net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2011 ProFUSION Embedded Systems
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI core. */
  27
  28 #include <linux/export.h>
  29 #include <linux/idr.h>
  30 #include <linux/rfkill.h>
  31 #include <linux/debugfs.h>
  32 #include <linux/crypto.h>
  33 #include <asm/unaligned.h>
  34
  35 #include <net/bluetooth/bluetooth.h>
  36 #include <net/bluetooth/hci_core.h>
  37 #include <net/bluetooth/l2cap.h>
  38 #include <net/bluetooth/mgmt.h>
  39
  40 #include "smp.h"
  41
  42 static void hci_rx_work(struct work_struct *work);
  43 static void hci_cmd_work(struct work_struct *work);
  44 static void hci_tx_work(struct work_struct *work);
  45
  46 /* HCI device list */
  47 LIST_HEAD(hci_dev_list);
  48 DEFINE_RWLOCK(hci_dev_list_lock);
  49
  50 /* HCI callback list */
  51 LIST_HEAD(hci_cb_list);
  52 DEFINE_RWLOCK(hci_cb_list_lock);
  53
  54 /* HCI ID Numbering */
  55 static DEFINE_IDA(hci_index_ida);
  56
  57 /* ----- HCI requests ----- */
  58
  59 #define HCI_REQ_DONE      0
  60 #define HCI_REQ_PEND      1
  61 #define HCI_REQ_CANCELED  2
  62
  63 #define hci_req_lock(d)         mutex_lock(&d->req_lock)
  64 #define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
  65
  66 /* ---- HCI notifications ---- */
  67
  68 static void hci_notify(struct hci_dev *hdev, int event)
  69 {
  70         hci_sock_dev_event(hdev, event);
  71 }
  72
  73 /* ---- HCI debugfs entries ---- */
  74
  75 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
  76                              size_t count, loff_t *ppos)
  77 {
  78         struct hci_dev *hdev = file->private_data;
  79         char buf[3];
  80
  81         buf[0] = test_bit(HCI_DUT_MODE, &hdev->dbg_flags) ? 'Y': 'N';
  82         buf[1] = '\n';
  83         buf[2] = '\0';
  84         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
  85 }
  86
  87 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
  88                               size_t count, loff_t *ppos)
  89 {
  90         struct hci_dev *hdev = file->private_data;
  91         struct sk_buff *skb;
  92         char buf[32];
  93         size_t buf_size = min(count, (sizeof(buf)-1));
  94         bool enable;
  95         int err;
  96
  97         if (!test_bit(HCI_UP, &hdev->flags))
  98                 return -ENETDOWN;
  99
 100         if (copy_from_user(buf, user_buf, buf_size))
 101                 return -EFAULT;
 102
 103         buf[buf_size] = '\0';
 104         if (strtobool(buf, &enable))
 105                 return -EINVAL;
 106
 107         if (enable == test_bit(HCI_DUT_MODE, &hdev->dbg_flags))
 108                 return -EALREADY;
 109
 110         hci_req_lock(hdev);
 111         if (enable)
 112                 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
 113                                      HCI_CMD_TIMEOUT);
 114         else
 115                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
 116                                      HCI_CMD_TIMEOUT);
 117         hci_req_unlock(hdev);
 118
 119         if (IS_ERR(skb))
 120                 return PTR_ERR(skb);
 121
 122         err = -bt_to_errno(skb->data[0]);
 123         kfree_skb(skb);
 124
 125         if (err < 0)
 126                 return err;
 127
 128         change_bit(HCI_DUT_MODE, &hdev->dbg_flags);
 129
 130         return count;
 131 }
 132
 133 static const struct file_operations dut_mode_fops = {
 134         .open           = simple_open,
 135         .read           = dut_mode_read,
 136         .write          = dut_mode_write,
 137         .llseek         = default_llseek,
 138 };
 139
 140 static int features_show(struct seq_file *f, void *ptr)
 141 {
 142         struct hci_dev *hdev = f->private;
 143         u8 p;
 144
 145         hci_dev_lock(hdev);
 146         for (p = 0; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
 147                 seq_printf(f, "%2u: 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x "
 148                            "0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n", p,
 149                            hdev->features[p][0], hdev->features[p][1],
 150                            hdev->features[p][2], hdev->features[p][3],
 151                            hdev->features[p][4], hdev->features[p][5],
 152                            hdev->features[p][6], hdev->features[p][7]);
 153         }
 154         if (lmp_le_capable(hdev))
 155                 seq_printf(f, "LE: 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x "
 156                            "0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n",
 157                            hdev->le_features[0], hdev->le_features[1],
 158                            hdev->le_features[2], hdev->le_features[3],
 159                            hdev->le_features[4], hdev->le_features[5],
 160                            hdev->le_features[6], hdev->le_features[7]);
 161         hci_dev_unlock(hdev);
 162
 163         return 0;
 164 }
 165
 166 static int features_open(struct inode *inode, struct file *file)
 167 {
 168         return single_open(file, features_show, inode->i_private);
 169 }
 170
 171 static const struct file_operations features_fops = {
 172         .open           = features_open,
 173         .read           = seq_read,
 174         .llseek         = seq_lseek,
 175         .release        = single_release,
 176 };
 177
 178 static int blacklist_show(struct seq_file *f, void *p)
 179 {
 180         struct hci_dev *hdev = f->private;
 181         struct bdaddr_list *b;
 182
 183         hci_dev_lock(hdev);
 184         list_for_each_entry(b, &hdev->blacklist, list)
 185                 seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
 186         hci_dev_unlock(hdev);
 187
 188         return 0;
 189 }
 190
 191 static int blacklist_open(struct inode *inode, struct file *file)
 192 {
 193         return single_open(file, blacklist_show, inode->i_private);
 194 }
 195
 196 static const struct file_operations blacklist_fops = {
 197         .open           = blacklist_open,
 198         .read           = seq_read,
 199         .llseek         = seq_lseek,
 200         .release        = single_release,
 201 };
 202
 203 static int whitelist_show(struct seq_file *f, void *p)
 204 {
 205         struct hci_dev *hdev = f->private;
 206         struct bdaddr_list *b;
 207
 208         hci_dev_lock(hdev);
 209         list_for_each_entry(b, &hdev->whitelist, list)
 210                 seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
 211         hci_dev_unlock(hdev);
 212
 213         return 0;
 214 }
 215
 216 static int whitelist_open(struct inode *inode, struct file *file)
 217 {
 218         return single_open(file, whitelist_show, inode->i_private);
 219 }
 220
 221 static const struct file_operations whitelist_fops = {
 222         .open           = whitelist_open,
 223         .read           = seq_read,
 224         .llseek         = seq_lseek,
 225         .release        = single_release,
 226 };
 227
 228 static int uuids_show(struct seq_file *f, void *p)
 229 {
 230         struct hci_dev *hdev = f->private;
 231         struct bt_uuid *uuid;
 232
 233         hci_dev_lock(hdev);
 234         list_for_each_entry(uuid, &hdev->uuids, list) {
 235                 u8 i, val[16];
 236
 237                 /* The Bluetooth UUID values are stored in big endian,
 238                  * but with reversed byte order. So convert them into
 239                  * the right order for the %pUb modifier.
 240                  */
 241                 for (i = 0; i < 16; i++)
 242                         val[i] = uuid->uuid[15 - i];
 243
 244                 seq_printf(f, "%pUb\n", val);
 245         }
 246         hci_dev_unlock(hdev);
 247
 248         return 0;
 249 }
 250
 251 static int uuids_open(struct inode *inode, struct file *file)
 252 {
 253         return single_open(file, uuids_show, inode->i_private);
 254 }
 255
 256 static const struct file_operations uuids_fops = {
 257         .open           = uuids_open,
 258         .read           = seq_read,
 259         .llseek         = seq_lseek,
 260         .release        = single_release,
 261 };
 262
 263 static int inquiry_cache_show(struct seq_file *f, void *p)
 264 {
 265         struct hci_dev *hdev = f->private;
 266         struct discovery_state *cache = &hdev->discovery;
 267         struct inquiry_entry *e;
 268
 269         hci_dev_lock(hdev);
 270
 271         list_for_each_entry(e, &cache->all, all) {
 272                 struct inquiry_data *data = &e->data;
 273                 seq_printf(f, "%pMR %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %d %u\n",
 274                            &data->bdaddr,
 275                            data->pscan_rep_mode, data->pscan_period_mode,
 276                            data->pscan_mode, data->dev_class[2],
 277                            data->dev_class[1], data->dev_class[0],
 278                            __le16_to_cpu(data->clock_offset),
 279                            data->rssi, data->ssp_mode, e->timestamp);
 280         }
 281
 282         hci_dev_unlock(hdev);
 283
 284         return 0;
 285 }
 286
 287 static int inquiry_cache_open(struct inode *inode, struct file *file)
 288 {
 289         return single_open(file, inquiry_cache_show, inode->i_private);
 290 }
 291
 292 static const struct file_operations inquiry_cache_fops = {
 293         .open           = inquiry_cache_open,
 294         .read           = seq_read,
 295         .llseek         = seq_lseek,
 296         .release        = single_release,
 297 };
 298
 299 static int link_keys_show(struct seq_file *f, void *ptr)
 300 {
 301         struct hci_dev *hdev = f->private;
 302         struct list_head *p, *n;
 303
 304         hci_dev_lock(hdev);
 305         list_for_each_safe(p, n, &hdev->link_keys) {
 306                 struct link_key *key = list_entry(p, struct link_key, list);
 307                 seq_printf(f, "%pMR %u %*phN %u\n", &key->bdaddr, key->type,
 308                            HCI_LINK_KEY_SIZE, key->val, key->pin_len);
 309         }
 310         hci_dev_unlock(hdev);
 311
 312         return 0;
 313 }
 314
 315 static int link_keys_open(struct inode *inode, struct file *file)
 316 {
 317         return single_open(file, link_keys_show, inode->i_private);
 318 }
 319
 320 static const struct file_operations link_keys_fops = {
 321         .open           = link_keys_open,
 322         .read           = seq_read,
 323         .llseek         = seq_lseek,
 324         .release        = single_release,
 325 };
 326
 327 static int dev_class_show(struct seq_file *f, void *ptr)
 328 {
 329         struct hci_dev *hdev = f->private;
 330
 331         hci_dev_lock(hdev);
 332         seq_printf(f, "0x%.2x%.2x%.2x\n", hdev->dev_class[2],
 333                    hdev->dev_class[1], hdev->dev_class[0]);
 334         hci_dev_unlock(hdev);
 335
 336         return 0;
 337 }
 338
 339 static int dev_class_open(struct inode *inode, struct file *file)
 340 {
 341         return single_open(file, dev_class_show, inode->i_private);
 342 }
 343
 344 static const struct file_operations dev_class_fops = {
 345         .open           = dev_class_open,
 346         .read           = seq_read,
 347         .llseek         = seq_lseek,
 348         .release        = single_release,
 349 };
 350
 351 static int voice_setting_get(void *data, u64 *val)
 352 {
 353         struct hci_dev *hdev = data;
 354
 355         hci_dev_lock(hdev);
 356         *val = hdev->voice_setting;
 357         hci_dev_unlock(hdev);
 358
 359         return 0;
 360 }
 361
 362 DEFINE_SIMPLE_ATTRIBUTE(voice_setting_fops, voice_setting_get,
 363                         NULL, "0x%4.4llx\n");
 364
 365 static int auto_accept_delay_set(void *data, u64 val)
 366 {
 367         struct hci_dev *hdev = data;
 368
 369         hci_dev_lock(hdev);
 370         hdev->auto_accept_delay = val;
 371         hci_dev_unlock(hdev);
 372
 373         return 0;
 374 }
 375
 376 static int auto_accept_delay_get(void *data, u64 *val)
 377 {
 378         struct hci_dev *hdev = data;
 379
 380         hci_dev_lock(hdev);
 381         *val = hdev->auto_accept_delay;
 382         hci_dev_unlock(hdev);
 383
 384         return 0;
 385 }
 386
 387 DEFINE_SIMPLE_ATTRIBUTE(auto_accept_delay_fops, auto_accept_delay_get,
 388                         auto_accept_delay_set, "%llu\n");
 389
 390 static ssize_t force_sc_support_read(struct file *file, char __user *user_buf,
 391                                      size_t count, loff_t *ppos)
 392 {
 393         struct hci_dev *hdev = file->private_data;
 394         char buf[3];
 395
 396         buf[0] = test_bit(HCI_FORCE_SC, &hdev->dbg_flags) ? 'Y': 'N';
 397         buf[1] = '\n';
 398         buf[2] = '\0';
 399         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 400 }
 401
 402 static ssize_t force_sc_support_write(struct file *file,
 403                                       const char __user *user_buf,
 404                                       size_t count, loff_t *ppos)
 405 {
 406         struct hci_dev *hdev = file->private_data;
 407         char buf[32];
 408         size_t buf_size = min(count, (sizeof(buf)-1));
 409         bool enable;
 410
 411         if (test_bit(HCI_UP, &hdev->flags))
 412                 return -EBUSY;
 413
 414         if (copy_from_user(buf, user_buf, buf_size))
 415                 return -EFAULT;
 416
 417         buf[buf_size] = '\0';
 418         if (strtobool(buf, &enable))
 419                 return -EINVAL;
 420
 421         if (enable == test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
 422                 return -EALREADY;
 423
 424         change_bit(HCI_FORCE_SC, &hdev->dbg_flags);
 425
 426         return count;
 427 }
 428
 429 static const struct file_operations force_sc_support_fops = {
 430         .open           = simple_open,
 431         .read           = force_sc_support_read,
 432         .write          = force_sc_support_write,
 433         .llseek         = default_llseek,
 434 };
 435
 436 static ssize_t sc_only_mode_read(struct file *file, char __user *user_buf,
 437                                  size_t count, loff_t *ppos)
 438 {
 439         struct hci_dev *hdev = file->private_data;
 440         char buf[3];
 441
 442         buf[0] = test_bit(HCI_SC_ONLY, &hdev->dev_flags) ? 'Y': 'N';
 443         buf[1] = '\n';
 444         buf[2] = '\0';
 445         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 446 }
 447
 448 static const struct file_operations sc_only_mode_fops = {
 449         .open           = simple_open,
 450         .read           = sc_only_mode_read,
 451         .llseek         = default_llseek,
 452 };
 453
 454 static int idle_timeout_set(void *data, u64 val)
 455 {
 456         struct hci_dev *hdev = data;
 457
 458         if (val != 0 && (val < 500 || val > 3600000))
 459                 return -EINVAL;
 460
 461         hci_dev_lock(hdev);
 462         hdev->idle_timeout = val;
 463         hci_dev_unlock(hdev);
 464
 465         return 0;
 466 }
 467
 468 static int idle_timeout_get(void *data, u64 *val)
 469 {
 470         struct hci_dev *hdev = data;
 471
 472         hci_dev_lock(hdev);
 473         *val = hdev->idle_timeout;
 474         hci_dev_unlock(hdev);
 475
 476         return 0;
 477 }
 478
 479 DEFINE_SIMPLE_ATTRIBUTE(idle_timeout_fops, idle_timeout_get,
 480                         idle_timeout_set, "%llu\n");
 481
 482 static int rpa_timeout_set(void *data, u64 val)
 483 {
 484         struct hci_dev *hdev = data;
 485
 486         /* Require the RPA timeout to be at least 30 seconds and at most
 487          * 24 hours.
 488          */
 489         if (val < 30 || val > (60 * 60 * 24))
 490                 return -EINVAL;
 491
 492         hci_dev_lock(hdev);
 493         hdev->rpa_timeout = val;
 494         hci_dev_unlock(hdev);
 495
 496         return 0;
 497 }
 498
 499 static int rpa_timeout_get(void *data, u64 *val)
 500 {
 501         struct hci_dev *hdev = data;
 502
 503         hci_dev_lock(hdev);
 504         *val = hdev->rpa_timeout;
 505         hci_dev_unlock(hdev);
 506
 507         return 0;
 508 }
 509
 510 DEFINE_SIMPLE_ATTRIBUTE(rpa_timeout_fops, rpa_timeout_get,
 511                         rpa_timeout_set, "%llu\n");
 512
 513 static int sniff_min_interval_set(void *data, u64 val)
 514 {
 515         struct hci_dev *hdev = data;
 516
 517         if (val == 0 || val % 2 || val > hdev->sniff_max_interval)
 518                 return -EINVAL;
 519
 520         hci_dev_lock(hdev);
 521         hdev->sniff_min_interval = val;
 522         hci_dev_unlock(hdev);
 523
 524         return 0;
 525 }
 526
 527 static int sniff_min_interval_get(void *data, u64 *val)
 528 {
 529         struct hci_dev *hdev = data;
 530
 531         hci_dev_lock(hdev);
 532         *val = hdev->sniff_min_interval;
 533         hci_dev_unlock(hdev);
 534
 535         return 0;
 536 }
 537
 538 DEFINE_SIMPLE_ATTRIBUTE(sniff_min_interval_fops, sniff_min_interval_get,
 539                         sniff_min_interval_set, "%llu\n");
 540
 541 static int sniff_max_interval_set(void *data, u64 val)
 542 {
 543         struct hci_dev *hdev = data;
 544
 545         if (val == 0 || val % 2 || val < hdev->sniff_min_interval)
 546                 return -EINVAL;
 547
 548         hci_dev_lock(hdev);
 549         hdev->sniff_max_interval = val;
 550         hci_dev_unlock(hdev);
 551
 552         return 0;
 553 }
 554
 555 static int sniff_max_interval_get(void *data, u64 *val)
 556 {
 557         struct hci_dev *hdev = data;
 558
 559         hci_dev_lock(hdev);
 560         *val = hdev->sniff_max_interval;
 561         hci_dev_unlock(hdev);
 562
 563         return 0;
 564 }
 565
 566 DEFINE_SIMPLE_ATTRIBUTE(sniff_max_interval_fops, sniff_max_interval_get,
 567                         sniff_max_interval_set, "%llu\n");
 568
 569 static int conn_info_min_age_set(void *data, u64 val)
 570 {
 571         struct hci_dev *hdev = data;
 572
 573         if (val == 0 || val > hdev->conn_info_max_age)
 574                 return -EINVAL;
 575
 576         hci_dev_lock(hdev);
 577         hdev->conn_info_min_age = val;
 578         hci_dev_unlock(hdev);
 579
 580         return 0;
 581 }
 582
 583 static int conn_info_min_age_get(void *data, u64 *val)
 584 {
 585         struct hci_dev *hdev = data;
 586
 587         hci_dev_lock(hdev);
 588         *val = hdev->conn_info_min_age;
 589         hci_dev_unlock(hdev);
 590
 591         return 0;
 592 }
 593
 594 DEFINE_SIMPLE_ATTRIBUTE(conn_info_min_age_fops, conn_info_min_age_get,
 595                         conn_info_min_age_set, "%llu\n");
 596
 597 static int conn_info_max_age_set(void *data, u64 val)
 598 {
 599         struct hci_dev *hdev = data;
 600
 601         if (val == 0 || val < hdev->conn_info_min_age)
 602                 return -EINVAL;
 603
 604         hci_dev_lock(hdev);
 605         hdev->conn_info_max_age = val;
 606         hci_dev_unlock(hdev);
 607
 608         return 0;
 609 }
 610
 611 static int conn_info_max_age_get(void *data, u64 *val)
 612 {
 613         struct hci_dev *hdev = data;
 614
 615         hci_dev_lock(hdev);
 616         *val = hdev->conn_info_max_age;
 617         hci_dev_unlock(hdev);
 618
 619         return 0;
 620 }
 621
 622 DEFINE_SIMPLE_ATTRIBUTE(conn_info_max_age_fops, conn_info_max_age_get,
 623                         conn_info_max_age_set, "%llu\n");
 624
 625 static int identity_show(struct seq_file *f, void *p)
 626 {
 627         struct hci_dev *hdev = f->private;
 628         bdaddr_t addr;
 629         u8 addr_type;
 630
 631         hci_dev_lock(hdev);
 632
 633         hci_copy_identity_address(hdev, &addr, &addr_type);
 634
 635         seq_printf(f, "%pMR (type %u) %*phN %pMR\n", &addr, addr_type,
 636                    16, hdev->irk, &hdev->rpa);
 637
 638         hci_dev_unlock(hdev);
 639
 640         return 0;
 641 }
 642
 643 static int identity_open(struct inode *inode, struct file *file)
 644 {
 645         return single_open(file, identity_show, inode->i_private);
 646 }
 647
 648 static const struct file_operations identity_fops = {
 649         .open           = identity_open,
 650         .read           = seq_read,
 651         .llseek         = seq_lseek,
 652         .release        = single_release,
 653 };
 654
 655 static int random_address_show(struct seq_file *f, void *p)
 656 {
 657         struct hci_dev *hdev = f->private;
 658
 659         hci_dev_lock(hdev);
 660         seq_printf(f, "%pMR\n", &hdev->random_addr);
 661         hci_dev_unlock(hdev);
 662
 663         return 0;
 664 }
 665
 666 static int random_address_open(struct inode *inode, struct file *file)
 667 {
 668         return single_open(file, random_address_show, inode->i_private);
 669 }
 670
 671 static const struct file_operations random_address_fops = {
 672         .open           = random_address_open,
 673         .read           = seq_read,
 674         .llseek         = seq_lseek,
 675         .release        = single_release,
 676 };
 677
 678 static int static_address_show(struct seq_file *f, void *p)
 679 {
 680         struct hci_dev *hdev = f->private;
 681
 682         hci_dev_lock(hdev);
 683         seq_printf(f, "%pMR\n", &hdev->static_addr);
 684         hci_dev_unlock(hdev);
 685
 686         return 0;
 687 }
 688
 689 static int static_address_open(struct inode *inode, struct file *file)
 690 {
 691         return single_open(file, static_address_show, inode->i_private);
 692 }
 693
 694 static const struct file_operations static_address_fops = {
 695         .open           = static_address_open,
 696         .read           = seq_read,
 697         .llseek         = seq_lseek,
 698         .release        = single_release,
 699 };
 700
 701 static ssize_t force_static_address_read(struct file *file,
 702                                          char __user *user_buf,
 703                                          size_t count, loff_t *ppos)
 704 {
 705         struct hci_dev *hdev = file->private_data;
 706         char buf[3];
 707
 708         buf[0] = test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ? 'Y': 'N';
 709         buf[1] = '\n';
 710         buf[2] = '\0';
 711         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 712 }
 713
 714 static ssize_t force_static_address_write(struct file *file,
 715                                           const char __user *user_buf,
 716                                           size_t count, loff_t *ppos)
 717 {
 718         struct hci_dev *hdev = file->private_data;
 719         char buf[32];
 720         size_t buf_size = min(count, (sizeof(buf)-1));
 721         bool enable;
 722
 723         if (test_bit(HCI_UP, &hdev->flags))
 724                 return -EBUSY;
 725
 726         if (copy_from_user(buf, user_buf, buf_size))
 727                 return -EFAULT;
 728
 729         buf[buf_size] = '\0';
 730         if (strtobool(buf, &enable))
 731                 return -EINVAL;
 732
 733         if (enable == test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags))
 734                 return -EALREADY;
 735
 736         change_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags);
 737
 738         return count;
 739 }
 740
 741 static const struct file_operations force_static_address_fops = {
 742         .open           = simple_open,
 743         .read           = force_static_address_read,
 744         .write          = force_static_address_write,
 745         .llseek         = default_llseek,
 746 };
 747
 748 static int white_list_show(struct seq_file *f, void *ptr)
 749 {
 750         struct hci_dev *hdev = f->private;
 751         struct bdaddr_list *b;
 752
 753         hci_dev_lock(hdev);
 754         list_for_each_entry(b, &hdev->le_white_list, list)
 755                 seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
 756         hci_dev_unlock(hdev);
 757
 758         return 0;
 759 }
 760
 761 static int white_list_open(struct inode *inode, struct file *file)
 762 {
 763         return single_open(file, white_list_show, inode->i_private);
 764 }
 765
 766 static const struct file_operations white_list_fops = {
 767         .open           = white_list_open,
 768         .read           = seq_read,
 769         .llseek         = seq_lseek,
 770         .release        = single_release,
 771 };
 772
 773 static int identity_resolving_keys_show(struct seq_file *f, void *ptr)
 774 {
 775         struct hci_dev *hdev = f->private;
 776         struct list_head *p, *n;
 777
 778         hci_dev_lock(hdev);
 779         list_for_each_safe(p, n, &hdev->identity_resolving_keys) {
 780                 struct smp_irk *irk = list_entry(p, struct smp_irk, list);
 781                 seq_printf(f, "%pMR (type %u) %*phN %pMR\n",
 782                            &irk->bdaddr, irk->addr_type,
 783                            16, irk->val, &irk->rpa);
 784         }
 785         hci_dev_unlock(hdev);
 786
 787         return 0;
 788 }
 789
 790 static int identity_resolving_keys_open(struct inode *inode, struct file *file)
 791 {
 792         return single_open(file, identity_resolving_keys_show,
 793                            inode->i_private);
 794 }
 795
 796 static const struct file_operations identity_resolving_keys_fops = {
 797         .open           = identity_resolving_keys_open,
 798         .read           = seq_read,
 799         .llseek         = seq_lseek,
 800         .release        = single_release,
 801 };
 802
 803 static int long_term_keys_show(struct seq_file *f, void *ptr)
 804 {
 805         struct hci_dev *hdev = f->private;
 806         struct list_head *p, *n;
 807
 808         hci_dev_lock(hdev);
 809         list_for_each_safe(p, n, &hdev->long_term_keys) {
 810                 struct smp_ltk *ltk = list_entry(p, struct smp_ltk, list);
 811                 seq_printf(f, "%pMR (type %u) %u 0x%02x %u %.4x %.16llx %*phN\n",
 812                            &ltk->bdaddr, ltk->bdaddr_type, ltk->authenticated,
 813                            ltk->type, ltk->enc_size, __le16_to_cpu(ltk->ediv),
 814                            __le64_to_cpu(ltk->rand), 16, ltk->val);
 815         }
 816         hci_dev_unlock(hdev);
 817
 818         return 0;
 819 }
 820
 821 static int long_term_keys_open(struct inode *inode, struct file *file)
 822 {
 823         return single_open(file, long_term_keys_show, inode->i_private);
 824 }
 825
 826 static const struct file_operations long_term_keys_fops = {
 827         .open           = long_term_keys_open,
 828         .read           = seq_read,
 829         .llseek         = seq_lseek,
 830         .release        = single_release,
 831 };
 832
 833 static int conn_min_interval_set(void *data, u64 val)
 834 {
 835         struct hci_dev *hdev = data;
 836
 837         if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval)
 838                 return -EINVAL;
 839
 840         hci_dev_lock(hdev);
 841         hdev->le_conn_min_interval = val;
 842         hci_dev_unlock(hdev);
 843
 844         return 0;
 845 }
 846
 847 static int conn_min_interval_get(void *data, u64 *val)
 848 {
 849         struct hci_dev *hdev = data;
 850
 851         hci_dev_lock(hdev);
 852         *val = hdev->le_conn_min_interval;
 853         hci_dev_unlock(hdev);
 854
 855         return 0;
 856 }
 857
 858 DEFINE_SIMPLE_ATTRIBUTE(conn_min_interval_fops, conn_min_interval_get,
 859                         conn_min_interval_set, "%llu\n");
 860
 861 static int conn_max_interval_set(void *data, u64 val)
 862 {
 863         struct hci_dev *hdev = data;
 864
 865         if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval)
 866                 return -EINVAL;
 867
 868         hci_dev_lock(hdev);
 869         hdev->le_conn_max_interval = val;
 870         hci_dev_unlock(hdev);
 871
 872         return 0;
 873 }
 874
 875 static int conn_max_interval_get(void *data, u64 *val)
 876 {
 877         struct hci_dev *hdev = data;
 878
 879         hci_dev_lock(hdev);
 880         *val = hdev->le_conn_max_interval;
 881         hci_dev_unlock(hdev);
 882
 883         return 0;
 884 }
 885
 886 DEFINE_SIMPLE_ATTRIBUTE(conn_max_interval_fops, conn_max_interval_get,
 887                         conn_max_interval_set, "%llu\n");
 888
 889 static int conn_latency_set(void *data, u64 val)
 890 {
 891         struct hci_dev *hdev = data;
 892
 893         if (val > 0x01f3)
 894                 return -EINVAL;
 895
 896         hci_dev_lock(hdev);
 897         hdev->le_conn_latency = val;
 898         hci_dev_unlock(hdev);
 899
 900         return 0;
 901 }
 902
 903 static int conn_latency_get(void *data, u64 *val)
 904 {
 905         struct hci_dev *hdev = data;
 906
 907         hci_dev_lock(hdev);
 908         *val = hdev->le_conn_latency;
 909         hci_dev_unlock(hdev);
 910
 911         return 0;
 912 }
 913
 914 DEFINE_SIMPLE_ATTRIBUTE(conn_latency_fops, conn_latency_get,
 915                         conn_latency_set, "%llu\n");
 916
 917 static int supervision_timeout_set(void *data, u64 val)
 918 {
 919         struct hci_dev *hdev = data;
 920
 921         if (val < 0x000a || val > 0x0c80)
 922                 return -EINVAL;
 923
 924         hci_dev_lock(hdev);
 925         hdev->le_supv_timeout = val;
 926         hci_dev_unlock(hdev);
 927
 928         return 0;
 929 }
 930
 931 static int supervision_timeout_get(void *data, u64 *val)
 932 {
 933         struct hci_dev *hdev = data;
 934
 935         hci_dev_lock(hdev);
 936         *val = hdev->le_supv_timeout;
 937         hci_dev_unlock(hdev);
 938
 939         return 0;
 940 }
 941
 942 DEFINE_SIMPLE_ATTRIBUTE(supervision_timeout_fops, supervision_timeout_get,
 943                         supervision_timeout_set, "%llu\n");
 944
 945 static int adv_channel_map_set(void *data, u64 val)
 946 {
 947         struct hci_dev *hdev = data;
 948
 949         if (val < 0x01 || val > 0x07)
 950                 return -EINVAL;
 951
 952         hci_dev_lock(hdev);
 953         hdev->le_adv_channel_map = val;
 954         hci_dev_unlock(hdev);
 955
 956         return 0;
 957 }
 958
 959 static int adv_channel_map_get(void *data, u64 *val)
 960 {
 961         struct hci_dev *hdev = data;
 962
 963         hci_dev_lock(hdev);
 964         *val = hdev->le_adv_channel_map;
 965         hci_dev_unlock(hdev);
 966
 967         return 0;
 968 }
 969
 970 DEFINE_SIMPLE_ATTRIBUTE(adv_channel_map_fops, adv_channel_map_get,
 971                         adv_channel_map_set, "%llu\n");
 972
 973 static int adv_min_interval_set(void *data, u64 val)
 974 {
 975         struct hci_dev *hdev = data;
 976
 977         if (val < 0x0020 || val > 0x4000 || val > hdev->le_adv_max_interval)
 978                 return -EINVAL;
 979
 980         hci_dev_lock(hdev);
 981         hdev->le_adv_min_interval = val;
 982         hci_dev_unlock(hdev);
 983
 984         return 0;
 985 }
 986
 987 static int adv_min_interval_get(void *data, u64 *val)
 988 {
 989         struct hci_dev *hdev = data;
 990
 991         hci_dev_lock(hdev);
 992         *val = hdev->le_adv_min_interval;
 993         hci_dev_unlock(hdev);
 994
 995         return 0;
 996 }
 997
 998 DEFINE_SIMPLE_ATTRIBUTE(adv_min_interval_fops, adv_min_interval_get,
 999                         adv_min_interval_set, "%llu\n");
1000
1001 static int adv_max_interval_set(void *data, u64 val)
1002 {
1003         struct hci_dev *hdev = data;
1004
1005         if (val < 0x0020 || val > 0x4000 || val < hdev->le_adv_min_interval)
1006                 return -EINVAL;
1007
1008         hci_dev_lock(hdev);
1009         hdev->le_adv_max_interval = val;
1010         hci_dev_unlock(hdev);
1011
1012         return 0;
1013 }
1014
1015 static int adv_max_interval_get(void *data, u64 *val)
1016 {
1017         struct hci_dev *hdev = data;
1018
1019         hci_dev_lock(hdev);
1020         *val = hdev->le_adv_max_interval;
1021         hci_dev_unlock(hdev);
1022
1023         return 0;
1024 }
1025
1026 DEFINE_SIMPLE_ATTRIBUTE(adv_max_interval_fops, adv_max_interval_get,
1027                         adv_max_interval_set, "%llu\n");
1028
1029 static int device_list_show(struct seq_file *f, void *ptr)
1030 {
1031         struct hci_dev *hdev = f->private;
1032         struct hci_conn_params *p;
1033
1034         hci_dev_lock(hdev);
1035         list_for_each_entry(p, &hdev->le_conn_params, list) {
1036                 seq_printf(f, "%pMR %u %u\n", &p->addr, p->addr_type,
1037                            p->auto_connect);
1038         }
1039         hci_dev_unlock(hdev);
1040
1041         return 0;
1042 }
1043
1044 static int device_list_open(struct inode *inode, struct file *file)
1045 {
1046         return single_open(file, device_list_show, inode->i_private);
1047 }
1048
1049 static const struct file_operations device_list_fops = {
1050         .open           = device_list_open,
1051         .read           = seq_read,
1052         .llseek         = seq_lseek,
1053         .release        = single_release,
1054 };
1055
1056 /* ---- HCI requests ---- */
1057
1058 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
1059 {
1060         BT_DBG("%s result 0x%2.2x", hdev->name, result);
1061
1062         if (hdev->req_status == HCI_REQ_PEND) {
1063                 hdev->req_result = result;
1064                 hdev->req_status = HCI_REQ_DONE;
1065                 wake_up_interruptible(&hdev->req_wait_q);
1066         }
1067 }
1068
1069 static void hci_req_cancel(struct hci_dev *hdev, int err)
1070 {
1071         BT_DBG("%s err 0x%2.2x", hdev->name, err);
1072
1073         if (hdev->req_status == HCI_REQ_PEND) {
1074                 hdev->req_result = err;
1075                 hdev->req_status = HCI_REQ_CANCELED;
1076                 wake_up_interruptible(&hdev->req_wait_q);
1077         }
1078 }
1079
1080 static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
1081                                             u8 event)
1082 {
1083         struct hci_ev_cmd_complete *ev;
1084         struct hci_event_hdr *hdr;
1085         struct sk_buff *skb;
1086
1087         hci_dev_lock(hdev);
1088
1089         skb = hdev->recv_evt;
1090         hdev->recv_evt = NULL;
1091
1092         hci_dev_unlock(hdev);
1093
1094         if (!skb)
1095                 return ERR_PTR(-ENODATA);
1096
1097         if (skb->len < sizeof(*hdr)) {
1098                 BT_ERR("Too short HCI event");
1099                 goto failed;
1100         }
1101
1102         hdr = (void *) skb->data;
1103         skb_pull(skb, HCI_EVENT_HDR_SIZE);
1104
1105         if (event) {
1106                 if (hdr->evt != event)
1107                         goto failed;
1108                 return skb;
1109         }
1110
1111         if (hdr->evt != HCI_EV_CMD_COMPLETE) {
1112                 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
1113                 goto failed;
1114         }
1115
1116         if (skb->len < sizeof(*ev)) {
1117                 BT_ERR("Too short cmd_complete event");
1118                 goto failed;
1119         }
1120
1121         ev = (void *) skb->data;
1122         skb_pull(skb, sizeof(*ev));
1123
1124         if (opcode == __le16_to_cpu(ev->opcode))
1125                 return skb;
1126
1127         BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
1128                __le16_to_cpu(ev->opcode));
1129
1130 failed:
1131         kfree_skb(skb);
1132         return ERR_PTR(-ENODATA);
1133 }
1134
1135 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
1136                                   const void *param, u8 event, u32 timeout)
1137 {
1138         DECLARE_WAITQUEUE(wait, current);
1139         struct hci_request req;
1140         int err = 0;
1141
1142         BT_DBG("%s", hdev->name);
1143
1144         hci_req_init(&req, hdev);
1145
1146         hci_req_add_ev(&req, opcode, plen, param, event);
1147
1148         hdev->req_status = HCI_REQ_PEND;
1149
1150         err = hci_req_run(&req, hci_req_sync_complete);
1151         if (err < 0)
1152                 return ERR_PTR(err);
1153
1154         add_wait_queue(&hdev->req_wait_q, &wait);
1155         set_current_state(TASK_INTERRUPTIBLE);
1156
1157         schedule_timeout(timeout);
1158
1159         remove_wait_queue(&hdev->req_wait_q, &wait);
1160
1161         if (signal_pending(current))
1162                 return ERR_PTR(-EINTR);
1163
1164         switch (hdev->req_status) {
1165         case HCI_REQ_DONE:
1166                 err = -bt_to_errno(hdev->req_result);
1167                 break;
1168
1169         case HCI_REQ_CANCELED:
1170                 err = -hdev->req_result;
1171                 break;
1172
1173         default:
1174                 err = -ETIMEDOUT;
1175                 break;
1176         }
1177
1178         hdev->req_status = hdev->req_result = 0;
1179
1180         BT_DBG("%s end: err %d", hdev->name, err);
1181
1182         if (err < 0)
1183                 return ERR_PTR(err);
1184
1185         return hci_get_cmd_complete(hdev, opcode, event);
1186 }
1187 EXPORT_SYMBOL(__hci_cmd_sync_ev);
1188
1189 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
1190                                const void *param, u32 timeout)
1191 {
1192         return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
1193 }
1194 EXPORT_SYMBOL(__hci_cmd_sync);
1195
1196 /* Execute request and wait for completion. */
1197 static int __hci_req_sync(struct hci_dev *hdev,
1198                           void (*func)(struct hci_request *req,
1199                                       unsigned long opt),
1200                           unsigned long opt, __u32 timeout)
1201 {
1202         struct hci_request req;
1203         DECLARE_WAITQUEUE(wait, current);
1204         int err = 0;
1205
1206         BT_DBG("%s start", hdev->name);
1207
1208         hci_req_init(&req, hdev);
1209
1210         hdev->req_status = HCI_REQ_PEND;
1211
1212         func(&req, opt);
1213
1214         err = hci_req_run(&req, hci_req_sync_complete);
1215         if (err < 0) {
1216                 hdev->req_status = 0;
1217
1218                 /* ENODATA means the HCI request command queue is empty.
1219                  * This can happen when a request with conditionals doesn't
1220                  * trigger any commands to be sent. This is normal behavior
1221                  * and should not trigger an error return.
1222                  */
1223                 if (err == -ENODATA)
1224                         return 0;
1225
1226                 return err;
1227         }
1228
1229         add_wait_queue(&hdev->req_wait_q, &wait);
1230         set_current_state(TASK_INTERRUPTIBLE);
1231
1232         schedule_timeout(timeout);
1233
1234         remove_wait_queue(&hdev->req_wait_q, &wait);
1235
1236         if (signal_pending(current))
1237                 return -EINTR;
1238
1239         switch (hdev->req_status) {
1240         case HCI_REQ_DONE:
1241                 err = -bt_to_errno(hdev->req_result);
1242                 break;
1243
1244         case HCI_REQ_CANCELED:
1245                 err = -hdev->req_result;
1246                 break;
1247
1248         default:
1249                 err = -ETIMEDOUT;
1250                 break;
1251         }
1252
1253         hdev->req_status = hdev->req_result = 0;
1254
1255         BT_DBG("%s end: err %d", hdev->name, err);
1256
1257         return err;
1258 }
1259
1260 static int hci_req_sync(struct hci_dev *hdev,
1261                         void (*req)(struct hci_request *req,
1262                                     unsigned long opt),
1263                         unsigned long opt, __u32 timeout)
1264 {
1265         int ret;
1266
1267         if (!test_bit(HCI_UP, &hdev->flags))
1268                 return -ENETDOWN;
1269
1270         /* Serialize all requests */
1271         hci_req_lock(hdev);
1272         ret = __hci_req_sync(hdev, req, opt, timeout);
1273         hci_req_unlock(hdev);
1274
1275         return ret;
1276 }
1277
1278 static void hci_reset_req(struct hci_request *req, unsigned long opt)
1279 {
1280         BT_DBG("%s %ld", req->hdev->name, opt);
1281
1282         /* Reset device */
1283         set_bit(HCI_RESET, &req->hdev->flags);
1284         hci_req_add(req, HCI_OP_RESET, 0, NULL);
1285 }
1286
1287 static void bredr_init(struct hci_request *req)
1288 {
1289         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
1290
1291         /* Read Local Supported Features */
1292         hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1293
1294         /* Read Local Version */
1295         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1296
1297         /* Read BD Address */
1298         hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1299 }
1300
1301 static void amp_init(struct hci_request *req)
1302 {
1303         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
1304
1305         /* Read Local Version */
1306         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1307
1308         /* Read Local Supported Commands */
1309         hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
1310
1311         /* Read Local Supported Features */
1312         hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1313
1314         /* Read Local AMP Info */
1315         hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
1316
1317         /* Read Data Blk size */
1318         hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
1319
1320         /* Read Flow Control Mode */
1321         hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
1322
1323         /* Read Location Data */
1324         hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
1325 }
1326
1327 static void hci_init1_req(struct hci_request *req, unsigned long opt)
1328 {
1329         struct hci_dev *hdev = req->hdev;
1330
1331         BT_DBG("%s %ld", hdev->name, opt);
1332
1333         /* Reset */
1334         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
1335                 hci_reset_req(req, 0);
1336
1337         switch (hdev->dev_type) {
1338         case HCI_BREDR:
1339                 bredr_init(req);
1340                 break;
1341
1342         case HCI_AMP:
1343                 amp_init(req);
1344                 break;
1345
1346         default:
1347                 BT_ERR("Unknown device type %d", hdev->dev_type);
1348                 break;
1349         }
1350 }
1351
1352 static void bredr_setup(struct hci_request *req)
1353 {
1354         struct hci_dev *hdev = req->hdev;
1355
1356         __le16 param;
1357         __u8 flt_type;
1358
1359         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
1360         hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1361
1362         /* Read Class of Device */
1363         hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
1364
1365         /* Read Local Name */
1366         hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1367
1368         /* Read Voice Setting */
1369         hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1370
1371         /* Read Number of Supported IAC */
1372         hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
1373
1374         /* Read Current IAC LAP */
1375         hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
1376
1377         /* Clear Event Filters */
1378         flt_type = HCI_FLT_CLEAR_ALL;
1379         hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1380
1381         /* Connection accept timeout ~20 secs */
1382         param = cpu_to_le16(0x7d00);
1383         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
1384
1385         /* AVM Berlin (31), aka "BlueFRITZ!", reports version 1.2,
1386          * but it does not support page scan related HCI commands.
1387          */
1388         if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1) {
1389                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
1390                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
1391         }
1392 }
1393
1394 static void le_setup(struct hci_request *req)
1395 {
1396         struct hci_dev *hdev = req->hdev;
1397
1398         /* Read LE Buffer Size */
1399         hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
1400
1401         /* Read LE Local Supported Features */
1402         hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
1403
1404         /* Read LE Supported States */
1405         hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
1406
1407         /* Read LE White List Size */
1408         hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
1409
1410         /* Clear LE White List */
1411         hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
1412
1413         /* LE-only controllers have LE implicitly enabled */
1414         if (!lmp_bredr_capable(hdev))
1415                 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1416 }
1417
1418 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
1419 {
1420         if (lmp_ext_inq_capable(hdev))
1421                 return 0x02;
1422
1423         if (lmp_inq_rssi_capable(hdev))
1424                 return 0x01;
1425
1426         if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
1427             hdev->lmp_subver == 0x0757)
1428                 return 0x01;
1429
1430         if (hdev->manufacturer == 15) {
1431                 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
1432                         return 0x01;
1433                 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
1434                         return 0x01;
1435                 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
1436                         return 0x01;
1437         }
1438
1439         if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
1440             hdev->lmp_subver == 0x1805)
1441                 return 0x01;
1442
1443         return 0x00;
1444 }
1445
1446 static void hci_setup_inquiry_mode(struct hci_request *req)
1447 {
1448         u8 mode;
1449
1450         mode = hci_get_inquiry_mode(req->hdev);
1451
1452         hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
1453 }
1454
1455 static void hci_setup_event_mask(struct hci_request *req)
1456 {
1457         struct hci_dev *hdev = req->hdev;
1458
1459         /* The second byte is 0xff instead of 0x9f (two reserved bits
1460          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
1461          * command otherwise.
1462          */
1463         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
1464
1465         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
1466          * any event mask for pre 1.2 devices.
1467          */
1468         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
1469                 return;
1470
1471         if (lmp_bredr_capable(hdev)) {
1472                 events[4] |= 0x01; /* Flow Specification Complete */
1473                 events[4] |= 0x02; /* Inquiry Result with RSSI */
1474                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
1475                 events[5] |= 0x08; /* Synchronous Connection Complete */
1476                 events[5] |= 0x10; /* Synchronous Connection Changed */
1477         } else {
1478                 /* Use a different default for LE-only devices */
1479                 memset(events, 0, sizeof(events));
1480                 events[0] |= 0x10; /* Disconnection Complete */
1481                 events[1] |= 0x08; /* Read Remote Version Information Complete */
1482                 events[1] |= 0x20; /* Command Complete */
1483                 events[1] |= 0x40; /* Command Status */
1484                 events[1] |= 0x80; /* Hardware Error */
1485                 events[2] |= 0x04; /* Number of Completed Packets */
1486                 events[3] |= 0x02; /* Data Buffer Overflow */
1487
1488                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
1489                         events[0] |= 0x80; /* Encryption Change */
1490                         events[5] |= 0x80; /* Encryption Key Refresh Complete */
1491                 }
1492         }
1493
1494         if (lmp_inq_rssi_capable(hdev))
1495                 events[4] |= 0x02; /* Inquiry Result with RSSI */
1496
1497         if (lmp_sniffsubr_capable(hdev))
1498                 events[5] |= 0x20; /* Sniff Subrating */
1499
1500         if (lmp_pause_enc_capable(hdev))
1501                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
1502
1503         if (lmp_ext_inq_capable(hdev))
1504                 events[5] |= 0x40; /* Extended Inquiry Result */
1505
1506         if (lmp_no_flush_capable(hdev))
1507                 events[7] |= 0x01; /* Enhanced Flush Complete */
1508
1509         if (lmp_lsto_capable(hdev))
1510                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
1511
1512         if (lmp_ssp_capable(hdev)) {
1513                 events[6] |= 0x01;      /* IO Capability Request */
1514                 events[6] |= 0x02;      /* IO Capability Response */
1515                 events[6] |= 0x04;      /* User Confirmation Request */
1516                 events[6] |= 0x08;      /* User Passkey Request */
1517                 events[6] |= 0x10;      /* Remote OOB Data Request */
1518                 events[6] |= 0x20;      /* Simple Pairing Complete */
1519                 events[7] |= 0x04;      /* User Passkey Notification */
1520                 events[7] |= 0x08;      /* Keypress Notification */
1521                 events[7] |= 0x10;      /* Remote Host Supported
1522                                          * Features Notification
1523                                          */
1524         }
1525
1526         if (lmp_le_capable(hdev))
1527                 events[7] |= 0x20;      /* LE Meta-Event */
1528
1529         hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
1530 }
1531
1532 static void hci_init2_req(struct hci_request *req, unsigned long opt)
1533 {
1534         struct hci_dev *hdev = req->hdev;
1535
1536         if (lmp_bredr_capable(hdev))
1537                 bredr_setup(req);
1538         else
1539                 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
1540
1541         if (lmp_le_capable(hdev))
1542                 le_setup(req);
1543
1544         /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
1545          * local supported commands HCI command.
1546          */
1547         if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
1548                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
1549
1550         if (lmp_ssp_capable(hdev)) {
1551                 /* When SSP is available, then the host features page
1552                  * should also be available as well. However some
1553                  * controllers list the max_page as 0 as long as SSP
1554                  * has not been enabled. To achieve proper debugging
1555                  * output, force the minimum max_page to 1 at least.
1556                  */
1557                 hdev->max_page = 0x01;
1558
1559                 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
1560                         u8 mode = 0x01;
1561                         hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
1562                                     sizeof(mode), &mode);
1563                 } else {
1564                         struct hci_cp_write_eir cp;
1565
1566                         memset(hdev->eir, 0, sizeof(hdev->eir));
1567                         memset(&cp, 0, sizeof(cp));
1568
1569                         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1570                 }
1571         }
1572
1573         if (lmp_inq_rssi_capable(hdev))
1574                 hci_setup_inquiry_mode(req);
1575
1576         if (lmp_inq_tx_pwr_capable(hdev))
1577                 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
1578
1579         if (lmp_ext_feat_capable(hdev)) {
1580                 struct hci_cp_read_local_ext_features cp;
1581
1582                 cp.page = 0x01;
1583                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
1584                             sizeof(cp), &cp);
1585         }
1586
1587         if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
1588                 u8 enable = 1;
1589                 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
1590                             &enable);
1591         }
1592 }
1593
1594 static void hci_setup_link_policy(struct hci_request *req)
1595 {
1596         struct hci_dev *hdev = req->hdev;
1597         struct hci_cp_write_def_link_policy cp;
1598         u16 link_policy = 0;
1599
1600         if (lmp_rswitch_capable(hdev))
1601                 link_policy |= HCI_LP_RSWITCH;
1602         if (lmp_hold_capable(hdev))
1603                 link_policy |= HCI_LP_HOLD;
1604         if (lmp_sniff_capable(hdev))
1605                 link_policy |= HCI_LP_SNIFF;
1606         if (lmp_park_capable(hdev))
1607                 link_policy |= HCI_LP_PARK;
1608
1609         cp.policy = cpu_to_le16(link_policy);
1610         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
1611 }
1612
1613 static void hci_set_le_support(struct hci_request *req)
1614 {
1615         struct hci_dev *hdev = req->hdev;
1616         struct hci_cp_write_le_host_supported cp;
1617
1618         /* LE-only devices do not support explicit enablement */
1619         if (!lmp_bredr_capable(hdev))
1620                 return;
1621
1622         memset(&cp, 0, sizeof(cp));
1623
1624         if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
1625                 cp.le = 0x01;
1626                 cp.simul = 0x00;
1627         }
1628
1629         if (cp.le != lmp_host_le_capable(hdev))
1630                 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
1631                             &cp);
1632 }
1633
1634 static void hci_set_event_mask_page_2(struct hci_request *req)
1635 {
1636         struct hci_dev *hdev = req->hdev;
1637         u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
1638
1639         /* If Connectionless Slave Broadcast master role is supported
1640          * enable all necessary events for it.
1641          */
1642         if (lmp_csb_master_capable(hdev)) {
1643                 events[1] |= 0x40;      /* Triggered Clock Capture */
1644                 events[1] |= 0x80;      /* Synchronization Train Complete */
1645                 events[2] |= 0x10;      /* Slave Page Response Timeout */
1646                 events[2] |= 0x20;      /* CSB Channel Map Change */
1647         }
1648
1649         /* If Connectionless Slave Broadcast slave role is supported
1650          * enable all necessary events for it.
1651          */
1652         if (lmp_csb_slave_capable(hdev)) {
1653                 events[2] |= 0x01;      /* Synchronization Train Received */
1654                 events[2] |= 0x02;      /* CSB Receive */
1655                 events[2] |= 0x04;      /* CSB Timeout */
1656                 events[2] |= 0x08;      /* Truncated Page Complete */
1657         }
1658
1659         /* Enable Authenticated Payload Timeout Expired event if supported */
1660         if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
1661                 events[2] |= 0x80;
1662
1663         hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
1664 }
1665
1666 static void hci_init3_req(struct hci_request *req, unsigned long opt)
1667 {
1668         struct hci_dev *hdev = req->hdev;
1669         u8 p;
1670
1671         hci_setup_event_mask(req);
1672
1673         /* Some Broadcom based Bluetooth controllers do not support the
1674          * Delete Stored Link Key command. They are clearly indicating its
1675          * absence in the bit mask of supported commands.
1676          *
1677          * Check the supported commands and only if the the command is marked
1678          * as supported send it. If not supported assume that the controller
1679          * does not have actual support for stored link keys which makes this
1680          * command redundant anyway.
1681          *
1682          * Some controllers indicate that they support handling deleting
1683          * stored link keys, but they don't. The quirk lets a driver
1684          * just disable this command.
1685          */
1686         if (hdev->commands[6] & 0x80 &&
1687             !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
1688                 struct hci_cp_delete_stored_link_key cp;
1689
1690                 bacpy(&cp.bdaddr, BDADDR_ANY);
1691                 cp.delete_all = 0x01;
1692                 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
1693                             sizeof(cp), &cp);
1694         }
1695
1696         if (hdev->commands[5] & 0x10)
1697                 hci_setup_link_policy(req);
1698
1699         if (lmp_le_capable(hdev)) {
1700                 u8 events[8];
1701
1702                 memset(events, 0, sizeof(events));
1703                 events[0] = 0x0f;
1704
1705                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
1706                         events[0] |= 0x10;      /* LE Long Term Key Request */
1707
1708                 /* If controller supports the Connection Parameters Request
1709                  * Link Layer Procedure, enable the corresponding event.
1710                  */
1711                 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
1712                         events[0] |= 0x20;      /* LE Remote Connection
1713                                                  * Parameter Request
1714                                                  */
1715
1716                 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
1717                             events);
1718
1719                 if (hdev->commands[25] & 0x40) {
1720                         /* Read LE Advertising Channel TX Power */
1721                         hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
1722                 }
1723
1724                 hci_set_le_support(req);
1725         }
1726
1727         /* Read features beyond page 1 if available */
1728         for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
1729                 struct hci_cp_read_local_ext_features cp;
1730
1731                 cp.page = p;
1732                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
1733                             sizeof(cp), &cp);
1734         }
1735 }
1736
1737 static void hci_init4_req(struct hci_request *req, unsigned long opt)
1738 {
1739         struct hci_dev *hdev = req->hdev;
1740
1741         /* Set event mask page 2 if the HCI command for it is supported */
1742         if (hdev->commands[22] & 0x04)
1743                 hci_set_event_mask_page_2(req);
1744
1745         /* Read local codec list if the HCI command is supported */
1746         if (hdev->commands[29] & 0x20)
1747                 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
1748
1749         /* Get MWS transport configuration if the HCI command is supported */
1750         if (hdev->commands[30] & 0x08)
1751                 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
1752
1753         /* Check for Synchronization Train support */
1754         if (lmp_sync_train_capable(hdev))
1755                 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
1756
1757         /* Enable Secure Connections if supported and configured */
1758         if ((lmp_sc_capable(hdev) ||
1759              test_bit(HCI_FORCE_SC, &hdev->dbg_flags)) &&
1760             test_bit(HCI_SC_ENABLED, &hdev->dev_flags)) {
1761                 u8 support = 0x01;
1762                 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
1763                             sizeof(support), &support);
1764         }
1765 }
1766
1767 static int __hci_init(struct hci_dev *hdev)
1768 {
1769         int err;
1770
1771         err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
1772         if (err < 0)
1773                 return err;
1774
1775         /* The Device Under Test (DUT) mode is special and available for
1776          * all controller types. So just create it early on.
1777          */
1778         if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
1779                 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
1780                                     &dut_mode_fops);
1781         }
1782
1783         /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
1784          * BR/EDR/LE type controllers. AMP controllers only need the
1785          * first stage init.
1786          */
1787         if (hdev->dev_type != HCI_BREDR)
1788                 return 0;
1789
1790         err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
1791         if (err < 0)
1792                 return err;
1793
1794         err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
1795         if (err < 0)
1796                 return err;
1797
1798         err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
1799         if (err < 0)
1800                 return err;
1801
1802         /* Only create debugfs entries during the initial setup
1803          * phase and not every time the controller gets powered on.
1804          */
1805         if (!test_bit(HCI_SETUP, &hdev->dev_flags))
1806                 return 0;
1807
1808         debugfs_create_file("features", 0444, hdev->debugfs, hdev,
1809                             &features_fops);
1810         debugfs_create_u16("manufacturer", 0444, hdev->debugfs,
1811                            &hdev->manufacturer);
1812         debugfs_create_u8("hci_version", 0444, hdev->debugfs, &hdev->hci_ver);
1813         debugfs_create_u16("hci_revision", 0444, hdev->debugfs, &hdev->hci_rev);
1814         debugfs_create_file("blacklist", 0444, hdev->debugfs, hdev,
1815                             &blacklist_fops);
1816         debugfs_create_file("whitelist", 0444, hdev->debugfs, hdev,
1817                             &whitelist_fops);
1818         debugfs_create_file("uuids", 0444, hdev->debugfs, hdev, &uuids_fops);
1819
1820         debugfs_create_file("conn_info_min_age", 0644, hdev->debugfs, hdev,
1821                             &conn_info_min_age_fops);
1822         debugfs_create_file("conn_info_max_age", 0644, hdev->debugfs, hdev,
1823                             &conn_info_max_age_fops);
1824
1825         if (lmp_bredr_capable(hdev)) {
1826                 debugfs_create_file("inquiry_cache", 0444, hdev->debugfs,
1827                                     hdev, &inquiry_cache_fops);
1828                 debugfs_create_file("link_keys", 0400, hdev->debugfs,
1829                                     hdev, &link_keys_fops);
1830                 debugfs_create_file("dev_class", 0444, hdev->debugfs,
1831                                     hdev, &dev_class_fops);
1832                 debugfs_create_file("voice_setting", 0444, hdev->debugfs,
1833                                     hdev, &voice_setting_fops);
1834         }
1835
1836         if (lmp_ssp_capable(hdev)) {
1837                 debugfs_create_file("auto_accept_delay", 0644, hdev->debugfs,
1838                                     hdev, &auto_accept_delay_fops);
1839                 debugfs_create_file("force_sc_support", 0644, hdev->debugfs,
1840                                     hdev, &force_sc_support_fops);
1841                 debugfs_create_file("sc_only_mode", 0444, hdev->debugfs,
1842                                     hdev, &sc_only_mode_fops);
1843         }
1844
1845         if (lmp_sniff_capable(hdev)) {
1846                 debugfs_create_file("idle_timeout", 0644, hdev->debugfs,
1847                                     hdev, &idle_timeout_fops);
1848                 debugfs_create_file("sniff_min_interval", 0644, hdev->debugfs,
1849                                     hdev, &sniff_min_interval_fops);
1850                 debugfs_create_file("sniff_max_interval", 0644, hdev->debugfs,
1851                                     hdev, &sniff_max_interval_fops);
1852         }
1853
1854         if (lmp_le_capable(hdev)) {
1855                 debugfs_create_file("identity", 0400, hdev->debugfs,
1856                                     hdev, &identity_fops);
1857                 debugfs_create_file("rpa_timeout", 0644, hdev->debugfs,
1858                                     hdev, &rpa_timeout_fops);
1859                 debugfs_create_file("random_address", 0444, hdev->debugfs,
1860                                     hdev, &random_address_fops);
1861                 debugfs_create_file("static_address", 0444, hdev->debugfs,
1862                                     hdev, &static_address_fops);
1863
1864                 /* For controllers with a public address, provide a debug
1865                  * option to force the usage of the configured static
1866                  * address. By default the public address is used.
1867                  */
1868                 if (bacmp(&hdev->bdaddr, BDADDR_ANY))
1869                         debugfs_create_file("force_static_address", 0644,
1870                                             hdev->debugfs, hdev,
1871                                             &force_static_address_fops);
1872
1873                 debugfs_create_u8("white_list_size", 0444, hdev->debugfs,
1874                                   &hdev->le_white_list_size);
1875                 debugfs_create_file("white_list", 0444, hdev->debugfs, hdev,
1876                                     &white_list_fops);
1877                 debugfs_create_file("identity_resolving_keys", 0400,
1878                                     hdev->debugfs, hdev,
1879                                     &identity_resolving_keys_fops);
1880                 debugfs_create_file("long_term_keys", 0400, hdev->debugfs,
1881                                     hdev, &long_term_keys_fops);
1882                 debugfs_create_file("conn_min_interval", 0644, hdev->debugfs,
1883                                     hdev, &conn_min_interval_fops);
1884                 debugfs_create_file("conn_max_interval", 0644, hdev->debugfs,
1885                                     hdev, &conn_max_interval_fops);
1886                 debugfs_create_file("conn_latency", 0644, hdev->debugfs,
1887                                     hdev, &conn_latency_fops);
1888                 debugfs_create_file("supervision_timeout", 0644, hdev->debugfs,
1889                                     hdev, &supervision_timeout_fops);
1890                 debugfs_create_file("adv_channel_map", 0644, hdev->debugfs,
1891                                     hdev, &adv_channel_map_fops);
1892                 debugfs_create_file("adv_min_interval", 0644, hdev->debugfs,
1893                                     hdev, &adv_min_interval_fops);
1894                 debugfs_create_file("adv_max_interval", 0644, hdev->debugfs,
1895                                     hdev, &adv_max_interval_fops);
1896                 debugfs_create_file("device_list", 0444, hdev->debugfs, hdev,
1897                                     &device_list_fops);
1898                 debugfs_create_u16("discov_interleaved_timeout", 0644,
1899                                    hdev->debugfs,
1900                                    &hdev->discov_interleaved_timeout);
1901         }
1902
1903         return 0;
1904 }
1905
1906 static void hci_init0_req(struct hci_request *req, unsigned long opt)
1907 {
1908         struct hci_dev *hdev = req->hdev;
1909
1910         BT_DBG("%s %ld", hdev->name, opt);
1911
1912         /* Reset */
1913         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
1914                 hci_reset_req(req, 0);
1915
1916         /* Read Local Version */
1917         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1918
1919         /* Read BD Address */
1920         if (hdev->set_bdaddr)
1921                 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1922 }
1923
1924 static int __hci_unconf_init(struct hci_dev *hdev)
1925 {
1926         int err;
1927
1928         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
1929                 return 0;
1930
1931         err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT);
1932         if (err < 0)
1933                 return err;
1934
1935         return 0;
1936 }
1937
1938 static void hci_scan_req(struct hci_request *req, unsigned long opt)
1939 {
1940         __u8 scan = opt;
1941
1942         BT_DBG("%s %x", req->hdev->name, scan);
1943
1944         /* Inquiry and Page scans */
1945         hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1946 }
1947
1948 static void hci_auth_req(struct hci_request *req, unsigned long opt)
1949 {
1950         __u8 auth = opt;
1951
1952         BT_DBG("%s %x", req->hdev->name, auth);
1953
1954         /* Authentication */
1955         hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1956 }
1957
1958 static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
1959 {
1960         __u8 encrypt = opt;
1961
1962         BT_DBG("%s %x", req->hdev->name, encrypt);
1963
1964         /* Encryption */
1965         hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1966 }
1967
1968 static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
1969 {
1970         __le16 policy = cpu_to_le16(opt);
1971
1972         BT_DBG("%s %x", req->hdev->name, policy);
1973
1974         /* Default link policy */
1975         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
1976 }
1977
1978 /* Get HCI device by index.
1979  * Device is held on return. */
1980 struct hci_dev *hci_dev_get(int index)
1981 {
1982         struct hci_dev *hdev = NULL, *d;
1983
1984         BT_DBG("%d", index);
1985
1986         if (index < 0)
1987                 return NULL;
1988
1989         read_lock(&hci_dev_list_lock);
1990         list_for_each_entry(d, &hci_dev_list, list) {
1991                 if (d->id == index) {
1992                         hdev = hci_dev_hold(d);
1993                         break;
1994                 }
1995         }
1996         read_unlock(&hci_dev_list_lock);
1997         return hdev;
1998 }
1999
2000 /* ---- Inquiry support ---- */
2001
2002 bool hci_discovery_active(struct hci_dev *hdev)
2003 {
2004         struct discovery_state *discov = &hdev->discovery;
2005
2006         switch (discov->state) {
2007         case DISCOVERY_FINDING:
2008         case DISCOVERY_RESOLVING:
2009                 return true;
2010
2011         default:
2012                 return false;
2013         }
2014 }
2015
2016 void hci_discovery_set_state(struct hci_dev *hdev, int state)
2017 {
2018         int old_state = hdev->discovery.state;
2019
2020         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
2021
2022         if (old_state == state)
2023                 return;
2024
2025         hdev->discovery.state = state;
2026
2027         switch (state) {
2028         case DISCOVERY_STOPPED:
2029                 hci_update_background_scan(hdev);
2030
2031                 if (old_state != DISCOVERY_STARTING)
2032                         mgmt_discovering(hdev, 0);
2033                 break;
2034         case DISCOVERY_STARTING:
2035                 break;
2036         case DISCOVERY_FINDING:
2037                 mgmt_discovering(hdev, 1);
2038                 break;
2039         case DISCOVERY_RESOLVING:
2040                 break;
2041         case DISCOVERY_STOPPING:
2042                 break;
2043         }
2044 }
2045
2046 void hci_inquiry_cache_flush(struct hci_dev *hdev)
2047 {
2048         struct discovery_state *cache = &hdev->discovery;
2049         struct inquiry_entry *p, *n;
2050
2051         list_for_each_entry_safe(p, n, &cache->all, all) {
2052                 list_del(&p->all);
2053                 kfree(p);
2054         }
2055
2056         INIT_LIST_HEAD(&cache->unknown);
2057         INIT_LIST_HEAD(&cache->resolve);
2058 }
2059
2060 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
2061                                                bdaddr_t *bdaddr)
2062 {
2063         struct discovery_state *cache = &hdev->discovery;
2064         struct inquiry_entry *e;
2065
2066         BT_DBG("cache %p, %pMR", cache, bdaddr);
2067
2068         list_for_each_entry(e, &cache->all, all) {
2069                 if (!bacmp(&e->data.bdaddr, bdaddr))
2070                         return e;
2071         }
2072
2073         return NULL;
2074 }
2075
2076 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
2077                                                        bdaddr_t *bdaddr)
2078 {
2079         struct discovery_state *cache = &hdev->discovery;
2080         struct inquiry_entry *e;
2081
2082         BT_DBG("cache %p, %pMR", cache, bdaddr);
2083
2084         list_for_each_entry(e, &cache->unknown, list) {
2085                 if (!bacmp(&e->data.bdaddr, bdaddr))
2086                         return e;
2087         }
2088
2089         return NULL;
2090 }
2091
2092 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
2093                                                        bdaddr_t *bdaddr,
2094                                                        int state)
2095 {
2096         struct discovery_state *cache = &hdev->discovery;
2097         struct inquiry_entry *e;
2098
2099         BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
2100
2101         list_for_each_entry(e, &cache->resolve, list) {
2102                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
2103                         return e;
2104                 if (!bacmp(&e->data.bdaddr, bdaddr))
2105                         return e;
2106         }
2107
2108         return NULL;
2109 }
2110
2111 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
2112                                       struct inquiry_entry *ie)
2113 {
2114         struct discovery_state *cache = &hdev->discovery;
2115         struct list_head *pos = &cache->resolve;
2116         struct inquiry_entry *p;
2117
2118         list_del(&ie->list);
2119
2120         list_for_each_entry(p, &cache->resolve, list) {
2121                 if (p->name_state != NAME_PENDING &&
2122                     abs(p->data.rssi) >= abs(ie->data.rssi))
2123                         break;
2124                 pos = &p->list;
2125         }
2126
2127         list_add(&ie->list, pos);
2128 }
2129
2130 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
2131                              bool name_known)
2132 {
2133         struct discovery_state *cache = &hdev->discovery;
2134         struct inquiry_entry *ie;
2135         u32 flags = 0;
2136
2137         BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
2138
2139         hci_remove_remote_oob_data(hdev, &data->bdaddr);
2140
2141         if (!data->ssp_mode)
2142                 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
2143
2144         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
2145         if (ie) {
2146                 if (!ie->data.ssp_mode)
2147                         flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
2148
2149                 if (ie->name_state == NAME_NEEDED &&
2150                     data->rssi != ie->data.rssi) {
2151                         ie->data.rssi = data->rssi;
2152                         hci_inquiry_cache_update_resolve(hdev, ie);
2153                 }
2154
2155                 goto update;
2156         }
2157
2158         /* Entry not in the cache. Add new one. */
2159         ie = kzalloc(sizeof(*ie), GFP_KERNEL);
2160         if (!ie) {
2161                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
2162                 goto done;
2163         }
2164
2165         list_add(&ie->all, &cache->all);
2166
2167         if (name_known) {
2168                 ie->name_state = NAME_KNOWN;
2169         } else {
2170                 ie->name_state = NAME_NOT_KNOWN;
2171                 list_add(&ie->list, &cache->unknown);
2172         }
2173
2174 update:
2175         if (name_known && ie->name_state != NAME_KNOWN &&
2176             ie->name_state != NAME_PENDING) {
2177                 ie->name_state = NAME_KNOWN;
2178                 list_del(&ie->list);
2179         }
2180
2181         memcpy(&ie->data, data, sizeof(*data));
2182         ie->timestamp = jiffies;
2183         cache->timestamp = jiffies;
2184
2185         if (ie->name_state == NAME_NOT_KNOWN)
2186                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
2187
2188 done:
2189         return flags;
2190 }
2191
2192 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
2193 {
2194         struct discovery_state *cache = &hdev->discovery;
2195         struct inquiry_info *info = (struct inquiry_info *) buf;
2196         struct inquiry_entry *e;
2197         int copied = 0;
2198
2199         list_for_each_entry(e, &cache->all, all) {
2200                 struct inquiry_data *data = &e->data;
2201
2202                 if (copied >= num)
2203                         break;
2204
2205                 bacpy(&info->bdaddr, &data->bdaddr);
2206                 info->pscan_rep_mode    = data->pscan_rep_mode;
2207                 info->pscan_period_mode = data->pscan_period_mode;
2208                 info->pscan_mode        = data->pscan_mode;
2209                 memcpy(info->dev_class, data->dev_class, 3);
2210                 info->clock_offset      = data->clock_offset;
2211
2212                 info++;
2213                 copied++;
2214         }
2215
2216         BT_DBG("cache %p, copied %d", cache, copied);
2217         return copied;
2218 }
2219
2220 static void hci_inq_req(struct hci_request *req, unsigned long opt)
2221 {
2222         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
2223         struct hci_dev *hdev = req->hdev;
2224         struct hci_cp_inquiry cp;
2225
2226         BT_DBG("%s", hdev->name);
2227
2228         if (test_bit(HCI_INQUIRY, &hdev->flags))
2229                 return;
2230
2231         /* Start Inquiry */
2232         memcpy(&cp.lap, &ir->lap, 3);
2233         cp.length  = ir->length;
2234         cp.num_rsp = ir->num_rsp;
2235         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
2236 }
2237
2238 int hci_inquiry(void __user *arg)
2239 {
2240         __u8 __user *ptr = arg;
2241         struct hci_inquiry_req ir;
2242         struct hci_dev *hdev;
2243         int err = 0, do_inquiry = 0, max_rsp;
2244         long timeo;
2245         __u8 *buf;
2246
2247         if (copy_from_user(&ir, ptr, sizeof(ir)))
2248                 return -EFAULT;
2249
2250         hdev = hci_dev_get(ir.dev_id);
2251         if (!hdev)
2252                 return -ENODEV;
2253
2254         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2255                 err = -EBUSY;
2256                 goto done;
2257         }
2258
2259         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2260                 err = -EOPNOTSUPP;
2261                 goto done;
2262         }
2263
2264         if (hdev->dev_type != HCI_BREDR) {
2265                 err = -EOPNOTSUPP;
2266                 goto done;
2267         }
2268
2269         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2270                 err = -EOPNOTSUPP;
2271                 goto done;
2272         }
2273
2274         hci_dev_lock(hdev);
2275         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
2276             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
2277                 hci_inquiry_cache_flush(hdev);
2278                 do_inquiry = 1;
2279         }
2280         hci_dev_unlock(hdev);
2281
2282         timeo = ir.length * msecs_to_jiffies(2000);
2283
2284         if (do_inquiry) {
2285                 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
2286                                    timeo);
2287                 if (err < 0)
2288                         goto done;
2289
2290                 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
2291                  * cleared). If it is interrupted by a signal, return -EINTR.
2292                  */
2293                 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
2294                                 TASK_INTERRUPTIBLE))
2295                         return -EINTR;
2296         }
2297
2298         /* for unlimited number of responses we will use buffer with
2299          * 255 entries
2300          */
2301         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
2302
2303         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
2304          * copy it to the user space.
2305          */
2306         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
2307         if (!buf) {
2308                 err = -ENOMEM;
2309                 goto done;
2310         }
2311
2312         hci_dev_lock(hdev);
2313         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
2314         hci_dev_unlock(hdev);
2315
2316         BT_DBG("num_rsp %d", ir.num_rsp);
2317
2318         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
2319                 ptr += sizeof(ir);
2320                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
2321                                  ir.num_rsp))
2322                         err = -EFAULT;
2323         } else
2324                 err = -EFAULT;
2325
2326         kfree(buf);
2327
2328 done:
2329         hci_dev_put(hdev);
2330         return err;
2331 }
2332
2333 static int hci_dev_do_open(struct hci_dev *hdev)
2334 {
2335         int ret = 0;
2336
2337         BT_DBG("%s %p", hdev->name, hdev);
2338
2339         hci_req_lock(hdev);
2340
2341         if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
2342                 ret = -ENODEV;
2343                 goto done;
2344         }
2345
2346         if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
2347             !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
2348                 /* Check for rfkill but allow the HCI setup stage to
2349                  * proceed (which in itself doesn't cause any RF activity).
2350                  */
2351                 if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
2352                         ret = -ERFKILL;
2353                         goto done;
2354                 }
2355
2356                 /* Check for valid public address or a configured static
2357                  * random adddress, but let the HCI setup proceed to
2358                  * be able to determine if there is a public address
2359                  * or not.
2360                  *
2361                  * In case of user channel usage, it is not important
2362                  * if a public address or static random address is
2363                  * available.
2364                  *
2365                  * This check is only valid for BR/EDR controllers
2366                  * since AMP controllers do not have an address.
2367                  */
2368                 if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
2369                     hdev->dev_type == HCI_BREDR &&
2370                     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2371                     !bacmp(&hdev->static_addr, BDADDR_ANY)) {
2372                         ret = -EADDRNOTAVAIL;
2373                         goto done;
2374                 }
2375         }
2376
2377         if (test_bit(HCI_UP, &hdev->flags)) {
2378                 ret = -EALREADY;
2379                 goto done;
2380         }
2381
2382         if (hdev->open(hdev)) {
2383                 ret = -EIO;
2384                 goto done;
2385         }
2386
2387         atomic_set(&hdev->cmd_cnt, 1);
2388         set_bit(HCI_INIT, &hdev->flags);
2389
2390         if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
2391                 if (hdev->setup)
2392                         ret = hdev->setup(hdev);
2393
2394                 /* The transport driver can set these quirks before
2395                  * creating the HCI device or in its setup callback.
2396                  *
2397                  * In case any of them is set, the controller has to
2398                  * start up as unconfigured.
2399                  */
2400                 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
2401                     test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
2402                         set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
2403
2404                 /* For an unconfigured controller it is required to
2405                  * read at least the version information provided by
2406                  * the Read Local Version Information command.
2407                  *
2408                  * If the set_bdaddr driver callback is provided, then
2409                  * also the original Bluetooth public device address
2410                  * will be read using the Read BD Address command.
2411                  */
2412                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
2413                         ret = __hci_unconf_init(hdev);
2414         }
2415
2416         if (test_bit(HCI_CONFIG, &hdev->dev_flags)) {
2417                 /* If public address change is configured, ensure that
2418                  * the address gets programmed. If the driver does not
2419                  * support changing the public address, fail the power
2420                  * on procedure.
2421                  */
2422                 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
2423                     hdev->set_bdaddr)
2424                         ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
2425                 else
2426                         ret = -EADDRNOTAVAIL;
2427         }
2428
2429         if (!ret) {
2430                 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2431                     !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
2432                         ret = __hci_init(hdev);
2433         }
2434
2435         clear_bit(HCI_INIT, &hdev->flags);
2436
2437         if (!ret) {
2438                 hci_dev_hold(hdev);
2439                 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
2440                 set_bit(HCI_UP, &hdev->flags);
2441                 hci_notify(hdev, HCI_DEV_UP);
2442                 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
2443                     !test_bit(HCI_CONFIG, &hdev->dev_flags) &&
2444                     !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2445                     !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
2446                     hdev->dev_type == HCI_BREDR) {
2447                         hci_dev_lock(hdev);
2448                         mgmt_powered(hdev, 1);
2449                         hci_dev_unlock(hdev);
2450                 }
2451         } else {
2452                 /* Init failed, cleanup */
2453                 flush_work(&hdev->tx_work);
2454                 flush_work(&hdev->cmd_work);
2455                 flush_work(&hdev->rx_work);
2456
2457                 skb_queue_purge(&hdev->cmd_q);
2458                 skb_queue_purge(&hdev->rx_q);
2459
2460                 if (hdev->flush)
2461                         hdev->flush(hdev);
2462
2463                 if (hdev->sent_cmd) {
2464                         kfree_skb(hdev->sent_cmd);
2465                         hdev->sent_cmd = NULL;
2466                 }
2467
2468                 hdev->close(hdev);
2469                 hdev->flags &= BIT(HCI_RAW);
2470         }
2471
2472 done:
2473         hci_req_unlock(hdev);
2474         return ret;
2475 }
2476
2477 /* ---- HCI ioctl helpers ---- */
2478
2479 int hci_dev_open(__u16 dev)
2480 {
2481         struct hci_dev *hdev;
2482         int err;
2483
2484         hdev = hci_dev_get(dev);
2485         if (!hdev)
2486                 return -ENODEV;
2487
2488         /* Devices that are marked as unconfigured can only be powered
2489          * up as user channel. Trying to bring them up as normal devices
2490          * will result into a failure. Only user channel operation is
2491          * possible.
2492          *
2493          * When this function is called for a user channel, the flag
2494          * HCI_USER_CHANNEL will be set first before attempting to
2495          * open the device.
2496          */
2497         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2498             !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2499                 err = -EOPNOTSUPP;
2500                 goto done;
2501         }
2502
2503         /* We need to ensure that no other power on/off work is pending
2504          * before proceeding to call hci_dev_do_open. This is
2505          * particularly important if the setup procedure has not yet
2506          * completed.
2507          */
2508         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2509                 cancel_delayed_work(&hdev->power_off);
2510
2511         /* After this call it is guaranteed that the setup procedure
2512          * has finished. This means that error conditions like RFKILL
2513          * or no valid public or static random address apply.
2514          */
2515         flush_workqueue(hdev->req_workqueue);
2516
2517         /* For controllers not using the management interface and that
2518          * are brought up using legacy ioctl, set the HCI_BONDABLE bit
2519          * so that pairing works for them. Once the management interface
2520          * is in use this bit will be cleared again and userspace has
2521          * to explicitly enable it.
2522          */
2523         if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
2524             !test_bit(HCI_MGMT, &hdev->dev_flags))
2525                 set_bit(HCI_BONDABLE, &hdev->dev_flags);
2526
2527         err = hci_dev_do_open(hdev);
2528
2529 done:
2530         hci_dev_put(hdev);
2531         return err;
2532 }
2533
2534 /* This function requires the caller holds hdev->lock */
2535 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
2536 {
2537         struct hci_conn_params *p;
2538
2539         list_for_each_entry(p, &hdev->le_conn_params, list) {
2540                 if (p->conn) {
2541                         hci_conn_drop(p->conn);
2542                         p->conn = NULL;
2543                 }
2544                 list_del_init(&p->action);
2545         }
2546
2547         BT_DBG("All LE pending actions cleared");
2548 }
2549
2550 static int hci_dev_do_close(struct hci_dev *hdev)
2551 {
2552         BT_DBG("%s %p", hdev->name, hdev);
2553
2554         cancel_delayed_work(&hdev->power_off);
2555
2556         hci_req_cancel(hdev, ENODEV);
2557         hci_req_lock(hdev);
2558
2559         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
2560                 cancel_delayed_work_sync(&hdev->cmd_timer);
2561                 hci_req_unlock(hdev);
2562                 return 0;
2563         }
2564
2565         /* Flush RX and TX works */
2566         flush_work(&hdev->tx_work);
2567         flush_work(&hdev->rx_work);
2568
2569         if (hdev->discov_timeout > 0) {
2570                 cancel_delayed_work(&hdev->discov_off);
2571                 hdev->discov_timeout = 0;
2572                 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
2573                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
2574         }
2575
2576         if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
2577                 cancel_delayed_work(&hdev->service_cache);
2578
2579         cancel_delayed_work_sync(&hdev->le_scan_disable);
2580
2581         if (test_bit(HCI_MGMT, &hdev->dev_flags))
2582                 cancel_delayed_work_sync(&hdev->rpa_expired);
2583
2584         hci_dev_lock(hdev);
2585         hci_inquiry_cache_flush(hdev);
2586         hci_pend_le_actions_clear(hdev);
2587         hci_conn_hash_flush(hdev);
2588         hci_dev_unlock(hdev);
2589
2590         hci_notify(hdev, HCI_DEV_DOWN);
2591
2592         if (hdev->flush)
2593                 hdev->flush(hdev);
2594
2595         /* Reset device */
2596         skb_queue_purge(&hdev->cmd_q);
2597         atomic_set(&hdev->cmd_cnt, 1);
2598         if (!test_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
2599             !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2600             test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
2601                 set_bit(HCI_INIT, &hdev->flags);
2602                 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
2603                 clear_bit(HCI_INIT, &hdev->flags);
2604         }
2605
2606         /* flush cmd  work */
2607         flush_work(&hdev->cmd_work);
2608
2609         /* Drop queues */
2610         skb_queue_purge(&hdev->rx_q);
2611         skb_queue_purge(&hdev->cmd_q);
2612         skb_queue_purge(&hdev->raw_q);
2613
2614         /* Drop last sent command */
2615         if (hdev->sent_cmd) {
2616                 cancel_delayed_work_sync(&hdev->cmd_timer);
2617                 kfree_skb(hdev->sent_cmd);
2618                 hdev->sent_cmd = NULL;
2619         }
2620
2621         kfree_skb(hdev->recv_evt);
2622         hdev->recv_evt = NULL;
2623
2624         /* After this point our queues are empty
2625          * and no tasks are scheduled. */
2626         hdev->close(hdev);
2627
2628         /* Clear flags */
2629         hdev->flags &= BIT(HCI_RAW);
2630         hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
2631
2632         if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
2633                 if (hdev->dev_type == HCI_BREDR) {
2634                         hci_dev_lock(hdev);
2635                         mgmt_powered(hdev, 0);
2636                         hci_dev_unlock(hdev);
2637                 }
2638         }
2639
2640         /* Controller radio is available but is currently powered down */
2641         hdev->amp_status = AMP_STATUS_POWERED_DOWN;
2642
2643         memset(hdev->eir, 0, sizeof(hdev->eir));
2644         memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
2645         bacpy(&hdev->random_addr, BDADDR_ANY);
2646
2647         hci_req_unlock(hdev);
2648
2649         hci_dev_put(hdev);
2650         return 0;
2651 }
2652
2653 int hci_dev_close(__u16 dev)
2654 {
2655         struct hci_dev *hdev;
2656         int err;
2657
2658         hdev = hci_dev_get(dev);
2659         if (!hdev)
2660                 return -ENODEV;
2661
2662         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2663                 err = -EBUSY;
2664                 goto done;
2665         }
2666
2667         if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2668                 cancel_delayed_work(&hdev->power_off);
2669
2670         err = hci_dev_do_close(hdev);
2671
2672 done:
2673         hci_dev_put(hdev);
2674         return err;
2675 }
2676
2677 int hci_dev_reset(__u16 dev)
2678 {
2679         struct hci_dev *hdev;
2680         int ret = 0;
2681
2682         hdev = hci_dev_get(dev);
2683         if (!hdev)
2684                 return -ENODEV;
2685
2686         hci_req_lock(hdev);
2687
2688         if (!test_bit(HCI_UP, &hdev->flags)) {
2689                 ret = -ENETDOWN;
2690                 goto done;
2691         }
2692
2693         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2694                 ret = -EBUSY;
2695                 goto done;
2696         }
2697
2698         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2699                 ret = -EOPNOTSUPP;
2700                 goto done;
2701         }
2702
2703         /* Drop queues */
2704         skb_queue_purge(&hdev->rx_q);
2705         skb_queue_purge(&hdev->cmd_q);
2706
2707         hci_dev_lock(hdev);
2708         hci_inquiry_cache_flush(hdev);
2709         hci_conn_hash_flush(hdev);
2710         hci_dev_unlock(hdev);
2711
2712         if (hdev->flush)
2713                 hdev->flush(hdev);
2714
2715         atomic_set(&hdev->cmd_cnt, 1);
2716         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
2717
2718         ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
2719
2720 done:
2721         hci_req_unlock(hdev);
2722         hci_dev_put(hdev);
2723         return ret;
2724 }
2725
2726 int hci_dev_reset_stat(__u16 dev)
2727 {
2728         struct hci_dev *hdev;
2729         int ret = 0;
2730
2731         hdev = hci_dev_get(dev);
2732         if (!hdev)
2733                 return -ENODEV;
2734
2735         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2736                 ret = -EBUSY;
2737                 goto done;
2738         }
2739
2740         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2741                 ret = -EOPNOTSUPP;
2742                 goto done;
2743         }
2744
2745         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
2746
2747 done:
2748         hci_dev_put(hdev);
2749         return ret;
2750 }
2751
2752 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
2753 {
2754         bool conn_changed, discov_changed;
2755
2756         BT_DBG("%s scan 0x%02x", hdev->name, scan);
2757
2758         if ((scan & SCAN_PAGE))
2759                 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
2760                                                  &hdev->dev_flags);
2761         else
2762                 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
2763                                                   &hdev->dev_flags);
2764
2765         if ((scan & SCAN_INQUIRY)) {
2766                 discov_changed = !test_and_set_bit(HCI_DISCOVERABLE,
2767                                                    &hdev->dev_flags);
2768         } else {
2769                 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
2770                 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
2771                                                     &hdev->dev_flags);
2772         }
2773
2774         if (!test_bit(HCI_MGMT, &hdev->dev_flags))
2775                 return;
2776
2777         if (conn_changed || discov_changed) {
2778                 /* In case this was disabled through mgmt */
2779                 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
2780
2781                 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
2782                         mgmt_update_adv_data(hdev);
2783
2784                 mgmt_new_settings(hdev);
2785         }
2786 }
2787
2788 int hci_dev_cmd(unsigned int cmd, void __user *arg)
2789 {
2790         struct hci_dev *hdev;
2791         struct hci_dev_req dr;
2792         int err = 0;
2793
2794         if (copy_from_user(&dr, arg, sizeof(dr)))
2795                 return -EFAULT;
2796
2797         hdev = hci_dev_get(dr.dev_id);
2798         if (!hdev)
2799                 return -ENODEV;
2800
2801         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
2802                 err = -EBUSY;
2803                 goto done;
2804         }
2805
2806         if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2807                 err = -EOPNOTSUPP;
2808                 goto done;
2809         }
2810
2811         if (hdev->dev_type != HCI_BREDR) {
2812                 err = -EOPNOTSUPP;
2813                 goto done;
2814         }
2815
2816         if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
2817                 err = -EOPNOTSUPP;
2818                 goto done;
2819         }
2820
2821         switch (cmd) {
2822         case HCISETAUTH:
2823                 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2824                                    HCI_INIT_TIMEOUT);
2825                 break;
2826
2827         case HCISETENCRYPT:
2828                 if (!lmp_encrypt_capable(hdev)) {
2829                         err = -EOPNOTSUPP;
2830                         break;
2831                 }
2832
2833                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
2834                         /* Auth must be enabled first */
2835                         err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2836                                            HCI_INIT_TIMEOUT);
2837                         if (err)
2838                                 break;
2839                 }
2840
2841                 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
2842                                    HCI_INIT_TIMEOUT);
2843                 break;
2844
2845         case HCISETSCAN:
2846                 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
2847                                    HCI_INIT_TIMEOUT);
2848
2849                 /* Ensure that the connectable and discoverable states
2850                  * get correctly modified as this was a non-mgmt change.
2851                  */
2852                 if (!err)
2853                         hci_update_scan_state(hdev, dr.dev_opt);
2854                 break;
2855
2856         case HCISETLINKPOL:
2857                 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
2858                                    HCI_INIT_TIMEOUT);
2859                 break;
2860
2861         case HCISETLINKMODE:
2862                 hdev->link_mode = ((__u16) dr.dev_opt) &
2863                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
2864                 break;
2865
2866         case HCISETPTYPE:
2867                 hdev->pkt_type = (__u16) dr.dev_opt;
2868                 break;
2869
2870         case HCISETACLMTU:
2871                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
2872                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
2873                 break;
2874
2875         case HCISETSCOMTU:
2876                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
2877                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
2878                 break;
2879
2880         default:
2881                 err = -EINVAL;
2882                 break;
2883         }
2884
2885 done:
2886         hci_dev_put(hdev);
2887         return err;
2888 }
2889
2890 int hci_get_dev_list(void __user *arg)
2891 {
2892         struct hci_dev *hdev;
2893         struct hci_dev_list_req *dl;
2894         struct hci_dev_req *dr;
2895         int n = 0, size, err;
2896         __u16 dev_num;
2897
2898         if (get_user(dev_num, (__u16 __user *) arg))
2899                 return -EFAULT;
2900
2901         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2902                 return -EINVAL;
2903
2904         size = sizeof(*dl) + dev_num * sizeof(*dr);
2905
2906         dl = kzalloc(size, GFP_KERNEL);
2907         if (!dl)
2908                 return -ENOMEM;
2909
2910         dr = dl->dev_req;
2911
2912         read_lock(&hci_dev_list_lock);
2913         list_for_each_entry(hdev, &hci_dev_list, list) {
2914                 unsigned long flags = hdev->flags;
2915
2916                 /* When the auto-off is configured it means the transport
2917                  * is running, but in that case still indicate that the
2918                  * device is actually down.
2919                  */
2920                 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2921                         flags &= ~BIT(HCI_UP);
2922
2923                 (dr + n)->dev_id  = hdev->id;
2924                 (dr + n)->dev_opt = flags;
2925
2926                 if (++n >= dev_num)
2927                         break;
2928         }
2929         read_unlock(&hci_dev_list_lock);
2930
2931         dl->dev_num = n;
2932         size = sizeof(*dl) + n * sizeof(*dr);
2933
2934         err = copy_to_user(arg, dl, size);
2935         kfree(dl);
2936
2937         return err ? -EFAULT : 0;
2938 }
2939
2940 int hci_get_dev_info(void __user *arg)
2941 {
2942         struct hci_dev *hdev;
2943         struct hci_dev_info di;
2944         unsigned long flags;
2945         int err = 0;
2946
2947         if (copy_from_user(&di, arg, sizeof(di)))
2948                 return -EFAULT;
2949
2950         hdev = hci_dev_get(di.dev_id);
2951         if (!hdev)
2952                 return -ENODEV;
2953
2954         /* When the auto-off is configured it means the transport
2955          * is running, but in that case still indicate that the
2956          * device is actually down.
2957          */
2958         if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2959                 flags = hdev->flags & ~BIT(HCI_UP);
2960         else
2961                 flags = hdev->flags;
2962
2963         strcpy(di.name, hdev->name);
2964         di.bdaddr   = hdev->bdaddr;
2965         di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2966         di.flags    = flags;
2967         di.pkt_type = hdev->pkt_type;
2968         if (lmp_bredr_capable(hdev)) {
2969                 di.acl_mtu  = hdev->acl_mtu;
2970                 di.acl_pkts = hdev->acl_pkts;
2971                 di.sco_mtu  = hdev->sco_mtu;
2972                 di.sco_pkts = hdev->sco_pkts;
2973         } else {
2974                 di.acl_mtu  = hdev->le_mtu;
2975                 di.acl_pkts = hdev->le_pkts;
2976                 di.sco_mtu  = 0;
2977                 di.sco_pkts = 0;
2978         }
2979         di.link_policy = hdev->link_policy;
2980         di.link_mode   = hdev->link_mode;
2981
2982         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2983         memcpy(&di.features, &hdev->features, sizeof(di.features));
2984
2985         if (copy_to_user(arg, &di, sizeof(di)))
2986                 err = -EFAULT;
2987
2988         hci_dev_put(hdev);
2989
2990         return err;
2991 }
2992
2993 /* ---- Interface to HCI drivers ---- */
2994
2995 static int hci_rfkill_set_block(void *data, bool blocked)
2996 {
2997         struct hci_dev *hdev = data;
2998
2999         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
3000
3001         if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
3002                 return -EBUSY;
3003
3004         if (blocked) {
3005                 set_bit(HCI_RFKILLED, &hdev->dev_flags);
3006                 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
3007                     !test_bit(HCI_CONFIG, &hdev->dev_flags))
3008                         hci_dev_do_close(hdev);
3009         } else {
3010                 clear_bit(HCI_RFKILLED, &hdev->dev_flags);
3011         }
3012
3013         return 0;
3014 }
3015
3016 static const struct rfkill_ops hci_rfkill_ops = {
3017         .set_block = hci_rfkill_set_block,
3018 };
3019
3020 static void hci_power_on(struct work_struct *work)
3021 {
3022         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
3023         int err;
3024
3025         BT_DBG("%s", hdev->name);
3026
3027         err = hci_dev_do_open(hdev);
3028         if (err < 0) {
3029                 mgmt_set_powered_failed(hdev, err);
3030                 return;
3031         }
3032
3033         /* During the HCI setup phase, a few error conditions are
3034          * ignored and they need to be checked now. If they are still
3035          * valid, it is important to turn the device back off.
3036          */
3037         if (test_bit(HCI_RFKILLED, &hdev->dev_flags) ||
3038             test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
3039             (hdev->dev_type == HCI_BREDR &&
3040              !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
3041              !bacmp(&hdev->static_addr, BDADDR_ANY))) {
3042                 clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
3043                 hci_dev_do_close(hdev);
3044         } else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
3045                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
3046                                    HCI_AUTO_OFF_TIMEOUT);
3047         }
3048
3049         if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags)) {
3050                 /* For unconfigured devices, set the HCI_RAW flag
3051                  * so that userspace can easily identify them.
3052                  */
3053                 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
3054                         set_bit(HCI_RAW, &hdev->flags);
3055
3056                 /* For fully configured devices, this will send
3057                  * the Index Added event. For unconfigured devices,
3058                  * it will send Unconfigued Index Added event.
3059                  *
3060                  * Devices with HCI_QUIRK_RAW_DEVICE are ignored
3061                  * and no event will be send.
3062                  */
3063                 mgmt_index_added(hdev);
3064         } else if (test_and_clear_bit(HCI_CONFIG, &hdev->dev_flags)) {
3065                 /* When the controller is now configured, then it
3066                  * is important to clear the HCI_RAW flag.
3067                  */
3068                 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
3069                         clear_bit(HCI_RAW, &hdev->flags);
3070
3071                 /* Powering on the controller with HCI_CONFIG set only
3072                  * happens with the transition from unconfigured to
3073                  * configured. This will send the Index Added event.
3074                  */
3075                 mgmt_index_added(hdev);
3076         }
3077 }
3078
3079 static void hci_power_off(struct work_struct *work)
3080 {
3081         struct hci_dev *hdev = container_of(work, struct hci_dev,
3082                                             power_off.work);
3083
3084         BT_DBG("%s", hdev->name);
3085
3086         hci_dev_do_close(hdev);
3087 }
3088
3089 static void hci_discov_off(struct work_struct *work)
3090 {
3091         struct hci_dev *hdev;
3092
3093         hdev = container_of(work, struct hci_dev, discov_off.work);
3094
3095         BT_DBG("%s", hdev->name);
3096
3097         mgmt_discoverable_timeout(hdev);
3098 }
3099
3100 void hci_uuids_clear(struct hci_dev *hdev)
3101 {
3102         struct bt_uuid *uuid, *tmp;
3103
3104         list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
3105                 list_del(&uuid->list);
3106                 kfree(uuid);
3107         }
3108 }
3109
3110 void hci_link_keys_clear(struct hci_dev *hdev)
3111 {
3112         struct list_head *p, *n;
3113
3114         list_for_each_safe(p, n, &hdev->link_keys) {
3115                 struct link_key *key;
3116
3117                 key = list_entry(p, struct link_key, list);
3118
3119                 list_del(p);
3120                 kfree(key);
3121         }
3122 }
3123
3124 void hci_smp_ltks_clear(struct hci_dev *hdev)
3125 {
3126         struct smp_ltk *k, *tmp;
3127
3128         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
3129                 list_del(&k->list);
3130                 kfree(k);
3131         }
3132 }
3133
3134 void hci_smp_irks_clear(struct hci_dev *hdev)
3135 {
3136         struct smp_irk *k, *tmp;
3137
3138         list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
3139                 list_del(&k->list);
3140                 kfree(k);
3141         }
3142 }
3143
3144 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
3145 {
3146         struct link_key *k;
3147
3148         list_for_each_entry(k, &hdev->link_keys, list)
3149                 if (bacmp(bdaddr, &k->bdaddr) == 0)
3150                         return k;
3151
3152         return NULL;
3153 }
3154
3155 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
3156                                u8 key_type, u8 old_key_type)
3157 {
3158         /* Legacy key */
3159         if (key_type < 0x03)
3160                 return true;
3161
3162         /* Debug keys are insecure so don't store them persistently */
3163         if (key_type == HCI_LK_DEBUG_COMBINATION)
3164                 return false;
3165
3166         /* Changed combination key and there's no previous one */
3167         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
3168                 return false;
3169
3170         /* Security mode 3 case */
3171         if (!conn)
3172                 return true;
3173
3174         /* Neither local nor remote side had no-bonding as requirement */
3175         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
3176                 return true;
3177
3178         /* Local side had dedicated bonding as requirement */
3179         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
3180                 return true;
3181
3182         /* Remote side had dedicated bonding as requirement */
3183         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
3184                 return true;
3185
3186         /* If none of the above criteria match, then don't store the key
3187          * persistently */
3188         return false;
3189 }
3190
3191 static u8 ltk_role(u8 type)
3192 {
3193         if (type == SMP_LTK)
3194                 return HCI_ROLE_MASTER;
3195
3196         return HCI_ROLE_SLAVE;
3197 }
3198
3199 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, __le64 rand,
3200                              u8 role)
3201 {
3202         struct smp_ltk *k;
3203
3204         list_for_each_entry(k, &hdev->long_term_keys, list) {
3205                 if (k->ediv != ediv || k->rand != rand)
3206                         continue;
3207
3208                 if (ltk_role(k->type) != role)
3209                         continue;
3210
3211                 return k;
3212         }
3213
3214         return NULL;
3215 }
3216
3217 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
3218                                      u8 addr_type, u8 role)
3219 {
3220         struct smp_ltk *k;
3221
3222         list_for_each_entry(k, &hdev->long_term_keys, list)
3223                 if (addr_type == k->bdaddr_type &&
3224                     bacmp(bdaddr, &k->bdaddr) == 0 &&
3225                     ltk_role(k->type) == role)
3226                         return k;
3227
3228         return NULL;
3229 }
3230
3231 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
3232 {
3233         struct smp_irk *irk;
3234
3235         list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
3236                 if (!bacmp(&irk->rpa, rpa))
3237                         return irk;
3238         }
3239
3240         list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
3241                 if (smp_irk_matches(hdev->tfm_aes, irk->val, rpa)) {
3242                         bacpy(&irk->rpa, rpa);
3243                         return irk;
3244                 }
3245         }
3246
3247         return NULL;
3248 }
3249
3250 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
3251                                      u8 addr_type)
3252 {
3253         struct smp_irk *irk;
3254
3255         /* Identity Address must be public or static random */
3256         if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
3257                 return NULL;
3258
3259         list_for_each_entry(irk, &hdev->identity_resolving_keys, list) {
3260                 if (addr_type == irk->addr_type &&
3261                     bacmp(bdaddr, &irk->bdaddr) == 0)
3262                         return irk;
3263         }
3264
3265         return NULL;
3266 }
3267
3268 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
3269                                   bdaddr_t *bdaddr, u8 *val, u8 type,
3270                                   u8 pin_len, bool *persistent)
3271 {
3272         struct link_key *key, *old_key;
3273         u8 old_key_type;
3274
3275         old_key = hci_find_link_key(hdev, bdaddr);
3276         if (old_key) {
3277                 old_key_type = old_key->type;
3278                 key = old_key;
3279         } else {
3280                 old_key_type = conn ? conn->key_type : 0xff;
3281                 key = kzalloc(sizeof(*key), GFP_KERNEL);
3282                 if (!key)
3283                         return NULL;
3284                 list_add(&key->list, &hdev->link_keys);
3285         }
3286
3287         BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
3288
3289         /* Some buggy controller combinations generate a changed
3290          * combination key for legacy pairing even when there's no
3291          * previous key */
3292         if (type == HCI_LK_CHANGED_COMBINATION &&
3293             (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
3294                 type = HCI_LK_COMBINATION;
3295                 if (conn)
3296                         conn->key_type = type;
3297         }
3298
3299         bacpy(&key->bdaddr, bdaddr);
3300         memcpy(key->val, val, HCI_LINK_KEY_SIZE);
3301         key->pin_len = pin_len;
3302
3303         if (type == HCI_LK_CHANGED_COMBINATION)
3304                 key->type = old_key_type;
3305         else
3306                 key->type = type;
3307
3308         if (persistent)
3309                 *persistent = hci_persistent_key(hdev, conn, type,
3310                                                  old_key_type);
3311
3312         return key;
3313 }
3314
3315 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
3316                             u8 addr_type, u8 type, u8 authenticated,
3317                             u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
3318 {
3319         struct smp_ltk *key, *old_key;
3320         u8 role = ltk_role(type);
3321
3322         old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type, role);
3323         if (old_key)
3324                 key = old_key;
3325         else {
3326                 key = kzalloc(sizeof(*key), GFP_KERNEL);
3327                 if (!key)
3328                         return NULL;
3329                 list_add(&key->list, &hdev->long_term_keys);
3330         }
3331
3332         bacpy(&key->bdaddr, bdaddr);
3333         key->bdaddr_type = addr_type;
3334         memcpy(key->val, tk, sizeof(key->val));
3335         key->authenticated = authenticated;
3336         key->ediv = ediv;
3337         key->rand = rand;
3338         key->enc_size = enc_size;
3339         key->type = type;
3340
3341         return key;
3342 }
3343
3344 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
3345                             u8 addr_type, u8 val[16], bdaddr_t *rpa)
3346 {
3347         struct smp_irk *irk;
3348
3349         irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
3350         if (!irk) {
3351                 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
3352                 if (!irk)
3353                         return NULL;
3354
3355                 bacpy(&irk->bdaddr, bdaddr);
3356                 irk->addr_type = addr_type;
3357
3358                 list_add(&irk->list, &hdev->identity_resolving_keys);
3359         }
3360
3361         memcpy(irk->val, val, 16);
3362         bacpy(&irk->rpa, rpa);
3363
3364         return irk;
3365 }
3366
3367 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
3368 {
3369         struct link_key *key;
3370
3371         key = hci_find_link_key(hdev, bdaddr);
3372         if (!key)
3373                 return -ENOENT;
3374
3375         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3376
3377         list_del(&key->list);
3378         kfree(key);
3379
3380         return 0;
3381 }
3382
3383 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
3384 {
3385         struct smp_ltk *k, *tmp;
3386         int removed = 0;
3387
3388         list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
3389                 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
3390                         continue;
3391
3392                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3393
3394                 list_del(&k->list);
3395                 kfree(k);
3396                 removed++;
3397         }
3398
3399         return removed ? 0 : -ENOENT;
3400 }
3401
3402 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
3403 {
3404         struct smp_irk *k, *tmp;
3405
3406         list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
3407                 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
3408                         continue;
3409
3410                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3411
3412                 list_del(&k->list);
3413                 kfree(k);
3414         }
3415 }
3416
3417 /* HCI command timer function */
3418 static void hci_cmd_timeout(struct work_struct *work)
3419 {
3420         struct hci_dev *hdev = container_of(work, struct hci_dev,
3421                                             cmd_timer.work);
3422
3423         if (hdev->sent_cmd) {
3424                 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
3425                 u16 opcode = __le16_to_cpu(sent->opcode);
3426
3427                 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
3428         } else {
3429                 BT_ERR("%s command tx timeout", hdev->name);
3430         }
3431
3432         atomic_set(&hdev->cmd_cnt, 1);
3433         queue_work(hdev->workqueue, &hdev->cmd_work);
3434 }
3435
3436 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
3437                                           bdaddr_t *bdaddr)
3438 {
3439         struct oob_data *data;
3440
3441         list_for_each_entry(data, &hdev->remote_oob_data, list)
3442                 if (bacmp(bdaddr, &data->bdaddr) == 0)
3443                         return data;
3444
3445         return NULL;
3446 }
3447
3448 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
3449 {
3450         struct oob_data *data;
3451
3452         data = hci_find_remote_oob_data(hdev, bdaddr);
3453         if (!data)
3454                 return -ENOENT;
3455
3456         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3457
3458         list_del(&data->list);
3459         kfree(data);
3460
3461         return 0;
3462 }
3463
3464 void hci_remote_oob_data_clear(struct hci_dev *hdev)
3465 {
3466         struct oob_data *data, *n;
3467
3468         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
3469                 list_del(&data->list);
3470                 kfree(data);
3471         }
3472 }
3473
3474 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
3475                             u8 *hash, u8 *randomizer)
3476 {
3477         struct oob_data *data;
3478
3479         data = hci_find_remote_oob_data(hdev, bdaddr);
3480         if (!data) {
3481                 data = kmalloc(sizeof(*data), GFP_KERNEL);
3482                 if (!data)
3483                         return -ENOMEM;
3484
3485                 bacpy(&data->bdaddr, bdaddr);
3486                 list_add(&data->list, &hdev->remote_oob_data);
3487         }
3488
3489         memcpy(data->hash192, hash, sizeof(data->hash192));
3490         memcpy(data->randomizer192, randomizer, sizeof(data->randomizer192));
3491
3492         memset(data->hash256, 0, sizeof(data->hash256));
3493         memset(data->randomizer256, 0, sizeof(data->randomizer256));
3494
3495         BT_DBG("%s for %pMR", hdev->name, bdaddr);
3496
3497         return 0;
3498 }
3499
3500 int hci_add_remote_oob_ext_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
3501                                 u8 *hash192, u8 *randomizer192,
3502                                 u8 *hash256, u8 *randomizer256)
3503 {
3504         struct oob_data *data;
3505
3506         data = hci_find_remote_oob_data(hdev, bdaddr);
3507         if (!data) {
3508                 data = kmalloc(sizeof(*data), GFP_KERNEL);
3509                 if (!data)
3510                         return -ENOMEM;
3511
3512                 bacpy(&data->bdaddr, bdaddr);
3513                 list_add(&data->list, &hdev->remote_oob_data);
3514         }
3515
3516         memcpy(data->hash192, hash192, sizeof(data->hash192));
3517         memcpy(data->randomizer192, randomizer192, sizeof(data->randomizer192));
3518
3519         memcpy(data->hash256, hash256, sizeof(data->hash256));
3520         memcpy(data->randomizer256, randomizer256, sizeof(data->randomizer256));
3521
3522         BT_DBG("%s for %pMR", hdev->name, bdaddr);
3523
3524         return 0;
3525 }
3526
3527 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
3528                                          bdaddr_t *bdaddr, u8 type)
3529 {
3530         struct bdaddr_list *b;
3531
3532         list_for_each_entry(b, bdaddr_list, list) {
3533                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3534                         return b;
3535         }
3536
3537         return NULL;
3538 }
3539
3540 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
3541 {
3542         struct list_head *p, *n;
3543
3544         list_for_each_safe(p, n, bdaddr_list) {
3545                 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
3546
3547                 list_del(p);
3548                 kfree(b);
3549         }
3550 }
3551
3552 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
3553 {
3554         struct bdaddr_list *entry;
3555
3556         if (!bacmp(bdaddr, BDADDR_ANY))
3557                 return -EBADF;
3558
3559         if (hci_bdaddr_list_lookup(list, bdaddr, type))
3560                 return -EEXIST;
3561
3562         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3563         if (!entry)
3564                 return -ENOMEM;
3565
3566         bacpy(&entry->bdaddr, bdaddr);
3567         entry->bdaddr_type = type;
3568
3569         list_add(&entry->list, list);
3570
3571         return 0;
3572 }
3573
3574 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
3575 {
3576         struct bdaddr_list *entry;
3577
3578         if (!bacmp(bdaddr, BDADDR_ANY)) {
3579                 hci_bdaddr_list_clear(list);
3580                 return 0;
3581         }
3582
3583         entry = hci_bdaddr_list_lookup(list, bdaddr, type);
3584         if (!entry)
3585                 return -ENOENT;
3586
3587         list_del(&entry->list);
3588         kfree(entry);
3589
3590         return 0;
3591 }
3592
3593 /* This function requires the caller holds hdev->lock */
3594 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
3595                                                bdaddr_t *addr, u8 addr_type)
3596 {
3597         struct hci_conn_params *params;
3598
3599         /* The conn params list only contains identity addresses */
3600         if (!hci_is_identity_address(addr, addr_type))
3601                 return NULL;
3602
3603         list_for_each_entry(params, &hdev->le_conn_params, list) {
3604                 if (bacmp(&params->addr, addr) == 0 &&
3605                     params->addr_type == addr_type) {
3606                         return params;
3607                 }
3608         }
3609
3610         return NULL;
3611 }
3612
3613 static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
3614 {
3615         struct hci_conn *conn;
3616
3617         conn = hci_conn_hash_lookup_ba(hdev, LE_LINK, addr);
3618         if (!conn)
3619                 return false;
3620
3621         if (conn->dst_type != type)
3622                 return false;
3623
3624         if (conn->state != BT_CONNECTED)
3625                 return false;
3626
3627         return true;
3628 }
3629
3630 /* This function requires the caller holds hdev->lock */
3631 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
3632                                                   bdaddr_t *addr, u8 addr_type)
3633 {
3634         struct hci_conn_params *param;
3635
3636         /* The list only contains identity addresses */
3637         if (!hci_is_identity_address(addr, addr_type))
3638                 return NULL;
3639
3640         list_for_each_entry(param, list, action) {
3641                 if (bacmp(&param->addr, addr) == 0 &&
3642                     param->addr_type == addr_type)
3643                         return param;
3644         }
3645
3646         return NULL;
3647 }
3648
3649 /* This function requires the caller holds hdev->lock */
3650 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
3651                                             bdaddr_t *addr, u8 addr_type)
3652 {
3653         struct hci_conn_params *params;
3654
3655         if (!hci_is_identity_address(addr, addr_type))
3656                 return NULL;
3657
3658         params = hci_conn_params_lookup(hdev, addr, addr_type);
3659         if (params)
3660                 return params;
3661
3662         params = kzalloc(sizeof(*params), GFP_KERNEL);
3663         if (!params) {
3664                 BT_ERR("Out of memory");
3665                 return NULL;
3666         }
3667
3668         bacpy(&params->addr, addr);
3669         params->addr_type = addr_type;
3670
3671         list_add(&params->list, &hdev->le_conn_params);
3672         INIT_LIST_HEAD(&params->action);
3673
3674         params->conn_min_interval = hdev->le_conn_min_interval;
3675         params->conn_max_interval = hdev->le_conn_max_interval;
3676         params->conn_latency = hdev->le_conn_latency;
3677         params->supervision_timeout = hdev->le_supv_timeout;
3678         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3679
3680         BT_DBG("addr %pMR (type %u)", addr, addr_type);
3681
3682         return params;
3683 }
3684
3685 /* This function requires the caller holds hdev->lock */
3686 int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type,
3687                         u8 auto_connect)
3688 {
3689         struct hci_conn_params *params;
3690
3691         params = hci_conn_params_add(hdev, addr, addr_type);
3692         if (!params)
3693                 return -EIO;
3694
3695         if (params->auto_connect == auto_connect)
3696                 return 0;
3697
3698         list_del_init(&params->action);
3699
3700         switch (auto_connect) {
3701         case HCI_AUTO_CONN_DISABLED:
3702         case HCI_AUTO_CONN_LINK_LOSS:
3703                 hci_update_background_scan(hdev);
3704                 break;
3705         case HCI_AUTO_CONN_REPORT:
3706                 list_add(&params->action, &hdev->pend_le_reports);
3707                 hci_update_background_scan(hdev);
3708                 break;
3709         case HCI_AUTO_CONN_DIRECT:
3710         case HCI_AUTO_CONN_ALWAYS:
3711                 if (!is_connected(hdev, addr, addr_type)) {
3712                         list_add(&params->action, &hdev->pend_le_conns);
3713                         hci_update_background_scan(hdev);
3714                 }
3715                 break;
3716         }
3717
3718         params->auto_connect = auto_connect;
3719
3720         BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
3721                auto_connect);
3722
3723         return 0;
3724 }
3725
3726 /* This function requires the caller holds hdev->lock */
3727 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3728 {
3729         struct hci_conn_params *params;
3730
3731         params = hci_conn_params_lookup(hdev, addr, addr_type);
3732         if (!params)
3733                 return;
3734
3735         if (params->conn)
3736                 hci_conn_drop(params->conn);
3737
3738         list_del(&params->action);
3739         list_del(&params->list);
3740         kfree(params);
3741
3742         hci_update_background_scan(hdev);
3743
3744         BT_DBG("addr %pMR (type %u)", addr, addr_type);
3745 }
3746
3747 /* This function requires the caller holds hdev->lock */
3748 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
3749 {
3750         struct hci_conn_params *params, *tmp;
3751
3752         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3753                 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3754                         continue;
3755                 list_del(&params->list);
3756                 kfree(params);
3757         }
3758
3759         BT_DBG("All LE disabled connection parameters were removed");
3760 }
3761
3762 /* This function requires the caller holds hdev->lock */
3763 void hci_conn_params_clear_all(struct hci_dev *hdev)
3764 {
3765         struct hci_conn_params *params, *tmp;
3766
3767         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3768                 if (params->conn)
3769                         hci_conn_drop(params->conn);
3770                 list_del(&params->action);
3771                 list_del(&params->list);
3772                 kfree(params);
3773         }
3774
3775         hci_update_background_scan(hdev);
3776
3777         BT_DBG("All LE connection parameters were removed");
3778 }
3779
3780 static void inquiry_complete(struct hci_dev *hdev, u8 status)
3781 {
3782         if (status) {
3783                 BT_ERR("Failed to start inquiry: status %d", status);
3784
3785                 hci_dev_lock(hdev);
3786                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3787                 hci_dev_unlock(hdev);
3788                 return;
3789         }
3790 }
3791
3792 static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
3793 {
3794         /* General inquiry access code (GIAC) */
3795         u8 lap[3] = { 0x33, 0x8b, 0x9e };
3796         struct hci_request req;
3797         struct hci_cp_inquiry cp;
3798         int err;
3799
3800         if (status) {
3801                 BT_ERR("Failed to disable LE scanning: status %d", status);
3802                 return;
3803         }
3804
3805         switch (hdev->discovery.type) {
3806         case DISCOV_TYPE_LE:
3807                 hci_dev_lock(hdev);
3808                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3809                 hci_dev_unlock(hdev);
3810                 break;
3811
3812         case DISCOV_TYPE_INTERLEAVED:
3813                 hci_req_init(&req, hdev);
3814
3815                 memset(&cp, 0, sizeof(cp));
3816                 memcpy(&cp.lap, lap, sizeof(cp.lap));
3817                 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
3818                 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
3819
3820                 hci_dev_lock(hdev);
3821
3822                 hci_inquiry_cache_flush(hdev);
3823
3824                 err = hci_req_run(&req, inquiry_complete);
3825                 if (err) {
3826                         BT_ERR("Inquiry request failed: err %d", err);
3827                         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3828                 }
3829
3830                 hci_dev_unlock(hdev);
3831                 break;
3832         }
3833 }
3834
3835 static void le_scan_disable_work(struct work_struct *work)
3836 {
3837         struct hci_dev *hdev = container_of(work, struct hci_dev,
3838                                             le_scan_disable.work);
3839         struct hci_request req;
3840         int err;
3841
3842         BT_DBG("%s", hdev->name);
3843
3844         hci_req_init(&req, hdev);
3845
3846         hci_req_add_le_scan_disable(&req);
3847
3848         err = hci_req_run(&req, le_scan_disable_work_complete);
3849         if (err)
3850                 BT_ERR("Disable LE scanning request failed: err %d", err);
3851 }
3852
3853 static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
3854 {
3855         struct hci_dev *hdev = req->hdev;
3856
3857         /* If we're advertising or initiating an LE connection we can't
3858          * go ahead and change the random address at this time. This is
3859          * because the eventual initiator address used for the
3860          * subsequently created connection will be undefined (some
3861          * controllers use the new address and others the one we had
3862          * when the operation started).
3863          *
3864          * In this kind of scenario skip the update and let the random
3865          * address be updated at the next cycle.
3866          */
3867         if (test_bit(HCI_LE_ADV, &hdev->dev_flags) ||
3868             hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
3869                 BT_DBG("Deferring random address update");
3870                 return;
3871         }
3872
3873         hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6, rpa);
3874 }
3875
3876 int hci_update_random_address(struct hci_request *req, bool require_privacy,
3877                               u8 *own_addr_type)
3878 {
3879         struct hci_dev *hdev = req->hdev;
3880         int err;
3881
3882         /* If privacy is enabled use a resolvable private address. If
3883          * current RPA has expired or there is something else than
3884          * the current RPA in use, then generate a new one.
3885          */
3886         if (test_bit(HCI_PRIVACY, &hdev->dev_flags)) {
3887                 int to;
3888
3889                 *own_addr_type = ADDR_LE_DEV_RANDOM;
3890
3891                 if (!test_and_clear_bit(HCI_RPA_EXPIRED, &hdev->dev_flags) &&
3892                     !bacmp(&hdev->random_addr, &hdev->rpa))
3893                         return 0;
3894
3895                 err = smp_generate_rpa(hdev->tfm_aes, hdev->irk, &hdev->rpa);
3896                 if (err < 0) {
3897                         BT_ERR("%s failed to generate new RPA", hdev->name);
3898                         return err;
3899                 }
3900
3901                 set_random_addr(req, &hdev->rpa);
3902
3903                 to = msecs_to_jiffies(hdev->rpa_timeout * 1000);
3904                 queue_delayed_work(hdev->workqueue, &hdev->rpa_expired, to);
3905
3906                 return 0;
3907         }
3908
3909         /* In case of required privacy without resolvable private address,
3910          * use an unresolvable private address. This is useful for active
3911          * scanning and non-connectable advertising.
3912          */
3913         if (require_privacy) {
3914                 bdaddr_t urpa;
3915
3916                 get_random_bytes(&urpa, 6);
3917                 urpa.b[5] &= 0x3f;      /* Clear two most significant bits */
3918
3919                 *own_addr_type = ADDR_LE_DEV_RANDOM;
3920                 set_random_addr(req, &urpa);
3921                 return 0;
3922         }
3923
3924         /* If forcing static address is in use or there is no public
3925          * address use the static address as random address (but skip
3926          * the HCI command if the current random address is already the
3927          * static one.
3928          */
3929         if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
3930             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
3931                 *own_addr_type = ADDR_LE_DEV_RANDOM;
3932                 if (bacmp(&hdev->static_addr, &hdev->random_addr))
3933                         hci_req_add(req, HCI_OP_LE_SET_RANDOM_ADDR, 6,
3934                                     &hdev->static_addr);
3935                 return 0;
3936         }
3937
3938         /* Neither privacy nor static address is being used so use a
3939          * public address.
3940          */
3941         *own_addr_type = ADDR_LE_DEV_PUBLIC;
3942
3943         return 0;
3944 }
3945
3946 /* Copy the Identity Address of the controller.
3947  *
3948  * If the controller has a public BD_ADDR, then by default use that one.
3949  * If this is a LE only controller without a public address, default to
3950  * the static random address.
3951  *
3952  * For debugging purposes it is possible to force controllers with a
3953  * public address to use the static random address instead.
3954  */
3955 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3956                                u8 *bdaddr_type)
3957 {
3958         if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
3959             !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
3960                 bacpy(bdaddr, &hdev->static_addr);
3961                 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3962         } else {
3963                 bacpy(bdaddr, &hdev->bdaddr);
3964                 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3965         }
3966 }
3967
3968 /* Alloc HCI device */
3969 struct hci_dev *hci_alloc_dev(void)
3970 {
3971         struct hci_dev *hdev;
3972
3973         hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3974         if (!hdev)
3975                 return NULL;
3976
3977         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3978         hdev->esco_type = (ESCO_HV1);
3979         hdev->link_mode = (HCI_LM_ACCEPT);
3980         hdev->num_iac = 0x01;           /* One IAC support is mandatory */
3981         hdev->io_capability = 0x03;     /* No Input No Output */
3982         hdev->manufacturer = 0xffff;    /* Default to internal use */
3983         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3984         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3985
3986         hdev->sniff_max_interval = 800;
3987         hdev->sniff_min_interval = 80;
3988
3989         hdev->le_adv_channel_map = 0x07;
3990         hdev->le_adv_min_interval = 0x0800;
3991         hdev->le_adv_max_interval = 0x0800;
3992         hdev->le_scan_interval = 0x0060;
3993         hdev->le_scan_window = 0x0030;
3994         hdev->le_conn_min_interval = 0x0028;
3995         hdev->le_conn_max_interval = 0x0038;
3996         hdev->le_conn_latency = 0x0000;
3997         hdev->le_supv_timeout = 0x002a;
3998
3999         hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
4000         hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
4001         hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
4002         hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
4003
4004         mutex_init(&hdev->lock);
4005         mutex_init(&hdev->req_lock);
4006
4007         INIT_LIST_HEAD(&hdev->mgmt_pending);
4008         INIT_LIST_HEAD(&hdev->blacklist);
4009         INIT_LIST_HEAD(&hdev->whitelist);
4010         INIT_LIST_HEAD(&hdev->uuids);
4011         INIT_LIST_HEAD(&hdev->link_keys);
4012         INIT_LIST_HEAD(&hdev->long_term_keys);
4013         INIT_LIST_HEAD(&hdev->identity_resolving_keys);
4014         INIT_LIST_HEAD(&hdev->remote_oob_data);
4015         INIT_LIST_HEAD(&hdev->le_white_list);
4016         INIT_LIST_HEAD(&hdev->le_conn_params);
4017         INIT_LIST_HEAD(&hdev->pend_le_conns);
4018         INIT_LIST_HEAD(&hdev->pend_le_reports);
4019         INIT_LIST_HEAD(&hdev->conn_hash.list);
4020
4021         INIT_WORK(&hdev->rx_work, hci_rx_work);
4022         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
4023         INIT_WORK(&hdev->tx_work, hci_tx_work);
4024         INIT_WORK(&hdev->power_on, hci_power_on);
4025
4026         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
4027         INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
4028         INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
4029
4030         skb_queue_head_init(&hdev->rx_q);
4031         skb_queue_head_init(&hdev->cmd_q);
4032         skb_queue_head_init(&hdev->raw_q);
4033
4034         init_waitqueue_head(&hdev->req_wait_q);
4035
4036         INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
4037
4038         hci_init_sysfs(hdev);
4039         discovery_init(hdev);
4040
4041         return hdev;
4042 }
4043 EXPORT_SYMBOL(hci_alloc_dev);
4044
4045 /* Free HCI device */
4046 void hci_free_dev(struct hci_dev *hdev)
4047 {
4048         /* will free via device release */
4049         put_device(&hdev->dev);
4050 }
4051 EXPORT_SYMBOL(hci_free_dev);
4052
4053 /* Register HCI device */
4054 int hci_register_dev(struct hci_dev *hdev)
4055 {
4056         int id, error;
4057
4058         if (!hdev->open || !hdev->close || !hdev->send)
4059                 return -EINVAL;
4060
4061         /* Do not allow HCI_AMP devices to register at index 0,
4062          * so the index can be used as the AMP controller ID.
4063          */
4064         switch (hdev->dev_type) {
4065         case HCI_BREDR:
4066                 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
4067                 break;
4068         case HCI_AMP:
4069                 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
4070                 break;
4071         default:
4072                 return -EINVAL;
4073         }
4074
4075         if (id < 0)
4076                 return id;
4077
4078         sprintf(hdev->name, "hci%d", id);
4079         hdev->id = id;
4080
4081         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
4082
4083         hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
4084                                           WQ_MEM_RECLAIM, 1, hdev->name);
4085         if (!hdev->workqueue) {
4086                 error = -ENOMEM;
4087                 goto err;
4088         }
4089
4090         hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
4091                                               WQ_MEM_RECLAIM, 1, hdev->name);
4092         if (!hdev->req_workqueue) {
4093                 destroy_workqueue(hdev->workqueue);
4094                 error = -ENOMEM;
4095                 goto err;
4096         }
4097
4098         if (!IS_ERR_OR_NULL(bt_debugfs))
4099                 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
4100
4101         dev_set_name(&hdev->dev, "%s", hdev->name);
4102
4103         hdev->tfm_aes = crypto_alloc_blkcipher("ecb(aes)", 0,
4104                                                CRYPTO_ALG_ASYNC);
4105         if (IS_ERR(hdev->tfm_aes)) {
4106                 BT_ERR("Unable to create crypto context");
4107                 error = PTR_ERR(hdev->tfm_aes);
4108                 hdev->tfm_aes = NULL;
4109                 goto err_wqueue;
4110         }
4111
4112         error = device_add(&hdev->dev);
4113         if (error < 0)
4114                 goto err_tfm;
4115
4116         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
4117                                     RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
4118                                     hdev);
4119         if (hdev->rfkill) {
4120                 if (rfkill_register(hdev->rfkill) < 0) {
4121                         rfkill_destroy(hdev->rfkill);
4122                         hdev->rfkill = NULL;
4123                 }
4124         }
4125
4126         if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
4127                 set_bit(HCI_RFKILLED, &hdev->dev_flags);
4128
4129         set_bit(HCI_SETUP, &hdev->dev_flags);
4130         set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
4131
4132         if (hdev->dev_type == HCI_BREDR) {
4133                 /* Assume BR/EDR support until proven otherwise (such as
4134                  * through reading supported features during init.
4135                  */
4136                 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
4137         }
4138
4139         write_lock(&hci_dev_list_lock);
4140         list_add(&hdev->list, &hci_dev_list);
4141         write_unlock(&hci_dev_list_lock);
4142
4143         /* Devices that are marked for raw-only usage are unconfigured
4144          * and should not be included in normal operation.
4145          */
4146         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
4147                 set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
4148
4149         hci_notify(hdev, HCI_DEV_REG);
4150         hci_dev_hold(hdev);
4151
4152         queue_work(hdev->req_workqueue, &hdev->power_on);
4153
4154         return id;
4155
4156 err_tfm:
4157         crypto_free_blkcipher(hdev->tfm_aes);
4158 err_wqueue:
4159         destroy_workqueue(hdev->workqueue);
4160         destroy_workqueue(hdev->req_workqueue);
4161 err:
4162         ida_simple_remove(&hci_index_ida, hdev->id);
4163
4164         return error;
4165 }
4166 EXPORT_SYMBOL(hci_register_dev);
4167
4168 /* Unregister HCI device */
4169 void hci_unregister_dev(struct hci_dev *hdev)
4170 {
4171         int i, id;
4172
4173         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
4174
4175         set_bit(HCI_UNREGISTER, &hdev->dev_flags);
4176
4177         id = hdev->id;
4178
4179         write_lock(&hci_dev_list_lock);
4180         list_del(&hdev->list);
4181         write_unlock(&hci_dev_list_lock);
4182
4183         hci_dev_do_close(hdev);
4184
4185         for (i = 0; i < NUM_REASSEMBLY; i++)
4186                 kfree_skb(hdev->reassembly[i]);
4187
4188         cancel_work_sync(&hdev->power_on);
4189
4190         if (!test_bit(HCI_INIT, &hdev->flags) &&
4191             !test_bit(HCI_SETUP, &hdev->dev_flags) &&
4192             !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
4193                 hci_dev_lock(hdev);
4194                 mgmt_index_removed(hdev);
4195                 hci_dev_unlock(hdev);
4196         }
4197
4198         /* mgmt_index_removed should take care of emptying the
4199          * pending list */
4200         BUG_ON(!list_empty(&hdev->mgmt_pending));
4201
4202         hci_notify(hdev, HCI_DEV_UNREG);
4203
4204         if (hdev->rfkill) {
4205                 rfkill_unregister(hdev->rfkill);
4206                 rfkill_destroy(hdev->rfkill);
4207         }
4208
4209         if (hdev->tfm_aes)
4210                 crypto_free_blkcipher(hdev->tfm_aes);
4211
4212         device_del(&hdev->dev);
4213
4214         debugfs_remove_recursive(hdev->debugfs);
4215
4216         destroy_workqueue(hdev->workqueue);
4217         destroy_workqueue(hdev->req_workqueue);
4218
4219         hci_dev_lock(hdev);
4220         hci_bdaddr_list_clear(&hdev->blacklist);
4221         hci_bdaddr_list_clear(&hdev->whitelist);
4222         hci_uuids_clear(hdev);
4223         hci_link_keys_clear(hdev);
4224         hci_smp_ltks_clear(hdev);
4225         hci_smp_irks_clear(hdev);
4226         hci_remote_oob_data_clear(hdev);
4227         hci_bdaddr_list_clear(&hdev->le_white_list);
4228         hci_conn_params_clear_all(hdev);
4229         hci_dev_unlock(hdev);
4230
4231         hci_dev_put(hdev);
4232
4233         ida_simple_remove(&hci_index_ida, id);
4234 }
4235 EXPORT_SYMBOL(hci_unregister_dev);
4236
4237 /* Suspend HCI device */
4238 int hci_suspend_dev(struct hci_dev *hdev)
4239 {
4240         hci_notify(hdev, HCI_DEV_SUSPEND);
4241         return 0;
4242 }
4243 EXPORT_SYMBOL(hci_suspend_dev);
4244
4245 /* Resume HCI device */
4246 int hci_resume_dev(struct hci_dev *hdev)
4247 {
4248         hci_notify(hdev, HCI_DEV_RESUME);
4249         return 0;
4250 }
4251 EXPORT_SYMBOL(hci_resume_dev);
4252
4253 /* Receive frame from HCI drivers */
4254 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
4255 {
4256         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
4257                       && !test_bit(HCI_INIT, &hdev->flags))) {
4258                 kfree_skb(skb);
4259                 return -ENXIO;
4260         }
4261
4262         /* Incoming skb */
4263         bt_cb(skb)->incoming = 1;
4264
4265         /* Time stamp */
4266         __net_timestamp(skb);
4267
4268         skb_queue_tail(&hdev->rx_q, skb);
4269         queue_work(hdev->workqueue, &hdev->rx_work);
4270
4271         return 0;
4272 }
4273 EXPORT_SYMBOL(hci_recv_frame);
4274
4275 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
4276                           int count, __u8 index)
4277 {
4278         int len = 0;
4279         int hlen = 0;
4280         int remain = count;
4281         struct sk_buff *skb;
4282         struct bt_skb_cb *scb;
4283
4284         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
4285             index >= NUM_REASSEMBLY)
4286                 return -EILSEQ;
4287
4288         skb = hdev->reassembly[index];
4289
4290         if (!skb) {
4291                 switch (type) {
4292                 case HCI_ACLDATA_PKT:
4293                         len = HCI_MAX_FRAME_SIZE;
4294                         hlen = HCI_ACL_HDR_SIZE;
4295                         break;
4296                 case HCI_EVENT_PKT:
4297                         len = HCI_MAX_EVENT_SIZE;
4298                         hlen = HCI_EVENT_HDR_SIZE;
4299                         break;
4300                 case HCI_SCODATA_PKT:
4301                         len = HCI_MAX_SCO_SIZE;
4302                         hlen = HCI_SCO_HDR_SIZE;
4303                         break;
4304                 }
4305
4306                 skb = bt_skb_alloc(len, GFP_ATOMIC);
4307                 if (!skb)
4308                         return -ENOMEM;
4309
4310                 scb = (void *) skb->cb;
4311                 scb->expect = hlen;
4312                 scb->pkt_type = type;
4313
4314                 hdev->reassembly[index] = skb;
4315         }
4316
4317         while (count) {
4318                 scb = (void *) skb->cb;
4319                 len = min_t(uint, scb->expect, count);
4320
4321                 memcpy(skb_put(skb, len), data, len);
4322
4323                 count -= len;
4324                 data += len;
4325                 scb->expect -= len;
4326                 remain = count;
4327
4328                 switch (type) {
4329                 case HCI_EVENT_PKT:
4330                         if (skb->len == HCI_EVENT_HDR_SIZE) {
4331                                 struct hci_event_hdr *h = hci_event_hdr(skb);
4332                                 scb->expect = h->plen;
4333
4334                                 if (skb_tailroom(skb) < scb->expect) {
4335                                         kfree_skb(skb);
4336                                         hdev->reassembly[index] = NULL;
4337                                         return -ENOMEM;
4338                                 }
4339                         }
4340                         break;
4341
4342                 case HCI_ACLDATA_PKT:
4343                         if (skb->len  == HCI_ACL_HDR_SIZE) {
4344                                 struct hci_acl_hdr *h = hci_acl_hdr(skb);
4345                                 scb->expect = __le16_to_cpu(h->dlen);
4346
4347                                 if (skb_tailroom(skb) < scb->expect) {
4348                                         kfree_skb(skb);
4349                                         hdev->reassembly[index] = NULL;
4350                                         return -ENOMEM;
4351                                 }
4352                         }
4353                         break;
4354
4355                 case HCI_SCODATA_PKT:
4356                         if (skb->len == HCI_SCO_HDR_SIZE) {
4357                                 struct hci_sco_hdr *h = hci_sco_hdr(skb);
4358                                 scb->expect = h->dlen;
4359
4360                                 if (skb_tailroom(skb) < scb->expect) {
4361                                         kfree_skb(skb);
4362                                         hdev->reassembly[index] = NULL;
4363                                         return -ENOMEM;
4364                                 }
4365                         }
4366                         break;
4367                 }
4368
4369                 if (scb->expect == 0) {
4370                         /* Complete frame */
4371
4372                         bt_cb(skb)->pkt_type = type;
4373                         hci_recv_frame(hdev, skb);
4374
4375                         hdev->reassembly[index] = NULL;
4376                         return remain;
4377                 }
4378         }
4379
4380         return remain;
4381 }
4382
4383 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
4384 {
4385         int rem = 0;
4386
4387         if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
4388                 return -EILSEQ;
4389
4390         while (count) {
4391                 rem = hci_reassembly(hdev, type, data, count, type - 1);
4392                 if (rem < 0)
4393                         return rem;
4394
4395                 data += (count - rem);
4396                 count = rem;
4397         }
4398
4399         return rem;
4400 }
4401 EXPORT_SYMBOL(hci_recv_fragment);
4402
4403 #define STREAM_REASSEMBLY 0
4404
4405 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
4406 {
4407         int type;
4408         int rem = 0;
4409
4410         while (count) {
4411                 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
4412
4413                 if (!skb) {
4414                         struct { char type; } *pkt;
4415
4416                         /* Start of the frame */
4417                         pkt = data;
4418                         type = pkt->type;
4419
4420                         data++;
4421                         count--;
4422                 } else
4423                         type = bt_cb(skb)->pkt_type;
4424
4425                 rem = hci_reassembly(hdev, type, data, count,
4426                                      STREAM_REASSEMBLY);
4427                 if (rem < 0)
4428                         return rem;
4429
4430                 data += (count - rem);
4431                 count = rem;
4432         }
4433
4434         return rem;
4435 }
4436 EXPORT_SYMBOL(hci_recv_stream_fragment);
4437
4438 /* ---- Interface to upper protocols ---- */
4439
4440 int hci_register_cb(struct hci_cb *cb)
4441 {
4442         BT_DBG("%p name %s", cb, cb->name);
4443
4444         write_lock(&hci_cb_list_lock);
4445         list_add(&cb->list, &hci_cb_list);
4446         write_unlock(&hci_cb_list_lock);
4447
4448         return 0;
4449 }
4450 EXPORT_SYMBOL(hci_register_cb);
4451
4452 int hci_unregister_cb(struct hci_cb *cb)
4453 {
4454         BT_DBG("%p name %s", cb, cb->name);
4455
4456         write_lock(&hci_cb_list_lock);
4457         list_del(&cb->list);
4458         write_unlock(&hci_cb_list_lock);
4459
4460         return 0;
4461 }
4462 EXPORT_SYMBOL(hci_unregister_cb);
4463
4464 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
4465 {
4466         int err;
4467
4468         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
4469
4470         /* Time stamp */
4471         __net_timestamp(skb);
4472
4473         /* Send copy to monitor */
4474         hci_send_to_monitor(hdev, skb);
4475
4476         if (atomic_read(&hdev->promisc)) {
4477                 /* Send copy to the sockets */
4478                 hci_send_to_sock(hdev, skb);
4479         }
4480
4481         /* Get rid of skb owner, prior to sending to the driver. */
4482         skb_orphan(skb);
4483
4484         err = hdev->send(hdev, skb);
4485         if (err < 0) {
4486                 BT_ERR("%s sending frame failed (%d)", hdev->name, err);
4487                 kfree_skb(skb);
4488         }
4489 }
4490
4491 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
4492 {
4493         skb_queue_head_init(&req->cmd_q);
4494         req->hdev = hdev;
4495         req->err = 0;
4496 }
4497
4498 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
4499 {
4500         struct hci_dev *hdev = req->hdev;
4501         struct sk_buff *skb;
4502         unsigned long flags;
4503
4504         BT_DBG("length %u", skb_queue_len(&req->cmd_q));
4505
4506         /* If an error occured during request building, remove all HCI
4507          * commands queued on the HCI request queue.
4508          */
4509         if (req->err) {
4510                 skb_queue_purge(&req->cmd_q);
4511                 return req->err;
4512         }
4513
4514         /* Do not allow empty requests */
4515         if (skb_queue_empty(&req->cmd_q))
4516                 return -ENODATA;
4517
4518         skb = skb_peek_tail(&req->cmd_q);
4519         bt_cb(skb)->req.complete = complete;
4520
4521         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4522         skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
4523         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4524
4525         queue_work(hdev->workqueue, &hdev->cmd_work);
4526
4527         return 0;
4528 }
4529
4530 bool hci_req_pending(struct hci_dev *hdev)
4531 {
4532         return (hdev->req_status == HCI_REQ_PEND);
4533 }
4534
4535 static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
4536                                        u32 plen, const void *param)
4537 {
4538         int len = HCI_COMMAND_HDR_SIZE + plen;
4539         struct hci_command_hdr *hdr;
4540         struct sk_buff *skb;
4541
4542         skb = bt_skb_alloc(len, GFP_ATOMIC);
4543         if (!skb)
4544                 return NULL;
4545
4546         hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
4547         hdr->opcode = cpu_to_le16(opcode);
4548         hdr->plen   = plen;
4549
4550         if (plen)
4551                 memcpy(skb_put(skb, plen), param, plen);
4552
4553         BT_DBG("skb len %d", skb->len);
4554
4555         bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
4556
4557         return skb;
4558 }
4559
4560 /* Send HCI command */
4561 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
4562                  const void *param)
4563 {
4564         struct sk_buff *skb;
4565
4566         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
4567
4568         skb = hci_prepare_cmd(hdev, opcode, plen, param);
4569         if (!skb) {
4570                 BT_ERR("%s no memory for command", hdev->name);
4571                 return -ENOMEM;
4572         }
4573
4574         /* Stand-alone HCI commands must be flaged as
4575          * single-command requests.
4576          */
4577         bt_cb(skb)->req.start = true;
4578
4579         skb_queue_tail(&hdev->cmd_q, skb);
4580         queue_work(hdev->workqueue, &hdev->cmd_work);
4581
4582         return 0;
4583 }
4584
4585 /* Queue a command to an asynchronous HCI request */
4586 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
4587                     const void *param, u8 event)
4588 {
4589         struct hci_dev *hdev = req->hdev;
4590         struct sk_buff *skb;
4591
4592         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
4593
4594         /* If an error occured during request building, there is no point in
4595          * queueing the HCI command. We can simply return.
4596          */
4597         if (req->err)
4598                 return;
4599
4600         skb = hci_prepare_cmd(hdev, opcode, plen, param);
4601         if (!skb) {
4602                 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
4603                        hdev->name, opcode);
4604                 req->err = -ENOMEM;
4605                 return;
4606         }
4607
4608         if (skb_queue_empty(&req->cmd_q))
4609                 bt_cb(skb)->req.start = true;
4610
4611         bt_cb(skb)->req.event = event;
4612
4613         skb_queue_tail(&req->cmd_q, skb);
4614 }
4615
4616 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
4617                  const void *param)
4618 {
4619         hci_req_add_ev(req, opcode, plen, param, 0);
4620 }
4621
4622 /* Get data from the previously sent command */
4623 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
4624 {
4625         struct hci_command_hdr *hdr;
4626
4627         if (!hdev->sent_cmd)
4628                 return NULL;
4629
4630         hdr = (void *) hdev->sent_cmd->data;
4631
4632         if (hdr->opcode != cpu_to_le16(opcode))
4633                 return NULL;
4634
4635         BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
4636
4637         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
4638 }
4639
4640 /* Send ACL data */
4641 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
4642 {
4643         struct hci_acl_hdr *hdr;
4644         int len = skb->len;
4645
4646         skb_push(skb, HCI_ACL_HDR_SIZE);
4647         skb_reset_transport_header(skb);
4648         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
4649         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
4650         hdr->dlen   = cpu_to_le16(len);
4651 }
4652
4653 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
4654                           struct sk_buff *skb, __u16 flags)
4655 {
4656         struct hci_conn *conn = chan->conn;
4657         struct hci_dev *hdev = conn->hdev;
4658         struct sk_buff *list;
4659
4660         skb->len = skb_headlen(skb);
4661         skb->data_len = 0;
4662
4663         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
4664
4665         switch (hdev->dev_type) {
4666         case HCI_BREDR:
4667                 hci_add_acl_hdr(skb, conn->handle, flags);
4668                 break;
4669         case HCI_AMP:
4670                 hci_add_acl_hdr(skb, chan->handle, flags);
4671                 break;
4672         default:
4673                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
4674                 return;
4675         }
4676
4677         list = skb_shinfo(skb)->frag_list;
4678         if (!list) {
4679                 /* Non fragmented */
4680                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
4681
4682                 skb_queue_tail(queue, skb);
4683         } else {
4684                 /* Fragmented */
4685                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4686
4687                 skb_shinfo(skb)->frag_list = NULL;
4688
4689                 /* Queue all fragments atomically */
4690                 spin_lock(&queue->lock);
4691
4692                 __skb_queue_tail(queue, skb);
4693
4694                 flags &= ~ACL_START;
4695                 flags |= ACL_CONT;
4696                 do {
4697                         skb = list; list = list->next;
4698
4699                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
4700                         hci_add_acl_hdr(skb, conn->handle, flags);
4701
4702                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4703
4704                         __skb_queue_tail(queue, skb);
4705                 } while (list);
4706
4707                 spin_unlock(&queue->lock);
4708         }
4709 }
4710
4711 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
4712 {
4713         struct hci_dev *hdev = chan->conn->hdev;
4714
4715         BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
4716
4717         hci_queue_acl(chan, &chan->data_q, skb, flags);
4718
4719         queue_work(hdev->workqueue, &hdev->tx_work);
4720 }
4721
4722 /* Send SCO data */
4723 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
4724 {
4725         struct hci_dev *hdev = conn->hdev;
4726         struct hci_sco_hdr hdr;
4727
4728         BT_DBG("%s len %d", hdev->name, skb->len);
4729
4730         hdr.handle = cpu_to_le16(conn->handle);
4731         hdr.dlen   = skb->len;
4732
4733         skb_push(skb, HCI_SCO_HDR_SIZE);
4734         skb_reset_transport_header(skb);
4735         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
4736
4737         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
4738
4739         skb_queue_tail(&conn->data_q, skb);
4740         queue_work(hdev->workqueue, &hdev->tx_work);
4741 }
4742
4743 /* ---- HCI TX task (outgoing data) ---- */
4744
4745 /* HCI Connection scheduler */
4746 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
4747                                      int *quote)
4748 {
4749         struct hci_conn_hash *h = &hdev->conn_hash;
4750         struct hci_conn *conn = NULL, *c;
4751         unsigned int num = 0, min = ~0;
4752
4753         /* We don't have to lock device here. Connections are always
4754          * added and removed with TX task disabled. */
4755
4756         rcu_read_lock();
4757
4758         list_for_each_entry_rcu(c, &h->list, list) {
4759                 if (c->type != type || skb_queue_empty(&c->data_q))
4760                         continue;
4761
4762                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
4763                         continue;
4764
4765                 num++;
4766
4767                 if (c->sent < min) {
4768                         min  = c->sent;
4769                         conn = c;
4770                 }
4771
4772                 if (hci_conn_num(hdev, type) == num)
4773                         break;
4774         }
4775
4776         rcu_read_unlock();
4777
4778         if (conn) {
4779                 int cnt, q;
4780
4781                 switch (conn->type) {
4782                 case ACL_LINK:
4783                         cnt = hdev->acl_cnt;
4784                         break;
4785                 case SCO_LINK:
4786                 case ESCO_LINK:
4787                         cnt = hdev->sco_cnt;
4788                         break;
4789                 case LE_LINK:
4790                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4791                         break;
4792                 default:
4793                         cnt = 0;
4794                         BT_ERR("Unknown link type");
4795                 }
4796
4797                 q = cnt / num;
4798                 *quote = q ? q : 1;
4799         } else
4800                 *quote = 0;
4801
4802         BT_DBG("conn %p quote %d", conn, *quote);
4803         return conn;
4804 }
4805
4806 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
4807 {
4808         struct hci_conn_hash *h = &hdev->conn_hash;
4809         struct hci_conn *c;
4810
4811         BT_ERR("%s link tx timeout", hdev->name);
4812
4813         rcu_read_lock();
4814
4815         /* Kill stalled connections */
4816         list_for_each_entry_rcu(c, &h->list, list) {
4817                 if (c->type == type && c->sent) {
4818                         BT_ERR("%s killing stalled connection %pMR",
4819                                hdev->name, &c->dst);
4820                         hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
4821                 }
4822         }
4823
4824         rcu_read_unlock();
4825 }
4826
4827 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
4828                                       int *quote)
4829 {
4830         struct hci_conn_hash *h = &hdev->conn_hash;
4831         struct hci_chan *chan = NULL;
4832         unsigned int num = 0, min = ~0, cur_prio = 0;
4833         struct hci_conn *conn;
4834         int cnt, q, conn_num = 0;
4835
4836         BT_DBG("%s", hdev->name);
4837
4838         rcu_read_lock();
4839
4840         list_for_each_entry_rcu(conn, &h->list, list) {
4841                 struct hci_chan *tmp;
4842
4843                 if (conn->type != type)
4844                         continue;
4845
4846                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4847                         continue;
4848
4849                 conn_num++;
4850
4851                 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
4852                         struct sk_buff *skb;
4853
4854                         if (skb_queue_empty(&tmp->data_q))
4855                                 continue;
4856
4857                         skb = skb_peek(&tmp->data_q);
4858                         if (skb->priority < cur_prio)
4859                                 continue;
4860
4861                         if (skb->priority > cur_prio) {
4862                                 num = 0;
4863                                 min = ~0;
4864                                 cur_prio = skb->priority;
4865                         }
4866
4867                         num++;
4868
4869                         if (conn->sent < min) {
4870                                 min  = conn->sent;
4871                                 chan = tmp;
4872                         }
4873                 }
4874
4875                 if (hci_conn_num(hdev, type) == conn_num)
4876                         break;
4877         }
4878
4879         rcu_read_unlock();
4880
4881         if (!chan)
4882                 return NULL;
4883
4884         switch (chan->conn->type) {
4885         case ACL_LINK:
4886                 cnt = hdev->acl_cnt;
4887                 break;
4888         case AMP_LINK:
4889                 cnt = hdev->block_cnt;
4890                 break;
4891         case SCO_LINK:
4892         case ESCO_LINK:
4893                 cnt = hdev->sco_cnt;
4894                 break;
4895         case LE_LINK:
4896                 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4897                 break;
4898         default:
4899                 cnt = 0;
4900                 BT_ERR("Unknown link type");
4901         }
4902
4903         q = cnt / num;
4904         *quote = q ? q : 1;
4905         BT_DBG("chan %p quote %d", chan, *quote);
4906         return chan;
4907 }
4908
4909 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
4910 {
4911         struct hci_conn_hash *h = &hdev->conn_hash;
4912         struct hci_conn *conn;
4913         int num = 0;
4914
4915         BT_DBG("%s", hdev->name);
4916
4917         rcu_read_lock();
4918
4919         list_for_each_entry_rcu(conn, &h->list, list) {
4920                 struct hci_chan *chan;
4921
4922                 if (conn->type != type)
4923                         continue;
4924
4925                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4926                         continue;
4927
4928                 num++;
4929
4930                 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
4931                         struct sk_buff *skb;
4932
4933                         if (chan->sent) {
4934                                 chan->sent = 0;
4935                                 continue;
4936                         }
4937
4938                         if (skb_queue_empty(&chan->data_q))
4939                                 continue;
4940
4941                         skb = skb_peek(&chan->data_q);
4942                         if (skb->priority >= HCI_PRIO_MAX - 1)
4943                                 continue;
4944
4945                         skb->priority = HCI_PRIO_MAX - 1;
4946
4947                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
4948                                skb->priority);
4949                 }
4950
4951                 if (hci_conn_num(hdev, type) == num)
4952                         break;
4953         }
4954
4955         rcu_read_unlock();
4956
4957 }
4958
4959 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
4960 {
4961         /* Calculate count of blocks used by this packet */
4962         return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
4963 }
4964
4965 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
4966 {
4967         if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
4968                 /* ACL tx timeout must be longer than maximum
4969                  * link supervision timeout (40.9 seconds) */
4970                 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
4971                                        HCI_ACL_TX_TIMEOUT))
4972                         hci_link_tx_to(hdev, ACL_LINK);
4973         }
4974 }
4975
4976 static void hci_sched_acl_pkt(struct hci_dev *hdev)
4977 {
4978         unsigned int cnt = hdev->acl_cnt;
4979         struct hci_chan *chan;
4980         struct sk_buff *skb;
4981         int quote;
4982
4983         __check_timeout(hdev, cnt);
4984
4985         while (hdev->acl_cnt &&
4986                (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
4987                 u32 priority = (skb_peek(&chan->data_q))->priority;
4988                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4989                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4990                                skb->len, skb->priority);
4991
4992                         /* Stop if priority has changed */
4993                         if (skb->priority < priority)
4994                                 break;
4995
4996                         skb = skb_dequeue(&chan->data_q);
4997
4998                         hci_conn_enter_active_mode(chan->conn,
4999                                                    bt_cb(skb)->force_active);
5000
5001                         hci_send_frame(hdev, skb);
5002                         hdev->acl_last_tx = jiffies;
5003
5004                         hdev->acl_cnt--;
5005                         chan->sent++;
5006                         chan->conn->sent++;
5007                 }
5008         }
5009
5010         if (cnt != hdev->acl_cnt)
5011                 hci_prio_recalculate(hdev, ACL_LINK);
5012 }
5013
5014 static void hci_sched_acl_blk(struct hci_dev *hdev)
5015 {
5016         unsigned int cnt = hdev->block_cnt;
5017         struct hci_chan *chan;
5018         struct sk_buff *skb;
5019         int quote;
5020         u8 type;
5021
5022         __check_timeout(hdev, cnt);
5023
5024         BT_DBG("%s", hdev->name);
5025
5026         if (hdev->dev_type == HCI_AMP)
5027                 type = AMP_LINK;
5028         else
5029                 type = ACL_LINK;
5030
5031         while (hdev->block_cnt > 0 &&
5032                (chan = hci_chan_sent(hdev, type, &quote))) {
5033                 u32 priority = (skb_peek(&chan->data_q))->priority;
5034                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
5035                         int blocks;
5036
5037                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
5038                                skb->len, skb->priority);
5039
5040                         /* Stop if priority has changed */
5041                         if (skb->priority < priority)
5042                                 break;
5043
5044                         skb = skb_dequeue(&chan->data_q);
5045
5046                         blocks = __get_blocks(hdev, skb);
5047                         if (blocks > hdev->block_cnt)
5048                                 return;
5049
5050                         hci_conn_enter_active_mode(chan->conn,
5051                                                    bt_cb(skb)->force_active);
5052
5053                         hci_send_frame(hdev, skb);
5054                         hdev->acl_last_tx = jiffies;
5055
5056                         hdev->block_cnt -= blocks;
5057                         quote -= blocks;
5058
5059                         chan->sent += blocks;
5060                         chan->conn->sent += blocks;
5061                 }
5062         }
5063
5064         if (cnt != hdev->block_cnt)
5065                 hci_prio_recalculate(hdev, type);
5066 }
5067
5068 static void hci_sched_acl(struct hci_dev *hdev)
5069 {
5070         BT_DBG("%s", hdev->name);
5071
5072         /* No ACL link over BR/EDR controller */
5073         if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
5074                 return;
5075
5076         /* No AMP link over AMP controller */
5077         if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
5078                 return;
5079
5080         switch (hdev->flow_ctl_mode) {
5081         case HCI_FLOW_CTL_MODE_PACKET_BASED:
5082                 hci_sched_acl_pkt(hdev);
5083                 break;
5084
5085         case HCI_FLOW_CTL_MODE_BLOCK_BASED:
5086                 hci_sched_acl_blk(hdev);
5087                 break;
5088         }
5089 }
5090
5091 /* Schedule SCO */
5092 static void hci_sched_sco(struct hci_dev *hdev)
5093 {
5094         struct hci_conn *conn;
5095         struct sk_buff *skb;
5096         int quote;
5097
5098         BT_DBG("%s", hdev->name);
5099
5100         if (!hci_conn_num(hdev, SCO_LINK))
5101                 return;
5102
5103         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
5104                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
5105                         BT_DBG("skb %p len %d", skb, skb->len);
5106                         hci_send_frame(hdev, skb);
5107
5108                         conn->sent++;
5109                         if (conn->sent == ~0)
5110                                 conn->sent = 0;
5111                 }
5112         }
5113 }
5114
5115 static void hci_sched_esco(struct hci_dev *hdev)
5116 {
5117         struct hci_conn *conn;
5118         struct sk_buff *skb;
5119         int quote;
5120
5121         BT_DBG("%s", hdev->name);
5122
5123         if (!hci_conn_num(hdev, ESCO_LINK))
5124                 return;
5125
5126         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
5127                                                      &quote))) {
5128                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
5129                         BT_DBG("skb %p len %d", skb, skb->len);
5130                         hci_send_frame(hdev, skb);
5131
5132                         conn->sent++;
5133                         if (conn->sent == ~0)
5134                                 conn->sent = 0;
5135                 }
5136         }
5137 }
5138
5139 static void hci_sched_le(struct hci_dev *hdev)
5140 {
5141         struct hci_chan *chan;
5142         struct sk_buff *skb;
5143         int quote, cnt, tmp;
5144
5145         BT_DBG("%s", hdev->name);
5146
5147         if (!hci_conn_num(hdev, LE_LINK))
5148                 return;
5149
5150         if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
5151                 /* LE tx timeout must be longer than maximum
5152                  * link supervision timeout (40.9 seconds) */
5153                 if (!hdev->le_cnt && hdev->le_pkts &&
5154                     time_after(jiffies, hdev->le_last_tx + HZ * 45))
5155                         hci_link_tx_to(hdev, LE_LINK);
5156         }
5157
5158         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
5159         tmp = cnt;
5160         while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
5161                 u32 priority = (skb_peek(&chan->data_q))->priority;
5162                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
5163                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
5164                                skb->len, skb->priority);
5165
5166                         /* Stop if priority has changed */
5167                         if (skb->priority < priority)
5168                                 break;
5169
5170                         skb = skb_dequeue(&chan->data_q);
5171
5172                         hci_send_frame(hdev, skb);
5173                         hdev->le_last_tx = jiffies;
5174
5175                         cnt--;
5176                         chan->sent++;
5177                         chan->conn->sent++;
5178                 }
5179         }
5180
5181         if (hdev->le_pkts)
5182                 hdev->le_cnt = cnt;
5183         else
5184                 hdev->acl_cnt = cnt;
5185
5186         if (cnt != tmp)
5187                 hci_prio_recalculate(hdev, LE_LINK);
5188 }
5189
5190 static void hci_tx_work(struct work_struct *work)
5191 {
5192         struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
5193         struct sk_buff *skb;
5194
5195         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
5196                hdev->sco_cnt, hdev->le_cnt);
5197
5198         if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5199                 /* Schedule queues and send stuff to HCI driver */
5200                 hci_sched_acl(hdev);
5201                 hci_sched_sco(hdev);
5202                 hci_sched_esco(hdev);
5203                 hci_sched_le(hdev);
5204         }
5205
5206         /* Send next queued raw (unknown type) packet */
5207         while ((skb = skb_dequeue(&hdev->raw_q)))
5208                 hci_send_frame(hdev, skb);
5209 }
5210
5211 /* ----- HCI RX task (incoming data processing) ----- */
5212
5213 /* ACL data packet */
5214 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
5215 {
5216         struct hci_acl_hdr *hdr = (void *) skb->data;
5217         struct hci_conn *conn;
5218         __u16 handle, flags;
5219
5220         skb_pull(skb, HCI_ACL_HDR_SIZE);
5221
5222         handle = __le16_to_cpu(hdr->handle);
5223         flags  = hci_flags(handle);
5224         handle = hci_handle(handle);
5225
5226         BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
5227                handle, flags);
5228
5229         hdev->stat.acl_rx++;
5230
5231         hci_dev_lock(hdev);
5232         conn = hci_conn_hash_lookup_handle(hdev, handle);
5233         hci_dev_unlock(hdev);
5234
5235         if (conn) {
5236                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
5237
5238                 /* Send to upper protocol */
5239                 l2cap_recv_acldata(conn, skb, flags);
5240                 return;
5241         } else {
5242                 BT_ERR("%s ACL packet for unknown connection handle %d",
5243                        hdev->name, handle);
5244         }
5245
5246         kfree_skb(skb);
5247 }
5248
5249 /* SCO data packet */
5250 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
5251 {
5252         struct hci_sco_hdr *hdr = (void *) skb->data;
5253         struct hci_conn *conn;
5254         __u16 handle;
5255
5256         skb_pull(skb, HCI_SCO_HDR_SIZE);
5257
5258         handle = __le16_to_cpu(hdr->handle);
5259
5260         BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
5261
5262         hdev->stat.sco_rx++;
5263
5264         hci_dev_lock(hdev);
5265         conn = hci_conn_hash_lookup_handle(hdev, handle);
5266         hci_dev_unlock(hdev);
5267
5268         if (conn) {
5269                 /* Send to upper protocol */
5270                 sco_recv_scodata(conn, skb);
5271                 return;
5272         } else {
5273                 BT_ERR("%s SCO packet for unknown connection handle %d",
5274                        hdev->name, handle);
5275         }
5276
5277         kfree_skb(skb);
5278 }
5279
5280 static bool hci_req_is_complete(struct hci_dev *hdev)
5281 {
5282         struct sk_buff *skb;
5283
5284         skb = skb_peek(&hdev->cmd_q);
5285         if (!skb)
5286                 return true;
5287
5288         return bt_cb(skb)->req.start;
5289 }
5290
5291 static void hci_resend_last(struct hci_dev *hdev)
5292 {
5293         struct hci_command_hdr *sent;
5294         struct sk_buff *skb;
5295         u16 opcode;
5296
5297         if (!hdev->sent_cmd)
5298                 return;
5299
5300         sent = (void *) hdev->sent_cmd->data;
5301         opcode = __le16_to_cpu(sent->opcode);
5302         if (opcode == HCI_OP_RESET)
5303                 return;
5304
5305         skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
5306         if (!skb)
5307                 return;
5308
5309         skb_queue_head(&hdev->cmd_q, skb);
5310         queue_work(hdev->workqueue, &hdev->cmd_work);
5311 }
5312
5313 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
5314 {
5315         hci_req_complete_t req_complete = NULL;
5316         struct sk_buff *skb;
5317         unsigned long flags;
5318
5319         BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
5320
5321         /* If the completed command doesn't match the last one that was
5322          * sent we need to do special handling of it.
5323          */
5324         if (!hci_sent_cmd_data(hdev, opcode)) {
5325                 /* Some CSR based controllers generate a spontaneous
5326                  * reset complete event during init and any pending
5327                  * command will never be completed. In such a case we
5328                  * need to resend whatever was the last sent
5329                  * command.
5330                  */
5331                 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
5332                         hci_resend_last(hdev);
5333
5334                 return;
5335         }
5336
5337         /* If the command succeeded and there's still more commands in
5338          * this request the request is not yet complete.
5339          */
5340         if (!status && !hci_req_is_complete(hdev))
5341                 return;
5342
5343         /* If this was the last command in a request the complete
5344          * callback would be found in hdev->sent_cmd instead of the
5345          * command queue (hdev->cmd_q).
5346          */
5347         if (hdev->sent_cmd) {
5348                 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
5349
5350                 if (req_complete) {
5351                         /* We must set the complete callback to NULL to
5352                          * avoid calling the callback more than once if
5353                          * this function gets called again.
5354                          */
5355                         bt_cb(hdev->sent_cmd)->req.complete = NULL;
5356
5357                         goto call_complete;
5358                 }
5359         }
5360
5361         /* Remove all pending commands belonging to this request */
5362         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
5363         while ((skb = __skb_dequeue(&hdev->cmd_q))) {
5364                 if (bt_cb(skb)->req.start) {
5365                         __skb_queue_head(&hdev->cmd_q, skb);
5366                         break;
5367                 }
5368
5369                 req_complete = bt_cb(skb)->req.complete;
5370                 kfree_skb(skb);
5371         }
5372         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
5373
5374 call_complete:
5375         if (req_complete)
5376                 req_complete(hdev, status);
5377 }
5378
5379 static void hci_rx_work(struct work_struct *work)
5380 {
5381         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
5382         struct sk_buff *skb;
5383
5384         BT_DBG("%s", hdev->name);
5385
5386         while ((skb = skb_dequeue(&hdev->rx_q))) {
5387                 /* Send copy to monitor */
5388                 hci_send_to_monitor(hdev, skb);
5389
5390                 if (atomic_read(&hdev->promisc)) {
5391                         /* Send copy to the sockets */
5392                         hci_send_to_sock(hdev, skb);
5393                 }
5394
5395                 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
5396                         kfree_skb(skb);
5397                         continue;
5398                 }
5399
5400                 if (test_bit(HCI_INIT, &hdev->flags)) {
5401                         /* Don't process data packets in this states. */
5402                         switch (bt_cb(skb)->pkt_type) {
5403                         case HCI_ACLDATA_PKT:
5404                         case HCI_SCODATA_PKT:
5405                                 kfree_skb(skb);
5406                                 continue;
5407                         }
5408                 }
5409
5410                 /* Process frame */
5411                 switch (bt_cb(skb)->pkt_type) {
5412                 case HCI_EVENT_PKT:
5413                         BT_DBG("%s Event packet", hdev->name);
5414                         hci_event_packet(hdev, skb);
5415                         break;
5416
5417                 case HCI_ACLDATA_PKT:
5418                         BT_DBG("%s ACL data packet", hdev->name);
5419                         hci_acldata_packet(hdev, skb);
5420                         break;
5421
5422                 case HCI_SCODATA_PKT:
5423                         BT_DBG("%s SCO data packet", hdev->name);
5424                         hci_scodata_packet(hdev, skb);
5425                         break;
5426
5427                 default:
5428                         kfree_skb(skb);
5429                         break;
5430                 }
5431         }
5432 }
5433
5434 static void hci_cmd_work(struct work_struct *work)
5435 {
5436         struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
5437         struct sk_buff *skb;
5438
5439         BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
5440                atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
5441
5442         /* Send queued commands */
5443         if (atomic_read(&hdev->cmd_cnt)) {
5444                 skb = skb_dequeue(&hdev->cmd_q);
5445                 if (!skb)
5446                         return;
5447
5448                 kfree_skb(hdev->sent_cmd);
5449
5450                 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
5451                 if (hdev->sent_cmd) {
5452                         atomic_dec(&hdev->cmd_cnt);
5453                         hci_send_frame(hdev, skb);
5454                         if (test_bit(HCI_RESET, &hdev->flags))
5455                                 cancel_delayed_work(&hdev->cmd_timer);
5456                         else
5457                                 schedule_delayed_work(&hdev->cmd_timer,
5458                                                       HCI_CMD_TIMEOUT);
5459                 } else {
5460                         skb_queue_head(&hdev->cmd_q, skb);
5461                         queue_work(hdev->workqueue, &hdev->cmd_work);
5462                 }
5463         }
5464 }
5465
5466 void hci_req_add_le_scan_disable(struct hci_request *req)
5467 {
5468         struct hci_cp_le_set_scan_enable cp;
5469
5470         memset(&cp, 0, sizeof(cp));
5471         cp.enable = LE_SCAN_DISABLE;
5472         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
5473 }
5474
5475 static void add_to_white_list(struct hci_request *req,
5476                               struct hci_conn_params *params)
5477 {
5478         struct hci_cp_le_add_to_white_list cp;
5479
5480         cp.bdaddr_type = params->addr_type;
5481         bacpy(&cp.bdaddr, &params->addr);
5482
5483         hci_req_add(req, HCI_OP_LE_ADD_TO_WHITE_LIST, sizeof(cp), &cp);
5484 }
5485
5486 static u8 update_white_list(struct hci_request *req)
5487 {
5488         struct hci_dev *hdev = req->hdev;
5489         struct hci_conn_params *params;
5490         struct bdaddr_list *b;
5491         uint8_t white_list_entries = 0;
5492
5493         /* Go through the current white list programmed into the
5494          * controller one by one and check if that address is still
5495          * in the list of pending connections or list of devices to
5496          * report. If not present in either list, then queue the
5497          * command to remove it from the controller.
5498          */
5499         list_for_each_entry(b, &hdev->le_white_list, list) {
5500                 struct hci_cp_le_del_from_white_list cp;
5501
5502                 if (hci_pend_le_action_lookup(&hdev->pend_le_conns,
5503                                               &b->bdaddr, b->bdaddr_type) ||
5504                     hci_pend_le_action_lookup(&hdev->pend_le_reports,
5505                                               &b->bdaddr, b->bdaddr_type)) {
5506                         white_list_entries++;
5507                         continue;
5508                 }
5509
5510                 cp.bdaddr_type = b->bdaddr_type;
5511                 bacpy(&cp.bdaddr, &b->bdaddr);
5512
5513                 hci_req_add(req, HCI_OP_LE_DEL_FROM_WHITE_LIST,
5514                             sizeof(cp), &cp);
5515         }
5516
5517         /* Since all no longer valid white list entries have been
5518          * removed, walk through the list of pending connections
5519          * and ensure that any new device gets programmed into
5520          * the controller.
5521          *
5522          * If the list of the devices is larger than the list of
5523          * available white list entries in the controller, then
5524          * just abort and return filer policy value to not use the
5525          * white list.
5526          */
5527         list_for_each_entry(params, &hdev->pend_le_conns, action) {
5528                 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
5529                                            &params->addr, params->addr_type))
5530                         continue;
5531
5532                 if (white_list_entries >= hdev->le_white_list_size) {
5533                         /* Select filter policy to accept all advertising */
5534                         return 0x00;
5535                 }
5536
5537                 if (hci_find_irk_by_addr(hdev, &params->addr,
5538                                          params->addr_type)) {
5539                         /* White list can not be used with RPAs */
5540                         return 0x00;
5541                 }
5542
5543                 white_list_entries++;
5544                 add_to_white_list(req, params);
5545         }
5546
5547         /* After adding all new pending connections, walk through
5548          * the list of pending reports and also add these to the
5549          * white list if there is still space.
5550          */
5551         list_for_each_entry(params, &hdev->pend_le_reports, action) {
5552                 if (hci_bdaddr_list_lookup(&hdev->le_white_list,
5553                                            &params->addr, params->addr_type))
5554                         continue;
5555
5556                 if (white_list_entries >= hdev->le_white_list_size) {
5557                         /* Select filter policy to accept all advertising */
5558                         return 0x00;
5559                 }
5560
5561                 if (hci_find_irk_by_addr(hdev, &params->addr,
5562                                          params->addr_type)) {
5563                         /* White list can not be used with RPAs */
5564                         return 0x00;
5565                 }
5566
5567                 white_list_entries++;
5568                 add_to_white_list(req, params);
5569         }
5570
5571         /* Select filter policy to use white list */
5572         return 0x01;
5573 }
5574
5575 void hci_req_add_le_passive_scan(struct hci_request *req)
5576 {
5577         struct hci_cp_le_set_scan_param param_cp;
5578         struct hci_cp_le_set_scan_enable enable_cp;
5579         struct hci_dev *hdev = req->hdev;
5580         u8 own_addr_type;
5581         u8 filter_policy;
5582
5583         /* Set require_privacy to false since no SCAN_REQ are send
5584          * during passive scanning. Not using an unresolvable address
5585          * here is important so that peer devices using direct
5586          * advertising with our address will be correctly reported
5587          * by the controller.
5588          */
5589         if (hci_update_random_address(req, false, &own_addr_type))
5590                 return;
5591
5592         /* Adding or removing entries from the white list must
5593          * happen before enabling scanning. The controller does
5594          * not allow white list modification while scanning.
5595          */
5596         filter_policy = update_white_list(req);
5597
5598         memset(&param_cp, 0, sizeof(param_cp));
5599         param_cp.type = LE_SCAN_PASSIVE;
5600         param_cp.interval = cpu_to_le16(hdev->le_scan_interval);
5601         param_cp.window = cpu_to_le16(hdev->le_scan_window);
5602         param_cp.own_address_type = own_addr_type;
5603         param_cp.filter_policy = filter_policy;
5604         hci_req_add(req, HCI_OP_LE_SET_SCAN_PARAM, sizeof(param_cp),
5605                     &param_cp);
5606
5607         memset(&enable_cp, 0, sizeof(enable_cp));
5608         enable_cp.enable = LE_SCAN_ENABLE;
5609         enable_cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
5610         hci_req_add(req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(enable_cp),
5611                     &enable_cp);
5612 }
5613
5614 static void update_background_scan_complete(struct hci_dev *hdev, u8 status)
5615 {
5616         if (status)
5617                 BT_DBG("HCI request failed to update background scanning: "
5618                        "status 0x%2.2x", status);
5619 }
5620
5621 /* This function controls the background scanning based on hdev->pend_le_conns
5622  * list. If there are pending LE connection we start the background scanning,
5623  * otherwise we stop it.
5624  *
5625  * This function requires the caller holds hdev->lock.
5626  */
5627 void hci_update_background_scan(struct hci_dev *hdev)
5628 {
5629         struct hci_request req;
5630         struct hci_conn *conn;
5631         int err;
5632
5633         if (!test_bit(HCI_UP, &hdev->flags) ||
5634             test_bit(HCI_INIT, &hdev->flags) ||
5635             test_bit(HCI_SETUP, &hdev->dev_flags) ||
5636             test_bit(HCI_CONFIG, &hdev->dev_flags) ||
5637             test_bit(HCI_AUTO_OFF, &hdev->dev_flags) ||
5638             test_bit(HCI_UNREGISTER, &hdev->dev_flags))
5639                 return;
5640
5641         /* No point in doing scanning if LE support hasn't been enabled */
5642         if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
5643                 return;
5644
5645         /* If discovery is active don't interfere with it */
5646         if (hdev->discovery.state != DISCOVERY_STOPPED)
5647                 return;
5648
5649         hci_req_init(&req, hdev);
5650
5651         if (list_empty(&hdev->pend_le_conns) &&
5652             list_empty(&hdev->pend_le_reports)) {
5653                 /* If there is no pending LE connections or devices
5654                  * to be scanned for, we should stop the background
5655                  * scanning.
5656                  */
5657
5658                 /* If controller is not scanning we are done. */
5659                 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
5660                         return;
5661
5662                 hci_req_add_le_scan_disable(&req);
5663
5664                 BT_DBG("%s stopping background scanning", hdev->name);
5665         } else {
5666                 /* If there is at least one pending LE connection, we should
5667                  * keep the background scan running.
5668                  */
5669
5670                 /* If controller is connecting, we should not start scanning
5671                  * since some controllers are not able to scan and connect at
5672                  * the same time.
5673                  */
5674                 conn = hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT);
5675                 if (conn)
5676                         return;
5677
5678                 /* If controller is currently scanning, we stop it to ensure we
5679                  * don't miss any advertising (due to duplicates filter).
5680                  */
5681                 if (test_bit(HCI_LE_SCAN, &hdev->dev_flags))
5682                         hci_req_add_le_scan_disable(&req);
5683
5684                 hci_req_add_le_passive_scan(&req);
5685
5686                 BT_DBG("%s starting background scanning", hdev->name);
5687         }
5688
5689         err = hci_req_run(&req, update_background_scan_complete);
5690         if (err)
5691                 BT_ERR("Failed to run HCI request: err %d", err);
5692 }