {
1736 struct adv_info *adv_instance;
1737
4518bb0f 1738 cancel_delayed_work_sync(&hdev->rpa_expired);
7ba8b4be 1739
a73c046a
JK		 1740 list_for_each_entry(adv_instance, &hdev->adv_instances, list)
1741 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1742 }
1743
76727c02
JH		 1744 /* Avoid potential lockdep warnings from the *_flush() calls by
1745 * ensuring the workqueue is empty up front.
1746 */
1747 drain_workqueue(hdev->workqueue);
1748
09fd0de5 1749 hci_dev_lock(hdev);
1aeb9c65 1750
8f502f84
JH		 1751 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1752
acc649c6
MH		 1753 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1754
ca8bee5d 1755 if (!auto_off && hdev->dev_type == HCI_PRIMARY &&
baab7932 1756 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
2ff13894
JH		 1757 hci_dev_test_flag(hdev, HCI_MGMT))
1758 __mgmt_power_off(hdev);
1aeb9c65 1759
1f9b9a5d 1760 hci_inquiry_cache_flush(hdev);
d7347f3c 1761 hci_pend_le_actions_clear(hdev);
f161dd41 1762 hci_conn_hash_flush(hdev);
09fd0de5 1763 hci_dev_unlock(hdev);
1da177e4 1764
64dae967
MH		 1765 smp_unregister(hdev);
1766
05fcd4c4 1767 hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1da177e4 1768
145373cb
MC		 1769 msft_do_close(hdev);
1770
1da177e4
LT		 1771 if (hdev->flush)
1772 hdev->flush(hdev);
1773
1774 /* Reset device */
1775 skb_queue_purge(&hdev->cmd_q);
1776 atomic_set(&hdev->cmd_cnt, 1);
acc649c6
MH		 1777 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1778 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1da177e4 1779 set_bit(HCI_INIT, &hdev->flags);
4ebeee2d 1780 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1da177e4
LT		 1781 clear_bit(HCI_INIT, &hdev->flags);
1782 }
1783
c347b765
GP		 1784 /* flush cmd work */
1785 flush_work(&hdev->cmd_work);
1da177e4
LT		 1786
1787 /* Drop queues */
1788 skb_queue_purge(&hdev->rx_q);
1789 skb_queue_purge(&hdev->cmd_q);
1790 skb_queue_purge(&hdev->raw_q);
1791
1792 /* Drop last sent command */
1793 if (hdev->sent_cmd) {
65cc2b49 1794 cancel_delayed_work_sync(&hdev->cmd_timer);
1da177e4
LT		 1795 kfree_skb(hdev->sent_cmd);
1796 hdev->sent_cmd = NULL;
1797 }
1798
e9ca8bf1 1799 clear_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1800 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
4a3f95b7 1801
9952d90e
APS		 1802 if (test_and_clear_bit(SUSPEND_POWERING_DOWN, hdev->suspend_tasks))
1803 wake_up(&hdev->suspend_wait_q);
1804
1da177e4
LT		 1805 /* After this point our queues are empty
1806 * and no tasks are scheduled. */
1807 hdev->close(hdev);
1808
35b973c9 1809 /* Clear flags */
fee746b0 1810 hdev->flags &= BIT(HCI_RAW);
eacb44df 1811 hci_dev_clear_volatile_flags(hdev);
35b973c9 1812
ced5c338 1813 /* Controller radio is available but is currently powered down */
536619e8 1814 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
ced5c338 1815
e59fda8d 1816 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 1817 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
7a4cd51d 1818 bacpy(&hdev->random_addr, BDADDR_ANY);
e59fda8d 1819
b504430c 1820 hci_req_sync_unlock(hdev);
1da177e4
LT		 1821
1822 hci_dev_put(hdev);
1823 return 0;
1824}
1825
1826int hci_dev_close(__u16 dev)
1827{
1828 struct hci_dev *hdev;
1829 int err;
1830
70f23020
AE		 1831 hdev = hci_dev_get(dev);
1832 if (!hdev)
1da177e4 1833 return -ENODEV;
8ee56540 1834
d7a5a11d 1835 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1836 err = -EBUSY;
1837 goto done;
1838 }
1839
a69d8927 1840 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
8ee56540
MH		 1841 cancel_delayed_work(&hdev->power_off);
1842
1da177e4 1843 err = hci_dev_do_close(hdev);
8ee56540 1844
0736cfa8 1845done:
1da177e4
LT		 1846 hci_dev_put(hdev);
1847 return err;
1848}
1849
5c912495 1850static int hci_dev_do_reset(struct hci_dev *hdev)
1da177e4 1851{
5c912495 1852 int ret;
1da177e4 1853
5c912495 1854 BT_DBG("%s %p", hdev->name, hdev);
1da177e4 1855
b504430c 1856 hci_req_sync_lock(hdev);
1da177e4 1857
1da177e4
LT		 1858 /* Drop queues */
1859 skb_queue_purge(&hdev->rx_q);
1860 skb_queue_purge(&hdev->cmd_q);
1861
76727c02
JH		 1862 /* Avoid potential lockdep warnings from the *_flush() calls by
1863 * ensuring the workqueue is empty up front.
1864 */
1865 drain_workqueue(hdev->workqueue);
1866
09fd0de5 1867 hci_dev_lock(hdev);
1f9b9a5d 1868 hci_inquiry_cache_flush(hdev);
1da177e4 1869 hci_conn_hash_flush(hdev);
09fd0de5 1870 hci_dev_unlock(hdev);
1da177e4
LT		 1871
1872 if (hdev->flush)
1873 hdev->flush(hdev);
1874
8e87d142 1875 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 1876 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4 1877
4ebeee2d 1878 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1da177e4 1879
b504430c 1880 hci_req_sync_unlock(hdev);
1da177e4
LT		 1881 return ret;
1882}
1883
5c912495
MH		 1884int hci_dev_reset(__u16 dev)
1885{
1886 struct hci_dev *hdev;
1887 int err;
1888
1889 hdev = hci_dev_get(dev);
1890 if (!hdev)
1891 return -ENODEV;
1892
1893 if (!test_bit(HCI_UP, &hdev->flags)) {
1894 err = -ENETDOWN;
1895 goto done;
1896 }
1897
d7a5a11d 1898 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
5c912495
MH		 1899 err = -EBUSY;
1900 goto done;
1901 }
1902
d7a5a11d 1903 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
5c912495
MH		 1904 err = -EOPNOTSUPP;
1905 goto done;
1906 }
1907
1908 err = hci_dev_do_reset(hdev);
1909
1910done:
1911 hci_dev_put(hdev);
1912 return err;
1913}
1914
1da177e4
LT		 1915int hci_dev_reset_stat(__u16 dev)
1916{
1917 struct hci_dev *hdev;
1918 int ret = 0;
1919
70f23020
AE		 1920 hdev = hci_dev_get(dev);
1921 if (!hdev)
1da177e4
LT		 1922 return -ENODEV;
1923
d7a5a11d 1924 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1925 ret = -EBUSY;
1926 goto done;
1927 }
1928
d7a5a11d 1929 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1930 ret = -EOPNOTSUPP;
1931 goto done;
1932 }
1933
1da177e4
LT		 1934 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1935
0736cfa8 1936done:
1da177e4 1937 hci_dev_put(hdev);
1da177e4
LT		 1938 return ret;
1939}
1940
123abc08
JH		 1941static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1942{
bc6d2d04 1943 bool conn_changed, discov_changed;
123abc08
JH		 1944
1945 BT_DBG("%s scan 0x%02x", hdev->name, scan);
1946
1947 if ((scan & SCAN_PAGE))
238be788
MH		 1948 conn_changed = !hci_dev_test_and_set_flag(hdev,
1949 HCI_CONNECTABLE);
123abc08 1950 else
a69d8927
MH		 1951 conn_changed = hci_dev_test_and_clear_flag(hdev,
1952 HCI_CONNECTABLE);
123abc08 1953
bc6d2d04 1954 if ((scan & SCAN_INQUIRY)) {
238be788
MH		 1955 discov_changed = !hci_dev_test_and_set_flag(hdev,
1956 HCI_DISCOVERABLE);
bc6d2d04 1957 } else {
a358dc11 1958 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
a69d8927
MH		 1959 discov_changed = hci_dev_test_and_clear_flag(hdev,
1960 HCI_DISCOVERABLE);
bc6d2d04
JH		 1961 }
1962
d7a5a11d 1963 if (!hci_dev_test_flag(hdev, HCI_MGMT))
123abc08
JH		 1964 return;
1965
bc6d2d04
JH		 1966 if (conn_changed || discov_changed) {
1967 /* In case this was disabled through mgmt */
a1536da2 1968 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
bc6d2d04 1969
d7a5a11d 1970 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
cab054ab 1971 hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
bc6d2d04 1972
123abc08 1973 mgmt_new_settings(hdev);
bc6d2d04 1974 }
123abc08
JH		 1975}
1976
1da177e4
LT		 1977int hci_dev_cmd(unsigned int cmd, void __user *arg)
1978{
1979 struct hci_dev *hdev;
1980 struct hci_dev_req dr;
1981 int err = 0;
1982
1983 if (copy_from_user(&dr, arg, sizeof(dr)))
1984 return -EFAULT;
1985
70f23020
AE		 1986 hdev = hci_dev_get(dr.dev_id);
1987 if (!hdev)
1da177e4
LT		 1988 return -ENODEV;
1989
d7a5a11d 1990 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1991 err = -EBUSY;
1992 goto done;
1993 }
1994
d7a5a11d 1995 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1996 err = -EOPNOTSUPP;
1997 goto done;
1998 }
1999
ca8bee5d 2000 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 2001 err = -EOPNOTSUPP;
2002 goto done;
2003 }
2004
d7a5a11d 2005 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 2006 err = -EOPNOTSUPP;
2007 goto done;
2008 }
2009
1da177e4
LT		 2010 switch (cmd) {
2011 case HCISETAUTH:
01178cd4 2012 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 2013 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 2014 break;
2015
2016 case HCISETENCRYPT:
2017 if (!lmp_encrypt_capable(hdev)) {
2018 err = -EOPNOTSUPP;
2019 break;
2020 }
2021
2022 if (!test_bit(HCI_AUTH, &hdev->flags)) {
2023 /* Auth must be enabled first */
01178cd4 2024 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 2025 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 2026 if (err)
2027 break;
2028 }
2029
01178cd4 2030 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
4ebeee2d 2031 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 2032 break;
2033
2034 case HCISETSCAN:
01178cd4 2035 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
4ebeee2d 2036 HCI_INIT_TIMEOUT, NULL);
91a668b0 2037
bc6d2d04
JH		 2038 /* Ensure that the connectable and discoverable states
2039 * get correctly modified as this was a non-mgmt change.
91a668b0 2040 */
123abc08
JH		 2041 if (!err)
2042 hci_update_scan_state(hdev, dr.dev_opt);
1da177e4
LT		 2043 break;
2044
1da177e4 2045 case HCISETLINKPOL:
01178cd4 2046 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
4ebeee2d 2047 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 2048 break;
2049
2050 case HCISETLINKMODE:
e4e8e37c
MH		 2051 hdev->link_mode = ((__u16) dr.dev_opt) &
2052 (HCI_LM_MASTER | HCI_LM_ACCEPT);
2053 break;
2054
2055 case HCISETPTYPE:
b7c23df8
JK		 2056 if (hdev->pkt_type == (__u16) dr.dev_opt)
2057 break;
2058
e4e8e37c 2059 hdev->pkt_type = (__u16) dr.dev_opt;
b7c23df8 2060 mgmt_phy_configuration_changed(hdev, NULL);
1da177e4
LT		 2061 break;
2062
2063 case HCISETACLMTU:
e4e8e37c
MH		 2064 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
2065 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 2066 break;
2067
2068 case HCISETSCOMTU:
e4e8e37c
MH		 2069 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
2070 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 2071 break;
2072
2073 default:
2074 err = -EINVAL;
2075 break;
2076 }
e4e8e37c 2077
0736cfa8 2078done:
1da177e4
LT		 2079 hci_dev_put(hdev);
2080 return err;
2081}
2082
2083int hci_get_dev_list(void __user *arg)
2084{
8035ded4 2085 struct hci_dev *hdev;
1da177e4
LT		 2086 struct hci_dev_list_req *dl;
2087 struct hci_dev_req *dr;
1da177e4
LT		 2088 int n = 0, size, err;
2089 __u16 dev_num;
2090
2091 if (get_user(dev_num, (__u16 __user *) arg))
2092 return -EFAULT;
2093
2094 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2095 return -EINVAL;
2096
2097 size = sizeof(*dl) + dev_num * sizeof(*dr);
2098
70f23020
AE		 2099 dl = kzalloc(size, GFP_KERNEL);
2100 if (!dl)
1da177e4
LT		 2101 return -ENOMEM;
2102
2103 dr = dl->dev_req;
2104
f20d09d5 2105 read_lock(&hci_dev_list_lock);
8035ded4 2106 list_for_each_entry(hdev, &hci_dev_list, list) {
2e84d8db 2107 unsigned long flags = hdev->flags;
c542a06c 2108
2e84d8db
MH		 2109 /* When the auto-off is configured it means the transport
2110 * is running, but in that case still indicate that the
2111 * device is actually down.
2112 */
d7a5a11d 2113 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db 2114 flags &= ~BIT(HCI_UP);
c542a06c 2115
1da177e4 2116 (dr + n)->dev_id = hdev->id;
2e84d8db 2117 (dr + n)->dev_opt = flags;
c542a06c 2118
1da177e4
LT		 2119 if (++n >= dev_num)
2120 break;
2121 }
f20d09d5 2122 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 2123
2124 dl->dev_num = n;
2125 size = sizeof(*dl) + n * sizeof(*dr);
2126
2127 err = copy_to_user(arg, dl, size);
2128 kfree(dl);
2129
2130 return err ? -EFAULT : 0;
2131}
2132
2133int hci_get_dev_info(void __user *arg)
2134{
2135 struct hci_dev *hdev;
2136 struct hci_dev_info di;
2e84d8db 2137 unsigned long flags;
1da177e4
LT		 2138 int err = 0;
2139
2140 if (copy_from_user(&di, arg, sizeof(di)))
2141 return -EFAULT;
2142
70f23020
AE		 2143 hdev = hci_dev_get(di.dev_id);
2144 if (!hdev)
1da177e4
LT		 2145 return -ENODEV;
2146
2e84d8db
MH		 2147 /* When the auto-off is configured it means the transport
2148 * is running, but in that case still indicate that the
2149 * device is actually down.
2150 */
d7a5a11d 2151 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db
MH		 2152 flags = hdev->flags & ~BIT(HCI_UP);
2153 else
2154 flags = hdev->flags;
c542a06c 2155
1da177e4
LT		 2156 strcpy(di.name, hdev->name);
2157 di.bdaddr = hdev->bdaddr;
60f2a3ed 2158 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2e84d8db 2159 di.flags = flags;
1da177e4 2160 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 2161 if (lmp_bredr_capable(hdev)) {
2162 di.acl_mtu = hdev->acl_mtu;
2163 di.acl_pkts = hdev->acl_pkts;
2164 di.sco_mtu = hdev->sco_mtu;
2165 di.sco_pkts = hdev->sco_pkts;
2166 } else {
2167 di.acl_mtu = hdev->le_mtu;
2168 di.acl_pkts = hdev->le_pkts;
2169 di.sco_mtu = 0;
2170 di.sco_pkts = 0;
2171 }
1da177e4
LT		 2172 di.link_policy = hdev->link_policy;
2173 di.link_mode = hdev->link_mode;
2174
2175 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2176 memcpy(&di.features, &hdev->features, sizeof(di.features));
2177
2178 if (copy_to_user(arg, &di, sizeof(di)))
2179 err = -EFAULT;
2180
2181 hci_dev_put(hdev);
2182
2183 return err;
2184}
2185
2186/* ---- Interface to HCI drivers ---- */
2187
611b30f7
MH		 2188static int hci_rfkill_set_block(void *data, bool blocked)
2189{
2190 struct hci_dev *hdev = data;
2191
2192 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2193
d7a5a11d 2194 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
0736cfa8
MH		 2195 return -EBUSY;
2196
5e130367 2197 if (blocked) {
a1536da2 2198 hci_dev_set_flag(hdev, HCI_RFKILLED);
d7a5a11d
MH		 2199 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2200 !hci_dev_test_flag(hdev, HCI_CONFIG))
bf543036 2201 hci_dev_do_close(hdev);
5e130367 2202 } else {
a358dc11 2203 hci_dev_clear_flag(hdev, HCI_RFKILLED);
1025c04c 2204 }
611b30f7
MH		 2205
2206 return 0;
2207}
2208
2209static const struct rfkill_ops hci_rfkill_ops = {
2210 .set_block = hci_rfkill_set_block,
2211};
2212
ab81cbf9
JH		 2213static void hci_power_on(struct work_struct *work)
2214{
2215 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 2216 int err;
ab81cbf9
JH		 2217
2218 BT_DBG("%s", hdev->name);
2219
2ff13894
JH		 2220 if (test_bit(HCI_UP, &hdev->flags) &&
2221 hci_dev_test_flag(hdev, HCI_MGMT) &&
2222 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
d82142a8 2223 cancel_delayed_work(&hdev->power_off);
2ff13894
JH		 2224 hci_req_sync_lock(hdev);
2225 err = __hci_req_hci_power_on(hdev);
2226 hci_req_sync_unlock(hdev);
2227 mgmt_power_on(hdev, err);
2228 return;
2229 }
2230
cbed0ca1 2231 err = hci_dev_do_open(hdev);
96570ffc 2232 if (err < 0) {
3ad67582 2233 hci_dev_lock(hdev);
96570ffc 2234 mgmt_set_powered_failed(hdev, err);
3ad67582 2235 hci_dev_unlock(hdev);
ab81cbf9 2236 return;
96570ffc 2237 }
ab81cbf9 2238
a5c8f270
MH		 2239 /* During the HCI setup phase, a few error conditions are
2240 * ignored and they need to be checked now. If they are still
2241 * valid, it is important to turn the device back off.
2242 */
d7a5a11d
MH		 2243 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2244 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
ca8bee5d 2245 (hdev->dev_type == HCI_PRIMARY &&
a5c8f270
MH		 2246 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2247 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
a358dc11 2248 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
bf543036 2249 hci_dev_do_close(hdev);
d7a5a11d 2250 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
19202573
JH		 2251 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2252 HCI_AUTO_OFF_TIMEOUT);
bf543036 2253 }
ab81cbf9 2254
a69d8927 2255 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
4a964404
MH		 2256 /* For unconfigured devices, set the HCI_RAW flag
2257 * so that userspace can easily identify them.
4a964404 2258 */
d7a5a11d 2259 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4a964404 2260 set_bit(HCI_RAW, &hdev->flags);
0602a8ad
MH		 2261
2262 /* For fully configured devices, this will send
2263 * the Index Added event. For unconfigured devices,
2264 * it will send Unconfigued Index Added event.
2265 *
2266 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2267 * and no event will be send.
2268 */
2269 mgmt_index_added(hdev);
a69d8927 2270 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
5ea234d3
MH		 2271 /* When the controller is now configured, then it
2272 * is important to clear the HCI_RAW flag.
2273 */
d7a5a11d 2274 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5ea234d3
MH		 2275 clear_bit(HCI_RAW, &hdev->flags);
2276
d603b76b
MH		 2277 /* Powering on the controller with HCI_CONFIG set only
2278 * happens with the transition from unconfigured to
2279 * configured. This will send the Index Added event.
2280 */
744cf19e 2281 mgmt_index_added(hdev);
fee746b0 2282 }
ab81cbf9
JH		 2283}
2284
2285static void hci_power_off(struct work_struct *work)
2286{
3243553f 2287 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 2288 power_off.work);
ab81cbf9
JH		 2289
2290 BT_DBG("%s", hdev->name);
2291
8ee56540 2292 hci_dev_do_close(hdev);
ab81cbf9
JH		 2293}
2294
c7741d16
MH		 2295static void hci_error_reset(struct work_struct *work)
2296{
2297 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2298
2299 BT_DBG("%s", hdev->name);
2300
2301 if (hdev->hw_error)
2302 hdev->hw_error(hdev, hdev->hw_error_code);
2303 else
2064ee33 2304 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
c7741d16
MH		 2305
2306 if (hci_dev_do_close(hdev))
2307 return;
2308
c7741d16
MH		 2309 hci_dev_do_open(hdev);
2310}
2311
35f7498a 2312void hci_uuids_clear(struct hci_dev *hdev)
2aeb9a1a 2313{
4821002c 2314 struct bt_uuid *uuid, *tmp;
2aeb9a1a 2315
4821002c
JH		 2316 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2317 list_del(&uuid->list);
2aeb9a1a
JH		 2318 kfree(uuid);
2319 }
2aeb9a1a
JH		 2320}
2321
35f7498a 2322void hci_link_keys_clear(struct hci_dev *hdev)
55ed8ca1 2323{
0378b597 2324 struct link_key *key;
55ed8ca1 2325
d7d41682 2326 list_for_each_entry(key, &hdev->link_keys, list) {
0378b597
JH		 2327 list_del_rcu(&key->list);
2328 kfree_rcu(key, rcu);
55ed8ca1 2329 }
55ed8ca1
JH		 2330}
2331
35f7498a 2332void hci_smp_ltks_clear(struct hci_dev *hdev)
b899efaf 2333{
970d0f1b 2334 struct smp_ltk *k;
b899efaf 2335
d7d41682 2336 list_for_each_entry(k, &hdev->long_term_keys, list) {
970d0f1b
JH		 2337 list_del_rcu(&k->list);
2338 kfree_rcu(k, rcu);
b899efaf 2339 }
b899efaf
VCG		 2340}
2341
970c4e46
JH		 2342void hci_smp_irks_clear(struct hci_dev *hdev)
2343{
adae20cb 2344 struct smp_irk *k;
970c4e46 2345
d7d41682 2346 list_for_each_entry(k, &hdev->identity_resolving_keys, list) {
adae20cb
JH		 2347 list_del_rcu(&k->list);
2348 kfree_rcu(k, rcu);
970c4e46
JH		 2349 }
2350}
2351
600a8749
AM		 2352void hci_blocked_keys_clear(struct hci_dev *hdev)
2353{
2354 struct blocked_key *b;
2355
d7d41682 2356 list_for_each_entry(b, &hdev->blocked_keys, list) {
600a8749
AM		 2357 list_del_rcu(&b->list);
2358 kfree_rcu(b, rcu);
2359 }
2360}
2361
2362bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
2363{
2364 bool blocked = false;
2365 struct blocked_key *b;
2366
2367 rcu_read_lock();
0c2ac7d4 2368 list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
600a8749
AM		 2369 if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
2370 blocked = true;
2371 break;
2372 }
2373 }
2374
2375 rcu_read_unlock();
2376 return blocked;
2377}
2378
55ed8ca1
JH		 2379struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2380{
8035ded4 2381 struct link_key *k;
55ed8ca1 2382
0378b597
JH		 2383 rcu_read_lock();
2384 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2385 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2386 rcu_read_unlock();
600a8749
AM		 2387
2388 if (hci_is_blocked_key(hdev,
2389 HCI_BLOCKED_KEY_TYPE_LINKKEY,
2390 k->val)) {
2391 bt_dev_warn_ratelimited(hdev,
2392 "Link key blocked for %pMR",
2393 &k->bdaddr);
2394 return NULL;
2395 }
2396
55ed8ca1 2397 return k;
0378b597
JH		 2398 }
2399 }
2400 rcu_read_unlock();
55ed8ca1
JH		 2401
2402 return NULL;
2403}
2404
745c0ce3 2405static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 2406 u8 key_type, u8 old_key_type)
d25e28ab
JH		 2407{
2408 /* Legacy key */
2409 if (key_type < 0x03)
745c0ce3 2410 return true;
d25e28ab
JH		 2411
2412 /* Debug keys are insecure so don't store them persistently */
2413 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 2414 return false;
d25e28ab
JH		 2415
2416 /* Changed combination key and there's no previous one */
2417 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 2418 return false;
d25e28ab
JH		 2419
2420 /* Security mode 3 case */
2421 if (!conn)
745c0ce3 2422 return true;
d25e28ab 2423
e3befab9
JH		 2424 /* BR/EDR key derived using SC from an LE link */
2425 if (conn->type == LE_LINK)
2426 return true;
2427
d25e28ab
JH		 2428 /* Neither local nor remote side had no-bonding as requirement */
2429 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 2430 return true;
d25e28ab
JH		 2431
2432 /* Local side had dedicated bonding as requirement */
2433 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 2434 return true;
d25e28ab
JH		 2435
2436 /* Remote side had dedicated bonding as requirement */
2437 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 2438 return true;
d25e28ab
JH		 2439
2440 /* If none of the above criteria match, then don't store the key
2441 * persistently */
745c0ce3 2442 return false;
d25e28ab
JH		 2443}
2444
e804d25d 2445static u8 ltk_role(u8 type)
98a0b845 2446{
e804d25d
JH		 2447 if (type == SMP_LTK)
2448 return HCI_ROLE_MASTER;
98a0b845 2449
e804d25d 2450 return HCI_ROLE_SLAVE;
98a0b845
JH		 2451}
2452
f3a73d97
JH		 2453struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2454 u8 addr_type, u8 role)
75d262c2 2455{
c9839a11 2456 struct smp_ltk *k;
75d262c2 2457
970d0f1b
JH		 2458 rcu_read_lock();
2459 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
5378bc56
JH		 2460 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2461 continue;
2462
923e2414 2463 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
970d0f1b 2464 rcu_read_unlock();
600a8749
AM		 2465
2466 if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
2467 k->val)) {
2468 bt_dev_warn_ratelimited(hdev,
2469 "LTK blocked for %pMR",
2470 &k->bdaddr);
2471 return NULL;
2472 }
2473
75d262c2 2474 return k;
970d0f1b
JH		 2475 }
2476 }
2477 rcu_read_unlock();
75d262c2
VCG		 2478
2479 return NULL;
2480}
75d262c2 2481
970c4e46
JH		 2482struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2483{
600a8749 2484 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 2485 struct smp_irk *irk;
2486
adae20cb
JH		 2487 rcu_read_lock();
2488 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2489 if (!bacmp(&irk->rpa, rpa)) {
600a8749
AM		 2490 irk_to_return = irk;
2491 goto done;
adae20cb 2492 }
970c4e46
JH		 2493 }
2494
adae20cb 2495 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
defce9e8 2496 if (smp_irk_matches(hdev, irk->val, rpa)) {
970c4e46 2497 bacpy(&irk->rpa, rpa);
600a8749
AM		 2498 irk_to_return = irk;
2499 goto done;
970c4e46
JH		 2500 }
2501 }
600a8749
AM		 2502
2503done:
2504 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2505 irk_to_return->val)) {
2506 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
2507 &irk_to_return->bdaddr);
2508 irk_to_return = NULL;
2509 }
2510
adae20cb 2511 rcu_read_unlock();
970c4e46 2512
600a8749 2513 return irk_to_return;
970c4e46
JH		 2514}
2515
2516struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2517 u8 addr_type)
2518{
600a8749 2519 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 2520 struct smp_irk *irk;
2521
6cfc9988
JH		 2522 /* Identity Address must be public or static random */
2523 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2524 return NULL;
2525
adae20cb
JH		 2526 rcu_read_lock();
2527 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
970c4e46 2528 if (addr_type == irk->addr_type &&
adae20cb 2529 bacmp(bdaddr, &irk->bdaddr) == 0) {
600a8749
AM		 2530 irk_to_return = irk;
2531 goto done;
adae20cb 2532 }
970c4e46 2533 }
600a8749
AM		 2534
2535done:
2536
2537 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2538 irk_to_return->val)) {
2539 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
2540 &irk_to_return->bdaddr);
2541 irk_to_return = NULL;
2542 }
2543
adae20cb 2544 rcu_read_unlock();
970c4e46 2545
600a8749 2546 return irk_to_return;
970c4e46
JH		 2547}
2548
567fa2aa 2549struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
7652ff6a
JH		 2550 bdaddr_t *bdaddr, u8 *val, u8 type,
2551 u8 pin_len, bool *persistent)
55ed8ca1
JH		 2552{
2553 struct link_key *key, *old_key;
745c0ce3 2554 u8 old_key_type;
55ed8ca1
JH		 2555
2556 old_key = hci_find_link_key(hdev, bdaddr);
2557 if (old_key) {
2558 old_key_type = old_key->type;
2559 key = old_key;
2560 } else {
12adcf3a 2561 old_key_type = conn ? conn->key_type : 0xff;
0a14ab41 2562 key = kzalloc(sizeof(*key), GFP_KERNEL);
55ed8ca1 2563 if (!key)
567fa2aa 2564 return NULL;
0378b597 2565 list_add_rcu(&key->list, &hdev->link_keys);
55ed8ca1
JH		 2566 }
2567
6ed93dc6 2568 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 2569
d25e28ab
JH		 2570 /* Some buggy controller combinations generate a changed
2571 * combination key for legacy pairing even when there's no
2572 * previous key */
2573 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 2574 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 2575 type = HCI_LK_COMBINATION;
655fe6ec
JH		 2576 if (conn)
2577 conn->key_type = type;
2578 }
d25e28ab 2579
55ed8ca1 2580 bacpy(&key->bdaddr, bdaddr);
9b3b4460 2581 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 2582 key->pin_len = pin_len;
2583
b6020ba0 2584 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 2585 key->type = old_key_type;
4748fed2
JH		 2586 else
2587 key->type = type;
2588
7652ff6a
JH		 2589 if (persistent)
2590 *persistent = hci_persistent_key(hdev, conn, type,
2591 old_key_type);
4df378a1 2592
567fa2aa 2593 return key;
55ed8ca1
JH		 2594}
2595
ca9142b8 2596struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
35d70271 2597 u8 addr_type, u8 type, u8 authenticated,
fe39c7b2 2598 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
75d262c2 2599{
c9839a11 2600 struct smp_ltk *key, *old_key;
e804d25d 2601 u8 role = ltk_role(type);
75d262c2 2602
f3a73d97 2603 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
c9839a11 2604 if (old_key)
75d262c2 2605 key = old_key;
c9839a11 2606 else {
0a14ab41 2607 key = kzalloc(sizeof(*key), GFP_KERNEL);
75d262c2 2608 if (!key)
ca9142b8 2609 return NULL;
970d0f1b 2610 list_add_rcu(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 2611 }
2612
75d262c2 2613 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 2614 key->bdaddr_type = addr_type;
2615 memcpy(key->val, tk, sizeof(key->val));
2616 key->authenticated = authenticated;
2617 key->ediv = ediv;
fe39c7b2 2618 key->rand = rand;
c9839a11
VCG		 2619 key->enc_size = enc_size;
2620 key->type = type;
75d262c2 2621
ca9142b8 2622 return key;
75d262c2
VCG		 2623}
2624
ca9142b8
JH		 2625struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2626 u8 addr_type, u8 val[16], bdaddr_t *rpa)
970c4e46
JH		 2627{
2628 struct smp_irk *irk;
2629
2630 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2631 if (!irk) {
2632 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2633 if (!irk)
ca9142b8 2634 return NULL;
970c4e46
JH		 2635
2636 bacpy(&irk->bdaddr, bdaddr);
2637 irk->addr_type = addr_type;
2638
adae20cb 2639 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
970c4e46
JH		 2640 }
2641
2642 memcpy(irk->val, val, 16);
2643 bacpy(&irk->rpa, rpa);
2644
ca9142b8 2645 return irk;
970c4e46
JH		 2646}
2647
55ed8ca1
JH		 2648int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2649{
2650 struct link_key *key;
2651
2652 key = hci_find_link_key(hdev, bdaddr);
2653 if (!key)
2654 return -ENOENT;
2655
6ed93dc6 2656 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1 2657
0378b597
JH		 2658 list_del_rcu(&key->list);
2659 kfree_rcu(key, rcu);
55ed8ca1
JH		 2660
2661 return 0;
2662}
2663
e0b2b27e 2664int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
b899efaf 2665{
970d0f1b 2666 struct smp_ltk *k;
c51ffa0b 2667 int removed = 0;
b899efaf 2668
970d0f1b 2669 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
e0b2b27e 2670 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
b899efaf
VCG		 2671 continue;
2672
6ed93dc6 2673 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf 2674
970d0f1b
JH		 2675 list_del_rcu(&k->list);
2676 kfree_rcu(k, rcu);
c51ffa0b 2677 removed++;
b899efaf
VCG		 2678 }
2679
c51ffa0b 2680 return removed ? 0 : -ENOENT;
b899efaf
VCG		 2681}
2682
a7ec7338
JH		 2683void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2684{
adae20cb 2685 struct smp_irk *k;
a7ec7338 2686
adae20cb 2687 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
a7ec7338
JH		 2688 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2689 continue;
2690
2691 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2692
adae20cb
JH		 2693 list_del_rcu(&k->list);
2694 kfree_rcu(k, rcu);
a7ec7338
JH		 2695 }
2696}
2697
55e76b38
JH		 2698bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2699{
2700 struct smp_ltk *k;
4ba9faf3 2701 struct smp_irk *irk;
55e76b38
JH		 2702 u8 addr_type;
2703
2704 if (type == BDADDR_BREDR) {
2705 if (hci_find_link_key(hdev, bdaddr))
2706 return true;
2707 return false;
2708 }
2709
2710 /* Convert to HCI addr type which struct smp_ltk uses */
2711 if (type == BDADDR_LE_PUBLIC)
2712 addr_type = ADDR_LE_DEV_PUBLIC;
2713 else
2714 addr_type = ADDR_LE_DEV_RANDOM;
2715
4ba9faf3
JH		 2716 irk = hci_get_irk(hdev, bdaddr, addr_type);
2717 if (irk) {
2718 bdaddr = &irk->bdaddr;
2719 addr_type = irk->addr_type;
2720 }
2721
55e76b38
JH		 2722 rcu_read_lock();
2723 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
87c8b28d
JH		 2724 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2725 rcu_read_unlock();
55e76b38 2726 return true;
87c8b28d 2727 }
55e76b38
JH		 2728 }
2729 rcu_read_unlock();
2730
2731 return false;
2732}
2733
6bd32326 2734/* HCI command timer function */
65cc2b49 2735static void hci_cmd_timeout(struct work_struct *work)
6bd32326 2736{
65cc2b49
MH		 2737 struct hci_dev *hdev = container_of(work, struct hci_dev,
2738 cmd_timer.work);
6bd32326 2739
bda4f23a
AE		 2740 if (hdev->sent_cmd) {
2741 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2742 u16 opcode = __le16_to_cpu(sent->opcode);
2743
2064ee33 2744 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
bda4f23a 2745 } else {
2064ee33 2746 bt_dev_err(hdev, "command tx timeout");
bda4f23a
AE		 2747 }
2748
e2bef384
RJ		 2749 if (hdev->cmd_timeout)
2750 hdev->cmd_timeout(hdev);
2751
6bd32326 2752 atomic_set(&hdev->cmd_cnt, 1);
c347b765 2753 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 2754}
2755
2763eda6 2756struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
6928a924 2757 bdaddr_t *bdaddr, u8 bdaddr_type)
2763eda6
SJ		 2758{
2759 struct oob_data *data;
2760
6928a924
JH		 2761 list_for_each_entry(data, &hdev->remote_oob_data, list) {
2762 if (bacmp(bdaddr, &data->bdaddr) != 0)
2763 continue;
2764 if (data->bdaddr_type != bdaddr_type)
2765 continue;
2766 return data;
2767 }
2763eda6
SJ		 2768
2769 return NULL;
2770}
2771
6928a924
JH		 2772int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2773 u8 bdaddr_type)
2763eda6
SJ		 2774{
2775 struct oob_data *data;
2776
6928a924 2777 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6
SJ		 2778 if (!data)
2779 return -ENOENT;
2780
6928a924 2781 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2763eda6
SJ		 2782
2783 list_del(&data->list);
2784 kfree(data);
2785
2786 return 0;
2787}
2788
35f7498a 2789void hci_remote_oob_data_clear(struct hci_dev *hdev)
2763eda6
SJ		 2790{
2791 struct oob_data *data, *n;
2792
2793 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2794 list_del(&data->list);
2795 kfree(data);
2796 }
2763eda6
SJ		 2797}
2798
0798872e 2799int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
6928a924 2800 u8 bdaddr_type, u8 *hash192, u8 *rand192,
81328d5c 2801 u8 *hash256, u8 *rand256)
2763eda6
SJ		 2802{
2803 struct oob_data *data;
2804
6928a924 2805 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6 2806 if (!data) {
0a14ab41 2807 data = kmalloc(sizeof(*data), GFP_KERNEL);
2763eda6
SJ		 2808 if (!data)
2809 return -ENOMEM;
2810
2811 bacpy(&data->bdaddr, bdaddr);
6928a924 2812 data->bdaddr_type = bdaddr_type;
2763eda6
SJ		 2813 list_add(&data->list, &hdev->remote_oob_data);
2814 }
2815
81328d5c
JH		 2816 if (hash192 && rand192) {
2817 memcpy(data->hash192, hash192, sizeof(data->hash192));
2818 memcpy(data->rand192, rand192, sizeof(data->rand192));
f7697b16
MH		 2819 if (hash256 && rand256)
2820 data->present = 0x03;
81328d5c
JH		 2821 } else {
2822 memset(data->hash192, 0, sizeof(data->hash192));
2823 memset(data->rand192, 0, sizeof(data->rand192));
f7697b16
MH		 2824 if (hash256 && rand256)
2825 data->present = 0x02;
2826 else
2827 data->present = 0x00;
0798872e
MH		 2828 }
2829
81328d5c
JH		 2830 if (hash256 && rand256) {
2831 memcpy(data->hash256, hash256, sizeof(data->hash256));
2832 memcpy(data->rand256, rand256, sizeof(data->rand256));
2833 } else {
2834 memset(data->hash256, 0, sizeof(data->hash256));
2835 memset(data->rand256, 0, sizeof(data->rand256));
f7697b16
MH		 2836 if (hash192 && rand192)
2837 data->present = 0x01;
81328d5c 2838 }
0798872e 2839
6ed93dc6 2840 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 2841
2842 return 0;
2843}
2844
d2609b34
FG		 2845/* This function requires the caller holds hdev->lock */
2846struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2847{
2848 struct adv_info *adv_instance;
2849
2850 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2851 if (adv_instance->instance == instance)
2852 return adv_instance;
2853 }
2854
2855 return NULL;
2856}
2857
2858/* This function requires the caller holds hdev->lock */
74b93e9f
PK		 2859struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2860{
d2609b34
FG		 2861 struct adv_info *cur_instance;
2862
2863 cur_instance = hci_find_adv_instance(hdev, instance);
2864 if (!cur_instance)
2865 return NULL;
2866
2867 if (cur_instance == list_last_entry(&hdev->adv_instances,
2868 struct adv_info, list))
2869 return list_first_entry(&hdev->adv_instances,
2870 struct adv_info, list);
2871 else
2872 return list_next_entry(cur_instance, list);
2873}
2874
2875/* This function requires the caller holds hdev->lock */
2876int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2877{
2878 struct adv_info *adv_instance;
2879
2880 adv_instance = hci_find_adv_instance(hdev, instance);
2881 if (!adv_instance)
2882 return -ENOENT;
2883
2884 BT_DBG("%s removing %dMR", hdev->name, instance);
2885
cab054ab
JH		 2886 if (hdev->cur_adv_instance == instance) {
2887 if (hdev->adv_instance_timeout) {
2888 cancel_delayed_work(&hdev->adv_instance_expire);
2889 hdev->adv_instance_timeout = 0;
2890 }
2891 hdev->cur_adv_instance = 0x00;
5d900e46
FG		 2892 }
2893
a73c046a
JK		 2894 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2895
d2609b34
FG		 2896 list_del(&adv_instance->list);
2897 kfree(adv_instance);
2898
2899 hdev->adv_instance_cnt--;
2900
2901 return 0;
2902}
2903
a73c046a
JK		 2904void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
2905{
2906 struct adv_info *adv_instance, *n;
2907
2908 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
2909 adv_instance->rpa_expired = rpa_expired;
2910}
2911
d2609b34
FG		 2912/* This function requires the caller holds hdev->lock */
2913void hci_adv_instances_clear(struct hci_dev *hdev)
2914{
2915 struct adv_info *adv_instance, *n;
2916
5d900e46
FG		 2917 if (hdev->adv_instance_timeout) {
2918 cancel_delayed_work(&hdev->adv_instance_expire);
2919 hdev->adv_instance_timeout = 0;
2920 }
2921
d2609b34 2922 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
a73c046a 2923 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
d2609b34
FG		 2924 list_del(&adv_instance->list);
2925 kfree(adv_instance);
2926 }
2927
2928 hdev->adv_instance_cnt = 0;
cab054ab 2929 hdev->cur_adv_instance = 0x00;
d2609b34
FG		 2930}
2931
a73c046a
JK		 2932static void adv_instance_rpa_expired(struct work_struct *work)
2933{
2934 struct adv_info *adv_instance = container_of(work, struct adv_info,
2935 rpa_expired_cb.work);
2936
2937 BT_DBG("");
2938
2939 adv_instance->rpa_expired = true;
2940}
2941
d2609b34
FG		 2942/* This function requires the caller holds hdev->lock */
2943int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2944 u16 adv_data_len, u8 *adv_data,
2945 u16 scan_rsp_len, u8 *scan_rsp_data,
2946 u16 timeout, u16 duration)
2947{
2948 struct adv_info *adv_instance;
2949
2950 adv_instance = hci_find_adv_instance(hdev, instance);
2951 if (adv_instance) {
2952 memset(adv_instance->adv_data, 0,
2953 sizeof(adv_instance->adv_data));
2954 memset(adv_instance->scan_rsp_data, 0,
2955 sizeof(adv_instance->scan_rsp_data));
2956 } else {
1d0fac2c 2957 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
d2609b34
FG		 2958 instance < 1 || instance > HCI_MAX_ADV_INSTANCES)
2959 return -EOVERFLOW;
2960
39ecfad6 2961 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
d2609b34
FG		 2962 if (!adv_instance)
2963 return -ENOMEM;
2964
fffd38bc 2965 adv_instance->pending = true;
d2609b34
FG		 2966 adv_instance->instance = instance;
2967 list_add(&adv_instance->list, &hdev->adv_instances);
2968 hdev->adv_instance_cnt++;
2969 }
2970
2971 adv_instance->flags = flags;
2972 adv_instance->adv_data_len = adv_data_len;
2973 adv_instance->scan_rsp_len = scan_rsp_len;
2974
2975 if (adv_data_len)
2976 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
2977
2978 if (scan_rsp_len)
2979 memcpy(adv_instance->scan_rsp_data,
2980 scan_rsp_data, scan_rsp_len);
2981
2982 adv_instance->timeout = timeout;
5d900e46 2983 adv_instance->remaining_time = timeout;
d2609b34
FG		 2984
2985 if (duration == 0)
10873f99 2986 adv_instance->duration = hdev->def_multi_adv_rotation_duration;
d2609b34
FG		 2987 else
2988 adv_instance->duration = duration;
2989
de181e88
JK		 2990 adv_instance->tx_power = HCI_TX_POWER_INVALID;
2991
a73c046a
JK		 2992 INIT_DELAYED_WORK(&adv_instance->rpa_expired_cb,
2993 adv_instance_rpa_expired);
2994
d2609b34
FG		 2995 BT_DBG("%s for %dMR", hdev->name, instance);
2996
2997 return 0;
2998}
2999
e5e1e7fd
MC		 3000/* This function requires the caller holds hdev->lock */
3001void hci_adv_monitors_clear(struct hci_dev *hdev)
3002{
b139553d
MC		 3003 struct adv_monitor *monitor;
3004 int handle;
3005
3006 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
3007 hci_free_adv_monitor(monitor);
3008
e5e1e7fd
MC		 3009 idr_destroy(&hdev->adv_monitors_idr);
3010}
3011
b139553d
MC		 3012void hci_free_adv_monitor(struct adv_monitor *monitor)
3013{
3014 struct adv_pattern *pattern;
3015 struct adv_pattern *tmp;
3016
3017 if (!monitor)
3018 return;
3019
3020 list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list)
3021 kfree(pattern);
3022
3023 kfree(monitor);
3024}
3025
3026/* This function requires the caller holds hdev->lock */
3027int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
3028{
3029 int min, max, handle;
3030
3031 if (!monitor)
3032 return -EINVAL;
3033
3034 min = HCI_MIN_ADV_MONITOR_HANDLE;
3035 max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES;
3036 handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max,
3037 GFP_KERNEL);
3038 if (handle < 0)
3039 return handle;
3040
3041 hdev->adv_monitors_cnt++;
3042 monitor->handle = handle;
8208f5a9
MC		 3043
3044 hci_update_background_scan(hdev);
3045
b139553d
MC		 3046 return 0;
3047}
3048
bd2fbc6c
MC		 3049static int free_adv_monitor(int id, void *ptr, void *data)
3050{
3051 struct hci_dev *hdev = data;
3052 struct adv_monitor *monitor = ptr;
3053
3054 idr_remove(&hdev->adv_monitors_idr, monitor->handle);
3055 hci_free_adv_monitor(monitor);
3056
3057 return 0;
3058}
3059
3060/* This function requires the caller holds hdev->lock */
3061int hci_remove_adv_monitor(struct hci_dev *hdev, u16 handle)
3062{
3063 struct adv_monitor *monitor;
3064
3065 if (handle) {
3066 monitor = idr_find(&hdev->adv_monitors_idr, handle);
3067 if (!monitor)
3068 return -ENOENT;
3069
3070 idr_remove(&hdev->adv_monitors_idr, monitor->handle);
3071 hci_free_adv_monitor(monitor);
3072 } else {
3073 /* Remove all monitors if handle is 0. */
3074 idr_for_each(&hdev->adv_monitors_idr, &free_adv_monitor, hdev);
3075 }
3076
8208f5a9
MC		 3077 hci_update_background_scan(hdev);
3078
bd2fbc6c
MC		 3079 return 0;
3080}
3081
8208f5a9
MC		 3082/* This function requires the caller holds hdev->lock */
3083bool hci_is_adv_monitoring(struct hci_dev *hdev)
3084{
3085 return !idr_is_empty(&hdev->adv_monitors_idr);
3086}
3087
dcc36c16 3088struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
b9ee0a78 3089 bdaddr_t *bdaddr, u8 type)
b2a66aad 3090{
8035ded4 3091 struct bdaddr_list *b;
b2a66aad 3092
dcc36c16 3093 list_for_each_entry(b, bdaddr_list, list) {
b9ee0a78 3094 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
b2a66aad 3095 return b;
b9ee0a78 3096 }
b2a66aad
AJ		 3097
3098 return NULL;
3099}
3100
b950aa88
AN		 3101struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
3102 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
3103 u8 type)
3104{
3105 struct bdaddr_list_with_irk *b;
3106
3107 list_for_each_entry(b, bdaddr_list, list) {
3108 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3109 return b;
3110 }
3111
3112 return NULL;
3113}
3114
8baaa403
APS		 3115struct bdaddr_list_with_flags *
3116hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list,
3117 bdaddr_t *bdaddr, u8 type)
3118{
3119 struct bdaddr_list_with_flags *b;
3120
3121 list_for_each_entry(b, bdaddr_list, list) {
3122 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3123 return b;
3124 }
3125
3126 return NULL;
3127}
3128
dcc36c16 3129void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
b2a66aad 3130{
7eb7404f 3131 struct bdaddr_list *b, *n;
b2a66aad 3132
7eb7404f
GT		 3133 list_for_each_entry_safe(b, n, bdaddr_list, list) {
3134 list_del(&b->list);
b2a66aad
AJ		 3135 kfree(b);
3136 }
b2a66aad
AJ		 3137}
3138
dcc36c16 3139int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 3140{
3141 struct bdaddr_list *entry;
b2a66aad 3142
b9ee0a78 3143 if (!bacmp(bdaddr, BDADDR_ANY))
b2a66aad
AJ		 3144 return -EBADF;
3145
dcc36c16 3146 if (hci_bdaddr_list_lookup(list, bdaddr, type))
5e762444 3147 return -EEXIST;
b2a66aad 3148
27f70f3e 3149 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
5e762444
AJ		 3150 if (!entry)
3151 return -ENOMEM;
b2a66aad
AJ		 3152
3153 bacpy(&entry->bdaddr, bdaddr);
b9ee0a78 3154 entry->bdaddr_type = type;
b2a66aad 3155
dcc36c16 3156 list_add(&entry->list, list);
b2a66aad 3157
2a8357f2 3158 return 0;
b2a66aad
AJ		 3159}
3160
b950aa88
AN		 3161int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3162 u8 type, u8 *peer_irk, u8 *local_irk)
3163{
3164 struct bdaddr_list_with_irk *entry;
3165
3166 if (!bacmp(bdaddr, BDADDR_ANY))
3167 return -EBADF;
3168
3169 if (hci_bdaddr_list_lookup(list, bdaddr, type))
3170 return -EEXIST;
3171
3172 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3173 if (!entry)
3174 return -ENOMEM;
3175
3176 bacpy(&entry->bdaddr, bdaddr);
3177 entry->bdaddr_type = type;
3178
3179 if (peer_irk)
3180 memcpy(entry->peer_irk, peer_irk, 16);
3181
3182 if (local_irk)
3183 memcpy(entry->local_irk, local_irk, 16);
3184
3185 list_add(&entry->list, list);
3186
3187 return 0;
3188}
3189
8baaa403
APS		 3190int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr,
3191 u8 type, u32 flags)
3192{
3193 struct bdaddr_list_with_flags *entry;
3194
3195 if (!bacmp(bdaddr, BDADDR_ANY))
3196 return -EBADF;
3197
3198 if (hci_bdaddr_list_lookup(list, bdaddr, type))
3199 return -EEXIST;
3200
3201 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3202 if (!entry)
3203 return -ENOMEM;
3204
3205 bacpy(&entry->bdaddr, bdaddr);
3206 entry->bdaddr_type = type;
3207 entry->current_flags = flags;
3208
3209 list_add(&entry->list, list);
3210
3211 return 0;
3212}
3213
dcc36c16 3214int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 3215{
3216 struct bdaddr_list *entry;
b2a66aad 3217
35f7498a 3218 if (!bacmp(bdaddr, BDADDR_ANY)) {
dcc36c16 3219 hci_bdaddr_list_clear(list);
35f7498a
JH		 3220 return 0;
3221 }
b2a66aad 3222
dcc36c16 3223 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
d2ab0ac1
MH		 3224 if (!entry)
3225 return -ENOENT;
3226
3227 list_del(&entry->list);
3228 kfree(entry);
3229
3230 return 0;
3231}
3232
b950aa88
AN		 3233int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3234 u8 type)
3235{
3236 struct bdaddr_list_with_irk *entry;
3237
3238 if (!bacmp(bdaddr, BDADDR_ANY)) {
3239 hci_bdaddr_list_clear(list);
3240 return 0;
3241 }
3242
3243 entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
3244 if (!entry)
3245 return -ENOENT;
3246
3247 list_del(&entry->list);
3248 kfree(entry);
3249
3250 return 0;
3251}
3252
8baaa403
APS		 3253int hci_bdaddr_list_del_with_flags(struct list_head *list, bdaddr_t *bdaddr,
3254 u8 type)
3255{
3256 struct bdaddr_list_with_flags *entry;
3257
3258 if (!bacmp(bdaddr, BDADDR_ANY)) {
3259 hci_bdaddr_list_clear(list);
3260 return 0;
3261 }
3262
3263 entry = hci_bdaddr_list_lookup_with_flags(list, bdaddr, type);
3264 if (!entry)
3265 return -ENOENT;
3266
3267 list_del(&entry->list);
3268 kfree(entry);
3269
3270 return 0;
3271}
3272
15819a70
AG		 3273/* This function requires the caller holds hdev->lock */
3274struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
3275 bdaddr_t *addr, u8 addr_type)
3276{
3277 struct hci_conn_params *params;
3278
3279 list_for_each_entry(params, &hdev->le_conn_params, list) {
3280 if (bacmp(&params->addr, addr) == 0 &&
3281 params->addr_type == addr_type) {
3282 return params;
3283 }
3284 }
3285
3286 return NULL;
3287}
3288
4b10966f 3289/* This function requires the caller holds hdev->lock */
501f8827
JH		 3290struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
3291 bdaddr_t *addr, u8 addr_type)
a9b0a04c 3292{
912b42ef 3293 struct hci_conn_params *param;
a9b0a04c 3294
501f8827 3295 list_for_each_entry(param, list, action) {
912b42ef
JH		 3296 if (bacmp(&param->addr, addr) == 0 &&
3297 param->addr_type == addr_type)
3298 return param;
4b10966f
MH		 3299 }
3300
3301 return NULL;
a9b0a04c
AG		 3302}
3303
15819a70 3304/* This function requires the caller holds hdev->lock */
51d167c0
MH		 3305struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
3306 bdaddr_t *addr, u8 addr_type)
15819a70
AG		 3307{
3308 struct hci_conn_params *params;
3309
3310 params = hci_conn_params_lookup(hdev, addr, addr_type);
cef952ce 3311 if (params)
51d167c0 3312 return params;
15819a70
AG		 3313
3314 params = kzalloc(sizeof(*params), GFP_KERNEL);
3315 if (!params) {
2064ee33 3316 bt_dev_err(hdev, "out of memory");
51d167c0 3317 return NULL;
15819a70
AG		 3318 }
3319
3320 bacpy(&params->addr, addr);
3321 params->addr_type = addr_type;
cef952ce
AG		 3322
3323 list_add(&params->list, &hdev->le_conn_params);
93450c75 3324 INIT_LIST_HEAD(&params->action);
cef952ce 3325
bf5b3c8b
MH		 3326 params->conn_min_interval = hdev->le_conn_min_interval;
3327 params->conn_max_interval = hdev->le_conn_max_interval;
3328 params->conn_latency = hdev->le_conn_latency;
3329 params->supervision_timeout = hdev->le_supv_timeout;
3330 params->auto_connect = HCI_AUTO_CONN_DISABLED;
3331
3332 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3333
51d167c0 3334 return params;
bf5b3c8b
MH		 3335}
3336
f6c63249 3337static void hci_conn_params_free(struct hci_conn_params *params)
15819a70 3338{
f8aaf9b6 3339 if (params->conn) {
f161dd41 3340 hci_conn_drop(params->conn);
f8aaf9b6
JH		 3341 hci_conn_put(params->conn);
3342 }
f161dd41 3343
95305baa 3344 list_del(&params->action);
15819a70
AG		 3345 list_del(&params->list);
3346 kfree(params);
f6c63249
JH		 3347}
3348
3349/* This function requires the caller holds hdev->lock */
3350void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3351{
3352 struct hci_conn_params *params;
3353
3354 params = hci_conn_params_lookup(hdev, addr, addr_type);
3355 if (!params)
3356 return;
3357
3358 hci_conn_params_free(params);
15819a70 3359
95305baa
JH		 3360 hci_update_background_scan(hdev);
3361
15819a70
AG		 3362 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3363}
3364
3365/* This function requires the caller holds hdev->lock */
55af49a8 3366void hci_conn_params_clear_disabled(struct hci_dev *hdev)
15819a70
AG		 3367{
3368 struct hci_conn_params *params, *tmp;
3369
3370 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
55af49a8
JH		 3371 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3372 continue;
f75113a2
JP		 3373
3374 /* If trying to estabilish one time connection to disabled
3375 * device, leave the params, but mark them as just once.
3376 */
3377 if (params->explicit_connect) {
3378 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3379 continue;
3380 }
3381
15819a70
AG		 3382 list_del(&params->list);
3383 kfree(params);
3384 }
3385
55af49a8 3386 BT_DBG("All LE disabled connection parameters were removed");
77a77a30
AG		 3387}
3388
3389/* This function requires the caller holds hdev->lock */
030e7f81 3390static void hci_conn_params_clear_all(struct hci_dev *hdev)
77a77a30 3391{
15819a70 3392 struct hci_conn_params *params, *tmp;
77a77a30 3393
f6c63249
JH		 3394 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
3395 hci_conn_params_free(params);
77a77a30 3396
15819a70 3397 BT_DBG("All LE connection parameters were removed");
77a77a30
AG		 3398}
3399
a1f4c318
JH		 3400/* Copy the Identity Address of the controller.
3401 *
3402 * If the controller has a public BD_ADDR, then by default use that one.
3403 * If this is a LE only controller without a public address, default to
3404 * the static random address.
3405 *
3406 * For debugging purposes it is possible to force controllers with a
3407 * public address to use the static random address instead.
50b5b952
MH		 3408 *
3409 * In case BR/EDR has been disabled on a dual-mode controller and
3410 * userspace has configured a static address, then that address
3411 * becomes the identity address instead of the public BR/EDR address.
a1f4c318
JH		 3412 */
3413void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3414 u8 *bdaddr_type)
3415{
b7cb93e5 3416 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
50b5b952 3417 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
d7a5a11d 3418 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
50b5b952 3419 bacmp(&hdev->static_addr, BDADDR_ANY))) {
a1f4c318
JH		 3420 bacpy(bdaddr, &hdev->static_addr);
3421 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3422 } else {
3423 bacpy(bdaddr, &hdev->bdaddr);
3424 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3425 }
3426}
3427
9952d90e
APS		 3428static int hci_suspend_wait_event(struct hci_dev *hdev)
3429{
3430#define WAKE_COND \
3431 (find_first_bit(hdev->suspend_tasks, __SUSPEND_NUM_TASKS) == \
3432 __SUSPEND_NUM_TASKS)
3433
3434 int i;
3435 int ret = wait_event_timeout(hdev->suspend_wait_q,
3436 WAKE_COND, SUSPEND_NOTIFIER_TIMEOUT);
3437
3438 if (ret == 0) {
a9ec8423 3439 bt_dev_err(hdev, "Timed out waiting for suspend events");
9952d90e
APS		 3440 for (i = 0; i < __SUSPEND_NUM_TASKS; ++i) {
3441 if (test_bit(i, hdev->suspend_tasks))
a9ec8423 3442 bt_dev_err(hdev, "Suspend timeout bit: %d", i);
9952d90e
APS		 3443 clear_bit(i, hdev->suspend_tasks);
3444 }
3445
3446 ret = -ETIMEDOUT;
3447 } else {
3448 ret = 0;
3449 }
3450
3451 return ret;
3452}
3453
3454static void hci_prepare_suspend(struct work_struct *work)
3455{
3456 struct hci_dev *hdev =
3457 container_of(work, struct hci_dev, suspend_prepare);
3458
3459 hci_dev_lock(hdev);
3460 hci_req_prepare_suspend(hdev, hdev->suspend_state_next);
3461 hci_dev_unlock(hdev);
3462}
3463
8731840a
APS		 3464static int hci_change_suspend_state(struct hci_dev *hdev,
3465 enum suspended_state next)
3466{
3467 hdev->suspend_state_next = next;
3468 set_bit(SUSPEND_PREPARE_NOTIFIER, hdev->suspend_tasks);
3469 queue_work(hdev->req_workqueue, &hdev->suspend_prepare);
3470 return hci_suspend_wait_event(hdev);
3471}
3472
9952d90e
APS		 3473static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
3474 void *data)
3475{
3476 struct hci_dev *hdev =
3477 container_of(nb, struct hci_dev, suspend_notifier);
3478 int ret = 0;
3479
3480 /* If powering down, wait for completion. */
3481 if (mgmt_powering_down(hdev)) {
3482 set_bit(SUSPEND_POWERING_DOWN, hdev->suspend_tasks);
3483 ret = hci_suspend_wait_event(hdev);
3484 if (ret)
3485 goto done;
3486 }
3487
3488 /* Suspend notifier should only act on events when powered. */
3489 if (!hdev_is_powered(hdev))
3490 goto done;
3491
3492 if (action == PM_SUSPEND_PREPARE) {
4f40afc6
APS		 3493 /* Suspend consists of two actions:
3494 * - First, disconnect everything and make the controller not
3495 * connectable (disabling scanning)
3496 * - Second, program event filter/whitelist and enable scan
3497 */
8731840a 3498 ret = hci_change_suspend_state(hdev, BT_SUSPEND_DISCONNECT);
4f40afc6 3499
81dafad5
APS		 3500 /* Only configure whitelist if disconnect succeeded and wake
3501 * isn't being prevented.
3502 */
3503 if (!ret && !(hdev->prevent_wake && hdev->prevent_wake(hdev)))
8731840a 3504 ret = hci_change_suspend_state(hdev,
0d2c9825 3505 BT_SUSPEND_CONFIGURE_WAKE);
9952d90e 3506 } else if (action == PM_POST_SUSPEND) {
8731840a 3507 ret = hci_change_suspend_state(hdev, BT_RUNNING);
9952d90e
APS		 3508 }
3509
3510done:
a9ec8423
APS		 3511 /* We always allow suspend even if suspend preparation failed and
3512 * attempt to recover in resume.
3513 */
3514 if (ret)
3515 bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
3516 action, ret);
3517
3518 return NOTIFY_STOP;
9952d90e 3519}
8731840a 3520
9be0dab7
DH		 3521/* Alloc HCI device */
3522struct hci_dev *hci_alloc_dev(void)
3523{
3524 struct hci_dev *hdev;
3525
27f70f3e 3526 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
9be0dab7
DH		 3527 if (!hdev)
3528 return NULL;
3529
b1b813d4
DH		 3530 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3531 hdev->esco_type = (ESCO_HV1);
3532 hdev->link_mode = (HCI_LM_ACCEPT);
b4cb9fb2
MH		 3533 hdev->num_iac = 0x01; /* One IAC support is mandatory */
3534 hdev->io_capability = 0x03; /* No Input No Output */
96c2103a 3535 hdev->manufacturer = 0xffff; /* Default to internal use */
bbaf444a
JH		 3536 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3537 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
d2609b34
FG		 3538 hdev->adv_instance_cnt = 0;
3539 hdev->cur_adv_instance = 0x00;
5d900e46 3540 hdev->adv_instance_timeout = 0;
b1b813d4 3541
b1b813d4
DH		 3542 hdev->sniff_max_interval = 800;
3543 hdev->sniff_min_interval = 80;
3544
3f959d46 3545 hdev->le_adv_channel_map = 0x07;
628531c9
GL		 3546 hdev->le_adv_min_interval = 0x0800;
3547 hdev->le_adv_max_interval = 0x0800;
bef64738
MH		 3548 hdev->le_scan_interval = 0x0060;
3549 hdev->le_scan_window = 0x0030;
10873f99
AM		 3550 hdev->le_scan_int_suspend = 0x0400;
3551 hdev->le_scan_window_suspend = 0x0012;
3552 hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT;
3553 hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN;
3554 hdev->le_scan_int_connect = 0x0060;
3555 hdev->le_scan_window_connect = 0x0060;
b48c3b59
JH		 3556 hdev->le_conn_min_interval = 0x0018;
3557 hdev->le_conn_max_interval = 0x0028;
04fb7d90
MH		 3558 hdev->le_conn_latency = 0x0000;
3559 hdev->le_supv_timeout = 0x002a;
a8e1bfaa
MH		 3560 hdev->le_def_tx_len = 0x001b;
3561 hdev->le_def_tx_time = 0x0148;
3562 hdev->le_max_tx_len = 0x001b;
3563 hdev->le_max_tx_time = 0x0148;
3564 hdev->le_max_rx_len = 0x001b;
3565 hdev->le_max_rx_time = 0x0148;
30d65e08
MK		 3566 hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
3567 hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
6decb5b4
JK		 3568 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
3569 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
1d0fac2c 3570 hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
10873f99 3571 hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
49b020c1 3572 hdev->def_le_autoconnect_timeout = HCI_LE_AUTOCONN_TIMEOUT;
bef64738 3573
d6bfd59c 3574 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
b9a7a61e 3575 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
31ad1691
AK		 3576 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3577 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
302975cb 3578 hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
58a96fc3 3579 hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
d6bfd59c 3580
10873f99
AM		 3581 /* default 1.28 sec page scan */
3582 hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;
3583 hdev->def_page_scan_int = 0x0800;
3584 hdev->def_page_scan_window = 0x0012;
3585
b1b813d4
DH		 3586 mutex_init(&hdev->lock);
3587 mutex_init(&hdev->req_lock);
3588
3589 INIT_LIST_HEAD(&hdev->mgmt_pending);
3590 INIT_LIST_HEAD(&hdev->blacklist);
6659358e 3591 INIT_LIST_HEAD(&hdev->whitelist);
b1b813d4
DH		 3592 INIT_LIST_HEAD(&hdev->uuids);
3593 INIT_LIST_HEAD(&hdev->link_keys);
3594 INIT_LIST_HEAD(&hdev->long_term_keys);
970c4e46 3595 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
b1b813d4 3596 INIT_LIST_HEAD(&hdev->remote_oob_data);
d2ab0ac1 3597 INIT_LIST_HEAD(&hdev->le_white_list);
cfdb0c2d 3598 INIT_LIST_HEAD(&hdev->le_resolv_list);
15819a70 3599 INIT_LIST_HEAD(&hdev->le_conn_params);
77a77a30 3600 INIT_LIST_HEAD(&hdev->pend_le_conns);
66f8455a 3601 INIT_LIST_HEAD(&hdev->pend_le_reports);
6b536b5e 3602 INIT_LIST_HEAD(&hdev->conn_hash.list);
d2609b34 3603 INIT_LIST_HEAD(&hdev->adv_instances);
600a8749 3604 INIT_LIST_HEAD(&hdev->blocked_keys);
b1b813d4
DH		 3605
3606 INIT_WORK(&hdev->rx_work, hci_rx_work);
3607 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3608 INIT_WORK(&hdev->tx_work, hci_tx_work);
3609 INIT_WORK(&hdev->power_on, hci_power_on);
c7741d16 3610 INIT_WORK(&hdev->error_reset, hci_error_reset);
9952d90e 3611 INIT_WORK(&hdev->suspend_prepare, hci_prepare_suspend);
b1b813d4 3612
b1b813d4 3613 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
b1b813d4 3614
b1b813d4
DH		 3615 skb_queue_head_init(&hdev->rx_q);
3616 skb_queue_head_init(&hdev->cmd_q);
3617 skb_queue_head_init(&hdev->raw_q);
3618
3619 init_waitqueue_head(&hdev->req_wait_q);
9952d90e 3620 init_waitqueue_head(&hdev->suspend_wait_q);
b1b813d4 3621
65cc2b49 3622 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
b1b813d4 3623
5fc16cc4
JH		 3624 hci_request_setup(hdev);
3625
b1b813d4
DH		 3626 hci_init_sysfs(hdev);
3627 discovery_init(hdev);
9be0dab7
DH		 3628
3629 return hdev;
3630}
3631EXPORT_SYMBOL(hci_alloc_dev);
3632
3633/* Free HCI device */
3634void hci_free_dev(struct hci_dev *hdev)
3635{
9be0dab7
DH		 3636 /* will free via device release */
3637 put_device(&hdev->dev);
3638}
3639EXPORT_SYMBOL(hci_free_dev);
3640
1da177e4
LT		 3641/* Register HCI device */
3642int hci_register_dev(struct hci_dev *hdev)
3643{
b1b813d4 3644 int id, error;
1da177e4 3645
74292d5a 3646 if (!hdev->open || !hdev->close || !hdev->send)
1da177e4
LT		 3647 return -EINVAL;
3648
08add513
MM		 3649 /* Do not allow HCI_AMP devices to register at index 0,
3650 * so the index can be used as the AMP controller ID.
3651 */
3df92b31 3652 switch (hdev->dev_type) {
ca8bee5d 3653 case HCI_PRIMARY:
3df92b31
SL		 3654 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3655 break;
3656 case HCI_AMP:
3657 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3658 break;
3659 default:
3660 return -EINVAL;
1da177e4 3661 }
8e87d142 3662
3df92b31
SL		 3663 if (id < 0)
3664 return id;
3665
1da177e4
LT		 3666 sprintf(hdev->name, "hci%d", id);
3667 hdev->id = id;
2d8b3a11
AE		 3668
3669 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3670
29e2dd0d 3671 hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
33ca954d
DH		 3672 if (!hdev->workqueue) {
3673 error = -ENOMEM;
3674 goto err;
3675 }
f48fd9c8 3676
29e2dd0d
TH		 3677 hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
3678 hdev->name);
6ead1bbc
JH		 3679 if (!hdev->req_workqueue) {
3680 destroy_workqueue(hdev->workqueue);
3681 error = -ENOMEM;
3682 goto err;
3683 }
3684
0153e2ec
MH		 3685 if (!IS_ERR_OR_NULL(bt_debugfs))
3686 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3687
bdc3e0f1
MH		 3688 dev_set_name(&hdev->dev, "%s", hdev->name);
3689
3690 error = device_add(&hdev->dev);
33ca954d 3691 if (error < 0)
54506918 3692 goto err_wqueue;
1da177e4 3693
6d5d2ee6
HK		 3694 hci_leds_init(hdev);
3695
611b30f7 3696 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 3697 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3698 hdev);
611b30f7
MH		 3699 if (hdev->rfkill) {
3700 if (rfkill_register(hdev->rfkill) < 0) {
3701 rfkill_destroy(hdev->rfkill);
3702 hdev->rfkill = NULL;
3703 }
3704 }
3705
5e130367 3706 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
a1536da2 3707 hci_dev_set_flag(hdev, HCI_RFKILLED);
5e130367 3708
a1536da2
MH		 3709 hci_dev_set_flag(hdev, HCI_SETUP);
3710 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
ce2be9ac 3711
ca8bee5d 3712 if (hdev->dev_type == HCI_PRIMARY) {
56f87901
JH		 3713 /* Assume BR/EDR support until proven otherwise (such as
3714 * through reading supported features during init.
3715 */
a1536da2 3716 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
56f87901 3717 }
ce2be9ac 3718
fcee3377
GP		 3719 write_lock(&hci_dev_list_lock);
3720 list_add(&hdev->list, &hci_dev_list);
3721 write_unlock(&hci_dev_list_lock);
3722
4a964404
MH		 3723 /* Devices that are marked for raw-only usage are unconfigured
3724 * and should not be included in normal operation.
fee746b0
MH		 3725 */
3726 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
a1536da2 3727 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
fee746b0 3728
05fcd4c4 3729 hci_sock_dev_event(hdev, HCI_DEV_REG);
dc946bd8 3730 hci_dev_hold(hdev);
1da177e4 3731
9952d90e
APS		 3732 hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
3733 error = register_pm_notifier(&hdev->suspend_notifier);
3734 if (error)
3735 goto err_wqueue;
3736
19202573 3737 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 3738
e5e1e7fd
MC		 3739 idr_init(&hdev->adv_monitors_idr);
3740
1da177e4 3741 return id;
f48fd9c8 3742
33ca954d
DH		 3743err_wqueue:
3744 destroy_workqueue(hdev->workqueue);
6ead1bbc 3745 destroy_workqueue(hdev->req_workqueue);
33ca954d 3746err:
3df92b31 3747 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 3748
33ca954d 3749 return error;
1da177e4
LT		 3750}
3751EXPORT_SYMBOL(hci_register_dev);
3752
3753/* Unregister HCI device */
59735631 3754void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 3755{
2d7cc19e 3756 int id;
ef222013 3757
c13854ce 3758 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 3759
a1536da2 3760 hci_dev_set_flag(hdev, HCI_UNREGISTER);
94324962 3761
3df92b31
SL		 3762 id = hdev->id;
3763
f20d09d5 3764 write_lock(&hci_dev_list_lock);
1da177e4 3765 list_del(&hdev->list);
f20d09d5 3766 write_unlock(&hci_dev_list_lock);
1da177e4 3767
b9b5ef18
GP		 3768 cancel_work_sync(&hdev->power_on);
3769
bf389cab
JS		 3770 hci_dev_do_close(hdev);
3771
9952d90e
APS		 3772 unregister_pm_notifier(&hdev->suspend_notifier);
3773
ab81cbf9 3774 if (!test_bit(HCI_INIT, &hdev->flags) &&
d7a5a11d
MH		 3775 !hci_dev_test_flag(hdev, HCI_SETUP) &&
3776 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
09fd0de5 3777 hci_dev_lock(hdev);
744cf19e 3778 mgmt_index_removed(hdev);
09fd0de5 3779 hci_dev_unlock(hdev);
56e5cb86 3780 }
ab81cbf9 3781
2e58ef3e
JH		 3782 /* mgmt_index_removed should take care of emptying the
3783 * pending list */
3784 BUG_ON(!list_empty(&hdev->mgmt_pending));
3785
05fcd4c4 3786 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
1da177e4 3787
611b30f7
MH		 3788 if (hdev->rfkill) {
3789 rfkill_unregister(hdev->rfkill);
3790 rfkill_destroy(hdev->rfkill);
3791 }
3792
bdc3e0f1 3793 device_del(&hdev->dev);
147e2d59 3794
0153e2ec 3795 debugfs_remove_recursive(hdev->debugfs);
5177a838
MH		 3796 kfree_const(hdev->hw_info);
3797 kfree_const(hdev->fw_info);
0153e2ec 3798
f48fd9c8 3799 destroy_workqueue(hdev->workqueue);
6ead1bbc 3800 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 3801
09fd0de5 3802 hci_dev_lock(hdev);
dcc36c16 3803 hci_bdaddr_list_clear(&hdev->blacklist);
6659358e 3804 hci_bdaddr_list_clear(&hdev->whitelist);
2aeb9a1a 3805 hci_uuids_clear(hdev);
55ed8ca1 3806 hci_link_keys_clear(hdev);
b899efaf 3807 hci_smp_ltks_clear(hdev);
970c4e46 3808 hci_smp_irks_clear(hdev);
2763eda6 3809 hci_remote_oob_data_clear(hdev);
d2609b34 3810 hci_adv_instances_clear(hdev);
e5e1e7fd 3811 hci_adv_monitors_clear(hdev);
dcc36c16 3812 hci_bdaddr_list_clear(&hdev->le_white_list);
cfdb0c2d 3813 hci_bdaddr_list_clear(&hdev->le_resolv_list);
373110c5 3814 hci_conn_params_clear_all(hdev);
22078800 3815 hci_discovery_filter_clear(hdev);
600a8749 3816 hci_blocked_keys_clear(hdev);
09fd0de5 3817 hci_dev_unlock(hdev);
e2e0cacb 3818
dc946bd8 3819 hci_dev_put(hdev);
3df92b31
SL		 3820
3821 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 3822}
3823EXPORT_SYMBOL(hci_unregister_dev);
3824
3825/* Suspend HCI device */
3826int hci_suspend_dev(struct hci_dev *hdev)
3827{
05fcd4c4 3828 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
1da177e4
LT		 3829 return 0;
3830}
3831EXPORT_SYMBOL(hci_suspend_dev);
3832
3833/* Resume HCI device */
3834int hci_resume_dev(struct hci_dev *hdev)
3835{
05fcd4c4 3836 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
1da177e4
LT		 3837 return 0;
3838}
3839EXPORT_SYMBOL(hci_resume_dev);
3840
75e0569f
MH		 3841/* Reset HCI device */
3842int hci_reset_dev(struct hci_dev *hdev)
3843{
1e4b6e91 3844 static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
75e0569f
MH		 3845 struct sk_buff *skb;
3846
3847 skb = bt_skb_alloc(3, GFP_ATOMIC);
3848 if (!skb)
3849 return -ENOMEM;
3850
d79f34e3 3851 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
59ae1d12 3852 skb_put_data(skb, hw_err, 3);
75e0569f
MH		 3853
3854 /* Send Hardware Error to upper stack */
3855 return hci_recv_frame(hdev, skb);
3856}
3857EXPORT_SYMBOL(hci_reset_dev);
3858
76bca880 3859/* Receive frame from HCI drivers */
e1a26170 3860int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
76bca880 3861{
76bca880 3862 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 3863 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 3864 kfree_skb(skb);
3865 return -ENXIO;
3866 }
3867
d79f34e3
MH		 3868 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
3869 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
cc974003
MH		 3870 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
3871 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) {
fe806dce
MH		 3872 kfree_skb(skb);
3873 return -EINVAL;
3874 }
3875
d82603c6 3876 /* Incoming skb */
76bca880
MH		 3877 bt_cb(skb)->incoming = 1;
3878
3879 /* Time stamp */
3880 __net_timestamp(skb);
3881
76bca880 3882 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 3883 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 3884
76bca880
MH		 3885 return 0;
3886}
3887EXPORT_SYMBOL(hci_recv_frame);
3888
e875ff84
MH		 3889/* Receive diagnostic message from HCI drivers */
3890int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
3891{
581d6fd6 3892 /* Mark as diagnostic packet */
d79f34e3 3893 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
581d6fd6 3894
e875ff84
MH		 3895 /* Time stamp */
3896 __net_timestamp(skb);
3897
581d6fd6
MH		 3898 skb_queue_tail(&hdev->rx_q, skb);
3899 queue_work(hdev->workqueue, &hdev->rx_work);
e875ff84 3900
e875ff84
MH		 3901 return 0;
3902}
3903EXPORT_SYMBOL(hci_recv_diag);
3904
5177a838
MH		 3905void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
3906{
3907 va_list vargs;
3908
3909 va_start(vargs, fmt);
3910 kfree_const(hdev->hw_info);
3911 hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3912 va_end(vargs);
3913}
3914EXPORT_SYMBOL(hci_set_hw_info);
3915
3916void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
3917{
3918 va_list vargs;
3919
3920 va_start(vargs, fmt);
3921 kfree_const(hdev->fw_info);
3922 hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3923 va_end(vargs);
3924}
3925EXPORT_SYMBOL(hci_set_fw_info);
3926
1da177e4
LT		 3927/* ---- Interface to upper protocols ---- */
3928
1da177e4
LT		 3929int hci_register_cb(struct hci_cb *cb)
3930{
3931 BT_DBG("%p name %s", cb, cb->name);
3932
fba7ecf0 3933 mutex_lock(&hci_cb_list_lock);
00629e0f 3934 list_add_tail(&cb->list, &hci_cb_list);
fba7ecf0 3935 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 3936
3937 return 0;
3938}
3939EXPORT_SYMBOL(hci_register_cb);
3940
3941int hci_unregister_cb(struct hci_cb *cb)
3942{
3943 BT_DBG("%p name %s", cb, cb->name);
3944
fba7ecf0 3945 mutex_lock(&hci_cb_list_lock);
1da177e4 3946 list_del(&cb->list);
fba7ecf0 3947 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 3948
3949 return 0;
3950}
3951EXPORT_SYMBOL(hci_unregister_cb);
3952
51086991 3953static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3954{
cdc52faa
MH		 3955 int err;
3956
d79f34e3
MH		 3957 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3958 skb->len);
1da177e4 3959
cd82e61c
MH		 3960 /* Time stamp */
3961 __net_timestamp(skb);
1da177e4 3962
cd82e61c
MH		 3963 /* Send copy to monitor */
3964 hci_send_to_monitor(hdev, skb);
3965
3966 if (atomic_read(&hdev->promisc)) {
3967 /* Send copy to the sockets */
470fe1b5 3968 hci_send_to_sock(hdev, skb);
1da177e4
LT		 3969 }
3970
3971 /* Get rid of skb owner, prior to sending to the driver. */
3972 skb_orphan(skb);
3973
73d0d3c8
MH		 3974 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3975 kfree_skb(skb);
3976 return;
3977 }
3978
cdc52faa
MH		 3979 err = hdev->send(hdev, skb);
3980 if (err < 0) {
2064ee33 3981 bt_dev_err(hdev, "sending frame failed (%d)", err);
cdc52faa
MH		 3982 kfree_skb(skb);
3983 }
1da177e4
LT		 3984}
3985
1ca3a9d0 3986/* Send HCI command */
07dc93dd
JH		 3987int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3988 const void *param)
1ca3a9d0
JH		 3989{
3990 struct sk_buff *skb;
3991
3992 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3993
3994 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3995 if (!skb) {
2064ee33 3996 bt_dev_err(hdev, "no memory for command");
1ca3a9d0
JH		 3997 return -ENOMEM;
3998 }
3999
49c922bb 4000 /* Stand-alone HCI commands must be flagged as
11714b3d
JH		 4001 * single-command requests.
4002 */
44d27137 4003 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
11714b3d 4004
1da177e4 4005 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 4006 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4007
4008 return 0;
4009}
1da177e4 4010
d6ee6ad7
LP		 4011int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
4012 const void *param)
4013{
4014 struct sk_buff *skb;
4015
4016 if (hci_opcode_ogf(opcode) != 0x3f) {
4017 /* A controller receiving a command shall respond with either
4018 * a Command Status Event or a Command Complete Event.
4019 * Therefore, all standard HCI commands must be sent via the
4020 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
4021 * Some vendors do not comply with this rule for vendor-specific
4022 * commands and do not return any event. We want to support
4023 * unresponded commands for such cases only.
4024 */
4025 bt_dev_err(hdev, "unresponded command not supported");
4026 return -EINVAL;
4027 }
4028
4029 skb = hci_prepare_cmd(hdev, opcode, plen, param);
4030 if (!skb) {
4031 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
4032 opcode);
4033 return -ENOMEM;
4034 }
4035
4036 hci_send_frame(hdev, skb);
4037
4038 return 0;
4039}
4040EXPORT_SYMBOL(__hci_cmd_send);
4041
1da177e4 4042/* Get data from the previously sent command */
a9de9248 4043void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 4044{
4045 struct hci_command_hdr *hdr;
4046
4047 if (!hdev->sent_cmd)
4048 return NULL;
4049
4050 hdr = (void *) hdev->sent_cmd->data;
4051
a9de9248 4052 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 4053 return NULL;
4054
f0e09510 4055 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 4056
4057 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
4058}
4059
fbef168f
LP		 4060/* Send HCI command and wait for command commplete event */
4061struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
4062 const void *param, u32 timeout)
4063{
4064 struct sk_buff *skb;
4065
4066 if (!test_bit(HCI_UP, &hdev->flags))
4067 return ERR_PTR(-ENETDOWN);
4068
4069 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
4070
b504430c 4071 hci_req_sync_lock(hdev);
fbef168f 4072 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
b504430c 4073 hci_req_sync_unlock(hdev);
fbef168f
LP		 4074
4075 return skb;
4076}
4077EXPORT_SYMBOL(hci_cmd_sync);
4078
1da177e4
LT		 4079/* Send ACL data */
4080static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
4081{
4082 struct hci_acl_hdr *hdr;
4083 int len = skb->len;
4084
badff6d0
ACM		 4085 skb_push(skb, HCI_ACL_HDR_SIZE);
4086 skb_reset_transport_header(skb);
9c70220b 4087 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 4088 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
4089 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 4090}
4091
ee22be7e 4092static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 4093 struct sk_buff *skb, __u16 flags)
1da177e4 4094{
ee22be7e 4095 struct hci_conn *conn = chan->conn;
1da177e4
LT		 4096 struct hci_dev *hdev = conn->hdev;
4097 struct sk_buff *list;
4098
087bfd99
GP		 4099 skb->len = skb_headlen(skb);
4100 skb->data_len = 0;
4101
d79f34e3 4102 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
204a6e54
AE		 4103
4104 switch (hdev->dev_type) {
ca8bee5d 4105 case HCI_PRIMARY:
204a6e54
AE		 4106 hci_add_acl_hdr(skb, conn->handle, flags);
4107 break;
4108 case HCI_AMP:
4109 hci_add_acl_hdr(skb, chan->handle, flags);
4110 break;
4111 default:
2064ee33 4112 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
204a6e54
AE		 4113 return;
4114 }
087bfd99 4115
70f23020
AE		 4116 list = skb_shinfo(skb)->frag_list;
4117 if (!list) {
1da177e4
LT		 4118 /* Non fragmented */
4119 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
4120
73d80deb 4121 skb_queue_tail(queue, skb);
1da177e4
LT		 4122 } else {
4123 /* Fragmented */
4124 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4125
4126 skb_shinfo(skb)->frag_list = NULL;
4127
9cfd5a23
JR		 4128 /* Queue all fragments atomically. We need to use spin_lock_bh
4129 * here because of 6LoWPAN links, as there this function is
4130 * called from softirq and using normal spin lock could cause
4131 * deadlocks.
4132 */
4133 spin_lock_bh(&queue->lock);
1da177e4 4134
73d80deb 4135 __skb_queue_tail(queue, skb);
e702112f
AE		 4136
4137 flags &= ~ACL_START;
4138 flags |= ACL_CONT;
1da177e4
LT		 4139 do {
4140 skb = list; list = list->next;
8e87d142 4141
d79f34e3 4142 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
e702112f 4143 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 4144
4145 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4146
73d80deb 4147 __skb_queue_tail(queue, skb);
1da177e4
LT		 4148 } while (list);
4149
9cfd5a23 4150 spin_unlock_bh(&queue->lock);
1da177e4 4151 }
73d80deb
LAD		 4152}
4153
4154void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
4155{
ee22be7e 4156 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 4157
f0e09510 4158 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb 4159
ee22be7e 4160 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 4161
3eff45ea 4162 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 4163}
1da177e4
LT		 4164
4165/* Send SCO data */
0d861d8b 4166void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 4167{
4168 struct hci_dev *hdev = conn->hdev;
4169 struct hci_sco_hdr hdr;
4170
4171 BT_DBG("%s len %d", hdev->name, skb->len);
4172
aca3192c 4173 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 4174 hdr.dlen = skb->len;
4175
badff6d0
ACM		 4176 skb_push(skb, HCI_SCO_HDR_SIZE);
4177 skb_reset_transport_header(skb);
9c70220b 4178 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4 4179
d79f34e3 4180 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
c78ae283 4181
1da177e4 4182 skb_queue_tail(&conn->data_q, skb);
3eff45ea 4183 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 4184}
1da177e4
LT		 4185
4186/* ---- HCI TX task (outgoing data) ---- */
4187
4188/* HCI Connection scheduler */
6039aa73
GP		 4189static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
4190 int *quote)
1da177e4
LT		 4191{
4192 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 4193 struct hci_conn *conn = NULL, *c;
abc5de8f 4194 unsigned int num = 0, min = ~0;
1da177e4 4195
8e87d142 4196 /* We don't have to lock device here. Connections are always
1da177e4 4197 * added and removed with TX task disabled. */
bf4c6325
GP		 4198
4199 rcu_read_lock();
4200
4201 list_for_each_entry_rcu(c, &h->list, list) {
769be974 4202 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 4203 continue;
769be974
MH		 4204
4205 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
4206 continue;
4207
1da177e4
LT		 4208 num++;
4209
4210 if (c->sent < min) {
4211 min = c->sent;
4212 conn = c;
4213 }
52087a79
LAD		 4214
4215 if (hci_conn_num(hdev, type) == num)
4216 break;
1da177e4
LT		 4217 }
4218
bf4c6325
GP		 4219 rcu_read_unlock();
4220
1da177e4 4221 if (conn) {
6ed58ec5
VT		 4222 int cnt, q;
4223
4224 switch (conn->type) {
4225 case ACL_LINK:
4226 cnt = hdev->acl_cnt;
4227 break;
4228 case SCO_LINK:
4229 case ESCO_LINK:
4230 cnt = hdev->sco_cnt;
4231 break;
4232 case LE_LINK:
4233 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4234 break;
4235 default:
4236 cnt = 0;
2064ee33 4237 bt_dev_err(hdev, "unknown link type %d", conn->type);
6ed58ec5
VT		 4238 }
4239
4240 q = cnt / num;
1da177e4
LT		 4241 *quote = q ? q : 1;
4242 } else
4243 *quote = 0;
4244
4245 BT_DBG("conn %p quote %d", conn, *quote);
4246 return conn;
4247}
4248
6039aa73 4249static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 4250{
4251 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 4252 struct hci_conn *c;
1da177e4 4253
2064ee33 4254 bt_dev_err(hdev, "link tx timeout");
1da177e4 4255
bf4c6325
GP		 4256 rcu_read_lock();
4257
1da177e4 4258 /* Kill stalled connections */
bf4c6325 4259 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 4260 if (c->type == type && c->sent) {
2064ee33
MH		 4261 bt_dev_err(hdev, "killing stalled connection %pMR",
4262 &c->dst);
bed71748 4263 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 4264 }
4265 }
bf4c6325
GP		 4266
4267 rcu_read_unlock();
1da177e4
LT		 4268}
4269
6039aa73
GP		 4270static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
4271 int *quote)
1da177e4 4272{
73d80deb
LAD		 4273 struct hci_conn_hash *h = &hdev->conn_hash;
4274 struct hci_chan *chan = NULL;
abc5de8f 4275 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 4276 struct hci_conn *conn;
73d80deb
LAD		 4277 int cnt, q, conn_num = 0;
4278
4279 BT_DBG("%s", hdev->name);
4280
bf4c6325
GP		 4281 rcu_read_lock();
4282
4283 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 4284 struct hci_chan *tmp;
4285
4286 if (conn->type != type)
4287 continue;
4288
4289 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4290 continue;
4291
4292 conn_num++;
4293
8192edef 4294 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 4295 struct sk_buff *skb;
4296
4297 if (skb_queue_empty(&tmp->data_q))
4298 continue;
4299
4300 skb = skb_peek(&tmp->data_q);
4301 if (skb->priority < cur_prio)
4302 continue;
4303
4304 if (skb->priority > cur_prio) {
4305 num = 0;
4306 min = ~0;
4307 cur_prio = skb->priority;
4308 }
4309
4310 num++;
4311
4312 if (conn->sent < min) {
4313 min = conn->sent;
4314 chan = tmp;
4315 }
4316 }
4317
4318 if (hci_conn_num(hdev, type) == conn_num)
4319 break;
4320 }
4321
bf4c6325
GP		 4322 rcu_read_unlock();
4323
73d80deb
LAD		 4324 if (!chan)
4325 return NULL;
4326
4327 switch (chan->conn->type) {
4328 case ACL_LINK:
4329 cnt = hdev->acl_cnt;
4330 break;
bd1eb66b
AE		 4331 case AMP_LINK:
4332 cnt = hdev->block_cnt;
4333 break;
73d80deb
LAD		 4334 case SCO_LINK:
4335 case ESCO_LINK:
4336 cnt = hdev->sco_cnt;
4337 break;
4338 case LE_LINK:
4339 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4340 break;
4341 default:
4342 cnt = 0;
2064ee33 4343 bt_dev_err(hdev, "unknown link type %d", chan->conn->type);
73d80deb
LAD		 4344 }
4345
4346 q = cnt / num;
4347 *quote = q ? q : 1;
4348 BT_DBG("chan %p quote %d", chan, *quote);
4349 return chan;
4350}
4351
02b20f0b
LAD		 4352static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
4353{
4354 struct hci_conn_hash *h = &hdev->conn_hash;
4355 struct hci_conn *conn;
4356 int num = 0;
4357
4358 BT_DBG("%s", hdev->name);
4359
bf4c6325
GP		 4360 rcu_read_lock();
4361
4362 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 4363 struct hci_chan *chan;
4364
4365 if (conn->type != type)
4366 continue;
4367
4368 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4369 continue;
4370
4371 num++;
4372
8192edef 4373 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 4374 struct sk_buff *skb;
4375
4376 if (chan->sent) {
4377 chan->sent = 0;
4378 continue;
4379 }
4380
4381 if (skb_queue_empty(&chan->data_q))
4382 continue;
4383
4384 skb = skb_peek(&chan->data_q);
4385 if (skb->priority >= HCI_PRIO_MAX - 1)
4386 continue;
4387
4388 skb->priority = HCI_PRIO_MAX - 1;
4389
4390 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 4391 skb->priority);
02b20f0b
LAD		 4392 }
4393
4394 if (hci_conn_num(hdev, type) == num)
4395 break;
4396 }
bf4c6325
GP		 4397
4398 rcu_read_unlock();
4399
02b20f0b
LAD		 4400}
4401
b71d385a
AE		 4402static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
4403{
4404 /* Calculate count of blocks used by this packet */
4405 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
4406}
4407
6039aa73 4408static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 4409{
d7a5a11d 4410 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1da177e4
LT		 4411 /* ACL tx timeout must be longer than maximum
4412 * link supervision timeout (40.9 seconds) */
63d2bc1b 4413 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 4414 HCI_ACL_TX_TIMEOUT))
bae1f5d9 4415 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 4416 }
63d2bc1b 4417}
1da177e4 4418
7fedd3bb
APS		 4419/* Schedule SCO */
4420static void hci_sched_sco(struct hci_dev *hdev)
4421{
4422 struct hci_conn *conn;
4423 struct sk_buff *skb;
4424 int quote;
4425
4426 BT_DBG("%s", hdev->name);
4427
4428 if (!hci_conn_num(hdev, SCO_LINK))
4429 return;
4430
4431 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
4432 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4433 BT_DBG("skb %p len %d", skb, skb->len);
4434 hci_send_frame(hdev, skb);
4435
4436 conn->sent++;
4437 if (conn->sent == ~0)
4438 conn->sent = 0;
4439 }
4440 }
4441}
4442
4443static void hci_sched_esco(struct hci_dev *hdev)
4444{
4445 struct hci_conn *conn;
4446 struct sk_buff *skb;
4447 int quote;
4448
4449 BT_DBG("%s", hdev->name);
4450
4451 if (!hci_conn_num(hdev, ESCO_LINK))
4452 return;
4453
4454 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4455 &quote))) {
4456 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4457 BT_DBG("skb %p len %d", skb, skb->len);
4458 hci_send_frame(hdev, skb);
4459
4460 conn->sent++;
4461 if (conn->sent == ~0)
4462 conn->sent = 0;
4463 }
4464 }
4465}
4466
6039aa73 4467static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 4468{
4469 unsigned int cnt = hdev->acl_cnt;
4470 struct hci_chan *chan;
4471 struct sk_buff *skb;
4472 int quote;
4473
4474 __check_timeout(hdev, cnt);
04837f64 4475
73d80deb 4476 while (hdev->acl_cnt &&
a8c5fb1a 4477 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 4478 u32 priority = (skb_peek(&chan->data_q))->priority;
4479 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 4480 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 4481 skb->len, skb->priority);
73d80deb 4482
ec1cce24
LAD		 4483 /* Stop if priority has changed */
4484 if (skb->priority < priority)
4485 break;
4486
4487 skb = skb_dequeue(&chan->data_q);
4488
73d80deb 4489 hci_conn_enter_active_mode(chan->conn,
04124681 4490 bt_cb(skb)->force_active);
04837f64 4491
57d17d70 4492 hci_send_frame(hdev, skb);
1da177e4
LT		 4493 hdev->acl_last_tx = jiffies;
4494
4495 hdev->acl_cnt--;
73d80deb
LAD		 4496 chan->sent++;
4497 chan->conn->sent++;
7fedd3bb
APS		 4498
4499 /* Send pending SCO packets right away */
4500 hci_sched_sco(hdev);
4501 hci_sched_esco(hdev);
1da177e4
LT		 4502 }
4503 }
02b20f0b
LAD		 4504
4505 if (cnt != hdev->acl_cnt)
4506 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 4507}
4508
6039aa73 4509static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 4510{
63d2bc1b 4511 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 4512 struct hci_chan *chan;
4513 struct sk_buff *skb;
4514 int quote;
bd1eb66b 4515 u8 type;
b71d385a 4516
63d2bc1b 4517 __check_timeout(hdev, cnt);
b71d385a 4518
bd1eb66b
AE		 4519 BT_DBG("%s", hdev->name);
4520
4521 if (hdev->dev_type == HCI_AMP)
4522 type = AMP_LINK;
4523 else
4524 type = ACL_LINK;
4525
b71d385a 4526 while (hdev->block_cnt > 0 &&
bd1eb66b 4527 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 4528 u32 priority = (skb_peek(&chan->data_q))->priority;
4529 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
4530 int blocks;
4531
4532 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 4533 skb->len, skb->priority);
b71d385a
AE		 4534
4535 /* Stop if priority has changed */
4536 if (skb->priority < priority)
4537 break;
4538
4539 skb = skb_dequeue(&chan->data_q);
4540
4541 blocks = __get_blocks(hdev, skb);
4542 if (blocks > hdev->block_cnt)
4543 return;
4544
4545 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 4546 bt_cb(skb)->force_active);
b71d385a 4547
57d17d70 4548 hci_send_frame(hdev, skb);
b71d385a
AE		 4549 hdev->acl_last_tx = jiffies;
4550
4551 hdev->block_cnt -= blocks;
4552 quote -= blocks;
4553
4554 chan->sent += blocks;
4555 chan->conn->sent += blocks;
4556 }
4557 }
4558
4559 if (cnt != hdev->block_cnt)
bd1eb66b 4560 hci_prio_recalculate(hdev, type);
b71d385a
AE		 4561}
4562
6039aa73 4563static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 4564{
4565 BT_DBG("%s", hdev->name);
4566
bd1eb66b 4567 /* No ACL link over BR/EDR controller */
ca8bee5d 4568 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
bd1eb66b
AE		 4569 return;
4570
4571 /* No AMP link over AMP controller */
4572 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 4573 return;
4574
4575 switch (hdev->flow_ctl_mode) {
4576 case HCI_FLOW_CTL_MODE_PACKET_BASED:
4577 hci_sched_acl_pkt(hdev);
4578 break;
4579
4580 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4581 hci_sched_acl_blk(hdev);
4582 break;
4583 }
4584}
4585
6039aa73 4586static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 4587{
73d80deb 4588 struct hci_chan *chan;
6ed58ec5 4589 struct sk_buff *skb;
02b20f0b 4590 int quote, cnt, tmp;
6ed58ec5
VT		 4591
4592 BT_DBG("%s", hdev->name);
4593
52087a79
LAD		 4594 if (!hci_conn_num(hdev, LE_LINK))
4595 return;
4596
6ed58ec5 4597 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
1b1d29e5
LAD		 4598
4599 __check_timeout(hdev, cnt);
4600
02b20f0b 4601 tmp = cnt;
73d80deb 4602 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 4603 u32 priority = (skb_peek(&chan->data_q))->priority;
4604 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 4605 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 4606 skb->len, skb->priority);
6ed58ec5 4607
ec1cce24
LAD		 4608 /* Stop if priority has changed */
4609 if (skb->priority < priority)
4610 break;
4611
4612 skb = skb_dequeue(&chan->data_q);
4613
57d17d70 4614 hci_send_frame(hdev, skb);
6ed58ec5
VT		 4615 hdev->le_last_tx = jiffies;
4616
4617 cnt--;
73d80deb
LAD		 4618 chan->sent++;
4619 chan->conn->sent++;
7fedd3bb
APS		 4620
4621 /* Send pending SCO packets right away */
4622 hci_sched_sco(hdev);
4623 hci_sched_esco(hdev);
6ed58ec5
VT		 4624 }
4625 }
73d80deb 4626
6ed58ec5
VT		 4627 if (hdev->le_pkts)
4628 hdev->le_cnt = cnt;
4629 else
4630 hdev->acl_cnt = cnt;
02b20f0b
LAD		 4631
4632 if (cnt != tmp)
4633 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 4634}
4635
3eff45ea 4636static void hci_tx_work(struct work_struct *work)
1da177e4 4637{
3eff45ea 4638 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 4639 struct sk_buff *skb;
4640
6ed58ec5 4641 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 4642 hdev->sco_cnt, hdev->le_cnt);
1da177e4 4643
d7a5a11d 4644 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
52de599e 4645 /* Schedule queues and send stuff to HCI driver */
52de599e
MH		 4646 hci_sched_sco(hdev);
4647 hci_sched_esco(hdev);
7fedd3bb 4648 hci_sched_acl(hdev);
52de599e
MH		 4649 hci_sched_le(hdev);
4650 }
6ed58ec5 4651
1da177e4
LT		 4652 /* Send next queued raw (unknown type) packet */
4653 while ((skb = skb_dequeue(&hdev->raw_q)))
57d17d70 4654 hci_send_frame(hdev, skb);
1da177e4
LT		 4655}
4656
25985edc 4657/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 4658
4659/* ACL data packet */
6039aa73 4660static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 4661{
4662 struct hci_acl_hdr *hdr = (void *) skb->data;
4663 struct hci_conn *conn;
4664 __u16 handle, flags;
4665
4666 skb_pull(skb, HCI_ACL_HDR_SIZE);
4667
4668 handle = __le16_to_cpu(hdr->handle);
4669 flags = hci_flags(handle);
4670 handle = hci_handle(handle);
4671
f0e09510 4672 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 4673 handle, flags);
1da177e4
LT		 4674
4675 hdev->stat.acl_rx++;
4676
4677 hci_dev_lock(hdev);
4678 conn = hci_conn_hash_lookup_handle(hdev, handle);
4679 hci_dev_unlock(hdev);
8e87d142 4680
1da177e4 4681 if (conn) {
65983fc7 4682 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 4683
1da177e4 4684 /* Send to upper protocol */
686ebf28
UF		 4685 l2cap_recv_acldata(conn, skb, flags);
4686 return;
1da177e4 4687 } else {
2064ee33
MH		 4688 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
4689 handle);
1da177e4
LT		 4690 }
4691
4692 kfree_skb(skb);
4693}
4694
4695/* SCO data packet */
6039aa73 4696static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 4697{
4698 struct hci_sco_hdr *hdr = (void *) skb->data;
4699 struct hci_conn *conn;
debdedf2 4700 __u16 handle, flags;
1da177e4
LT		 4701
4702 skb_pull(skb, HCI_SCO_HDR_SIZE);
4703
4704 handle = __le16_to_cpu(hdr->handle);
debdedf2
MH		 4705 flags = hci_flags(handle);
4706 handle = hci_handle(handle);
1da177e4 4707
debdedf2
MH		 4708 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4709 handle, flags);
1da177e4
LT		 4710
4711 hdev->stat.sco_rx++;
4712
4713 hci_dev_lock(hdev);
4714 conn = hci_conn_hash_lookup_handle(hdev, handle);
4715 hci_dev_unlock(hdev);
4716
4717 if (conn) {
1da177e4 4718 /* Send to upper protocol */
00398e1d 4719 bt_cb(skb)->sco.pkt_status = flags & 0x03;
686ebf28
UF		 4720 sco_recv_scodata(conn, skb);
4721 return;
1da177e4 4722 } else {
2064ee33
MH		 4723 bt_dev_err(hdev, "SCO packet for unknown connection handle %d",
4724 handle);
1da177e4
LT		 4725 }
4726
4727 kfree_skb(skb);
4728}
4729
9238f36a
JH		 4730static bool hci_req_is_complete(struct hci_dev *hdev)
4731{
4732 struct sk_buff *skb;
4733
4734 skb = skb_peek(&hdev->cmd_q);
4735 if (!skb)
4736 return true;
4737
44d27137 4738 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
9238f36a
JH		 4739}
4740
42c6b129
JH		 4741static void hci_resend_last(struct hci_dev *hdev)
4742{
4743 struct hci_command_hdr *sent;
4744 struct sk_buff *skb;
4745 u16 opcode;
4746
4747 if (!hdev->sent_cmd)
4748 return;
4749
4750 sent = (void *) hdev->sent_cmd->data;
4751 opcode = __le16_to_cpu(sent->opcode);
4752 if (opcode == HCI_OP_RESET)
4753 return;
4754
4755 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4756 if (!skb)
4757 return;
4758
4759 skb_queue_head(&hdev->cmd_q, skb);
4760 queue_work(hdev->workqueue, &hdev->cmd_work);
4761}
4762
e6214487
JH		 4763void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4764 hci_req_complete_t *req_complete,
4765 hci_req_complete_skb_t *req_complete_skb)
9238f36a 4766{
9238f36a
JH		 4767 struct sk_buff *skb;
4768 unsigned long flags;
4769
4770 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4771
42c6b129
JH		 4772 /* If the completed command doesn't match the last one that was
4773 * sent we need to do special handling of it.
9238f36a 4774 */
42c6b129
JH		 4775 if (!hci_sent_cmd_data(hdev, opcode)) {
4776 /* Some CSR based controllers generate a spontaneous
4777 * reset complete event during init and any pending
4778 * command will never be completed. In such a case we
4779 * need to resend whatever was the last sent
4780 * command.
4781 */
4782 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4783 hci_resend_last(hdev);
4784
9238f36a 4785 return;
42c6b129 4786 }
9238f36a 4787
f80c5dad
JPRV		 4788 /* If we reach this point this event matches the last command sent */
4789 hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
4790
9238f36a
JH		 4791 /* If the command succeeded and there's still more commands in
4792 * this request the request is not yet complete.
4793 */
4794 if (!status && !hci_req_is_complete(hdev))
4795 return;
4796
4797 /* If this was the last command in a request the complete
4798 * callback would be found in hdev->sent_cmd instead of the
4799 * command queue (hdev->cmd_q).
4800 */
44d27137
JH		 4801 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4802 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
e6214487
JH		 4803 return;
4804 }
53e21fbc 4805
44d27137
JH		 4806 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4807 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
e6214487 4808 return;
9238f36a
JH		 4809 }
4810
4811 /* Remove all pending commands belonging to this request */
4812 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4813 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
44d27137 4814 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
9238f36a
JH		 4815 __skb_queue_head(&hdev->cmd_q, skb);
4816 break;
4817 }
4818
3bd7594e
DA		 4819 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4820 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4821 else
4822 *req_complete = bt_cb(skb)->hci.req_complete;
9238f36a
JH		 4823 kfree_skb(skb);
4824 }
4825 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
9238f36a
JH		 4826}
4827
b78752cc 4828static void hci_rx_work(struct work_struct *work)
1da177e4 4829{
b78752cc 4830 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 4831 struct sk_buff *skb;
4832
4833 BT_DBG("%s", hdev->name);
4834
1da177e4 4835 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 4836 /* Send copy to monitor */
4837 hci_send_to_monitor(hdev, skb);
4838
1da177e4
LT		 4839 if (atomic_read(&hdev->promisc)) {
4840 /* Send copy to the sockets */
470fe1b5 4841 hci_send_to_sock(hdev, skb);
1da177e4
LT		 4842 }
4843
eb8c101e
MK		 4844 /* If the device has been opened in HCI_USER_CHANNEL,
4845 * the userspace has exclusive access to device.
4846 * When device is HCI_INIT, we still need to process
4847 * the data packets to the driver in order
4848 * to complete its setup().
4849 */
4850 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4851 !test_bit(HCI_INIT, &hdev->flags)) {
1da177e4
LT		 4852 kfree_skb(skb);
4853 continue;
4854 }
4855
4856 if (test_bit(HCI_INIT, &hdev->flags)) {
4857 /* Don't process data packets in this states. */
d79f34e3 4858 switch (hci_skb_pkt_type(skb)) {
1da177e4
LT		 4859 case HCI_ACLDATA_PKT:
4860 case HCI_SCODATA_PKT:
cc974003 4861 case HCI_ISODATA_PKT:
1da177e4
LT		 4862 kfree_skb(skb);
4863 continue;
3ff50b79 4864 }
1da177e4
LT		 4865 }
4866
4867 /* Process frame */
d79f34e3 4868 switch (hci_skb_pkt_type(skb)) {
1da177e4 4869 case HCI_EVENT_PKT:
b78752cc 4870 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 4871 hci_event_packet(hdev, skb);
4872 break;
4873
4874 case HCI_ACLDATA_PKT:
4875 BT_DBG("%s ACL data packet", hdev->name);
4876 hci_acldata_packet(hdev, skb);
4877 break;
4878
4879 case HCI_SCODATA_PKT:
4880 BT_DBG("%s SCO data packet", hdev->name);
4881 hci_scodata_packet(hdev, skb);
4882 break;
4883
4884 default:
4885 kfree_skb(skb);
4886 break;
4887 }
4888 }
1da177e4
LT		 4889}
4890
c347b765 4891static void hci_cmd_work(struct work_struct *work)
1da177e4 4892{
c347b765 4893 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 4894 struct sk_buff *skb;
4895
2104786b
AE		 4896 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4897 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 4898
1da177e4 4899 /* Send queued commands */
5a08ecce
AE		 4900 if (atomic_read(&hdev->cmd_cnt)) {
4901 skb = skb_dequeue(&hdev->cmd_q);
4902 if (!skb)
4903 return;
4904
7585b97a 4905 kfree_skb(hdev->sent_cmd);
1da177e4 4906
a675d7f1 4907 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
70f23020 4908 if (hdev->sent_cmd) {
f80c5dad
JPRV		 4909 if (hci_req_status_pend(hdev))
4910 hci_dev_set_flag(hdev, HCI_CMD_PENDING);
1da177e4 4911 atomic_dec(&hdev->cmd_cnt);
57d17d70 4912 hci_send_frame(hdev, skb);
7bdb8a5c 4913 if (test_bit(HCI_RESET, &hdev->flags))
65cc2b49 4914 cancel_delayed_work(&hdev->cmd_timer);
7bdb8a5c 4915 else
65cc2b49
MH		 4916 schedule_delayed_work(&hdev->cmd_timer,
4917 HCI_CMD_TIMEOUT);
1da177e4
LT		 4918 } else {
4919 skb_queue_head(&hdev->cmd_q, skb);
c347b765 4920 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4921 }
4922 }
4923}
Linux 6.x block layer and io_uring tree(s)