Bluetooth: Support HCI_QUIRK_RAW_DEVICE for hci_vhci driver
[linux-block.git] / net / bluetooth / hci_core.c
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4    Copyright (C) 2011 ProFUSION Embedded Systems
5
6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License version 2 as
10    published by the Free Software Foundation;
11
12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23    SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth HCI core. */
27
28 #include <linux/export.h>
29 #include <linux/idr.h>
30 #include <linux/rfkill.h>
31 #include <linux/debugfs.h>
32 #include <linux/crypto.h>
33 #include <asm/unaligned.h>
34
35 #include <net/bluetooth/bluetooth.h>
36 #include <net/bluetooth/hci_core.h>
37 #include <net/bluetooth/l2cap.h>
38 #include <net/bluetooth/mgmt.h>
39
40 #include "smp.h"
41
42 static void hci_rx_work(struct work_struct *work);
43 static void hci_cmd_work(struct work_struct *work);
44 static void hci_tx_work(struct work_struct *work);
45
46 /* HCI device list */
47 LIST_HEAD(hci_dev_list);
48 DEFINE_RWLOCK(hci_dev_list_lock);
49
50 /* HCI callback list */
51 LIST_HEAD(hci_cb_list);
52 DEFINE_RWLOCK(hci_cb_list_lock);
53
54 /* HCI ID Numbering */
55 static DEFINE_IDA(hci_index_ida);
56
57 /* ---- HCI notifications ---- */
58
59 static void hci_notify(struct hci_dev *hdev, int event)
60 {
61         hci_sock_dev_event(hdev, event);
62 }
63
64 /* ---- HCI debugfs entries ---- */
65
66 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
67                              size_t count, loff_t *ppos)
68 {
69         struct hci_dev *hdev = file->private_data;
70         char buf[3];
71
72         buf[0] = test_bit(HCI_DUT_MODE, &hdev->dbg_flags) ? 'Y': 'N';
73         buf[1] = '\n';
74         buf[2] = '\0';
75         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
76 }
77
78 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
79                               size_t count, loff_t *ppos)
80 {
81         struct hci_dev *hdev = file->private_data;
82         struct sk_buff *skb;
83         char buf[32];
84         size_t buf_size = min(count, (sizeof(buf)-1));
85         bool enable;
86         int err;
87
88         if (!test_bit(HCI_UP, &hdev->flags))
89                 return -ENETDOWN;
90
91         if (copy_from_user(buf, user_buf, buf_size))
92                 return -EFAULT;
93
94         buf[buf_size] = '\0';
95         if (strtobool(buf, &enable))
96                 return -EINVAL;
97
98         if (enable == test_bit(HCI_DUT_MODE, &hdev->dbg_flags))
99                 return -EALREADY;
100
101         hci_req_lock(hdev);
102         if (enable)
103                 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
104                                      HCI_CMD_TIMEOUT);
105         else
106                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
107                                      HCI_CMD_TIMEOUT);
108         hci_req_unlock(hdev);
109
110         if (IS_ERR(skb))
111                 return PTR_ERR(skb);
112
113         err = -bt_to_errno(skb->data[0]);
114         kfree_skb(skb);
115
116         if (err < 0)
117                 return err;
118
119         change_bit(HCI_DUT_MODE, &hdev->dbg_flags);
120
121         return count;
122 }
123
124 static const struct file_operations dut_mode_fops = {
125         .open           = simple_open,
126         .read           = dut_mode_read,
127         .write          = dut_mode_write,
128         .llseek         = default_llseek,
129 };
130
131 static int features_show(struct seq_file *f, void *ptr)
132 {
133         struct hci_dev *hdev = f->private;
134         u8 p;
135
136         hci_dev_lock(hdev);
137         for (p = 0; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
138                 seq_printf(f, "%2u: 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x "
139                            "0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n", p,
140                            hdev->features[p][0], hdev->features[p][1],
141                            hdev->features[p][2], hdev->features[p][3],
142                            hdev->features[p][4], hdev->features[p][5],
143                            hdev->features[p][6], hdev->features[p][7]);
144         }
145         if (lmp_le_capable(hdev))
146                 seq_printf(f, "LE: 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x "
147                            "0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n",
148                            hdev->le_features[0], hdev->le_features[1],
149                            hdev->le_features[2], hdev->le_features[3],
150                            hdev->le_features[4], hdev->le_features[5],
151                            hdev->le_features[6], hdev->le_features[7]);
152         hci_dev_unlock(hdev);
153
154         return 0;
155 }
156
157 static int features_open(struct inode *inode, struct file *file)
158 {
159         return single_open(file, features_show, inode->i_private);
160 }
161
162 static const struct file_operations features_fops = {
163         .open           = features_open,
164         .read           = seq_read,
165         .llseek         = seq_lseek,
166         .release        = single_release,
167 };
168
169 static int blacklist_show(struct seq_file *f, void *p)
170 {
171         struct hci_dev *hdev = f->private;
172         struct bdaddr_list *b;
173
174         hci_dev_lock(hdev);
175         list_for_each_entry(b, &hdev->blacklist, list)
176                 seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
177         hci_dev_unlock(hdev);
178
179         return 0;
180 }
181
182 static int blacklist_open(struct inode *inode, struct file *file)
183 {
184         return single_open(file, blacklist_show, inode->i_private);
185 }
186
187 static const struct file_operations blacklist_fops = {
188         .open           = blacklist_open,
189         .read           = seq_read,
190         .llseek         = seq_lseek,
191         .release        = single_release,
192 };
193
194 static int uuids_show(struct seq_file *f, void *p)
195 {
196         struct hci_dev *hdev = f->private;
197         struct bt_uuid *uuid;
198
199         hci_dev_lock(hdev);
200         list_for_each_entry(uuid, &hdev->uuids, list) {
201                 u8 i, val[16];
202
203                 /* The Bluetooth UUID values are stored in big endian,
204                  * but with reversed byte order. So convert them into
205                  * the right order for the %pUb modifier.
206                  */
207                 for (i = 0; i < 16; i++)
208                         val[i] = uuid->uuid[15 - i];
209
210                 seq_printf(f, "%pUb\n", val);
211         }
212         hci_dev_unlock(hdev);
213
214         return 0;
215 }
216
217 static int uuids_open(struct inode *inode, struct file *file)
218 {
219         return single_open(file, uuids_show, inode->i_private);
220 }
221
222 static const struct file_operations uuids_fops = {
223         .open           = uuids_open,
224         .read           = seq_read,
225         .llseek         = seq_lseek,
226         .release        = single_release,
227 };
228
229 static int inquiry_cache_show(struct seq_file *f, void *p)
230 {
231         struct hci_dev *hdev = f->private;
232         struct discovery_state *cache = &hdev->discovery;
233         struct inquiry_entry *e;
234
235         hci_dev_lock(hdev);
236
237         list_for_each_entry(e, &cache->all, all) {
238                 struct inquiry_data *data = &e->data;
239                 seq_printf(f, "%pMR %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %d %u\n",
240                            &data->bdaddr,
241                            data->pscan_rep_mode, data->pscan_period_mode,
242                            data->pscan_mode, data->dev_class[2],
243                            data->dev_class[1], data->dev_class[0],
244                            __le16_to_cpu(data->clock_offset),
245                            data->rssi, data->ssp_mode, e->timestamp);
246         }
247
248         hci_dev_unlock(hdev);
249
250         return 0;
251 }
252
253 static int inquiry_cache_open(struct inode *inode, struct file *file)
254 {
255         return single_open(file, inquiry_cache_show, inode->i_private);
256 }
257
258 static const struct file_operations inquiry_cache_fops = {
259         .open           = inquiry_cache_open,
260         .read           = seq_read,
261         .llseek         = seq_lseek,
262         .release        = single_release,
263 };
264
265 static int link_keys_show(struct seq_file *f, void *ptr)
266 {
267         struct hci_dev *hdev = f->private;
268         struct list_head *p, *n;
269
270         hci_dev_lock(hdev);
271         list_for_each_safe(p, n, &hdev->link_keys) {
272                 struct link_key *key = list_entry(p, struct link_key, list);
273                 seq_printf(f, "%pMR %u %*phN %u\n", &key->bdaddr, key->type,
274                            HCI_LINK_KEY_SIZE, key->val, key->pin_len);
275         }
276         hci_dev_unlock(hdev);
277
278         return 0;
279 }
280
281 static int link_keys_open(struct inode *inode, struct file *file)
282 {
283         return single_open(file, link_keys_show, inode->i_private);
284 }
285
286 static const struct file_operations link_keys_fops = {
287         .open           = link_keys_open,
288         .read           = seq_read,
289         .llseek         = seq_lseek,
290         .release        = single_release,
291 };
292
293 static int dev_class_show(struct seq_file *f, void *ptr)
294 {
295         struct hci_dev *hdev = f->private;
296
297         hci_dev_lock(hdev);
298         seq_printf(f, "0x%.2x%.2x%.2x\n", hdev->dev_class[2],
299                    hdev->dev_class[1], hdev->dev_class[0]);
300         hci_dev_unlock(hdev);
301
302         return 0;
303 }
304
305 static int dev_class_open(struct inode *inode, struct file *file)
306 {
307         return single_open(file, dev_class_show, inode->i_private);
308 }
309
310 static const struct file_operations dev_class_fops = {
311         .open           = dev_class_open,
312         .read           = seq_read,
313         .llseek         = seq_lseek,
314         .release        = single_release,
315 };
316
317 static int voice_setting_get(void *data, u64 *val)
318 {
319         struct hci_dev *hdev = data;
320
321         hci_dev_lock(hdev);
322         *val = hdev->voice_setting;
323         hci_dev_unlock(hdev);
324
325         return 0;
326 }
327
328 DEFINE_SIMPLE_ATTRIBUTE(voice_setting_fops, voice_setting_get,
329                         NULL, "0x%4.4llx\n");
330
331 static int auto_accept_delay_set(void *data, u64 val)
332 {
333         struct hci_dev *hdev = data;
334
335         hci_dev_lock(hdev);
336         hdev->auto_accept_delay = val;
337         hci_dev_unlock(hdev);
338
339         return 0;
340 }
341
342 static int auto_accept_delay_get(void *data, u64 *val)
343 {
344         struct hci_dev *hdev = data;
345
346         hci_dev_lock(hdev);
347         *val = hdev->auto_accept_delay;
348         hci_dev_unlock(hdev);
349
350         return 0;
351 }
352
353 DEFINE_SIMPLE_ATTRIBUTE(auto_accept_delay_fops, auto_accept_delay_get,
354                         auto_accept_delay_set, "%llu\n");
355
356 static ssize_t force_sc_support_read(struct file *file, char __user *user_buf,
357                                      size_t count, loff_t *ppos)
358 {
359         struct hci_dev *hdev = file->private_data;
360         char buf[3];
361
362         buf[0] = test_bit(HCI_FORCE_SC, &hdev->dbg_flags) ? 'Y': 'N';
363         buf[1] = '\n';
364         buf[2] = '\0';
365         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
366 }
367
368 static ssize_t force_sc_support_write(struct file *file,
369                                       const char __user *user_buf,
370                                       size_t count, loff_t *ppos)
371 {
372         struct hci_dev *hdev = file->private_data;
373         char buf[32];
374         size_t buf_size = min(count, (sizeof(buf)-1));
375         bool enable;
376
377         if (test_bit(HCI_UP, &hdev->flags))
378                 return -EBUSY;
379
380         if (copy_from_user(buf, user_buf, buf_size))
381                 return -EFAULT;
382
383         buf[buf_size] = '\0';
384         if (strtobool(buf, &enable))
385                 return -EINVAL;
386
387         if (enable == test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
388                 return -EALREADY;
389
390         change_bit(HCI_FORCE_SC, &hdev->dbg_flags);
391
392         return count;
393 }
394
395 static const struct file_operations force_sc_support_fops = {
396         .open           = simple_open,
397         .read           = force_sc_support_read,
398         .write          = force_sc_support_write,
399         .llseek         = default_llseek,
400 };
401
402 static ssize_t sc_only_mode_read(struct file *file, char __user *user_buf,
403                                  size_t count, loff_t *ppos)
404 {
405         struct hci_dev *hdev = file->private_data;
406         char buf[3];
407
408         buf[0] = test_bit(HCI_SC_ONLY, &hdev->dev_flags) ? 'Y': 'N';
409         buf[1] = '\n';
410         buf[2] = '\0';
411         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
412 }
413
414 static const struct file_operations sc_only_mode_fops = {
415         .open           = simple_open,
416         .read           = sc_only_mode_read,
417         .llseek         = default_llseek,
418 };
419
420 static int idle_timeout_set(void *data, u64 val)
421 {
422         struct hci_dev *hdev = data;
423
424         if (val != 0 && (val < 500 || val > 3600000))
425                 return -EINVAL;
426
427         hci_dev_lock(hdev);
428         hdev->idle_timeout = val;
429         hci_dev_unlock(hdev);
430
431         return 0;
432 }
433
434 static int idle_timeout_get(void *data, u64 *val)
435 {
436         struct hci_dev *hdev = data;
437
438         hci_dev_lock(hdev);
439         *val = hdev->idle_timeout;
440         hci_dev_unlock(hdev);
441
442         return 0;
443 }
444
445 DEFINE_SIMPLE_ATTRIBUTE(idle_timeout_fops, idle_timeout_get,
446                         idle_timeout_set, "%llu\n");
447
448 static int rpa_timeout_set(void *data, u64 val)
449 {
450         struct hci_dev *hdev = data;
451
452         /* Require the RPA timeout to be at least 30 seconds and at most
453          * 24 hours.
454          */
455         if (val < 30 || val > (60 * 60 * 24))
456                 return -EINVAL;
457
458         hci_dev_lock(hdev);
459         hdev->rpa_timeout = val;
460         hci_dev_unlock(hdev);
461
462         return 0;
463 }
464
465 static int rpa_timeout_get(void *data, u64 *val)
466 {
467         struct hci_dev *hdev = data;
468
469         hci_dev_lock(hdev);
470         *val = hdev->rpa_timeout;
471         hci_dev_unlock(hdev);
472
473         return 0;
474 }
475
476 DEFINE_SIMPLE_ATTRIBUTE(rpa_timeout_fops, rpa_timeout_get,
477                         rpa_timeout_set, "%llu\n");
478
479 static int sniff_min_interval_set(void *data, u64 val)
480 {
481         struct hci_dev *hdev = data;
482
483         if (val == 0 || val % 2 || val > hdev->sniff_max_interval)
484                 return -EINVAL;
485
486         hci_dev_lock(hdev);
487         hdev->sniff_min_interval = val;
488         hci_dev_unlock(hdev);
489
490         return 0;
491 }
492
493 static int sniff_min_interval_get(void *data, u64 *val)
494 {
495         struct hci_dev *hdev = data;
496
497         hci_dev_lock(hdev);
498         *val = hdev->sniff_min_interval;
499         hci_dev_unlock(hdev);
500
501         return 0;
502 }
503
504 DEFINE_SIMPLE_ATTRIBUTE(sniff_min_interval_fops, sniff_min_interval_get,
505                         sniff_min_interval_set, "%llu\n");
506
507 static int sniff_max_interval_set(void *data, u64 val)
508 {
509         struct hci_dev *hdev = data;
510
511         if (val == 0 || val % 2 || val < hdev->sniff_min_interval)
512                 return -EINVAL;
513
514         hci_dev_lock(hdev);
515         hdev->sniff_max_interval = val;
516         hci_dev_unlock(hdev);
517
518         return 0;
519 }
520
521 static int sniff_max_interval_get(void *data, u64 *val)
522 {
523         struct hci_dev *hdev = data;
524
525         hci_dev_lock(hdev);
526         *val = hdev->sniff_max_interval;
527         hci_dev_unlock(hdev);
528
529         return 0;
530 }
531
532 DEFINE_SIMPLE_ATTRIBUTE(sniff_max_interval_fops, sniff_max_interval_get,
533                         sniff_max_interval_set, "%llu\n");
534
535 static int conn_info_min_age_set(void *data, u64 val)
536 {
537         struct hci_dev *hdev = data;
538
539         if (val == 0 || val > hdev->conn_info_max_age)
540                 return -EINVAL;
541
542         hci_dev_lock(hdev);
543         hdev->conn_info_min_age = val;
544         hci_dev_unlock(hdev);
545
546         return 0;
547 }
548
549 static int conn_info_min_age_get(void *data, u64 *val)
550 {
551         struct hci_dev *hdev = data;
552
553         hci_dev_lock(hdev);
554         *val = hdev->conn_info_min_age;
555         hci_dev_unlock(hdev);
556
557         return 0;
558 }
559
560 DEFINE_SIMPLE_ATTRIBUTE(conn_info_min_age_fops, conn_info_min_age_get,
561                         conn_info_min_age_set, "%llu\n");
562
563 static int conn_info_max_age_set(void *data, u64 val)
564 {
565         struct hci_dev *hdev = data;
566
567         if (val == 0 || val < hdev->conn_info_min_age)
568                 return -EINVAL;
569
570         hci_dev_lock(hdev);
571         hdev->conn_info_max_age = val;
572         hci_dev_unlock(hdev);
573
574         return 0;
575 }
576
577 static int conn_info_max_age_get(void *data, u64 *val)
578 {
579         struct hci_dev *hdev = data;
580
581         hci_dev_lock(hdev);
582         *val = hdev->conn_info_max_age;
583         hci_dev_unlock(hdev);
584
585         return 0;
586 }
587
588 DEFINE_SIMPLE_ATTRIBUTE(conn_info_max_age_fops, conn_info_max_age_get,
589                         conn_info_max_age_set, "%llu\n");
590
591 static int identity_show(struct seq_file *f, void *p)
592 {
593         struct hci_dev *hdev = f->private;
594         bdaddr_t addr;
595         u8 addr_type;
596
597         hci_dev_lock(hdev);
598
599         hci_copy_identity_address(hdev, &addr, &addr_type);
600
601         seq_printf(f, "%pMR (type %u) %*phN %pMR\n", &addr, addr_type,
602                    16, hdev->irk, &hdev->rpa);
603
604         hci_dev_unlock(hdev);
605
606         return 0;
607 }
608
609 static int identity_open(struct inode *inode, struct file *file)
610 {
611         return single_open(file, identity_show, inode->i_private);
612 }
613
614 static const struct file_operations identity_fops = {
615         .open           = identity_open,
616         .read           = seq_read,
617         .llseek         = seq_lseek,
618         .release        = single_release,
619 };
620
621 static int random_address_show(struct seq_file *f, void *p)
622 {
623         struct hci_dev *hdev = f->private;
624
625         hci_dev_lock(hdev);
626         seq_printf(f, "%pMR\n", &hdev->random_addr);
627         hci_dev_unlock(hdev);
628
629         return 0;
630 }
631
632 static int random_address_open(struct inode *inode, struct file *file)
633 {
634         return single_open(file, random_address_show, inode->i_private);
635 }
636
637 static const struct file_operations random_address_fops = {
638         .open           = random_address_open,
639         .read           = seq_read,
640         .llseek         = seq_lseek,
641         .release        = single_release,
642 };
643
644 static int static_address_show(struct seq_file *f, void *p)
645 {
646         struct hci_dev *hdev = f->private;
647
648         hci_dev_lock(hdev);
649         seq_printf(f, "%pMR\n", &hdev->static_addr);
650         hci_dev_unlock(hdev);
651
652         return 0;
653 }
654
655 static int static_address_open(struct inode *inode, struct file *file)
656 {
657         return single_open(file, static_address_show, inode->i_private);
658 }
659
660 static const struct file_operations static_address_fops = {
661         .open           = static_address_open,
662         .read           = seq_read,
663         .llseek         = seq_lseek,
664         .release        = single_release,
665 };
666
667 static ssize_t force_static_address_read(struct file *file,
668                                          char __user *user_buf,
669                                          size_t count, loff_t *ppos)
670 {
671         struct hci_dev *hdev = file->private_data;
672         char buf[3];
673
674         buf[0] = test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ? 'Y': 'N';
675         buf[1] = '\n';
676         buf[2] = '\0';
677         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
678 }
679
680 static ssize_t force_static_address_write(struct file *file,
681                                           const char __user *user_buf,
682                                           size_t count, loff_t *ppos)
683 {
684         struct hci_dev *hdev = file->private_data;
685         char buf[32];
686         size_t buf_size = min(count, (sizeof(buf)-1));
687         bool enable;
688
689         if (test_bit(HCI_UP, &hdev->flags))
690                 return -EBUSY;
691
692         if (copy_from_user(buf, user_buf, buf_size))
693                 return -EFAULT;
694
695         buf[buf_size] = '\0';
696         if (strtobool(buf, &enable))
697                 return -EINVAL;
698
699         if (enable == test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags))
700                 return -EALREADY;
701
702         change_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags);
703
704         return count;
705 }
706
707 static const struct file_operations force_static_address_fops = {
708         .open           = simple_open,
709         .read           = force_static_address_read,
710         .write          = force_static_address_write,
711         .llseek         = default_llseek,
712 };
713
714 static int white_list_show(struct seq_file *f, void *ptr)
715 {
716         struct hci_dev *hdev = f->private;
717         struct bdaddr_list *b;
718
719         hci_dev_lock(hdev);
720         list_for_each_entry(b, &hdev->le_white_list, list)
721                 seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
722         hci_dev_unlock(hdev);
723
724         return 0;
725 }
726
727 static int white_list_open(struct inode *inode, struct file *file)
728 {
729         return single_open(file, white_list_show, inode->i_private);
730 }
731
732 static const struct file_operations white_list_fops = {
733         .open           = white_list_open,
734         .read           = seq_read,
735         .llseek         = seq_lseek,
736         .release        = single_release,
737 };
738
739 static int identity_resolving_keys_show(struct seq_file *f, void *ptr)
740 {
741         struct hci_dev *hdev = f->private;
742         struct list_head *p, *n;
743
744         hci_dev_lock(hdev);
745         list_for_each_safe(p, n, &hdev->identity_resolving_keys) {
746                 struct smp_irk *irk = list_entry(p, struct smp_irk, list);
747                 seq_printf(f, "%pMR (type %u) %*phN %pMR\n",
748                            &irk->bdaddr, irk->addr_type,
749                            16, irk->val, &irk->rpa);
750         }
751         hci_dev_unlock(hdev);
752
753         return 0;
754 }
755
756 static int identity_resolving_keys_open(struct inode *inode, struct file *file)
757 {
758         return single_open(file, identity_resolving_keys_show,
759                            inode->i_private);
760 }
761
762 static const struct file_operations identity_resolving_keys_fops = {
763         .open           = identity_resolving_keys_open,
764         .read           = seq_read,
765         .llseek         = seq_lseek,
766         .release        = single_release,
767 };
768
769 static int long_term_keys_show(struct seq_file *f, void *ptr)
770 {
771         struct hci_dev *hdev = f->private;
772         struct list_head *p, *n;
773
774         hci_dev_lock(hdev);
775         list_for_each_safe(p, n, &hdev->long_term_keys) {
776                 struct smp_ltk *ltk = list_entry(p, struct smp_ltk, list);
777                 seq_printf(f, "%pMR (type %u) %u 0x%02x %u %.4x %.16llx %*phN\n",
778                            &ltk->bdaddr, ltk->bdaddr_type, ltk->authenticated,
779                            ltk->type, ltk->enc_size, __le16_to_cpu(ltk->ediv),
780                            __le64_to_cpu(ltk->rand), 16, ltk->val);
781         }
782         hci_dev_unlock(hdev);
783
784         return 0;
785 }
786
787 static int long_term_keys_open(struct inode *inode, struct file *file)
788 {
789         return single_open(file, long_term_keys_show, inode->i_private);
790 }
791
792 static const struct file_operations long_term_keys_fops = {
793         .open           = long_term_keys_open,
794         .read           = seq_read,
795         .llseek         = seq_lseek,
796         .release        = single_release,
797 };
798
799 static int conn_min_interval_set(void *data, u64 val)
800 {
801         struct hci_dev *hdev = data;
802
803         if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval)
804                 return -EINVAL;
805
806         hci_dev_lock(hdev);
807         hdev->le_conn_min_interval = val;
808         hci_dev_unlock(hdev);
809
810         return 0;
811 }
812
813 static int conn_min_interval_get(void *data, u64 *val)
814 {
815         struct hci_dev *hdev = data;
816
817         hci_dev_lock(hdev);
818         *val = hdev->le_conn_min_interval;
819         hci_dev_unlock(hdev);
820
821         return 0;
822 }
823
824 DEFINE_SIMPLE_ATTRIBUTE(conn_min_interval_fops, conn_min_interval_get,
825                         conn_min_interval_set, "%llu\n");
826
827 static int conn_max_interval_set(void *data, u64 val)
828 {
829         struct hci_dev *hdev = data;
830
831         if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval)
832                 return -EINVAL;
833
834         hci_dev_lock(hdev);
835         hdev->le_conn_max_interval = val;
836         hci_dev_unlock(hdev);
837
838         return 0;
839 }
840
841 static int conn_max_interval_get(void *data, u64 *val)
842 {
843         struct hci_dev *hdev = data;
844
845         hci_dev_lock(hdev);
846         *val = hdev->le_conn_max_interval;
847         hci_dev_unlock(hdev);
848
849         return 0;
850 }
851
852 DEFINE_SIMPLE_ATTRIBUTE(conn_max_interval_fops, conn_max_interval_get,
853                         conn_max_interval_set, "%llu\n");
854
855 static int conn_latency_set(void *data, u64 val)
856 {
857         struct hci_dev *hdev = data;
858
859         if (val > 0x01f3)
860                 return -EINVAL;
861
862         hci_dev_lock(hdev);
863         hdev->le_conn_latency = val;
864         hci_dev_unlock(hdev);
865
866         return 0;
867 }
868
869 static int conn_latency_get(void *data, u64 *val)
870 {
871         struct hci_dev *hdev = data;
872
873         hci_dev_lock(hdev);
874         *val = hdev->le_conn_latency;
875         hci_dev_unlock(hdev);
876
877         return 0;
878 }
879
880 DEFINE_SIMPLE_ATTRIBUTE(conn_latency_fops, conn_latency_get,
881                         conn_latency_set, "%llu\n");
882
883 static int supervision_timeout_set(void *data, u64 val)
884 {
885         struct hci_dev *hdev = data;
886
887         if (val < 0x000a || val > 0x0c80)
888                 return -EINVAL;
889
890         hci_dev_lock(hdev);
891         hdev->le_supv_timeout = val;
892         hci_dev_unlock(hdev);
893
894         return 0;
895 }
896
897 static int supervision_timeout_get(void *data, u64 *val)
898 {
899         struct hci_dev *hdev = data;
900
901         hci_dev_lock(hdev);
902         *val = hdev->le_supv_timeout;
903         hci_dev_unlock(hdev);
904
905         return 0;
906 }
907
908 DEFINE_SIMPLE_ATTRIBUTE(supervision_timeout_fops, supervision_timeout_get,
909                         supervision_timeout_set, "%llu\n");
910
911 static int adv_channel_map_set(void *data, u64 val)
912 {
913         struct hci_dev *hdev = data;
914
915         if (val < 0x01 || val > 0x07)
916                 return -EINVAL;
917
918         hci_dev_lock(hdev);
919         hdev->le_adv_channel_map = val;
920         hci_dev_unlock(hdev);
921
922         return 0;
923 }
924
925 static int adv_channel_map_get(void *data, u64 *val)
926 {
927         struct hci_dev *hdev = data;
928
929         hci_dev_lock(hdev);
930         *val = hdev->le_adv_channel_map;
931         hci_dev_unlock(hdev);
932
933         return 0;
934 }
935
936 DEFINE_SIMPLE_ATTRIBUTE(adv_channel_map_fops, adv_channel_map_get,
937                         adv_channel_map_set, "%llu\n");
938
939 static int device_list_show(struct seq_file *f, void *ptr)
940 {
941         struct hci_dev *hdev = f->private;
942         struct hci_conn_params *p;
943
944         hci_dev_lock(hdev);
945         list_for_each_entry(p, &hdev->le_conn_params, list) {
946                 seq_printf(f, "%pMR %u %u\n", &p->addr, p->addr_type,
947                            p->auto_connect);
948         }
949         hci_dev_unlock(hdev);
950
951         return 0;
952 }
953
954 static int device_list_open(struct inode *inode, struct file *file)
955 {
956         return single_open(file, device_list_show, inode->i_private);
957 }
958
959 static const struct file_operations device_list_fops = {
960         .open           = device_list_open,
961         .read           = seq_read,
962         .llseek         = seq_lseek,
963         .release        = single_release,
964 };
965
966 /* ---- HCI requests ---- */
967
968 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
969 {
970         BT_DBG("%s result 0x%2.2x", hdev->name, result);
971
972         if (hdev->req_status == HCI_REQ_PEND) {
973                 hdev->req_result = result;
974                 hdev->req_status = HCI_REQ_DONE;
975                 wake_up_interruptible(&hdev->req_wait_q);
976         }
977 }
978
979 static void hci_req_cancel(struct hci_dev *hdev, int err)
980 {
981         BT_DBG("%s err 0x%2.2x", hdev->name, err);
982
983         if (hdev->req_status == HCI_REQ_PEND) {
984                 hdev->req_result = err;
985                 hdev->req_status = HCI_REQ_CANCELED;
986                 wake_up_interruptible(&hdev->req_wait_q);
987         }
988 }
989
990 static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
991                                             u8 event)
992 {
993         struct hci_ev_cmd_complete *ev;
994         struct hci_event_hdr *hdr;
995         struct sk_buff *skb;
996
997         hci_dev_lock(hdev);
998
999         skb = hdev->recv_evt;
1000         hdev->recv_evt = NULL;
1001
1002         hci_dev_unlock(hdev);
1003
1004         if (!skb)
1005                 return ERR_PTR(-ENODATA);
1006
1007         if (skb->len < sizeof(*hdr)) {
1008                 BT_ERR("Too short HCI event");
1009                 goto failed;
1010         }
1011
1012         hdr = (void *) skb->data;
1013         skb_pull(skb, HCI_EVENT_HDR_SIZE);
1014
1015         if (event) {
1016                 if (hdr->evt != event)
1017                         goto failed;
1018                 return skb;
1019         }
1020
1021         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
1022                 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
1023                 goto failed;
1024         }
1025
1026         if (skb->len < sizeof(*ev)) {
1027                 BT_ERR("Too short cmd_complete event");
1028                 goto failed;
1029         }
1030
1031         ev = (void *) skb->data;
1032         skb_pull(skb, sizeof(*ev));
1033
1034         if (opcode == __le16_to_cpu(ev->opcode))
1035                 return skb;
1036
1037         BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
1038                __le16_to_cpu(ev->opcode));
1039
1040 failed:
1041         kfree_skb(skb);
1042         return ERR_PTR(-ENODATA);
1043 }
1044
1045 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
1046                                   const void *param, u8 event, u32 timeout)
1047 {
1048         DECLARE_WAITQUEUE(wait, current);
1049         struct hci_request req;
1050         int err = 0;
1051
1052         BT_DBG("%s", hdev->name);
1053
1054         hci_req_init(&req, hdev);
1055
1056         hci_req_add_ev(&req, opcode, plen, param, event);
1057
1058         hdev->req_status = HCI_REQ_PEND;
1059
1060         err = hci_req_run(&req, hci_req_sync_complete);
1061         if (err < 0)
1062                 return ERR_PTR(err);
1063
1064         add_wait_queue(&hdev->req_wait_q, &wait);
1065         set_current_state(TASK_INTERRUPTIBLE);
1066
1067         schedule_timeout(timeout);
1068
1069         remove_wait_queue(&hdev->req_wait_q, &wait);
1070
1071         if (signal_pending(current))
1072                 return ERR_PTR(-EINTR);
1073
1074         switch (hdev->req_status) {
1075         case HCI_REQ_DONE:
1076                 err = -bt_to_errno(hdev->req_result);
1077                 break;
1078
1079         case HCI_REQ_CANCELED:
1080                 err = -hdev->req_result;
1081                 break;
1082
1083         default:
1084                 err = -ETIMEDOUT;
1085                 break;
1086         }
1087
1088         hdev->req_status = hdev->req_result = 0;
1089
1090         BT_DBG("%s end: err %d", hdev->name, err);
1091
1092         if (err < 0)
1093                 return ERR_PTR(err);
1094
1095         return hci_get_cmd_complete(hdev, opcode, event);
1096 }
1097 EXPORT_SYMBOL(__hci_cmd_sync_ev);
1098
1099 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
1100                                const void *param, u32 timeout)
1101 {
1102         return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
1103 }
1104 EXPORT_SYMBOL(__hci_cmd_sync);
1105
1106 /* Execute request and wait for completion. */
1107 static int __hci_req_sync(struct hci_dev *hdev,
1108                           void (*func)(struct hci_request *req,
1109                                       unsigned long opt),
1110                           unsigned long opt, __u32 timeout)
1111 {
1112         struct hci_request req;
1113         DECLARE_WAITQUEUE(wait, current);
1114         int err = 0;
1115
1116         BT_DBG("%s start", hdev->name);
1117
1118         hci_req_init(&req, hdev);
1119
1120         hdev->req_status = HCI_REQ_PEND;
1121
1122         func(&req, opt);
1123
1124         err = hci_req_run(&req, hci_req_sync_complete);
1125         if (err < 0) {
1126                 hdev->req_status = 0;
1127
1128                 /* ENODATA means the HCI request command queue is empty.
1129                  * This can happen when a request with conditionals doesn't
1130                  * trigger any commands to be sent. This is normal behavior
1131                  * and should not trigger an error return.
1132                  */
1133                 if (err == -ENODATA)
1134                         return 0;
1135
1136                 return err;
1137         }
1138
1139         add_wait_queue(&hdev->req_wait_q, &wait);
1140         set_current_state(TASK_INTERRUPTIBLE);
1141
1142         schedule_timeout(timeout);
1143
1144         remove_wait_queue(&hdev->req_wait_q, &wait);
1145
1146         if (signal_pending(current))
1147                 return -EINTR;
1148
1149         switch (hdev->req_status) {
1150         case HCI_REQ_DONE:
1151                 err = -bt_to_errno(hdev->req_result);
1152                 break;
1153
1154         case HCI_REQ_CANCELED:
1155                 err = -hdev->req_result;
1156                 break;
1157
1158         default:
1159                 err = -ETIMEDOUT;
1160                 break;
1161         }
1162
1163         hdev->req_status = hdev->req_result = 0;
1164
1165         BT_DBG("%s end: err %d", hdev->name, err);
1166
1167         return err;
1168 }
1169
1170 static int hci_req_sync(struct hci_dev *hdev,
1171                         void (*req)(struct hci_request *req,
1172                                     unsigned long opt),
1173                         unsigned long opt, __u32 timeout)
1174 {
1175         int ret;
1176
1177         if (!test_bit(HCI_UP, &hdev->flags))
1178                 return -ENETDOWN;
1179
1180         /* Serialize all requests */
1181         hci_req_lock(hdev);
1182         ret = __hci_req_sync(hdev, req, opt, timeout);
1183         hci_req_unlock(hdev);
1184
1185         return ret;
1186 }
1187
1188 static void hci_reset_req(struct hci_request *req, unsigned long opt)
1189 {
1190         BT_DBG("%s %ld", req->hdev->name, opt);
1191
1192         /* Reset device */
1193         set_bit(HCI_RESET, &req->hdev->flags);
1194         hci_req_add(req, HCI_OP_RESET, 0, NULL);
1195 }
1196
1197 static void bredr_init(struct hci_request *req)
1198 {
1199         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
1200
1201         /* Read Local Supported Features */
1202         hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1203
1204         /* Read Local Version */
1205         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1206
1207         /* Read BD Address */
1208         hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1209 }
1210
1211 static void amp_init(struct hci_request *req)
1212 {
1213         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
1214
1215         /* Read Local Version */
1216         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1217
1218         /* Read Local Supported Commands */
1219         hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
1220
1221         /* Read Local Supported Features */
1222         hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1223
1224         /* Read Local AMP Info */
1225         hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
1226
1227         /* Read Data Blk size */
1228         hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
1229
1230         /* Read Flow Control Mode */
1231         hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
1232
1233         /* Read Location Data */
1234         hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
1235 }
1236
1237 static void hci_init1_req(struct hci_request *req, unsigned long opt)
1238 {
1239         struct hci_dev *hdev = req->hdev;
1240
1241         BT_DBG("%s %ld", hdev->name, opt);
1242
1243         /* Reset */
1244         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
1245                 hci_reset_req(req, 0);
1246
1247         switch (hdev->dev_type) {
1248         case HCI_BREDR:
1249                 bredr_init(req);
1250                 break;
1251
1252         case HCI_AMP:
1253                 amp_init(req);
1254                 break;
1255
1256         default:
1257                 BT_ERR("Unknown device type %d", hdev->dev_type);
1258                 break;
1259         }
1260 }
1261
1262 static void bredr_setup(struct hci_request *req)
1263 {
1264         struct hci_dev *hdev = req->hdev;
1265
1266         __le16 param;
1267         __u8 flt_type;
1268
1269         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
1270         hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1271
1272         /* Read Class of Device */
1273         hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
1274
1275         /* Read Local Name */
1276         hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1277
1278         /* Read Voice Setting */
1279         hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1280
1281         /* Read Number of Supported IAC */
1282         hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
1283
1284         /* Read Current IAC LAP */
1285         hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
1286
1287         /* Clear Event Filters */
1288         flt_type = HCI_FLT_CLEAR_ALL;
1289         hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1290
1291         /* Connection accept timeout ~20 secs */
1292         param = cpu_to_le16(0x7d00);
1293         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
1294
1295         /* AVM Berlin (31), aka "BlueFRITZ!", reports version 1.2,
1296          * but it does not support page scan related HCI commands.
1297          */
1298         if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1) {
1299                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
1300                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
1301         }
1302 }
1303
1304 static void le_setup(struct hci_request *req)
1305 {
1306         struct hci_dev *hdev = req->hdev;
1307
1308         /* Read LE Buffer Size */
1309         hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
1310
1311         /* Read LE Local Supported Features */
1312         hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
1313
1314         /* Read LE Supported States */
1315         hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
1316
1317         /* Read LE Advertising Channel TX Power */
1318         hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
1319
1320         /* Read LE White List Size */
1321         hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
1322
1323         /* Clear LE White List */
1324         hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
1325
1326         /* LE-only controllers have LE implicitly enabled */
1327         if (!lmp_bredr_capable(hdev))
1328                 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1329 }
1330
1331 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
1332 {
1333         if (lmp_ext_inq_capable(hdev))
1334                 return 0x02;
1335
1336         if (lmp_inq_rssi_capable(hdev))
1337                 return 0x01;
1338
1339         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
1340             hdev->lmp_subver == 0x0757)
1341                 return 0x01;
1342
1343         if (hdev->manufacturer == 15) {
1344                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
1345                         return 0x01;
1346                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
1347                         return 0x01;
1348                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
1349                         return 0x01;
1350         }
1351
1352         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
1353             hdev->lmp_subver == 0x1805)
1354                 return 0x01;
1355
1356         return 0x00;
1357 }
1358
1359 static void hci_setup_inquiry_mode(struct hci_request *req)
1360 {
1361         u8 mode;
1362
1363         mode = hci_get_inquiry_mode(req->hdev);
1364
1365         hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
1366 }
1367
1368 static void hci_setup_event_mask(struct hci_request *req)
1369 {
1370         struct hci_dev *hdev = req->hdev;
1371
1372         /* The second byte is 0xff instead of 0x9f (two reserved bits
1373          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
1374          * command otherwise.
1375          */
1376         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
1377
1378         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
1379          * any event mask for pre 1.2 devices.
1380          */
1381         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1382                 return;
1383
1384         if (lmp_bredr_capable(hdev)) {
1385                 events[4] |= 0x01; /* Flow Specification Complete */
1386                 events[4] |= 0x02; /* Inquiry Result with RSSI */
1387                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
1388                 events[5] |= 0x08; /* Synchronous Connection Complete */
1389                 events[5] |= 0x10; /* Synchronous Connection Changed */
1390         } else {
1391                 /* Use a different default for LE-only devices */
1392                 memset(events, 0, sizeof(events));
1393                 events[0] |= 0x10; /* Disconnection Complete */
1394                 events[0] |= 0x80; /* Encryption Change */
1395                 events[1] |= 0x08; /* Read Remote Version Information Complete */
1396                 events[1] |= 0x20; /* Command Complete */
1397                 events[1] |= 0x40; /* Command Status */
1398                 events[1] |= 0x80; /* Hardware Error */
1399                 events[2] |= 0x04; /* Number of Completed Packets */
1400                 events[3] |= 0x02; /* Data Buffer Overflow */
1401                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
1402         }
1403
1404         if (lmp_inq_rssi_capable(hdev))
1405                 events[4] |= 0x02; /* Inquiry Result with RSSI */
1406
1407         if (lmp_sniffsubr_capable(hdev))
1408                 events[5] |= 0x20; /* Sniff Subrating */
1409
1410         if (lmp_pause_enc_capable(hdev))
1411                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
1412
1413         if (lmp_ext_inq_capable(hdev))
1414                 events[5] |= 0x40; /* Extended Inquiry Result */
1415
1416         if (lmp_no_flush_capable(hdev))
1417                 events[7] |= 0x01; /* Enhanced Flush Complete */
1418
1419         if (lmp_lsto_capable(hdev))
1420                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
1421
1422         if (lmp_ssp_capable(hdev)) {
1423                 events[6] |= 0x01;      /* IO Capability Request */
1424                 events[6] |= 0x02;      /* IO Capability Response */
1425                 events[6] |= 0x04;      /* User Confirmation Request */
1426                 events[6] |= 0x08;      /* User Passkey Request */
1427                 events[6] |= 0x10;      /* Remote OOB Data Request */
1428                 events[6] |= 0x20;      /* Simple Pairing Complete */
1429                 events[7] |= 0x04;      /* User Passkey Notification */
1430                 events[7] |= 0x08;      /* Keypress Notification */
1431                 events[7] |= 0x10;      /* Remote Host Supported
1432                                          * Features Notification
1433                                          */
1434         }
1435
1436         if (lmp_le_capable(hdev))
1437                 events[7] |= 0x20;      /* LE Meta-Event */
1438
1439         hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
1440 }
1441
1442 static void hci_init2_req(struct hci_request *req, unsigned long opt)
1443 {
1444         struct hci_dev *hdev = req->hdev;
1445
1446         if (lmp_bredr_capable(hdev))
1447                 bredr_setup(req);
1448         else
1449                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
1450
1451         if (lmp_le_capable(hdev))
1452                 le_setup(req);
1453
1454         hci_setup_event_mask(req);
1455
1456         /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
1457          * local supported commands HCI command.
1458          */
1459         if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
1460                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
1461
1462         if (lmp_ssp_capable(hdev)) {
1463                 /* When SSP is available, then the host features page
1464                  * should also be available as well. However some
1465                  * controllers list the max_page as 0 as long as SSP
1466                  * has not been enabled. To achieve proper debugging
1467                  * output, force the minimum max_page to 1 at least.
1468                  */
1469                 hdev->max_page = 0x01;
1470
1471                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1472                         u8 mode = 0x01;
1473                         hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
1474                                     sizeof(mode), &mode);
1475                 } else {
1476                         struct hci_cp_write_eir cp;
1477
1478                         memset(hdev->eir, 0, sizeof(hdev->eir));
1479                         memset(&cp, 0, sizeof(cp));
1480
1481                         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1482                 }
1483         }
1484
1485         if (lmp_inq_rssi_capable(hdev))
1486                 hci_setup_inquiry_mode(req);
1487
1488         if (lmp_inq_tx_pwr_capable(hdev))
1489                 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
1490
1491         if (lmp_ext_feat_capable(hdev)) {
1492                 struct hci_cp_read_local_ext_features cp;
1493
1494                 cp.page = 0x01;
1495                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
1496                             sizeof(cp), &cp);
1497         }
1498
1499         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
1500                 u8 enable = 1;
1501                 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
1502                             &enable);
1503         }
1504 }
1505
1506 static void hci_setup_link_policy(struct hci_request *req)
1507 {
1508         struct hci_dev *hdev = req->hdev;
1509         struct hci_cp_write_def_link_policy cp;
1510         u16 link_policy = 0;
1511
1512         if (lmp_rswitch_capable(hdev))
1513                 link_policy |= HCI_LP_RSWITCH;
1514         if (lmp_hold_capable(hdev))
1515                 link_policy |= HCI_LP_HOLD;
1516         if (lmp_sniff_capable(hdev))
1517                 link_policy |= HCI_LP_SNIFF;
1518         if (lmp_park_capable(hdev))
1519                 link_policy |= HCI_LP_PARK;
1520
1521         cp.policy = cpu_to_le16(link_policy);
1522         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
1523 }
1524
1525 static void hci_set_le_support(struct hci_request *req)
1526 {
1527         struct hci_dev *hdev = req->hdev;
1528         struct hci_cp_write_le_host_supported cp;
1529
1530         /* LE-only devices do not support explicit enablement */
1531         if (!lmp_bredr_capable(hdev))
1532                 return;
1533
1534         memset(&cp, 0, sizeof(cp));
1535
1536         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1537                 cp.le = 0x01;
1538                 cp.simul = lmp_le_br_capable(hdev);
1539         }
1540
1541         if (cp.le != lmp_host_le_capable(hdev))
1542                 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
1543                             &cp);
1544 }
1545
1546 static void hci_set_event_mask_page_2(struct hci_request *req)
1547 {
1548         struct hci_dev *hdev = req->hdev;
1549         u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1550
1551         /* If Connectionless Slave Broadcast master role is supported
1552          * enable all necessary events for it.
1553          */
1554         if (lmp_csb_master_capable(hdev)) {
1555                 events[1] |= 0x40;      /* Triggered Clock Capture */
1556                 events[1] |= 0x80;      /* Synchronization Train Complete */
1557                 events[2] |= 0x10;      /* Slave Page Response Timeout */
1558                 events[2] |= 0x20;      /* CSB Channel Map Change */
1559         }
1560
1561         /* If Connectionless Slave Broadcast slave role is supported
1562          * enable all necessary events for it.
1563          */
1564         if (lmp_csb_slave_capable(hdev)) {
1565                 events[2] |= 0x01;      /* Synchronization Train Received */
1566                 events[2] |= 0x02;      /* CSB Receive */
1567                 events[2] |= 0x04;      /* CSB Timeout */
1568                 events[2] |= 0x08;      /* Truncated Page Complete */
1569         }
1570
1571         /* Enable Authenticated Payload Timeout Expired event if supported */
1572         if (lmp_ping_capable(hdev))
1573                 events[2] |= 0x80;
1574
1575         hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
1576 }
1577
1578 static void hci_init3_req(struct hci_request *req, unsigned long opt)
1579 {
1580         struct hci_dev *hdev = req->hdev;
1581         u8 p;
1582
1583         /* Some Broadcom based Bluetooth controllers do not support the
1584          * Delete Stored Link Key command. They are clearly indicating its
1585          * absence in the bit mask of supported commands.
1586          *
1587          * Check the supported commands and only if the the command is marked
1588          * as supported send it. If not supported assume that the controller
1589          * does not have actual support for stored link keys which makes this
1590          * command redundant anyway.
1591          *
1592          * Some controllers indicate that they support handling deleting
1593          * stored link keys, but they don't. The quirk lets a driver
1594          * just disable this command.
1595          */
1596         if (hdev->commands[6] & 0x80 &&
1597             !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
1598                 struct hci_cp_delete_stored_link_key cp;
1599
1600                 bacpy(&cp.bdaddr, BDADDR_ANY);
1601                 cp.delete_all = 0x01;
1602                 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
1603                             sizeof(cp), &cp);
1604         }
1605
1606         if (hdev->commands[5] & 0x10)
1607                 hci_setup_link_policy(req);
1608
1609         if (lmp_le_capable(hdev)) {
1610                 u8 events[8];
1611
1612                 memset(events, 0, sizeof(events));
1613                 events[0] = 0x1f;
1614
1615                 /* If controller supports the Connection Parameters Request
1616                  * Link Layer Procedure, enable the corresponding event.
1617                  */
1618                 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
1619                         events[0] |= 0x20;      /* LE Remote Connection
1620                                                  * Parameter Request
1621                                                  */
1622
1623                 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
1624                             events);
1625
1626                 hci_set_le_support(req);
1627         }
1628
1629         /* Read features beyond page 1 if available */
1630         for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
1631                 struct hci_cp_read_local_ext_features cp;
1632
1633                 cp.page = p;
1634                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
1635                             sizeof(cp), &cp);
1636         }
1637 }
1638
1639 static void hci_init4_req(struct hci_request *req, unsigned long opt)
1640 {
1641         struct hci_dev *hdev = req->hdev;
1642
1643         /* Set event mask page 2 if the HCI command for it is supported */
1644         if (hdev->commands[22] & 0x04)
1645                 hci_set_event_mask_page_2(req);
1646
1647         /* Check for Synchronization Train support */
1648         if (lmp_sync_train_capable(hdev))
1649                 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
1650
1651         /* Enable Secure Connections if supported and configured */
1652         if ((lmp_sc_capable(hdev) ||
1653              test_bit(HCI_FORCE_SC, &hdev->dbg_flags)) &&
1654             test_bit(HCI_SC_ENABLED, &hdev->dev_flags)) {
1655                 u8 support = 0x01;
1656                 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
1657                             sizeof(support), &support);
1658         }
1659 }
1660
1661 static int __hci_init(struct hci_dev *hdev)
1662 {
1663         int err;
1664
1665         err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
1666         if (err < 0)
1667                 return err;
1668
1669         /* The Device Under Test (DUT) mode is special and available for
1670          * all controller types. So just create it early on.
1671          */
1672         if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
1673                 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
1674                                     &dut_mode_fops);
1675         }
1676
1677         /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
1678          * BR/EDR/LE type controllers. AMP controllers only need the
1679          * first stage init.
1680          */
1681         if (hdev->dev_type != HCI_BREDR)
1682                 return 0;
1683
1684         err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
1685         if (err < 0)
1686                 return err;
1687
1688         err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
1689         if (err < 0)
1690                 return err;
1691
1692         err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
1693         if (err < 0)
1694                 return err;
1695
1696         /* Only create debugfs entries during the initial setup
1697          * phase and not every time the controller gets powered on.
1698          */
1699         if (!test_bit(HCI_SETUP, &hdev->dev_flags))
1700                 return 0;
1701
1702         debugfs_create_file("features", 0444, hdev->debugfs, hdev,
1703                             &features_fops);
1704         debugfs_create_u16("manufacturer", 0444, hdev->debugfs,
1705                            &hdev->manufacturer);
1706         debugfs_create_u8("hci_version", 0444, hdev->debugfs, &hdev->hci_ver);
1707         debugfs_create_u16("hci_revision", 0444, hdev->debugfs, &hdev->hci_rev);
1708         debugfs_create_file("blacklist", 0444, hdev->debugfs, hdev,
1709                             &blacklist_fops);
1710         debugfs_create_file("uuids", 0444, hdev->debugfs, hdev, &uuids_fops);
1711
1712         debugfs_create_file("conn_info_min_age", 0644, hdev->debugfs, hdev,
1713                             &conn_info_min_age_fops);
1714         debugfs_create_file("conn_info_max_age", 0644, hdev->debugfs, hdev,
1715                             &conn_info_max_age_fops);
1716
1717         if (lmp_bredr_capable(hdev)) {
1718                 debugfs_create_file("inquiry_cache", 0444, hdev->debugfs,
1719                                     hdev, &inquiry_cache_fops);
1720                 debugfs_create_file("link_keys", 0400, hdev->debugfs,
1721                                     hdev, &link_keys_fops);
1722                 debugfs_create_file("dev_class", 0444, hdev->debugfs,
1723                                     hdev, &dev_class_fops);
1724                 debugfs_create_file("voice_setting", 0444, hdev->debugfs,
1725                                     hdev, &voice_setting_fops);
1726         }
1727
1728         if (lmp_ssp_capable(hdev)) {
1729                 debugfs_create_file("auto_accept_delay", 0644, hdev->debugfs,
1730                                     hdev, &auto_accept_delay_fops);
1731                 debugfs_create_file("force_sc_support", 0644, hdev->debugfs,
1732                                     hdev, &force_sc_support_fops);
1733                 debugfs_create_file("sc_only_mode", 0444, hdev->debugfs,
1734                                     hdev, &sc_only_mode_fops);
1735         }
1736
1737         if (lmp_sniff_capable(hdev)) {
1738                 debugfs_create_file("idle_timeout", 0644, hdev->debugfs,
1739                                     hdev, &idle_timeout_fops);
1740                 debugfs_create_file("sniff_min_interval", 0644, hdev->debugfs,
1741                                     hdev, &sniff_min_interval_fops);
1742                 debugfs_create_file("sniff_max_interval", 0644, hdev->debugfs,
1743                                     hdev, &sniff_max_interval_fops);
1744         }
1745
1746         if (lmp_le_capable(hdev)) {
1747                 debugfs_create_file("identity", 0400, hdev->debugfs,
1748                                     hdev, &identity_fops);
1749                 debugfs_create_file("rpa_timeout", 0644, hdev->debugfs,
1750                                     hdev, &rpa_timeout_fops);
1751                 debugfs_create_file("random_address", 0444, hdev->debugfs,
1752                                     hdev, &random_address_fops);
1753                 debugfs_create_file("static_address", 0444, hdev->debugfs,
1754                                     hdev, &static_address_fops);
1755
1756                 /* For controllers with a public address, provide a debug
1757                  * option to force the usage of the configured static
1758                  * address. By default the public address is used.
1759                  */
1760                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1761                         debugfs_create_file("force_static_address", 0644,
1762                                             hdev->debugfs, hdev,
1763                                             &force_static_address_fops);
1764
1765                 debugfs_create_u8("white_list_size", 0444, hdev->debugfs,
1766                                   &hdev->le_white_list_size);
1767                 debugfs_create_file("white_list", 0444, hdev->debugfs, hdev,
1768                                     &white_list_fops);
1769                 debugfs_create_file("identity_resolving_keys", 0400,
1770                                     hdev->debugfs, hdev,
1771                                     &identity_resolving_keys_fops);
1772                 debugfs_create_file("long_term_keys", 0400, hdev->debugfs,
1773                                     hdev, &long_term_keys_fops);
1774                 debugfs_create_file("conn_min_interval", 0644, hdev->debugfs,
1775                                     hdev, &conn_min_interval_fops);
1776                 debugfs_create_file("conn_max_interval", 0644, hdev->debugfs,
1777                                     hdev, &conn_max_interval_fops);
1778                 debugfs_create_file("conn_latency", 0644, hdev->debugfs,
1779                                     hdev, &conn_latency_fops);
1780                 debugfs_create_file("supervision_timeout", 0644, hdev->debugfs,
1781                                     hdev, &supervision_timeout_fops);
1782                 debugfs_create_file("adv_channel_map", 0644, hdev->debugfs,
1783                                     hdev, &adv_channel_map_fops);
1784                 debugfs_create_file("device_list", 0444, hdev->debugfs, hdev,
1785                                     &device_list_fops);
1786                 debugfs_create_u16("discov_interleaved_timeout", 0644,
1787                                    hdev->debugfs,
1788                                    &hdev->discov_interleaved_timeout);
1789         }
1790
1791         return 0;
1792 }
1793
1794 static void hci_scan_req(struct hci_request *req, unsigned long opt)
1795 {
1796         __u8 scan = opt;
1797
1798         BT_DBG("%s %x", req->hdev->name, scan);
1799
1800         /* Inquiry and Page scans */
1801         hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1802 }
1803
1804 static void hci_auth_req(struct hci_request *req, unsigned long opt)
1805 {
1806         __u8 auth = opt;
1807
1808         BT_DBG("%s %x", req->hdev->name, auth);
1809
1810         /* Authentication */
1811         hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1812 }
1813
1814 static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
1815 {
1816         __u8 encrypt = opt;
1817
1818         BT_DBG("%s %x", req->hdev->name, encrypt);
1819
1820         /* Encryption */
1821         hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1822 }
1823
1824 static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
1825 {
1826         __le16 policy = cpu_to_le16(opt);
1827
1828         BT_DBG("%s %x", req->hdev->name, policy);
1829
1830         /* Default link policy */
1831         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
1832 }
1833
1834 /* Get HCI device by index.
1835  * Device is held on return. */
1836 struct hci_dev *hci_dev_get(int index)
1837 {
1838         struct hci_dev *hdev = NULL, *d;
1839
1840         BT_DBG("%d", index);
1841
1842         if (index < 0)
1843                 return NULL;
1844
1845         read_lock(&hci_dev_list_lock);
1846         list_for_each_entry(d, &hci_dev_list, list) {
1847                 if (d->id == index) {
1848                         hdev = hci_dev_hold(d);
1849                         break;
1850                 }
1851         }
1852         read_unlock(&hci_dev_list_lock);
1853         return hdev;
1854 }
1855
1856 /* ---- Inquiry support ---- */
1857
1858 bool hci_discovery_active(struct hci_dev *hdev)
1859 {
1860         struct discovery_state *discov = &hdev->discovery;
1861
1862         switch (discov->state) {
1863         case DISCOVERY_FINDING:
1864         case DISCOVERY_RESOLVING:
1865                 return true;
1866
1867         default:
1868                 return false;
1869         }
1870 }
1871
1872 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1873 {
1874         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1875
1876         if (hdev->discovery.state == state)
1877                 return;
1878
1879         switch (state) {
1880         case DISCOVERY_STOPPED:
1881                 hci_update_background_scan(hdev);
1882
1883                 if (hdev->discovery.state != DISCOVERY_STARTING)
1884                         mgmt_discovering(hdev, 0);
1885                 break;
1886         case DISCOVERY_STARTING:
1887                 break;
1888         case DISCOVERY_FINDING:
1889                 mgmt_discovering(hdev, 1);
1890                 break;
1891         case DISCOVERY_RESOLVING:
1892                 break;
1893         case DISCOVERY_STOPPING:
1894                 break;
1895         }
1896
1897         hdev->discovery.state = state;
1898 }
1899
1900 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1901 {
1902         struct discovery_state *cache = &hdev->discovery;
1903         struct inquiry_entry *p, *n;
1904
1905         list_for_each_entry_safe(p, n, &cache->all, all) {
1906                 list_del(&p->all);
1907                 kfree(p);
1908         }
1909
1910         INIT_LIST_HEAD(&cache->unknown);
1911         INIT_LIST_HEAD(&cache->resolve);
1912 }
1913
1914 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1915                                                bdaddr_t *bdaddr)
1916 {
1917         struct discovery_state *cache = &hdev->discovery;
1918         struct inquiry_entry *e;
1919
1920         BT_DBG("cache %p, %pMR", cache, bdaddr);
1921
1922         list_for_each_entry(e, &cache->all, all) {
1923                 if (!bacmp(&e->data.bdaddr, bdaddr))
1924                         return e;
1925         }
1926
1927         return NULL;
1928 }
1929
1930 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1931                                                        bdaddr_t *bdaddr)
1932 {
1933         struct discovery_state *cache = &hdev->discovery;
1934         struct inquiry_entry *e;
1935
1936         BT_DBG("cache %p, %pMR", cache, bdaddr);
1937
1938         list_for_each_entry(e, &cache->unknown, list) {
1939                 if (!bacmp(&e->data.bdaddr, bdaddr))
1940                         return e;
1941         }
1942
1943         return NULL;
1944 }
1945
1946 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1947                                                        bdaddr_t *bdaddr,
1948                                                        int state)
1949 {
1950         struct discovery_state *cache = &hdev->discovery;
1951         struct inquiry_entry *e;
1952
1953         BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1954
1955         list_for_each_entry(e, &cache->resolve, list) {
1956                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1957                         return e;
1958                 if (!bacmp(&e->data.bdaddr, bdaddr))
1959                         return e;
1960         }
1961
1962         return NULL;
1963 }
1964
1965 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1966                                       struct inquiry_entry *ie)
1967 {
1968         struct discovery_state *cache = &hdev->discovery;
1969         struct list_head *pos = &cache->resolve;
1970         struct inquiry_entry *p;
1971
1972         list_del(&ie->list);
1973
1974         list_for_each_entry(p, &cache->resolve, list) {
1975                 if (p->name_state != NAME_PENDING &&
1976                     abs(p->data.rssi) >= abs(ie->data.rssi))
1977                         break;
1978                 pos = &p->list;
1979         }
1980
1981         list_add(&ie->list, pos);
1982 }
1983
1984 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1985                              bool name_known)
1986 {
1987         struct discovery_state *cache = &hdev->discovery;
1988         struct inquiry_entry *ie;
1989         u32 flags = 0;
1990
1991         BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1992
1993         hci_remove_remote_oob_data(hdev, &data->bdaddr);
1994
1995         if (!data->ssp_mode)
1996                 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1997
1998         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1999         if (ie) {
2000                 if (!ie->data.ssp_mode)
2001                         flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
2002
2003                 if (ie->name_state == NAME_NEEDED &&
2004                     data->rssi != ie->data.rssi) {
2005                         ie->data.rssi = data->rssi;
2006                         hci_inquiry_cache_update_resolve(hdev, ie);
2007                 }
2008
2009                 goto update;
2010         }
2011
2012         /* Entry not in the cache. Add new one. */
2013         ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
2014         if (!ie) {
2015                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
2016                 goto done;
2017         }
2018
2019         list_add(&ie->all, &cache->all);
2020
2021         if (name_known) {
2022                 ie->name_state = NAME_KNOWN;
2023         } else {
2024                 ie->name_state = NAME_NOT_KNOWN;
2025                 list_add(&ie->list, &cache->unknown);
2026         }
2027
2028 update:
2029         if (name_known && ie->name_state != NAME_KNOWN &&
2030             ie->name_state != NAME_PENDING) {
2031                 ie->name_state = NAME_KNOWN;
2032                 list_del(&ie->list);
2033         }
2034
2035         memcpy(&ie->data, data, sizeof(*data));
2036         ie->timestamp = jiffies;
2037         cache->timestamp = jiffies;
2038
2039         if (ie->name_state == NAME_NOT_KNOWN)
2040                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
2041
2042 done:
2043         return flags;
2044 }
2045
2046 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
2047 {
2048         struct discovery_state *cache = &hdev->discovery;
2049         struct inquiry_info *info = (struct inquiry_info *) buf;
2050         struct inquiry_entry *e;
2051         int copied = 0;
2052
2053         list_for_each_entry(e, &cache->all, all) {
2054                 struct inquiry_data *data = &e->data;
2055
2056                 if (copied >= num)
2057                         break;
2058
2059                 bacpy(&info->bdaddr, &data->bdaddr);
2060                 info->pscan_rep_mode    = data->pscan_rep_mode;
2061                 info->pscan_period_mode = data->pscan_period_mode;
2062                 info->pscan_mode        = data->pscan_mode;
2063                 memcpy(info->dev_class, data->dev_class, 3);
2064                 info->clock_offset      = data->clock_offset;
2065
2066                 info++;
2067                 copied++;
2068         }
2069
2070         BT_DBG("cache %p, copied %d", cache, copied);
2071         return copied;
2072 }
2073
2074 static void hci_inq_req(struct hci_request *req, unsigned long opt)
2075 {
2076         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
2077         struct hci_dev *hdev = req->hdev;
2078         struct hci_cp_inquiry cp;
2079
2080         BT_DBG("%s", hdev->name);
2081
2082         if (test_bit(HCI_INQUIRY, &hdev->flags))
2083                 return;
2084
2085         /* Start Inquiry */
2086         memcpy(&cp.lap, &ir->lap, 3);
2087         cp.length  = ir->length;
2088         cp.num_rsp = ir->num_rsp;
2089         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
2090 }
2091
2092 static int wait_inquiry(void *word)
2093 {
2094         schedule();
2095         return signal_pending(current);
2096 }
2097
2098 int hci_inquiry(void __user *arg)
2099 {
2100         __u8 __user *ptr = arg;
2101         struct hci_inquiry_req ir;
2102         struct hci_dev *hdev;
2103         int err = 0, do_inquiry = 0, max_rsp;
2104         long timeo;
2105         __u8 *buf;
2106
2107         if (copy_from_user(&ir, ptr, sizeof(ir)))
2108                 return -EFAULT;
2109
2110         hdev = hci_dev_get(ir.dev_id);
2111         if (!hdev)
2112                 return -ENODEV;
2113
2114         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2115                 err = -EBUSY;
2116                 goto done;
2117         }
2118
2119         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2120                 err = -EOPNOTSUPP;
2121                 goto done;
2122         }
2123
2124         if (hdev->dev_type != HCI_BREDR) {
2125                 err = -EOPNOTSUPP;
2126                 goto done;
2127         }
2128
2129         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2130                 err = -EOPNOTSUPP;
2131                 goto done;
2132         }
2133
2134         hci_dev_lock(hdev);
2135         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
2136             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
2137                 hci_inquiry_cache_flush(hdev);
2138                 do_inquiry = 1;
2139         }
2140         hci_dev_unlock(hdev);
2141
2142         timeo = ir.length * msecs_to_jiffies(2000);
2143
2144         if (do_inquiry) {
2145                 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
2146                                    timeo);
2147                 if (err < 0)
2148                         goto done;
2149
2150                 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
2151                  * cleared). If it is interrupted by a signal, return -EINTR.
2152                  */
2153                 if (wait_on_bit(&hdev->flags, HCI_INQUIRY, wait_inquiry,
2154                                 TASK_INTERRUPTIBLE))
2155                         return -EINTR;
2156         }
2157
2158         /* for unlimited number of responses we will use buffer with
2159          * 255 entries
2160          */
2161         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
2162
2163         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
2164          * copy it to the user space.
2165          */
2166         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
2167         if (!buf) {
2168                 err = -ENOMEM;
2169                 goto done;
2170         }
2171
2172         hci_dev_lock(hdev);
2173         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
2174         hci_dev_unlock(hdev);
2175
2176         BT_DBG("num_rsp %d", ir.num_rsp);
2177
2178         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
2179                 ptr += sizeof(ir);
2180                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
2181                                  ir.num_rsp))
2182                         err = -EFAULT;
2183         } else
2184                 err = -EFAULT;
2185
2186         kfree(buf);
2187
2188 done:
2189         hci_dev_put(hdev);
2190         return err;
2191 }
2192
2193 static int hci_dev_do_open(struct hci_dev *hdev)
2194 {
2195         int ret = 0;
2196
2197         BT_DBG("%s %p", hdev->name, hdev);
2198
2199         hci_req_lock(hdev);
2200
2201         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
2202                 ret = -ENODEV;
2203                 goto done;
2204         }
2205
2206         if (!test_bit(HCI_SETUP, &hdev->dev_flags)) {
2207                 /* Check for rfkill but allow the HCI setup stage to
2208                  * proceed (which in itself doesn't cause any RF activity).
2209                  */
2210                 if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
2211                         ret = -ERFKILL;
2212                         goto done;
2213                 }
2214
2215                 /* Check for valid public address or a configured static
2216                  * random adddress, but let the HCI setup proceed to
2217                  * be able to determine if there is a public address
2218                  * or not.
2219                  *
2220                  * In case of user channel usage, it is not important
2221                  * if a public address or static random address is
2222                  * available.
2223                  *
2224                  * This check is only valid for BR/EDR controllers
2225                  * since AMP controllers do not have an address.
2226                  */
2227                 if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
2228                     hdev->dev_type == HCI_BREDR &&
2229                     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2230                     !bacmp(&hdev->static_addr, BDADDR_ANY)) {
2231                         ret = -EADDRNOTAVAIL;
2232                         goto done;
2233                 }
2234         }
2235
2236         if (test_bit(HCI_UP, &hdev->flags)) {
2237                 ret = -EALREADY;
2238                 goto done;
2239         }
2240
2241         if (hdev->open(hdev)) {
2242                 ret = -EIO;
2243                 goto done;
2244         }
2245
2246         atomic_set(&hdev->cmd_cnt, 1);
2247         set_bit(HCI_INIT, &hdev->flags);
2248
2249         if (hdev->setup && test_bit(HCI_SETUP, &hdev->dev_flags))
2250                 ret = hdev->setup(hdev);
2251
2252         /* If public address change is configured, ensure that the
2253          * address gets programmed. If the driver does not support
2254          * changing the public address, fail the power on procedure.
2255          */
2256         if (!ret && bacmp(&hdev->public_addr, BDADDR_ANY)) {
2257                 if (hdev->set_bdaddr)
2258                         ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
2259                 else
2260                         ret = -EADDRNOTAVAIL;
2261         }
2262
2263         if (!ret) {
2264                 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2265                     !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
2266                         ret = __hci_init(hdev);
2267         }
2268
2269         clear_bit(HCI_INIT, &hdev->flags);
2270
2271         if (!ret) {
2272                 hci_dev_hold(hdev);
2273                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
2274                 set_bit(HCI_UP, &hdev->flags);
2275                 hci_notify(hdev, HCI_DEV_UP);
2276                 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
2277                     !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2278                     !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
2279                     hdev->dev_type == HCI_BREDR) {
2280                         hci_dev_lock(hdev);
2281                         mgmt_powered(hdev, 1);
2282                         hci_dev_unlock(hdev);
2283                 }
2284         } else {
2285                 /* Init failed, cleanup */
2286                 flush_work(&hdev->tx_work);
2287                 flush_work(&hdev->cmd_work);
2288                 flush_work(&hdev->rx_work);
2289
2290                 skb_queue_purge(&hdev->cmd_q);
2291                 skb_queue_purge(&hdev->rx_q);
2292
2293                 if (hdev->flush)
2294                         hdev->flush(hdev);
2295
2296                 if (hdev->sent_cmd) {
2297                         kfree_skb(hdev->sent_cmd);
2298                         hdev->sent_cmd = NULL;
2299                 }
2300
2301                 hdev->close(hdev);
2302                 hdev->flags &= BIT(HCI_RAW);
2303         }
2304
2305 done:
2306         hci_req_unlock(hdev);
2307         return ret;
2308 }
2309
2310 /* ---- HCI ioctl helpers ---- */
2311
2312 int hci_dev_open(__u16 dev)
2313 {
2314         struct hci_dev *hdev;
2315         int err;
2316
2317         hdev = hci_dev_get(dev);
2318         if (!hdev)
2319                 return -ENODEV;
2320
2321         /* Devices that are marked as unconfigured can only be powered
2322          * up as user channel. Trying to bring them up as normal devices
2323          * will result into a failure. Only user channel operation is
2324          * possible.
2325          *
2326          * When this function is called for a user channel, the flag
2327          * HCI_USER_CHANNEL will be set first before attempting to
2328          * open the device.
2329          */
2330         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2331             !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2332                 err = -EOPNOTSUPP;
2333                 goto done;
2334         }
2335
2336         /* We need to ensure that no other power on/off work is pending
2337          * before proceeding to call hci_dev_do_open. This is
2338          * particularly important if the setup procedure has not yet
2339          * completed.
2340          */
2341         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2342                 cancel_delayed_work(&hdev->power_off);
2343
2344         /* After this call it is guaranteed that the setup procedure
2345          * has finished. This means that error conditions like RFKILL
2346          * or no valid public or static random address apply.
2347          */
2348         flush_workqueue(hdev->req_workqueue);
2349
2350         err = hci_dev_do_open(hdev);
2351
2352 done:
2353         hci_dev_put(hdev);
2354         return err;
2355 }
2356
2357 static int hci_dev_do_close(struct hci_dev *hdev)
2358 {
2359         BT_DBG("%s %p", hdev->name, hdev);
2360
2361         cancel_delayed_work(&hdev->power_off);
2362
2363         hci_req_cancel(hdev, ENODEV);
2364         hci_req_lock(hdev);
2365
2366         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
2367                 cancel_delayed_work_sync(&hdev->cmd_timer);
2368                 hci_req_unlock(hdev);
2369                 return 0;
2370         }
2371
2372         /* Flush RX and TX works */
2373         flush_work(&hdev->tx_work);
2374         flush_work(&hdev->rx_work);
2375
2376         if (hdev->discov_timeout > 0) {
2377                 cancel_delayed_work(&hdev->discov_off);
2378                 hdev->discov_timeout = 0;
2379                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
2380                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
2381         }
2382
2383         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
2384                 cancel_delayed_work(&hdev->service_cache);
2385
2386         cancel_delayed_work_sync(&hdev->le_scan_disable);
2387
2388         if (test_bit(HCI_MGMT, &hdev->dev_flags))
2389                 cancel_delayed_work_sync(&hdev->rpa_expired);
2390
2391         hci_dev_lock(hdev);
2392         hci_inquiry_cache_flush(hdev);
2393         hci_conn_hash_flush(hdev);
2394         hci_pend_le_conns_clear(hdev);
2395         hci_dev_unlock(hdev);
2396
2397         hci_notify(hdev, HCI_DEV_DOWN);
2398
2399         if (hdev->flush)
2400                 hdev->flush(hdev);
2401
2402         /* Reset device */
2403         skb_queue_purge(&hdev->cmd_q);
2404         atomic_set(&hdev->cmd_cnt, 1);
2405         if (!test_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
2406             !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2407             test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
2408                 set_bit(HCI_INIT, &hdev->flags);
2409                 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
2410                 clear_bit(HCI_INIT, &hdev->flags);
2411         }
2412
2413         /* flush cmd  work */
2414         flush_work(&hdev->cmd_work);
2415
2416         /* Drop queues */
2417         skb_queue_purge(&hdev->rx_q);
2418         skb_queue_purge(&hdev->cmd_q);
2419         skb_queue_purge(&hdev->raw_q);
2420
2421         /* Drop last sent command */
2422         if (hdev->sent_cmd) {
2423                 cancel_delayed_work_sync(&hdev->cmd_timer);
2424                 kfree_skb(hdev->sent_cmd);
2425                 hdev->sent_cmd = NULL;
2426         }
2427
2428         kfree_skb(hdev->recv_evt);
2429         hdev->recv_evt = NULL;
2430
2431         /* After this point our queues are empty
2432          * and no tasks are scheduled. */
2433         hdev->close(hdev);
2434
2435         /* Clear flags */
2436         hdev->flags &= BIT(HCI_RAW);
2437         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
2438
2439         if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
2440                 if (hdev->dev_type == HCI_BREDR) {
2441                         hci_dev_lock(hdev);
2442                         mgmt_powered(hdev, 0);
2443                         hci_dev_unlock(hdev);
2444                 }
2445         }
2446
2447         /* Controller radio is available but is currently powered down */
2448         hdev->amp_status = AMP_STATUS_POWERED_DOWN;
2449
2450         memset(hdev->eir, 0, sizeof(hdev->eir));
2451         memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
2452         bacpy(&hdev->random_addr, BDADDR_ANY);
2453
2454         hci_req_unlock(hdev);
2455
2456         hci_dev_put(hdev);
2457         return 0;
2458 }
2459
2460 int hci_dev_close(__u16 dev)
2461 {
2462         struct hci_dev *hdev;
2463         int err;
2464
2465         hdev = hci_dev_get(dev);
2466         if (!hdev)
2467                 return -ENODEV;
2468
2469         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2470                 err = -EBUSY;
2471                 goto done;
2472         }
2473
2474         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2475                 cancel_delayed_work(&hdev->power_off);
2476
2477         err = hci_dev_do_close(hdev);
2478
2479 done:
2480         hci_dev_put(hdev);
2481         return err;
2482 }
2483
2484 int hci_dev_reset(__u16 dev)
2485 {
2486         struct hci_dev *hdev;
2487         int ret = 0;
2488
2489         hdev = hci_dev_get(dev);
2490         if (!hdev)
2491                 return -ENODEV;
2492
2493         hci_req_lock(hdev);
2494
2495         if (!test_bit(HCI_UP, &hdev->flags)) {
2496                 ret = -ENETDOWN;
2497                 goto done;
2498         }
2499
2500         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2501                 ret = -EBUSY;
2502                 goto done;
2503         }
2504
2505         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2506                 ret = -EOPNOTSUPP;
2507                 goto done;
2508         }
2509
2510         /* Drop queues */
2511         skb_queue_purge(&hdev->rx_q);
2512         skb_queue_purge(&hdev->cmd_q);
2513
2514         hci_dev_lock(hdev);
2515         hci_inquiry_cache_flush(hdev);
2516         hci_conn_hash_flush(hdev);
2517         hci_dev_unlock(hdev);
2518
2519         if (hdev->flush)
2520                 hdev->flush(hdev);
2521
2522         atomic_set(&hdev->cmd_cnt, 1);
2523         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
2524
2525         ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
2526
2527 done:
2528         hci_req_unlock(hdev);
2529         hci_dev_put(hdev);
2530         return ret;
2531 }
2532
2533 int hci_dev_reset_stat(__u16 dev)
2534 {
2535         struct hci_dev *hdev;
2536         int ret = 0;
2537
2538         hdev = hci_dev_get(dev);
2539         if (!hdev)
2540                 return -ENODEV;
2541
2542         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2543                 ret = -EBUSY;
2544                 goto done;
2545         }
2546
2547         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2548                 ret = -EOPNOTSUPP;
2549                 goto done;
2550         }
2551
2552         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
2553
2554 done:
2555         hci_dev_put(hdev);
2556         return ret;
2557 }
2558
2559 int hci_dev_cmd(unsigned int cmd, void __user *arg)
2560 {
2561         struct hci_dev *hdev;
2562         struct hci_dev_req dr;
2563         int err = 0;
2564
2565         if (copy_from_user(&dr, arg, sizeof(dr)))
2566                 return -EFAULT;
2567
2568         hdev = hci_dev_get(dr.dev_id);
2569         if (!hdev)
2570                 return -ENODEV;
2571
2572         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2573                 err = -EBUSY;
2574                 goto done;
2575         }
2576
2577         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2578                 err = -EOPNOTSUPP;
2579                 goto done;
2580         }
2581
2582         if (hdev->dev_type != HCI_BREDR) {
2583                 err = -EOPNOTSUPP;
2584                 goto done;
2585         }
2586
2587         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2588                 err = -EOPNOTSUPP;
2589                 goto done;
2590         }
2591
2592         switch (cmd) {
2593         case HCISETAUTH:
2594                 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2595                                    HCI_INIT_TIMEOUT);
2596                 break;
2597
2598         case HCISETENCRYPT:
2599                 if (!lmp_encrypt_capable(hdev)) {
2600                         err = -EOPNOTSUPP;
2601                         break;
2602                 }
2603
2604                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
2605                         /* Auth must be enabled first */
2606                         err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2607                                            HCI_INIT_TIMEOUT);
2608                         if (err)
2609                                 break;
2610                 }
2611
2612                 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
2613                                    HCI_INIT_TIMEOUT);
2614                 break;
2615
2616         case HCISETSCAN:
2617                 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
2618                                    HCI_INIT_TIMEOUT);
2619                 break;
2620
2621         case HCISETLINKPOL:
2622                 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
2623                                    HCI_INIT_TIMEOUT);
2624                 break;
2625
2626         case HCISETLINKMODE:
2627                 hdev->link_mode = ((__u16) dr.dev_opt) &
2628                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
2629                 break;
2630
2631         case HCISETPTYPE:
2632                 hdev->pkt_type = (__u16) dr.dev_opt;
2633                 break;
2634
2635         case HCISETACLMTU:
2636                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
2637                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
2638                 break;
2639
2640         case HCISETSCOMTU:
2641                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
2642                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
2643                 break;
2644
2645         default:
2646                 err = -EINVAL;
2647                 break;
2648         }
2649
2650 done:
2651         hci_dev_put(hdev);
2652         return err;
2653 }
2654
2655 int hci_get_dev_list(void __user *arg)
2656 {
2657         struct hci_dev *hdev;
2658         struct hci_dev_list_req *dl;
2659         struct hci_dev_req *dr;
2660         int n = 0, size, err;
2661         __u16 dev_num;
2662
2663         if (get_user(dev_num, (__u16 __user *) arg))
2664                 return -EFAULT;
2665
2666         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2667                 return -EINVAL;
2668
2669         size = sizeof(*dl) + dev_num * sizeof(*dr);
2670
2671         dl = kzalloc(size, GFP_KERNEL);
2672         if (!dl)
2673                 return -ENOMEM;
2674
2675         dr = dl->dev_req;
2676
2677         read_lock(&hci_dev_list_lock);
2678         list_for_each_entry(hdev, &hci_dev_list, list) {
2679                 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2680                         cancel_delayed_work(&hdev->power_off);
2681
2682                 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2683                         set_bit(HCI_PAIRABLE, &hdev->dev_flags);
2684
2685                 (dr + n)->dev_id  = hdev->id;
2686                 (dr + n)->dev_opt = hdev->flags;
2687
2688                 if (++n >= dev_num)
2689                         break;
2690         }
2691         read_unlock(&hci_dev_list_lock);
2692
2693         dl->dev_num = n;
2694         size = sizeof(*dl) + n * sizeof(*dr);
2695
2696         err = copy_to_user(arg, dl, size);
2697         kfree(dl);
2698
2699         return err ? -EFAULT : 0;
2700 }
2701
2702 int hci_get_dev_info(void __user *arg)
2703 {
2704         struct hci_dev *hdev;
2705         struct hci_dev_info di;
2706         int err = 0;
2707
2708         if (copy_from_user(&di, arg, sizeof(di)))
2709                 return -EFAULT;
2710
2711         hdev = hci_dev_get(di.dev_id);
2712         if (!hdev)
2713                 return -ENODEV;
2714
2715         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2716                 cancel_delayed_work_sync(&hdev->power_off);
2717
2718         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2719                 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
2720
2721         strcpy(di.name, hdev->name);
2722         di.bdaddr   = hdev->bdaddr;
2723         di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2724         di.flags    = hdev->flags;
2725         di.pkt_type = hdev->pkt_type;
2726         if (lmp_bredr_capable(hdev)) {
2727                 di.acl_mtu  = hdev->acl_mtu;
2728                 di.acl_pkts = hdev->acl_pkts;
2729                 di.sco_mtu  = hdev->sco_mtu;
2730                 di.sco_pkts = hdev->sco_pkts;
2731         } else {
2732                 di.acl_mtu  = hdev->le_mtu;
2733                 di.acl_pkts = hdev->le_pkts;
2734                 di.sco_mtu  = 0;
2735                 di.sco_pkts = 0;
2736         }
2737         di.link_policy = hdev->link_policy;
2738         di.link_mode   = hdev->link_mode;
2739
2740         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2741         memcpy(&di.features, &hdev->features, sizeof(di.features));
2742
2743         if (copy_to_user(arg, &di, sizeof(di)))
2744                 err = -EFAULT;
2745
2746         hci_dev_put(hdev);
2747
2748         return err;
2749 }
2750
2751 /* ---- Interface to HCI drivers ---- */
2752
2753 static int hci_rfkill_set_block(void *data, bool blocked)
2754 {
2755         struct hci_dev *hdev = data;
2756
2757         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2758
2759         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
2760                 return -EBUSY;
2761
2762         if (blocked) {
2763                 set_bit(HCI_RFKILLED, &hdev->dev_flags);
2764                 if (!test_bit(HCI_SETUP, &hdev->dev_flags))
2765                         hci_dev_do_close(hdev);
2766         } else {
2767                 clear_bit(HCI_RFKILLED, &hdev->dev_flags);
2768         }
2769
2770         return 0;
2771 }
2772
2773 static const struct rfkill_ops hci_rfkill_ops = {
2774         .set_block = hci_rfkill_set_block,
2775 };
2776
2777 static void hci_power_on(struct work_struct *work)
2778 {
2779         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2780         int err;
2781
2782         BT_DBG("%s", hdev->name);
2783
2784         err = hci_dev_do_open(hdev);
2785         if (err < 0) {
2786                 mgmt_set_powered_failed(hdev, err);
2787                 return;
2788         }
2789
2790         /* During the HCI setup phase, a few error conditions are
2791          * ignored and they need to be checked now. If they are still
2792          * valid, it is important to turn the device back off.
2793          */
2794         if (test_bit(HCI_RFKILLED, &hdev->dev_flags) ||
2795             test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
2796             (hdev->dev_type == HCI_BREDR &&
2797              !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2798              !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2799                 clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
2800                 hci_dev_do_close(hdev);
2801         } else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
2802                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2803                                    HCI_AUTO_OFF_TIMEOUT);
2804         }
2805
2806         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags)) {
2807                 /* For unconfigured devices, set the HCI_RAW flag
2808                  * so that userspace can easily identify them.
2809                  */
2810                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
2811                         set_bit(HCI_RAW, &hdev->flags);
2812
2813                 /* For fully configured devices, this will send
2814                  * the Index Added event. For unconfigured devices,
2815                  * it will send Unconfigued Index Added event.
2816                  *
2817                  * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2818                  * and no event will be send.
2819                  */
2820                 mgmt_index_added(hdev);
2821         }
2822 }
2823
2824 static void hci_power_off(struct work_struct *work)
2825 {
2826         struct hci_dev *hdev = container_of(work, struct hci_dev,
2827                                             power_off.work);
2828
2829         BT_DBG("%s", hdev->name);
2830
2831         hci_dev_do_close(hdev);
2832 }
2833
2834 static void hci_discov_off(struct work_struct *work)
2835 {
2836         struct hci_dev *hdev;
2837
2838         hdev = container_of(work, struct hci_dev, discov_off.work);
2839
2840         BT_DBG("%s", hdev->name);
2841
2842         mgmt_discoverable_timeout(hdev);
2843 }
2844
2845 void hci_uuids_clear(struct hci_dev *hdev)
2846 {
2847         struct bt_uuid *uuid, *tmp;
2848
2849         list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2850                 list_del(&uuid->list);
2851                 kfree(uuid);
2852         }
2853 }
2854
2855 void hci_link_keys_clear(struct hci_dev *hdev)
2856 {
2857         struct list_head *p, *n;
2858
2859         list_for_each_safe(p, n, &hdev->link_keys) {
2860                 struct link_key *key;
2861
2862                 key = list_entry(p, struct link_key, list);
2863
2864                 list_del(p);
2865                 kfree(key);
2866         }
2867 }
2868
2869 void hci_smp_ltks_clear(struct hci_dev *hdev)
2870 {
2871         struct smp_ltk *k, *tmp;
2872
2873         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
2874                 list_del(&k->list);
2875                 kfree(k);
2876         }
2877 }
2878
2879 void hci_smp_irks_clear(struct hci_dev *hdev)
2880 {
2881         struct smp_irk *k, *tmp;
2882
2883         list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
2884                 list_del(&k->list);
2885                 kfree(k);
2886         }
2887 }
2888
2889 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2890 {
2891         struct link_key *k;
2892
2893         list_for_each_entry(k, &hdev->link_keys, list)
2894                 if (bacmp(bdaddr, &k->bdaddr) == 0)
2895                         return k;
2896
2897         return NULL;
2898 }
2899
2900 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2901                                u8 key_type, u8 old_key_type)
2902 {
2903         /* Legacy key */
2904         if (key_type < 0x03)
2905                 return true;
2906
2907         /* Debug keys are insecure so don't store them persistently */
2908         if (key_type == HCI_LK_DEBUG_COMBINATION)
2909                 return false;
2910
2911         /* Changed combination key and there's no previous one */
2912         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2913                 return false;
2914
2915         /* Security mode 3 case */
2916         if (!conn)
2917                 return true;
2918
2919         /* Neither local nor remote side had no-bonding as requirement */
2920         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2921                 return true;
2922
2923         /* Local side had dedicated bonding as requirement */
2924         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2925                 return true;
2926
2927         /* Remote side had dedicated bonding as requirement */
2928         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2929                 return true;
2930
2931         /* If none of the above criteria match, then don't store the key
2932          * persistently */
2933         return false;
2934 }
2935
2936 static bool ltk_type_master(u8 type)
2937 {
2938         return (type == SMP_LTK);
2939 }
2940
2941 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, __le64 rand,
2942                              bool master)
2943 {
2944         struct smp_ltk *k;
2945
2946         list_for_each_entry(k, &hdev->long_term_keys, list) {
2947                 if (k->ediv != ediv || k->rand != rand)
2948                         continue;
2949
2950                 if (ltk_type_master(k->type) != master)
2951                         continue;
2952
2953                 return k;
2954         }
2955
2956         return NULL;
2957 }
2958
2959 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2960                                      u8 addr_type, bool master)
2961 {
2962         struct smp_ltk *k;
2963
2964         list_for_each_entry(k, &hdev->long_term_keys, list)
2965                 if (addr_type == k->bdaddr_type &&
2966                     bacmp(bdaddr, &k->bdaddr) == 0 &&
2967                     ltk_type_master(k->type) == master)
2968                         return k;
2969
2970         return NULL;
2971 }
2972
2973 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2974 {
2975         struct smp_irk *irk;
2976
2977         list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
2978                 if (!bacmp(&irk->rpa, rpa))
2979                         return irk;
2980         }
2981
2982         list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
2983                 if (smp_irk_matches(hdev->tfm_aes, irk->val, rpa)) {
2984                         bacpy(&irk->rpa, rpa);
2985                         return irk;
2986                 }
2987         }
2988
2989         return NULL;
2990 }
2991
2992 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2993                                      u8 addr_type)
2994 {
2995         struct smp_irk *irk;
2996
2997         /* Identity Address must be public or static random */
2998         if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2999                 return NULL;
3000
3001         list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
3002                 if (addr_type == irk->addr_type &&
3003                     bacmp(bdaddr, &irk->bdaddr) == 0)
3004                         return irk;
3005         }
3006
3007         return NULL;
3008 }
3009
3010 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
3011                                   bdaddr_t *bdaddr, u8 *val, u8 type,
3012                                   u8 pin_len, bool *persistent)
3013 {
3014         struct link_key *key, *old_key;
3015         u8 old_key_type;
3016
3017         old_key = hci_find_link_key(hdev, bdaddr);
3018         if (old_key) {
3019                 old_key_type = old_key->type;
3020                 key = old_key;
3021         } else {
3022                 old_key_type = conn ? conn->key_type : 0xff;
3023                 key = kzalloc(sizeof(*key), GFP_KERNEL);
3024                 if (!key)
3025                         return NULL;
3026                 list_add(&key->list, &hdev->link_keys);
3027         }
3028
3029         BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
3030
3031         /* Some buggy controller combinations generate a changed
3032          * combination key for legacy pairing even when there's no
3033          * previous key */
3034         if (type == HCI_LK_CHANGED_COMBINATION &&
3035             (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
3036                 type = HCI_LK_COMBINATION;
3037                 if (conn)
3038                         conn->key_type = type;
3039         }
3040
3041         bacpy(&key->bdaddr, bdaddr);
3042         memcpy(key->val, val, HCI_LINK_KEY_SIZE);
3043         key->pin_len = pin_len;
3044
3045         if (type == HCI_LK_CHANGED_COMBINATION)
3046                 key->type = old_key_type;
3047         else
3048                 key->type = type;
3049
3050         if (persistent)
3051                 *persistent = hci_persistent_key(hdev, conn, type,
3052                                                  old_key_type);
3053
3054         return key;
3055 }
3056
3057 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
3058                             u8 addr_type, u8 type, u8 authenticated,
3059                             u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
3060 {
3061         struct smp_ltk *key, *old_key;
3062         bool master = ltk_type_master(type);
3063
3064         old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type, master);
3065         if (old_key)
3066                 key = old_key;
3067         else {
3068                 key = kzalloc(sizeof(*key), GFP_KERNEL);
3069                 if (!key)
3070                         return NULL;
3071                 list_add(&key->list, &hdev->long_term_keys);
3072         }
3073
3074         bacpy(&key->bdaddr, bdaddr);
3075         key->bdaddr_type = addr_type;
3076         memcpy(key->val, tk, sizeof(key->val));
3077         key->authenticated = authenticated;
3078         key->ediv = ediv;
3079         key->rand = rand;
3080         key->enc_size = enc_size;
3081         key->type = type;
3082
3083         return key;
3084 }
3085
3086 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
3087                             u8 addr_type, u8 val[16], bdaddr_t *rpa)
3088 {
3089         struct smp_irk *irk;
3090
3091         irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
3092         if (!irk) {
3093                 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
3094                 if (!irk)
3095                         return NULL;
3096
3097                 bacpy(&irk->bdaddr, bdaddr);
3098                 irk->addr_type = addr_type;
3099
3100                 list_add(&irk->list, &hdev->identity_resolving_keys);
3101         }
3102
3103         memcpy(irk->val, val, 16);
3104         bacpy(&irk->rpa, rpa);
3105
3106         return irk;
3107 }
3108
3109 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
3110 {
3111         struct link_key *key;
3112
3113         key = hci_find_link_key(hdev, bdaddr);
3114         if (!key)
3115                 return -ENOENT;
3116
3117         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3118
3119         list_del(&key->list);
3120         kfree(key);
3121
3122         return 0;
3123 }
3124
3125 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
3126 {
3127         struct smp_ltk *k, *tmp;
3128         int removed = 0;
3129
3130         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
3131                 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
3132                         continue;
3133
3134                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3135
3136                 list_del(&k->list);
3137                 kfree(k);
3138                 removed++;
3139         }
3140
3141         return removed ? 0 : -ENOENT;
3142 }
3143
3144 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
3145 {
3146         struct smp_irk *k, *tmp;
3147
3148         list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
3149                 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
3150                         continue;
3151
3152                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3153
3154                 list_del(&k->list);
3155                 kfree(k);
3156         }
3157 }
3158
3159 /* HCI command timer function */
3160 static void hci_cmd_timeout(struct work_struct *work)
3161 {
3162         struct hci_dev *hdev = container_of(work, struct hci_dev,
3163                                             cmd_timer.work);
3164
3165         if (hdev->sent_cmd) {
3166                 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
3167                 u16 opcode = __le16_to_cpu(sent->opcode);
3168
3169                 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
3170         } else {
3171                 BT_ERR("%s command tx timeout", hdev->name);
3172         }
3173
3174         atomic_set(&hdev->cmd_cnt, 1);
3175         queue_work(hdev->workqueue, &hdev->cmd_work);
3176 }
3177
3178 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
3179                                           bdaddr_t *bdaddr)
3180 {
3181         struct oob_data *data;
3182
3183         list_for_each_entry(data, &hdev->remote_oob_data, list)
3184                 if (bacmp(bdaddr, &data->bdaddr) == 0)
3185                         return data;
3186
3187         return NULL;
3188 }
3189
3190 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
3191 {
3192         struct oob_data *data;
3193
3194         data = hci_find_remote_oob_data(hdev, bdaddr);
3195         if (!data)
3196                 return -ENOENT;
3197
3198         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3199
3200         list_del(&data->list);
3201         kfree(data);
3202
3203         return 0;
3204 }
3205
3206 void hci_remote_oob_data_clear(struct hci_dev *hdev)
3207 {
3208         struct oob_data *data, *n;
3209
3210         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
3211                 list_del(&data->list);
3212                 kfree(data);
3213         }
3214 }
3215
3216 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
3217                             u8 *hash, u8 *randomizer)
3218 {
3219         struct oob_data *data;
3220
3221         data = hci_find_remote_oob_data(hdev, bdaddr);
3222         if (!data) {
3223                 data = kmalloc(sizeof(*data), GFP_KERNEL);
3224                 if (!data)
3225                         return -ENOMEM;
3226
3227                 bacpy(&data->bdaddr, bdaddr);
3228                 list_add(&data->list, &hdev->remote_oob_data);
3229         }
3230
3231         memcpy(data->hash192, hash, sizeof(data->hash192));
3232         memcpy(data->randomizer192, randomizer, sizeof(data->randomizer192));
3233
3234         memset(data->hash256, 0, sizeof(data->hash256));
3235         memset(data->randomizer256, 0, sizeof(data->randomizer256));
3236
3237         BT_DBG("%s for %pMR", hdev->name, bdaddr);
3238
3239         return 0;
3240 }
3241
3242 int hci_add_remote_oob_ext_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
3243                                 u8 *hash192, u8 *randomizer192,
3244                                 u8 *hash256, u8 *randomizer256)
3245 {
3246         struct oob_data *data;
3247
3248         data = hci_find_remote_oob_data(hdev, bdaddr);
3249         if (!data) {
3250                 data = kmalloc(sizeof(*data), GFP_KERNEL);
3251                 if (!data)
3252                         return -ENOMEM;
3253
3254                 bacpy(&data->bdaddr, bdaddr);
3255                 list_add(&data->list, &hdev->remote_oob_data);
3256         }
3257
3258         memcpy(data->hash192, hash192, sizeof(data->hash192));
3259         memcpy(data->randomizer192, randomizer192, sizeof(data->randomizer192));
3260
3261         memcpy(data->hash256, hash256, sizeof(data->hash256));
3262         memcpy(data->randomizer256, randomizer256, sizeof(data->randomizer256));
3263
3264         BT_DBG("%s for %pMR", hdev->name, bdaddr);
3265
3266         return 0;
3267 }
3268
3269 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
3270                                          bdaddr_t *bdaddr, u8 type)
3271 {
3272         struct bdaddr_list *b;
3273
3274         list_for_each_entry(b, &hdev->blacklist, list) {
3275                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3276                         return b;
3277         }
3278
3279         return NULL;
3280 }
3281
3282 static void hci_blacklist_clear(struct hci_dev *hdev)
3283 {
3284         struct list_head *p, *n;
3285
3286         list_for_each_safe(p, n, &hdev->blacklist) {
3287                 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
3288
3289                 list_del(p);
3290                 kfree(b);
3291         }
3292 }
3293
3294 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3295 {
3296         struct bdaddr_list *entry;
3297
3298         if (!bacmp(bdaddr, BDADDR_ANY))
3299                 return -EBADF;
3300
3301         if (hci_blacklist_lookup(hdev, bdaddr, type))
3302                 return -EEXIST;
3303
3304         entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
3305         if (!entry)
3306                 return -ENOMEM;
3307
3308         bacpy(&entry->bdaddr, bdaddr);
3309         entry->bdaddr_type = type;
3310
3311         list_add(&entry->list, &hdev->blacklist);
3312
3313         return 0;
3314 }
3315
3316 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3317 {
3318         struct bdaddr_list *entry;
3319
3320         if (!bacmp(bdaddr, BDADDR_ANY)) {
3321                 hci_blacklist_clear(hdev);
3322                 return 0;
3323         }
3324
3325         entry = hci_blacklist_lookup(hdev, bdaddr, type);
3326         if (!entry)
3327                 return -ENOENT;
3328
3329         list_del(&entry->list);
3330         kfree(entry);
3331
3332         return 0;
3333 }
3334
3335 struct bdaddr_list *hci_white_list_lookup(struct hci_dev *hdev,
3336                                           bdaddr_t *bdaddr, u8 type)
3337 {
3338         struct bdaddr_list *b;
3339
3340         list_for_each_entry(b, &hdev->le_white_list, list) {
3341                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3342                         return b;
3343         }
3344
3345         return NULL;
3346 }
3347
3348 void hci_white_list_clear(struct hci_dev *hdev)
3349 {
3350         struct list_head *p, *n;
3351
3352         list_for_each_safe(p, n, &hdev->le_white_list) {
3353                 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
3354
3355                 list_del(p);
3356                 kfree(b);
3357         }
3358 }
3359
3360 int hci_white_list_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3361 {
3362         struct bdaddr_list *entry;
3363
3364         if (!bacmp(bdaddr, BDADDR_ANY))
3365                 return -EBADF;
3366
3367         entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
3368         if (!entry)
3369                 return -ENOMEM;
3370
3371         bacpy(&entry->bdaddr, bdaddr);
3372         entry->bdaddr_type = type;
3373
3374         list_add(&entry->list, &hdev->le_white_list);
3375
3376         return 0;
3377 }
3378
3379 int hci_white_list_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
3380 {
3381         struct bdaddr_list *entry;
3382
3383         if (!bacmp(bdaddr, BDADDR_ANY))
3384                 return -EBADF;
3385
3386         entry = hci_white_list_lookup(hdev, bdaddr, type);
3387         if (!entry)
3388                 return -ENOENT;
3389
3390         list_del(&entry->list);
3391         kfree(entry);
3392
3393         return 0;
3394 }
3395
3396 /* This function requires the caller holds hdev->lock */
3397 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
3398                                                bdaddr_t *addr, u8 addr_type)
3399 {
3400         struct hci_conn_params *params;
3401
3402         list_for_each_entry(params, &hdev->le_conn_params, list) {
3403                 if (bacmp(&params->addr, addr) == 0 &&
3404                     params->addr_type == addr_type) {
3405                         return params;
3406                 }
3407         }
3408
3409         return NULL;
3410 }
3411
3412 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
3413 {
3414         struct hci_conn *conn;
3415
3416         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
3417         if (!conn)
3418                 return false;
3419
3420         if (conn->dst_type != type)
3421                 return false;
3422
3423         if (conn->state != BT_CONNECTED)
3424                 return false;
3425
3426         return true;
3427 }
3428
3429 /* This function requires the caller holds hdev->lock */
3430 struct bdaddr_list *hci_pend_le_conn_lookup(struct hci_dev *hdev,
3431                                             bdaddr_t *addr, u8 addr_type)
3432 {
3433         struct bdaddr_list *entry;
3434
3435         list_for_each_entry(entry, &hdev->pend_le_conns, list) {
3436                 if (bacmp(&entry->bdaddr, addr) == 0 &&
3437                     entry->bdaddr_type == addr_type)
3438                         return entry;
3439         }
3440
3441         return NULL;
3442 }
3443
3444 /* This function requires the caller holds hdev->lock */
3445 void hci_pend_le_conn_add(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3446 {
3447         struct bdaddr_list *entry;
3448
3449         entry = hci_pend_le_conn_lookup(hdev, addr, addr_type);
3450         if (entry)
3451                 goto done;
3452
3453         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3454         if (!entry) {
3455                 BT_ERR("Out of memory");
3456                 return;
3457         }
3458
3459         bacpy(&entry->bdaddr, addr);
3460         entry->bdaddr_type = addr_type;
3461
3462         list_add(&entry->list, &hdev->pend_le_conns);
3463
3464         BT_DBG("addr %pMR (type %u)", addr, addr_type);
3465
3466 done:
3467         hci_update_background_scan(hdev);
3468 }
3469
3470 /* This function requires the caller holds hdev->lock */
3471 void hci_pend_le_conn_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3472 {
3473         struct bdaddr_list *entry;
3474
3475         entry = hci_pend_le_conn_lookup(hdev, addr, addr_type);
3476         if (!entry)
3477                 goto done;
3478
3479         list_del(&entry->list);
3480         kfree(entry);
3481
3482         BT_DBG("addr %pMR (type %u)", addr, addr_type);
3483
3484 done:
3485         hci_update_background_scan(hdev);
3486 }
3487
3488 /* This function requires the caller holds hdev->lock */
3489 void hci_pend_le_conns_clear(struct hci_dev *hdev)
3490 {
3491         struct bdaddr_list *entry, *tmp;
3492
3493         list_for_each_entry_safe(entry, tmp, &hdev->pend_le_conns, list) {
3494                 list_del(&entry->list);
3495                 kfree(entry);
3496         }
3497
3498         BT_DBG("All LE pending connections cleared");
3499
3500         hci_update_background_scan(hdev);
3501 }
3502
3503 /* This function requires the caller holds hdev->lock */
3504 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
3505                                             bdaddr_t *addr, u8 addr_type)
3506 {
3507         struct hci_conn_params *params;
3508
3509         if (!hci_is_identity_address(addr, addr_type))
3510                 return NULL;
3511
3512         params = hci_conn_params_lookup(hdev, addr, addr_type);
3513         if (params)
3514                 return params;
3515
3516         params = kzalloc(sizeof(*params), GFP_KERNEL);
3517         if (!params) {
3518                 BT_ERR("Out of memory");
3519                 return NULL;
3520         }
3521
3522         bacpy(&params->addr, addr);
3523         params->addr_type = addr_type;
3524
3525         list_add(&params->list, &hdev->le_conn_params);
3526
3527         params->conn_min_interval = hdev->le_conn_min_interval;
3528         params->conn_max_interval = hdev->le_conn_max_interval;
3529         params->conn_latency = hdev->le_conn_latency;
3530         params->supervision_timeout = hdev->le_supv_timeout;
3531         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3532
3533         BT_DBG("addr %pMR (type %u)", addr, addr_type);
3534
3535         return params;
3536 }
3537
3538 /* This function requires the caller holds hdev->lock */
3539 int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type,
3540                         u8 auto_connect)
3541 {
3542         struct hci_conn_params *params;
3543
3544         params = hci_conn_params_add(hdev, addr, addr_type);
3545         if (!params)
3546                 return -EIO;
3547
3548         params->auto_connect = auto_connect;
3549
3550         switch (auto_connect) {
3551         case HCI_AUTO_CONN_DISABLED:
3552         case HCI_AUTO_CONN_REPORT:
3553         case HCI_AUTO_CONN_LINK_LOSS:
3554                 hci_pend_le_conn_del(hdev, addr, addr_type);
3555                 break;
3556         case HCI_AUTO_CONN_ALWAYS:
3557                 if (!is_connected(hdev, addr, addr_type))
3558                         hci_pend_le_conn_add(hdev, addr, addr_type);
3559                 break;
3560         }
3561
3562         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
3563                auto_connect);
3564
3565         return 0;
3566 }
3567
3568 /* This function requires the caller holds hdev->lock */
3569 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3570 {
3571         struct hci_conn_params *params;
3572
3573         params = hci_conn_params_lookup(hdev, addr, addr_type);
3574         if (!params)
3575                 return;
3576
3577         hci_pend_le_conn_del(hdev, addr, addr_type);
3578
3579         list_del(&params->list);
3580         kfree(params);
3581
3582         BT_DBG("addr %pMR (type %u)", addr, addr_type);
3583 }
3584
3585 /* This function requires the caller holds hdev->lock */
3586 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
3587 {
3588         struct hci_conn_params *params, *tmp;
3589
3590         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3591                 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3592                         continue;
3593                 list_del(&params->list);
3594                 kfree(params);
3595         }
3596
3597         BT_DBG("All LE disabled connection parameters were removed");
3598 }
3599
3600 /* This function requires the caller holds hdev->lock */
3601 void hci_conn_params_clear_enabled(struct hci_dev *hdev)
3602 {
3603         struct hci_conn_params *params, *tmp;
3604
3605         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3606                 if (params->auto_connect == HCI_AUTO_CONN_DISABLED)
3607                         continue;
3608                 list_del(&params->list);
3609                 kfree(params);
3610         }
3611
3612         hci_pend_le_conns_clear(hdev);
3613
3614         BT_DBG("All enabled LE connection parameters were removed");
3615 }
3616
3617 /* This function requires the caller holds hdev->lock */
3618 void hci_conn_params_clear_all(struct hci_dev *hdev)
3619 {
3620         struct hci_conn_params *params, *tmp;
3621
3622         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3623                 list_del(&params->list);
3624                 kfree(params);
3625         }
3626
3627         hci_pend_le_conns_clear(hdev);
3628
3629         BT_DBG("All LE connection parameters were removed");
3630 }
3631
3632 static void inquiry_complete(struct hci_dev *hdev, u8 status)
3633 {
3634         if (status) {
3635                 BT_ERR("Failed to start inquiry: status %d", status);
3636
3637                 hci_dev_lock(hdev);
3638                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3639                 hci_dev_unlock(hdev);
3640                 return;
3641         }
3642 }
3643
3644 static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
3645 {
3646         /* General inquiry access code (GIAC) */
3647         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3648         struct hci_request req;
3649         struct hci_cp_inquiry cp;
3650         int err;
3651
3652         if (status) {
3653                 BT_ERR("Failed to disable LE scanning: status %d", status);
3654                 return;
3655         }
3656
3657         switch (hdev->discovery.type) {
3658         case DISCOV_TYPE_LE:
3659                 hci_dev_lock(hdev);
3660                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3661                 hci_dev_unlock(hdev);
3662                 break;
3663
3664         case DISCOV_TYPE_INTERLEAVED:
3665                 hci_req_init(&req, hdev);
3666
3667                 memset(&cp, 0, sizeof(cp));
3668                 memcpy(&cp.lap, lap, sizeof(cp.lap));
3669                 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
3670                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
3671
3672                 hci_dev_lock(hdev);
3673
3674                 hci_inquiry_cache_flush(hdev);
3675
3676                 err = hci_req_run(&req, inquiry_complete);
3677                 if (err) {
3678                         BT_ERR("Inquiry request failed: err %d", err);
3679                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3680                 }
3681
3682                 hci_dev_unlock(hdev);
3683                 break;
3684         }
3685 }
3686
3687 static void le_scan_disable_work(struct work_struct *work)
3688 {
3689         struct hci_dev *hdev = container_of(work, struct hci_dev,
3690                                             le_scan_disable.work);
3691         struct hci_request req;
3692         int err;
3693
3694         BT_DBG("%s", hdev->name);
3695
3696         hci_req_init(&req, hdev);
3697
3698         hci_req_add_le_scan_disable(&req);
3699
3700         err = hci_req_run(&req, le_scan_disable_work_complete);
3701         if (err)
3702                 BT_ERR("Disable LE scanning request failed: err %d", err);
3703 }
3704
3705 static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
3706 {
3707         struct hci_dev *hdev = req->hdev;
3708
3709         /* If we're advertising or initiating an LE connection we can't
3710          * go ahead and change the random address at this time. This is
3711          * because the eventual initiator address used for the
3712          * subsequently created connection will be undefined (some
3713          * controllers use the new address and others the one we had
3714          * when the operation started).
3715          *
3716          * In this kind of scenario skip the update and let the random
3717          * address be updated at the next cycle.
3718          */
3719         if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
3720             hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
3721                 BT_DBG("Deferring random address update");
3722                 return;
3723         }
3724
3725         hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
3726 }
3727
3728 int hci_update_random_address(struct hci_request *req, bool require_privacy,
3729                               u8 *own_addr_type)
3730 {
3731         struct hci_dev *hdev = req->hdev;
3732         int err;
3733
3734         /* If privacy is enabled use a resolvable private address. If
3735          * current RPA has expired or there is something else than
3736          * the current RPA in use, then generate a new one.
3737          */
3738         if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
3739                 int to;
3740
3741                 *own_addr_type = ADDR_LE_DEV_RANDOM;
3742
3743                 if (!test_and_clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags) &&
3744                     !bacmp(&hdev->random_addr, &hdev->rpa))
3745                         return 0;
3746
3747                 err = smp_generate_rpa(hdev->tfm_aes, hdev->irk, &hdev->rpa);
3748                 if (err < 0) {
3749                         BT_ERR("%s failed to generate new RPA", hdev->name);
3750                         return err;
3751                 }
3752
3753                 set_random_addr(req, &hdev->rpa);
3754
3755                 to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
3756                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
3757
3758                 return 0;
3759         }
3760
3761         /* In case of required privacy without resolvable private address,
3762          * use an unresolvable private address. This is useful for active
3763          * scanning and non-connectable advertising.
3764          */
3765         if (require_privacy) {
3766                 bdaddr_t urpa;
3767
3768                 get_random_bytes(&urpa, 6);
3769                 urpa.b[5] &= 0x3f;      /* Clear two most significant bits */
3770
3771                 *own_addr_type = ADDR_LE_DEV_RANDOM;
3772                 set_random_addr(req, &urpa);
3773                 return 0;
3774         }
3775
3776         /* If forcing static address is in use or there is no public
3777          * address use the static address as random address (but skip
3778          * the HCI command if the current random address is already the
3779          * static one.
3780          */
3781         if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
3782             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
3783                 *own_addr_type = ADDR_LE_DEV_RANDOM;
3784                 if (bacmp(&hdev->static_addr, &hdev->random_addr))
3785                         hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3786                                     &hdev->static_addr);
3787                 return 0;
3788         }
3789
3790         /* Neither privacy nor static address is being used so use a
3791          * public address.
3792          */
3793         *own_addr_type = ADDR_LE_DEV_PUBLIC;
3794
3795         return 0;
3796 }
3797
3798 /* Copy the Identity Address of the controller.
3799  *
3800  * If the controller has a public BD_ADDR, then by default use that one.
3801  * If this is a LE only controller without a public address, default to
3802  * the static random address.
3803  *
3804  * For debugging purposes it is possible to force controllers with a
3805  * public address to use the static random address instead.
3806  */
3807 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3808                                u8 *bdaddr_type)
3809 {
3810         if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
3811             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
3812                 bacpy(bdaddr, &hdev->static_addr);
3813                 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3814         } else {
3815                 bacpy(bdaddr, &hdev->bdaddr);
3816                 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3817         }
3818 }
3819
3820 /* Alloc HCI device */
3821 struct hci_dev *hci_alloc_dev(void)
3822 {
3823         struct hci_dev *hdev;
3824
3825         hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
3826         if (!hdev)
3827                 return NULL;
3828
3829         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3830         hdev->esco_type = (ESCO_HV1);
3831         hdev->link_mode = (HCI_LM_ACCEPT);
3832         hdev->num_iac = 0x01;           /* One IAC support is mandatory */
3833         hdev->io_capability = 0x03;     /* No Input No Output */
3834         hdev->manufacturer = 0xffff;    /* Default to internal use */
3835         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3836         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3837
3838         hdev->sniff_max_interval = 800;
3839         hdev->sniff_min_interval = 80;
3840
3841         hdev->le_adv_channel_map = 0x07;
3842         hdev->le_scan_interval = 0x0060;
3843         hdev->le_scan_window = 0x0030;
3844         hdev->le_conn_min_interval = 0x0028;
3845         hdev->le_conn_max_interval = 0x0038;
3846         hdev->le_conn_latency = 0x0000;
3847         hdev->le_supv_timeout = 0x002a;
3848
3849         hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3850         hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3851         hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3852         hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3853
3854         mutex_init(&hdev->lock);
3855         mutex_init(&hdev->req_lock);
3856
3857         INIT_LIST_HEAD(&hdev->mgmt_pending);
3858         INIT_LIST_HEAD(&hdev->blacklist);
3859         INIT_LIST_HEAD(&hdev->uuids);
3860         INIT_LIST_HEAD(&hdev->link_keys);
3861         INIT_LIST_HEAD(&hdev->long_term_keys);
3862         INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3863         INIT_LIST_HEAD(&hdev->remote_oob_data);
3864         INIT_LIST_HEAD(&hdev->le_white_list);
3865         INIT_LIST_HEAD(&hdev->le_conn_params);
3866         INIT_LIST_HEAD(&hdev->pend_le_conns);
3867         INIT_LIST_HEAD(&hdev->conn_hash.list);
3868
3869         INIT_WORK(&hdev->rx_work, hci_rx_work);
3870         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3871         INIT_WORK(&hdev->tx_work, hci_tx_work);
3872         INIT_WORK(&hdev->power_on, hci_power_on);
3873
3874         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3875         INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
3876         INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
3877
3878         skb_queue_head_init(&hdev->rx_q);
3879         skb_queue_head_init(&hdev->cmd_q);
3880         skb_queue_head_init(&hdev->raw_q);
3881
3882         init_waitqueue_head(&hdev->req_wait_q);
3883
3884         INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3885
3886         hci_init_sysfs(hdev);
3887         discovery_init(hdev);
3888
3889         return hdev;
3890 }
3891 EXPORT_SYMBOL(hci_alloc_dev);
3892
3893 /* Free HCI device */
3894 void hci_free_dev(struct hci_dev *hdev)
3895 {
3896         /* will free via device release */
3897         put_device(&hdev->dev);
3898 }
3899 EXPORT_SYMBOL(hci_free_dev);
3900
3901 /* Register HCI device */
3902 int hci_register_dev(struct hci_dev *hdev)
3903 {
3904         int id, error;
3905
3906         if (!hdev->open || !hdev->close)
3907                 return -EINVAL;
3908
3909         /* Do not allow HCI_AMP devices to register at index 0,
3910          * so the index can be used as the AMP controller ID.
3911          */
3912         switch (hdev->dev_type) {
3913         case HCI_BREDR:
3914                 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3915                 break;
3916         case HCI_AMP:
3917                 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3918                 break;
3919         default:
3920                 return -EINVAL;
3921         }
3922
3923         if (id < 0)
3924                 return id;
3925
3926         sprintf(hdev->name, "hci%d", id);
3927         hdev->id = id;
3928
3929         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3930
3931         hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3932                                           WQ_MEM_RECLAIM, 1, hdev->name);
3933         if (!hdev->workqueue) {
3934                 error = -ENOMEM;
3935                 goto err;
3936         }
3937
3938         hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3939                                               WQ_MEM_RECLAIM, 1, hdev->name);
3940         if (!hdev->req_workqueue) {
3941                 destroy_workqueue(hdev->workqueue);
3942                 error = -ENOMEM;
3943                 goto err;
3944         }
3945
3946         if (!IS_ERR_OR_NULL(bt_debugfs))
3947                 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3948
3949         dev_set_name(&hdev->dev, "%s", hdev->name);
3950
3951         hdev->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0,
3952                                                CRYPTO_ALG_ASYNC);
3953         if (IS_ERR(hdev->tfm_aes)) {
3954                 BT_ERR("Unable to create crypto context");
3955                 error = PTR_ERR(hdev->tfm_aes);
3956                 hdev->tfm_aes = NULL;
3957                 goto err_wqueue;
3958         }
3959
3960         error = device_add(&hdev->dev);
3961         if (error < 0)
3962                 goto err_tfm;
3963
3964         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3965                                     RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3966                                     hdev);
3967         if (hdev->rfkill) {
3968                 if (rfkill_register(hdev->rfkill) < 0) {
3969                         rfkill_destroy(hdev->rfkill);
3970                         hdev->rfkill = NULL;
3971                 }
3972         }
3973
3974         if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3975                 set_bit(HCI_RFKILLED, &hdev->dev_flags);
3976
3977         set_bit(HCI_SETUP, &hdev->dev_flags);
3978         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
3979
3980         if (hdev->dev_type == HCI_BREDR) {
3981                 /* Assume BR/EDR support until proven otherwise (such as
3982                  * through reading supported features during init.
3983                  */
3984                 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3985         }
3986
3987         write_lock(&hci_dev_list_lock);
3988         list_add(&hdev->list, &hci_dev_list);
3989         write_unlock(&hci_dev_list_lock);
3990
3991         /* Devices that are marked for raw-only usage are unconfigured
3992          * and should not be included in normal operation.
3993          */
3994         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3995                 set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
3996
3997         hci_notify(hdev, HCI_DEV_REG);
3998         hci_dev_hold(hdev);
3999
4000         queue_work(hdev->req_workqueue, &hdev->power_on);
4001
4002         return id;
4003
4004 err_tfm:
4005         crypto_free_blkcipher(hdev->tfm_aes);
4006 err_wqueue:
4007         destroy_workqueue(hdev->workqueue);
4008         destroy_workqueue(hdev->req_workqueue);
4009 err:
4010         ida_simple_remove(&hci_index_ida, hdev->id);
4011
4012         return error;
4013 }
4014 EXPORT_SYMBOL(hci_register_dev);
4015
4016 /* Unregister HCI device */
4017 void hci_unregister_dev(struct hci_dev *hdev)
4018 {
4019         int i, id;
4020
4021         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
4022
4023         set_bit(HCI_UNREGISTER, &hdev->dev_flags);
4024
4025         id = hdev->id;
4026
4027         write_lock(&hci_dev_list_lock);
4028         list_del(&hdev->list);
4029         write_unlock(&hci_dev_list_lock);
4030
4031         hci_dev_do_close(hdev);
4032
4033         for (i = 0; i < NUM_REASSEMBLY; i++)
4034                 kfree_skb(hdev->reassembly[i]);
4035
4036         cancel_work_sync(&hdev->power_on);
4037
4038         if (!test_bit(HCI_INIT, &hdev->flags) &&
4039             !test_bit(HCI_SETUP, &hdev->dev_flags)) {
4040                 hci_dev_lock(hdev);
4041                 mgmt_index_removed(hdev);
4042                 hci_dev_unlock(hdev);
4043         }
4044
4045         /* mgmt_index_removed should take care of emptying the
4046          * pending list */
4047         BUG_ON(!list_empty(&hdev->mgmt_pending));
4048
4049         hci_notify(hdev, HCI_DEV_UNREG);
4050
4051         if (hdev->rfkill) {
4052                 rfkill_unregister(hdev->rfkill);
4053                 rfkill_destroy(hdev->rfkill);
4054         }
4055
4056         if (hdev->tfm_aes)
4057                 crypto_free_blkcipher(hdev->tfm_aes);
4058
4059         device_del(&hdev->dev);
4060
4061         debugfs_remove_recursive(hdev->debugfs);
4062
4063         destroy_workqueue(hdev->workqueue);
4064         destroy_workqueue(hdev->req_workqueue);
4065
4066         hci_dev_lock(hdev);
4067         hci_blacklist_clear(hdev);
4068         hci_uuids_clear(hdev);
4069         hci_link_keys_clear(hdev);
4070         hci_smp_ltks_clear(hdev);
4071         hci_smp_irks_clear(hdev);
4072         hci_remote_oob_data_clear(hdev);
4073         hci_white_list_clear(hdev);
4074         hci_conn_params_clear_all(hdev);
4075         hci_dev_unlock(hdev);
4076
4077         hci_dev_put(hdev);
4078
4079         ida_simple_remove(&hci_index_ida, id);
4080 }
4081 EXPORT_SYMBOL(hci_unregister_dev);
4082
4083 /* Suspend HCI device */
4084 int hci_suspend_dev(struct hci_dev *hdev)
4085 {
4086         hci_notify(hdev, HCI_DEV_SUSPEND);
4087         return 0;
4088 }
4089 EXPORT_SYMBOL(hci_suspend_dev);
4090
4091 /* Resume HCI device */
4092 int hci_resume_dev(struct hci_dev *hdev)
4093 {
4094         hci_notify(hdev, HCI_DEV_RESUME);
4095         return 0;
4096 }
4097 EXPORT_SYMBOL(hci_resume_dev);
4098
4099 /* Receive frame from HCI drivers */
4100 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
4101 {
4102         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
4103                       && !test_bit(HCI_INIT, &hdev->flags))) {
4104                 kfree_skb(skb);
4105                 return -ENXIO;
4106         }
4107
4108         /* Incoming skb */
4109         bt_cb(skb)->incoming = 1;
4110
4111         /* Time stamp */
4112         __net_timestamp(skb);
4113
4114         skb_queue_tail(&hdev->rx_q, skb);
4115         queue_work(hdev->workqueue, &hdev->rx_work);
4116
4117         return 0;
4118 }
4119 EXPORT_SYMBOL(hci_recv_frame);
4120
4121 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
4122                           int count, __u8 index)
4123 {
4124         int len = 0;
4125         int hlen = 0;
4126         int remain = count;
4127         struct sk_buff *skb;
4128         struct bt_skb_cb *scb;
4129
4130         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
4131             index >= NUM_REASSEMBLY)
4132                 return -EILSEQ;
4133
4134         skb = hdev->reassembly[index];
4135
4136         if (!skb) {
4137                 switch (type) {
4138                 case HCI_ACLDATA_PKT:
4139                         len = HCI_MAX_FRAME_SIZE;
4140                         hlen = HCI_ACL_HDR_SIZE;
4141                         break;
4142                 case HCI_EVENT_PKT:
4143                         len = HCI_MAX_EVENT_SIZE;
4144                         hlen = HCI_EVENT_HDR_SIZE;
4145                         break;
4146                 case HCI_SCODATA_PKT:
4147                         len = HCI_MAX_SCO_SIZE;
4148                         hlen = HCI_SCO_HDR_SIZE;
4149                         break;
4150                 }
4151
4152                 skb = bt_skb_alloc(len, GFP_ATOMIC);
4153                 if (!skb)
4154                         return -ENOMEM;
4155
4156                 scb = (void *) skb->cb;
4157                 scb->expect = hlen;
4158                 scb->pkt_type = type;
4159
4160                 hdev->reassembly[index] = skb;
4161         }
4162
4163         while (count) {
4164                 scb = (void *) skb->cb;
4165                 len = min_t(uint, scb->expect, count);
4166
4167                 memcpy(skb_put(skb, len), data, len);
4168
4169                 count -= len;
4170                 data += len;
4171                 scb->expect -= len;
4172                 remain = count;
4173
4174                 switch (type) {
4175                 case HCI_EVENT_PKT:
4176                         if (skb->len == HCI_EVENT_HDR_SIZE) {
4177                                 struct hci_event_hdr *h = hci_event_hdr(skb);
4178                                 scb->expect = h->plen;
4179
4180                                 if (skb_tailroom(skb) < scb->expect) {
4181                                         kfree_skb(skb);
4182                                         hdev->reassembly[index] = NULL;
4183                                         return -ENOMEM;
4184                                 }
4185                         }
4186                         break;
4187
4188                 case HCI_ACLDATA_PKT:
4189                         if (skb->len  == HCI_ACL_HDR_SIZE) {
4190                                 struct hci_acl_hdr *h = hci_acl_hdr(skb);
4191                                 scb->expect = __le16_to_cpu(h->dlen);
4192
4193                                 if (skb_tailroom(skb) < scb->expect) {
4194                                         kfree_skb(skb);
4195                                         hdev->reassembly[index] = NULL;
4196                                         return -ENOMEM;
4197                                 }
4198                         }
4199                         break;
4200
4201                 case HCI_SCODATA_PKT:
4202                         if (skb->len == HCI_SCO_HDR_SIZE) {
4203                                 struct hci_sco_hdr *h = hci_sco_hdr(skb);
4204                                 scb->expect = h->dlen;
4205
4206                                 if (skb_tailroom(skb) < scb->expect) {
4207                                         kfree_skb(skb);
4208                                         hdev->reassembly[index] = NULL;
4209                                         return -ENOMEM;
4210                                 }
4211                         }
4212                         break;
4213                 }
4214
4215                 if (scb->expect == 0) {
4216                         /* Complete frame */
4217
4218                         bt_cb(skb)->pkt_type = type;
4219                         hci_recv_frame(hdev, skb);
4220
4221                         hdev->reassembly[index] = NULL;
4222                         return remain;
4223                 }
4224         }
4225
4226         return remain;
4227 }
4228
4229 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
4230 {
4231         int rem = 0;
4232
4233         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
4234                 return -EILSEQ;
4235
4236         while (count) {
4237                 rem = hci_reassembly(hdev, type, data, count, type - 1);
4238                 if (rem < 0)
4239                         return rem;
4240
4241                 data += (count - rem);
4242                 count = rem;
4243         }
4244
4245         return rem;
4246 }
4247 EXPORT_SYMBOL(hci_recv_fragment);
4248
4249 #define STREAM_REASSEMBLY 0
4250
4251 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
4252 {
4253         int type;
4254         int rem = 0;
4255
4256         while (count) {
4257                 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
4258
4259                 if (!skb) {
4260                         struct { char type; } *pkt;
4261
4262                         /* Start of the frame */
4263                         pkt = data;
4264                         type = pkt->type;
4265
4266                         data++;
4267                         count--;
4268                 } else
4269                         type = bt_cb(skb)->pkt_type;
4270
4271                 rem = hci_reassembly(hdev, type, data, count,
4272                                      STREAM_REASSEMBLY);
4273                 if (rem < 0)
4274                         return rem;
4275
4276                 data += (count - rem);
4277                 count = rem;
4278         }
4279
4280         return rem;
4281 }
4282 EXPORT_SYMBOL(hci_recv_stream_fragment);
4283
4284 /* ---- Interface to upper protocols ---- */
4285
4286 int hci_register_cb(struct hci_cb *cb)
4287 {
4288         BT_DBG("%p name %s", cb, cb->name);
4289
4290         write_lock(&hci_cb_list_lock);
4291         list_add(&cb->list, &hci_cb_list);
4292         write_unlock(&hci_cb_list_lock);
4293
4294         return 0;
4295 }
4296 EXPORT_SYMBOL(hci_register_cb);
4297
4298 int hci_unregister_cb(struct hci_cb *cb)
4299 {
4300         BT_DBG("%p name %s", cb, cb->name);
4301
4302         write_lock(&hci_cb_list_lock);
4303         list_del(&cb->list);
4304         write_unlock(&hci_cb_list_lock);
4305
4306         return 0;
4307 }
4308 EXPORT_SYMBOL(hci_unregister_cb);
4309
4310 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
4311 {
4312         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
4313
4314         /* Time stamp */
4315         __net_timestamp(skb);
4316
4317         /* Send copy to monitor */
4318         hci_send_to_monitor(hdev, skb);
4319
4320         if (atomic_read(&hdev->promisc)) {
4321                 /* Send copy to the sockets */
4322                 hci_send_to_sock(hdev, skb);
4323         }
4324
4325         /* Get rid of skb owner, prior to sending to the driver. */
4326         skb_orphan(skb);
4327
4328         if (hdev->send(hdev, skb) < 0)
4329                 BT_ERR("%s sending frame failed", hdev->name);
4330 }
4331
4332 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
4333 {
4334         skb_queue_head_init(&req->cmd_q);
4335         req->hdev = hdev;
4336         req->err = 0;
4337 }
4338
4339 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
4340 {
4341         struct hci_dev *hdev = req->hdev;
4342         struct sk_buff *skb;
4343         unsigned long flags;
4344
4345         BT_DBG("length %u", skb_queue_len(&req->cmd_q));
4346
4347         /* If an error occured during request building, remove all HCI
4348          * commands queued on the HCI request queue.
4349          */
4350         if (req->err) {
4351                 skb_queue_purge(&req->cmd_q);
4352                 return req->err;
4353         }
4354
4355         /* Do not allow empty requests */
4356         if (skb_queue_empty(&req->cmd_q))
4357                 return -ENODATA;
4358
4359         skb = skb_peek_tail(&req->cmd_q);
4360         bt_cb(skb)->req.complete = complete;
4361
4362         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4363         skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
4364         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4365
4366         queue_work(hdev->workqueue, &hdev->cmd_work);
4367
4368         return 0;
4369 }
4370
4371 static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
4372                                        u32 plen, const void *param)
4373 {
4374         int len = HCI_COMMAND_HDR_SIZE + plen;
4375         struct hci_command_hdr *hdr;
4376         struct sk_buff *skb;
4377
4378         skb = bt_skb_alloc(len, GFP_ATOMIC);
4379         if (!skb)
4380                 return NULL;
4381
4382         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
4383         hdr->opcode = cpu_to_le16(opcode);
4384         hdr->plen   = plen;
4385
4386         if (plen)
4387                 memcpy(skb_put(skb, plen), param, plen);
4388
4389         BT_DBG("skb len %d", skb->len);
4390
4391         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
4392
4393         return skb;
4394 }
4395
4396 /* Send HCI command */
4397 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
4398                  const void *param)
4399 {
4400         struct sk_buff *skb;
4401
4402         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
4403
4404         skb = hci_prepare_cmd(hdev, opcode, plen, param);
4405         if (!skb) {
4406                 BT_ERR("%s no memory for command", hdev->name);
4407                 return -ENOMEM;
4408         }
4409
4410         /* Stand-alone HCI commands must be flaged as
4411          * single-command requests.
4412          */
4413         bt_cb(skb)->req.start = true;
4414
4415         skb_queue_tail(&hdev->cmd_q, skb);
4416         queue_work(hdev->workqueue, &hdev->cmd_work);
4417
4418         return 0;
4419 }
4420
4421 /* Queue a command to an asynchronous HCI request */
4422 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
4423                     const void *param, u8 event)
4424 {
4425         struct hci_dev *hdev = req->hdev;
4426         struct sk_buff *skb;
4427
4428         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
4429
4430         /* If an error occured during request building, there is no point in
4431          * queueing the HCI command. We can simply return.
4432          */
4433         if (req->err)
4434                 return;
4435
4436         skb = hci_prepare_cmd(hdev, opcode, plen, param);
4437         if (!skb) {
4438                 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
4439                        hdev->name, opcode);
4440                 req->err = -ENOMEM;
4441                 return;
4442         }
4443
4444         if (skb_queue_empty(&req->cmd_q))
4445                 bt_cb(skb)->req.start = true;
4446
4447         bt_cb(skb)->req.event = event;
4448
4449         skb_queue_tail(&req->cmd_q, skb);
4450 }
4451
4452 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
4453                  const void *param)
4454 {
4455         hci_req_add_ev(req, opcode, plen, param, 0);
4456 }
4457
4458 /* Get data from the previously sent command */
4459 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
4460 {
4461         struct hci_command_hdr *hdr;
4462
4463         if (!hdev->sent_cmd)
4464                 return NULL;
4465
4466         hdr = (void *) hdev->sent_cmd->data;
4467
4468         if (hdr->opcode != cpu_to_le16(opcode))
4469                 return NULL;
4470
4471         BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
4472
4473         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
4474 }
4475
4476 /* Send ACL data */
4477 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
4478 {
4479         struct hci_acl_hdr *hdr;
4480         int len = skb->len;
4481
4482         skb_push(skb, HCI_ACL_HDR_SIZE);
4483         skb_reset_transport_header(skb);
4484         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
4485         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
4486         hdr->dlen   = cpu_to_le16(len);
4487 }
4488
4489 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
4490                           struct sk_buff *skb, __u16 flags)
4491 {
4492         struct hci_conn *conn = chan->conn;
4493         struct hci_dev *hdev = conn->hdev;
4494         struct sk_buff *list;
4495
4496         skb->len = skb_headlen(skb);
4497         skb->data_len = 0;
4498
4499         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
4500
4501         switch (hdev->dev_type) {
4502         case HCI_BREDR:
4503                 hci_add_acl_hdr(skb, conn->handle, flags);
4504                 break;
4505         case HCI_AMP:
4506                 hci_add_acl_hdr(skb, chan->handle, flags);
4507                 break;
4508         default:
4509                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
4510                 return;
4511         }
4512
4513         list = skb_shinfo(skb)->frag_list;
4514         if (!list) {
4515                 /* Non fragmented */
4516                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
4517
4518                 skb_queue_tail(queue, skb);
4519         } else {
4520                 /* Fragmented */
4521                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4522
4523                 skb_shinfo(skb)->frag_list = NULL;
4524
4525                 /* Queue all fragments atomically */
4526                 spin_lock(&queue->lock);
4527
4528                 __skb_queue_tail(queue, skb);
4529
4530                 flags &= ~ACL_START;
4531                 flags |= ACL_CONT;
4532                 do {
4533                         skb = list; list = list->next;
4534
4535                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
4536                         hci_add_acl_hdr(skb, conn->handle, flags);
4537
4538                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4539
4540                         __skb_queue_tail(queue, skb);
4541                 } while (list);
4542
4543                 spin_unlock(&queue->lock);
4544         }
4545 }
4546
4547 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
4548 {
4549         struct hci_dev *hdev = chan->conn->hdev;
4550
4551         BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
4552
4553         hci_queue_acl(chan, &chan->data_q, skb, flags);
4554
4555         queue_work(hdev->workqueue, &hdev->tx_work);
4556 }
4557
4558 /* Send SCO data */
4559 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
4560 {
4561         struct hci_dev *hdev = conn->hdev;
4562         struct hci_sco_hdr hdr;
4563
4564         BT_DBG("%s len %d", hdev->name, skb->len);
4565
4566         hdr.handle = cpu_to_le16(conn->handle);
4567         hdr.dlen   = skb->len;
4568
4569         skb_push(skb, HCI_SCO_HDR_SIZE);
4570         skb_reset_transport_header(skb);
4571         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
4572
4573         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
4574
4575         skb_queue_tail(&conn->data_q, skb);
4576         queue_work(hdev->workqueue, &hdev->tx_work);
4577 }
4578
4579 /* ---- HCI TX task (outgoing data) ---- */
4580
4581 /* HCI Connection scheduler */
4582 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
4583                                      int *quote)
4584 {
4585         struct hci_conn_hash *h = &hdev->conn_hash;
4586         struct hci_conn *conn = NULL, *c;
4587         unsigned int num = 0, min = ~0;
4588
4589         /* We don't have to lock device here. Connections are always
4590          * added and removed with TX task disabled. */
4591
4592         rcu_read_lock();
4593
4594         list_for_each_entry_rcu(c, &h->list, list) {
4595                 if (c->type != type || skb_queue_empty(&c->data_q))
4596                         continue;
4597
4598                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
4599                         continue;
4600
4601                 num++;
4602
4603                 if (c->sent < min) {
4604                         min  = c->sent;
4605                         conn = c;
4606                 }
4607
4608                 if (hci_conn_num(hdev, type) == num)
4609                         break;
4610         }
4611
4612         rcu_read_unlock();
4613
4614         if (conn) {
4615                 int cnt, q;
4616
4617                 switch (conn->type) {
4618                 case ACL_LINK:
4619                         cnt = hdev->acl_cnt;
4620                         break;
4621                 case SCO_LINK:
4622                 case ESCO_LINK:
4623                         cnt = hdev->sco_cnt;
4624                         break;
4625                 case LE_LINK:
4626                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4627                         break;
4628                 default:
4629                         cnt = 0;
4630                         BT_ERR("Unknown link type");
4631                 }
4632
4633                 q = cnt / num;
4634                 *quote = q ? q : 1;
4635         } else
4636                 *quote = 0;
4637
4638         BT_DBG("conn %p quote %d", conn, *quote);
4639         return conn;
4640 }
4641
4642 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
4643 {
4644         struct hci_conn_hash *h = &hdev->conn_hash;
4645         struct hci_conn *c;
4646
4647         BT_ERR("%s link tx timeout", hdev->name);
4648
4649         rcu_read_lock();
4650
4651         /* Kill stalled connections */
4652         list_for_each_entry_rcu(c, &h->list, list) {
4653                 if (c->type == type && c->sent) {
4654                         BT_ERR("%s killing stalled connection %pMR",
4655                                hdev->name, &c->dst);
4656                         hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
4657                 }
4658         }
4659
4660         rcu_read_unlock();
4661 }
4662
4663 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
4664                                       int *quote)
4665 {
4666         struct hci_conn_hash *h = &hdev->conn_hash;
4667         struct hci_chan *chan = NULL;
4668         unsigned int num = 0, min = ~0, cur_prio = 0;
4669         struct hci_conn *conn;
4670         int cnt, q, conn_num = 0;
4671
4672         BT_DBG("%s", hdev->name);
4673
4674         rcu_read_lock();
4675
4676         list_for_each_entry_rcu(conn, &h->list, list) {
4677                 struct hci_chan *tmp;
4678
4679                 if (conn->type != type)
4680                         continue;
4681
4682                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4683                         continue;
4684
4685                 conn_num++;
4686
4687                 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
4688                         struct sk_buff *skb;
4689
4690                         if (skb_queue_empty(&tmp->data_q))
4691                                 continue;
4692
4693                         skb = skb_peek(&tmp->data_q);
4694                         if (skb->priority < cur_prio)
4695                                 continue;
4696
4697                         if (skb->priority > cur_prio) {
4698                                 num = 0;
4699                                 min = ~0;
4700                                 cur_prio = skb->priority;
4701                         }
4702
4703                         num++;
4704
4705                         if (conn->sent < min) {
4706                                 min  = conn->sent;
4707                                 chan = tmp;
4708                         }
4709                 }
4710
4711                 if (hci_conn_num(hdev, type) == conn_num)
4712                         break;
4713         }
4714
4715         rcu_read_unlock();
4716
4717         if (!chan)
4718                 return NULL;
4719
4720         switch (chan->conn->type) {
4721         case ACL_LINK:
4722                 cnt = hdev->acl_cnt;
4723                 break;
4724         case AMP_LINK:
4725                 cnt = hdev->block_cnt;
4726                 break;
4727         case SCO_LINK:
4728         case ESCO_LINK:
4729                 cnt = hdev->sco_cnt;
4730                 break;
4731         case LE_LINK:
4732                 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4733                 break;
4734         default:
4735                 cnt = 0;
4736                 BT_ERR("Unknown link type");
4737         }
4738
4739         q = cnt / num;
4740         *quote = q ? q : 1;
4741         BT_DBG("chan %p quote %d", chan, *quote);
4742         return chan;
4743 }
4744
4745 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
4746 {
4747         struct hci_conn_hash *h = &hdev->conn_hash;
4748         struct hci_conn *conn;
4749         int num = 0;
4750
4751         BT_DBG("%s", hdev->name);
4752
4753         rcu_read_lock();
4754
4755         list_for_each_entry_rcu(conn, &h->list, list) {
4756                 struct hci_chan *chan;
4757
4758                 if (conn->type != type)
4759                         continue;
4760
4761                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4762                         continue;
4763
4764                 num++;
4765
4766                 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
4767                         struct sk_buff *skb;
4768
4769                         if (chan->sent) {
4770                                 chan->sent = 0;
4771                                 continue;
4772                         }
4773
4774                         if (skb_queue_empty(&chan->data_q))
4775                                 continue;
4776
4777                         skb = skb_peek(&chan->data_q);
4778                         if (skb->priority >= HCI_PRIO_MAX - 1)
4779                                 continue;
4780
4781                         skb->priority = HCI_PRIO_MAX - 1;
4782
4783                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
4784                                skb->priority);
4785                 }
4786
4787                 if (hci_conn_num(hdev, type) == num)
4788                         break;
4789         }
4790
4791         rcu_read_unlock();
4792
4793 }
4794
4795 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
4796 {
4797         /* Calculate count of blocks used by this packet */
4798         return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
4799 }
4800
4801 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
4802 {
4803         if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
4804                 /* ACL tx timeout must be longer than maximum
4805                  * link supervision timeout (40.9 seconds) */
4806                 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
4807                                        HCI_ACL_TX_TIMEOUT))
4808                         hci_link_tx_to(hdev, ACL_LINK);
4809         }
4810 }
4811
4812 static void hci_sched_acl_pkt(struct hci_dev *hdev)
4813 {
4814         unsigned int cnt = hdev->acl_cnt;
4815         struct hci_chan *chan;
4816         struct sk_buff *skb;
4817         int quote;
4818
4819         __check_timeout(hdev, cnt);
4820
4821         while (hdev->acl_cnt &&
4822                (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
4823                 u32 priority = (skb_peek(&chan->data_q))->priority;
4824                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4825                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4826                                skb->len, skb->priority);
4827
4828                         /* Stop if priority has changed */
4829                         if (skb->priority < priority)
4830                                 break;
4831
4832                         skb = skb_dequeue(&chan->data_q);
4833
4834                         hci_conn_enter_active_mode(chan->conn,
4835                                                    bt_cb(skb)->force_active);
4836
4837                         hci_send_frame(hdev, skb);
4838                         hdev->acl_last_tx = jiffies;
4839
4840                         hdev->acl_cnt--;
4841                         chan->sent++;
4842                         chan->conn->sent++;
4843                 }
4844         }
4845
4846         if (cnt != hdev->acl_cnt)
4847                 hci_prio_recalculate(hdev, ACL_LINK);
4848 }
4849
4850 static void hci_sched_acl_blk(struct hci_dev *hdev)
4851 {
4852         unsigned int cnt = hdev->block_cnt;
4853         struct hci_chan *chan;
4854         struct sk_buff *skb;
4855         int quote;
4856         u8 type;
4857
4858         __check_timeout(hdev, cnt);
4859
4860         BT_DBG("%s", hdev->name);
4861
4862         if (hdev->dev_type == HCI_AMP)
4863                 type = AMP_LINK;
4864         else
4865                 type = ACL_LINK;
4866
4867         while (hdev->block_cnt > 0 &&
4868                (chan = hci_chan_sent(hdev, type, &quote))) {
4869                 u32 priority = (skb_peek(&chan->data_q))->priority;
4870                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
4871                         int blocks;
4872
4873                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4874                                skb->len, skb->priority);
4875
4876                         /* Stop if priority has changed */
4877                         if (skb->priority < priority)
4878                                 break;
4879
4880                         skb = skb_dequeue(&chan->data_q);
4881
4882                         blocks = __get_blocks(hdev, skb);
4883                         if (blocks > hdev->block_cnt)
4884                                 return;
4885
4886                         hci_conn_enter_active_mode(chan->conn,
4887                                                    bt_cb(skb)->force_active);
4888
4889                         hci_send_frame(hdev, skb);
4890                         hdev->acl_last_tx = jiffies;
4891
4892                         hdev->block_cnt -= blocks;
4893                         quote -= blocks;
4894
4895                         chan->sent += blocks;
4896                         chan->conn->sent += blocks;
4897                 }
4898         }
4899
4900         if (cnt != hdev->block_cnt)
4901                 hci_prio_recalculate(hdev, type);
4902 }
4903
4904 static void hci_sched_acl(struct hci_dev *hdev)
4905 {
4906         BT_DBG("%s", hdev->name);
4907
4908         /* No ACL link over BR/EDR controller */
4909         if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
4910                 return;
4911
4912         /* No AMP link over AMP controller */
4913         if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4914                 return;
4915
4916         switch (hdev->flow_ctl_mode) {
4917         case HCI_FLOW_CTL_MODE_PACKET_BASED:
4918                 hci_sched_acl_pkt(hdev);
4919                 break;
4920
4921         case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4922                 hci_sched_acl_blk(hdev);
4923                 break;
4924         }
4925 }
4926
4927 /* Schedule SCO */
4928 static void hci_sched_sco(struct hci_dev *hdev)
4929 {
4930         struct hci_conn *conn;
4931         struct sk_buff *skb;
4932         int quote;
4933
4934         BT_DBG("%s", hdev->name);
4935
4936         if (!hci_conn_num(hdev, SCO_LINK))
4937                 return;
4938
4939         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
4940                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4941                         BT_DBG("skb %p len %d", skb, skb->len);
4942                         hci_send_frame(hdev, skb);
4943
4944                         conn->sent++;
4945                         if (conn->sent == ~0)
4946                                 conn->sent = 0;
4947                 }
4948         }
4949 }
4950
4951 static void hci_sched_esco(struct hci_dev *hdev)
4952 {
4953         struct hci_conn *conn;
4954         struct sk_buff *skb;
4955         int quote;
4956
4957         BT_DBG("%s", hdev->name);
4958
4959         if (!hci_conn_num(hdev, ESCO_LINK))
4960                 return;
4961
4962         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4963                                                      &quote))) {
4964                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4965                         BT_DBG("skb %p len %d", skb, skb->len);
4966                         hci_send_frame(hdev, skb);
4967
4968                         conn->sent++;
4969                         if (conn->sent == ~0)
4970                                 conn->sent = 0;
4971                 }
4972         }
4973 }
4974
4975 static void hci_sched_le(struct hci_dev *hdev)
4976 {
4977         struct hci_chan *chan;
4978         struct sk_buff *skb;
4979         int quote, cnt, tmp;
4980
4981         BT_DBG("%s", hdev->name);
4982
4983         if (!hci_conn_num(hdev, LE_LINK))
4984                 return;
4985
4986         if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
4987                 /* LE tx timeout must be longer than maximum
4988                  * link supervision timeout (40.9 seconds) */
4989                 if (!hdev->le_cnt && hdev->le_pkts &&
4990                     time_after(jiffies, hdev->le_last_tx + HZ * 45))
4991                         hci_link_tx_to(hdev, LE_LINK);
4992         }
4993
4994         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
4995         tmp = cnt;
4996         while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
4997                 u32 priority = (skb_peek(&chan->data_q))->priority;
4998                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4999                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
5000                                skb->len, skb->priority);
5001
5002                         /* Stop if priority has changed */
5003                         if (skb->priority < priority)
5004                                 break;
5005
5006                         skb = skb_dequeue(&chan->data_q);
5007
5008                         hci_send_frame(hdev, skb);
5009                         hdev->le_last_tx = jiffies;
5010
5011                         cnt--;
5012                         chan->sent++;
5013                         chan->conn->sent++;
5014                 }
5015         }
5016
5017         if (hdev->le_pkts)
5018                 hdev->le_cnt = cnt;
5019         else
5020                 hdev->acl_cnt = cnt;
5021
5022         if (cnt != tmp)
5023                 hci_prio_recalculate(hdev, LE_LINK);
5024 }
5025
5026 static void hci_tx_work(struct work_struct *work)
5027 {
5028         struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
5029         struct sk_buff *skb;
5030
5031         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
5032                hdev->sco_cnt, hdev->le_cnt);
5033
5034         if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5035                 /* Schedule queues and send stuff to HCI driver */
5036                 hci_sched_acl(hdev);
5037                 hci_sched_sco(hdev);
5038                 hci_sched_esco(hdev);
5039                 hci_sched_le(hdev);
5040         }
5041
5042         /* Send next queued raw (unknown type) packet */
5043         while ((skb = skb_dequeue(&hdev->raw_q)))
5044                 hci_send_frame(hdev, skb);
5045 }
5046
5047 /* ----- HCI RX task (incoming data processing) ----- */
5048
5049 /* ACL data packet */
5050 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
5051 {
5052         struct hci_acl_hdr *hdr = (void *) skb->data;
5053         struct hci_conn *conn;
5054         __u16 handle, flags;
5055
5056         skb_pull(skb, HCI_ACL_HDR_SIZE);
5057
5058         handle = __le16_to_cpu(hdr->handle);
5059         flags  = hci_flags(handle);
5060         handle = hci_handle(handle);
5061
5062         BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
5063                handle, flags);
5064
5065         hdev->stat.acl_rx++;
5066
5067         hci_dev_lock(hdev);
5068         conn = hci_conn_hash_lookup_handle(hdev, handle);
5069         hci_dev_unlock(hdev);
5070
5071         if (conn) {
5072                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
5073
5074                 /* Send to upper protocol */
5075                 l2cap_recv_acldata(conn, skb, flags);
5076                 return;
5077         } else {
5078                 BT_ERR("%s ACL packet for unknown connection handle %d",
5079                        hdev->name, handle);
5080         }
5081
5082         kfree_skb(skb);
5083 }
5084
5085 /* SCO data packet */
5086 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
5087 {
5088         struct hci_sco_hdr *hdr = (void *) skb->data;
5089         struct hci_conn *conn;
5090         __u16 handle;
5091
5092         skb_pull(skb, HCI_SCO_HDR_SIZE);
5093
5094         handle = __le16_to_cpu(hdr->handle);
5095
5096         BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
5097
5098         hdev->stat.sco_rx++;
5099
5100         hci_dev_lock(hdev);
5101         conn = hci_conn_hash_lookup_handle(hdev, handle);
5102         hci_dev_unlock(hdev);
5103
5104         if (conn) {
5105                 /* Send to upper protocol */
5106                 sco_recv_scodata(conn, skb);
5107                 return;
5108         } else {
5109                 BT_ERR("%s SCO packet for unknown connection handle %d",
5110                        hdev->name, handle);
5111         }
5112
5113         kfree_skb(skb);
5114 }
5115
5116 static bool hci_req_is_complete(struct hci_dev *hdev)
5117 {
5118         struct sk_buff *skb;
5119
5120         skb = skb_peek(&hdev->cmd_q);
5121         if (!skb)
5122                 return true;
5123
5124         return bt_cb(skb)->req.start;
5125 }
5126
5127 static void hci_resend_last(struct hci_dev *hdev)
5128 {
5129         struct hci_command_hdr *sent;
5130         struct sk_buff *skb;
5131         u16 opcode;
5132
5133         if (!hdev->sent_cmd)
5134                 return;
5135
5136         sent = (void *) hdev->sent_cmd->data;
5137         opcode = __le16_to_cpu(sent->opcode);
5138         if (opcode == HCI_OP_RESET)
5139                 return;
5140
5141         skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
5142         if (!skb)
5143                 return;
5144
5145         skb_queue_head(&hdev->cmd_q, skb);
5146         queue_work(hdev->workqueue, &hdev->cmd_work);
5147 }
5148
5149 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
5150 {
5151         hci_req_complete_t req_complete = NULL;
5152         struct sk_buff *skb;
5153         unsigned long flags;
5154
5155         BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
5156
5157         /* If the completed command doesn't match the last one that was
5158          * sent we need to do special handling of it.
5159          */
5160         if (!hci_sent_cmd_data(hdev, opcode)) {
5161                 /* Some CSR based controllers generate a spontaneous
5162                  * reset complete event during init and any pending
5163                  * command will never be completed. In such a case we
5164                  * need to resend whatever was the last sent
5165                  * command.
5166                  */
5167                 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
5168                         hci_resend_last(hdev);
5169
5170                 return;
5171         }
5172
5173         /* If the command succeeded and there's still more commands in
5174          * this request the request is not yet complete.
5175          */
5176         if (!status && !hci_req_is_complete(hdev))
5177                 return;
5178
5179         /* If this was the last command in a request the complete
5180          * callback would be found in hdev->sent_cmd instead of the
5181          * command queue (hdev->cmd_q).
5182          */
5183         if (hdev->sent_cmd) {
5184                 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
5185
5186                 if (req_complete) {
5187                         /* We must set the complete callback to NULL to
5188                          * avoid calling the callback more than once if
5189                          * this function gets called again.
5190                          */
5191                         bt_cb(hdev->sent_cmd)->req.complete = NULL;
5192
5193                         goto call_complete;
5194                 }
5195         }
5196
5197         /* Remove all pending commands belonging to this request */
5198         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
5199         while ((skb = __skb_dequeue(&hdev->cmd_q))) {
5200                 if (bt_cb(skb)->req.start) {
5201                         __skb_queue_head(&hdev->cmd_q, skb);
5202                         break;
5203                 }
5204
5205                 req_complete = bt_cb(skb)->req.complete;
5206                 kfree_skb(skb);
5207         }
5208         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
5209
5210 call_complete:
5211         if (req_complete)
5212                 req_complete(hdev, status);
5213 }
5214
5215 static void hci_rx_work(struct work_struct *work)
5216 {
5217         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
5218         struct sk_buff *skb;
5219
5220         BT_DBG("%s", hdev->name);
5221
5222         while ((skb = skb_dequeue(&hdev->rx_q))) {
5223                 /* Send copy to monitor */
5224                 hci_send_to_monitor(hdev, skb);
5225
5226                 if (atomic_read(&hdev->promisc)) {
5227                         /* Send copy to the sockets */
5228                         hci_send_to_sock(hdev, skb);
5229                 }
5230
5231                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5232                         kfree_skb(skb);
5233                         continue;
5234                 }
5235
5236                 if (test_bit(HCI_INIT, &hdev->flags)) {
5237                         /* Don't process data packets in this states. */
5238                         switch (bt_cb(skb)->pkt_type) {
5239                         case HCI_ACLDATA_PKT:
5240                         case HCI_SCODATA_PKT:
5241                                 kfree_skb(skb);
5242                                 continue;
5243                         }
5244                 }
5245
5246                 /* Process frame */
5247                 switch (bt_cb(skb)->pkt_type) {
5248                 case HCI_EVENT_PKT:
5249                         BT_DBG("%s Event packet", hdev->name);
5250                         hci_event_packet(hdev, skb);
5251                         break;
5252
5253                 case HCI_ACLDATA_PKT:
5254                         BT_DBG("%s ACL data packet", hdev->name);
5255                         hci_acldata_packet(hdev, skb);
5256                         break;
5257
5258                 case HCI_SCODATA_PKT:
5259                         BT_DBG("%s SCO data packet", hdev->name);
5260                         hci_scodata_packet(hdev, skb);
5261                         break;
5262
5263                 default:
5264                         kfree_skb(skb);
5265                         break;
5266                 }
5267         }
5268 }
5269
5270 static void hci_cmd_work(struct work_struct *work)
5271 {
5272         struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
5273         struct sk_buff *skb;
5274
5275         BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
5276                atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
5277
5278         /* Send queued commands */
5279         if (atomic_read(&hdev->cmd_cnt)) {
5280                 skb = skb_dequeue(&hdev->cmd_q);
5281                 if (!skb)
5282                         return;
5283
5284                 kfree_skb(hdev->sent_cmd);
5285
5286                 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
5287                 if (hdev->sent_cmd) {
5288                         atomic_dec(&hdev->cmd_cnt);
5289                         hci_send_frame(hdev, skb);
5290                         if (test_bit(HCI_RESET, &hdev->flags))
5291                                 cancel_delayed_work(&hdev->cmd_timer);
5292                         else
5293                                 schedule_delayed_work(&hdev->cmd_timer,
5294                                                       HCI_CMD_TIMEOUT);
5295                 } else {
5296                         skb_queue_head(&hdev->cmd_q, skb);
5297                         queue_work(hdev->workqueue, &hdev->cmd_work);
5298                 }
5299         }
5300 }
5301
5302 void hci_req_add_le_scan_disable(struct hci_request *req)
5303 {
5304         struct hci_cp_le_set_scan_enable cp;
5305
5306         memset(&cp, 0, sizeof(cp));
5307         cp.enable = LE_SCAN_DISABLE;
5308         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
5309 }
5310
5311 void hci_req_add_le_passive_scan(struct hci_request *req)
5312 {
5313         struct hci_cp_le_set_scan_param param_cp;
5314         struct hci_cp_le_set_scan_enable enable_cp;
5315         struct hci_dev *hdev = req->hdev;
5316         u8 own_addr_type;
5317
5318         /* Set require_privacy to false since no SCAN_REQ are send
5319          * during passive scanning. Not using an unresolvable address
5320          * here is important so that peer devices using direct
5321          * advertising with our address will be correctly reported
5322          * by the controller.
5323          */
5324         if (hci_update_random_address(req, false, &own_addr_type))
5325                 return;
5326
5327         memset(&param_cp, 0, sizeof(param_cp));
5328         param_cp.type = LE_SCAN_PASSIVE;
5329         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
5330         param_cp.window = cpu_to_le16(hdev->le_scan_window);
5331         param_cp.own_address_type = own_addr_type;
5332         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
5333                     &param_cp);
5334
5335         memset(&enable_cp, 0, sizeof(enable_cp));
5336         enable_cp.enable = LE_SCAN_ENABLE;
5337         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
5338         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
5339                     &enable_cp);
5340 }
5341
5342 static void update_background_scan_complete(struct hci_dev *hdev, u8 status)
5343 {
5344         if (status)
5345                 BT_DBG("HCI request failed to update background scanning: "
5346                        "status 0x%2.2x", status);
5347 }
5348
5349 /* This function controls the background scanning based on hdev->pend_le_conns
5350  * list. If there are pending LE connection we start the background scanning,
5351  * otherwise we stop it.
5352  *
5353  * This function requires the caller holds hdev->lock.
5354  */
5355 void hci_update_background_scan(struct hci_dev *hdev)
5356 {
5357         struct hci_request req;
5358         struct hci_conn *conn;
5359         int err;
5360
5361         if (!test_bit(HCI_UP, &hdev->flags) ||
5362             test_bit(HCI_INIT, &hdev->flags) ||
5363             test_bit(HCI_SETUP, &hdev->dev_flags) ||
5364             test_bit(HCI_AUTO_OFF, &hdev->dev_flags) ||
5365             test_bit(HCI_UNREGISTER, &hdev->dev_flags))
5366                 return;
5367
5368         hci_req_init(&req, hdev);
5369
5370         if (list_empty(&hdev->pend_le_conns)) {
5371                 /* If there is no pending LE connections, we should stop
5372                  * the background scanning.
5373                  */
5374
5375                 /* If controller is not scanning we are done. */
5376                 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
5377                         return;
5378
5379                 hci_req_add_le_scan_disable(&req);
5380
5381                 BT_DBG("%s stopping background scanning", hdev->name);
5382         } else {
5383                 /* If there is at least one pending LE connection, we should
5384                  * keep the background scan running.
5385                  */
5386
5387                 /* If controller is connecting, we should not start scanning
5388                  * since some controllers are not able to scan and connect at
5389                  * the same time.
5390                  */
5391                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
5392                 if (conn)
5393                         return;
5394
5395                 /* If controller is currently scanning, we stop it to ensure we
5396                  * don't miss any advertising (due to duplicates filter).
5397                  */
5398                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
5399                         hci_req_add_le_scan_disable(&req);
5400
5401                 hci_req_add_le_passive_scan(&req);
5402
5403                 BT_DBG("%s starting background scanning", hdev->name);
5404         }
5405
5406         err = hci_req_run(&req, update_background_scan_complete);
5407         if (err)
5408                 BT_ERR("Failed to run HCI request: err %d", err);
5409 }