net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2011 ProFUSION Embedded Systems
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI core. */
  27
  28 #include <linux/export.h>
  29 #include <linux/idr.h>
  30 #include <linux/rfkill.h>
  31 #include <linux/debugfs.h>
  32 #include <linux/crypto.h>
  33 #include <asm/unaligned.h>
  34
  35 #include <net/bluetooth/bluetooth.h>
  36 #include <net/bluetooth/hci_core.h>
  37 #include <net/bluetooth/l2cap.h>
  38 #include <net/bluetooth/mgmt.h>
  39
  40 #include "hci_request.h"
  41 #include "hci_debugfs.h"
  42 #include "smp.h"
  43
  44 static void hci_rx_work(struct work_struct *work);
  45 static void hci_cmd_work(struct work_struct *work);
  46 static void hci_tx_work(struct work_struct *work);
  47
  48 /* HCI device list */
  49 LIST_HEAD(hci_dev_list);
  50 DEFINE_RWLOCK(hci_dev_list_lock);
  51
  52 /* HCI callback list */
  53 LIST_HEAD(hci_cb_list);
  54 DEFINE_MUTEX(hci_cb_list_lock);
  55
  56 /* HCI ID Numbering */
  57 static DEFINE_IDA(hci_index_ida);
  58
  59 /* ---- HCI debugfs entries ---- */
  60
  61 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
  62                              size_t count, loff_t *ppos)
  63 {
  64         struct hci_dev *hdev = file->private_data;
  65         char buf[3];
  66
  67         buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
  68         buf[1] = '\n';
  69         buf[2] = '\0';
  70         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
  71 }
  72
  73 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
  74                               size_t count, loff_t *ppos)
  75 {
  76         struct hci_dev *hdev = file->private_data;
  77         struct sk_buff *skb;
  78         char buf[32];
  79         size_t buf_size = min(count, (sizeof(buf)-1));
  80         bool enable;
  81
  82         if (!test_bit(HCI_UP, &hdev->flags))
  83                 return -ENETDOWN;
  84
  85         if (copy_from_user(buf, user_buf, buf_size))
  86                 return -EFAULT;
  87
  88         buf[buf_size] = '\0';
  89         if (strtobool(buf, &enable))
  90                 return -EINVAL;
  91
  92         if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
  93                 return -EALREADY;
  94
  95         hci_req_sync_lock(hdev);
  96         if (enable)
  97                 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
  98                                      HCI_CMD_TIMEOUT);
  99         else
 100                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
 101                                      HCI_CMD_TIMEOUT);
 102         hci_req_sync_unlock(hdev);
 103
 104         if (IS_ERR(skb))
 105                 return PTR_ERR(skb);
 106
 107         kfree_skb(skb);
 108
 109         hci_dev_change_flag(hdev, HCI_DUT_MODE);
 110
 111         return count;
 112 }
 113
 114 static const struct file_operations dut_mode_fops = {
 115         .open           = simple_open,
 116         .read           = dut_mode_read,
 117         .write          = dut_mode_write,
 118         .llseek         = default_llseek,
 119 };
 120
 121 static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
 122                                 size_t count, loff_t *ppos)
 123 {
 124         struct hci_dev *hdev = file->private_data;
 125         char buf[3];
 126
 127         buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
 128         buf[1] = '\n';
 129         buf[2] = '\0';
 130         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 131 }
 132
 133 static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
 134                                  size_t count, loff_t *ppos)
 135 {
 136         struct hci_dev *hdev = file->private_data;
 137         char buf[32];
 138         size_t buf_size = min(count, (sizeof(buf)-1));
 139         bool enable;
 140         int err;
 141
 142         if (copy_from_user(buf, user_buf, buf_size))
 143                 return -EFAULT;
 144
 145         buf[buf_size] = '\0';
 146         if (strtobool(buf, &enable))
 147                 return -EINVAL;
 148
 149         /* When the diagnostic flags are not persistent and the transport
 150          * is not active, then there is no need for the vendor callback.
 151          *
 152          * Instead just store the desired value. If needed the setting
 153          * will be programmed when the controller gets powered on.
 154          */
 155         if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
 156             !test_bit(HCI_RUNNING, &hdev->flags))
 157                 goto done;
 158
 159         hci_req_sync_lock(hdev);
 160         err = hdev->set_diag(hdev, enable);
 161         hci_req_sync_unlock(hdev);
 162
 163         if (err < 0)
 164                 return err;
 165
 166 done:
 167         if (enable)
 168                 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
 169         else
 170                 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
 171
 172         return count;
 173 }
 174
 175 static const struct file_operations vendor_diag_fops = {
 176         .open           = simple_open,
 177         .read           = vendor_diag_read,
 178         .write          = vendor_diag_write,
 179         .llseek         = default_llseek,
 180 };
 181
 182 static void hci_debugfs_create_basic(struct hci_dev *hdev)
 183 {
 184         debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
 185                             &dut_mode_fops);
 186
 187         if (hdev->set_diag)
 188                 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
 189                                     &vendor_diag_fops);
 190 }
 191
 192 static int hci_reset_req(struct hci_request *req, unsigned long opt)
 193 {
 194         BT_DBG("%s %ld", req->hdev->name, opt);
 195
 196         /* Reset device */
 197         set_bit(HCI_RESET, &req->hdev->flags);
 198         hci_req_add(req, HCI_OP_RESET, 0, NULL);
 199         return 0;
 200 }
 201
 202 static void bredr_init(struct hci_request *req)
 203 {
 204         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
 205
 206         /* Read Local Supported Features */
 207         hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 208
 209         /* Read Local Version */
 210         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 211
 212         /* Read BD Address */
 213         hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
 214 }
 215
 216 static void amp_init1(struct hci_request *req)
 217 {
 218         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
 219
 220         /* Read Local Version */
 221         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 222
 223         /* Read Local Supported Commands */
 224         hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 225
 226         /* Read Local AMP Info */
 227         hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 228
 229         /* Read Data Blk size */
 230         hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
 231
 232         /* Read Flow Control Mode */
 233         hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
 234
 235         /* Read Location Data */
 236         hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
 237 }
 238
 239 static int amp_init2(struct hci_request *req)
 240 {
 241         /* Read Local Supported Features. Not all AMP controllers
 242          * support this so it's placed conditionally in the second
 243          * stage init.
 244          */
 245         if (req->hdev->commands[14] & 0x20)
 246                 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 247
 248         return 0;
 249 }
 250
 251 static int hci_init1_req(struct hci_request *req, unsigned long opt)
 252 {
 253         struct hci_dev *hdev = req->hdev;
 254
 255         BT_DBG("%s %ld", hdev->name, opt);
 256
 257         /* Reset */
 258         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
 259                 hci_reset_req(req, 0);
 260
 261         switch (hdev->dev_type) {
 262         case HCI_BREDR:
 263                 bredr_init(req);
 264                 break;
 265
 266         case HCI_AMP:
 267                 amp_init1(req);
 268                 break;
 269
 270         default:
 271                 BT_ERR("Unknown device type %d", hdev->dev_type);
 272                 break;
 273         }
 274
 275         return 0;
 276 }
 277
 278 static void bredr_setup(struct hci_request *req)
 279 {
 280         __le16 param;
 281         __u8 flt_type;
 282
 283         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 284         hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 285
 286         /* Read Class of Device */
 287         hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 288
 289         /* Read Local Name */
 290         hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 291
 292         /* Read Voice Setting */
 293         hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 294
 295         /* Read Number of Supported IAC */
 296         hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
 297
 298         /* Read Current IAC LAP */
 299         hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
 300
 301         /* Clear Event Filters */
 302         flt_type = HCI_FLT_CLEAR_ALL;
 303         hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 304
 305         /* Connection accept timeout ~20 secs */
 306         param = cpu_to_le16(0x7d00);
 307         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 308 }
 309
 310 static void le_setup(struct hci_request *req)
 311 {
 312         struct hci_dev *hdev = req->hdev;
 313
 314         /* Read LE Buffer Size */
 315         hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 316
 317         /* Read LE Local Supported Features */
 318         hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
 319
 320         /* Read LE Supported States */
 321         hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
 322
 323         /* LE-only controllers have LE implicitly enabled */
 324         if (!lmp_bredr_capable(hdev))
 325                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
 326 }
 327
 328 static void hci_setup_event_mask(struct hci_request *req)
 329 {
 330         struct hci_dev *hdev = req->hdev;
 331
 332         /* The second byte is 0xff instead of 0x9f (two reserved bits
 333          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 334          * command otherwise.
 335          */
 336         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 337
 338         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 339          * any event mask for pre 1.2 devices.
 340          */
 341         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 342                 return;
 343
 344         if (lmp_bredr_capable(hdev)) {
 345                 events[4] |= 0x01; /* Flow Specification Complete */
 346         } else {
 347                 /* Use a different default for LE-only devices */
 348                 memset(events, 0, sizeof(events));
 349                 events[1] |= 0x20; /* Command Complete */
 350                 events[1] |= 0x40; /* Command Status */
 351                 events[1] |= 0x80; /* Hardware Error */
 352
 353                 /* If the controller supports the Disconnect command, enable
 354                  * the corresponding event. In addition enable packet flow
 355                  * control related events.
 356                  */
 357                 if (hdev->commands[0] & 0x20) {
 358                         events[0] |= 0x10; /* Disconnection Complete */
 359                         events[2] |= 0x04; /* Number of Completed Packets */
 360                         events[3] |= 0x02; /* Data Buffer Overflow */
 361                 }
 362
 363                 /* If the controller supports the Read Remote Version
 364                  * Information command, enable the corresponding event.
 365                  */
 366                 if (hdev->commands[2] & 0x80)
 367                         events[1] |= 0x08; /* Read Remote Version Information
 368                                             * Complete
 369                                             */
 370
 371                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
 372                         events[0] |= 0x80; /* Encryption Change */
 373                         events[5] |= 0x80; /* Encryption Key Refresh Complete */
 374                 }
 375         }
 376
 377         if (lmp_inq_rssi_capable(hdev) ||
 378             test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
 379                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 380
 381         if (lmp_ext_feat_capable(hdev))
 382                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
 383
 384         if (lmp_esco_capable(hdev)) {
 385                 events[5] |= 0x08; /* Synchronous Connection Complete */
 386                 events[5] |= 0x10; /* Synchronous Connection Changed */
 387         }
 388
 389         if (lmp_sniffsubr_capable(hdev))
 390                 events[5] |= 0x20; /* Sniff Subrating */
 391
 392         if (lmp_pause_enc_capable(hdev))
 393                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 394
 395         if (lmp_ext_inq_capable(hdev))
 396                 events[5] |= 0x40; /* Extended Inquiry Result */
 397
 398         if (lmp_no_flush_capable(hdev))
 399                 events[7] |= 0x01; /* Enhanced Flush Complete */
 400
 401         if (lmp_lsto_capable(hdev))
 402                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 403
 404         if (lmp_ssp_capable(hdev)) {
 405                 events[6] |= 0x01;      /* IO Capability Request */
 406                 events[6] |= 0x02;      /* IO Capability Response */
 407                 events[6] |= 0x04;      /* User Confirmation Request */
 408                 events[6] |= 0x08;      /* User Passkey Request */
 409                 events[6] |= 0x10;      /* Remote OOB Data Request */
 410                 events[6] |= 0x20;      /* Simple Pairing Complete */
 411                 events[7] |= 0x04;      /* User Passkey Notification */
 412                 events[7] |= 0x08;      /* Keypress Notification */
 413                 events[7] |= 0x10;      /* Remote Host Supported
 414                                          * Features Notification
 415                                          */
 416         }
 417
 418         if (lmp_le_capable(hdev))
 419                 events[7] |= 0x20;      /* LE Meta-Event */
 420
 421         hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 422 }
 423
 424 static int hci_init2_req(struct hci_request *req, unsigned long opt)
 425 {
 426         struct hci_dev *hdev = req->hdev;
 427
 428         if (hdev->dev_type == HCI_AMP)
 429                 return amp_init2(req);
 430
 431         if (lmp_bredr_capable(hdev))
 432                 bredr_setup(req);
 433         else
 434                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
 435
 436         if (lmp_le_capable(hdev))
 437                 le_setup(req);
 438
 439         /* All Bluetooth 1.2 and later controllers should support the
 440          * HCI command for reading the local supported commands.
 441          *
 442          * Unfortunately some controllers indicate Bluetooth 1.2 support,
 443          * but do not have support for this command. If that is the case,
 444          * the driver can quirk the behavior and skip reading the local
 445          * supported commands.
 446          */
 447         if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
 448             !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
 449                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 450
 451         if (lmp_ssp_capable(hdev)) {
 452                 /* When SSP is available, then the host features page
 453                  * should also be available as well. However some
 454                  * controllers list the max_page as 0 as long as SSP
 455                  * has not been enabled. To achieve proper debugging
 456                  * output, force the minimum max_page to 1 at least.
 457                  */
 458                 hdev->max_page = 0x01;
 459
 460                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
 461                         u8 mode = 0x01;
 462
 463                         hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
 464                                     sizeof(mode), &mode);
 465                 } else {
 466                         struct hci_cp_write_eir cp;
 467
 468                         memset(hdev->eir, 0, sizeof(hdev->eir));
 469                         memset(&cp, 0, sizeof(cp));
 470
 471                         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 472                 }
 473         }
 474
 475         if (lmp_inq_rssi_capable(hdev) ||
 476             test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
 477                 u8 mode;
 478
 479                 /* If Extended Inquiry Result events are supported, then
 480                  * they are clearly preferred over Inquiry Result with RSSI
 481                  * events.
 482                  */
 483                 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
 484
 485                 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 486         }
 487
 488         if (lmp_inq_tx_pwr_capable(hdev))
 489                 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 490
 491         if (lmp_ext_feat_capable(hdev)) {
 492                 struct hci_cp_read_local_ext_features cp;
 493
 494                 cp.page = 0x01;
 495                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
 496                             sizeof(cp), &cp);
 497         }
 498
 499         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
 500                 u8 enable = 1;
 501                 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
 502                             &enable);
 503         }
 504
 505         return 0;
 506 }
 507
 508 static void hci_setup_link_policy(struct hci_request *req)
 509 {
 510         struct hci_dev *hdev = req->hdev;
 511         struct hci_cp_write_def_link_policy cp;
 512         u16 link_policy = 0;
 513
 514         if (lmp_rswitch_capable(hdev))
 515                 link_policy |= HCI_LP_RSWITCH;
 516         if (lmp_hold_capable(hdev))
 517                 link_policy |= HCI_LP_HOLD;
 518         if (lmp_sniff_capable(hdev))
 519                 link_policy |= HCI_LP_SNIFF;
 520         if (lmp_park_capable(hdev))
 521                 link_policy |= HCI_LP_PARK;
 522
 523         cp.policy = cpu_to_le16(link_policy);
 524         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 525 }
 526
 527 static void hci_set_le_support(struct hci_request *req)
 528 {
 529         struct hci_dev *hdev = req->hdev;
 530         struct hci_cp_write_le_host_supported cp;
 531
 532         /* LE-only devices do not support explicit enablement */
 533         if (!lmp_bredr_capable(hdev))
 534                 return;
 535
 536         memset(&cp, 0, sizeof(cp));
 537
 538         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
 539                 cp.le = 0x01;
 540                 cp.simul = 0x00;
 541         }
 542
 543         if (cp.le != lmp_host_le_capable(hdev))
 544                 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
 545                             &cp);
 546 }
 547
 548 static void hci_set_event_mask_page_2(struct hci_request *req)
 549 {
 550         struct hci_dev *hdev = req->hdev;
 551         u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 552
 553         /* If Connectionless Slave Broadcast master role is supported
 554          * enable all necessary events for it.
 555          */
 556         if (lmp_csb_master_capable(hdev)) {
 557                 events[1] |= 0x40;      /* Triggered Clock Capture */
 558                 events[1] |= 0x80;      /* Synchronization Train Complete */
 559                 events[2] |= 0x10;      /* Slave Page Response Timeout */
 560                 events[2] |= 0x20;      /* CSB Channel Map Change */
 561         }
 562
 563         /* If Connectionless Slave Broadcast slave role is supported
 564          * enable all necessary events for it.
 565          */
 566         if (lmp_csb_slave_capable(hdev)) {
 567                 events[2] |= 0x01;      /* Synchronization Train Received */
 568                 events[2] |= 0x02;      /* CSB Receive */
 569                 events[2] |= 0x04;      /* CSB Timeout */
 570                 events[2] |= 0x08;      /* Truncated Page Complete */
 571         }
 572
 573         /* Enable Authenticated Payload Timeout Expired event if supported */
 574         if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
 575                 events[2] |= 0x80;
 576
 577         hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
 578 }
 579
 580 static int hci_init3_req(struct hci_request *req, unsigned long opt)
 581 {
 582         struct hci_dev *hdev = req->hdev;
 583         u8 p;
 584
 585         hci_setup_event_mask(req);
 586
 587         if (hdev->commands[6] & 0x20 &&
 588             !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
 589                 struct hci_cp_read_stored_link_key cp;
 590
 591                 bacpy(&cp.bdaddr, BDADDR_ANY);
 592                 cp.read_all = 0x01;
 593                 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
 594         }
 595
 596         if (hdev->commands[5] & 0x10)
 597                 hci_setup_link_policy(req);
 598
 599         if (hdev->commands[8] & 0x01)
 600                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
 601
 602         /* Some older Broadcom based Bluetooth 1.2 controllers do not
 603          * support the Read Page Scan Type command. Check support for
 604          * this command in the bit mask of supported commands.
 605          */
 606         if (hdev->commands[13] & 0x01)
 607                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
 608
 609         if (lmp_le_capable(hdev)) {
 610                 u8 events[8];
 611
 612                 memset(events, 0, sizeof(events));
 613
 614                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
 615                         events[0] |= 0x10;      /* LE Long Term Key Request */
 616
 617                 /* If controller supports the Connection Parameters Request
 618                  * Link Layer Procedure, enable the corresponding event.
 619                  */
 620                 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
 621                         events[0] |= 0x20;      /* LE Remote Connection
 622                                                  * Parameter Request
 623                                                  */
 624
 625                 /* If the controller supports the Data Length Extension
 626                  * feature, enable the corresponding event.
 627                  */
 628                 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
 629                         events[0] |= 0x40;      /* LE Data Length Change */
 630
 631                 /* If the controller supports Extended Scanner Filter
 632                  * Policies, enable the correspondig event.
 633                  */
 634                 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
 635                         events[1] |= 0x04;      /* LE Direct Advertising
 636                                                  * Report
 637                                                  */
 638
 639                 /* If the controller supports the LE Set Scan Enable command,
 640                  * enable the corresponding advertising report event.
 641                  */
 642                 if (hdev->commands[26] & 0x08)
 643                         events[0] |= 0x02;      /* LE Advertising Report */
 644
 645                 /* If the controller supports the LE Create Connection
 646                  * command, enable the corresponding event.
 647                  */
 648                 if (hdev->commands[26] & 0x10)
 649                         events[0] |= 0x01;      /* LE Connection Complete */
 650
 651                 /* If the controller supports the LE Connection Update
 652                  * command, enable the corresponding event.
 653                  */
 654                 if (hdev->commands[27] & 0x04)
 655                         events[0] |= 0x04;      /* LE Connection Update
 656                                                  * Complete
 657                                                  */
 658
 659                 /* If the controller supports the LE Read Remote Used Features
 660                  * command, enable the corresponding event.
 661                  */
 662                 if (hdev->commands[27] & 0x20)
 663                         events[0] |= 0x08;      /* LE Read Remote Used
 664                                                  * Features Complete
 665                                                  */
 666
 667                 /* If the controller supports the LE Read Local P-256
 668                  * Public Key command, enable the corresponding event.
 669                  */
 670                 if (hdev->commands[34] & 0x02)
 671                         events[0] |= 0x80;      /* LE Read Local P-256
 672                                                  * Public Key Complete
 673                                                  */
 674
 675                 /* If the controller supports the LE Generate DHKey
 676                  * command, enable the corresponding event.
 677                  */
 678                 if (hdev->commands[34] & 0x04)
 679                         events[1] |= 0x01;      /* LE Generate DHKey Complete */
 680
 681                 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
 682                             events);
 683
 684                 if (hdev->commands[25] & 0x40) {
 685                         /* Read LE Advertising Channel TX Power */
 686                         hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
 687                 }
 688
 689                 if (hdev->commands[26] & 0x40) {
 690                         /* Read LE White List Size */
 691                         hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE,
 692                                     0, NULL);
 693                 }
 694
 695                 if (hdev->commands[26] & 0x80) {
 696                         /* Clear LE White List */
 697                         hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
 698                 }
 699
 700                 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
 701                         /* Read LE Maximum Data Length */
 702                         hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
 703
 704                         /* Read LE Suggested Default Data Length */
 705                         hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
 706                 }
 707
 708                 hci_set_le_support(req);
 709         }
 710
 711         /* Read features beyond page 1 if available */
 712         for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
 713                 struct hci_cp_read_local_ext_features cp;
 714
 715                 cp.page = p;
 716                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
 717                             sizeof(cp), &cp);
 718         }
 719
 720         return 0;
 721 }
 722
 723 static int hci_init4_req(struct hci_request *req, unsigned long opt)
 724 {
 725         struct hci_dev *hdev = req->hdev;
 726
 727         /* Some Broadcom based Bluetooth controllers do not support the
 728          * Delete Stored Link Key command. They are clearly indicating its
 729          * absence in the bit mask of supported commands.
 730          *
 731          * Check the supported commands and only if the the command is marked
 732          * as supported send it. If not supported assume that the controller
 733          * does not have actual support for stored link keys which makes this
 734          * command redundant anyway.
 735          *
 736          * Some controllers indicate that they support handling deleting
 737          * stored link keys, but they don't. The quirk lets a driver
 738          * just disable this command.
 739          */
 740         if (hdev->commands[6] & 0x80 &&
 741             !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
 742                 struct hci_cp_delete_stored_link_key cp;
 743
 744                 bacpy(&cp.bdaddr, BDADDR_ANY);
 745                 cp.delete_all = 0x01;
 746                 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
 747                             sizeof(cp), &cp);
 748         }
 749
 750         /* Set event mask page 2 if the HCI command for it is supported */
 751         if (hdev->commands[22] & 0x04)
 752                 hci_set_event_mask_page_2(req);
 753
 754         /* Read local codec list if the HCI command is supported */
 755         if (hdev->commands[29] & 0x20)
 756                 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
 757
 758         /* Get MWS transport configuration if the HCI command is supported */
 759         if (hdev->commands[30] & 0x08)
 760                 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
 761
 762         /* Check for Synchronization Train support */
 763         if (lmp_sync_train_capable(hdev))
 764                 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
 765
 766         /* Enable Secure Connections if supported and configured */
 767         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
 768             bredr_sc_enabled(hdev)) {
 769                 u8 support = 0x01;
 770
 771                 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
 772                             sizeof(support), &support);
 773         }
 774
 775         return 0;
 776 }
 777
 778 static int __hci_init(struct hci_dev *hdev)
 779 {
 780         int err;
 781
 782         err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
 783         if (err < 0)
 784                 return err;
 785
 786         if (hci_dev_test_flag(hdev, HCI_SETUP))
 787                 hci_debugfs_create_basic(hdev);
 788
 789         err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
 790         if (err < 0)
 791                 return err;
 792
 793         /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
 794          * BR/EDR/LE type controllers. AMP controllers only need the
 795          * first two stages of init.
 796          */
 797         if (hdev->dev_type != HCI_BREDR)
 798                 return 0;
 799
 800         err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
 801         if (err < 0)
 802                 return err;
 803
 804         err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
 805         if (err < 0)
 806                 return err;
 807
 808         /* This function is only called when the controller is actually in
 809          * configured state. When the controller is marked as unconfigured,
 810          * this initialization procedure is not run.
 811          *
 812          * It means that it is possible that a controller runs through its
 813          * setup phase and then discovers missing settings. If that is the
 814          * case, then this function will not be called. It then will only
 815          * be called during the config phase.
 816          *
 817          * So only when in setup phase or config phase, create the debugfs
 818          * entries and register the SMP channels.
 819          */
 820         if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
 821             !hci_dev_test_flag(hdev, HCI_CONFIG))
 822                 return 0;
 823
 824         hci_debugfs_create_common(hdev);
 825
 826         if (lmp_bredr_capable(hdev))
 827                 hci_debugfs_create_bredr(hdev);
 828
 829         if (lmp_le_capable(hdev))
 830                 hci_debugfs_create_le(hdev);
 831
 832         return 0;
 833 }
 834
 835 static int hci_init0_req(struct hci_request *req, unsigned long opt)
 836 {
 837         struct hci_dev *hdev = req->hdev;
 838
 839         BT_DBG("%s %ld", hdev->name, opt);
 840
 841         /* Reset */
 842         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
 843                 hci_reset_req(req, 0);
 844
 845         /* Read Local Version */
 846         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 847
 848         /* Read BD Address */
 849         if (hdev->set_bdaddr)
 850                 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
 851
 852         return 0;
 853 }
 854
 855 static int __hci_unconf_init(struct hci_dev *hdev)
 856 {
 857         int err;
 858
 859         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 860                 return 0;
 861
 862         err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
 863         if (err < 0)
 864                 return err;
 865
 866         if (hci_dev_test_flag(hdev, HCI_SETUP))
 867                 hci_debugfs_create_basic(hdev);
 868
 869         return 0;
 870 }
 871
 872 static int hci_scan_req(struct hci_request *req, unsigned long opt)
 873 {
 874         __u8 scan = opt;
 875
 876         BT_DBG("%s %x", req->hdev->name, scan);
 877
 878         /* Inquiry and Page scans */
 879         hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 880         return 0;
 881 }
 882
 883 static int hci_auth_req(struct hci_request *req, unsigned long opt)
 884 {
 885         __u8 auth = opt;
 886
 887         BT_DBG("%s %x", req->hdev->name, auth);
 888
 889         /* Authentication */
 890         hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 891         return 0;
 892 }
 893
 894 static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
 895 {
 896         __u8 encrypt = opt;
 897
 898         BT_DBG("%s %x", req->hdev->name, encrypt);
 899
 900         /* Encryption */
 901         hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 902         return 0;
 903 }
 904
 905 static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
 906 {
 907         __le16 policy = cpu_to_le16(opt);
 908
 909         BT_DBG("%s %x", req->hdev->name, policy);
 910
 911         /* Default link policy */
 912         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 913         return 0;
 914 }
 915
 916 /* Get HCI device by index.
 917  * Device is held on return. */
 918 struct hci_dev *hci_dev_get(int index)
 919 {
 920         struct hci_dev *hdev = NULL, *d;
 921
 922         BT_DBG("%d", index);
 923
 924         if (index < 0)
 925                 return NULL;
 926
 927         read_lock(&hci_dev_list_lock);
 928         list_for_each_entry(d, &hci_dev_list, list) {
 929                 if (d->id == index) {
 930                         hdev = hci_dev_hold(d);
 931                         break;
 932                 }
 933         }
 934         read_unlock(&hci_dev_list_lock);
 935         return hdev;
 936 }
 937
 938 /* ---- Inquiry support ---- */
 939
 940 bool hci_discovery_active(struct hci_dev *hdev)
 941 {
 942         struct discovery_state *discov = &hdev->discovery;
 943
 944         switch (discov->state) {
 945         case DISCOVERY_FINDING:
 946         case DISCOVERY_RESOLVING:
 947                 return true;
 948
 949         default:
 950                 return false;
 951         }
 952 }
 953
 954 void hci_discovery_set_state(struct hci_dev *hdev, int state)
 955 {
 956         int old_state = hdev->discovery.state;
 957
 958         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
 959
 960         if (old_state == state)
 961                 return;
 962
 963         hdev->discovery.state = state;
 964
 965         switch (state) {
 966         case DISCOVERY_STOPPED:
 967                 hci_update_background_scan(hdev);
 968
 969                 if (old_state != DISCOVERY_STARTING)
 970                         mgmt_discovering(hdev, 0);
 971                 break;
 972         case DISCOVERY_STARTING:
 973                 break;
 974         case DISCOVERY_FINDING:
 975                 mgmt_discovering(hdev, 1);
 976                 break;
 977         case DISCOVERY_RESOLVING:
 978                 break;
 979         case DISCOVERY_STOPPING:
 980                 break;
 981         }
 982 }
 983
 984 void hci_inquiry_cache_flush(struct hci_dev *hdev)
 985 {
 986         struct discovery_state *cache = &hdev->discovery;
 987         struct inquiry_entry *p, *n;
 988
 989         list_for_each_entry_safe(p, n, &cache->all, all) {
 990                 list_del(&p->all);
 991                 kfree(p);
 992         }
 993
 994         INIT_LIST_HEAD(&cache->unknown);
 995         INIT_LIST_HEAD(&cache->resolve);
 996 }
 997
 998 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
 999                                                bdaddr_t *bdaddr)
1000 {
1001         struct discovery_state *cache = &hdev->discovery;
1002         struct inquiry_entry *e;
1003
1004         BT_DBG("cache %p, %pMR", cache, bdaddr);
1005
1006         list_for_each_entry(e, &cache->all, all) {
1007                 if (!bacmp(&e->data.bdaddr, bdaddr))
1008                         return e;
1009         }
1010
1011         return NULL;
1012 }
1013
1014 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1015                                                        bdaddr_t *bdaddr)
1016 {
1017         struct discovery_state *cache = &hdev->discovery;
1018         struct inquiry_entry *e;
1019
1020         BT_DBG("cache %p, %pMR", cache, bdaddr);
1021
1022         list_for_each_entry(e, &cache->unknown, list) {
1023                 if (!bacmp(&e->data.bdaddr, bdaddr))
1024                         return e;
1025         }
1026
1027         return NULL;
1028 }
1029
1030 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1031                                                        bdaddr_t *bdaddr,
1032                                                        int state)
1033 {
1034         struct discovery_state *cache = &hdev->discovery;
1035         struct inquiry_entry *e;
1036
1037         BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1038
1039         list_for_each_entry(e, &cache->resolve, list) {
1040                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1041                         return e;
1042                 if (!bacmp(&e->data.bdaddr, bdaddr))
1043                         return e;
1044         }
1045
1046         return NULL;
1047 }
1048
1049 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1050                                       struct inquiry_entry *ie)
1051 {
1052         struct discovery_state *cache = &hdev->discovery;
1053         struct list_head *pos = &cache->resolve;
1054         struct inquiry_entry *p;
1055
1056         list_del(&ie->list);
1057
1058         list_for_each_entry(p, &cache->resolve, list) {
1059                 if (p->name_state != NAME_PENDING &&
1060                     abs(p->data.rssi) >= abs(ie->data.rssi))
1061                         break;
1062                 pos = &p->list;
1063         }
1064
1065         list_add(&ie->list, pos);
1066 }
1067
1068 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1069                              bool name_known)
1070 {
1071         struct discovery_state *cache = &hdev->discovery;
1072         struct inquiry_entry *ie;
1073         u32 flags = 0;
1074
1075         BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1076
1077         hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1078
1079         if (!data->ssp_mode)
1080                 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1081
1082         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1083         if (ie) {
1084                 if (!ie->data.ssp_mode)
1085                         flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1086
1087                 if (ie->name_state == NAME_NEEDED &&
1088                     data->rssi != ie->data.rssi) {
1089                         ie->data.rssi = data->rssi;
1090                         hci_inquiry_cache_update_resolve(hdev, ie);
1091                 }
1092
1093                 goto update;
1094         }
1095
1096         /* Entry not in the cache. Add new one. */
1097         ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1098         if (!ie) {
1099                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1100                 goto done;
1101         }
1102
1103         list_add(&ie->all, &cache->all);
1104
1105         if (name_known) {
1106                 ie->name_state = NAME_KNOWN;
1107         } else {
1108                 ie->name_state = NAME_NOT_KNOWN;
1109                 list_add(&ie->list, &cache->unknown);
1110         }
1111
1112 update:
1113         if (name_known && ie->name_state != NAME_KNOWN &&
1114             ie->name_state != NAME_PENDING) {
1115                 ie->name_state = NAME_KNOWN;
1116                 list_del(&ie->list);
1117         }
1118
1119         memcpy(&ie->data, data, sizeof(*data));
1120         ie->timestamp = jiffies;
1121         cache->timestamp = jiffies;
1122
1123         if (ie->name_state == NAME_NOT_KNOWN)
1124                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1125
1126 done:
1127         return flags;
1128 }
1129
1130 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1131 {
1132         struct discovery_state *cache = &hdev->discovery;
1133         struct inquiry_info *info = (struct inquiry_info *) buf;
1134         struct inquiry_entry *e;
1135         int copied = 0;
1136
1137         list_for_each_entry(e, &cache->all, all) {
1138                 struct inquiry_data *data = &e->data;
1139
1140                 if (copied >= num)
1141                         break;
1142
1143                 bacpy(&info->bdaddr, &data->bdaddr);
1144                 info->pscan_rep_mode    = data->pscan_rep_mode;
1145                 info->pscan_period_mode = data->pscan_period_mode;
1146                 info->pscan_mode        = data->pscan_mode;
1147                 memcpy(info->dev_class, data->dev_class, 3);
1148                 info->clock_offset      = data->clock_offset;
1149
1150                 info++;
1151                 copied++;
1152         }
1153
1154         BT_DBG("cache %p, copied %d", cache, copied);
1155         return copied;
1156 }
1157
1158 static int hci_inq_req(struct hci_request *req, unsigned long opt)
1159 {
1160         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1161         struct hci_dev *hdev = req->hdev;
1162         struct hci_cp_inquiry cp;
1163
1164         BT_DBG("%s", hdev->name);
1165
1166         if (test_bit(HCI_INQUIRY, &hdev->flags))
1167                 return 0;
1168
1169         /* Start Inquiry */
1170         memcpy(&cp.lap, &ir->lap, 3);
1171         cp.length  = ir->length;
1172         cp.num_rsp = ir->num_rsp;
1173         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1174
1175         return 0;
1176 }
1177
1178 int hci_inquiry(void __user *arg)
1179 {
1180         __u8 __user *ptr = arg;
1181         struct hci_inquiry_req ir;
1182         struct hci_dev *hdev;
1183         int err = 0, do_inquiry = 0, max_rsp;
1184         long timeo;
1185         __u8 *buf;
1186
1187         if (copy_from_user(&ir, ptr, sizeof(ir)))
1188                 return -EFAULT;
1189
1190         hdev = hci_dev_get(ir.dev_id);
1191         if (!hdev)
1192                 return -ENODEV;
1193
1194         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1195                 err = -EBUSY;
1196                 goto done;
1197         }
1198
1199         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1200                 err = -EOPNOTSUPP;
1201                 goto done;
1202         }
1203
1204         if (hdev->dev_type != HCI_BREDR) {
1205                 err = -EOPNOTSUPP;
1206                 goto done;
1207         }
1208
1209         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1210                 err = -EOPNOTSUPP;
1211                 goto done;
1212         }
1213
1214         hci_dev_lock(hdev);
1215         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1216             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1217                 hci_inquiry_cache_flush(hdev);
1218                 do_inquiry = 1;
1219         }
1220         hci_dev_unlock(hdev);
1221
1222         timeo = ir.length * msecs_to_jiffies(2000);
1223
1224         if (do_inquiry) {
1225                 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1226                                    timeo, NULL);
1227                 if (err < 0)
1228                         goto done;
1229
1230                 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1231                  * cleared). If it is interrupted by a signal, return -EINTR.
1232                  */
1233                 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1234                                 TASK_INTERRUPTIBLE))
1235                         return -EINTR;
1236         }
1237
1238         /* for unlimited number of responses we will use buffer with
1239          * 255 entries
1240          */
1241         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1242
1243         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1244          * copy it to the user space.
1245          */
1246         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
1247         if (!buf) {
1248                 err = -ENOMEM;
1249                 goto done;
1250         }
1251
1252         hci_dev_lock(hdev);
1253         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1254         hci_dev_unlock(hdev);
1255
1256         BT_DBG("num_rsp %d", ir.num_rsp);
1257
1258         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1259                 ptr += sizeof(ir);
1260                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1261                                  ir.num_rsp))
1262                         err = -EFAULT;
1263         } else
1264                 err = -EFAULT;
1265
1266         kfree(buf);
1267
1268 done:
1269         hci_dev_put(hdev);
1270         return err;
1271 }
1272
1273 static int hci_dev_do_open(struct hci_dev *hdev)
1274 {
1275         int ret = 0;
1276
1277         BT_DBG("%s %p", hdev->name, hdev);
1278
1279         hci_req_sync_lock(hdev);
1280
1281         if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1282                 ret = -ENODEV;
1283                 goto done;
1284         }
1285
1286         if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1287             !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1288                 /* Check for rfkill but allow the HCI setup stage to
1289                  * proceed (which in itself doesn't cause any RF activity).
1290                  */
1291                 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1292                         ret = -ERFKILL;
1293                         goto done;
1294                 }
1295
1296                 /* Check for valid public address or a configured static
1297                  * random adddress, but let the HCI setup proceed to
1298                  * be able to determine if there is a public address
1299                  * or not.
1300                  *
1301                  * In case of user channel usage, it is not important
1302                  * if a public address or static random address is
1303                  * available.
1304                  *
1305                  * This check is only valid for BR/EDR controllers
1306                  * since AMP controllers do not have an address.
1307                  */
1308                 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1309                     hdev->dev_type == HCI_BREDR &&
1310                     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1311                     !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1312                         ret = -EADDRNOTAVAIL;
1313                         goto done;
1314                 }
1315         }
1316
1317         if (test_bit(HCI_UP, &hdev->flags)) {
1318                 ret = -EALREADY;
1319                 goto done;
1320         }
1321
1322         if (hdev->open(hdev)) {
1323                 ret = -EIO;
1324                 goto done;
1325         }
1326
1327         set_bit(HCI_RUNNING, &hdev->flags);
1328         hci_sock_dev_event(hdev, HCI_DEV_OPEN);
1329
1330         atomic_set(&hdev->cmd_cnt, 1);
1331         set_bit(HCI_INIT, &hdev->flags);
1332
1333         if (hci_dev_test_flag(hdev, HCI_SETUP)) {
1334                 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1335
1336                 if (hdev->setup)
1337                         ret = hdev->setup(hdev);
1338
1339                 /* The transport driver can set these quirks before
1340                  * creating the HCI device or in its setup callback.
1341                  *
1342                  * In case any of them is set, the controller has to
1343                  * start up as unconfigured.
1344                  */
1345                 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1346                     test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
1347                         hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1348
1349                 /* For an unconfigured controller it is required to
1350                  * read at least the version information provided by
1351                  * the Read Local Version Information command.
1352                  *
1353                  * If the set_bdaddr driver callback is provided, then
1354                  * also the original Bluetooth public device address
1355                  * will be read using the Read BD Address command.
1356                  */
1357                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1358                         ret = __hci_unconf_init(hdev);
1359         }
1360
1361         if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1362                 /* If public address change is configured, ensure that
1363                  * the address gets programmed. If the driver does not
1364                  * support changing the public address, fail the power
1365                  * on procedure.
1366                  */
1367                 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1368                     hdev->set_bdaddr)
1369                         ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1370                 else
1371                         ret = -EADDRNOTAVAIL;
1372         }
1373
1374         if (!ret) {
1375                 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1376                     !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1377                         ret = __hci_init(hdev);
1378                         if (!ret && hdev->post_init)
1379                                 ret = hdev->post_init(hdev);
1380                 }
1381         }
1382
1383         /* If the HCI Reset command is clearing all diagnostic settings,
1384          * then they need to be reprogrammed after the init procedure
1385          * completed.
1386          */
1387         if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
1388             hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1389                 ret = hdev->set_diag(hdev, true);
1390
1391         clear_bit(HCI_INIT, &hdev->flags);
1392
1393         if (!ret) {
1394                 hci_dev_hold(hdev);
1395                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1396                 set_bit(HCI_UP, &hdev->flags);
1397                 hci_sock_dev_event(hdev, HCI_DEV_UP);
1398                 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1399                     !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1400                     !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1401                     !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1402                     hci_dev_test_flag(hdev, HCI_MGMT) &&
1403                     hdev->dev_type == HCI_BREDR) {
1404                         ret = __hci_req_hci_power_on(hdev);
1405                         mgmt_power_on(hdev, ret);
1406                 }
1407         } else {
1408                 /* Init failed, cleanup */
1409                 flush_work(&hdev->tx_work);
1410                 flush_work(&hdev->cmd_work);
1411                 flush_work(&hdev->rx_work);
1412
1413                 skb_queue_purge(&hdev->cmd_q);
1414                 skb_queue_purge(&hdev->rx_q);
1415
1416                 if (hdev->flush)
1417                         hdev->flush(hdev);
1418
1419                 if (hdev->sent_cmd) {
1420                         kfree_skb(hdev->sent_cmd);
1421                         hdev->sent_cmd = NULL;
1422                 }
1423
1424                 clear_bit(HCI_RUNNING, &hdev->flags);
1425                 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1426
1427                 hdev->close(hdev);
1428                 hdev->flags &= BIT(HCI_RAW);
1429         }
1430
1431 done:
1432         hci_req_sync_unlock(hdev);
1433         return ret;
1434 }
1435
1436 /* ---- HCI ioctl helpers ---- */
1437
1438 int hci_dev_open(__u16 dev)
1439 {
1440         struct hci_dev *hdev;
1441         int err;
1442
1443         hdev = hci_dev_get(dev);
1444         if (!hdev)
1445                 return -ENODEV;
1446
1447         /* Devices that are marked as unconfigured can only be powered
1448          * up as user channel. Trying to bring them up as normal devices
1449          * will result into a failure. Only user channel operation is
1450          * possible.
1451          *
1452          * When this function is called for a user channel, the flag
1453          * HCI_USER_CHANNEL will be set first before attempting to
1454          * open the device.
1455          */
1456         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1457             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1458                 err = -EOPNOTSUPP;
1459                 goto done;
1460         }
1461
1462         /* We need to ensure that no other power on/off work is pending
1463          * before proceeding to call hci_dev_do_open. This is
1464          * particularly important if the setup procedure has not yet
1465          * completed.
1466          */
1467         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1468                 cancel_delayed_work(&hdev->power_off);
1469
1470         /* After this call it is guaranteed that the setup procedure
1471          * has finished. This means that error conditions like RFKILL
1472          * or no valid public or static random address apply.
1473          */
1474         flush_workqueue(hdev->req_workqueue);
1475
1476         /* For controllers not using the management interface and that
1477          * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1478          * so that pairing works for them. Once the management interface
1479          * is in use this bit will be cleared again and userspace has
1480          * to explicitly enable it.
1481          */
1482         if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1483             !hci_dev_test_flag(hdev, HCI_MGMT))
1484                 hci_dev_set_flag(hdev, HCI_BONDABLE);
1485
1486         err = hci_dev_do_open(hdev);
1487
1488 done:
1489         hci_dev_put(hdev);
1490         return err;
1491 }
1492
1493 /* This function requires the caller holds hdev->lock */
1494 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1495 {
1496         struct hci_conn_params *p;
1497
1498         list_for_each_entry(p, &hdev->le_conn_params, list) {
1499                 if (p->conn) {
1500                         hci_conn_drop(p->conn);
1501                         hci_conn_put(p->conn);
1502                         p->conn = NULL;
1503                 }
1504                 list_del_init(&p->action);
1505         }
1506
1507         BT_DBG("All LE pending actions cleared");
1508 }
1509
1510 int hci_dev_do_close(struct hci_dev *hdev)
1511 {
1512         bool auto_off;
1513
1514         BT_DBG("%s %p", hdev->name, hdev);
1515
1516         if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
1517             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1518             test_bit(HCI_UP, &hdev->flags)) {
1519                 /* Execute vendor specific shutdown routine */
1520                 if (hdev->shutdown)
1521                         hdev->shutdown(hdev);
1522         }
1523
1524         cancel_delayed_work(&hdev->power_off);
1525
1526         hci_request_cancel_all(hdev);
1527         hci_req_sync_lock(hdev);
1528
1529         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1530                 cancel_delayed_work_sync(&hdev->cmd_timer);
1531                 hci_req_sync_unlock(hdev);
1532                 return 0;
1533         }
1534
1535         /* Flush RX and TX works */
1536         flush_work(&hdev->tx_work);
1537         flush_work(&hdev->rx_work);
1538
1539         if (hdev->discov_timeout > 0) {
1540                 hdev->discov_timeout = 0;
1541                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1542                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1543         }
1544
1545         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1546                 cancel_delayed_work(&hdev->service_cache);
1547
1548         if (hci_dev_test_flag(hdev, HCI_MGMT))
1549                 cancel_delayed_work_sync(&hdev->rpa_expired);
1550
1551         /* Avoid potential lockdep warnings from the *_flush() calls by
1552          * ensuring the workqueue is empty up front.
1553          */
1554         drain_workqueue(hdev->workqueue);
1555
1556         hci_dev_lock(hdev);
1557
1558         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1559
1560         auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1561
1562         if (!auto_off && hdev->dev_type == HCI_BREDR &&
1563             hci_dev_test_flag(hdev, HCI_MGMT))
1564                 __mgmt_power_off(hdev);
1565
1566         hci_inquiry_cache_flush(hdev);
1567         hci_pend_le_actions_clear(hdev);
1568         hci_conn_hash_flush(hdev);
1569         hci_dev_unlock(hdev);
1570
1571         smp_unregister(hdev);
1572
1573         hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1574
1575         if (hdev->flush)
1576                 hdev->flush(hdev);
1577
1578         /* Reset device */
1579         skb_queue_purge(&hdev->cmd_q);
1580         atomic_set(&hdev->cmd_cnt, 1);
1581         if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1582             !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1583                 set_bit(HCI_INIT, &hdev->flags);
1584                 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1585                 clear_bit(HCI_INIT, &hdev->flags);
1586         }
1587
1588         /* flush cmd  work */
1589         flush_work(&hdev->cmd_work);
1590
1591         /* Drop queues */
1592         skb_queue_purge(&hdev->rx_q);
1593         skb_queue_purge(&hdev->cmd_q);
1594         skb_queue_purge(&hdev->raw_q);
1595
1596         /* Drop last sent command */
1597         if (hdev->sent_cmd) {
1598                 cancel_delayed_work_sync(&hdev->cmd_timer);
1599                 kfree_skb(hdev->sent_cmd);
1600                 hdev->sent_cmd = NULL;
1601         }
1602
1603         clear_bit(HCI_RUNNING, &hdev->flags);
1604         hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1605
1606         /* After this point our queues are empty
1607          * and no tasks are scheduled. */
1608         hdev->close(hdev);
1609
1610         /* Clear flags */
1611         hdev->flags &= BIT(HCI_RAW);
1612         hci_dev_clear_volatile_flags(hdev);
1613
1614         /* Controller radio is available but is currently powered down */
1615         hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1616
1617         memset(hdev->eir, 0, sizeof(hdev->eir));
1618         memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1619         bacpy(&hdev->random_addr, BDADDR_ANY);
1620
1621         hci_req_sync_unlock(hdev);
1622
1623         hci_dev_put(hdev);
1624         return 0;
1625 }
1626
1627 int hci_dev_close(__u16 dev)
1628 {
1629         struct hci_dev *hdev;
1630         int err;
1631
1632         hdev = hci_dev_get(dev);
1633         if (!hdev)
1634                 return -ENODEV;
1635
1636         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1637                 err = -EBUSY;
1638                 goto done;
1639         }
1640
1641         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1642                 cancel_delayed_work(&hdev->power_off);
1643
1644         err = hci_dev_do_close(hdev);
1645
1646 done:
1647         hci_dev_put(hdev);
1648         return err;
1649 }
1650
1651 static int hci_dev_do_reset(struct hci_dev *hdev)
1652 {
1653         int ret;
1654
1655         BT_DBG("%s %p", hdev->name, hdev);
1656
1657         hci_req_sync_lock(hdev);
1658
1659         /* Drop queues */
1660         skb_queue_purge(&hdev->rx_q);
1661         skb_queue_purge(&hdev->cmd_q);
1662
1663         /* Avoid potential lockdep warnings from the *_flush() calls by
1664          * ensuring the workqueue is empty up front.
1665          */
1666         drain_workqueue(hdev->workqueue);
1667
1668         hci_dev_lock(hdev);
1669         hci_inquiry_cache_flush(hdev);
1670         hci_conn_hash_flush(hdev);
1671         hci_dev_unlock(hdev);
1672
1673         if (hdev->flush)
1674                 hdev->flush(hdev);
1675
1676         atomic_set(&hdev->cmd_cnt, 1);
1677         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1678
1679         ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1680
1681         hci_req_sync_unlock(hdev);
1682         return ret;
1683 }
1684
1685 int hci_dev_reset(__u16 dev)
1686 {
1687         struct hci_dev *hdev;
1688         int err;
1689
1690         hdev = hci_dev_get(dev);
1691         if (!hdev)
1692                 return -ENODEV;
1693
1694         if (!test_bit(HCI_UP, &hdev->flags)) {
1695                 err = -ENETDOWN;
1696                 goto done;
1697         }
1698
1699         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1700                 err = -EBUSY;
1701                 goto done;
1702         }
1703
1704         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1705                 err = -EOPNOTSUPP;
1706                 goto done;
1707         }
1708
1709         err = hci_dev_do_reset(hdev);
1710
1711 done:
1712         hci_dev_put(hdev);
1713         return err;
1714 }
1715
1716 int hci_dev_reset_stat(__u16 dev)
1717 {
1718         struct hci_dev *hdev;
1719         int ret = 0;
1720
1721         hdev = hci_dev_get(dev);
1722         if (!hdev)
1723                 return -ENODEV;
1724
1725         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1726                 ret = -EBUSY;
1727                 goto done;
1728         }
1729
1730         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1731                 ret = -EOPNOTSUPP;
1732                 goto done;
1733         }
1734
1735         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1736
1737 done:
1738         hci_dev_put(hdev);
1739         return ret;
1740 }
1741
1742 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1743 {
1744         bool conn_changed, discov_changed;
1745
1746         BT_DBG("%s scan 0x%02x", hdev->name, scan);
1747
1748         if ((scan & SCAN_PAGE))
1749                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1750                                                           HCI_CONNECTABLE);
1751         else
1752                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1753                                                            HCI_CONNECTABLE);
1754
1755         if ((scan & SCAN_INQUIRY)) {
1756                 discov_changed = !hci_dev_test_and_set_flag(hdev,
1757                                                             HCI_DISCOVERABLE);
1758         } else {
1759                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1760                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1761                                                              HCI_DISCOVERABLE);
1762         }
1763
1764         if (!hci_dev_test_flag(hdev, HCI_MGMT))
1765                 return;
1766
1767         if (conn_changed || discov_changed) {
1768                 /* In case this was disabled through mgmt */
1769                 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
1770
1771                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1772                         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1773
1774                 mgmt_new_settings(hdev);
1775         }
1776 }
1777
1778 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1779 {
1780         struct hci_dev *hdev;
1781         struct hci_dev_req dr;
1782         int err = 0;
1783
1784         if (copy_from_user(&dr, arg, sizeof(dr)))
1785                 return -EFAULT;
1786
1787         hdev = hci_dev_get(dr.dev_id);
1788         if (!hdev)
1789                 return -ENODEV;
1790
1791         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1792                 err = -EBUSY;
1793                 goto done;
1794         }
1795
1796         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1797                 err = -EOPNOTSUPP;
1798                 goto done;
1799         }
1800
1801         if (hdev->dev_type != HCI_BREDR) {
1802                 err = -EOPNOTSUPP;
1803                 goto done;
1804         }
1805
1806         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1807                 err = -EOPNOTSUPP;
1808                 goto done;
1809         }
1810
1811         switch (cmd) {
1812         case HCISETAUTH:
1813                 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1814                                    HCI_INIT_TIMEOUT, NULL);
1815                 break;
1816
1817         case HCISETENCRYPT:
1818                 if (!lmp_encrypt_capable(hdev)) {
1819                         err = -EOPNOTSUPP;
1820                         break;
1821                 }
1822
1823                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1824                         /* Auth must be enabled first */
1825                         err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1826                                            HCI_INIT_TIMEOUT, NULL);
1827                         if (err)
1828                                 break;
1829                 }
1830
1831                 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1832                                    HCI_INIT_TIMEOUT, NULL);
1833                 break;
1834
1835         case HCISETSCAN:
1836                 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1837                                    HCI_INIT_TIMEOUT, NULL);
1838
1839                 /* Ensure that the connectable and discoverable states
1840                  * get correctly modified as this was a non-mgmt change.
1841                  */
1842                 if (!err)
1843                         hci_update_scan_state(hdev, dr.dev_opt);
1844                 break;
1845
1846         case HCISETLINKPOL:
1847                 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1848                                    HCI_INIT_TIMEOUT, NULL);
1849                 break;
1850
1851         case HCISETLINKMODE:
1852                 hdev->link_mode = ((__u16) dr.dev_opt) &
1853                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
1854                 break;
1855
1856         case HCISETPTYPE:
1857                 hdev->pkt_type = (__u16) dr.dev_opt;
1858                 break;
1859
1860         case HCISETACLMTU:
1861                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
1862                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1863                 break;
1864
1865         case HCISETSCOMTU:
1866                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
1867                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1868                 break;
1869
1870         default:
1871                 err = -EINVAL;
1872                 break;
1873         }
1874
1875 done:
1876         hci_dev_put(hdev);
1877         return err;
1878 }
1879
1880 int hci_get_dev_list(void __user *arg)
1881 {
1882         struct hci_dev *hdev;
1883         struct hci_dev_list_req *dl;
1884         struct hci_dev_req *dr;
1885         int n = 0, size, err;
1886         __u16 dev_num;
1887
1888         if (get_user(dev_num, (__u16 __user *) arg))
1889                 return -EFAULT;
1890
1891         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1892                 return -EINVAL;
1893
1894         size = sizeof(*dl) + dev_num * sizeof(*dr);
1895
1896         dl = kzalloc(size, GFP_KERNEL);
1897         if (!dl)
1898                 return -ENOMEM;
1899
1900         dr = dl->dev_req;
1901
1902         read_lock(&hci_dev_list_lock);
1903         list_for_each_entry(hdev, &hci_dev_list, list) {
1904                 unsigned long flags = hdev->flags;
1905
1906                 /* When the auto-off is configured it means the transport
1907                  * is running, but in that case still indicate that the
1908                  * device is actually down.
1909                  */
1910                 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
1911                         flags &= ~BIT(HCI_UP);
1912
1913                 (dr + n)->dev_id  = hdev->id;
1914                 (dr + n)->dev_opt = flags;
1915
1916                 if (++n >= dev_num)
1917                         break;
1918         }
1919         read_unlock(&hci_dev_list_lock);
1920
1921         dl->dev_num = n;
1922         size = sizeof(*dl) + n * sizeof(*dr);
1923
1924         err = copy_to_user(arg, dl, size);
1925         kfree(dl);
1926
1927         return err ? -EFAULT : 0;
1928 }
1929
1930 int hci_get_dev_info(void __user *arg)
1931 {
1932         struct hci_dev *hdev;
1933         struct hci_dev_info di;
1934         unsigned long flags;
1935         int err = 0;
1936
1937         if (copy_from_user(&di, arg, sizeof(di)))
1938                 return -EFAULT;
1939
1940         hdev = hci_dev_get(di.dev_id);
1941         if (!hdev)
1942                 return -ENODEV;
1943
1944         /* When the auto-off is configured it means the transport
1945          * is running, but in that case still indicate that the
1946          * device is actually down.
1947          */
1948         if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
1949                 flags = hdev->flags & ~BIT(HCI_UP);
1950         else
1951                 flags = hdev->flags;
1952
1953         strcpy(di.name, hdev->name);
1954         di.bdaddr   = hdev->bdaddr;
1955         di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
1956         di.flags    = flags;
1957         di.pkt_type = hdev->pkt_type;
1958         if (lmp_bredr_capable(hdev)) {
1959                 di.acl_mtu  = hdev->acl_mtu;
1960                 di.acl_pkts = hdev->acl_pkts;
1961                 di.sco_mtu  = hdev->sco_mtu;
1962                 di.sco_pkts = hdev->sco_pkts;
1963         } else {
1964                 di.acl_mtu  = hdev->le_mtu;
1965                 di.acl_pkts = hdev->le_pkts;
1966                 di.sco_mtu  = 0;
1967                 di.sco_pkts = 0;
1968         }
1969         di.link_policy = hdev->link_policy;
1970         di.link_mode   = hdev->link_mode;
1971
1972         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1973         memcpy(&di.features, &hdev->features, sizeof(di.features));
1974
1975         if (copy_to_user(arg, &di, sizeof(di)))
1976                 err = -EFAULT;
1977
1978         hci_dev_put(hdev);
1979
1980         return err;
1981 }
1982
1983 /* ---- Interface to HCI drivers ---- */
1984
1985 static int hci_rfkill_set_block(void *data, bool blocked)
1986 {
1987         struct hci_dev *hdev = data;
1988
1989         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1990
1991         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
1992                 return -EBUSY;
1993
1994         if (blocked) {
1995                 hci_dev_set_flag(hdev, HCI_RFKILLED);
1996                 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1997                     !hci_dev_test_flag(hdev, HCI_CONFIG))
1998                         hci_dev_do_close(hdev);
1999         } else {
2000                 hci_dev_clear_flag(hdev, HCI_RFKILLED);
2001         }
2002
2003         return 0;
2004 }
2005
2006 static const struct rfkill_ops hci_rfkill_ops = {
2007         .set_block = hci_rfkill_set_block,
2008 };
2009
2010 static void hci_power_on(struct work_struct *work)
2011 {
2012         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2013         int err;
2014
2015         BT_DBG("%s", hdev->name);
2016
2017         if (test_bit(HCI_UP, &hdev->flags) &&
2018             hci_dev_test_flag(hdev, HCI_MGMT) &&
2019             hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
2020                 hci_req_sync_lock(hdev);
2021                 err = __hci_req_hci_power_on(hdev);
2022                 hci_req_sync_unlock(hdev);
2023                 mgmt_power_on(hdev, err);
2024                 return;
2025         }
2026
2027         err = hci_dev_do_open(hdev);
2028         if (err < 0) {
2029                 hci_dev_lock(hdev);
2030                 mgmt_set_powered_failed(hdev, err);
2031                 hci_dev_unlock(hdev);
2032                 return;
2033         }
2034
2035         /* During the HCI setup phase, a few error conditions are
2036          * ignored and they need to be checked now. If they are still
2037          * valid, it is important to turn the device back off.
2038          */
2039         if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2040             hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2041             (hdev->dev_type == HCI_BREDR &&
2042              !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2043              !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2044                 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2045                 hci_dev_do_close(hdev);
2046         } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2047                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2048                                    HCI_AUTO_OFF_TIMEOUT);
2049         }
2050
2051         if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2052                 /* For unconfigured devices, set the HCI_RAW flag
2053                  * so that userspace can easily identify them.
2054                  */
2055                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2056                         set_bit(HCI_RAW, &hdev->flags);
2057
2058                 /* For fully configured devices, this will send
2059                  * the Index Added event. For unconfigured devices,
2060                  * it will send Unconfigued Index Added event.
2061                  *
2062                  * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2063                  * and no event will be send.
2064                  */
2065                 mgmt_index_added(hdev);
2066         } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2067                 /* When the controller is now configured, then it
2068                  * is important to clear the HCI_RAW flag.
2069                  */
2070                 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2071                         clear_bit(HCI_RAW, &hdev->flags);
2072
2073                 /* Powering on the controller with HCI_CONFIG set only
2074                  * happens with the transition from unconfigured to
2075                  * configured. This will send the Index Added event.
2076                  */
2077                 mgmt_index_added(hdev);
2078         }
2079 }
2080
2081 static void hci_power_off(struct work_struct *work)
2082 {
2083         struct hci_dev *hdev = container_of(work, struct hci_dev,
2084                                             power_off.work);
2085
2086         BT_DBG("%s", hdev->name);
2087
2088         hci_dev_do_close(hdev);
2089 }
2090
2091 static void hci_error_reset(struct work_struct *work)
2092 {
2093         struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2094
2095         BT_DBG("%s", hdev->name);
2096
2097         if (hdev->hw_error)
2098                 hdev->hw_error(hdev, hdev->hw_error_code);
2099         else
2100                 BT_ERR("%s hardware error 0x%2.2x", hdev->name,
2101                        hdev->hw_error_code);
2102
2103         if (hci_dev_do_close(hdev))
2104                 return;
2105
2106         hci_dev_do_open(hdev);
2107 }
2108
2109 void hci_uuids_clear(struct hci_dev *hdev)
2110 {
2111         struct bt_uuid *uuid, *tmp;
2112
2113         list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2114                 list_del(&uuid->list);
2115                 kfree(uuid);
2116         }
2117 }
2118
2119 void hci_link_keys_clear(struct hci_dev *hdev)
2120 {
2121         struct link_key *key;
2122
2123         list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2124                 list_del_rcu(&key->list);
2125                 kfree_rcu(key, rcu);
2126         }
2127 }
2128
2129 void hci_smp_ltks_clear(struct hci_dev *hdev)
2130 {
2131         struct smp_ltk *k;
2132
2133         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2134                 list_del_rcu(&k->list);
2135                 kfree_rcu(k, rcu);
2136         }
2137 }
2138
2139 void hci_smp_irks_clear(struct hci_dev *hdev)
2140 {
2141         struct smp_irk *k;
2142
2143         list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2144                 list_del_rcu(&k->list);
2145                 kfree_rcu(k, rcu);
2146         }
2147 }
2148
2149 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2150 {
2151         struct link_key *k;
2152
2153         rcu_read_lock();
2154         list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2155                 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2156                         rcu_read_unlock();
2157                         return k;
2158                 }
2159         }
2160         rcu_read_unlock();
2161
2162         return NULL;
2163 }
2164
2165 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2166                                u8 key_type, u8 old_key_type)
2167 {
2168         /* Legacy key */
2169         if (key_type < 0x03)
2170                 return true;
2171
2172         /* Debug keys are insecure so don't store them persistently */
2173         if (key_type == HCI_LK_DEBUG_COMBINATION)
2174                 return false;
2175
2176         /* Changed combination key and there's no previous one */
2177         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2178                 return false;
2179
2180         /* Security mode 3 case */
2181         if (!conn)
2182                 return true;
2183
2184         /* BR/EDR key derived using SC from an LE link */
2185         if (conn->type == LE_LINK)
2186                 return true;
2187
2188         /* Neither local nor remote side had no-bonding as requirement */
2189         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2190                 return true;
2191
2192         /* Local side had dedicated bonding as requirement */
2193         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2194                 return true;
2195
2196         /* Remote side had dedicated bonding as requirement */
2197         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2198                 return true;
2199
2200         /* If none of the above criteria match, then don't store the key
2201          * persistently */
2202         return false;
2203 }
2204
2205 static u8 ltk_role(u8 type)
2206 {
2207         if (type == SMP_LTK)
2208                 return HCI_ROLE_MASTER;
2209
2210         return HCI_ROLE_SLAVE;
2211 }
2212
2213 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2214                              u8 addr_type, u8 role)
2215 {
2216         struct smp_ltk *k;
2217
2218         rcu_read_lock();
2219         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2220                 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2221                         continue;
2222
2223                 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2224                         rcu_read_unlock();
2225                         return k;
2226                 }
2227         }
2228         rcu_read_unlock();
2229
2230         return NULL;
2231 }
2232
2233 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2234 {
2235         struct smp_irk *irk;
2236
2237         rcu_read_lock();
2238         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2239                 if (!bacmp(&irk->rpa, rpa)) {
2240                         rcu_read_unlock();
2241                         return irk;
2242                 }
2243         }
2244
2245         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2246                 if (smp_irk_matches(hdev, irk->val, rpa)) {
2247                         bacpy(&irk->rpa, rpa);
2248                         rcu_read_unlock();
2249                         return irk;
2250                 }
2251         }
2252         rcu_read_unlock();
2253
2254         return NULL;
2255 }
2256
2257 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2258                                      u8 addr_type)
2259 {
2260         struct smp_irk *irk;
2261
2262         /* Identity Address must be public or static random */
2263         if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2264                 return NULL;
2265
2266         rcu_read_lock();
2267         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2268                 if (addr_type == irk->addr_type &&
2269                     bacmp(bdaddr, &irk->bdaddr) == 0) {
2270                         rcu_read_unlock();
2271                         return irk;
2272                 }
2273         }
2274         rcu_read_unlock();
2275
2276         return NULL;
2277 }
2278
2279 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2280                                   bdaddr_t *bdaddr, u8 *val, u8 type,
2281                                   u8 pin_len, bool *persistent)
2282 {
2283         struct link_key *key, *old_key;
2284         u8 old_key_type;
2285
2286         old_key = hci_find_link_key(hdev, bdaddr);
2287         if (old_key) {
2288                 old_key_type = old_key->type;
2289                 key = old_key;
2290         } else {
2291                 old_key_type = conn ? conn->key_type : 0xff;
2292                 key = kzalloc(sizeof(*key), GFP_KERNEL);
2293                 if (!key)
2294                         return NULL;
2295                 list_add_rcu(&key->list, &hdev->link_keys);
2296         }
2297
2298         BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2299
2300         /* Some buggy controller combinations generate a changed
2301          * combination key for legacy pairing even when there's no
2302          * previous key */
2303         if (type == HCI_LK_CHANGED_COMBINATION &&
2304             (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2305                 type = HCI_LK_COMBINATION;
2306                 if (conn)
2307                         conn->key_type = type;
2308         }
2309
2310         bacpy(&key->bdaddr, bdaddr);
2311         memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2312         key->pin_len = pin_len;
2313
2314         if (type == HCI_LK_CHANGED_COMBINATION)
2315                 key->type = old_key_type;
2316         else
2317                 key->type = type;
2318
2319         if (persistent)
2320                 *persistent = hci_persistent_key(hdev, conn, type,
2321                                                  old_key_type);
2322
2323         return key;
2324 }
2325
2326 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2327                             u8 addr_type, u8 type, u8 authenticated,
2328                             u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2329 {
2330         struct smp_ltk *key, *old_key;
2331         u8 role = ltk_role(type);
2332
2333         old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2334         if (old_key)
2335                 key = old_key;
2336         else {
2337                 key = kzalloc(sizeof(*key), GFP_KERNEL);
2338                 if (!key)
2339                         return NULL;
2340                 list_add_rcu(&key->list, &hdev->long_term_keys);
2341         }
2342
2343         bacpy(&key->bdaddr, bdaddr);
2344         key->bdaddr_type = addr_type;
2345         memcpy(key->val, tk, sizeof(key->val));
2346         key->authenticated = authenticated;
2347         key->ediv = ediv;
2348         key->rand = rand;
2349         key->enc_size = enc_size;
2350         key->type = type;
2351
2352         return key;
2353 }
2354
2355 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2356                             u8 addr_type, u8 val[16], bdaddr_t *rpa)
2357 {
2358         struct smp_irk *irk;
2359
2360         irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2361         if (!irk) {
2362                 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2363                 if (!irk)
2364                         return NULL;
2365
2366                 bacpy(&irk->bdaddr, bdaddr);
2367                 irk->addr_type = addr_type;
2368
2369                 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2370         }
2371
2372         memcpy(irk->val, val, 16);
2373         bacpy(&irk->rpa, rpa);
2374
2375         return irk;
2376 }
2377
2378 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2379 {
2380         struct link_key *key;
2381
2382         key = hci_find_link_key(hdev, bdaddr);
2383         if (!key)
2384                 return -ENOENT;
2385
2386         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2387
2388         list_del_rcu(&key->list);
2389         kfree_rcu(key, rcu);
2390
2391         return 0;
2392 }
2393
2394 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2395 {
2396         struct smp_ltk *k;
2397         int removed = 0;
2398
2399         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2400                 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2401                         continue;
2402
2403                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2404
2405                 list_del_rcu(&k->list);
2406                 kfree_rcu(k, rcu);
2407                 removed++;
2408         }
2409
2410         return removed ? 0 : -ENOENT;
2411 }
2412
2413 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2414 {
2415         struct smp_irk *k;
2416
2417         list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2418                 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2419                         continue;
2420
2421                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2422
2423                 list_del_rcu(&k->list);
2424                 kfree_rcu(k, rcu);
2425         }
2426 }
2427
2428 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2429 {
2430         struct smp_ltk *k;
2431         struct smp_irk *irk;
2432         u8 addr_type;
2433
2434         if (type == BDADDR_BREDR) {
2435                 if (hci_find_link_key(hdev, bdaddr))
2436                         return true;
2437                 return false;
2438         }
2439
2440         /* Convert to HCI addr type which struct smp_ltk uses */
2441         if (type == BDADDR_LE_PUBLIC)
2442                 addr_type = ADDR_LE_DEV_PUBLIC;
2443         else
2444                 addr_type = ADDR_LE_DEV_RANDOM;
2445
2446         irk = hci_get_irk(hdev, bdaddr, addr_type);
2447         if (irk) {
2448                 bdaddr = &irk->bdaddr;
2449                 addr_type = irk->addr_type;
2450         }
2451
2452         rcu_read_lock();
2453         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2454                 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2455                         rcu_read_unlock();
2456                         return true;
2457                 }
2458         }
2459         rcu_read_unlock();
2460
2461         return false;
2462 }
2463
2464 /* HCI command timer function */
2465 static void hci_cmd_timeout(struct work_struct *work)
2466 {
2467         struct hci_dev *hdev = container_of(work, struct hci_dev,
2468                                             cmd_timer.work);
2469
2470         if (hdev->sent_cmd) {
2471                 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2472                 u16 opcode = __le16_to_cpu(sent->opcode);
2473
2474                 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
2475         } else {
2476                 BT_ERR("%s command tx timeout", hdev->name);
2477         }
2478
2479         atomic_set(&hdev->cmd_cnt, 1);
2480         queue_work(hdev->workqueue, &hdev->cmd_work);
2481 }
2482
2483 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2484                                           bdaddr_t *bdaddr, u8 bdaddr_type)
2485 {
2486         struct oob_data *data;
2487
2488         list_for_each_entry(data, &hdev->remote_oob_data, list) {
2489                 if (bacmp(bdaddr, &data->bdaddr) != 0)
2490                         continue;
2491                 if (data->bdaddr_type != bdaddr_type)
2492                         continue;
2493                 return data;
2494         }
2495
2496         return NULL;
2497 }
2498
2499 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2500                                u8 bdaddr_type)
2501 {
2502         struct oob_data *data;
2503
2504         data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2505         if (!data)
2506                 return -ENOENT;
2507
2508         BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2509
2510         list_del(&data->list);
2511         kfree(data);
2512
2513         return 0;
2514 }
2515
2516 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2517 {
2518         struct oob_data *data, *n;
2519
2520         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2521                 list_del(&data->list);
2522                 kfree(data);
2523         }
2524 }
2525
2526 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2527                             u8 bdaddr_type, u8 *hash192, u8 *rand192,
2528                             u8 *hash256, u8 *rand256)
2529 {
2530         struct oob_data *data;
2531
2532         data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2533         if (!data) {
2534                 data = kmalloc(sizeof(*data), GFP_KERNEL);
2535                 if (!data)
2536                         return -ENOMEM;
2537
2538                 bacpy(&data->bdaddr, bdaddr);
2539                 data->bdaddr_type = bdaddr_type;
2540                 list_add(&data->list, &hdev->remote_oob_data);
2541         }
2542
2543         if (hash192 && rand192) {
2544                 memcpy(data->hash192, hash192, sizeof(data->hash192));
2545                 memcpy(data->rand192, rand192, sizeof(data->rand192));
2546                 if (hash256 && rand256)
2547                         data->present = 0x03;
2548         } else {
2549                 memset(data->hash192, 0, sizeof(data->hash192));
2550                 memset(data->rand192, 0, sizeof(data->rand192));
2551                 if (hash256 && rand256)
2552                         data->present = 0x02;
2553                 else
2554                         data->present = 0x00;
2555         }
2556
2557         if (hash256 && rand256) {
2558                 memcpy(data->hash256, hash256, sizeof(data->hash256));
2559                 memcpy(data->rand256, rand256, sizeof(data->rand256));
2560         } else {
2561                 memset(data->hash256, 0, sizeof(data->hash256));
2562                 memset(data->rand256, 0, sizeof(data->rand256));
2563                 if (hash192 && rand192)
2564                         data->present = 0x01;
2565         }
2566
2567         BT_DBG("%s for %pMR", hdev->name, bdaddr);
2568
2569         return 0;
2570 }
2571
2572 /* This function requires the caller holds hdev->lock */
2573 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2574 {
2575         struct adv_info *adv_instance;
2576
2577         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2578                 if (adv_instance->instance == instance)
2579                         return adv_instance;
2580         }
2581
2582         return NULL;
2583 }
2584
2585 /* This function requires the caller holds hdev->lock */
2586 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2587 {
2588         struct adv_info *cur_instance;
2589
2590         cur_instance = hci_find_adv_instance(hdev, instance);
2591         if (!cur_instance)
2592                 return NULL;
2593
2594         if (cur_instance == list_last_entry(&hdev->adv_instances,
2595                                             struct adv_info, list))
2596                 return list_first_entry(&hdev->adv_instances,
2597                                                  struct adv_info, list);
2598         else
2599                 return list_next_entry(cur_instance, list);
2600 }
2601
2602 /* This function requires the caller holds hdev->lock */
2603 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2604 {
2605         struct adv_info *adv_instance;
2606
2607         adv_instance = hci_find_adv_instance(hdev, instance);
2608         if (!adv_instance)
2609                 return -ENOENT;
2610
2611         BT_DBG("%s removing %dMR", hdev->name, instance);
2612
2613         if (hdev->cur_adv_instance == instance) {
2614                 if (hdev->adv_instance_timeout) {
2615                         cancel_delayed_work(&hdev->adv_instance_expire);
2616                         hdev->adv_instance_timeout = 0;
2617                 }
2618                 hdev->cur_adv_instance = 0x00;
2619         }
2620
2621         list_del(&adv_instance->list);
2622         kfree(adv_instance);
2623
2624         hdev->adv_instance_cnt--;
2625
2626         return 0;
2627 }
2628
2629 /* This function requires the caller holds hdev->lock */
2630 void hci_adv_instances_clear(struct hci_dev *hdev)
2631 {
2632         struct adv_info *adv_instance, *n;
2633
2634         if (hdev->adv_instance_timeout) {
2635                 cancel_delayed_work(&hdev->adv_instance_expire);
2636                 hdev->adv_instance_timeout = 0;
2637         }
2638
2639         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
2640                 list_del(&adv_instance->list);
2641                 kfree(adv_instance);
2642         }
2643
2644         hdev->adv_instance_cnt = 0;
2645         hdev->cur_adv_instance = 0x00;
2646 }
2647
2648 /* This function requires the caller holds hdev->lock */
2649 int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2650                          u16 adv_data_len, u8 *adv_data,
2651                          u16 scan_rsp_len, u8 *scan_rsp_data,
2652                          u16 timeout, u16 duration)
2653 {
2654         struct adv_info *adv_instance;
2655
2656         adv_instance = hci_find_adv_instance(hdev, instance);
2657         if (adv_instance) {
2658                 memset(adv_instance->adv_data, 0,
2659                        sizeof(adv_instance->adv_data));
2660                 memset(adv_instance->scan_rsp_data, 0,
2661                        sizeof(adv_instance->scan_rsp_data));
2662         } else {
2663                 if (hdev->adv_instance_cnt >= HCI_MAX_ADV_INSTANCES ||
2664                     instance < 1 || instance > HCI_MAX_ADV_INSTANCES)
2665                         return -EOVERFLOW;
2666
2667                 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
2668                 if (!adv_instance)
2669                         return -ENOMEM;
2670
2671                 adv_instance->pending = true;
2672                 adv_instance->instance = instance;
2673                 list_add(&adv_instance->list, &hdev->adv_instances);
2674                 hdev->adv_instance_cnt++;
2675         }
2676
2677         adv_instance->flags = flags;
2678         adv_instance->adv_data_len = adv_data_len;
2679         adv_instance->scan_rsp_len = scan_rsp_len;
2680
2681         if (adv_data_len)
2682                 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
2683
2684         if (scan_rsp_len)
2685                 memcpy(adv_instance->scan_rsp_data,
2686                        scan_rsp_data, scan_rsp_len);
2687
2688         adv_instance->timeout = timeout;
2689         adv_instance->remaining_time = timeout;
2690
2691         if (duration == 0)
2692                 adv_instance->duration = HCI_DEFAULT_ADV_DURATION;
2693         else
2694                 adv_instance->duration = duration;
2695
2696         BT_DBG("%s for %dMR", hdev->name, instance);
2697
2698         return 0;
2699 }
2700
2701 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2702                                          bdaddr_t *bdaddr, u8 type)
2703 {
2704         struct bdaddr_list *b;
2705
2706         list_for_each_entry(b, bdaddr_list, list) {
2707                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2708                         return b;
2709         }
2710
2711         return NULL;
2712 }
2713
2714 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2715 {
2716         struct bdaddr_list *b, *n;
2717
2718         list_for_each_entry_safe(b, n, bdaddr_list, list) {
2719                 list_del(&b->list);
2720                 kfree(b);
2721         }
2722 }
2723
2724 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2725 {
2726         struct bdaddr_list *entry;
2727
2728         if (!bacmp(bdaddr, BDADDR_ANY))
2729                 return -EBADF;
2730
2731         if (hci_bdaddr_list_lookup(list, bdaddr, type))
2732                 return -EEXIST;
2733
2734         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2735         if (!entry)
2736                 return -ENOMEM;
2737
2738         bacpy(&entry->bdaddr, bdaddr);
2739         entry->bdaddr_type = type;
2740
2741         list_add(&entry->list, list);
2742
2743         return 0;
2744 }
2745
2746 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2747 {
2748         struct bdaddr_list *entry;
2749
2750         if (!bacmp(bdaddr, BDADDR_ANY)) {
2751                 hci_bdaddr_list_clear(list);
2752                 return 0;
2753         }
2754
2755         entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2756         if (!entry)
2757                 return -ENOENT;
2758
2759         list_del(&entry->list);
2760         kfree(entry);
2761
2762         return 0;
2763 }
2764
2765 /* This function requires the caller holds hdev->lock */
2766 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2767                                                bdaddr_t *addr, u8 addr_type)
2768 {
2769         struct hci_conn_params *params;
2770
2771         list_for_each_entry(params, &hdev->le_conn_params, list) {
2772                 if (bacmp(&params->addr, addr) == 0 &&
2773                     params->addr_type == addr_type) {
2774                         return params;
2775                 }
2776         }
2777
2778         return NULL;
2779 }
2780
2781 /* This function requires the caller holds hdev->lock */
2782 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2783                                                   bdaddr_t *addr, u8 addr_type)
2784 {
2785         struct hci_conn_params *param;
2786
2787         list_for_each_entry(param, list, action) {
2788                 if (bacmp(&param->addr, addr) == 0 &&
2789                     param->addr_type == addr_type)
2790                         return param;
2791         }
2792
2793         return NULL;
2794 }
2795
2796 /* This function requires the caller holds hdev->lock */
2797 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2798                                             bdaddr_t *addr, u8 addr_type)
2799 {
2800         struct hci_conn_params *params;
2801
2802         params = hci_conn_params_lookup(hdev, addr, addr_type);
2803         if (params)
2804                 return params;
2805
2806         params = kzalloc(sizeof(*params), GFP_KERNEL);
2807         if (!params) {
2808                 BT_ERR("Out of memory");
2809                 return NULL;
2810         }
2811
2812         bacpy(&params->addr, addr);
2813         params->addr_type = addr_type;
2814
2815         list_add(&params->list, &hdev->le_conn_params);
2816         INIT_LIST_HEAD(&params->action);
2817
2818         params->conn_min_interval = hdev->le_conn_min_interval;
2819         params->conn_max_interval = hdev->le_conn_max_interval;
2820         params->conn_latency = hdev->le_conn_latency;
2821         params->supervision_timeout = hdev->le_supv_timeout;
2822         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2823
2824         BT_DBG("addr %pMR (type %u)", addr, addr_type);
2825
2826         return params;
2827 }
2828
2829 static void hci_conn_params_free(struct hci_conn_params *params)
2830 {
2831         if (params->conn) {
2832                 hci_conn_drop(params->conn);
2833                 hci_conn_put(params->conn);
2834         }
2835
2836         list_del(&params->action);
2837         list_del(&params->list);
2838         kfree(params);
2839 }
2840
2841 /* This function requires the caller holds hdev->lock */
2842 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2843 {
2844         struct hci_conn_params *params;
2845
2846         params = hci_conn_params_lookup(hdev, addr, addr_type);
2847         if (!params)
2848                 return;
2849
2850         hci_conn_params_free(params);
2851
2852         hci_update_background_scan(hdev);
2853
2854         BT_DBG("addr %pMR (type %u)", addr, addr_type);
2855 }
2856
2857 /* This function requires the caller holds hdev->lock */
2858 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
2859 {
2860         struct hci_conn_params *params, *tmp;
2861
2862         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
2863                 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2864                         continue;
2865
2866                 /* If trying to estabilish one time connection to disabled
2867                  * device, leave the params, but mark them as just once.
2868                  */
2869                 if (params->explicit_connect) {
2870                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2871                         continue;
2872                 }
2873
2874                 list_del(&params->list);
2875                 kfree(params);
2876         }
2877
2878         BT_DBG("All LE disabled connection parameters were removed");
2879 }
2880
2881 /* This function requires the caller holds hdev->lock */
2882 static void hci_conn_params_clear_all(struct hci_dev *hdev)
2883 {
2884         struct hci_conn_params *params, *tmp;
2885
2886         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2887                 hci_conn_params_free(params);
2888
2889         BT_DBG("All LE connection parameters were removed");
2890 }
2891
2892 /* Copy the Identity Address of the controller.
2893  *
2894  * If the controller has a public BD_ADDR, then by default use that one.
2895  * If this is a LE only controller without a public address, default to
2896  * the static random address.
2897  *
2898  * For debugging purposes it is possible to force controllers with a
2899  * public address to use the static random address instead.
2900  *
2901  * In case BR/EDR has been disabled on a dual-mode controller and
2902  * userspace has configured a static address, then that address
2903  * becomes the identity address instead of the public BR/EDR address.
2904  */
2905 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2906                                u8 *bdaddr_type)
2907 {
2908         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
2909             !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
2910             (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
2911              bacmp(&hdev->static_addr, BDADDR_ANY))) {
2912                 bacpy(bdaddr, &hdev->static_addr);
2913                 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2914         } else {
2915                 bacpy(bdaddr, &hdev->bdaddr);
2916                 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
2917         }
2918 }
2919
2920 /* Alloc HCI device */
2921 struct hci_dev *hci_alloc_dev(void)
2922 {
2923         struct hci_dev *hdev;
2924
2925         hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
2926         if (!hdev)
2927                 return NULL;
2928
2929         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2930         hdev->esco_type = (ESCO_HV1);
2931         hdev->link_mode = (HCI_LM_ACCEPT);
2932         hdev->num_iac = 0x01;           /* One IAC support is mandatory */
2933         hdev->io_capability = 0x03;     /* No Input No Output */
2934         hdev->manufacturer = 0xffff;    /* Default to internal use */
2935         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2936         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
2937         hdev->adv_instance_cnt = 0;
2938         hdev->cur_adv_instance = 0x00;
2939         hdev->adv_instance_timeout = 0;
2940
2941         hdev->sniff_max_interval = 800;
2942         hdev->sniff_min_interval = 80;
2943
2944         hdev->le_adv_channel_map = 0x07;
2945         hdev->le_adv_min_interval = 0x0800;
2946         hdev->le_adv_max_interval = 0x0800;
2947         hdev->le_scan_interval = 0x0060;
2948         hdev->le_scan_window = 0x0030;
2949         hdev->le_conn_min_interval = 0x0028;
2950         hdev->le_conn_max_interval = 0x0038;
2951         hdev->le_conn_latency = 0x0000;
2952         hdev->le_supv_timeout = 0x002a;
2953         hdev->le_def_tx_len = 0x001b;
2954         hdev->le_def_tx_time = 0x0148;
2955         hdev->le_max_tx_len = 0x001b;
2956         hdev->le_max_tx_time = 0x0148;
2957         hdev->le_max_rx_len = 0x001b;
2958         hdev->le_max_rx_time = 0x0148;
2959
2960         hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
2961         hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
2962         hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
2963         hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
2964
2965         mutex_init(&hdev->lock);
2966         mutex_init(&hdev->req_lock);
2967
2968         INIT_LIST_HEAD(&hdev->mgmt_pending);
2969         INIT_LIST_HEAD(&hdev->blacklist);
2970         INIT_LIST_HEAD(&hdev->whitelist);
2971         INIT_LIST_HEAD(&hdev->uuids);
2972         INIT_LIST_HEAD(&hdev->link_keys);
2973         INIT_LIST_HEAD(&hdev->long_term_keys);
2974         INIT_LIST_HEAD(&hdev->identity_resolving_keys);
2975         INIT_LIST_HEAD(&hdev->remote_oob_data);
2976         INIT_LIST_HEAD(&hdev->le_white_list);
2977         INIT_LIST_HEAD(&hdev->le_conn_params);
2978         INIT_LIST_HEAD(&hdev->pend_le_conns);
2979         INIT_LIST_HEAD(&hdev->pend_le_reports);
2980         INIT_LIST_HEAD(&hdev->conn_hash.list);
2981         INIT_LIST_HEAD(&hdev->adv_instances);
2982
2983         INIT_WORK(&hdev->rx_work, hci_rx_work);
2984         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2985         INIT_WORK(&hdev->tx_work, hci_tx_work);
2986         INIT_WORK(&hdev->power_on, hci_power_on);
2987         INIT_WORK(&hdev->error_reset, hci_error_reset);
2988
2989         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
2990
2991         skb_queue_head_init(&hdev->rx_q);
2992         skb_queue_head_init(&hdev->cmd_q);
2993         skb_queue_head_init(&hdev->raw_q);
2994
2995         init_waitqueue_head(&hdev->req_wait_q);
2996
2997         INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
2998
2999         hci_request_setup(hdev);
3000
3001         hci_init_sysfs(hdev);
3002         discovery_init(hdev);
3003
3004         return hdev;
3005 }
3006 EXPORT_SYMBOL(hci_alloc_dev);
3007
3008 /* Free HCI device */
3009 void hci_free_dev(struct hci_dev *hdev)
3010 {
3011         /* will free via device release */
3012         put_device(&hdev->dev);
3013 }
3014 EXPORT_SYMBOL(hci_free_dev);
3015
3016 /* Register HCI device */
3017 int hci_register_dev(struct hci_dev *hdev)
3018 {
3019         int id, error;
3020
3021         if (!hdev->open || !hdev->close || !hdev->send)
3022                 return -EINVAL;
3023
3024         /* Do not allow HCI_AMP devices to register at index 0,
3025          * so the index can be used as the AMP controller ID.
3026          */
3027         switch (hdev->dev_type) {
3028         case HCI_BREDR:
3029                 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3030                 break;
3031         case HCI_AMP:
3032                 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3033                 break;
3034         default:
3035                 return -EINVAL;
3036         }
3037
3038         if (id < 0)
3039                 return id;
3040
3041         sprintf(hdev->name, "hci%d", id);
3042         hdev->id = id;
3043
3044         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3045
3046         hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3047                                           WQ_MEM_RECLAIM, 1, hdev->name);
3048         if (!hdev->workqueue) {
3049                 error = -ENOMEM;
3050                 goto err;
3051         }
3052
3053         hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3054                                               WQ_MEM_RECLAIM, 1, hdev->name);
3055         if (!hdev->req_workqueue) {
3056                 destroy_workqueue(hdev->workqueue);
3057                 error = -ENOMEM;
3058                 goto err;
3059         }
3060
3061         if (!IS_ERR_OR_NULL(bt_debugfs))
3062                 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3063
3064         dev_set_name(&hdev->dev, "%s", hdev->name);
3065
3066         error = device_add(&hdev->dev);
3067         if (error < 0)
3068                 goto err_wqueue;
3069
3070         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3071                                     RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3072                                     hdev);
3073         if (hdev->rfkill) {
3074                 if (rfkill_register(hdev->rfkill) < 0) {
3075                         rfkill_destroy(hdev->rfkill);
3076                         hdev->rfkill = NULL;
3077                 }
3078         }
3079
3080         if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3081                 hci_dev_set_flag(hdev, HCI_RFKILLED);
3082
3083         hci_dev_set_flag(hdev, HCI_SETUP);
3084         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3085
3086         if (hdev->dev_type == HCI_BREDR) {
3087                 /* Assume BR/EDR support until proven otherwise (such as
3088                  * through reading supported features during init.
3089                  */
3090                 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3091         }
3092
3093         write_lock(&hci_dev_list_lock);
3094         list_add(&hdev->list, &hci_dev_list);
3095         write_unlock(&hci_dev_list_lock);
3096
3097         /* Devices that are marked for raw-only usage are unconfigured
3098          * and should not be included in normal operation.
3099          */
3100         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3101                 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3102
3103         hci_sock_dev_event(hdev, HCI_DEV_REG);
3104         hci_dev_hold(hdev);
3105
3106         queue_work(hdev->req_workqueue, &hdev->power_on);
3107
3108         return id;
3109
3110 err_wqueue:
3111         destroy_workqueue(hdev->workqueue);
3112         destroy_workqueue(hdev->req_workqueue);
3113 err:
3114         ida_simple_remove(&hci_index_ida, hdev->id);
3115
3116         return error;
3117 }
3118 EXPORT_SYMBOL(hci_register_dev);
3119
3120 /* Unregister HCI device */
3121 void hci_unregister_dev(struct hci_dev *hdev)
3122 {
3123         int id;
3124
3125         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3126
3127         hci_dev_set_flag(hdev, HCI_UNREGISTER);
3128
3129         id = hdev->id;
3130
3131         write_lock(&hci_dev_list_lock);
3132         list_del(&hdev->list);
3133         write_unlock(&hci_dev_list_lock);
3134
3135         hci_dev_do_close(hdev);
3136
3137         cancel_work_sync(&hdev->power_on);
3138
3139         if (!test_bit(HCI_INIT, &hdev->flags) &&
3140             !hci_dev_test_flag(hdev, HCI_SETUP) &&
3141             !hci_dev_test_flag(hdev, HCI_CONFIG)) {
3142                 hci_dev_lock(hdev);
3143                 mgmt_index_removed(hdev);
3144                 hci_dev_unlock(hdev);
3145         }
3146
3147         /* mgmt_index_removed should take care of emptying the
3148          * pending list */
3149         BUG_ON(!list_empty(&hdev->mgmt_pending));
3150
3151         hci_sock_dev_event(hdev, HCI_DEV_UNREG);
3152
3153         if (hdev->rfkill) {
3154                 rfkill_unregister(hdev->rfkill);
3155                 rfkill_destroy(hdev->rfkill);
3156         }
3157
3158         device_del(&hdev->dev);
3159
3160         debugfs_remove_recursive(hdev->debugfs);
3161
3162         destroy_workqueue(hdev->workqueue);
3163         destroy_workqueue(hdev->req_workqueue);
3164
3165         hci_dev_lock(hdev);
3166         hci_bdaddr_list_clear(&hdev->blacklist);
3167         hci_bdaddr_list_clear(&hdev->whitelist);
3168         hci_uuids_clear(hdev);
3169         hci_link_keys_clear(hdev);
3170         hci_smp_ltks_clear(hdev);
3171         hci_smp_irks_clear(hdev);
3172         hci_remote_oob_data_clear(hdev);
3173         hci_adv_instances_clear(hdev);
3174         hci_bdaddr_list_clear(&hdev->le_white_list);
3175         hci_conn_params_clear_all(hdev);
3176         hci_discovery_filter_clear(hdev);
3177         hci_dev_unlock(hdev);
3178
3179         hci_dev_put(hdev);
3180
3181         ida_simple_remove(&hci_index_ida, id);
3182 }
3183 EXPORT_SYMBOL(hci_unregister_dev);
3184
3185 /* Suspend HCI device */
3186 int hci_suspend_dev(struct hci_dev *hdev)
3187 {
3188         hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
3189         return 0;
3190 }
3191 EXPORT_SYMBOL(hci_suspend_dev);
3192
3193 /* Resume HCI device */
3194 int hci_resume_dev(struct hci_dev *hdev)
3195 {
3196         hci_sock_dev_event(hdev, HCI_DEV_RESUME);
3197         return 0;
3198 }
3199 EXPORT_SYMBOL(hci_resume_dev);
3200
3201 /* Reset HCI device */
3202 int hci_reset_dev(struct hci_dev *hdev)
3203 {
3204         const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3205         struct sk_buff *skb;
3206
3207         skb = bt_skb_alloc(3, GFP_ATOMIC);
3208         if (!skb)
3209                 return -ENOMEM;
3210
3211         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
3212         memcpy(skb_put(skb, 3), hw_err, 3);
3213
3214         /* Send Hardware Error to upper stack */
3215         return hci_recv_frame(hdev, skb);
3216 }
3217 EXPORT_SYMBOL(hci_reset_dev);
3218
3219 /* Receive frame from HCI drivers */
3220 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
3221 {
3222         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
3223                       && !test_bit(HCI_INIT, &hdev->flags))) {
3224                 kfree_skb(skb);
3225                 return -ENXIO;
3226         }
3227
3228         if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
3229             hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
3230             hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
3231                 kfree_skb(skb);
3232                 return -EINVAL;
3233         }
3234
3235         /* Incoming skb */
3236         bt_cb(skb)->incoming = 1;
3237
3238         /* Time stamp */
3239         __net_timestamp(skb);
3240
3241         skb_queue_tail(&hdev->rx_q, skb);
3242         queue_work(hdev->workqueue, &hdev->rx_work);
3243
3244         return 0;
3245 }
3246 EXPORT_SYMBOL(hci_recv_frame);
3247
3248 /* Receive diagnostic message from HCI drivers */
3249 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
3250 {
3251         /* Mark as diagnostic packet */
3252         hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
3253
3254         /* Time stamp */
3255         __net_timestamp(skb);
3256
3257         skb_queue_tail(&hdev->rx_q, skb);
3258         queue_work(hdev->workqueue, &hdev->rx_work);
3259
3260         return 0;
3261 }
3262 EXPORT_SYMBOL(hci_recv_diag);
3263
3264 /* ---- Interface to upper protocols ---- */
3265
3266 int hci_register_cb(struct hci_cb *cb)
3267 {
3268         BT_DBG("%p name %s", cb, cb->name);
3269
3270         mutex_lock(&hci_cb_list_lock);
3271         list_add_tail(&cb->list, &hci_cb_list);
3272         mutex_unlock(&hci_cb_list_lock);
3273
3274         return 0;
3275 }
3276 EXPORT_SYMBOL(hci_register_cb);
3277
3278 int hci_unregister_cb(struct hci_cb *cb)
3279 {
3280         BT_DBG("%p name %s", cb, cb->name);
3281
3282         mutex_lock(&hci_cb_list_lock);
3283         list_del(&cb->list);
3284         mutex_unlock(&hci_cb_list_lock);
3285
3286         return 0;
3287 }
3288 EXPORT_SYMBOL(hci_unregister_cb);
3289
3290 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
3291 {
3292         int err;
3293
3294         BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3295                skb->len);
3296
3297         /* Time stamp */
3298         __net_timestamp(skb);
3299
3300         /* Send copy to monitor */
3301         hci_send_to_monitor(hdev, skb);
3302
3303         if (atomic_read(&hdev->promisc)) {
3304                 /* Send copy to the sockets */
3305                 hci_send_to_sock(hdev, skb);
3306         }
3307
3308         /* Get rid of skb owner, prior to sending to the driver. */
3309         skb_orphan(skb);
3310
3311         if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3312                 kfree_skb(skb);
3313                 return;
3314         }
3315
3316         err = hdev->send(hdev, skb);
3317         if (err < 0) {
3318                 BT_ERR("%s sending frame failed (%d)", hdev->name, err);
3319                 kfree_skb(skb);
3320         }
3321 }
3322
3323 /* Send HCI command */
3324 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3325                  const void *param)
3326 {
3327         struct sk_buff *skb;
3328
3329         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3330
3331         skb = hci_prepare_cmd(hdev, opcode, plen, param);
3332         if (!skb) {
3333                 BT_ERR("%s no memory for command", hdev->name);
3334                 return -ENOMEM;
3335         }
3336
3337         /* Stand-alone HCI commands must be flagged as
3338          * single-command requests.
3339          */
3340         bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
3341
3342         skb_queue_tail(&hdev->cmd_q, skb);
3343         queue_work(hdev->workqueue, &hdev->cmd_work);
3344
3345         return 0;
3346 }
3347
3348 /* Get data from the previously sent command */
3349 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
3350 {
3351         struct hci_command_hdr *hdr;
3352
3353         if (!hdev->sent_cmd)
3354                 return NULL;
3355
3356         hdr = (void *) hdev->sent_cmd->data;
3357
3358         if (hdr->opcode != cpu_to_le16(opcode))
3359                 return NULL;
3360
3361         BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3362
3363         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3364 }
3365
3366 /* Send HCI command and wait for command commplete event */
3367 struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
3368                              const void *param, u32 timeout)
3369 {
3370         struct sk_buff *skb;
3371
3372         if (!test_bit(HCI_UP, &hdev->flags))
3373                 return ERR_PTR(-ENETDOWN);
3374
3375         bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
3376
3377         hci_req_sync_lock(hdev);
3378         skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
3379         hci_req_sync_unlock(hdev);
3380
3381         return skb;
3382 }
3383 EXPORT_SYMBOL(hci_cmd_sync);
3384
3385 /* Send ACL data */
3386 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3387 {
3388         struct hci_acl_hdr *hdr;
3389         int len = skb->len;
3390
3391         skb_push(skb, HCI_ACL_HDR_SIZE);
3392         skb_reset_transport_header(skb);
3393         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3394         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3395         hdr->dlen   = cpu_to_le16(len);
3396 }
3397
3398 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
3399                           struct sk_buff *skb, __u16 flags)
3400 {
3401         struct hci_conn *conn = chan->conn;
3402         struct hci_dev *hdev = conn->hdev;
3403         struct sk_buff *list;
3404
3405         skb->len = skb_headlen(skb);
3406         skb->data_len = 0;
3407
3408         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3409
3410         switch (hdev->dev_type) {
3411         case HCI_BREDR:
3412                 hci_add_acl_hdr(skb, conn->handle, flags);
3413                 break;
3414         case HCI_AMP:
3415                 hci_add_acl_hdr(skb, chan->handle, flags);
3416                 break;
3417         default:
3418                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3419                 return;
3420         }
3421
3422         list = skb_shinfo(skb)->frag_list;
3423         if (!list) {
3424                 /* Non fragmented */
3425                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3426
3427                 skb_queue_tail(queue, skb);
3428         } else {
3429                 /* Fragmented */
3430                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3431
3432                 skb_shinfo(skb)->frag_list = NULL;
3433
3434                 /* Queue all fragments atomically. We need to use spin_lock_bh
3435                  * here because of 6LoWPAN links, as there this function is
3436                  * called from softirq and using normal spin lock could cause
3437                  * deadlocks.
3438                  */
3439                 spin_lock_bh(&queue->lock);
3440
3441                 __skb_queue_tail(queue, skb);
3442
3443                 flags &= ~ACL_START;
3444                 flags |= ACL_CONT;
3445                 do {
3446                         skb = list; list = list->next;
3447
3448                         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3449                         hci_add_acl_hdr(skb, conn->handle, flags);
3450
3451                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3452
3453                         __skb_queue_tail(queue, skb);
3454                 } while (list);
3455
3456                 spin_unlock_bh(&queue->lock);
3457         }
3458 }
3459
3460 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3461 {
3462         struct hci_dev *hdev = chan->conn->hdev;
3463
3464         BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
3465
3466         hci_queue_acl(chan, &chan->data_q, skb, flags);
3467
3468         queue_work(hdev->workqueue, &hdev->tx_work);
3469 }
3470
3471 /* Send SCO data */
3472 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
3473 {
3474         struct hci_dev *hdev = conn->hdev;
3475         struct hci_sco_hdr hdr;
3476
3477         BT_DBG("%s len %d", hdev->name, skb->len);
3478
3479         hdr.handle = cpu_to_le16(conn->handle);
3480         hdr.dlen   = skb->len;
3481
3482         skb_push(skb, HCI_SCO_HDR_SIZE);
3483         skb_reset_transport_header(skb);
3484         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
3485
3486         hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
3487
3488         skb_queue_tail(&conn->data_q, skb);
3489         queue_work(hdev->workqueue, &hdev->tx_work);
3490 }
3491
3492 /* ---- HCI TX task (outgoing data) ---- */
3493
3494 /* HCI Connection scheduler */
3495 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3496                                      int *quote)
3497 {
3498         struct hci_conn_hash *h = &hdev->conn_hash;
3499         struct hci_conn *conn = NULL, *c;
3500         unsigned int num = 0, min = ~0;
3501
3502         /* We don't have to lock device here. Connections are always
3503          * added and removed with TX task disabled. */
3504
3505         rcu_read_lock();
3506
3507         list_for_each_entry_rcu(c, &h->list, list) {
3508                 if (c->type != type || skb_queue_empty(&c->data_q))
3509                         continue;
3510
3511                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3512                         continue;
3513
3514                 num++;
3515
3516                 if (c->sent < min) {
3517                         min  = c->sent;
3518                         conn = c;
3519                 }
3520
3521                 if (hci_conn_num(hdev, type) == num)
3522                         break;
3523         }
3524
3525         rcu_read_unlock();
3526
3527         if (conn) {
3528                 int cnt, q;
3529
3530                 switch (conn->type) {
3531                 case ACL_LINK:
3532                         cnt = hdev->acl_cnt;
3533                         break;
3534                 case SCO_LINK:
3535                 case ESCO_LINK:
3536                         cnt = hdev->sco_cnt;
3537                         break;
3538                 case LE_LINK:
3539                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3540                         break;
3541                 default:
3542                         cnt = 0;
3543                         BT_ERR("Unknown link type");
3544                 }
3545
3546                 q = cnt / num;
3547                 *quote = q ? q : 1;
3548         } else
3549                 *quote = 0;
3550
3551         BT_DBG("conn %p quote %d", conn, *quote);
3552         return conn;
3553 }
3554
3555 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
3556 {
3557         struct hci_conn_hash *h = &hdev->conn_hash;
3558         struct hci_conn *c;
3559
3560         BT_ERR("%s link tx timeout", hdev->name);
3561
3562         rcu_read_lock();
3563
3564         /* Kill stalled connections */
3565         list_for_each_entry_rcu(c, &h->list, list) {
3566                 if (c->type == type && c->sent) {
3567                         BT_ERR("%s killing stalled connection %pMR",
3568                                hdev->name, &c->dst);
3569                         hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3570                 }
3571         }
3572
3573         rcu_read_unlock();
3574 }
3575
3576 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3577                                       int *quote)
3578 {
3579         struct hci_conn_hash *h = &hdev->conn_hash;
3580         struct hci_chan *chan = NULL;
3581         unsigned int num = 0, min = ~0, cur_prio = 0;
3582         struct hci_conn *conn;
3583         int cnt, q, conn_num = 0;
3584
3585         BT_DBG("%s", hdev->name);
3586
3587         rcu_read_lock();
3588
3589         list_for_each_entry_rcu(conn, &h->list, list) {
3590                 struct hci_chan *tmp;
3591
3592                 if (conn->type != type)
3593                         continue;
3594
3595                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3596                         continue;
3597
3598                 conn_num++;
3599
3600                 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
3601                         struct sk_buff *skb;
3602
3603                         if (skb_queue_empty(&tmp->data_q))
3604                                 continue;
3605
3606                         skb = skb_peek(&tmp->data_q);
3607                         if (skb->priority < cur_prio)
3608                                 continue;
3609
3610                         if (skb->priority > cur_prio) {
3611                                 num = 0;
3612                                 min = ~0;
3613                                 cur_prio = skb->priority;
3614                         }
3615
3616                         num++;
3617
3618                         if (conn->sent < min) {
3619                                 min  = conn->sent;
3620                                 chan = tmp;
3621                         }
3622                 }
3623
3624                 if (hci_conn_num(hdev, type) == conn_num)
3625                         break;
3626         }
3627
3628         rcu_read_unlock();
3629
3630         if (!chan)
3631                 return NULL;
3632
3633         switch (chan->conn->type) {
3634         case ACL_LINK:
3635                 cnt = hdev->acl_cnt;
3636                 break;
3637         case AMP_LINK:
3638                 cnt = hdev->block_cnt;
3639                 break;
3640         case SCO_LINK:
3641         case ESCO_LINK:
3642                 cnt = hdev->sco_cnt;
3643                 break;
3644         case LE_LINK:
3645                 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3646                 break;
3647         default:
3648                 cnt = 0;
3649                 BT_ERR("Unknown link type");
3650         }
3651
3652         q = cnt / num;
3653         *quote = q ? q : 1;
3654         BT_DBG("chan %p quote %d", chan, *quote);
3655         return chan;
3656 }
3657
3658 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3659 {
3660         struct hci_conn_hash *h = &hdev->conn_hash;
3661         struct hci_conn *conn;
3662         int num = 0;
3663
3664         BT_DBG("%s", hdev->name);
3665
3666         rcu_read_lock();
3667
3668         list_for_each_entry_rcu(conn, &h->list, list) {
3669                 struct hci_chan *chan;
3670
3671                 if (conn->type != type)
3672                         continue;
3673
3674                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3675                         continue;
3676
3677                 num++;
3678
3679                 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
3680                         struct sk_buff *skb;
3681
3682                         if (chan->sent) {
3683                                 chan->sent = 0;
3684                                 continue;
3685                         }
3686
3687                         if (skb_queue_empty(&chan->data_q))
3688                                 continue;
3689
3690                         skb = skb_peek(&chan->data_q);
3691                         if (skb->priority >= HCI_PRIO_MAX - 1)
3692                                 continue;
3693
3694                         skb->priority = HCI_PRIO_MAX - 1;
3695
3696                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
3697                                skb->priority);
3698                 }
3699
3700                 if (hci_conn_num(hdev, type) == num)
3701                         break;
3702         }
3703
3704         rcu_read_unlock();
3705
3706 }
3707
3708 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3709 {
3710         /* Calculate count of blocks used by this packet */
3711         return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3712 }
3713
3714 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
3715 {
3716         if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
3717                 /* ACL tx timeout must be longer than maximum
3718                  * link supervision timeout (40.9 seconds) */
3719                 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
3720                                        HCI_ACL_TX_TIMEOUT))
3721                         hci_link_tx_to(hdev, ACL_LINK);
3722         }
3723 }
3724
3725 static void hci_sched_acl_pkt(struct hci_dev *hdev)
3726 {
3727         unsigned int cnt = hdev->acl_cnt;
3728         struct hci_chan *chan;
3729         struct sk_buff *skb;
3730         int quote;
3731
3732         __check_timeout(hdev, cnt);
3733
3734         while (hdev->acl_cnt &&
3735                (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3736                 u32 priority = (skb_peek(&chan->data_q))->priority;
3737                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3738                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3739                                skb->len, skb->priority);
3740
3741                         /* Stop if priority has changed */
3742                         if (skb->priority < priority)
3743                                 break;
3744
3745                         skb = skb_dequeue(&chan->data_q);
3746
3747                         hci_conn_enter_active_mode(chan->conn,
3748                                                    bt_cb(skb)->force_active);
3749
3750                         hci_send_frame(hdev, skb);
3751                         hdev->acl_last_tx = jiffies;
3752
3753                         hdev->acl_cnt--;
3754                         chan->sent++;
3755                         chan->conn->sent++;
3756                 }
3757         }
3758
3759         if (cnt != hdev->acl_cnt)
3760                 hci_prio_recalculate(hdev, ACL_LINK);
3761 }
3762
3763 static void hci_sched_acl_blk(struct hci_dev *hdev)
3764 {
3765         unsigned int cnt = hdev->block_cnt;
3766         struct hci_chan *chan;
3767         struct sk_buff *skb;
3768         int quote;
3769         u8 type;
3770
3771         __check_timeout(hdev, cnt);
3772
3773         BT_DBG("%s", hdev->name);
3774
3775         if (hdev->dev_type == HCI_AMP)
3776                 type = AMP_LINK;
3777         else
3778                 type = ACL_LINK;
3779
3780         while (hdev->block_cnt > 0 &&
3781                (chan = hci_chan_sent(hdev, type, &quote))) {
3782                 u32 priority = (skb_peek(&chan->data_q))->priority;
3783                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3784                         int blocks;
3785
3786                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3787                                skb->len, skb->priority);
3788
3789                         /* Stop if priority has changed */
3790                         if (skb->priority < priority)
3791                                 break;
3792
3793                         skb = skb_dequeue(&chan->data_q);
3794
3795                         blocks = __get_blocks(hdev, skb);
3796                         if (blocks > hdev->block_cnt)
3797                                 return;
3798
3799                         hci_conn_enter_active_mode(chan->conn,
3800                                                    bt_cb(skb)->force_active);
3801
3802                         hci_send_frame(hdev, skb);
3803                         hdev->acl_last_tx = jiffies;
3804
3805                         hdev->block_cnt -= blocks;
3806                         quote -= blocks;
3807
3808                         chan->sent += blocks;
3809                         chan->conn->sent += blocks;
3810                 }
3811         }
3812
3813         if (cnt != hdev->block_cnt)
3814                 hci_prio_recalculate(hdev, type);
3815 }
3816
3817 static void hci_sched_acl(struct hci_dev *hdev)
3818 {
3819         BT_DBG("%s", hdev->name);
3820
3821         /* No ACL link over BR/EDR controller */
3822         if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3823                 return;
3824
3825         /* No AMP link over AMP controller */
3826         if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
3827                 return;
3828
3829         switch (hdev->flow_ctl_mode) {
3830         case HCI_FLOW_CTL_MODE_PACKET_BASED:
3831                 hci_sched_acl_pkt(hdev);
3832                 break;
3833
3834         case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3835                 hci_sched_acl_blk(hdev);
3836                 break;
3837         }
3838 }
3839
3840 /* Schedule SCO */
3841 static void hci_sched_sco(struct hci_dev *hdev)
3842 {
3843         struct hci_conn *conn;
3844         struct sk_buff *skb;
3845         int quote;
3846
3847         BT_DBG("%s", hdev->name);
3848
3849         if (!hci_conn_num(hdev, SCO_LINK))
3850                 return;
3851
3852         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3853                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3854                         BT_DBG("skb %p len %d", skb, skb->len);
3855                         hci_send_frame(hdev, skb);
3856
3857                         conn->sent++;
3858                         if (conn->sent == ~0)
3859                                 conn->sent = 0;
3860                 }
3861         }
3862 }
3863
3864 static void hci_sched_esco(struct hci_dev *hdev)
3865 {
3866         struct hci_conn *conn;
3867         struct sk_buff *skb;
3868         int quote;
3869
3870         BT_DBG("%s", hdev->name);
3871
3872         if (!hci_conn_num(hdev, ESCO_LINK))
3873                 return;
3874
3875         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3876                                                      &quote))) {
3877                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3878                         BT_DBG("skb %p len %d", skb, skb->len);
3879                         hci_send_frame(hdev, skb);
3880
3881                         conn->sent++;
3882                         if (conn->sent == ~0)
3883                                 conn->sent = 0;
3884                 }
3885         }
3886 }
3887
3888 static void hci_sched_le(struct hci_dev *hdev)
3889 {
3890         struct hci_chan *chan;
3891         struct sk_buff *skb;
3892         int quote, cnt, tmp;
3893
3894         BT_DBG("%s", hdev->name);
3895
3896         if (!hci_conn_num(hdev, LE_LINK))
3897                 return;
3898
3899         if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
3900                 /* LE tx timeout must be longer than maximum
3901                  * link supervision timeout (40.9 seconds) */
3902                 if (!hdev->le_cnt && hdev->le_pkts &&
3903                     time_after(jiffies, hdev->le_last_tx + HZ * 45))
3904                         hci_link_tx_to(hdev, LE_LINK);
3905         }
3906
3907         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
3908         tmp = cnt;
3909         while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
3910                 u32 priority = (skb_peek(&chan->data_q))->priority;
3911                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3912                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3913                                skb->len, skb->priority);
3914
3915                         /* Stop if priority has changed */
3916                         if (skb->priority < priority)
3917                                 break;
3918
3919                         skb = skb_dequeue(&chan->data_q);
3920
3921                         hci_send_frame(hdev, skb);
3922                         hdev->le_last_tx = jiffies;
3923
3924                         cnt--;
3925                         chan->sent++;
3926                         chan->conn->sent++;
3927                 }
3928         }
3929
3930         if (hdev->le_pkts)
3931                 hdev->le_cnt = cnt;
3932         else
3933                 hdev->acl_cnt = cnt;
3934
3935         if (cnt != tmp)
3936                 hci_prio_recalculate(hdev, LE_LINK);
3937 }
3938
3939 static void hci_tx_work(struct work_struct *work)
3940 {
3941         struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
3942         struct sk_buff *skb;
3943
3944         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
3945                hdev->sco_cnt, hdev->le_cnt);
3946
3947         if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
3948                 /* Schedule queues and send stuff to HCI driver */
3949                 hci_sched_acl(hdev);
3950                 hci_sched_sco(hdev);
3951                 hci_sched_esco(hdev);
3952                 hci_sched_le(hdev);
3953         }
3954
3955         /* Send next queued raw (unknown type) packet */
3956         while ((skb = skb_dequeue(&hdev->raw_q)))
3957                 hci_send_frame(hdev, skb);
3958 }
3959
3960 /* ----- HCI RX task (incoming data processing) ----- */
3961
3962 /* ACL data packet */
3963 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3964 {
3965         struct hci_acl_hdr *hdr = (void *) skb->data;
3966         struct hci_conn *conn;
3967         __u16 handle, flags;
3968
3969         skb_pull(skb, HCI_ACL_HDR_SIZE);
3970
3971         handle = __le16_to_cpu(hdr->handle);
3972         flags  = hci_flags(handle);
3973         handle = hci_handle(handle);
3974
3975         BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
3976                handle, flags);
3977
3978         hdev->stat.acl_rx++;
3979
3980         hci_dev_lock(hdev);
3981         conn = hci_conn_hash_lookup_handle(hdev, handle);
3982         hci_dev_unlock(hdev);
3983
3984         if (conn) {
3985                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
3986
3987                 /* Send to upper protocol */
3988                 l2cap_recv_acldata(conn, skb, flags);
3989                 return;
3990         } else {
3991                 BT_ERR("%s ACL packet for unknown connection handle %d",
3992                        hdev->name, handle);
3993         }
3994
3995         kfree_skb(skb);
3996 }
3997
3998 /* SCO data packet */
3999 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4000 {
4001         struct hci_sco_hdr *hdr = (void *) skb->data;
4002         struct hci_conn *conn;
4003         __u16 handle;
4004
4005         skb_pull(skb, HCI_SCO_HDR_SIZE);
4006
4007         handle = __le16_to_cpu(hdr->handle);
4008
4009         BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
4010
4011         hdev->stat.sco_rx++;
4012
4013         hci_dev_lock(hdev);
4014         conn = hci_conn_hash_lookup_handle(hdev, handle);
4015         hci_dev_unlock(hdev);
4016
4017         if (conn) {
4018                 /* Send to upper protocol */
4019                 sco_recv_scodata(conn, skb);
4020                 return;
4021         } else {
4022                 BT_ERR("%s SCO packet for unknown connection handle %d",
4023                        hdev->name, handle);
4024         }
4025
4026         kfree_skb(skb);
4027 }
4028
4029 static bool hci_req_is_complete(struct hci_dev *hdev)
4030 {
4031         struct sk_buff *skb;
4032
4033         skb = skb_peek(&hdev->cmd_q);
4034         if (!skb)
4035                 return true;
4036
4037         return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
4038 }
4039
4040 static void hci_resend_last(struct hci_dev *hdev)
4041 {
4042         struct hci_command_hdr *sent;
4043         struct sk_buff *skb;
4044         u16 opcode;
4045
4046         if (!hdev->sent_cmd)
4047                 return;
4048
4049         sent = (void *) hdev->sent_cmd->data;
4050         opcode = __le16_to_cpu(sent->opcode);
4051         if (opcode == HCI_OP_RESET)
4052                 return;
4053
4054         skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4055         if (!skb)
4056                 return;
4057
4058         skb_queue_head(&hdev->cmd_q, skb);
4059         queue_work(hdev->workqueue, &hdev->cmd_work);
4060 }
4061
4062 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4063                           hci_req_complete_t *req_complete,
4064                           hci_req_complete_skb_t *req_complete_skb)
4065 {
4066         struct sk_buff *skb;
4067         unsigned long flags;
4068
4069         BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4070
4071         /* If the completed command doesn't match the last one that was
4072          * sent we need to do special handling of it.
4073          */
4074         if (!hci_sent_cmd_data(hdev, opcode)) {
4075                 /* Some CSR based controllers generate a spontaneous
4076                  * reset complete event during init and any pending
4077                  * command will never be completed. In such a case we
4078                  * need to resend whatever was the last sent
4079                  * command.
4080                  */
4081                 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4082                         hci_resend_last(hdev);
4083
4084                 return;
4085         }
4086
4087         /* If the command succeeded and there's still more commands in
4088          * this request the request is not yet complete.
4089          */
4090         if (!status && !hci_req_is_complete(hdev))
4091                 return;
4092
4093         /* If this was the last command in a request the complete
4094          * callback would be found in hdev->sent_cmd instead of the
4095          * command queue (hdev->cmd_q).
4096          */
4097         if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4098                 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
4099                 return;
4100         }
4101
4102         if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4103                 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
4104                 return;
4105         }
4106
4107         /* Remove all pending commands belonging to this request */
4108         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4109         while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4110                 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
4111                         __skb_queue_head(&hdev->cmd_q, skb);
4112                         break;
4113                 }
4114
4115                 *req_complete = bt_cb(skb)->hci.req_complete;
4116                 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4117                 kfree_skb(skb);
4118         }
4119         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4120 }
4121
4122 static void hci_rx_work(struct work_struct *work)
4123 {
4124         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
4125         struct sk_buff *skb;
4126
4127         BT_DBG("%s", hdev->name);
4128
4129         while ((skb = skb_dequeue(&hdev->rx_q))) {
4130                 /* Send copy to monitor */
4131                 hci_send_to_monitor(hdev, skb);
4132
4133                 if (atomic_read(&hdev->promisc)) {
4134                         /* Send copy to the sockets */
4135                         hci_send_to_sock(hdev, skb);
4136                 }
4137
4138                 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4139                         kfree_skb(skb);
4140                         continue;
4141                 }
4142
4143                 if (test_bit(HCI_INIT, &hdev->flags)) {
4144                         /* Don't process data packets in this states. */
4145                         switch (hci_skb_pkt_type(skb)) {
4146                         case HCI_ACLDATA_PKT:
4147                         case HCI_SCODATA_PKT:
4148                                 kfree_skb(skb);
4149                                 continue;
4150                         }
4151                 }
4152
4153                 /* Process frame */
4154                 switch (hci_skb_pkt_type(skb)) {
4155                 case HCI_EVENT_PKT:
4156                         BT_DBG("%s Event packet", hdev->name);
4157                         hci_event_packet(hdev, skb);
4158                         break;
4159
4160                 case HCI_ACLDATA_PKT:
4161                         BT_DBG("%s ACL data packet", hdev->name);
4162                         hci_acldata_packet(hdev, skb);
4163                         break;
4164
4165                 case HCI_SCODATA_PKT:
4166                         BT_DBG("%s SCO data packet", hdev->name);
4167                         hci_scodata_packet(hdev, skb);
4168                         break;
4169
4170                 default:
4171                         kfree_skb(skb);
4172                         break;
4173                 }
4174         }
4175 }
4176
4177 static void hci_cmd_work(struct work_struct *work)
4178 {
4179         struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4180         struct sk_buff *skb;
4181
4182         BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4183                atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4184
4185         /* Send queued commands */
4186         if (atomic_read(&hdev->cmd_cnt)) {
4187                 skb = skb_dequeue(&hdev->cmd_q);
4188                 if (!skb)
4189                         return;
4190
4191                 kfree_skb(hdev->sent_cmd);
4192
4193                 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4194                 if (hdev->sent_cmd) {
4195                         atomic_dec(&hdev->cmd_cnt);
4196                         hci_send_frame(hdev, skb);
4197                         if (test_bit(HCI_RESET, &hdev->flags))
4198                                 cancel_delayed_work(&hdev->cmd_timer);
4199                         else
4200                                 schedule_delayed_work(&hdev->cmd_timer,
4201                                                       HCI_CMD_TIMEOUT);
4202                 } else {
4203                         skb_queue_head(&hdev->cmd_q, skb);
4204                         queue_work(hdev->workqueue, &hdev->cmd_work);
4205                 }
4206         }
4207 }