projects / linux-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Merge tag 'soc-dt-6.4' of git://git.kernel.org/pub/scm/linux/kernel/git/soc/soc
[linux-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
8c520a59 29#include <linux/rfkill.h>
baf27f6e 30#include <linux/debugfs.h>
99780a7b 31#include <linux/crypto.h>
9f30de9e 32#include <linux/kcov.h>
7a0e5b15 33#include <linux/property.h>
9952d90e
APS		 34#include <linux/suspend.h>
35#include <linux/wait.h>
47219839 36#include <asm/unaligned.h>
1da177e4
LT		 37
38#include <net/bluetooth/bluetooth.h>
39#include <net/bluetooth/hci_core.h>
4bc58f51 40#include <net/bluetooth/l2cap.h>
af58925c 41#include <net/bluetooth/mgmt.h>
1da177e4 42
0857dd3b 43#include "hci_request.h"
60c5f5fb 44#include "hci_debugfs.h"
970c4e46 45#include "smp.h"
6d5d2ee6 46#include "leds.h"
145373cb 47#include "msft.h"
f67743f9 48#include "aosp.h"
8961987f 49#include "hci_codec.h"
970c4e46 50
b78752cc 51static void hci_rx_work(struct work_struct *work);
c347b765 52static void hci_cmd_work(struct work_struct *work);
3eff45ea 53static void hci_tx_work(struct work_struct *work);
1da177e4 54
1da177e4
LT		 55/* HCI device list */
56LIST_HEAD(hci_dev_list);
57DEFINE_RWLOCK(hci_dev_list_lock);
58
59/* HCI callback list */
60LIST_HEAD(hci_cb_list);
fba7ecf0 61DEFINE_MUTEX(hci_cb_list_lock);
1da177e4 62
3df92b31
SL		 63/* HCI ID Numbering */
64static DEFINE_IDA(hci_index_ida);
65
a1d01db1 66static int hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 67{
68 __u8 scan = opt;
69
42c6b129 70 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 71
72 /* Inquiry and Page scans */
42c6b129 73 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
a1d01db1 74 return 0;
1da177e4
LT		 75}
76
a1d01db1 77static int hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 78{
79 __u8 auth = opt;
80
42c6b129 81 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 82
83 /* Authentication */
42c6b129 84 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
a1d01db1 85 return 0;
1da177e4
LT		 86}
87
a1d01db1 88static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 89{
90 __u8 encrypt = opt;
91
42c6b129 92 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 93
e4e8e37c 94 /* Encryption */
42c6b129 95 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
a1d01db1 96 return 0;
1da177e4
LT		 97}
98
a1d01db1 99static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 100{
101 __le16 policy = cpu_to_le16(opt);
102
42c6b129 103 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 104
105 /* Default link policy */
42c6b129 106 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
a1d01db1 107 return 0;
e4e8e37c
MH		 108}
109
8e87d142 110/* Get HCI device by index.
1da177e4
LT		 111 * Device is held on return. */
112struct hci_dev *hci_dev_get(int index)
113{
8035ded4 114 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 115
116 BT_DBG("%d", index);
117
118 if (index < 0)
119 return NULL;
120
121 read_lock(&hci_dev_list_lock);
8035ded4 122 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 123 if (d->id == index) {
124 hdev = hci_dev_hold(d);
125 break;
126 }
127 }
128 read_unlock(&hci_dev_list_lock);
129 return hdev;
130}
1da177e4
LT		 131
132/* ---- Inquiry support ---- */
ff9ef578 133
30dc78e1
JH		 134bool hci_discovery_active(struct hci_dev *hdev)
135{
136 struct discovery_state *discov = &hdev->discovery;
137
6fbe195d 138 switch (discov->state) {
343f935b 139 case DISCOVERY_FINDING:
6fbe195d 140 case DISCOVERY_RESOLVING:
30dc78e1
JH		 141 return true;
142
6fbe195d
AG		 143 default:
144 return false;
145 }
30dc78e1
JH		 146}
147
ff9ef578
JH		 148void hci_discovery_set_state(struct hci_dev *hdev, int state)
149{
bb3e0a33
JH		 150 int old_state = hdev->discovery.state;
151
ff9ef578
JH		 152 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
153
bb3e0a33 154 if (old_state == state)
ff9ef578
JH		 155 return;
156
bb3e0a33
JH		 157 hdev->discovery.state = state;
158
ff9ef578
JH		 159 switch (state) {
160 case DISCOVERY_STOPPED:
5bee2fd6 161 hci_update_passive_scan(hdev);
c54c3860 162
bb3e0a33 163 if (old_state != DISCOVERY_STARTING)
7b99b659 164 mgmt_discovering(hdev, 0);
ff9ef578
JH		 165 break;
166 case DISCOVERY_STARTING:
167 break;
343f935b 168 case DISCOVERY_FINDING:
ff9ef578
JH		 169 mgmt_discovering(hdev, 1);
170 break;
30dc78e1
JH		 171 case DISCOVERY_RESOLVING:
172 break;
ff9ef578
JH		 173 case DISCOVERY_STOPPING:
174 break;
175 }
ff9ef578
JH		 176}
177
1f9b9a5d 178void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 179{
30883512 180 struct discovery_state *cache = &hdev->discovery;
b57c1a56 181 struct inquiry_entry *p, *n;
1da177e4 182
561aafbc
JH		 183 list_for_each_entry_safe(p, n, &cache->all, all) {
184 list_del(&p->all);
b57c1a56 185 kfree(p);
1da177e4 186 }
561aafbc
JH		 187
188 INIT_LIST_HEAD(&cache->unknown);
189 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 190}
191
a8c5fb1a
GP		 192struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
193 bdaddr_t *bdaddr)
1da177e4 194{
30883512 195 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 196 struct inquiry_entry *e;
197
6ed93dc6 198 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 199
561aafbc
JH		 200 list_for_each_entry(e, &cache->all, all) {
201 if (!bacmp(&e->data.bdaddr, bdaddr))
202 return e;
203 }
204
205 return NULL;
206}
207
208struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 209 bdaddr_t *bdaddr)
561aafbc 210{
30883512 211 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 212 struct inquiry_entry *e;
213
6ed93dc6 214 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 215
216 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 217 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 218 return e;
219 }
220
221 return NULL;
1da177e4
LT		 222}
223
30dc78e1 224struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 225 bdaddr_t *bdaddr,
226 int state)
30dc78e1
JH		 227{
228 struct discovery_state *cache = &hdev->discovery;
229 struct inquiry_entry *e;
230
6ed93dc6 231 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 232
233 list_for_each_entry(e, &cache->resolve, list) {
234 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
235 return e;
236 if (!bacmp(&e->data.bdaddr, bdaddr))
237 return e;
238 }
239
240 return NULL;
241}
242
a3d4e20a 243void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 244 struct inquiry_entry *ie)
a3d4e20a
JH		 245{
246 struct discovery_state *cache = &hdev->discovery;
247 struct list_head *pos = &cache->resolve;
248 struct inquiry_entry *p;
249
250 list_del(&ie->list);
251
252 list_for_each_entry(p, &cache->resolve, list) {
253 if (p->name_state != NAME_PENDING &&
a8c5fb1a 254 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 255 break;
256 pos = &p->list;
257 }
258
259 list_add(&ie->list, pos);
260}
261
af58925c
MH		 262u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
263 bool name_known)
1da177e4 264{
30883512 265 struct discovery_state *cache = &hdev->discovery;
70f23020 266 struct inquiry_entry *ie;
af58925c 267 u32 flags = 0;
1da177e4 268
6ed93dc6 269 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 270
6928a924 271 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
2b2fec4d 272
af58925c
MH		 273 if (!data->ssp_mode)
274 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 275
70f23020 276 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 277 if (ie) {
af58925c
MH		 278 if (!ie->data.ssp_mode)
279 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 280
a3d4e20a 281 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 282 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 283 ie->data.rssi = data->rssi;
284 hci_inquiry_cache_update_resolve(hdev, ie);
285 }
286
561aafbc 287 goto update;
a3d4e20a 288 }
561aafbc
JH		 289
290 /* Entry not in the cache. Add new one. */
27f70f3e 291 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
af58925c
MH		 292 if (!ie) {
293 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
294 goto done;
295 }
561aafbc
JH		 296
297 list_add(&ie->all, &cache->all);
298
299 if (name_known) {
300 ie->name_state = NAME_KNOWN;
301 } else {
302 ie->name_state = NAME_NOT_KNOWN;
303 list_add(&ie->list, &cache->unknown);
304 }
70f23020 305
561aafbc
JH		 306update:
307 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 308 ie->name_state != NAME_PENDING) {
561aafbc
JH		 309 ie->name_state = NAME_KNOWN;
310 list_del(&ie->list);
1da177e4
LT		 311 }
312
70f23020
AE		 313 memcpy(&ie->data, data, sizeof(*data));
314 ie->timestamp = jiffies;
1da177e4 315 cache->timestamp = jiffies;
3175405b
JH		 316
317 if (ie->name_state == NAME_NOT_KNOWN)
af58925c 318 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
3175405b 319
af58925c
MH		 320done:
321 return flags;
1da177e4
LT		 322}
323
324static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
325{
30883512 326 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 327 struct inquiry_info *info = (struct inquiry_info *) buf;
328 struct inquiry_entry *e;
329 int copied = 0;
330
561aafbc 331 list_for_each_entry(e, &cache->all, all) {
1da177e4 332 struct inquiry_data *data = &e->data;
b57c1a56
JH		 333
334 if (copied >= num)
335 break;
336
1da177e4
LT		 337 bacpy(&info->bdaddr, &data->bdaddr);
338 info->pscan_rep_mode = data->pscan_rep_mode;
339 info->pscan_period_mode = data->pscan_period_mode;
340 info->pscan_mode = data->pscan_mode;
341 memcpy(info->dev_class, data->dev_class, 3);
342 info->clock_offset = data->clock_offset;
b57c1a56 343
1da177e4 344 info++;
b57c1a56 345 copied++;
1da177e4
LT		 346 }
347
348 BT_DBG("cache %p, copied %d", cache, copied);
349 return copied;
350}
351
a1d01db1 352static int hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 353{
354 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 355 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 356 struct hci_cp_inquiry cp;
357
358 BT_DBG("%s", hdev->name);
359
360 if (test_bit(HCI_INQUIRY, &hdev->flags))
a1d01db1 361 return 0;
1da177e4
LT		 362
363 /* Start Inquiry */
364 memcpy(&cp.lap, &ir->lap, 3);
365 cp.length = ir->length;
366 cp.num_rsp = ir->num_rsp;
42c6b129 367 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
a1d01db1
JH		 368
369 return 0;
1da177e4
LT		 370}
371
372int hci_inquiry(void __user *arg)
373{
374 __u8 __user *ptr = arg;
375 struct hci_inquiry_req ir;
376 struct hci_dev *hdev;
377 int err = 0, do_inquiry = 0, max_rsp;
378 long timeo;
379 __u8 *buf;
380
381 if (copy_from_user(&ir, ptr, sizeof(ir)))
382 return -EFAULT;
383
5a08ecce
AE		 384 hdev = hci_dev_get(ir.dev_id);
385 if (!hdev)
1da177e4
LT		 386 return -ENODEV;
387
d7a5a11d 388 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 389 err = -EBUSY;
390 goto done;
391 }
392
d7a5a11d 393 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 394 err = -EOPNOTSUPP;
395 goto done;
396 }
397
ca8bee5d 398 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 399 err = -EOPNOTSUPP;
400 goto done;
401 }
402
d7a5a11d 403 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 404 err = -EOPNOTSUPP;
405 goto done;
406 }
407
f41a4b2b
PS		 408 /* Restrict maximum inquiry length to 60 seconds */
409 if (ir.length > 60) {
410 err = -EINVAL;
411 goto done;
412 }
413
09fd0de5 414 hci_dev_lock(hdev);
8e87d142 415 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 416 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 417 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 418 do_inquiry = 1;
419 }
09fd0de5 420 hci_dev_unlock(hdev);
1da177e4 421
04837f64 422 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 423
424 if (do_inquiry) {
01178cd4 425 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
4ebeee2d 426 timeo, NULL);
70f23020
AE		 427 if (err < 0)
428 goto done;
3e13fa1e
AG		 429
430 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
431 * cleared). If it is interrupted by a signal, return -EINTR.
432 */
74316201 433 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
28a758c8
PB		 434 TASK_INTERRUPTIBLE)) {
435 err = -EINTR;
436 goto done;
437 }
70f23020 438 }
1da177e4 439
8fc9ced3
GP		 440 /* for unlimited number of responses we will use buffer with
441 * 255 entries
442 */
1da177e4
LT		 443 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
444
445 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
446 * copy it to the user space.
447 */
6da2ec56 448 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
70f23020 449 if (!buf) {
1da177e4
LT		 450 err = -ENOMEM;
451 goto done;
452 }
453
09fd0de5 454 hci_dev_lock(hdev);
1da177e4 455 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 456 hci_dev_unlock(hdev);
1da177e4
LT		 457
458 BT_DBG("num_rsp %d", ir.num_rsp);
459
460 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
461 ptr += sizeof(ir);
462 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 463 ir.num_rsp))
1da177e4 464 err = -EFAULT;
8e87d142 465 } else
1da177e4
LT		 466 err = -EFAULT;
467
468 kfree(buf);
469
470done:
471 hci_dev_put(hdev);
472 return err;
473}
474
cf75ad8b
LAD		 475static int hci_dev_do_open(struct hci_dev *hdev)
476{
477 int ret = 0;
478
479 BT_DBG("%s %p", hdev->name, hdev);
480
481 hci_req_sync_lock(hdev);
482
483 ret = hci_dev_open_sync(hdev);
484
b504430c 485 hci_req_sync_unlock(hdev);
1da177e4
LT		 486 return ret;
487}
488
cbed0ca1
JH		 489/* ---- HCI ioctl helpers ---- */
490
491int hci_dev_open(__u16 dev)
492{
493 struct hci_dev *hdev;
494 int err;
495
496 hdev = hci_dev_get(dev);
497 if (!hdev)
498 return -ENODEV;
499
4a964404 500 /* Devices that are marked as unconfigured can only be powered
fee746b0
MH		 501 * up as user channel. Trying to bring them up as normal devices
502 * will result into a failure. Only user channel operation is
503 * possible.
504 *
505 * When this function is called for a user channel, the flag
506 * HCI_USER_CHANNEL will be set first before attempting to
507 * open the device.
508 */
d7a5a11d
MH		 509 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
510 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
fee746b0
MH		 511 err = -EOPNOTSUPP;
512 goto done;
513 }
514
e1d08f40
JH		 515 /* We need to ensure that no other power on/off work is pending
516 * before proceeding to call hci_dev_do_open. This is
517 * particularly important if the setup procedure has not yet
518 * completed.
519 */
a69d8927 520 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
e1d08f40
JH		 521 cancel_delayed_work(&hdev->power_off);
522
a5c8f270
MH		 523 /* After this call it is guaranteed that the setup procedure
524 * has finished. This means that error conditions like RFKILL
525 * or no valid public or static random address apply.
526 */
e1d08f40
JH		 527 flush_workqueue(hdev->req_workqueue);
528
12aa4f0a 529 /* For controllers not using the management interface and that
b6ae8457 530 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
12aa4f0a
MH		 531 * so that pairing works for them. Once the management interface
532 * is in use this bit will be cleared again and userspace has
533 * to explicitly enable it.
534 */
d7a5a11d
MH		 535 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
536 !hci_dev_test_flag(hdev, HCI_MGMT))
a1536da2 537 hci_dev_set_flag(hdev, HCI_BONDABLE);
12aa4f0a 538
cbed0ca1
JH		 539 err = hci_dev_do_open(hdev);
540
fee746b0 541done:
cbed0ca1 542 hci_dev_put(hdev);
cbed0ca1
JH		 543 return err;
544}
545
cf75ad8b
LAD		 546int hci_dev_do_close(struct hci_dev *hdev)
547{
548 int err;
549
550 BT_DBG("%s %p", hdev->name, hdev);
551
552 hci_req_sync_lock(hdev);
553
554 err = hci_dev_close_sync(hdev);
555
b504430c 556 hci_req_sync_unlock(hdev);
1da177e4 557
61969ef8 558 return err;
1da177e4
LT		 559}
560
561int hci_dev_close(__u16 dev)
562{
563 struct hci_dev *hdev;
564 int err;
565
70f23020
AE		 566 hdev = hci_dev_get(dev);
567 if (!hdev)
1da177e4 568 return -ENODEV;
8ee56540 569
d7a5a11d 570 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 571 err = -EBUSY;
572 goto done;
573 }
574
e36bea6e 575 cancel_work_sync(&hdev->power_on);
a69d8927 576 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
8ee56540
MH		 577 cancel_delayed_work(&hdev->power_off);
578
1da177e4 579 err = hci_dev_do_close(hdev);
8ee56540 580
0736cfa8 581done:
1da177e4
LT		 582 hci_dev_put(hdev);
583 return err;
584}
585
5c912495 586static int hci_dev_do_reset(struct hci_dev *hdev)
1da177e4 587{
5c912495 588 int ret;
1da177e4 589
5c912495 590 BT_DBG("%s %p", hdev->name, hdev);
1da177e4 591
b504430c 592 hci_req_sync_lock(hdev);
1da177e4 593
1da177e4
LT		 594 /* Drop queues */
595 skb_queue_purge(&hdev->rx_q);
596 skb_queue_purge(&hdev->cmd_q);
597
877afada
SS		 598 /* Cancel these to avoid queueing non-chained pending work */
599 hci_dev_set_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
deee93d1
TH		 600 /* Wait for
601 *
602 * if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
603 * queue_delayed_work(&hdev->{cmd,ncmd}_timer)
604 *
605 * inside RCU section to see the flag or complete scheduling.
606 */
607 synchronize_rcu();
608 /* Explicitly cancel works in case scheduled after setting the flag. */
877afada
SS		 609 cancel_delayed_work(&hdev->cmd_timer);
610 cancel_delayed_work(&hdev->ncmd_timer);
611
76727c02
JH		 612 /* Avoid potential lockdep warnings from the *_flush() calls by
613 * ensuring the workqueue is empty up front.
614 */
615 drain_workqueue(hdev->workqueue);
616
09fd0de5 617 hci_dev_lock(hdev);
1f9b9a5d 618 hci_inquiry_cache_flush(hdev);
1da177e4 619 hci_conn_hash_flush(hdev);
09fd0de5 620 hci_dev_unlock(hdev);
1da177e4
LT		 621
622 if (hdev->flush)
623 hdev->flush(hdev);
624
877afada
SS		 625 hci_dev_clear_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
626
8e87d142 627 atomic_set(&hdev->cmd_cnt, 1);
26afbd82
LAD		 628 hdev->acl_cnt = 0;
629 hdev->sco_cnt = 0;
630 hdev->le_cnt = 0;
631 hdev->iso_cnt = 0;
1da177e4 632
d0b13706 633 ret = hci_reset_sync(hdev);
1da177e4 634
b504430c 635 hci_req_sync_unlock(hdev);
1da177e4
LT		 636 return ret;
637}
638
5c912495
MH		 639int hci_dev_reset(__u16 dev)
640{
641 struct hci_dev *hdev;
642 int err;
643
644 hdev = hci_dev_get(dev);
645 if (!hdev)
646 return -ENODEV;
647
648 if (!test_bit(HCI_UP, &hdev->flags)) {
649 err = -ENETDOWN;
650 goto done;
651 }
652
d7a5a11d 653 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
5c912495
MH		 654 err = -EBUSY;
655 goto done;
656 }
657
d7a5a11d 658 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
5c912495
MH		 659 err = -EOPNOTSUPP;
660 goto done;
661 }
662
663 err = hci_dev_do_reset(hdev);
664
665done:
666 hci_dev_put(hdev);
667 return err;
668}
669
1da177e4
LT		 670int hci_dev_reset_stat(__u16 dev)
671{
672 struct hci_dev *hdev;
673 int ret = 0;
674
70f23020
AE		 675 hdev = hci_dev_get(dev);
676 if (!hdev)
1da177e4
LT		 677 return -ENODEV;
678
d7a5a11d 679 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 680 ret = -EBUSY;
681 goto done;
682 }
683
d7a5a11d 684 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 685 ret = -EOPNOTSUPP;
686 goto done;
687 }
688
1da177e4
LT		 689 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
690
0736cfa8 691done:
1da177e4 692 hci_dev_put(hdev);
1da177e4
LT		 693 return ret;
694}
695
5bee2fd6 696static void hci_update_passive_scan_state(struct hci_dev *hdev, u8 scan)
123abc08 697{
bc6d2d04 698 bool conn_changed, discov_changed;
123abc08
JH		 699
700 BT_DBG("%s scan 0x%02x", hdev->name, scan);
701
702 if ((scan & SCAN_PAGE))
238be788
MH		 703 conn_changed = !hci_dev_test_and_set_flag(hdev,
704 HCI_CONNECTABLE);
123abc08 705 else
a69d8927
MH		 706 conn_changed = hci_dev_test_and_clear_flag(hdev,
707 HCI_CONNECTABLE);
123abc08 708
bc6d2d04 709 if ((scan & SCAN_INQUIRY)) {
238be788
MH		 710 discov_changed = !hci_dev_test_and_set_flag(hdev,
711 HCI_DISCOVERABLE);
bc6d2d04 712 } else {
a358dc11 713 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
a69d8927
MH		 714 discov_changed = hci_dev_test_and_clear_flag(hdev,
715 HCI_DISCOVERABLE);
bc6d2d04
JH		 716 }
717
d7a5a11d 718 if (!hci_dev_test_flag(hdev, HCI_MGMT))
123abc08
JH		 719 return;
720
bc6d2d04
JH		 721 if (conn_changed || discov_changed) {
722 /* In case this was disabled through mgmt */
a1536da2 723 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
bc6d2d04 724
d7a5a11d 725 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
651cd3d6 726 hci_update_adv_data(hdev, hdev->cur_adv_instance);
bc6d2d04 727
123abc08 728 mgmt_new_settings(hdev);
bc6d2d04 729 }
123abc08
JH		 730}
731
1da177e4
LT		 732int hci_dev_cmd(unsigned int cmd, void __user *arg)
733{
734 struct hci_dev *hdev;
735 struct hci_dev_req dr;
736 int err = 0;
737
738 if (copy_from_user(&dr, arg, sizeof(dr)))
739 return -EFAULT;
740
70f23020
AE		 741 hdev = hci_dev_get(dr.dev_id);
742 if (!hdev)
1da177e4
LT		 743 return -ENODEV;
744
d7a5a11d 745 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 746 err = -EBUSY;
747 goto done;
748 }
749
d7a5a11d 750 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 751 err = -EOPNOTSUPP;
752 goto done;
753 }
754
ca8bee5d 755 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 756 err = -EOPNOTSUPP;
757 goto done;
758 }
759
d7a5a11d 760 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 761 err = -EOPNOTSUPP;
762 goto done;
763 }
764
1da177e4
LT		 765 switch (cmd) {
766 case HCISETAUTH:
01178cd4 767 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 768 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 769 break;
770
771 case HCISETENCRYPT:
772 if (!lmp_encrypt_capable(hdev)) {
773 err = -EOPNOTSUPP;
774 break;
775 }
776
777 if (!test_bit(HCI_AUTH, &hdev->flags)) {
778 /* Auth must be enabled first */
01178cd4 779 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 780 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 781 if (err)
782 break;
783 }
784
01178cd4 785 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
4ebeee2d 786 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 787 break;
788
789 case HCISETSCAN:
01178cd4 790 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
4ebeee2d 791 HCI_INIT_TIMEOUT, NULL);
91a668b0 792
bc6d2d04
JH		 793 /* Ensure that the connectable and discoverable states
794 * get correctly modified as this was a non-mgmt change.
91a668b0 795 */
123abc08 796 if (!err)
5bee2fd6 797 hci_update_passive_scan_state(hdev, dr.dev_opt);
1da177e4
LT		 798 break;
799
1da177e4 800 case HCISETLINKPOL:
01178cd4 801 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
4ebeee2d 802 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 803 break;
804
805 case HCISETLINKMODE:
e4e8e37c
MH		 806 hdev->link_mode = ((__u16) dr.dev_opt) &
807 (HCI_LM_MASTER | HCI_LM_ACCEPT);
808 break;
809
810 case HCISETPTYPE:
b7c23df8
JK		 811 if (hdev->pkt_type == (__u16) dr.dev_opt)
812 break;
813
e4e8e37c 814 hdev->pkt_type = (__u16) dr.dev_opt;
b7c23df8 815 mgmt_phy_configuration_changed(hdev, NULL);
1da177e4
LT		 816 break;
817
818 case HCISETACLMTU:
e4e8e37c
MH		 819 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
820 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 821 break;
822
823 case HCISETSCOMTU:
e4e8e37c
MH		 824 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
825 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 826 break;
827
828 default:
829 err = -EINVAL;
830 break;
831 }
e4e8e37c 832
0736cfa8 833done:
1da177e4
LT		 834 hci_dev_put(hdev);
835 return err;
836}
837
838int hci_get_dev_list(void __user *arg)
839{
8035ded4 840 struct hci_dev *hdev;
1da177e4
LT		 841 struct hci_dev_list_req *dl;
842 struct hci_dev_req *dr;
1da177e4
LT		 843 int n = 0, size, err;
844 __u16 dev_num;
845
846 if (get_user(dev_num, (__u16 __user *) arg))
847 return -EFAULT;
848
849 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
850 return -EINVAL;
851
852 size = sizeof(*dl) + dev_num * sizeof(*dr);
853
70f23020
AE		 854 dl = kzalloc(size, GFP_KERNEL);
855 if (!dl)
1da177e4
LT		 856 return -ENOMEM;
857
858 dr = dl->dev_req;
859
f20d09d5 860 read_lock(&hci_dev_list_lock);
8035ded4 861 list_for_each_entry(hdev, &hci_dev_list, list) {
2e84d8db 862 unsigned long flags = hdev->flags;
c542a06c 863
2e84d8db
MH		 864 /* When the auto-off is configured it means the transport
865 * is running, but in that case still indicate that the
866 * device is actually down.
867 */
d7a5a11d 868 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db 869 flags &= ~BIT(HCI_UP);
c542a06c 870
1da177e4 871 (dr + n)->dev_id = hdev->id;
2e84d8db 872 (dr + n)->dev_opt = flags;
c542a06c 873
1da177e4
LT		 874 if (++n >= dev_num)
875 break;
876 }
f20d09d5 877 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 878
879 dl->dev_num = n;
880 size = sizeof(*dl) + n * sizeof(*dr);
881
882 err = copy_to_user(arg, dl, size);
883 kfree(dl);
884
885 return err ? -EFAULT : 0;
886}
887
888int hci_get_dev_info(void __user *arg)
889{
890 struct hci_dev *hdev;
891 struct hci_dev_info di;
2e84d8db 892 unsigned long flags;
1da177e4
LT		 893 int err = 0;
894
895 if (copy_from_user(&di, arg, sizeof(di)))
896 return -EFAULT;
897
70f23020
AE		 898 hdev = hci_dev_get(di.dev_id);
899 if (!hdev)
1da177e4
LT		 900 return -ENODEV;
901
2e84d8db
MH		 902 /* When the auto-off is configured it means the transport
903 * is running, but in that case still indicate that the
904 * device is actually down.
905 */
d7a5a11d 906 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db
MH		 907 flags = hdev->flags & ~BIT(HCI_UP);
908 else
909 flags = hdev->flags;
c542a06c 910
1da177e4
LT		 911 strcpy(di.name, hdev->name);
912 di.bdaddr = hdev->bdaddr;
60f2a3ed 913 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2e84d8db 914 di.flags = flags;
1da177e4 915 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 916 if (lmp_bredr_capable(hdev)) {
917 di.acl_mtu = hdev->acl_mtu;
918 di.acl_pkts = hdev->acl_pkts;
919 di.sco_mtu = hdev->sco_mtu;
920 di.sco_pkts = hdev->sco_pkts;
921 } else {
922 di.acl_mtu = hdev->le_mtu;
923 di.acl_pkts = hdev->le_pkts;
924 di.sco_mtu = 0;
925 di.sco_pkts = 0;
926 }
1da177e4
LT		 927 di.link_policy = hdev->link_policy;
928 di.link_mode = hdev->link_mode;
929
930 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
931 memcpy(&di.features, &hdev->features, sizeof(di.features));
932
933 if (copy_to_user(arg, &di, sizeof(di)))
934 err = -EFAULT;
935
936 hci_dev_put(hdev);
937
938 return err;
939}
940
941/* ---- Interface to HCI drivers ---- */
942
611b30f7
MH		 943static int hci_rfkill_set_block(void *data, bool blocked)
944{
945 struct hci_dev *hdev = data;
946
947 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
948
d7a5a11d 949 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
0736cfa8
MH		 950 return -EBUSY;
951
5e130367 952 if (blocked) {
a1536da2 953 hci_dev_set_flag(hdev, HCI_RFKILLED);
d7a5a11d
MH		 954 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
955 !hci_dev_test_flag(hdev, HCI_CONFIG))
bf543036 956 hci_dev_do_close(hdev);
5e130367 957 } else {
a358dc11 958 hci_dev_clear_flag(hdev, HCI_RFKILLED);
1025c04c 959 }
611b30f7
MH		 960
961 return 0;
962}
963
964static const struct rfkill_ops hci_rfkill_ops = {
965 .set_block = hci_rfkill_set_block,
966};
967
ab81cbf9
JH		 968static void hci_power_on(struct work_struct *work)
969{
970 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 971 int err;
ab81cbf9
JH		 972
973 BT_DBG("%s", hdev->name);
974
2ff13894
JH		 975 if (test_bit(HCI_UP, &hdev->flags) &&
976 hci_dev_test_flag(hdev, HCI_MGMT) &&
977 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
d82142a8 978 cancel_delayed_work(&hdev->power_off);
cf75ad8b 979 err = hci_powered_update_sync(hdev);
2ff13894
JH		 980 mgmt_power_on(hdev, err);
981 return;
982 }
983
cbed0ca1 984 err = hci_dev_do_open(hdev);
96570ffc 985 if (err < 0) {
3ad67582 986 hci_dev_lock(hdev);
96570ffc 987 mgmt_set_powered_failed(hdev, err);
3ad67582 988 hci_dev_unlock(hdev);
ab81cbf9 989 return;
96570ffc 990 }
ab81cbf9 991
a5c8f270
MH		 992 /* During the HCI setup phase, a few error conditions are
993 * ignored and they need to be checked now. If they are still
994 * valid, it is important to turn the device back off.
995 */
d7a5a11d
MH		 996 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
997 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
ca8bee5d 998 (hdev->dev_type == HCI_PRIMARY &&
a5c8f270
MH		 999 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1000 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
a358dc11 1001 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
bf543036 1002 hci_dev_do_close(hdev);
d7a5a11d 1003 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
19202573
JH		 1004 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1005 HCI_AUTO_OFF_TIMEOUT);
bf543036 1006 }
ab81cbf9 1007
a69d8927 1008 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
4a964404
MH		 1009 /* For unconfigured devices, set the HCI_RAW flag
1010 * so that userspace can easily identify them.
4a964404 1011 */
d7a5a11d 1012 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4a964404 1013 set_bit(HCI_RAW, &hdev->flags);
0602a8ad
MH		 1014
1015 /* For fully configured devices, this will send
1016 * the Index Added event. For unconfigured devices,
1017 * it will send Unconfigued Index Added event.
1018 *
1019 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
1020 * and no event will be send.
1021 */
1022 mgmt_index_added(hdev);
a69d8927 1023 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
5ea234d3
MH		 1024 /* When the controller is now configured, then it
1025 * is important to clear the HCI_RAW flag.
1026 */
d7a5a11d 1027 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5ea234d3
MH		 1028 clear_bit(HCI_RAW, &hdev->flags);
1029
d603b76b
MH		 1030 /* Powering on the controller with HCI_CONFIG set only
1031 * happens with the transition from unconfigured to
1032 * configured. This will send the Index Added event.
1033 */
744cf19e 1034 mgmt_index_added(hdev);
fee746b0 1035 }
ab81cbf9
JH		 1036}
1037
1038static void hci_power_off(struct work_struct *work)
1039{
3243553f 1040 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 1041 power_off.work);
ab81cbf9
JH		 1042
1043 BT_DBG("%s", hdev->name);
1044
8ee56540 1045 hci_dev_do_close(hdev);
ab81cbf9
JH		 1046}
1047
c7741d16
MH		 1048static void hci_error_reset(struct work_struct *work)
1049{
1050 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
1051
1052 BT_DBG("%s", hdev->name);
1053
1054 if (hdev->hw_error)
1055 hdev->hw_error(hdev, hdev->hw_error_code);
1056 else
2064ee33 1057 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
c7741d16
MH		 1058
1059 if (hci_dev_do_close(hdev))
1060 return;
1061
c7741d16
MH		 1062 hci_dev_do_open(hdev);
1063}
1064
35f7498a 1065void hci_uuids_clear(struct hci_dev *hdev)
2aeb9a1a 1066{
4821002c 1067 struct bt_uuid *uuid, *tmp;
2aeb9a1a 1068
4821002c
JH		 1069 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1070 list_del(&uuid->list);
2aeb9a1a
JH		 1071 kfree(uuid);
1072 }
2aeb9a1a
JH		 1073}
1074
35f7498a 1075void hci_link_keys_clear(struct hci_dev *hdev)
55ed8ca1 1076{
0378b597 1077 struct link_key *key;
55ed8ca1 1078
d7d41682 1079 list_for_each_entry(key, &hdev->link_keys, list) {
0378b597
JH		 1080 list_del_rcu(&key->list);
1081 kfree_rcu(key, rcu);
55ed8ca1 1082 }
55ed8ca1
JH		 1083}
1084
35f7498a 1085void hci_smp_ltks_clear(struct hci_dev *hdev)
b899efaf 1086{
970d0f1b 1087 struct smp_ltk *k;
b899efaf 1088
d7d41682 1089 list_for_each_entry(k, &hdev->long_term_keys, list) {
970d0f1b
JH		 1090 list_del_rcu(&k->list);
1091 kfree_rcu(k, rcu);
b899efaf 1092 }
b899efaf
VCG		 1093}
1094
970c4e46
JH		 1095void hci_smp_irks_clear(struct hci_dev *hdev)
1096{
adae20cb 1097 struct smp_irk *k;
970c4e46 1098
d7d41682 1099 list_for_each_entry(k, &hdev->identity_resolving_keys, list) {
adae20cb
JH		 1100 list_del_rcu(&k->list);
1101 kfree_rcu(k, rcu);
970c4e46
JH		 1102 }
1103}
1104
600a8749
AM		 1105void hci_blocked_keys_clear(struct hci_dev *hdev)
1106{
1107 struct blocked_key *b;
1108
d7d41682 1109 list_for_each_entry(b, &hdev->blocked_keys, list) {
600a8749
AM		 1110 list_del_rcu(&b->list);
1111 kfree_rcu(b, rcu);
1112 }
1113}
1114
1115bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
1116{
1117 bool blocked = false;
1118 struct blocked_key *b;
1119
1120 rcu_read_lock();
0c2ac7d4 1121 list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
600a8749
AM		 1122 if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
1123 blocked = true;
1124 break;
1125 }
1126 }
1127
1128 rcu_read_unlock();
1129 return blocked;
1130}
1131
55ed8ca1
JH		 1132struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1133{
8035ded4 1134 struct link_key *k;
55ed8ca1 1135
0378b597
JH		 1136 rcu_read_lock();
1137 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
1138 if (bacmp(bdaddr, &k->bdaddr) == 0) {
1139 rcu_read_unlock();
600a8749
AM		 1140
1141 if (hci_is_blocked_key(hdev,
1142 HCI_BLOCKED_KEY_TYPE_LINKKEY,
1143 k->val)) {
1144 bt_dev_warn_ratelimited(hdev,
1145 "Link key blocked for %pMR",
1146 &k->bdaddr);
1147 return NULL;
1148 }
1149
55ed8ca1 1150 return k;
0378b597
JH		 1151 }
1152 }
1153 rcu_read_unlock();
55ed8ca1
JH		 1154
1155 return NULL;
1156}
1157
745c0ce3 1158static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 1159 u8 key_type, u8 old_key_type)
d25e28ab
JH		 1160{
1161 /* Legacy key */
1162 if (key_type < 0x03)
745c0ce3 1163 return true;
d25e28ab
JH		 1164
1165 /* Debug keys are insecure so don't store them persistently */
1166 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 1167 return false;
d25e28ab
JH		 1168
1169 /* Changed combination key and there's no previous one */
1170 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 1171 return false;
d25e28ab
JH		 1172
1173 /* Security mode 3 case */
1174 if (!conn)
745c0ce3 1175 return true;
d25e28ab 1176
e3befab9
JH		 1177 /* BR/EDR key derived using SC from an LE link */
1178 if (conn->type == LE_LINK)
1179 return true;
1180
d25e28ab
JH		 1181 /* Neither local nor remote side had no-bonding as requirement */
1182 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 1183 return true;
d25e28ab
JH		 1184
1185 /* Local side had dedicated bonding as requirement */
1186 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 1187 return true;
d25e28ab
JH		 1188
1189 /* Remote side had dedicated bonding as requirement */
1190 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 1191 return true;
d25e28ab
JH		 1192
1193 /* If none of the above criteria match, then don't store the key
1194 * persistently */
745c0ce3 1195 return false;
d25e28ab
JH		 1196}
1197
e804d25d 1198static u8 ltk_role(u8 type)
98a0b845 1199{
e804d25d
JH		 1200 if (type == SMP_LTK)
1201 return HCI_ROLE_MASTER;
98a0b845 1202
e804d25d 1203 return HCI_ROLE_SLAVE;
98a0b845
JH		 1204}
1205
f3a73d97
JH		 1206struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1207 u8 addr_type, u8 role)
75d262c2 1208{
c9839a11 1209 struct smp_ltk *k;
75d262c2 1210
970d0f1b
JH		 1211 rcu_read_lock();
1212 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
5378bc56
JH		 1213 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
1214 continue;
1215
923e2414 1216 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
970d0f1b 1217 rcu_read_unlock();
600a8749
AM		 1218
1219 if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
1220 k->val)) {
1221 bt_dev_warn_ratelimited(hdev,
1222 "LTK blocked for %pMR",
1223 &k->bdaddr);
1224 return NULL;
1225 }
1226
75d262c2 1227 return k;
970d0f1b
JH		 1228 }
1229 }
1230 rcu_read_unlock();
75d262c2
VCG		 1231
1232 return NULL;
1233}
75d262c2 1234
970c4e46
JH		 1235struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
1236{
600a8749 1237 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 1238 struct smp_irk *irk;
1239
adae20cb
JH		 1240 rcu_read_lock();
1241 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
1242 if (!bacmp(&irk->rpa, rpa)) {
600a8749
AM		 1243 irk_to_return = irk;
1244 goto done;
adae20cb 1245 }
970c4e46
JH		 1246 }
1247
adae20cb 1248 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
defce9e8 1249 if (smp_irk_matches(hdev, irk->val, rpa)) {
970c4e46 1250 bacpy(&irk->rpa, rpa);
600a8749
AM		 1251 irk_to_return = irk;
1252 goto done;
970c4e46
JH		 1253 }
1254 }
600a8749
AM		 1255
1256done:
1257 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1258 irk_to_return->val)) {
1259 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1260 &irk_to_return->bdaddr);
1261 irk_to_return = NULL;
1262 }
1263
adae20cb 1264 rcu_read_unlock();
970c4e46 1265
600a8749 1266 return irk_to_return;
970c4e46
JH		 1267}
1268
1269struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1270 u8 addr_type)
1271{
600a8749 1272 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 1273 struct smp_irk *irk;
1274
6cfc9988
JH		 1275 /* Identity Address must be public or static random */
1276 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
1277 return NULL;
1278
adae20cb
JH		 1279 rcu_read_lock();
1280 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
970c4e46 1281 if (addr_type == irk->addr_type &&
adae20cb 1282 bacmp(bdaddr, &irk->bdaddr) == 0) {
600a8749
AM		 1283 irk_to_return = irk;
1284 goto done;
adae20cb 1285 }
970c4e46 1286 }
600a8749
AM		 1287
1288done:
1289
1290 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1291 irk_to_return->val)) {
1292 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1293 &irk_to_return->bdaddr);
1294 irk_to_return = NULL;
1295 }
1296
adae20cb 1297 rcu_read_unlock();
970c4e46 1298
600a8749 1299 return irk_to_return;
970c4e46
JH		 1300}
1301
567fa2aa 1302struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
7652ff6a
JH		 1303 bdaddr_t *bdaddr, u8 *val, u8 type,
1304 u8 pin_len, bool *persistent)
55ed8ca1
JH		 1305{
1306 struct link_key *key, *old_key;
745c0ce3 1307 u8 old_key_type;
55ed8ca1
JH		 1308
1309 old_key = hci_find_link_key(hdev, bdaddr);
1310 if (old_key) {
1311 old_key_type = old_key->type;
1312 key = old_key;
1313 } else {
12adcf3a 1314 old_key_type = conn ? conn->key_type : 0xff;
0a14ab41 1315 key = kzalloc(sizeof(*key), GFP_KERNEL);
55ed8ca1 1316 if (!key)
567fa2aa 1317 return NULL;
0378b597 1318 list_add_rcu(&key->list, &hdev->link_keys);
55ed8ca1
JH		 1319 }
1320
6ed93dc6 1321 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 1322
d25e28ab
JH		 1323 /* Some buggy controller combinations generate a changed
1324 * combination key for legacy pairing even when there's no
1325 * previous key */
1326 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 1327 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 1328 type = HCI_LK_COMBINATION;
655fe6ec
JH		 1329 if (conn)
1330 conn->key_type = type;
1331 }
d25e28ab 1332
55ed8ca1 1333 bacpy(&key->bdaddr, bdaddr);
9b3b4460 1334 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 1335 key->pin_len = pin_len;
1336
b6020ba0 1337 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 1338 key->type = old_key_type;
4748fed2
JH		 1339 else
1340 key->type = type;
1341
7652ff6a
JH		 1342 if (persistent)
1343 *persistent = hci_persistent_key(hdev, conn, type,
1344 old_key_type);
4df378a1 1345
567fa2aa 1346 return key;
55ed8ca1
JH		 1347}
1348
ca9142b8 1349struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
35d70271 1350 u8 addr_type, u8 type, u8 authenticated,
fe39c7b2 1351 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
75d262c2 1352{
c9839a11 1353 struct smp_ltk *key, *old_key;
e804d25d 1354 u8 role = ltk_role(type);
75d262c2 1355
f3a73d97 1356 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
c9839a11 1357 if (old_key)
75d262c2 1358 key = old_key;
c9839a11 1359 else {
0a14ab41 1360 key = kzalloc(sizeof(*key), GFP_KERNEL);
75d262c2 1361 if (!key)
ca9142b8 1362 return NULL;
970d0f1b 1363 list_add_rcu(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 1364 }
1365
75d262c2 1366 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 1367 key->bdaddr_type = addr_type;
1368 memcpy(key->val, tk, sizeof(key->val));
1369 key->authenticated = authenticated;
1370 key->ediv = ediv;
fe39c7b2 1371 key->rand = rand;
c9839a11
VCG		 1372 key->enc_size = enc_size;
1373 key->type = type;
75d262c2 1374
ca9142b8 1375 return key;
75d262c2
VCG		 1376}
1377
ca9142b8
JH		 1378struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1379 u8 addr_type, u8 val[16], bdaddr_t *rpa)
970c4e46
JH		 1380{
1381 struct smp_irk *irk;
1382
1383 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
1384 if (!irk) {
1385 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
1386 if (!irk)
ca9142b8 1387 return NULL;
970c4e46
JH		 1388
1389 bacpy(&irk->bdaddr, bdaddr);
1390 irk->addr_type = addr_type;
1391
adae20cb 1392 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
970c4e46
JH		 1393 }
1394
1395 memcpy(irk->val, val, 16);
1396 bacpy(&irk->rpa, rpa);
1397
ca9142b8 1398 return irk;
970c4e46
JH		 1399}
1400
55ed8ca1
JH		 1401int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1402{
1403 struct link_key *key;
1404
1405 key = hci_find_link_key(hdev, bdaddr);
1406 if (!key)
1407 return -ENOENT;
1408
6ed93dc6 1409 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1 1410
0378b597
JH		 1411 list_del_rcu(&key->list);
1412 kfree_rcu(key, rcu);
55ed8ca1
JH		 1413
1414 return 0;
1415}
1416
e0b2b27e 1417int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
b899efaf 1418{
970d0f1b 1419 struct smp_ltk *k;
c51ffa0b 1420 int removed = 0;
b899efaf 1421
970d0f1b 1422 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
e0b2b27e 1423 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
b899efaf
VCG		 1424 continue;
1425
6ed93dc6 1426 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf 1427
970d0f1b
JH		 1428 list_del_rcu(&k->list);
1429 kfree_rcu(k, rcu);
c51ffa0b 1430 removed++;
b899efaf
VCG		 1431 }
1432
c51ffa0b 1433 return removed ? 0 : -ENOENT;
b899efaf
VCG		 1434}
1435
a7ec7338
JH		 1436void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
1437{
adae20cb 1438 struct smp_irk *k;
a7ec7338 1439
adae20cb 1440 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
a7ec7338
JH		 1441 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
1442 continue;
1443
1444 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1445
adae20cb
JH		 1446 list_del_rcu(&k->list);
1447 kfree_rcu(k, rcu);
a7ec7338
JH		 1448 }
1449}
1450
55e76b38
JH		 1451bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1452{
1453 struct smp_ltk *k;
4ba9faf3 1454 struct smp_irk *irk;
55e76b38
JH		 1455 u8 addr_type;
1456
1457 if (type == BDADDR_BREDR) {
1458 if (hci_find_link_key(hdev, bdaddr))
1459 return true;
1460 return false;
1461 }
1462
1463 /* Convert to HCI addr type which struct smp_ltk uses */
1464 if (type == BDADDR_LE_PUBLIC)
1465 addr_type = ADDR_LE_DEV_PUBLIC;
1466 else
1467 addr_type = ADDR_LE_DEV_RANDOM;
1468
4ba9faf3
JH		 1469 irk = hci_get_irk(hdev, bdaddr, addr_type);
1470 if (irk) {
1471 bdaddr = &irk->bdaddr;
1472 addr_type = irk->addr_type;
1473 }
1474
55e76b38
JH		 1475 rcu_read_lock();
1476 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
87c8b28d
JH		 1477 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
1478 rcu_read_unlock();
55e76b38 1479 return true;
87c8b28d 1480 }
55e76b38
JH		 1481 }
1482 rcu_read_unlock();
1483
1484 return false;
1485}
1486
6bd32326 1487/* HCI command timer function */
65cc2b49 1488static void hci_cmd_timeout(struct work_struct *work)
6bd32326 1489{
65cc2b49
MH		 1490 struct hci_dev *hdev = container_of(work, struct hci_dev,
1491 cmd_timer.work);
6bd32326 1492
bda4f23a
AE		 1493 if (hdev->sent_cmd) {
1494 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1495 u16 opcode = __le16_to_cpu(sent->opcode);
1496
2064ee33 1497 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
bda4f23a 1498 } else {
2064ee33 1499 bt_dev_err(hdev, "command tx timeout");
bda4f23a
AE		 1500 }
1501
e2bef384
RJ		 1502 if (hdev->cmd_timeout)
1503 hdev->cmd_timeout(hdev);
1504
6bd32326 1505 atomic_set(&hdev->cmd_cnt, 1);
c347b765 1506 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 1507}
1508
de75cd0d
MM		 1509/* HCI ncmd timer function */
1510static void hci_ncmd_timeout(struct work_struct *work)
1511{
1512 struct hci_dev *hdev = container_of(work, struct hci_dev,
1513 ncmd_timer.work);
1514
1515 bt_dev_err(hdev, "Controller not accepting commands anymore: ncmd = 0");
1516
1517 /* During HCI_INIT phase no events can be injected if the ncmd timer
1518 * triggers since the procedure has its own timeout handling.
1519 */
1520 if (test_bit(HCI_INIT, &hdev->flags))
1521 return;
1522
1523 /* This is an irrecoverable state, inject hardware error event */
1524 hci_reset_dev(hdev);
1525}
1526
2763eda6 1527struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
6928a924 1528 bdaddr_t *bdaddr, u8 bdaddr_type)
2763eda6
SJ		 1529{
1530 struct oob_data *data;
1531
6928a924
JH		 1532 list_for_each_entry(data, &hdev->remote_oob_data, list) {
1533 if (bacmp(bdaddr, &data->bdaddr) != 0)
1534 continue;
1535 if (data->bdaddr_type != bdaddr_type)
1536 continue;
1537 return data;
1538 }
2763eda6
SJ		 1539
1540 return NULL;
1541}
1542
6928a924
JH		 1543int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
1544 u8 bdaddr_type)
2763eda6
SJ		 1545{
1546 struct oob_data *data;
1547
6928a924 1548 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6
SJ		 1549 if (!data)
1550 return -ENOENT;
1551
6928a924 1552 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2763eda6
SJ		 1553
1554 list_del(&data->list);
1555 kfree(data);
1556
1557 return 0;
1558}
1559
35f7498a 1560void hci_remote_oob_data_clear(struct hci_dev *hdev)
2763eda6
SJ		 1561{
1562 struct oob_data *data, *n;
1563
1564 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1565 list_del(&data->list);
1566 kfree(data);
1567 }
2763eda6
SJ		 1568}
1569
0798872e 1570int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
6928a924 1571 u8 bdaddr_type, u8 *hash192, u8 *rand192,
81328d5c 1572 u8 *hash256, u8 *rand256)
2763eda6
SJ		 1573{
1574 struct oob_data *data;
1575
6928a924 1576 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6 1577 if (!data) {
0a14ab41 1578 data = kmalloc(sizeof(*data), GFP_KERNEL);
2763eda6
SJ		 1579 if (!data)
1580 return -ENOMEM;
1581
1582 bacpy(&data->bdaddr, bdaddr);
6928a924 1583 data->bdaddr_type = bdaddr_type;
2763eda6
SJ		 1584 list_add(&data->list, &hdev->remote_oob_data);
1585 }
1586
81328d5c
JH		 1587 if (hash192 && rand192) {
1588 memcpy(data->hash192, hash192, sizeof(data->hash192));
1589 memcpy(data->rand192, rand192, sizeof(data->rand192));
f7697b16
MH		 1590 if (hash256 && rand256)
1591 data->present = 0x03;
81328d5c
JH		 1592 } else {
1593 memset(data->hash192, 0, sizeof(data->hash192));
1594 memset(data->rand192, 0, sizeof(data->rand192));
f7697b16
MH		 1595 if (hash256 && rand256)
1596 data->present = 0x02;
1597 else
1598 data->present = 0x00;
0798872e
MH		 1599 }
1600
81328d5c
JH		 1601 if (hash256 && rand256) {
1602 memcpy(data->hash256, hash256, sizeof(data->hash256));
1603 memcpy(data->rand256, rand256, sizeof(data->rand256));
1604 } else {
1605 memset(data->hash256, 0, sizeof(data->hash256));
1606 memset(data->rand256, 0, sizeof(data->rand256));
f7697b16
MH		 1607 if (hash192 && rand192)
1608 data->present = 0x01;
81328d5c 1609 }
0798872e 1610
6ed93dc6 1611 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 1612
1613 return 0;
1614}
1615
d2609b34
FG		 1616/* This function requires the caller holds hdev->lock */
1617struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
1618{
1619 struct adv_info *adv_instance;
1620
1621 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
1622 if (adv_instance->instance == instance)
1623 return adv_instance;
1624 }
1625
1626 return NULL;
1627}
1628
1629/* This function requires the caller holds hdev->lock */
74b93e9f
PK		 1630struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
1631{
d2609b34
FG		 1632 struct adv_info *cur_instance;
1633
1634 cur_instance = hci_find_adv_instance(hdev, instance);
1635 if (!cur_instance)
1636 return NULL;
1637
1638 if (cur_instance == list_last_entry(&hdev->adv_instances,
1639 struct adv_info, list))
1640 return list_first_entry(&hdev->adv_instances,
1641 struct adv_info, list);
1642 else
1643 return list_next_entry(cur_instance, list);
1644}
1645
1646/* This function requires the caller holds hdev->lock */
1647int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
1648{
1649 struct adv_info *adv_instance;
1650
1651 adv_instance = hci_find_adv_instance(hdev, instance);
1652 if (!adv_instance)
1653 return -ENOENT;
1654
1655 BT_DBG("%s removing %dMR", hdev->name, instance);
1656
cab054ab
JH		 1657 if (hdev->cur_adv_instance == instance) {
1658 if (hdev->adv_instance_timeout) {
1659 cancel_delayed_work(&hdev->adv_instance_expire);
1660 hdev->adv_instance_timeout = 0;
1661 }
1662 hdev->cur_adv_instance = 0x00;
5d900e46
FG		 1663 }
1664
a73c046a
JK		 1665 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1666
d2609b34
FG		 1667 list_del(&adv_instance->list);
1668 kfree(adv_instance);
1669
1670 hdev->adv_instance_cnt--;
1671
1672 return 0;
1673}
1674
a73c046a
JK		 1675void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
1676{
1677 struct adv_info *adv_instance, *n;
1678
1679 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
1680 adv_instance->rpa_expired = rpa_expired;
1681}
1682
d2609b34
FG		 1683/* This function requires the caller holds hdev->lock */
1684void hci_adv_instances_clear(struct hci_dev *hdev)
1685{
1686 struct adv_info *adv_instance, *n;
1687
5d900e46
FG		 1688 if (hdev->adv_instance_timeout) {
1689 cancel_delayed_work(&hdev->adv_instance_expire);
1690 hdev->adv_instance_timeout = 0;
1691 }
1692
d2609b34 1693 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
a73c046a 1694 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
d2609b34
FG		 1695 list_del(&adv_instance->list);
1696 kfree(adv_instance);
1697 }
1698
1699 hdev->adv_instance_cnt = 0;
cab054ab 1700 hdev->cur_adv_instance = 0x00;
d2609b34
FG		 1701}
1702
a73c046a
JK		 1703static void adv_instance_rpa_expired(struct work_struct *work)
1704{
1705 struct adv_info *adv_instance = container_of(work, struct adv_info,
1706 rpa_expired_cb.work);
1707
1708 BT_DBG("");
1709
1710 adv_instance->rpa_expired = true;
1711}
1712
d2609b34 1713/* This function requires the caller holds hdev->lock */
eca0ae4a
LAD		 1714struct adv_info *hci_add_adv_instance(struct hci_dev *hdev, u8 instance,
1715 u32 flags, u16 adv_data_len, u8 *adv_data,
1716 u16 scan_rsp_len, u8 *scan_rsp_data,
1717 u16 timeout, u16 duration, s8 tx_power,
b338d917
BG		 1718 u32 min_interval, u32 max_interval,
1719 u8 mesh_handle)
d2609b34 1720{
eca0ae4a 1721 struct adv_info *adv;
d2609b34 1722
eca0ae4a
LAD		 1723 adv = hci_find_adv_instance(hdev, instance);
1724 if (adv) {
1725 memset(adv->adv_data, 0, sizeof(adv->adv_data));
1726 memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1727 memset(adv->per_adv_data, 0, sizeof(adv->per_adv_data));
d2609b34 1728 } else {
1d0fac2c 1729 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
b338d917 1730 instance < 1 || instance > hdev->le_num_of_adv_sets + 1)
eca0ae4a 1731 return ERR_PTR(-EOVERFLOW);
d2609b34 1732
eca0ae4a
LAD		 1733 adv = kzalloc(sizeof(*adv), GFP_KERNEL);
1734 if (!adv)
1735 return ERR_PTR(-ENOMEM);
d2609b34 1736
eca0ae4a
LAD		 1737 adv->pending = true;
1738 adv->instance = instance;
1739 list_add(&adv->list, &hdev->adv_instances);
d2609b34
FG		 1740 hdev->adv_instance_cnt++;
1741 }
1742
eca0ae4a
LAD		 1743 adv->flags = flags;
1744 adv->min_interval = min_interval;
1745 adv->max_interval = max_interval;
1746 adv->tx_power = tx_power;
b338d917
BG		 1747 /* Defining a mesh_handle changes the timing units to ms,
1748 * rather than seconds, and ties the instance to the requested
1749 * mesh_tx queue.
1750 */
1751 adv->mesh = mesh_handle;
d2609b34 1752
34a718bc
LAD		 1753 hci_set_adv_instance_data(hdev, instance, adv_data_len, adv_data,
1754 scan_rsp_len, scan_rsp_data);
d2609b34 1755
eca0ae4a
LAD		 1756 adv->timeout = timeout;
1757 adv->remaining_time = timeout;
d2609b34
FG		 1758
1759 if (duration == 0)
eca0ae4a 1760 adv->duration = hdev->def_multi_adv_rotation_duration;
d2609b34 1761 else
eca0ae4a 1762 adv->duration = duration;
d2609b34 1763
eca0ae4a 1764 INIT_DELAYED_WORK(&adv->rpa_expired_cb, adv_instance_rpa_expired);
a73c046a 1765
d2609b34
FG		 1766 BT_DBG("%s for %dMR", hdev->name, instance);
1767
eca0ae4a
LAD		 1768 return adv;
1769}
1770
1771/* This function requires the caller holds hdev->lock */
1772struct adv_info *hci_add_per_instance(struct hci_dev *hdev, u8 instance,
1773 u32 flags, u8 data_len, u8 *data,
1774 u32 min_interval, u32 max_interval)
1775{
1776 struct adv_info *adv;
1777
1778 adv = hci_add_adv_instance(hdev, instance, flags, 0, NULL, 0, NULL,
1779 0, 0, HCI_ADV_TX_POWER_NO_PREFERENCE,
b338d917 1780 min_interval, max_interval, 0);
eca0ae4a
LAD		 1781 if (IS_ERR(adv))
1782 return adv;
1783
1784 adv->periodic = true;
1785 adv->per_adv_data_len = data_len;
1786
1787 if (data)
1788 memcpy(adv->per_adv_data, data, data_len);
1789
1790 return adv;
d2609b34
FG		 1791}
1792
31aab5c2
DW		 1793/* This function requires the caller holds hdev->lock */
1794int hci_set_adv_instance_data(struct hci_dev *hdev, u8 instance,
1795 u16 adv_data_len, u8 *adv_data,
1796 u16 scan_rsp_len, u8 *scan_rsp_data)
1797{
34a718bc 1798 struct adv_info *adv;
31aab5c2 1799
34a718bc 1800 adv = hci_find_adv_instance(hdev, instance);
31aab5c2
DW		 1801
1802 /* If advertisement doesn't exist, we can't modify its data */
34a718bc 1803 if (!adv)
31aab5c2
DW		 1804 return -ENOENT;
1805
34a718bc
LAD		 1806 if (adv_data_len && ADV_DATA_CMP(adv, adv_data, adv_data_len)) {
1807 memset(adv->adv_data, 0, sizeof(adv->adv_data));
1808 memcpy(adv->adv_data, adv_data, adv_data_len);
1809 adv->adv_data_len = adv_data_len;
1810 adv->adv_data_changed = true;
31aab5c2
DW		 1811 }
1812
34a718bc
LAD		 1813 if (scan_rsp_len && SCAN_RSP_CMP(adv, scan_rsp_data, scan_rsp_len)) {
1814 memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1815 memcpy(adv->scan_rsp_data, scan_rsp_data, scan_rsp_len);
1816 adv->scan_rsp_len = scan_rsp_len;
1817 adv->scan_rsp_changed = true;
31aab5c2
DW		 1818 }
1819
34a718bc
LAD		 1820 /* Mark as changed if there are flags which would affect it */
1821 if (((adv->flags & MGMT_ADV_FLAG_APPEARANCE) && hdev->appearance) ||
1822 adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1823 adv->scan_rsp_changed = true;
1824
31aab5c2
DW		 1825 return 0;
1826}
1827
01ce70b0
LAD		 1828/* This function requires the caller holds hdev->lock */
1829u32 hci_adv_instance_flags(struct hci_dev *hdev, u8 instance)
1830{
1831 u32 flags;
1832 struct adv_info *adv;
1833
1834 if (instance == 0x00) {
1835 /* Instance 0 always manages the "Tx Power" and "Flags"
1836 * fields
1837 */
1838 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
1839
1840 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
1841 * corresponds to the "connectable" instance flag.
1842 */
1843 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
1844 flags |= MGMT_ADV_FLAG_CONNECTABLE;
1845
1846 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1847 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
1848 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1849 flags |= MGMT_ADV_FLAG_DISCOV;
1850
1851 return flags;
1852 }
1853
1854 adv = hci_find_adv_instance(hdev, instance);
1855
1856 /* Return 0 when we got an invalid instance identifier. */
1857 if (!adv)
1858 return 0;
1859
1860 return adv->flags;
1861}
1862
1863bool hci_adv_instance_is_scannable(struct hci_dev *hdev, u8 instance)
1864{
1865 struct adv_info *adv;
1866
1867 /* Instance 0x00 always set local name */
1868 if (instance == 0x00)
1869 return true;
1870
1871 adv = hci_find_adv_instance(hdev, instance);
1872 if (!adv)
1873 return false;
1874
1875 if (adv->flags & MGMT_ADV_FLAG_APPEARANCE ||
1876 adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1877 return true;
1878
1879 return adv->scan_rsp_len ? true : false;
1880}
1881
e5e1e7fd
MC		 1882/* This function requires the caller holds hdev->lock */
1883void hci_adv_monitors_clear(struct hci_dev *hdev)
1884{
b139553d
MC		 1885 struct adv_monitor *monitor;
1886 int handle;
1887
1888 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
66bd095a 1889 hci_free_adv_monitor(hdev, monitor);
b139553d 1890
e5e1e7fd
MC		 1891 idr_destroy(&hdev->adv_monitors_idr);
1892}
1893
66bd095a
AP		 1894/* Frees the monitor structure and do some bookkeepings.
1895 * This function requires the caller holds hdev->lock.
1896 */
1897void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
b139553d
MC		 1898{
1899 struct adv_pattern *pattern;
1900 struct adv_pattern *tmp;
1901
1902 if (!monitor)
1903 return;
1904
66bd095a
AP		 1905 list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list) {
1906 list_del(&pattern->list);
b139553d 1907 kfree(pattern);
66bd095a
AP		 1908 }
1909
1910 if (monitor->handle)
1911 idr_remove(&hdev->adv_monitors_idr, monitor->handle);
1912
1913 if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) {
1914 hdev->adv_monitors_cnt--;
1915 mgmt_adv_monitor_removed(hdev, monitor->handle);
1916 }
b139553d
MC		 1917
1918 kfree(monitor);
1919}
1920
a2a4dedf
AP		 1921/* Assigns handle to a monitor, and if offloading is supported and power is on,
1922 * also attempts to forward the request to the controller.
b747a836 1923 * This function requires the caller holds hci_req_sync_lock.
a2a4dedf 1924 */
b747a836 1925int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
b139553d
MC		 1926{
1927 int min, max, handle;
b747a836 1928 int status = 0;
b139553d 1929
b747a836
MM		 1930 if (!monitor)
1931 return -EINVAL;
a2a4dedf 1932
b747a836 1933 hci_dev_lock(hdev);
b139553d
MC		 1934
1935 min = HCI_MIN_ADV_MONITOR_HANDLE;
1936 max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES;
1937 handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max,
1938 GFP_KERNEL);
b747a836
MM		 1939
1940 hci_dev_unlock(hdev);
1941
1942 if (handle < 0)
1943 return handle;
b139553d 1944
b139553d 1945 monitor->handle = handle;
8208f5a9 1946
a2a4dedf 1947 if (!hdev_is_powered(hdev))
b747a836 1948 return status;
8208f5a9 1949
a2a4dedf
AP		 1950 switch (hci_get_adv_monitor_offload_ext(hdev)) {
1951 case HCI_ADV_MONITOR_EXT_NONE:
b747a836
MM		 1952 bt_dev_dbg(hdev, "%s add monitor %d status %d", hdev->name,
1953 monitor->handle, status);
a2a4dedf 1954 /* Message was not forwarded to controller - not an error */
b747a836
MM		 1955 break;
1956
a2a4dedf 1957 case HCI_ADV_MONITOR_EXT_MSFT:
b747a836
MM		 1958 status = msft_add_monitor_pattern(hdev, monitor);
1959 bt_dev_dbg(hdev, "%s add monitor %d msft status %d", hdev->name,
1960 monitor->handle, status);
a2a4dedf
AP		 1961 break;
1962 }
1963
b747a836 1964 return status;
b139553d
MC		 1965}
1966
66bd095a
AP		 1967/* Attempts to tell the controller and free the monitor. If somehow the
1968 * controller doesn't have a corresponding handle, remove anyway.
7cf5c297 1969 * This function requires the caller holds hci_req_sync_lock.
66bd095a 1970 */
7cf5c297
MM		 1971static int hci_remove_adv_monitor(struct hci_dev *hdev,
1972 struct adv_monitor *monitor)
bd2fbc6c 1973{
7cf5c297 1974 int status = 0;
bd2fbc6c 1975
66bd095a
AP		 1976 switch (hci_get_adv_monitor_offload_ext(hdev)) {
1977 case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */
7cf5c297
MM		 1978 bt_dev_dbg(hdev, "%s remove monitor %d status %d", hdev->name,
1979 monitor->handle, status);
66bd095a 1980 goto free_monitor;
7cf5c297 1981
66bd095a 1982 case HCI_ADV_MONITOR_EXT_MSFT:
7cf5c297
MM		 1983 status = msft_remove_monitor(hdev, monitor);
1984 bt_dev_dbg(hdev, "%s remove monitor %d msft status %d",
1985 hdev->name, monitor->handle, status);
66bd095a
AP		 1986 break;
1987 }
bd2fbc6c 1988
66bd095a 1989 /* In case no matching handle registered, just free the monitor */
7cf5c297 1990 if (status == -ENOENT)
66bd095a
AP		 1991 goto free_monitor;
1992
7cf5c297 1993 return status;
66bd095a
AP		 1994
1995free_monitor:
7cf5c297 1996 if (status == -ENOENT)
66bd095a
AP		 1997 bt_dev_warn(hdev, "Removing monitor with no matching handle %d",
1998 monitor->handle);
1999 hci_free_adv_monitor(hdev, monitor);
2000
7cf5c297 2001 return status;
bd2fbc6c
MC		 2002}
2003
7cf5c297
MM		 2004/* This function requires the caller holds hci_req_sync_lock */
2005int hci_remove_single_adv_monitor(struct hci_dev *hdev, u16 handle)
66bd095a
AP		 2006{
2007 struct adv_monitor *monitor = idr_find(&hdev->adv_monitors_idr, handle);
66bd095a 2008
7cf5c297
MM		 2009 if (!monitor)
2010 return -EINVAL;
66bd095a 2011
7cf5c297 2012 return hci_remove_adv_monitor(hdev, monitor);
66bd095a
AP		 2013}
2014
7cf5c297
MM		 2015/* This function requires the caller holds hci_req_sync_lock */
2016int hci_remove_all_adv_monitor(struct hci_dev *hdev)
bd2fbc6c
MC		 2017{
2018 struct adv_monitor *monitor;
66bd095a 2019 int idr_next_id = 0;
7cf5c297 2020 int status = 0;
66bd095a 2021
7cf5c297 2022 while (1) {
66bd095a 2023 monitor = idr_get_next(&hdev->adv_monitors_idr, &idr_next_id);
bd2fbc6c 2024 if (!monitor)
66bd095a 2025 break;
bd2fbc6c 2026
7cf5c297
MM		 2027 status = hci_remove_adv_monitor(hdev, monitor);
2028 if (status)
2029 return status;
66bd095a 2030
7cf5c297 2031 idr_next_id++;
bd2fbc6c
MC		 2032 }
2033
7cf5c297 2034 return status;
bd2fbc6c
MC		 2035}
2036
8208f5a9
MC		 2037/* This function requires the caller holds hdev->lock */
2038bool hci_is_adv_monitoring(struct hci_dev *hdev)
2039{
2040 return !idr_is_empty(&hdev->adv_monitors_idr);
2041}
2042
a2a4dedf
AP		 2043int hci_get_adv_monitor_offload_ext(struct hci_dev *hdev)
2044{
2045 if (msft_monitor_supported(hdev))
2046 return HCI_ADV_MONITOR_EXT_MSFT;
2047
2048 return HCI_ADV_MONITOR_EXT_NONE;
2049}
2050
dcc36c16 2051struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
b9ee0a78 2052 bdaddr_t *bdaddr, u8 type)
b2a66aad 2053{
8035ded4 2054 struct bdaddr_list *b;
b2a66aad 2055
dcc36c16 2056 list_for_each_entry(b, bdaddr_list, list) {
b9ee0a78 2057 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
b2a66aad 2058 return b;
b9ee0a78 2059 }
b2a66aad
AJ		 2060
2061 return NULL;
2062}
2063
b950aa88
AN		 2064struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
2065 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
2066 u8 type)
2067{
2068 struct bdaddr_list_with_irk *b;
2069
2070 list_for_each_entry(b, bdaddr_list, list) {
2071 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2072 return b;
2073 }
2074
2075 return NULL;
2076}
2077
8baaa403
APS		 2078struct bdaddr_list_with_flags *
2079hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list,
2080 bdaddr_t *bdaddr, u8 type)
2081{
2082 struct bdaddr_list_with_flags *b;
2083
2084 list_for_each_entry(b, bdaddr_list, list) {
2085 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2086 return b;
2087 }
2088
2089 return NULL;
2090}
2091
dcc36c16 2092void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
b2a66aad 2093{
7eb7404f 2094 struct bdaddr_list *b, *n;
b2a66aad 2095
7eb7404f
GT		 2096 list_for_each_entry_safe(b, n, bdaddr_list, list) {
2097 list_del(&b->list);
b2a66aad
AJ		 2098 kfree(b);
2099 }
b2a66aad
AJ		 2100}
2101
dcc36c16 2102int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2103{
2104 struct bdaddr_list *entry;
b2a66aad 2105
b9ee0a78 2106 if (!bacmp(bdaddr, BDADDR_ANY))
b2a66aad
AJ		 2107 return -EBADF;
2108
dcc36c16 2109 if (hci_bdaddr_list_lookup(list, bdaddr, type))
5e762444 2110 return -EEXIST;
b2a66aad 2111
27f70f3e 2112 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
5e762444
AJ		 2113 if (!entry)
2114 return -ENOMEM;
b2a66aad
AJ		 2115
2116 bacpy(&entry->bdaddr, bdaddr);
b9ee0a78 2117 entry->bdaddr_type = type;
b2a66aad 2118
dcc36c16 2119 list_add(&entry->list, list);
b2a66aad 2120
2a8357f2 2121 return 0;
b2a66aad
AJ		 2122}
2123
b950aa88
AN		 2124int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2125 u8 type, u8 *peer_irk, u8 *local_irk)
2126{
2127 struct bdaddr_list_with_irk *entry;
2128
2129 if (!bacmp(bdaddr, BDADDR_ANY))
2130 return -EBADF;
2131
2132 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2133 return -EEXIST;
2134
2135 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2136 if (!entry)
2137 return -ENOMEM;
2138
2139 bacpy(&entry->bdaddr, bdaddr);
2140 entry->bdaddr_type = type;
2141
2142 if (peer_irk)
2143 memcpy(entry->peer_irk, peer_irk, 16);
2144
2145 if (local_irk)
2146 memcpy(entry->local_irk, local_irk, 16);
2147
2148 list_add(&entry->list, list);
2149
2150 return 0;
2151}
2152
8baaa403
APS		 2153int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2154 u8 type, u32 flags)
2155{
2156 struct bdaddr_list_with_flags *entry;
2157
2158 if (!bacmp(bdaddr, BDADDR_ANY))
2159 return -EBADF;
2160
2161 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2162 return -EEXIST;
2163
2164 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2165 if (!entry)
2166 return -ENOMEM;
2167
2168 bacpy(&entry->bdaddr, bdaddr);
2169 entry->bdaddr_type = type;
e1cff700 2170 entry->flags = flags;
8baaa403
APS		 2171
2172 list_add(&entry->list, list);
2173
2174 return 0;
2175}
2176
dcc36c16 2177int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2178{
2179 struct bdaddr_list *entry;
b2a66aad 2180
35f7498a 2181 if (!bacmp(bdaddr, BDADDR_ANY)) {
dcc36c16 2182 hci_bdaddr_list_clear(list);
35f7498a
JH		 2183 return 0;
2184 }
b2a66aad 2185
dcc36c16 2186 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
d2ab0ac1
MH		 2187 if (!entry)
2188 return -ENOENT;
2189
2190 list_del(&entry->list);
2191 kfree(entry);
2192
2193 return 0;
2194}
2195
b950aa88
AN		 2196int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2197 u8 type)
2198{
2199 struct bdaddr_list_with_irk *entry;
2200
2201 if (!bacmp(bdaddr, BDADDR_ANY)) {
2202 hci_bdaddr_list_clear(list);
2203 return 0;
2204 }
2205
2206 entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
2207 if (!entry)
2208 return -ENOENT;
2209
2210 list_del(&entry->list);
2211 kfree(entry);
2212
2213 return 0;
2214}
2215
8baaa403
APS		 2216int hci_bdaddr_list_del_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2217 u8 type)
2218{
2219 struct bdaddr_list_with_flags *entry;
2220
2221 if (!bacmp(bdaddr, BDADDR_ANY)) {
2222 hci_bdaddr_list_clear(list);
2223 return 0;
2224 }
2225
2226 entry = hci_bdaddr_list_lookup_with_flags(list, bdaddr, type);
2227 if (!entry)
2228 return -ENOENT;
2229
2230 list_del(&entry->list);
2231 kfree(entry);
2232
2233 return 0;
2234}
2235
15819a70
AG		 2236/* This function requires the caller holds hdev->lock */
2237struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2238 bdaddr_t *addr, u8 addr_type)
2239{
2240 struct hci_conn_params *params;
2241
2242 list_for_each_entry(params, &hdev->le_conn_params, list) {
2243 if (bacmp(&params->addr, addr) == 0 &&
2244 params->addr_type == addr_type) {
2245 return params;
2246 }
2247 }
2248
2249 return NULL;
2250}
2251
4b10966f 2252/* This function requires the caller holds hdev->lock */
501f8827
JH		 2253struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2254 bdaddr_t *addr, u8 addr_type)
a9b0a04c 2255{
912b42ef 2256 struct hci_conn_params *param;
a9b0a04c 2257
501f8827 2258 list_for_each_entry(param, list, action) {
912b42ef
JH		 2259 if (bacmp(&param->addr, addr) == 0 &&
2260 param->addr_type == addr_type)
2261 return param;
4b10966f
MH		 2262 }
2263
2264 return NULL;
a9b0a04c
AG		 2265}
2266
15819a70 2267/* This function requires the caller holds hdev->lock */
51d167c0
MH		 2268struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2269 bdaddr_t *addr, u8 addr_type)
15819a70
AG		 2270{
2271 struct hci_conn_params *params;
2272
2273 params = hci_conn_params_lookup(hdev, addr, addr_type);
cef952ce 2274 if (params)
51d167c0 2275 return params;
15819a70
AG		 2276
2277 params = kzalloc(sizeof(*params), GFP_KERNEL);
2278 if (!params) {
2064ee33 2279 bt_dev_err(hdev, "out of memory");
51d167c0 2280 return NULL;
15819a70
AG		 2281 }
2282
2283 bacpy(&params->addr, addr);
2284 params->addr_type = addr_type;
cef952ce
AG		 2285
2286 list_add(&params->list, &hdev->le_conn_params);
93450c75 2287 INIT_LIST_HEAD(&params->action);
cef952ce 2288
bf5b3c8b
MH		 2289 params->conn_min_interval = hdev->le_conn_min_interval;
2290 params->conn_max_interval = hdev->le_conn_max_interval;
2291 params->conn_latency = hdev->le_conn_latency;
2292 params->supervision_timeout = hdev->le_supv_timeout;
2293 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2294
2295 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2296
51d167c0 2297 return params;
bf5b3c8b
MH		 2298}
2299
f6c63249 2300static void hci_conn_params_free(struct hci_conn_params *params)
15819a70 2301{
f8aaf9b6 2302 if (params->conn) {
f161dd41 2303 hci_conn_drop(params->conn);
f8aaf9b6
JH		 2304 hci_conn_put(params->conn);
2305 }
f161dd41 2306
95305baa 2307 list_del(&params->action);
15819a70
AG		 2308 list_del(&params->list);
2309 kfree(params);
f6c63249
JH		 2310}
2311
2312/* This function requires the caller holds hdev->lock */
2313void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2314{
2315 struct hci_conn_params *params;
2316
2317 params = hci_conn_params_lookup(hdev, addr, addr_type);
2318 if (!params)
2319 return;
2320
2321 hci_conn_params_free(params);
15819a70 2322
5bee2fd6 2323 hci_update_passive_scan(hdev);
95305baa 2324
15819a70
AG		 2325 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2326}
2327
2328/* This function requires the caller holds hdev->lock */
55af49a8 2329void hci_conn_params_clear_disabled(struct hci_dev *hdev)
15819a70
AG		 2330{
2331 struct hci_conn_params *params, *tmp;
2332
2333 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
55af49a8
JH		 2334 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2335 continue;
f75113a2 2336
91641b79 2337 /* If trying to establish one time connection to disabled
f75113a2
JP		 2338 * device, leave the params, but mark them as just once.
2339 */
2340 if (params->explicit_connect) {
2341 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2342 continue;
2343 }
2344
15819a70
AG		 2345 list_del(&params->list);
2346 kfree(params);
2347 }
2348
55af49a8 2349 BT_DBG("All LE disabled connection parameters were removed");
77a77a30
AG		 2350}
2351
2352/* This function requires the caller holds hdev->lock */
030e7f81 2353static void hci_conn_params_clear_all(struct hci_dev *hdev)
77a77a30 2354{
15819a70 2355 struct hci_conn_params *params, *tmp;
77a77a30 2356
f6c63249
JH		 2357 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2358 hci_conn_params_free(params);
77a77a30 2359
15819a70 2360 BT_DBG("All LE connection parameters were removed");
77a77a30
AG		 2361}
2362
a1f4c318
JH		 2363/* Copy the Identity Address of the controller.
2364 *
2365 * If the controller has a public BD_ADDR, then by default use that one.
2366 * If this is a LE only controller without a public address, default to
2367 * the static random address.
2368 *
2369 * For debugging purposes it is possible to force controllers with a
2370 * public address to use the static random address instead.
50b5b952
MH		 2371 *
2372 * In case BR/EDR has been disabled on a dual-mode controller and
2373 * userspace has configured a static address, then that address
2374 * becomes the identity address instead of the public BR/EDR address.
a1f4c318
JH		 2375 */
2376void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2377 u8 *bdaddr_type)
2378{
b7cb93e5 2379 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
50b5b952 2380 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
d7a5a11d 2381 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
50b5b952 2382 bacmp(&hdev->static_addr, BDADDR_ANY))) {
a1f4c318
JH		 2383 bacpy(bdaddr, &hdev->static_addr);
2384 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2385 } else {
2386 bacpy(bdaddr, &hdev->bdaddr);
2387 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
2388 }
2389}
2390
2f20216c
APS		 2391static void hci_clear_wake_reason(struct hci_dev *hdev)
2392{
2393 hci_dev_lock(hdev);
2394
2395 hdev->wake_reason = 0;
2396 bacpy(&hdev->wake_addr, BDADDR_ANY);
2397 hdev->wake_addr_type = 0;
2398
2399 hci_dev_unlock(hdev);
2400}
2401
9952d90e
APS		 2402static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
2403 void *data)
2404{
2405 struct hci_dev *hdev =
2406 container_of(nb, struct hci_dev, suspend_notifier);
2407 int ret = 0;
9952d90e 2408
4b8af331
APS		 2409 /* Userspace has full control of this device. Do nothing. */
2410 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2411 return NOTIFY_DONE;
2412
e1b77d68
LAD		 2413 if (action == PM_SUSPEND_PREPARE)
2414 ret = hci_suspend_dev(hdev);
2415 else if (action == PM_POST_SUSPEND)
2416 ret = hci_resume_dev(hdev);
2f20216c 2417
a9ec8423
APS		 2418 if (ret)
2419 bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
2420 action, ret);
2421
24b06572 2422 return NOTIFY_DONE;
9952d90e 2423}
8731840a 2424
9be0dab7 2425/* Alloc HCI device */
6ec56613 2426struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
9be0dab7
DH		 2427{
2428 struct hci_dev *hdev;
6ec56613 2429 unsigned int alloc_size;
9be0dab7 2430
6ec56613
THJA		 2431 alloc_size = sizeof(*hdev);
2432 if (sizeof_priv) {
2433 /* Fixme: May need ALIGN-ment? */
2434 alloc_size += sizeof_priv;
2435 }
9be0dab7 2436
6ec56613 2437 hdev = kzalloc(alloc_size, GFP_KERNEL);
9be0dab7
DH		 2438 if (!hdev)
2439 return NULL;
2440
b1b813d4
DH		 2441 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2442 hdev->esco_type = (ESCO_HV1);
2443 hdev->link_mode = (HCI_LM_ACCEPT);
b4cb9fb2
MH		 2444 hdev->num_iac = 0x01; /* One IAC support is mandatory */
2445 hdev->io_capability = 0x03; /* No Input No Output */
96c2103a 2446 hdev->manufacturer = 0xffff; /* Default to internal use */
bbaf444a
JH		 2447 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2448 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
d2609b34
FG		 2449 hdev->adv_instance_cnt = 0;
2450 hdev->cur_adv_instance = 0x00;
5d900e46 2451 hdev->adv_instance_timeout = 0;
b1b813d4 2452
c4f1f408
HC		 2453 hdev->advmon_allowlist_duration = 300;
2454 hdev->advmon_no_filter_duration = 500;
80af16a3 2455 hdev->enable_advmon_interleave_scan = 0x00; /* Default to disable */
c4f1f408 2456
b1b813d4
DH		 2457 hdev->sniff_max_interval = 800;
2458 hdev->sniff_min_interval = 80;
2459
3f959d46 2460 hdev->le_adv_channel_map = 0x07;
628531c9
GL		 2461 hdev->le_adv_min_interval = 0x0800;
2462 hdev->le_adv_max_interval = 0x0800;
bef64738
MH		 2463 hdev->le_scan_interval = 0x0060;
2464 hdev->le_scan_window = 0x0030;
10873f99
AM		 2465 hdev->le_scan_int_suspend = 0x0400;
2466 hdev->le_scan_window_suspend = 0x0012;
2467 hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT;
2468 hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN;
ba29d036
MH		 2469 hdev->le_scan_int_adv_monitor = 0x0060;
2470 hdev->le_scan_window_adv_monitor = 0x0030;
10873f99
AM		 2471 hdev->le_scan_int_connect = 0x0060;
2472 hdev->le_scan_window_connect = 0x0060;
b48c3b59
JH		 2473 hdev->le_conn_min_interval = 0x0018;
2474 hdev->le_conn_max_interval = 0x0028;
04fb7d90
MH		 2475 hdev->le_conn_latency = 0x0000;
2476 hdev->le_supv_timeout = 0x002a;
a8e1bfaa
MH		 2477 hdev->le_def_tx_len = 0x001b;
2478 hdev->le_def_tx_time = 0x0148;
2479 hdev->le_max_tx_len = 0x001b;
2480 hdev->le_max_tx_time = 0x0148;
2481 hdev->le_max_rx_len = 0x001b;
2482 hdev->le_max_rx_time = 0x0148;
30d65e08
MK		 2483 hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
2484 hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
6decb5b4
JK		 2485 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
2486 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
1d0fac2c 2487 hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
10873f99 2488 hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
49b020c1 2489 hdev->def_le_autoconnect_timeout = HCI_LE_AUTOCONN_TIMEOUT;
7c395ea5
DW		 2490 hdev->min_le_tx_power = HCI_TX_POWER_INVALID;
2491 hdev->max_le_tx_power = HCI_TX_POWER_INVALID;
bef64738 2492
d6bfd59c 2493 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
b9a7a61e 2494 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
31ad1691
AK		 2495 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
2496 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
302975cb 2497 hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
58a96fc3 2498 hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
d6bfd59c 2499
10873f99
AM		 2500 /* default 1.28 sec page scan */
2501 hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;
2502 hdev->def_page_scan_int = 0x0800;
2503 hdev->def_page_scan_window = 0x0012;
2504
b1b813d4
DH		 2505 mutex_init(&hdev->lock);
2506 mutex_init(&hdev->req_lock);
2507
b338d917 2508 INIT_LIST_HEAD(&hdev->mesh_pending);
b1b813d4 2509 INIT_LIST_HEAD(&hdev->mgmt_pending);
3d4f9c00
AP		 2510 INIT_LIST_HEAD(&hdev->reject_list);
2511 INIT_LIST_HEAD(&hdev->accept_list);
b1b813d4
DH		 2512 INIT_LIST_HEAD(&hdev->uuids);
2513 INIT_LIST_HEAD(&hdev->link_keys);
2514 INIT_LIST_HEAD(&hdev->long_term_keys);
970c4e46 2515 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
b1b813d4 2516 INIT_LIST_HEAD(&hdev->remote_oob_data);
3d4f9c00 2517 INIT_LIST_HEAD(&hdev->le_accept_list);
cfdb0c2d 2518 INIT_LIST_HEAD(&hdev->le_resolv_list);
15819a70 2519 INIT_LIST_HEAD(&hdev->le_conn_params);
77a77a30 2520 INIT_LIST_HEAD(&hdev->pend_le_conns);
66f8455a 2521 INIT_LIST_HEAD(&hdev->pend_le_reports);
6b536b5e 2522 INIT_LIST_HEAD(&hdev->conn_hash.list);
d2609b34 2523 INIT_LIST_HEAD(&hdev->adv_instances);
600a8749 2524 INIT_LIST_HEAD(&hdev->blocked_keys);
3368aa35 2525 INIT_LIST_HEAD(&hdev->monitored_devices);
b1b813d4 2526
8961987f 2527 INIT_LIST_HEAD(&hdev->local_codecs);
b1b813d4
DH		 2528 INIT_WORK(&hdev->rx_work, hci_rx_work);
2529 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2530 INIT_WORK(&hdev->tx_work, hci_tx_work);
2531 INIT_WORK(&hdev->power_on, hci_power_on);
c7741d16 2532 INIT_WORK(&hdev->error_reset, hci_error_reset);
b1b813d4 2533
6a98e383
MH		 2534 hci_cmd_sync_init(hdev);
2535
b1b813d4 2536 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
b1b813d4 2537
b1b813d4
DH		 2538 skb_queue_head_init(&hdev->rx_q);
2539 skb_queue_head_init(&hdev->cmd_q);
2540 skb_queue_head_init(&hdev->raw_q);
2541
2542 init_waitqueue_head(&hdev->req_wait_q);
2543
65cc2b49 2544 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
de75cd0d 2545 INIT_DELAYED_WORK(&hdev->ncmd_timer, hci_ncmd_timeout);
b1b813d4 2546
5fc16cc4
JH		 2547 hci_request_setup(hdev);
2548
b1b813d4
DH		 2549 hci_init_sysfs(hdev);
2550 discovery_init(hdev);
9be0dab7
DH		 2551
2552 return hdev;
2553}
6ec56613 2554EXPORT_SYMBOL(hci_alloc_dev_priv);
9be0dab7
DH		 2555
2556/* Free HCI device */
2557void hci_free_dev(struct hci_dev *hdev)
2558{
9be0dab7
DH		 2559 /* will free via device release */
2560 put_device(&hdev->dev);
2561}
2562EXPORT_SYMBOL(hci_free_dev);
2563
1da177e4
LT		 2564/* Register HCI device */
2565int hci_register_dev(struct hci_dev *hdev)
2566{
b1b813d4 2567 int id, error;
1da177e4 2568
74292d5a 2569 if (!hdev->open || !hdev->close || !hdev->send)
1da177e4
LT		 2570 return -EINVAL;
2571
08add513
MM		 2572 /* Do not allow HCI_AMP devices to register at index 0,
2573 * so the index can be used as the AMP controller ID.
2574 */
3df92b31 2575 switch (hdev->dev_type) {
ca8bee5d 2576 case HCI_PRIMARY:
103a2f32 2577 id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
3df92b31
SL		 2578 break;
2579 case HCI_AMP:
103a2f32 2580 id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
3df92b31
SL		 2581 break;
2582 default:
2583 return -EINVAL;
1da177e4 2584 }
8e87d142 2585
3df92b31
SL		 2586 if (id < 0)
2587 return id;
2588
103a2f32 2589 snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
1da177e4 2590 hdev->id = id;
2d8b3a11
AE		 2591
2592 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2593
29e2dd0d 2594 hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
33ca954d
DH		 2595 if (!hdev->workqueue) {
2596 error = -ENOMEM;
2597 goto err;
2598 }
f48fd9c8 2599
29e2dd0d
TH		 2600 hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
2601 hdev->name);
6ead1bbc
JH		 2602 if (!hdev->req_workqueue) {
2603 destroy_workqueue(hdev->workqueue);
2604 error = -ENOMEM;
2605 goto err;
2606 }
2607
0153e2ec
MH		 2608 if (!IS_ERR_OR_NULL(bt_debugfs))
2609 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
2610
bdc3e0f1
MH		 2611 dev_set_name(&hdev->dev, "%s", hdev->name);
2612
2613 error = device_add(&hdev->dev);
33ca954d 2614 if (error < 0)
54506918 2615 goto err_wqueue;
1da177e4 2616
6d5d2ee6
HK		 2617 hci_leds_init(hdev);
2618
611b30f7 2619 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 2620 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2621 hdev);
611b30f7
MH		 2622 if (hdev->rfkill) {
2623 if (rfkill_register(hdev->rfkill) < 0) {
2624 rfkill_destroy(hdev->rfkill);
2625 hdev->rfkill = NULL;
2626 }
2627 }
2628
5e130367 2629 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
a1536da2 2630 hci_dev_set_flag(hdev, HCI_RFKILLED);
5e130367 2631
a1536da2
MH		 2632 hci_dev_set_flag(hdev, HCI_SETUP);
2633 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
ce2be9ac 2634
ca8bee5d 2635 if (hdev->dev_type == HCI_PRIMARY) {
56f87901
JH		 2636 /* Assume BR/EDR support until proven otherwise (such as
2637 * through reading supported features during init.
2638 */
a1536da2 2639 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
56f87901 2640 }
ce2be9ac 2641
fcee3377
GP		 2642 write_lock(&hci_dev_list_lock);
2643 list_add(&hdev->list, &hci_dev_list);
2644 write_unlock(&hci_dev_list_lock);
2645
4a964404
MH		 2646 /* Devices that are marked for raw-only usage are unconfigured
2647 * and should not be included in normal operation.
fee746b0
MH		 2648 */
2649 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
a1536da2 2650 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
fee746b0 2651
fe92ee64
LAD		 2652 /* Mark Remote Wakeup connection flag as supported if driver has wakeup
2653 * callback.
2654 */
2655 if (hdev->wakeup)
e1cff700 2656 hdev->conn_flags |= HCI_CONN_FLAG_REMOTE_WAKEUP;
fe92ee64 2657
05fcd4c4 2658 hci_sock_dev_event(hdev, HCI_DEV_REG);
dc946bd8 2659 hci_dev_hold(hdev);
1da177e4 2660
91117864
DC		 2661 error = hci_register_suspend_notifier(hdev);
2662 if (error)
0d75da38 2663 BT_WARN("register suspend notifier failed error:%d\n", error);
9952d90e 2664
19202573 2665 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 2666
e5e1e7fd 2667 idr_init(&hdev->adv_monitors_idr);
5031ffcc 2668 msft_register(hdev);
e5e1e7fd 2669
1da177e4 2670 return id;
f48fd9c8 2671
33ca954d 2672err_wqueue:
5a4bb6a8 2673 debugfs_remove_recursive(hdev->debugfs);
33ca954d 2674 destroy_workqueue(hdev->workqueue);
6ead1bbc 2675 destroy_workqueue(hdev->req_workqueue);
33ca954d 2676err:
3df92b31 2677 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 2678
33ca954d 2679 return error;
1da177e4
LT		 2680}
2681EXPORT_SYMBOL(hci_register_dev);
2682
2683/* Unregister HCI device */
59735631 2684void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 2685{
c13854ce 2686 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 2687
a1536da2 2688 hci_dev_set_flag(hdev, HCI_UNREGISTER);
94324962 2689
f20d09d5 2690 write_lock(&hci_dev_list_lock);
1da177e4 2691 list_del(&hdev->list);
f20d09d5 2692 write_unlock(&hci_dev_list_lock);
1da177e4 2693
e36bea6e
VV		 2694 cancel_work_sync(&hdev->power_on);
2695
6a98e383
MH		 2696 hci_cmd_sync_clear(hdev);
2697
359ee4f8 2698 hci_unregister_suspend_notifier(hdev);
4e8c36c3 2699
5031ffcc
MC		 2700 msft_unregister(hdev);
2701
4e8c36c3 2702 hci_dev_do_close(hdev);
9952d90e 2703
ab81cbf9 2704 if (!test_bit(HCI_INIT, &hdev->flags) &&
d7a5a11d
MH		 2705 !hci_dev_test_flag(hdev, HCI_SETUP) &&
2706 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
09fd0de5 2707 hci_dev_lock(hdev);
744cf19e 2708 mgmt_index_removed(hdev);
09fd0de5 2709 hci_dev_unlock(hdev);
56e5cb86 2710 }
ab81cbf9 2711
2e58ef3e
JH		 2712 /* mgmt_index_removed should take care of emptying the
2713 * pending list */
2714 BUG_ON(!list_empty(&hdev->mgmt_pending));
2715
05fcd4c4 2716 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
1da177e4 2717
611b30f7
MH		 2718 if (hdev->rfkill) {
2719 rfkill_unregister(hdev->rfkill);
2720 rfkill_destroy(hdev->rfkill);
2721 }
2722
bdc3e0f1 2723 device_del(&hdev->dev);
e61fbee7 2724 /* Actual cleanup is deferred until hci_release_dev(). */
e0448092
TH		 2725 hci_dev_put(hdev);
2726}
2727EXPORT_SYMBOL(hci_unregister_dev);
147e2d59 2728
58ce6d5b
TH		 2729/* Release HCI device */
2730void hci_release_dev(struct hci_dev *hdev)
e0448092 2731{
0153e2ec 2732 debugfs_remove_recursive(hdev->debugfs);
5177a838
MH		 2733 kfree_const(hdev->hw_info);
2734 kfree_const(hdev->fw_info);
0153e2ec 2735
f48fd9c8 2736 destroy_workqueue(hdev->workqueue);
6ead1bbc 2737 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 2738
09fd0de5 2739 hci_dev_lock(hdev);
3d4f9c00
AP		 2740 hci_bdaddr_list_clear(&hdev->reject_list);
2741 hci_bdaddr_list_clear(&hdev->accept_list);
2aeb9a1a 2742 hci_uuids_clear(hdev);
55ed8ca1 2743 hci_link_keys_clear(hdev);
b899efaf 2744 hci_smp_ltks_clear(hdev);
970c4e46 2745 hci_smp_irks_clear(hdev);
2763eda6 2746 hci_remote_oob_data_clear(hdev);
d2609b34 2747 hci_adv_instances_clear(hdev);
e5e1e7fd 2748 hci_adv_monitors_clear(hdev);
3d4f9c00 2749 hci_bdaddr_list_clear(&hdev->le_accept_list);
cfdb0c2d 2750 hci_bdaddr_list_clear(&hdev->le_resolv_list);
373110c5 2751 hci_conn_params_clear_all(hdev);
22078800 2752 hci_discovery_filter_clear(hdev);
600a8749 2753 hci_blocked_keys_clear(hdev);
09fd0de5 2754 hci_dev_unlock(hdev);
e2e0cacb 2755
e0448092 2756 ida_simple_remove(&hci_index_ida, hdev->id);
dd3b1dc3 2757 kfree_skb(hdev->sent_cmd);
dfe6d5c3 2758 kfree_skb(hdev->recv_event);
58ce6d5b 2759 kfree(hdev);
1da177e4 2760}
58ce6d5b 2761EXPORT_SYMBOL(hci_release_dev);
1da177e4 2762
359ee4f8
APS		 2763int hci_register_suspend_notifier(struct hci_dev *hdev)
2764{
2765 int ret = 0;
2766
b5ca3387
LAD		 2767 if (!hdev->suspend_notifier.notifier_call &&
2768 !test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
359ee4f8
APS		 2769 hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
2770 ret = register_pm_notifier(&hdev->suspend_notifier);
2771 }
2772
2773 return ret;
2774}
2775
2776int hci_unregister_suspend_notifier(struct hci_dev *hdev)
2777{
2778 int ret = 0;
2779
b5ca3387 2780 if (hdev->suspend_notifier.notifier_call) {
359ee4f8 2781 ret = unregister_pm_notifier(&hdev->suspend_notifier);
b5ca3387
LAD		 2782 if (!ret)
2783 hdev->suspend_notifier.notifier_call = NULL;
2784 }
359ee4f8
APS		 2785
2786 return ret;
2787}
2788
1da177e4
LT		 2789/* Suspend HCI device */
2790int hci_suspend_dev(struct hci_dev *hdev)
2791{
e1b77d68 2792 int ret;
e1b77d68
LAD		 2793
2794 bt_dev_dbg(hdev, "");
2795
2796 /* Suspend should only act on when powered. */
2797 if (!hdev_is_powered(hdev) ||
2798 hci_dev_test_flag(hdev, HCI_UNREGISTER))
2799 return 0;
2800
182ee45d
LAD		 2801 /* If powering down don't attempt to suspend */
2802 if (mgmt_powering_down(hdev))
2803 return 0;
4539ca67 2804
182ee45d
LAD		 2805 hci_req_sync_lock(hdev);
2806 ret = hci_suspend_sync(hdev);
2807 hci_req_sync_unlock(hdev);
e1b77d68
LAD		 2808
2809 hci_clear_wake_reason(hdev);
182ee45d 2810 mgmt_suspending(hdev, hdev->suspend_state);
e1b77d68 2811
05fcd4c4 2812 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
e1b77d68 2813 return ret;
1da177e4
LT		 2814}
2815EXPORT_SYMBOL(hci_suspend_dev);
2816
2817/* Resume HCI device */
2818int hci_resume_dev(struct hci_dev *hdev)
2819{
e1b77d68
LAD		 2820 int ret;
2821
2822 bt_dev_dbg(hdev, "");
2823
2824 /* Resume should only act on when powered. */
2825 if (!hdev_is_powered(hdev) ||
2826 hci_dev_test_flag(hdev, HCI_UNREGISTER))
2827 return 0;
2828
2829 /* If powering down don't attempt to resume */
2830 if (mgmt_powering_down(hdev))
2831 return 0;
2832
182ee45d
LAD		 2833 hci_req_sync_lock(hdev);
2834 ret = hci_resume_sync(hdev);
2835 hci_req_sync_unlock(hdev);
e1b77d68
LAD		 2836
2837 mgmt_resuming(hdev, hdev->wake_reason, &hdev->wake_addr,
182ee45d 2838 hdev->wake_addr_type);
e1b77d68 2839
05fcd4c4 2840 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
e1b77d68 2841 return ret;
1da177e4
LT		 2842}
2843EXPORT_SYMBOL(hci_resume_dev);
2844
75e0569f
MH		 2845/* Reset HCI device */
2846int hci_reset_dev(struct hci_dev *hdev)
2847{
1e4b6e91 2848 static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
75e0569f
MH		 2849 struct sk_buff *skb;
2850
2851 skb = bt_skb_alloc(3, GFP_ATOMIC);
2852 if (!skb)
2853 return -ENOMEM;
2854
d79f34e3 2855 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
59ae1d12 2856 skb_put_data(skb, hw_err, 3);
75e0569f 2857
de75cd0d
MM		 2858 bt_dev_err(hdev, "Injecting HCI hardware error event");
2859
75e0569f
MH		 2860 /* Send Hardware Error to upper stack */
2861 return hci_recv_frame(hdev, skb);
2862}
2863EXPORT_SYMBOL(hci_reset_dev);
2864
76bca880 2865/* Receive frame from HCI drivers */
e1a26170 2866int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
76bca880 2867{
76bca880 2868 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 2869 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 2870 kfree_skb(skb);
2871 return -ENXIO;
2872 }
2873
876e7810
LAD		 2874 switch (hci_skb_pkt_type(skb)) {
2875 case HCI_EVENT_PKT:
2876 break;
2877 case HCI_ACLDATA_PKT:
2878 /* Detect if ISO packet has been sent as ACL */
2879 if (hci_conn_num(hdev, ISO_LINK)) {
2880 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
2881 __u8 type;
2882
2883 type = hci_conn_lookup_type(hdev, hci_handle(handle));
2884 if (type == ISO_LINK)
2885 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
2886 }
2887 break;
2888 case HCI_SCODATA_PKT:
2889 break;
2890 case HCI_ISODATA_PKT:
2891 break;
2892 default:
fe806dce
MH		 2893 kfree_skb(skb);
2894 return -EINVAL;
2895 }
2896
d82603c6 2897 /* Incoming skb */
76bca880
MH		 2898 bt_cb(skb)->incoming = 1;
2899
2900 /* Time stamp */
2901 __net_timestamp(skb);
2902
76bca880 2903 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 2904 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 2905
76bca880
MH		 2906 return 0;
2907}
2908EXPORT_SYMBOL(hci_recv_frame);
2909
e875ff84
MH		 2910/* Receive diagnostic message from HCI drivers */
2911int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
2912{
581d6fd6 2913 /* Mark as diagnostic packet */
d79f34e3 2914 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
581d6fd6 2915
e875ff84
MH		 2916 /* Time stamp */
2917 __net_timestamp(skb);
2918
581d6fd6
MH		 2919 skb_queue_tail(&hdev->rx_q, skb);
2920 queue_work(hdev->workqueue, &hdev->rx_work);
e875ff84 2921
e875ff84
MH		 2922 return 0;
2923}
2924EXPORT_SYMBOL(hci_recv_diag);
2925
5177a838
MH		 2926void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
2927{
2928 va_list vargs;
2929
2930 va_start(vargs, fmt);
2931 kfree_const(hdev->hw_info);
2932 hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2933 va_end(vargs);
2934}
2935EXPORT_SYMBOL(hci_set_hw_info);
2936
2937void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
2938{
2939 va_list vargs;
2940
2941 va_start(vargs, fmt);
2942 kfree_const(hdev->fw_info);
2943 hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2944 va_end(vargs);
2945}
2946EXPORT_SYMBOL(hci_set_fw_info);
2947
1da177e4
LT		 2948/* ---- Interface to upper protocols ---- */
2949
1da177e4
LT		 2950int hci_register_cb(struct hci_cb *cb)
2951{
2952 BT_DBG("%p name %s", cb, cb->name);
2953
fba7ecf0 2954 mutex_lock(&hci_cb_list_lock);
00629e0f 2955 list_add_tail(&cb->list, &hci_cb_list);
fba7ecf0 2956 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 2957
2958 return 0;
2959}
2960EXPORT_SYMBOL(hci_register_cb);
2961
2962int hci_unregister_cb(struct hci_cb *cb)
2963{
2964 BT_DBG("%p name %s", cb, cb->name);
2965
fba7ecf0 2966 mutex_lock(&hci_cb_list_lock);
1da177e4 2967 list_del(&cb->list);
fba7ecf0 2968 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 2969
2970 return 0;
2971}
2972EXPORT_SYMBOL(hci_unregister_cb);
2973
2250abad 2974static int hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 2975{
cdc52faa
MH		 2976 int err;
2977
d79f34e3
MH		 2978 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
2979 skb->len);
1da177e4 2980
cd82e61c
MH		 2981 /* Time stamp */
2982 __net_timestamp(skb);
1da177e4 2983
cd82e61c
MH		 2984 /* Send copy to monitor */
2985 hci_send_to_monitor(hdev, skb);
2986
2987 if (atomic_read(&hdev->promisc)) {
2988 /* Send copy to the sockets */
470fe1b5 2989 hci_send_to_sock(hdev, skb);
1da177e4
LT		 2990 }
2991
2992 /* Get rid of skb owner, prior to sending to the driver. */
2993 skb_orphan(skb);
2994
73d0d3c8
MH		 2995 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
2996 kfree_skb(skb);
2250abad 2997 return -EINVAL;
73d0d3c8
MH		 2998 }
2999
cdc52faa
MH		 3000 err = hdev->send(hdev, skb);
3001 if (err < 0) {
2064ee33 3002 bt_dev_err(hdev, "sending frame failed (%d)", err);
cdc52faa 3003 kfree_skb(skb);
2250abad 3004 return err;
cdc52faa 3005 }
2250abad
BB		 3006
3007 return 0;
1da177e4
LT		 3008}
3009
1ca3a9d0 3010/* Send HCI command */
07dc93dd
JH		 3011int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3012 const void *param)
1ca3a9d0
JH		 3013{
3014 struct sk_buff *skb;
3015
3016 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3017
3018 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3019 if (!skb) {
2064ee33 3020 bt_dev_err(hdev, "no memory for command");
1ca3a9d0
JH		 3021 return -ENOMEM;
3022 }
3023
49c922bb 3024 /* Stand-alone HCI commands must be flagged as
11714b3d
JH		 3025 * single-command requests.
3026 */
44d27137 3027 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
11714b3d 3028
1da177e4 3029 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 3030 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3031
3032 return 0;
3033}
1da177e4 3034
d6ee6ad7
LP		 3035int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
3036 const void *param)
3037{
3038 struct sk_buff *skb;
3039
3040 if (hci_opcode_ogf(opcode) != 0x3f) {
3041 /* A controller receiving a command shall respond with either
3042 * a Command Status Event or a Command Complete Event.
3043 * Therefore, all standard HCI commands must be sent via the
3044 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
3045 * Some vendors do not comply with this rule for vendor-specific
3046 * commands and do not return any event. We want to support
3047 * unresponded commands for such cases only.
3048 */
3049 bt_dev_err(hdev, "unresponded command not supported");
3050 return -EINVAL;
3051 }
3052
3053 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3054 if (!skb) {
3055 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
3056 opcode);
3057 return -ENOMEM;
3058 }
3059
3060 hci_send_frame(hdev, skb);
3061
3062 return 0;
3063}
3064EXPORT_SYMBOL(__hci_cmd_send);
3065
1da177e4 3066/* Get data from the previously sent command */
a9de9248 3067void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 3068{
3069 struct hci_command_hdr *hdr;
3070
3071 if (!hdev->sent_cmd)
3072 return NULL;
3073
3074 hdr = (void *) hdev->sent_cmd->data;
3075
a9de9248 3076 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 3077 return NULL;
3078
f0e09510 3079 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 3080
3081 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3082}
3083
dfe6d5c3
LAD		 3084/* Get data from last received event */
3085void *hci_recv_event_data(struct hci_dev *hdev, __u8 event)
3086{
3087 struct hci_event_hdr *hdr;
3088 int offset;
3089
3090 if (!hdev->recv_event)
3091 return NULL;
3092
3093 hdr = (void *)hdev->recv_event->data;
3094 offset = sizeof(*hdr);
3095
3096 if (hdr->evt != event) {
3097 /* In case of LE metaevent check the subevent match */
3098 if (hdr->evt == HCI_EV_LE_META) {
3099 struct hci_ev_le_meta *ev;
3100
3101 ev = (void *)hdev->recv_event->data + offset;
3102 offset += sizeof(*ev);
3103 if (ev->subevent == event)
3104 goto found;
3105 }
3106 return NULL;
3107 }
3108
3109found:
3110 bt_dev_dbg(hdev, "event 0x%2.2x", event);
3111
3112 return hdev->recv_event->data + offset;
3113}
3114
1da177e4
LT		 3115/* Send ACL data */
3116static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3117{
3118 struct hci_acl_hdr *hdr;
3119 int len = skb->len;
3120
badff6d0
ACM		 3121 skb_push(skb, HCI_ACL_HDR_SIZE);
3122 skb_reset_transport_header(skb);
9c70220b 3123 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 3124 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3125 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 3126}
3127
ee22be7e 3128static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 3129 struct sk_buff *skb, __u16 flags)
1da177e4 3130{
ee22be7e 3131 struct hci_conn *conn = chan->conn;
1da177e4
LT		 3132 struct hci_dev *hdev = conn->hdev;
3133 struct sk_buff *list;
3134
087bfd99
GP		 3135 skb->len = skb_headlen(skb);
3136 skb->data_len = 0;
3137
d79f34e3 3138 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
204a6e54
AE		 3139
3140 switch (hdev->dev_type) {
ca8bee5d 3141 case HCI_PRIMARY:
204a6e54
AE		 3142 hci_add_acl_hdr(skb, conn->handle, flags);
3143 break;
3144 case HCI_AMP:
3145 hci_add_acl_hdr(skb, chan->handle, flags);
3146 break;
3147 default:
2064ee33 3148 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
204a6e54
AE		 3149 return;
3150 }
087bfd99 3151
70f23020
AE		 3152 list = skb_shinfo(skb)->frag_list;
3153 if (!list) {
1da177e4
LT		 3154 /* Non fragmented */
3155 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3156
73d80deb 3157 skb_queue_tail(queue, skb);
1da177e4
LT		 3158 } else {
3159 /* Fragmented */
3160 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3161
3162 skb_shinfo(skb)->frag_list = NULL;
3163
9cfd5a23
JR		 3164 /* Queue all fragments atomically. We need to use spin_lock_bh
3165 * here because of 6LoWPAN links, as there this function is
3166 * called from softirq and using normal spin lock could cause
3167 * deadlocks.
3168 */
3169 spin_lock_bh(&queue->lock);
1da177e4 3170
73d80deb 3171 __skb_queue_tail(queue, skb);
e702112f
AE		 3172
3173 flags &= ~ACL_START;
3174 flags |= ACL_CONT;
1da177e4
LT		 3175 do {
3176 skb = list; list = list->next;
8e87d142 3177
d79f34e3 3178 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
e702112f 3179 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 3180
3181 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3182
73d80deb 3183 __skb_queue_tail(queue, skb);
1da177e4
LT		 3184 } while (list);
3185
9cfd5a23 3186 spin_unlock_bh(&queue->lock);
1da177e4 3187 }
73d80deb
LAD		 3188}
3189
3190void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3191{
ee22be7e 3192 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 3193
f0e09510 3194 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb 3195
ee22be7e 3196 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 3197
3eff45ea 3198 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3199}
1da177e4
LT		 3200
3201/* Send SCO data */
0d861d8b 3202void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 3203{
3204 struct hci_dev *hdev = conn->hdev;
3205 struct hci_sco_hdr hdr;
3206
3207 BT_DBG("%s len %d", hdev->name, skb->len);
3208
aca3192c 3209 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 3210 hdr.dlen = skb->len;
3211
badff6d0
ACM		 3212 skb_push(skb, HCI_SCO_HDR_SIZE);
3213 skb_reset_transport_header(skb);
9c70220b 3214 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4 3215
d79f34e3 3216 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
c78ae283 3217
1da177e4 3218 skb_queue_tail(&conn->data_q, skb);
3eff45ea 3219 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3220}
1da177e4 3221
26afbd82
LAD		 3222/* Send ISO data */
3223static void hci_add_iso_hdr(struct sk_buff *skb, __u16 handle, __u8 flags)
3224{
3225 struct hci_iso_hdr *hdr;
3226 int len = skb->len;
3227
3228 skb_push(skb, HCI_ISO_HDR_SIZE);
3229 skb_reset_transport_header(skb);
3230 hdr = (struct hci_iso_hdr *)skb_transport_header(skb);
3231 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3232 hdr->dlen = cpu_to_le16(len);
3233}
3234
3235static void hci_queue_iso(struct hci_conn *conn, struct sk_buff_head *queue,
3236 struct sk_buff *skb)
3237{
3238 struct hci_dev *hdev = conn->hdev;
3239 struct sk_buff *list;
3240 __u16 flags;
3241
3242 skb->len = skb_headlen(skb);
3243 skb->data_len = 0;
3244
3245 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3246
3247 list = skb_shinfo(skb)->frag_list;
3248
3249 flags = hci_iso_flags_pack(list ? ISO_START : ISO_SINGLE, 0x00);
3250 hci_add_iso_hdr(skb, conn->handle, flags);
3251
3252 if (!list) {
3253 /* Non fragmented */
3254 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3255
3256 skb_queue_tail(queue, skb);
3257 } else {
3258 /* Fragmented */
3259 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3260
3261 skb_shinfo(skb)->frag_list = NULL;
3262
3263 __skb_queue_tail(queue, skb);
3264
3265 do {
3266 skb = list; list = list->next;
3267
3268 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3269 flags = hci_iso_flags_pack(list ? ISO_CONT : ISO_END,
3270 0x00);
3271 hci_add_iso_hdr(skb, conn->handle, flags);
3272
3273 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3274
3275 __skb_queue_tail(queue, skb);
3276 } while (list);
3277 }
3278}
3279
3280void hci_send_iso(struct hci_conn *conn, struct sk_buff *skb)
3281{
3282 struct hci_dev *hdev = conn->hdev;
3283
3284 BT_DBG("%s len %d", hdev->name, skb->len);
3285
3286 hci_queue_iso(conn, &conn->data_q, skb);
3287
3288 queue_work(hdev->workqueue, &hdev->tx_work);
3289}
3290
1da177e4
LT		 3291/* ---- HCI TX task (outgoing data) ---- */
3292
3293/* HCI Connection scheduler */
26afbd82
LAD		 3294static inline void hci_quote_sent(struct hci_conn *conn, int num, int *quote)
3295{
3296 struct hci_dev *hdev;
3297 int cnt, q;
3298
3299 if (!conn) {
3300 *quote = 0;
3301 return;
3302 }
3303
3304 hdev = conn->hdev;
3305
3306 switch (conn->type) {
3307 case ACL_LINK:
3308 cnt = hdev->acl_cnt;
3309 break;
3310 case AMP_LINK:
3311 cnt = hdev->block_cnt;
3312 break;
3313 case SCO_LINK:
3314 case ESCO_LINK:
3315 cnt = hdev->sco_cnt;
3316 break;
3317 case LE_LINK:
3318 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3319 break;
3320 case ISO_LINK:
3321 cnt = hdev->iso_mtu ? hdev->iso_cnt :
3322 hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3323 break;
3324 default:
3325 cnt = 0;
3326 bt_dev_err(hdev, "unknown link type %d", conn->type);
3327 }
3328
3329 q = cnt / num;
3330 *quote = q ? q : 1;
3331}
3332
6039aa73
GP		 3333static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3334 int *quote)
1da177e4
LT		 3335{
3336 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3337 struct hci_conn *conn = NULL, *c;
abc5de8f 3338 unsigned int num = 0, min = ~0;
1da177e4 3339
8e87d142 3340 /* We don't have to lock device here. Connections are always
1da177e4 3341 * added and removed with TX task disabled. */
bf4c6325
GP		 3342
3343 rcu_read_lock();
3344
3345 list_for_each_entry_rcu(c, &h->list, list) {
769be974 3346 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 3347 continue;
769be974
MH		 3348
3349 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3350 continue;
3351
1da177e4
LT		 3352 num++;
3353
3354 if (c->sent < min) {
3355 min = c->sent;
3356 conn = c;
3357 }
52087a79
LAD		 3358
3359 if (hci_conn_num(hdev, type) == num)
3360 break;
1da177e4
LT		 3361 }
3362
bf4c6325
GP		 3363 rcu_read_unlock();
3364
26afbd82 3365 hci_quote_sent(conn, num, quote);
1da177e4
LT		 3366
3367 BT_DBG("conn %p quote %d", conn, *quote);
3368 return conn;
3369}
3370
6039aa73 3371static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 3372{
3373 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3374 struct hci_conn *c;
1da177e4 3375
2064ee33 3376 bt_dev_err(hdev, "link tx timeout");
1da177e4 3377
bf4c6325
GP		 3378 rcu_read_lock();
3379
1da177e4 3380 /* Kill stalled connections */
bf4c6325 3381 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 3382 if (c->type == type && c->sent) {
2064ee33
MH		 3383 bt_dev_err(hdev, "killing stalled connection %pMR",
3384 &c->dst);
bed71748 3385 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 3386 }
3387 }
bf4c6325
GP		 3388
3389 rcu_read_unlock();
1da177e4
LT		 3390}
3391
6039aa73
GP		 3392static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3393 int *quote)
1da177e4 3394{
73d80deb
LAD		 3395 struct hci_conn_hash *h = &hdev->conn_hash;
3396 struct hci_chan *chan = NULL;
abc5de8f 3397 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 3398 struct hci_conn *conn;
26afbd82 3399 int conn_num = 0;
73d80deb
LAD		 3400
3401 BT_DBG("%s", hdev->name);
3402
bf4c6325
GP		 3403 rcu_read_lock();
3404
3405 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 3406 struct hci_chan *tmp;
3407
3408 if (conn->type != type)
3409 continue;
3410
3411 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3412 continue;
3413
3414 conn_num++;
3415
8192edef 3416 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 3417 struct sk_buff *skb;
3418
3419 if (skb_queue_empty(&tmp->data_q))
3420 continue;
3421
3422 skb = skb_peek(&tmp->data_q);
3423 if (skb->priority < cur_prio)
3424 continue;
3425
3426 if (skb->priority > cur_prio) {
3427 num = 0;
3428 min = ~0;
3429 cur_prio = skb->priority;
3430 }
3431
3432 num++;
3433
3434 if (conn->sent < min) {
3435 min = conn->sent;
3436 chan = tmp;
3437 }
3438 }
3439
3440 if (hci_conn_num(hdev, type) == conn_num)
3441 break;
3442 }
3443
bf4c6325
GP		 3444 rcu_read_unlock();
3445
73d80deb
LAD		 3446 if (!chan)
3447 return NULL;
3448
26afbd82 3449 hci_quote_sent(chan->conn, num, quote);
73d80deb 3450
73d80deb
LAD		 3451 BT_DBG("chan %p quote %d", chan, *quote);
3452 return chan;
3453}
3454
02b20f0b
LAD		 3455static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3456{
3457 struct hci_conn_hash *h = &hdev->conn_hash;
3458 struct hci_conn *conn;
3459 int num = 0;
3460
3461 BT_DBG("%s", hdev->name);
3462
bf4c6325
GP		 3463 rcu_read_lock();
3464
3465 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 3466 struct hci_chan *chan;
3467
3468 if (conn->type != type)
3469 continue;
3470
3471 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3472 continue;
3473
3474 num++;
3475
8192edef 3476 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 3477 struct sk_buff *skb;
3478
3479 if (chan->sent) {
3480 chan->sent = 0;
3481 continue;
3482 }
3483
3484 if (skb_queue_empty(&chan->data_q))
3485 continue;
3486
3487 skb = skb_peek(&chan->data_q);
3488 if (skb->priority >= HCI_PRIO_MAX - 1)
3489 continue;
3490
3491 skb->priority = HCI_PRIO_MAX - 1;
3492
3493 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 3494 skb->priority);
02b20f0b
LAD		 3495 }
3496
3497 if (hci_conn_num(hdev, type) == num)
3498 break;
3499 }
bf4c6325
GP		 3500
3501 rcu_read_unlock();
3502
02b20f0b
LAD		 3503}
3504
b71d385a
AE		 3505static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3506{
3507 /* Calculate count of blocks used by this packet */
3508 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3509}
3510
116523c8 3511static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type)
73d80deb 3512{
116523c8
LAD		 3513 unsigned long last_tx;
3514
3515 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
3516 return;
3517
3518 switch (type) {
3519 case LE_LINK:
3520 last_tx = hdev->le_last_tx;
3521 break;
3522 default:
3523 last_tx = hdev->acl_last_tx;
3524 break;
1da177e4 3525 }
116523c8
LAD		 3526
3527 /* tx timeout must be longer than maximum link supervision timeout
3528 * (40.9 seconds)
3529 */
3530 if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT))
3531 hci_link_tx_to(hdev, type);
63d2bc1b 3532}
1da177e4 3533
7fedd3bb
APS		 3534/* Schedule SCO */
3535static void hci_sched_sco(struct hci_dev *hdev)
3536{
3537 struct hci_conn *conn;
3538 struct sk_buff *skb;
3539 int quote;
3540
3541 BT_DBG("%s", hdev->name);
3542
3543 if (!hci_conn_num(hdev, SCO_LINK))
3544 return;
3545
3546 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3547 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3548 BT_DBG("skb %p len %d", skb, skb->len);
3549 hci_send_frame(hdev, skb);
3550
3551 conn->sent++;
3552 if (conn->sent == ~0)
3553 conn->sent = 0;
3554 }
3555 }
3556}
3557
3558static void hci_sched_esco(struct hci_dev *hdev)
3559{
3560 struct hci_conn *conn;
3561 struct sk_buff *skb;
3562 int quote;
3563
3564 BT_DBG("%s", hdev->name);
3565
3566 if (!hci_conn_num(hdev, ESCO_LINK))
3567 return;
3568
3569 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3570 &quote))) {
3571 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3572 BT_DBG("skb %p len %d", skb, skb->len);
3573 hci_send_frame(hdev, skb);
3574
3575 conn->sent++;
3576 if (conn->sent == ~0)
3577 conn->sent = 0;
3578 }
3579 }
3580}
3581
6039aa73 3582static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 3583{
3584 unsigned int cnt = hdev->acl_cnt;
3585 struct hci_chan *chan;
3586 struct sk_buff *skb;
3587 int quote;
3588
116523c8 3589 __check_timeout(hdev, cnt, ACL_LINK);
04837f64 3590
73d80deb 3591 while (hdev->acl_cnt &&
a8c5fb1a 3592 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 3593 u32 priority = (skb_peek(&chan->data_q))->priority;
3594 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3595 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3596 skb->len, skb->priority);
73d80deb 3597
ec1cce24
LAD		 3598 /* Stop if priority has changed */
3599 if (skb->priority < priority)
3600 break;
3601
3602 skb = skb_dequeue(&chan->data_q);
3603
73d80deb 3604 hci_conn_enter_active_mode(chan->conn,
04124681 3605 bt_cb(skb)->force_active);
04837f64 3606
57d17d70 3607 hci_send_frame(hdev, skb);
1da177e4
LT		 3608 hdev->acl_last_tx = jiffies;
3609
3610 hdev->acl_cnt--;
73d80deb
LAD		 3611 chan->sent++;
3612 chan->conn->sent++;
7fedd3bb
APS		 3613
3614 /* Send pending SCO packets right away */
3615 hci_sched_sco(hdev);
3616 hci_sched_esco(hdev);
1da177e4
LT		 3617 }
3618 }
02b20f0b
LAD		 3619
3620 if (cnt != hdev->acl_cnt)
3621 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 3622}
3623
6039aa73 3624static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 3625{
63d2bc1b 3626 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 3627 struct hci_chan *chan;
3628 struct sk_buff *skb;
3629 int quote;
bd1eb66b 3630 u8 type;
b71d385a 3631
bd1eb66b
AE		 3632 BT_DBG("%s", hdev->name);
3633
3634 if (hdev->dev_type == HCI_AMP)
3635 type = AMP_LINK;
3636 else
3637 type = ACL_LINK;
3638
116523c8
LAD		 3639 __check_timeout(hdev, cnt, type);
3640
b71d385a 3641 while (hdev->block_cnt > 0 &&
bd1eb66b 3642 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 3643 u32 priority = (skb_peek(&chan->data_q))->priority;
3644 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3645 int blocks;
3646
3647 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3648 skb->len, skb->priority);
b71d385a
AE		 3649
3650 /* Stop if priority has changed */
3651 if (skb->priority < priority)
3652 break;
3653
3654 skb = skb_dequeue(&chan->data_q);
3655
3656 blocks = __get_blocks(hdev, skb);
3657 if (blocks > hdev->block_cnt)
3658 return;
3659
3660 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 3661 bt_cb(skb)->force_active);
b71d385a 3662
57d17d70 3663 hci_send_frame(hdev, skb);
b71d385a
AE		 3664 hdev->acl_last_tx = jiffies;
3665
3666 hdev->block_cnt -= blocks;
3667 quote -= blocks;
3668
3669 chan->sent += blocks;
3670 chan->conn->sent += blocks;
3671 }
3672 }
3673
3674 if (cnt != hdev->block_cnt)
bd1eb66b 3675 hci_prio_recalculate(hdev, type);
b71d385a
AE		 3676}
3677
6039aa73 3678static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 3679{
3680 BT_DBG("%s", hdev->name);
3681
bd1eb66b 3682 /* No ACL link over BR/EDR controller */
ca8bee5d 3683 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
bd1eb66b
AE		 3684 return;
3685
3686 /* No AMP link over AMP controller */
3687 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 3688 return;
3689
3690 switch (hdev->flow_ctl_mode) {
3691 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3692 hci_sched_acl_pkt(hdev);
3693 break;
3694
3695 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3696 hci_sched_acl_blk(hdev);
3697 break;
3698 }
3699}
3700
6039aa73 3701static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 3702{
73d80deb 3703 struct hci_chan *chan;
6ed58ec5 3704 struct sk_buff *skb;
02b20f0b 3705 int quote, cnt, tmp;
6ed58ec5
VT		 3706
3707 BT_DBG("%s", hdev->name);
3708
52087a79
LAD		 3709 if (!hci_conn_num(hdev, LE_LINK))
3710 return;
3711
6ed58ec5 3712 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
1b1d29e5 3713
116523c8 3714 __check_timeout(hdev, cnt, LE_LINK);
1b1d29e5 3715
02b20f0b 3716 tmp = cnt;
73d80deb 3717 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 3718 u32 priority = (skb_peek(&chan->data_q))->priority;
3719 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3720 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3721 skb->len, skb->priority);
6ed58ec5 3722
ec1cce24
LAD		 3723 /* Stop if priority has changed */
3724 if (skb->priority < priority)
3725 break;
3726
3727 skb = skb_dequeue(&chan->data_q);
3728
57d17d70 3729 hci_send_frame(hdev, skb);
6ed58ec5
VT		 3730 hdev->le_last_tx = jiffies;
3731
3732 cnt--;
73d80deb
LAD		 3733 chan->sent++;
3734 chan->conn->sent++;
7fedd3bb
APS		 3735
3736 /* Send pending SCO packets right away */
3737 hci_sched_sco(hdev);
3738 hci_sched_esco(hdev);
6ed58ec5
VT		 3739 }
3740 }
73d80deb 3741
6ed58ec5
VT		 3742 if (hdev->le_pkts)
3743 hdev->le_cnt = cnt;
3744 else
3745 hdev->acl_cnt = cnt;
02b20f0b
LAD		 3746
3747 if (cnt != tmp)
3748 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 3749}
3750
26afbd82
LAD		 3751/* Schedule CIS */
3752static void hci_sched_iso(struct hci_dev *hdev)
3753{
3754 struct hci_conn *conn;
3755 struct sk_buff *skb;
3756 int quote, *cnt;
3757
3758 BT_DBG("%s", hdev->name);
3759
3760 if (!hci_conn_num(hdev, ISO_LINK))
3761 return;
3762
3763 cnt = hdev->iso_pkts ? &hdev->iso_cnt :
3764 hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
3765 while (*cnt && (conn = hci_low_sent(hdev, ISO_LINK, &quote))) {
3766 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3767 BT_DBG("skb %p len %d", skb, skb->len);
3768 hci_send_frame(hdev, skb);
3769
3770 conn->sent++;
3771 if (conn->sent == ~0)
3772 conn->sent = 0;
3773 (*cnt)--;
3774 }
3775 }
3776}
3777
3eff45ea 3778static void hci_tx_work(struct work_struct *work)
1da177e4 3779{
3eff45ea 3780 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 3781 struct sk_buff *skb;
3782
26afbd82
LAD		 3783 BT_DBG("%s acl %d sco %d le %d iso %d", hdev->name, hdev->acl_cnt,
3784 hdev->sco_cnt, hdev->le_cnt, hdev->iso_cnt);
1da177e4 3785
d7a5a11d 3786 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
52de599e 3787 /* Schedule queues and send stuff to HCI driver */
52de599e
MH		 3788 hci_sched_sco(hdev);
3789 hci_sched_esco(hdev);
26afbd82 3790 hci_sched_iso(hdev);
7fedd3bb 3791 hci_sched_acl(hdev);
52de599e
MH		 3792 hci_sched_le(hdev);
3793 }
6ed58ec5 3794
1da177e4
LT		 3795 /* Send next queued raw (unknown type) packet */
3796 while ((skb = skb_dequeue(&hdev->raw_q)))
57d17d70 3797 hci_send_frame(hdev, skb);
1da177e4
LT		 3798}
3799
25985edc 3800/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 3801
3802/* ACL data packet */
6039aa73 3803static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3804{
3805 struct hci_acl_hdr *hdr = (void *) skb->data;
3806 struct hci_conn *conn;
3807 __u16 handle, flags;
3808
3809 skb_pull(skb, HCI_ACL_HDR_SIZE);
3810
3811 handle = __le16_to_cpu(hdr->handle);
3812 flags = hci_flags(handle);
3813 handle = hci_handle(handle);
3814
f0e09510 3815 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 3816 handle, flags);
1da177e4
LT		 3817
3818 hdev->stat.acl_rx++;
3819
3820 hci_dev_lock(hdev);
3821 conn = hci_conn_hash_lookup_handle(hdev, handle);
3822 hci_dev_unlock(hdev);
8e87d142 3823
1da177e4 3824 if (conn) {
65983fc7 3825 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 3826
1da177e4 3827 /* Send to upper protocol */
686ebf28
UF		 3828 l2cap_recv_acldata(conn, skb, flags);
3829 return;
1da177e4 3830 } else {
2064ee33
MH		 3831 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
3832 handle);
1da177e4
LT		 3833 }
3834
3835 kfree_skb(skb);
3836}
3837
3838/* SCO data packet */
6039aa73 3839static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3840{
3841 struct hci_sco_hdr *hdr = (void *) skb->data;
3842 struct hci_conn *conn;
debdedf2 3843 __u16 handle, flags;
1da177e4
LT		 3844
3845 skb_pull(skb, HCI_SCO_HDR_SIZE);
3846
3847 handle = __le16_to_cpu(hdr->handle);
debdedf2
MH		 3848 flags = hci_flags(handle);
3849 handle = hci_handle(handle);
1da177e4 3850
debdedf2
MH		 3851 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
3852 handle, flags);
1da177e4
LT		 3853
3854 hdev->stat.sco_rx++;
3855
3856 hci_dev_lock(hdev);
3857 conn = hci_conn_hash_lookup_handle(hdev, handle);
3858 hci_dev_unlock(hdev);
3859
3860 if (conn) {
1da177e4 3861 /* Send to upper protocol */
00398e1d 3862 bt_cb(skb)->sco.pkt_status = flags & 0x03;
686ebf28
UF		 3863 sco_recv_scodata(conn, skb);
3864 return;
1da177e4 3865 } else {
2d4b37b6
LAD		 3866 bt_dev_err_ratelimited(hdev, "SCO packet for unknown connection handle %d",
3867 handle);
1da177e4
LT		 3868 }
3869
3870 kfree_skb(skb);
3871}
3872
26afbd82
LAD		 3873static void hci_isodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3874{
3875 struct hci_iso_hdr *hdr;
3876 struct hci_conn *conn;
3877 __u16 handle, flags;
3878
3879 hdr = skb_pull_data(skb, sizeof(*hdr));
3880 if (!hdr) {
3881 bt_dev_err(hdev, "ISO packet too small");
3882 goto drop;
3883 }
3884
3885 handle = __le16_to_cpu(hdr->handle);
3886 flags = hci_flags(handle);
3887 handle = hci_handle(handle);
3888
3889 bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
3890 handle, flags);
3891
3892 hci_dev_lock(hdev);
3893 conn = hci_conn_hash_lookup_handle(hdev, handle);
3894 hci_dev_unlock(hdev);
3895
26afbd82
LAD		 3896 if (!conn) {
3897 bt_dev_err(hdev, "ISO packet for unknown connection handle %d",
3898 handle);
ccf74f23 3899 goto drop;
26afbd82
LAD		 3900 }
3901
ccf74f23
LAD		 3902 /* Send to upper protocol */
3903 iso_recv(conn, skb, flags);
3904 return;
3905
26afbd82
LAD		 3906drop:
3907 kfree_skb(skb);
3908}
3909
9238f36a
JH		 3910static bool hci_req_is_complete(struct hci_dev *hdev)
3911{
3912 struct sk_buff *skb;
3913
3914 skb = skb_peek(&hdev->cmd_q);
3915 if (!skb)
3916 return true;
3917
44d27137 3918 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
9238f36a
JH		 3919}
3920
42c6b129
JH		 3921static void hci_resend_last(struct hci_dev *hdev)
3922{
3923 struct hci_command_hdr *sent;
3924 struct sk_buff *skb;
3925 u16 opcode;
3926
3927 if (!hdev->sent_cmd)
3928 return;
3929
3930 sent = (void *) hdev->sent_cmd->data;
3931 opcode = __le16_to_cpu(sent->opcode);
3932 if (opcode == HCI_OP_RESET)
3933 return;
3934
3935 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3936 if (!skb)
3937 return;
3938
3939 skb_queue_head(&hdev->cmd_q, skb);
3940 queue_work(hdev->workqueue, &hdev->cmd_work);
3941}
3942
e6214487
JH		 3943void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
3944 hci_req_complete_t *req_complete,
3945 hci_req_complete_skb_t *req_complete_skb)
9238f36a 3946{
9238f36a
JH		 3947 struct sk_buff *skb;
3948 unsigned long flags;
3949
3950 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3951
42c6b129
JH		 3952 /* If the completed command doesn't match the last one that was
3953 * sent we need to do special handling of it.
9238f36a 3954 */
42c6b129
JH		 3955 if (!hci_sent_cmd_data(hdev, opcode)) {
3956 /* Some CSR based controllers generate a spontaneous
3957 * reset complete event during init and any pending
3958 * command will never be completed. In such a case we
3959 * need to resend whatever was the last sent
3960 * command.
3961 */
3962 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3963 hci_resend_last(hdev);
3964
9238f36a 3965 return;
42c6b129 3966 }
9238f36a 3967
f80c5dad
JPRV		 3968 /* If we reach this point this event matches the last command sent */
3969 hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
3970
9238f36a
JH		 3971 /* If the command succeeded and there's still more commands in
3972 * this request the request is not yet complete.
3973 */
3974 if (!status && !hci_req_is_complete(hdev))
3975 return;
3976
3977 /* If this was the last command in a request the complete
3978 * callback would be found in hdev->sent_cmd instead of the
3979 * command queue (hdev->cmd_q).
3980 */
44d27137
JH		 3981 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
3982 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
e6214487
JH		 3983 return;
3984 }
53e21fbc 3985
44d27137
JH		 3986 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
3987 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
e6214487 3988 return;
9238f36a
JH		 3989 }
3990
3991 /* Remove all pending commands belonging to this request */
3992 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
3993 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
44d27137 3994 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
9238f36a
JH		 3995 __skb_queue_head(&hdev->cmd_q, skb);
3996 break;
3997 }
3998
3bd7594e
DA		 3999 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4000 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4001 else
4002 *req_complete = bt_cb(skb)->hci.req_complete;
39c1eb6f 4003 dev_kfree_skb_irq(skb);
9238f36a
JH		 4004 }
4005 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
9238f36a
JH		 4006}
4007
b78752cc 4008static void hci_rx_work(struct work_struct *work)
1da177e4 4009{
b78752cc 4010 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 4011 struct sk_buff *skb;
4012
4013 BT_DBG("%s", hdev->name);
4014
9f30de9e
TK		 4015 /* The kcov_remote functions used for collecting packet parsing
4016 * coverage information from this background thread and associate
4017 * the coverage with the syscall's thread which originally injected
4018 * the packet. This helps fuzzing the kernel.
4019 */
4020 for (; (skb = skb_dequeue(&hdev->rx_q)); kcov_remote_stop()) {
4021 kcov_remote_start_common(skb_get_kcov_handle(skb));
4022
cd82e61c
MH		 4023 /* Send copy to monitor */
4024 hci_send_to_monitor(hdev, skb);
4025
1da177e4
LT		 4026 if (atomic_read(&hdev->promisc)) {
4027 /* Send copy to the sockets */
470fe1b5 4028 hci_send_to_sock(hdev, skb);
1da177e4
LT		 4029 }
4030
eb8c101e
MK		 4031 /* If the device has been opened in HCI_USER_CHANNEL,
4032 * the userspace has exclusive access to device.
4033 * When device is HCI_INIT, we still need to process
4034 * the data packets to the driver in order
4035 * to complete its setup().
4036 */
4037 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4038 !test_bit(HCI_INIT, &hdev->flags)) {
1da177e4
LT		 4039 kfree_skb(skb);
4040 continue;
4041 }
4042
4043 if (test_bit(HCI_INIT, &hdev->flags)) {
4044 /* Don't process data packets in this states. */
d79f34e3 4045 switch (hci_skb_pkt_type(skb)) {
1da177e4
LT		 4046 case HCI_ACLDATA_PKT:
4047 case HCI_SCODATA_PKT:
cc974003 4048 case HCI_ISODATA_PKT:
1da177e4
LT		 4049 kfree_skb(skb);
4050 continue;
3ff50b79 4051 }
1da177e4
LT		 4052 }
4053
4054 /* Process frame */
d79f34e3 4055 switch (hci_skb_pkt_type(skb)) {
1da177e4 4056 case HCI_EVENT_PKT:
b78752cc 4057 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 4058 hci_event_packet(hdev, skb);
4059 break;
4060
4061 case HCI_ACLDATA_PKT:
4062 BT_DBG("%s ACL data packet", hdev->name);
4063 hci_acldata_packet(hdev, skb);
4064 break;
4065
4066 case HCI_SCODATA_PKT:
4067 BT_DBG("%s SCO data packet", hdev->name);
4068 hci_scodata_packet(hdev, skb);
4069 break;
4070
26afbd82
LAD		 4071 case HCI_ISODATA_PKT:
4072 BT_DBG("%s ISO data packet", hdev->name);
4073 hci_isodata_packet(hdev, skb);
4074 break;
4075
1da177e4
LT		 4076 default:
4077 kfree_skb(skb);
4078 break;
4079 }
4080 }
1da177e4
LT		 4081}
4082
c347b765 4083static void hci_cmd_work(struct work_struct *work)
1da177e4 4084{
c347b765 4085 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 4086 struct sk_buff *skb;
4087
2104786b
AE		 4088 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4089 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 4090
1da177e4 4091 /* Send queued commands */
5a08ecce
AE		 4092 if (atomic_read(&hdev->cmd_cnt)) {
4093 skb = skb_dequeue(&hdev->cmd_q);
4094 if (!skb)
4095 return;
4096
7585b97a 4097 kfree_skb(hdev->sent_cmd);
1da177e4 4098
a675d7f1 4099 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
70f23020 4100 if (hdev->sent_cmd) {
2250abad 4101 int res;
f80c5dad
JPRV		 4102 if (hci_req_status_pend(hdev))
4103 hci_dev_set_flag(hdev, HCI_CMD_PENDING);
1da177e4 4104 atomic_dec(&hdev->cmd_cnt);
2250abad
BB		 4105
4106 res = hci_send_frame(hdev, skb);
4107 if (res < 0)
744451c1 4108 __hci_cmd_sync_cancel(hdev, -res);
2250abad 4109
deee93d1 4110 rcu_read_lock();
877afada
SS		 4111 if (test_bit(HCI_RESET, &hdev->flags) ||
4112 hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
65cc2b49 4113 cancel_delayed_work(&hdev->cmd_timer);
7bdb8a5c 4114 else
deee93d1
TH		 4115 queue_delayed_work(hdev->workqueue, &hdev->cmd_timer,
4116 HCI_CMD_TIMEOUT);
4117 rcu_read_unlock();
1da177e4
LT		 4118 } else {
4119 skb_queue_head(&hdev->cmd_q, skb);
c347b765 4120 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4121 }
4122 }
4123}
Linux 6.x block layer and io_uring tree(s)