net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2011 ProFUSION Embedded Systems
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI core. */
  27
  28 #include <linux/export.h>
  29 #include <linux/idr.h>
  30 #include <linux/rfkill.h>
  31 #include <linux/debugfs.h>
  32 #include <linux/crypto.h>
  33 #include <asm/unaligned.h>
  34
  35 #include <net/bluetooth/bluetooth.h>
  36 #include <net/bluetooth/hci_core.h>
  37 #include <net/bluetooth/l2cap.h>
  38 #include <net/bluetooth/mgmt.h>
  39
  40 #include "hci_request.h"
  41 #include "hci_debugfs.h"
  42 #include "smp.h"
  43
  44 static void hci_rx_work(struct work_struct *work);
  45 static void hci_cmd_work(struct work_struct *work);
  46 static void hci_tx_work(struct work_struct *work);
  47
  48 /* HCI device list */
  49 LIST_HEAD(hci_dev_list);
  50 DEFINE_RWLOCK(hci_dev_list_lock);
  51
  52 /* HCI callback list */
  53 LIST_HEAD(hci_cb_list);
  54 DEFINE_MUTEX(hci_cb_list_lock);
  55
  56 /* HCI ID Numbering */
  57 static DEFINE_IDA(hci_index_ida);
  58
  59 /* ----- HCI requests ----- */
  60
  61 #define HCI_REQ_DONE      0
  62 #define HCI_REQ_PEND      1
  63 #define HCI_REQ_CANCELED  2
  64
  65 #define hci_req_lock(d)         mutex_lock(&d->req_lock)
  66 #define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
  67
  68 /* ---- HCI notifications ---- */
  69
  70 static void hci_notify(struct hci_dev *hdev, int event)
  71 {
  72         hci_sock_dev_event(hdev, event);
  73 }
  74
  75 /* ---- HCI debugfs entries ---- */
  76
  77 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
  78                              size_t count, loff_t *ppos)
  79 {
  80         struct hci_dev *hdev = file->private_data;
  81         char buf[3];
  82
  83         buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y': 'N';
  84         buf[1] = '\n';
  85         buf[2] = '\0';
  86         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
  87 }
  88
  89 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
  90                               size_t count, loff_t *ppos)
  91 {
  92         struct hci_dev *hdev = file->private_data;
  93         struct sk_buff *skb;
  94         char buf[32];
  95         size_t buf_size = min(count, (sizeof(buf)-1));
  96         bool enable;
  97         int err;
  98
  99         if (!test_bit(HCI_UP, &hdev->flags))
 100                 return -ENETDOWN;
 101
 102         if (copy_from_user(buf, user_buf, buf_size))
 103                 return -EFAULT;
 104
 105         buf[buf_size] = '\0';
 106         if (strtobool(buf, &enable))
 107                 return -EINVAL;
 108
 109         if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
 110                 return -EALREADY;
 111
 112         hci_req_lock(hdev);
 113         if (enable)
 114                 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
 115                                      HCI_CMD_TIMEOUT);
 116         else
 117                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
 118                                      HCI_CMD_TIMEOUT);
 119         hci_req_unlock(hdev);
 120
 121         if (IS_ERR(skb))
 122                 return PTR_ERR(skb);
 123
 124         err = -bt_to_errno(skb->data[0]);
 125         kfree_skb(skb);
 126
 127         if (err < 0)
 128                 return err;
 129
 130         hci_dev_change_flag(hdev, HCI_DUT_MODE);
 131
 132         return count;
 133 }
 134
 135 static const struct file_operations dut_mode_fops = {
 136         .open           = simple_open,
 137         .read           = dut_mode_read,
 138         .write          = dut_mode_write,
 139         .llseek         = default_llseek,
 140 };
 141
 142 /* ---- HCI requests ---- */
 143
 144 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
 145                                   struct sk_buff *skb)
 146 {
 147         BT_DBG("%s result 0x%2.2x", hdev->name, result);
 148
 149         if (hdev->req_status == HCI_REQ_PEND) {
 150                 hdev->req_result = result;
 151                 hdev->req_status = HCI_REQ_DONE;
 152                 if (skb)
 153                         hdev->req_skb = skb_get(skb);
 154                 wake_up_interruptible(&hdev->req_wait_q);
 155         }
 156 }
 157
 158 static void hci_req_cancel(struct hci_dev *hdev, int err)
 159 {
 160         BT_DBG("%s err 0x%2.2x", hdev->name, err);
 161
 162         if (hdev->req_status == HCI_REQ_PEND) {
 163                 hdev->req_result = err;
 164                 hdev->req_status = HCI_REQ_CANCELED;
 165                 wake_up_interruptible(&hdev->req_wait_q);
 166         }
 167 }
 168
 169 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
 170                                   const void *param, u8 event, u32 timeout)
 171 {
 172         DECLARE_WAITQUEUE(wait, current);
 173         struct hci_request req;
 174         struct sk_buff *skb;
 175         int err = 0;
 176
 177         BT_DBG("%s", hdev->name);
 178
 179         hci_req_init(&req, hdev);
 180
 181         hci_req_add_ev(&req, opcode, plen, param, event);
 182
 183         hdev->req_status = HCI_REQ_PEND;
 184
 185         add_wait_queue(&hdev->req_wait_q, &wait);
 186         set_current_state(TASK_INTERRUPTIBLE);
 187
 188         err = hci_req_run_skb(&req, hci_req_sync_complete);
 189         if (err < 0) {
 190                 remove_wait_queue(&hdev->req_wait_q, &wait);
 191                 set_current_state(TASK_RUNNING);
 192                 return ERR_PTR(err);
 193         }
 194
 195         schedule_timeout(timeout);
 196
 197         remove_wait_queue(&hdev->req_wait_q, &wait);
 198
 199         if (signal_pending(current))
 200                 return ERR_PTR(-EINTR);
 201
 202         switch (hdev->req_status) {
 203         case HCI_REQ_DONE:
 204                 err = -bt_to_errno(hdev->req_result);
 205                 break;
 206
 207         case HCI_REQ_CANCELED:
 208                 err = -hdev->req_result;
 209                 break;
 210
 211         default:
 212                 err = -ETIMEDOUT;
 213                 break;
 214         }
 215
 216         hdev->req_status = hdev->req_result = 0;
 217         skb = hdev->req_skb;
 218         hdev->req_skb = NULL;
 219
 220         BT_DBG("%s end: err %d", hdev->name, err);
 221
 222         if (err < 0) {
 223                 kfree_skb(skb);
 224                 return ERR_PTR(err);
 225         }
 226
 227         if (!skb)
 228                 return ERR_PTR(-ENODATA);
 229
 230         return skb;
 231 }
 232 EXPORT_SYMBOL(__hci_cmd_sync_ev);
 233
 234 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
 235                                const void *param, u32 timeout)
 236 {
 237         return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
 238 }
 239 EXPORT_SYMBOL(__hci_cmd_sync);
 240
 241 /* Execute request and wait for completion. */
 242 static int __hci_req_sync(struct hci_dev *hdev,
 243                           void (*func)(struct hci_request *req,
 244                                       unsigned long opt),
 245                           unsigned long opt, __u32 timeout)
 246 {
 247         struct hci_request req;
 248         DECLARE_WAITQUEUE(wait, current);
 249         int err = 0;
 250
 251         BT_DBG("%s start", hdev->name);
 252
 253         hci_req_init(&req, hdev);
 254
 255         hdev->req_status = HCI_REQ_PEND;
 256
 257         func(&req, opt);
 258
 259         add_wait_queue(&hdev->req_wait_q, &wait);
 260         set_current_state(TASK_INTERRUPTIBLE);
 261
 262         err = hci_req_run_skb(&req, hci_req_sync_complete);
 263         if (err < 0) {
 264                 hdev->req_status = 0;
 265
 266                 remove_wait_queue(&hdev->req_wait_q, &wait);
 267                 set_current_state(TASK_RUNNING);
 268
 269                 /* ENODATA means the HCI request command queue is empty.
 270                  * This can happen when a request with conditionals doesn't
 271                  * trigger any commands to be sent. This is normal behavior
 272                  * and should not trigger an error return.
 273                  */
 274                 if (err == -ENODATA)
 275                         return 0;
 276
 277                 return err;
 278         }
 279
 280         schedule_timeout(timeout);
 281
 282         remove_wait_queue(&hdev->req_wait_q, &wait);
 283
 284         if (signal_pending(current))
 285                 return -EINTR;
 286
 287         switch (hdev->req_status) {
 288         case HCI_REQ_DONE:
 289                 err = -bt_to_errno(hdev->req_result);
 290                 break;
 291
 292         case HCI_REQ_CANCELED:
 293                 err = -hdev->req_result;
 294                 break;
 295
 296         default:
 297                 err = -ETIMEDOUT;
 298                 break;
 299         }
 300
 301         hdev->req_status = hdev->req_result = 0;
 302
 303         BT_DBG("%s end: err %d", hdev->name, err);
 304
 305         return err;
 306 }
 307
 308 static int hci_req_sync(struct hci_dev *hdev,
 309                         void (*req)(struct hci_request *req,
 310                                     unsigned long opt),
 311                         unsigned long opt, __u32 timeout)
 312 {
 313         int ret;
 314
 315         if (!test_bit(HCI_UP, &hdev->flags))
 316                 return -ENETDOWN;
 317
 318         /* Serialize all requests */
 319         hci_req_lock(hdev);
 320         ret = __hci_req_sync(hdev, req, opt, timeout);
 321         hci_req_unlock(hdev);
 322
 323         return ret;
 324 }
 325
 326 static void hci_reset_req(struct hci_request *req, unsigned long opt)
 327 {
 328         BT_DBG("%s %ld", req->hdev->name, opt);
 329
 330         /* Reset device */
 331         set_bit(HCI_RESET, &req->hdev->flags);
 332         hci_req_add(req, HCI_OP_RESET, 0, NULL);
 333 }
 334
 335 static void bredr_init(struct hci_request *req)
 336 {
 337         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
 338
 339         /* Read Local Supported Features */
 340         hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 341
 342         /* Read Local Version */
 343         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 344
 345         /* Read BD Address */
 346         hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
 347 }
 348
 349 static void amp_init1(struct hci_request *req)
 350 {
 351         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
 352
 353         /* Read Local Version */
 354         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 355
 356         /* Read Local Supported Commands */
 357         hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 358
 359         /* Read Local AMP Info */
 360         hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 361
 362         /* Read Data Blk size */
 363         hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
 364
 365         /* Read Flow Control Mode */
 366         hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
 367
 368         /* Read Location Data */
 369         hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
 370 }
 371
 372 static void amp_init2(struct hci_request *req)
 373 {
 374         /* Read Local Supported Features. Not all AMP controllers
 375          * support this so it's placed conditionally in the second
 376          * stage init.
 377          */
 378         if (req->hdev->commands[14] & 0x20)
 379                 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 380 }
 381
 382 static void hci_init1_req(struct hci_request *req, unsigned long opt)
 383 {
 384         struct hci_dev *hdev = req->hdev;
 385
 386         BT_DBG("%s %ld", hdev->name, opt);
 387
 388         /* Reset */
 389         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
 390                 hci_reset_req(req, 0);
 391
 392         switch (hdev->dev_type) {
 393         case HCI_BREDR:
 394                 bredr_init(req);
 395                 break;
 396
 397         case HCI_AMP:
 398                 amp_init1(req);
 399                 break;
 400
 401         default:
 402                 BT_ERR("Unknown device type %d", hdev->dev_type);
 403                 break;
 404         }
 405 }
 406
 407 static void bredr_setup(struct hci_request *req)
 408 {
 409         __le16 param;
 410         __u8 flt_type;
 411
 412         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 413         hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 414
 415         /* Read Class of Device */
 416         hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 417
 418         /* Read Local Name */
 419         hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 420
 421         /* Read Voice Setting */
 422         hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 423
 424         /* Read Number of Supported IAC */
 425         hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
 426
 427         /* Read Current IAC LAP */
 428         hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
 429
 430         /* Clear Event Filters */
 431         flt_type = HCI_FLT_CLEAR_ALL;
 432         hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 433
 434         /* Connection accept timeout ~20 secs */
 435         param = cpu_to_le16(0x7d00);
 436         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 437 }
 438
 439 static void le_setup(struct hci_request *req)
 440 {
 441         struct hci_dev *hdev = req->hdev;
 442
 443         /* Read LE Buffer Size */
 444         hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 445
 446         /* Read LE Local Supported Features */
 447         hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
 448
 449         /* Read LE Supported States */
 450         hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
 451
 452         /* Read LE White List Size */
 453         hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
 454
 455         /* Clear LE White List */
 456         hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
 457
 458         /* LE-only controllers have LE implicitly enabled */
 459         if (!lmp_bredr_capable(hdev))
 460                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
 461 }
 462
 463 static void hci_setup_event_mask(struct hci_request *req)
 464 {
 465         struct hci_dev *hdev = req->hdev;
 466
 467         /* The second byte is 0xff instead of 0x9f (two reserved bits
 468          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 469          * command otherwise.
 470          */
 471         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 472
 473         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 474          * any event mask for pre 1.2 devices.
 475          */
 476         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 477                 return;
 478
 479         if (lmp_bredr_capable(hdev)) {
 480                 events[4] |= 0x01; /* Flow Specification Complete */
 481                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 482                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
 483                 events[5] |= 0x08; /* Synchronous Connection Complete */
 484                 events[5] |= 0x10; /* Synchronous Connection Changed */
 485         } else {
 486                 /* Use a different default for LE-only devices */
 487                 memset(events, 0, sizeof(events));
 488                 events[0] |= 0x10; /* Disconnection Complete */
 489                 events[1] |= 0x08; /* Read Remote Version Information Complete */
 490                 events[1] |= 0x20; /* Command Complete */
 491                 events[1] |= 0x40; /* Command Status */
 492                 events[1] |= 0x80; /* Hardware Error */
 493                 events[2] |= 0x04; /* Number of Completed Packets */
 494                 events[3] |= 0x02; /* Data Buffer Overflow */
 495
 496                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
 497                         events[0] |= 0x80; /* Encryption Change */
 498                         events[5] |= 0x80; /* Encryption Key Refresh Complete */
 499                 }
 500         }
 501
 502         if (lmp_inq_rssi_capable(hdev))
 503                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 504
 505         if (lmp_sniffsubr_capable(hdev))
 506                 events[5] |= 0x20; /* Sniff Subrating */
 507
 508         if (lmp_pause_enc_capable(hdev))
 509                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 510
 511         if (lmp_ext_inq_capable(hdev))
 512                 events[5] |= 0x40; /* Extended Inquiry Result */
 513
 514         if (lmp_no_flush_capable(hdev))
 515                 events[7] |= 0x01; /* Enhanced Flush Complete */
 516
 517         if (lmp_lsto_capable(hdev))
 518                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 519
 520         if (lmp_ssp_capable(hdev)) {
 521                 events[6] |= 0x01;      /* IO Capability Request */
 522                 events[6] |= 0x02;      /* IO Capability Response */
 523                 events[6] |= 0x04;      /* User Confirmation Request */
 524                 events[6] |= 0x08;      /* User Passkey Request */
 525                 events[6] |= 0x10;      /* Remote OOB Data Request */
 526                 events[6] |= 0x20;      /* Simple Pairing Complete */
 527                 events[7] |= 0x04;      /* User Passkey Notification */
 528                 events[7] |= 0x08;      /* Keypress Notification */
 529                 events[7] |= 0x10;      /* Remote Host Supported
 530                                          * Features Notification
 531                                          */
 532         }
 533
 534         if (lmp_le_capable(hdev))
 535                 events[7] |= 0x20;      /* LE Meta-Event */
 536
 537         hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 538 }
 539
 540 static void hci_init2_req(struct hci_request *req, unsigned long opt)
 541 {
 542         struct hci_dev *hdev = req->hdev;
 543
 544         if (hdev->dev_type == HCI_AMP)
 545                 return amp_init2(req);
 546
 547         if (lmp_bredr_capable(hdev))
 548                 bredr_setup(req);
 549         else
 550                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
 551
 552         if (lmp_le_capable(hdev))
 553                 le_setup(req);
 554
 555         /* All Bluetooth 1.2 and later controllers should support the
 556          * HCI command for reading the local supported commands.
 557          *
 558          * Unfortunately some controllers indicate Bluetooth 1.2 support,
 559          * but do not have support for this command. If that is the case,
 560          * the driver can quirk the behavior and skip reading the local
 561          * supported commands.
 562          */
 563         if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
 564             !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
 565                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 566
 567         if (lmp_ssp_capable(hdev)) {
 568                 /* When SSP is available, then the host features page
 569                  * should also be available as well. However some
 570                  * controllers list the max_page as 0 as long as SSP
 571                  * has not been enabled. To achieve proper debugging
 572                  * output, force the minimum max_page to 1 at least.
 573                  */
 574                 hdev->max_page = 0x01;
 575
 576                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
 577                         u8 mode = 0x01;
 578
 579                         hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
 580                                     sizeof(mode), &mode);
 581                 } else {
 582                         struct hci_cp_write_eir cp;
 583
 584                         memset(hdev->eir, 0, sizeof(hdev->eir));
 585                         memset(&cp, 0, sizeof(cp));
 586
 587                         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 588                 }
 589         }
 590
 591         if (lmp_inq_rssi_capable(hdev) ||
 592             test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
 593                 u8 mode;
 594
 595                 /* If Extended Inquiry Result events are supported, then
 596                  * they are clearly preferred over Inquiry Result with RSSI
 597                  * events.
 598                  */
 599                 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
 600
 601                 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 602         }
 603
 604         if (lmp_inq_tx_pwr_capable(hdev))
 605                 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 606
 607         if (lmp_ext_feat_capable(hdev)) {
 608                 struct hci_cp_read_local_ext_features cp;
 609
 610                 cp.page = 0x01;
 611                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
 612                             sizeof(cp), &cp);
 613         }
 614
 615         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
 616                 u8 enable = 1;
 617                 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
 618                             &enable);
 619         }
 620 }
 621
 622 static void hci_setup_link_policy(struct hci_request *req)
 623 {
 624         struct hci_dev *hdev = req->hdev;
 625         struct hci_cp_write_def_link_policy cp;
 626         u16 link_policy = 0;
 627
 628         if (lmp_rswitch_capable(hdev))
 629                 link_policy |= HCI_LP_RSWITCH;
 630         if (lmp_hold_capable(hdev))
 631                 link_policy |= HCI_LP_HOLD;
 632         if (lmp_sniff_capable(hdev))
 633                 link_policy |= HCI_LP_SNIFF;
 634         if (lmp_park_capable(hdev))
 635                 link_policy |= HCI_LP_PARK;
 636
 637         cp.policy = cpu_to_le16(link_policy);
 638         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 639 }
 640
 641 static void hci_set_le_support(struct hci_request *req)
 642 {
 643         struct hci_dev *hdev = req->hdev;
 644         struct hci_cp_write_le_host_supported cp;
 645
 646         /* LE-only devices do not support explicit enablement */
 647         if (!lmp_bredr_capable(hdev))
 648                 return;
 649
 650         memset(&cp, 0, sizeof(cp));
 651
 652         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
 653                 cp.le = 0x01;
 654                 cp.simul = 0x00;
 655         }
 656
 657         if (cp.le != lmp_host_le_capable(hdev))
 658                 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
 659                             &cp);
 660 }
 661
 662 static void hci_set_event_mask_page_2(struct hci_request *req)
 663 {
 664         struct hci_dev *hdev = req->hdev;
 665         u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 666
 667         /* If Connectionless Slave Broadcast master role is supported
 668          * enable all necessary events for it.
 669          */
 670         if (lmp_csb_master_capable(hdev)) {
 671                 events[1] |= 0x40;      /* Triggered Clock Capture */
 672                 events[1] |= 0x80;      /* Synchronization Train Complete */
 673                 events[2] |= 0x10;      /* Slave Page Response Timeout */
 674                 events[2] |= 0x20;      /* CSB Channel Map Change */
 675         }
 676
 677         /* If Connectionless Slave Broadcast slave role is supported
 678          * enable all necessary events for it.
 679          */
 680         if (lmp_csb_slave_capable(hdev)) {
 681                 events[2] |= 0x01;      /* Synchronization Train Received */
 682                 events[2] |= 0x02;      /* CSB Receive */
 683                 events[2] |= 0x04;      /* CSB Timeout */
 684                 events[2] |= 0x08;      /* Truncated Page Complete */
 685         }
 686
 687         /* Enable Authenticated Payload Timeout Expired event if supported */
 688         if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
 689                 events[2] |= 0x80;
 690
 691         hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
 692 }
 693
 694 static void hci_init3_req(struct hci_request *req, unsigned long opt)
 695 {
 696         struct hci_dev *hdev = req->hdev;
 697         u8 p;
 698
 699         hci_setup_event_mask(req);
 700
 701         if (hdev->commands[6] & 0x20) {
 702                 struct hci_cp_read_stored_link_key cp;
 703
 704                 bacpy(&cp.bdaddr, BDADDR_ANY);
 705                 cp.read_all = 0x01;
 706                 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
 707         }
 708
 709         if (hdev->commands[5] & 0x10)
 710                 hci_setup_link_policy(req);
 711
 712         if (hdev->commands[8] & 0x01)
 713                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
 714
 715         /* Some older Broadcom based Bluetooth 1.2 controllers do not
 716          * support the Read Page Scan Type command. Check support for
 717          * this command in the bit mask of supported commands.
 718          */
 719         if (hdev->commands[13] & 0x01)
 720                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
 721
 722         if (lmp_le_capable(hdev)) {
 723                 u8 events[8];
 724
 725                 memset(events, 0, sizeof(events));
 726                 events[0] = 0x0f;
 727
 728                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
 729                         events[0] |= 0x10;      /* LE Long Term Key Request */
 730
 731                 /* If controller supports the Connection Parameters Request
 732                  * Link Layer Procedure, enable the corresponding event.
 733                  */
 734                 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
 735                         events[0] |= 0x20;      /* LE Remote Connection
 736                                                  * Parameter Request
 737                                                  */
 738
 739                 /* If the controller supports the Data Length Extension
 740                  * feature, enable the corresponding event.
 741                  */
 742                 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
 743                         events[0] |= 0x40;      /* LE Data Length Change */
 744
 745                 /* If the controller supports Extended Scanner Filter
 746                  * Policies, enable the correspondig event.
 747                  */
 748                 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
 749                         events[1] |= 0x04;      /* LE Direct Advertising
 750                                                  * Report
 751                                                  */
 752
 753                 /* If the controller supports the LE Read Local P-256
 754                  * Public Key command, enable the corresponding event.
 755                  */
 756                 if (hdev->commands[34] & 0x02)
 757                         events[0] |= 0x80;      /* LE Read Local P-256
 758                                                  * Public Key Complete
 759                                                  */
 760
 761                 /* If the controller supports the LE Generate DHKey
 762                  * command, enable the corresponding event.
 763                  */
 764                 if (hdev->commands[34] & 0x04)
 765                         events[1] |= 0x01;      /* LE Generate DHKey Complete */
 766
 767                 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
 768                             events);
 769
 770                 if (hdev->commands[25] & 0x40) {
 771                         /* Read LE Advertising Channel TX Power */
 772                         hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
 773                 }
 774
 775                 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
 776                         /* Read LE Maximum Data Length */
 777                         hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
 778
 779                         /* Read LE Suggested Default Data Length */
 780                         hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
 781                 }
 782
 783                 hci_set_le_support(req);
 784         }
 785
 786         /* Read features beyond page 1 if available */
 787         for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
 788                 struct hci_cp_read_local_ext_features cp;
 789
 790                 cp.page = p;
 791                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
 792                             sizeof(cp), &cp);
 793         }
 794 }
 795
 796 static void hci_init4_req(struct hci_request *req, unsigned long opt)
 797 {
 798         struct hci_dev *hdev = req->hdev;
 799
 800         /* Some Broadcom based Bluetooth controllers do not support the
 801          * Delete Stored Link Key command. They are clearly indicating its
 802          * absence in the bit mask of supported commands.
 803          *
 804          * Check the supported commands and only if the the command is marked
 805          * as supported send it. If not supported assume that the controller
 806          * does not have actual support for stored link keys which makes this
 807          * command redundant anyway.
 808          *
 809          * Some controllers indicate that they support handling deleting
 810          * stored link keys, but they don't. The quirk lets a driver
 811          * just disable this command.
 812          */
 813         if (hdev->commands[6] & 0x80 &&
 814             !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
 815                 struct hci_cp_delete_stored_link_key cp;
 816
 817                 bacpy(&cp.bdaddr, BDADDR_ANY);
 818                 cp.delete_all = 0x01;
 819                 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
 820                             sizeof(cp), &cp);
 821         }
 822
 823         /* Set event mask page 2 if the HCI command for it is supported */
 824         if (hdev->commands[22] & 0x04)
 825                 hci_set_event_mask_page_2(req);
 826
 827         /* Read local codec list if the HCI command is supported */
 828         if (hdev->commands[29] & 0x20)
 829                 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
 830
 831         /* Get MWS transport configuration if the HCI command is supported */
 832         if (hdev->commands[30] & 0x08)
 833                 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
 834
 835         /* Check for Synchronization Train support */
 836         if (lmp_sync_train_capable(hdev))
 837                 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
 838
 839         /* Enable Secure Connections if supported and configured */
 840         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
 841             bredr_sc_enabled(hdev)) {
 842                 u8 support = 0x01;
 843
 844                 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
 845                             sizeof(support), &support);
 846         }
 847 }
 848
 849 static int __hci_init(struct hci_dev *hdev)
 850 {
 851         int err;
 852
 853         err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
 854         if (err < 0)
 855                 return err;
 856
 857         /* The Device Under Test (DUT) mode is special and available for
 858          * all controller types. So just create it early on.
 859          */
 860         if (hci_dev_test_flag(hdev, HCI_SETUP)) {
 861                 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
 862                                     &dut_mode_fops);
 863         }
 864
 865         err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
 866         if (err < 0)
 867                 return err;
 868
 869         /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
 870          * BR/EDR/LE type controllers. AMP controllers only need the
 871          * first two stages of init.
 872          */
 873         if (hdev->dev_type != HCI_BREDR)
 874                 return 0;
 875
 876         err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
 877         if (err < 0)
 878                 return err;
 879
 880         err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
 881         if (err < 0)
 882                 return err;
 883
 884         /* This function is only called when the controller is actually in
 885          * configured state. When the controller is marked as unconfigured,
 886          * this initialization procedure is not run.
 887          *
 888          * It means that it is possible that a controller runs through its
 889          * setup phase and then discovers missing settings. If that is the
 890          * case, then this function will not be called. It then will only
 891          * be called during the config phase.
 892          *
 893          * So only when in setup phase or config phase, create the debugfs
 894          * entries and register the SMP channels.
 895          */
 896         if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
 897             !hci_dev_test_flag(hdev, HCI_CONFIG))
 898                 return 0;
 899
 900         hci_debugfs_create_common(hdev);
 901
 902         if (lmp_bredr_capable(hdev))
 903                 hci_debugfs_create_bredr(hdev);
 904
 905         if (lmp_le_capable(hdev))
 906                 hci_debugfs_create_le(hdev);
 907
 908         return 0;
 909 }
 910
 911 static void hci_init0_req(struct hci_request *req, unsigned long opt)
 912 {
 913         struct hci_dev *hdev = req->hdev;
 914
 915         BT_DBG("%s %ld", hdev->name, opt);
 916
 917         /* Reset */
 918         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
 919                 hci_reset_req(req, 0);
 920
 921         /* Read Local Version */
 922         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 923
 924         /* Read BD Address */
 925         if (hdev->set_bdaddr)
 926                 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
 927 }
 928
 929 static int __hci_unconf_init(struct hci_dev *hdev)
 930 {
 931         int err;
 932
 933         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 934                 return 0;
 935
 936         err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT);
 937         if (err < 0)
 938                 return err;
 939
 940         return 0;
 941 }
 942
 943 static void hci_scan_req(struct hci_request *req, unsigned long opt)
 944 {
 945         __u8 scan = opt;
 946
 947         BT_DBG("%s %x", req->hdev->name, scan);
 948
 949         /* Inquiry and Page scans */
 950         hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 951 }
 952
 953 static void hci_auth_req(struct hci_request *req, unsigned long opt)
 954 {
 955         __u8 auth = opt;
 956
 957         BT_DBG("%s %x", req->hdev->name, auth);
 958
 959         /* Authentication */
 960         hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 961 }
 962
 963 static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
 964 {
 965         __u8 encrypt = opt;
 966
 967         BT_DBG("%s %x", req->hdev->name, encrypt);
 968
 969         /* Encryption */
 970         hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 971 }
 972
 973 static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
 974 {
 975         __le16 policy = cpu_to_le16(opt);
 976
 977         BT_DBG("%s %x", req->hdev->name, policy);
 978
 979         /* Default link policy */
 980         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 981 }
 982
 983 /* Get HCI device by index.
 984  * Device is held on return. */
 985 struct hci_dev *hci_dev_get(int index)
 986 {
 987         struct hci_dev *hdev = NULL, *d;
 988
 989         BT_DBG("%d", index);
 990
 991         if (index < 0)
 992                 return NULL;
 993
 994         read_lock(&hci_dev_list_lock);
 995         list_for_each_entry(d, &hci_dev_list, list) {
 996                 if (d->id == index) {
 997                         hdev = hci_dev_hold(d);
 998                         break;
 999                 }
1000         }
1001         read_unlock(&hci_dev_list_lock);
1002         return hdev;
1003 }
1004
1005 /* ---- Inquiry support ---- */
1006
1007 bool hci_discovery_active(struct hci_dev *hdev)
1008 {
1009         struct discovery_state *discov = &hdev->discovery;
1010
1011         switch (discov->state) {
1012         case DISCOVERY_FINDING:
1013         case DISCOVERY_RESOLVING:
1014                 return true;
1015
1016         default:
1017                 return false;
1018         }
1019 }
1020
1021 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1022 {
1023         int old_state = hdev->discovery.state;
1024
1025         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1026
1027         if (old_state == state)
1028                 return;
1029
1030         hdev->discovery.state = state;
1031
1032         switch (state) {
1033         case DISCOVERY_STOPPED:
1034                 hci_update_background_scan(hdev);
1035
1036                 if (old_state != DISCOVERY_STARTING)
1037                         mgmt_discovering(hdev, 0);
1038                 break;
1039         case DISCOVERY_STARTING:
1040                 break;
1041         case DISCOVERY_FINDING:
1042                 mgmt_discovering(hdev, 1);
1043                 break;
1044         case DISCOVERY_RESOLVING:
1045                 break;
1046         case DISCOVERY_STOPPING:
1047                 break;
1048         }
1049 }
1050
1051 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1052 {
1053         struct discovery_state *cache = &hdev->discovery;
1054         struct inquiry_entry *p, *n;
1055
1056         list_for_each_entry_safe(p, n, &cache->all, all) {
1057                 list_del(&p->all);
1058                 kfree(p);
1059         }
1060
1061         INIT_LIST_HEAD(&cache->unknown);
1062         INIT_LIST_HEAD(&cache->resolve);
1063 }
1064
1065 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1066                                                bdaddr_t *bdaddr)
1067 {
1068         struct discovery_state *cache = &hdev->discovery;
1069         struct inquiry_entry *e;
1070
1071         BT_DBG("cache %p, %pMR", cache, bdaddr);
1072
1073         list_for_each_entry(e, &cache->all, all) {
1074                 if (!bacmp(&e->data.bdaddr, bdaddr))
1075                         return e;
1076         }
1077
1078         return NULL;
1079 }
1080
1081 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1082                                                        bdaddr_t *bdaddr)
1083 {
1084         struct discovery_state *cache = &hdev->discovery;
1085         struct inquiry_entry *e;
1086
1087         BT_DBG("cache %p, %pMR", cache, bdaddr);
1088
1089         list_for_each_entry(e, &cache->unknown, list) {
1090                 if (!bacmp(&e->data.bdaddr, bdaddr))
1091                         return e;
1092         }
1093
1094         return NULL;
1095 }
1096
1097 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1098                                                        bdaddr_t *bdaddr,
1099                                                        int state)
1100 {
1101         struct discovery_state *cache = &hdev->discovery;
1102         struct inquiry_entry *e;
1103
1104         BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1105
1106         list_for_each_entry(e, &cache->resolve, list) {
1107                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1108                         return e;
1109                 if (!bacmp(&e->data.bdaddr, bdaddr))
1110                         return e;
1111         }
1112
1113         return NULL;
1114 }
1115
1116 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1117                                       struct inquiry_entry *ie)
1118 {
1119         struct discovery_state *cache = &hdev->discovery;
1120         struct list_head *pos = &cache->resolve;
1121         struct inquiry_entry *p;
1122
1123         list_del(&ie->list);
1124
1125         list_for_each_entry(p, &cache->resolve, list) {
1126                 if (p->name_state != NAME_PENDING &&
1127                     abs(p->data.rssi) >= abs(ie->data.rssi))
1128                         break;
1129                 pos = &p->list;
1130         }
1131
1132         list_add(&ie->list, pos);
1133 }
1134
1135 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1136                              bool name_known)
1137 {
1138         struct discovery_state *cache = &hdev->discovery;
1139         struct inquiry_entry *ie;
1140         u32 flags = 0;
1141
1142         BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1143
1144         hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1145
1146         if (!data->ssp_mode)
1147                 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1148
1149         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1150         if (ie) {
1151                 if (!ie->data.ssp_mode)
1152                         flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1153
1154                 if (ie->name_state == NAME_NEEDED &&
1155                     data->rssi != ie->data.rssi) {
1156                         ie->data.rssi = data->rssi;
1157                         hci_inquiry_cache_update_resolve(hdev, ie);
1158                 }
1159
1160                 goto update;
1161         }
1162
1163         /* Entry not in the cache. Add new one. */
1164         ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1165         if (!ie) {
1166                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1167                 goto done;
1168         }
1169
1170         list_add(&ie->all, &cache->all);
1171
1172         if (name_known) {
1173                 ie->name_state = NAME_KNOWN;
1174         } else {
1175                 ie->name_state = NAME_NOT_KNOWN;
1176                 list_add(&ie->list, &cache->unknown);
1177         }
1178
1179 update:
1180         if (name_known && ie->name_state != NAME_KNOWN &&
1181             ie->name_state != NAME_PENDING) {
1182                 ie->name_state = NAME_KNOWN;
1183                 list_del(&ie->list);
1184         }
1185
1186         memcpy(&ie->data, data, sizeof(*data));
1187         ie->timestamp = jiffies;
1188         cache->timestamp = jiffies;
1189
1190         if (ie->name_state == NAME_NOT_KNOWN)
1191                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1192
1193 done:
1194         return flags;
1195 }
1196
1197 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1198 {
1199         struct discovery_state *cache = &hdev->discovery;
1200         struct inquiry_info *info = (struct inquiry_info *) buf;
1201         struct inquiry_entry *e;
1202         int copied = 0;
1203
1204         list_for_each_entry(e, &cache->all, all) {
1205                 struct inquiry_data *data = &e->data;
1206
1207                 if (copied >= num)
1208                         break;
1209
1210                 bacpy(&info->bdaddr, &data->bdaddr);
1211                 info->pscan_rep_mode    = data->pscan_rep_mode;
1212                 info->pscan_period_mode = data->pscan_period_mode;
1213                 info->pscan_mode        = data->pscan_mode;
1214                 memcpy(info->dev_class, data->dev_class, 3);
1215                 info->clock_offset      = data->clock_offset;
1216
1217                 info++;
1218                 copied++;
1219         }
1220
1221         BT_DBG("cache %p, copied %d", cache, copied);
1222         return copied;
1223 }
1224
1225 static void hci_inq_req(struct hci_request *req, unsigned long opt)
1226 {
1227         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1228         struct hci_dev *hdev = req->hdev;
1229         struct hci_cp_inquiry cp;
1230
1231         BT_DBG("%s", hdev->name);
1232
1233         if (test_bit(HCI_INQUIRY, &hdev->flags))
1234                 return;
1235
1236         /* Start Inquiry */
1237         memcpy(&cp.lap, &ir->lap, 3);
1238         cp.length  = ir->length;
1239         cp.num_rsp = ir->num_rsp;
1240         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1241 }
1242
1243 int hci_inquiry(void __user *arg)
1244 {
1245         __u8 __user *ptr = arg;
1246         struct hci_inquiry_req ir;
1247         struct hci_dev *hdev;
1248         int err = 0, do_inquiry = 0, max_rsp;
1249         long timeo;
1250         __u8 *buf;
1251
1252         if (copy_from_user(&ir, ptr, sizeof(ir)))
1253                 return -EFAULT;
1254
1255         hdev = hci_dev_get(ir.dev_id);
1256         if (!hdev)
1257                 return -ENODEV;
1258
1259         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1260                 err = -EBUSY;
1261                 goto done;
1262         }
1263
1264         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1265                 err = -EOPNOTSUPP;
1266                 goto done;
1267         }
1268
1269         if (hdev->dev_type != HCI_BREDR) {
1270                 err = -EOPNOTSUPP;
1271                 goto done;
1272         }
1273
1274         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1275                 err = -EOPNOTSUPP;
1276                 goto done;
1277         }
1278
1279         hci_dev_lock(hdev);
1280         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1281             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1282                 hci_inquiry_cache_flush(hdev);
1283                 do_inquiry = 1;
1284         }
1285         hci_dev_unlock(hdev);
1286
1287         timeo = ir.length * msecs_to_jiffies(2000);
1288
1289         if (do_inquiry) {
1290                 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1291                                    timeo);
1292                 if (err < 0)
1293                         goto done;
1294
1295                 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1296                  * cleared). If it is interrupted by a signal, return -EINTR.
1297                  */
1298                 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1299                                 TASK_INTERRUPTIBLE))
1300                         return -EINTR;
1301         }
1302
1303         /* for unlimited number of responses we will use buffer with
1304          * 255 entries
1305          */
1306         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1307
1308         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1309          * copy it to the user space.
1310          */
1311         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
1312         if (!buf) {
1313                 err = -ENOMEM;
1314                 goto done;
1315         }
1316
1317         hci_dev_lock(hdev);
1318         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1319         hci_dev_unlock(hdev);
1320
1321         BT_DBG("num_rsp %d", ir.num_rsp);
1322
1323         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1324                 ptr += sizeof(ir);
1325                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1326                                  ir.num_rsp))
1327                         err = -EFAULT;
1328         } else
1329                 err = -EFAULT;
1330
1331         kfree(buf);
1332
1333 done:
1334         hci_dev_put(hdev);
1335         return err;
1336 }
1337
1338 static int hci_dev_do_open(struct hci_dev *hdev)
1339 {
1340         int ret = 0;
1341
1342         BT_DBG("%s %p", hdev->name, hdev);
1343
1344         hci_req_lock(hdev);
1345
1346         if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1347                 ret = -ENODEV;
1348                 goto done;
1349         }
1350
1351         if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1352             !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1353                 /* Check for rfkill but allow the HCI setup stage to
1354                  * proceed (which in itself doesn't cause any RF activity).
1355                  */
1356                 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1357                         ret = -ERFKILL;
1358                         goto done;
1359                 }
1360
1361                 /* Check for valid public address or a configured static
1362                  * random adddress, but let the HCI setup proceed to
1363                  * be able to determine if there is a public address
1364                  * or not.
1365                  *
1366                  * In case of user channel usage, it is not important
1367                  * if a public address or static random address is
1368                  * available.
1369                  *
1370                  * This check is only valid for BR/EDR controllers
1371                  * since AMP controllers do not have an address.
1372                  */
1373                 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1374                     hdev->dev_type == HCI_BREDR &&
1375                     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1376                     !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1377                         ret = -EADDRNOTAVAIL;
1378                         goto done;
1379                 }
1380         }
1381
1382         if (test_bit(HCI_UP, &hdev->flags)) {
1383                 ret = -EALREADY;
1384                 goto done;
1385         }
1386
1387         if (hdev->open(hdev)) {
1388                 ret = -EIO;
1389                 goto done;
1390         }
1391
1392         atomic_set(&hdev->cmd_cnt, 1);
1393         set_bit(HCI_INIT, &hdev->flags);
1394
1395         if (hci_dev_test_flag(hdev, HCI_SETUP)) {
1396                 if (hdev->setup)
1397                         ret = hdev->setup(hdev);
1398
1399                 /* The transport driver can set these quirks before
1400                  * creating the HCI device or in its setup callback.
1401                  *
1402                  * In case any of them is set, the controller has to
1403                  * start up as unconfigured.
1404                  */
1405                 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1406                     test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
1407                         hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1408
1409                 /* For an unconfigured controller it is required to
1410                  * read at least the version information provided by
1411                  * the Read Local Version Information command.
1412                  *
1413                  * If the set_bdaddr driver callback is provided, then
1414                  * also the original Bluetooth public device address
1415                  * will be read using the Read BD Address command.
1416                  */
1417                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1418                         ret = __hci_unconf_init(hdev);
1419         }
1420
1421         if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1422                 /* If public address change is configured, ensure that
1423                  * the address gets programmed. If the driver does not
1424                  * support changing the public address, fail the power
1425                  * on procedure.
1426                  */
1427                 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1428                     hdev->set_bdaddr)
1429                         ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1430                 else
1431                         ret = -EADDRNOTAVAIL;
1432         }
1433
1434         if (!ret) {
1435                 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1436                     !hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
1437                         ret = __hci_init(hdev);
1438         }
1439
1440         clear_bit(HCI_INIT, &hdev->flags);
1441
1442         if (!ret) {
1443                 hci_dev_hold(hdev);
1444                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1445                 set_bit(HCI_UP, &hdev->flags);
1446                 hci_notify(hdev, HCI_DEV_UP);
1447                 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1448                     !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1449                     !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1450                     !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1451                     hdev->dev_type == HCI_BREDR) {
1452                         hci_dev_lock(hdev);
1453                         mgmt_powered(hdev, 1);
1454                         hci_dev_unlock(hdev);
1455                 }
1456         } else {
1457                 /* Init failed, cleanup */
1458                 flush_work(&hdev->tx_work);
1459                 flush_work(&hdev->cmd_work);
1460                 flush_work(&hdev->rx_work);
1461
1462                 skb_queue_purge(&hdev->cmd_q);
1463                 skb_queue_purge(&hdev->rx_q);
1464
1465                 if (hdev->flush)
1466                         hdev->flush(hdev);
1467
1468                 if (hdev->sent_cmd) {
1469                         kfree_skb(hdev->sent_cmd);
1470                         hdev->sent_cmd = NULL;
1471                 }
1472
1473                 hdev->close(hdev);
1474                 hdev->flags &= BIT(HCI_RAW);
1475         }
1476
1477 done:
1478         hci_req_unlock(hdev);
1479         return ret;
1480 }
1481
1482 /* ---- HCI ioctl helpers ---- */
1483
1484 int hci_dev_open(__u16 dev)
1485 {
1486         struct hci_dev *hdev;
1487         int err;
1488
1489         hdev = hci_dev_get(dev);
1490         if (!hdev)
1491                 return -ENODEV;
1492
1493         /* Devices that are marked as unconfigured can only be powered
1494          * up as user channel. Trying to bring them up as normal devices
1495          * will result into a failure. Only user channel operation is
1496          * possible.
1497          *
1498          * When this function is called for a user channel, the flag
1499          * HCI_USER_CHANNEL will be set first before attempting to
1500          * open the device.
1501          */
1502         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1503             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1504                 err = -EOPNOTSUPP;
1505                 goto done;
1506         }
1507
1508         /* We need to ensure that no other power on/off work is pending
1509          * before proceeding to call hci_dev_do_open. This is
1510          * particularly important if the setup procedure has not yet
1511          * completed.
1512          */
1513         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1514                 cancel_delayed_work(&hdev->power_off);
1515
1516         /* After this call it is guaranteed that the setup procedure
1517          * has finished. This means that error conditions like RFKILL
1518          * or no valid public or static random address apply.
1519          */
1520         flush_workqueue(hdev->req_workqueue);
1521
1522         /* For controllers not using the management interface and that
1523          * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1524          * so that pairing works for them. Once the management interface
1525          * is in use this bit will be cleared again and userspace has
1526          * to explicitly enable it.
1527          */
1528         if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1529             !hci_dev_test_flag(hdev, HCI_MGMT))
1530                 hci_dev_set_flag(hdev, HCI_BONDABLE);
1531
1532         err = hci_dev_do_open(hdev);
1533
1534 done:
1535         hci_dev_put(hdev);
1536         return err;
1537 }
1538
1539 /* This function requires the caller holds hdev->lock */
1540 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1541 {
1542         struct hci_conn_params *p;
1543
1544         list_for_each_entry(p, &hdev->le_conn_params, list) {
1545                 if (p->conn) {
1546                         hci_conn_drop(p->conn);
1547                         hci_conn_put(p->conn);
1548                         p->conn = NULL;
1549                 }
1550                 list_del_init(&p->action);
1551         }
1552
1553         BT_DBG("All LE pending actions cleared");
1554 }
1555
1556 static int hci_dev_do_close(struct hci_dev *hdev)
1557 {
1558         BT_DBG("%s %p", hdev->name, hdev);
1559
1560         if (!hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1561                 /* Execute vendor specific shutdown routine */
1562                 if (hdev->shutdown)
1563                         hdev->shutdown(hdev);
1564         }
1565
1566         cancel_delayed_work(&hdev->power_off);
1567
1568         hci_req_cancel(hdev, ENODEV);
1569         hci_req_lock(hdev);
1570
1571         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1572                 cancel_delayed_work_sync(&hdev->cmd_timer);
1573                 hci_req_unlock(hdev);
1574                 return 0;
1575         }
1576
1577         /* Flush RX and TX works */
1578         flush_work(&hdev->tx_work);
1579         flush_work(&hdev->rx_work);
1580
1581         if (hdev->discov_timeout > 0) {
1582                 cancel_delayed_work(&hdev->discov_off);
1583                 hdev->discov_timeout = 0;
1584                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1585                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1586         }
1587
1588         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1589                 cancel_delayed_work(&hdev->service_cache);
1590
1591         cancel_delayed_work_sync(&hdev->le_scan_disable);
1592         cancel_delayed_work_sync(&hdev->le_scan_restart);
1593
1594         if (hci_dev_test_flag(hdev, HCI_MGMT))
1595                 cancel_delayed_work_sync(&hdev->rpa_expired);
1596
1597         /* Avoid potential lockdep warnings from the *_flush() calls by
1598          * ensuring the workqueue is empty up front.
1599          */
1600         drain_workqueue(hdev->workqueue);
1601
1602         hci_dev_lock(hdev);
1603
1604         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1605
1606         if (!hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1607                 if (hdev->dev_type == HCI_BREDR)
1608                         mgmt_powered(hdev, 0);
1609         }
1610
1611         hci_inquiry_cache_flush(hdev);
1612         hci_pend_le_actions_clear(hdev);
1613         hci_conn_hash_flush(hdev);
1614         hci_dev_unlock(hdev);
1615
1616         smp_unregister(hdev);
1617
1618         hci_notify(hdev, HCI_DEV_DOWN);
1619
1620         if (hdev->flush)
1621                 hdev->flush(hdev);
1622
1623         /* Reset device */
1624         skb_queue_purge(&hdev->cmd_q);
1625         atomic_set(&hdev->cmd_cnt, 1);
1626         if (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
1627             !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1628             test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1629                 set_bit(HCI_INIT, &hdev->flags);
1630                 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1631                 clear_bit(HCI_INIT, &hdev->flags);
1632         }
1633
1634         /* flush cmd  work */
1635         flush_work(&hdev->cmd_work);
1636
1637         /* Drop queues */
1638         skb_queue_purge(&hdev->rx_q);
1639         skb_queue_purge(&hdev->cmd_q);
1640         skb_queue_purge(&hdev->raw_q);
1641
1642         /* Drop last sent command */
1643         if (hdev->sent_cmd) {
1644                 cancel_delayed_work_sync(&hdev->cmd_timer);
1645                 kfree_skb(hdev->sent_cmd);
1646                 hdev->sent_cmd = NULL;
1647         }
1648
1649         /* After this point our queues are empty
1650          * and no tasks are scheduled. */
1651         hdev->close(hdev);
1652
1653         /* Clear flags */
1654         hdev->flags &= BIT(HCI_RAW);
1655         hci_dev_clear_volatile_flags(hdev);
1656
1657         /* Controller radio is available but is currently powered down */
1658         hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1659
1660         memset(hdev->eir, 0, sizeof(hdev->eir));
1661         memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1662         bacpy(&hdev->random_addr, BDADDR_ANY);
1663
1664         hci_req_unlock(hdev);
1665
1666         hci_dev_put(hdev);
1667         return 0;
1668 }
1669
1670 int hci_dev_close(__u16 dev)
1671 {
1672         struct hci_dev *hdev;
1673         int err;
1674
1675         hdev = hci_dev_get(dev);
1676         if (!hdev)
1677                 return -ENODEV;
1678
1679         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1680                 err = -EBUSY;
1681                 goto done;
1682         }
1683
1684         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1685                 cancel_delayed_work(&hdev->power_off);
1686
1687         err = hci_dev_do_close(hdev);
1688
1689 done:
1690         hci_dev_put(hdev);
1691         return err;
1692 }
1693
1694 static int hci_dev_do_reset(struct hci_dev *hdev)
1695 {
1696         int ret;
1697
1698         BT_DBG("%s %p", hdev->name, hdev);
1699
1700         hci_req_lock(hdev);
1701
1702         /* Drop queues */
1703         skb_queue_purge(&hdev->rx_q);
1704         skb_queue_purge(&hdev->cmd_q);
1705
1706         /* Avoid potential lockdep warnings from the *_flush() calls by
1707          * ensuring the workqueue is empty up front.
1708          */
1709         drain_workqueue(hdev->workqueue);
1710
1711         hci_dev_lock(hdev);
1712         hci_inquiry_cache_flush(hdev);
1713         hci_conn_hash_flush(hdev);
1714         hci_dev_unlock(hdev);
1715
1716         if (hdev->flush)
1717                 hdev->flush(hdev);
1718
1719         atomic_set(&hdev->cmd_cnt, 1);
1720         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1721
1722         ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1723
1724         hci_req_unlock(hdev);
1725         return ret;
1726 }
1727
1728 int hci_dev_reset(__u16 dev)
1729 {
1730         struct hci_dev *hdev;
1731         int err;
1732
1733         hdev = hci_dev_get(dev);
1734         if (!hdev)
1735                 return -ENODEV;
1736
1737         if (!test_bit(HCI_UP, &hdev->flags)) {
1738                 err = -ENETDOWN;
1739                 goto done;
1740         }
1741
1742         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1743                 err = -EBUSY;
1744                 goto done;
1745         }
1746
1747         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1748                 err = -EOPNOTSUPP;
1749                 goto done;
1750         }
1751
1752         err = hci_dev_do_reset(hdev);
1753
1754 done:
1755         hci_dev_put(hdev);
1756         return err;
1757 }
1758
1759 int hci_dev_reset_stat(__u16 dev)
1760 {
1761         struct hci_dev *hdev;
1762         int ret = 0;
1763
1764         hdev = hci_dev_get(dev);
1765         if (!hdev)
1766                 return -ENODEV;
1767
1768         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1769                 ret = -EBUSY;
1770                 goto done;
1771         }
1772
1773         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1774                 ret = -EOPNOTSUPP;
1775                 goto done;
1776         }
1777
1778         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1779
1780 done:
1781         hci_dev_put(hdev);
1782         return ret;
1783 }
1784
1785 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1786 {
1787         bool conn_changed, discov_changed;
1788
1789         BT_DBG("%s scan 0x%02x", hdev->name, scan);
1790
1791         if ((scan & SCAN_PAGE))
1792                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1793                                                           HCI_CONNECTABLE);
1794         else
1795                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1796                                                            HCI_CONNECTABLE);
1797
1798         if ((scan & SCAN_INQUIRY)) {
1799                 discov_changed = !hci_dev_test_and_set_flag(hdev,
1800                                                             HCI_DISCOVERABLE);
1801         } else {
1802                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1803                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1804                                                              HCI_DISCOVERABLE);
1805         }
1806
1807         if (!hci_dev_test_flag(hdev, HCI_MGMT))
1808                 return;
1809
1810         if (conn_changed || discov_changed) {
1811                 /* In case this was disabled through mgmt */
1812                 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
1813
1814                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1815                         mgmt_update_adv_data(hdev);
1816
1817                 mgmt_new_settings(hdev);
1818         }
1819 }
1820
1821 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1822 {
1823         struct hci_dev *hdev;
1824         struct hci_dev_req dr;
1825         int err = 0;
1826
1827         if (copy_from_user(&dr, arg, sizeof(dr)))
1828                 return -EFAULT;
1829
1830         hdev = hci_dev_get(dr.dev_id);
1831         if (!hdev)
1832                 return -ENODEV;
1833
1834         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1835                 err = -EBUSY;
1836                 goto done;
1837         }
1838
1839         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1840                 err = -EOPNOTSUPP;
1841                 goto done;
1842         }
1843
1844         if (hdev->dev_type != HCI_BREDR) {
1845                 err = -EOPNOTSUPP;
1846                 goto done;
1847         }
1848
1849         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1850                 err = -EOPNOTSUPP;
1851                 goto done;
1852         }
1853
1854         switch (cmd) {
1855         case HCISETAUTH:
1856                 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1857                                    HCI_INIT_TIMEOUT);
1858                 break;
1859
1860         case HCISETENCRYPT:
1861                 if (!lmp_encrypt_capable(hdev)) {
1862                         err = -EOPNOTSUPP;
1863                         break;
1864                 }
1865
1866                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1867                         /* Auth must be enabled first */
1868                         err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1869                                            HCI_INIT_TIMEOUT);
1870                         if (err)
1871                                 break;
1872                 }
1873
1874                 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1875                                    HCI_INIT_TIMEOUT);
1876                 break;
1877
1878         case HCISETSCAN:
1879                 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1880                                    HCI_INIT_TIMEOUT);
1881
1882                 /* Ensure that the connectable and discoverable states
1883                  * get correctly modified as this was a non-mgmt change.
1884                  */
1885                 if (!err)
1886                         hci_update_scan_state(hdev, dr.dev_opt);
1887                 break;
1888
1889         case HCISETLINKPOL:
1890                 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1891                                    HCI_INIT_TIMEOUT);
1892                 break;
1893
1894         case HCISETLINKMODE:
1895                 hdev->link_mode = ((__u16) dr.dev_opt) &
1896                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
1897                 break;
1898
1899         case HCISETPTYPE:
1900                 hdev->pkt_type = (__u16) dr.dev_opt;
1901                 break;
1902
1903         case HCISETACLMTU:
1904                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
1905                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1906                 break;
1907
1908         case HCISETSCOMTU:
1909                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
1910                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1911                 break;
1912
1913         default:
1914                 err = -EINVAL;
1915                 break;
1916         }
1917
1918 done:
1919         hci_dev_put(hdev);
1920         return err;
1921 }
1922
1923 int hci_get_dev_list(void __user *arg)
1924 {
1925         struct hci_dev *hdev;
1926         struct hci_dev_list_req *dl;
1927         struct hci_dev_req *dr;
1928         int n = 0, size, err;
1929         __u16 dev_num;
1930
1931         if (get_user(dev_num, (__u16 __user *) arg))
1932                 return -EFAULT;
1933
1934         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1935                 return -EINVAL;
1936
1937         size = sizeof(*dl) + dev_num * sizeof(*dr);
1938
1939         dl = kzalloc(size, GFP_KERNEL);
1940         if (!dl)
1941                 return -ENOMEM;
1942
1943         dr = dl->dev_req;
1944
1945         read_lock(&hci_dev_list_lock);
1946         list_for_each_entry(hdev, &hci_dev_list, list) {
1947                 unsigned long flags = hdev->flags;
1948
1949                 /* When the auto-off is configured it means the transport
1950                  * is running, but in that case still indicate that the
1951                  * device is actually down.
1952                  */
1953                 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
1954                         flags &= ~BIT(HCI_UP);
1955
1956                 (dr + n)->dev_id  = hdev->id;
1957                 (dr + n)->dev_opt = flags;
1958
1959                 if (++n >= dev_num)
1960                         break;
1961         }
1962         read_unlock(&hci_dev_list_lock);
1963
1964         dl->dev_num = n;
1965         size = sizeof(*dl) + n * sizeof(*dr);
1966
1967         err = copy_to_user(arg, dl, size);
1968         kfree(dl);
1969
1970         return err ? -EFAULT : 0;
1971 }
1972
1973 int hci_get_dev_info(void __user *arg)
1974 {
1975         struct hci_dev *hdev;
1976         struct hci_dev_info di;
1977         unsigned long flags;
1978         int err = 0;
1979
1980         if (copy_from_user(&di, arg, sizeof(di)))
1981                 return -EFAULT;
1982
1983         hdev = hci_dev_get(di.dev_id);
1984         if (!hdev)
1985                 return -ENODEV;
1986
1987         /* When the auto-off is configured it means the transport
1988          * is running, but in that case still indicate that the
1989          * device is actually down.
1990          */
1991         if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
1992                 flags = hdev->flags & ~BIT(HCI_UP);
1993         else
1994                 flags = hdev->flags;
1995
1996         strcpy(di.name, hdev->name);
1997         di.bdaddr   = hdev->bdaddr;
1998         di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
1999         di.flags    = flags;
2000         di.pkt_type = hdev->pkt_type;
2001         if (lmp_bredr_capable(hdev)) {
2002                 di.acl_mtu  = hdev->acl_mtu;
2003                 di.acl_pkts = hdev->acl_pkts;
2004                 di.sco_mtu  = hdev->sco_mtu;
2005                 di.sco_pkts = hdev->sco_pkts;
2006         } else {
2007                 di.acl_mtu  = hdev->le_mtu;
2008                 di.acl_pkts = hdev->le_pkts;
2009                 di.sco_mtu  = 0;
2010                 di.sco_pkts = 0;
2011         }
2012         di.link_policy = hdev->link_policy;
2013         di.link_mode   = hdev->link_mode;
2014
2015         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2016         memcpy(&di.features, &hdev->features, sizeof(di.features));
2017
2018         if (copy_to_user(arg, &di, sizeof(di)))
2019                 err = -EFAULT;
2020
2021         hci_dev_put(hdev);
2022
2023         return err;
2024 }
2025
2026 /* ---- Interface to HCI drivers ---- */
2027
2028 static int hci_rfkill_set_block(void *data, bool blocked)
2029 {
2030         struct hci_dev *hdev = data;
2031
2032         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2033
2034         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2035                 return -EBUSY;
2036
2037         if (blocked) {
2038                 hci_dev_set_flag(hdev, HCI_RFKILLED);
2039                 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2040                     !hci_dev_test_flag(hdev, HCI_CONFIG))
2041                         hci_dev_do_close(hdev);
2042         } else {
2043                 hci_dev_clear_flag(hdev, HCI_RFKILLED);
2044         }
2045
2046         return 0;
2047 }
2048
2049 static const struct rfkill_ops hci_rfkill_ops = {
2050         .set_block = hci_rfkill_set_block,
2051 };
2052
2053 static void hci_power_on(struct work_struct *work)
2054 {
2055         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2056         int err;
2057
2058         BT_DBG("%s", hdev->name);
2059
2060         err = hci_dev_do_open(hdev);
2061         if (err < 0) {
2062                 hci_dev_lock(hdev);
2063                 mgmt_set_powered_failed(hdev, err);
2064                 hci_dev_unlock(hdev);
2065                 return;
2066         }
2067
2068         /* During the HCI setup phase, a few error conditions are
2069          * ignored and they need to be checked now. If they are still
2070          * valid, it is important to turn the device back off.
2071          */
2072         if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2073             hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2074             (hdev->dev_type == HCI_BREDR &&
2075              !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2076              !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2077                 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2078                 hci_dev_do_close(hdev);
2079         } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2080                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2081                                    HCI_AUTO_OFF_TIMEOUT);
2082         }
2083
2084         if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2085                 /* For unconfigured devices, set the HCI_RAW flag
2086                  * so that userspace can easily identify them.
2087                  */
2088                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2089                         set_bit(HCI_RAW, &hdev->flags);
2090
2091                 /* For fully configured devices, this will send
2092                  * the Index Added event. For unconfigured devices,
2093                  * it will send Unconfigued Index Added event.
2094                  *
2095                  * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2096                  * and no event will be send.
2097                  */
2098                 mgmt_index_added(hdev);
2099         } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2100                 /* When the controller is now configured, then it
2101                  * is important to clear the HCI_RAW flag.
2102                  */
2103                 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2104                         clear_bit(HCI_RAW, &hdev->flags);
2105
2106                 /* Powering on the controller with HCI_CONFIG set only
2107                  * happens with the transition from unconfigured to
2108                  * configured. This will send the Index Added event.
2109                  */
2110                 mgmt_index_added(hdev);
2111         }
2112 }
2113
2114 static void hci_power_off(struct work_struct *work)
2115 {
2116         struct hci_dev *hdev = container_of(work, struct hci_dev,
2117                                             power_off.work);
2118
2119         BT_DBG("%s", hdev->name);
2120
2121         hci_dev_do_close(hdev);
2122 }
2123
2124 static void hci_error_reset(struct work_struct *work)
2125 {
2126         struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2127
2128         BT_DBG("%s", hdev->name);
2129
2130         if (hdev->hw_error)
2131                 hdev->hw_error(hdev, hdev->hw_error_code);
2132         else
2133                 BT_ERR("%s hardware error 0x%2.2x", hdev->name,
2134                        hdev->hw_error_code);
2135
2136         if (hci_dev_do_close(hdev))
2137                 return;
2138
2139         hci_dev_do_open(hdev);
2140 }
2141
2142 static void hci_discov_off(struct work_struct *work)
2143 {
2144         struct hci_dev *hdev;
2145
2146         hdev = container_of(work, struct hci_dev, discov_off.work);
2147
2148         BT_DBG("%s", hdev->name);
2149
2150         mgmt_discoverable_timeout(hdev);
2151 }
2152
2153 void hci_uuids_clear(struct hci_dev *hdev)
2154 {
2155         struct bt_uuid *uuid, *tmp;
2156
2157         list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2158                 list_del(&uuid->list);
2159                 kfree(uuid);
2160         }
2161 }
2162
2163 void hci_link_keys_clear(struct hci_dev *hdev)
2164 {
2165         struct link_key *key;
2166
2167         list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2168                 list_del_rcu(&key->list);
2169                 kfree_rcu(key, rcu);
2170         }
2171 }
2172
2173 void hci_smp_ltks_clear(struct hci_dev *hdev)
2174 {
2175         struct smp_ltk *k;
2176
2177         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2178                 list_del_rcu(&k->list);
2179                 kfree_rcu(k, rcu);
2180         }
2181 }
2182
2183 void hci_smp_irks_clear(struct hci_dev *hdev)
2184 {
2185         struct smp_irk *k;
2186
2187         list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2188                 list_del_rcu(&k->list);
2189                 kfree_rcu(k, rcu);
2190         }
2191 }
2192
2193 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2194 {
2195         struct link_key *k;
2196
2197         rcu_read_lock();
2198         list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2199                 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2200                         rcu_read_unlock();
2201                         return k;
2202                 }
2203         }
2204         rcu_read_unlock();
2205
2206         return NULL;
2207 }
2208
2209 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2210                                u8 key_type, u8 old_key_type)
2211 {
2212         /* Legacy key */
2213         if (key_type < 0x03)
2214                 return true;
2215
2216         /* Debug keys are insecure so don't store them persistently */
2217         if (key_type == HCI_LK_DEBUG_COMBINATION)
2218                 return false;
2219
2220         /* Changed combination key and there's no previous one */
2221         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2222                 return false;
2223
2224         /* Security mode 3 case */
2225         if (!conn)
2226                 return true;
2227
2228         /* BR/EDR key derived using SC from an LE link */
2229         if (conn->type == LE_LINK)
2230                 return true;
2231
2232         /* Neither local nor remote side had no-bonding as requirement */
2233         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2234                 return true;
2235
2236         /* Local side had dedicated bonding as requirement */
2237         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2238                 return true;
2239
2240         /* Remote side had dedicated bonding as requirement */
2241         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2242                 return true;
2243
2244         /* If none of the above criteria match, then don't store the key
2245          * persistently */
2246         return false;
2247 }
2248
2249 static u8 ltk_role(u8 type)
2250 {
2251         if (type == SMP_LTK)
2252                 return HCI_ROLE_MASTER;
2253
2254         return HCI_ROLE_SLAVE;
2255 }
2256
2257 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2258                              u8 addr_type, u8 role)
2259 {
2260         struct smp_ltk *k;
2261
2262         rcu_read_lock();
2263         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2264                 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2265                         continue;
2266
2267                 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2268                         rcu_read_unlock();
2269                         return k;
2270                 }
2271         }
2272         rcu_read_unlock();
2273
2274         return NULL;
2275 }
2276
2277 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2278 {
2279         struct smp_irk *irk;
2280
2281         rcu_read_lock();
2282         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2283                 if (!bacmp(&irk->rpa, rpa)) {
2284                         rcu_read_unlock();
2285                         return irk;
2286                 }
2287         }
2288
2289         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2290                 if (smp_irk_matches(hdev, irk->val, rpa)) {
2291                         bacpy(&irk->rpa, rpa);
2292                         rcu_read_unlock();
2293                         return irk;
2294                 }
2295         }
2296         rcu_read_unlock();
2297
2298         return NULL;
2299 }
2300
2301 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2302                                      u8 addr_type)
2303 {
2304         struct smp_irk *irk;
2305
2306         /* Identity Address must be public or static random */
2307         if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2308                 return NULL;
2309
2310         rcu_read_lock();
2311         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2312                 if (addr_type == irk->addr_type &&
2313                     bacmp(bdaddr, &irk->bdaddr) == 0) {
2314                         rcu_read_unlock();
2315                         return irk;
2316                 }
2317         }
2318         rcu_read_unlock();
2319
2320         return NULL;
2321 }
2322
2323 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2324                                   bdaddr_t *bdaddr, u8 *val, u8 type,
2325                                   u8 pin_len, bool *persistent)
2326 {
2327         struct link_key *key, *old_key;
2328         u8 old_key_type;
2329
2330         old_key = hci_find_link_key(hdev, bdaddr);
2331         if (old_key) {
2332                 old_key_type = old_key->type;
2333                 key = old_key;
2334         } else {
2335                 old_key_type = conn ? conn->key_type : 0xff;
2336                 key = kzalloc(sizeof(*key), GFP_KERNEL);
2337                 if (!key)
2338                         return NULL;
2339                 list_add_rcu(&key->list, &hdev->link_keys);
2340         }
2341
2342         BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2343
2344         /* Some buggy controller combinations generate a changed
2345          * combination key for legacy pairing even when there's no
2346          * previous key */
2347         if (type == HCI_LK_CHANGED_COMBINATION &&
2348             (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2349                 type = HCI_LK_COMBINATION;
2350                 if (conn)
2351                         conn->key_type = type;
2352         }
2353
2354         bacpy(&key->bdaddr, bdaddr);
2355         memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2356         key->pin_len = pin_len;
2357
2358         if (type == HCI_LK_CHANGED_COMBINATION)
2359                 key->type = old_key_type;
2360         else
2361                 key->type = type;
2362
2363         if (persistent)
2364                 *persistent = hci_persistent_key(hdev, conn, type,
2365                                                  old_key_type);
2366
2367         return key;
2368 }
2369
2370 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2371                             u8 addr_type, u8 type, u8 authenticated,
2372                             u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2373 {
2374         struct smp_ltk *key, *old_key;
2375         u8 role = ltk_role(type);
2376
2377         old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2378         if (old_key)
2379                 key = old_key;
2380         else {
2381                 key = kzalloc(sizeof(*key), GFP_KERNEL);
2382                 if (!key)
2383                         return NULL;
2384                 list_add_rcu(&key->list, &hdev->long_term_keys);
2385         }
2386
2387         bacpy(&key->bdaddr, bdaddr);
2388         key->bdaddr_type = addr_type;
2389         memcpy(key->val, tk, sizeof(key->val));
2390         key->authenticated = authenticated;
2391         key->ediv = ediv;
2392         key->rand = rand;
2393         key->enc_size = enc_size;
2394         key->type = type;
2395
2396         return key;
2397 }
2398
2399 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2400                             u8 addr_type, u8 val[16], bdaddr_t *rpa)
2401 {
2402         struct smp_irk *irk;
2403
2404         irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2405         if (!irk) {
2406                 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2407                 if (!irk)
2408                         return NULL;
2409
2410                 bacpy(&irk->bdaddr, bdaddr);
2411                 irk->addr_type = addr_type;
2412
2413                 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2414         }
2415
2416         memcpy(irk->val, val, 16);
2417         bacpy(&irk->rpa, rpa);
2418
2419         return irk;
2420 }
2421
2422 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2423 {
2424         struct link_key *key;
2425
2426         key = hci_find_link_key(hdev, bdaddr);
2427         if (!key)
2428                 return -ENOENT;
2429
2430         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2431
2432         list_del_rcu(&key->list);
2433         kfree_rcu(key, rcu);
2434
2435         return 0;
2436 }
2437
2438 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2439 {
2440         struct smp_ltk *k;
2441         int removed = 0;
2442
2443         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2444                 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2445                         continue;
2446
2447                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2448
2449                 list_del_rcu(&k->list);
2450                 kfree_rcu(k, rcu);
2451                 removed++;
2452         }
2453
2454         return removed ? 0 : -ENOENT;
2455 }
2456
2457 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2458 {
2459         struct smp_irk *k;
2460
2461         list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2462                 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2463                         continue;
2464
2465                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2466
2467                 list_del_rcu(&k->list);
2468                 kfree_rcu(k, rcu);
2469         }
2470 }
2471
2472 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2473 {
2474         struct smp_ltk *k;
2475         struct smp_irk *irk;
2476         u8 addr_type;
2477
2478         if (type == BDADDR_BREDR) {
2479                 if (hci_find_link_key(hdev, bdaddr))
2480                         return true;
2481                 return false;
2482         }
2483
2484         /* Convert to HCI addr type which struct smp_ltk uses */
2485         if (type == BDADDR_LE_PUBLIC)
2486                 addr_type = ADDR_LE_DEV_PUBLIC;
2487         else
2488                 addr_type = ADDR_LE_DEV_RANDOM;
2489
2490         irk = hci_get_irk(hdev, bdaddr, addr_type);
2491         if (irk) {
2492                 bdaddr = &irk->bdaddr;
2493                 addr_type = irk->addr_type;
2494         }
2495
2496         rcu_read_lock();
2497         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2498                 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2499                         rcu_read_unlock();
2500                         return true;
2501                 }
2502         }
2503         rcu_read_unlock();
2504
2505         return false;
2506 }
2507
2508 /* HCI command timer function */
2509 static void hci_cmd_timeout(struct work_struct *work)
2510 {
2511         struct hci_dev *hdev = container_of(work, struct hci_dev,
2512                                             cmd_timer.work);
2513
2514         if (hdev->sent_cmd) {
2515                 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2516                 u16 opcode = __le16_to_cpu(sent->opcode);
2517
2518                 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
2519         } else {
2520                 BT_ERR("%s command tx timeout", hdev->name);
2521         }
2522
2523         atomic_set(&hdev->cmd_cnt, 1);
2524         queue_work(hdev->workqueue, &hdev->cmd_work);
2525 }
2526
2527 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2528                                           bdaddr_t *bdaddr, u8 bdaddr_type)
2529 {
2530         struct oob_data *data;
2531
2532         list_for_each_entry(data, &hdev->remote_oob_data, list) {
2533                 if (bacmp(bdaddr, &data->bdaddr) != 0)
2534                         continue;
2535                 if (data->bdaddr_type != bdaddr_type)
2536                         continue;
2537                 return data;
2538         }
2539
2540         return NULL;
2541 }
2542
2543 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2544                                u8 bdaddr_type)
2545 {
2546         struct oob_data *data;
2547
2548         data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2549         if (!data)
2550                 return -ENOENT;
2551
2552         BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2553
2554         list_del(&data->list);
2555         kfree(data);
2556
2557         return 0;
2558 }
2559
2560 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2561 {
2562         struct oob_data *data, *n;
2563
2564         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2565                 list_del(&data->list);
2566                 kfree(data);
2567         }
2568 }
2569
2570 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2571                             u8 bdaddr_type, u8 *hash192, u8 *rand192,
2572                             u8 *hash256, u8 *rand256)
2573 {
2574         struct oob_data *data;
2575
2576         data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2577         if (!data) {
2578                 data = kmalloc(sizeof(*data), GFP_KERNEL);
2579                 if (!data)
2580                         return -ENOMEM;
2581
2582                 bacpy(&data->bdaddr, bdaddr);
2583                 data->bdaddr_type = bdaddr_type;
2584                 list_add(&data->list, &hdev->remote_oob_data);
2585         }
2586
2587         if (hash192 && rand192) {
2588                 memcpy(data->hash192, hash192, sizeof(data->hash192));
2589                 memcpy(data->rand192, rand192, sizeof(data->rand192));
2590                 if (hash256 && rand256)
2591                         data->present = 0x03;
2592         } else {
2593                 memset(data->hash192, 0, sizeof(data->hash192));
2594                 memset(data->rand192, 0, sizeof(data->rand192));
2595                 if (hash256 && rand256)
2596                         data->present = 0x02;
2597                 else
2598                         data->present = 0x00;
2599         }
2600
2601         if (hash256 && rand256) {
2602                 memcpy(data->hash256, hash256, sizeof(data->hash256));
2603                 memcpy(data->rand256, rand256, sizeof(data->rand256));
2604         } else {
2605                 memset(data->hash256, 0, sizeof(data->hash256));
2606                 memset(data->rand256, 0, sizeof(data->rand256));
2607                 if (hash192 && rand192)
2608                         data->present = 0x01;
2609         }
2610
2611         BT_DBG("%s for %pMR", hdev->name, bdaddr);
2612
2613         return 0;
2614 }
2615
2616 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2617                                          bdaddr_t *bdaddr, u8 type)
2618 {
2619         struct bdaddr_list *b;
2620
2621         list_for_each_entry(b, bdaddr_list, list) {
2622                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2623                         return b;
2624         }
2625
2626         return NULL;
2627 }
2628
2629 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2630 {
2631         struct list_head *p, *n;
2632
2633         list_for_each_safe(p, n, bdaddr_list) {
2634                 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
2635
2636                 list_del(p);
2637                 kfree(b);
2638         }
2639 }
2640
2641 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2642 {
2643         struct bdaddr_list *entry;
2644
2645         if (!bacmp(bdaddr, BDADDR_ANY))
2646                 return -EBADF;
2647
2648         if (hci_bdaddr_list_lookup(list, bdaddr, type))
2649                 return -EEXIST;
2650
2651         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2652         if (!entry)
2653                 return -ENOMEM;
2654
2655         bacpy(&entry->bdaddr, bdaddr);
2656         entry->bdaddr_type = type;
2657
2658         list_add(&entry->list, list);
2659
2660         return 0;
2661 }
2662
2663 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2664 {
2665         struct bdaddr_list *entry;
2666
2667         if (!bacmp(bdaddr, BDADDR_ANY)) {
2668                 hci_bdaddr_list_clear(list);
2669                 return 0;
2670         }
2671
2672         entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2673         if (!entry)
2674                 return -ENOENT;
2675
2676         list_del(&entry->list);
2677         kfree(entry);
2678
2679         return 0;
2680 }
2681
2682 /* This function requires the caller holds hdev->lock */
2683 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2684                                                bdaddr_t *addr, u8 addr_type)
2685 {
2686         struct hci_conn_params *params;
2687
2688         /* The conn params list only contains identity addresses */
2689         if (!hci_is_identity_address(addr, addr_type))
2690                 return NULL;
2691
2692         list_for_each_entry(params, &hdev->le_conn_params, list) {
2693                 if (bacmp(&params->addr, addr) == 0 &&
2694                     params->addr_type == addr_type) {
2695                         return params;
2696                 }
2697         }
2698
2699         return NULL;
2700 }
2701
2702 /* This function requires the caller holds hdev->lock */
2703 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2704                                                   bdaddr_t *addr, u8 addr_type)
2705 {
2706         struct hci_conn_params *param;
2707
2708         /* The list only contains identity addresses */
2709         if (!hci_is_identity_address(addr, addr_type))
2710                 return NULL;
2711
2712         list_for_each_entry(param, list, action) {
2713                 if (bacmp(&param->addr, addr) == 0 &&
2714                     param->addr_type == addr_type)
2715                         return param;
2716         }
2717
2718         return NULL;
2719 }
2720
2721 /* This function requires the caller holds hdev->lock */
2722 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2723                                             bdaddr_t *addr, u8 addr_type)
2724 {
2725         struct hci_conn_params *params;
2726
2727         if (!hci_is_identity_address(addr, addr_type))
2728                 return NULL;
2729
2730         params = hci_conn_params_lookup(hdev, addr, addr_type);
2731         if (params)
2732                 return params;
2733
2734         params = kzalloc(sizeof(*params), GFP_KERNEL);
2735         if (!params) {
2736                 BT_ERR("Out of memory");
2737                 return NULL;
2738         }
2739
2740         bacpy(&params->addr, addr);
2741         params->addr_type = addr_type;
2742
2743         list_add(&params->list, &hdev->le_conn_params);
2744         INIT_LIST_HEAD(&params->action);
2745
2746         params->conn_min_interval = hdev->le_conn_min_interval;
2747         params->conn_max_interval = hdev->le_conn_max_interval;
2748         params->conn_latency = hdev->le_conn_latency;
2749         params->supervision_timeout = hdev->le_supv_timeout;
2750         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2751
2752         BT_DBG("addr %pMR (type %u)", addr, addr_type);
2753
2754         return params;
2755 }
2756
2757 static void hci_conn_params_free(struct hci_conn_params *params)
2758 {
2759         if (params->conn) {
2760                 hci_conn_drop(params->conn);
2761                 hci_conn_put(params->conn);
2762         }
2763
2764         list_del(&params->action);
2765         list_del(&params->list);
2766         kfree(params);
2767 }
2768
2769 /* This function requires the caller holds hdev->lock */
2770 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2771 {
2772         struct hci_conn_params *params;
2773
2774         params = hci_conn_params_lookup(hdev, addr, addr_type);
2775         if (!params)
2776                 return;
2777
2778         hci_conn_params_free(params);
2779
2780         hci_update_background_scan(hdev);
2781
2782         BT_DBG("addr %pMR (type %u)", addr, addr_type);
2783 }
2784
2785 /* This function requires the caller holds hdev->lock */
2786 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
2787 {
2788         struct hci_conn_params *params, *tmp;
2789
2790         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
2791                 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2792                         continue;
2793                 list_del(&params->list);
2794                 kfree(params);
2795         }
2796
2797         BT_DBG("All LE disabled connection parameters were removed");
2798 }
2799
2800 /* This function requires the caller holds hdev->lock */
2801 void hci_conn_params_clear_all(struct hci_dev *hdev)
2802 {
2803         struct hci_conn_params *params, *tmp;
2804
2805         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2806                 hci_conn_params_free(params);
2807
2808         hci_update_background_scan(hdev);
2809
2810         BT_DBG("All LE connection parameters were removed");
2811 }
2812
2813 static void inquiry_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2814 {
2815         if (status) {
2816                 BT_ERR("Failed to start inquiry: status %d", status);
2817
2818                 hci_dev_lock(hdev);
2819                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2820                 hci_dev_unlock(hdev);
2821                 return;
2822         }
2823 }
2824
2825 static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status,
2826                                           u16 opcode)
2827 {
2828         /* General inquiry access code (GIAC) */
2829         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2830         struct hci_cp_inquiry cp;
2831         int err;
2832
2833         if (status) {
2834                 BT_ERR("Failed to disable LE scanning: status %d", status);
2835                 return;
2836         }
2837
2838         hdev->discovery.scan_start = 0;
2839
2840         switch (hdev->discovery.type) {
2841         case DISCOV_TYPE_LE:
2842                 hci_dev_lock(hdev);
2843                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2844                 hci_dev_unlock(hdev);
2845                 break;
2846
2847         case DISCOV_TYPE_INTERLEAVED:
2848                 hci_dev_lock(hdev);
2849
2850                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
2851                              &hdev->quirks)) {
2852                         /* If we were running LE only scan, change discovery
2853                          * state. If we were running both LE and BR/EDR inquiry
2854                          * simultaneously, and BR/EDR inquiry is already
2855                          * finished, stop discovery, otherwise BR/EDR inquiry
2856                          * will stop discovery when finished.
2857                          */
2858                         if (!test_bit(HCI_INQUIRY, &hdev->flags))
2859                                 hci_discovery_set_state(hdev,
2860                                                         DISCOVERY_STOPPED);
2861                 } else {
2862                         struct hci_request req;
2863
2864                         hci_inquiry_cache_flush(hdev);
2865
2866                         hci_req_init(&req, hdev);
2867
2868                         memset(&cp, 0, sizeof(cp));
2869                         memcpy(&cp.lap, lap, sizeof(cp.lap));
2870                         cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
2871                         hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
2872
2873                         err = hci_req_run(&req, inquiry_complete);
2874                         if (err) {
2875                                 BT_ERR("Inquiry request failed: err %d", err);
2876                                 hci_discovery_set_state(hdev,
2877                                                         DISCOVERY_STOPPED);
2878                         }
2879                 }
2880
2881                 hci_dev_unlock(hdev);
2882                 break;
2883         }
2884 }
2885
2886 static void le_scan_disable_work(struct work_struct *work)
2887 {
2888         struct hci_dev *hdev = container_of(work, struct hci_dev,
2889                                             le_scan_disable.work);
2890         struct hci_request req;
2891         int err;
2892
2893         BT_DBG("%s", hdev->name);
2894
2895         cancel_delayed_work_sync(&hdev->le_scan_restart);
2896
2897         hci_req_init(&req, hdev);
2898
2899         hci_req_add_le_scan_disable(&req);
2900
2901         err = hci_req_run(&req, le_scan_disable_work_complete);
2902         if (err)
2903                 BT_ERR("Disable LE scanning request failed: err %d", err);
2904 }
2905
2906 static void le_scan_restart_work_complete(struct hci_dev *hdev, u8 status,
2907                                           u16 opcode)
2908 {
2909         unsigned long timeout, duration, scan_start, now;
2910
2911         BT_DBG("%s", hdev->name);
2912
2913         if (status) {
2914                 BT_ERR("Failed to restart LE scan: status %d", status);
2915                 return;
2916         }
2917
2918         if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
2919             !hdev->discovery.scan_start)
2920                 return;
2921
2922         /* When the scan was started, hdev->le_scan_disable has been queued
2923          * after duration from scan_start. During scan restart this job
2924          * has been canceled, and we need to queue it again after proper
2925          * timeout, to make sure that scan does not run indefinitely.
2926          */
2927         duration = hdev->discovery.scan_duration;
2928         scan_start = hdev->discovery.scan_start;
2929         now = jiffies;
2930         if (now - scan_start <= duration) {
2931                 int elapsed;
2932
2933                 if (now >= scan_start)
2934                         elapsed = now - scan_start;
2935                 else
2936                         elapsed = ULONG_MAX - scan_start + now;
2937
2938                 timeout = duration - elapsed;
2939         } else {
2940                 timeout = 0;
2941         }
2942         queue_delayed_work(hdev->workqueue,
2943                            &hdev->le_scan_disable, timeout);
2944 }
2945
2946 static void le_scan_restart_work(struct work_struct *work)
2947 {
2948         struct hci_dev *hdev = container_of(work, struct hci_dev,
2949                                             le_scan_restart.work);
2950         struct hci_request req;
2951         struct hci_cp_le_set_scan_enable cp;
2952         int err;
2953
2954         BT_DBG("%s", hdev->name);
2955
2956         /* If controller is not scanning we are done. */
2957         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
2958                 return;
2959
2960         hci_req_init(&req, hdev);
2961
2962         hci_req_add_le_scan_disable(&req);
2963
2964         memset(&cp, 0, sizeof(cp));
2965         cp.enable = LE_SCAN_ENABLE;
2966         cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2967         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2968
2969         err = hci_req_run(&req, le_scan_restart_work_complete);
2970         if (err)
2971                 BT_ERR("Restart LE scan request failed: err %d", err);
2972 }
2973
2974 /* Copy the Identity Address of the controller.
2975  *
2976  * If the controller has a public BD_ADDR, then by default use that one.
2977  * If this is a LE only controller without a public address, default to
2978  * the static random address.
2979  *
2980  * For debugging purposes it is possible to force controllers with a
2981  * public address to use the static random address instead.
2982  *
2983  * In case BR/EDR has been disabled on a dual-mode controller and
2984  * userspace has configured a static address, then that address
2985  * becomes the identity address instead of the public BR/EDR address.
2986  */
2987 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2988                                u8 *bdaddr_type)
2989 {
2990         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
2991             !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
2992             (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
2993              bacmp(&hdev->static_addr, BDADDR_ANY))) {
2994                 bacpy(bdaddr, &hdev->static_addr);
2995                 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2996         } else {
2997                 bacpy(bdaddr, &hdev->bdaddr);
2998                 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
2999         }
3000 }
3001
3002 /* Alloc HCI device */
3003 struct hci_dev *hci_alloc_dev(void)
3004 {
3005         struct hci_dev *hdev;
3006
3007         hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3008         if (!hdev)
3009                 return NULL;
3010
3011         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3012         hdev->esco_type = (ESCO_HV1);
3013         hdev->link_mode = (HCI_LM_ACCEPT);
3014         hdev->num_iac = 0x01;           /* One IAC support is mandatory */
3015         hdev->io_capability = 0x03;     /* No Input No Output */
3016         hdev->manufacturer = 0xffff;    /* Default to internal use */
3017         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3018         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3019
3020         hdev->sniff_max_interval = 800;
3021         hdev->sniff_min_interval = 80;
3022
3023         hdev->le_adv_channel_map = 0x07;
3024         hdev->le_adv_min_interval = 0x0800;
3025         hdev->le_adv_max_interval = 0x0800;
3026         hdev->le_scan_interval = 0x0060;
3027         hdev->le_scan_window = 0x0030;
3028         hdev->le_conn_min_interval = 0x0028;
3029         hdev->le_conn_max_interval = 0x0038;
3030         hdev->le_conn_latency = 0x0000;
3031         hdev->le_supv_timeout = 0x002a;
3032         hdev->le_def_tx_len = 0x001b;
3033         hdev->le_def_tx_time = 0x0148;
3034         hdev->le_max_tx_len = 0x001b;
3035         hdev->le_max_tx_time = 0x0148;
3036         hdev->le_max_rx_len = 0x001b;
3037         hdev->le_max_rx_time = 0x0148;
3038
3039         hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3040         hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3041         hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3042         hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3043
3044         mutex_init(&hdev->lock);
3045         mutex_init(&hdev->req_lock);
3046
3047         INIT_LIST_HEAD(&hdev->mgmt_pending);
3048         INIT_LIST_HEAD(&hdev->blacklist);
3049         INIT_LIST_HEAD(&hdev->whitelist);
3050         INIT_LIST_HEAD(&hdev->uuids);
3051         INIT_LIST_HEAD(&hdev->link_keys);
3052         INIT_LIST_HEAD(&hdev->long_term_keys);
3053         INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3054         INIT_LIST_HEAD(&hdev->remote_oob_data);
3055         INIT_LIST_HEAD(&hdev->le_white_list);
3056         INIT_LIST_HEAD(&hdev->le_conn_params);
3057         INIT_LIST_HEAD(&hdev->pend_le_conns);
3058         INIT_LIST_HEAD(&hdev->pend_le_reports);
3059         INIT_LIST_HEAD(&hdev->conn_hash.list);
3060
3061         INIT_WORK(&hdev->rx_work, hci_rx_work);
3062         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3063         INIT_WORK(&hdev->tx_work, hci_tx_work);
3064         INIT_WORK(&hdev->power_on, hci_power_on);
3065         INIT_WORK(&hdev->error_reset, hci_error_reset);
3066
3067         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3068         INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
3069         INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
3070         INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
3071
3072         skb_queue_head_init(&hdev->rx_q);
3073         skb_queue_head_init(&hdev->cmd_q);
3074         skb_queue_head_init(&hdev->raw_q);
3075
3076         init_waitqueue_head(&hdev->req_wait_q);
3077
3078         INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3079
3080         hci_init_sysfs(hdev);
3081         discovery_init(hdev);
3082         adv_info_init(hdev);
3083
3084         return hdev;
3085 }
3086 EXPORT_SYMBOL(hci_alloc_dev);
3087
3088 /* Free HCI device */
3089 void hci_free_dev(struct hci_dev *hdev)
3090 {
3091         /* will free via device release */
3092         put_device(&hdev->dev);
3093 }
3094 EXPORT_SYMBOL(hci_free_dev);
3095
3096 /* Register HCI device */
3097 int hci_register_dev(struct hci_dev *hdev)
3098 {
3099         int id, error;
3100
3101         if (!hdev->open || !hdev->close || !hdev->send)
3102                 return -EINVAL;
3103
3104         /* Do not allow HCI_AMP devices to register at index 0,
3105          * so the index can be used as the AMP controller ID.
3106          */
3107         switch (hdev->dev_type) {
3108         case HCI_BREDR:
3109                 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3110                 break;
3111         case HCI_AMP:
3112                 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3113                 break;
3114         default:
3115                 return -EINVAL;
3116         }
3117
3118         if (id < 0)
3119                 return id;
3120
3121         sprintf(hdev->name, "hci%d", id);
3122         hdev->id = id;
3123
3124         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3125
3126         hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3127                                           WQ_MEM_RECLAIM, 1, hdev->name);
3128         if (!hdev->workqueue) {
3129                 error = -ENOMEM;
3130                 goto err;
3131         }
3132
3133         hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3134                                               WQ_MEM_RECLAIM, 1, hdev->name);
3135         if (!hdev->req_workqueue) {
3136                 destroy_workqueue(hdev->workqueue);
3137                 error = -ENOMEM;
3138                 goto err;
3139         }
3140
3141         if (!IS_ERR_OR_NULL(bt_debugfs))
3142                 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3143
3144         dev_set_name(&hdev->dev, "%s", hdev->name);
3145
3146         error = device_add(&hdev->dev);
3147         if (error < 0)
3148                 goto err_wqueue;
3149
3150         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3151                                     RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3152                                     hdev);
3153         if (hdev->rfkill) {
3154                 if (rfkill_register(hdev->rfkill) < 0) {
3155                         rfkill_destroy(hdev->rfkill);
3156                         hdev->rfkill = NULL;
3157                 }
3158         }
3159
3160         if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3161                 hci_dev_set_flag(hdev, HCI_RFKILLED);
3162
3163         hci_dev_set_flag(hdev, HCI_SETUP);
3164         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3165
3166         if (hdev->dev_type == HCI_BREDR) {
3167                 /* Assume BR/EDR support until proven otherwise (such as
3168                  * through reading supported features during init.
3169                  */
3170                 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3171         }
3172
3173         write_lock(&hci_dev_list_lock);
3174         list_add(&hdev->list, &hci_dev_list);
3175         write_unlock(&hci_dev_list_lock);
3176
3177         /* Devices that are marked for raw-only usage are unconfigured
3178          * and should not be included in normal operation.
3179          */
3180         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3181                 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3182
3183         hci_notify(hdev, HCI_DEV_REG);
3184         hci_dev_hold(hdev);
3185
3186         queue_work(hdev->req_workqueue, &hdev->power_on);
3187
3188         return id;
3189
3190 err_wqueue:
3191         destroy_workqueue(hdev->workqueue);
3192         destroy_workqueue(hdev->req_workqueue);
3193 err:
3194         ida_simple_remove(&hci_index_ida, hdev->id);
3195
3196         return error;
3197 }
3198 EXPORT_SYMBOL(hci_register_dev);
3199
3200 /* Unregister HCI device */
3201 void hci_unregister_dev(struct hci_dev *hdev)
3202 {
3203         int i, id;
3204
3205         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3206
3207         hci_dev_set_flag(hdev, HCI_UNREGISTER);
3208
3209         id = hdev->id;
3210
3211         write_lock(&hci_dev_list_lock);
3212         list_del(&hdev->list);
3213         write_unlock(&hci_dev_list_lock);
3214
3215         hci_dev_do_close(hdev);
3216
3217         for (i = 0; i < NUM_REASSEMBLY; i++)
3218                 kfree_skb(hdev->reassembly[i]);
3219
3220         cancel_work_sync(&hdev->power_on);
3221
3222         if (!test_bit(HCI_INIT, &hdev->flags) &&
3223             !hci_dev_test_flag(hdev, HCI_SETUP) &&
3224             !hci_dev_test_flag(hdev, HCI_CONFIG)) {
3225                 hci_dev_lock(hdev);
3226                 mgmt_index_removed(hdev);
3227                 hci_dev_unlock(hdev);
3228         }
3229
3230         /* mgmt_index_removed should take care of emptying the
3231          * pending list */
3232         BUG_ON(!list_empty(&hdev->mgmt_pending));
3233
3234         hci_notify(hdev, HCI_DEV_UNREG);
3235
3236         if (hdev->rfkill) {
3237                 rfkill_unregister(hdev->rfkill);
3238                 rfkill_destroy(hdev->rfkill);
3239         }
3240
3241         device_del(&hdev->dev);
3242
3243         debugfs_remove_recursive(hdev->debugfs);
3244
3245         destroy_workqueue(hdev->workqueue);
3246         destroy_workqueue(hdev->req_workqueue);
3247
3248         hci_dev_lock(hdev);
3249         hci_bdaddr_list_clear(&hdev->blacklist);
3250         hci_bdaddr_list_clear(&hdev->whitelist);
3251         hci_uuids_clear(hdev);
3252         hci_link_keys_clear(hdev);
3253         hci_smp_ltks_clear(hdev);
3254         hci_smp_irks_clear(hdev);
3255         hci_remote_oob_data_clear(hdev);
3256         hci_bdaddr_list_clear(&hdev->le_white_list);
3257         hci_conn_params_clear_all(hdev);
3258         hci_discovery_filter_clear(hdev);
3259         hci_dev_unlock(hdev);
3260
3261         hci_dev_put(hdev);
3262
3263         ida_simple_remove(&hci_index_ida, id);
3264 }
3265 EXPORT_SYMBOL(hci_unregister_dev);
3266
3267 /* Suspend HCI device */
3268 int hci_suspend_dev(struct hci_dev *hdev)
3269 {
3270         hci_notify(hdev, HCI_DEV_SUSPEND);
3271         return 0;
3272 }
3273 EXPORT_SYMBOL(hci_suspend_dev);
3274
3275 /* Resume HCI device */
3276 int hci_resume_dev(struct hci_dev *hdev)
3277 {
3278         hci_notify(hdev, HCI_DEV_RESUME);
3279         return 0;
3280 }
3281 EXPORT_SYMBOL(hci_resume_dev);
3282
3283 /* Reset HCI device */
3284 int hci_reset_dev(struct hci_dev *hdev)
3285 {
3286         const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3287         struct sk_buff *skb;
3288
3289         skb = bt_skb_alloc(3, GFP_ATOMIC);
3290         if (!skb)
3291                 return -ENOMEM;
3292
3293         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3294         memcpy(skb_put(skb, 3), hw_err, 3);
3295
3296         /* Send Hardware Error to upper stack */
3297         return hci_recv_frame(hdev, skb);
3298 }
3299 EXPORT_SYMBOL(hci_reset_dev);
3300
3301 /* Receive frame from HCI drivers */
3302 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
3303 {
3304         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
3305                       && !test_bit(HCI_INIT, &hdev->flags))) {
3306                 kfree_skb(skb);
3307                 return -ENXIO;
3308         }
3309
3310         /* Incoming skb */
3311         bt_cb(skb)->incoming = 1;
3312
3313         /* Time stamp */
3314         __net_timestamp(skb);
3315
3316         skb_queue_tail(&hdev->rx_q, skb);
3317         queue_work(hdev->workqueue, &hdev->rx_work);
3318
3319         return 0;
3320 }
3321 EXPORT_SYMBOL(hci_recv_frame);
3322
3323 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
3324                           int count, __u8 index)
3325 {
3326         int len = 0;
3327         int hlen = 0;
3328         int remain = count;
3329         struct sk_buff *skb;
3330         struct bt_skb_cb *scb;
3331
3332         if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
3333             index >= NUM_REASSEMBLY)
3334                 return -EILSEQ;
3335
3336         skb = hdev->reassembly[index];
3337
3338         if (!skb) {
3339                 switch (type) {
3340                 case HCI_ACLDATA_PKT:
3341                         len = HCI_MAX_FRAME_SIZE;
3342                         hlen = HCI_ACL_HDR_SIZE;
3343                         break;
3344                 case HCI_EVENT_PKT:
3345                         len = HCI_MAX_EVENT_SIZE;
3346                         hlen = HCI_EVENT_HDR_SIZE;
3347                         break;
3348                 case HCI_SCODATA_PKT:
3349                         len = HCI_MAX_SCO_SIZE;
3350                         hlen = HCI_SCO_HDR_SIZE;
3351                         break;
3352                 }
3353
3354                 skb = bt_skb_alloc(len, GFP_ATOMIC);
3355                 if (!skb)
3356                         return -ENOMEM;
3357
3358                 scb = (void *) skb->cb;
3359                 scb->expect = hlen;
3360                 scb->pkt_type = type;
3361
3362                 hdev->reassembly[index] = skb;
3363         }
3364
3365         while (count) {
3366                 scb = (void *) skb->cb;
3367                 len = min_t(uint, scb->expect, count);
3368
3369                 memcpy(skb_put(skb, len), data, len);
3370
3371                 count -= len;
3372                 data += len;
3373                 scb->expect -= len;
3374                 remain = count;
3375
3376                 switch (type) {
3377                 case HCI_EVENT_PKT:
3378                         if (skb->len == HCI_EVENT_HDR_SIZE) {
3379                                 struct hci_event_hdr *h = hci_event_hdr(skb);
3380                                 scb->expect = h->plen;
3381
3382                                 if (skb_tailroom(skb) < scb->expect) {
3383                                         kfree_skb(skb);
3384                                         hdev->reassembly[index] = NULL;
3385                                         return -ENOMEM;
3386                                 }
3387                         }
3388                         break;
3389
3390                 case HCI_ACLDATA_PKT:
3391                         if (skb->len  == HCI_ACL_HDR_SIZE) {
3392                                 struct hci_acl_hdr *h = hci_acl_hdr(skb);
3393                                 scb->expect = __le16_to_cpu(h->dlen);
3394
3395                                 if (skb_tailroom(skb) < scb->expect) {
3396                                         kfree_skb(skb);
3397                                         hdev->reassembly[index] = NULL;
3398                                         return -ENOMEM;
3399                                 }
3400                         }
3401                         break;
3402
3403                 case HCI_SCODATA_PKT:
3404                         if (skb->len == HCI_SCO_HDR_SIZE) {
3405                                 struct hci_sco_hdr *h = hci_sco_hdr(skb);
3406                                 scb->expect = h->dlen;
3407
3408                                 if (skb_tailroom(skb) < scb->expect) {
3409                                         kfree_skb(skb);
3410                                         hdev->reassembly[index] = NULL;
3411                                         return -ENOMEM;
3412                                 }
3413                         }
3414                         break;
3415                 }
3416
3417                 if (scb->expect == 0) {
3418                         /* Complete frame */
3419
3420                         bt_cb(skb)->pkt_type = type;
3421                         hci_recv_frame(hdev, skb);
3422
3423                         hdev->reassembly[index] = NULL;
3424                         return remain;
3425                 }
3426         }
3427
3428         return remain;
3429 }
3430
3431 #define STREAM_REASSEMBLY 0
3432
3433 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
3434 {
3435         int type;
3436         int rem = 0;
3437
3438         while (count) {
3439                 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
3440
3441                 if (!skb) {
3442                         struct { char type; } *pkt;
3443
3444                         /* Start of the frame */
3445                         pkt = data;
3446                         type = pkt->type;
3447
3448                         data++;
3449                         count--;
3450                 } else
3451                         type = bt_cb(skb)->pkt_type;
3452
3453                 rem = hci_reassembly(hdev, type, data, count,
3454                                      STREAM_REASSEMBLY);
3455                 if (rem < 0)
3456                         return rem;
3457
3458                 data += (count - rem);
3459                 count = rem;
3460         }
3461
3462         return rem;
3463 }
3464 EXPORT_SYMBOL(hci_recv_stream_fragment);
3465
3466 /* ---- Interface to upper protocols ---- */
3467
3468 int hci_register_cb(struct hci_cb *cb)
3469 {
3470         BT_DBG("%p name %s", cb, cb->name);
3471
3472         mutex_lock(&hci_cb_list_lock);
3473         list_add_tail(&cb->list, &hci_cb_list);
3474         mutex_unlock(&hci_cb_list_lock);
3475
3476         return 0;
3477 }
3478 EXPORT_SYMBOL(hci_register_cb);
3479
3480 int hci_unregister_cb(struct hci_cb *cb)
3481 {
3482         BT_DBG("%p name %s", cb, cb->name);
3483
3484         mutex_lock(&hci_cb_list_lock);
3485         list_del(&cb->list);
3486         mutex_unlock(&hci_cb_list_lock);
3487
3488         return 0;
3489 }
3490 EXPORT_SYMBOL(hci_unregister_cb);
3491
3492 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
3493 {
3494         int err;
3495
3496         BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
3497
3498         /* Time stamp */
3499         __net_timestamp(skb);
3500
3501         /* Send copy to monitor */
3502         hci_send_to_monitor(hdev, skb);
3503
3504         if (atomic_read(&hdev->promisc)) {
3505                 /* Send copy to the sockets */
3506                 hci_send_to_sock(hdev, skb);
3507         }
3508
3509         /* Get rid of skb owner, prior to sending to the driver. */
3510         skb_orphan(skb);
3511
3512         err = hdev->send(hdev, skb);
3513         if (err < 0) {
3514                 BT_ERR("%s sending frame failed (%d)", hdev->name, err);
3515                 kfree_skb(skb);
3516         }
3517 }
3518
3519 /* Send HCI command */
3520 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3521                  const void *param)
3522 {
3523         struct sk_buff *skb;
3524
3525         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3526
3527         skb = hci_prepare_cmd(hdev, opcode, plen, param);
3528         if (!skb) {
3529                 BT_ERR("%s no memory for command", hdev->name);
3530                 return -ENOMEM;
3531         }
3532
3533         /* Stand-alone HCI commands must be flagged as
3534          * single-command requests.
3535          */
3536         bt_cb(skb)->req.start = true;
3537
3538         skb_queue_tail(&hdev->cmd_q, skb);
3539         queue_work(hdev->workqueue, &hdev->cmd_work);
3540
3541         return 0;
3542 }
3543
3544 /* Get data from the previously sent command */
3545 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
3546 {
3547         struct hci_command_hdr *hdr;
3548
3549         if (!hdev->sent_cmd)
3550                 return NULL;
3551
3552         hdr = (void *) hdev->sent_cmd->data;
3553
3554         if (hdr->opcode != cpu_to_le16(opcode))
3555                 return NULL;
3556
3557         BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3558
3559         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3560 }
3561
3562 /* Send ACL data */
3563 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3564 {
3565         struct hci_acl_hdr *hdr;
3566         int len = skb->len;
3567
3568         skb_push(skb, HCI_ACL_HDR_SIZE);
3569         skb_reset_transport_header(skb);
3570         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3571         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3572         hdr->dlen   = cpu_to_le16(len);
3573 }
3574
3575 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
3576                           struct sk_buff *skb, __u16 flags)
3577 {
3578         struct hci_conn *conn = chan->conn;
3579         struct hci_dev *hdev = conn->hdev;
3580         struct sk_buff *list;
3581
3582         skb->len = skb_headlen(skb);
3583         skb->data_len = 0;
3584
3585         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
3586
3587         switch (hdev->dev_type) {
3588         case HCI_BREDR:
3589                 hci_add_acl_hdr(skb, conn->handle, flags);
3590                 break;
3591         case HCI_AMP:
3592                 hci_add_acl_hdr(skb, chan->handle, flags);
3593                 break;
3594         default:
3595                 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3596                 return;
3597         }
3598
3599         list = skb_shinfo(skb)->frag_list;
3600         if (!list) {
3601                 /* Non fragmented */
3602                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3603
3604                 skb_queue_tail(queue, skb);
3605         } else {
3606                 /* Fragmented */
3607                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3608
3609                 skb_shinfo(skb)->frag_list = NULL;
3610
3611                 /* Queue all fragments atomically. We need to use spin_lock_bh
3612                  * here because of 6LoWPAN links, as there this function is
3613                  * called from softirq and using normal spin lock could cause
3614                  * deadlocks.
3615                  */
3616                 spin_lock_bh(&queue->lock);
3617
3618                 __skb_queue_tail(queue, skb);
3619
3620                 flags &= ~ACL_START;
3621                 flags |= ACL_CONT;
3622                 do {
3623                         skb = list; list = list->next;
3624
3625                         bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
3626                         hci_add_acl_hdr(skb, conn->handle, flags);
3627
3628                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3629
3630                         __skb_queue_tail(queue, skb);
3631                 } while (list);
3632
3633                 spin_unlock_bh(&queue->lock);
3634         }
3635 }
3636
3637 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3638 {
3639         struct hci_dev *hdev = chan->conn->hdev;
3640
3641         BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
3642
3643         hci_queue_acl(chan, &chan->data_q, skb, flags);
3644
3645         queue_work(hdev->workqueue, &hdev->tx_work);
3646 }
3647
3648 /* Send SCO data */
3649 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
3650 {
3651         struct hci_dev *hdev = conn->hdev;
3652         struct hci_sco_hdr hdr;
3653
3654         BT_DBG("%s len %d", hdev->name, skb->len);
3655
3656         hdr.handle = cpu_to_le16(conn->handle);
3657         hdr.dlen   = skb->len;
3658
3659         skb_push(skb, HCI_SCO_HDR_SIZE);
3660         skb_reset_transport_header(skb);
3661         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
3662
3663         bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
3664
3665         skb_queue_tail(&conn->data_q, skb);
3666         queue_work(hdev->workqueue, &hdev->tx_work);
3667 }
3668
3669 /* ---- HCI TX task (outgoing data) ---- */
3670
3671 /* HCI Connection scheduler */
3672 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3673                                      int *quote)
3674 {
3675         struct hci_conn_hash *h = &hdev->conn_hash;
3676         struct hci_conn *conn = NULL, *c;
3677         unsigned int num = 0, min = ~0;
3678
3679         /* We don't have to lock device here. Connections are always
3680          * added and removed with TX task disabled. */
3681
3682         rcu_read_lock();
3683
3684         list_for_each_entry_rcu(c, &h->list, list) {
3685                 if (c->type != type || skb_queue_empty(&c->data_q))
3686                         continue;
3687
3688                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3689                         continue;
3690
3691                 num++;
3692
3693                 if (c->sent < min) {
3694                         min  = c->sent;
3695                         conn = c;
3696                 }
3697
3698                 if (hci_conn_num(hdev, type) == num)
3699                         break;
3700         }
3701
3702         rcu_read_unlock();
3703
3704         if (conn) {
3705                 int cnt, q;
3706
3707                 switch (conn->type) {
3708                 case ACL_LINK:
3709                         cnt = hdev->acl_cnt;
3710                         break;
3711                 case SCO_LINK:
3712                 case ESCO_LINK:
3713                         cnt = hdev->sco_cnt;
3714                         break;
3715                 case LE_LINK:
3716                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3717                         break;
3718                 default:
3719                         cnt = 0;
3720                         BT_ERR("Unknown link type");
3721                 }
3722
3723                 q = cnt / num;
3724                 *quote = q ? q : 1;
3725         } else
3726                 *quote = 0;
3727
3728         BT_DBG("conn %p quote %d", conn, *quote);
3729         return conn;
3730 }
3731
3732 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
3733 {
3734         struct hci_conn_hash *h = &hdev->conn_hash;
3735         struct hci_conn *c;
3736
3737         BT_ERR("%s link tx timeout", hdev->name);
3738
3739         rcu_read_lock();
3740
3741         /* Kill stalled connections */
3742         list_for_each_entry_rcu(c, &h->list, list) {
3743                 if (c->type == type && c->sent) {
3744                         BT_ERR("%s killing stalled connection %pMR",
3745                                hdev->name, &c->dst);
3746                         hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3747                 }
3748         }
3749
3750         rcu_read_unlock();
3751 }
3752
3753 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3754                                       int *quote)
3755 {
3756         struct hci_conn_hash *h = &hdev->conn_hash;
3757         struct hci_chan *chan = NULL;
3758         unsigned int num = 0, min = ~0, cur_prio = 0;
3759         struct hci_conn *conn;
3760         int cnt, q, conn_num = 0;
3761
3762         BT_DBG("%s", hdev->name);
3763
3764         rcu_read_lock();
3765
3766         list_for_each_entry_rcu(conn, &h->list, list) {
3767                 struct hci_chan *tmp;
3768
3769                 if (conn->type != type)
3770                         continue;
3771
3772                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3773                         continue;
3774
3775                 conn_num++;
3776
3777                 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
3778                         struct sk_buff *skb;
3779
3780                         if (skb_queue_empty(&tmp->data_q))
3781                                 continue;
3782
3783                         skb = skb_peek(&tmp->data_q);
3784                         if (skb->priority < cur_prio)
3785                                 continue;
3786
3787                         if (skb->priority > cur_prio) {
3788                                 num = 0;
3789                                 min = ~0;
3790                                 cur_prio = skb->priority;
3791                         }
3792
3793                         num++;
3794
3795                         if (conn->sent < min) {
3796                                 min  = conn->sent;
3797                                 chan = tmp;
3798                         }
3799                 }
3800
3801                 if (hci_conn_num(hdev, type) == conn_num)
3802                         break;
3803         }
3804
3805         rcu_read_unlock();
3806
3807         if (!chan)
3808                 return NULL;
3809
3810         switch (chan->conn->type) {
3811         case ACL_LINK:
3812                 cnt = hdev->acl_cnt;
3813                 break;
3814         case AMP_LINK:
3815                 cnt = hdev->block_cnt;
3816                 break;
3817         case SCO_LINK:
3818         case ESCO_LINK:
3819                 cnt = hdev->sco_cnt;
3820                 break;
3821         case LE_LINK:
3822                 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3823                 break;
3824         default:
3825                 cnt = 0;
3826                 BT_ERR("Unknown link type");
3827         }
3828
3829         q = cnt / num;
3830         *quote = q ? q : 1;
3831         BT_DBG("chan %p quote %d", chan, *quote);
3832         return chan;
3833 }
3834
3835 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3836 {
3837         struct hci_conn_hash *h = &hdev->conn_hash;
3838         struct hci_conn *conn;
3839         int num = 0;
3840
3841         BT_DBG("%s", hdev->name);
3842
3843         rcu_read_lock();
3844
3845         list_for_each_entry_rcu(conn, &h->list, list) {
3846                 struct hci_chan *chan;
3847
3848                 if (conn->type != type)
3849                         continue;
3850
3851                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3852                         continue;
3853
3854                 num++;
3855
3856                 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
3857                         struct sk_buff *skb;
3858
3859                         if (chan->sent) {
3860                                 chan->sent = 0;
3861                                 continue;
3862                         }
3863
3864                         if (skb_queue_empty(&chan->data_q))
3865                                 continue;
3866
3867                         skb = skb_peek(&chan->data_q);
3868                         if (skb->priority >= HCI_PRIO_MAX - 1)
3869                                 continue;
3870
3871                         skb->priority = HCI_PRIO_MAX - 1;
3872
3873                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
3874                                skb->priority);
3875                 }
3876
3877                 if (hci_conn_num(hdev, type) == num)
3878                         break;
3879         }
3880
3881         rcu_read_unlock();
3882
3883 }
3884
3885 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3886 {
3887         /* Calculate count of blocks used by this packet */
3888         return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3889 }
3890
3891 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
3892 {
3893         if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
3894                 /* ACL tx timeout must be longer than maximum
3895                  * link supervision timeout (40.9 seconds) */
3896                 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
3897                                        HCI_ACL_TX_TIMEOUT))
3898                         hci_link_tx_to(hdev, ACL_LINK);
3899         }
3900 }
3901
3902 static void hci_sched_acl_pkt(struct hci_dev *hdev)
3903 {
3904         unsigned int cnt = hdev->acl_cnt;
3905         struct hci_chan *chan;
3906         struct sk_buff *skb;
3907         int quote;
3908
3909         __check_timeout(hdev, cnt);
3910
3911         while (hdev->acl_cnt &&
3912                (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3913                 u32 priority = (skb_peek(&chan->data_q))->priority;
3914                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3915                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3916                                skb->len, skb->priority);
3917
3918                         /* Stop if priority has changed */
3919                         if (skb->priority < priority)
3920                                 break;
3921
3922                         skb = skb_dequeue(&chan->data_q);
3923
3924                         hci_conn_enter_active_mode(chan->conn,
3925                                                    bt_cb(skb)->force_active);
3926
3927                         hci_send_frame(hdev, skb);
3928                         hdev->acl_last_tx = jiffies;
3929
3930                         hdev->acl_cnt--;
3931                         chan->sent++;
3932                         chan->conn->sent++;
3933                 }
3934         }
3935
3936         if (cnt != hdev->acl_cnt)
3937                 hci_prio_recalculate(hdev, ACL_LINK);
3938 }
3939
3940 static void hci_sched_acl_blk(struct hci_dev *hdev)
3941 {
3942         unsigned int cnt = hdev->block_cnt;
3943         struct hci_chan *chan;
3944         struct sk_buff *skb;
3945         int quote;
3946         u8 type;
3947
3948         __check_timeout(hdev, cnt);
3949
3950         BT_DBG("%s", hdev->name);
3951
3952         if (hdev->dev_type == HCI_AMP)
3953                 type = AMP_LINK;
3954         else
3955                 type = ACL_LINK;
3956
3957         while (hdev->block_cnt > 0 &&
3958                (chan = hci_chan_sent(hdev, type, &quote))) {
3959                 u32 priority = (skb_peek(&chan->data_q))->priority;
3960                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3961                         int blocks;
3962
3963                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3964                                skb->len, skb->priority);
3965
3966                         /* Stop if priority has changed */
3967                         if (skb->priority < priority)
3968                                 break;
3969
3970                         skb = skb_dequeue(&chan->data_q);
3971
3972                         blocks = __get_blocks(hdev, skb);
3973                         if (blocks > hdev->block_cnt)
3974                                 return;
3975
3976                         hci_conn_enter_active_mode(chan->conn,
3977                                                    bt_cb(skb)->force_active);
3978
3979                         hci_send_frame(hdev, skb);
3980                         hdev->acl_last_tx = jiffies;
3981
3982                         hdev->block_cnt -= blocks;
3983                         quote -= blocks;
3984
3985                         chan->sent += blocks;
3986                         chan->conn->sent += blocks;
3987                 }
3988         }
3989
3990         if (cnt != hdev->block_cnt)
3991                 hci_prio_recalculate(hdev, type);
3992 }
3993
3994 static void hci_sched_acl(struct hci_dev *hdev)
3995 {
3996         BT_DBG("%s", hdev->name);
3997
3998         /* No ACL link over BR/EDR controller */
3999         if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
4000                 return;
4001
4002         /* No AMP link over AMP controller */
4003         if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4004                 return;
4005
4006         switch (hdev->flow_ctl_mode) {
4007         case HCI_FLOW_CTL_MODE_PACKET_BASED:
4008                 hci_sched_acl_pkt(hdev);
4009                 break;
4010
4011         case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4012                 hci_sched_acl_blk(hdev);
4013                 break;
4014         }
4015 }
4016
4017 /* Schedule SCO */
4018 static void hci_sched_sco(struct hci_dev *hdev)
4019 {
4020         struct hci_conn *conn;
4021         struct sk_buff *skb;
4022         int quote;
4023
4024         BT_DBG("%s", hdev->name);
4025
4026         if (!hci_conn_num(hdev, SCO_LINK))
4027                 return;
4028
4029         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
4030                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4031                         BT_DBG("skb %p len %d", skb, skb->len);
4032                         hci_send_frame(hdev, skb);
4033
4034                         conn->sent++;
4035                         if (conn->sent == ~0)
4036                                 conn->sent = 0;
4037                 }
4038         }
4039 }
4040
4041 static void hci_sched_esco(struct hci_dev *hdev)
4042 {
4043         struct hci_conn *conn;
4044         struct sk_buff *skb;
4045         int quote;
4046
4047         BT_DBG("%s", hdev->name);
4048
4049         if (!hci_conn_num(hdev, ESCO_LINK))
4050                 return;
4051
4052         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4053                                                      &quote))) {
4054                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4055                         BT_DBG("skb %p len %d", skb, skb->len);
4056                         hci_send_frame(hdev, skb);
4057
4058                         conn->sent++;
4059                         if (conn->sent == ~0)
4060                                 conn->sent = 0;
4061                 }
4062         }
4063 }
4064
4065 static void hci_sched_le(struct hci_dev *hdev)
4066 {
4067         struct hci_chan *chan;
4068         struct sk_buff *skb;
4069         int quote, cnt, tmp;
4070
4071         BT_DBG("%s", hdev->name);
4072
4073         if (!hci_conn_num(hdev, LE_LINK))
4074                 return;
4075
4076         if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
4077                 /* LE tx timeout must be longer than maximum
4078                  * link supervision timeout (40.9 seconds) */
4079                 if (!hdev->le_cnt && hdev->le_pkts &&
4080                     time_after(jiffies, hdev->le_last_tx + HZ * 45))
4081                         hci_link_tx_to(hdev, LE_LINK);
4082         }
4083
4084         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
4085         tmp = cnt;
4086         while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
4087                 u32 priority = (skb_peek(&chan->data_q))->priority;
4088                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4089                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4090                                skb->len, skb->priority);
4091
4092                         /* Stop if priority has changed */
4093                         if (skb->priority < priority)
4094                                 break;
4095
4096                         skb = skb_dequeue(&chan->data_q);
4097
4098                         hci_send_frame(hdev, skb);
4099                         hdev->le_last_tx = jiffies;
4100
4101                         cnt--;
4102                         chan->sent++;
4103                         chan->conn->sent++;
4104                 }
4105         }
4106
4107         if (hdev->le_pkts)
4108                 hdev->le_cnt = cnt;
4109         else
4110                 hdev->acl_cnt = cnt;
4111
4112         if (cnt != tmp)
4113                 hci_prio_recalculate(hdev, LE_LINK);
4114 }
4115
4116 static void hci_tx_work(struct work_struct *work)
4117 {
4118         struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
4119         struct sk_buff *skb;
4120
4121         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
4122                hdev->sco_cnt, hdev->le_cnt);
4123
4124         if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4125                 /* Schedule queues and send stuff to HCI driver */
4126                 hci_sched_acl(hdev);
4127                 hci_sched_sco(hdev);
4128                 hci_sched_esco(hdev);
4129                 hci_sched_le(hdev);
4130         }
4131
4132         /* Send next queued raw (unknown type) packet */
4133         while ((skb = skb_dequeue(&hdev->raw_q)))
4134                 hci_send_frame(hdev, skb);
4135 }
4136
4137 /* ----- HCI RX task (incoming data processing) ----- */
4138
4139 /* ACL data packet */
4140 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4141 {
4142         struct hci_acl_hdr *hdr = (void *) skb->data;
4143         struct hci_conn *conn;
4144         __u16 handle, flags;
4145
4146         skb_pull(skb, HCI_ACL_HDR_SIZE);
4147
4148         handle = __le16_to_cpu(hdr->handle);
4149         flags  = hci_flags(handle);
4150         handle = hci_handle(handle);
4151
4152         BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4153                handle, flags);
4154
4155         hdev->stat.acl_rx++;
4156
4157         hci_dev_lock(hdev);
4158         conn = hci_conn_hash_lookup_handle(hdev, handle);
4159         hci_dev_unlock(hdev);
4160
4161         if (conn) {
4162                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
4163
4164                 /* Send to upper protocol */
4165                 l2cap_recv_acldata(conn, skb, flags);
4166                 return;
4167         } else {
4168                 BT_ERR("%s ACL packet for unknown connection handle %d",
4169                        hdev->name, handle);
4170         }
4171
4172         kfree_skb(skb);
4173 }
4174
4175 /* SCO data packet */
4176 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4177 {
4178         struct hci_sco_hdr *hdr = (void *) skb->data;
4179         struct hci_conn *conn;
4180         __u16 handle;
4181
4182         skb_pull(skb, HCI_SCO_HDR_SIZE);
4183
4184         handle = __le16_to_cpu(hdr->handle);
4185
4186         BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
4187
4188         hdev->stat.sco_rx++;
4189
4190         hci_dev_lock(hdev);
4191         conn = hci_conn_hash_lookup_handle(hdev, handle);
4192         hci_dev_unlock(hdev);
4193
4194         if (conn) {
4195                 /* Send to upper protocol */
4196                 sco_recv_scodata(conn, skb);
4197                 return;
4198         } else {
4199                 BT_ERR("%s SCO packet for unknown connection handle %d",
4200                        hdev->name, handle);
4201         }
4202
4203         kfree_skb(skb);
4204 }
4205
4206 static bool hci_req_is_complete(struct hci_dev *hdev)
4207 {
4208         struct sk_buff *skb;
4209
4210         skb = skb_peek(&hdev->cmd_q);
4211         if (!skb)
4212                 return true;
4213
4214         return bt_cb(skb)->req.start;
4215 }
4216
4217 static void hci_resend_last(struct hci_dev *hdev)
4218 {
4219         struct hci_command_hdr *sent;
4220         struct sk_buff *skb;
4221         u16 opcode;
4222
4223         if (!hdev->sent_cmd)
4224                 return;
4225
4226         sent = (void *) hdev->sent_cmd->data;
4227         opcode = __le16_to_cpu(sent->opcode);
4228         if (opcode == HCI_OP_RESET)
4229                 return;
4230
4231         skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4232         if (!skb)
4233                 return;
4234
4235         skb_queue_head(&hdev->cmd_q, skb);
4236         queue_work(hdev->workqueue, &hdev->cmd_work);
4237 }
4238
4239 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4240                           hci_req_complete_t *req_complete,
4241                           hci_req_complete_skb_t *req_complete_skb)
4242 {
4243         struct sk_buff *skb;
4244         unsigned long flags;
4245
4246         BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4247
4248         /* If the completed command doesn't match the last one that was
4249          * sent we need to do special handling of it.
4250          */
4251         if (!hci_sent_cmd_data(hdev, opcode)) {
4252                 /* Some CSR based controllers generate a spontaneous
4253                  * reset complete event during init and any pending
4254                  * command will never be completed. In such a case we
4255                  * need to resend whatever was the last sent
4256                  * command.
4257                  */
4258                 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4259                         hci_resend_last(hdev);
4260
4261                 return;
4262         }
4263
4264         /* If the command succeeded and there's still more commands in
4265          * this request the request is not yet complete.
4266          */
4267         if (!status && !hci_req_is_complete(hdev))
4268                 return;
4269
4270         /* If this was the last command in a request the complete
4271          * callback would be found in hdev->sent_cmd instead of the
4272          * command queue (hdev->cmd_q).
4273          */
4274         if (bt_cb(hdev->sent_cmd)->req.complete) {
4275                 *req_complete = bt_cb(hdev->sent_cmd)->req.complete;
4276                 return;
4277         }
4278
4279         if (bt_cb(hdev->sent_cmd)->req.complete_skb) {
4280                 *req_complete_skb = bt_cb(hdev->sent_cmd)->req.complete_skb;
4281                 return;
4282         }
4283
4284         /* Remove all pending commands belonging to this request */
4285         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4286         while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4287                 if (bt_cb(skb)->req.start) {
4288                         __skb_queue_head(&hdev->cmd_q, skb);
4289                         break;
4290                 }
4291
4292                 *req_complete = bt_cb(skb)->req.complete;
4293                 *req_complete_skb = bt_cb(skb)->req.complete_skb;
4294                 kfree_skb(skb);
4295         }
4296         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4297 }
4298
4299 static void hci_rx_work(struct work_struct *work)
4300 {
4301         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
4302         struct sk_buff *skb;
4303
4304         BT_DBG("%s", hdev->name);
4305
4306         while ((skb = skb_dequeue(&hdev->rx_q))) {
4307                 /* Send copy to monitor */
4308                 hci_send_to_monitor(hdev, skb);
4309
4310                 if (atomic_read(&hdev->promisc)) {
4311                         /* Send copy to the sockets */
4312                         hci_send_to_sock(hdev, skb);
4313                 }
4314
4315                 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4316                         kfree_skb(skb);
4317                         continue;
4318                 }
4319
4320                 if (test_bit(HCI_INIT, &hdev->flags)) {
4321                         /* Don't process data packets in this states. */
4322                         switch (bt_cb(skb)->pkt_type) {
4323                         case HCI_ACLDATA_PKT:
4324                         case HCI_SCODATA_PKT:
4325                                 kfree_skb(skb);
4326                                 continue;
4327                         }
4328                 }
4329
4330                 /* Process frame */
4331                 switch (bt_cb(skb)->pkt_type) {
4332                 case HCI_EVENT_PKT:
4333                         BT_DBG("%s Event packet", hdev->name);
4334                         hci_event_packet(hdev, skb);
4335                         break;
4336
4337                 case HCI_ACLDATA_PKT:
4338                         BT_DBG("%s ACL data packet", hdev->name);
4339                         hci_acldata_packet(hdev, skb);
4340                         break;
4341
4342                 case HCI_SCODATA_PKT:
4343                         BT_DBG("%s SCO data packet", hdev->name);
4344                         hci_scodata_packet(hdev, skb);
4345                         break;
4346
4347                 default:
4348                         kfree_skb(skb);
4349                         break;
4350                 }
4351         }
4352 }
4353
4354 static void hci_cmd_work(struct work_struct *work)
4355 {
4356         struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4357         struct sk_buff *skb;
4358
4359         BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4360                atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4361
4362         /* Send queued commands */
4363         if (atomic_read(&hdev->cmd_cnt)) {
4364                 skb = skb_dequeue(&hdev->cmd_q);
4365                 if (!skb)
4366                         return;
4367
4368                 kfree_skb(hdev->sent_cmd);
4369
4370                 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4371                 if (hdev->sent_cmd) {
4372                         atomic_dec(&hdev->cmd_cnt);
4373                         hci_send_frame(hdev, skb);
4374                         if (test_bit(HCI_RESET, &hdev->flags))
4375                                 cancel_delayed_work(&hdev->cmd_timer);
4376                         else
4377                                 schedule_delayed_work(&hdev->cmd_timer,
4378                                                       HCI_CMD_TIMEOUT);
4379                 } else {
4380                         skb_queue_head(&hdev->cmd_q, skb);
4381                         queue_work(hdev->workqueue, &hdev->cmd_work);
4382                 }
4383         }
4384 }