projects / linux-2.6-block.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: monitor: Add support for ISO packets
[linux-2.6-block.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
3df92b31 29#include <linux/idr.h>
8c520a59 30#include <linux/rfkill.h>
baf27f6e 31#include <linux/debugfs.h>
99780a7b 32#include <linux/crypto.h>
7a0e5b15 33#include <linux/property.h>
47219839 34#include <asm/unaligned.h>
1da177e4
LT		 35
36#include <net/bluetooth/bluetooth.h>
37#include <net/bluetooth/hci_core.h>
4bc58f51 38#include <net/bluetooth/l2cap.h>
af58925c 39#include <net/bluetooth/mgmt.h>
1da177e4 40
0857dd3b 41#include "hci_request.h"
60c5f5fb 42#include "hci_debugfs.h"
970c4e46 43#include "smp.h"
6d5d2ee6 44#include "leds.h"
970c4e46 45
b78752cc 46static void hci_rx_work(struct work_struct *work);
c347b765 47static void hci_cmd_work(struct work_struct *work);
3eff45ea 48static void hci_tx_work(struct work_struct *work);
1da177e4 49
1da177e4
LT		 50/* HCI device list */
51LIST_HEAD(hci_dev_list);
52DEFINE_RWLOCK(hci_dev_list_lock);
53
54/* HCI callback list */
55LIST_HEAD(hci_cb_list);
fba7ecf0 56DEFINE_MUTEX(hci_cb_list_lock);
1da177e4 57
3df92b31
SL		 58/* HCI ID Numbering */
59static DEFINE_IDA(hci_index_ida);
60
baf27f6e
MH		 61/* ---- HCI debugfs entries ---- */
62
4b4148e9
MH		 63static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
64 size_t count, loff_t *ppos)
65{
66 struct hci_dev *hdev = file->private_data;
67 char buf[3];
68
74b93e9f 69 buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
4b4148e9
MH		 70 buf[1] = '\n';
71 buf[2] = '\0';
72 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
73}
74
75static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
76 size_t count, loff_t *ppos)
77{
78 struct hci_dev *hdev = file->private_data;
79 struct sk_buff *skb;
4b4148e9 80 bool enable;
3bf5e97d 81 int err;
4b4148e9
MH		 82
83 if (!test_bit(HCI_UP, &hdev->flags))
84 return -ENETDOWN;
85
3bf5e97d
AS		 86 err = kstrtobool_from_user(user_buf, count, &enable);
87 if (err)
88 return err;
4b4148e9 89
b7cb93e5 90 if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
4b4148e9
MH		 91 return -EALREADY;
92
b504430c 93 hci_req_sync_lock(hdev);
4b4148e9
MH		 94 if (enable)
95 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
96 HCI_CMD_TIMEOUT);
97 else
98 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
99 HCI_CMD_TIMEOUT);
b504430c 100 hci_req_sync_unlock(hdev);
4b4148e9
MH		 101
102 if (IS_ERR(skb))
103 return PTR_ERR(skb);
104
4b4148e9
MH		 105 kfree_skb(skb);
106
b7cb93e5 107 hci_dev_change_flag(hdev, HCI_DUT_MODE);
4b4148e9
MH		 108
109 return count;
110}
111
112static const struct file_operations dut_mode_fops = {
113 .open = simple_open,
114 .read = dut_mode_read,
115 .write = dut_mode_write,
116 .llseek = default_llseek,
117};
118
4b4113d6
MH		 119static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
120 size_t count, loff_t *ppos)
121{
122 struct hci_dev *hdev = file->private_data;
123 char buf[3];
124
74b93e9f 125 buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
4b4113d6
MH		 126 buf[1] = '\n';
127 buf[2] = '\0';
128 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
129}
130
131static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
132 size_t count, loff_t *ppos)
133{
134 struct hci_dev *hdev = file->private_data;
4b4113d6
MH		 135 bool enable;
136 int err;
137
3bf5e97d
AS		 138 err = kstrtobool_from_user(user_buf, count, &enable);
139 if (err)
140 return err;
4b4113d6 141
7e995b9e 142 /* When the diagnostic flags are not persistent and the transport
b56c7b25
MH		 143 * is not active or in user channel operation, then there is no need
144 * for the vendor callback. Instead just store the desired value and
145 * the setting will be programmed when the controller gets powered on.
7e995b9e
MH		 146 */
147 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
b56c7b25
MH		 148 (!test_bit(HCI_RUNNING, &hdev->flags) ||
149 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)))
7e995b9e
MH		 150 goto done;
151
b504430c 152 hci_req_sync_lock(hdev);
4b4113d6 153 err = hdev->set_diag(hdev, enable);
b504430c 154 hci_req_sync_unlock(hdev);
4b4113d6
MH		 155
156 if (err < 0)
157 return err;
158
7e995b9e 159done:
4b4113d6
MH		 160 if (enable)
161 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
162 else
163 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
164
165 return count;
166}
167
168static const struct file_operations vendor_diag_fops = {
169 .open = simple_open,
170 .read = vendor_diag_read,
171 .write = vendor_diag_write,
172 .llseek = default_llseek,
173};
174
f640ee98
MH		 175static void hci_debugfs_create_basic(struct hci_dev *hdev)
176{
177 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
178 &dut_mode_fops);
179
180 if (hdev->set_diag)
181 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
182 &vendor_diag_fops);
183}
184
a1d01db1 185static int hci_reset_req(struct hci_request *req, unsigned long opt)
1da177e4 186{
42c6b129 187 BT_DBG("%s %ld", req->hdev->name, opt);
1da177e4
LT		 188
189 /* Reset device */
42c6b129
JH		 190 set_bit(HCI_RESET, &req->hdev->flags);
191 hci_req_add(req, HCI_OP_RESET, 0, NULL);
a1d01db1 192 return 0;
1da177e4
LT		 193}
194
42c6b129 195static void bredr_init(struct hci_request *req)
1da177e4 196{
42c6b129 197 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
2455a3ea 198
1da177e4 199 /* Read Local Supported Features */
42c6b129 200 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 201
1143e5a6 202 /* Read Local Version */
42c6b129 203 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
2177bab5
JH		 204
205 /* Read BD Address */
42c6b129 206 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1da177e4
LT		 207}
208
0af801b9 209static void amp_init1(struct hci_request *req)
e61ef499 210{
42c6b129 211 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
2455a3ea 212
e61ef499 213 /* Read Local Version */
42c6b129 214 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489 215
f6996cfe
MH		 216 /* Read Local Supported Commands */
217 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
218
6bcbc489 219 /* Read Local AMP Info */
42c6b129 220 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 221
222 /* Read Data Blk size */
42c6b129 223 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
7528ca1c 224
f38ba941
MH		 225 /* Read Flow Control Mode */
226 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
227
7528ca1c
MH		 228 /* Read Location Data */
229 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
e61ef499
AE		 230}
231
a1d01db1 232static int amp_init2(struct hci_request *req)
0af801b9
JH		 233{
234 /* Read Local Supported Features. Not all AMP controllers
235 * support this so it's placed conditionally in the second
236 * stage init.
237 */
238 if (req->hdev->commands[14] & 0x20)
239 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
a1d01db1
JH		 240
241 return 0;
0af801b9
JH		 242}
243
a1d01db1 244static int hci_init1_req(struct hci_request *req, unsigned long opt)
e61ef499 245{
42c6b129 246 struct hci_dev *hdev = req->hdev;
e61ef499
AE		 247
248 BT_DBG("%s %ld", hdev->name, opt);
249
11778716
AE		 250 /* Reset */
251 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
42c6b129 252 hci_reset_req(req, 0);
11778716 253
e61ef499 254 switch (hdev->dev_type) {
ca8bee5d 255 case HCI_PRIMARY:
42c6b129 256 bredr_init(req);
e61ef499 257 break;
e61ef499 258 case HCI_AMP:
0af801b9 259 amp_init1(req);
e61ef499 260 break;
e61ef499 261 default:
2064ee33 262 bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
e61ef499
AE		 263 break;
264 }
a1d01db1
JH		 265
266 return 0;
e61ef499
AE		 267}
268
42c6b129 269static void bredr_setup(struct hci_request *req)
2177bab5 270{
2177bab5
JH		 271 __le16 param;
272 __u8 flt_type;
273
274 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
42c6b129 275 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 276
277 /* Read Class of Device */
42c6b129 278 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
2177bab5
JH		 279
280 /* Read Local Name */
42c6b129 281 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
2177bab5
JH		 282
283 /* Read Voice Setting */
42c6b129 284 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
2177bab5 285
b4cb9fb2
MH		 286 /* Read Number of Supported IAC */
287 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
288
4b836f39
MH		 289 /* Read Current IAC LAP */
290 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
291
2177bab5
JH		 292 /* Clear Event Filters */
293 flt_type = HCI_FLT_CLEAR_ALL;
42c6b129 294 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
2177bab5
JH		 295
296 /* Connection accept timeout ~20 secs */
dcf4adbf 297 param = cpu_to_le16(0x7d00);
42c6b129 298 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
2177bab5
JH		 299}
300
42c6b129 301static void le_setup(struct hci_request *req)
2177bab5 302{
c73eee91
JH		 303 struct hci_dev *hdev = req->hdev;
304
2177bab5 305 /* Read LE Buffer Size */
42c6b129 306 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 307
308 /* Read LE Local Supported Features */
42c6b129 309 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
2177bab5 310
747d3f03
MH		 311 /* Read LE Supported States */
312 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
313
c73eee91
JH		 314 /* LE-only controllers have LE implicitly enabled */
315 if (!lmp_bredr_capable(hdev))
a1536da2 316 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2177bab5
JH		 317}
318
42c6b129 319static void hci_setup_event_mask(struct hci_request *req)
2177bab5 320{
42c6b129
JH		 321 struct hci_dev *hdev = req->hdev;
322
2177bab5
JH		 323 /* The second byte is 0xff instead of 0x9f (two reserved bits
324 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
325 * command otherwise.
326 */
327 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
328
329 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
330 * any event mask for pre 1.2 devices.
331 */
332 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
333 return;
334
335 if (lmp_bredr_capable(hdev)) {
336 events[4] |= 0x01; /* Flow Specification Complete */
c7882cbd
MH		 337 } else {
338 /* Use a different default for LE-only devices */
339 memset(events, 0, sizeof(events));
c7882cbd
MH		 340 events[1] |= 0x20; /* Command Complete */
341 events[1] |= 0x40; /* Command Status */
342 events[1] |= 0x80; /* Hardware Error */
5c3d3b4c
MH		 343
344 /* If the controller supports the Disconnect command, enable
345 * the corresponding event. In addition enable packet flow
346 * control related events.
347 */
348 if (hdev->commands[0] & 0x20) {
349 events[0] |= 0x10; /* Disconnection Complete */
350 events[2] |= 0x04; /* Number of Completed Packets */
351 events[3] |= 0x02; /* Data Buffer Overflow */
352 }
353
354 /* If the controller supports the Read Remote Version
355 * Information command, enable the corresponding event.
356 */
357 if (hdev->commands[2] & 0x80)
358 events[1] |= 0x08; /* Read Remote Version Information
359 * Complete
360 */
0da71f1b
MH		 361
362 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
363 events[0] |= 0x80; /* Encryption Change */
364 events[5] |= 0x80; /* Encryption Key Refresh Complete */
365 }
2177bab5
JH		 366 }
367
9fe759ce
MH		 368 if (lmp_inq_rssi_capable(hdev) ||
369 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
2177bab5
JH		 370 events[4] |= 0x02; /* Inquiry Result with RSSI */
371
70f56aa2
MH		 372 if (lmp_ext_feat_capable(hdev))
373 events[4] |= 0x04; /* Read Remote Extended Features Complete */
374
375 if (lmp_esco_capable(hdev)) {
376 events[5] |= 0x08; /* Synchronous Connection Complete */
377 events[5] |= 0x10; /* Synchronous Connection Changed */
378 }
379
2177bab5
JH		 380 if (lmp_sniffsubr_capable(hdev))
381 events[5] |= 0x20; /* Sniff Subrating */
382
383 if (lmp_pause_enc_capable(hdev))
384 events[5] |= 0x80; /* Encryption Key Refresh Complete */
385
386 if (lmp_ext_inq_capable(hdev))
387 events[5] |= 0x40; /* Extended Inquiry Result */
388
389 if (lmp_no_flush_capable(hdev))
390 events[7] |= 0x01; /* Enhanced Flush Complete */
391
392 if (lmp_lsto_capable(hdev))
393 events[6] |= 0x80; /* Link Supervision Timeout Changed */
394
395 if (lmp_ssp_capable(hdev)) {
396 events[6] |= 0x01; /* IO Capability Request */
397 events[6] |= 0x02; /* IO Capability Response */
398 events[6] |= 0x04; /* User Confirmation Request */
399 events[6] |= 0x08; /* User Passkey Request */
400 events[6] |= 0x10; /* Remote OOB Data Request */
401 events[6] |= 0x20; /* Simple Pairing Complete */
402 events[7] |= 0x04; /* User Passkey Notification */
403 events[7] |= 0x08; /* Keypress Notification */
404 events[7] |= 0x10; /* Remote Host Supported
405 * Features Notification
406 */
407 }
408
409 if (lmp_le_capable(hdev))
410 events[7] |= 0x20; /* LE Meta-Event */
411
42c6b129 412 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
2177bab5
JH		 413}
414
a1d01db1 415static int hci_init2_req(struct hci_request *req, unsigned long opt)
2177bab5 416{
42c6b129
JH		 417 struct hci_dev *hdev = req->hdev;
418
0af801b9
JH		 419 if (hdev->dev_type == HCI_AMP)
420 return amp_init2(req);
421
2177bab5 422 if (lmp_bredr_capable(hdev))
42c6b129 423 bredr_setup(req);
56f87901 424 else
a358dc11 425 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
2177bab5
JH		 426
427 if (lmp_le_capable(hdev))
42c6b129 428 le_setup(req);
2177bab5 429
0f3adeae
MH		 430 /* All Bluetooth 1.2 and later controllers should support the
431 * HCI command for reading the local supported commands.
432 *
433 * Unfortunately some controllers indicate Bluetooth 1.2 support,
434 * but do not have support for this command. If that is the case,
435 * the driver can quirk the behavior and skip reading the local
436 * supported commands.
3f8e2d75 437 */
0f3adeae
MH		 438 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
439 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
42c6b129 440 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
2177bab5
JH		 441
442 if (lmp_ssp_capable(hdev)) {
57af75a8
MH		 443 /* When SSP is available, then the host features page
444 * should also be available as well. However some
445 * controllers list the max_page as 0 as long as SSP
446 * has not been enabled. To achieve proper debugging
447 * output, force the minimum max_page to 1 at least.
448 */
449 hdev->max_page = 0x01;
450
d7a5a11d 451 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2177bab5 452 u8 mode = 0x01;
574ea3c7 453
42c6b129
JH		 454 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
455 sizeof(mode), &mode);
2177bab5
JH		 456 } else {
457 struct hci_cp_write_eir cp;
458
459 memset(hdev->eir, 0, sizeof(hdev->eir));
460 memset(&cp, 0, sizeof(cp));
461
42c6b129 462 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
2177bab5
JH		 463 }
464 }
465
043ec9bf
MH		 466 if (lmp_inq_rssi_capable(hdev) ||
467 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
04422da9
MH		 468 u8 mode;
469
470 /* If Extended Inquiry Result events are supported, then
471 * they are clearly preferred over Inquiry Result with RSSI
472 * events.
473 */
474 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
475
476 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
477 }
2177bab5
JH		 478
479 if (lmp_inq_tx_pwr_capable(hdev))
42c6b129 480 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
2177bab5
JH		 481
482 if (lmp_ext_feat_capable(hdev)) {
483 struct hci_cp_read_local_ext_features cp;
484
485 cp.page = 0x01;
42c6b129
JH		 486 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
487 sizeof(cp), &cp);
2177bab5
JH		 488 }
489
d7a5a11d 490 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2177bab5 491 u8 enable = 1;
42c6b129
JH		 492 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
493 &enable);
2177bab5 494 }
a1d01db1
JH		 495
496 return 0;
2177bab5
JH		 497}
498
42c6b129 499static void hci_setup_link_policy(struct hci_request *req)
2177bab5 500{
42c6b129 501 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 502 struct hci_cp_write_def_link_policy cp;
503 u16 link_policy = 0;
504
505 if (lmp_rswitch_capable(hdev))
506 link_policy |= HCI_LP_RSWITCH;
507 if (lmp_hold_capable(hdev))
508 link_policy |= HCI_LP_HOLD;
509 if (lmp_sniff_capable(hdev))
510 link_policy |= HCI_LP_SNIFF;
511 if (lmp_park_capable(hdev))
512 link_policy |= HCI_LP_PARK;
513
514 cp.policy = cpu_to_le16(link_policy);
42c6b129 515 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
2177bab5
JH		 516}
517
42c6b129 518static void hci_set_le_support(struct hci_request *req)
2177bab5 519{
42c6b129 520 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 521 struct hci_cp_write_le_host_supported cp;
522
c73eee91
JH		 523 /* LE-only devices do not support explicit enablement */
524 if (!lmp_bredr_capable(hdev))
525 return;
526
2177bab5
JH		 527 memset(&cp, 0, sizeof(cp));
528
d7a5a11d 529 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2177bab5 530 cp.le = 0x01;
32226e4f 531 cp.simul = 0x00;
2177bab5
JH		 532 }
533
534 if (cp.le != lmp_host_le_capable(hdev))
42c6b129
JH		 535 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
536 &cp);
2177bab5
JH		 537}
538
d62e6d67
JH		 539static void hci_set_event_mask_page_2(struct hci_request *req)
540{
541 struct hci_dev *hdev = req->hdev;
542 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
313f6888 543 bool changed = false;
d62e6d67
JH		 544
545 /* If Connectionless Slave Broadcast master role is supported
546 * enable all necessary events for it.
547 */
53b834d2 548 if (lmp_csb_master_capable(hdev)) {
d62e6d67
JH		 549 events[1] |= 0x40; /* Triggered Clock Capture */
550 events[1] |= 0x80; /* Synchronization Train Complete */
551 events[2] |= 0x10; /* Slave Page Response Timeout */
552 events[2] |= 0x20; /* CSB Channel Map Change */
313f6888 553 changed = true;
d62e6d67
JH		 554 }
555
556 /* If Connectionless Slave Broadcast slave role is supported
557 * enable all necessary events for it.
558 */
53b834d2 559 if (lmp_csb_slave_capable(hdev)) {
d62e6d67
JH		 560 events[2] |= 0x01; /* Synchronization Train Received */
561 events[2] |= 0x02; /* CSB Receive */
562 events[2] |= 0x04; /* CSB Timeout */
563 events[2] |= 0x08; /* Truncated Page Complete */
313f6888 564 changed = true;
d62e6d67
JH		 565 }
566
40c59fcb 567 /* Enable Authenticated Payload Timeout Expired event if supported */
313f6888 568 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
40c59fcb 569 events[2] |= 0x80;
313f6888
MH		 570 changed = true;
571 }
40c59fcb 572
313f6888
MH		 573 /* Some Broadcom based controllers indicate support for Set Event
574 * Mask Page 2 command, but then actually do not support it. Since
575 * the default value is all bits set to zero, the command is only
576 * required if the event mask has to be changed. In case no change
577 * to the event mask is needed, skip this command.
578 */
579 if (changed)
580 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
581 sizeof(events), events);
d62e6d67
JH		 582}
583
a1d01db1 584static int hci_init3_req(struct hci_request *req, unsigned long opt)
2177bab5 585{
42c6b129 586 struct hci_dev *hdev = req->hdev;
d2c5d77f 587 u8 p;
42c6b129 588
0da71f1b
MH		 589 hci_setup_event_mask(req);
590
e81be90b
JH		 591 if (hdev->commands[6] & 0x20 &&
592 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
48ce62c4
MH		 593 struct hci_cp_read_stored_link_key cp;
594
595 bacpy(&cp.bdaddr, BDADDR_ANY);
596 cp.read_all = 0x01;
597 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
598 }
599
2177bab5 600 if (hdev->commands[5] & 0x10)
42c6b129 601 hci_setup_link_policy(req);
2177bab5 602
417287de
MH		 603 if (hdev->commands[8] & 0x01)
604 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
605
606 /* Some older Broadcom based Bluetooth 1.2 controllers do not
607 * support the Read Page Scan Type command. Check support for
608 * this command in the bit mask of supported commands.
609 */
610 if (hdev->commands[13] & 0x01)
611 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
612
9193c6e8
AG		 613 if (lmp_le_capable(hdev)) {
614 u8 events[8];
615
616 memset(events, 0, sizeof(events));
4d6c705b
MH		 617
618 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
619 events[0] |= 0x10; /* LE Long Term Key Request */
662bc2e6
AG		 620
621 /* If controller supports the Connection Parameters Request
622 * Link Layer Procedure, enable the corresponding event.
623 */
624 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
625 events[0] |= 0x20; /* LE Remote Connection
626 * Parameter Request
627 */
628
a9f6068e
MH		 629 /* If the controller supports the Data Length Extension
630 * feature, enable the corresponding event.
631 */
632 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
633 events[0] |= 0x40; /* LE Data Length Change */
634
4b71bba4
MH		 635 /* If the controller supports Extended Scanner Filter
636 * Policies, enable the correspondig event.
637 */
638 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
639 events[1] |= 0x04; /* LE Direct Advertising
640 * Report
641 */
642
9756d33b
MH		 643 /* If the controller supports Channel Selection Algorithm #2
644 * feature, enable the corresponding event.
645 */
646 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
647 events[2] |= 0x08; /* LE Channel Selection
648 * Algorithm
649 */
650
7d26f5c4
MH		 651 /* If the controller supports the LE Set Scan Enable command,
652 * enable the corresponding advertising report event.
653 */
654 if (hdev->commands[26] & 0x08)
655 events[0] |= 0x02; /* LE Advertising Report */
656
657 /* If the controller supports the LE Create Connection
658 * command, enable the corresponding event.
659 */
660 if (hdev->commands[26] & 0x10)
661 events[0] |= 0x01; /* LE Connection Complete */
662
663 /* If the controller supports the LE Connection Update
664 * command, enable the corresponding event.
665 */
666 if (hdev->commands[27] & 0x04)
667 events[0] |= 0x04; /* LE Connection Update
668 * Complete
669 */
670
671 /* If the controller supports the LE Read Remote Used Features
672 * command, enable the corresponding event.
673 */
674 if (hdev->commands[27] & 0x20)
675 events[0] |= 0x08; /* LE Read Remote Used
676 * Features Complete
677 */
678
5a34bd5f
MH		 679 /* If the controller supports the LE Read Local P-256
680 * Public Key command, enable the corresponding event.
681 */
682 if (hdev->commands[34] & 0x02)
683 events[0] |= 0x80; /* LE Read Local P-256
684 * Public Key Complete
685 */
686
687 /* If the controller supports the LE Generate DHKey
688 * command, enable the corresponding event.
689 */
690 if (hdev->commands[34] & 0x04)
691 events[1] |= 0x01; /* LE Generate DHKey Complete */
692
27bbca44
MH		 693 /* If the controller supports the LE Set Default PHY or
694 * LE Set PHY commands, enable the corresponding event.
695 */
696 if (hdev->commands[35] & (0x20 | 0x40))
697 events[1] |= 0x08; /* LE PHY Update Complete */
698
c215e939
JK		 699 /* If the controller supports LE Set Extended Scan Parameters
700 * and LE Set Extended Scan Enable commands, enable the
701 * corresponding event.
702 */
703 if (use_ext_scan(hdev))
704 events[1] |= 0x10; /* LE Extended Advertising
705 * Report
706 */
707
4d94f95d
JK		 708 /* If the controller supports the LE Extended Create Connection
709 * command, enable the corresponding event.
710 */
711 if (use_ext_conn(hdev))
712 events[1] |= 0x02; /* LE Enhanced Connection
713 * Complete
714 */
715
acf0aeae
JK		 716 /* If the controller supports the LE Extended Advertising
717 * command, enable the corresponding event.
718 */
719 if (ext_adv_capable(hdev))
720 events[2] |= 0x02; /* LE Advertising Set
721 * Terminated
722 */
723
9193c6e8
AG		 724 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
725 events);
726
6b49bcb4
JK		 727 /* Read LE Advertising Channel TX Power */
728 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
729 /* HCI TS spec forbids mixing of legacy and extended
730 * advertising commands wherein READ_ADV_TX_POWER is
731 * also included. So do not call it if extended adv
732 * is supported otherwise controller will return
733 * COMMAND_DISALLOWED for extended commands.
734 */
15a49cca
MH		 735 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
736 }
737
2ab216a7
MH		 738 if (hdev->commands[26] & 0x40) {
739 /* Read LE White List Size */
740 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE,
741 0, NULL);
742 }
743
744 if (hdev->commands[26] & 0x80) {
745 /* Clear LE White List */
746 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
747 }
748
cfdb0c2d
AN		 749 if (hdev->commands[34] & 0x40) {
750 /* Read LE Resolving List Size */
751 hci_req_add(req, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
752 0, NULL);
753 }
754
545f2596
AN		 755 if (hdev->commands[34] & 0x20) {
756 /* Clear LE Resolving List */
757 hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL);
758 }
759
a9f6068e
MH		 760 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
761 /* Read LE Maximum Data Length */
762 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
763
764 /* Read LE Suggested Default Data Length */
765 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
766 }
767
6b49bcb4
JK		 768 if (ext_adv_capable(hdev)) {
769 /* Read LE Number of Supported Advertising Sets */
770 hci_req_add(req, HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
771 0, NULL);
772 }
773
42c6b129 774 hci_set_le_support(req);
9193c6e8 775 }
d2c5d77f
JH		 776
777 /* Read features beyond page 1 if available */
778 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
779 struct hci_cp_read_local_ext_features cp;
780
781 cp.page = p;
782 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
783 sizeof(cp), &cp);
784 }
a1d01db1
JH		 785
786 return 0;
2177bab5
JH		 787}
788
a1d01db1 789static int hci_init4_req(struct hci_request *req, unsigned long opt)
5d4e7e8d
JH		 790{
791 struct hci_dev *hdev = req->hdev;
792
36f260ce
MH		 793 /* Some Broadcom based Bluetooth controllers do not support the
794 * Delete Stored Link Key command. They are clearly indicating its
795 * absence in the bit mask of supported commands.
796 *
797 * Check the supported commands and only if the the command is marked
798 * as supported send it. If not supported assume that the controller
799 * does not have actual support for stored link keys which makes this
800 * command redundant anyway.
801 *
802 * Some controllers indicate that they support handling deleting
803 * stored link keys, but they don't. The quirk lets a driver
804 * just disable this command.
805 */
806 if (hdev->commands[6] & 0x80 &&
807 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
808 struct hci_cp_delete_stored_link_key cp;
809
810 bacpy(&cp.bdaddr, BDADDR_ANY);
811 cp.delete_all = 0x01;
812 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
813 sizeof(cp), &cp);
814 }
815
d62e6d67
JH		 816 /* Set event mask page 2 if the HCI command for it is supported */
817 if (hdev->commands[22] & 0x04)
818 hci_set_event_mask_page_2(req);
819
109e3191
MH		 820 /* Read local codec list if the HCI command is supported */
821 if (hdev->commands[29] & 0x20)
822 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
823
f4fe73ed
MH		 824 /* Get MWS transport configuration if the HCI command is supported */
825 if (hdev->commands[30] & 0x08)
826 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
827
5d4e7e8d 828 /* Check for Synchronization Train support */
53b834d2 829 if (lmp_sync_train_capable(hdev))
5d4e7e8d 830 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
a6d0d690
MH		 831
832 /* Enable Secure Connections if supported and configured */
d7a5a11d 833 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
574ea3c7 834 bredr_sc_enabled(hdev)) {
a6d0d690 835 u8 support = 0x01;
574ea3c7 836
a6d0d690
MH		 837 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
838 sizeof(support), &support);
839 }
a1d01db1 840
12204875
MH		 841 /* Set Suggested Default Data Length to maximum if supported */
842 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
843 struct hci_cp_le_write_def_data_len cp;
844
727ea61a
BDC		 845 cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
846 cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
12204875
MH		 847 hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
848 }
849
de2ba303
MH		 850 /* Set Default PHY parameters if command is supported */
851 if (hdev->commands[35] & 0x20) {
852 struct hci_cp_le_set_default_phy cp;
853
6decb5b4
JK		 854 cp.all_phys = 0x00;
855 cp.tx_phys = hdev->le_tx_def_phys;
856 cp.rx_phys = hdev->le_rx_def_phys;
de2ba303
MH		 857
858 hci_req_add(req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp), &cp);
859 }
860
a1d01db1 861 return 0;
5d4e7e8d
JH		 862}
863
2177bab5
JH		 864static int __hci_init(struct hci_dev *hdev)
865{
866 int err;
867
4ebeee2d 868 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
2177bab5
JH		 869 if (err < 0)
870 return err;
871
f640ee98
MH		 872 if (hci_dev_test_flag(hdev, HCI_SETUP))
873 hci_debugfs_create_basic(hdev);
4b4148e9 874
4ebeee2d 875 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
0af801b9
JH		 876 if (err < 0)
877 return err;
878
ca8bee5d 879 /* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
2177bab5 880 * BR/EDR/LE type controllers. AMP controllers only need the
0af801b9 881 * first two stages of init.
2177bab5 882 */
ca8bee5d 883 if (hdev->dev_type != HCI_PRIMARY)
2177bab5
JH		 884 return 0;
885
4ebeee2d 886 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
5d4e7e8d
JH		 887 if (err < 0)
888 return err;
889
4ebeee2d 890 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
baf27f6e
MH		 891 if (err < 0)
892 return err;
893
ec6cef9c
MH		 894 /* This function is only called when the controller is actually in
895 * configured state. When the controller is marked as unconfigured,
896 * this initialization procedure is not run.
897 *
898 * It means that it is possible that a controller runs through its
899 * setup phase and then discovers missing settings. If that is the
900 * case, then this function will not be called. It then will only
901 * be called during the config phase.
902 *
903 * So only when in setup phase or config phase, create the debugfs
904 * entries and register the SMP channels.
baf27f6e 905 */
d7a5a11d
MH		 906 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
907 !hci_dev_test_flag(hdev, HCI_CONFIG))
baf27f6e
MH		 908 return 0;
909
60c5f5fb
MH		 910 hci_debugfs_create_common(hdev);
911
71c3b60e 912 if (lmp_bredr_capable(hdev))
60c5f5fb 913 hci_debugfs_create_bredr(hdev);
2bfa3531 914
162a3bac 915 if (lmp_le_capable(hdev))
60c5f5fb 916 hci_debugfs_create_le(hdev);
e7b8fc92 917
baf27f6e 918 return 0;
2177bab5
JH		 919}
920
a1d01db1 921static int hci_init0_req(struct hci_request *req, unsigned long opt)
0ebca7d6
MH		 922{
923 struct hci_dev *hdev = req->hdev;
924
925 BT_DBG("%s %ld", hdev->name, opt);
926
927 /* Reset */
928 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
929 hci_reset_req(req, 0);
930
931 /* Read Local Version */
932 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
933
934 /* Read BD Address */
935 if (hdev->set_bdaddr)
936 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
a1d01db1
JH		 937
938 return 0;
0ebca7d6
MH		 939}
940
941static int __hci_unconf_init(struct hci_dev *hdev)
942{
943 int err;
944
cc78b44b
MH		 945 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
946 return 0;
947
4ebeee2d 948 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
0ebca7d6
MH		 949 if (err < 0)
950 return err;
951
f640ee98
MH		 952 if (hci_dev_test_flag(hdev, HCI_SETUP))
953 hci_debugfs_create_basic(hdev);
954
0ebca7d6
MH		 955 return 0;
956}
957
a1d01db1 958static int hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 959{
960 __u8 scan = opt;
961
42c6b129 962 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 963
964 /* Inquiry and Page scans */
42c6b129 965 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
a1d01db1 966 return 0;
1da177e4
LT		 967}
968
a1d01db1 969static int hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 970{
971 __u8 auth = opt;
972
42c6b129 973 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 974
975 /* Authentication */
42c6b129 976 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
a1d01db1 977 return 0;
1da177e4
LT		 978}
979
a1d01db1 980static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 981{
982 __u8 encrypt = opt;
983
42c6b129 984 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 985
e4e8e37c 986 /* Encryption */
42c6b129 987 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
a1d01db1 988 return 0;
1da177e4
LT		 989}
990
a1d01db1 991static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 992{
993 __le16 policy = cpu_to_le16(opt);
994
42c6b129 995 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 996
997 /* Default link policy */
42c6b129 998 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
a1d01db1 999 return 0;
e4e8e37c
MH		 1000}
1001
8e87d142 1002/* Get HCI device by index.
1da177e4
LT		 1003 * Device is held on return. */
1004struct hci_dev *hci_dev_get(int index)
1005{
8035ded4 1006 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 1007
1008 BT_DBG("%d", index);
1009
1010 if (index < 0)
1011 return NULL;
1012
1013 read_lock(&hci_dev_list_lock);
8035ded4 1014 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 1015 if (d->id == index) {
1016 hdev = hci_dev_hold(d);
1017 break;
1018 }
1019 }
1020 read_unlock(&hci_dev_list_lock);
1021 return hdev;
1022}
1da177e4
LT		 1023
1024/* ---- Inquiry support ---- */
ff9ef578 1025
30dc78e1
JH		 1026bool hci_discovery_active(struct hci_dev *hdev)
1027{
1028 struct discovery_state *discov = &hdev->discovery;
1029
6fbe195d 1030 switch (discov->state) {
343f935b 1031 case DISCOVERY_FINDING:
6fbe195d 1032 case DISCOVERY_RESOLVING:
30dc78e1
JH		 1033 return true;
1034
6fbe195d
AG		 1035 default:
1036 return false;
1037 }
30dc78e1
JH		 1038}
1039
ff9ef578
JH		 1040void hci_discovery_set_state(struct hci_dev *hdev, int state)
1041{
bb3e0a33
JH		 1042 int old_state = hdev->discovery.state;
1043
ff9ef578
JH		 1044 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1045
bb3e0a33 1046 if (old_state == state)
ff9ef578
JH		 1047 return;
1048
bb3e0a33
JH		 1049 hdev->discovery.state = state;
1050
ff9ef578
JH		 1051 switch (state) {
1052 case DISCOVERY_STOPPED:
c54c3860
AG		 1053 hci_update_background_scan(hdev);
1054
bb3e0a33 1055 if (old_state != DISCOVERY_STARTING)
7b99b659 1056 mgmt_discovering(hdev, 0);
ff9ef578
JH		 1057 break;
1058 case DISCOVERY_STARTING:
1059 break;
343f935b 1060 case DISCOVERY_FINDING:
ff9ef578
JH		 1061 mgmt_discovering(hdev, 1);
1062 break;
30dc78e1
JH		 1063 case DISCOVERY_RESOLVING:
1064 break;
ff9ef578
JH		 1065 case DISCOVERY_STOPPING:
1066 break;
1067 }
ff9ef578
JH		 1068}
1069
1f9b9a5d 1070void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 1071{
30883512 1072 struct discovery_state *cache = &hdev->discovery;
b57c1a56 1073 struct inquiry_entry *p, *n;
1da177e4 1074
561aafbc
JH		 1075 list_for_each_entry_safe(p, n, &cache->all, all) {
1076 list_del(&p->all);
b57c1a56 1077 kfree(p);
1da177e4 1078 }
561aafbc
JH		 1079
1080 INIT_LIST_HEAD(&cache->unknown);
1081 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 1082}
1083
a8c5fb1a
GP		 1084struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1085 bdaddr_t *bdaddr)
1da177e4 1086{
30883512 1087 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 1088 struct inquiry_entry *e;
1089
6ed93dc6 1090 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 1091
561aafbc
JH		 1092 list_for_each_entry(e, &cache->all, all) {
1093 if (!bacmp(&e->data.bdaddr, bdaddr))
1094 return e;
1095 }
1096
1097 return NULL;
1098}
1099
1100struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 1101 bdaddr_t *bdaddr)
561aafbc 1102{
30883512 1103 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 1104 struct inquiry_entry *e;
1105
6ed93dc6 1106 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 1107
1108 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 1109 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 1110 return e;
1111 }
1112
1113 return NULL;
1da177e4
LT		 1114}
1115
30dc78e1 1116struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 1117 bdaddr_t *bdaddr,
1118 int state)
30dc78e1
JH		 1119{
1120 struct discovery_state *cache = &hdev->discovery;
1121 struct inquiry_entry *e;
1122
6ed93dc6 1123 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 1124
1125 list_for_each_entry(e, &cache->resolve, list) {
1126 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1127 return e;
1128 if (!bacmp(&e->data.bdaddr, bdaddr))
1129 return e;
1130 }
1131
1132 return NULL;
1133}
1134
a3d4e20a 1135void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 1136 struct inquiry_entry *ie)
a3d4e20a
JH		 1137{
1138 struct discovery_state *cache = &hdev->discovery;
1139 struct list_head *pos = &cache->resolve;
1140 struct inquiry_entry *p;
1141
1142 list_del(&ie->list);
1143
1144 list_for_each_entry(p, &cache->resolve, list) {
1145 if (p->name_state != NAME_PENDING &&
a8c5fb1a 1146 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 1147 break;
1148 pos = &p->list;
1149 }
1150
1151 list_add(&ie->list, pos);
1152}
1153
af58925c
MH		 1154u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1155 bool name_known)
1da177e4 1156{
30883512 1157 struct discovery_state *cache = &hdev->discovery;
70f23020 1158 struct inquiry_entry *ie;
af58925c 1159 u32 flags = 0;
1da177e4 1160
6ed93dc6 1161 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 1162
6928a924 1163 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
2b2fec4d 1164
af58925c
MH		 1165 if (!data->ssp_mode)
1166 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 1167
70f23020 1168 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 1169 if (ie) {
af58925c
MH		 1170 if (!ie->data.ssp_mode)
1171 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 1172
a3d4e20a 1173 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 1174 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 1175 ie->data.rssi = data->rssi;
1176 hci_inquiry_cache_update_resolve(hdev, ie);
1177 }
1178
561aafbc 1179 goto update;
a3d4e20a 1180 }
561aafbc
JH		 1181
1182 /* Entry not in the cache. Add new one. */
27f70f3e 1183 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
af58925c
MH		 1184 if (!ie) {
1185 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1186 goto done;
1187 }
561aafbc
JH		 1188
1189 list_add(&ie->all, &cache->all);
1190
1191 if (name_known) {
1192 ie->name_state = NAME_KNOWN;
1193 } else {
1194 ie->name_state = NAME_NOT_KNOWN;
1195 list_add(&ie->list, &cache->unknown);
1196 }
70f23020 1197
561aafbc
JH		 1198update:
1199 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 1200 ie->name_state != NAME_PENDING) {
561aafbc
JH		 1201 ie->name_state = NAME_KNOWN;
1202 list_del(&ie->list);
1da177e4
LT		 1203 }
1204
70f23020
AE		 1205 memcpy(&ie->data, data, sizeof(*data));
1206 ie->timestamp = jiffies;
1da177e4 1207 cache->timestamp = jiffies;
3175405b
JH		 1208
1209 if (ie->name_state == NAME_NOT_KNOWN)
af58925c 1210 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
3175405b 1211
af58925c
MH		 1212done:
1213 return flags;
1da177e4
LT		 1214}
1215
1216static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1217{
30883512 1218 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 1219 struct inquiry_info *info = (struct inquiry_info *) buf;
1220 struct inquiry_entry *e;
1221 int copied = 0;
1222
561aafbc 1223 list_for_each_entry(e, &cache->all, all) {
1da177e4 1224 struct inquiry_data *data = &e->data;
b57c1a56
JH		 1225
1226 if (copied >= num)
1227 break;
1228
1da177e4
LT		 1229 bacpy(&info->bdaddr, &data->bdaddr);
1230 info->pscan_rep_mode = data->pscan_rep_mode;
1231 info->pscan_period_mode = data->pscan_period_mode;
1232 info->pscan_mode = data->pscan_mode;
1233 memcpy(info->dev_class, data->dev_class, 3);
1234 info->clock_offset = data->clock_offset;
b57c1a56 1235
1da177e4 1236 info++;
b57c1a56 1237 copied++;
1da177e4
LT		 1238 }
1239
1240 BT_DBG("cache %p, copied %d", cache, copied);
1241 return copied;
1242}
1243
a1d01db1 1244static int hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1245{
1246 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 1247 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 1248 struct hci_cp_inquiry cp;
1249
1250 BT_DBG("%s", hdev->name);
1251
1252 if (test_bit(HCI_INQUIRY, &hdev->flags))
a1d01db1 1253 return 0;
1da177e4
LT		 1254
1255 /* Start Inquiry */
1256 memcpy(&cp.lap, &ir->lap, 3);
1257 cp.length = ir->length;
1258 cp.num_rsp = ir->num_rsp;
42c6b129 1259 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
a1d01db1
JH		 1260
1261 return 0;
1da177e4
LT		 1262}
1263
1264int hci_inquiry(void __user *arg)
1265{
1266 __u8 __user *ptr = arg;
1267 struct hci_inquiry_req ir;
1268 struct hci_dev *hdev;
1269 int err = 0, do_inquiry = 0, max_rsp;
1270 long timeo;
1271 __u8 *buf;
1272
1273 if (copy_from_user(&ir, ptr, sizeof(ir)))
1274 return -EFAULT;
1275
5a08ecce
AE		 1276 hdev = hci_dev_get(ir.dev_id);
1277 if (!hdev)
1da177e4
LT		 1278 return -ENODEV;
1279
d7a5a11d 1280 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1281 err = -EBUSY;
1282 goto done;
1283 }
1284
d7a5a11d 1285 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1286 err = -EOPNOTSUPP;
1287 goto done;
1288 }
1289
ca8bee5d 1290 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 1291 err = -EOPNOTSUPP;
1292 goto done;
1293 }
1294
d7a5a11d 1295 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 1296 err = -EOPNOTSUPP;
1297 goto done;
1298 }
1299
09fd0de5 1300 hci_dev_lock(hdev);
8e87d142 1301 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 1302 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 1303 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 1304 do_inquiry = 1;
1305 }
09fd0de5 1306 hci_dev_unlock(hdev);
1da177e4 1307
04837f64 1308 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 1309
1310 if (do_inquiry) {
01178cd4 1311 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
4ebeee2d 1312 timeo, NULL);
70f23020
AE		 1313 if (err < 0)
1314 goto done;
3e13fa1e
AG		 1315
1316 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1317 * cleared). If it is interrupted by a signal, return -EINTR.
1318 */
74316201 1319 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
3e13fa1e
AG		 1320 TASK_INTERRUPTIBLE))
1321 return -EINTR;
70f23020 1322 }
1da177e4 1323
8fc9ced3
GP		 1324 /* for unlimited number of responses we will use buffer with
1325 * 255 entries
1326 */
1da177e4
LT		 1327 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1328
1329 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1330 * copy it to the user space.
1331 */
6da2ec56 1332 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
70f23020 1333 if (!buf) {
1da177e4
LT		 1334 err = -ENOMEM;
1335 goto done;
1336 }
1337
09fd0de5 1338 hci_dev_lock(hdev);
1da177e4 1339 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 1340 hci_dev_unlock(hdev);
1da177e4
LT		 1341
1342 BT_DBG("num_rsp %d", ir.num_rsp);
1343
1344 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1345 ptr += sizeof(ir);
1346 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 1347 ir.num_rsp))
1da177e4 1348 err = -EFAULT;
8e87d142 1349 } else
1da177e4
LT		 1350 err = -EFAULT;
1351
1352 kfree(buf);
1353
1354done:
1355 hci_dev_put(hdev);
1356 return err;
1357}
1358
7a0e5b15
MK		 1359/**
1360 * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address
1361 * (BD_ADDR) for a HCI device from
1362 * a firmware node property.
1363 * @hdev: The HCI device
1364 *
1365 * Search the firmware node for 'local-bd-address'.
1366 *
1367 * All-zero BD addresses are rejected, because those could be properties
1368 * that exist in the firmware tables, but were not updated by the firmware. For
1369 * example, the DTS could define 'local-bd-address', with zero BD addresses.
1370 */
1371static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev)
1372{
1373 struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
1374 bdaddr_t ba;
1375 int ret;
1376
1377 ret = fwnode_property_read_u8_array(fwnode, "local-bd-address",
1378 (u8 *)&ba, sizeof(ba));
1379 if (ret < 0 || !bacmp(&ba, BDADDR_ANY))
1380 return;
1381
1382 bacpy(&hdev->public_addr, &ba);
1383}
1384
cbed0ca1 1385static int hci_dev_do_open(struct hci_dev *hdev)
1da177e4 1386{
1da177e4
LT		 1387 int ret = 0;
1388
1da177e4
LT		 1389 BT_DBG("%s %p", hdev->name, hdev);
1390
b504430c 1391 hci_req_sync_lock(hdev);
1da177e4 1392
d7a5a11d 1393 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
94324962
JH		 1394 ret = -ENODEV;
1395 goto done;
1396 }
1397
d7a5a11d
MH		 1398 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1399 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
a5c8f270
MH		 1400 /* Check for rfkill but allow the HCI setup stage to
1401 * proceed (which in itself doesn't cause any RF activity).
1402 */
d7a5a11d 1403 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
a5c8f270
MH		 1404 ret = -ERFKILL;
1405 goto done;
1406 }
1407
1408 /* Check for valid public address or a configured static
1409 * random adddress, but let the HCI setup proceed to
1410 * be able to determine if there is a public address
1411 * or not.
1412 *
c6beca0e
MH		 1413 * In case of user channel usage, it is not important
1414 * if a public address or static random address is
1415 * available.
1416 *
a5c8f270
MH		 1417 * This check is only valid for BR/EDR controllers
1418 * since AMP controllers do not have an address.
1419 */
d7a5a11d 1420 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
ca8bee5d 1421 hdev->dev_type == HCI_PRIMARY &&
a5c8f270
MH		 1422 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1423 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1424 ret = -EADDRNOTAVAIL;
1425 goto done;
1426 }
611b30f7
MH		 1427 }
1428
1da177e4
LT		 1429 if (test_bit(HCI_UP, &hdev->flags)) {
1430 ret = -EALREADY;
1431 goto done;
1432 }
1433
1da177e4
LT		 1434 if (hdev->open(hdev)) {
1435 ret = -EIO;
1436 goto done;
1437 }
1438
e9ca8bf1 1439 set_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1440 hci_sock_dev_event(hdev, HCI_DEV_OPEN);
4a3f95b7 1441
f41c70c4
MH		 1442 atomic_set(&hdev->cmd_cnt, 1);
1443 set_bit(HCI_INIT, &hdev->flags);
1444
740011cf
SW		 1445 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1446 test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
7fdf6c6a
MH		 1447 bool invalid_bdaddr;
1448
e131d74a
MH		 1449 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1450
af202f84
MH		 1451 if (hdev->setup)
1452 ret = hdev->setup(hdev);
f41c70c4 1453
7fdf6c6a
MH		 1454 /* The transport driver can set the quirk to mark the
1455 * BD_ADDR invalid before creating the HCI device or in
1456 * its setup callback.
1457 */
1458 invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR,
1459 &hdev->quirks);
1460
7a0e5b15
MK		 1461 if (ret)
1462 goto setup_failed;
1463
1464 if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
1465 if (!bacmp(&hdev->public_addr, BDADDR_ANY))
1466 hci_dev_get_bd_addr_from_property(hdev);
1467
1468 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
7fdf6c6a 1469 hdev->set_bdaddr) {
7a0e5b15
MK		 1470 ret = hdev->set_bdaddr(hdev,
1471 &hdev->public_addr);
7fdf6c6a
MH		 1472
1473 /* If setting of the BD_ADDR from the device
1474 * property succeeds, then treat the address
1475 * as valid even if the invalid BD_ADDR
1476 * quirk indicates otherwise.
1477 */
1478 if (!ret)
1479 invalid_bdaddr = false;
1480 }
7a0e5b15
MK		 1481 }
1482
1483setup_failed:
af202f84
MH		 1484 /* The transport driver can set these quirks before
1485 * creating the HCI device or in its setup callback.
1486 *
7fdf6c6a
MH		 1487 * For the invalid BD_ADDR quirk it is possible that
1488 * it becomes a valid address if the bootloader does
1489 * provide it (see above).
1490 *
af202f84
MH		 1491 * In case any of them is set, the controller has to
1492 * start up as unconfigured.
1493 */
eb1904f4 1494 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
7fdf6c6a 1495 invalid_bdaddr)
a1536da2 1496 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
f41c70c4 1497
0ebca7d6
MH		 1498 /* For an unconfigured controller it is required to
1499 * read at least the version information provided by
1500 * the Read Local Version Information command.
1501 *
1502 * If the set_bdaddr driver callback is provided, then
1503 * also the original Bluetooth public device address
1504 * will be read using the Read BD Address command.
1505 */
d7a5a11d 1506 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
0ebca7d6 1507 ret = __hci_unconf_init(hdev);
89bc22d2
MH		 1508 }
1509
d7a5a11d 1510 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
9713c17b
MH		 1511 /* If public address change is configured, ensure that
1512 * the address gets programmed. If the driver does not
1513 * support changing the public address, fail the power
1514 * on procedure.
1515 */
1516 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1517 hdev->set_bdaddr)
24c457e2
MH		 1518 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1519 else
1520 ret = -EADDRNOTAVAIL;
1521 }
1522
f41c70c4 1523 if (!ret) {
d7a5a11d 1524 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
98a63aaf 1525 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
f41c70c4 1526 ret = __hci_init(hdev);
98a63aaf
MH		 1527 if (!ret && hdev->post_init)
1528 ret = hdev->post_init(hdev);
1529 }
1da177e4
LT		 1530 }
1531
7e995b9e
MH		 1532 /* If the HCI Reset command is clearing all diagnostic settings,
1533 * then they need to be reprogrammed after the init procedure
1534 * completed.
1535 */
1536 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
b56c7b25 1537 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
7e995b9e
MH		 1538 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1539 ret = hdev->set_diag(hdev, true);
1540
f41c70c4
MH		 1541 clear_bit(HCI_INIT, &hdev->flags);
1542
1da177e4
LT		 1543 if (!ret) {
1544 hci_dev_hold(hdev);
a1536da2 1545 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
a73c046a 1546 hci_adv_instances_set_rpa_expired(hdev, true);
1da177e4 1547 set_bit(HCI_UP, &hdev->flags);
05fcd4c4 1548 hci_sock_dev_event(hdev, HCI_DEV_UP);
6d5d2ee6 1549 hci_leds_update_powered(hdev, true);
d7a5a11d
MH		 1550 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1551 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1552 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1553 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
2ff13894 1554 hci_dev_test_flag(hdev, HCI_MGMT) &&
ca8bee5d 1555 hdev->dev_type == HCI_PRIMARY) {
2ff13894
JH		 1556 ret = __hci_req_hci_power_on(hdev);
1557 mgmt_power_on(hdev, ret);
56e5cb86 1558 }
8e87d142 1559 } else {
1da177e4 1560 /* Init failed, cleanup */
3eff45ea 1561 flush_work(&hdev->tx_work);
c347b765 1562 flush_work(&hdev->cmd_work);
b78752cc 1563 flush_work(&hdev->rx_work);
1da177e4
LT		 1564
1565 skb_queue_purge(&hdev->cmd_q);
1566 skb_queue_purge(&hdev->rx_q);
1567
1568 if (hdev->flush)
1569 hdev->flush(hdev);
1570
1571 if (hdev->sent_cmd) {
1572 kfree_skb(hdev->sent_cmd);
1573 hdev->sent_cmd = NULL;
1574 }
1575
e9ca8bf1 1576 clear_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1577 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
4a3f95b7 1578
1da177e4 1579 hdev->close(hdev);
fee746b0 1580 hdev->flags &= BIT(HCI_RAW);
1da177e4
LT		 1581 }
1582
1583done:
b504430c 1584 hci_req_sync_unlock(hdev);
1da177e4
LT		 1585 return ret;
1586}
1587
cbed0ca1
JH		 1588/* ---- HCI ioctl helpers ---- */
1589
1590int hci_dev_open(__u16 dev)
1591{
1592 struct hci_dev *hdev;
1593 int err;
1594
1595 hdev = hci_dev_get(dev);
1596 if (!hdev)
1597 return -ENODEV;
1598
4a964404 1599 /* Devices that are marked as unconfigured can only be powered
fee746b0
MH		 1600 * up as user channel. Trying to bring them up as normal devices
1601 * will result into a failure. Only user channel operation is
1602 * possible.
1603 *
1604 * When this function is called for a user channel, the flag
1605 * HCI_USER_CHANNEL will be set first before attempting to
1606 * open the device.
1607 */
d7a5a11d
MH		 1608 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1609 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
fee746b0
MH		 1610 err = -EOPNOTSUPP;
1611 goto done;
1612 }
1613
e1d08f40
JH		 1614 /* We need to ensure that no other power on/off work is pending
1615 * before proceeding to call hci_dev_do_open. This is
1616 * particularly important if the setup procedure has not yet
1617 * completed.
1618 */
a69d8927 1619 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
e1d08f40
JH		 1620 cancel_delayed_work(&hdev->power_off);
1621
a5c8f270
MH		 1622 /* After this call it is guaranteed that the setup procedure
1623 * has finished. This means that error conditions like RFKILL
1624 * or no valid public or static random address apply.
1625 */
e1d08f40
JH		 1626 flush_workqueue(hdev->req_workqueue);
1627
12aa4f0a 1628 /* For controllers not using the management interface and that
b6ae8457 1629 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
12aa4f0a
MH		 1630 * so that pairing works for them. Once the management interface
1631 * is in use this bit will be cleared again and userspace has
1632 * to explicitly enable it.
1633 */
d7a5a11d
MH		 1634 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1635 !hci_dev_test_flag(hdev, HCI_MGMT))
a1536da2 1636 hci_dev_set_flag(hdev, HCI_BONDABLE);
12aa4f0a 1637
cbed0ca1
JH		 1638 err = hci_dev_do_open(hdev);
1639
fee746b0 1640done:
cbed0ca1 1641 hci_dev_put(hdev);
cbed0ca1
JH		 1642 return err;
1643}
1644
d7347f3c
JH		 1645/* This function requires the caller holds hdev->lock */
1646static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1647{
1648 struct hci_conn_params *p;
1649
f161dd41
JH		 1650 list_for_each_entry(p, &hdev->le_conn_params, list) {
1651 if (p->conn) {
1652 hci_conn_drop(p->conn);
f8aaf9b6 1653 hci_conn_put(p->conn);
f161dd41
JH		 1654 p->conn = NULL;
1655 }
d7347f3c 1656 list_del_init(&p->action);
f161dd41 1657 }
d7347f3c
JH		 1658
1659 BT_DBG("All LE pending actions cleared");
1660}
1661
6b3cc1db 1662int hci_dev_do_close(struct hci_dev *hdev)
1da177e4 1663{
acc649c6
MH		 1664 bool auto_off;
1665
1da177e4
LT		 1666 BT_DBG("%s %p", hdev->name, hdev);
1667
d24d8144 1668 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
867146a0 1669 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
d24d8144 1670 test_bit(HCI_UP, &hdev->flags)) {
a44fecbd
THJA		 1671 /* Execute vendor specific shutdown routine */
1672 if (hdev->shutdown)
1673 hdev->shutdown(hdev);
1674 }
1675
78c04c0b
VCG		 1676 cancel_delayed_work(&hdev->power_off);
1677
7df0f73e 1678 hci_request_cancel_all(hdev);
b504430c 1679 hci_req_sync_lock(hdev);
1da177e4
LT		 1680
1681 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
65cc2b49 1682 cancel_delayed_work_sync(&hdev->cmd_timer);
b504430c 1683 hci_req_sync_unlock(hdev);
1da177e4
LT		 1684 return 0;
1685 }
1686
6d5d2ee6
HK		 1687 hci_leds_update_powered(hdev, false);
1688
3eff45ea
GP		 1689 /* Flush RX and TX works */
1690 flush_work(&hdev->tx_work);
b78752cc 1691 flush_work(&hdev->rx_work);
1da177e4 1692
16ab91ab 1693 if (hdev->discov_timeout > 0) {
16ab91ab 1694 hdev->discov_timeout = 0;
a358dc11
MH		 1695 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1696 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
16ab91ab
JH		 1697 }
1698
a69d8927 1699 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1700 cancel_delayed_work(&hdev->service_cache);
1701
a73c046a
JK		 1702 if (hci_dev_test_flag(hdev, HCI_MGMT)) {
1703 struct adv_info *adv_instance;
1704
4518bb0f 1705 cancel_delayed_work_sync(&hdev->rpa_expired);
7ba8b4be 1706
a73c046a
JK		 1707 list_for_each_entry(adv_instance, &hdev->adv_instances, list)
1708 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1709 }
1710
76727c02
JH		 1711 /* Avoid potential lockdep warnings from the *_flush() calls by
1712 * ensuring the workqueue is empty up front.
1713 */
1714 drain_workqueue(hdev->workqueue);
1715
09fd0de5 1716 hci_dev_lock(hdev);
1aeb9c65 1717
8f502f84
JH		 1718 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1719
acc649c6
MH		 1720 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1721
ca8bee5d 1722 if (!auto_off && hdev->dev_type == HCI_PRIMARY &&
baab7932 1723 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
2ff13894
JH		 1724 hci_dev_test_flag(hdev, HCI_MGMT))
1725 __mgmt_power_off(hdev);
1aeb9c65 1726
1f9b9a5d 1727 hci_inquiry_cache_flush(hdev);
d7347f3c 1728 hci_pend_le_actions_clear(hdev);
f161dd41 1729 hci_conn_hash_flush(hdev);
09fd0de5 1730 hci_dev_unlock(hdev);
1da177e4 1731
64dae967
MH		 1732 smp_unregister(hdev);
1733
05fcd4c4 1734 hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1da177e4
LT		 1735
1736 if (hdev->flush)
1737 hdev->flush(hdev);
1738
1739 /* Reset device */
1740 skb_queue_purge(&hdev->cmd_q);
1741 atomic_set(&hdev->cmd_cnt, 1);
acc649c6
MH		 1742 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1743 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1da177e4 1744 set_bit(HCI_INIT, &hdev->flags);
4ebeee2d 1745 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1da177e4
LT		 1746 clear_bit(HCI_INIT, &hdev->flags);
1747 }
1748
c347b765
GP		 1749 /* flush cmd work */
1750 flush_work(&hdev->cmd_work);
1da177e4
LT		 1751
1752 /* Drop queues */
1753 skb_queue_purge(&hdev->rx_q);
1754 skb_queue_purge(&hdev->cmd_q);
1755 skb_queue_purge(&hdev->raw_q);
1756
1757 /* Drop last sent command */
1758 if (hdev->sent_cmd) {
65cc2b49 1759 cancel_delayed_work_sync(&hdev->cmd_timer);
1da177e4
LT		 1760 kfree_skb(hdev->sent_cmd);
1761 hdev->sent_cmd = NULL;
1762 }
1763
e9ca8bf1 1764 clear_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1765 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
4a3f95b7 1766
1da177e4
LT		 1767 /* After this point our queues are empty
1768 * and no tasks are scheduled. */
1769 hdev->close(hdev);
1770
35b973c9 1771 /* Clear flags */
fee746b0 1772 hdev->flags &= BIT(HCI_RAW);
eacb44df 1773 hci_dev_clear_volatile_flags(hdev);
35b973c9 1774
ced5c338 1775 /* Controller radio is available but is currently powered down */
536619e8 1776 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
ced5c338 1777
e59fda8d 1778 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 1779 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
7a4cd51d 1780 bacpy(&hdev->random_addr, BDADDR_ANY);
e59fda8d 1781
b504430c 1782 hci_req_sync_unlock(hdev);
1da177e4
LT		 1783
1784 hci_dev_put(hdev);
1785 return 0;
1786}
1787
1788int hci_dev_close(__u16 dev)
1789{
1790 struct hci_dev *hdev;
1791 int err;
1792
70f23020
AE		 1793 hdev = hci_dev_get(dev);
1794 if (!hdev)
1da177e4 1795 return -ENODEV;
8ee56540 1796
d7a5a11d 1797 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1798 err = -EBUSY;
1799 goto done;
1800 }
1801
a69d8927 1802 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
8ee56540
MH		 1803 cancel_delayed_work(&hdev->power_off);
1804
1da177e4 1805 err = hci_dev_do_close(hdev);
8ee56540 1806
0736cfa8 1807done:
1da177e4
LT		 1808 hci_dev_put(hdev);
1809 return err;
1810}
1811
5c912495 1812static int hci_dev_do_reset(struct hci_dev *hdev)
1da177e4 1813{
5c912495 1814 int ret;
1da177e4 1815
5c912495 1816 BT_DBG("%s %p", hdev->name, hdev);
1da177e4 1817
b504430c 1818 hci_req_sync_lock(hdev);
1da177e4 1819
1da177e4
LT		 1820 /* Drop queues */
1821 skb_queue_purge(&hdev->rx_q);
1822 skb_queue_purge(&hdev->cmd_q);
1823
76727c02
JH		 1824 /* Avoid potential lockdep warnings from the *_flush() calls by
1825 * ensuring the workqueue is empty up front.
1826 */
1827 drain_workqueue(hdev->workqueue);
1828
09fd0de5 1829 hci_dev_lock(hdev);
1f9b9a5d 1830 hci_inquiry_cache_flush(hdev);
1da177e4 1831 hci_conn_hash_flush(hdev);
09fd0de5 1832 hci_dev_unlock(hdev);
1da177e4
LT		 1833
1834 if (hdev->flush)
1835 hdev->flush(hdev);
1836
8e87d142 1837 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 1838 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4 1839
4ebeee2d 1840 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1da177e4 1841
b504430c 1842 hci_req_sync_unlock(hdev);
1da177e4
LT		 1843 return ret;
1844}
1845
5c912495
MH		 1846int hci_dev_reset(__u16 dev)
1847{
1848 struct hci_dev *hdev;
1849 int err;
1850
1851 hdev = hci_dev_get(dev);
1852 if (!hdev)
1853 return -ENODEV;
1854
1855 if (!test_bit(HCI_UP, &hdev->flags)) {
1856 err = -ENETDOWN;
1857 goto done;
1858 }
1859
d7a5a11d 1860 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
5c912495
MH		 1861 err = -EBUSY;
1862 goto done;
1863 }
1864
d7a5a11d 1865 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
5c912495
MH		 1866 err = -EOPNOTSUPP;
1867 goto done;
1868 }
1869
1870 err = hci_dev_do_reset(hdev);
1871
1872done:
1873 hci_dev_put(hdev);
1874 return err;
1875}
1876
1da177e4
LT		 1877int hci_dev_reset_stat(__u16 dev)
1878{
1879 struct hci_dev *hdev;
1880 int ret = 0;
1881
70f23020
AE		 1882 hdev = hci_dev_get(dev);
1883 if (!hdev)
1da177e4
LT		 1884 return -ENODEV;
1885
d7a5a11d 1886 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1887 ret = -EBUSY;
1888 goto done;
1889 }
1890
d7a5a11d 1891 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1892 ret = -EOPNOTSUPP;
1893 goto done;
1894 }
1895
1da177e4
LT		 1896 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1897
0736cfa8 1898done:
1da177e4 1899 hci_dev_put(hdev);
1da177e4
LT		 1900 return ret;
1901}
1902
123abc08
JH		 1903static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1904{
bc6d2d04 1905 bool conn_changed, discov_changed;
123abc08
JH		 1906
1907 BT_DBG("%s scan 0x%02x", hdev->name, scan);
1908
1909 if ((scan & SCAN_PAGE))
238be788
MH		 1910 conn_changed = !hci_dev_test_and_set_flag(hdev,
1911 HCI_CONNECTABLE);
123abc08 1912 else
a69d8927
MH		 1913 conn_changed = hci_dev_test_and_clear_flag(hdev,
1914 HCI_CONNECTABLE);
123abc08 1915
bc6d2d04 1916 if ((scan & SCAN_INQUIRY)) {
238be788
MH		 1917 discov_changed = !hci_dev_test_and_set_flag(hdev,
1918 HCI_DISCOVERABLE);
bc6d2d04 1919 } else {
a358dc11 1920 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
a69d8927
MH		 1921 discov_changed = hci_dev_test_and_clear_flag(hdev,
1922 HCI_DISCOVERABLE);
bc6d2d04
JH		 1923 }
1924
d7a5a11d 1925 if (!hci_dev_test_flag(hdev, HCI_MGMT))
123abc08
JH		 1926 return;
1927
bc6d2d04
JH		 1928 if (conn_changed || discov_changed) {
1929 /* In case this was disabled through mgmt */
a1536da2 1930 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
bc6d2d04 1931
d7a5a11d 1932 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
cab054ab 1933 hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
bc6d2d04 1934
123abc08 1935 mgmt_new_settings(hdev);
bc6d2d04 1936 }
123abc08
JH		 1937}
1938
1da177e4
LT		 1939int hci_dev_cmd(unsigned int cmd, void __user *arg)
1940{
1941 struct hci_dev *hdev;
1942 struct hci_dev_req dr;
1943 int err = 0;
1944
1945 if (copy_from_user(&dr, arg, sizeof(dr)))
1946 return -EFAULT;
1947
70f23020
AE		 1948 hdev = hci_dev_get(dr.dev_id);
1949 if (!hdev)
1da177e4
LT		 1950 return -ENODEV;
1951
d7a5a11d 1952 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1953 err = -EBUSY;
1954 goto done;
1955 }
1956
d7a5a11d 1957 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1958 err = -EOPNOTSUPP;
1959 goto done;
1960 }
1961
ca8bee5d 1962 if (hdev->dev_type != HCI_PRIMARY) {
5b69bef5
MH		 1963 err = -EOPNOTSUPP;
1964 goto done;
1965 }
1966
d7a5a11d 1967 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 1968 err = -EOPNOTSUPP;
1969 goto done;
1970 }
1971
1da177e4
LT		 1972 switch (cmd) {
1973 case HCISETAUTH:
01178cd4 1974 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 1975 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1976 break;
1977
1978 case HCISETENCRYPT:
1979 if (!lmp_encrypt_capable(hdev)) {
1980 err = -EOPNOTSUPP;
1981 break;
1982 }
1983
1984 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1985 /* Auth must be enabled first */
01178cd4 1986 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 1987 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1988 if (err)
1989 break;
1990 }
1991
01178cd4 1992 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
4ebeee2d 1993 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1994 break;
1995
1996 case HCISETSCAN:
01178cd4 1997 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
4ebeee2d 1998 HCI_INIT_TIMEOUT, NULL);
91a668b0 1999
bc6d2d04
JH		 2000 /* Ensure that the connectable and discoverable states
2001 * get correctly modified as this was a non-mgmt change.
91a668b0 2002 */
123abc08
JH		 2003 if (!err)
2004 hci_update_scan_state(hdev, dr.dev_opt);
1da177e4
LT		 2005 break;
2006
1da177e4 2007 case HCISETLINKPOL:
01178cd4 2008 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
4ebeee2d 2009 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 2010 break;
2011
2012 case HCISETLINKMODE:
e4e8e37c
MH		 2013 hdev->link_mode = ((__u16) dr.dev_opt) &
2014 (HCI_LM_MASTER | HCI_LM_ACCEPT);
2015 break;
2016
2017 case HCISETPTYPE:
b7c23df8
JK		 2018 if (hdev->pkt_type == (__u16) dr.dev_opt)
2019 break;
2020
e4e8e37c 2021 hdev->pkt_type = (__u16) dr.dev_opt;
b7c23df8 2022 mgmt_phy_configuration_changed(hdev, NULL);
1da177e4
LT		 2023 break;
2024
2025 case HCISETACLMTU:
e4e8e37c
MH		 2026 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
2027 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 2028 break;
2029
2030 case HCISETSCOMTU:
e4e8e37c
MH		 2031 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
2032 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 2033 break;
2034
2035 default:
2036 err = -EINVAL;
2037 break;
2038 }
e4e8e37c 2039
0736cfa8 2040done:
1da177e4
LT		 2041 hci_dev_put(hdev);
2042 return err;
2043}
2044
2045int hci_get_dev_list(void __user *arg)
2046{
8035ded4 2047 struct hci_dev *hdev;
1da177e4
LT		 2048 struct hci_dev_list_req *dl;
2049 struct hci_dev_req *dr;
1da177e4
LT		 2050 int n = 0, size, err;
2051 __u16 dev_num;
2052
2053 if (get_user(dev_num, (__u16 __user *) arg))
2054 return -EFAULT;
2055
2056 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2057 return -EINVAL;
2058
2059 size = sizeof(*dl) + dev_num * sizeof(*dr);
2060
70f23020
AE		 2061 dl = kzalloc(size, GFP_KERNEL);
2062 if (!dl)
1da177e4
LT		 2063 return -ENOMEM;
2064
2065 dr = dl->dev_req;
2066
f20d09d5 2067 read_lock(&hci_dev_list_lock);
8035ded4 2068 list_for_each_entry(hdev, &hci_dev_list, list) {
2e84d8db 2069 unsigned long flags = hdev->flags;
c542a06c 2070
2e84d8db
MH		 2071 /* When the auto-off is configured it means the transport
2072 * is running, but in that case still indicate that the
2073 * device is actually down.
2074 */
d7a5a11d 2075 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db 2076 flags &= ~BIT(HCI_UP);
c542a06c 2077
1da177e4 2078 (dr + n)->dev_id = hdev->id;
2e84d8db 2079 (dr + n)->dev_opt = flags;
c542a06c 2080
1da177e4
LT		 2081 if (++n >= dev_num)
2082 break;
2083 }
f20d09d5 2084 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 2085
2086 dl->dev_num = n;
2087 size = sizeof(*dl) + n * sizeof(*dr);
2088
2089 err = copy_to_user(arg, dl, size);
2090 kfree(dl);
2091
2092 return err ? -EFAULT : 0;
2093}
2094
2095int hci_get_dev_info(void __user *arg)
2096{
2097 struct hci_dev *hdev;
2098 struct hci_dev_info di;
2e84d8db 2099 unsigned long flags;
1da177e4
LT		 2100 int err = 0;
2101
2102 if (copy_from_user(&di, arg, sizeof(di)))
2103 return -EFAULT;
2104
70f23020
AE		 2105 hdev = hci_dev_get(di.dev_id);
2106 if (!hdev)
1da177e4
LT		 2107 return -ENODEV;
2108
2e84d8db
MH		 2109 /* When the auto-off is configured it means the transport
2110 * is running, but in that case still indicate that the
2111 * device is actually down.
2112 */
d7a5a11d 2113 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db
MH		 2114 flags = hdev->flags & ~BIT(HCI_UP);
2115 else
2116 flags = hdev->flags;
c542a06c 2117
1da177e4
LT		 2118 strcpy(di.name, hdev->name);
2119 di.bdaddr = hdev->bdaddr;
60f2a3ed 2120 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2e84d8db 2121 di.flags = flags;
1da177e4 2122 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 2123 if (lmp_bredr_capable(hdev)) {
2124 di.acl_mtu = hdev->acl_mtu;
2125 di.acl_pkts = hdev->acl_pkts;
2126 di.sco_mtu = hdev->sco_mtu;
2127 di.sco_pkts = hdev->sco_pkts;
2128 } else {
2129 di.acl_mtu = hdev->le_mtu;
2130 di.acl_pkts = hdev->le_pkts;
2131 di.sco_mtu = 0;
2132 di.sco_pkts = 0;
2133 }
1da177e4
LT		 2134 di.link_policy = hdev->link_policy;
2135 di.link_mode = hdev->link_mode;
2136
2137 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2138 memcpy(&di.features, &hdev->features, sizeof(di.features));
2139
2140 if (copy_to_user(arg, &di, sizeof(di)))
2141 err = -EFAULT;
2142
2143 hci_dev_put(hdev);
2144
2145 return err;
2146}
2147
2148/* ---- Interface to HCI drivers ---- */
2149
611b30f7
MH		 2150static int hci_rfkill_set_block(void *data, bool blocked)
2151{
2152 struct hci_dev *hdev = data;
2153
2154 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2155
d7a5a11d 2156 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
0736cfa8
MH		 2157 return -EBUSY;
2158
5e130367 2159 if (blocked) {
a1536da2 2160 hci_dev_set_flag(hdev, HCI_RFKILLED);
d7a5a11d
MH		 2161 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2162 !hci_dev_test_flag(hdev, HCI_CONFIG))
bf543036 2163 hci_dev_do_close(hdev);
5e130367 2164 } else {
a358dc11 2165 hci_dev_clear_flag(hdev, HCI_RFKILLED);
1025c04c 2166 }
611b30f7
MH		 2167
2168 return 0;
2169}
2170
2171static const struct rfkill_ops hci_rfkill_ops = {
2172 .set_block = hci_rfkill_set_block,
2173};
2174
ab81cbf9
JH		 2175static void hci_power_on(struct work_struct *work)
2176{
2177 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 2178 int err;
ab81cbf9
JH		 2179
2180 BT_DBG("%s", hdev->name);
2181
2ff13894
JH		 2182 if (test_bit(HCI_UP, &hdev->flags) &&
2183 hci_dev_test_flag(hdev, HCI_MGMT) &&
2184 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
d82142a8 2185 cancel_delayed_work(&hdev->power_off);
2ff13894
JH		 2186 hci_req_sync_lock(hdev);
2187 err = __hci_req_hci_power_on(hdev);
2188 hci_req_sync_unlock(hdev);
2189 mgmt_power_on(hdev, err);
2190 return;
2191 }
2192
cbed0ca1 2193 err = hci_dev_do_open(hdev);
96570ffc 2194 if (err < 0) {
3ad67582 2195 hci_dev_lock(hdev);
96570ffc 2196 mgmt_set_powered_failed(hdev, err);
3ad67582 2197 hci_dev_unlock(hdev);
ab81cbf9 2198 return;
96570ffc 2199 }
ab81cbf9 2200
a5c8f270
MH		 2201 /* During the HCI setup phase, a few error conditions are
2202 * ignored and they need to be checked now. If they are still
2203 * valid, it is important to turn the device back off.
2204 */
d7a5a11d
MH		 2205 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2206 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
ca8bee5d 2207 (hdev->dev_type == HCI_PRIMARY &&
a5c8f270
MH		 2208 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2209 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
a358dc11 2210 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
bf543036 2211 hci_dev_do_close(hdev);
d7a5a11d 2212 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
19202573
JH		 2213 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2214 HCI_AUTO_OFF_TIMEOUT);
bf543036 2215 }
ab81cbf9 2216
a69d8927 2217 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
4a964404
MH		 2218 /* For unconfigured devices, set the HCI_RAW flag
2219 * so that userspace can easily identify them.
4a964404 2220 */
d7a5a11d 2221 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4a964404 2222 set_bit(HCI_RAW, &hdev->flags);
0602a8ad
MH		 2223
2224 /* For fully configured devices, this will send
2225 * the Index Added event. For unconfigured devices,
2226 * it will send Unconfigued Index Added event.
2227 *
2228 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2229 * and no event will be send.
2230 */
2231 mgmt_index_added(hdev);
a69d8927 2232 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
5ea234d3
MH		 2233 /* When the controller is now configured, then it
2234 * is important to clear the HCI_RAW flag.
2235 */
d7a5a11d 2236 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5ea234d3
MH		 2237 clear_bit(HCI_RAW, &hdev->flags);
2238
d603b76b
MH		 2239 /* Powering on the controller with HCI_CONFIG set only
2240 * happens with the transition from unconfigured to
2241 * configured. This will send the Index Added event.
2242 */
744cf19e 2243 mgmt_index_added(hdev);
fee746b0 2244 }
ab81cbf9
JH		 2245}
2246
2247static void hci_power_off(struct work_struct *work)
2248{
3243553f 2249 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 2250 power_off.work);
ab81cbf9
JH		 2251
2252 BT_DBG("%s", hdev->name);
2253
8ee56540 2254 hci_dev_do_close(hdev);
ab81cbf9
JH		 2255}
2256
c7741d16
MH		 2257static void hci_error_reset(struct work_struct *work)
2258{
2259 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2260
2261 BT_DBG("%s", hdev->name);
2262
2263 if (hdev->hw_error)
2264 hdev->hw_error(hdev, hdev->hw_error_code);
2265 else
2064ee33 2266 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
c7741d16
MH		 2267
2268 if (hci_dev_do_close(hdev))
2269 return;
2270
c7741d16
MH		 2271 hci_dev_do_open(hdev);
2272}
2273
35f7498a 2274void hci_uuids_clear(struct hci_dev *hdev)
2aeb9a1a 2275{
4821002c 2276 struct bt_uuid *uuid, *tmp;
2aeb9a1a 2277
4821002c
JH		 2278 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2279 list_del(&uuid->list);
2aeb9a1a
JH		 2280 kfree(uuid);
2281 }
2aeb9a1a
JH		 2282}
2283
35f7498a 2284void hci_link_keys_clear(struct hci_dev *hdev)
55ed8ca1 2285{
0378b597 2286 struct link_key *key;
55ed8ca1 2287
0378b597
JH		 2288 list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2289 list_del_rcu(&key->list);
2290 kfree_rcu(key, rcu);
55ed8ca1 2291 }
55ed8ca1
JH		 2292}
2293
35f7498a 2294void hci_smp_ltks_clear(struct hci_dev *hdev)
b899efaf 2295{
970d0f1b 2296 struct smp_ltk *k;
b899efaf 2297
970d0f1b
JH		 2298 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2299 list_del_rcu(&k->list);
2300 kfree_rcu(k, rcu);
b899efaf 2301 }
b899efaf
VCG		 2302}
2303
970c4e46
JH		 2304void hci_smp_irks_clear(struct hci_dev *hdev)
2305{
adae20cb 2306 struct smp_irk *k;
970c4e46 2307
adae20cb
JH		 2308 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2309 list_del_rcu(&k->list);
2310 kfree_rcu(k, rcu);
970c4e46
JH		 2311 }
2312}
2313
600a8749
AM		 2314void hci_blocked_keys_clear(struct hci_dev *hdev)
2315{
2316 struct blocked_key *b;
2317
2318 list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
2319 list_del_rcu(&b->list);
2320 kfree_rcu(b, rcu);
2321 }
2322}
2323
2324bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
2325{
2326 bool blocked = false;
2327 struct blocked_key *b;
2328
2329 rcu_read_lock();
2330 list_for_each_entry(b, &hdev->blocked_keys, list) {
2331 if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
2332 blocked = true;
2333 break;
2334 }
2335 }
2336
2337 rcu_read_unlock();
2338 return blocked;
2339}
2340
55ed8ca1
JH		 2341struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2342{
8035ded4 2343 struct link_key *k;
55ed8ca1 2344
0378b597
JH		 2345 rcu_read_lock();
2346 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2347 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2348 rcu_read_unlock();
600a8749
AM		 2349
2350 if (hci_is_blocked_key(hdev,
2351 HCI_BLOCKED_KEY_TYPE_LINKKEY,
2352 k->val)) {
2353 bt_dev_warn_ratelimited(hdev,
2354 "Link key blocked for %pMR",
2355 &k->bdaddr);
2356 return NULL;
2357 }
2358
55ed8ca1 2359 return k;
0378b597
JH		 2360 }
2361 }
2362 rcu_read_unlock();
55ed8ca1
JH		 2363
2364 return NULL;
2365}
2366
745c0ce3 2367static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 2368 u8 key_type, u8 old_key_type)
d25e28ab
JH		 2369{
2370 /* Legacy key */
2371 if (key_type < 0x03)
745c0ce3 2372 return true;
d25e28ab
JH		 2373
2374 /* Debug keys are insecure so don't store them persistently */
2375 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 2376 return false;
d25e28ab
JH		 2377
2378 /* Changed combination key and there's no previous one */
2379 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 2380 return false;
d25e28ab
JH		 2381
2382 /* Security mode 3 case */
2383 if (!conn)
745c0ce3 2384 return true;
d25e28ab 2385
e3befab9
JH		 2386 /* BR/EDR key derived using SC from an LE link */
2387 if (conn->type == LE_LINK)
2388 return true;
2389
d25e28ab
JH		 2390 /* Neither local nor remote side had no-bonding as requirement */
2391 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 2392 return true;
d25e28ab
JH		 2393
2394 /* Local side had dedicated bonding as requirement */
2395 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 2396 return true;
d25e28ab
JH		 2397
2398 /* Remote side had dedicated bonding as requirement */
2399 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 2400 return true;
d25e28ab
JH		 2401
2402 /* If none of the above criteria match, then don't store the key
2403 * persistently */
745c0ce3 2404 return false;
d25e28ab
JH		 2405}
2406
e804d25d 2407static u8 ltk_role(u8 type)
98a0b845 2408{
e804d25d
JH		 2409 if (type == SMP_LTK)
2410 return HCI_ROLE_MASTER;
98a0b845 2411
e804d25d 2412 return HCI_ROLE_SLAVE;
98a0b845
JH		 2413}
2414
f3a73d97
JH		 2415struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2416 u8 addr_type, u8 role)
75d262c2 2417{
c9839a11 2418 struct smp_ltk *k;
75d262c2 2419
970d0f1b
JH		 2420 rcu_read_lock();
2421 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
5378bc56
JH		 2422 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2423 continue;
2424
923e2414 2425 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
970d0f1b 2426 rcu_read_unlock();
600a8749
AM		 2427
2428 if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
2429 k->val)) {
2430 bt_dev_warn_ratelimited(hdev,
2431 "LTK blocked for %pMR",
2432 &k->bdaddr);
2433 return NULL;
2434 }
2435
75d262c2 2436 return k;
970d0f1b
JH		 2437 }
2438 }
2439 rcu_read_unlock();
75d262c2
VCG		 2440
2441 return NULL;
2442}
75d262c2 2443
970c4e46
JH		 2444struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2445{
600a8749 2446 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 2447 struct smp_irk *irk;
2448
adae20cb
JH		 2449 rcu_read_lock();
2450 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2451 if (!bacmp(&irk->rpa, rpa)) {
600a8749
AM		 2452 irk_to_return = irk;
2453 goto done;
adae20cb 2454 }
970c4e46
JH		 2455 }
2456
adae20cb 2457 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
defce9e8 2458 if (smp_irk_matches(hdev, irk->val, rpa)) {
970c4e46 2459 bacpy(&irk->rpa, rpa);
600a8749
AM		 2460 irk_to_return = irk;
2461 goto done;
970c4e46
JH		 2462 }
2463 }
600a8749
AM		 2464
2465done:
2466 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2467 irk_to_return->val)) {
2468 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
2469 &irk_to_return->bdaddr);
2470 irk_to_return = NULL;
2471 }
2472
adae20cb 2473 rcu_read_unlock();
970c4e46 2474
600a8749 2475 return irk_to_return;
970c4e46
JH		 2476}
2477
2478struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2479 u8 addr_type)
2480{
600a8749 2481 struct smp_irk *irk_to_return = NULL;
970c4e46
JH		 2482 struct smp_irk *irk;
2483
6cfc9988
JH		 2484 /* Identity Address must be public or static random */
2485 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2486 return NULL;
2487
adae20cb
JH		 2488 rcu_read_lock();
2489 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
970c4e46 2490 if (addr_type == irk->addr_type &&
adae20cb 2491 bacmp(bdaddr, &irk->bdaddr) == 0) {
600a8749
AM		 2492 irk_to_return = irk;
2493 goto done;
adae20cb 2494 }
970c4e46 2495 }
600a8749
AM		 2496
2497done:
2498
2499 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2500 irk_to_return->val)) {
2501 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
2502 &irk_to_return->bdaddr);
2503 irk_to_return = NULL;
2504 }
2505
adae20cb 2506 rcu_read_unlock();
970c4e46 2507
600a8749 2508 return irk_to_return;
970c4e46
JH		 2509}
2510
567fa2aa 2511struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
7652ff6a
JH		 2512 bdaddr_t *bdaddr, u8 *val, u8 type,
2513 u8 pin_len, bool *persistent)
55ed8ca1
JH		 2514{
2515 struct link_key *key, *old_key;
745c0ce3 2516 u8 old_key_type;
55ed8ca1
JH		 2517
2518 old_key = hci_find_link_key(hdev, bdaddr);
2519 if (old_key) {
2520 old_key_type = old_key->type;
2521 key = old_key;
2522 } else {
12adcf3a 2523 old_key_type = conn ? conn->key_type : 0xff;
0a14ab41 2524 key = kzalloc(sizeof(*key), GFP_KERNEL);
55ed8ca1 2525 if (!key)
567fa2aa 2526 return NULL;
0378b597 2527 list_add_rcu(&key->list, &hdev->link_keys);
55ed8ca1
JH		 2528 }
2529
6ed93dc6 2530 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 2531
d25e28ab
JH		 2532 /* Some buggy controller combinations generate a changed
2533 * combination key for legacy pairing even when there's no
2534 * previous key */
2535 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 2536 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 2537 type = HCI_LK_COMBINATION;
655fe6ec
JH		 2538 if (conn)
2539 conn->key_type = type;
2540 }
d25e28ab 2541
55ed8ca1 2542 bacpy(&key->bdaddr, bdaddr);
9b3b4460 2543 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 2544 key->pin_len = pin_len;
2545
b6020ba0 2546 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 2547 key->type = old_key_type;
4748fed2
JH		 2548 else
2549 key->type = type;
2550
7652ff6a
JH		 2551 if (persistent)
2552 *persistent = hci_persistent_key(hdev, conn, type,
2553 old_key_type);
4df378a1 2554
567fa2aa 2555 return key;
55ed8ca1
JH		 2556}
2557
ca9142b8 2558struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
35d70271 2559 u8 addr_type, u8 type, u8 authenticated,
fe39c7b2 2560 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
75d262c2 2561{
c9839a11 2562 struct smp_ltk *key, *old_key;
e804d25d 2563 u8 role = ltk_role(type);
75d262c2 2564
f3a73d97 2565 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
c9839a11 2566 if (old_key)
75d262c2 2567 key = old_key;
c9839a11 2568 else {
0a14ab41 2569 key = kzalloc(sizeof(*key), GFP_KERNEL);
75d262c2 2570 if (!key)
ca9142b8 2571 return NULL;
970d0f1b 2572 list_add_rcu(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 2573 }
2574
75d262c2 2575 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 2576 key->bdaddr_type = addr_type;
2577 memcpy(key->val, tk, sizeof(key->val));
2578 key->authenticated = authenticated;
2579 key->ediv = ediv;
fe39c7b2 2580 key->rand = rand;
c9839a11
VCG		 2581 key->enc_size = enc_size;
2582 key->type = type;
75d262c2 2583
ca9142b8 2584 return key;
75d262c2
VCG		 2585}
2586
ca9142b8
JH		 2587struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2588 u8 addr_type, u8 val[16], bdaddr_t *rpa)
970c4e46
JH		 2589{
2590 struct smp_irk *irk;
2591
2592 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2593 if (!irk) {
2594 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2595 if (!irk)
ca9142b8 2596 return NULL;
970c4e46
JH		 2597
2598 bacpy(&irk->bdaddr, bdaddr);
2599 irk->addr_type = addr_type;
2600
adae20cb 2601 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
970c4e46
JH		 2602 }
2603
2604 memcpy(irk->val, val, 16);
2605 bacpy(&irk->rpa, rpa);
2606
ca9142b8 2607 return irk;
970c4e46
JH		 2608}
2609
55ed8ca1
JH		 2610int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2611{
2612 struct link_key *key;
2613
2614 key = hci_find_link_key(hdev, bdaddr);
2615 if (!key)
2616 return -ENOENT;
2617
6ed93dc6 2618 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1 2619
0378b597
JH		 2620 list_del_rcu(&key->list);
2621 kfree_rcu(key, rcu);
55ed8ca1
JH		 2622
2623 return 0;
2624}
2625
e0b2b27e 2626int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
b899efaf 2627{
970d0f1b 2628 struct smp_ltk *k;
c51ffa0b 2629 int removed = 0;
b899efaf 2630
970d0f1b 2631 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
e0b2b27e 2632 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
b899efaf
VCG		 2633 continue;
2634
6ed93dc6 2635 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf 2636
970d0f1b
JH		 2637 list_del_rcu(&k->list);
2638 kfree_rcu(k, rcu);
c51ffa0b 2639 removed++;
b899efaf
VCG		 2640 }
2641
c51ffa0b 2642 return removed ? 0 : -ENOENT;
b899efaf
VCG		 2643}
2644
a7ec7338
JH		 2645void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2646{
adae20cb 2647 struct smp_irk *k;
a7ec7338 2648
adae20cb 2649 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
a7ec7338
JH		 2650 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2651 continue;
2652
2653 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2654
adae20cb
JH		 2655 list_del_rcu(&k->list);
2656 kfree_rcu(k, rcu);
a7ec7338
JH		 2657 }
2658}
2659
55e76b38
JH		 2660bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2661{
2662 struct smp_ltk *k;
4ba9faf3 2663 struct smp_irk *irk;
55e76b38
JH		 2664 u8 addr_type;
2665
2666 if (type == BDADDR_BREDR) {
2667 if (hci_find_link_key(hdev, bdaddr))
2668 return true;
2669 return false;
2670 }
2671
2672 /* Convert to HCI addr type which struct smp_ltk uses */
2673 if (type == BDADDR_LE_PUBLIC)
2674 addr_type = ADDR_LE_DEV_PUBLIC;
2675 else
2676 addr_type = ADDR_LE_DEV_RANDOM;
2677
4ba9faf3
JH		 2678 irk = hci_get_irk(hdev, bdaddr, addr_type);
2679 if (irk) {
2680 bdaddr = &irk->bdaddr;
2681 addr_type = irk->addr_type;
2682 }
2683
55e76b38
JH		 2684 rcu_read_lock();
2685 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
87c8b28d
JH		 2686 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2687 rcu_read_unlock();
55e76b38 2688 return true;
87c8b28d 2689 }
55e76b38
JH		 2690 }
2691 rcu_read_unlock();
2692
2693 return false;
2694}
2695
6bd32326 2696/* HCI command timer function */
65cc2b49 2697static void hci_cmd_timeout(struct work_struct *work)
6bd32326 2698{
65cc2b49
MH		 2699 struct hci_dev *hdev = container_of(work, struct hci_dev,
2700 cmd_timer.work);
6bd32326 2701
bda4f23a
AE		 2702 if (hdev->sent_cmd) {
2703 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2704 u16 opcode = __le16_to_cpu(sent->opcode);
2705
2064ee33 2706 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
bda4f23a 2707 } else {
2064ee33 2708 bt_dev_err(hdev, "command tx timeout");
bda4f23a
AE		 2709 }
2710
e2bef384
RJ		 2711 if (hdev->cmd_timeout)
2712 hdev->cmd_timeout(hdev);
2713
6bd32326 2714 atomic_set(&hdev->cmd_cnt, 1);
c347b765 2715 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 2716}
2717
2763eda6 2718struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
6928a924 2719 bdaddr_t *bdaddr, u8 bdaddr_type)
2763eda6
SJ		 2720{
2721 struct oob_data *data;
2722
6928a924
JH		 2723 list_for_each_entry(data, &hdev->remote_oob_data, list) {
2724 if (bacmp(bdaddr, &data->bdaddr) != 0)
2725 continue;
2726 if (data->bdaddr_type != bdaddr_type)
2727 continue;
2728 return data;
2729 }
2763eda6
SJ		 2730
2731 return NULL;
2732}
2733
6928a924
JH		 2734int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2735 u8 bdaddr_type)
2763eda6
SJ		 2736{
2737 struct oob_data *data;
2738
6928a924 2739 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6
SJ		 2740 if (!data)
2741 return -ENOENT;
2742
6928a924 2743 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2763eda6
SJ		 2744
2745 list_del(&data->list);
2746 kfree(data);
2747
2748 return 0;
2749}
2750
35f7498a 2751void hci_remote_oob_data_clear(struct hci_dev *hdev)
2763eda6
SJ		 2752{
2753 struct oob_data *data, *n;
2754
2755 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2756 list_del(&data->list);
2757 kfree(data);
2758 }
2763eda6
SJ		 2759}
2760
0798872e 2761int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
6928a924 2762 u8 bdaddr_type, u8 *hash192, u8 *rand192,
81328d5c 2763 u8 *hash256, u8 *rand256)
2763eda6
SJ		 2764{
2765 struct oob_data *data;
2766
6928a924 2767 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6 2768 if (!data) {
0a14ab41 2769 data = kmalloc(sizeof(*data), GFP_KERNEL);
2763eda6
SJ		 2770 if (!data)
2771 return -ENOMEM;
2772
2773 bacpy(&data->bdaddr, bdaddr);
6928a924 2774 data->bdaddr_type = bdaddr_type;
2763eda6
SJ		 2775 list_add(&data->list, &hdev->remote_oob_data);
2776 }
2777
81328d5c
JH		 2778 if (hash192 && rand192) {
2779 memcpy(data->hash192, hash192, sizeof(data->hash192));
2780 memcpy(data->rand192, rand192, sizeof(data->rand192));
f7697b16
MH		 2781 if (hash256 && rand256)
2782 data->present = 0x03;
81328d5c
JH		 2783 } else {
2784 memset(data->hash192, 0, sizeof(data->hash192));
2785 memset(data->rand192, 0, sizeof(data->rand192));
f7697b16
MH		 2786 if (hash256 && rand256)
2787 data->present = 0x02;
2788 else
2789 data->present = 0x00;
0798872e
MH		 2790 }
2791
81328d5c
JH		 2792 if (hash256 && rand256) {
2793 memcpy(data->hash256, hash256, sizeof(data->hash256));
2794 memcpy(data->rand256, rand256, sizeof(data->rand256));
2795 } else {
2796 memset(data->hash256, 0, sizeof(data->hash256));
2797 memset(data->rand256, 0, sizeof(data->rand256));
f7697b16
MH		 2798 if (hash192 && rand192)
2799 data->present = 0x01;
81328d5c 2800 }
0798872e 2801
6ed93dc6 2802 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 2803
2804 return 0;
2805}
2806
d2609b34
FG		 2807/* This function requires the caller holds hdev->lock */
2808struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2809{
2810 struct adv_info *adv_instance;
2811
2812 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2813 if (adv_instance->instance == instance)
2814 return adv_instance;
2815 }
2816
2817 return NULL;
2818}
2819
2820/* This function requires the caller holds hdev->lock */
74b93e9f
PK		 2821struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2822{
d2609b34
FG		 2823 struct adv_info *cur_instance;
2824
2825 cur_instance = hci_find_adv_instance(hdev, instance);
2826 if (!cur_instance)
2827 return NULL;
2828
2829 if (cur_instance == list_last_entry(&hdev->adv_instances,
2830 struct adv_info, list))
2831 return list_first_entry(&hdev->adv_instances,
2832 struct adv_info, list);
2833 else
2834 return list_next_entry(cur_instance, list);
2835}
2836
2837/* This function requires the caller holds hdev->lock */
2838int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2839{
2840 struct adv_info *adv_instance;
2841
2842 adv_instance = hci_find_adv_instance(hdev, instance);
2843 if (!adv_instance)
2844 return -ENOENT;
2845
2846 BT_DBG("%s removing %dMR", hdev->name, instance);
2847
cab054ab
JH		 2848 if (hdev->cur_adv_instance == instance) {
2849 if (hdev->adv_instance_timeout) {
2850 cancel_delayed_work(&hdev->adv_instance_expire);
2851 hdev->adv_instance_timeout = 0;
2852 }
2853 hdev->cur_adv_instance = 0x00;
5d900e46
FG		 2854 }
2855
a73c046a
JK		 2856 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2857
d2609b34
FG		 2858 list_del(&adv_instance->list);
2859 kfree(adv_instance);
2860
2861 hdev->adv_instance_cnt--;
2862
2863 return 0;
2864}
2865
a73c046a
JK		 2866void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
2867{
2868 struct adv_info *adv_instance, *n;
2869
2870 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
2871 adv_instance->rpa_expired = rpa_expired;
2872}
2873
d2609b34
FG		 2874/* This function requires the caller holds hdev->lock */
2875void hci_adv_instances_clear(struct hci_dev *hdev)
2876{
2877 struct adv_info *adv_instance, *n;
2878
5d900e46
FG		 2879 if (hdev->adv_instance_timeout) {
2880 cancel_delayed_work(&hdev->adv_instance_expire);
2881 hdev->adv_instance_timeout = 0;
2882 }
2883
d2609b34 2884 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
a73c046a 2885 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
d2609b34
FG		 2886 list_del(&adv_instance->list);
2887 kfree(adv_instance);
2888 }
2889
2890 hdev->adv_instance_cnt = 0;
cab054ab 2891 hdev->cur_adv_instance = 0x00;
d2609b34
FG		 2892}
2893
a73c046a
JK		 2894static void adv_instance_rpa_expired(struct work_struct *work)
2895{
2896 struct adv_info *adv_instance = container_of(work, struct adv_info,
2897 rpa_expired_cb.work);
2898
2899 BT_DBG("");
2900
2901 adv_instance->rpa_expired = true;
2902}
2903
d2609b34
FG		 2904/* This function requires the caller holds hdev->lock */
2905int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2906 u16 adv_data_len, u8 *adv_data,
2907 u16 scan_rsp_len, u8 *scan_rsp_data,
2908 u16 timeout, u16 duration)
2909{
2910 struct adv_info *adv_instance;
2911
2912 adv_instance = hci_find_adv_instance(hdev, instance);
2913 if (adv_instance) {
2914 memset(adv_instance->adv_data, 0,
2915 sizeof(adv_instance->adv_data));
2916 memset(adv_instance->scan_rsp_data, 0,
2917 sizeof(adv_instance->scan_rsp_data));
2918 } else {
1d0fac2c 2919 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
d2609b34
FG		 2920 instance < 1 || instance > HCI_MAX_ADV_INSTANCES)
2921 return -EOVERFLOW;
2922
39ecfad6 2923 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
d2609b34
FG		 2924 if (!adv_instance)
2925 return -ENOMEM;
2926
fffd38bc 2927 adv_instance->pending = true;
d2609b34
FG		 2928 adv_instance->instance = instance;
2929 list_add(&adv_instance->list, &hdev->adv_instances);
2930 hdev->adv_instance_cnt++;
2931 }
2932
2933 adv_instance->flags = flags;
2934 adv_instance->adv_data_len = adv_data_len;
2935 adv_instance->scan_rsp_len = scan_rsp_len;
2936
2937 if (adv_data_len)
2938 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
2939
2940 if (scan_rsp_len)
2941 memcpy(adv_instance->scan_rsp_data,
2942 scan_rsp_data, scan_rsp_len);
2943
2944 adv_instance->timeout = timeout;
5d900e46 2945 adv_instance->remaining_time = timeout;
d2609b34
FG		 2946
2947 if (duration == 0)
2948 adv_instance->duration = HCI_DEFAULT_ADV_DURATION;
2949 else
2950 adv_instance->duration = duration;
2951
de181e88
JK		 2952 adv_instance->tx_power = HCI_TX_POWER_INVALID;
2953
a73c046a
JK		 2954 INIT_DELAYED_WORK(&adv_instance->rpa_expired_cb,
2955 adv_instance_rpa_expired);
2956
d2609b34
FG		 2957 BT_DBG("%s for %dMR", hdev->name, instance);
2958
2959 return 0;
2960}
2961
dcc36c16 2962struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
b9ee0a78 2963 bdaddr_t *bdaddr, u8 type)
b2a66aad 2964{
8035ded4 2965 struct bdaddr_list *b;
b2a66aad 2966
dcc36c16 2967 list_for_each_entry(b, bdaddr_list, list) {
b9ee0a78 2968 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
b2a66aad 2969 return b;
b9ee0a78 2970 }
b2a66aad
AJ		 2971
2972 return NULL;
2973}
2974
b950aa88
AN		 2975struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
2976 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
2977 u8 type)
2978{
2979 struct bdaddr_list_with_irk *b;
2980
2981 list_for_each_entry(b, bdaddr_list, list) {
2982 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2983 return b;
2984 }
2985
2986 return NULL;
2987}
2988
dcc36c16 2989void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
b2a66aad 2990{
7eb7404f 2991 struct bdaddr_list *b, *n;
b2a66aad 2992
7eb7404f
GT		 2993 list_for_each_entry_safe(b, n, bdaddr_list, list) {
2994 list_del(&b->list);
b2a66aad
AJ		 2995 kfree(b);
2996 }
b2a66aad
AJ		 2997}
2998
dcc36c16 2999int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 3000{
3001 struct bdaddr_list *entry;
b2a66aad 3002
b9ee0a78 3003 if (!bacmp(bdaddr, BDADDR_ANY))
b2a66aad
AJ		 3004 return -EBADF;
3005
dcc36c16 3006 if (hci_bdaddr_list_lookup(list, bdaddr, type))
5e762444 3007 return -EEXIST;
b2a66aad 3008
27f70f3e 3009 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
5e762444
AJ		 3010 if (!entry)
3011 return -ENOMEM;
b2a66aad
AJ		 3012
3013 bacpy(&entry->bdaddr, bdaddr);
b9ee0a78 3014 entry->bdaddr_type = type;
b2a66aad 3015
dcc36c16 3016 list_add(&entry->list, list);
b2a66aad 3017
2a8357f2 3018 return 0;
b2a66aad
AJ		 3019}
3020
b950aa88
AN		 3021int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3022 u8 type, u8 *peer_irk, u8 *local_irk)
3023{
3024 struct bdaddr_list_with_irk *entry;
3025
3026 if (!bacmp(bdaddr, BDADDR_ANY))
3027 return -EBADF;
3028
3029 if (hci_bdaddr_list_lookup(list, bdaddr, type))
3030 return -EEXIST;
3031
3032 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3033 if (!entry)
3034 return -ENOMEM;
3035
3036 bacpy(&entry->bdaddr, bdaddr);
3037 entry->bdaddr_type = type;
3038
3039 if (peer_irk)
3040 memcpy(entry->peer_irk, peer_irk, 16);
3041
3042 if (local_irk)
3043 memcpy(entry->local_irk, local_irk, 16);
3044
3045 list_add(&entry->list, list);
3046
3047 return 0;
3048}
3049
dcc36c16 3050int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 3051{
3052 struct bdaddr_list *entry;
b2a66aad 3053
35f7498a 3054 if (!bacmp(bdaddr, BDADDR_ANY)) {
dcc36c16 3055 hci_bdaddr_list_clear(list);
35f7498a
JH		 3056 return 0;
3057 }
b2a66aad 3058
dcc36c16 3059 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
d2ab0ac1
MH		 3060 if (!entry)
3061 return -ENOENT;
3062
3063 list_del(&entry->list);
3064 kfree(entry);
3065
3066 return 0;
3067}
3068
b950aa88
AN		 3069int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3070 u8 type)
3071{
3072 struct bdaddr_list_with_irk *entry;
3073
3074 if (!bacmp(bdaddr, BDADDR_ANY)) {
3075 hci_bdaddr_list_clear(list);
3076 return 0;
3077 }
3078
3079 entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
3080 if (!entry)
3081 return -ENOENT;
3082
3083 list_del(&entry->list);
3084 kfree(entry);
3085
3086 return 0;
3087}
3088
15819a70
AG		 3089/* This function requires the caller holds hdev->lock */
3090struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
3091 bdaddr_t *addr, u8 addr_type)
3092{
3093 struct hci_conn_params *params;
3094
3095 list_for_each_entry(params, &hdev->le_conn_params, list) {
3096 if (bacmp(&params->addr, addr) == 0 &&
3097 params->addr_type == addr_type) {
3098 return params;
3099 }
3100 }
3101
3102 return NULL;
3103}
3104
4b10966f 3105/* This function requires the caller holds hdev->lock */
501f8827
JH		 3106struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
3107 bdaddr_t *addr, u8 addr_type)
a9b0a04c 3108{
912b42ef 3109 struct hci_conn_params *param;
a9b0a04c 3110
501f8827 3111 list_for_each_entry(param, list, action) {
912b42ef
JH		 3112 if (bacmp(&param->addr, addr) == 0 &&
3113 param->addr_type == addr_type)
3114 return param;
4b10966f
MH		 3115 }
3116
3117 return NULL;
a9b0a04c
AG		 3118}
3119
15819a70 3120/* This function requires the caller holds hdev->lock */
51d167c0
MH		 3121struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
3122 bdaddr_t *addr, u8 addr_type)
15819a70
AG		 3123{
3124 struct hci_conn_params *params;
3125
3126 params = hci_conn_params_lookup(hdev, addr, addr_type);
cef952ce 3127 if (params)
51d167c0 3128 return params;
15819a70
AG		 3129
3130 params = kzalloc(sizeof(*params), GFP_KERNEL);
3131 if (!params) {
2064ee33 3132 bt_dev_err(hdev, "out of memory");
51d167c0 3133 return NULL;
15819a70
AG		 3134 }
3135
3136 bacpy(&params->addr, addr);
3137 params->addr_type = addr_type;
cef952ce
AG		 3138
3139 list_add(&params->list, &hdev->le_conn_params);
93450c75 3140 INIT_LIST_HEAD(&params->action);
cef952ce 3141
bf5b3c8b
MH		 3142 params->conn_min_interval = hdev->le_conn_min_interval;
3143 params->conn_max_interval = hdev->le_conn_max_interval;
3144 params->conn_latency = hdev->le_conn_latency;
3145 params->supervision_timeout = hdev->le_supv_timeout;
3146 params->auto_connect = HCI_AUTO_CONN_DISABLED;
3147
3148 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3149
51d167c0 3150 return params;
bf5b3c8b
MH		 3151}
3152
f6c63249 3153static void hci_conn_params_free(struct hci_conn_params *params)
15819a70 3154{
f8aaf9b6 3155 if (params->conn) {
f161dd41 3156 hci_conn_drop(params->conn);
f8aaf9b6
JH		 3157 hci_conn_put(params->conn);
3158 }
f161dd41 3159
95305baa 3160 list_del(&params->action);
15819a70
AG		 3161 list_del(&params->list);
3162 kfree(params);
f6c63249
JH		 3163}
3164
3165/* This function requires the caller holds hdev->lock */
3166void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3167{
3168 struct hci_conn_params *params;
3169
3170 params = hci_conn_params_lookup(hdev, addr, addr_type);
3171 if (!params)
3172 return;
3173
3174 hci_conn_params_free(params);
15819a70 3175
95305baa
JH		 3176 hci_update_background_scan(hdev);
3177
15819a70
AG		 3178 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3179}
3180
3181/* This function requires the caller holds hdev->lock */
55af49a8 3182void hci_conn_params_clear_disabled(struct hci_dev *hdev)
15819a70
AG		 3183{
3184 struct hci_conn_params *params, *tmp;
3185
3186 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
55af49a8
JH		 3187 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3188 continue;
f75113a2
JP		 3189
3190 /* If trying to estabilish one time connection to disabled
3191 * device, leave the params, but mark them as just once.
3192 */
3193 if (params->explicit_connect) {
3194 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3195 continue;
3196 }
3197
15819a70
AG		 3198 list_del(&params->list);
3199 kfree(params);
3200 }
3201
55af49a8 3202 BT_DBG("All LE disabled connection parameters were removed");
77a77a30
AG		 3203}
3204
3205/* This function requires the caller holds hdev->lock */
030e7f81 3206static void hci_conn_params_clear_all(struct hci_dev *hdev)
77a77a30 3207{
15819a70 3208 struct hci_conn_params *params, *tmp;
77a77a30 3209
f6c63249
JH		 3210 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
3211 hci_conn_params_free(params);
77a77a30 3212
15819a70 3213 BT_DBG("All LE connection parameters were removed");
77a77a30
AG		 3214}
3215
a1f4c318
JH		 3216/* Copy the Identity Address of the controller.
3217 *
3218 * If the controller has a public BD_ADDR, then by default use that one.
3219 * If this is a LE only controller without a public address, default to
3220 * the static random address.
3221 *
3222 * For debugging purposes it is possible to force controllers with a
3223 * public address to use the static random address instead.
50b5b952
MH		 3224 *
3225 * In case BR/EDR has been disabled on a dual-mode controller and
3226 * userspace has configured a static address, then that address
3227 * becomes the identity address instead of the public BR/EDR address.
a1f4c318
JH		 3228 */
3229void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3230 u8 *bdaddr_type)
3231{
b7cb93e5 3232 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
50b5b952 3233 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
d7a5a11d 3234 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
50b5b952 3235 bacmp(&hdev->static_addr, BDADDR_ANY))) {
a1f4c318
JH		 3236 bacpy(bdaddr, &hdev->static_addr);
3237 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3238 } else {
3239 bacpy(bdaddr, &hdev->bdaddr);
3240 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3241 }
3242}
3243
9be0dab7
DH		 3244/* Alloc HCI device */
3245struct hci_dev *hci_alloc_dev(void)
3246{
3247 struct hci_dev *hdev;
3248
27f70f3e 3249 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
9be0dab7
DH		 3250 if (!hdev)
3251 return NULL;
3252
b1b813d4
DH		 3253 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3254 hdev->esco_type = (ESCO_HV1);
3255 hdev->link_mode = (HCI_LM_ACCEPT);
b4cb9fb2
MH		 3256 hdev->num_iac = 0x01; /* One IAC support is mandatory */
3257 hdev->io_capability = 0x03; /* No Input No Output */
96c2103a 3258 hdev->manufacturer = 0xffff; /* Default to internal use */
bbaf444a
JH		 3259 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3260 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
d2609b34
FG		 3261 hdev->adv_instance_cnt = 0;
3262 hdev->cur_adv_instance = 0x00;
5d900e46 3263 hdev->adv_instance_timeout = 0;
b1b813d4 3264
b1b813d4
DH		 3265 hdev->sniff_max_interval = 800;
3266 hdev->sniff_min_interval = 80;
3267
3f959d46 3268 hdev->le_adv_channel_map = 0x07;
628531c9
GL		 3269 hdev->le_adv_min_interval = 0x0800;
3270 hdev->le_adv_max_interval = 0x0800;
bef64738
MH		 3271 hdev->le_scan_interval = 0x0060;
3272 hdev->le_scan_window = 0x0030;
b48c3b59
JH		 3273 hdev->le_conn_min_interval = 0x0018;
3274 hdev->le_conn_max_interval = 0x0028;
04fb7d90
MH		 3275 hdev->le_conn_latency = 0x0000;
3276 hdev->le_supv_timeout = 0x002a;
a8e1bfaa
MH		 3277 hdev->le_def_tx_len = 0x001b;
3278 hdev->le_def_tx_time = 0x0148;
3279 hdev->le_max_tx_len = 0x001b;
3280 hdev->le_max_tx_time = 0x0148;
3281 hdev->le_max_rx_len = 0x001b;
3282 hdev->le_max_rx_time = 0x0148;
30d65e08
MK		 3283 hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
3284 hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
6decb5b4
JK		 3285 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
3286 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
1d0fac2c 3287 hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
bef64738 3288
d6bfd59c 3289 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
b9a7a61e 3290 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
31ad1691
AK		 3291 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3292 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
302975cb 3293 hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
58a96fc3 3294 hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
d6bfd59c 3295
b1b813d4
DH		 3296 mutex_init(&hdev->lock);
3297 mutex_init(&hdev->req_lock);
3298
3299 INIT_LIST_HEAD(&hdev->mgmt_pending);
3300 INIT_LIST_HEAD(&hdev->blacklist);
6659358e 3301 INIT_LIST_HEAD(&hdev->whitelist);
b1b813d4
DH		 3302 INIT_LIST_HEAD(&hdev->uuids);
3303 INIT_LIST_HEAD(&hdev->link_keys);
3304 INIT_LIST_HEAD(&hdev->long_term_keys);
970c4e46 3305 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
b1b813d4 3306 INIT_LIST_HEAD(&hdev->remote_oob_data);
d2ab0ac1 3307 INIT_LIST_HEAD(&hdev->le_white_list);
cfdb0c2d 3308 INIT_LIST_HEAD(&hdev->le_resolv_list);
15819a70 3309 INIT_LIST_HEAD(&hdev->le_conn_params);
77a77a30 3310 INIT_LIST_HEAD(&hdev->pend_le_conns);
66f8455a 3311 INIT_LIST_HEAD(&hdev->pend_le_reports);
6b536b5e 3312 INIT_LIST_HEAD(&hdev->conn_hash.list);
d2609b34 3313 INIT_LIST_HEAD(&hdev->adv_instances);
600a8749 3314 INIT_LIST_HEAD(&hdev->blocked_keys);
b1b813d4
DH		 3315
3316 INIT_WORK(&hdev->rx_work, hci_rx_work);
3317 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3318 INIT_WORK(&hdev->tx_work, hci_tx_work);
3319 INIT_WORK(&hdev->power_on, hci_power_on);
c7741d16 3320 INIT_WORK(&hdev->error_reset, hci_error_reset);
b1b813d4 3321
b1b813d4 3322 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
b1b813d4 3323
b1b813d4
DH		 3324 skb_queue_head_init(&hdev->rx_q);
3325 skb_queue_head_init(&hdev->cmd_q);
3326 skb_queue_head_init(&hdev->raw_q);
3327
3328 init_waitqueue_head(&hdev->req_wait_q);
3329
65cc2b49 3330 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
b1b813d4 3331
5fc16cc4
JH		 3332 hci_request_setup(hdev);
3333
b1b813d4
DH		 3334 hci_init_sysfs(hdev);
3335 discovery_init(hdev);
9be0dab7
DH		 3336
3337 return hdev;
3338}
3339EXPORT_SYMBOL(hci_alloc_dev);
3340
3341/* Free HCI device */
3342void hci_free_dev(struct hci_dev *hdev)
3343{
9be0dab7
DH		 3344 /* will free via device release */
3345 put_device(&hdev->dev);
3346}
3347EXPORT_SYMBOL(hci_free_dev);
3348
1da177e4
LT		 3349/* Register HCI device */
3350int hci_register_dev(struct hci_dev *hdev)
3351{
b1b813d4 3352 int id, error;
1da177e4 3353
74292d5a 3354 if (!hdev->open || !hdev->close || !hdev->send)
1da177e4
LT		 3355 return -EINVAL;
3356
08add513
MM		 3357 /* Do not allow HCI_AMP devices to register at index 0,
3358 * so the index can be used as the AMP controller ID.
3359 */
3df92b31 3360 switch (hdev->dev_type) {
ca8bee5d 3361 case HCI_PRIMARY:
3df92b31
SL		 3362 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3363 break;
3364 case HCI_AMP:
3365 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3366 break;
3367 default:
3368 return -EINVAL;
1da177e4 3369 }
8e87d142 3370
3df92b31
SL		 3371 if (id < 0)
3372 return id;
3373
1da177e4
LT		 3374 sprintf(hdev->name, "hci%d", id);
3375 hdev->id = id;
2d8b3a11
AE		 3376
3377 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3378
29e2dd0d 3379 hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
33ca954d
DH		 3380 if (!hdev->workqueue) {
3381 error = -ENOMEM;
3382 goto err;
3383 }
f48fd9c8 3384
29e2dd0d
TH		 3385 hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
3386 hdev->name);
6ead1bbc
JH		 3387 if (!hdev->req_workqueue) {
3388 destroy_workqueue(hdev->workqueue);
3389 error = -ENOMEM;
3390 goto err;
3391 }
3392
0153e2ec
MH		 3393 if (!IS_ERR_OR_NULL(bt_debugfs))
3394 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3395
bdc3e0f1
MH		 3396 dev_set_name(&hdev->dev, "%s", hdev->name);
3397
3398 error = device_add(&hdev->dev);
33ca954d 3399 if (error < 0)
54506918 3400 goto err_wqueue;
1da177e4 3401
6d5d2ee6
HK		 3402 hci_leds_init(hdev);
3403
611b30f7 3404 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 3405 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3406 hdev);
611b30f7
MH		 3407 if (hdev->rfkill) {
3408 if (rfkill_register(hdev->rfkill) < 0) {
3409 rfkill_destroy(hdev->rfkill);
3410 hdev->rfkill = NULL;
3411 }
3412 }
3413
5e130367 3414 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
a1536da2 3415 hci_dev_set_flag(hdev, HCI_RFKILLED);
5e130367 3416
a1536da2
MH		 3417 hci_dev_set_flag(hdev, HCI_SETUP);
3418 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
ce2be9ac 3419
ca8bee5d 3420 if (hdev->dev_type == HCI_PRIMARY) {
56f87901
JH		 3421 /* Assume BR/EDR support until proven otherwise (such as
3422 * through reading supported features during init.
3423 */
a1536da2 3424 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
56f87901 3425 }
ce2be9ac 3426
fcee3377
GP		 3427 write_lock(&hci_dev_list_lock);
3428 list_add(&hdev->list, &hci_dev_list);
3429 write_unlock(&hci_dev_list_lock);
3430
4a964404
MH		 3431 /* Devices that are marked for raw-only usage are unconfigured
3432 * and should not be included in normal operation.
fee746b0
MH		 3433 */
3434 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
a1536da2 3435 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
fee746b0 3436
05fcd4c4 3437 hci_sock_dev_event(hdev, HCI_DEV_REG);
dc946bd8 3438 hci_dev_hold(hdev);
1da177e4 3439
19202573 3440 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 3441
1da177e4 3442 return id;
f48fd9c8 3443
33ca954d
DH		 3444err_wqueue:
3445 destroy_workqueue(hdev->workqueue);
6ead1bbc 3446 destroy_workqueue(hdev->req_workqueue);
33ca954d 3447err:
3df92b31 3448 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 3449
33ca954d 3450 return error;
1da177e4
LT		 3451}
3452EXPORT_SYMBOL(hci_register_dev);
3453
3454/* Unregister HCI device */
59735631 3455void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 3456{
2d7cc19e 3457 int id;
ef222013 3458
c13854ce 3459 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 3460
a1536da2 3461 hci_dev_set_flag(hdev, HCI_UNREGISTER);
94324962 3462
3df92b31
SL		 3463 id = hdev->id;
3464
f20d09d5 3465 write_lock(&hci_dev_list_lock);
1da177e4 3466 list_del(&hdev->list);
f20d09d5 3467 write_unlock(&hci_dev_list_lock);
1da177e4 3468
b9b5ef18
GP		 3469 cancel_work_sync(&hdev->power_on);
3470
bf389cab
JS		 3471 hci_dev_do_close(hdev);
3472
ab81cbf9 3473 if (!test_bit(HCI_INIT, &hdev->flags) &&
d7a5a11d
MH		 3474 !hci_dev_test_flag(hdev, HCI_SETUP) &&
3475 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
09fd0de5 3476 hci_dev_lock(hdev);
744cf19e 3477 mgmt_index_removed(hdev);
09fd0de5 3478 hci_dev_unlock(hdev);
56e5cb86 3479 }
ab81cbf9 3480
2e58ef3e
JH		 3481 /* mgmt_index_removed should take care of emptying the
3482 * pending list */
3483 BUG_ON(!list_empty(&hdev->mgmt_pending));
3484
05fcd4c4 3485 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
1da177e4 3486
611b30f7
MH		 3487 if (hdev->rfkill) {
3488 rfkill_unregister(hdev->rfkill);
3489 rfkill_destroy(hdev->rfkill);
3490 }
3491
bdc3e0f1 3492 device_del(&hdev->dev);
147e2d59 3493
0153e2ec 3494 debugfs_remove_recursive(hdev->debugfs);
5177a838
MH		 3495 kfree_const(hdev->hw_info);
3496 kfree_const(hdev->fw_info);
0153e2ec 3497
f48fd9c8 3498 destroy_workqueue(hdev->workqueue);
6ead1bbc 3499 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 3500
09fd0de5 3501 hci_dev_lock(hdev);
dcc36c16 3502 hci_bdaddr_list_clear(&hdev->blacklist);
6659358e 3503 hci_bdaddr_list_clear(&hdev->whitelist);
2aeb9a1a 3504 hci_uuids_clear(hdev);
55ed8ca1 3505 hci_link_keys_clear(hdev);
b899efaf 3506 hci_smp_ltks_clear(hdev);
970c4e46 3507 hci_smp_irks_clear(hdev);
2763eda6 3508 hci_remote_oob_data_clear(hdev);
d2609b34 3509 hci_adv_instances_clear(hdev);
dcc36c16 3510 hci_bdaddr_list_clear(&hdev->le_white_list);
cfdb0c2d 3511 hci_bdaddr_list_clear(&hdev->le_resolv_list);
373110c5 3512 hci_conn_params_clear_all(hdev);
22078800 3513 hci_discovery_filter_clear(hdev);
600a8749 3514 hci_blocked_keys_clear(hdev);
09fd0de5 3515 hci_dev_unlock(hdev);
e2e0cacb 3516
dc946bd8 3517 hci_dev_put(hdev);
3df92b31
SL		 3518
3519 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 3520}
3521EXPORT_SYMBOL(hci_unregister_dev);
3522
3523/* Suspend HCI device */
3524int hci_suspend_dev(struct hci_dev *hdev)
3525{
05fcd4c4 3526 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
1da177e4
LT		 3527 return 0;
3528}
3529EXPORT_SYMBOL(hci_suspend_dev);
3530
3531/* Resume HCI device */
3532int hci_resume_dev(struct hci_dev *hdev)
3533{
05fcd4c4 3534 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
1da177e4
LT		 3535 return 0;
3536}
3537EXPORT_SYMBOL(hci_resume_dev);
3538
75e0569f
MH		 3539/* Reset HCI device */
3540int hci_reset_dev(struct hci_dev *hdev)
3541{
1e4b6e91 3542 static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
75e0569f
MH		 3543 struct sk_buff *skb;
3544
3545 skb = bt_skb_alloc(3, GFP_ATOMIC);
3546 if (!skb)
3547 return -ENOMEM;
3548
d79f34e3 3549 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
59ae1d12 3550 skb_put_data(skb, hw_err, 3);
75e0569f
MH		 3551
3552 /* Send Hardware Error to upper stack */
3553 return hci_recv_frame(hdev, skb);
3554}
3555EXPORT_SYMBOL(hci_reset_dev);
3556
76bca880 3557/* Receive frame from HCI drivers */
e1a26170 3558int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
76bca880 3559{
76bca880 3560 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 3561 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 3562 kfree_skb(skb);
3563 return -ENXIO;
3564 }
3565
d79f34e3
MH		 3566 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
3567 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
3568 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
fe806dce
MH		 3569 kfree_skb(skb);
3570 return -EINVAL;
3571 }
3572
d82603c6 3573 /* Incoming skb */
76bca880
MH		 3574 bt_cb(skb)->incoming = 1;
3575
3576 /* Time stamp */
3577 __net_timestamp(skb);
3578
76bca880 3579 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 3580 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 3581
76bca880
MH		 3582 return 0;
3583}
3584EXPORT_SYMBOL(hci_recv_frame);
3585
e875ff84
MH		 3586/* Receive diagnostic message from HCI drivers */
3587int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
3588{
581d6fd6 3589 /* Mark as diagnostic packet */
d79f34e3 3590 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
581d6fd6 3591
e875ff84
MH		 3592 /* Time stamp */
3593 __net_timestamp(skb);
3594
581d6fd6
MH		 3595 skb_queue_tail(&hdev->rx_q, skb);
3596 queue_work(hdev->workqueue, &hdev->rx_work);
e875ff84 3597
e875ff84
MH		 3598 return 0;
3599}
3600EXPORT_SYMBOL(hci_recv_diag);
3601
5177a838
MH		 3602void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
3603{
3604 va_list vargs;
3605
3606 va_start(vargs, fmt);
3607 kfree_const(hdev->hw_info);
3608 hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3609 va_end(vargs);
3610}
3611EXPORT_SYMBOL(hci_set_hw_info);
3612
3613void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
3614{
3615 va_list vargs;
3616
3617 va_start(vargs, fmt);
3618 kfree_const(hdev->fw_info);
3619 hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3620 va_end(vargs);
3621}
3622EXPORT_SYMBOL(hci_set_fw_info);
3623
1da177e4
LT		 3624/* ---- Interface to upper protocols ---- */
3625
1da177e4
LT		 3626int hci_register_cb(struct hci_cb *cb)
3627{
3628 BT_DBG("%p name %s", cb, cb->name);
3629
fba7ecf0 3630 mutex_lock(&hci_cb_list_lock);
00629e0f 3631 list_add_tail(&cb->list, &hci_cb_list);
fba7ecf0 3632 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 3633
3634 return 0;
3635}
3636EXPORT_SYMBOL(hci_register_cb);
3637
3638int hci_unregister_cb(struct hci_cb *cb)
3639{
3640 BT_DBG("%p name %s", cb, cb->name);
3641
fba7ecf0 3642 mutex_lock(&hci_cb_list_lock);
1da177e4 3643 list_del(&cb->list);
fba7ecf0 3644 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 3645
3646 return 0;
3647}
3648EXPORT_SYMBOL(hci_unregister_cb);
3649
51086991 3650static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3651{
cdc52faa
MH		 3652 int err;
3653
d79f34e3
MH		 3654 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3655 skb->len);
1da177e4 3656
cd82e61c
MH		 3657 /* Time stamp */
3658 __net_timestamp(skb);
1da177e4 3659
cd82e61c
MH		 3660 /* Send copy to monitor */
3661 hci_send_to_monitor(hdev, skb);
3662
3663 if (atomic_read(&hdev->promisc)) {
3664 /* Send copy to the sockets */
470fe1b5 3665 hci_send_to_sock(hdev, skb);
1da177e4
LT		 3666 }
3667
3668 /* Get rid of skb owner, prior to sending to the driver. */
3669 skb_orphan(skb);
3670
73d0d3c8
MH		 3671 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3672 kfree_skb(skb);
3673 return;
3674 }
3675
cdc52faa
MH		 3676 err = hdev->send(hdev, skb);
3677 if (err < 0) {
2064ee33 3678 bt_dev_err(hdev, "sending frame failed (%d)", err);
cdc52faa
MH		 3679 kfree_skb(skb);
3680 }
1da177e4
LT		 3681}
3682
1ca3a9d0 3683/* Send HCI command */
07dc93dd
JH		 3684int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3685 const void *param)
1ca3a9d0
JH		 3686{
3687 struct sk_buff *skb;
3688
3689 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3690
3691 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3692 if (!skb) {
2064ee33 3693 bt_dev_err(hdev, "no memory for command");
1ca3a9d0
JH		 3694 return -ENOMEM;
3695 }
3696
49c922bb 3697 /* Stand-alone HCI commands must be flagged as
11714b3d
JH		 3698 * single-command requests.
3699 */
44d27137 3700 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
11714b3d 3701
1da177e4 3702 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 3703 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3704
3705 return 0;
3706}
1da177e4 3707
d6ee6ad7
LP		 3708int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
3709 const void *param)
3710{
3711 struct sk_buff *skb;
3712
3713 if (hci_opcode_ogf(opcode) != 0x3f) {
3714 /* A controller receiving a command shall respond with either
3715 * a Command Status Event or a Command Complete Event.
3716 * Therefore, all standard HCI commands must be sent via the
3717 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
3718 * Some vendors do not comply with this rule for vendor-specific
3719 * commands and do not return any event. We want to support
3720 * unresponded commands for such cases only.
3721 */
3722 bt_dev_err(hdev, "unresponded command not supported");
3723 return -EINVAL;
3724 }
3725
3726 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3727 if (!skb) {
3728 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
3729 opcode);
3730 return -ENOMEM;
3731 }
3732
3733 hci_send_frame(hdev, skb);
3734
3735 return 0;
3736}
3737EXPORT_SYMBOL(__hci_cmd_send);
3738
1da177e4 3739/* Get data from the previously sent command */
a9de9248 3740void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 3741{
3742 struct hci_command_hdr *hdr;
3743
3744 if (!hdev->sent_cmd)
3745 return NULL;
3746
3747 hdr = (void *) hdev->sent_cmd->data;
3748
a9de9248 3749 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 3750 return NULL;
3751
f0e09510 3752 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 3753
3754 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3755}
3756
fbef168f
LP		 3757/* Send HCI command and wait for command commplete event */
3758struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
3759 const void *param, u32 timeout)
3760{
3761 struct sk_buff *skb;
3762
3763 if (!test_bit(HCI_UP, &hdev->flags))
3764 return ERR_PTR(-ENETDOWN);
3765
3766 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
3767
b504430c 3768 hci_req_sync_lock(hdev);
fbef168f 3769 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
b504430c 3770 hci_req_sync_unlock(hdev);
fbef168f
LP		 3771
3772 return skb;
3773}
3774EXPORT_SYMBOL(hci_cmd_sync);
3775
1da177e4
LT		 3776/* Send ACL data */
3777static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3778{
3779 struct hci_acl_hdr *hdr;
3780 int len = skb->len;
3781
badff6d0
ACM		 3782 skb_push(skb, HCI_ACL_HDR_SIZE);
3783 skb_reset_transport_header(skb);
9c70220b 3784 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 3785 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3786 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 3787}
3788
ee22be7e 3789static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 3790 struct sk_buff *skb, __u16 flags)
1da177e4 3791{
ee22be7e 3792 struct hci_conn *conn = chan->conn;
1da177e4
LT		 3793 struct hci_dev *hdev = conn->hdev;
3794 struct sk_buff *list;
3795
087bfd99
GP		 3796 skb->len = skb_headlen(skb);
3797 skb->data_len = 0;
3798
d79f34e3 3799 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
204a6e54
AE		 3800
3801 switch (hdev->dev_type) {
ca8bee5d 3802 case HCI_PRIMARY:
204a6e54
AE		 3803 hci_add_acl_hdr(skb, conn->handle, flags);
3804 break;
3805 case HCI_AMP:
3806 hci_add_acl_hdr(skb, chan->handle, flags);
3807 break;
3808 default:
2064ee33 3809 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
204a6e54
AE		 3810 return;
3811 }
087bfd99 3812
70f23020
AE		 3813 list = skb_shinfo(skb)->frag_list;
3814 if (!list) {
1da177e4
LT		 3815 /* Non fragmented */
3816 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3817
73d80deb 3818 skb_queue_tail(queue, skb);
1da177e4
LT		 3819 } else {
3820 /* Fragmented */
3821 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3822
3823 skb_shinfo(skb)->frag_list = NULL;
3824
9cfd5a23
JR		 3825 /* Queue all fragments atomically. We need to use spin_lock_bh
3826 * here because of 6LoWPAN links, as there this function is
3827 * called from softirq and using normal spin lock could cause
3828 * deadlocks.
3829 */
3830 spin_lock_bh(&queue->lock);
1da177e4 3831
73d80deb 3832 __skb_queue_tail(queue, skb);
e702112f
AE		 3833
3834 flags &= ~ACL_START;
3835 flags |= ACL_CONT;
1da177e4
LT		 3836 do {
3837 skb = list; list = list->next;
8e87d142 3838
d79f34e3 3839 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
e702112f 3840 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 3841
3842 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3843
73d80deb 3844 __skb_queue_tail(queue, skb);
1da177e4
LT		 3845 } while (list);
3846
9cfd5a23 3847 spin_unlock_bh(&queue->lock);
1da177e4 3848 }
73d80deb
LAD		 3849}
3850
3851void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3852{
ee22be7e 3853 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 3854
f0e09510 3855 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb 3856
ee22be7e 3857 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 3858
3eff45ea 3859 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3860}
1da177e4
LT		 3861
3862/* Send SCO data */
0d861d8b 3863void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 3864{
3865 struct hci_dev *hdev = conn->hdev;
3866 struct hci_sco_hdr hdr;
3867
3868 BT_DBG("%s len %d", hdev->name, skb->len);
3869
aca3192c 3870 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 3871 hdr.dlen = skb->len;
3872
badff6d0
ACM		 3873 skb_push(skb, HCI_SCO_HDR_SIZE);
3874 skb_reset_transport_header(skb);
9c70220b 3875 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4 3876
d79f34e3 3877 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
c78ae283 3878
1da177e4 3879 skb_queue_tail(&conn->data_q, skb);
3eff45ea 3880 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3881}
1da177e4
LT		 3882
3883/* ---- HCI TX task (outgoing data) ---- */
3884
3885/* HCI Connection scheduler */
6039aa73
GP		 3886static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3887 int *quote)
1da177e4
LT		 3888{
3889 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3890 struct hci_conn *conn = NULL, *c;
abc5de8f 3891 unsigned int num = 0, min = ~0;
1da177e4 3892
8e87d142 3893 /* We don't have to lock device here. Connections are always
1da177e4 3894 * added and removed with TX task disabled. */
bf4c6325
GP		 3895
3896 rcu_read_lock();
3897
3898 list_for_each_entry_rcu(c, &h->list, list) {
769be974 3899 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 3900 continue;
769be974
MH		 3901
3902 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3903 continue;
3904
1da177e4
LT		 3905 num++;
3906
3907 if (c->sent < min) {
3908 min = c->sent;
3909 conn = c;
3910 }
52087a79
LAD		 3911
3912 if (hci_conn_num(hdev, type) == num)
3913 break;
1da177e4
LT		 3914 }
3915
bf4c6325
GP		 3916 rcu_read_unlock();
3917
1da177e4 3918 if (conn) {
6ed58ec5
VT		 3919 int cnt, q;
3920
3921 switch (conn->type) {
3922 case ACL_LINK:
3923 cnt = hdev->acl_cnt;
3924 break;
3925 case SCO_LINK:
3926 case ESCO_LINK:
3927 cnt = hdev->sco_cnt;
3928 break;
3929 case LE_LINK:
3930 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3931 break;
3932 default:
3933 cnt = 0;
2064ee33 3934 bt_dev_err(hdev, "unknown link type %d", conn->type);
6ed58ec5
VT		 3935 }
3936
3937 q = cnt / num;
1da177e4
LT		 3938 *quote = q ? q : 1;
3939 } else
3940 *quote = 0;
3941
3942 BT_DBG("conn %p quote %d", conn, *quote);
3943 return conn;
3944}
3945
6039aa73 3946static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 3947{
3948 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3949 struct hci_conn *c;
1da177e4 3950
2064ee33 3951 bt_dev_err(hdev, "link tx timeout");
1da177e4 3952
bf4c6325
GP		 3953 rcu_read_lock();
3954
1da177e4 3955 /* Kill stalled connections */
bf4c6325 3956 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 3957 if (c->type == type && c->sent) {
2064ee33
MH		 3958 bt_dev_err(hdev, "killing stalled connection %pMR",
3959 &c->dst);
bed71748 3960 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 3961 }
3962 }
bf4c6325
GP		 3963
3964 rcu_read_unlock();
1da177e4
LT		 3965}
3966
6039aa73
GP		 3967static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3968 int *quote)
1da177e4 3969{
73d80deb
LAD		 3970 struct hci_conn_hash *h = &hdev->conn_hash;
3971 struct hci_chan *chan = NULL;
abc5de8f 3972 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 3973 struct hci_conn *conn;
73d80deb
LAD		 3974 int cnt, q, conn_num = 0;
3975
3976 BT_DBG("%s", hdev->name);
3977
bf4c6325
GP		 3978 rcu_read_lock();
3979
3980 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 3981 struct hci_chan *tmp;
3982
3983 if (conn->type != type)
3984 continue;
3985
3986 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3987 continue;
3988
3989 conn_num++;
3990
8192edef 3991 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 3992 struct sk_buff *skb;
3993
3994 if (skb_queue_empty(&tmp->data_q))
3995 continue;
3996
3997 skb = skb_peek(&tmp->data_q);
3998 if (skb->priority < cur_prio)
3999 continue;
4000
4001 if (skb->priority > cur_prio) {
4002 num = 0;
4003 min = ~0;
4004 cur_prio = skb->priority;
4005 }
4006
4007 num++;
4008
4009 if (conn->sent < min) {
4010 min = conn->sent;
4011 chan = tmp;
4012 }
4013 }
4014
4015 if (hci_conn_num(hdev, type) == conn_num)
4016 break;
4017 }
4018
bf4c6325
GP		 4019 rcu_read_unlock();
4020
73d80deb
LAD		 4021 if (!chan)
4022 return NULL;
4023
4024 switch (chan->conn->type) {
4025 case ACL_LINK:
4026 cnt = hdev->acl_cnt;
4027 break;
bd1eb66b
AE		 4028 case AMP_LINK:
4029 cnt = hdev->block_cnt;
4030 break;
73d80deb
LAD		 4031 case SCO_LINK:
4032 case ESCO_LINK:
4033 cnt = hdev->sco_cnt;
4034 break;
4035 case LE_LINK:
4036 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4037 break;
4038 default:
4039 cnt = 0;
2064ee33 4040 bt_dev_err(hdev, "unknown link type %d", chan->conn->type);
73d80deb
LAD		 4041 }
4042
4043 q = cnt / num;
4044 *quote = q ? q : 1;
4045 BT_DBG("chan %p quote %d", chan, *quote);
4046 return chan;
4047}
4048
02b20f0b
LAD		 4049static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
4050{
4051 struct hci_conn_hash *h = &hdev->conn_hash;
4052 struct hci_conn *conn;
4053 int num = 0;
4054
4055 BT_DBG("%s", hdev->name);
4056
bf4c6325
GP		 4057 rcu_read_lock();
4058
4059 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 4060 struct hci_chan *chan;
4061
4062 if (conn->type != type)
4063 continue;
4064
4065 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4066 continue;
4067
4068 num++;
4069
8192edef 4070 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 4071 struct sk_buff *skb;
4072
4073 if (chan->sent) {
4074 chan->sent = 0;
4075 continue;
4076 }
4077
4078 if (skb_queue_empty(&chan->data_q))
4079 continue;
4080
4081 skb = skb_peek(&chan->data_q);
4082 if (skb->priority >= HCI_PRIO_MAX - 1)
4083 continue;
4084
4085 skb->priority = HCI_PRIO_MAX - 1;
4086
4087 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 4088 skb->priority);
02b20f0b
LAD		 4089 }
4090
4091 if (hci_conn_num(hdev, type) == num)
4092 break;
4093 }
bf4c6325
GP		 4094
4095 rcu_read_unlock();
4096
02b20f0b
LAD		 4097}
4098
b71d385a
AE		 4099static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
4100{
4101 /* Calculate count of blocks used by this packet */
4102 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
4103}
4104
6039aa73 4105static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 4106{
d7a5a11d 4107 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1da177e4
LT		 4108 /* ACL tx timeout must be longer than maximum
4109 * link supervision timeout (40.9 seconds) */
63d2bc1b 4110 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 4111 HCI_ACL_TX_TIMEOUT))
bae1f5d9 4112 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 4113 }
63d2bc1b 4114}
1da177e4 4115
6039aa73 4116static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 4117{
4118 unsigned int cnt = hdev->acl_cnt;
4119 struct hci_chan *chan;
4120 struct sk_buff *skb;
4121 int quote;
4122
4123 __check_timeout(hdev, cnt);
04837f64 4124
73d80deb 4125 while (hdev->acl_cnt &&
a8c5fb1a 4126 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 4127 u32 priority = (skb_peek(&chan->data_q))->priority;
4128 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 4129 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 4130 skb->len, skb->priority);
73d80deb 4131
ec1cce24
LAD		 4132 /* Stop if priority has changed */
4133 if (skb->priority < priority)
4134 break;
4135
4136 skb = skb_dequeue(&chan->data_q);
4137
73d80deb 4138 hci_conn_enter_active_mode(chan->conn,
04124681 4139 bt_cb(skb)->force_active);
04837f64 4140
57d17d70 4141 hci_send_frame(hdev, skb);
1da177e4
LT		 4142 hdev->acl_last_tx = jiffies;
4143
4144 hdev->acl_cnt--;
73d80deb
LAD		 4145 chan->sent++;
4146 chan->conn->sent++;
1da177e4
LT		 4147 }
4148 }
02b20f0b
LAD		 4149
4150 if (cnt != hdev->acl_cnt)
4151 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 4152}
4153
6039aa73 4154static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 4155{
63d2bc1b 4156 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 4157 struct hci_chan *chan;
4158 struct sk_buff *skb;
4159 int quote;
bd1eb66b 4160 u8 type;
b71d385a 4161
63d2bc1b 4162 __check_timeout(hdev, cnt);
b71d385a 4163
bd1eb66b
AE		 4164 BT_DBG("%s", hdev->name);
4165
4166 if (hdev->dev_type == HCI_AMP)
4167 type = AMP_LINK;
4168 else
4169 type = ACL_LINK;
4170
b71d385a 4171 while (hdev->block_cnt > 0 &&
bd1eb66b 4172 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 4173 u32 priority = (skb_peek(&chan->data_q))->priority;
4174 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
4175 int blocks;
4176
4177 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 4178 skb->len, skb->priority);
b71d385a
AE		 4179
4180 /* Stop if priority has changed */
4181 if (skb->priority < priority)
4182 break;
4183
4184 skb = skb_dequeue(&chan->data_q);
4185
4186 blocks = __get_blocks(hdev, skb);
4187 if (blocks > hdev->block_cnt)
4188 return;
4189
4190 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 4191 bt_cb(skb)->force_active);
b71d385a 4192
57d17d70 4193 hci_send_frame(hdev, skb);
b71d385a
AE		 4194 hdev->acl_last_tx = jiffies;
4195
4196 hdev->block_cnt -= blocks;
4197 quote -= blocks;
4198
4199 chan->sent += blocks;
4200 chan->conn->sent += blocks;
4201 }
4202 }
4203
4204 if (cnt != hdev->block_cnt)
bd1eb66b 4205 hci_prio_recalculate(hdev, type);
b71d385a
AE		 4206}
4207
6039aa73 4208static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 4209{
4210 BT_DBG("%s", hdev->name);
4211
bd1eb66b 4212 /* No ACL link over BR/EDR controller */
ca8bee5d 4213 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
bd1eb66b
AE		 4214 return;
4215
4216 /* No AMP link over AMP controller */
4217 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 4218 return;
4219
4220 switch (hdev->flow_ctl_mode) {
4221 case HCI_FLOW_CTL_MODE_PACKET_BASED:
4222 hci_sched_acl_pkt(hdev);
4223 break;
4224
4225 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4226 hci_sched_acl_blk(hdev);
4227 break;
4228 }
4229}
4230
1da177e4 4231/* Schedule SCO */
6039aa73 4232static void hci_sched_sco(struct hci_dev *hdev)
1da177e4
LT		 4233{
4234 struct hci_conn *conn;
4235 struct sk_buff *skb;
4236 int quote;
4237
4238 BT_DBG("%s", hdev->name);
4239
52087a79
LAD		 4240 if (!hci_conn_num(hdev, SCO_LINK))
4241 return;
4242
1da177e4
LT		 4243 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
4244 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4245 BT_DBG("skb %p len %d", skb, skb->len);
57d17d70 4246 hci_send_frame(hdev, skb);
1da177e4
LT		 4247
4248 conn->sent++;
4249 if (conn->sent == ~0)
4250 conn->sent = 0;
4251 }
4252 }
4253}
4254
6039aa73 4255static void hci_sched_esco(struct hci_dev *hdev)
b6a0dc82
MH		 4256{
4257 struct hci_conn *conn;
4258 struct sk_buff *skb;
4259 int quote;
4260
4261 BT_DBG("%s", hdev->name);
4262
52087a79
LAD		 4263 if (!hci_conn_num(hdev, ESCO_LINK))
4264 return;
4265
8fc9ced3
GP		 4266 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4267 &quote))) {
b6a0dc82
MH		 4268 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4269 BT_DBG("skb %p len %d", skb, skb->len);
57d17d70 4270 hci_send_frame(hdev, skb);
b6a0dc82
MH		 4271
4272 conn->sent++;
4273 if (conn->sent == ~0)
4274 conn->sent = 0;
4275 }
4276 }
4277}
4278
6039aa73 4279static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 4280{
73d80deb 4281 struct hci_chan *chan;
6ed58ec5 4282 struct sk_buff *skb;
02b20f0b 4283 int quote, cnt, tmp;
6ed58ec5
VT		 4284
4285 BT_DBG("%s", hdev->name);
4286
52087a79
LAD		 4287 if (!hci_conn_num(hdev, LE_LINK))
4288 return;
4289
d7a5a11d 4290 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6ed58ec5
VT		 4291 /* LE tx timeout must be longer than maximum
4292 * link supervision timeout (40.9 seconds) */
bae1f5d9 4293 if (!hdev->le_cnt && hdev->le_pkts &&
a8c5fb1a 4294 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 4295 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 4296 }
4297
4298 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 4299 tmp = cnt;
73d80deb 4300 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 4301 u32 priority = (skb_peek(&chan->data_q))->priority;
4302 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 4303 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 4304 skb->len, skb->priority);
6ed58ec5 4305
ec1cce24
LAD		 4306 /* Stop if priority has changed */
4307 if (skb->priority < priority)
4308 break;
4309
4310 skb = skb_dequeue(&chan->data_q);
4311
57d17d70 4312 hci_send_frame(hdev, skb);
6ed58ec5
VT		 4313 hdev->le_last_tx = jiffies;
4314
4315 cnt--;
73d80deb
LAD		 4316 chan->sent++;
4317 chan->conn->sent++;
6ed58ec5
VT		 4318 }
4319 }
73d80deb 4320
6ed58ec5
VT		 4321 if (hdev->le_pkts)
4322 hdev->le_cnt = cnt;
4323 else
4324 hdev->acl_cnt = cnt;
02b20f0b
LAD		 4325
4326 if (cnt != tmp)
4327 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 4328}
4329
3eff45ea 4330static void hci_tx_work(struct work_struct *work)
1da177e4 4331{
3eff45ea 4332 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 4333 struct sk_buff *skb;
4334
6ed58ec5 4335 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 4336 hdev->sco_cnt, hdev->le_cnt);
1da177e4 4337
d7a5a11d 4338 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
52de599e
MH		 4339 /* Schedule queues and send stuff to HCI driver */
4340 hci_sched_acl(hdev);
4341 hci_sched_sco(hdev);
4342 hci_sched_esco(hdev);
4343 hci_sched_le(hdev);
4344 }
6ed58ec5 4345
1da177e4
LT		 4346 /* Send next queued raw (unknown type) packet */
4347 while ((skb = skb_dequeue(&hdev->raw_q)))
57d17d70 4348 hci_send_frame(hdev, skb);
1da177e4
LT		 4349}
4350
25985edc 4351/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 4352
4353/* ACL data packet */
6039aa73 4354static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 4355{
4356 struct hci_acl_hdr *hdr = (void *) skb->data;
4357 struct hci_conn *conn;
4358 __u16 handle, flags;
4359
4360 skb_pull(skb, HCI_ACL_HDR_SIZE);
4361
4362 handle = __le16_to_cpu(hdr->handle);
4363 flags = hci_flags(handle);
4364 handle = hci_handle(handle);
4365
f0e09510 4366 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 4367 handle, flags);
1da177e4
LT		 4368
4369 hdev->stat.acl_rx++;
4370
4371 hci_dev_lock(hdev);
4372 conn = hci_conn_hash_lookup_handle(hdev, handle);
4373 hci_dev_unlock(hdev);
8e87d142 4374
1da177e4 4375 if (conn) {
65983fc7 4376 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 4377
1da177e4 4378 /* Send to upper protocol */
686ebf28
UF		 4379 l2cap_recv_acldata(conn, skb, flags);
4380 return;
1da177e4 4381 } else {
2064ee33
MH		 4382 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
4383 handle);
1da177e4
LT		 4384 }
4385
4386 kfree_skb(skb);
4387}
4388
4389/* SCO data packet */
6039aa73 4390static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 4391{
4392 struct hci_sco_hdr *hdr = (void *) skb->data;
4393 struct hci_conn *conn;
4394 __u16 handle;
4395
4396 skb_pull(skb, HCI_SCO_HDR_SIZE);
4397
4398 handle = __le16_to_cpu(hdr->handle);
4399
f0e09510 4400 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
1da177e4
LT		 4401
4402 hdev->stat.sco_rx++;
4403
4404 hci_dev_lock(hdev);
4405 conn = hci_conn_hash_lookup_handle(hdev, handle);
4406 hci_dev_unlock(hdev);
4407
4408 if (conn) {
1da177e4 4409 /* Send to upper protocol */
686ebf28
UF		 4410 sco_recv_scodata(conn, skb);
4411 return;
1da177e4 4412 } else {
2064ee33
MH		 4413 bt_dev_err(hdev, "SCO packet for unknown connection handle %d",
4414 handle);
1da177e4
LT		 4415 }
4416
4417 kfree_skb(skb);
4418}
4419
9238f36a
JH		 4420static bool hci_req_is_complete(struct hci_dev *hdev)
4421{
4422 struct sk_buff *skb;
4423
4424 skb = skb_peek(&hdev->cmd_q);
4425 if (!skb)
4426 return true;
4427
44d27137 4428 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
9238f36a
JH		 4429}
4430
42c6b129
JH		 4431static void hci_resend_last(struct hci_dev *hdev)
4432{
4433 struct hci_command_hdr *sent;
4434 struct sk_buff *skb;
4435 u16 opcode;
4436
4437 if (!hdev->sent_cmd)
4438 return;
4439
4440 sent = (void *) hdev->sent_cmd->data;
4441 opcode = __le16_to_cpu(sent->opcode);
4442 if (opcode == HCI_OP_RESET)
4443 return;
4444
4445 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4446 if (!skb)
4447 return;
4448
4449 skb_queue_head(&hdev->cmd_q, skb);
4450 queue_work(hdev->workqueue, &hdev->cmd_work);
4451}
4452
e6214487
JH		 4453void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4454 hci_req_complete_t *req_complete,
4455 hci_req_complete_skb_t *req_complete_skb)
9238f36a 4456{
9238f36a
JH		 4457 struct sk_buff *skb;
4458 unsigned long flags;
4459
4460 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4461
42c6b129
JH		 4462 /* If the completed command doesn't match the last one that was
4463 * sent we need to do special handling of it.
9238f36a 4464 */
42c6b129
JH		 4465 if (!hci_sent_cmd_data(hdev, opcode)) {
4466 /* Some CSR based controllers generate a spontaneous
4467 * reset complete event during init and any pending
4468 * command will never be completed. In such a case we
4469 * need to resend whatever was the last sent
4470 * command.
4471 */
4472 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4473 hci_resend_last(hdev);
4474
9238f36a 4475 return;
42c6b129 4476 }
9238f36a 4477
f80c5dad
JPRV		 4478 /* If we reach this point this event matches the last command sent */
4479 hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
4480
9238f36a
JH		 4481 /* If the command succeeded and there's still more commands in
4482 * this request the request is not yet complete.
4483 */
4484 if (!status && !hci_req_is_complete(hdev))
4485 return;
4486
4487 /* If this was the last command in a request the complete
4488 * callback would be found in hdev->sent_cmd instead of the
4489 * command queue (hdev->cmd_q).
4490 */
44d27137
JH		 4491 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4492 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
e6214487
JH		 4493 return;
4494 }
53e21fbc 4495
44d27137
JH		 4496 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4497 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
e6214487 4498 return;
9238f36a
JH		 4499 }
4500
4501 /* Remove all pending commands belonging to this request */
4502 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4503 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
44d27137 4504 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
9238f36a
JH		 4505 __skb_queue_head(&hdev->cmd_q, skb);
4506 break;
4507 }
4508
3bd7594e
DA		 4509 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4510 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4511 else
4512 *req_complete = bt_cb(skb)->hci.req_complete;
9238f36a
JH		 4513 kfree_skb(skb);
4514 }
4515 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
9238f36a
JH		 4516}
4517
b78752cc 4518static void hci_rx_work(struct work_struct *work)
1da177e4 4519{
b78752cc 4520 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 4521 struct sk_buff *skb;
4522
4523 BT_DBG("%s", hdev->name);
4524
1da177e4 4525 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 4526 /* Send copy to monitor */
4527 hci_send_to_monitor(hdev, skb);
4528
1da177e4
LT		 4529 if (atomic_read(&hdev->promisc)) {
4530 /* Send copy to the sockets */
470fe1b5 4531 hci_send_to_sock(hdev, skb);
1da177e4
LT		 4532 }
4533
eb8c101e
MK		 4534 /* If the device has been opened in HCI_USER_CHANNEL,
4535 * the userspace has exclusive access to device.
4536 * When device is HCI_INIT, we still need to process
4537 * the data packets to the driver in order
4538 * to complete its setup().
4539 */
4540 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4541 !test_bit(HCI_INIT, &hdev->flags)) {
1da177e4
LT		 4542 kfree_skb(skb);
4543 continue;
4544 }
4545
4546 if (test_bit(HCI_INIT, &hdev->flags)) {
4547 /* Don't process data packets in this states. */
d79f34e3 4548 switch (hci_skb_pkt_type(skb)) {
1da177e4
LT		 4549 case HCI_ACLDATA_PKT:
4550 case HCI_SCODATA_PKT:
4551 kfree_skb(skb);
4552 continue;
3ff50b79 4553 }
1da177e4
LT		 4554 }
4555
4556 /* Process frame */
d79f34e3 4557 switch (hci_skb_pkt_type(skb)) {
1da177e4 4558 case HCI_EVENT_PKT:
b78752cc 4559 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 4560 hci_event_packet(hdev, skb);
4561 break;
4562
4563 case HCI_ACLDATA_PKT:
4564 BT_DBG("%s ACL data packet", hdev->name);
4565 hci_acldata_packet(hdev, skb);
4566 break;
4567
4568 case HCI_SCODATA_PKT:
4569 BT_DBG("%s SCO data packet", hdev->name);
4570 hci_scodata_packet(hdev, skb);
4571 break;
4572
4573 default:
4574 kfree_skb(skb);
4575 break;
4576 }
4577 }
1da177e4
LT		 4578}
4579
c347b765 4580static void hci_cmd_work(struct work_struct *work)
1da177e4 4581{
c347b765 4582 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 4583 struct sk_buff *skb;
4584
2104786b
AE		 4585 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4586 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 4587
1da177e4 4588 /* Send queued commands */
5a08ecce
AE		 4589 if (atomic_read(&hdev->cmd_cnt)) {
4590 skb = skb_dequeue(&hdev->cmd_q);
4591 if (!skb)
4592 return;
4593
7585b97a 4594 kfree_skb(hdev->sent_cmd);
1da177e4 4595
a675d7f1 4596 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
70f23020 4597 if (hdev->sent_cmd) {
f80c5dad
JPRV		 4598 if (hci_req_status_pend(hdev))
4599 hci_dev_set_flag(hdev, HCI_CMD_PENDING);
1da177e4 4600 atomic_dec(&hdev->cmd_cnt);
57d17d70 4601 hci_send_frame(hdev, skb);
7bdb8a5c 4602 if (test_bit(HCI_RESET, &hdev->flags))
65cc2b49 4603 cancel_delayed_work(&hdev->cmd_timer);
7bdb8a5c 4604 else
65cc2b49
MH		 4605 schedule_delayed_work(&hdev->cmd_timer,
4606 HCI_CMD_TIMEOUT);
1da177e4
LT		 4607 } else {
4608 skb_queue_head(&hdev->cmd_q, skb);
c347b765 4609 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4610 }
4611 }
4612}
Linux 6.x block layer and io_uring tree(s)