projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge git://git.kernel.org/pub/scm/linux/kernel/git/davem/net
[linux-2.6-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
3df92b31 29#include <linux/idr.h>
8c520a59 30#include <linux/rfkill.h>
baf27f6e 31#include <linux/debugfs.h>
99780a7b 32#include <linux/crypto.h>
47219839 33#include <asm/unaligned.h>
1da177e4
LT		 34
35#include <net/bluetooth/bluetooth.h>
36#include <net/bluetooth/hci_core.h>
4bc58f51 37#include <net/bluetooth/l2cap.h>
af58925c 38#include <net/bluetooth/mgmt.h>
1da177e4 39
0857dd3b 40#include "hci_request.h"
60c5f5fb 41#include "hci_debugfs.h"
970c4e46
JH		 42#include "smp.h"
43
b78752cc 44static void hci_rx_work(struct work_struct *work);
c347b765 45static void hci_cmd_work(struct work_struct *work);
3eff45ea 46static void hci_tx_work(struct work_struct *work);
1da177e4 47
1da177e4
LT		 48/* HCI device list */
49LIST_HEAD(hci_dev_list);
50DEFINE_RWLOCK(hci_dev_list_lock);
51
52/* HCI callback list */
53LIST_HEAD(hci_cb_list);
fba7ecf0 54DEFINE_MUTEX(hci_cb_list_lock);
1da177e4 55
3df92b31
SL		 56/* HCI ID Numbering */
57static DEFINE_IDA(hci_index_ida);
58
baf27f6e
MH		 59/* ---- HCI debugfs entries ---- */
60
4b4148e9
MH		 61static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
62 size_t count, loff_t *ppos)
63{
64 struct hci_dev *hdev = file->private_data;
65 char buf[3];
66
74b93e9f 67 buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
4b4148e9
MH		 68 buf[1] = '\n';
69 buf[2] = '\0';
70 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
71}
72
73static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
74 size_t count, loff_t *ppos)
75{
76 struct hci_dev *hdev = file->private_data;
77 struct sk_buff *skb;
78 char buf[32];
79 size_t buf_size = min(count, (sizeof(buf)-1));
80 bool enable;
4b4148e9
MH		 81
82 if (!test_bit(HCI_UP, &hdev->flags))
83 return -ENETDOWN;
84
85 if (copy_from_user(buf, user_buf, buf_size))
86 return -EFAULT;
87
88 buf[buf_size] = '\0';
89 if (strtobool(buf, &enable))
90 return -EINVAL;
91
b7cb93e5 92 if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
4b4148e9
MH		 93 return -EALREADY;
94
b504430c 95 hci_req_sync_lock(hdev);
4b4148e9
MH		 96 if (enable)
97 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
98 HCI_CMD_TIMEOUT);
99 else
100 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
101 HCI_CMD_TIMEOUT);
b504430c 102 hci_req_sync_unlock(hdev);
4b4148e9
MH		 103
104 if (IS_ERR(skb))
105 return PTR_ERR(skb);
106
4b4148e9
MH		 107 kfree_skb(skb);
108
b7cb93e5 109 hci_dev_change_flag(hdev, HCI_DUT_MODE);
4b4148e9
MH		 110
111 return count;
112}
113
114static const struct file_operations dut_mode_fops = {
115 .open = simple_open,
116 .read = dut_mode_read,
117 .write = dut_mode_write,
118 .llseek = default_llseek,
119};
120
4b4113d6
MH		 121static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
122 size_t count, loff_t *ppos)
123{
124 struct hci_dev *hdev = file->private_data;
125 char buf[3];
126
74b93e9f 127 buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
4b4113d6
MH		 128 buf[1] = '\n';
129 buf[2] = '\0';
130 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
131}
132
133static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
134 size_t count, loff_t *ppos)
135{
136 struct hci_dev *hdev = file->private_data;
137 char buf[32];
138 size_t buf_size = min(count, (sizeof(buf)-1));
139 bool enable;
140 int err;
141
142 if (copy_from_user(buf, user_buf, buf_size))
143 return -EFAULT;
144
145 buf[buf_size] = '\0';
146 if (strtobool(buf, &enable))
147 return -EINVAL;
148
7e995b9e
MH		 149 /* When the diagnostic flags are not persistent and the transport
150 * is not active, then there is no need for the vendor callback.
151 *
152 * Instead just store the desired value. If needed the setting
153 * will be programmed when the controller gets powered on.
154 */
155 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
156 !test_bit(HCI_RUNNING, &hdev->flags))
157 goto done;
158
b504430c 159 hci_req_sync_lock(hdev);
4b4113d6 160 err = hdev->set_diag(hdev, enable);
b504430c 161 hci_req_sync_unlock(hdev);
4b4113d6
MH		 162
163 if (err < 0)
164 return err;
165
7e995b9e 166done:
4b4113d6
MH		 167 if (enable)
168 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
169 else
170 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
171
172 return count;
173}
174
175static const struct file_operations vendor_diag_fops = {
176 .open = simple_open,
177 .read = vendor_diag_read,
178 .write = vendor_diag_write,
179 .llseek = default_llseek,
180};
181
f640ee98
MH		 182static void hci_debugfs_create_basic(struct hci_dev *hdev)
183{
184 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
185 &dut_mode_fops);
186
187 if (hdev->set_diag)
188 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
189 &vendor_diag_fops);
190}
191
a1d01db1 192static int hci_reset_req(struct hci_request *req, unsigned long opt)
1da177e4 193{
42c6b129 194 BT_DBG("%s %ld", req->hdev->name, opt);
1da177e4
LT		 195
196 /* Reset device */
42c6b129
JH		 197 set_bit(HCI_RESET, &req->hdev->flags);
198 hci_req_add(req, HCI_OP_RESET, 0, NULL);
a1d01db1 199 return 0;
1da177e4
LT		 200}
201
42c6b129 202static void bredr_init(struct hci_request *req)
1da177e4 203{
42c6b129 204 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
2455a3ea 205
1da177e4 206 /* Read Local Supported Features */
42c6b129 207 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 208
1143e5a6 209 /* Read Local Version */
42c6b129 210 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
2177bab5
JH		 211
212 /* Read BD Address */
42c6b129 213 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1da177e4
LT		 214}
215
0af801b9 216static void amp_init1(struct hci_request *req)
e61ef499 217{
42c6b129 218 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
2455a3ea 219
e61ef499 220 /* Read Local Version */
42c6b129 221 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489 222
f6996cfe
MH		 223 /* Read Local Supported Commands */
224 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
225
6bcbc489 226 /* Read Local AMP Info */
42c6b129 227 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 228
229 /* Read Data Blk size */
42c6b129 230 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
7528ca1c 231
f38ba941
MH		 232 /* Read Flow Control Mode */
233 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
234
7528ca1c
MH		 235 /* Read Location Data */
236 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
e61ef499
AE		 237}
238
a1d01db1 239static int amp_init2(struct hci_request *req)
0af801b9
JH		 240{
241 /* Read Local Supported Features. Not all AMP controllers
242 * support this so it's placed conditionally in the second
243 * stage init.
244 */
245 if (req->hdev->commands[14] & 0x20)
246 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
a1d01db1
JH		 247
248 return 0;
0af801b9
JH		 249}
250
a1d01db1 251static int hci_init1_req(struct hci_request *req, unsigned long opt)
e61ef499 252{
42c6b129 253 struct hci_dev *hdev = req->hdev;
e61ef499
AE		 254
255 BT_DBG("%s %ld", hdev->name, opt);
256
11778716
AE		 257 /* Reset */
258 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
42c6b129 259 hci_reset_req(req, 0);
11778716 260
e61ef499
AE		 261 switch (hdev->dev_type) {
262 case HCI_BREDR:
42c6b129 263 bredr_init(req);
e61ef499
AE		 264 break;
265
266 case HCI_AMP:
0af801b9 267 amp_init1(req);
e61ef499
AE		 268 break;
269
270 default:
271 BT_ERR("Unknown device type %d", hdev->dev_type);
272 break;
273 }
a1d01db1
JH		 274
275 return 0;
e61ef499
AE		 276}
277
42c6b129 278static void bredr_setup(struct hci_request *req)
2177bab5 279{
2177bab5
JH		 280 __le16 param;
281 __u8 flt_type;
282
283 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
42c6b129 284 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 285
286 /* Read Class of Device */
42c6b129 287 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
2177bab5
JH		 288
289 /* Read Local Name */
42c6b129 290 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
2177bab5
JH		 291
292 /* Read Voice Setting */
42c6b129 293 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
2177bab5 294
b4cb9fb2
MH		 295 /* Read Number of Supported IAC */
296 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
297
4b836f39
MH		 298 /* Read Current IAC LAP */
299 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
300
2177bab5
JH		 301 /* Clear Event Filters */
302 flt_type = HCI_FLT_CLEAR_ALL;
42c6b129 303 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
2177bab5
JH		 304
305 /* Connection accept timeout ~20 secs */
dcf4adbf 306 param = cpu_to_le16(0x7d00);
42c6b129 307 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
2177bab5
JH		 308}
309
42c6b129 310static void le_setup(struct hci_request *req)
2177bab5 311{
c73eee91
JH		 312 struct hci_dev *hdev = req->hdev;
313
2177bab5 314 /* Read LE Buffer Size */
42c6b129 315 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 316
317 /* Read LE Local Supported Features */
42c6b129 318 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
2177bab5 319
747d3f03
MH		 320 /* Read LE Supported States */
321 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
322
c73eee91
JH		 323 /* LE-only controllers have LE implicitly enabled */
324 if (!lmp_bredr_capable(hdev))
a1536da2 325 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2177bab5
JH		 326}
327
42c6b129 328static void hci_setup_event_mask(struct hci_request *req)
2177bab5 329{
42c6b129
JH		 330 struct hci_dev *hdev = req->hdev;
331
2177bab5
JH		 332 /* The second byte is 0xff instead of 0x9f (two reserved bits
333 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
334 * command otherwise.
335 */
336 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
337
338 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
339 * any event mask for pre 1.2 devices.
340 */
341 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
342 return;
343
344 if (lmp_bredr_capable(hdev)) {
345 events[4] |= 0x01; /* Flow Specification Complete */
c7882cbd
MH		 346 } else {
347 /* Use a different default for LE-only devices */
348 memset(events, 0, sizeof(events));
c7882cbd
MH		 349 events[1] |= 0x20; /* Command Complete */
350 events[1] |= 0x40; /* Command Status */
351 events[1] |= 0x80; /* Hardware Error */
5c3d3b4c
MH		 352
353 /* If the controller supports the Disconnect command, enable
354 * the corresponding event. In addition enable packet flow
355 * control related events.
356 */
357 if (hdev->commands[0] & 0x20) {
358 events[0] |= 0x10; /* Disconnection Complete */
359 events[2] |= 0x04; /* Number of Completed Packets */
360 events[3] |= 0x02; /* Data Buffer Overflow */
361 }
362
363 /* If the controller supports the Read Remote Version
364 * Information command, enable the corresponding event.
365 */
366 if (hdev->commands[2] & 0x80)
367 events[1] |= 0x08; /* Read Remote Version Information
368 * Complete
369 */
0da71f1b
MH		 370
371 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
372 events[0] |= 0x80; /* Encryption Change */
373 events[5] |= 0x80; /* Encryption Key Refresh Complete */
374 }
2177bab5
JH		 375 }
376
9fe759ce
MH		 377 if (lmp_inq_rssi_capable(hdev) ||
378 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
2177bab5
JH		 379 events[4] |= 0x02; /* Inquiry Result with RSSI */
380
70f56aa2
MH		 381 if (lmp_ext_feat_capable(hdev))
382 events[4] |= 0x04; /* Read Remote Extended Features Complete */
383
384 if (lmp_esco_capable(hdev)) {
385 events[5] |= 0x08; /* Synchronous Connection Complete */
386 events[5] |= 0x10; /* Synchronous Connection Changed */
387 }
388
2177bab5
JH		 389 if (lmp_sniffsubr_capable(hdev))
390 events[5] |= 0x20; /* Sniff Subrating */
391
392 if (lmp_pause_enc_capable(hdev))
393 events[5] |= 0x80; /* Encryption Key Refresh Complete */
394
395 if (lmp_ext_inq_capable(hdev))
396 events[5] |= 0x40; /* Extended Inquiry Result */
397
398 if (lmp_no_flush_capable(hdev))
399 events[7] |= 0x01; /* Enhanced Flush Complete */
400
401 if (lmp_lsto_capable(hdev))
402 events[6] |= 0x80; /* Link Supervision Timeout Changed */
403
404 if (lmp_ssp_capable(hdev)) {
405 events[6] |= 0x01; /* IO Capability Request */
406 events[6] |= 0x02; /* IO Capability Response */
407 events[6] |= 0x04; /* User Confirmation Request */
408 events[6] |= 0x08; /* User Passkey Request */
409 events[6] |= 0x10; /* Remote OOB Data Request */
410 events[6] |= 0x20; /* Simple Pairing Complete */
411 events[7] |= 0x04; /* User Passkey Notification */
412 events[7] |= 0x08; /* Keypress Notification */
413 events[7] |= 0x10; /* Remote Host Supported
414 * Features Notification
415 */
416 }
417
418 if (lmp_le_capable(hdev))
419 events[7] |= 0x20; /* LE Meta-Event */
420
42c6b129 421 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
2177bab5
JH		 422}
423
a1d01db1 424static int hci_init2_req(struct hci_request *req, unsigned long opt)
2177bab5 425{
42c6b129
JH		 426 struct hci_dev *hdev = req->hdev;
427
0af801b9
JH		 428 if (hdev->dev_type == HCI_AMP)
429 return amp_init2(req);
430
2177bab5 431 if (lmp_bredr_capable(hdev))
42c6b129 432 bredr_setup(req);
56f87901 433 else
a358dc11 434 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
2177bab5
JH		 435
436 if (lmp_le_capable(hdev))
42c6b129 437 le_setup(req);
2177bab5 438
0f3adeae
MH		 439 /* All Bluetooth 1.2 and later controllers should support the
440 * HCI command for reading the local supported commands.
441 *
442 * Unfortunately some controllers indicate Bluetooth 1.2 support,
443 * but do not have support for this command. If that is the case,
444 * the driver can quirk the behavior and skip reading the local
445 * supported commands.
3f8e2d75 446 */
0f3adeae
MH		 447 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
448 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
42c6b129 449 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
2177bab5
JH		 450
451 if (lmp_ssp_capable(hdev)) {
57af75a8
MH		 452 /* When SSP is available, then the host features page
453 * should also be available as well. However some
454 * controllers list the max_page as 0 as long as SSP
455 * has not been enabled. To achieve proper debugging
456 * output, force the minimum max_page to 1 at least.
457 */
458 hdev->max_page = 0x01;
459
d7a5a11d 460 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2177bab5 461 u8 mode = 0x01;
574ea3c7 462
42c6b129
JH		 463 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
464 sizeof(mode), &mode);
2177bab5
JH		 465 } else {
466 struct hci_cp_write_eir cp;
467
468 memset(hdev->eir, 0, sizeof(hdev->eir));
469 memset(&cp, 0, sizeof(cp));
470
42c6b129 471 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
2177bab5
JH		 472 }
473 }
474
043ec9bf
MH		 475 if (lmp_inq_rssi_capable(hdev) ||
476 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
04422da9
MH		 477 u8 mode;
478
479 /* If Extended Inquiry Result events are supported, then
480 * they are clearly preferred over Inquiry Result with RSSI
481 * events.
482 */
483 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
484
485 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
486 }
2177bab5
JH		 487
488 if (lmp_inq_tx_pwr_capable(hdev))
42c6b129 489 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
2177bab5
JH		 490
491 if (lmp_ext_feat_capable(hdev)) {
492 struct hci_cp_read_local_ext_features cp;
493
494 cp.page = 0x01;
42c6b129
JH		 495 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
496 sizeof(cp), &cp);
2177bab5
JH		 497 }
498
d7a5a11d 499 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2177bab5 500 u8 enable = 1;
42c6b129
JH		 501 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
502 &enable);
2177bab5 503 }
a1d01db1
JH		 504
505 return 0;
2177bab5
JH		 506}
507
42c6b129 508static void hci_setup_link_policy(struct hci_request *req)
2177bab5 509{
42c6b129 510 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 511 struct hci_cp_write_def_link_policy cp;
512 u16 link_policy = 0;
513
514 if (lmp_rswitch_capable(hdev))
515 link_policy |= HCI_LP_RSWITCH;
516 if (lmp_hold_capable(hdev))
517 link_policy |= HCI_LP_HOLD;
518 if (lmp_sniff_capable(hdev))
519 link_policy |= HCI_LP_SNIFF;
520 if (lmp_park_capable(hdev))
521 link_policy |= HCI_LP_PARK;
522
523 cp.policy = cpu_to_le16(link_policy);
42c6b129 524 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
2177bab5
JH		 525}
526
42c6b129 527static void hci_set_le_support(struct hci_request *req)
2177bab5 528{
42c6b129 529 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 530 struct hci_cp_write_le_host_supported cp;
531
c73eee91
JH		 532 /* LE-only devices do not support explicit enablement */
533 if (!lmp_bredr_capable(hdev))
534 return;
535
2177bab5
JH		 536 memset(&cp, 0, sizeof(cp));
537
d7a5a11d 538 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2177bab5 539 cp.le = 0x01;
32226e4f 540 cp.simul = 0x00;
2177bab5
JH		 541 }
542
543 if (cp.le != lmp_host_le_capable(hdev))
42c6b129
JH		 544 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
545 &cp);
2177bab5
JH		 546}
547
d62e6d67
JH		 548static void hci_set_event_mask_page_2(struct hci_request *req)
549{
550 struct hci_dev *hdev = req->hdev;
551 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
552
553 /* If Connectionless Slave Broadcast master role is supported
554 * enable all necessary events for it.
555 */
53b834d2 556 if (lmp_csb_master_capable(hdev)) {
d62e6d67
JH		 557 events[1] |= 0x40; /* Triggered Clock Capture */
558 events[1] |= 0x80; /* Synchronization Train Complete */
559 events[2] |= 0x10; /* Slave Page Response Timeout */
560 events[2] |= 0x20; /* CSB Channel Map Change */
561 }
562
563 /* If Connectionless Slave Broadcast slave role is supported
564 * enable all necessary events for it.
565 */
53b834d2 566 if (lmp_csb_slave_capable(hdev)) {
d62e6d67
JH		 567 events[2] |= 0x01; /* Synchronization Train Received */
568 events[2] |= 0x02; /* CSB Receive */
569 events[2] |= 0x04; /* CSB Timeout */
570 events[2] |= 0x08; /* Truncated Page Complete */
571 }
572
40c59fcb 573 /* Enable Authenticated Payload Timeout Expired event if supported */
cd7ca0ec 574 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
40c59fcb
MH		 575 events[2] |= 0x80;
576
d62e6d67
JH		 577 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
578}
579
a1d01db1 580static int hci_init3_req(struct hci_request *req, unsigned long opt)
2177bab5 581{
42c6b129 582 struct hci_dev *hdev = req->hdev;
d2c5d77f 583 u8 p;
42c6b129 584
0da71f1b
MH		 585 hci_setup_event_mask(req);
586
e81be90b
JH		 587 if (hdev->commands[6] & 0x20 &&
588 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
48ce62c4
MH		 589 struct hci_cp_read_stored_link_key cp;
590
591 bacpy(&cp.bdaddr, BDADDR_ANY);
592 cp.read_all = 0x01;
593 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
594 }
595
2177bab5 596 if (hdev->commands[5] & 0x10)
42c6b129 597 hci_setup_link_policy(req);
2177bab5 598
417287de
MH		 599 if (hdev->commands[8] & 0x01)
600 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
601
602 /* Some older Broadcom based Bluetooth 1.2 controllers do not
603 * support the Read Page Scan Type command. Check support for
604 * this command in the bit mask of supported commands.
605 */
606 if (hdev->commands[13] & 0x01)
607 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
608
9193c6e8
AG		 609 if (lmp_le_capable(hdev)) {
610 u8 events[8];
611
612 memset(events, 0, sizeof(events));
4d6c705b
MH		 613
614 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
615 events[0] |= 0x10; /* LE Long Term Key Request */
662bc2e6
AG		 616
617 /* If controller supports the Connection Parameters Request
618 * Link Layer Procedure, enable the corresponding event.
619 */
620 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
621 events[0] |= 0x20; /* LE Remote Connection
622 * Parameter Request
623 */
624
a9f6068e
MH		 625 /* If the controller supports the Data Length Extension
626 * feature, enable the corresponding event.
627 */
628 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
629 events[0] |= 0x40; /* LE Data Length Change */
630
4b71bba4
MH		 631 /* If the controller supports Extended Scanner Filter
632 * Policies, enable the correspondig event.
633 */
634 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
635 events[1] |= 0x04; /* LE Direct Advertising
636 * Report
637 */
638
7d26f5c4
MH		 639 /* If the controller supports the LE Set Scan Enable command,
640 * enable the corresponding advertising report event.
641 */
642 if (hdev->commands[26] & 0x08)
643 events[0] |= 0x02; /* LE Advertising Report */
644
645 /* If the controller supports the LE Create Connection
646 * command, enable the corresponding event.
647 */
648 if (hdev->commands[26] & 0x10)
649 events[0] |= 0x01; /* LE Connection Complete */
650
651 /* If the controller supports the LE Connection Update
652 * command, enable the corresponding event.
653 */
654 if (hdev->commands[27] & 0x04)
655 events[0] |= 0x04; /* LE Connection Update
656 * Complete
657 */
658
659 /* If the controller supports the LE Read Remote Used Features
660 * command, enable the corresponding event.
661 */
662 if (hdev->commands[27] & 0x20)
663 events[0] |= 0x08; /* LE Read Remote Used
664 * Features Complete
665 */
666
5a34bd5f
MH		 667 /* If the controller supports the LE Read Local P-256
668 * Public Key command, enable the corresponding event.
669 */
670 if (hdev->commands[34] & 0x02)
671 events[0] |= 0x80; /* LE Read Local P-256
672 * Public Key Complete
673 */
674
675 /* If the controller supports the LE Generate DHKey
676 * command, enable the corresponding event.
677 */
678 if (hdev->commands[34] & 0x04)
679 events[1] |= 0x01; /* LE Generate DHKey Complete */
680
9193c6e8
AG		 681 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
682 events);
683
15a49cca
MH		 684 if (hdev->commands[25] & 0x40) {
685 /* Read LE Advertising Channel TX Power */
686 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
687 }
688
2ab216a7
MH		 689 if (hdev->commands[26] & 0x40) {
690 /* Read LE White List Size */
691 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE,
692 0, NULL);
693 }
694
695 if (hdev->commands[26] & 0x80) {
696 /* Clear LE White List */
697 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
698 }
699
a9f6068e
MH		 700 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
701 /* Read LE Maximum Data Length */
702 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
703
704 /* Read LE Suggested Default Data Length */
705 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
706 }
707
42c6b129 708 hci_set_le_support(req);
9193c6e8 709 }
d2c5d77f
JH		 710
711 /* Read features beyond page 1 if available */
712 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
713 struct hci_cp_read_local_ext_features cp;
714
715 cp.page = p;
716 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
717 sizeof(cp), &cp);
718 }
a1d01db1
JH		 719
720 return 0;
2177bab5
JH		 721}
722
a1d01db1 723static int hci_init4_req(struct hci_request *req, unsigned long opt)
5d4e7e8d
JH		 724{
725 struct hci_dev *hdev = req->hdev;
726
36f260ce
MH		 727 /* Some Broadcom based Bluetooth controllers do not support the
728 * Delete Stored Link Key command. They are clearly indicating its
729 * absence in the bit mask of supported commands.
730 *
731 * Check the supported commands and only if the the command is marked
732 * as supported send it. If not supported assume that the controller
733 * does not have actual support for stored link keys which makes this
734 * command redundant anyway.
735 *
736 * Some controllers indicate that they support handling deleting
737 * stored link keys, but they don't. The quirk lets a driver
738 * just disable this command.
739 */
740 if (hdev->commands[6] & 0x80 &&
741 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
742 struct hci_cp_delete_stored_link_key cp;
743
744 bacpy(&cp.bdaddr, BDADDR_ANY);
745 cp.delete_all = 0x01;
746 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
747 sizeof(cp), &cp);
748 }
749
d62e6d67
JH		 750 /* Set event mask page 2 if the HCI command for it is supported */
751 if (hdev->commands[22] & 0x04)
752 hci_set_event_mask_page_2(req);
753
109e3191
MH		 754 /* Read local codec list if the HCI command is supported */
755 if (hdev->commands[29] & 0x20)
756 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
757
f4fe73ed
MH		 758 /* Get MWS transport configuration if the HCI command is supported */
759 if (hdev->commands[30] & 0x08)
760 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
761
5d4e7e8d 762 /* Check for Synchronization Train support */
53b834d2 763 if (lmp_sync_train_capable(hdev))
5d4e7e8d 764 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
a6d0d690
MH		 765
766 /* Enable Secure Connections if supported and configured */
d7a5a11d 767 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
574ea3c7 768 bredr_sc_enabled(hdev)) {
a6d0d690 769 u8 support = 0x01;
574ea3c7 770
a6d0d690
MH		 771 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
772 sizeof(support), &support);
773 }
a1d01db1
JH		 774
775 return 0;
5d4e7e8d
JH		 776}
777
2177bab5
JH		 778static int __hci_init(struct hci_dev *hdev)
779{
780 int err;
781
4ebeee2d 782 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
2177bab5
JH		 783 if (err < 0)
784 return err;
785
f640ee98
MH		 786 if (hci_dev_test_flag(hdev, HCI_SETUP))
787 hci_debugfs_create_basic(hdev);
4b4148e9 788
4ebeee2d 789 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
0af801b9
JH		 790 if (err < 0)
791 return err;
792
2177bab5
JH		 793 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
794 * BR/EDR/LE type controllers. AMP controllers only need the
0af801b9 795 * first two stages of init.
2177bab5
JH		 796 */
797 if (hdev->dev_type != HCI_BREDR)
798 return 0;
799
4ebeee2d 800 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
5d4e7e8d
JH		 801 if (err < 0)
802 return err;
803
4ebeee2d 804 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
baf27f6e
MH		 805 if (err < 0)
806 return err;
807
ec6cef9c
MH		 808 /* This function is only called when the controller is actually in
809 * configured state. When the controller is marked as unconfigured,
810 * this initialization procedure is not run.
811 *
812 * It means that it is possible that a controller runs through its
813 * setup phase and then discovers missing settings. If that is the
814 * case, then this function will not be called. It then will only
815 * be called during the config phase.
816 *
817 * So only when in setup phase or config phase, create the debugfs
818 * entries and register the SMP channels.
baf27f6e 819 */
d7a5a11d
MH		 820 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
821 !hci_dev_test_flag(hdev, HCI_CONFIG))
baf27f6e
MH		 822 return 0;
823
60c5f5fb
MH		 824 hci_debugfs_create_common(hdev);
825
71c3b60e 826 if (lmp_bredr_capable(hdev))
60c5f5fb 827 hci_debugfs_create_bredr(hdev);
2bfa3531 828
162a3bac 829 if (lmp_le_capable(hdev))
60c5f5fb 830 hci_debugfs_create_le(hdev);
e7b8fc92 831
baf27f6e 832 return 0;
2177bab5
JH		 833}
834
a1d01db1 835static int hci_init0_req(struct hci_request *req, unsigned long opt)
0ebca7d6
MH		 836{
837 struct hci_dev *hdev = req->hdev;
838
839 BT_DBG("%s %ld", hdev->name, opt);
840
841 /* Reset */
842 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
843 hci_reset_req(req, 0);
844
845 /* Read Local Version */
846 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
847
848 /* Read BD Address */
849 if (hdev->set_bdaddr)
850 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
a1d01db1
JH		 851
852 return 0;
0ebca7d6
MH		 853}
854
855static int __hci_unconf_init(struct hci_dev *hdev)
856{
857 int err;
858
cc78b44b
MH		 859 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
860 return 0;
861
4ebeee2d 862 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
0ebca7d6
MH		 863 if (err < 0)
864 return err;
865
f640ee98
MH		 866 if (hci_dev_test_flag(hdev, HCI_SETUP))
867 hci_debugfs_create_basic(hdev);
868
0ebca7d6
MH		 869 return 0;
870}
871
a1d01db1 872static int hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 873{
874 __u8 scan = opt;
875
42c6b129 876 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 877
878 /* Inquiry and Page scans */
42c6b129 879 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
a1d01db1 880 return 0;
1da177e4
LT		 881}
882
a1d01db1 883static int hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 884{
885 __u8 auth = opt;
886
42c6b129 887 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 888
889 /* Authentication */
42c6b129 890 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
a1d01db1 891 return 0;
1da177e4
LT		 892}
893
a1d01db1 894static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 895{
896 __u8 encrypt = opt;
897
42c6b129 898 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 899
e4e8e37c 900 /* Encryption */
42c6b129 901 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
a1d01db1 902 return 0;
1da177e4
LT		 903}
904
a1d01db1 905static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 906{
907 __le16 policy = cpu_to_le16(opt);
908
42c6b129 909 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 910
911 /* Default link policy */
42c6b129 912 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
a1d01db1 913 return 0;
e4e8e37c
MH		 914}
915
8e87d142 916/* Get HCI device by index.
1da177e4
LT		 917 * Device is held on return. */
918struct hci_dev *hci_dev_get(int index)
919{
8035ded4 920 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 921
922 BT_DBG("%d", index);
923
924 if (index < 0)
925 return NULL;
926
927 read_lock(&hci_dev_list_lock);
8035ded4 928 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 929 if (d->id == index) {
930 hdev = hci_dev_hold(d);
931 break;
932 }
933 }
934 read_unlock(&hci_dev_list_lock);
935 return hdev;
936}
1da177e4
LT		 937
938/* ---- Inquiry support ---- */
ff9ef578 939
30dc78e1
JH		 940bool hci_discovery_active(struct hci_dev *hdev)
941{
942 struct discovery_state *discov = &hdev->discovery;
943
6fbe195d 944 switch (discov->state) {
343f935b 945 case DISCOVERY_FINDING:
6fbe195d 946 case DISCOVERY_RESOLVING:
30dc78e1
JH		 947 return true;
948
6fbe195d
AG		 949 default:
950 return false;
951 }
30dc78e1
JH		 952}
953
ff9ef578
JH		 954void hci_discovery_set_state(struct hci_dev *hdev, int state)
955{
bb3e0a33
JH		 956 int old_state = hdev->discovery.state;
957
ff9ef578
JH		 958 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
959
bb3e0a33 960 if (old_state == state)
ff9ef578
JH		 961 return;
962
bb3e0a33
JH		 963 hdev->discovery.state = state;
964
ff9ef578
JH		 965 switch (state) {
966 case DISCOVERY_STOPPED:
c54c3860
AG		 967 hci_update_background_scan(hdev);
968
bb3e0a33 969 if (old_state != DISCOVERY_STARTING)
7b99b659 970 mgmt_discovering(hdev, 0);
ff9ef578
JH		 971 break;
972 case DISCOVERY_STARTING:
973 break;
343f935b 974 case DISCOVERY_FINDING:
ff9ef578
JH		 975 mgmt_discovering(hdev, 1);
976 break;
30dc78e1
JH		 977 case DISCOVERY_RESOLVING:
978 break;
ff9ef578
JH		 979 case DISCOVERY_STOPPING:
980 break;
981 }
ff9ef578
JH		 982}
983
1f9b9a5d 984void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 985{
30883512 986 struct discovery_state *cache = &hdev->discovery;
b57c1a56 987 struct inquiry_entry *p, *n;
1da177e4 988
561aafbc
JH		 989 list_for_each_entry_safe(p, n, &cache->all, all) {
990 list_del(&p->all);
b57c1a56 991 kfree(p);
1da177e4 992 }
561aafbc
JH		 993
994 INIT_LIST_HEAD(&cache->unknown);
995 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 996}
997
a8c5fb1a
GP		 998struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
999 bdaddr_t *bdaddr)
1da177e4 1000{
30883512 1001 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 1002 struct inquiry_entry *e;
1003
6ed93dc6 1004 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 1005
561aafbc
JH		 1006 list_for_each_entry(e, &cache->all, all) {
1007 if (!bacmp(&e->data.bdaddr, bdaddr))
1008 return e;
1009 }
1010
1011 return NULL;
1012}
1013
1014struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 1015 bdaddr_t *bdaddr)
561aafbc 1016{
30883512 1017 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 1018 struct inquiry_entry *e;
1019
6ed93dc6 1020 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 1021
1022 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 1023 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 1024 return e;
1025 }
1026
1027 return NULL;
1da177e4
LT		 1028}
1029
30dc78e1 1030struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 1031 bdaddr_t *bdaddr,
1032 int state)
30dc78e1
JH		 1033{
1034 struct discovery_state *cache = &hdev->discovery;
1035 struct inquiry_entry *e;
1036
6ed93dc6 1037 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 1038
1039 list_for_each_entry(e, &cache->resolve, list) {
1040 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1041 return e;
1042 if (!bacmp(&e->data.bdaddr, bdaddr))
1043 return e;
1044 }
1045
1046 return NULL;
1047}
1048
a3d4e20a 1049void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 1050 struct inquiry_entry *ie)
a3d4e20a
JH		 1051{
1052 struct discovery_state *cache = &hdev->discovery;
1053 struct list_head *pos = &cache->resolve;
1054 struct inquiry_entry *p;
1055
1056 list_del(&ie->list);
1057
1058 list_for_each_entry(p, &cache->resolve, list) {
1059 if (p->name_state != NAME_PENDING &&
a8c5fb1a 1060 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 1061 break;
1062 pos = &p->list;
1063 }
1064
1065 list_add(&ie->list, pos);
1066}
1067
af58925c
MH		 1068u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1069 bool name_known)
1da177e4 1070{
30883512 1071 struct discovery_state *cache = &hdev->discovery;
70f23020 1072 struct inquiry_entry *ie;
af58925c 1073 u32 flags = 0;
1da177e4 1074
6ed93dc6 1075 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 1076
6928a924 1077 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
2b2fec4d 1078
af58925c
MH		 1079 if (!data->ssp_mode)
1080 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 1081
70f23020 1082 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 1083 if (ie) {
af58925c
MH		 1084 if (!ie->data.ssp_mode)
1085 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 1086
a3d4e20a 1087 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 1088 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 1089 ie->data.rssi = data->rssi;
1090 hci_inquiry_cache_update_resolve(hdev, ie);
1091 }
1092
561aafbc 1093 goto update;
a3d4e20a 1094 }
561aafbc
JH		 1095
1096 /* Entry not in the cache. Add new one. */
27f70f3e 1097 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
af58925c
MH		 1098 if (!ie) {
1099 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1100 goto done;
1101 }
561aafbc
JH		 1102
1103 list_add(&ie->all, &cache->all);
1104
1105 if (name_known) {
1106 ie->name_state = NAME_KNOWN;
1107 } else {
1108 ie->name_state = NAME_NOT_KNOWN;
1109 list_add(&ie->list, &cache->unknown);
1110 }
70f23020 1111
561aafbc
JH		 1112update:
1113 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 1114 ie->name_state != NAME_PENDING) {
561aafbc
JH		 1115 ie->name_state = NAME_KNOWN;
1116 list_del(&ie->list);
1da177e4
LT		 1117 }
1118
70f23020
AE		 1119 memcpy(&ie->data, data, sizeof(*data));
1120 ie->timestamp = jiffies;
1da177e4 1121 cache->timestamp = jiffies;
3175405b
JH		 1122
1123 if (ie->name_state == NAME_NOT_KNOWN)
af58925c 1124 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
3175405b 1125
af58925c
MH		 1126done:
1127 return flags;
1da177e4
LT		 1128}
1129
1130static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1131{
30883512 1132 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 1133 struct inquiry_info *info = (struct inquiry_info *) buf;
1134 struct inquiry_entry *e;
1135 int copied = 0;
1136
561aafbc 1137 list_for_each_entry(e, &cache->all, all) {
1da177e4 1138 struct inquiry_data *data = &e->data;
b57c1a56
JH		 1139
1140 if (copied >= num)
1141 break;
1142
1da177e4
LT		 1143 bacpy(&info->bdaddr, &data->bdaddr);
1144 info->pscan_rep_mode = data->pscan_rep_mode;
1145 info->pscan_period_mode = data->pscan_period_mode;
1146 info->pscan_mode = data->pscan_mode;
1147 memcpy(info->dev_class, data->dev_class, 3);
1148 info->clock_offset = data->clock_offset;
b57c1a56 1149
1da177e4 1150 info++;
b57c1a56 1151 copied++;
1da177e4
LT		 1152 }
1153
1154 BT_DBG("cache %p, copied %d", cache, copied);
1155 return copied;
1156}
1157
a1d01db1 1158static int hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1159{
1160 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 1161 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 1162 struct hci_cp_inquiry cp;
1163
1164 BT_DBG("%s", hdev->name);
1165
1166 if (test_bit(HCI_INQUIRY, &hdev->flags))
a1d01db1 1167 return 0;
1da177e4
LT		 1168
1169 /* Start Inquiry */
1170 memcpy(&cp.lap, &ir->lap, 3);
1171 cp.length = ir->length;
1172 cp.num_rsp = ir->num_rsp;
42c6b129 1173 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
a1d01db1
JH		 1174
1175 return 0;
1da177e4
LT		 1176}
1177
1178int hci_inquiry(void __user *arg)
1179{
1180 __u8 __user *ptr = arg;
1181 struct hci_inquiry_req ir;
1182 struct hci_dev *hdev;
1183 int err = 0, do_inquiry = 0, max_rsp;
1184 long timeo;
1185 __u8 *buf;
1186
1187 if (copy_from_user(&ir, ptr, sizeof(ir)))
1188 return -EFAULT;
1189
5a08ecce
AE		 1190 hdev = hci_dev_get(ir.dev_id);
1191 if (!hdev)
1da177e4
LT		 1192 return -ENODEV;
1193
d7a5a11d 1194 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1195 err = -EBUSY;
1196 goto done;
1197 }
1198
d7a5a11d 1199 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1200 err = -EOPNOTSUPP;
1201 goto done;
1202 }
1203
5b69bef5
MH		 1204 if (hdev->dev_type != HCI_BREDR) {
1205 err = -EOPNOTSUPP;
1206 goto done;
1207 }
1208
d7a5a11d 1209 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 1210 err = -EOPNOTSUPP;
1211 goto done;
1212 }
1213
09fd0de5 1214 hci_dev_lock(hdev);
8e87d142 1215 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 1216 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 1217 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 1218 do_inquiry = 1;
1219 }
09fd0de5 1220 hci_dev_unlock(hdev);
1da177e4 1221
04837f64 1222 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 1223
1224 if (do_inquiry) {
01178cd4 1225 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
4ebeee2d 1226 timeo, NULL);
70f23020
AE		 1227 if (err < 0)
1228 goto done;
3e13fa1e
AG		 1229
1230 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1231 * cleared). If it is interrupted by a signal, return -EINTR.
1232 */
74316201 1233 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
3e13fa1e
AG		 1234 TASK_INTERRUPTIBLE))
1235 return -EINTR;
70f23020 1236 }
1da177e4 1237
8fc9ced3
GP		 1238 /* for unlimited number of responses we will use buffer with
1239 * 255 entries
1240 */
1da177e4
LT		 1241 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1242
1243 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1244 * copy it to the user space.
1245 */
01df8c31 1246 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 1247 if (!buf) {
1da177e4
LT		 1248 err = -ENOMEM;
1249 goto done;
1250 }
1251
09fd0de5 1252 hci_dev_lock(hdev);
1da177e4 1253 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 1254 hci_dev_unlock(hdev);
1da177e4
LT		 1255
1256 BT_DBG("num_rsp %d", ir.num_rsp);
1257
1258 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1259 ptr += sizeof(ir);
1260 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 1261 ir.num_rsp))
1da177e4 1262 err = -EFAULT;
8e87d142 1263 } else
1da177e4
LT		 1264 err = -EFAULT;
1265
1266 kfree(buf);
1267
1268done:
1269 hci_dev_put(hdev);
1270 return err;
1271}
1272
cbed0ca1 1273static int hci_dev_do_open(struct hci_dev *hdev)
1da177e4 1274{
1da177e4
LT		 1275 int ret = 0;
1276
1da177e4
LT		 1277 BT_DBG("%s %p", hdev->name, hdev);
1278
b504430c 1279 hci_req_sync_lock(hdev);
1da177e4 1280
d7a5a11d 1281 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
94324962
JH		 1282 ret = -ENODEV;
1283 goto done;
1284 }
1285
d7a5a11d
MH		 1286 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1287 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
a5c8f270
MH		 1288 /* Check for rfkill but allow the HCI setup stage to
1289 * proceed (which in itself doesn't cause any RF activity).
1290 */
d7a5a11d 1291 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
a5c8f270
MH		 1292 ret = -ERFKILL;
1293 goto done;
1294 }
1295
1296 /* Check for valid public address or a configured static
1297 * random adddress, but let the HCI setup proceed to
1298 * be able to determine if there is a public address
1299 * or not.
1300 *
c6beca0e
MH		 1301 * In case of user channel usage, it is not important
1302 * if a public address or static random address is
1303 * available.
1304 *
a5c8f270
MH		 1305 * This check is only valid for BR/EDR controllers
1306 * since AMP controllers do not have an address.
1307 */
d7a5a11d 1308 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
c6beca0e 1309 hdev->dev_type == HCI_BREDR &&
a5c8f270
MH		 1310 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1311 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1312 ret = -EADDRNOTAVAIL;
1313 goto done;
1314 }
611b30f7
MH		 1315 }
1316
1da177e4
LT		 1317 if (test_bit(HCI_UP, &hdev->flags)) {
1318 ret = -EALREADY;
1319 goto done;
1320 }
1321
1da177e4
LT		 1322 if (hdev->open(hdev)) {
1323 ret = -EIO;
1324 goto done;
1325 }
1326
e9ca8bf1 1327 set_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1328 hci_sock_dev_event(hdev, HCI_DEV_OPEN);
4a3f95b7 1329
f41c70c4
MH		 1330 atomic_set(&hdev->cmd_cnt, 1);
1331 set_bit(HCI_INIT, &hdev->flags);
1332
d7a5a11d 1333 if (hci_dev_test_flag(hdev, HCI_SETUP)) {
e131d74a
MH		 1334 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1335
af202f84
MH		 1336 if (hdev->setup)
1337 ret = hdev->setup(hdev);
f41c70c4 1338
af202f84
MH		 1339 /* The transport driver can set these quirks before
1340 * creating the HCI device or in its setup callback.
1341 *
1342 * In case any of them is set, the controller has to
1343 * start up as unconfigured.
1344 */
eb1904f4
MH		 1345 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1346 test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
a1536da2 1347 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
f41c70c4 1348
0ebca7d6
MH		 1349 /* For an unconfigured controller it is required to
1350 * read at least the version information provided by
1351 * the Read Local Version Information command.
1352 *
1353 * If the set_bdaddr driver callback is provided, then
1354 * also the original Bluetooth public device address
1355 * will be read using the Read BD Address command.
1356 */
d7a5a11d 1357 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
0ebca7d6 1358 ret = __hci_unconf_init(hdev);
89bc22d2
MH		 1359 }
1360
d7a5a11d 1361 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
9713c17b
MH		 1362 /* If public address change is configured, ensure that
1363 * the address gets programmed. If the driver does not
1364 * support changing the public address, fail the power
1365 * on procedure.
1366 */
1367 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1368 hdev->set_bdaddr)
24c457e2
MH		 1369 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1370 else
1371 ret = -EADDRNOTAVAIL;
1372 }
1373
f41c70c4 1374 if (!ret) {
d7a5a11d 1375 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
98a63aaf 1376 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
f41c70c4 1377 ret = __hci_init(hdev);
98a63aaf
MH		 1378 if (!ret && hdev->post_init)
1379 ret = hdev->post_init(hdev);
1380 }
1da177e4
LT		 1381 }
1382
7e995b9e
MH		 1383 /* If the HCI Reset command is clearing all diagnostic settings,
1384 * then they need to be reprogrammed after the init procedure
1385 * completed.
1386 */
1387 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
1388 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1389 ret = hdev->set_diag(hdev, true);
1390
f41c70c4
MH		 1391 clear_bit(HCI_INIT, &hdev->flags);
1392
1da177e4
LT		 1393 if (!ret) {
1394 hci_dev_hold(hdev);
a1536da2 1395 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1da177e4 1396 set_bit(HCI_UP, &hdev->flags);
05fcd4c4 1397 hci_sock_dev_event(hdev, HCI_DEV_UP);
d7a5a11d
MH		 1398 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1399 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1400 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1401 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
2ff13894 1402 hci_dev_test_flag(hdev, HCI_MGMT) &&
1514b892 1403 hdev->dev_type == HCI_BREDR) {
2ff13894
JH		 1404 ret = __hci_req_hci_power_on(hdev);
1405 mgmt_power_on(hdev, ret);
56e5cb86 1406 }
8e87d142 1407 } else {
1da177e4 1408 /* Init failed, cleanup */
3eff45ea 1409 flush_work(&hdev->tx_work);
c347b765 1410 flush_work(&hdev->cmd_work);
b78752cc 1411 flush_work(&hdev->rx_work);
1da177e4
LT		 1412
1413 skb_queue_purge(&hdev->cmd_q);
1414 skb_queue_purge(&hdev->rx_q);
1415
1416 if (hdev->flush)
1417 hdev->flush(hdev);
1418
1419 if (hdev->sent_cmd) {
1420 kfree_skb(hdev->sent_cmd);
1421 hdev->sent_cmd = NULL;
1422 }
1423
e9ca8bf1 1424 clear_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1425 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
4a3f95b7 1426
1da177e4 1427 hdev->close(hdev);
fee746b0 1428 hdev->flags &= BIT(HCI_RAW);
1da177e4
LT		 1429 }
1430
1431done:
b504430c 1432 hci_req_sync_unlock(hdev);
1da177e4
LT		 1433 return ret;
1434}
1435
cbed0ca1
JH		 1436/* ---- HCI ioctl helpers ---- */
1437
1438int hci_dev_open(__u16 dev)
1439{
1440 struct hci_dev *hdev;
1441 int err;
1442
1443 hdev = hci_dev_get(dev);
1444 if (!hdev)
1445 return -ENODEV;
1446
4a964404 1447 /* Devices that are marked as unconfigured can only be powered
fee746b0
MH		 1448 * up as user channel. Trying to bring them up as normal devices
1449 * will result into a failure. Only user channel operation is
1450 * possible.
1451 *
1452 * When this function is called for a user channel, the flag
1453 * HCI_USER_CHANNEL will be set first before attempting to
1454 * open the device.
1455 */
d7a5a11d
MH		 1456 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1457 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
fee746b0
MH		 1458 err = -EOPNOTSUPP;
1459 goto done;
1460 }
1461
e1d08f40
JH		 1462 /* We need to ensure that no other power on/off work is pending
1463 * before proceeding to call hci_dev_do_open. This is
1464 * particularly important if the setup procedure has not yet
1465 * completed.
1466 */
a69d8927 1467 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
e1d08f40
JH		 1468 cancel_delayed_work(&hdev->power_off);
1469
a5c8f270
MH		 1470 /* After this call it is guaranteed that the setup procedure
1471 * has finished. This means that error conditions like RFKILL
1472 * or no valid public or static random address apply.
1473 */
e1d08f40
JH		 1474 flush_workqueue(hdev->req_workqueue);
1475
12aa4f0a 1476 /* For controllers not using the management interface and that
b6ae8457 1477 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
12aa4f0a
MH		 1478 * so that pairing works for them. Once the management interface
1479 * is in use this bit will be cleared again and userspace has
1480 * to explicitly enable it.
1481 */
d7a5a11d
MH		 1482 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1483 !hci_dev_test_flag(hdev, HCI_MGMT))
a1536da2 1484 hci_dev_set_flag(hdev, HCI_BONDABLE);
12aa4f0a 1485
cbed0ca1
JH		 1486 err = hci_dev_do_open(hdev);
1487
fee746b0 1488done:
cbed0ca1 1489 hci_dev_put(hdev);
cbed0ca1
JH		 1490 return err;
1491}
1492
d7347f3c
JH		 1493/* This function requires the caller holds hdev->lock */
1494static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1495{
1496 struct hci_conn_params *p;
1497
f161dd41
JH		 1498 list_for_each_entry(p, &hdev->le_conn_params, list) {
1499 if (p->conn) {
1500 hci_conn_drop(p->conn);
f8aaf9b6 1501 hci_conn_put(p->conn);
f161dd41
JH		 1502 p->conn = NULL;
1503 }
d7347f3c 1504 list_del_init(&p->action);
f161dd41 1505 }
d7347f3c
JH		 1506
1507 BT_DBG("All LE pending actions cleared");
1508}
1509
6b3cc1db 1510int hci_dev_do_close(struct hci_dev *hdev)
1da177e4 1511{
acc649c6
MH		 1512 bool auto_off;
1513
1da177e4
LT		 1514 BT_DBG("%s %p", hdev->name, hdev);
1515
d24d8144 1516 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
867146a0 1517 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
d24d8144 1518 test_bit(HCI_UP, &hdev->flags)) {
a44fecbd
THJA		 1519 /* Execute vendor specific shutdown routine */
1520 if (hdev->shutdown)
1521 hdev->shutdown(hdev);
1522 }
1523
78c04c0b
VCG		 1524 cancel_delayed_work(&hdev->power_off);
1525
7df0f73e 1526 hci_request_cancel_all(hdev);
b504430c 1527 hci_req_sync_lock(hdev);
1da177e4
LT		 1528
1529 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
65cc2b49 1530 cancel_delayed_work_sync(&hdev->cmd_timer);
b504430c 1531 hci_req_sync_unlock(hdev);
1da177e4
LT		 1532 return 0;
1533 }
1534
3eff45ea
GP		 1535 /* Flush RX and TX works */
1536 flush_work(&hdev->tx_work);
b78752cc 1537 flush_work(&hdev->rx_work);
1da177e4 1538
16ab91ab 1539 if (hdev->discov_timeout > 0) {
16ab91ab 1540 hdev->discov_timeout = 0;
a358dc11
MH		 1541 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1542 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
16ab91ab
JH		 1543 }
1544
a69d8927 1545 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1546 cancel_delayed_work(&hdev->service_cache);
1547
d7a5a11d 1548 if (hci_dev_test_flag(hdev, HCI_MGMT))
4518bb0f 1549 cancel_delayed_work_sync(&hdev->rpa_expired);
7ba8b4be 1550
76727c02
JH		 1551 /* Avoid potential lockdep warnings from the *_flush() calls by
1552 * ensuring the workqueue is empty up front.
1553 */
1554 drain_workqueue(hdev->workqueue);
1555
09fd0de5 1556 hci_dev_lock(hdev);
1aeb9c65 1557
8f502f84
JH		 1558 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1559
acc649c6
MH		 1560 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1561
2ff13894
JH		 1562 if (!auto_off && hdev->dev_type == HCI_BREDR &&
1563 hci_dev_test_flag(hdev, HCI_MGMT))
1564 __mgmt_power_off(hdev);
1aeb9c65 1565
1f9b9a5d 1566 hci_inquiry_cache_flush(hdev);
d7347f3c 1567 hci_pend_le_actions_clear(hdev);
f161dd41 1568 hci_conn_hash_flush(hdev);
09fd0de5 1569 hci_dev_unlock(hdev);
1da177e4 1570
64dae967
MH		 1571 smp_unregister(hdev);
1572
05fcd4c4 1573 hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1da177e4
LT		 1574
1575 if (hdev->flush)
1576 hdev->flush(hdev);
1577
1578 /* Reset device */
1579 skb_queue_purge(&hdev->cmd_q);
1580 atomic_set(&hdev->cmd_cnt, 1);
acc649c6
MH		 1581 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1582 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1da177e4 1583 set_bit(HCI_INIT, &hdev->flags);
4ebeee2d 1584 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1da177e4
LT		 1585 clear_bit(HCI_INIT, &hdev->flags);
1586 }
1587
c347b765
GP		 1588 /* flush cmd work */
1589 flush_work(&hdev->cmd_work);
1da177e4
LT		 1590
1591 /* Drop queues */
1592 skb_queue_purge(&hdev->rx_q);
1593 skb_queue_purge(&hdev->cmd_q);
1594 skb_queue_purge(&hdev->raw_q);
1595
1596 /* Drop last sent command */
1597 if (hdev->sent_cmd) {
65cc2b49 1598 cancel_delayed_work_sync(&hdev->cmd_timer);
1da177e4
LT		 1599 kfree_skb(hdev->sent_cmd);
1600 hdev->sent_cmd = NULL;
1601 }
1602
e9ca8bf1 1603 clear_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1604 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
4a3f95b7 1605
1da177e4
LT		 1606 /* After this point our queues are empty
1607 * and no tasks are scheduled. */
1608 hdev->close(hdev);
1609
35b973c9 1610 /* Clear flags */
fee746b0 1611 hdev->flags &= BIT(HCI_RAW);
eacb44df 1612 hci_dev_clear_volatile_flags(hdev);
35b973c9 1613
ced5c338 1614 /* Controller radio is available but is currently powered down */
536619e8 1615 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
ced5c338 1616
e59fda8d 1617 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 1618 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
7a4cd51d 1619 bacpy(&hdev->random_addr, BDADDR_ANY);
e59fda8d 1620
b504430c 1621 hci_req_sync_unlock(hdev);
1da177e4
LT		 1622
1623 hci_dev_put(hdev);
1624 return 0;
1625}
1626
1627int hci_dev_close(__u16 dev)
1628{
1629 struct hci_dev *hdev;
1630 int err;
1631
70f23020
AE		 1632 hdev = hci_dev_get(dev);
1633 if (!hdev)
1da177e4 1634 return -ENODEV;
8ee56540 1635
d7a5a11d 1636 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1637 err = -EBUSY;
1638 goto done;
1639 }
1640
a69d8927 1641 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
8ee56540
MH		 1642 cancel_delayed_work(&hdev->power_off);
1643
1da177e4 1644 err = hci_dev_do_close(hdev);
8ee56540 1645
0736cfa8 1646done:
1da177e4
LT		 1647 hci_dev_put(hdev);
1648 return err;
1649}
1650
5c912495 1651static int hci_dev_do_reset(struct hci_dev *hdev)
1da177e4 1652{
5c912495 1653 int ret;
1da177e4 1654
5c912495 1655 BT_DBG("%s %p", hdev->name, hdev);
1da177e4 1656
b504430c 1657 hci_req_sync_lock(hdev);
1da177e4 1658
1da177e4
LT		 1659 /* Drop queues */
1660 skb_queue_purge(&hdev->rx_q);
1661 skb_queue_purge(&hdev->cmd_q);
1662
76727c02
JH		 1663 /* Avoid potential lockdep warnings from the *_flush() calls by
1664 * ensuring the workqueue is empty up front.
1665 */
1666 drain_workqueue(hdev->workqueue);
1667
09fd0de5 1668 hci_dev_lock(hdev);
1f9b9a5d 1669 hci_inquiry_cache_flush(hdev);
1da177e4 1670 hci_conn_hash_flush(hdev);
09fd0de5 1671 hci_dev_unlock(hdev);
1da177e4
LT		 1672
1673 if (hdev->flush)
1674 hdev->flush(hdev);
1675
8e87d142 1676 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 1677 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4 1678
4ebeee2d 1679 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1da177e4 1680
b504430c 1681 hci_req_sync_unlock(hdev);
1da177e4
LT		 1682 return ret;
1683}
1684
5c912495
MH		 1685int hci_dev_reset(__u16 dev)
1686{
1687 struct hci_dev *hdev;
1688 int err;
1689
1690 hdev = hci_dev_get(dev);
1691 if (!hdev)
1692 return -ENODEV;
1693
1694 if (!test_bit(HCI_UP, &hdev->flags)) {
1695 err = -ENETDOWN;
1696 goto done;
1697 }
1698
d7a5a11d 1699 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
5c912495
MH		 1700 err = -EBUSY;
1701 goto done;
1702 }
1703
d7a5a11d 1704 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
5c912495
MH		 1705 err = -EOPNOTSUPP;
1706 goto done;
1707 }
1708
1709 err = hci_dev_do_reset(hdev);
1710
1711done:
1712 hci_dev_put(hdev);
1713 return err;
1714}
1715
1da177e4
LT		 1716int hci_dev_reset_stat(__u16 dev)
1717{
1718 struct hci_dev *hdev;
1719 int ret = 0;
1720
70f23020
AE		 1721 hdev = hci_dev_get(dev);
1722 if (!hdev)
1da177e4
LT		 1723 return -ENODEV;
1724
d7a5a11d 1725 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1726 ret = -EBUSY;
1727 goto done;
1728 }
1729
d7a5a11d 1730 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1731 ret = -EOPNOTSUPP;
1732 goto done;
1733 }
1734
1da177e4
LT		 1735 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1736
0736cfa8 1737done:
1da177e4 1738 hci_dev_put(hdev);
1da177e4
LT		 1739 return ret;
1740}
1741
123abc08
JH		 1742static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1743{
bc6d2d04 1744 bool conn_changed, discov_changed;
123abc08
JH		 1745
1746 BT_DBG("%s scan 0x%02x", hdev->name, scan);
1747
1748 if ((scan & SCAN_PAGE))
238be788
MH		 1749 conn_changed = !hci_dev_test_and_set_flag(hdev,
1750 HCI_CONNECTABLE);
123abc08 1751 else
a69d8927
MH		 1752 conn_changed = hci_dev_test_and_clear_flag(hdev,
1753 HCI_CONNECTABLE);
123abc08 1754
bc6d2d04 1755 if ((scan & SCAN_INQUIRY)) {
238be788
MH		 1756 discov_changed = !hci_dev_test_and_set_flag(hdev,
1757 HCI_DISCOVERABLE);
bc6d2d04 1758 } else {
a358dc11 1759 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
a69d8927
MH		 1760 discov_changed = hci_dev_test_and_clear_flag(hdev,
1761 HCI_DISCOVERABLE);
bc6d2d04
JH		 1762 }
1763
d7a5a11d 1764 if (!hci_dev_test_flag(hdev, HCI_MGMT))
123abc08
JH		 1765 return;
1766
bc6d2d04
JH		 1767 if (conn_changed || discov_changed) {
1768 /* In case this was disabled through mgmt */
a1536da2 1769 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
bc6d2d04 1770
d7a5a11d 1771 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
cab054ab 1772 hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
bc6d2d04 1773
123abc08 1774 mgmt_new_settings(hdev);
bc6d2d04 1775 }
123abc08
JH		 1776}
1777
1da177e4
LT		 1778int hci_dev_cmd(unsigned int cmd, void __user *arg)
1779{
1780 struct hci_dev *hdev;
1781 struct hci_dev_req dr;
1782 int err = 0;
1783
1784 if (copy_from_user(&dr, arg, sizeof(dr)))
1785 return -EFAULT;
1786
70f23020
AE		 1787 hdev = hci_dev_get(dr.dev_id);
1788 if (!hdev)
1da177e4
LT		 1789 return -ENODEV;
1790
d7a5a11d 1791 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1792 err = -EBUSY;
1793 goto done;
1794 }
1795
d7a5a11d 1796 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1797 err = -EOPNOTSUPP;
1798 goto done;
1799 }
1800
5b69bef5
MH		 1801 if (hdev->dev_type != HCI_BREDR) {
1802 err = -EOPNOTSUPP;
1803 goto done;
1804 }
1805
d7a5a11d 1806 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 1807 err = -EOPNOTSUPP;
1808 goto done;
1809 }
1810
1da177e4
LT		 1811 switch (cmd) {
1812 case HCISETAUTH:
01178cd4 1813 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 1814 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1815 break;
1816
1817 case HCISETENCRYPT:
1818 if (!lmp_encrypt_capable(hdev)) {
1819 err = -EOPNOTSUPP;
1820 break;
1821 }
1822
1823 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1824 /* Auth must be enabled first */
01178cd4 1825 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 1826 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1827 if (err)
1828 break;
1829 }
1830
01178cd4 1831 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
4ebeee2d 1832 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1833 break;
1834
1835 case HCISETSCAN:
01178cd4 1836 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
4ebeee2d 1837 HCI_INIT_TIMEOUT, NULL);
91a668b0 1838
bc6d2d04
JH		 1839 /* Ensure that the connectable and discoverable states
1840 * get correctly modified as this was a non-mgmt change.
91a668b0 1841 */
123abc08
JH		 1842 if (!err)
1843 hci_update_scan_state(hdev, dr.dev_opt);
1da177e4
LT		 1844 break;
1845
1da177e4 1846 case HCISETLINKPOL:
01178cd4 1847 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
4ebeee2d 1848 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1849 break;
1850
1851 case HCISETLINKMODE:
e4e8e37c
MH		 1852 hdev->link_mode = ((__u16) dr.dev_opt) &
1853 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1854 break;
1855
1856 case HCISETPTYPE:
1857 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 1858 break;
1859
1860 case HCISETACLMTU:
e4e8e37c
MH		 1861 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1862 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1863 break;
1864
1865 case HCISETSCOMTU:
e4e8e37c
MH		 1866 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1867 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1868 break;
1869
1870 default:
1871 err = -EINVAL;
1872 break;
1873 }
e4e8e37c 1874
0736cfa8 1875done:
1da177e4
LT		 1876 hci_dev_put(hdev);
1877 return err;
1878}
1879
1880int hci_get_dev_list(void __user *arg)
1881{
8035ded4 1882 struct hci_dev *hdev;
1da177e4
LT		 1883 struct hci_dev_list_req *dl;
1884 struct hci_dev_req *dr;
1da177e4
LT		 1885 int n = 0, size, err;
1886 __u16 dev_num;
1887
1888 if (get_user(dev_num, (__u16 __user *) arg))
1889 return -EFAULT;
1890
1891 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1892 return -EINVAL;
1893
1894 size = sizeof(*dl) + dev_num * sizeof(*dr);
1895
70f23020
AE		 1896 dl = kzalloc(size, GFP_KERNEL);
1897 if (!dl)
1da177e4
LT		 1898 return -ENOMEM;
1899
1900 dr = dl->dev_req;
1901
f20d09d5 1902 read_lock(&hci_dev_list_lock);
8035ded4 1903 list_for_each_entry(hdev, &hci_dev_list, list) {
2e84d8db 1904 unsigned long flags = hdev->flags;
c542a06c 1905
2e84d8db
MH		 1906 /* When the auto-off is configured it means the transport
1907 * is running, but in that case still indicate that the
1908 * device is actually down.
1909 */
d7a5a11d 1910 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db 1911 flags &= ~BIT(HCI_UP);
c542a06c 1912
1da177e4 1913 (dr + n)->dev_id = hdev->id;
2e84d8db 1914 (dr + n)->dev_opt = flags;
c542a06c 1915
1da177e4
LT		 1916 if (++n >= dev_num)
1917 break;
1918 }
f20d09d5 1919 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 1920
1921 dl->dev_num = n;
1922 size = sizeof(*dl) + n * sizeof(*dr);
1923
1924 err = copy_to_user(arg, dl, size);
1925 kfree(dl);
1926
1927 return err ? -EFAULT : 0;
1928}
1929
1930int hci_get_dev_info(void __user *arg)
1931{
1932 struct hci_dev *hdev;
1933 struct hci_dev_info di;
2e84d8db 1934 unsigned long flags;
1da177e4
LT		 1935 int err = 0;
1936
1937 if (copy_from_user(&di, arg, sizeof(di)))
1938 return -EFAULT;
1939
70f23020
AE		 1940 hdev = hci_dev_get(di.dev_id);
1941 if (!hdev)
1da177e4
LT		 1942 return -ENODEV;
1943
2e84d8db
MH		 1944 /* When the auto-off is configured it means the transport
1945 * is running, but in that case still indicate that the
1946 * device is actually down.
1947 */
d7a5a11d 1948 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db
MH		 1949 flags = hdev->flags & ~BIT(HCI_UP);
1950 else
1951 flags = hdev->flags;
c542a06c 1952
1da177e4
LT		 1953 strcpy(di.name, hdev->name);
1954 di.bdaddr = hdev->bdaddr;
60f2a3ed 1955 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2e84d8db 1956 di.flags = flags;
1da177e4 1957 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 1958 if (lmp_bredr_capable(hdev)) {
1959 di.acl_mtu = hdev->acl_mtu;
1960 di.acl_pkts = hdev->acl_pkts;
1961 di.sco_mtu = hdev->sco_mtu;
1962 di.sco_pkts = hdev->sco_pkts;
1963 } else {
1964 di.acl_mtu = hdev->le_mtu;
1965 di.acl_pkts = hdev->le_pkts;
1966 di.sco_mtu = 0;
1967 di.sco_pkts = 0;
1968 }
1da177e4
LT		 1969 di.link_policy = hdev->link_policy;
1970 di.link_mode = hdev->link_mode;
1971
1972 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1973 memcpy(&di.features, &hdev->features, sizeof(di.features));
1974
1975 if (copy_to_user(arg, &di, sizeof(di)))
1976 err = -EFAULT;
1977
1978 hci_dev_put(hdev);
1979
1980 return err;
1981}
1982
1983/* ---- Interface to HCI drivers ---- */
1984
611b30f7
MH		 1985static int hci_rfkill_set_block(void *data, bool blocked)
1986{
1987 struct hci_dev *hdev = data;
1988
1989 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1990
d7a5a11d 1991 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
0736cfa8
MH		 1992 return -EBUSY;
1993
5e130367 1994 if (blocked) {
a1536da2 1995 hci_dev_set_flag(hdev, HCI_RFKILLED);
d7a5a11d
MH		 1996 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1997 !hci_dev_test_flag(hdev, HCI_CONFIG))
bf543036 1998 hci_dev_do_close(hdev);
5e130367 1999 } else {
a358dc11 2000 hci_dev_clear_flag(hdev, HCI_RFKILLED);
1025c04c 2001 }
611b30f7
MH		 2002
2003 return 0;
2004}
2005
2006static const struct rfkill_ops hci_rfkill_ops = {
2007 .set_block = hci_rfkill_set_block,
2008};
2009
ab81cbf9
JH		 2010static void hci_power_on(struct work_struct *work)
2011{
2012 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 2013 int err;
ab81cbf9
JH		 2014
2015 BT_DBG("%s", hdev->name);
2016
2ff13894
JH		 2017 if (test_bit(HCI_UP, &hdev->flags) &&
2018 hci_dev_test_flag(hdev, HCI_MGMT) &&
2019 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
2020 hci_req_sync_lock(hdev);
2021 err = __hci_req_hci_power_on(hdev);
2022 hci_req_sync_unlock(hdev);
2023 mgmt_power_on(hdev, err);
2024 return;
2025 }
2026
cbed0ca1 2027 err = hci_dev_do_open(hdev);
96570ffc 2028 if (err < 0) {
3ad67582 2029 hci_dev_lock(hdev);
96570ffc 2030 mgmt_set_powered_failed(hdev, err);
3ad67582 2031 hci_dev_unlock(hdev);
ab81cbf9 2032 return;
96570ffc 2033 }
ab81cbf9 2034
a5c8f270
MH		 2035 /* During the HCI setup phase, a few error conditions are
2036 * ignored and they need to be checked now. If they are still
2037 * valid, it is important to turn the device back off.
2038 */
d7a5a11d
MH		 2039 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2040 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
a5c8f270
MH		 2041 (hdev->dev_type == HCI_BREDR &&
2042 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2043 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
a358dc11 2044 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
bf543036 2045 hci_dev_do_close(hdev);
d7a5a11d 2046 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
19202573
JH		 2047 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2048 HCI_AUTO_OFF_TIMEOUT);
bf543036 2049 }
ab81cbf9 2050
a69d8927 2051 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
4a964404
MH		 2052 /* For unconfigured devices, set the HCI_RAW flag
2053 * so that userspace can easily identify them.
4a964404 2054 */
d7a5a11d 2055 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4a964404 2056 set_bit(HCI_RAW, &hdev->flags);
0602a8ad
MH		 2057
2058 /* For fully configured devices, this will send
2059 * the Index Added event. For unconfigured devices,
2060 * it will send Unconfigued Index Added event.
2061 *
2062 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2063 * and no event will be send.
2064 */
2065 mgmt_index_added(hdev);
a69d8927 2066 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
5ea234d3
MH		 2067 /* When the controller is now configured, then it
2068 * is important to clear the HCI_RAW flag.
2069 */
d7a5a11d 2070 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5ea234d3
MH		 2071 clear_bit(HCI_RAW, &hdev->flags);
2072
d603b76b
MH		 2073 /* Powering on the controller with HCI_CONFIG set only
2074 * happens with the transition from unconfigured to
2075 * configured. This will send the Index Added event.
2076 */
744cf19e 2077 mgmt_index_added(hdev);
fee746b0 2078 }
ab81cbf9
JH		 2079}
2080
2081static void hci_power_off(struct work_struct *work)
2082{
3243553f 2083 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 2084 power_off.work);
ab81cbf9
JH		 2085
2086 BT_DBG("%s", hdev->name);
2087
8ee56540 2088 hci_dev_do_close(hdev);
ab81cbf9
JH		 2089}
2090
c7741d16
MH		 2091static void hci_error_reset(struct work_struct *work)
2092{
2093 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2094
2095 BT_DBG("%s", hdev->name);
2096
2097 if (hdev->hw_error)
2098 hdev->hw_error(hdev, hdev->hw_error_code);
2099 else
2100 BT_ERR("%s hardware error 0x%2.2x", hdev->name,
2101 hdev->hw_error_code);
2102
2103 if (hci_dev_do_close(hdev))
2104 return;
2105
c7741d16
MH		 2106 hci_dev_do_open(hdev);
2107}
2108
35f7498a 2109void hci_uuids_clear(struct hci_dev *hdev)
2aeb9a1a 2110{
4821002c 2111 struct bt_uuid *uuid, *tmp;
2aeb9a1a 2112
4821002c
JH		 2113 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2114 list_del(&uuid->list);
2aeb9a1a
JH		 2115 kfree(uuid);
2116 }
2aeb9a1a
JH		 2117}
2118
35f7498a 2119void hci_link_keys_clear(struct hci_dev *hdev)
55ed8ca1 2120{
0378b597 2121 struct link_key *key;
55ed8ca1 2122
0378b597
JH		 2123 list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2124 list_del_rcu(&key->list);
2125 kfree_rcu(key, rcu);
55ed8ca1 2126 }
55ed8ca1
JH		 2127}
2128
35f7498a 2129void hci_smp_ltks_clear(struct hci_dev *hdev)
b899efaf 2130{
970d0f1b 2131 struct smp_ltk *k;
b899efaf 2132
970d0f1b
JH		 2133 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2134 list_del_rcu(&k->list);
2135 kfree_rcu(k, rcu);
b899efaf 2136 }
b899efaf
VCG		 2137}
2138
970c4e46
JH		 2139void hci_smp_irks_clear(struct hci_dev *hdev)
2140{
adae20cb 2141 struct smp_irk *k;
970c4e46 2142
adae20cb
JH		 2143 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2144 list_del_rcu(&k->list);
2145 kfree_rcu(k, rcu);
970c4e46
JH		 2146 }
2147}
2148
55ed8ca1
JH		 2149struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2150{
8035ded4 2151 struct link_key *k;
55ed8ca1 2152
0378b597
JH		 2153 rcu_read_lock();
2154 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2155 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2156 rcu_read_unlock();
55ed8ca1 2157 return k;
0378b597
JH		 2158 }
2159 }
2160 rcu_read_unlock();
55ed8ca1
JH		 2161
2162 return NULL;
2163}
2164
745c0ce3 2165static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 2166 u8 key_type, u8 old_key_type)
d25e28ab
JH		 2167{
2168 /* Legacy key */
2169 if (key_type < 0x03)
745c0ce3 2170 return true;
d25e28ab
JH		 2171
2172 /* Debug keys are insecure so don't store them persistently */
2173 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 2174 return false;
d25e28ab
JH		 2175
2176 /* Changed combination key and there's no previous one */
2177 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 2178 return false;
d25e28ab
JH		 2179
2180 /* Security mode 3 case */
2181 if (!conn)
745c0ce3 2182 return true;
d25e28ab 2183
e3befab9
JH		 2184 /* BR/EDR key derived using SC from an LE link */
2185 if (conn->type == LE_LINK)
2186 return true;
2187
d25e28ab
JH		 2188 /* Neither local nor remote side had no-bonding as requirement */
2189 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 2190 return true;
d25e28ab
JH		 2191
2192 /* Local side had dedicated bonding as requirement */
2193 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 2194 return true;
d25e28ab
JH		 2195
2196 /* Remote side had dedicated bonding as requirement */
2197 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 2198 return true;
d25e28ab
JH		 2199
2200 /* If none of the above criteria match, then don't store the key
2201 * persistently */
745c0ce3 2202 return false;
d25e28ab
JH		 2203}
2204
e804d25d 2205static u8 ltk_role(u8 type)
98a0b845 2206{
e804d25d
JH		 2207 if (type == SMP_LTK)
2208 return HCI_ROLE_MASTER;
98a0b845 2209
e804d25d 2210 return HCI_ROLE_SLAVE;
98a0b845
JH		 2211}
2212
f3a73d97
JH		 2213struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2214 u8 addr_type, u8 role)
75d262c2 2215{
c9839a11 2216 struct smp_ltk *k;
75d262c2 2217
970d0f1b
JH		 2218 rcu_read_lock();
2219 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
5378bc56
JH		 2220 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2221 continue;
2222
923e2414 2223 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
970d0f1b 2224 rcu_read_unlock();
75d262c2 2225 return k;
970d0f1b
JH		 2226 }
2227 }
2228 rcu_read_unlock();
75d262c2
VCG		 2229
2230 return NULL;
2231}
75d262c2 2232
970c4e46
JH		 2233struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2234{
2235 struct smp_irk *irk;
2236
adae20cb
JH		 2237 rcu_read_lock();
2238 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2239 if (!bacmp(&irk->rpa, rpa)) {
2240 rcu_read_unlock();
970c4e46 2241 return irk;
adae20cb 2242 }
970c4e46
JH		 2243 }
2244
adae20cb 2245 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
defce9e8 2246 if (smp_irk_matches(hdev, irk->val, rpa)) {
970c4e46 2247 bacpy(&irk->rpa, rpa);
adae20cb 2248 rcu_read_unlock();
970c4e46
JH		 2249 return irk;
2250 }
2251 }
adae20cb 2252 rcu_read_unlock();
970c4e46
JH		 2253
2254 return NULL;
2255}
2256
2257struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2258 u8 addr_type)
2259{
2260 struct smp_irk *irk;
2261
6cfc9988
JH		 2262 /* Identity Address must be public or static random */
2263 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2264 return NULL;
2265
adae20cb
JH		 2266 rcu_read_lock();
2267 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
970c4e46 2268 if (addr_type == irk->addr_type &&
adae20cb
JH		 2269 bacmp(bdaddr, &irk->bdaddr) == 0) {
2270 rcu_read_unlock();
970c4e46 2271 return irk;
adae20cb 2272 }
970c4e46 2273 }
adae20cb 2274 rcu_read_unlock();
970c4e46
JH		 2275
2276 return NULL;
2277}
2278
567fa2aa 2279struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
7652ff6a
JH		 2280 bdaddr_t *bdaddr, u8 *val, u8 type,
2281 u8 pin_len, bool *persistent)
55ed8ca1
JH		 2282{
2283 struct link_key *key, *old_key;
745c0ce3 2284 u8 old_key_type;
55ed8ca1
JH		 2285
2286 old_key = hci_find_link_key(hdev, bdaddr);
2287 if (old_key) {
2288 old_key_type = old_key->type;
2289 key = old_key;
2290 } else {
12adcf3a 2291 old_key_type = conn ? conn->key_type : 0xff;
0a14ab41 2292 key = kzalloc(sizeof(*key), GFP_KERNEL);
55ed8ca1 2293 if (!key)
567fa2aa 2294 return NULL;
0378b597 2295 list_add_rcu(&key->list, &hdev->link_keys);
55ed8ca1
JH		 2296 }
2297
6ed93dc6 2298 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 2299
d25e28ab
JH		 2300 /* Some buggy controller combinations generate a changed
2301 * combination key for legacy pairing even when there's no
2302 * previous key */
2303 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 2304 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 2305 type = HCI_LK_COMBINATION;
655fe6ec
JH		 2306 if (conn)
2307 conn->key_type = type;
2308 }
d25e28ab 2309
55ed8ca1 2310 bacpy(&key->bdaddr, bdaddr);
9b3b4460 2311 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 2312 key->pin_len = pin_len;
2313
b6020ba0 2314 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 2315 key->type = old_key_type;
4748fed2
JH		 2316 else
2317 key->type = type;
2318
7652ff6a
JH		 2319 if (persistent)
2320 *persistent = hci_persistent_key(hdev, conn, type,
2321 old_key_type);
4df378a1 2322
567fa2aa 2323 return key;
55ed8ca1
JH		 2324}
2325
ca9142b8 2326struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
35d70271 2327 u8 addr_type, u8 type, u8 authenticated,
fe39c7b2 2328 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
75d262c2 2329{
c9839a11 2330 struct smp_ltk *key, *old_key;
e804d25d 2331 u8 role = ltk_role(type);
75d262c2 2332
f3a73d97 2333 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
c9839a11 2334 if (old_key)
75d262c2 2335 key = old_key;
c9839a11 2336 else {
0a14ab41 2337 key = kzalloc(sizeof(*key), GFP_KERNEL);
75d262c2 2338 if (!key)
ca9142b8 2339 return NULL;
970d0f1b 2340 list_add_rcu(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 2341 }
2342
75d262c2 2343 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 2344 key->bdaddr_type = addr_type;
2345 memcpy(key->val, tk, sizeof(key->val));
2346 key->authenticated = authenticated;
2347 key->ediv = ediv;
fe39c7b2 2348 key->rand = rand;
c9839a11
VCG		 2349 key->enc_size = enc_size;
2350 key->type = type;
75d262c2 2351
ca9142b8 2352 return key;
75d262c2
VCG		 2353}
2354
ca9142b8
JH		 2355struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2356 u8 addr_type, u8 val[16], bdaddr_t *rpa)
970c4e46
JH		 2357{
2358 struct smp_irk *irk;
2359
2360 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2361 if (!irk) {
2362 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2363 if (!irk)
ca9142b8 2364 return NULL;
970c4e46
JH		 2365
2366 bacpy(&irk->bdaddr, bdaddr);
2367 irk->addr_type = addr_type;
2368
adae20cb 2369 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
970c4e46
JH		 2370 }
2371
2372 memcpy(irk->val, val, 16);
2373 bacpy(&irk->rpa, rpa);
2374
ca9142b8 2375 return irk;
970c4e46
JH		 2376}
2377
55ed8ca1
JH		 2378int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2379{
2380 struct link_key *key;
2381
2382 key = hci_find_link_key(hdev, bdaddr);
2383 if (!key)
2384 return -ENOENT;
2385
6ed93dc6 2386 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1 2387
0378b597
JH		 2388 list_del_rcu(&key->list);
2389 kfree_rcu(key, rcu);
55ed8ca1
JH		 2390
2391 return 0;
2392}
2393
e0b2b27e 2394int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
b899efaf 2395{
970d0f1b 2396 struct smp_ltk *k;
c51ffa0b 2397 int removed = 0;
b899efaf 2398
970d0f1b 2399 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
e0b2b27e 2400 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
b899efaf
VCG		 2401 continue;
2402
6ed93dc6 2403 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf 2404
970d0f1b
JH		 2405 list_del_rcu(&k->list);
2406 kfree_rcu(k, rcu);
c51ffa0b 2407 removed++;
b899efaf
VCG		 2408 }
2409
c51ffa0b 2410 return removed ? 0 : -ENOENT;
b899efaf
VCG		 2411}
2412
a7ec7338
JH		 2413void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2414{
adae20cb 2415 struct smp_irk *k;
a7ec7338 2416
adae20cb 2417 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
a7ec7338
JH		 2418 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2419 continue;
2420
2421 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2422
adae20cb
JH		 2423 list_del_rcu(&k->list);
2424 kfree_rcu(k, rcu);
a7ec7338
JH		 2425 }
2426}
2427
55e76b38
JH		 2428bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2429{
2430 struct smp_ltk *k;
4ba9faf3 2431 struct smp_irk *irk;
55e76b38
JH		 2432 u8 addr_type;
2433
2434 if (type == BDADDR_BREDR) {
2435 if (hci_find_link_key(hdev, bdaddr))
2436 return true;
2437 return false;
2438 }
2439
2440 /* Convert to HCI addr type which struct smp_ltk uses */
2441 if (type == BDADDR_LE_PUBLIC)
2442 addr_type = ADDR_LE_DEV_PUBLIC;
2443 else
2444 addr_type = ADDR_LE_DEV_RANDOM;
2445
4ba9faf3
JH		 2446 irk = hci_get_irk(hdev, bdaddr, addr_type);
2447 if (irk) {
2448 bdaddr = &irk->bdaddr;
2449 addr_type = irk->addr_type;
2450 }
2451
55e76b38
JH		 2452 rcu_read_lock();
2453 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
87c8b28d
JH		 2454 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2455 rcu_read_unlock();
55e76b38 2456 return true;
87c8b28d 2457 }
55e76b38
JH		 2458 }
2459 rcu_read_unlock();
2460
2461 return false;
2462}
2463
6bd32326 2464/* HCI command timer function */
65cc2b49 2465static void hci_cmd_timeout(struct work_struct *work)
6bd32326 2466{
65cc2b49
MH		 2467 struct hci_dev *hdev = container_of(work, struct hci_dev,
2468 cmd_timer.work);
6bd32326 2469
bda4f23a
AE		 2470 if (hdev->sent_cmd) {
2471 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2472 u16 opcode = __le16_to_cpu(sent->opcode);
2473
2474 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
2475 } else {
2476 BT_ERR("%s command tx timeout", hdev->name);
2477 }
2478
6bd32326 2479 atomic_set(&hdev->cmd_cnt, 1);
c347b765 2480 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 2481}
2482
2763eda6 2483struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
6928a924 2484 bdaddr_t *bdaddr, u8 bdaddr_type)
2763eda6
SJ		 2485{
2486 struct oob_data *data;
2487
6928a924
JH		 2488 list_for_each_entry(data, &hdev->remote_oob_data, list) {
2489 if (bacmp(bdaddr, &data->bdaddr) != 0)
2490 continue;
2491 if (data->bdaddr_type != bdaddr_type)
2492 continue;
2493 return data;
2494 }
2763eda6
SJ		 2495
2496 return NULL;
2497}
2498
6928a924
JH		 2499int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2500 u8 bdaddr_type)
2763eda6
SJ		 2501{
2502 struct oob_data *data;
2503
6928a924 2504 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6
SJ		 2505 if (!data)
2506 return -ENOENT;
2507
6928a924 2508 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2763eda6
SJ		 2509
2510 list_del(&data->list);
2511 kfree(data);
2512
2513 return 0;
2514}
2515
35f7498a 2516void hci_remote_oob_data_clear(struct hci_dev *hdev)
2763eda6
SJ		 2517{
2518 struct oob_data *data, *n;
2519
2520 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2521 list_del(&data->list);
2522 kfree(data);
2523 }
2763eda6
SJ		 2524}
2525
0798872e 2526int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
6928a924 2527 u8 bdaddr_type, u8 *hash192, u8 *rand192,
81328d5c 2528 u8 *hash256, u8 *rand256)
2763eda6
SJ		 2529{
2530 struct oob_data *data;
2531
6928a924 2532 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6 2533 if (!data) {
0a14ab41 2534 data = kmalloc(sizeof(*data), GFP_KERNEL);
2763eda6
SJ		 2535 if (!data)
2536 return -ENOMEM;
2537
2538 bacpy(&data->bdaddr, bdaddr);
6928a924 2539 data->bdaddr_type = bdaddr_type;
2763eda6
SJ		 2540 list_add(&data->list, &hdev->remote_oob_data);
2541 }
2542
81328d5c
JH		 2543 if (hash192 && rand192) {
2544 memcpy(data->hash192, hash192, sizeof(data->hash192));
2545 memcpy(data->rand192, rand192, sizeof(data->rand192));
f7697b16
MH		 2546 if (hash256 && rand256)
2547 data->present = 0x03;
81328d5c
JH		 2548 } else {
2549 memset(data->hash192, 0, sizeof(data->hash192));
2550 memset(data->rand192, 0, sizeof(data->rand192));
f7697b16
MH		 2551 if (hash256 && rand256)
2552 data->present = 0x02;
2553 else
2554 data->present = 0x00;
0798872e
MH		 2555 }
2556
81328d5c
JH		 2557 if (hash256 && rand256) {
2558 memcpy(data->hash256, hash256, sizeof(data->hash256));
2559 memcpy(data->rand256, rand256, sizeof(data->rand256));
2560 } else {
2561 memset(data->hash256, 0, sizeof(data->hash256));
2562 memset(data->rand256, 0, sizeof(data->rand256));
f7697b16
MH		 2563 if (hash192 && rand192)
2564 data->present = 0x01;
81328d5c 2565 }
0798872e 2566
6ed93dc6 2567 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 2568
2569 return 0;
2570}
2571
d2609b34
FG		 2572/* This function requires the caller holds hdev->lock */
2573struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2574{
2575 struct adv_info *adv_instance;
2576
2577 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2578 if (adv_instance->instance == instance)
2579 return adv_instance;
2580 }
2581
2582 return NULL;
2583}
2584
2585/* This function requires the caller holds hdev->lock */
74b93e9f
PK		 2586struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2587{
d2609b34
FG		 2588 struct adv_info *cur_instance;
2589
2590 cur_instance = hci_find_adv_instance(hdev, instance);
2591 if (!cur_instance)
2592 return NULL;
2593
2594 if (cur_instance == list_last_entry(&hdev->adv_instances,
2595 struct adv_info, list))
2596 return list_first_entry(&hdev->adv_instances,
2597 struct adv_info, list);
2598 else
2599 return list_next_entry(cur_instance, list);
2600}
2601
2602/* This function requires the caller holds hdev->lock */
2603int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2604{
2605 struct adv_info *adv_instance;
2606
2607 adv_instance = hci_find_adv_instance(hdev, instance);
2608 if (!adv_instance)
2609 return -ENOENT;
2610
2611 BT_DBG("%s removing %dMR", hdev->name, instance);
2612
cab054ab
JH		 2613 if (hdev->cur_adv_instance == instance) {
2614 if (hdev->adv_instance_timeout) {
2615 cancel_delayed_work(&hdev->adv_instance_expire);
2616 hdev->adv_instance_timeout = 0;
2617 }
2618 hdev->cur_adv_instance = 0x00;
5d900e46
FG		 2619 }
2620
d2609b34
FG		 2621 list_del(&adv_instance->list);
2622 kfree(adv_instance);
2623
2624 hdev->adv_instance_cnt--;
2625
2626 return 0;
2627}
2628
2629/* This function requires the caller holds hdev->lock */
2630void hci_adv_instances_clear(struct hci_dev *hdev)
2631{
2632 struct adv_info *adv_instance, *n;
2633
5d900e46
FG		 2634 if (hdev->adv_instance_timeout) {
2635 cancel_delayed_work(&hdev->adv_instance_expire);
2636 hdev->adv_instance_timeout = 0;
2637 }
2638
d2609b34
FG		 2639 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
2640 list_del(&adv_instance->list);
2641 kfree(adv_instance);
2642 }
2643
2644 hdev->adv_instance_cnt = 0;
cab054ab 2645 hdev->cur_adv_instance = 0x00;
d2609b34
FG		 2646}
2647
2648/* This function requires the caller holds hdev->lock */
2649int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2650 u16 adv_data_len, u8 *adv_data,
2651 u16 scan_rsp_len, u8 *scan_rsp_data,
2652 u16 timeout, u16 duration)
2653{
2654 struct adv_info *adv_instance;
2655
2656 adv_instance = hci_find_adv_instance(hdev, instance);
2657 if (adv_instance) {
2658 memset(adv_instance->adv_data, 0,
2659 sizeof(adv_instance->adv_data));
2660 memset(adv_instance->scan_rsp_data, 0,
2661 sizeof(adv_instance->scan_rsp_data));
2662 } else {
2663 if (hdev->adv_instance_cnt >= HCI_MAX_ADV_INSTANCES ||
2664 instance < 1 || instance > HCI_MAX_ADV_INSTANCES)
2665 return -EOVERFLOW;
2666
39ecfad6 2667 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
d2609b34
FG		 2668 if (!adv_instance)
2669 return -ENOMEM;
2670
fffd38bc 2671 adv_instance->pending = true;
d2609b34
FG		 2672 adv_instance->instance = instance;
2673 list_add(&adv_instance->list, &hdev->adv_instances);
2674 hdev->adv_instance_cnt++;
2675 }
2676
2677 adv_instance->flags = flags;
2678 adv_instance->adv_data_len = adv_data_len;
2679 adv_instance->scan_rsp_len = scan_rsp_len;
2680
2681 if (adv_data_len)
2682 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
2683
2684 if (scan_rsp_len)
2685 memcpy(adv_instance->scan_rsp_data,
2686 scan_rsp_data, scan_rsp_len);
2687
2688 adv_instance->timeout = timeout;
5d900e46 2689 adv_instance->remaining_time = timeout;
d2609b34
FG		 2690
2691 if (duration == 0)
2692 adv_instance->duration = HCI_DEFAULT_ADV_DURATION;
2693 else
2694 adv_instance->duration = duration;
2695
2696 BT_DBG("%s for %dMR", hdev->name, instance);
2697
2698 return 0;
2699}
2700
dcc36c16 2701struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
b9ee0a78 2702 bdaddr_t *bdaddr, u8 type)
b2a66aad 2703{
8035ded4 2704 struct bdaddr_list *b;
b2a66aad 2705
dcc36c16 2706 list_for_each_entry(b, bdaddr_list, list) {
b9ee0a78 2707 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
b2a66aad 2708 return b;
b9ee0a78 2709 }
b2a66aad
AJ		 2710
2711 return NULL;
2712}
2713
dcc36c16 2714void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
b2a66aad 2715{
7eb7404f 2716 struct bdaddr_list *b, *n;
b2a66aad 2717
7eb7404f
GT		 2718 list_for_each_entry_safe(b, n, bdaddr_list, list) {
2719 list_del(&b->list);
b2a66aad
AJ		 2720 kfree(b);
2721 }
b2a66aad
AJ		 2722}
2723
dcc36c16 2724int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2725{
2726 struct bdaddr_list *entry;
b2a66aad 2727
b9ee0a78 2728 if (!bacmp(bdaddr, BDADDR_ANY))
b2a66aad
AJ		 2729 return -EBADF;
2730
dcc36c16 2731 if (hci_bdaddr_list_lookup(list, bdaddr, type))
5e762444 2732 return -EEXIST;
b2a66aad 2733
27f70f3e 2734 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
5e762444
AJ		 2735 if (!entry)
2736 return -ENOMEM;
b2a66aad
AJ		 2737
2738 bacpy(&entry->bdaddr, bdaddr);
b9ee0a78 2739 entry->bdaddr_type = type;
b2a66aad 2740
dcc36c16 2741 list_add(&entry->list, list);
b2a66aad 2742
2a8357f2 2743 return 0;
b2a66aad
AJ		 2744}
2745
dcc36c16 2746int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2747{
2748 struct bdaddr_list *entry;
b2a66aad 2749
35f7498a 2750 if (!bacmp(bdaddr, BDADDR_ANY)) {
dcc36c16 2751 hci_bdaddr_list_clear(list);
35f7498a
JH		 2752 return 0;
2753 }
b2a66aad 2754
dcc36c16 2755 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
d2ab0ac1
MH		 2756 if (!entry)
2757 return -ENOENT;
2758
2759 list_del(&entry->list);
2760 kfree(entry);
2761
2762 return 0;
2763}
2764
15819a70
AG		 2765/* This function requires the caller holds hdev->lock */
2766struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2767 bdaddr_t *addr, u8 addr_type)
2768{
2769 struct hci_conn_params *params;
2770
2771 list_for_each_entry(params, &hdev->le_conn_params, list) {
2772 if (bacmp(&params->addr, addr) == 0 &&
2773 params->addr_type == addr_type) {
2774 return params;
2775 }
2776 }
2777
2778 return NULL;
2779}
2780
4b10966f 2781/* This function requires the caller holds hdev->lock */
501f8827
JH		 2782struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2783 bdaddr_t *addr, u8 addr_type)
a9b0a04c 2784{
912b42ef 2785 struct hci_conn_params *param;
a9b0a04c 2786
501f8827 2787 list_for_each_entry(param, list, action) {
912b42ef
JH		 2788 if (bacmp(&param->addr, addr) == 0 &&
2789 param->addr_type == addr_type)
2790 return param;
4b10966f
MH		 2791 }
2792
2793 return NULL;
a9b0a04c
AG		 2794}
2795
15819a70 2796/* This function requires the caller holds hdev->lock */
51d167c0
MH		 2797struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2798 bdaddr_t *addr, u8 addr_type)
15819a70
AG		 2799{
2800 struct hci_conn_params *params;
2801
2802 params = hci_conn_params_lookup(hdev, addr, addr_type);
cef952ce 2803 if (params)
51d167c0 2804 return params;
15819a70
AG		 2805
2806 params = kzalloc(sizeof(*params), GFP_KERNEL);
2807 if (!params) {
2808 BT_ERR("Out of memory");
51d167c0 2809 return NULL;
15819a70
AG		 2810 }
2811
2812 bacpy(&params->addr, addr);
2813 params->addr_type = addr_type;
cef952ce
AG		 2814
2815 list_add(&params->list, &hdev->le_conn_params);
93450c75 2816 INIT_LIST_HEAD(&params->action);
cef952ce 2817
bf5b3c8b
MH		 2818 params->conn_min_interval = hdev->le_conn_min_interval;
2819 params->conn_max_interval = hdev->le_conn_max_interval;
2820 params->conn_latency = hdev->le_conn_latency;
2821 params->supervision_timeout = hdev->le_supv_timeout;
2822 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2823
2824 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2825
51d167c0 2826 return params;
bf5b3c8b
MH		 2827}
2828
f6c63249 2829static void hci_conn_params_free(struct hci_conn_params *params)
15819a70 2830{
f8aaf9b6 2831 if (params->conn) {
f161dd41 2832 hci_conn_drop(params->conn);
f8aaf9b6
JH		 2833 hci_conn_put(params->conn);
2834 }
f161dd41 2835
95305baa 2836 list_del(&params->action);
15819a70
AG		 2837 list_del(&params->list);
2838 kfree(params);
f6c63249
JH		 2839}
2840
2841/* This function requires the caller holds hdev->lock */
2842void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2843{
2844 struct hci_conn_params *params;
2845
2846 params = hci_conn_params_lookup(hdev, addr, addr_type);
2847 if (!params)
2848 return;
2849
2850 hci_conn_params_free(params);
15819a70 2851
95305baa
JH		 2852 hci_update_background_scan(hdev);
2853
15819a70
AG		 2854 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2855}
2856
2857/* This function requires the caller holds hdev->lock */
55af49a8 2858void hci_conn_params_clear_disabled(struct hci_dev *hdev)
15819a70
AG		 2859{
2860 struct hci_conn_params *params, *tmp;
2861
2862 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
55af49a8
JH		 2863 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2864 continue;
f75113a2
JP		 2865
2866 /* If trying to estabilish one time connection to disabled
2867 * device, leave the params, but mark them as just once.
2868 */
2869 if (params->explicit_connect) {
2870 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2871 continue;
2872 }
2873
15819a70
AG		 2874 list_del(&params->list);
2875 kfree(params);
2876 }
2877
55af49a8 2878 BT_DBG("All LE disabled connection parameters were removed");
77a77a30
AG		 2879}
2880
2881/* This function requires the caller holds hdev->lock */
030e7f81 2882static void hci_conn_params_clear_all(struct hci_dev *hdev)
77a77a30 2883{
15819a70 2884 struct hci_conn_params *params, *tmp;
77a77a30 2885
f6c63249
JH		 2886 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2887 hci_conn_params_free(params);
77a77a30 2888
15819a70 2889 BT_DBG("All LE connection parameters were removed");
77a77a30
AG		 2890}
2891
a1f4c318
JH		 2892/* Copy the Identity Address of the controller.
2893 *
2894 * If the controller has a public BD_ADDR, then by default use that one.
2895 * If this is a LE only controller without a public address, default to
2896 * the static random address.
2897 *
2898 * For debugging purposes it is possible to force controllers with a
2899 * public address to use the static random address instead.
50b5b952
MH		 2900 *
2901 * In case BR/EDR has been disabled on a dual-mode controller and
2902 * userspace has configured a static address, then that address
2903 * becomes the identity address instead of the public BR/EDR address.
a1f4c318
JH		 2904 */
2905void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2906 u8 *bdaddr_type)
2907{
b7cb93e5 2908 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
50b5b952 2909 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
d7a5a11d 2910 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
50b5b952 2911 bacmp(&hdev->static_addr, BDADDR_ANY))) {
a1f4c318
JH		 2912 bacpy(bdaddr, &hdev->static_addr);
2913 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2914 } else {
2915 bacpy(bdaddr, &hdev->bdaddr);
2916 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
2917 }
2918}
2919
9be0dab7
DH		 2920/* Alloc HCI device */
2921struct hci_dev *hci_alloc_dev(void)
2922{
2923 struct hci_dev *hdev;
2924
27f70f3e 2925 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
9be0dab7
DH		 2926 if (!hdev)
2927 return NULL;
2928
b1b813d4
DH		 2929 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2930 hdev->esco_type = (ESCO_HV1);
2931 hdev->link_mode = (HCI_LM_ACCEPT);
b4cb9fb2
MH		 2932 hdev->num_iac = 0x01; /* One IAC support is mandatory */
2933 hdev->io_capability = 0x03; /* No Input No Output */
96c2103a 2934 hdev->manufacturer = 0xffff; /* Default to internal use */
bbaf444a
JH		 2935 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2936 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
d2609b34
FG		 2937 hdev->adv_instance_cnt = 0;
2938 hdev->cur_adv_instance = 0x00;
5d900e46 2939 hdev->adv_instance_timeout = 0;
b1b813d4 2940
b1b813d4
DH		 2941 hdev->sniff_max_interval = 800;
2942 hdev->sniff_min_interval = 80;
2943
3f959d46 2944 hdev->le_adv_channel_map = 0x07;
628531c9
GL		 2945 hdev->le_adv_min_interval = 0x0800;
2946 hdev->le_adv_max_interval = 0x0800;
bef64738
MH		 2947 hdev->le_scan_interval = 0x0060;
2948 hdev->le_scan_window = 0x0030;
4e70c7e7
MH		 2949 hdev->le_conn_min_interval = 0x0028;
2950 hdev->le_conn_max_interval = 0x0038;
04fb7d90
MH		 2951 hdev->le_conn_latency = 0x0000;
2952 hdev->le_supv_timeout = 0x002a;
a8e1bfaa
MH		 2953 hdev->le_def_tx_len = 0x001b;
2954 hdev->le_def_tx_time = 0x0148;
2955 hdev->le_max_tx_len = 0x001b;
2956 hdev->le_max_tx_time = 0x0148;
2957 hdev->le_max_rx_len = 0x001b;
2958 hdev->le_max_rx_time = 0x0148;
bef64738 2959
d6bfd59c 2960 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
b9a7a61e 2961 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
31ad1691
AK		 2962 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
2963 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
d6bfd59c 2964
b1b813d4
DH		 2965 mutex_init(&hdev->lock);
2966 mutex_init(&hdev->req_lock);
2967
2968 INIT_LIST_HEAD(&hdev->mgmt_pending);
2969 INIT_LIST_HEAD(&hdev->blacklist);
6659358e 2970 INIT_LIST_HEAD(&hdev->whitelist);
b1b813d4
DH		 2971 INIT_LIST_HEAD(&hdev->uuids);
2972 INIT_LIST_HEAD(&hdev->link_keys);
2973 INIT_LIST_HEAD(&hdev->long_term_keys);
970c4e46 2974 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
b1b813d4 2975 INIT_LIST_HEAD(&hdev->remote_oob_data);
d2ab0ac1 2976 INIT_LIST_HEAD(&hdev->le_white_list);
15819a70 2977 INIT_LIST_HEAD(&hdev->le_conn_params);
77a77a30 2978 INIT_LIST_HEAD(&hdev->pend_le_conns);
66f8455a 2979 INIT_LIST_HEAD(&hdev->pend_le_reports);
6b536b5e 2980 INIT_LIST_HEAD(&hdev->conn_hash.list);
d2609b34 2981 INIT_LIST_HEAD(&hdev->adv_instances);
b1b813d4
DH		 2982
2983 INIT_WORK(&hdev->rx_work, hci_rx_work);
2984 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2985 INIT_WORK(&hdev->tx_work, hci_tx_work);
2986 INIT_WORK(&hdev->power_on, hci_power_on);
c7741d16 2987 INIT_WORK(&hdev->error_reset, hci_error_reset);
b1b813d4 2988
b1b813d4 2989 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
b1b813d4 2990
b1b813d4
DH		 2991 skb_queue_head_init(&hdev->rx_q);
2992 skb_queue_head_init(&hdev->cmd_q);
2993 skb_queue_head_init(&hdev->raw_q);
2994
2995 init_waitqueue_head(&hdev->req_wait_q);
2996
65cc2b49 2997 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
b1b813d4 2998
5fc16cc4
JH		 2999 hci_request_setup(hdev);
3000
b1b813d4
DH		 3001 hci_init_sysfs(hdev);
3002 discovery_init(hdev);
9be0dab7
DH		 3003
3004 return hdev;
3005}
3006EXPORT_SYMBOL(hci_alloc_dev);
3007
3008/* Free HCI device */
3009void hci_free_dev(struct hci_dev *hdev)
3010{
9be0dab7
DH		 3011 /* will free via device release */
3012 put_device(&hdev->dev);
3013}
3014EXPORT_SYMBOL(hci_free_dev);
3015
1da177e4
LT		 3016/* Register HCI device */
3017int hci_register_dev(struct hci_dev *hdev)
3018{
b1b813d4 3019 int id, error;
1da177e4 3020
74292d5a 3021 if (!hdev->open || !hdev->close || !hdev->send)
1da177e4
LT		 3022 return -EINVAL;
3023
08add513
MM		 3024 /* Do not allow HCI_AMP devices to register at index 0,
3025 * so the index can be used as the AMP controller ID.
3026 */
3df92b31
SL		 3027 switch (hdev->dev_type) {
3028 case HCI_BREDR:
3029 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3030 break;
3031 case HCI_AMP:
3032 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3033 break;
3034 default:
3035 return -EINVAL;
1da177e4 3036 }
8e87d142 3037
3df92b31
SL		 3038 if (id < 0)
3039 return id;
3040
1da177e4
LT		 3041 sprintf(hdev->name, "hci%d", id);
3042 hdev->id = id;
2d8b3a11
AE		 3043
3044 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3045
d8537548
KC		 3046 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3047 WQ_MEM_RECLAIM, 1, hdev->name);
33ca954d
DH		 3048 if (!hdev->workqueue) {
3049 error = -ENOMEM;
3050 goto err;
3051 }
f48fd9c8 3052
d8537548
KC		 3053 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3054 WQ_MEM_RECLAIM, 1, hdev->name);
6ead1bbc
JH		 3055 if (!hdev->req_workqueue) {
3056 destroy_workqueue(hdev->workqueue);
3057 error = -ENOMEM;
3058 goto err;
3059 }
3060
0153e2ec
MH		 3061 if (!IS_ERR_OR_NULL(bt_debugfs))
3062 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3063
bdc3e0f1
MH		 3064 dev_set_name(&hdev->dev, "%s", hdev->name);
3065
3066 error = device_add(&hdev->dev);
33ca954d 3067 if (error < 0)
54506918 3068 goto err_wqueue;
1da177e4 3069
611b30f7 3070 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 3071 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3072 hdev);
611b30f7
MH		 3073 if (hdev->rfkill) {
3074 if (rfkill_register(hdev->rfkill) < 0) {
3075 rfkill_destroy(hdev->rfkill);
3076 hdev->rfkill = NULL;
3077 }
3078 }
3079
5e130367 3080 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
a1536da2 3081 hci_dev_set_flag(hdev, HCI_RFKILLED);
5e130367 3082
a1536da2
MH		 3083 hci_dev_set_flag(hdev, HCI_SETUP);
3084 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
ce2be9ac 3085
01cd3404 3086 if (hdev->dev_type == HCI_BREDR) {
56f87901
JH		 3087 /* Assume BR/EDR support until proven otherwise (such as
3088 * through reading supported features during init.
3089 */
a1536da2 3090 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
56f87901 3091 }
ce2be9ac 3092
fcee3377
GP		 3093 write_lock(&hci_dev_list_lock);
3094 list_add(&hdev->list, &hci_dev_list);
3095 write_unlock(&hci_dev_list_lock);
3096
4a964404
MH		 3097 /* Devices that are marked for raw-only usage are unconfigured
3098 * and should not be included in normal operation.
fee746b0
MH		 3099 */
3100 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
a1536da2 3101 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
fee746b0 3102
05fcd4c4 3103 hci_sock_dev_event(hdev, HCI_DEV_REG);
dc946bd8 3104 hci_dev_hold(hdev);
1da177e4 3105
19202573 3106 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 3107
1da177e4 3108 return id;
f48fd9c8 3109
33ca954d
DH		 3110err_wqueue:
3111 destroy_workqueue(hdev->workqueue);
6ead1bbc 3112 destroy_workqueue(hdev->req_workqueue);
33ca954d 3113err:
3df92b31 3114 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 3115
33ca954d 3116 return error;
1da177e4
LT		 3117}
3118EXPORT_SYMBOL(hci_register_dev);
3119
3120/* Unregister HCI device */
59735631 3121void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 3122{
2d7cc19e 3123 int id;
ef222013 3124
c13854ce 3125 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 3126
a1536da2 3127 hci_dev_set_flag(hdev, HCI_UNREGISTER);
94324962 3128
3df92b31
SL		 3129 id = hdev->id;
3130
f20d09d5 3131 write_lock(&hci_dev_list_lock);
1da177e4 3132 list_del(&hdev->list);
f20d09d5 3133 write_unlock(&hci_dev_list_lock);
1da177e4
LT		 3134
3135 hci_dev_do_close(hdev);
3136
b9b5ef18
GP		 3137 cancel_work_sync(&hdev->power_on);
3138
ab81cbf9 3139 if (!test_bit(HCI_INIT, &hdev->flags) &&
d7a5a11d
MH		 3140 !hci_dev_test_flag(hdev, HCI_SETUP) &&
3141 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
09fd0de5 3142 hci_dev_lock(hdev);
744cf19e 3143 mgmt_index_removed(hdev);
09fd0de5 3144 hci_dev_unlock(hdev);
56e5cb86 3145 }
ab81cbf9 3146
2e58ef3e
JH		 3147 /* mgmt_index_removed should take care of emptying the
3148 * pending list */
3149 BUG_ON(!list_empty(&hdev->mgmt_pending));
3150
05fcd4c4 3151 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
1da177e4 3152
611b30f7
MH		 3153 if (hdev->rfkill) {
3154 rfkill_unregister(hdev->rfkill);
3155 rfkill_destroy(hdev->rfkill);
3156 }
3157
bdc3e0f1 3158 device_del(&hdev->dev);
147e2d59 3159
0153e2ec
MH		 3160 debugfs_remove_recursive(hdev->debugfs);
3161
f48fd9c8 3162 destroy_workqueue(hdev->workqueue);
6ead1bbc 3163 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 3164
09fd0de5 3165 hci_dev_lock(hdev);
dcc36c16 3166 hci_bdaddr_list_clear(&hdev->blacklist);
6659358e 3167 hci_bdaddr_list_clear(&hdev->whitelist);
2aeb9a1a 3168 hci_uuids_clear(hdev);
55ed8ca1 3169 hci_link_keys_clear(hdev);
b899efaf 3170 hci_smp_ltks_clear(hdev);
970c4e46 3171 hci_smp_irks_clear(hdev);
2763eda6 3172 hci_remote_oob_data_clear(hdev);
d2609b34 3173 hci_adv_instances_clear(hdev);
dcc36c16 3174 hci_bdaddr_list_clear(&hdev->le_white_list);
373110c5 3175 hci_conn_params_clear_all(hdev);
22078800 3176 hci_discovery_filter_clear(hdev);
09fd0de5 3177 hci_dev_unlock(hdev);
e2e0cacb 3178
dc946bd8 3179 hci_dev_put(hdev);
3df92b31
SL		 3180
3181 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 3182}
3183EXPORT_SYMBOL(hci_unregister_dev);
3184
3185/* Suspend HCI device */
3186int hci_suspend_dev(struct hci_dev *hdev)
3187{
05fcd4c4 3188 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
1da177e4
LT		 3189 return 0;
3190}
3191EXPORT_SYMBOL(hci_suspend_dev);
3192
3193/* Resume HCI device */
3194int hci_resume_dev(struct hci_dev *hdev)
3195{
05fcd4c4 3196 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
1da177e4
LT		 3197 return 0;
3198}
3199EXPORT_SYMBOL(hci_resume_dev);
3200
75e0569f
MH		 3201/* Reset HCI device */
3202int hci_reset_dev(struct hci_dev *hdev)
3203{
3204 const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3205 struct sk_buff *skb;
3206
3207 skb = bt_skb_alloc(3, GFP_ATOMIC);
3208 if (!skb)
3209 return -ENOMEM;
3210
d79f34e3 3211 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
75e0569f
MH		 3212 memcpy(skb_put(skb, 3), hw_err, 3);
3213
3214 /* Send Hardware Error to upper stack */
3215 return hci_recv_frame(hdev, skb);
3216}
3217EXPORT_SYMBOL(hci_reset_dev);
3218
76bca880 3219/* Receive frame from HCI drivers */
e1a26170 3220int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
76bca880 3221{
76bca880 3222 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 3223 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 3224 kfree_skb(skb);
3225 return -ENXIO;
3226 }
3227
d79f34e3
MH		 3228 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
3229 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
3230 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
fe806dce
MH		 3231 kfree_skb(skb);
3232 return -EINVAL;
3233 }
3234
d82603c6 3235 /* Incoming skb */
76bca880
MH		 3236 bt_cb(skb)->incoming = 1;
3237
3238 /* Time stamp */
3239 __net_timestamp(skb);
3240
76bca880 3241 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 3242 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 3243
76bca880
MH		 3244 return 0;
3245}
3246EXPORT_SYMBOL(hci_recv_frame);
3247
e875ff84
MH		 3248/* Receive diagnostic message from HCI drivers */
3249int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
3250{
581d6fd6 3251 /* Mark as diagnostic packet */
d79f34e3 3252 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
581d6fd6 3253
e875ff84
MH		 3254 /* Time stamp */
3255 __net_timestamp(skb);
3256
581d6fd6
MH		 3257 skb_queue_tail(&hdev->rx_q, skb);
3258 queue_work(hdev->workqueue, &hdev->rx_work);
e875ff84 3259
e875ff84
MH		 3260 return 0;
3261}
3262EXPORT_SYMBOL(hci_recv_diag);
3263
1da177e4
LT		 3264/* ---- Interface to upper protocols ---- */
3265
1da177e4
LT		 3266int hci_register_cb(struct hci_cb *cb)
3267{
3268 BT_DBG("%p name %s", cb, cb->name);
3269
fba7ecf0 3270 mutex_lock(&hci_cb_list_lock);
00629e0f 3271 list_add_tail(&cb->list, &hci_cb_list);
fba7ecf0 3272 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 3273
3274 return 0;
3275}
3276EXPORT_SYMBOL(hci_register_cb);
3277
3278int hci_unregister_cb(struct hci_cb *cb)
3279{
3280 BT_DBG("%p name %s", cb, cb->name);
3281
fba7ecf0 3282 mutex_lock(&hci_cb_list_lock);
1da177e4 3283 list_del(&cb->list);
fba7ecf0 3284 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 3285
3286 return 0;
3287}
3288EXPORT_SYMBOL(hci_unregister_cb);
3289
51086991 3290static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3291{
cdc52faa
MH		 3292 int err;
3293
d79f34e3
MH		 3294 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3295 skb->len);
1da177e4 3296
cd82e61c
MH		 3297 /* Time stamp */
3298 __net_timestamp(skb);
1da177e4 3299
cd82e61c
MH		 3300 /* Send copy to monitor */
3301 hci_send_to_monitor(hdev, skb);
3302
3303 if (atomic_read(&hdev->promisc)) {
3304 /* Send copy to the sockets */
470fe1b5 3305 hci_send_to_sock(hdev, skb);
1da177e4
LT		 3306 }
3307
3308 /* Get rid of skb owner, prior to sending to the driver. */
3309 skb_orphan(skb);
3310
73d0d3c8
MH		 3311 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3312 kfree_skb(skb);
3313 return;
3314 }
3315
cdc52faa
MH		 3316 err = hdev->send(hdev, skb);
3317 if (err < 0) {
3318 BT_ERR("%s sending frame failed (%d)", hdev->name, err);
3319 kfree_skb(skb);
3320 }
1da177e4
LT		 3321}
3322
1ca3a9d0 3323/* Send HCI command */
07dc93dd
JH		 3324int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3325 const void *param)
1ca3a9d0
JH		 3326{
3327 struct sk_buff *skb;
3328
3329 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3330
3331 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3332 if (!skb) {
3333 BT_ERR("%s no memory for command", hdev->name);
3334 return -ENOMEM;
3335 }
3336
49c922bb 3337 /* Stand-alone HCI commands must be flagged as
11714b3d
JH		 3338 * single-command requests.
3339 */
44d27137 3340 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
11714b3d 3341
1da177e4 3342 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 3343 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3344
3345 return 0;
3346}
1da177e4
LT		 3347
3348/* Get data from the previously sent command */
a9de9248 3349void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 3350{
3351 struct hci_command_hdr *hdr;
3352
3353 if (!hdev->sent_cmd)
3354 return NULL;
3355
3356 hdr = (void *) hdev->sent_cmd->data;
3357
a9de9248 3358 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 3359 return NULL;
3360
f0e09510 3361 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 3362
3363 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3364}
3365
fbef168f
LP		 3366/* Send HCI command and wait for command commplete event */
3367struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
3368 const void *param, u32 timeout)
3369{
3370 struct sk_buff *skb;
3371
3372 if (!test_bit(HCI_UP, &hdev->flags))
3373 return ERR_PTR(-ENETDOWN);
3374
3375 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
3376
b504430c 3377 hci_req_sync_lock(hdev);
fbef168f 3378 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
b504430c 3379 hci_req_sync_unlock(hdev);
fbef168f
LP		 3380
3381 return skb;
3382}
3383EXPORT_SYMBOL(hci_cmd_sync);
3384
1da177e4
LT		 3385/* Send ACL data */
3386static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3387{
3388 struct hci_acl_hdr *hdr;
3389 int len = skb->len;
3390
badff6d0
ACM		 3391 skb_push(skb, HCI_ACL_HDR_SIZE);
3392 skb_reset_transport_header(skb);
9c70220b 3393 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 3394 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3395 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 3396}
3397
ee22be7e 3398static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 3399 struct sk_buff *skb, __u16 flags)
1da177e4 3400{
ee22be7e 3401 struct hci_conn *conn = chan->conn;
1da177e4
LT		 3402 struct hci_dev *hdev = conn->hdev;
3403 struct sk_buff *list;
3404
087bfd99
GP		 3405 skb->len = skb_headlen(skb);
3406 skb->data_len = 0;
3407
d79f34e3 3408 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
204a6e54
AE		 3409
3410 switch (hdev->dev_type) {
3411 case HCI_BREDR:
3412 hci_add_acl_hdr(skb, conn->handle, flags);
3413 break;
3414 case HCI_AMP:
3415 hci_add_acl_hdr(skb, chan->handle, flags);
3416 break;
3417 default:
3418 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3419 return;
3420 }
087bfd99 3421
70f23020
AE		 3422 list = skb_shinfo(skb)->frag_list;
3423 if (!list) {
1da177e4
LT		 3424 /* Non fragmented */
3425 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3426
73d80deb 3427 skb_queue_tail(queue, skb);
1da177e4
LT		 3428 } else {
3429 /* Fragmented */
3430 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3431
3432 skb_shinfo(skb)->frag_list = NULL;
3433
9cfd5a23
JR		 3434 /* Queue all fragments atomically. We need to use spin_lock_bh
3435 * here because of 6LoWPAN links, as there this function is
3436 * called from softirq and using normal spin lock could cause
3437 * deadlocks.
3438 */
3439 spin_lock_bh(&queue->lock);
1da177e4 3440
73d80deb 3441 __skb_queue_tail(queue, skb);
e702112f
AE		 3442
3443 flags &= ~ACL_START;
3444 flags |= ACL_CONT;
1da177e4
LT		 3445 do {
3446 skb = list; list = list->next;
8e87d142 3447
d79f34e3 3448 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
e702112f 3449 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 3450
3451 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3452
73d80deb 3453 __skb_queue_tail(queue, skb);
1da177e4
LT		 3454 } while (list);
3455
9cfd5a23 3456 spin_unlock_bh(&queue->lock);
1da177e4 3457 }
73d80deb
LAD		 3458}
3459
3460void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3461{
ee22be7e 3462 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 3463
f0e09510 3464 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb 3465
ee22be7e 3466 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 3467
3eff45ea 3468 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3469}
1da177e4
LT		 3470
3471/* Send SCO data */
0d861d8b 3472void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 3473{
3474 struct hci_dev *hdev = conn->hdev;
3475 struct hci_sco_hdr hdr;
3476
3477 BT_DBG("%s len %d", hdev->name, skb->len);
3478
aca3192c 3479 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 3480 hdr.dlen = skb->len;
3481
badff6d0
ACM		 3482 skb_push(skb, HCI_SCO_HDR_SIZE);
3483 skb_reset_transport_header(skb);
9c70220b 3484 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4 3485
d79f34e3 3486 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
c78ae283 3487
1da177e4 3488 skb_queue_tail(&conn->data_q, skb);
3eff45ea 3489 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3490}
1da177e4
LT		 3491
3492/* ---- HCI TX task (outgoing data) ---- */
3493
3494/* HCI Connection scheduler */
6039aa73
GP		 3495static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3496 int *quote)
1da177e4
LT		 3497{
3498 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3499 struct hci_conn *conn = NULL, *c;
abc5de8f 3500 unsigned int num = 0, min = ~0;
1da177e4 3501
8e87d142 3502 /* We don't have to lock device here. Connections are always
1da177e4 3503 * added and removed with TX task disabled. */
bf4c6325
GP		 3504
3505 rcu_read_lock();
3506
3507 list_for_each_entry_rcu(c, &h->list, list) {
769be974 3508 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 3509 continue;
769be974
MH		 3510
3511 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3512 continue;
3513
1da177e4
LT		 3514 num++;
3515
3516 if (c->sent < min) {
3517 min = c->sent;
3518 conn = c;
3519 }
52087a79
LAD		 3520
3521 if (hci_conn_num(hdev, type) == num)
3522 break;
1da177e4
LT		 3523 }
3524
bf4c6325
GP		 3525 rcu_read_unlock();
3526
1da177e4 3527 if (conn) {
6ed58ec5
VT		 3528 int cnt, q;
3529
3530 switch (conn->type) {
3531 case ACL_LINK:
3532 cnt = hdev->acl_cnt;
3533 break;
3534 case SCO_LINK:
3535 case ESCO_LINK:
3536 cnt = hdev->sco_cnt;
3537 break;
3538 case LE_LINK:
3539 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3540 break;
3541 default:
3542 cnt = 0;
3543 BT_ERR("Unknown link type");
3544 }
3545
3546 q = cnt / num;
1da177e4
LT		 3547 *quote = q ? q : 1;
3548 } else
3549 *quote = 0;
3550
3551 BT_DBG("conn %p quote %d", conn, *quote);
3552 return conn;
3553}
3554
6039aa73 3555static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 3556{
3557 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3558 struct hci_conn *c;
1da177e4 3559
bae1f5d9 3560 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 3561
bf4c6325
GP		 3562 rcu_read_lock();
3563
1da177e4 3564 /* Kill stalled connections */
bf4c6325 3565 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 3566 if (c->type == type && c->sent) {
6ed93dc6
AE		 3567 BT_ERR("%s killing stalled connection %pMR",
3568 hdev->name, &c->dst);
bed71748 3569 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 3570 }
3571 }
bf4c6325
GP		 3572
3573 rcu_read_unlock();
1da177e4
LT		 3574}
3575
6039aa73
GP		 3576static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3577 int *quote)
1da177e4 3578{
73d80deb
LAD		 3579 struct hci_conn_hash *h = &hdev->conn_hash;
3580 struct hci_chan *chan = NULL;
abc5de8f 3581 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 3582 struct hci_conn *conn;
73d80deb
LAD		 3583 int cnt, q, conn_num = 0;
3584
3585 BT_DBG("%s", hdev->name);
3586
bf4c6325
GP		 3587 rcu_read_lock();
3588
3589 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 3590 struct hci_chan *tmp;
3591
3592 if (conn->type != type)
3593 continue;
3594
3595 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3596 continue;
3597
3598 conn_num++;
3599
8192edef 3600 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 3601 struct sk_buff *skb;
3602
3603 if (skb_queue_empty(&tmp->data_q))
3604 continue;
3605
3606 skb = skb_peek(&tmp->data_q);
3607 if (skb->priority < cur_prio)
3608 continue;
3609
3610 if (skb->priority > cur_prio) {
3611 num = 0;
3612 min = ~0;
3613 cur_prio = skb->priority;
3614 }
3615
3616 num++;
3617
3618 if (conn->sent < min) {
3619 min = conn->sent;
3620 chan = tmp;
3621 }
3622 }
3623
3624 if (hci_conn_num(hdev, type) == conn_num)
3625 break;
3626 }
3627
bf4c6325
GP		 3628 rcu_read_unlock();
3629
73d80deb
LAD		 3630 if (!chan)
3631 return NULL;
3632
3633 switch (chan->conn->type) {
3634 case ACL_LINK:
3635 cnt = hdev->acl_cnt;
3636 break;
bd1eb66b
AE		 3637 case AMP_LINK:
3638 cnt = hdev->block_cnt;
3639 break;
73d80deb
LAD		 3640 case SCO_LINK:
3641 case ESCO_LINK:
3642 cnt = hdev->sco_cnt;
3643 break;
3644 case LE_LINK:
3645 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3646 break;
3647 default:
3648 cnt = 0;
3649 BT_ERR("Unknown link type");
3650 }
3651
3652 q = cnt / num;
3653 *quote = q ? q : 1;
3654 BT_DBG("chan %p quote %d", chan, *quote);
3655 return chan;
3656}
3657
02b20f0b
LAD		 3658static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3659{
3660 struct hci_conn_hash *h = &hdev->conn_hash;
3661 struct hci_conn *conn;
3662 int num = 0;
3663
3664 BT_DBG("%s", hdev->name);
3665
bf4c6325
GP		 3666 rcu_read_lock();
3667
3668 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 3669 struct hci_chan *chan;
3670
3671 if (conn->type != type)
3672 continue;
3673
3674 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3675 continue;
3676
3677 num++;
3678
8192edef 3679 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 3680 struct sk_buff *skb;
3681
3682 if (chan->sent) {
3683 chan->sent = 0;
3684 continue;
3685 }
3686
3687 if (skb_queue_empty(&chan->data_q))
3688 continue;
3689
3690 skb = skb_peek(&chan->data_q);
3691 if (skb->priority >= HCI_PRIO_MAX - 1)
3692 continue;
3693
3694 skb->priority = HCI_PRIO_MAX - 1;
3695
3696 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 3697 skb->priority);
02b20f0b
LAD		 3698 }
3699
3700 if (hci_conn_num(hdev, type) == num)
3701 break;
3702 }
bf4c6325
GP		 3703
3704 rcu_read_unlock();
3705
02b20f0b
LAD		 3706}
3707
b71d385a
AE		 3708static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3709{
3710 /* Calculate count of blocks used by this packet */
3711 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3712}
3713
6039aa73 3714static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 3715{
d7a5a11d 3716 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1da177e4
LT		 3717 /* ACL tx timeout must be longer than maximum
3718 * link supervision timeout (40.9 seconds) */
63d2bc1b 3719 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 3720 HCI_ACL_TX_TIMEOUT))
bae1f5d9 3721 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 3722 }
63d2bc1b 3723}
1da177e4 3724
6039aa73 3725static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 3726{
3727 unsigned int cnt = hdev->acl_cnt;
3728 struct hci_chan *chan;
3729 struct sk_buff *skb;
3730 int quote;
3731
3732 __check_timeout(hdev, cnt);
04837f64 3733
73d80deb 3734 while (hdev->acl_cnt &&
a8c5fb1a 3735 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 3736 u32 priority = (skb_peek(&chan->data_q))->priority;
3737 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3738 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3739 skb->len, skb->priority);
73d80deb 3740
ec1cce24
LAD		 3741 /* Stop if priority has changed */
3742 if (skb->priority < priority)
3743 break;
3744
3745 skb = skb_dequeue(&chan->data_q);
3746
73d80deb 3747 hci_conn_enter_active_mode(chan->conn,
04124681 3748 bt_cb(skb)->force_active);
04837f64 3749
57d17d70 3750 hci_send_frame(hdev, skb);
1da177e4
LT		 3751 hdev->acl_last_tx = jiffies;
3752
3753 hdev->acl_cnt--;
73d80deb
LAD		 3754 chan->sent++;
3755 chan->conn->sent++;
1da177e4
LT		 3756 }
3757 }
02b20f0b
LAD		 3758
3759 if (cnt != hdev->acl_cnt)
3760 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 3761}
3762
6039aa73 3763static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 3764{
63d2bc1b 3765 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 3766 struct hci_chan *chan;
3767 struct sk_buff *skb;
3768 int quote;
bd1eb66b 3769 u8 type;
b71d385a 3770
63d2bc1b 3771 __check_timeout(hdev, cnt);
b71d385a 3772
bd1eb66b
AE		 3773 BT_DBG("%s", hdev->name);
3774
3775 if (hdev->dev_type == HCI_AMP)
3776 type = AMP_LINK;
3777 else
3778 type = ACL_LINK;
3779
b71d385a 3780 while (hdev->block_cnt > 0 &&
bd1eb66b 3781 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 3782 u32 priority = (skb_peek(&chan->data_q))->priority;
3783 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3784 int blocks;
3785
3786 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3787 skb->len, skb->priority);
b71d385a
AE		 3788
3789 /* Stop if priority has changed */
3790 if (skb->priority < priority)
3791 break;
3792
3793 skb = skb_dequeue(&chan->data_q);
3794
3795 blocks = __get_blocks(hdev, skb);
3796 if (blocks > hdev->block_cnt)
3797 return;
3798
3799 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 3800 bt_cb(skb)->force_active);
b71d385a 3801
57d17d70 3802 hci_send_frame(hdev, skb);
b71d385a
AE		 3803 hdev->acl_last_tx = jiffies;
3804
3805 hdev->block_cnt -= blocks;
3806 quote -= blocks;
3807
3808 chan->sent += blocks;
3809 chan->conn->sent += blocks;
3810 }
3811 }
3812
3813 if (cnt != hdev->block_cnt)
bd1eb66b 3814 hci_prio_recalculate(hdev, type);
b71d385a
AE		 3815}
3816
6039aa73 3817static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 3818{
3819 BT_DBG("%s", hdev->name);
3820
bd1eb66b
AE		 3821 /* No ACL link over BR/EDR controller */
3822 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3823 return;
3824
3825 /* No AMP link over AMP controller */
3826 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 3827 return;
3828
3829 switch (hdev->flow_ctl_mode) {
3830 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3831 hci_sched_acl_pkt(hdev);
3832 break;
3833
3834 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3835 hci_sched_acl_blk(hdev);
3836 break;
3837 }
3838}
3839
1da177e4 3840/* Schedule SCO */
6039aa73 3841static void hci_sched_sco(struct hci_dev *hdev)
1da177e4
LT		 3842{
3843 struct hci_conn *conn;
3844 struct sk_buff *skb;
3845 int quote;
3846
3847 BT_DBG("%s", hdev->name);
3848
52087a79
LAD		 3849 if (!hci_conn_num(hdev, SCO_LINK))
3850 return;
3851
1da177e4
LT		 3852 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3853 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3854 BT_DBG("skb %p len %d", skb, skb->len);
57d17d70 3855 hci_send_frame(hdev, skb);
1da177e4
LT		 3856
3857 conn->sent++;
3858 if (conn->sent == ~0)
3859 conn->sent = 0;
3860 }
3861 }
3862}
3863
6039aa73 3864static void hci_sched_esco(struct hci_dev *hdev)
b6a0dc82
MH		 3865{
3866 struct hci_conn *conn;
3867 struct sk_buff *skb;
3868 int quote;
3869
3870 BT_DBG("%s", hdev->name);
3871
52087a79
LAD		 3872 if (!hci_conn_num(hdev, ESCO_LINK))
3873 return;
3874
8fc9ced3
GP		 3875 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3876 &quote))) {
b6a0dc82
MH		 3877 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3878 BT_DBG("skb %p len %d", skb, skb->len);
57d17d70 3879 hci_send_frame(hdev, skb);
b6a0dc82
MH		 3880
3881 conn->sent++;
3882 if (conn->sent == ~0)
3883 conn->sent = 0;
3884 }
3885 }
3886}
3887
6039aa73 3888static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 3889{
73d80deb 3890 struct hci_chan *chan;
6ed58ec5 3891 struct sk_buff *skb;
02b20f0b 3892 int quote, cnt, tmp;
6ed58ec5
VT		 3893
3894 BT_DBG("%s", hdev->name);
3895
52087a79
LAD		 3896 if (!hci_conn_num(hdev, LE_LINK))
3897 return;
3898
d7a5a11d 3899 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6ed58ec5
VT		 3900 /* LE tx timeout must be longer than maximum
3901 * link supervision timeout (40.9 seconds) */
bae1f5d9 3902 if (!hdev->le_cnt && hdev->le_pkts &&
a8c5fb1a 3903 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 3904 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 3905 }
3906
3907 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 3908 tmp = cnt;
73d80deb 3909 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 3910 u32 priority = (skb_peek(&chan->data_q))->priority;
3911 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3912 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3913 skb->len, skb->priority);
6ed58ec5 3914
ec1cce24
LAD		 3915 /* Stop if priority has changed */
3916 if (skb->priority < priority)
3917 break;
3918
3919 skb = skb_dequeue(&chan->data_q);
3920
57d17d70 3921 hci_send_frame(hdev, skb);
6ed58ec5
VT		 3922 hdev->le_last_tx = jiffies;
3923
3924 cnt--;
73d80deb
LAD		 3925 chan->sent++;
3926 chan->conn->sent++;
6ed58ec5
VT		 3927 }
3928 }
73d80deb 3929
6ed58ec5
VT		 3930 if (hdev->le_pkts)
3931 hdev->le_cnt = cnt;
3932 else
3933 hdev->acl_cnt = cnt;
02b20f0b
LAD		 3934
3935 if (cnt != tmp)
3936 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 3937}
3938
3eff45ea 3939static void hci_tx_work(struct work_struct *work)
1da177e4 3940{
3eff45ea 3941 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 3942 struct sk_buff *skb;
3943
6ed58ec5 3944 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 3945 hdev->sco_cnt, hdev->le_cnt);
1da177e4 3946
d7a5a11d 3947 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
52de599e
MH		 3948 /* Schedule queues and send stuff to HCI driver */
3949 hci_sched_acl(hdev);
3950 hci_sched_sco(hdev);
3951 hci_sched_esco(hdev);
3952 hci_sched_le(hdev);
3953 }
6ed58ec5 3954
1da177e4
LT		 3955 /* Send next queued raw (unknown type) packet */
3956 while ((skb = skb_dequeue(&hdev->raw_q)))
57d17d70 3957 hci_send_frame(hdev, skb);
1da177e4
LT		 3958}
3959
25985edc 3960/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 3961
3962/* ACL data packet */
6039aa73 3963static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3964{
3965 struct hci_acl_hdr *hdr = (void *) skb->data;
3966 struct hci_conn *conn;
3967 __u16 handle, flags;
3968
3969 skb_pull(skb, HCI_ACL_HDR_SIZE);
3970
3971 handle = __le16_to_cpu(hdr->handle);
3972 flags = hci_flags(handle);
3973 handle = hci_handle(handle);
3974
f0e09510 3975 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 3976 handle, flags);
1da177e4
LT		 3977
3978 hdev->stat.acl_rx++;
3979
3980 hci_dev_lock(hdev);
3981 conn = hci_conn_hash_lookup_handle(hdev, handle);
3982 hci_dev_unlock(hdev);
8e87d142 3983
1da177e4 3984 if (conn) {
65983fc7 3985 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 3986
1da177e4 3987 /* Send to upper protocol */
686ebf28
UF		 3988 l2cap_recv_acldata(conn, skb, flags);
3989 return;
1da177e4 3990 } else {
8e87d142 3991 BT_ERR("%s ACL packet for unknown connection handle %d",
a8c5fb1a 3992 hdev->name, handle);
1da177e4
LT		 3993 }
3994
3995 kfree_skb(skb);
3996}
3997
3998/* SCO data packet */
6039aa73 3999static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 4000{
4001 struct hci_sco_hdr *hdr = (void *) skb->data;
4002 struct hci_conn *conn;
4003 __u16 handle;
4004
4005 skb_pull(skb, HCI_SCO_HDR_SIZE);
4006
4007 handle = __le16_to_cpu(hdr->handle);
4008
f0e09510 4009 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
1da177e4
LT		 4010
4011 hdev->stat.sco_rx++;
4012
4013 hci_dev_lock(hdev);
4014 conn = hci_conn_hash_lookup_handle(hdev, handle);
4015 hci_dev_unlock(hdev);
4016
4017 if (conn) {
1da177e4 4018 /* Send to upper protocol */
686ebf28
UF		 4019 sco_recv_scodata(conn, skb);
4020 return;
1da177e4 4021 } else {
8e87d142 4022 BT_ERR("%s SCO packet for unknown connection handle %d",
a8c5fb1a 4023 hdev->name, handle);
1da177e4
LT		 4024 }
4025
4026 kfree_skb(skb);
4027}
4028
9238f36a
JH		 4029static bool hci_req_is_complete(struct hci_dev *hdev)
4030{
4031 struct sk_buff *skb;
4032
4033 skb = skb_peek(&hdev->cmd_q);
4034 if (!skb)
4035 return true;
4036
44d27137 4037 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
9238f36a
JH		 4038}
4039
42c6b129
JH		 4040static void hci_resend_last(struct hci_dev *hdev)
4041{
4042 struct hci_command_hdr *sent;
4043 struct sk_buff *skb;
4044 u16 opcode;
4045
4046 if (!hdev->sent_cmd)
4047 return;
4048
4049 sent = (void *) hdev->sent_cmd->data;
4050 opcode = __le16_to_cpu(sent->opcode);
4051 if (opcode == HCI_OP_RESET)
4052 return;
4053
4054 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4055 if (!skb)
4056 return;
4057
4058 skb_queue_head(&hdev->cmd_q, skb);
4059 queue_work(hdev->workqueue, &hdev->cmd_work);
4060}
4061
e6214487
JH		 4062void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4063 hci_req_complete_t *req_complete,
4064 hci_req_complete_skb_t *req_complete_skb)
9238f36a 4065{
9238f36a
JH		 4066 struct sk_buff *skb;
4067 unsigned long flags;
4068
4069 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4070
42c6b129
JH		 4071 /* If the completed command doesn't match the last one that was
4072 * sent we need to do special handling of it.
9238f36a 4073 */
42c6b129
JH		 4074 if (!hci_sent_cmd_data(hdev, opcode)) {
4075 /* Some CSR based controllers generate a spontaneous
4076 * reset complete event during init and any pending
4077 * command will never be completed. In such a case we
4078 * need to resend whatever was the last sent
4079 * command.
4080 */
4081 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4082 hci_resend_last(hdev);
4083
9238f36a 4084 return;
42c6b129 4085 }
9238f36a
JH		 4086
4087 /* If the command succeeded and there's still more commands in
4088 * this request the request is not yet complete.
4089 */
4090 if (!status && !hci_req_is_complete(hdev))
4091 return;
4092
4093 /* If this was the last command in a request the complete
4094 * callback would be found in hdev->sent_cmd instead of the
4095 * command queue (hdev->cmd_q).
4096 */
44d27137
JH		 4097 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4098 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
e6214487
JH		 4099 return;
4100 }
53e21fbc 4101
44d27137
JH		 4102 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4103 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
e6214487 4104 return;
9238f36a
JH		 4105 }
4106
4107 /* Remove all pending commands belonging to this request */
4108 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4109 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
44d27137 4110 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
9238f36a
JH		 4111 __skb_queue_head(&hdev->cmd_q, skb);
4112 break;
4113 }
4114
3bd7594e
DA		 4115 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4116 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4117 else
4118 *req_complete = bt_cb(skb)->hci.req_complete;
9238f36a
JH		 4119 kfree_skb(skb);
4120 }
4121 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
9238f36a
JH		 4122}
4123
b78752cc 4124static void hci_rx_work(struct work_struct *work)
1da177e4 4125{
b78752cc 4126 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 4127 struct sk_buff *skb;
4128
4129 BT_DBG("%s", hdev->name);
4130
1da177e4 4131 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 4132 /* Send copy to monitor */
4133 hci_send_to_monitor(hdev, skb);
4134
1da177e4
LT		 4135 if (atomic_read(&hdev->promisc)) {
4136 /* Send copy to the sockets */
470fe1b5 4137 hci_send_to_sock(hdev, skb);
1da177e4
LT		 4138 }
4139
d7a5a11d 4140 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1da177e4
LT		 4141 kfree_skb(skb);
4142 continue;
4143 }
4144
4145 if (test_bit(HCI_INIT, &hdev->flags)) {
4146 /* Don't process data packets in this states. */
d79f34e3 4147 switch (hci_skb_pkt_type(skb)) {
1da177e4
LT		 4148 case HCI_ACLDATA_PKT:
4149 case HCI_SCODATA_PKT:
4150 kfree_skb(skb);
4151 continue;
3ff50b79 4152 }
1da177e4
LT		 4153 }
4154
4155 /* Process frame */
d79f34e3 4156 switch (hci_skb_pkt_type(skb)) {
1da177e4 4157 case HCI_EVENT_PKT:
b78752cc 4158 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 4159 hci_event_packet(hdev, skb);
4160 break;
4161
4162 case HCI_ACLDATA_PKT:
4163 BT_DBG("%s ACL data packet", hdev->name);
4164 hci_acldata_packet(hdev, skb);
4165 break;
4166
4167 case HCI_SCODATA_PKT:
4168 BT_DBG("%s SCO data packet", hdev->name);
4169 hci_scodata_packet(hdev, skb);
4170 break;
4171
4172 default:
4173 kfree_skb(skb);
4174 break;
4175 }
4176 }
1da177e4
LT		 4177}
4178
c347b765 4179static void hci_cmd_work(struct work_struct *work)
1da177e4 4180{
c347b765 4181 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 4182 struct sk_buff *skb;
4183
2104786b
AE		 4184 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4185 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 4186
1da177e4 4187 /* Send queued commands */
5a08ecce
AE		 4188 if (atomic_read(&hdev->cmd_cnt)) {
4189 skb = skb_dequeue(&hdev->cmd_q);
4190 if (!skb)
4191 return;
4192
7585b97a 4193 kfree_skb(hdev->sent_cmd);
1da177e4 4194
a675d7f1 4195 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
70f23020 4196 if (hdev->sent_cmd) {
1da177e4 4197 atomic_dec(&hdev->cmd_cnt);
57d17d70 4198 hci_send_frame(hdev, skb);
7bdb8a5c 4199 if (test_bit(HCI_RESET, &hdev->flags))
65cc2b49 4200 cancel_delayed_work(&hdev->cmd_timer);
7bdb8a5c 4201 else
65cc2b49
MH		 4202 schedule_delayed_work(&hdev->cmd_timer,
4203 HCI_CMD_TIMEOUT);
1da177e4
LT		 4204 } else {
4205 skb_queue_head(&hdev->cmd_q, skb);
c347b765 4206 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4207 }
4208 }
4209}
Linux 6.x block layer and io_uring tree(s)