projects / deliverable / linux.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
Bluetooth: add LED trigger for indicating HCI is powered up
[deliverable/linux.git] / net / bluetooth / hci_core.c
CommitLineData
8e87d142 1/*
1da177e4
LT		 2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
590051de 4 Copyright (C) 2011 ProFUSION Embedded Systems
1da177e4
LT		 5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
8e87d142
YH		 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
1da177e4
LT		 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
8e87d142
YH		 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
1da177e4
LT		 23 SOFTWARE IS DISCLAIMED.
24*/
25
26/* Bluetooth HCI core. */
27
8c520a59 28#include <linux/export.h>
3df92b31 29#include <linux/idr.h>
8c520a59 30#include <linux/rfkill.h>
baf27f6e 31#include <linux/debugfs.h>
99780a7b 32#include <linux/crypto.h>
47219839 33#include <asm/unaligned.h>
1da177e4
LT		 34
35#include <net/bluetooth/bluetooth.h>
36#include <net/bluetooth/hci_core.h>
4bc58f51 37#include <net/bluetooth/l2cap.h>
af58925c 38#include <net/bluetooth/mgmt.h>
1da177e4 39
0857dd3b 40#include "hci_request.h"
60c5f5fb 41#include "hci_debugfs.h"
970c4e46 42#include "smp.h"
6d5d2ee6 43#include "leds.h"
970c4e46 44
b78752cc 45static void hci_rx_work(struct work_struct *work);
c347b765 46static void hci_cmd_work(struct work_struct *work);
3eff45ea 47static void hci_tx_work(struct work_struct *work);
1da177e4 48
1da177e4
LT		 49/* HCI device list */
50LIST_HEAD(hci_dev_list);
51DEFINE_RWLOCK(hci_dev_list_lock);
52
53/* HCI callback list */
54LIST_HEAD(hci_cb_list);
fba7ecf0 55DEFINE_MUTEX(hci_cb_list_lock);
1da177e4 56
3df92b31
SL		 57/* HCI ID Numbering */
58static DEFINE_IDA(hci_index_ida);
59
baf27f6e
MH		 60/* ---- HCI debugfs entries ---- */
61
4b4148e9
MH		 62static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
63 size_t count, loff_t *ppos)
64{
65 struct hci_dev *hdev = file->private_data;
66 char buf[3];
67
74b93e9f 68 buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
4b4148e9
MH		 69 buf[1] = '\n';
70 buf[2] = '\0';
71 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
72}
73
74static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
75 size_t count, loff_t *ppos)
76{
77 struct hci_dev *hdev = file->private_data;
78 struct sk_buff *skb;
79 char buf[32];
80 size_t buf_size = min(count, (sizeof(buf)-1));
81 bool enable;
4b4148e9
MH		 82
83 if (!test_bit(HCI_UP, &hdev->flags))
84 return -ENETDOWN;
85
86 if (copy_from_user(buf, user_buf, buf_size))
87 return -EFAULT;
88
89 buf[buf_size] = '\0';
90 if (strtobool(buf, &enable))
91 return -EINVAL;
92
b7cb93e5 93 if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
4b4148e9
MH		 94 return -EALREADY;
95
b504430c 96 hci_req_sync_lock(hdev);
4b4148e9
MH		 97 if (enable)
98 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
99 HCI_CMD_TIMEOUT);
100 else
101 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
102 HCI_CMD_TIMEOUT);
b504430c 103 hci_req_sync_unlock(hdev);
4b4148e9
MH		 104
105 if (IS_ERR(skb))
106 return PTR_ERR(skb);
107
4b4148e9
MH		 108 kfree_skb(skb);
109
b7cb93e5 110 hci_dev_change_flag(hdev, HCI_DUT_MODE);
4b4148e9
MH		 111
112 return count;
113}
114
115static const struct file_operations dut_mode_fops = {
116 .open = simple_open,
117 .read = dut_mode_read,
118 .write = dut_mode_write,
119 .llseek = default_llseek,
120};
121
4b4113d6
MH		 122static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
123 size_t count, loff_t *ppos)
124{
125 struct hci_dev *hdev = file->private_data;
126 char buf[3];
127
74b93e9f 128 buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
4b4113d6
MH		 129 buf[1] = '\n';
130 buf[2] = '\0';
131 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
132}
133
134static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
135 size_t count, loff_t *ppos)
136{
137 struct hci_dev *hdev = file->private_data;
138 char buf[32];
139 size_t buf_size = min(count, (sizeof(buf)-1));
140 bool enable;
141 int err;
142
143 if (copy_from_user(buf, user_buf, buf_size))
144 return -EFAULT;
145
146 buf[buf_size] = '\0';
147 if (strtobool(buf, &enable))
148 return -EINVAL;
149
7e995b9e
MH		 150 /* When the diagnostic flags are not persistent and the transport
151 * is not active, then there is no need for the vendor callback.
152 *
153 * Instead just store the desired value. If needed the setting
154 * will be programmed when the controller gets powered on.
155 */
156 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
157 !test_bit(HCI_RUNNING, &hdev->flags))
158 goto done;
159
b504430c 160 hci_req_sync_lock(hdev);
4b4113d6 161 err = hdev->set_diag(hdev, enable);
b504430c 162 hci_req_sync_unlock(hdev);
4b4113d6
MH		 163
164 if (err < 0)
165 return err;
166
7e995b9e 167done:
4b4113d6
MH		 168 if (enable)
169 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
170 else
171 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
172
173 return count;
174}
175
176static const struct file_operations vendor_diag_fops = {
177 .open = simple_open,
178 .read = vendor_diag_read,
179 .write = vendor_diag_write,
180 .llseek = default_llseek,
181};
182
f640ee98
MH		 183static void hci_debugfs_create_basic(struct hci_dev *hdev)
184{
185 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
186 &dut_mode_fops);
187
188 if (hdev->set_diag)
189 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
190 &vendor_diag_fops);
191}
192
a1d01db1 193static int hci_reset_req(struct hci_request *req, unsigned long opt)
1da177e4 194{
42c6b129 195 BT_DBG("%s %ld", req->hdev->name, opt);
1da177e4
LT		 196
197 /* Reset device */
42c6b129
JH		 198 set_bit(HCI_RESET, &req->hdev->flags);
199 hci_req_add(req, HCI_OP_RESET, 0, NULL);
a1d01db1 200 return 0;
1da177e4
LT		 201}
202
42c6b129 203static void bredr_init(struct hci_request *req)
1da177e4 204{
42c6b129 205 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
2455a3ea 206
1da177e4 207 /* Read Local Supported Features */
42c6b129 208 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
1da177e4 209
1143e5a6 210 /* Read Local Version */
42c6b129 211 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
2177bab5
JH		 212
213 /* Read BD Address */
42c6b129 214 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
1da177e4
LT		 215}
216
0af801b9 217static void amp_init1(struct hci_request *req)
e61ef499 218{
42c6b129 219 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
2455a3ea 220
e61ef499 221 /* Read Local Version */
42c6b129 222 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
6bcbc489 223
f6996cfe
MH		 224 /* Read Local Supported Commands */
225 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
226
6bcbc489 227 /* Read Local AMP Info */
42c6b129 228 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
e71dfaba
AE		 229
230 /* Read Data Blk size */
42c6b129 231 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
7528ca1c 232
f38ba941
MH		 233 /* Read Flow Control Mode */
234 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
235
7528ca1c
MH		 236 /* Read Location Data */
237 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
e61ef499
AE		 238}
239
a1d01db1 240static int amp_init2(struct hci_request *req)
0af801b9
JH		 241{
242 /* Read Local Supported Features. Not all AMP controllers
243 * support this so it's placed conditionally in the second
244 * stage init.
245 */
246 if (req->hdev->commands[14] & 0x20)
247 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
a1d01db1
JH		 248
249 return 0;
0af801b9
JH		 250}
251
a1d01db1 252static int hci_init1_req(struct hci_request *req, unsigned long opt)
e61ef499 253{
42c6b129 254 struct hci_dev *hdev = req->hdev;
e61ef499
AE		 255
256 BT_DBG("%s %ld", hdev->name, opt);
257
11778716
AE		 258 /* Reset */
259 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
42c6b129 260 hci_reset_req(req, 0);
11778716 261
e61ef499
AE		 262 switch (hdev->dev_type) {
263 case HCI_BREDR:
42c6b129 264 bredr_init(req);
e61ef499
AE		 265 break;
266
267 case HCI_AMP:
0af801b9 268 amp_init1(req);
e61ef499
AE		 269 break;
270
271 default:
272 BT_ERR("Unknown device type %d", hdev->dev_type);
273 break;
274 }
a1d01db1
JH		 275
276 return 0;
e61ef499
AE		 277}
278
42c6b129 279static void bredr_setup(struct hci_request *req)
2177bab5 280{
2177bab5
JH		 281 __le16 param;
282 __u8 flt_type;
283
284 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
42c6b129 285 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 286
287 /* Read Class of Device */
42c6b129 288 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
2177bab5
JH		 289
290 /* Read Local Name */
42c6b129 291 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
2177bab5
JH		 292
293 /* Read Voice Setting */
42c6b129 294 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
2177bab5 295
b4cb9fb2
MH		 296 /* Read Number of Supported IAC */
297 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
298
4b836f39
MH		 299 /* Read Current IAC LAP */
300 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
301
2177bab5
JH		 302 /* Clear Event Filters */
303 flt_type = HCI_FLT_CLEAR_ALL;
42c6b129 304 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
2177bab5
JH		 305
306 /* Connection accept timeout ~20 secs */
dcf4adbf 307 param = cpu_to_le16(0x7d00);
42c6b129 308 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
2177bab5
JH		 309}
310
42c6b129 311static void le_setup(struct hci_request *req)
2177bab5 312{
c73eee91
JH		 313 struct hci_dev *hdev = req->hdev;
314
2177bab5 315 /* Read LE Buffer Size */
42c6b129 316 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
2177bab5
JH		 317
318 /* Read LE Local Supported Features */
42c6b129 319 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
2177bab5 320
747d3f03
MH		 321 /* Read LE Supported States */
322 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
323
c73eee91
JH		 324 /* LE-only controllers have LE implicitly enabled */
325 if (!lmp_bredr_capable(hdev))
a1536da2 326 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
2177bab5
JH		 327}
328
42c6b129 329static void hci_setup_event_mask(struct hci_request *req)
2177bab5 330{
42c6b129
JH		 331 struct hci_dev *hdev = req->hdev;
332
2177bab5
JH		 333 /* The second byte is 0xff instead of 0x9f (two reserved bits
334 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
335 * command otherwise.
336 */
337 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
338
339 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
340 * any event mask for pre 1.2 devices.
341 */
342 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
343 return;
344
345 if (lmp_bredr_capable(hdev)) {
346 events[4] |= 0x01; /* Flow Specification Complete */
c7882cbd
MH		 347 } else {
348 /* Use a different default for LE-only devices */
349 memset(events, 0, sizeof(events));
c7882cbd
MH		 350 events[1] |= 0x20; /* Command Complete */
351 events[1] |= 0x40; /* Command Status */
352 events[1] |= 0x80; /* Hardware Error */
5c3d3b4c
MH		 353
354 /* If the controller supports the Disconnect command, enable
355 * the corresponding event. In addition enable packet flow
356 * control related events.
357 */
358 if (hdev->commands[0] & 0x20) {
359 events[0] |= 0x10; /* Disconnection Complete */
360 events[2] |= 0x04; /* Number of Completed Packets */
361 events[3] |= 0x02; /* Data Buffer Overflow */
362 }
363
364 /* If the controller supports the Read Remote Version
365 * Information command, enable the corresponding event.
366 */
367 if (hdev->commands[2] & 0x80)
368 events[1] |= 0x08; /* Read Remote Version Information
369 * Complete
370 */
0da71f1b
MH		 371
372 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
373 events[0] |= 0x80; /* Encryption Change */
374 events[5] |= 0x80; /* Encryption Key Refresh Complete */
375 }
2177bab5
JH		 376 }
377
9fe759ce
MH		 378 if (lmp_inq_rssi_capable(hdev) ||
379 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
2177bab5
JH		 380 events[4] |= 0x02; /* Inquiry Result with RSSI */
381
70f56aa2
MH		 382 if (lmp_ext_feat_capable(hdev))
383 events[4] |= 0x04; /* Read Remote Extended Features Complete */
384
385 if (lmp_esco_capable(hdev)) {
386 events[5] |= 0x08; /* Synchronous Connection Complete */
387 events[5] |= 0x10; /* Synchronous Connection Changed */
388 }
389
2177bab5
JH		 390 if (lmp_sniffsubr_capable(hdev))
391 events[5] |= 0x20; /* Sniff Subrating */
392
393 if (lmp_pause_enc_capable(hdev))
394 events[5] |= 0x80; /* Encryption Key Refresh Complete */
395
396 if (lmp_ext_inq_capable(hdev))
397 events[5] |= 0x40; /* Extended Inquiry Result */
398
399 if (lmp_no_flush_capable(hdev))
400 events[7] |= 0x01; /* Enhanced Flush Complete */
401
402 if (lmp_lsto_capable(hdev))
403 events[6] |= 0x80; /* Link Supervision Timeout Changed */
404
405 if (lmp_ssp_capable(hdev)) {
406 events[6] |= 0x01; /* IO Capability Request */
407 events[6] |= 0x02; /* IO Capability Response */
408 events[6] |= 0x04; /* User Confirmation Request */
409 events[6] |= 0x08; /* User Passkey Request */
410 events[6] |= 0x10; /* Remote OOB Data Request */
411 events[6] |= 0x20; /* Simple Pairing Complete */
412 events[7] |= 0x04; /* User Passkey Notification */
413 events[7] |= 0x08; /* Keypress Notification */
414 events[7] |= 0x10; /* Remote Host Supported
415 * Features Notification
416 */
417 }
418
419 if (lmp_le_capable(hdev))
420 events[7] |= 0x20; /* LE Meta-Event */
421
42c6b129 422 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
2177bab5
JH		 423}
424
a1d01db1 425static int hci_init2_req(struct hci_request *req, unsigned long opt)
2177bab5 426{
42c6b129
JH		 427 struct hci_dev *hdev = req->hdev;
428
0af801b9
JH		 429 if (hdev->dev_type == HCI_AMP)
430 return amp_init2(req);
431
2177bab5 432 if (lmp_bredr_capable(hdev))
42c6b129 433 bredr_setup(req);
56f87901 434 else
a358dc11 435 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
2177bab5
JH		 436
437 if (lmp_le_capable(hdev))
42c6b129 438 le_setup(req);
2177bab5 439
0f3adeae
MH		 440 /* All Bluetooth 1.2 and later controllers should support the
441 * HCI command for reading the local supported commands.
442 *
443 * Unfortunately some controllers indicate Bluetooth 1.2 support,
444 * but do not have support for this command. If that is the case,
445 * the driver can quirk the behavior and skip reading the local
446 * supported commands.
3f8e2d75 447 */
0f3adeae
MH		 448 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
449 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
42c6b129 450 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
2177bab5
JH		 451
452 if (lmp_ssp_capable(hdev)) {
57af75a8
MH		 453 /* When SSP is available, then the host features page
454 * should also be available as well. However some
455 * controllers list the max_page as 0 as long as SSP
456 * has not been enabled. To achieve proper debugging
457 * output, force the minimum max_page to 1 at least.
458 */
459 hdev->max_page = 0x01;
460
d7a5a11d 461 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
2177bab5 462 u8 mode = 0x01;
574ea3c7 463
42c6b129
JH		 464 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
465 sizeof(mode), &mode);
2177bab5
JH		 466 } else {
467 struct hci_cp_write_eir cp;
468
469 memset(hdev->eir, 0, sizeof(hdev->eir));
470 memset(&cp, 0, sizeof(cp));
471
42c6b129 472 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
2177bab5
JH		 473 }
474 }
475
043ec9bf
MH		 476 if (lmp_inq_rssi_capable(hdev) ||
477 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
04422da9
MH		 478 u8 mode;
479
480 /* If Extended Inquiry Result events are supported, then
481 * they are clearly preferred over Inquiry Result with RSSI
482 * events.
483 */
484 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
485
486 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
487 }
2177bab5
JH		 488
489 if (lmp_inq_tx_pwr_capable(hdev))
42c6b129 490 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
2177bab5
JH		 491
492 if (lmp_ext_feat_capable(hdev)) {
493 struct hci_cp_read_local_ext_features cp;
494
495 cp.page = 0x01;
42c6b129
JH		 496 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
497 sizeof(cp), &cp);
2177bab5
JH		 498 }
499
d7a5a11d 500 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
2177bab5 501 u8 enable = 1;
42c6b129
JH		 502 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
503 &enable);
2177bab5 504 }
a1d01db1
JH		 505
506 return 0;
2177bab5
JH		 507}
508
42c6b129 509static void hci_setup_link_policy(struct hci_request *req)
2177bab5 510{
42c6b129 511 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 512 struct hci_cp_write_def_link_policy cp;
513 u16 link_policy = 0;
514
515 if (lmp_rswitch_capable(hdev))
516 link_policy |= HCI_LP_RSWITCH;
517 if (lmp_hold_capable(hdev))
518 link_policy |= HCI_LP_HOLD;
519 if (lmp_sniff_capable(hdev))
520 link_policy |= HCI_LP_SNIFF;
521 if (lmp_park_capable(hdev))
522 link_policy |= HCI_LP_PARK;
523
524 cp.policy = cpu_to_le16(link_policy);
42c6b129 525 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
2177bab5
JH		 526}
527
42c6b129 528static void hci_set_le_support(struct hci_request *req)
2177bab5 529{
42c6b129 530 struct hci_dev *hdev = req->hdev;
2177bab5
JH		 531 struct hci_cp_write_le_host_supported cp;
532
c73eee91
JH		 533 /* LE-only devices do not support explicit enablement */
534 if (!lmp_bredr_capable(hdev))
535 return;
536
2177bab5
JH		 537 memset(&cp, 0, sizeof(cp));
538
d7a5a11d 539 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
2177bab5 540 cp.le = 0x01;
32226e4f 541 cp.simul = 0x00;
2177bab5
JH		 542 }
543
544 if (cp.le != lmp_host_le_capable(hdev))
42c6b129
JH		 545 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
546 &cp);
2177bab5
JH		 547}
548
d62e6d67
JH		 549static void hci_set_event_mask_page_2(struct hci_request *req)
550{
551 struct hci_dev *hdev = req->hdev;
552 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
553
554 /* If Connectionless Slave Broadcast master role is supported
555 * enable all necessary events for it.
556 */
53b834d2 557 if (lmp_csb_master_capable(hdev)) {
d62e6d67
JH		 558 events[1] |= 0x40; /* Triggered Clock Capture */
559 events[1] |= 0x80; /* Synchronization Train Complete */
560 events[2] |= 0x10; /* Slave Page Response Timeout */
561 events[2] |= 0x20; /* CSB Channel Map Change */
562 }
563
564 /* If Connectionless Slave Broadcast slave role is supported
565 * enable all necessary events for it.
566 */
53b834d2 567 if (lmp_csb_slave_capable(hdev)) {
d62e6d67
JH		 568 events[2] |= 0x01; /* Synchronization Train Received */
569 events[2] |= 0x02; /* CSB Receive */
570 events[2] |= 0x04; /* CSB Timeout */
571 events[2] |= 0x08; /* Truncated Page Complete */
572 }
573
40c59fcb 574 /* Enable Authenticated Payload Timeout Expired event if supported */
cd7ca0ec 575 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
40c59fcb
MH		 576 events[2] |= 0x80;
577
d62e6d67
JH		 578 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
579}
580
a1d01db1 581static int hci_init3_req(struct hci_request *req, unsigned long opt)
2177bab5 582{
42c6b129 583 struct hci_dev *hdev = req->hdev;
d2c5d77f 584 u8 p;
42c6b129 585
0da71f1b
MH		 586 hci_setup_event_mask(req);
587
e81be90b
JH		 588 if (hdev->commands[6] & 0x20 &&
589 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
48ce62c4
MH		 590 struct hci_cp_read_stored_link_key cp;
591
592 bacpy(&cp.bdaddr, BDADDR_ANY);
593 cp.read_all = 0x01;
594 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
595 }
596
2177bab5 597 if (hdev->commands[5] & 0x10)
42c6b129 598 hci_setup_link_policy(req);
2177bab5 599
417287de
MH		 600 if (hdev->commands[8] & 0x01)
601 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
602
603 /* Some older Broadcom based Bluetooth 1.2 controllers do not
604 * support the Read Page Scan Type command. Check support for
605 * this command in the bit mask of supported commands.
606 */
607 if (hdev->commands[13] & 0x01)
608 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
609
9193c6e8
AG		 610 if (lmp_le_capable(hdev)) {
611 u8 events[8];
612
613 memset(events, 0, sizeof(events));
4d6c705b
MH		 614
615 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
616 events[0] |= 0x10; /* LE Long Term Key Request */
662bc2e6
AG		 617
618 /* If controller supports the Connection Parameters Request
619 * Link Layer Procedure, enable the corresponding event.
620 */
621 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
622 events[0] |= 0x20; /* LE Remote Connection
623 * Parameter Request
624 */
625
a9f6068e
MH		 626 /* If the controller supports the Data Length Extension
627 * feature, enable the corresponding event.
628 */
629 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
630 events[0] |= 0x40; /* LE Data Length Change */
631
4b71bba4
MH		 632 /* If the controller supports Extended Scanner Filter
633 * Policies, enable the correspondig event.
634 */
635 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
636 events[1] |= 0x04; /* LE Direct Advertising
637 * Report
638 */
639
7d26f5c4
MH		 640 /* If the controller supports the LE Set Scan Enable command,
641 * enable the corresponding advertising report event.
642 */
643 if (hdev->commands[26] & 0x08)
644 events[0] |= 0x02; /* LE Advertising Report */
645
646 /* If the controller supports the LE Create Connection
647 * command, enable the corresponding event.
648 */
649 if (hdev->commands[26] & 0x10)
650 events[0] |= 0x01; /* LE Connection Complete */
651
652 /* If the controller supports the LE Connection Update
653 * command, enable the corresponding event.
654 */
655 if (hdev->commands[27] & 0x04)
656 events[0] |= 0x04; /* LE Connection Update
657 * Complete
658 */
659
660 /* If the controller supports the LE Read Remote Used Features
661 * command, enable the corresponding event.
662 */
663 if (hdev->commands[27] & 0x20)
664 events[0] |= 0x08; /* LE Read Remote Used
665 * Features Complete
666 */
667
5a34bd5f
MH		 668 /* If the controller supports the LE Read Local P-256
669 * Public Key command, enable the corresponding event.
670 */
671 if (hdev->commands[34] & 0x02)
672 events[0] |= 0x80; /* LE Read Local P-256
673 * Public Key Complete
674 */
675
676 /* If the controller supports the LE Generate DHKey
677 * command, enable the corresponding event.
678 */
679 if (hdev->commands[34] & 0x04)
680 events[1] |= 0x01; /* LE Generate DHKey Complete */
681
9193c6e8
AG		 682 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
683 events);
684
15a49cca
MH		 685 if (hdev->commands[25] & 0x40) {
686 /* Read LE Advertising Channel TX Power */
687 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
688 }
689
2ab216a7
MH		 690 if (hdev->commands[26] & 0x40) {
691 /* Read LE White List Size */
692 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE,
693 0, NULL);
694 }
695
696 if (hdev->commands[26] & 0x80) {
697 /* Clear LE White List */
698 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
699 }
700
a9f6068e
MH		 701 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
702 /* Read LE Maximum Data Length */
703 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
704
705 /* Read LE Suggested Default Data Length */
706 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
707 }
708
42c6b129 709 hci_set_le_support(req);
9193c6e8 710 }
d2c5d77f
JH		 711
712 /* Read features beyond page 1 if available */
713 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
714 struct hci_cp_read_local_ext_features cp;
715
716 cp.page = p;
717 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
718 sizeof(cp), &cp);
719 }
a1d01db1
JH		 720
721 return 0;
2177bab5
JH		 722}
723
a1d01db1 724static int hci_init4_req(struct hci_request *req, unsigned long opt)
5d4e7e8d
JH		 725{
726 struct hci_dev *hdev = req->hdev;
727
36f260ce
MH		 728 /* Some Broadcom based Bluetooth controllers do not support the
729 * Delete Stored Link Key command. They are clearly indicating its
730 * absence in the bit mask of supported commands.
731 *
732 * Check the supported commands and only if the the command is marked
733 * as supported send it. If not supported assume that the controller
734 * does not have actual support for stored link keys which makes this
735 * command redundant anyway.
736 *
737 * Some controllers indicate that they support handling deleting
738 * stored link keys, but they don't. The quirk lets a driver
739 * just disable this command.
740 */
741 if (hdev->commands[6] & 0x80 &&
742 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
743 struct hci_cp_delete_stored_link_key cp;
744
745 bacpy(&cp.bdaddr, BDADDR_ANY);
746 cp.delete_all = 0x01;
747 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
748 sizeof(cp), &cp);
749 }
750
d62e6d67
JH		 751 /* Set event mask page 2 if the HCI command for it is supported */
752 if (hdev->commands[22] & 0x04)
753 hci_set_event_mask_page_2(req);
754
109e3191
MH		 755 /* Read local codec list if the HCI command is supported */
756 if (hdev->commands[29] & 0x20)
757 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
758
f4fe73ed
MH		 759 /* Get MWS transport configuration if the HCI command is supported */
760 if (hdev->commands[30] & 0x08)
761 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
762
5d4e7e8d 763 /* Check for Synchronization Train support */
53b834d2 764 if (lmp_sync_train_capable(hdev))
5d4e7e8d 765 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
a6d0d690
MH		 766
767 /* Enable Secure Connections if supported and configured */
d7a5a11d 768 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
574ea3c7 769 bredr_sc_enabled(hdev)) {
a6d0d690 770 u8 support = 0x01;
574ea3c7 771
a6d0d690
MH		 772 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
773 sizeof(support), &support);
774 }
a1d01db1
JH		 775
776 return 0;
5d4e7e8d
JH		 777}
778
2177bab5
JH		 779static int __hci_init(struct hci_dev *hdev)
780{
781 int err;
782
4ebeee2d 783 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
2177bab5
JH		 784 if (err < 0)
785 return err;
786
f640ee98
MH		 787 if (hci_dev_test_flag(hdev, HCI_SETUP))
788 hci_debugfs_create_basic(hdev);
4b4148e9 789
4ebeee2d 790 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
0af801b9
JH		 791 if (err < 0)
792 return err;
793
2177bab5
JH		 794 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
795 * BR/EDR/LE type controllers. AMP controllers only need the
0af801b9 796 * first two stages of init.
2177bab5
JH		 797 */
798 if (hdev->dev_type != HCI_BREDR)
799 return 0;
800
4ebeee2d 801 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
5d4e7e8d
JH		 802 if (err < 0)
803 return err;
804
4ebeee2d 805 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
baf27f6e
MH		 806 if (err < 0)
807 return err;
808
ec6cef9c
MH		 809 /* This function is only called when the controller is actually in
810 * configured state. When the controller is marked as unconfigured,
811 * this initialization procedure is not run.
812 *
813 * It means that it is possible that a controller runs through its
814 * setup phase and then discovers missing settings. If that is the
815 * case, then this function will not be called. It then will only
816 * be called during the config phase.
817 *
818 * So only when in setup phase or config phase, create the debugfs
819 * entries and register the SMP channels.
baf27f6e 820 */
d7a5a11d
MH		 821 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
822 !hci_dev_test_flag(hdev, HCI_CONFIG))
baf27f6e
MH		 823 return 0;
824
60c5f5fb
MH		 825 hci_debugfs_create_common(hdev);
826
71c3b60e 827 if (lmp_bredr_capable(hdev))
60c5f5fb 828 hci_debugfs_create_bredr(hdev);
2bfa3531 829
162a3bac 830 if (lmp_le_capable(hdev))
60c5f5fb 831 hci_debugfs_create_le(hdev);
e7b8fc92 832
baf27f6e 833 return 0;
2177bab5
JH		 834}
835
a1d01db1 836static int hci_init0_req(struct hci_request *req, unsigned long opt)
0ebca7d6
MH		 837{
838 struct hci_dev *hdev = req->hdev;
839
840 BT_DBG("%s %ld", hdev->name, opt);
841
842 /* Reset */
843 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
844 hci_reset_req(req, 0);
845
846 /* Read Local Version */
847 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
848
849 /* Read BD Address */
850 if (hdev->set_bdaddr)
851 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
a1d01db1
JH		 852
853 return 0;
0ebca7d6
MH		 854}
855
856static int __hci_unconf_init(struct hci_dev *hdev)
857{
858 int err;
859
cc78b44b
MH		 860 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
861 return 0;
862
4ebeee2d 863 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
0ebca7d6
MH		 864 if (err < 0)
865 return err;
866
f640ee98
MH		 867 if (hci_dev_test_flag(hdev, HCI_SETUP))
868 hci_debugfs_create_basic(hdev);
869
0ebca7d6
MH		 870 return 0;
871}
872
a1d01db1 873static int hci_scan_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 874{
875 __u8 scan = opt;
876
42c6b129 877 BT_DBG("%s %x", req->hdev->name, scan);
1da177e4
LT		 878
879 /* Inquiry and Page scans */
42c6b129 880 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
a1d01db1 881 return 0;
1da177e4
LT		 882}
883
a1d01db1 884static int hci_auth_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 885{
886 __u8 auth = opt;
887
42c6b129 888 BT_DBG("%s %x", req->hdev->name, auth);
1da177e4
LT		 889
890 /* Authentication */
42c6b129 891 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
a1d01db1 892 return 0;
1da177e4
LT		 893}
894
a1d01db1 895static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 896{
897 __u8 encrypt = opt;
898
42c6b129 899 BT_DBG("%s %x", req->hdev->name, encrypt);
1da177e4 900
e4e8e37c 901 /* Encryption */
42c6b129 902 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
a1d01db1 903 return 0;
1da177e4
LT		 904}
905
a1d01db1 906static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
e4e8e37c
MH		 907{
908 __le16 policy = cpu_to_le16(opt);
909
42c6b129 910 BT_DBG("%s %x", req->hdev->name, policy);
e4e8e37c
MH		 911
912 /* Default link policy */
42c6b129 913 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
a1d01db1 914 return 0;
e4e8e37c
MH		 915}
916
8e87d142 917/* Get HCI device by index.
1da177e4
LT		 918 * Device is held on return. */
919struct hci_dev *hci_dev_get(int index)
920{
8035ded4 921 struct hci_dev *hdev = NULL, *d;
1da177e4
LT		 922
923 BT_DBG("%d", index);
924
925 if (index < 0)
926 return NULL;
927
928 read_lock(&hci_dev_list_lock);
8035ded4 929 list_for_each_entry(d, &hci_dev_list, list) {
1da177e4
LT		 930 if (d->id == index) {
931 hdev = hci_dev_hold(d);
932 break;
933 }
934 }
935 read_unlock(&hci_dev_list_lock);
936 return hdev;
937}
1da177e4
LT		 938
939/* ---- Inquiry support ---- */
ff9ef578 940
30dc78e1
JH		 941bool hci_discovery_active(struct hci_dev *hdev)
942{
943 struct discovery_state *discov = &hdev->discovery;
944
6fbe195d 945 switch (discov->state) {
343f935b 946 case DISCOVERY_FINDING:
6fbe195d 947 case DISCOVERY_RESOLVING:
30dc78e1
JH		 948 return true;
949
6fbe195d
AG		 950 default:
951 return false;
952 }
30dc78e1
JH		 953}
954
ff9ef578
JH		 955void hci_discovery_set_state(struct hci_dev *hdev, int state)
956{
bb3e0a33
JH		 957 int old_state = hdev->discovery.state;
958
ff9ef578
JH		 959 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
960
bb3e0a33 961 if (old_state == state)
ff9ef578
JH		 962 return;
963
bb3e0a33
JH		 964 hdev->discovery.state = state;
965
ff9ef578
JH		 966 switch (state) {
967 case DISCOVERY_STOPPED:
c54c3860
AG		 968 hci_update_background_scan(hdev);
969
bb3e0a33 970 if (old_state != DISCOVERY_STARTING)
7b99b659 971 mgmt_discovering(hdev, 0);
ff9ef578
JH		 972 break;
973 case DISCOVERY_STARTING:
974 break;
343f935b 975 case DISCOVERY_FINDING:
ff9ef578
JH		 976 mgmt_discovering(hdev, 1);
977 break;
30dc78e1
JH		 978 case DISCOVERY_RESOLVING:
979 break;
ff9ef578
JH		 980 case DISCOVERY_STOPPING:
981 break;
982 }
ff9ef578
JH		 983}
984
1f9b9a5d 985void hci_inquiry_cache_flush(struct hci_dev *hdev)
1da177e4 986{
30883512 987 struct discovery_state *cache = &hdev->discovery;
b57c1a56 988 struct inquiry_entry *p, *n;
1da177e4 989
561aafbc
JH		 990 list_for_each_entry_safe(p, n, &cache->all, all) {
991 list_del(&p->all);
b57c1a56 992 kfree(p);
1da177e4 993 }
561aafbc
JH		 994
995 INIT_LIST_HEAD(&cache->unknown);
996 INIT_LIST_HEAD(&cache->resolve);
1da177e4
LT		 997}
998
a8c5fb1a
GP		 999struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1000 bdaddr_t *bdaddr)
1da177e4 1001{
30883512 1002 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 1003 struct inquiry_entry *e;
1004
6ed93dc6 1005 BT_DBG("cache %p, %pMR", cache, bdaddr);
1da177e4 1006
561aafbc
JH		 1007 list_for_each_entry(e, &cache->all, all) {
1008 if (!bacmp(&e->data.bdaddr, bdaddr))
1009 return e;
1010 }
1011
1012 return NULL;
1013}
1014
1015struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
04124681 1016 bdaddr_t *bdaddr)
561aafbc 1017{
30883512 1018 struct discovery_state *cache = &hdev->discovery;
561aafbc
JH		 1019 struct inquiry_entry *e;
1020
6ed93dc6 1021 BT_DBG("cache %p, %pMR", cache, bdaddr);
561aafbc
JH		 1022
1023 list_for_each_entry(e, &cache->unknown, list) {
1da177e4 1024 if (!bacmp(&e->data.bdaddr, bdaddr))
b57c1a56
JH		 1025 return e;
1026 }
1027
1028 return NULL;
1da177e4
LT		 1029}
1030
30dc78e1 1031struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
04124681
GP		 1032 bdaddr_t *bdaddr,
1033 int state)
30dc78e1
JH		 1034{
1035 struct discovery_state *cache = &hdev->discovery;
1036 struct inquiry_entry *e;
1037
6ed93dc6 1038 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
30dc78e1
JH		 1039
1040 list_for_each_entry(e, &cache->resolve, list) {
1041 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1042 return e;
1043 if (!bacmp(&e->data.bdaddr, bdaddr))
1044 return e;
1045 }
1046
1047 return NULL;
1048}
1049
a3d4e20a 1050void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
04124681 1051 struct inquiry_entry *ie)
a3d4e20a
JH		 1052{
1053 struct discovery_state *cache = &hdev->discovery;
1054 struct list_head *pos = &cache->resolve;
1055 struct inquiry_entry *p;
1056
1057 list_del(&ie->list);
1058
1059 list_for_each_entry(p, &cache->resolve, list) {
1060 if (p->name_state != NAME_PENDING &&
a8c5fb1a 1061 abs(p->data.rssi) >= abs(ie->data.rssi))
a3d4e20a
JH		 1062 break;
1063 pos = &p->list;
1064 }
1065
1066 list_add(&ie->list, pos);
1067}
1068
af58925c
MH		 1069u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1070 bool name_known)
1da177e4 1071{
30883512 1072 struct discovery_state *cache = &hdev->discovery;
70f23020 1073 struct inquiry_entry *ie;
af58925c 1074 u32 flags = 0;
1da177e4 1075
6ed93dc6 1076 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1da177e4 1077
6928a924 1078 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
2b2fec4d 1079
af58925c
MH		 1080 if (!data->ssp_mode)
1081 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 1082
70f23020 1083 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
a3d4e20a 1084 if (ie) {
af58925c
MH		 1085 if (!ie->data.ssp_mode)
1086 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
388fc8fa 1087
a3d4e20a 1088 if (ie->name_state == NAME_NEEDED &&
a8c5fb1a 1089 data->rssi != ie->data.rssi) {
a3d4e20a
JH		 1090 ie->data.rssi = data->rssi;
1091 hci_inquiry_cache_update_resolve(hdev, ie);
1092 }
1093
561aafbc 1094 goto update;
a3d4e20a 1095 }
561aafbc
JH		 1096
1097 /* Entry not in the cache. Add new one. */
27f70f3e 1098 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
af58925c
MH		 1099 if (!ie) {
1100 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1101 goto done;
1102 }
561aafbc
JH		 1103
1104 list_add(&ie->all, &cache->all);
1105
1106 if (name_known) {
1107 ie->name_state = NAME_KNOWN;
1108 } else {
1109 ie->name_state = NAME_NOT_KNOWN;
1110 list_add(&ie->list, &cache->unknown);
1111 }
70f23020 1112
561aafbc
JH		 1113update:
1114 if (name_known && ie->name_state != NAME_KNOWN &&
a8c5fb1a 1115 ie->name_state != NAME_PENDING) {
561aafbc
JH		 1116 ie->name_state = NAME_KNOWN;
1117 list_del(&ie->list);
1da177e4
LT		 1118 }
1119
70f23020
AE		 1120 memcpy(&ie->data, data, sizeof(*data));
1121 ie->timestamp = jiffies;
1da177e4 1122 cache->timestamp = jiffies;
3175405b
JH		 1123
1124 if (ie->name_state == NAME_NOT_KNOWN)
af58925c 1125 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
3175405b 1126
af58925c
MH		 1127done:
1128 return flags;
1da177e4
LT		 1129}
1130
1131static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1132{
30883512 1133 struct discovery_state *cache = &hdev->discovery;
1da177e4
LT		 1134 struct inquiry_info *info = (struct inquiry_info *) buf;
1135 struct inquiry_entry *e;
1136 int copied = 0;
1137
561aafbc 1138 list_for_each_entry(e, &cache->all, all) {
1da177e4 1139 struct inquiry_data *data = &e->data;
b57c1a56
JH		 1140
1141 if (copied >= num)
1142 break;
1143
1da177e4
LT		 1144 bacpy(&info->bdaddr, &data->bdaddr);
1145 info->pscan_rep_mode = data->pscan_rep_mode;
1146 info->pscan_period_mode = data->pscan_period_mode;
1147 info->pscan_mode = data->pscan_mode;
1148 memcpy(info->dev_class, data->dev_class, 3);
1149 info->clock_offset = data->clock_offset;
b57c1a56 1150
1da177e4 1151 info++;
b57c1a56 1152 copied++;
1da177e4
LT		 1153 }
1154
1155 BT_DBG("cache %p, copied %d", cache, copied);
1156 return copied;
1157}
1158
a1d01db1 1159static int hci_inq_req(struct hci_request *req, unsigned long opt)
1da177e4
LT		 1160{
1161 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
42c6b129 1162 struct hci_dev *hdev = req->hdev;
1da177e4
LT		 1163 struct hci_cp_inquiry cp;
1164
1165 BT_DBG("%s", hdev->name);
1166
1167 if (test_bit(HCI_INQUIRY, &hdev->flags))
a1d01db1 1168 return 0;
1da177e4
LT		 1169
1170 /* Start Inquiry */
1171 memcpy(&cp.lap, &ir->lap, 3);
1172 cp.length = ir->length;
1173 cp.num_rsp = ir->num_rsp;
42c6b129 1174 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
a1d01db1
JH		 1175
1176 return 0;
1da177e4
LT		 1177}
1178
1179int hci_inquiry(void __user *arg)
1180{
1181 __u8 __user *ptr = arg;
1182 struct hci_inquiry_req ir;
1183 struct hci_dev *hdev;
1184 int err = 0, do_inquiry = 0, max_rsp;
1185 long timeo;
1186 __u8 *buf;
1187
1188 if (copy_from_user(&ir, ptr, sizeof(ir)))
1189 return -EFAULT;
1190
5a08ecce
AE		 1191 hdev = hci_dev_get(ir.dev_id);
1192 if (!hdev)
1da177e4
LT		 1193 return -ENODEV;
1194
d7a5a11d 1195 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1196 err = -EBUSY;
1197 goto done;
1198 }
1199
d7a5a11d 1200 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1201 err = -EOPNOTSUPP;
1202 goto done;
1203 }
1204
5b69bef5
MH		 1205 if (hdev->dev_type != HCI_BREDR) {
1206 err = -EOPNOTSUPP;
1207 goto done;
1208 }
1209
d7a5a11d 1210 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 1211 err = -EOPNOTSUPP;
1212 goto done;
1213 }
1214
09fd0de5 1215 hci_dev_lock(hdev);
8e87d142 1216 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
a8c5fb1a 1217 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1f9b9a5d 1218 hci_inquiry_cache_flush(hdev);
1da177e4
LT		 1219 do_inquiry = 1;
1220 }
09fd0de5 1221 hci_dev_unlock(hdev);
1da177e4 1222
04837f64 1223 timeo = ir.length * msecs_to_jiffies(2000);
70f23020
AE		 1224
1225 if (do_inquiry) {
01178cd4 1226 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
4ebeee2d 1227 timeo, NULL);
70f23020
AE		 1228 if (err < 0)
1229 goto done;
3e13fa1e
AG		 1230
1231 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1232 * cleared). If it is interrupted by a signal, return -EINTR.
1233 */
74316201 1234 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
3e13fa1e
AG		 1235 TASK_INTERRUPTIBLE))
1236 return -EINTR;
70f23020 1237 }
1da177e4 1238
8fc9ced3
GP		 1239 /* for unlimited number of responses we will use buffer with
1240 * 255 entries
1241 */
1da177e4
LT		 1242 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1243
1244 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1245 * copy it to the user space.
1246 */
01df8c31 1247 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
70f23020 1248 if (!buf) {
1da177e4
LT		 1249 err = -ENOMEM;
1250 goto done;
1251 }
1252
09fd0de5 1253 hci_dev_lock(hdev);
1da177e4 1254 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
09fd0de5 1255 hci_dev_unlock(hdev);
1da177e4
LT		 1256
1257 BT_DBG("num_rsp %d", ir.num_rsp);
1258
1259 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1260 ptr += sizeof(ir);
1261 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
a8c5fb1a 1262 ir.num_rsp))
1da177e4 1263 err = -EFAULT;
8e87d142 1264 } else
1da177e4
LT		 1265 err = -EFAULT;
1266
1267 kfree(buf);
1268
1269done:
1270 hci_dev_put(hdev);
1271 return err;
1272}
1273
cbed0ca1 1274static int hci_dev_do_open(struct hci_dev *hdev)
1da177e4 1275{
1da177e4
LT		 1276 int ret = 0;
1277
1da177e4
LT		 1278 BT_DBG("%s %p", hdev->name, hdev);
1279
b504430c 1280 hci_req_sync_lock(hdev);
1da177e4 1281
d7a5a11d 1282 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
94324962
JH		 1283 ret = -ENODEV;
1284 goto done;
1285 }
1286
d7a5a11d
MH		 1287 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1288 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
a5c8f270
MH		 1289 /* Check for rfkill but allow the HCI setup stage to
1290 * proceed (which in itself doesn't cause any RF activity).
1291 */
d7a5a11d 1292 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
a5c8f270
MH		 1293 ret = -ERFKILL;
1294 goto done;
1295 }
1296
1297 /* Check for valid public address or a configured static
1298 * random adddress, but let the HCI setup proceed to
1299 * be able to determine if there is a public address
1300 * or not.
1301 *
c6beca0e
MH		 1302 * In case of user channel usage, it is not important
1303 * if a public address or static random address is
1304 * available.
1305 *
a5c8f270
MH		 1306 * This check is only valid for BR/EDR controllers
1307 * since AMP controllers do not have an address.
1308 */
d7a5a11d 1309 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
c6beca0e 1310 hdev->dev_type == HCI_BREDR &&
a5c8f270
MH		 1311 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1312 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1313 ret = -EADDRNOTAVAIL;
1314 goto done;
1315 }
611b30f7
MH		 1316 }
1317
1da177e4
LT		 1318 if (test_bit(HCI_UP, &hdev->flags)) {
1319 ret = -EALREADY;
1320 goto done;
1321 }
1322
1da177e4
LT		 1323 if (hdev->open(hdev)) {
1324 ret = -EIO;
1325 goto done;
1326 }
1327
e9ca8bf1 1328 set_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1329 hci_sock_dev_event(hdev, HCI_DEV_OPEN);
4a3f95b7 1330
f41c70c4
MH		 1331 atomic_set(&hdev->cmd_cnt, 1);
1332 set_bit(HCI_INIT, &hdev->flags);
1333
d7a5a11d 1334 if (hci_dev_test_flag(hdev, HCI_SETUP)) {
e131d74a
MH		 1335 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1336
af202f84
MH		 1337 if (hdev->setup)
1338 ret = hdev->setup(hdev);
f41c70c4 1339
af202f84
MH		 1340 /* The transport driver can set these quirks before
1341 * creating the HCI device or in its setup callback.
1342 *
1343 * In case any of them is set, the controller has to
1344 * start up as unconfigured.
1345 */
eb1904f4
MH		 1346 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1347 test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
a1536da2 1348 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
f41c70c4 1349
0ebca7d6
MH		 1350 /* For an unconfigured controller it is required to
1351 * read at least the version information provided by
1352 * the Read Local Version Information command.
1353 *
1354 * If the set_bdaddr driver callback is provided, then
1355 * also the original Bluetooth public device address
1356 * will be read using the Read BD Address command.
1357 */
d7a5a11d 1358 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
0ebca7d6 1359 ret = __hci_unconf_init(hdev);
89bc22d2
MH		 1360 }
1361
d7a5a11d 1362 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
9713c17b
MH		 1363 /* If public address change is configured, ensure that
1364 * the address gets programmed. If the driver does not
1365 * support changing the public address, fail the power
1366 * on procedure.
1367 */
1368 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1369 hdev->set_bdaddr)
24c457e2
MH		 1370 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1371 else
1372 ret = -EADDRNOTAVAIL;
1373 }
1374
f41c70c4 1375 if (!ret) {
d7a5a11d 1376 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
98a63aaf 1377 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
f41c70c4 1378 ret = __hci_init(hdev);
98a63aaf
MH		 1379 if (!ret && hdev->post_init)
1380 ret = hdev->post_init(hdev);
1381 }
1da177e4
LT		 1382 }
1383
7e995b9e
MH		 1384 /* If the HCI Reset command is clearing all diagnostic settings,
1385 * then they need to be reprogrammed after the init procedure
1386 * completed.
1387 */
1388 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
1389 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1390 ret = hdev->set_diag(hdev, true);
1391
f41c70c4
MH		 1392 clear_bit(HCI_INIT, &hdev->flags);
1393
1da177e4
LT		 1394 if (!ret) {
1395 hci_dev_hold(hdev);
a1536da2 1396 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1da177e4 1397 set_bit(HCI_UP, &hdev->flags);
05fcd4c4 1398 hci_sock_dev_event(hdev, HCI_DEV_UP);
6d5d2ee6 1399 hci_leds_update_powered(hdev, true);
d7a5a11d
MH		 1400 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1401 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1402 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1403 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
2ff13894 1404 hci_dev_test_flag(hdev, HCI_MGMT) &&
1514b892 1405 hdev->dev_type == HCI_BREDR) {
2ff13894
JH		 1406 ret = __hci_req_hci_power_on(hdev);
1407 mgmt_power_on(hdev, ret);
56e5cb86 1408 }
8e87d142 1409 } else {
1da177e4 1410 /* Init failed, cleanup */
3eff45ea 1411 flush_work(&hdev->tx_work);
c347b765 1412 flush_work(&hdev->cmd_work);
b78752cc 1413 flush_work(&hdev->rx_work);
1da177e4
LT		 1414
1415 skb_queue_purge(&hdev->cmd_q);
1416 skb_queue_purge(&hdev->rx_q);
1417
1418 if (hdev->flush)
1419 hdev->flush(hdev);
1420
1421 if (hdev->sent_cmd) {
1422 kfree_skb(hdev->sent_cmd);
1423 hdev->sent_cmd = NULL;
1424 }
1425
e9ca8bf1 1426 clear_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1427 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
4a3f95b7 1428
1da177e4 1429 hdev->close(hdev);
fee746b0 1430 hdev->flags &= BIT(HCI_RAW);
1da177e4
LT		 1431 }
1432
1433done:
b504430c 1434 hci_req_sync_unlock(hdev);
1da177e4
LT		 1435 return ret;
1436}
1437
cbed0ca1
JH		 1438/* ---- HCI ioctl helpers ---- */
1439
1440int hci_dev_open(__u16 dev)
1441{
1442 struct hci_dev *hdev;
1443 int err;
1444
1445 hdev = hci_dev_get(dev);
1446 if (!hdev)
1447 return -ENODEV;
1448
4a964404 1449 /* Devices that are marked as unconfigured can only be powered
fee746b0
MH		 1450 * up as user channel. Trying to bring them up as normal devices
1451 * will result into a failure. Only user channel operation is
1452 * possible.
1453 *
1454 * When this function is called for a user channel, the flag
1455 * HCI_USER_CHANNEL will be set first before attempting to
1456 * open the device.
1457 */
d7a5a11d
MH		 1458 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1459 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
fee746b0
MH		 1460 err = -EOPNOTSUPP;
1461 goto done;
1462 }
1463
e1d08f40
JH		 1464 /* We need to ensure that no other power on/off work is pending
1465 * before proceeding to call hci_dev_do_open. This is
1466 * particularly important if the setup procedure has not yet
1467 * completed.
1468 */
a69d8927 1469 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
e1d08f40
JH		 1470 cancel_delayed_work(&hdev->power_off);
1471
a5c8f270
MH		 1472 /* After this call it is guaranteed that the setup procedure
1473 * has finished. This means that error conditions like RFKILL
1474 * or no valid public or static random address apply.
1475 */
e1d08f40
JH		 1476 flush_workqueue(hdev->req_workqueue);
1477
12aa4f0a 1478 /* For controllers not using the management interface and that
b6ae8457 1479 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
12aa4f0a
MH		 1480 * so that pairing works for them. Once the management interface
1481 * is in use this bit will be cleared again and userspace has
1482 * to explicitly enable it.
1483 */
d7a5a11d
MH		 1484 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1485 !hci_dev_test_flag(hdev, HCI_MGMT))
a1536da2 1486 hci_dev_set_flag(hdev, HCI_BONDABLE);
12aa4f0a 1487
cbed0ca1
JH		 1488 err = hci_dev_do_open(hdev);
1489
fee746b0 1490done:
cbed0ca1 1491 hci_dev_put(hdev);
cbed0ca1
JH		 1492 return err;
1493}
1494
d7347f3c
JH		 1495/* This function requires the caller holds hdev->lock */
1496static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1497{
1498 struct hci_conn_params *p;
1499
f161dd41
JH		 1500 list_for_each_entry(p, &hdev->le_conn_params, list) {
1501 if (p->conn) {
1502 hci_conn_drop(p->conn);
f8aaf9b6 1503 hci_conn_put(p->conn);
f161dd41
JH		 1504 p->conn = NULL;
1505 }
d7347f3c 1506 list_del_init(&p->action);
f161dd41 1507 }
d7347f3c
JH		 1508
1509 BT_DBG("All LE pending actions cleared");
1510}
1511
6b3cc1db 1512int hci_dev_do_close(struct hci_dev *hdev)
1da177e4 1513{
acc649c6
MH		 1514 bool auto_off;
1515
1da177e4
LT		 1516 BT_DBG("%s %p", hdev->name, hdev);
1517
d24d8144 1518 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
867146a0 1519 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
d24d8144 1520 test_bit(HCI_UP, &hdev->flags)) {
a44fecbd
THJA		 1521 /* Execute vendor specific shutdown routine */
1522 if (hdev->shutdown)
1523 hdev->shutdown(hdev);
1524 }
1525
78c04c0b
VCG		 1526 cancel_delayed_work(&hdev->power_off);
1527
7df0f73e 1528 hci_request_cancel_all(hdev);
b504430c 1529 hci_req_sync_lock(hdev);
1da177e4
LT		 1530
1531 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
65cc2b49 1532 cancel_delayed_work_sync(&hdev->cmd_timer);
b504430c 1533 hci_req_sync_unlock(hdev);
1da177e4
LT		 1534 return 0;
1535 }
1536
6d5d2ee6
HK		 1537 hci_leds_update_powered(hdev, false);
1538
3eff45ea
GP		 1539 /* Flush RX and TX works */
1540 flush_work(&hdev->tx_work);
b78752cc 1541 flush_work(&hdev->rx_work);
1da177e4 1542
16ab91ab 1543 if (hdev->discov_timeout > 0) {
16ab91ab 1544 hdev->discov_timeout = 0;
a358dc11
MH		 1545 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1546 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
16ab91ab
JH		 1547 }
1548
a69d8927 1549 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
7d78525d
JH		 1550 cancel_delayed_work(&hdev->service_cache);
1551
d7a5a11d 1552 if (hci_dev_test_flag(hdev, HCI_MGMT))
4518bb0f 1553 cancel_delayed_work_sync(&hdev->rpa_expired);
7ba8b4be 1554
76727c02
JH		 1555 /* Avoid potential lockdep warnings from the *_flush() calls by
1556 * ensuring the workqueue is empty up front.
1557 */
1558 drain_workqueue(hdev->workqueue);
1559
09fd0de5 1560 hci_dev_lock(hdev);
1aeb9c65 1561
8f502f84
JH		 1562 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1563
acc649c6
MH		 1564 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1565
2ff13894
JH		 1566 if (!auto_off && hdev->dev_type == HCI_BREDR &&
1567 hci_dev_test_flag(hdev, HCI_MGMT))
1568 __mgmt_power_off(hdev);
1aeb9c65 1569
1f9b9a5d 1570 hci_inquiry_cache_flush(hdev);
d7347f3c 1571 hci_pend_le_actions_clear(hdev);
f161dd41 1572 hci_conn_hash_flush(hdev);
09fd0de5 1573 hci_dev_unlock(hdev);
1da177e4 1574
64dae967
MH		 1575 smp_unregister(hdev);
1576
05fcd4c4 1577 hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1da177e4
LT		 1578
1579 if (hdev->flush)
1580 hdev->flush(hdev);
1581
1582 /* Reset device */
1583 skb_queue_purge(&hdev->cmd_q);
1584 atomic_set(&hdev->cmd_cnt, 1);
acc649c6
MH		 1585 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1586 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1da177e4 1587 set_bit(HCI_INIT, &hdev->flags);
4ebeee2d 1588 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1da177e4
LT		 1589 clear_bit(HCI_INIT, &hdev->flags);
1590 }
1591
c347b765
GP		 1592 /* flush cmd work */
1593 flush_work(&hdev->cmd_work);
1da177e4
LT		 1594
1595 /* Drop queues */
1596 skb_queue_purge(&hdev->rx_q);
1597 skb_queue_purge(&hdev->cmd_q);
1598 skb_queue_purge(&hdev->raw_q);
1599
1600 /* Drop last sent command */
1601 if (hdev->sent_cmd) {
65cc2b49 1602 cancel_delayed_work_sync(&hdev->cmd_timer);
1da177e4
LT		 1603 kfree_skb(hdev->sent_cmd);
1604 hdev->sent_cmd = NULL;
1605 }
1606
e9ca8bf1 1607 clear_bit(HCI_RUNNING, &hdev->flags);
05fcd4c4 1608 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
4a3f95b7 1609
1da177e4
LT		 1610 /* After this point our queues are empty
1611 * and no tasks are scheduled. */
1612 hdev->close(hdev);
1613
35b973c9 1614 /* Clear flags */
fee746b0 1615 hdev->flags &= BIT(HCI_RAW);
eacb44df 1616 hci_dev_clear_volatile_flags(hdev);
35b973c9 1617
ced5c338 1618 /* Controller radio is available but is currently powered down */
536619e8 1619 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
ced5c338 1620
e59fda8d 1621 memset(hdev->eir, 0, sizeof(hdev->eir));
09b3c3fb 1622 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
7a4cd51d 1623 bacpy(&hdev->random_addr, BDADDR_ANY);
e59fda8d 1624
b504430c 1625 hci_req_sync_unlock(hdev);
1da177e4
LT		 1626
1627 hci_dev_put(hdev);
1628 return 0;
1629}
1630
1631int hci_dev_close(__u16 dev)
1632{
1633 struct hci_dev *hdev;
1634 int err;
1635
70f23020
AE		 1636 hdev = hci_dev_get(dev);
1637 if (!hdev)
1da177e4 1638 return -ENODEV;
8ee56540 1639
d7a5a11d 1640 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1641 err = -EBUSY;
1642 goto done;
1643 }
1644
a69d8927 1645 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
8ee56540
MH		 1646 cancel_delayed_work(&hdev->power_off);
1647
1da177e4 1648 err = hci_dev_do_close(hdev);
8ee56540 1649
0736cfa8 1650done:
1da177e4
LT		 1651 hci_dev_put(hdev);
1652 return err;
1653}
1654
5c912495 1655static int hci_dev_do_reset(struct hci_dev *hdev)
1da177e4 1656{
5c912495 1657 int ret;
1da177e4 1658
5c912495 1659 BT_DBG("%s %p", hdev->name, hdev);
1da177e4 1660
b504430c 1661 hci_req_sync_lock(hdev);
1da177e4 1662
1da177e4
LT		 1663 /* Drop queues */
1664 skb_queue_purge(&hdev->rx_q);
1665 skb_queue_purge(&hdev->cmd_q);
1666
76727c02
JH		 1667 /* Avoid potential lockdep warnings from the *_flush() calls by
1668 * ensuring the workqueue is empty up front.
1669 */
1670 drain_workqueue(hdev->workqueue);
1671
09fd0de5 1672 hci_dev_lock(hdev);
1f9b9a5d 1673 hci_inquiry_cache_flush(hdev);
1da177e4 1674 hci_conn_hash_flush(hdev);
09fd0de5 1675 hci_dev_unlock(hdev);
1da177e4
LT		 1676
1677 if (hdev->flush)
1678 hdev->flush(hdev);
1679
8e87d142 1680 atomic_set(&hdev->cmd_cnt, 1);
6ed58ec5 1681 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1da177e4 1682
4ebeee2d 1683 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1da177e4 1684
b504430c 1685 hci_req_sync_unlock(hdev);
1da177e4
LT		 1686 return ret;
1687}
1688
5c912495
MH		 1689int hci_dev_reset(__u16 dev)
1690{
1691 struct hci_dev *hdev;
1692 int err;
1693
1694 hdev = hci_dev_get(dev);
1695 if (!hdev)
1696 return -ENODEV;
1697
1698 if (!test_bit(HCI_UP, &hdev->flags)) {
1699 err = -ENETDOWN;
1700 goto done;
1701 }
1702
d7a5a11d 1703 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
5c912495
MH		 1704 err = -EBUSY;
1705 goto done;
1706 }
1707
d7a5a11d 1708 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
5c912495
MH		 1709 err = -EOPNOTSUPP;
1710 goto done;
1711 }
1712
1713 err = hci_dev_do_reset(hdev);
1714
1715done:
1716 hci_dev_put(hdev);
1717 return err;
1718}
1719
1da177e4
LT		 1720int hci_dev_reset_stat(__u16 dev)
1721{
1722 struct hci_dev *hdev;
1723 int ret = 0;
1724
70f23020
AE		 1725 hdev = hci_dev_get(dev);
1726 if (!hdev)
1da177e4
LT		 1727 return -ENODEV;
1728
d7a5a11d 1729 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1730 ret = -EBUSY;
1731 goto done;
1732 }
1733
d7a5a11d 1734 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1735 ret = -EOPNOTSUPP;
1736 goto done;
1737 }
1738
1da177e4
LT		 1739 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1740
0736cfa8 1741done:
1da177e4 1742 hci_dev_put(hdev);
1da177e4
LT		 1743 return ret;
1744}
1745
123abc08
JH		 1746static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1747{
bc6d2d04 1748 bool conn_changed, discov_changed;
123abc08
JH		 1749
1750 BT_DBG("%s scan 0x%02x", hdev->name, scan);
1751
1752 if ((scan & SCAN_PAGE))
238be788
MH		 1753 conn_changed = !hci_dev_test_and_set_flag(hdev,
1754 HCI_CONNECTABLE);
123abc08 1755 else
a69d8927
MH		 1756 conn_changed = hci_dev_test_and_clear_flag(hdev,
1757 HCI_CONNECTABLE);
123abc08 1758
bc6d2d04 1759 if ((scan & SCAN_INQUIRY)) {
238be788
MH		 1760 discov_changed = !hci_dev_test_and_set_flag(hdev,
1761 HCI_DISCOVERABLE);
bc6d2d04 1762 } else {
a358dc11 1763 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
a69d8927
MH		 1764 discov_changed = hci_dev_test_and_clear_flag(hdev,
1765 HCI_DISCOVERABLE);
bc6d2d04
JH		 1766 }
1767
d7a5a11d 1768 if (!hci_dev_test_flag(hdev, HCI_MGMT))
123abc08
JH		 1769 return;
1770
bc6d2d04
JH		 1771 if (conn_changed || discov_changed) {
1772 /* In case this was disabled through mgmt */
a1536da2 1773 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
bc6d2d04 1774
d7a5a11d 1775 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
cab054ab 1776 hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
bc6d2d04 1777
123abc08 1778 mgmt_new_settings(hdev);
bc6d2d04 1779 }
123abc08
JH		 1780}
1781
1da177e4
LT		 1782int hci_dev_cmd(unsigned int cmd, void __user *arg)
1783{
1784 struct hci_dev *hdev;
1785 struct hci_dev_req dr;
1786 int err = 0;
1787
1788 if (copy_from_user(&dr, arg, sizeof(dr)))
1789 return -EFAULT;
1790
70f23020
AE		 1791 hdev = hci_dev_get(dr.dev_id);
1792 if (!hdev)
1da177e4
LT		 1793 return -ENODEV;
1794
d7a5a11d 1795 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
0736cfa8
MH		 1796 err = -EBUSY;
1797 goto done;
1798 }
1799
d7a5a11d 1800 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
fee746b0
MH		 1801 err = -EOPNOTSUPP;
1802 goto done;
1803 }
1804
5b69bef5
MH		 1805 if (hdev->dev_type != HCI_BREDR) {
1806 err = -EOPNOTSUPP;
1807 goto done;
1808 }
1809
d7a5a11d 1810 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
56f87901
JH		 1811 err = -EOPNOTSUPP;
1812 goto done;
1813 }
1814
1da177e4
LT		 1815 switch (cmd) {
1816 case HCISETAUTH:
01178cd4 1817 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 1818 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1819 break;
1820
1821 case HCISETENCRYPT:
1822 if (!lmp_encrypt_capable(hdev)) {
1823 err = -EOPNOTSUPP;
1824 break;
1825 }
1826
1827 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1828 /* Auth must be enabled first */
01178cd4 1829 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
4ebeee2d 1830 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1831 if (err)
1832 break;
1833 }
1834
01178cd4 1835 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
4ebeee2d 1836 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1837 break;
1838
1839 case HCISETSCAN:
01178cd4 1840 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
4ebeee2d 1841 HCI_INIT_TIMEOUT, NULL);
91a668b0 1842
bc6d2d04
JH		 1843 /* Ensure that the connectable and discoverable states
1844 * get correctly modified as this was a non-mgmt change.
91a668b0 1845 */
123abc08
JH		 1846 if (!err)
1847 hci_update_scan_state(hdev, dr.dev_opt);
1da177e4
LT		 1848 break;
1849
1da177e4 1850 case HCISETLINKPOL:
01178cd4 1851 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
4ebeee2d 1852 HCI_INIT_TIMEOUT, NULL);
1da177e4
LT		 1853 break;
1854
1855 case HCISETLINKMODE:
e4e8e37c
MH		 1856 hdev->link_mode = ((__u16) dr.dev_opt) &
1857 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1858 break;
1859
1860 case HCISETPTYPE:
1861 hdev->pkt_type = (__u16) dr.dev_opt;
1da177e4
LT		 1862 break;
1863
1864 case HCISETACLMTU:
e4e8e37c
MH		 1865 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1866 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1867 break;
1868
1869 case HCISETSCOMTU:
e4e8e37c
MH		 1870 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1871 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1da177e4
LT		 1872 break;
1873
1874 default:
1875 err = -EINVAL;
1876 break;
1877 }
e4e8e37c 1878
0736cfa8 1879done:
1da177e4
LT		 1880 hci_dev_put(hdev);
1881 return err;
1882}
1883
1884int hci_get_dev_list(void __user *arg)
1885{
8035ded4 1886 struct hci_dev *hdev;
1da177e4
LT		 1887 struct hci_dev_list_req *dl;
1888 struct hci_dev_req *dr;
1da177e4
LT		 1889 int n = 0, size, err;
1890 __u16 dev_num;
1891
1892 if (get_user(dev_num, (__u16 __user *) arg))
1893 return -EFAULT;
1894
1895 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1896 return -EINVAL;
1897
1898 size = sizeof(*dl) + dev_num * sizeof(*dr);
1899
70f23020
AE		 1900 dl = kzalloc(size, GFP_KERNEL);
1901 if (!dl)
1da177e4
LT		 1902 return -ENOMEM;
1903
1904 dr = dl->dev_req;
1905
f20d09d5 1906 read_lock(&hci_dev_list_lock);
8035ded4 1907 list_for_each_entry(hdev, &hci_dev_list, list) {
2e84d8db 1908 unsigned long flags = hdev->flags;
c542a06c 1909
2e84d8db
MH		 1910 /* When the auto-off is configured it means the transport
1911 * is running, but in that case still indicate that the
1912 * device is actually down.
1913 */
d7a5a11d 1914 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db 1915 flags &= ~BIT(HCI_UP);
c542a06c 1916
1da177e4 1917 (dr + n)->dev_id = hdev->id;
2e84d8db 1918 (dr + n)->dev_opt = flags;
c542a06c 1919
1da177e4
LT		 1920 if (++n >= dev_num)
1921 break;
1922 }
f20d09d5 1923 read_unlock(&hci_dev_list_lock);
1da177e4
LT		 1924
1925 dl->dev_num = n;
1926 size = sizeof(*dl) + n * sizeof(*dr);
1927
1928 err = copy_to_user(arg, dl, size);
1929 kfree(dl);
1930
1931 return err ? -EFAULT : 0;
1932}
1933
1934int hci_get_dev_info(void __user *arg)
1935{
1936 struct hci_dev *hdev;
1937 struct hci_dev_info di;
2e84d8db 1938 unsigned long flags;
1da177e4
LT		 1939 int err = 0;
1940
1941 if (copy_from_user(&di, arg, sizeof(di)))
1942 return -EFAULT;
1943
70f23020
AE		 1944 hdev = hci_dev_get(di.dev_id);
1945 if (!hdev)
1da177e4
LT		 1946 return -ENODEV;
1947
2e84d8db
MH		 1948 /* When the auto-off is configured it means the transport
1949 * is running, but in that case still indicate that the
1950 * device is actually down.
1951 */
d7a5a11d 1952 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2e84d8db
MH		 1953 flags = hdev->flags & ~BIT(HCI_UP);
1954 else
1955 flags = hdev->flags;
c542a06c 1956
1da177e4
LT		 1957 strcpy(di.name, hdev->name);
1958 di.bdaddr = hdev->bdaddr;
60f2a3ed 1959 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2e84d8db 1960 di.flags = flags;
1da177e4 1961 di.pkt_type = hdev->pkt_type;
572c7f84
JH		 1962 if (lmp_bredr_capable(hdev)) {
1963 di.acl_mtu = hdev->acl_mtu;
1964 di.acl_pkts = hdev->acl_pkts;
1965 di.sco_mtu = hdev->sco_mtu;
1966 di.sco_pkts = hdev->sco_pkts;
1967 } else {
1968 di.acl_mtu = hdev->le_mtu;
1969 di.acl_pkts = hdev->le_pkts;
1970 di.sco_mtu = 0;
1971 di.sco_pkts = 0;
1972 }
1da177e4
LT		 1973 di.link_policy = hdev->link_policy;
1974 di.link_mode = hdev->link_mode;
1975
1976 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1977 memcpy(&di.features, &hdev->features, sizeof(di.features));
1978
1979 if (copy_to_user(arg, &di, sizeof(di)))
1980 err = -EFAULT;
1981
1982 hci_dev_put(hdev);
1983
1984 return err;
1985}
1986
1987/* ---- Interface to HCI drivers ---- */
1988
611b30f7
MH		 1989static int hci_rfkill_set_block(void *data, bool blocked)
1990{
1991 struct hci_dev *hdev = data;
1992
1993 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1994
d7a5a11d 1995 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
0736cfa8
MH		 1996 return -EBUSY;
1997
5e130367 1998 if (blocked) {
a1536da2 1999 hci_dev_set_flag(hdev, HCI_RFKILLED);
d7a5a11d
MH		 2000 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2001 !hci_dev_test_flag(hdev, HCI_CONFIG))
bf543036 2002 hci_dev_do_close(hdev);
5e130367 2003 } else {
a358dc11 2004 hci_dev_clear_flag(hdev, HCI_RFKILLED);
1025c04c 2005 }
611b30f7
MH		 2006
2007 return 0;
2008}
2009
2010static const struct rfkill_ops hci_rfkill_ops = {
2011 .set_block = hci_rfkill_set_block,
2012};
2013
ab81cbf9
JH		 2014static void hci_power_on(struct work_struct *work)
2015{
2016 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
96570ffc 2017 int err;
ab81cbf9
JH		 2018
2019 BT_DBG("%s", hdev->name);
2020
2ff13894
JH		 2021 if (test_bit(HCI_UP, &hdev->flags) &&
2022 hci_dev_test_flag(hdev, HCI_MGMT) &&
2023 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
2024 hci_req_sync_lock(hdev);
2025 err = __hci_req_hci_power_on(hdev);
2026 hci_req_sync_unlock(hdev);
2027 mgmt_power_on(hdev, err);
2028 return;
2029 }
2030
cbed0ca1 2031 err = hci_dev_do_open(hdev);
96570ffc 2032 if (err < 0) {
3ad67582 2033 hci_dev_lock(hdev);
96570ffc 2034 mgmt_set_powered_failed(hdev, err);
3ad67582 2035 hci_dev_unlock(hdev);
ab81cbf9 2036 return;
96570ffc 2037 }
ab81cbf9 2038
a5c8f270
MH		 2039 /* During the HCI setup phase, a few error conditions are
2040 * ignored and they need to be checked now. If they are still
2041 * valid, it is important to turn the device back off.
2042 */
d7a5a11d
MH		 2043 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2044 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
a5c8f270
MH		 2045 (hdev->dev_type == HCI_BREDR &&
2046 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2047 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
a358dc11 2048 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
bf543036 2049 hci_dev_do_close(hdev);
d7a5a11d 2050 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
19202573
JH		 2051 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2052 HCI_AUTO_OFF_TIMEOUT);
bf543036 2053 }
ab81cbf9 2054
a69d8927 2055 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
4a964404
MH		 2056 /* For unconfigured devices, set the HCI_RAW flag
2057 * so that userspace can easily identify them.
4a964404 2058 */
d7a5a11d 2059 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4a964404 2060 set_bit(HCI_RAW, &hdev->flags);
0602a8ad
MH		 2061
2062 /* For fully configured devices, this will send
2063 * the Index Added event. For unconfigured devices,
2064 * it will send Unconfigued Index Added event.
2065 *
2066 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2067 * and no event will be send.
2068 */
2069 mgmt_index_added(hdev);
a69d8927 2070 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
5ea234d3
MH		 2071 /* When the controller is now configured, then it
2072 * is important to clear the HCI_RAW flag.
2073 */
d7a5a11d 2074 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5ea234d3
MH		 2075 clear_bit(HCI_RAW, &hdev->flags);
2076
d603b76b
MH		 2077 /* Powering on the controller with HCI_CONFIG set only
2078 * happens with the transition from unconfigured to
2079 * configured. This will send the Index Added event.
2080 */
744cf19e 2081 mgmt_index_added(hdev);
fee746b0 2082 }
ab81cbf9
JH		 2083}
2084
2085static void hci_power_off(struct work_struct *work)
2086{
3243553f 2087 struct hci_dev *hdev = container_of(work, struct hci_dev,
a8c5fb1a 2088 power_off.work);
ab81cbf9
JH		 2089
2090 BT_DBG("%s", hdev->name);
2091
8ee56540 2092 hci_dev_do_close(hdev);
ab81cbf9
JH		 2093}
2094
c7741d16
MH		 2095static void hci_error_reset(struct work_struct *work)
2096{
2097 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2098
2099 BT_DBG("%s", hdev->name);
2100
2101 if (hdev->hw_error)
2102 hdev->hw_error(hdev, hdev->hw_error_code);
2103 else
2104 BT_ERR("%s hardware error 0x%2.2x", hdev->name,
2105 hdev->hw_error_code);
2106
2107 if (hci_dev_do_close(hdev))
2108 return;
2109
c7741d16
MH		 2110 hci_dev_do_open(hdev);
2111}
2112
35f7498a 2113void hci_uuids_clear(struct hci_dev *hdev)
2aeb9a1a 2114{
4821002c 2115 struct bt_uuid *uuid, *tmp;
2aeb9a1a 2116
4821002c
JH		 2117 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2118 list_del(&uuid->list);
2aeb9a1a
JH		 2119 kfree(uuid);
2120 }
2aeb9a1a
JH		 2121}
2122
35f7498a 2123void hci_link_keys_clear(struct hci_dev *hdev)
55ed8ca1 2124{
0378b597 2125 struct link_key *key;
55ed8ca1 2126
0378b597
JH		 2127 list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2128 list_del_rcu(&key->list);
2129 kfree_rcu(key, rcu);
55ed8ca1 2130 }
55ed8ca1
JH		 2131}
2132
35f7498a 2133void hci_smp_ltks_clear(struct hci_dev *hdev)
b899efaf 2134{
970d0f1b 2135 struct smp_ltk *k;
b899efaf 2136
970d0f1b
JH		 2137 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2138 list_del_rcu(&k->list);
2139 kfree_rcu(k, rcu);
b899efaf 2140 }
b899efaf
VCG		 2141}
2142
970c4e46
JH		 2143void hci_smp_irks_clear(struct hci_dev *hdev)
2144{
adae20cb 2145 struct smp_irk *k;
970c4e46 2146
adae20cb
JH		 2147 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2148 list_del_rcu(&k->list);
2149 kfree_rcu(k, rcu);
970c4e46
JH		 2150 }
2151}
2152
55ed8ca1
JH		 2153struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2154{
8035ded4 2155 struct link_key *k;
55ed8ca1 2156
0378b597
JH		 2157 rcu_read_lock();
2158 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2159 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2160 rcu_read_unlock();
55ed8ca1 2161 return k;
0378b597
JH		 2162 }
2163 }
2164 rcu_read_unlock();
55ed8ca1
JH		 2165
2166 return NULL;
2167}
2168
745c0ce3 2169static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
a8c5fb1a 2170 u8 key_type, u8 old_key_type)
d25e28ab
JH		 2171{
2172 /* Legacy key */
2173 if (key_type < 0x03)
745c0ce3 2174 return true;
d25e28ab
JH		 2175
2176 /* Debug keys are insecure so don't store them persistently */
2177 if (key_type == HCI_LK_DEBUG_COMBINATION)
745c0ce3 2178 return false;
d25e28ab
JH		 2179
2180 /* Changed combination key and there's no previous one */
2181 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
745c0ce3 2182 return false;
d25e28ab
JH		 2183
2184 /* Security mode 3 case */
2185 if (!conn)
745c0ce3 2186 return true;
d25e28ab 2187
e3befab9
JH		 2188 /* BR/EDR key derived using SC from an LE link */
2189 if (conn->type == LE_LINK)
2190 return true;
2191
d25e28ab
JH		 2192 /* Neither local nor remote side had no-bonding as requirement */
2193 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
745c0ce3 2194 return true;
d25e28ab
JH		 2195
2196 /* Local side had dedicated bonding as requirement */
2197 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
745c0ce3 2198 return true;
d25e28ab
JH		 2199
2200 /* Remote side had dedicated bonding as requirement */
2201 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
745c0ce3 2202 return true;
d25e28ab
JH		 2203
2204 /* If none of the above criteria match, then don't store the key
2205 * persistently */
745c0ce3 2206 return false;
d25e28ab
JH		 2207}
2208
e804d25d 2209static u8 ltk_role(u8 type)
98a0b845 2210{
e804d25d
JH		 2211 if (type == SMP_LTK)
2212 return HCI_ROLE_MASTER;
98a0b845 2213
e804d25d 2214 return HCI_ROLE_SLAVE;
98a0b845
JH		 2215}
2216
f3a73d97
JH		 2217struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2218 u8 addr_type, u8 role)
75d262c2 2219{
c9839a11 2220 struct smp_ltk *k;
75d262c2 2221
970d0f1b
JH		 2222 rcu_read_lock();
2223 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
5378bc56
JH		 2224 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2225 continue;
2226
923e2414 2227 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
970d0f1b 2228 rcu_read_unlock();
75d262c2 2229 return k;
970d0f1b
JH		 2230 }
2231 }
2232 rcu_read_unlock();
75d262c2
VCG		 2233
2234 return NULL;
2235}
75d262c2 2236
970c4e46
JH		 2237struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2238{
2239 struct smp_irk *irk;
2240
adae20cb
JH		 2241 rcu_read_lock();
2242 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2243 if (!bacmp(&irk->rpa, rpa)) {
2244 rcu_read_unlock();
970c4e46 2245 return irk;
adae20cb 2246 }
970c4e46
JH		 2247 }
2248
adae20cb 2249 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
defce9e8 2250 if (smp_irk_matches(hdev, irk->val, rpa)) {
970c4e46 2251 bacpy(&irk->rpa, rpa);
adae20cb 2252 rcu_read_unlock();
970c4e46
JH		 2253 return irk;
2254 }
2255 }
adae20cb 2256 rcu_read_unlock();
970c4e46
JH		 2257
2258 return NULL;
2259}
2260
2261struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2262 u8 addr_type)
2263{
2264 struct smp_irk *irk;
2265
6cfc9988
JH		 2266 /* Identity Address must be public or static random */
2267 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2268 return NULL;
2269
adae20cb
JH		 2270 rcu_read_lock();
2271 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
970c4e46 2272 if (addr_type == irk->addr_type &&
adae20cb
JH		 2273 bacmp(bdaddr, &irk->bdaddr) == 0) {
2274 rcu_read_unlock();
970c4e46 2275 return irk;
adae20cb 2276 }
970c4e46 2277 }
adae20cb 2278 rcu_read_unlock();
970c4e46
JH		 2279
2280 return NULL;
2281}
2282
567fa2aa 2283struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
7652ff6a
JH		 2284 bdaddr_t *bdaddr, u8 *val, u8 type,
2285 u8 pin_len, bool *persistent)
55ed8ca1
JH		 2286{
2287 struct link_key *key, *old_key;
745c0ce3 2288 u8 old_key_type;
55ed8ca1
JH		 2289
2290 old_key = hci_find_link_key(hdev, bdaddr);
2291 if (old_key) {
2292 old_key_type = old_key->type;
2293 key = old_key;
2294 } else {
12adcf3a 2295 old_key_type = conn ? conn->key_type : 0xff;
0a14ab41 2296 key = kzalloc(sizeof(*key), GFP_KERNEL);
55ed8ca1 2297 if (!key)
567fa2aa 2298 return NULL;
0378b597 2299 list_add_rcu(&key->list, &hdev->link_keys);
55ed8ca1
JH		 2300 }
2301
6ed93dc6 2302 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
55ed8ca1 2303
d25e28ab
JH		 2304 /* Some buggy controller combinations generate a changed
2305 * combination key for legacy pairing even when there's no
2306 * previous key */
2307 if (type == HCI_LK_CHANGED_COMBINATION &&
a8c5fb1a 2308 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
d25e28ab 2309 type = HCI_LK_COMBINATION;
655fe6ec
JH		 2310 if (conn)
2311 conn->key_type = type;
2312 }
d25e28ab 2313
55ed8ca1 2314 bacpy(&key->bdaddr, bdaddr);
9b3b4460 2315 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
55ed8ca1
JH		 2316 key->pin_len = pin_len;
2317
b6020ba0 2318 if (type == HCI_LK_CHANGED_COMBINATION)
55ed8ca1 2319 key->type = old_key_type;
4748fed2
JH		 2320 else
2321 key->type = type;
2322
7652ff6a
JH		 2323 if (persistent)
2324 *persistent = hci_persistent_key(hdev, conn, type,
2325 old_key_type);
4df378a1 2326
567fa2aa 2327 return key;
55ed8ca1
JH		 2328}
2329
ca9142b8 2330struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
35d70271 2331 u8 addr_type, u8 type, u8 authenticated,
fe39c7b2 2332 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
75d262c2 2333{
c9839a11 2334 struct smp_ltk *key, *old_key;
e804d25d 2335 u8 role = ltk_role(type);
75d262c2 2336
f3a73d97 2337 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
c9839a11 2338 if (old_key)
75d262c2 2339 key = old_key;
c9839a11 2340 else {
0a14ab41 2341 key = kzalloc(sizeof(*key), GFP_KERNEL);
75d262c2 2342 if (!key)
ca9142b8 2343 return NULL;
970d0f1b 2344 list_add_rcu(&key->list, &hdev->long_term_keys);
75d262c2
VCG		 2345 }
2346
75d262c2 2347 bacpy(&key->bdaddr, bdaddr);
c9839a11
VCG		 2348 key->bdaddr_type = addr_type;
2349 memcpy(key->val, tk, sizeof(key->val));
2350 key->authenticated = authenticated;
2351 key->ediv = ediv;
fe39c7b2 2352 key->rand = rand;
c9839a11
VCG		 2353 key->enc_size = enc_size;
2354 key->type = type;
75d262c2 2355
ca9142b8 2356 return key;
75d262c2
VCG		 2357}
2358
ca9142b8
JH		 2359struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2360 u8 addr_type, u8 val[16], bdaddr_t *rpa)
970c4e46
JH		 2361{
2362 struct smp_irk *irk;
2363
2364 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2365 if (!irk) {
2366 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2367 if (!irk)
ca9142b8 2368 return NULL;
970c4e46
JH		 2369
2370 bacpy(&irk->bdaddr, bdaddr);
2371 irk->addr_type = addr_type;
2372
adae20cb 2373 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
970c4e46
JH		 2374 }
2375
2376 memcpy(irk->val, val, 16);
2377 bacpy(&irk->rpa, rpa);
2378
ca9142b8 2379 return irk;
970c4e46
JH		 2380}
2381
55ed8ca1
JH		 2382int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2383{
2384 struct link_key *key;
2385
2386 key = hci_find_link_key(hdev, bdaddr);
2387 if (!key)
2388 return -ENOENT;
2389
6ed93dc6 2390 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
55ed8ca1 2391
0378b597
JH		 2392 list_del_rcu(&key->list);
2393 kfree_rcu(key, rcu);
55ed8ca1
JH		 2394
2395 return 0;
2396}
2397
e0b2b27e 2398int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
b899efaf 2399{
970d0f1b 2400 struct smp_ltk *k;
c51ffa0b 2401 int removed = 0;
b899efaf 2402
970d0f1b 2403 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
e0b2b27e 2404 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
b899efaf
VCG		 2405 continue;
2406
6ed93dc6 2407 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
b899efaf 2408
970d0f1b
JH		 2409 list_del_rcu(&k->list);
2410 kfree_rcu(k, rcu);
c51ffa0b 2411 removed++;
b899efaf
VCG		 2412 }
2413
c51ffa0b 2414 return removed ? 0 : -ENOENT;
b899efaf
VCG		 2415}
2416
a7ec7338
JH		 2417void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2418{
adae20cb 2419 struct smp_irk *k;
a7ec7338 2420
adae20cb 2421 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
a7ec7338
JH		 2422 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2423 continue;
2424
2425 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2426
adae20cb
JH		 2427 list_del_rcu(&k->list);
2428 kfree_rcu(k, rcu);
a7ec7338
JH		 2429 }
2430}
2431
55e76b38
JH		 2432bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2433{
2434 struct smp_ltk *k;
4ba9faf3 2435 struct smp_irk *irk;
55e76b38
JH		 2436 u8 addr_type;
2437
2438 if (type == BDADDR_BREDR) {
2439 if (hci_find_link_key(hdev, bdaddr))
2440 return true;
2441 return false;
2442 }
2443
2444 /* Convert to HCI addr type which struct smp_ltk uses */
2445 if (type == BDADDR_LE_PUBLIC)
2446 addr_type = ADDR_LE_DEV_PUBLIC;
2447 else
2448 addr_type = ADDR_LE_DEV_RANDOM;
2449
4ba9faf3
JH		 2450 irk = hci_get_irk(hdev, bdaddr, addr_type);
2451 if (irk) {
2452 bdaddr = &irk->bdaddr;
2453 addr_type = irk->addr_type;
2454 }
2455
55e76b38
JH		 2456 rcu_read_lock();
2457 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
87c8b28d
JH		 2458 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2459 rcu_read_unlock();
55e76b38 2460 return true;
87c8b28d 2461 }
55e76b38
JH		 2462 }
2463 rcu_read_unlock();
2464
2465 return false;
2466}
2467
6bd32326 2468/* HCI command timer function */
65cc2b49 2469static void hci_cmd_timeout(struct work_struct *work)
6bd32326 2470{
65cc2b49
MH		 2471 struct hci_dev *hdev = container_of(work, struct hci_dev,
2472 cmd_timer.work);
6bd32326 2473
bda4f23a
AE		 2474 if (hdev->sent_cmd) {
2475 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2476 u16 opcode = __le16_to_cpu(sent->opcode);
2477
2478 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
2479 } else {
2480 BT_ERR("%s command tx timeout", hdev->name);
2481 }
2482
6bd32326 2483 atomic_set(&hdev->cmd_cnt, 1);
c347b765 2484 queue_work(hdev->workqueue, &hdev->cmd_work);
6bd32326
VT		 2485}
2486
2763eda6 2487struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
6928a924 2488 bdaddr_t *bdaddr, u8 bdaddr_type)
2763eda6
SJ		 2489{
2490 struct oob_data *data;
2491
6928a924
JH		 2492 list_for_each_entry(data, &hdev->remote_oob_data, list) {
2493 if (bacmp(bdaddr, &data->bdaddr) != 0)
2494 continue;
2495 if (data->bdaddr_type != bdaddr_type)
2496 continue;
2497 return data;
2498 }
2763eda6
SJ		 2499
2500 return NULL;
2501}
2502
6928a924
JH		 2503int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2504 u8 bdaddr_type)
2763eda6
SJ		 2505{
2506 struct oob_data *data;
2507
6928a924 2508 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6
SJ		 2509 if (!data)
2510 return -ENOENT;
2511
6928a924 2512 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2763eda6
SJ		 2513
2514 list_del(&data->list);
2515 kfree(data);
2516
2517 return 0;
2518}
2519
35f7498a 2520void hci_remote_oob_data_clear(struct hci_dev *hdev)
2763eda6
SJ		 2521{
2522 struct oob_data *data, *n;
2523
2524 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2525 list_del(&data->list);
2526 kfree(data);
2527 }
2763eda6
SJ		 2528}
2529
0798872e 2530int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
6928a924 2531 u8 bdaddr_type, u8 *hash192, u8 *rand192,
81328d5c 2532 u8 *hash256, u8 *rand256)
2763eda6
SJ		 2533{
2534 struct oob_data *data;
2535
6928a924 2536 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2763eda6 2537 if (!data) {
0a14ab41 2538 data = kmalloc(sizeof(*data), GFP_KERNEL);
2763eda6
SJ		 2539 if (!data)
2540 return -ENOMEM;
2541
2542 bacpy(&data->bdaddr, bdaddr);
6928a924 2543 data->bdaddr_type = bdaddr_type;
2763eda6
SJ		 2544 list_add(&data->list, &hdev->remote_oob_data);
2545 }
2546
81328d5c
JH		 2547 if (hash192 && rand192) {
2548 memcpy(data->hash192, hash192, sizeof(data->hash192));
2549 memcpy(data->rand192, rand192, sizeof(data->rand192));
f7697b16
MH		 2550 if (hash256 && rand256)
2551 data->present = 0x03;
81328d5c
JH		 2552 } else {
2553 memset(data->hash192, 0, sizeof(data->hash192));
2554 memset(data->rand192, 0, sizeof(data->rand192));
f7697b16
MH		 2555 if (hash256 && rand256)
2556 data->present = 0x02;
2557 else
2558 data->present = 0x00;
0798872e
MH		 2559 }
2560
81328d5c
JH		 2561 if (hash256 && rand256) {
2562 memcpy(data->hash256, hash256, sizeof(data->hash256));
2563 memcpy(data->rand256, rand256, sizeof(data->rand256));
2564 } else {
2565 memset(data->hash256, 0, sizeof(data->hash256));
2566 memset(data->rand256, 0, sizeof(data->rand256));
f7697b16
MH		 2567 if (hash192 && rand192)
2568 data->present = 0x01;
81328d5c 2569 }
0798872e 2570
6ed93dc6 2571 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2763eda6
SJ		 2572
2573 return 0;
2574}
2575
d2609b34
FG		 2576/* This function requires the caller holds hdev->lock */
2577struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2578{
2579 struct adv_info *adv_instance;
2580
2581 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2582 if (adv_instance->instance == instance)
2583 return adv_instance;
2584 }
2585
2586 return NULL;
2587}
2588
2589/* This function requires the caller holds hdev->lock */
74b93e9f
PK		 2590struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2591{
d2609b34
FG		 2592 struct adv_info *cur_instance;
2593
2594 cur_instance = hci_find_adv_instance(hdev, instance);
2595 if (!cur_instance)
2596 return NULL;
2597
2598 if (cur_instance == list_last_entry(&hdev->adv_instances,
2599 struct adv_info, list))
2600 return list_first_entry(&hdev->adv_instances,
2601 struct adv_info, list);
2602 else
2603 return list_next_entry(cur_instance, list);
2604}
2605
2606/* This function requires the caller holds hdev->lock */
2607int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2608{
2609 struct adv_info *adv_instance;
2610
2611 adv_instance = hci_find_adv_instance(hdev, instance);
2612 if (!adv_instance)
2613 return -ENOENT;
2614
2615 BT_DBG("%s removing %dMR", hdev->name, instance);
2616
cab054ab
JH		 2617 if (hdev->cur_adv_instance == instance) {
2618 if (hdev->adv_instance_timeout) {
2619 cancel_delayed_work(&hdev->adv_instance_expire);
2620 hdev->adv_instance_timeout = 0;
2621 }
2622 hdev->cur_adv_instance = 0x00;
5d900e46
FG		 2623 }
2624
d2609b34
FG		 2625 list_del(&adv_instance->list);
2626 kfree(adv_instance);
2627
2628 hdev->adv_instance_cnt--;
2629
2630 return 0;
2631}
2632
2633/* This function requires the caller holds hdev->lock */
2634void hci_adv_instances_clear(struct hci_dev *hdev)
2635{
2636 struct adv_info *adv_instance, *n;
2637
5d900e46
FG		 2638 if (hdev->adv_instance_timeout) {
2639 cancel_delayed_work(&hdev->adv_instance_expire);
2640 hdev->adv_instance_timeout = 0;
2641 }
2642
d2609b34
FG		 2643 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
2644 list_del(&adv_instance->list);
2645 kfree(adv_instance);
2646 }
2647
2648 hdev->adv_instance_cnt = 0;
cab054ab 2649 hdev->cur_adv_instance = 0x00;
d2609b34
FG		 2650}
2651
2652/* This function requires the caller holds hdev->lock */
2653int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2654 u16 adv_data_len, u8 *adv_data,
2655 u16 scan_rsp_len, u8 *scan_rsp_data,
2656 u16 timeout, u16 duration)
2657{
2658 struct adv_info *adv_instance;
2659
2660 adv_instance = hci_find_adv_instance(hdev, instance);
2661 if (adv_instance) {
2662 memset(adv_instance->adv_data, 0,
2663 sizeof(adv_instance->adv_data));
2664 memset(adv_instance->scan_rsp_data, 0,
2665 sizeof(adv_instance->scan_rsp_data));
2666 } else {
2667 if (hdev->adv_instance_cnt >= HCI_MAX_ADV_INSTANCES ||
2668 instance < 1 || instance > HCI_MAX_ADV_INSTANCES)
2669 return -EOVERFLOW;
2670
39ecfad6 2671 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
d2609b34
FG		 2672 if (!adv_instance)
2673 return -ENOMEM;
2674
fffd38bc 2675 adv_instance->pending = true;
d2609b34
FG		 2676 adv_instance->instance = instance;
2677 list_add(&adv_instance->list, &hdev->adv_instances);
2678 hdev->adv_instance_cnt++;
2679 }
2680
2681 adv_instance->flags = flags;
2682 adv_instance->adv_data_len = adv_data_len;
2683 adv_instance->scan_rsp_len = scan_rsp_len;
2684
2685 if (adv_data_len)
2686 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
2687
2688 if (scan_rsp_len)
2689 memcpy(adv_instance->scan_rsp_data,
2690 scan_rsp_data, scan_rsp_len);
2691
2692 adv_instance->timeout = timeout;
5d900e46 2693 adv_instance->remaining_time = timeout;
d2609b34
FG		 2694
2695 if (duration == 0)
2696 adv_instance->duration = HCI_DEFAULT_ADV_DURATION;
2697 else
2698 adv_instance->duration = duration;
2699
2700 BT_DBG("%s for %dMR", hdev->name, instance);
2701
2702 return 0;
2703}
2704
dcc36c16 2705struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
b9ee0a78 2706 bdaddr_t *bdaddr, u8 type)
b2a66aad 2707{
8035ded4 2708 struct bdaddr_list *b;
b2a66aad 2709
dcc36c16 2710 list_for_each_entry(b, bdaddr_list, list) {
b9ee0a78 2711 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
b2a66aad 2712 return b;
b9ee0a78 2713 }
b2a66aad
AJ		 2714
2715 return NULL;
2716}
2717
dcc36c16 2718void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
b2a66aad 2719{
7eb7404f 2720 struct bdaddr_list *b, *n;
b2a66aad 2721
7eb7404f
GT		 2722 list_for_each_entry_safe(b, n, bdaddr_list, list) {
2723 list_del(&b->list);
b2a66aad
AJ		 2724 kfree(b);
2725 }
b2a66aad
AJ		 2726}
2727
dcc36c16 2728int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2729{
2730 struct bdaddr_list *entry;
b2a66aad 2731
b9ee0a78 2732 if (!bacmp(bdaddr, BDADDR_ANY))
b2a66aad
AJ		 2733 return -EBADF;
2734
dcc36c16 2735 if (hci_bdaddr_list_lookup(list, bdaddr, type))
5e762444 2736 return -EEXIST;
b2a66aad 2737
27f70f3e 2738 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
5e762444
AJ		 2739 if (!entry)
2740 return -ENOMEM;
b2a66aad
AJ		 2741
2742 bacpy(&entry->bdaddr, bdaddr);
b9ee0a78 2743 entry->bdaddr_type = type;
b2a66aad 2744
dcc36c16 2745 list_add(&entry->list, list);
b2a66aad 2746
2a8357f2 2747 return 0;
b2a66aad
AJ		 2748}
2749
dcc36c16 2750int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
b2a66aad
AJ		 2751{
2752 struct bdaddr_list *entry;
b2a66aad 2753
35f7498a 2754 if (!bacmp(bdaddr, BDADDR_ANY)) {
dcc36c16 2755 hci_bdaddr_list_clear(list);
35f7498a
JH		 2756 return 0;
2757 }
b2a66aad 2758
dcc36c16 2759 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
d2ab0ac1
MH		 2760 if (!entry)
2761 return -ENOENT;
2762
2763 list_del(&entry->list);
2764 kfree(entry);
2765
2766 return 0;
2767}
2768
15819a70
AG		 2769/* This function requires the caller holds hdev->lock */
2770struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2771 bdaddr_t *addr, u8 addr_type)
2772{
2773 struct hci_conn_params *params;
2774
2775 list_for_each_entry(params, &hdev->le_conn_params, list) {
2776 if (bacmp(&params->addr, addr) == 0 &&
2777 params->addr_type == addr_type) {
2778 return params;
2779 }
2780 }
2781
2782 return NULL;
2783}
2784
4b10966f 2785/* This function requires the caller holds hdev->lock */
501f8827
JH		 2786struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2787 bdaddr_t *addr, u8 addr_type)
a9b0a04c 2788{
912b42ef 2789 struct hci_conn_params *param;
a9b0a04c 2790
501f8827 2791 list_for_each_entry(param, list, action) {
912b42ef
JH		 2792 if (bacmp(&param->addr, addr) == 0 &&
2793 param->addr_type == addr_type)
2794 return param;
4b10966f
MH		 2795 }
2796
2797 return NULL;
a9b0a04c
AG		 2798}
2799
15819a70 2800/* This function requires the caller holds hdev->lock */
51d167c0
MH		 2801struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2802 bdaddr_t *addr, u8 addr_type)
15819a70
AG		 2803{
2804 struct hci_conn_params *params;
2805
2806 params = hci_conn_params_lookup(hdev, addr, addr_type);
cef952ce 2807 if (params)
51d167c0 2808 return params;
15819a70
AG		 2809
2810 params = kzalloc(sizeof(*params), GFP_KERNEL);
2811 if (!params) {
2812 BT_ERR("Out of memory");
51d167c0 2813 return NULL;
15819a70
AG		 2814 }
2815
2816 bacpy(&params->addr, addr);
2817 params->addr_type = addr_type;
cef952ce
AG		 2818
2819 list_add(&params->list, &hdev->le_conn_params);
93450c75 2820 INIT_LIST_HEAD(&params->action);
cef952ce 2821
bf5b3c8b
MH		 2822 params->conn_min_interval = hdev->le_conn_min_interval;
2823 params->conn_max_interval = hdev->le_conn_max_interval;
2824 params->conn_latency = hdev->le_conn_latency;
2825 params->supervision_timeout = hdev->le_supv_timeout;
2826 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2827
2828 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2829
51d167c0 2830 return params;
bf5b3c8b
MH		 2831}
2832
f6c63249 2833static void hci_conn_params_free(struct hci_conn_params *params)
15819a70 2834{
f8aaf9b6 2835 if (params->conn) {
f161dd41 2836 hci_conn_drop(params->conn);
f8aaf9b6
JH		 2837 hci_conn_put(params->conn);
2838 }
f161dd41 2839
95305baa 2840 list_del(&params->action);
15819a70
AG		 2841 list_del(&params->list);
2842 kfree(params);
f6c63249
JH		 2843}
2844
2845/* This function requires the caller holds hdev->lock */
2846void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2847{
2848 struct hci_conn_params *params;
2849
2850 params = hci_conn_params_lookup(hdev, addr, addr_type);
2851 if (!params)
2852 return;
2853
2854 hci_conn_params_free(params);
15819a70 2855
95305baa
JH		 2856 hci_update_background_scan(hdev);
2857
15819a70
AG		 2858 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2859}
2860
2861/* This function requires the caller holds hdev->lock */
55af49a8 2862void hci_conn_params_clear_disabled(struct hci_dev *hdev)
15819a70
AG		 2863{
2864 struct hci_conn_params *params, *tmp;
2865
2866 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
55af49a8
JH		 2867 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2868 continue;
f75113a2
JP		 2869
2870 /* If trying to estabilish one time connection to disabled
2871 * device, leave the params, but mark them as just once.
2872 */
2873 if (params->explicit_connect) {
2874 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2875 continue;
2876 }
2877
15819a70
AG		 2878 list_del(&params->list);
2879 kfree(params);
2880 }
2881
55af49a8 2882 BT_DBG("All LE disabled connection parameters were removed");
77a77a30
AG		 2883}
2884
2885/* This function requires the caller holds hdev->lock */
030e7f81 2886static void hci_conn_params_clear_all(struct hci_dev *hdev)
77a77a30 2887{
15819a70 2888 struct hci_conn_params *params, *tmp;
77a77a30 2889
f6c63249
JH		 2890 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2891 hci_conn_params_free(params);
77a77a30 2892
15819a70 2893 BT_DBG("All LE connection parameters were removed");
77a77a30
AG		 2894}
2895
a1f4c318
JH		 2896/* Copy the Identity Address of the controller.
2897 *
2898 * If the controller has a public BD_ADDR, then by default use that one.
2899 * If this is a LE only controller without a public address, default to
2900 * the static random address.
2901 *
2902 * For debugging purposes it is possible to force controllers with a
2903 * public address to use the static random address instead.
50b5b952
MH		 2904 *
2905 * In case BR/EDR has been disabled on a dual-mode controller and
2906 * userspace has configured a static address, then that address
2907 * becomes the identity address instead of the public BR/EDR address.
a1f4c318
JH		 2908 */
2909void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2910 u8 *bdaddr_type)
2911{
b7cb93e5 2912 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
50b5b952 2913 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
d7a5a11d 2914 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
50b5b952 2915 bacmp(&hdev->static_addr, BDADDR_ANY))) {
a1f4c318
JH		 2916 bacpy(bdaddr, &hdev->static_addr);
2917 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2918 } else {
2919 bacpy(bdaddr, &hdev->bdaddr);
2920 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
2921 }
2922}
2923
9be0dab7
DH		 2924/* Alloc HCI device */
2925struct hci_dev *hci_alloc_dev(void)
2926{
2927 struct hci_dev *hdev;
2928
27f70f3e 2929 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
9be0dab7
DH		 2930 if (!hdev)
2931 return NULL;
2932
b1b813d4
DH		 2933 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2934 hdev->esco_type = (ESCO_HV1);
2935 hdev->link_mode = (HCI_LM_ACCEPT);
b4cb9fb2
MH		 2936 hdev->num_iac = 0x01; /* One IAC support is mandatory */
2937 hdev->io_capability = 0x03; /* No Input No Output */
96c2103a 2938 hdev->manufacturer = 0xffff; /* Default to internal use */
bbaf444a
JH		 2939 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2940 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
d2609b34
FG		 2941 hdev->adv_instance_cnt = 0;
2942 hdev->cur_adv_instance = 0x00;
5d900e46 2943 hdev->adv_instance_timeout = 0;
b1b813d4 2944
b1b813d4
DH		 2945 hdev->sniff_max_interval = 800;
2946 hdev->sniff_min_interval = 80;
2947
3f959d46 2948 hdev->le_adv_channel_map = 0x07;
628531c9
GL		 2949 hdev->le_adv_min_interval = 0x0800;
2950 hdev->le_adv_max_interval = 0x0800;
bef64738
MH		 2951 hdev->le_scan_interval = 0x0060;
2952 hdev->le_scan_window = 0x0030;
4e70c7e7
MH		 2953 hdev->le_conn_min_interval = 0x0028;
2954 hdev->le_conn_max_interval = 0x0038;
04fb7d90
MH		 2955 hdev->le_conn_latency = 0x0000;
2956 hdev->le_supv_timeout = 0x002a;
a8e1bfaa
MH		 2957 hdev->le_def_tx_len = 0x001b;
2958 hdev->le_def_tx_time = 0x0148;
2959 hdev->le_max_tx_len = 0x001b;
2960 hdev->le_max_tx_time = 0x0148;
2961 hdev->le_max_rx_len = 0x001b;
2962 hdev->le_max_rx_time = 0x0148;
bef64738 2963
d6bfd59c 2964 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
b9a7a61e 2965 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
31ad1691
AK		 2966 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
2967 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
d6bfd59c 2968
b1b813d4
DH		 2969 mutex_init(&hdev->lock);
2970 mutex_init(&hdev->req_lock);
2971
2972 INIT_LIST_HEAD(&hdev->mgmt_pending);
2973 INIT_LIST_HEAD(&hdev->blacklist);
6659358e 2974 INIT_LIST_HEAD(&hdev->whitelist);
b1b813d4
DH		 2975 INIT_LIST_HEAD(&hdev->uuids);
2976 INIT_LIST_HEAD(&hdev->link_keys);
2977 INIT_LIST_HEAD(&hdev->long_term_keys);
970c4e46 2978 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
b1b813d4 2979 INIT_LIST_HEAD(&hdev->remote_oob_data);
d2ab0ac1 2980 INIT_LIST_HEAD(&hdev->le_white_list);
15819a70 2981 INIT_LIST_HEAD(&hdev->le_conn_params);
77a77a30 2982 INIT_LIST_HEAD(&hdev->pend_le_conns);
66f8455a 2983 INIT_LIST_HEAD(&hdev->pend_le_reports);
6b536b5e 2984 INIT_LIST_HEAD(&hdev->conn_hash.list);
d2609b34 2985 INIT_LIST_HEAD(&hdev->adv_instances);
b1b813d4
DH		 2986
2987 INIT_WORK(&hdev->rx_work, hci_rx_work);
2988 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2989 INIT_WORK(&hdev->tx_work, hci_tx_work);
2990 INIT_WORK(&hdev->power_on, hci_power_on);
c7741d16 2991 INIT_WORK(&hdev->error_reset, hci_error_reset);
b1b813d4 2992
b1b813d4 2993 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
b1b813d4 2994
b1b813d4
DH		 2995 skb_queue_head_init(&hdev->rx_q);
2996 skb_queue_head_init(&hdev->cmd_q);
2997 skb_queue_head_init(&hdev->raw_q);
2998
2999 init_waitqueue_head(&hdev->req_wait_q);
3000
65cc2b49 3001 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
b1b813d4 3002
5fc16cc4
JH		 3003 hci_request_setup(hdev);
3004
b1b813d4
DH		 3005 hci_init_sysfs(hdev);
3006 discovery_init(hdev);
9be0dab7
DH		 3007
3008 return hdev;
3009}
3010EXPORT_SYMBOL(hci_alloc_dev);
3011
3012/* Free HCI device */
3013void hci_free_dev(struct hci_dev *hdev)
3014{
9be0dab7
DH		 3015 /* will free via device release */
3016 put_device(&hdev->dev);
3017}
3018EXPORT_SYMBOL(hci_free_dev);
3019
1da177e4
LT		 3020/* Register HCI device */
3021int hci_register_dev(struct hci_dev *hdev)
3022{
b1b813d4 3023 int id, error;
1da177e4 3024
74292d5a 3025 if (!hdev->open || !hdev->close || !hdev->send)
1da177e4
LT		 3026 return -EINVAL;
3027
08add513
MM		 3028 /* Do not allow HCI_AMP devices to register at index 0,
3029 * so the index can be used as the AMP controller ID.
3030 */
3df92b31
SL		 3031 switch (hdev->dev_type) {
3032 case HCI_BREDR:
3033 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3034 break;
3035 case HCI_AMP:
3036 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3037 break;
3038 default:
3039 return -EINVAL;
1da177e4 3040 }
8e87d142 3041
3df92b31
SL		 3042 if (id < 0)
3043 return id;
3044
1da177e4
LT		 3045 sprintf(hdev->name, "hci%d", id);
3046 hdev->id = id;
2d8b3a11
AE		 3047
3048 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3049
d8537548
KC		 3050 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3051 WQ_MEM_RECLAIM, 1, hdev->name);
33ca954d
DH		 3052 if (!hdev->workqueue) {
3053 error = -ENOMEM;
3054 goto err;
3055 }
f48fd9c8 3056
d8537548
KC		 3057 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3058 WQ_MEM_RECLAIM, 1, hdev->name);
6ead1bbc
JH		 3059 if (!hdev->req_workqueue) {
3060 destroy_workqueue(hdev->workqueue);
3061 error = -ENOMEM;
3062 goto err;
3063 }
3064
0153e2ec
MH		 3065 if (!IS_ERR_OR_NULL(bt_debugfs))
3066 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3067
bdc3e0f1
MH		 3068 dev_set_name(&hdev->dev, "%s", hdev->name);
3069
3070 error = device_add(&hdev->dev);
33ca954d 3071 if (error < 0)
54506918 3072 goto err_wqueue;
1da177e4 3073
6d5d2ee6
HK		 3074 hci_leds_init(hdev);
3075
611b30f7 3076 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
a8c5fb1a
GP		 3077 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3078 hdev);
611b30f7
MH		 3079 if (hdev->rfkill) {
3080 if (rfkill_register(hdev->rfkill) < 0) {
3081 rfkill_destroy(hdev->rfkill);
3082 hdev->rfkill = NULL;
3083 }
3084 }
3085
5e130367 3086 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
a1536da2 3087 hci_dev_set_flag(hdev, HCI_RFKILLED);
5e130367 3088
a1536da2
MH		 3089 hci_dev_set_flag(hdev, HCI_SETUP);
3090 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
ce2be9ac 3091
01cd3404 3092 if (hdev->dev_type == HCI_BREDR) {
56f87901
JH		 3093 /* Assume BR/EDR support until proven otherwise (such as
3094 * through reading supported features during init.
3095 */
a1536da2 3096 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
56f87901 3097 }
ce2be9ac 3098
fcee3377
GP		 3099 write_lock(&hci_dev_list_lock);
3100 list_add(&hdev->list, &hci_dev_list);
3101 write_unlock(&hci_dev_list_lock);
3102
4a964404
MH		 3103 /* Devices that are marked for raw-only usage are unconfigured
3104 * and should not be included in normal operation.
fee746b0
MH		 3105 */
3106 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
a1536da2 3107 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
fee746b0 3108
05fcd4c4 3109 hci_sock_dev_event(hdev, HCI_DEV_REG);
dc946bd8 3110 hci_dev_hold(hdev);
1da177e4 3111
19202573 3112 queue_work(hdev->req_workqueue, &hdev->power_on);
fbe96d6f 3113
1da177e4 3114 return id;
f48fd9c8 3115
33ca954d
DH		 3116err_wqueue:
3117 destroy_workqueue(hdev->workqueue);
6ead1bbc 3118 destroy_workqueue(hdev->req_workqueue);
33ca954d 3119err:
3df92b31 3120 ida_simple_remove(&hci_index_ida, hdev->id);
f48fd9c8 3121
33ca954d 3122 return error;
1da177e4
LT		 3123}
3124EXPORT_SYMBOL(hci_register_dev);
3125
3126/* Unregister HCI device */
59735631 3127void hci_unregister_dev(struct hci_dev *hdev)
1da177e4 3128{
2d7cc19e 3129 int id;
ef222013 3130
c13854ce 3131 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
1da177e4 3132
a1536da2 3133 hci_dev_set_flag(hdev, HCI_UNREGISTER);
94324962 3134
3df92b31
SL		 3135 id = hdev->id;
3136
6d5d2ee6
HK		 3137 hci_leds_exit(hdev);
3138
f20d09d5 3139 write_lock(&hci_dev_list_lock);
1da177e4 3140 list_del(&hdev->list);
f20d09d5 3141 write_unlock(&hci_dev_list_lock);
1da177e4
LT		 3142
3143 hci_dev_do_close(hdev);
3144
b9b5ef18
GP		 3145 cancel_work_sync(&hdev->power_on);
3146
ab81cbf9 3147 if (!test_bit(HCI_INIT, &hdev->flags) &&
d7a5a11d
MH		 3148 !hci_dev_test_flag(hdev, HCI_SETUP) &&
3149 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
09fd0de5 3150 hci_dev_lock(hdev);
744cf19e 3151 mgmt_index_removed(hdev);
09fd0de5 3152 hci_dev_unlock(hdev);
56e5cb86 3153 }
ab81cbf9 3154
2e58ef3e
JH		 3155 /* mgmt_index_removed should take care of emptying the
3156 * pending list */
3157 BUG_ON(!list_empty(&hdev->mgmt_pending));
3158
05fcd4c4 3159 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
1da177e4 3160
611b30f7
MH		 3161 if (hdev->rfkill) {
3162 rfkill_unregister(hdev->rfkill);
3163 rfkill_destroy(hdev->rfkill);
3164 }
3165
bdc3e0f1 3166 device_del(&hdev->dev);
147e2d59 3167
0153e2ec
MH		 3168 debugfs_remove_recursive(hdev->debugfs);
3169
f48fd9c8 3170 destroy_workqueue(hdev->workqueue);
6ead1bbc 3171 destroy_workqueue(hdev->req_workqueue);
f48fd9c8 3172
09fd0de5 3173 hci_dev_lock(hdev);
dcc36c16 3174 hci_bdaddr_list_clear(&hdev->blacklist);
6659358e 3175 hci_bdaddr_list_clear(&hdev->whitelist);
2aeb9a1a 3176 hci_uuids_clear(hdev);
55ed8ca1 3177 hci_link_keys_clear(hdev);
b899efaf 3178 hci_smp_ltks_clear(hdev);
970c4e46 3179 hci_smp_irks_clear(hdev);
2763eda6 3180 hci_remote_oob_data_clear(hdev);
d2609b34 3181 hci_adv_instances_clear(hdev);
dcc36c16 3182 hci_bdaddr_list_clear(&hdev->le_white_list);
373110c5 3183 hci_conn_params_clear_all(hdev);
22078800 3184 hci_discovery_filter_clear(hdev);
09fd0de5 3185 hci_dev_unlock(hdev);
e2e0cacb 3186
dc946bd8 3187 hci_dev_put(hdev);
3df92b31
SL		 3188
3189 ida_simple_remove(&hci_index_ida, id);
1da177e4
LT		 3190}
3191EXPORT_SYMBOL(hci_unregister_dev);
3192
3193/* Suspend HCI device */
3194int hci_suspend_dev(struct hci_dev *hdev)
3195{
05fcd4c4 3196 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
1da177e4
LT		 3197 return 0;
3198}
3199EXPORT_SYMBOL(hci_suspend_dev);
3200
3201/* Resume HCI device */
3202int hci_resume_dev(struct hci_dev *hdev)
3203{
05fcd4c4 3204 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
1da177e4
LT		 3205 return 0;
3206}
3207EXPORT_SYMBOL(hci_resume_dev);
3208
75e0569f
MH		 3209/* Reset HCI device */
3210int hci_reset_dev(struct hci_dev *hdev)
3211{
3212 const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3213 struct sk_buff *skb;
3214
3215 skb = bt_skb_alloc(3, GFP_ATOMIC);
3216 if (!skb)
3217 return -ENOMEM;
3218
d79f34e3 3219 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
75e0569f
MH		 3220 memcpy(skb_put(skb, 3), hw_err, 3);
3221
3222 /* Send Hardware Error to upper stack */
3223 return hci_recv_frame(hdev, skb);
3224}
3225EXPORT_SYMBOL(hci_reset_dev);
3226
76bca880 3227/* Receive frame from HCI drivers */
e1a26170 3228int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
76bca880 3229{
76bca880 3230 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
a8c5fb1a 3231 && !test_bit(HCI_INIT, &hdev->flags))) {
76bca880
MH		 3232 kfree_skb(skb);
3233 return -ENXIO;
3234 }
3235
d79f34e3
MH		 3236 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
3237 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
3238 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
fe806dce
MH		 3239 kfree_skb(skb);
3240 return -EINVAL;
3241 }
3242
d82603c6 3243 /* Incoming skb */
76bca880
MH		 3244 bt_cb(skb)->incoming = 1;
3245
3246 /* Time stamp */
3247 __net_timestamp(skb);
3248
76bca880 3249 skb_queue_tail(&hdev->rx_q, skb);
b78752cc 3250 queue_work(hdev->workqueue, &hdev->rx_work);
c78ae283 3251
76bca880
MH		 3252 return 0;
3253}
3254EXPORT_SYMBOL(hci_recv_frame);
3255
e875ff84
MH		 3256/* Receive diagnostic message from HCI drivers */
3257int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
3258{
581d6fd6 3259 /* Mark as diagnostic packet */
d79f34e3 3260 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
581d6fd6 3261
e875ff84
MH		 3262 /* Time stamp */
3263 __net_timestamp(skb);
3264
581d6fd6
MH		 3265 skb_queue_tail(&hdev->rx_q, skb);
3266 queue_work(hdev->workqueue, &hdev->rx_work);
e875ff84 3267
e875ff84
MH		 3268 return 0;
3269}
3270EXPORT_SYMBOL(hci_recv_diag);
3271
1da177e4
LT		 3272/* ---- Interface to upper protocols ---- */
3273
1da177e4
LT		 3274int hci_register_cb(struct hci_cb *cb)
3275{
3276 BT_DBG("%p name %s", cb, cb->name);
3277
fba7ecf0 3278 mutex_lock(&hci_cb_list_lock);
00629e0f 3279 list_add_tail(&cb->list, &hci_cb_list);
fba7ecf0 3280 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 3281
3282 return 0;
3283}
3284EXPORT_SYMBOL(hci_register_cb);
3285
3286int hci_unregister_cb(struct hci_cb *cb)
3287{
3288 BT_DBG("%p name %s", cb, cb->name);
3289
fba7ecf0 3290 mutex_lock(&hci_cb_list_lock);
1da177e4 3291 list_del(&cb->list);
fba7ecf0 3292 mutex_unlock(&hci_cb_list_lock);
1da177e4
LT		 3293
3294 return 0;
3295}
3296EXPORT_SYMBOL(hci_unregister_cb);
3297
51086991 3298static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4 3299{
cdc52faa
MH		 3300 int err;
3301
d79f34e3
MH		 3302 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3303 skb->len);
1da177e4 3304
cd82e61c
MH		 3305 /* Time stamp */
3306 __net_timestamp(skb);
1da177e4 3307
cd82e61c
MH		 3308 /* Send copy to monitor */
3309 hci_send_to_monitor(hdev, skb);
3310
3311 if (atomic_read(&hdev->promisc)) {
3312 /* Send copy to the sockets */
470fe1b5 3313 hci_send_to_sock(hdev, skb);
1da177e4
LT		 3314 }
3315
3316 /* Get rid of skb owner, prior to sending to the driver. */
3317 skb_orphan(skb);
3318
73d0d3c8
MH		 3319 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3320 kfree_skb(skb);
3321 return;
3322 }
3323
cdc52faa
MH		 3324 err = hdev->send(hdev, skb);
3325 if (err < 0) {
3326 BT_ERR("%s sending frame failed (%d)", hdev->name, err);
3327 kfree_skb(skb);
3328 }
1da177e4
LT		 3329}
3330
1ca3a9d0 3331/* Send HCI command */
07dc93dd
JH		 3332int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3333 const void *param)
1ca3a9d0
JH		 3334{
3335 struct sk_buff *skb;
3336
3337 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3338
3339 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3340 if (!skb) {
3341 BT_ERR("%s no memory for command", hdev->name);
3342 return -ENOMEM;
3343 }
3344
49c922bb 3345 /* Stand-alone HCI commands must be flagged as
11714b3d
JH		 3346 * single-command requests.
3347 */
44d27137 3348 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
11714b3d 3349
1da177e4 3350 skb_queue_tail(&hdev->cmd_q, skb);
c347b765 3351 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 3352
3353 return 0;
3354}
1da177e4
LT		 3355
3356/* Get data from the previously sent command */
a9de9248 3357void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
1da177e4
LT		 3358{
3359 struct hci_command_hdr *hdr;
3360
3361 if (!hdev->sent_cmd)
3362 return NULL;
3363
3364 hdr = (void *) hdev->sent_cmd->data;
3365
a9de9248 3366 if (hdr->opcode != cpu_to_le16(opcode))
1da177e4
LT		 3367 return NULL;
3368
f0e09510 3369 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
1da177e4
LT		 3370
3371 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3372}
3373
fbef168f
LP		 3374/* Send HCI command and wait for command commplete event */
3375struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
3376 const void *param, u32 timeout)
3377{
3378 struct sk_buff *skb;
3379
3380 if (!test_bit(HCI_UP, &hdev->flags))
3381 return ERR_PTR(-ENETDOWN);
3382
3383 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
3384
b504430c 3385 hci_req_sync_lock(hdev);
fbef168f 3386 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
b504430c 3387 hci_req_sync_unlock(hdev);
fbef168f
LP		 3388
3389 return skb;
3390}
3391EXPORT_SYMBOL(hci_cmd_sync);
3392
1da177e4
LT		 3393/* Send ACL data */
3394static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3395{
3396 struct hci_acl_hdr *hdr;
3397 int len = skb->len;
3398
badff6d0
ACM		 3399 skb_push(skb, HCI_ACL_HDR_SIZE);
3400 skb_reset_transport_header(skb);
9c70220b 3401 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
aca3192c
YH		 3402 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3403 hdr->dlen = cpu_to_le16(len);
1da177e4
LT		 3404}
3405
ee22be7e 3406static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
a8c5fb1a 3407 struct sk_buff *skb, __u16 flags)
1da177e4 3408{
ee22be7e 3409 struct hci_conn *conn = chan->conn;
1da177e4
LT		 3410 struct hci_dev *hdev = conn->hdev;
3411 struct sk_buff *list;
3412
087bfd99
GP		 3413 skb->len = skb_headlen(skb);
3414 skb->data_len = 0;
3415
d79f34e3 3416 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
204a6e54
AE		 3417
3418 switch (hdev->dev_type) {
3419 case HCI_BREDR:
3420 hci_add_acl_hdr(skb, conn->handle, flags);
3421 break;
3422 case HCI_AMP:
3423 hci_add_acl_hdr(skb, chan->handle, flags);
3424 break;
3425 default:
3426 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3427 return;
3428 }
087bfd99 3429
70f23020
AE		 3430 list = skb_shinfo(skb)->frag_list;
3431 if (!list) {
1da177e4
LT		 3432 /* Non fragmented */
3433 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3434
73d80deb 3435 skb_queue_tail(queue, skb);
1da177e4
LT		 3436 } else {
3437 /* Fragmented */
3438 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3439
3440 skb_shinfo(skb)->frag_list = NULL;
3441
9cfd5a23
JR		 3442 /* Queue all fragments atomically. We need to use spin_lock_bh
3443 * here because of 6LoWPAN links, as there this function is
3444 * called from softirq and using normal spin lock could cause
3445 * deadlocks.
3446 */
3447 spin_lock_bh(&queue->lock);
1da177e4 3448
73d80deb 3449 __skb_queue_tail(queue, skb);
e702112f
AE		 3450
3451 flags &= ~ACL_START;
3452 flags |= ACL_CONT;
1da177e4
LT		 3453 do {
3454 skb = list; list = list->next;
8e87d142 3455
d79f34e3 3456 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
e702112f 3457 hci_add_acl_hdr(skb, conn->handle, flags);
1da177e4
LT		 3458
3459 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3460
73d80deb 3461 __skb_queue_tail(queue, skb);
1da177e4
LT		 3462 } while (list);
3463
9cfd5a23 3464 spin_unlock_bh(&queue->lock);
1da177e4 3465 }
73d80deb
LAD		 3466}
3467
3468void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3469{
ee22be7e 3470 struct hci_dev *hdev = chan->conn->hdev;
73d80deb 3471
f0e09510 3472 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
73d80deb 3473
ee22be7e 3474 hci_queue_acl(chan, &chan->data_q, skb, flags);
1da177e4 3475
3eff45ea 3476 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3477}
1da177e4
LT		 3478
3479/* Send SCO data */
0d861d8b 3480void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
1da177e4
LT		 3481{
3482 struct hci_dev *hdev = conn->hdev;
3483 struct hci_sco_hdr hdr;
3484
3485 BT_DBG("%s len %d", hdev->name, skb->len);
3486
aca3192c 3487 hdr.handle = cpu_to_le16(conn->handle);
1da177e4
LT		 3488 hdr.dlen = skb->len;
3489
badff6d0
ACM		 3490 skb_push(skb, HCI_SCO_HDR_SIZE);
3491 skb_reset_transport_header(skb);
9c70220b 3492 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
1da177e4 3493
d79f34e3 3494 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
c78ae283 3495
1da177e4 3496 skb_queue_tail(&conn->data_q, skb);
3eff45ea 3497 queue_work(hdev->workqueue, &hdev->tx_work);
1da177e4 3498}
1da177e4
LT		 3499
3500/* ---- HCI TX task (outgoing data) ---- */
3501
3502/* HCI Connection scheduler */
6039aa73
GP		 3503static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3504 int *quote)
1da177e4
LT		 3505{
3506 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3507 struct hci_conn *conn = NULL, *c;
abc5de8f 3508 unsigned int num = 0, min = ~0;
1da177e4 3509
8e87d142 3510 /* We don't have to lock device here. Connections are always
1da177e4 3511 * added and removed with TX task disabled. */
bf4c6325
GP		 3512
3513 rcu_read_lock();
3514
3515 list_for_each_entry_rcu(c, &h->list, list) {
769be974 3516 if (c->type != type || skb_queue_empty(&c->data_q))
1da177e4 3517 continue;
769be974
MH		 3518
3519 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3520 continue;
3521
1da177e4
LT		 3522 num++;
3523
3524 if (c->sent < min) {
3525 min = c->sent;
3526 conn = c;
3527 }
52087a79
LAD		 3528
3529 if (hci_conn_num(hdev, type) == num)
3530 break;
1da177e4
LT		 3531 }
3532
bf4c6325
GP		 3533 rcu_read_unlock();
3534
1da177e4 3535 if (conn) {
6ed58ec5
VT		 3536 int cnt, q;
3537
3538 switch (conn->type) {
3539 case ACL_LINK:
3540 cnt = hdev->acl_cnt;
3541 break;
3542 case SCO_LINK:
3543 case ESCO_LINK:
3544 cnt = hdev->sco_cnt;
3545 break;
3546 case LE_LINK:
3547 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3548 break;
3549 default:
3550 cnt = 0;
3551 BT_ERR("Unknown link type");
3552 }
3553
3554 q = cnt / num;
1da177e4
LT		 3555 *quote = q ? q : 1;
3556 } else
3557 *quote = 0;
3558
3559 BT_DBG("conn %p quote %d", conn, *quote);
3560 return conn;
3561}
3562
6039aa73 3563static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
1da177e4
LT		 3564{
3565 struct hci_conn_hash *h = &hdev->conn_hash;
8035ded4 3566 struct hci_conn *c;
1da177e4 3567
bae1f5d9 3568 BT_ERR("%s link tx timeout", hdev->name);
1da177e4 3569
bf4c6325
GP		 3570 rcu_read_lock();
3571
1da177e4 3572 /* Kill stalled connections */
bf4c6325 3573 list_for_each_entry_rcu(c, &h->list, list) {
bae1f5d9 3574 if (c->type == type && c->sent) {
6ed93dc6
AE		 3575 BT_ERR("%s killing stalled connection %pMR",
3576 hdev->name, &c->dst);
bed71748 3577 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
1da177e4
LT		 3578 }
3579 }
bf4c6325
GP		 3580
3581 rcu_read_unlock();
1da177e4
LT		 3582}
3583
6039aa73
GP		 3584static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3585 int *quote)
1da177e4 3586{
73d80deb
LAD		 3587 struct hci_conn_hash *h = &hdev->conn_hash;
3588 struct hci_chan *chan = NULL;
abc5de8f 3589 unsigned int num = 0, min = ~0, cur_prio = 0;
1da177e4 3590 struct hci_conn *conn;
73d80deb
LAD		 3591 int cnt, q, conn_num = 0;
3592
3593 BT_DBG("%s", hdev->name);
3594
bf4c6325
GP		 3595 rcu_read_lock();
3596
3597 list_for_each_entry_rcu(conn, &h->list, list) {
73d80deb
LAD		 3598 struct hci_chan *tmp;
3599
3600 if (conn->type != type)
3601 continue;
3602
3603 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3604 continue;
3605
3606 conn_num++;
3607
8192edef 3608 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
73d80deb
LAD		 3609 struct sk_buff *skb;
3610
3611 if (skb_queue_empty(&tmp->data_q))
3612 continue;
3613
3614 skb = skb_peek(&tmp->data_q);
3615 if (skb->priority < cur_prio)
3616 continue;
3617
3618 if (skb->priority > cur_prio) {
3619 num = 0;
3620 min = ~0;
3621 cur_prio = skb->priority;
3622 }
3623
3624 num++;
3625
3626 if (conn->sent < min) {
3627 min = conn->sent;
3628 chan = tmp;
3629 }
3630 }
3631
3632 if (hci_conn_num(hdev, type) == conn_num)
3633 break;
3634 }
3635
bf4c6325
GP		 3636 rcu_read_unlock();
3637
73d80deb
LAD		 3638 if (!chan)
3639 return NULL;
3640
3641 switch (chan->conn->type) {
3642 case ACL_LINK:
3643 cnt = hdev->acl_cnt;
3644 break;
bd1eb66b
AE		 3645 case AMP_LINK:
3646 cnt = hdev->block_cnt;
3647 break;
73d80deb
LAD		 3648 case SCO_LINK:
3649 case ESCO_LINK:
3650 cnt = hdev->sco_cnt;
3651 break;
3652 case LE_LINK:
3653 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3654 break;
3655 default:
3656 cnt = 0;
3657 BT_ERR("Unknown link type");
3658 }
3659
3660 q = cnt / num;
3661 *quote = q ? q : 1;
3662 BT_DBG("chan %p quote %d", chan, *quote);
3663 return chan;
3664}
3665
02b20f0b
LAD		 3666static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3667{
3668 struct hci_conn_hash *h = &hdev->conn_hash;
3669 struct hci_conn *conn;
3670 int num = 0;
3671
3672 BT_DBG("%s", hdev->name);
3673
bf4c6325
GP		 3674 rcu_read_lock();
3675
3676 list_for_each_entry_rcu(conn, &h->list, list) {
02b20f0b
LAD		 3677 struct hci_chan *chan;
3678
3679 if (conn->type != type)
3680 continue;
3681
3682 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3683 continue;
3684
3685 num++;
3686
8192edef 3687 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
02b20f0b
LAD		 3688 struct sk_buff *skb;
3689
3690 if (chan->sent) {
3691 chan->sent = 0;
3692 continue;
3693 }
3694
3695 if (skb_queue_empty(&chan->data_q))
3696 continue;
3697
3698 skb = skb_peek(&chan->data_q);
3699 if (skb->priority >= HCI_PRIO_MAX - 1)
3700 continue;
3701
3702 skb->priority = HCI_PRIO_MAX - 1;
3703
3704 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
a8c5fb1a 3705 skb->priority);
02b20f0b
LAD		 3706 }
3707
3708 if (hci_conn_num(hdev, type) == num)
3709 break;
3710 }
bf4c6325
GP		 3711
3712 rcu_read_unlock();
3713
02b20f0b
LAD		 3714}
3715
b71d385a
AE		 3716static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3717{
3718 /* Calculate count of blocks used by this packet */
3719 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3720}
3721
6039aa73 3722static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
73d80deb 3723{
d7a5a11d 3724 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1da177e4
LT		 3725 /* ACL tx timeout must be longer than maximum
3726 * link supervision timeout (40.9 seconds) */
63d2bc1b 3727 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
5f246e89 3728 HCI_ACL_TX_TIMEOUT))
bae1f5d9 3729 hci_link_tx_to(hdev, ACL_LINK);
1da177e4 3730 }
63d2bc1b 3731}
1da177e4 3732
6039aa73 3733static void hci_sched_acl_pkt(struct hci_dev *hdev)
63d2bc1b
AE		 3734{
3735 unsigned int cnt = hdev->acl_cnt;
3736 struct hci_chan *chan;
3737 struct sk_buff *skb;
3738 int quote;
3739
3740 __check_timeout(hdev, cnt);
04837f64 3741
73d80deb 3742 while (hdev->acl_cnt &&
a8c5fb1a 3743 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
ec1cce24
LAD		 3744 u32 priority = (skb_peek(&chan->data_q))->priority;
3745 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3746 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3747 skb->len, skb->priority);
73d80deb 3748
ec1cce24
LAD		 3749 /* Stop if priority has changed */
3750 if (skb->priority < priority)
3751 break;
3752
3753 skb = skb_dequeue(&chan->data_q);
3754
73d80deb 3755 hci_conn_enter_active_mode(chan->conn,
04124681 3756 bt_cb(skb)->force_active);
04837f64 3757
57d17d70 3758 hci_send_frame(hdev, skb);
1da177e4
LT		 3759 hdev->acl_last_tx = jiffies;
3760
3761 hdev->acl_cnt--;
73d80deb
LAD		 3762 chan->sent++;
3763 chan->conn->sent++;
1da177e4
LT		 3764 }
3765 }
02b20f0b
LAD		 3766
3767 if (cnt != hdev->acl_cnt)
3768 hci_prio_recalculate(hdev, ACL_LINK);
1da177e4
LT		 3769}
3770
6039aa73 3771static void hci_sched_acl_blk(struct hci_dev *hdev)
b71d385a 3772{
63d2bc1b 3773 unsigned int cnt = hdev->block_cnt;
b71d385a
AE		 3774 struct hci_chan *chan;
3775 struct sk_buff *skb;
3776 int quote;
bd1eb66b 3777 u8 type;
b71d385a 3778
63d2bc1b 3779 __check_timeout(hdev, cnt);
b71d385a 3780
bd1eb66b
AE		 3781 BT_DBG("%s", hdev->name);
3782
3783 if (hdev->dev_type == HCI_AMP)
3784 type = AMP_LINK;
3785 else
3786 type = ACL_LINK;
3787
b71d385a 3788 while (hdev->block_cnt > 0 &&
bd1eb66b 3789 (chan = hci_chan_sent(hdev, type, &quote))) {
b71d385a
AE		 3790 u32 priority = (skb_peek(&chan->data_q))->priority;
3791 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3792 int blocks;
3793
3794 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3795 skb->len, skb->priority);
b71d385a
AE		 3796
3797 /* Stop if priority has changed */
3798 if (skb->priority < priority)
3799 break;
3800
3801 skb = skb_dequeue(&chan->data_q);
3802
3803 blocks = __get_blocks(hdev, skb);
3804 if (blocks > hdev->block_cnt)
3805 return;
3806
3807 hci_conn_enter_active_mode(chan->conn,
a8c5fb1a 3808 bt_cb(skb)->force_active);
b71d385a 3809
57d17d70 3810 hci_send_frame(hdev, skb);
b71d385a
AE		 3811 hdev->acl_last_tx = jiffies;
3812
3813 hdev->block_cnt -= blocks;
3814 quote -= blocks;
3815
3816 chan->sent += blocks;
3817 chan->conn->sent += blocks;
3818 }
3819 }
3820
3821 if (cnt != hdev->block_cnt)
bd1eb66b 3822 hci_prio_recalculate(hdev, type);
b71d385a
AE		 3823}
3824
6039aa73 3825static void hci_sched_acl(struct hci_dev *hdev)
b71d385a
AE		 3826{
3827 BT_DBG("%s", hdev->name);
3828
bd1eb66b
AE		 3829 /* No ACL link over BR/EDR controller */
3830 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3831 return;
3832
3833 /* No AMP link over AMP controller */
3834 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
b71d385a
AE		 3835 return;
3836
3837 switch (hdev->flow_ctl_mode) {
3838 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3839 hci_sched_acl_pkt(hdev);
3840 break;
3841
3842 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3843 hci_sched_acl_blk(hdev);
3844 break;
3845 }
3846}
3847
1da177e4 3848/* Schedule SCO */
6039aa73 3849static void hci_sched_sco(struct hci_dev *hdev)
1da177e4
LT		 3850{
3851 struct hci_conn *conn;
3852 struct sk_buff *skb;
3853 int quote;
3854
3855 BT_DBG("%s", hdev->name);
3856
52087a79
LAD		 3857 if (!hci_conn_num(hdev, SCO_LINK))
3858 return;
3859
1da177e4
LT		 3860 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3861 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3862 BT_DBG("skb %p len %d", skb, skb->len);
57d17d70 3863 hci_send_frame(hdev, skb);
1da177e4
LT		 3864
3865 conn->sent++;
3866 if (conn->sent == ~0)
3867 conn->sent = 0;
3868 }
3869 }
3870}
3871
6039aa73 3872static void hci_sched_esco(struct hci_dev *hdev)
b6a0dc82
MH		 3873{
3874 struct hci_conn *conn;
3875 struct sk_buff *skb;
3876 int quote;
3877
3878 BT_DBG("%s", hdev->name);
3879
52087a79
LAD		 3880 if (!hci_conn_num(hdev, ESCO_LINK))
3881 return;
3882
8fc9ced3
GP		 3883 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3884 &quote))) {
b6a0dc82
MH		 3885 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3886 BT_DBG("skb %p len %d", skb, skb->len);
57d17d70 3887 hci_send_frame(hdev, skb);
b6a0dc82
MH		 3888
3889 conn->sent++;
3890 if (conn->sent == ~0)
3891 conn->sent = 0;
3892 }
3893 }
3894}
3895
6039aa73 3896static void hci_sched_le(struct hci_dev *hdev)
6ed58ec5 3897{
73d80deb 3898 struct hci_chan *chan;
6ed58ec5 3899 struct sk_buff *skb;
02b20f0b 3900 int quote, cnt, tmp;
6ed58ec5
VT		 3901
3902 BT_DBG("%s", hdev->name);
3903
52087a79
LAD		 3904 if (!hci_conn_num(hdev, LE_LINK))
3905 return;
3906
d7a5a11d 3907 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
6ed58ec5
VT		 3908 /* LE tx timeout must be longer than maximum
3909 * link supervision timeout (40.9 seconds) */
bae1f5d9 3910 if (!hdev->le_cnt && hdev->le_pkts &&
a8c5fb1a 3911 time_after(jiffies, hdev->le_last_tx + HZ * 45))
bae1f5d9 3912 hci_link_tx_to(hdev, LE_LINK);
6ed58ec5
VT		 3913 }
3914
3915 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
02b20f0b 3916 tmp = cnt;
73d80deb 3917 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
ec1cce24
LAD		 3918 u32 priority = (skb_peek(&chan->data_q))->priority;
3919 while (quote-- && (skb = skb_peek(&chan->data_q))) {
73d80deb 3920 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
a8c5fb1a 3921 skb->len, skb->priority);
6ed58ec5 3922
ec1cce24
LAD		 3923 /* Stop if priority has changed */
3924 if (skb->priority < priority)
3925 break;
3926
3927 skb = skb_dequeue(&chan->data_q);
3928
57d17d70 3929 hci_send_frame(hdev, skb);
6ed58ec5
VT		 3930 hdev->le_last_tx = jiffies;
3931
3932 cnt--;
73d80deb
LAD		 3933 chan->sent++;
3934 chan->conn->sent++;
6ed58ec5
VT		 3935 }
3936 }
73d80deb 3937
6ed58ec5
VT		 3938 if (hdev->le_pkts)
3939 hdev->le_cnt = cnt;
3940 else
3941 hdev->acl_cnt = cnt;
02b20f0b
LAD		 3942
3943 if (cnt != tmp)
3944 hci_prio_recalculate(hdev, LE_LINK);
6ed58ec5
VT		 3945}
3946
3eff45ea 3947static void hci_tx_work(struct work_struct *work)
1da177e4 3948{
3eff45ea 3949 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
1da177e4
LT		 3950 struct sk_buff *skb;
3951
6ed58ec5 3952 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
a8c5fb1a 3953 hdev->sco_cnt, hdev->le_cnt);
1da177e4 3954
d7a5a11d 3955 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
52de599e
MH		 3956 /* Schedule queues and send stuff to HCI driver */
3957 hci_sched_acl(hdev);
3958 hci_sched_sco(hdev);
3959 hci_sched_esco(hdev);
3960 hci_sched_le(hdev);
3961 }
6ed58ec5 3962
1da177e4
LT		 3963 /* Send next queued raw (unknown type) packet */
3964 while ((skb = skb_dequeue(&hdev->raw_q)))
57d17d70 3965 hci_send_frame(hdev, skb);
1da177e4
LT		 3966}
3967
25985edc 3968/* ----- HCI RX task (incoming data processing) ----- */
1da177e4
LT		 3969
3970/* ACL data packet */
6039aa73 3971static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 3972{
3973 struct hci_acl_hdr *hdr = (void *) skb->data;
3974 struct hci_conn *conn;
3975 __u16 handle, flags;
3976
3977 skb_pull(skb, HCI_ACL_HDR_SIZE);
3978
3979 handle = __le16_to_cpu(hdr->handle);
3980 flags = hci_flags(handle);
3981 handle = hci_handle(handle);
3982
f0e09510 3983 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
a8c5fb1a 3984 handle, flags);
1da177e4
LT		 3985
3986 hdev->stat.acl_rx++;
3987
3988 hci_dev_lock(hdev);
3989 conn = hci_conn_hash_lookup_handle(hdev, handle);
3990 hci_dev_unlock(hdev);
8e87d142 3991
1da177e4 3992 if (conn) {
65983fc7 3993 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
04837f64 3994
1da177e4 3995 /* Send to upper protocol */
686ebf28
UF		 3996 l2cap_recv_acldata(conn, skb, flags);
3997 return;
1da177e4 3998 } else {
8e87d142 3999 BT_ERR("%s ACL packet for unknown connection handle %d",
a8c5fb1a 4000 hdev->name, handle);
1da177e4
LT		 4001 }
4002
4003 kfree_skb(skb);
4004}
4005
4006/* SCO data packet */
6039aa73 4007static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
1da177e4
LT		 4008{
4009 struct hci_sco_hdr *hdr = (void *) skb->data;
4010 struct hci_conn *conn;
4011 __u16 handle;
4012
4013 skb_pull(skb, HCI_SCO_HDR_SIZE);
4014
4015 handle = __le16_to_cpu(hdr->handle);
4016
f0e09510 4017 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
1da177e4
LT		 4018
4019 hdev->stat.sco_rx++;
4020
4021 hci_dev_lock(hdev);
4022 conn = hci_conn_hash_lookup_handle(hdev, handle);
4023 hci_dev_unlock(hdev);
4024
4025 if (conn) {
1da177e4 4026 /* Send to upper protocol */
686ebf28
UF		 4027 sco_recv_scodata(conn, skb);
4028 return;
1da177e4 4029 } else {
8e87d142 4030 BT_ERR("%s SCO packet for unknown connection handle %d",
a8c5fb1a 4031 hdev->name, handle);
1da177e4
LT		 4032 }
4033
4034 kfree_skb(skb);
4035}
4036
9238f36a
JH		 4037static bool hci_req_is_complete(struct hci_dev *hdev)
4038{
4039 struct sk_buff *skb;
4040
4041 skb = skb_peek(&hdev->cmd_q);
4042 if (!skb)
4043 return true;
4044
44d27137 4045 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
9238f36a
JH		 4046}
4047
42c6b129
JH		 4048static void hci_resend_last(struct hci_dev *hdev)
4049{
4050 struct hci_command_hdr *sent;
4051 struct sk_buff *skb;
4052 u16 opcode;
4053
4054 if (!hdev->sent_cmd)
4055 return;
4056
4057 sent = (void *) hdev->sent_cmd->data;
4058 opcode = __le16_to_cpu(sent->opcode);
4059 if (opcode == HCI_OP_RESET)
4060 return;
4061
4062 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4063 if (!skb)
4064 return;
4065
4066 skb_queue_head(&hdev->cmd_q, skb);
4067 queue_work(hdev->workqueue, &hdev->cmd_work);
4068}
4069
e6214487
JH		 4070void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4071 hci_req_complete_t *req_complete,
4072 hci_req_complete_skb_t *req_complete_skb)
9238f36a 4073{
9238f36a
JH		 4074 struct sk_buff *skb;
4075 unsigned long flags;
4076
4077 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4078
42c6b129
JH		 4079 /* If the completed command doesn't match the last one that was
4080 * sent we need to do special handling of it.
9238f36a 4081 */
42c6b129
JH		 4082 if (!hci_sent_cmd_data(hdev, opcode)) {
4083 /* Some CSR based controllers generate a spontaneous
4084 * reset complete event during init and any pending
4085 * command will never be completed. In such a case we
4086 * need to resend whatever was the last sent
4087 * command.
4088 */
4089 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4090 hci_resend_last(hdev);
4091
9238f36a 4092 return;
42c6b129 4093 }
9238f36a
JH		 4094
4095 /* If the command succeeded and there's still more commands in
4096 * this request the request is not yet complete.
4097 */
4098 if (!status && !hci_req_is_complete(hdev))
4099 return;
4100
4101 /* If this was the last command in a request the complete
4102 * callback would be found in hdev->sent_cmd instead of the
4103 * command queue (hdev->cmd_q).
4104 */
44d27137
JH		 4105 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4106 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
e6214487
JH		 4107 return;
4108 }
53e21fbc 4109
44d27137
JH		 4110 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4111 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
e6214487 4112 return;
9238f36a
JH		 4113 }
4114
4115 /* Remove all pending commands belonging to this request */
4116 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4117 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
44d27137 4118 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
9238f36a
JH		 4119 __skb_queue_head(&hdev->cmd_q, skb);
4120 break;
4121 }
4122
3bd7594e
DA		 4123 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4124 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4125 else
4126 *req_complete = bt_cb(skb)->hci.req_complete;
9238f36a
JH		 4127 kfree_skb(skb);
4128 }
4129 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
9238f36a
JH		 4130}
4131
b78752cc 4132static void hci_rx_work(struct work_struct *work)
1da177e4 4133{
b78752cc 4134 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
1da177e4
LT		 4135 struct sk_buff *skb;
4136
4137 BT_DBG("%s", hdev->name);
4138
1da177e4 4139 while ((skb = skb_dequeue(&hdev->rx_q))) {
cd82e61c
MH		 4140 /* Send copy to monitor */
4141 hci_send_to_monitor(hdev, skb);
4142
1da177e4
LT		 4143 if (atomic_read(&hdev->promisc)) {
4144 /* Send copy to the sockets */
470fe1b5 4145 hci_send_to_sock(hdev, skb);
1da177e4
LT		 4146 }
4147
d7a5a11d 4148 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1da177e4
LT		 4149 kfree_skb(skb);
4150 continue;
4151 }
4152
4153 if (test_bit(HCI_INIT, &hdev->flags)) {
4154 /* Don't process data packets in this states. */
d79f34e3 4155 switch (hci_skb_pkt_type(skb)) {
1da177e4
LT		 4156 case HCI_ACLDATA_PKT:
4157 case HCI_SCODATA_PKT:
4158 kfree_skb(skb);
4159 continue;
3ff50b79 4160 }
1da177e4
LT		 4161 }
4162
4163 /* Process frame */
d79f34e3 4164 switch (hci_skb_pkt_type(skb)) {
1da177e4 4165 case HCI_EVENT_PKT:
b78752cc 4166 BT_DBG("%s Event packet", hdev->name);
1da177e4
LT		 4167 hci_event_packet(hdev, skb);
4168 break;
4169
4170 case HCI_ACLDATA_PKT:
4171 BT_DBG("%s ACL data packet", hdev->name);
4172 hci_acldata_packet(hdev, skb);
4173 break;
4174
4175 case HCI_SCODATA_PKT:
4176 BT_DBG("%s SCO data packet", hdev->name);
4177 hci_scodata_packet(hdev, skb);
4178 break;
4179
4180 default:
4181 kfree_skb(skb);
4182 break;
4183 }
4184 }
1da177e4
LT		 4185}
4186
c347b765 4187static void hci_cmd_work(struct work_struct *work)
1da177e4 4188{
c347b765 4189 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
1da177e4
LT		 4190 struct sk_buff *skb;
4191
2104786b
AE		 4192 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4193 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
1da177e4 4194
1da177e4 4195 /* Send queued commands */
5a08ecce
AE		 4196 if (atomic_read(&hdev->cmd_cnt)) {
4197 skb = skb_dequeue(&hdev->cmd_q);
4198 if (!skb)
4199 return;
4200
7585b97a 4201 kfree_skb(hdev->sent_cmd);
1da177e4 4202
a675d7f1 4203 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
70f23020 4204 if (hdev->sent_cmd) {
1da177e4 4205 atomic_dec(&hdev->cmd_cnt);
57d17d70 4206 hci_send_frame(hdev, skb);
7bdb8a5c 4207 if (test_bit(HCI_RESET, &hdev->flags))
65cc2b49 4208 cancel_delayed_work(&hdev->cmd_timer);
7bdb8a5c 4209 else
65cc2b49
MH		 4210 schedule_delayed_work(&hdev->cmd_timer,
4211 HCI_CMD_TIMEOUT);
1da177e4
LT		 4212 } else {
4213 skb_queue_head(&hdev->cmd_q, skb);
c347b765 4214 queue_work(hdev->workqueue, &hdev->cmd_work);
1da177e4
LT		 4215 }
4216 }
4217}
Linux kernel - Deliverables
This page took 1.257683 seconds and 5 git commands to generate.