hci_core.c 120.3 KB
Newer Older
1
/*
L
Linus Torvalds 已提交
2 3
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated
4
   Copyright (C) 2011 ProFUSION Embedded Systems
L
Linus Torvalds 已提交
5 6 7 8 9 10 11 12 13 14 15

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 17 18
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
L
Linus Torvalds 已提交
19 20
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

21 22
   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
L
Linus Torvalds 已提交
23 24 25 26 27
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI core. */

28
#include <linux/export.h>
29
#include <linux/idr.h>
30
#include <linux/rfkill.h>
31
#include <linux/debugfs.h>
32
#include <linux/crypto.h>
33
#include <asm/unaligned.h>
L
Linus Torvalds 已提交
34 35 36

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
37
#include <net/bluetooth/l2cap.h>
38
#include <net/bluetooth/mgmt.h>
L
Linus Torvalds 已提交
39

40
#include "hci_request.h"
41 42
#include "smp.h"

43
static void hci_rx_work(struct work_struct *work);
44
static void hci_cmd_work(struct work_struct *work);
45
static void hci_tx_work(struct work_struct *work);
L
Linus Torvalds 已提交
46 47 48 49 50 51 52 53 54

/* HCI device list */
LIST_HEAD(hci_dev_list);
DEFINE_RWLOCK(hci_dev_list_lock);

/* HCI callback list */
LIST_HEAD(hci_cb_list);
DEFINE_RWLOCK(hci_cb_list_lock);

55 56 57
/* HCI ID Numbering */
static DEFINE_IDA(hci_index_ida);

58 59 60 61 62 63 64 65 66
/* ----- HCI requests ----- */

#define HCI_REQ_DONE	  0
#define HCI_REQ_PEND	  1
#define HCI_REQ_CANCELED  2

#define hci_req_lock(d)		mutex_lock(&d->req_lock)
#define hci_req_unlock(d)	mutex_unlock(&d->req_lock)

L
Linus Torvalds 已提交
67 68
/* ---- HCI notifications ---- */

69
static void hci_notify(struct hci_dev *hdev, int event)
L
Linus Torvalds 已提交
70
{
71
	hci_sock_dev_event(hdev, event);
L
Linus Torvalds 已提交
72 73
}

74 75
/* ---- HCI debugfs entries ---- */

76 77 78 79 80 81
static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
			     size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	char buf[3];

82
	buf[0] = test_bit(HCI_DUT_MODE, &hdev->dbg_flags) ? 'Y': 'N';
83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107
	buf[1] = '\n';
	buf[2] = '\0';
	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
}

static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
			      size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	struct sk_buff *skb;
	char buf[32];
	size_t buf_size = min(count, (sizeof(buf)-1));
	bool enable;
	int err;

	if (!test_bit(HCI_UP, &hdev->flags))
		return -ENETDOWN;

	if (copy_from_user(buf, user_buf, buf_size))
		return -EFAULT;

	buf[buf_size] = '\0';
	if (strtobool(buf, &enable))
		return -EINVAL;

108
	if (enable == test_bit(HCI_DUT_MODE, &hdev->dbg_flags))
109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128
		return -EALREADY;

	hci_req_lock(hdev);
	if (enable)
		skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
				     HCI_CMD_TIMEOUT);
	else
		skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
				     HCI_CMD_TIMEOUT);
	hci_req_unlock(hdev);

	if (IS_ERR(skb))
		return PTR_ERR(skb);

	err = -bt_to_errno(skb->data[0]);
	kfree_skb(skb);

	if (err < 0)
		return err;

129
	change_bit(HCI_DUT_MODE, &hdev->dbg_flags);
130 131 132 133 134 135 136 137 138 139 140

	return count;
}

static const struct file_operations dut_mode_fops = {
	.open		= simple_open,
	.read		= dut_mode_read,
	.write		= dut_mode_write,
	.llseek		= default_llseek,
};

141 142 143 144 145 146 147
static int features_show(struct seq_file *f, void *ptr)
{
	struct hci_dev *hdev = f->private;
	u8 p;

	hci_dev_lock(hdev);
	for (p = 0; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
148
		seq_printf(f, "%2u: 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x "
149 150 151 152 153 154
			   "0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n", p,
			   hdev->features[p][0], hdev->features[p][1],
			   hdev->features[p][2], hdev->features[p][3],
			   hdev->features[p][4], hdev->features[p][5],
			   hdev->features[p][6], hdev->features[p][7]);
	}
155 156 157 158 159 160 161
	if (lmp_le_capable(hdev))
		seq_printf(f, "LE: 0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x "
			   "0x%2.2x 0x%2.2x 0x%2.2x 0x%2.2x\n",
			   hdev->le_features[0], hdev->le_features[1],
			   hdev->le_features[2], hdev->le_features[3],
			   hdev->le_features[4], hdev->le_features[5],
			   hdev->le_features[6], hdev->le_features[7]);
162 163 164 165 166 167 168 169 170 171 172 173 174 175 176 177 178
	hci_dev_unlock(hdev);

	return 0;
}

static int features_open(struct inode *inode, struct file *file)
{
	return single_open(file, features_show, inode->i_private);
}

static const struct file_operations features_fops = {
	.open		= features_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

179 180 181 182 183 184 185
static int blacklist_show(struct seq_file *f, void *p)
{
	struct hci_dev *hdev = f->private;
	struct bdaddr_list *b;

	hci_dev_lock(hdev);
	list_for_each_entry(b, &hdev->blacklist, list)
186
		seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
187 188 189 190 191 192 193 194 195 196 197 198 199 200 201 202 203
	hci_dev_unlock(hdev);

	return 0;
}

static int blacklist_open(struct inode *inode, struct file *file)
{
	return single_open(file, blacklist_show, inode->i_private);
}

static const struct file_operations blacklist_fops = {
	.open		= blacklist_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

204 205 206 207 208 209 210
static int uuids_show(struct seq_file *f, void *p)
{
	struct hci_dev *hdev = f->private;
	struct bt_uuid *uuid;

	hci_dev_lock(hdev);
	list_for_each_entry(uuid, &hdev->uuids, list) {
211 212 213 214 215 216 217 218 219 220
		u8 i, val[16];

		/* The Bluetooth UUID values are stored in big endian,
		 * but with reversed byte order. So convert them into
		 * the right order for the %pUb modifier.
		 */
		for (i = 0; i < 16; i++)
			val[i] = uuid->uuid[15 - i];

		seq_printf(f, "%pUb\n", val);
221 222 223 224 225 226 227 228 229 230 231 232 233 234 235 236 237 238
	}
	hci_dev_unlock(hdev);

	return 0;
}

static int uuids_open(struct inode *inode, struct file *file)
{
	return single_open(file, uuids_show, inode->i_private);
}

static const struct file_operations uuids_fops = {
	.open		= uuids_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

239 240 241 242 243 244 245 246 247 248 249 250 251 252 253 254 255 256 257 258 259 260 261 262 263 264 265 266 267 268 269 270 271 272 273 274
static int inquiry_cache_show(struct seq_file *f, void *p)
{
	struct hci_dev *hdev = f->private;
	struct discovery_state *cache = &hdev->discovery;
	struct inquiry_entry *e;

	hci_dev_lock(hdev);

	list_for_each_entry(e, &cache->all, all) {
		struct inquiry_data *data = &e->data;
		seq_printf(f, "%pMR %d %d %d 0x%.2x%.2x%.2x 0x%.4x %d %d %u\n",
			   &data->bdaddr,
			   data->pscan_rep_mode, data->pscan_period_mode,
			   data->pscan_mode, data->dev_class[2],
			   data->dev_class[1], data->dev_class[0],
			   __le16_to_cpu(data->clock_offset),
			   data->rssi, data->ssp_mode, e->timestamp);
	}

	hci_dev_unlock(hdev);

	return 0;
}

static int inquiry_cache_open(struct inode *inode, struct file *file)
{
	return single_open(file, inquiry_cache_show, inode->i_private);
}

static const struct file_operations inquiry_cache_fops = {
	.open		= inquiry_cache_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

275 276 277
static int link_keys_show(struct seq_file *f, void *ptr)
{
	struct hci_dev *hdev = f->private;
278
	struct link_key *key;
279

280 281
	rcu_read_lock();
	list_for_each_entry_rcu(key, &hdev->link_keys, list)
282 283
		seq_printf(f, "%pMR %u %*phN %u\n", &key->bdaddr, key->type,
			   HCI_LINK_KEY_SIZE, key->val, key->pin_len);
284
	rcu_read_unlock();
285 286 287 288 289 290 291 292 293 294 295 296 297 298 299 300

	return 0;
}

static int link_keys_open(struct inode *inode, struct file *file)
{
	return single_open(file, link_keys_show, inode->i_private);
}

static const struct file_operations link_keys_fops = {
	.open		= link_keys_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

301 302 303 304 305 306 307 308 309 310 311 312 313 314 315 316 317 318 319 320 321 322 323 324
static int dev_class_show(struct seq_file *f, void *ptr)
{
	struct hci_dev *hdev = f->private;

	hci_dev_lock(hdev);
	seq_printf(f, "0x%.2x%.2x%.2x\n", hdev->dev_class[2],
		   hdev->dev_class[1], hdev->dev_class[0]);
	hci_dev_unlock(hdev);

	return 0;
}

static int dev_class_open(struct inode *inode, struct file *file)
{
	return single_open(file, dev_class_show, inode->i_private);
}

static const struct file_operations dev_class_fops = {
	.open		= dev_class_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

325 326 327 328 329 330 331 332 333 334 335 336 337 338
static int voice_setting_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->voice_setting;
	hci_dev_unlock(hdev);

	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(voice_setting_fops, voice_setting_get,
			NULL, "0x%4.4llx\n");

339 340 341 342 343 344 345 346 347 348 349 350 351 352 353 354 355 356 357 358 359 360 361 362 363
static int auto_accept_delay_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	hdev->auto_accept_delay = val;
	hci_dev_unlock(hdev);

	return 0;
}

static int auto_accept_delay_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->auto_accept_delay;
	hci_dev_unlock(hdev);

	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(auto_accept_delay_fops, auto_accept_delay_get,
			auto_accept_delay_set, "%llu\n");

364 365 366 367 368 369
static ssize_t force_sc_support_read(struct file *file, char __user *user_buf,
				     size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	char buf[3];

370
	buf[0] = test_bit(HCI_FORCE_SC, &hdev->dbg_flags) ? 'Y': 'N';
371 372 373 374 375 376 377 378 379 380 381 382 383 384 385 386 387 388 389 390 391 392 393 394
	buf[1] = '\n';
	buf[2] = '\0';
	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
}

static ssize_t force_sc_support_write(struct file *file,
				      const char __user *user_buf,
				      size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	char buf[32];
	size_t buf_size = min(count, (sizeof(buf)-1));
	bool enable;

	if (test_bit(HCI_UP, &hdev->flags))
		return -EBUSY;

	if (copy_from_user(buf, user_buf, buf_size))
		return -EFAULT;

	buf[buf_size] = '\0';
	if (strtobool(buf, &enable))
		return -EINVAL;

395
	if (enable == test_bit(HCI_FORCE_SC, &hdev->dbg_flags))
396 397
		return -EALREADY;

398
	change_bit(HCI_FORCE_SC, &hdev->dbg_flags);
399 400 401 402 403 404 405 406 407 408 409

	return count;
}

static const struct file_operations force_sc_support_fops = {
	.open		= simple_open,
	.read		= force_sc_support_read,
	.write		= force_sc_support_write,
	.llseek		= default_llseek,
};

410 411 412 413 414 415 416 417 418 419 420 421 422 423 424 425 426 427 428 429 430 431 432 433 434 435 436 437 438 439 440 441 442 443 444 445 446 447 448 449 450 451 452
static ssize_t force_lesc_support_read(struct file *file, char __user *user_buf,
				       size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	char buf[3];

	buf[0] = test_bit(HCI_FORCE_LESC, &hdev->dbg_flags) ? 'Y': 'N';
	buf[1] = '\n';
	buf[2] = '\0';
	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
}

static ssize_t force_lesc_support_write(struct file *file,
					const char __user *user_buf,
					size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	char buf[32];
	size_t buf_size = min(count, (sizeof(buf)-1));
	bool enable;

	if (copy_from_user(buf, user_buf, buf_size))
		return -EFAULT;

	buf[buf_size] = '\0';
	if (strtobool(buf, &enable))
		return -EINVAL;

	if (enable == test_bit(HCI_FORCE_LESC, &hdev->dbg_flags))
		return -EALREADY;

	change_bit(HCI_FORCE_LESC, &hdev->dbg_flags);

	return count;
}

static const struct file_operations force_lesc_support_fops = {
	.open		= simple_open,
	.read		= force_lesc_support_read,
	.write		= force_lesc_support_write,
	.llseek		= default_llseek,
};

453 454 455 456 457 458 459 460 461 462 463 464 465 466 467 468 469 470
static ssize_t sc_only_mode_read(struct file *file, char __user *user_buf,
				 size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	char buf[3];

	buf[0] = test_bit(HCI_SC_ONLY, &hdev->dev_flags) ? 'Y': 'N';
	buf[1] = '\n';
	buf[2] = '\0';
	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
}

static const struct file_operations sc_only_mode_fops = {
	.open		= simple_open,
	.read		= sc_only_mode_read,
	.llseek		= default_llseek,
};

471 472 473 474 475 476 477 478
static int idle_timeout_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;

	if (val != 0 && (val < 500 || val > 3600000))
		return -EINVAL;

	hci_dev_lock(hdev);
479
	hdev->idle_timeout = val;
480 481 482 483 484 485 486 487 488 489 490 491 492 493 494 495 496 497 498
	hci_dev_unlock(hdev);

	return 0;
}

static int idle_timeout_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->idle_timeout;
	hci_dev_unlock(hdev);

	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(idle_timeout_fops, idle_timeout_get,
			idle_timeout_set, "%llu\n");

499 500 501 502 503 504 505 506 507 508 509 510 511 512 513 514 515 516 517 518 519 520 521 522 523 524 525 526 527 528 529
static int rpa_timeout_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;

	/* Require the RPA timeout to be at least 30 seconds and at most
	 * 24 hours.
	 */
	if (val < 30 || val > (60 * 60 * 24))
		return -EINVAL;

	hci_dev_lock(hdev);
	hdev->rpa_timeout = val;
	hci_dev_unlock(hdev);

	return 0;
}

static int rpa_timeout_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->rpa_timeout;
	hci_dev_unlock(hdev);

	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(rpa_timeout_fops, rpa_timeout_get,
			rpa_timeout_set, "%llu\n");

530 531 532 533 534 535 536 537
static int sniff_min_interval_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;

	if (val == 0 || val % 2 || val > hdev->sniff_max_interval)
		return -EINVAL;

	hci_dev_lock(hdev);
538
	hdev->sniff_min_interval = val;
539 540 541 542 543 544 545 546 547 548 549 550 551 552 553 554 555 556 557 558 559 560 561 562 563 564 565
	hci_dev_unlock(hdev);

	return 0;
}

static int sniff_min_interval_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->sniff_min_interval;
	hci_dev_unlock(hdev);

	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(sniff_min_interval_fops, sniff_min_interval_get,
			sniff_min_interval_set, "%llu\n");

static int sniff_max_interval_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;

	if (val == 0 || val % 2 || val < hdev->sniff_min_interval)
		return -EINVAL;

	hci_dev_lock(hdev);
566
	hdev->sniff_max_interval = val;
567 568 569 570 571 572 573 574 575 576 577 578 579 580 581 582 583 584 585
	hci_dev_unlock(hdev);

	return 0;
}

static int sniff_max_interval_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->sniff_max_interval;
	hci_dev_unlock(hdev);

	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(sniff_max_interval_fops, sniff_max_interval_get,
			sniff_max_interval_set, "%llu\n");

586 587 588 589 590 591 592 593 594 595 596 597 598 599 600 601 602 603 604 605 606 607 608 609 610 611 612 613 614 615 616 617 618 619 620 621 622 623 624 625 626 627 628 629 630 631 632 633 634 635 636 637 638 639 640 641
static int conn_info_min_age_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;

	if (val == 0 || val > hdev->conn_info_max_age)
		return -EINVAL;

	hci_dev_lock(hdev);
	hdev->conn_info_min_age = val;
	hci_dev_unlock(hdev);

	return 0;
}

static int conn_info_min_age_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->conn_info_min_age;
	hci_dev_unlock(hdev);

	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(conn_info_min_age_fops, conn_info_min_age_get,
			conn_info_min_age_set, "%llu\n");

static int conn_info_max_age_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;

	if (val == 0 || val < hdev->conn_info_min_age)
		return -EINVAL;

	hci_dev_lock(hdev);
	hdev->conn_info_max_age = val;
	hci_dev_unlock(hdev);

	return 0;
}

static int conn_info_max_age_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->conn_info_max_age;
	hci_dev_unlock(hdev);

	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(conn_info_max_age_fops, conn_info_max_age_get,
			conn_info_max_age_set, "%llu\n");

642 643 644
static int identity_show(struct seq_file *f, void *p)
{
	struct hci_dev *hdev = f->private;
645
	bdaddr_t addr;
646 647 648 649
	u8 addr_type;

	hci_dev_lock(hdev);

650
	hci_copy_identity_address(hdev, &addr, &addr_type);
651

652
	seq_printf(f, "%pMR (type %u) %*phN %pMR\n", &addr, addr_type,
653
		   16, hdev->irk, &hdev->rpa);
654 655 656 657 658 659 660 661 662 663 664 665 666 667 668 669 670 671

	hci_dev_unlock(hdev);

	return 0;
}

static int identity_open(struct inode *inode, struct file *file)
{
	return single_open(file, identity_show, inode->i_private);
}

static const struct file_operations identity_fops = {
	.open		= identity_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

672 673 674 675 676 677 678 679 680 681 682 683 684 685 686 687 688 689 690 691 692 693 694
static int random_address_show(struct seq_file *f, void *p)
{
	struct hci_dev *hdev = f->private;

	hci_dev_lock(hdev);
	seq_printf(f, "%pMR\n", &hdev->random_addr);
	hci_dev_unlock(hdev);

	return 0;
}

static int random_address_open(struct inode *inode, struct file *file)
{
	return single_open(file, random_address_show, inode->i_private);
}

static const struct file_operations random_address_fops = {
	.open		= random_address_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

695 696 697 698 699 700 701 702 703 704 705 706 707 708 709 710 711 712 713 714 715 716 717
static int static_address_show(struct seq_file *f, void *p)
{
	struct hci_dev *hdev = f->private;

	hci_dev_lock(hdev);
	seq_printf(f, "%pMR\n", &hdev->static_addr);
	hci_dev_unlock(hdev);

	return 0;
}

static int static_address_open(struct inode *inode, struct file *file)
{
	return single_open(file, static_address_show, inode->i_private);
}

static const struct file_operations static_address_fops = {
	.open		= static_address_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

718 719 720
static ssize_t force_static_address_read(struct file *file,
					 char __user *user_buf,
					 size_t count, loff_t *ppos)
721
{
722 723
	struct hci_dev *hdev = file->private_data;
	char buf[3];
724

725
	buf[0] = test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ? 'Y': 'N';
726 727 728
	buf[1] = '\n';
	buf[2] = '\0';
	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
729 730
}

731 732 733
static ssize_t force_static_address_write(struct file *file,
					  const char __user *user_buf,
					  size_t count, loff_t *ppos)
734
{
735 736 737 738
	struct hci_dev *hdev = file->private_data;
	char buf[32];
	size_t buf_size = min(count, (sizeof(buf)-1));
	bool enable;
739

740 741
	if (test_bit(HCI_UP, &hdev->flags))
		return -EBUSY;
742

743 744 745 746 747 748 749
	if (copy_from_user(buf, user_buf, buf_size))
		return -EFAULT;

	buf[buf_size] = '\0';
	if (strtobool(buf, &enable))
		return -EINVAL;

750
	if (enable == test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags))
751 752
		return -EALREADY;

753
	change_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags);
754 755

	return count;
756 757
}

758 759 760 761 762 763
static const struct file_operations force_static_address_fops = {
	.open		= simple_open,
	.read		= force_static_address_read,
	.write		= force_static_address_write,
	.llseek		= default_llseek,
};
764

765 766 767 768 769 770 771 772 773 774 775 776 777 778 779 780 781 782 783 784 785 786 787 788 789
static int white_list_show(struct seq_file *f, void *ptr)
{
	struct hci_dev *hdev = f->private;
	struct bdaddr_list *b;

	hci_dev_lock(hdev);
	list_for_each_entry(b, &hdev->le_white_list, list)
		seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
	hci_dev_unlock(hdev);

	return 0;
}

static int white_list_open(struct inode *inode, struct file *file)
{
	return single_open(file, white_list_show, inode->i_private);
}

static const struct file_operations white_list_fops = {
	.open		= white_list_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

790 791 792
static int identity_resolving_keys_show(struct seq_file *f, void *ptr)
{
	struct hci_dev *hdev = f->private;
J
Johan Hedberg 已提交
793
	struct smp_irk *irk;
794

J
Johan Hedberg 已提交
795 796
	rcu_read_lock();
	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
797 798 799 800
		seq_printf(f, "%pMR (type %u) %*phN %pMR\n",
			   &irk->bdaddr, irk->addr_type,
			   16, irk->val, &irk->rpa);
	}
J
Johan Hedberg 已提交
801
	rcu_read_unlock();
802 803 804 805 806 807 808 809 810 811 812 813 814 815 816 817 818

	return 0;
}

static int identity_resolving_keys_open(struct inode *inode, struct file *file)
{
	return single_open(file, identity_resolving_keys_show,
			   inode->i_private);
}

static const struct file_operations identity_resolving_keys_fops = {
	.open		= identity_resolving_keys_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

819 820 821
static int long_term_keys_show(struct seq_file *f, void *ptr)
{
	struct hci_dev *hdev = f->private;
J
Johan Hedberg 已提交
822
	struct smp_ltk *ltk;
823

J
Johan Hedberg 已提交
824 825
	rcu_read_lock();
	list_for_each_entry_rcu(ltk, &hdev->long_term_keys, list)
826
		seq_printf(f, "%pMR (type %u) %u 0x%02x %u %.4x %.16llx %*phN\n",
827 828
			   &ltk->bdaddr, ltk->bdaddr_type, ltk->authenticated,
			   ltk->type, ltk->enc_size, __le16_to_cpu(ltk->ediv),
829
			   __le64_to_cpu(ltk->rand), 16, ltk->val);
J
Johan Hedberg 已提交
830
	rcu_read_unlock();
831 832 833 834 835 836 837 838 839 840 841 842 843 844 845 846

	return 0;
}

static int long_term_keys_open(struct inode *inode, struct file *file)
{
	return single_open(file, long_term_keys_show, inode->i_private);
}

static const struct file_operations long_term_keys_fops = {
	.open		= long_term_keys_open,
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

847 848 849 850 851 852 853 854
static int conn_min_interval_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;

	if (val < 0x0006 || val > 0x0c80 || val > hdev->le_conn_max_interval)
		return -EINVAL;

	hci_dev_lock(hdev);
855
	hdev->le_conn_min_interval = val;
856 857 858 859 860 861 862 863 864 865 866 867 868 869 870 871 872 873 874 875 876 877 878 879 880 881 882
	hci_dev_unlock(hdev);

	return 0;
}

static int conn_min_interval_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->le_conn_min_interval;
	hci_dev_unlock(hdev);

	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(conn_min_interval_fops, conn_min_interval_get,
			conn_min_interval_set, "%llu\n");

static int conn_max_interval_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;

	if (val < 0x0006 || val > 0x0c80 || val < hdev->le_conn_min_interval)
		return -EINVAL;

	hci_dev_lock(hdev);
883
	hdev->le_conn_max_interval = val;
884 885 886 887 888 889 890 891 892 893 894 895 896 897 898 899 900 901 902
	hci_dev_unlock(hdev);

	return 0;
}

static int conn_max_interval_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->le_conn_max_interval;
	hci_dev_unlock(hdev);

	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(conn_max_interval_fops, conn_max_interval_get,
			conn_max_interval_set, "%llu\n");

903
static int conn_latency_set(void *data, u64 val)
904 905 906
{
	struct hci_dev *hdev = data;

907
	if (val > 0x01f3)
908 909 910
		return -EINVAL;

	hci_dev_lock(hdev);
911
	hdev->le_conn_latency = val;
912 913 914 915 916
	hci_dev_unlock(hdev);

	return 0;
}

917
static int conn_latency_get(void *data, u64 *val)
918 919 920 921
{
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
922
	*val = hdev->le_conn_latency;
923 924 925 926 927
	hci_dev_unlock(hdev);

	return 0;
}

928 929
DEFINE_SIMPLE_ATTRIBUTE(conn_latency_fops, conn_latency_get,
			conn_latency_set, "%llu\n");
930

931
static int supervision_timeout_set(void *data, u64 val)
932
{
933
	struct hci_dev *hdev = data;
934

935 936 937 938 939 940 941 942
	if (val < 0x000a || val > 0x0c80)
		return -EINVAL;

	hci_dev_lock(hdev);
	hdev->le_supv_timeout = val;
	hci_dev_unlock(hdev);

	return 0;
943 944
}

945
static int supervision_timeout_get(void *data, u64 *val)
946
{
947
	struct hci_dev *hdev = data;
948

949 950 951
	hci_dev_lock(hdev);
	*val = hdev->le_supv_timeout;
	hci_dev_unlock(hdev);
952

953 954
	return 0;
}
955

956 957
DEFINE_SIMPLE_ATTRIBUTE(supervision_timeout_fops, supervision_timeout_get,
			supervision_timeout_set, "%llu\n");
958

959 960 961
static int adv_channel_map_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;
962

963 964
	if (val < 0x01 || val > 0x07)
		return -EINVAL;
965

966 967 968
	hci_dev_lock(hdev);
	hdev->le_adv_channel_map = val;
	hci_dev_unlock(hdev);
969

970 971
	return 0;
}
972

973
static int adv_channel_map_get(void *data, u64 *val)
974
{
975
	struct hci_dev *hdev = data;
976 977

	hci_dev_lock(hdev);
978 979
	*val = hdev->le_adv_channel_map;
	hci_dev_unlock(hdev);
980

981 982 983 984 985
	return 0;
}

DEFINE_SIMPLE_ATTRIBUTE(adv_channel_map_fops, adv_channel_map_get,
			adv_channel_map_set, "%llu\n");
986

987 988 989 990 991 992 993 994 995
static int adv_min_interval_set(void *data, u64 val)
{
	struct hci_dev *hdev = data;

	if (val < 0x0020 || val > 0x4000 || val > hdev->le_adv_max_interval)
		return -EINVAL;

	hci_dev_lock(hdev);
	hdev->le_adv_min_interval = val;
996 997 998 999 1000
	hci_dev_unlock(hdev);

	return 0;
}

1001
static int adv_min_interval_get(void *data, u64 *val)
1002
{
1003 1004 1005 1006 1007 1008 1009
	struct hci_dev *hdev = data;

	hci_dev_lock(hdev);
	*val = hdev->le_adv_min_interval;
	hci_dev_unlock(hdev);

	return 0;
1010 1011
}

1012 1013 1014 1015
DEFINE_SIMPLE_ATTRIBUTE(adv_min_interval_fops, adv_min_interval_get,
			adv_min_interval_set, "%llu\n");

static int adv_max_interval_set(void *data, u64 val)
1016
{
1017
	struct hci_dev *hdev = data;
1018

1019
	if (val < 0x0020 || val > 0x4000 || val < hdev->le_adv_min_interval)
1020 1021
		return -EINVAL;

1022 1023 1024
	hci_dev_lock(hdev);
	hdev->le_adv_max_interval = val;
	hci_dev_unlock(hdev);
1025

1026 1027
	return 0;
}
1028

1029 1030 1031
static int adv_max_interval_get(void *data, u64 *val)
{
	struct hci_dev *hdev = data;
1032

1033 1034 1035
	hci_dev_lock(hdev);
	*val = hdev->le_adv_max_interval;
	hci_dev_unlock(hdev);
1036

1037 1038
	return 0;
}
1039

1040 1041
DEFINE_SIMPLE_ATTRIBUTE(adv_max_interval_fops, adv_max_interval_get,
			adv_max_interval_set, "%llu\n");
1042

1043
static int device_list_show(struct seq_file *f, void *ptr)
1044
{
1045
	struct hci_dev *hdev = f->private;
1046
	struct hci_conn_params *p;
1047
	struct bdaddr_list *b;
1048 1049

	hci_dev_lock(hdev);
1050 1051
	list_for_each_entry(b, &hdev->whitelist, list)
		seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
1052
	list_for_each_entry(p, &hdev->le_conn_params, list) {
1053
		seq_printf(f, "%pMR (type %u) %u\n", &p->addr, p->addr_type,
1054 1055 1056 1057 1058 1059 1060
			   p->auto_connect);
	}
	hci_dev_unlock(hdev);

	return 0;
}

1061
static int device_list_open(struct inode *inode, struct file *file)
1062
{
1063
	return single_open(file, device_list_show, inode->i_private);
1064 1065
}

1066 1067
static const struct file_operations device_list_fops = {
	.open		= device_list_open,
1068 1069 1070 1071 1072
	.read		= seq_read,
	.llseek		= seq_lseek,
	.release	= single_release,
};

L
Linus Torvalds 已提交
1073 1074
/* ---- HCI requests ---- */

1075
static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
L
Linus Torvalds 已提交
1076
{
1077
	BT_DBG("%s result 0x%2.2x", hdev->name, result);
L
Linus Torvalds 已提交
1078 1079 1080 1081 1082 1083 1084 1085 1086 1087 1088 1089 1090 1091 1092 1093 1094 1095 1096

	if (hdev->req_status == HCI_REQ_PEND) {
		hdev->req_result = result;
		hdev->req_status = HCI_REQ_DONE;
		wake_up_interruptible(&hdev->req_wait_q);
	}
}

static void hci_req_cancel(struct hci_dev *hdev, int err)
{
	BT_DBG("%s err 0x%2.2x", hdev->name, err);

	if (hdev->req_status == HCI_REQ_PEND) {
		hdev->req_result = err;
		hdev->req_status = HCI_REQ_CANCELED;
		wake_up_interruptible(&hdev->req_wait_q);
	}
}

1097 1098
static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
					    u8 event)
1099 1100 1101 1102 1103 1104 1105 1106 1107 1108 1109 1110 1111 1112 1113 1114 1115 1116 1117 1118 1119 1120 1121
{
	struct hci_ev_cmd_complete *ev;
	struct hci_event_hdr *hdr;
	struct sk_buff *skb;

	hci_dev_lock(hdev);

	skb = hdev->recv_evt;
	hdev->recv_evt = NULL;

	hci_dev_unlock(hdev);

	if (!skb)
		return ERR_PTR(-ENODATA);

	if (skb->len < sizeof(*hdr)) {
		BT_ERR("Too short HCI event");
		goto failed;
	}

	hdr = (void *) skb->data;
	skb_pull(skb, HCI_EVENT_HDR_SIZE);

1122 1123 1124 1125 1126 1127
	if (event) {
		if (hdr->evt != event)
			goto failed;
		return skb;
	}

1128 1129 1130 1131 1132 1133 1134 1135 1136 1137 1138 1139 1140 1141 1142 1143 1144 1145 1146 1147 1148 1149 1150 1151
	if (hdr->evt != HCI_EV_CMD_COMPLETE) {
		BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
		goto failed;
	}

	if (skb->len < sizeof(*ev)) {
		BT_ERR("Too short cmd_complete event");
		goto failed;
	}

	ev = (void *) skb->data;
	skb_pull(skb, sizeof(*ev));

	if (opcode == __le16_to_cpu(ev->opcode))
		return skb;

	BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
	       __le16_to_cpu(ev->opcode));

failed:
	kfree_skb(skb);
	return ERR_PTR(-ENODATA);
}

1152
struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
1153
				  const void *param, u8 event, u32 timeout)
1154 1155 1156 1157 1158 1159 1160 1161 1162
{
	DECLARE_WAITQUEUE(wait, current);
	struct hci_request req;
	int err = 0;

	BT_DBG("%s", hdev->name);

	hci_req_init(&req, hdev);

1163
	hci_req_add_ev(&req, opcode, plen, param, event);
1164 1165 1166 1167 1168 1169

	hdev->req_status = HCI_REQ_PEND;

	add_wait_queue(&hdev->req_wait_q, &wait);
	set_current_state(TASK_INTERRUPTIBLE);

1170 1171 1172
	err = hci_req_run(&req, hci_req_sync_complete);
	if (err < 0) {
		remove_wait_queue(&hdev->req_wait_q, &wait);
1173
		set_current_state(TASK_RUNNING);
1174 1175 1176
		return ERR_PTR(err);
	}

1177 1178 1179 1180 1181 1182 1183 1184 1185 1186 1187 1188 1189 1190 1191 1192 1193 1194 1195 1196 1197 1198 1199 1200 1201 1202 1203 1204
	schedule_timeout(timeout);

	remove_wait_queue(&hdev->req_wait_q, &wait);

	if (signal_pending(current))
		return ERR_PTR(-EINTR);

	switch (hdev->req_status) {
	case HCI_REQ_DONE:
		err = -bt_to_errno(hdev->req_result);
		break;

	case HCI_REQ_CANCELED:
		err = -hdev->req_result;
		break;

	default:
		err = -ETIMEDOUT;
		break;
	}

	hdev->req_status = hdev->req_result = 0;

	BT_DBG("%s end: err %d", hdev->name, err);

	if (err < 0)
		return ERR_PTR(err);

1205 1206 1207 1208 1209
	return hci_get_cmd_complete(hdev, opcode, event);
}
EXPORT_SYMBOL(__hci_cmd_sync_ev);

struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
1210
			       const void *param, u32 timeout)
1211 1212
{
	return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
1213 1214 1215
}
EXPORT_SYMBOL(__hci_cmd_sync);

L
Linus Torvalds 已提交
1216
/* Execute request and wait for completion. */
1217
static int __hci_req_sync(struct hci_dev *hdev,
1218 1219
			  void (*func)(struct hci_request *req,
				      unsigned long opt),
1220
			  unsigned long opt, __u32 timeout)
L
Linus Torvalds 已提交
1221
{
1222
	struct hci_request req;
L
Linus Torvalds 已提交
1223 1224 1225 1226 1227
	DECLARE_WAITQUEUE(wait, current);
	int err = 0;

	BT_DBG("%s start", hdev->name);

1228 1229
	hci_req_init(&req, hdev);

L
Linus Torvalds 已提交
1230 1231
	hdev->req_status = HCI_REQ_PEND;

1232
	func(&req, opt);
1233

1234 1235 1236
	add_wait_queue(&hdev->req_wait_q, &wait);
	set_current_state(TASK_INTERRUPTIBLE);

1237 1238
	err = hci_req_run(&req, hci_req_sync_complete);
	if (err < 0) {
1239
		hdev->req_status = 0;
1240

1241
		remove_wait_queue(&hdev->req_wait_q, &wait);
1242
		set_current_state(TASK_RUNNING);
1243

1244 1245 1246 1247
		/* ENODATA means the HCI request command queue is empty.
		 * This can happen when a request with conditionals doesn't
		 * trigger any commands to be sent. This is normal behavior
		 * and should not trigger an error return.
1248
		 */
1249 1250 1251 1252
		if (err == -ENODATA)
			return 0;

		return err;
1253 1254
	}

L
Linus Torvalds 已提交
1255 1256 1257 1258 1259 1260 1261 1262 1263
	schedule_timeout(timeout);

	remove_wait_queue(&hdev->req_wait_q, &wait);

	if (signal_pending(current))
		return -EINTR;

	switch (hdev->req_status) {
	case HCI_REQ_DONE:
1264
		err = -bt_to_errno(hdev->req_result);
L
Linus Torvalds 已提交
1265 1266 1267 1268 1269 1270 1271 1272 1273
		break;

	case HCI_REQ_CANCELED:
		err = -hdev->req_result;
		break;

	default:
		err = -ETIMEDOUT;
		break;
1274
	}
L
Linus Torvalds 已提交
1275

1276
	hdev->req_status = hdev->req_result = 0;
L
Linus Torvalds 已提交
1277 1278 1279 1280 1281 1282

	BT_DBG("%s end: err %d", hdev->name, err);

	return err;
}

1283
static int hci_req_sync(struct hci_dev *hdev,
1284 1285
			void (*req)(struct hci_request *req,
				    unsigned long opt),
1286
			unsigned long opt, __u32 timeout)
L
Linus Torvalds 已提交
1287 1288 1289
{
	int ret;

1290 1291 1292
	if (!test_bit(HCI_UP, &hdev->flags))
		return -ENETDOWN;

L
Linus Torvalds 已提交
1293 1294
	/* Serialize all requests */
	hci_req_lock(hdev);
1295
	ret = __hci_req_sync(hdev, req, opt, timeout);
L
Linus Torvalds 已提交
1296 1297 1298 1299 1300
	hci_req_unlock(hdev);

	return ret;
}

1301
static void hci_reset_req(struct hci_request *req, unsigned long opt)
L
Linus Torvalds 已提交
1302
{
1303
	BT_DBG("%s %ld", req->hdev->name, opt);
L
Linus Torvalds 已提交
1304 1305

	/* Reset device */
1306 1307
	set_bit(HCI_RESET, &req->hdev->flags);
	hci_req_add(req, HCI_OP_RESET, 0, NULL);
L
Linus Torvalds 已提交
1308 1309
}

1310
static void bredr_init(struct hci_request *req)
L
Linus Torvalds 已提交
1311
{
1312
	req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
1313

L
Linus Torvalds 已提交
1314
	/* Read Local Supported Features */
1315
	hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
L
Linus Torvalds 已提交
1316

1317
	/* Read Local Version */
1318
	hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1319 1320

	/* Read BD Address */
1321
	hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
L
Linus Torvalds 已提交
1322 1323
}

1324
static void amp_init(struct hci_request *req)
1325
{
1326
	req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
1327

1328
	/* Read Local Version */
1329
	hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
1330

1331 1332 1333 1334 1335 1336
	/* Read Local Supported Commands */
	hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);

	/* Read Local Supported Features */
	hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);

1337
	/* Read Local AMP Info */
1338
	hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
1339 1340

	/* Read Data Blk size */
1341
	hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
1342

1343 1344 1345
	/* Read Flow Control Mode */
	hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);

1346 1347
	/* Read Location Data */
	hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
1348 1349
}

1350
static void hci_init1_req(struct hci_request *req, unsigned long opt)
1351
{
1352
	struct hci_dev *hdev = req->hdev;
1353 1354 1355

	BT_DBG("%s %ld", hdev->name, opt);

1356 1357
	/* Reset */
	if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
1358
		hci_reset_req(req, 0);
1359

1360 1361
	switch (hdev->dev_type) {
	case HCI_BREDR:
1362
		bredr_init(req);
1363 1364 1365
		break;

	case HCI_AMP:
1366
		amp_init(req);
1367 1368 1369 1370 1371 1372 1373 1374
		break;

	default:
		BT_ERR("Unknown device type %d", hdev->dev_type);
		break;
	}
}

1375
static void bredr_setup(struct hci_request *req)
1376 1377 1378 1379 1380
{
	__le16 param;
	__u8 flt_type;

	/* Read Buffer Size (ACL mtu, max pkt, etc.) */
1381
	hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
1382 1383

	/* Read Class of Device */
1384
	hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
1385 1386

	/* Read Local Name */
1387
	hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
1388 1389

	/* Read Voice Setting */
1390
	hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
1391

1392 1393 1394
	/* Read Number of Supported IAC */
	hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);

1395 1396 1397
	/* Read Current IAC LAP */
	hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);

1398 1399
	/* Clear Event Filters */
	flt_type = HCI_FLT_CLEAR_ALL;
1400
	hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
1401 1402

	/* Connection accept timeout ~20 secs */
1403
	param = cpu_to_le16(0x7d00);
1404
	hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
1405 1406
}

1407
static void le_setup(struct hci_request *req)
1408
{
1409 1410
	struct hci_dev *hdev = req->hdev;

1411
	/* Read LE Buffer Size */
1412
	hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
1413 1414

	/* Read LE Local Supported Features */
1415
	hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
1416

1417 1418 1419
	/* Read LE Supported States */
	hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);

1420
	/* Read LE White List Size */
1421
	hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
1422

1423 1424
	/* Clear LE White List */
	hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
1425 1426 1427 1428

	/* LE-only controllers have LE implicitly enabled */
	if (!lmp_bredr_capable(hdev))
		set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
1429 1430 1431 1432 1433 1434 1435 1436 1437 1438 1439 1440 1441 1442 1443 1444 1445 1446 1447 1448 1449 1450 1451 1452 1453 1454 1455 1456 1457 1458
}

static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
{
	if (lmp_ext_inq_capable(hdev))
		return 0x02;

	if (lmp_inq_rssi_capable(hdev))
		return 0x01;

	if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
	    hdev->lmp_subver == 0x0757)
		return 0x01;

	if (hdev->manufacturer == 15) {
		if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
			return 0x01;
		if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
			return 0x01;
		if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
			return 0x01;
	}

	if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
	    hdev->lmp_subver == 0x1805)
		return 0x01;

	return 0x00;
}

1459
static void hci_setup_inquiry_mode(struct hci_request *req)
1460 1461 1462
{
	u8 mode;

1463
	mode = hci_get_inquiry_mode(req->hdev);
1464

1465
	hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
1466 1467
}

1468
static void hci_setup_event_mask(struct hci_request *req)
1469
{
1470 1471
	struct hci_dev *hdev = req->hdev;

1472 1473 1474 1475 1476 1477 1478 1479 1480 1481 1482 1483 1484 1485 1486 1487 1488 1489
	/* The second byte is 0xff instead of 0x9f (two reserved bits
	 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
	 * command otherwise.
	 */
	u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };

	/* CSR 1.1 dongles does not accept any bitfield so don't try to set
	 * any event mask for pre 1.2 devices.
	 */
	if (hdev->hci_ver < BLUETOOTH_VER_1_2)
		return;

	if (lmp_bredr_capable(hdev)) {
		events[4] |= 0x01; /* Flow Specification Complete */
		events[4] |= 0x02; /* Inquiry Result with RSSI */
		events[4] |= 0x04; /* Read Remote Extended Features Complete */
		events[5] |= 0x08; /* Synchronous Connection Complete */
		events[5] |= 0x10; /* Synchronous Connection Changed */
1490 1491 1492 1493 1494 1495 1496 1497 1498 1499
	} else {
		/* Use a different default for LE-only devices */
		memset(events, 0, sizeof(events));
		events[0] |= 0x10; /* Disconnection Complete */
		events[1] |= 0x08; /* Read Remote Version Information Complete */
		events[1] |= 0x20; /* Command Complete */
		events[1] |= 0x40; /* Command Status */
		events[1] |= 0x80; /* Hardware Error */
		events[2] |= 0x04; /* Number of Completed Packets */
		events[3] |= 0x02; /* Data Buffer Overflow */
1500 1501 1502 1503 1504

		if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
			events[0] |= 0x80; /* Encryption Change */
			events[5] |= 0x80; /* Encryption Key Refresh Complete */
		}
1505 1506 1507 1508 1509 1510 1511 1512 1513 1514 1515 1516 1517 1518 1519 1520 1521 1522 1523 1524 1525 1526 1527 1528 1529 1530 1531 1532 1533 1534 1535 1536 1537 1538 1539 1540 1541
	}

	if (lmp_inq_rssi_capable(hdev))
		events[4] |= 0x02; /* Inquiry Result with RSSI */

	if (lmp_sniffsubr_capable(hdev))
		events[5] |= 0x20; /* Sniff Subrating */

	if (lmp_pause_enc_capable(hdev))
		events[5] |= 0x80; /* Encryption Key Refresh Complete */

	if (lmp_ext_inq_capable(hdev))
		events[5] |= 0x40; /* Extended Inquiry Result */

	if (lmp_no_flush_capable(hdev))
		events[7] |= 0x01; /* Enhanced Flush Complete */

	if (lmp_lsto_capable(hdev))
		events[6] |= 0x80; /* Link Supervision Timeout Changed */

	if (lmp_ssp_capable(hdev)) {
		events[6] |= 0x01;	/* IO Capability Request */
		events[6] |= 0x02;	/* IO Capability Response */
		events[6] |= 0x04;	/* User Confirmation Request */
		events[6] |= 0x08;	/* User Passkey Request */
		events[6] |= 0x10;	/* Remote OOB Data Request */
		events[6] |= 0x20;	/* Simple Pairing Complete */
		events[7] |= 0x04;	/* User Passkey Notification */
		events[7] |= 0x08;	/* Keypress Notification */
		events[7] |= 0x10;	/* Remote Host Supported
					 * Features Notification
					 */
	}

	if (lmp_le_capable(hdev))
		events[7] |= 0x20;	/* LE Meta-Event */

1542
	hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
1543 1544
}

1545
static void hci_init2_req(struct hci_request *req, unsigned long opt)
1546
{
1547 1548
	struct hci_dev *hdev = req->hdev;

1549
	if (lmp_bredr_capable(hdev))
1550
		bredr_setup(req);
1551 1552
	else
		clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
1553 1554

	if (lmp_le_capable(hdev))
1555
		le_setup(req);
1556

1557 1558 1559 1560
	/* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
	 * local supported commands HCI command.
	 */
	if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
1561
		hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
1562 1563

	if (lmp_ssp_capable(hdev)) {
1564 1565 1566 1567 1568 1569 1570 1571
		/* When SSP is available, then the host features page
		 * should also be available as well. However some
		 * controllers list the max_page as 0 as long as SSP
		 * has not been enabled. To achieve proper debugging
		 * output, force the minimum max_page to 1 at least.
		 */
		hdev->max_page = 0x01;

1572 1573
		if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
			u8 mode = 0x01;
1574 1575
			hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
				    sizeof(mode), &mode);
1576 1577 1578 1579 1580 1581
		} else {
			struct hci_cp_write_eir cp;

			memset(hdev->eir, 0, sizeof(hdev->eir));
			memset(&cp, 0, sizeof(cp));

1582
			hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
1583 1584 1585 1586
		}
	}

	if (lmp_inq_rssi_capable(hdev))
1587
		hci_setup_inquiry_mode(req);
1588 1589

	if (lmp_inq_tx_pwr_capable(hdev))
1590
		hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
1591 1592 1593 1594 1595

	if (lmp_ext_feat_capable(hdev)) {
		struct hci_cp_read_local_ext_features cp;

		cp.page = 0x01;
1596 1597
		hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
			    sizeof(cp), &cp);
1598 1599 1600 1601
	}

	if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
		u8 enable = 1;
1602 1603
		hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
			    &enable);
1604 1605 1606
	}
}

1607
static void hci_setup_link_policy(struct hci_request *req)
1608
{
1609
	struct hci_dev *hdev = req->hdev;
1610 1611 1612 1613 1614 1615 1616 1617 1618 1619 1620 1621 1622
	struct hci_cp_write_def_link_policy cp;
	u16 link_policy = 0;

	if (lmp_rswitch_capable(hdev))
		link_policy |= HCI_LP_RSWITCH;
	if (lmp_hold_capable(hdev))
		link_policy |= HCI_LP_HOLD;
	if (lmp_sniff_capable(hdev))
		link_policy |= HCI_LP_SNIFF;
	if (lmp_park_capable(hdev))
		link_policy |= HCI_LP_PARK;

	cp.policy = cpu_to_le16(link_policy);
1623
	hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
1624 1625
}

1626
static void hci_set_le_support(struct hci_request *req)
1627
{
1628
	struct hci_dev *hdev = req->hdev;
1629 1630
	struct hci_cp_write_le_host_supported cp;

1631 1632 1633 1634
	/* LE-only devices do not support explicit enablement */
	if (!lmp_bredr_capable(hdev))
		return;

1635 1636 1637 1638
	memset(&cp, 0, sizeof(cp));

	if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
		cp.le = 0x01;
1639
		cp.simul = 0x00;
1640 1641 1642
	}

	if (cp.le != lmp_host_le_capable(hdev))
1643 1644
		hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
			    &cp);
1645 1646
}

1647 1648 1649 1650 1651 1652 1653 1654
static void hci_set_event_mask_page_2(struct hci_request *req)
{
	struct hci_dev *hdev = req->hdev;
	u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };

	/* If Connectionless Slave Broadcast master role is supported
	 * enable all necessary events for it.
	 */
1655
	if (lmp_csb_master_capable(hdev)) {
1656 1657 1658 1659 1660 1661 1662 1663 1664
		events[1] |= 0x40;	/* Triggered Clock Capture */
		events[1] |= 0x80;	/* Synchronization Train Complete */
		events[2] |= 0x10;	/* Slave Page Response Timeout */
		events[2] |= 0x20;	/* CSB Channel Map Change */
	}

	/* If Connectionless Slave Broadcast slave role is supported
	 * enable all necessary events for it.
	 */
1665
	if (lmp_csb_slave_capable(hdev)) {
1666 1667 1668 1669 1670 1671
		events[2] |= 0x01;	/* Synchronization Train Received */
		events[2] |= 0x02;	/* CSB Receive */
		events[2] |= 0x04;	/* CSB Timeout */
		events[2] |= 0x08;	/* Truncated Page Complete */
	}

1672
	/* Enable Authenticated Payload Timeout Expired event if supported */
1673
	if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
1674 1675
		events[2] |= 0x80;

1676 1677 1678
	hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
}

1679
static void hci_init3_req(struct hci_request *req, unsigned long opt)
1680
{
1681
	struct hci_dev *hdev = req->hdev;
1682
	u8 p;
1683

1684 1685
	hci_setup_event_mask(req);

1686 1687 1688 1689 1690 1691 1692 1693
	/* Some Broadcom based Bluetooth controllers do not support the
	 * Delete Stored Link Key command. They are clearly indicating its
	 * absence in the bit mask of supported commands.
	 *
	 * Check the supported commands and only if the the command is marked
	 * as supported send it. If not supported assume that the controller
	 * does not have actual support for stored link keys which makes this
	 * command redundant anyway.
1694 1695 1696 1697
	 *
	 * Some controllers indicate that they support handling deleting
	 * stored link keys, but they don't. The quirk lets a driver
	 * just disable this command.
1698
	 */
1699 1700
	if (hdev->commands[6] & 0x80 &&
	    !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
1701 1702 1703 1704 1705 1706 1707 1708
		struct hci_cp_delete_stored_link_key cp;

		bacpy(&cp.bdaddr, BDADDR_ANY);
		cp.delete_all = 0x01;
		hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
			    sizeof(cp), &cp);
	}

1709
	if (hdev->commands[5] & 0x10)
1710
		hci_setup_link_policy(req);
1711

1712 1713 1714 1715 1716 1717 1718 1719 1720 1721
	if (hdev->commands[8] & 0x01)
		hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);

	/* Some older Broadcom based Bluetooth 1.2 controllers do not
	 * support the Read Page Scan Type command. Check support for
	 * this command in the bit mask of supported commands.
	 */
	if (hdev->commands[13] & 0x01)
		hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);

1722 1723 1724 1725
	if (lmp_le_capable(hdev)) {
		u8 events[8];

		memset(events, 0, sizeof(events));
1726 1727 1728 1729
		events[0] = 0x0f;

		if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
			events[0] |= 0x10;	/* LE Long Term Key Request */
1730 1731 1732 1733 1734 1735 1736 1737 1738

		/* If controller supports the Connection Parameters Request
		 * Link Layer Procedure, enable the corresponding event.
		 */
		if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
			events[0] |= 0x20;	/* LE Remote Connection
						 * Parameter Request
						 */

1739 1740 1741 1742 1743 1744 1745 1746
		/* If the controller supports Extended Scanner Filter
		 * Policies, enable the correspondig event.
		 */
		if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
			events[1] |= 0x04;	/* LE Direct Advertising
						 * Report
						 */

1747 1748 1749 1750 1751 1752 1753 1754 1755 1756 1757 1758 1759 1760
		/* If the controller supports the LE Read Local P-256
		 * Public Key command, enable the corresponding event.
		 */
		if (hdev->commands[34] & 0x02)
			events[0] |= 0x80;	/* LE Read Local P-256
						 * Public Key Complete
						 */

		/* If the controller supports the LE Generate DHKey
		 * command, enable the corresponding event.
		 */
		if (hdev->commands[34] & 0x04)
			events[1] |= 0x01;	/* LE Generate DHKey Complete */

1761 1762 1763
		hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
			    events);

1764 1765 1766 1767 1768
		if (hdev->commands[25] & 0x40) {
			/* Read LE Advertising Channel TX Power */
			hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
		}

1769
		hci_set_le_support(req);
1770
	}
1771 1772 1773 1774 1775 1776 1777 1778 1779

	/* Read features beyond page 1 if available */
	for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
		struct hci_cp_read_local_ext_features cp;

		cp.page = p;
		hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
			    sizeof(cp), &cp);
	}
1780 1781
}

1782 1783 1784 1785
static void hci_init4_req(struct hci_request *req, unsigned long opt)
{
	struct hci_dev *hdev = req->hdev;

1786 1787 1788 1789
	/* Set event mask page 2 if the HCI command for it is supported */
	if (hdev->commands[22] & 0x04)
		hci_set_event_mask_page_2(req);

1790 1791 1792 1793
	/* Read local codec list if the HCI command is supported */
	if (hdev->commands[29] & 0x20)
		hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);

1794 1795 1796 1797
	/* Get MWS transport configuration if the HCI command is supported */
	if (hdev->commands[30] & 0x08)
		hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);

1798
	/* Check for Synchronization Train support */
1799
	if (lmp_sync_train_capable(hdev))
1800
		hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
1801 1802

	/* Enable Secure Connections if supported and configured */
1803
	if (bredr_sc_enabled(hdev)) {
1804 1805 1806 1807
		u8 support = 0x01;
		hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
			    sizeof(support), &support);
	}
1808 1809
}

1810 1811 1812 1813 1814 1815 1816 1817
static int __hci_init(struct hci_dev *hdev)
{
	int err;

	err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
	if (err < 0)
		return err;

1818 1819 1820 1821 1822 1823 1824 1825
	/* The Device Under Test (DUT) mode is special and available for
	 * all controller types. So just create it early on.
	 */
	if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
		debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
				    &dut_mode_fops);
	}

1826 1827 1828 1829 1830 1831 1832 1833 1834 1835 1836
	/* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
	 * BR/EDR/LE type controllers. AMP controllers only need the
	 * first stage init.
	 */
	if (hdev->dev_type != HCI_BREDR)
		return 0;

	err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
	if (err < 0)
		return err;

1837 1838 1839 1840
	err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
	if (err < 0)
		return err;

1841 1842 1843 1844 1845 1846 1847 1848 1849 1850
	err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
	if (err < 0)
		return err;

	/* Only create debugfs entries during the initial setup
	 * phase and not every time the controller gets powered on.
	 */
	if (!test_bit(HCI_SETUP, &hdev->dev_flags))
		return 0;

1851 1852
	debugfs_create_file("features", 0444, hdev->debugfs, hdev,
			    &features_fops);
1853 1854 1855 1856
	debugfs_create_u16("manufacturer", 0444, hdev->debugfs,
			   &hdev->manufacturer);
	debugfs_create_u8("hci_version", 0444, hdev->debugfs, &hdev->hci_ver);
	debugfs_create_u16("hci_revision", 0444, hdev->debugfs, &hdev->hci_rev);
1857 1858
	debugfs_create_file("device_list", 0444, hdev->debugfs, hdev,
			    &device_list_fops);
1859 1860
	debugfs_create_file("blacklist", 0444, hdev->debugfs, hdev,
			    &blacklist_fops);
1861 1862
	debugfs_create_file("uuids", 0444, hdev->debugfs, hdev, &uuids_fops);

1863 1864 1865 1866 1867
	debugfs_create_file("conn_info_min_age", 0644, hdev->debugfs, hdev,
			    &conn_info_min_age_fops);
	debugfs_create_file("conn_info_max_age", 0644, hdev->debugfs, hdev,
			    &conn_info_max_age_fops);

1868 1869 1870
	if (lmp_bredr_capable(hdev)) {
		debugfs_create_file("inquiry_cache", 0444, hdev->debugfs,
				    hdev, &inquiry_cache_fops);
1871 1872
		debugfs_create_file("link_keys", 0400, hdev->debugfs,
				    hdev, &link_keys_fops);
1873 1874
		debugfs_create_file("dev_class", 0444, hdev->debugfs,
				    hdev, &dev_class_fops);
1875 1876
		debugfs_create_file("voice_setting", 0444, hdev->debugfs,
				    hdev, &voice_setting_fops);
1877 1878
	}

1879
	if (lmp_ssp_capable(hdev)) {
1880 1881
		debugfs_create_file("auto_accept_delay", 0644, hdev->debugfs,
				    hdev, &auto_accept_delay_fops);
1882 1883
		debugfs_create_file("force_sc_support", 0644, hdev->debugfs,
				    hdev, &force_sc_support_fops);
1884 1885
		debugfs_create_file("sc_only_mode", 0444, hdev->debugfs,
				    hdev, &sc_only_mode_fops);
1886 1887 1888 1889
		if (lmp_le_capable(hdev))
			debugfs_create_file("force_lesc_support", 0644,
					    hdev->debugfs, hdev,
					    &force_lesc_support_fops);
1890
	}
1891

1892 1893 1894 1895 1896 1897 1898 1899 1900
	if (lmp_sniff_capable(hdev)) {
		debugfs_create_file("idle_timeout", 0644, hdev->debugfs,
				    hdev, &idle_timeout_fops);
		debugfs_create_file("sniff_min_interval", 0644, hdev->debugfs,
				    hdev, &sniff_min_interval_fops);
		debugfs_create_file("sniff_max_interval", 0644, hdev->debugfs,
				    hdev, &sniff_max_interval_fops);
	}

1901
	if (lmp_le_capable(hdev)) {
1902 1903 1904 1905
		debugfs_create_file("identity", 0400, hdev->debugfs,
				    hdev, &identity_fops);
		debugfs_create_file("rpa_timeout", 0644, hdev->debugfs,
				    hdev, &rpa_timeout_fops);
1906 1907
		debugfs_create_file("random_address", 0444, hdev->debugfs,
				    hdev, &random_address_fops);
1908 1909 1910 1911 1912 1913 1914 1915 1916 1917 1918 1919
		debugfs_create_file("static_address", 0444, hdev->debugfs,
				    hdev, &static_address_fops);

		/* For controllers with a public address, provide a debug
		 * option to force the usage of the configured static
		 * address. By default the public address is used.
		 */
		if (bacmp(&hdev->bdaddr, BDADDR_ANY))
			debugfs_create_file("force_static_address", 0644,
					    hdev->debugfs, hdev,
					    &force_static_address_fops);

1920 1921
		debugfs_create_u8("white_list_size", 0444, hdev->debugfs,
				  &hdev->le_white_list_size);
1922 1923
		debugfs_create_file("white_list", 0444, hdev->debugfs, hdev,
				    &white_list_fops);
1924 1925 1926
		debugfs_create_file("identity_resolving_keys", 0400,
				    hdev->debugfs, hdev,
				    &identity_resolving_keys_fops);
1927 1928
		debugfs_create_file("long_term_keys", 0400, hdev->debugfs,
				    hdev, &long_term_keys_fops);
1929 1930 1931 1932
		debugfs_create_file("conn_min_interval", 0644, hdev->debugfs,
				    hdev, &conn_min_interval_fops);
		debugfs_create_file("conn_max_interval", 0644, hdev->debugfs,
				    hdev, &conn_max_interval_fops);
1933 1934
		debugfs_create_file("conn_latency", 0644, hdev->debugfs,
				    hdev, &conn_latency_fops);
1935 1936
		debugfs_create_file("supervision_timeout", 0644, hdev->debugfs,
				    hdev, &supervision_timeout_fops);
1937 1938
		debugfs_create_file("adv_channel_map", 0644, hdev->debugfs,
				    hdev, &adv_channel_map_fops);
1939 1940 1941 1942
		debugfs_create_file("adv_min_interval", 0644, hdev->debugfs,
				    hdev, &adv_min_interval_fops);
		debugfs_create_file("adv_max_interval", 0644, hdev->debugfs,
				    hdev, &adv_max_interval_fops);
1943 1944 1945
		debugfs_create_u16("discov_interleaved_timeout", 0644,
				   hdev->debugfs,
				   &hdev->discov_interleaved_timeout);
1946

1947
		smp_register(hdev);
1948
	}
1949

1950
	return 0;
1951 1952
}

1953 1954 1955 1956 1957 1958 1959 1960 1961 1962 1963 1964 1965 1966 1967 1968 1969 1970 1971 1972 1973 1974
static void hci_init0_req(struct hci_request *req, unsigned long opt)
{
	struct hci_dev *hdev = req->hdev;

	BT_DBG("%s %ld", hdev->name, opt);

	/* Reset */
	if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
		hci_reset_req(req, 0);

	/* Read Local Version */
	hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);

	/* Read BD Address */
	if (hdev->set_bdaddr)
		hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
}

static int __hci_unconf_init(struct hci_dev *hdev)
{
	int err;

1975 1976 1977
	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
		return 0;

1978 1979 1980 1981 1982 1983 1984
	err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT);
	if (err < 0)
		return err;

	return 0;
}

1985
static void hci_scan_req(struct hci_request *req, unsigned long opt)
L
Linus Torvalds 已提交
1986 1987 1988
{
	__u8 scan = opt;

1989
	BT_DBG("%s %x", req->hdev->name, scan);
L
Linus Torvalds 已提交
1990 1991

	/* Inquiry and Page scans */
1992
	hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
L
Linus Torvalds 已提交
1993 1994
}

1995
static void hci_auth_req(struct hci_request *req, unsigned long opt)
L
Linus Torvalds 已提交
1996 1997 1998
{
	__u8 auth = opt;

1999
	BT_DBG("%s %x", req->hdev->name, auth);
L
Linus Torvalds 已提交
2000 2001

	/* Authentication */
2002
	hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
L
Linus Torvalds 已提交
2003 2004
}

2005
static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
L
Linus Torvalds 已提交
2006 2007 2008
{
	__u8 encrypt = opt;

2009
	BT_DBG("%s %x", req->hdev->name, encrypt);
L
Linus Torvalds 已提交
2010

2011
	/* Encryption */
2012
	hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
L
Linus Torvalds 已提交
2013 2014
}

2015
static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
2016 2017 2018
{
	__le16 policy = cpu_to_le16(opt);

2019
	BT_DBG("%s %x", req->hdev->name, policy);
2020 2021

	/* Default link policy */
2022
	hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
2023 2024
}

2025
/* Get HCI device by index.
L
Linus Torvalds 已提交
2026 2027 2028
 * Device is held on return. */
struct hci_dev *hci_dev_get(int index)
{
2029
	struct hci_dev *hdev = NULL, *d;
L
Linus Torvalds 已提交
2030 2031 2032 2033 2034 2035 2036

	BT_DBG("%d", index);

	if (index < 0)
		return NULL;

	read_lock(&hci_dev_list_lock);
2037
	list_for_each_entry(d, &hci_dev_list, list) {
L
Linus Torvalds 已提交
2038 2039 2040 2041 2042 2043 2044 2045 2046 2047
		if (d->id == index) {
			hdev = hci_dev_hold(d);
			break;
		}
	}
	read_unlock(&hci_dev_list_lock);
	return hdev;
}

/* ---- Inquiry support ---- */
2048

2049 2050 2051 2052
bool hci_discovery_active(struct hci_dev *hdev)
{
	struct discovery_state *discov = &hdev->discovery;

A
Andre Guedes 已提交
2053
	switch (discov->state) {
2054
	case DISCOVERY_FINDING:
A
Andre Guedes 已提交
2055
	case DISCOVERY_RESOLVING:
2056 2057
		return true;

A
Andre Guedes 已提交
2058 2059 2060
	default:
		return false;
	}
2061 2062
}

2063 2064
void hci_discovery_set_state(struct hci_dev *hdev, int state)
{
2065 2066
	int old_state = hdev->discovery.state;

2067 2068
	BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);

2069
	if (old_state == state)
2070 2071
		return;

2072 2073
	hdev->discovery.state = state;

2074 2075
	switch (state) {
	case DISCOVERY_STOPPED:
2076 2077
		hci_update_background_scan(hdev);

2078
		if (old_state != DISCOVERY_STARTING)
2079
			mgmt_discovering(hdev, 0);
2080 2081 2082
		break;
	case DISCOVERY_STARTING:
		break;
2083
	case DISCOVERY_FINDING:
2084 2085
		mgmt_discovering(hdev, 1);
		break;
2086 2087
	case DISCOVERY_RESOLVING:
		break;
2088 2089 2090 2091 2092
	case DISCOVERY_STOPPING:
		break;
	}
}

2093
void hci_inquiry_cache_flush(struct hci_dev *hdev)
L
Linus Torvalds 已提交
2094
{
2095
	struct discovery_state *cache = &hdev->discovery;
2096
	struct inquiry_entry *p, *n;
L
Linus Torvalds 已提交
2097

2098 2099
	list_for_each_entry_safe(p, n, &cache->all, all) {
		list_del(&p->all);
2100
		kfree(p);
L
Linus Torvalds 已提交
2101
	}
2102 2103 2104

	INIT_LIST_HEAD(&cache->unknown);
	INIT_LIST_HEAD(&cache->resolve);
L
Linus Torvalds 已提交
2105 2106
}

2107 2108
struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
					       bdaddr_t *bdaddr)
L
Linus Torvalds 已提交
2109
{
2110
	struct discovery_state *cache = &hdev->discovery;
L
Linus Torvalds 已提交
2111 2112
	struct inquiry_entry *e;

2113
	BT_DBG("cache %p, %pMR", cache, bdaddr);
L
Linus Torvalds 已提交
2114

2115 2116 2117 2118 2119 2120 2121 2122 2123
	list_for_each_entry(e, &cache->all, all) {
		if (!bacmp(&e->data.bdaddr, bdaddr))
			return e;
	}

	return NULL;
}

struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
2124
						       bdaddr_t *bdaddr)
2125
{
2126
	struct discovery_state *cache = &hdev->discovery;
2127 2128
	struct inquiry_entry *e;

2129
	BT_DBG("cache %p, %pMR", cache, bdaddr);
2130 2131

	list_for_each_entry(e, &cache->unknown, list) {
L
Linus Torvalds 已提交
2132
		if (!bacmp(&e->data.bdaddr, bdaddr))
2133 2134 2135 2136
			return e;
	}

	return NULL;
L
Linus Torvalds 已提交
2137 2138
}

2139
struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
2140 2141
						       bdaddr_t *bdaddr,
						       int state)
2142 2143 2144 2145
{
	struct discovery_state *cache = &hdev->discovery;
	struct inquiry_entry *e;

2146
	BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
2147 2148 2149 2150 2151 2152 2153 2154 2155 2156 2157

	list_for_each_entry(e, &cache->resolve, list) {
		if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
			return e;
		if (!bacmp(&e->data.bdaddr, bdaddr))
			return e;
	}

	return NULL;
}

2158
void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
2159
				      struct inquiry_entry *ie)
2160 2161 2162 2163 2164 2165 2166 2167 2168
{
	struct discovery_state *cache = &hdev->discovery;
	struct list_head *pos = &cache->resolve;
	struct inquiry_entry *p;

	list_del(&ie->list);

	list_for_each_entry(p, &cache->resolve, list) {
		if (p->name_state != NAME_PENDING &&
2169
		    abs(p->data.rssi) >= abs(ie->data.rssi))
2170 2171 2172 2173 2174 2175 2176
			break;
		pos = &p->list;
	}

	list_add(&ie->list, pos);
}

2177 2178
u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
			     bool name_known)
L
Linus Torvalds 已提交
2179
{
2180
	struct discovery_state *cache = &hdev->discovery;
A
Andrei Emeltchenko 已提交
2181
	struct inquiry_entry *ie;
2182
	u32 flags = 0;
L
Linus Torvalds 已提交
2183

2184
	BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
L
Linus Torvalds 已提交
2185

2186
	hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
2187

2188 2189
	if (!data->ssp_mode)
		flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
2190

A
Andrei Emeltchenko 已提交
2191
	ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
2192
	if (ie) {
2193 2194
		if (!ie->data.ssp_mode)
			flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
2195

2196
		if (ie->name_state == NAME_NEEDED &&
2197
		    data->rssi != ie->data.rssi) {
2198 2199 2200 2201
			ie->data.rssi = data->rssi;
			hci_inquiry_cache_update_resolve(hdev, ie);
		}

2202
		goto update;
2203
	}
2204 2205

	/* Entry not in the cache. Add new one. */
2206
	ie = kzalloc(sizeof(*ie), GFP_KERNEL);
2207 2208 2209 2210
	if (!ie) {
		flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
		goto done;
	}
2211 2212 2213 2214 2215 2216 2217 2218 2219

	list_add(&ie->all, &cache->all);

	if (name_known) {
		ie->name_state = NAME_KNOWN;
	} else {
		ie->name_state = NAME_NOT_KNOWN;
		list_add(&ie->list, &cache->unknown);
	}
A
Andrei Emeltchenko 已提交
2220

2221 2222
update:
	if (name_known && ie->name_state != NAME_KNOWN &&
2223
	    ie->name_state != NAME_PENDING) {
2224 2225
		ie->name_state = NAME_KNOWN;
		list_del(&ie->list);
L
Linus Torvalds 已提交
2226 2227
	}

A
Andrei Emeltchenko 已提交
2228 2229
	memcpy(&ie->data, data, sizeof(*data));
	ie->timestamp = jiffies;
L
Linus Torvalds 已提交
2230
	cache->timestamp = jiffies;
2231 2232

	if (ie->name_state == NAME_NOT_KNOWN)
2233
		flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
2234

2235 2236
done:
	return flags;
L
Linus Torvalds 已提交
2237 2238 2239 2240
}

static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
{
2241
	struct discovery_state *cache = &hdev->discovery;
L
Linus Torvalds 已提交
2242 2243 2244 2245
	struct inquiry_info *info = (struct inquiry_info *) buf;
	struct inquiry_entry *e;
	int copied = 0;

2246
	list_for_each_entry(e, &cache->all, all) {
L
Linus Torvalds 已提交
2247
		struct inquiry_data *data = &e->data;
2248 2249 2250 2251

		if (copied >= num)
			break;

L
Linus Torvalds 已提交
2252 2253 2254 2255 2256 2257
		bacpy(&info->bdaddr, &data->bdaddr);
		info->pscan_rep_mode	= data->pscan_rep_mode;
		info->pscan_period_mode	= data->pscan_period_mode;
		info->pscan_mode	= data->pscan_mode;
		memcpy(info->dev_class, data->dev_class, 3);
		info->clock_offset	= data->clock_offset;
2258

L
Linus Torvalds 已提交
2259
		info++;
2260
		copied++;
L
Linus Torvalds 已提交
2261 2262 2263 2264 2265 2266
	}

	BT_DBG("cache %p, copied %d", cache, copied);
	return copied;
}

2267
static void hci_inq_req(struct hci_request *req, unsigned long opt)
L
Linus Torvalds 已提交
2268 2269
{
	struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
2270
	struct hci_dev *hdev = req->hdev;
L
Linus Torvalds 已提交
2271 2272 2273 2274 2275 2276 2277 2278 2279 2280 2281
	struct hci_cp_inquiry cp;

	BT_DBG("%s", hdev->name);

	if (test_bit(HCI_INQUIRY, &hdev->flags))
		return;

	/* Start Inquiry */
	memcpy(&cp.lap, &ir->lap, 3);
	cp.length  = ir->length;
	cp.num_rsp = ir->num_rsp;
2282
	hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
L
Linus Torvalds 已提交
2283 2284 2285 2286 2287 2288 2289 2290 2291 2292 2293 2294 2295 2296
}

int hci_inquiry(void __user *arg)
{
	__u8 __user *ptr = arg;
	struct hci_inquiry_req ir;
	struct hci_dev *hdev;
	int err = 0, do_inquiry = 0, max_rsp;
	long timeo;
	__u8 *buf;

	if (copy_from_user(&ir, ptr, sizeof(ir)))
		return -EFAULT;

2297 2298
	hdev = hci_dev_get(ir.dev_id);
	if (!hdev)
L
Linus Torvalds 已提交
2299 2300
		return -ENODEV;

2301 2302 2303 2304 2305
	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
		err = -EBUSY;
		goto done;
	}

2306
	if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2307 2308 2309 2310
		err = -EOPNOTSUPP;
		goto done;
	}

2311 2312 2313 2314 2315
	if (hdev->dev_type != HCI_BREDR) {
		err = -EOPNOTSUPP;
		goto done;
	}

2316 2317 2318 2319 2320
	if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
		err = -EOPNOTSUPP;
		goto done;
	}

2321
	hci_dev_lock(hdev);
2322
	if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
2323
	    inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
2324
		hci_inquiry_cache_flush(hdev);
L
Linus Torvalds 已提交
2325 2326
		do_inquiry = 1;
	}
2327
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
2328

2329
	timeo = ir.length * msecs_to_jiffies(2000);
A
Andrei Emeltchenko 已提交
2330 2331

	if (do_inquiry) {
2332 2333
		err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
				   timeo);
A
Andrei Emeltchenko 已提交
2334 2335
		if (err < 0)
			goto done;
2336 2337 2338 2339

		/* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
		 * cleared). If it is interrupted by a signal, return -EINTR.
		 */
2340
		if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
2341 2342
				TASK_INTERRUPTIBLE))
			return -EINTR;
A
Andrei Emeltchenko 已提交
2343
	}
L
Linus Torvalds 已提交
2344

2345 2346 2347
	/* for unlimited number of responses we will use buffer with
	 * 255 entries
	 */
L
Linus Torvalds 已提交
2348 2349 2350 2351 2352
	max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;

	/* cache_dump can't sleep. Therefore we allocate temp buffer and then
	 * copy it to the user space.
	 */
2353
	buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
A
Andrei Emeltchenko 已提交
2354
	if (!buf) {
L
Linus Torvalds 已提交
2355 2356 2357 2358
		err = -ENOMEM;
		goto done;
	}

2359
	hci_dev_lock(hdev);
L
Linus Torvalds 已提交
2360
	ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
2361
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
2362 2363 2364 2365 2366 2367

	BT_DBG("num_rsp %d", ir.num_rsp);

	if (!copy_to_user(ptr, &ir, sizeof(ir))) {
		ptr += sizeof(ir);
		if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
2368
				 ir.num_rsp))
L
Linus Torvalds 已提交
2369
			err = -EFAULT;
2370
	} else
L
Linus Torvalds 已提交
2371 2372 2373 2374 2375 2376 2377 2378 2379
		err = -EFAULT;

	kfree(buf);

done:
	hci_dev_put(hdev);
	return err;
}

2380
static int hci_dev_do_open(struct hci_dev *hdev)
L
Linus Torvalds 已提交
2381 2382 2383 2384 2385 2386 2387
{
	int ret = 0;

	BT_DBG("%s %p", hdev->name, hdev);

	hci_req_lock(hdev);

2388 2389 2390 2391 2392
	if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
		ret = -ENODEV;
		goto done;
	}

2393 2394
	if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
	    !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
2395 2396 2397 2398 2399 2400 2401 2402 2403 2404 2405 2406 2407
		/* Check for rfkill but allow the HCI setup stage to
		 * proceed (which in itself doesn't cause any RF activity).
		 */
		if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
			ret = -ERFKILL;
			goto done;
		}

		/* Check for valid public address or a configured static
		 * random adddress, but let the HCI setup proceed to
		 * be able to determine if there is a public address
		 * or not.
		 *
2408 2409 2410 2411
		 * In case of user channel usage, it is not important
		 * if a public address or static random address is
		 * available.
		 *
2412 2413 2414
		 * This check is only valid for BR/EDR controllers
		 * since AMP controllers do not have an address.
		 */
2415 2416
		if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
		    hdev->dev_type == HCI_BREDR &&
2417 2418 2419 2420 2421
		    !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
		    !bacmp(&hdev->static_addr, BDADDR_ANY)) {
			ret = -EADDRNOTAVAIL;
			goto done;
		}
2422 2423
	}

L
Linus Torvalds 已提交
2424 2425 2426 2427 2428 2429 2430 2431 2432 2433
	if (test_bit(HCI_UP, &hdev->flags)) {
		ret = -EALREADY;
		goto done;
	}

	if (hdev->open(hdev)) {
		ret = -EIO;
		goto done;
	}

2434 2435 2436
	atomic_set(&hdev->cmd_cnt, 1);
	set_bit(HCI_INIT, &hdev->flags);

2437 2438 2439
	if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
		if (hdev->setup)
			ret = hdev->setup(hdev);
2440

2441 2442 2443 2444 2445 2446
		/* The transport driver can set these quirks before
		 * creating the HCI device or in its setup callback.
		 *
		 * In case any of them is set, the controller has to
		 * start up as unconfigured.
		 */
2447 2448
		if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
		    test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
2449
			set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
2450

2451 2452 2453 2454 2455 2456 2457 2458 2459 2460
		/* For an unconfigured controller it is required to
		 * read at least the version information provided by
		 * the Read Local Version Information command.
		 *
		 * If the set_bdaddr driver callback is provided, then
		 * also the original Bluetooth public device address
		 * will be read using the Read BD Address command.
		 */
		if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
			ret = __hci_unconf_init(hdev);
2461 2462
	}

2463 2464 2465 2466 2467 2468 2469 2470
	if (test_bit(HCI_CONFIG, &hdev->dev_flags)) {
		/* If public address change is configured, ensure that
		 * the address gets programmed. If the driver does not
		 * support changing the public address, fail the power
		 * on procedure.
		 */
		if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
		    hdev->set_bdaddr)
2471 2472 2473 2474 2475
			ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
		else
			ret = -EADDRNOTAVAIL;
	}

2476
	if (!ret) {
2477
		if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2478
		    !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
2479
			ret = __hci_init(hdev);
L
Linus Torvalds 已提交
2480 2481
	}

2482 2483
	clear_bit(HCI_INIT, &hdev->flags);

L
Linus Torvalds 已提交
2484 2485
	if (!ret) {
		hci_dev_hold(hdev);
2486
		set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
L
Linus Torvalds 已提交
2487 2488
		set_bit(HCI_UP, &hdev->flags);
		hci_notify(hdev, HCI_DEV_UP);
2489
		if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
2490
		    !test_bit(HCI_CONFIG, &hdev->dev_flags) &&
2491
		    !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2492
		    !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
2493
		    hdev->dev_type == HCI_BREDR) {
2494
			hci_dev_lock(hdev);
2495
			mgmt_powered(hdev, 1);
2496
			hci_dev_unlock(hdev);
2497
		}
2498
	} else {
L
Linus Torvalds 已提交
2499
		/* Init failed, cleanup */
2500
		flush_work(&hdev->tx_work);
2501
		flush_work(&hdev->cmd_work);
2502
		flush_work(&hdev->rx_work);
L
Linus Torvalds 已提交
2503 2504 2505 2506 2507 2508 2509 2510 2511 2512 2513 2514 2515

		skb_queue_purge(&hdev->cmd_q);
		skb_queue_purge(&hdev->rx_q);

		if (hdev->flush)
			hdev->flush(hdev);

		if (hdev->sent_cmd) {
			kfree_skb(hdev->sent_cmd);
			hdev->sent_cmd = NULL;
		}

		hdev->close(hdev);
2516
		hdev->flags &= BIT(HCI_RAW);
L
Linus Torvalds 已提交
2517 2518 2519 2520 2521 2522 2523
	}

done:
	hci_req_unlock(hdev);
	return ret;
}

2524 2525 2526 2527 2528 2529 2530 2531 2532 2533 2534
/* ---- HCI ioctl helpers ---- */

int hci_dev_open(__u16 dev)
{
	struct hci_dev *hdev;
	int err;

	hdev = hci_dev_get(dev);
	if (!hdev)
		return -ENODEV;

2535
	/* Devices that are marked as unconfigured can only be powered
2536 2537 2538 2539 2540 2541 2542 2543
	 * up as user channel. Trying to bring them up as normal devices
	 * will result into a failure. Only user channel operation is
	 * possible.
	 *
	 * When this function is called for a user channel, the flag
	 * HCI_USER_CHANNEL will be set first before attempting to
	 * open the device.
	 */
2544
	if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2545 2546 2547 2548 2549
	    !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
		err = -EOPNOTSUPP;
		goto done;
	}

2550 2551 2552 2553 2554 2555 2556 2557
	/* We need to ensure that no other power on/off work is pending
	 * before proceeding to call hci_dev_do_open. This is
	 * particularly important if the setup procedure has not yet
	 * completed.
	 */
	if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
		cancel_delayed_work(&hdev->power_off);

2558 2559 2560 2561
	/* After this call it is guaranteed that the setup procedure
	 * has finished. This means that error conditions like RFKILL
	 * or no valid public or static random address apply.
	 */
2562 2563
	flush_workqueue(hdev->req_workqueue);

2564
	/* For controllers not using the management interface and that
2565
	 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
2566 2567 2568 2569 2570 2571
	 * so that pairing works for them. Once the management interface
	 * is in use this bit will be cleared again and userspace has
	 * to explicitly enable it.
	 */
	if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
	    !test_bit(HCI_MGMT, &hdev->dev_flags))
2572
		set_bit(HCI_BONDABLE, &hdev->dev_flags);
2573

2574 2575
	err = hci_dev_do_open(hdev);

2576
done:
2577 2578 2579 2580
	hci_dev_put(hdev);
	return err;
}

2581 2582 2583 2584 2585
/* This function requires the caller holds hdev->lock */
static void hci_pend_le_actions_clear(struct hci_dev *hdev)
{
	struct hci_conn_params *p;

2586 2587 2588
	list_for_each_entry(p, &hdev->le_conn_params, list) {
		if (p->conn) {
			hci_conn_drop(p->conn);
2589
			hci_conn_put(p->conn);
2590 2591
			p->conn = NULL;
		}
2592
		list_del_init(&p->action);
2593
	}
2594 2595 2596 2597

	BT_DBG("All LE pending actions cleared");
}

L
Linus Torvalds 已提交
2598 2599 2600 2601
static int hci_dev_do_close(struct hci_dev *hdev)
{
	BT_DBG("%s %p", hdev->name, hdev);

2602 2603
	cancel_delayed_work(&hdev->power_off);

L
Linus Torvalds 已提交
2604 2605 2606 2607
	hci_req_cancel(hdev, ENODEV);
	hci_req_lock(hdev);

	if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
2608
		cancel_delayed_work_sync(&hdev->cmd_timer);
L
Linus Torvalds 已提交
2609 2610 2611 2612
		hci_req_unlock(hdev);
		return 0;
	}

2613 2614
	/* Flush RX and TX works */
	flush_work(&hdev->tx_work);
2615
	flush_work(&hdev->rx_work);
L
Linus Torvalds 已提交
2616

2617
	if (hdev->discov_timeout > 0) {
2618
		cancel_delayed_work(&hdev->discov_off);
2619
		hdev->discov_timeout = 0;
2620
		clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
2621
		clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
2622 2623
	}

2624
	if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
2625 2626
		cancel_delayed_work(&hdev->service_cache);

A
Andre Guedes 已提交
2627
	cancel_delayed_work_sync(&hdev->le_scan_disable);
2628 2629 2630

	if (test_bit(HCI_MGMT, &hdev->dev_flags))
		cancel_delayed_work_sync(&hdev->rpa_expired);
A
Andre Guedes 已提交
2631

2632 2633 2634 2635 2636
	/* Avoid potential lockdep warnings from the *_flush() calls by
	 * ensuring the workqueue is empty up front.
	 */
	drain_workqueue(hdev->workqueue);

2637
	hci_dev_lock(hdev);
2638 2639 2640 2641 2642 2643

	if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
		if (hdev->dev_type == HCI_BREDR)
			mgmt_powered(hdev, 0);
	}

2644
	hci_inquiry_cache_flush(hdev);
2645
	hci_pend_le_actions_clear(hdev);
2646
	hci_conn_hash_flush(hdev);
2647
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
2648 2649 2650 2651 2652 2653 2654 2655 2656

	hci_notify(hdev, HCI_DEV_DOWN);

	if (hdev->flush)
		hdev->flush(hdev);

	/* Reset device */
	skb_queue_purge(&hdev->cmd_q);
	atomic_set(&hdev->cmd_cnt, 1);
2657 2658
	if (!test_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
	    !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
2659
	    test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
L
Linus Torvalds 已提交
2660
		set_bit(HCI_INIT, &hdev->flags);
2661
		__hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
L
Linus Torvalds 已提交
2662 2663 2664
		clear_bit(HCI_INIT, &hdev->flags);
	}

2665 2666
	/* flush cmd  work */
	flush_work(&hdev->cmd_work);
L
Linus Torvalds 已提交
2667 2668 2669 2670 2671 2672 2673 2674

	/* Drop queues */
	skb_queue_purge(&hdev->rx_q);
	skb_queue_purge(&hdev->cmd_q);
	skb_queue_purge(&hdev->raw_q);

	/* Drop last sent command */
	if (hdev->sent_cmd) {
2675
		cancel_delayed_work_sync(&hdev->cmd_timer);
L
Linus Torvalds 已提交
2676 2677 2678 2679
		kfree_skb(hdev->sent_cmd);
		hdev->sent_cmd = NULL;
	}

2680 2681 2682
	kfree_skb(hdev->recv_evt);
	hdev->recv_evt = NULL;

L
Linus Torvalds 已提交
2683 2684 2685 2686
	/* After this point our queues are empty
	 * and no tasks are scheduled. */
	hdev->close(hdev);

2687
	/* Clear flags */
2688
	hdev->flags &= BIT(HCI_RAW);
2689 2690
	hdev->dev_flags &= ~HCI_PERSISTENT_MASK;

2691
	/* Controller radio is available but is currently powered down */
2692
	hdev->amp_status = AMP_STATUS_POWERED_DOWN;
2693

2694
	memset(hdev->eir, 0, sizeof(hdev->eir));
2695
	memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
2696
	bacpy(&hdev->random_addr, BDADDR_ANY);
2697

L
Linus Torvalds 已提交
2698 2699 2700 2701 2702 2703 2704 2705 2706 2707 2708
	hci_req_unlock(hdev);

	hci_dev_put(hdev);
	return 0;
}

int hci_dev_close(__u16 dev)
{
	struct hci_dev *hdev;
	int err;

A
Andrei Emeltchenko 已提交
2709 2710
	hdev = hci_dev_get(dev);
	if (!hdev)
L
Linus Torvalds 已提交
2711
		return -ENODEV;
2712

2713 2714 2715 2716 2717
	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
		err = -EBUSY;
		goto done;
	}

2718 2719 2720
	if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
		cancel_delayed_work(&hdev->power_off);

L
Linus Torvalds 已提交
2721
	err = hci_dev_do_close(hdev);
2722

2723
done:
L
Linus Torvalds 已提交
2724 2725 2726 2727 2728 2729 2730 2731 2732
	hci_dev_put(hdev);
	return err;
}

int hci_dev_reset(__u16 dev)
{
	struct hci_dev *hdev;
	int ret = 0;

A
Andrei Emeltchenko 已提交
2733 2734
	hdev = hci_dev_get(dev);
	if (!hdev)
L
Linus Torvalds 已提交
2735 2736 2737 2738
		return -ENODEV;

	hci_req_lock(hdev);

2739 2740
	if (!test_bit(HCI_UP, &hdev->flags)) {
		ret = -ENETDOWN;
L
Linus Torvalds 已提交
2741
		goto done;
2742
	}
L
Linus Torvalds 已提交
2743

2744 2745 2746 2747 2748
	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
		ret = -EBUSY;
		goto done;
	}

2749
	if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2750 2751 2752 2753
		ret = -EOPNOTSUPP;
		goto done;
	}

L
Linus Torvalds 已提交
2754 2755 2756 2757
	/* Drop queues */
	skb_queue_purge(&hdev->rx_q);
	skb_queue_purge(&hdev->cmd_q);

2758 2759 2760 2761 2762
	/* Avoid potential lockdep warnings from the *_flush() calls by
	 * ensuring the workqueue is empty up front.
	 */
	drain_workqueue(hdev->workqueue);

2763
	hci_dev_lock(hdev);
2764
	hci_inquiry_cache_flush(hdev);
L
Linus Torvalds 已提交
2765
	hci_conn_hash_flush(hdev);
2766
	hci_dev_unlock(hdev);
L
Linus Torvalds 已提交
2767 2768 2769 2770

	if (hdev->flush)
		hdev->flush(hdev);

2771
	atomic_set(&hdev->cmd_cnt, 1);
2772
	hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
L
Linus Torvalds 已提交
2773

2774
	ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
2775 2776 2777 2778 2779 2780 2781 2782 2783 2784 2785 2786

done:
	hci_req_unlock(hdev);
	hci_dev_put(hdev);
	return ret;
}

int hci_dev_reset_stat(__u16 dev)
{
	struct hci_dev *hdev;
	int ret = 0;

A
Andrei Emeltchenko 已提交
2787 2788
	hdev = hci_dev_get(dev);
	if (!hdev)
L
Linus Torvalds 已提交
2789 2790
		return -ENODEV;

2791 2792 2793 2794 2795
	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
		ret = -EBUSY;
		goto done;
	}

2796
	if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2797 2798 2799 2800
		ret = -EOPNOTSUPP;
		goto done;
	}

L
Linus Torvalds 已提交
2801 2802
	memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));

2803
done:
L
Linus Torvalds 已提交
2804 2805 2806 2807
	hci_dev_put(hdev);
	return ret;
}

2808 2809
static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
{
2810
	bool conn_changed, discov_changed;
2811 2812 2813 2814 2815 2816 2817 2818 2819 2820

	BT_DBG("%s scan 0x%02x", hdev->name, scan);

	if ((scan & SCAN_PAGE))
		conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
						 &hdev->dev_flags);
	else
		conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
						  &hdev->dev_flags);

2821 2822 2823 2824 2825 2826 2827 2828 2829
	if ((scan & SCAN_INQUIRY)) {
		discov_changed = !test_and_set_bit(HCI_DISCOVERABLE,
						   &hdev->dev_flags);
	} else {
		clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
		discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
						    &hdev->dev_flags);
	}

2830 2831 2832
	if (!test_bit(HCI_MGMT, &hdev->dev_flags))
		return;

2833 2834 2835 2836 2837 2838 2839
	if (conn_changed || discov_changed) {
		/* In case this was disabled through mgmt */
		set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);

		if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
			mgmt_update_adv_data(hdev);

2840
		mgmt_new_settings(hdev);
2841
	}
2842 2843
}

L
Linus Torvalds 已提交
2844 2845 2846 2847 2848 2849 2850 2851 2852
int hci_dev_cmd(unsigned int cmd, void __user *arg)
{
	struct hci_dev *hdev;
	struct hci_dev_req dr;
	int err = 0;

	if (copy_from_user(&dr, arg, sizeof(dr)))
		return -EFAULT;

A
Andrei Emeltchenko 已提交
2853 2854
	hdev = hci_dev_get(dr.dev_id);
	if (!hdev)
L
Linus Torvalds 已提交
2855 2856
		return -ENODEV;

2857 2858 2859 2860 2861
	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
		err = -EBUSY;
		goto done;
	}

2862
	if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
2863 2864 2865 2866
		err = -EOPNOTSUPP;
		goto done;
	}

2867 2868 2869 2870 2871
	if (hdev->dev_type != HCI_BREDR) {
		err = -EOPNOTSUPP;
		goto done;
	}

2872 2873 2874 2875 2876
	if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
		err = -EOPNOTSUPP;
		goto done;
	}

L
Linus Torvalds 已提交
2877 2878
	switch (cmd) {
	case HCISETAUTH:
2879 2880
		err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
				   HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
2881 2882 2883 2884 2885 2886 2887 2888 2889 2890
		break;

	case HCISETENCRYPT:
		if (!lmp_encrypt_capable(hdev)) {
			err = -EOPNOTSUPP;
			break;
		}

		if (!test_bit(HCI_AUTH, &hdev->flags)) {
			/* Auth must be enabled first */
2891 2892
			err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
					   HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
2893 2894 2895 2896
			if (err)
				break;
		}

2897 2898
		err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
				   HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
2899 2900 2901
		break;

	case HCISETSCAN:
2902 2903
		err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
				   HCI_INIT_TIMEOUT);
2904

2905 2906
		/* Ensure that the connectable and discoverable states
		 * get correctly modified as this was a non-mgmt change.
2907
		 */
2908 2909
		if (!err)
			hci_update_scan_state(hdev, dr.dev_opt);
L
Linus Torvalds 已提交
2910 2911 2912
		break;

	case HCISETLINKPOL:
2913 2914
		err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
				   HCI_INIT_TIMEOUT);
L
Linus Torvalds 已提交
2915 2916 2917
		break;

	case HCISETLINKMODE:
2918 2919 2920 2921 2922 2923
		hdev->link_mode = ((__u16) dr.dev_opt) &
					(HCI_LM_MASTER | HCI_LM_ACCEPT);
		break;

	case HCISETPTYPE:
		hdev->pkt_type = (__u16) dr.dev_opt;
L
Linus Torvalds 已提交
2924 2925 2926
		break;

	case HCISETACLMTU:
2927 2928
		hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
		hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
L
Linus Torvalds 已提交
2929 2930 2931
		break;

	case HCISETSCOMTU:
2932 2933
		hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
		hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
L
Linus Torvalds 已提交
2934 2935 2936 2937 2938 2939
		break;

	default:
		err = -EINVAL;
		break;
	}
2940

2941
done:
L
Linus Torvalds 已提交
2942 2943 2944 2945 2946 2947
	hci_dev_put(hdev);
	return err;
}

int hci_get_dev_list(void __user *arg)
{
2948
	struct hci_dev *hdev;
L
Linus Torvalds 已提交
2949 2950 2951 2952 2953 2954 2955 2956 2957 2958 2959 2960 2961
	struct hci_dev_list_req *dl;
	struct hci_dev_req *dr;
	int n = 0, size, err;
	__u16 dev_num;

	if (get_user(dev_num, (__u16 __user *) arg))
		return -EFAULT;

	if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
		return -EINVAL;

	size = sizeof(*dl) + dev_num * sizeof(*dr);

A
Andrei Emeltchenko 已提交
2962 2963
	dl = kzalloc(size, GFP_KERNEL);
	if (!dl)
L
Linus Torvalds 已提交
2964 2965 2966 2967
		return -ENOMEM;

	dr = dl->dev_req;

2968
	read_lock(&hci_dev_list_lock);
2969
	list_for_each_entry(hdev, &hci_dev_list, list) {
2970
		unsigned long flags = hdev->flags;
2971

2972 2973 2974 2975 2976 2977
		/* When the auto-off is configured it means the transport
		 * is running, but in that case still indicate that the
		 * device is actually down.
		 */
		if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
			flags &= ~BIT(HCI_UP);
2978

L
Linus Torvalds 已提交
2979
		(dr + n)->dev_id  = hdev->id;
2980
		(dr + n)->dev_opt = flags;
2981

L
Linus Torvalds 已提交
2982 2983 2984
		if (++n >= dev_num)
			break;
	}
2985
	read_unlock(&hci_dev_list_lock);
L
Linus Torvalds 已提交
2986 2987 2988 2989 2990 2991 2992 2993 2994 2995 2996 2997 2998 2999

	dl->dev_num = n;
	size = sizeof(*dl) + n * sizeof(*dr);

	err = copy_to_user(arg, dl, size);
	kfree(dl);

	return err ? -EFAULT : 0;
}

int hci_get_dev_info(void __user *arg)
{
	struct hci_dev *hdev;
	struct hci_dev_info di;
3000
	unsigned long flags;
L
Linus Torvalds 已提交
3001 3002 3003 3004 3005
	int err = 0;

	if (copy_from_user(&di, arg, sizeof(di)))
		return -EFAULT;

A
Andrei Emeltchenko 已提交
3006 3007
	hdev = hci_dev_get(di.dev_id);
	if (!hdev)
L
Linus Torvalds 已提交
3008 3009
		return -ENODEV;

3010 3011 3012 3013 3014 3015 3016 3017
	/* When the auto-off is configured it means the transport
	 * is running, but in that case still indicate that the
	 * device is actually down.
	 */
	if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
		flags = hdev->flags & ~BIT(HCI_UP);
	else
		flags = hdev->flags;
3018

L
Linus Torvalds 已提交
3019 3020
	strcpy(di.name, hdev->name);
	di.bdaddr   = hdev->bdaddr;
3021
	di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
3022
	di.flags    = flags;
L
Linus Torvalds 已提交
3023
	di.pkt_type = hdev->pkt_type;
3024 3025 3026 3027 3028 3029 3030 3031 3032 3033 3034
	if (lmp_bredr_capable(hdev)) {
		di.acl_mtu  = hdev->acl_mtu;
		di.acl_pkts = hdev->acl_pkts;
		di.sco_mtu  = hdev->sco_mtu;
		di.sco_pkts = hdev->sco_pkts;
	} else {
		di.acl_mtu  = hdev->le_mtu;
		di.acl_pkts = hdev->le_pkts;
		di.sco_mtu  = 0;
		di.sco_pkts = 0;
	}
L
Linus Torvalds 已提交
3035 3036 3037 3038 3039 3040 3041 3042 3043 3044 3045 3046 3047 3048 3049 3050
	di.link_policy = hdev->link_policy;
	di.link_mode   = hdev->link_mode;

	memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
	memcpy(&di.features, &hdev->features, sizeof(di.features));

	if (copy_to_user(arg, &di, sizeof(di)))
		err = -EFAULT;

	hci_dev_put(hdev);

	return err;
}

/* ---- Interface to HCI drivers ---- */

3051 3052 3053 3054 3055 3056
static int hci_rfkill_set_block(void *data, bool blocked)
{
	struct hci_dev *hdev = data;

	BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);

3057 3058 3059
	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
		return -EBUSY;

3060 3061
	if (blocked) {
		set_bit(HCI_RFKILLED, &hdev->dev_flags);
3062 3063
		if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
		    !test_bit(HCI_CONFIG, &hdev->dev_flags))
3064
			hci_dev_do_close(hdev);
3065 3066
	} else {
		clear_bit(HCI_RFKILLED, &hdev->dev_flags);
3067
	}
3068 3069 3070 3071 3072 3073 3074 3075

	return 0;
}

static const struct rfkill_ops hci_rfkill_ops = {
	.set_block = hci_rfkill_set_block,
};

3076 3077 3078
static void hci_power_on(struct work_struct *work)
{
	struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
3079
	int err;
3080 3081 3082

	BT_DBG("%s", hdev->name);

3083
	err = hci_dev_do_open(hdev);
3084
	if (err < 0) {
3085
		hci_dev_lock(hdev);
3086
		mgmt_set_powered_failed(hdev, err);
3087
		hci_dev_unlock(hdev);
3088
		return;
3089
	}
3090

3091 3092 3093 3094 3095
	/* During the HCI setup phase, a few error conditions are
	 * ignored and they need to be checked now. If they are still
	 * valid, it is important to turn the device back off.
	 */
	if (test_bit(HCI_RFKILLED, &hdev->dev_flags) ||
3096
	    test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
3097 3098 3099
	    (hdev->dev_type == HCI_BREDR &&
	     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
	     !bacmp(&hdev->static_addr, BDADDR_ANY))) {
3100 3101 3102
		clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
		hci_dev_do_close(hdev);
	} else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
3103 3104
		queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
				   HCI_AUTO_OFF_TIMEOUT);
3105
	}
3106

3107
	if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags)) {
3108 3109 3110 3111 3112
		/* For unconfigured devices, set the HCI_RAW flag
		 * so that userspace can easily identify them.
		 */
		if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
			set_bit(HCI_RAW, &hdev->flags);
3113 3114 3115 3116 3117 3118 3119 3120 3121

		/* For fully configured devices, this will send
		 * the Index Added event. For unconfigured devices,
		 * it will send Unconfigued Index Added event.
		 *
		 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
		 * and no event will be send.
		 */
		mgmt_index_added(hdev);
3122
	} else if (test_and_clear_bit(HCI_CONFIG, &hdev->dev_flags)) {
3123 3124 3125 3126 3127 3128
		/* When the controller is now configured, then it
		 * is important to clear the HCI_RAW flag.
		 */
		if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
			clear_bit(HCI_RAW, &hdev->flags);

3129 3130 3131 3132
		/* Powering on the controller with HCI_CONFIG set only
		 * happens with the transition from unconfigured to
		 * configured. This will send the Index Added event.
		 */
3133
		mgmt_index_added(hdev);
3134
	}
3135 3136 3137 3138
}

static void hci_power_off(struct work_struct *work)
{
3139
	struct hci_dev *hdev = container_of(work, struct hci_dev,
3140
					    power_off.work);
3141 3142 3143

	BT_DBG("%s", hdev->name);

3144
	hci_dev_do_close(hdev);
3145 3146
}

3147 3148 3149 3150 3151 3152 3153 3154
static void hci_discov_off(struct work_struct *work)
{
	struct hci_dev *hdev;

	hdev = container_of(work, struct hci_dev, discov_off.work);

	BT_DBG("%s", hdev->name);

3155
	mgmt_discoverable_timeout(hdev);
3156 3157
}

3158
void hci_uuids_clear(struct hci_dev *hdev)
3159
{
3160
	struct bt_uuid *uuid, *tmp;
3161

3162 3163
	list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
		list_del(&uuid->list);
3164 3165 3166 3167
		kfree(uuid);
	}
}

3168
void hci_link_keys_clear(struct hci_dev *hdev)
3169
{
3170
	struct link_key *key;
3171

3172 3173 3174
	list_for_each_entry_rcu(key, &hdev->link_keys, list) {
		list_del_rcu(&key->list);
		kfree_rcu(key, rcu);
3175 3176 3177
	}
}

3178
void hci_smp_ltks_clear(struct hci_dev *hdev)
3179
{
J
Johan Hedberg 已提交
3180
	struct smp_ltk *k;
3181

J
Johan Hedberg 已提交
3182 3183 3184
	list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
		list_del_rcu(&k->list);
		kfree_rcu(k, rcu);
3185 3186 3187
	}
}

3188 3189
void hci_smp_irks_clear(struct hci_dev *hdev)
{
J
Johan Hedberg 已提交
3190
	struct smp_irk *k;
3191

J
Johan Hedberg 已提交
3192 3193 3194
	list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
		list_del_rcu(&k->list);
		kfree_rcu(k, rcu);
3195 3196 3197
	}
}

3198 3199
struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
{
3200
	struct link_key *k;
3201

3202 3203 3204 3205
	rcu_read_lock();
	list_for_each_entry_rcu(k, &hdev->link_keys, list) {
		if (bacmp(bdaddr, &k->bdaddr) == 0) {
			rcu_read_unlock();
3206
			return k;
3207 3208 3209
		}
	}
	rcu_read_unlock();
3210 3211 3212 3213

	return NULL;
}

3214
static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
3215
			       u8 key_type, u8 old_key_type)
3216 3217 3218
{
	/* Legacy key */
	if (key_type < 0x03)
3219
		return true;
3220 3221 3222

	/* Debug keys are insecure so don't store them persistently */
	if (key_type == HCI_LK_DEBUG_COMBINATION)
3223
		return false;
3224 3225 3226

	/* Changed combination key and there's no previous one */
	if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
3227
		return false;
3228 3229 3230

	/* Security mode 3 case */
	if (!conn)
3231
		return true;
3232

3233 3234 3235 3236
	/* BR/EDR key derived using SC from an LE link */
	if (conn->type == LE_LINK)
		return true;

3237 3238
	/* Neither local nor remote side had no-bonding as requirement */
	if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
3239
		return true;
3240 3241 3242

	/* Local side had dedicated bonding as requirement */
	if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
3243
		return true;
3244 3245 3246

	/* Remote side had dedicated bonding as requirement */
	if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
3247
		return true;
3248 3249 3250

	/* If none of the above criteria match, then don't store the key
	 * persistently */
3251
	return false;
3252 3253
}

3254
static u8 ltk_role(u8 type)
3255
{
3256 3257
	if (type == SMP_LTK)
		return HCI_ROLE_MASTER;
3258

3259
	return HCI_ROLE_SLAVE;
3260 3261
}

3262 3263
struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
			     u8 addr_type, u8 role)
3264
{
3265
	struct smp_ltk *k;
3266

J
Johan Hedberg 已提交
3267 3268
	rcu_read_lock();
	list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
3269 3270 3271
		if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
			continue;

3272
		if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
J
Johan Hedberg 已提交
3273
			rcu_read_unlock();
3274
			return k;
J
Johan Hedberg 已提交
3275 3276 3277
		}
	}
	rcu_read_unlock();
3278 3279 3280 3281

	return NULL;
}

3282 3283 3284 3285
struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
{
	struct smp_irk *irk;

J
Johan Hedberg 已提交
3286 3287 3288 3289
	rcu_read_lock();
	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
		if (!bacmp(&irk->rpa, rpa)) {
			rcu_read_unlock();
3290
			return irk;
J
Johan Hedberg 已提交
3291
		}
3292 3293
	}

J
Johan Hedberg 已提交
3294
	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
3295
		if (smp_irk_matches(hdev, irk->val, rpa)) {
3296
			bacpy(&irk->rpa, rpa);
J
Johan Hedberg 已提交
3297
			rcu_read_unlock();
3298 3299 3300
			return irk;
		}
	}
J
Johan Hedberg 已提交
3301
	rcu_read_unlock();
3302 3303 3304 3305 3306 3307 3308 3309 3310

	return NULL;
}

struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
				     u8 addr_type)
{
	struct smp_irk *irk;

3311 3312 3313 3314
	/* Identity Address must be public or static random */
	if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
		return NULL;

J
Johan Hedberg 已提交
3315 3316
	rcu_read_lock();
	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
3317
		if (addr_type == irk->addr_type &&
J
Johan Hedberg 已提交
3318 3319
		    bacmp(bdaddr, &irk->bdaddr) == 0) {
			rcu_read_unlock();
3320
			return irk;
J
Johan Hedberg 已提交
3321
		}
3322
	}
J
Johan Hedberg 已提交
3323
	rcu_read_unlock();
3324 3325 3326 3327

	return NULL;
}

3328
struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
3329 3330
				  bdaddr_t *bdaddr, u8 *val, u8 type,
				  u8 pin_len, bool *persistent)
3331 3332
{
	struct link_key *key, *old_key;
3333
	u8 old_key_type;
3334 3335 3336 3337 3338 3339

	old_key = hci_find_link_key(hdev, bdaddr);
	if (old_key) {
		old_key_type = old_key->type;
		key = old_key;
	} else {
3340
		old_key_type = conn ? conn->key_type : 0xff;
3341
		key = kzalloc(sizeof(*key), GFP_KERNEL);
3342
		if (!key)
3343
			return NULL;
3344
		list_add_rcu(&key->list, &hdev->link_keys);
3345 3346
	}

3347
	BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
3348

3349 3350 3351 3352
	/* Some buggy controller combinations generate a changed
	 * combination key for legacy pairing even when there's no
	 * previous key */
	if (type == HCI_LK_CHANGED_COMBINATION &&
3353
	    (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
3354
		type = HCI_LK_COMBINATION;
3355 3356 3357
		if (conn)
			conn->key_type = type;
	}
3358

3359
	bacpy(&key->bdaddr, bdaddr);
3360
	memcpy(key->val, val, HCI_LINK_KEY_SIZE);
3361 3362
	key->pin_len = pin_len;

3363
	if (type == HCI_LK_CHANGED_COMBINATION)
3364
		key->type = old_key_type;
3365 3366 3367
	else
		key->type = type;

3368 3369 3370
	if (persistent)
		*persistent = hci_persistent_key(hdev, conn, type,
						 old_key_type);
3371

3372
	return key;
3373 3374
}

3375
struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
3376
			    u8 addr_type, u8 type, u8 authenticated,
3377
			    u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
3378
{
3379
	struct smp_ltk *key, *old_key;
3380
	u8 role = ltk_role(type);
3381

3382
	old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
3383
	if (old_key)
3384
		key = old_key;
3385
	else {
3386
		key = kzalloc(sizeof(*key), GFP_KERNEL);
3387
		if (!key)
3388
			return NULL;
J
Johan Hedberg 已提交
3389
		list_add_rcu(&key->list, &hdev->long_term_keys);
3390 3391 3392
	}

	bacpy(&key->bdaddr, bdaddr);
3393 3394 3395 3396
	key->bdaddr_type = addr_type;
	memcpy(key->val, tk, sizeof(key->val));
	key->authenticated = authenticated;
	key->ediv = ediv;
3397
	key->rand = rand;
3398 3399
	key->enc_size = enc_size;
	key->type = type;
3400

3401
	return key;
3402 3403
}

3404 3405
struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
			    u8 addr_type, u8 val[16], bdaddr_t *rpa)
3406 3407 3408 3409 3410 3411 3412
{
	struct smp_irk *irk;

	irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
	if (!irk) {
		irk = kzalloc(sizeof(*irk), GFP_KERNEL);
		if (!irk)
3413
			return NULL;
3414 3415 3416 3417

		bacpy(&irk->bdaddr, bdaddr);
		irk->addr_type = addr_type;

J
Johan Hedberg 已提交
3418
		list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
3419 3420 3421 3422 3423
	}

	memcpy(irk->val, val, 16);
	bacpy(&irk->rpa, rpa);

3424
	return irk;
3425 3426
}

3427 3428 3429 3430 3431 3432 3433 3434
int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
{
	struct link_key *key;

	key = hci_find_link_key(hdev, bdaddr);
	if (!key)
		return -ENOENT;

3435
	BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3436

3437 3438
	list_del_rcu(&key->list);
	kfree_rcu(key, rcu);
3439 3440 3441 3442

	return 0;
}

3443
int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
3444
{
J
Johan Hedberg 已提交
3445
	struct smp_ltk *k;
3446
	int removed = 0;
3447

J
Johan Hedberg 已提交
3448
	list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
3449
		if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
3450 3451
			continue;

3452
		BT_DBG("%s removing %pMR", hdev->name, bdaddr);
3453

J
Johan Hedberg 已提交
3454 3455
		list_del_rcu(&k->list);
		kfree_rcu(k, rcu);
3456
		removed++;
3457 3458
	}

3459
	return removed ? 0 : -ENOENT;
3460 3461
}

3462 3463
void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
{
J
Johan Hedberg 已提交
3464
	struct smp_irk *k;
3465

J
Johan Hedberg 已提交
3466
	list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
3467 3468 3469 3470 3471
		if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
			continue;

		BT_DBG("%s removing %pMR", hdev->name, bdaddr);

J
Johan Hedberg 已提交
3472 3473
		list_del_rcu(&k->list);
		kfree_rcu(k, rcu);
3474 3475 3476
	}
}

3477
/* HCI command timer function */
3478
static void hci_cmd_timeout(struct work_struct *work)
3479
{
3480 3481
	struct hci_dev *hdev = container_of(work, struct hci_dev,
					    cmd_timer.work);
3482

3483 3484 3485 3486 3487 3488 3489 3490 3491
	if (hdev->sent_cmd) {
		struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
		u16 opcode = __le16_to_cpu(sent->opcode);

		BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
	} else {
		BT_ERR("%s command tx timeout", hdev->name);
	}

3492
	atomic_set(&hdev->cmd_cnt, 1);
3493
	queue_work(hdev->workqueue, &hdev->cmd_work);
3494 3495
}

3496
struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
3497
					  bdaddr_t *bdaddr, u8 bdaddr_type)
3498 3499 3500
{
	struct oob_data *data;

3501 3502 3503 3504 3505 3506 3507
	list_for_each_entry(data, &hdev->remote_oob_data, list) {
		if (bacmp(bdaddr, &data->bdaddr) != 0)
			continue;
		if (data->bdaddr_type != bdaddr_type)
			continue;
		return data;
	}
3508 3509 3510 3511

	return NULL;
}

3512 3513
int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
			       u8 bdaddr_type)
3514 3515 3516
{
	struct oob_data *data;

3517
	data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
3518 3519 3520
	if (!data)
		return -ENOENT;

3521
	BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
3522 3523 3524 3525 3526 3527 3528

	list_del(&data->list);
	kfree(data);

	return 0;
}

3529
void hci_remote_oob_data_clear(struct hci_dev *hdev)
3530 3531 3532 3533 3534 3535 3536 3537 3538
{
	struct oob_data *data, *n;

	list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
		list_del(&data->list);
		kfree(data);
	}
}

3539
int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
3540
			    u8 bdaddr_type, u8 *hash192, u8 *rand192,
3541
			    u8 *hash256, u8 *rand256)
3542 3543 3544
{
	struct oob_data *data;

3545
	data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
3546
	if (!data) {
3547
		data = kmalloc(sizeof(*data), GFP_KERNEL);
3548 3549 3550 3551
		if (!data)
			return -ENOMEM;

		bacpy(&data->bdaddr, bdaddr);
3552
		data->bdaddr_type = bdaddr_type;
3553 3554 3555
		list_add(&data->list, &hdev->remote_oob_data);
	}

3556 3557 3558 3559 3560 3561
	if (hash192 && rand192) {
		memcpy(data->hash192, hash192, sizeof(data->hash192));
		memcpy(data->rand192, rand192, sizeof(data->rand192));
	} else {
		memset(data->hash192, 0, sizeof(data->hash192));
		memset(data->rand192, 0, sizeof(data->rand192));
3562 3563
	}

3564 3565 3566 3567 3568 3569 3570
	if (hash256 && rand256) {
		memcpy(data->hash256, hash256, sizeof(data->hash256));
		memcpy(data->rand256, rand256, sizeof(data->rand256));
	} else {
		memset(data->hash256, 0, sizeof(data->hash256));
		memset(data->rand256, 0, sizeof(data->rand256));
	}
3571

3572
	BT_DBG("%s for %pMR", hdev->name, bdaddr);
3573 3574 3575 3576

	return 0;
}

3577
struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
3578
					 bdaddr_t *bdaddr, u8 type)
3579
{
3580
	struct bdaddr_list *b;
3581

3582
	list_for_each_entry(b, bdaddr_list, list) {
3583
		if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3584
			return b;
3585
	}
3586 3587 3588 3589

	return NULL;
}

3590
void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
3591 3592 3593
{
	struct list_head *p, *n;

3594
	list_for_each_safe(p, n, bdaddr_list) {
3595
		struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
3596 3597 3598 3599 3600 3601

		list_del(p);
		kfree(b);
	}
}

3602
int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
3603 3604 3605
{
	struct bdaddr_list *entry;

3606
	if (!bacmp(bdaddr, BDADDR_ANY))
3607 3608
		return -EBADF;

3609
	if (hci_bdaddr_list_lookup(list, bdaddr, type))
3610
		return -EEXIST;
3611

3612
	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3613 3614
	if (!entry)
		return -ENOMEM;
3615 3616

	bacpy(&entry->bdaddr, bdaddr);
3617
	entry->bdaddr_type = type;
3618

3619
	list_add(&entry->list, list);
3620

3621
	return 0;
3622 3623
}

3624
int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
3625 3626 3627
{
	struct bdaddr_list *entry;

3628
	if (!bacmp(bdaddr, BDADDR_ANY)) {
3629
		hci_bdaddr_list_clear(list);
3630 3631
		return 0;
	}
3632

3633
	entry = hci_bdaddr_list_lookup(list, bdaddr, type);
3634 3635 3636 3637 3638 3639 3640 3641 3642
	if (!entry)
		return -ENOENT;

	list_del(&entry->list);
	kfree(entry);

	return 0;
}

3643 3644 3645 3646 3647 3648
/* This function requires the caller holds hdev->lock */
struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
					       bdaddr_t *addr, u8 addr_type)
{
	struct hci_conn_params *params;

3649 3650 3651 3652
	/* The conn params list only contains identity addresses */
	if (!hci_is_identity_address(addr, addr_type))
		return NULL;

3653 3654 3655 3656 3657 3658 3659 3660 3661 3662
	list_for_each_entry(params, &hdev->le_conn_params, list) {
		if (bacmp(&params->addr, addr) == 0 &&
		    params->addr_type == addr_type) {
			return params;
		}
	}

	return NULL;
}

3663
/* This function requires the caller holds hdev->lock */
3664 3665
struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
						  bdaddr_t *addr, u8 addr_type)
3666
{
3667
	struct hci_conn_params *param;
3668

3669 3670 3671
	/* The list only contains identity addresses */
	if (!hci_is_identity_address(addr, addr_type))
		return NULL;
3672

3673
	list_for_each_entry(param, list, action) {
3674 3675 3676
		if (bacmp(&param->addr, addr) == 0 &&
		    param->addr_type == addr_type)
			return param;
3677 3678 3679
	}

	return NULL;
3680 3681
}

3682
/* This function requires the caller holds hdev->lock */
3683 3684
struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
					    bdaddr_t *addr, u8 addr_type)
3685 3686 3687
{
	struct hci_conn_params *params;

3688
	if (!hci_is_identity_address(addr, addr_type))
3689
		return NULL;
3690

3691
	params = hci_conn_params_lookup(hdev, addr, addr_type);
3692
	if (params)
3693
		return params;
3694 3695 3696 3697

	params = kzalloc(sizeof(*params), GFP_KERNEL);
	if (!params) {
		BT_ERR("Out of memory");
3698
		return NULL;
3699 3700 3701 3702
	}

	bacpy(&params->addr, addr);
	params->addr_type = addr_type;
3703 3704

	list_add(&params->list, &hdev->le_conn_params);
3705
	INIT_LIST_HEAD(&params->action);
3706

3707 3708 3709 3710 3711 3712 3713 3714
	params->conn_min_interval = hdev->le_conn_min_interval;
	params->conn_max_interval = hdev->le_conn_max_interval;
	params->conn_latency = hdev->le_conn_latency;
	params->supervision_timeout = hdev->le_supv_timeout;
	params->auto_connect = HCI_AUTO_CONN_DISABLED;

	BT_DBG("addr %pMR (type %u)", addr, addr_type);

3715
	return params;
3716 3717
}

3718
static void hci_conn_params_free(struct hci_conn_params *params)
3719
{
3720
	if (params->conn) {
3721
		hci_conn_drop(params->conn);
3722 3723
		hci_conn_put(params->conn);
	}
3724

3725
	list_del(&params->action);
3726 3727
	list_del(&params->list);
	kfree(params);
3728 3729 3730 3731 3732 3733 3734 3735 3736 3737 3738 3739
}

/* This function requires the caller holds hdev->lock */
void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
{
	struct hci_conn_params *params;

	params = hci_conn_params_lookup(hdev, addr, addr_type);
	if (!params)
		return;

	hci_conn_params_free(params);
3740

3741 3742
	hci_update_background_scan(hdev);

3743 3744 3745 3746
	BT_DBG("addr %pMR (type %u)", addr, addr_type);
}

/* This function requires the caller holds hdev->lock */
3747
void hci_conn_params_clear_disabled(struct hci_dev *hdev)
3748 3749 3750 3751
{
	struct hci_conn_params *params, *tmp;

	list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3752 3753
		if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
			continue;
3754 3755 3756 3757
		list_del(&params->list);
		kfree(params);
	}

3758
	BT_DBG("All LE disabled connection parameters were removed");
3759 3760 3761
}

/* This function requires the caller holds hdev->lock */
3762
void hci_conn_params_clear_all(struct hci_dev *hdev)
3763
{
3764
	struct hci_conn_params *params, *tmp;
3765

3766 3767
	list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
		hci_conn_params_free(params);
3768

3769
	hci_update_background_scan(hdev);
3770

3771
	BT_DBG("All LE connection parameters were removed");
3772 3773
}

3774
static void inquiry_complete(struct hci_dev *hdev, u8 status)
A
Andre Guedes 已提交
3775
{
3776 3777
	if (status) {
		BT_ERR("Failed to start inquiry: status %d", status);
A
Andre Guedes 已提交
3778

3779 3780 3781 3782 3783
		hci_dev_lock(hdev);
		hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
		hci_dev_unlock(hdev);
		return;
	}
A
Andre Guedes 已提交
3784 3785
}

3786
static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
A
Andre Guedes 已提交
3787
{
3788 3789 3790 3791
	/* General inquiry access code (GIAC) */
	u8 lap[3] = { 0x33, 0x8b, 0x9e };
	struct hci_request req;
	struct hci_cp_inquiry cp;
A
Andre Guedes 已提交
3792 3793
	int err;

3794 3795 3796 3797
	if (status) {
		BT_ERR("Failed to disable LE scanning: status %d", status);
		return;
	}
A
Andre Guedes 已提交
3798

3799 3800 3801 3802 3803 3804
	switch (hdev->discovery.type) {
	case DISCOV_TYPE_LE:
		hci_dev_lock(hdev);
		hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
		hci_dev_unlock(hdev);
		break;
A
Andre Guedes 已提交
3805

3806 3807
	case DISCOV_TYPE_INTERLEAVED:
		hci_req_init(&req, hdev);
A
Andre Guedes 已提交
3808

3809 3810 3811 3812
		memset(&cp, 0, sizeof(cp));
		memcpy(&cp.lap, lap, sizeof(cp.lap));
		cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
		hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
A
Andre Guedes 已提交
3813

3814
		hci_dev_lock(hdev);
3815

3816
		hci_inquiry_cache_flush(hdev);
3817

3818 3819 3820 3821 3822
		err = hci_req_run(&req, inquiry_complete);
		if (err) {
			BT_ERR("Inquiry request failed: err %d", err);
			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
		}
3823

3824 3825
		hci_dev_unlock(hdev);
		break;
3826 3827 3828
	}
}

A
Andre Guedes 已提交
3829 3830 3831
static void le_scan_disable_work(struct work_struct *work)
{
	struct hci_dev *hdev = container_of(work, struct hci_dev,
3832
					    le_scan_disable.work);
3833 3834
	struct hci_request req;
	int err;
A
Andre Guedes 已提交
3835 3836 3837

	BT_DBG("%s", hdev->name);

3838
	hci_req_init(&req, hdev);
A
Andre Guedes 已提交
3839

3840
	hci_req_add_le_scan_disable(&req);
A
Andre Guedes 已提交
3841

3842 3843 3844
	err = hci_req_run(&req, le_scan_disable_work_complete);
	if (err)
		BT_ERR("Disable LE scanning request failed: err %d", err);
A
Andre Guedes 已提交
3845 3846
}

3847 3848 3849 3850 3851 3852 3853 3854 3855 3856 3857 3858
/* Copy the Identity Address of the controller.
 *
 * If the controller has a public BD_ADDR, then by default use that one.
 * If this is a LE only controller without a public address, default to
 * the static random address.
 *
 * For debugging purposes it is possible to force controllers with a
 * public address to use the static random address instead.
 */
void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
			       u8 *bdaddr_type)
{
3859
	if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
3860 3861 3862 3863 3864 3865 3866 3867 3868
	    !bacmp(&hdev->bdaddr, BDADDR_ANY)) {
		bacpy(bdaddr, &hdev->static_addr);
		*bdaddr_type = ADDR_LE_DEV_RANDOM;
	} else {
		bacpy(bdaddr, &hdev->bdaddr);
		*bdaddr_type = ADDR_LE_DEV_PUBLIC;
	}
}

3869 3870 3871 3872 3873
/* Alloc HCI device */
struct hci_dev *hci_alloc_dev(void)
{
	struct hci_dev *hdev;

3874
	hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3875 3876 3877
	if (!hdev)
		return NULL;

3878 3879 3880
	hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
	hdev->esco_type = (ESCO_HV1);
	hdev->link_mode = (HCI_LM_ACCEPT);
3881 3882
	hdev->num_iac = 0x01;		/* One IAC support is mandatory */
	hdev->io_capability = 0x03;	/* No Input No Output */
3883
	hdev->manufacturer = 0xffff;	/* Default to internal use */
3884 3885
	hdev->inq_tx_power = HCI_TX_POWER_INVALID;
	hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3886 3887 3888 3889

	hdev->sniff_max_interval = 800;
	hdev->sniff_min_interval = 80;

3890
	hdev->le_adv_channel_map = 0x07;
3891 3892
	hdev->le_adv_min_interval = 0x0800;
	hdev->le_adv_max_interval = 0x0800;
3893 3894
	hdev->le_scan_interval = 0x0060;
	hdev->le_scan_window = 0x0030;
3895 3896
	hdev->le_conn_min_interval = 0x0028;
	hdev->le_conn_max_interval = 0x0038;
3897 3898
	hdev->le_conn_latency = 0x0000;
	hdev->le_supv_timeout = 0x002a;
3899

3900
	hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3901
	hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3902 3903
	hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
	hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3904

3905 3906 3907 3908 3909
	mutex_init(&hdev->lock);
	mutex_init(&hdev->req_lock);

	INIT_LIST_HEAD(&hdev->mgmt_pending);
	INIT_LIST_HEAD(&hdev->blacklist);
3910
	INIT_LIST_HEAD(&hdev->whitelist);
3911 3912 3913
	INIT_LIST_HEAD(&hdev->uuids);
	INIT_LIST_HEAD(&hdev->link_keys);
	INIT_LIST_HEAD(&hdev->long_term_keys);
3914
	INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3915
	INIT_LIST_HEAD(&hdev->remote_oob_data);
3916
	INIT_LIST_HEAD(&hdev->le_white_list);
3917
	INIT_LIST_HEAD(&hdev->le_conn_params);
3918
	INIT_LIST_HEAD(&hdev->pend_le_conns);
3919
	INIT_LIST_HEAD(&hdev->pend_le_reports);
3920
	INIT_LIST_HEAD(&hdev->conn_hash.list);
3921 3922 3923 3924 3925 3926 3927 3928 3929 3930 3931 3932 3933 3934 3935 3936

	INIT_WORK(&hdev->rx_work, hci_rx_work);
	INIT_WORK(&hdev->cmd_work, hci_cmd_work);
	INIT_WORK(&hdev->tx_work, hci_tx_work);
	INIT_WORK(&hdev->power_on, hci_power_on);

	INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
	INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
	INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);

	skb_queue_head_init(&hdev->rx_q);
	skb_queue_head_init(&hdev->cmd_q);
	skb_queue_head_init(&hdev->raw_q);

	init_waitqueue_head(&hdev->req_wait_q);

3937
	INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3938 3939 3940

	hci_init_sysfs(hdev);
	discovery_init(hdev);
3941 3942 3943 3944 3945 3946 3947 3948 3949 3950 3951 3952 3953

	return hdev;
}
EXPORT_SYMBOL(hci_alloc_dev);

/* Free HCI device */
void hci_free_dev(struct hci_dev *hdev)
{
	/* will free via device release */
	put_device(&hdev->dev);
}
EXPORT_SYMBOL(hci_free_dev);

L
Linus Torvalds 已提交
3954 3955 3956
/* Register HCI device */
int hci_register_dev(struct hci_dev *hdev)
{
3957
	int id, error;
L
Linus Torvalds 已提交
3958

3959
	if (!hdev->open || !hdev->close || !hdev->send)
L
Linus Torvalds 已提交
3960 3961
		return -EINVAL;

3962 3963 3964
	/* Do not allow HCI_AMP devices to register at index 0,
	 * so the index can be used as the AMP controller ID.
	 */
3965 3966 3967 3968 3969 3970 3971 3972 3973
	switch (hdev->dev_type) {
	case HCI_BREDR:
		id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
		break;
	case HCI_AMP:
		id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
		break;
	default:
		return -EINVAL;
L
Linus Torvalds 已提交
3974
	}
3975

3976 3977 3978
	if (id < 0)
		return id;

L
Linus Torvalds 已提交
3979 3980
	sprintf(hdev->name, "hci%d", id);
	hdev->id = id;
3981 3982 3983

	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);

3984 3985
	hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
					  WQ_MEM_RECLAIM, 1, hdev->name);
3986 3987 3988 3989
	if (!hdev->workqueue) {
		error = -ENOMEM;
		goto err;
	}
3990

3991 3992
	hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
					      WQ_MEM_RECLAIM, 1, hdev->name);
3993 3994 3995 3996 3997 3998
	if (!hdev->req_workqueue) {
		destroy_workqueue(hdev->workqueue);
		error = -ENOMEM;
		goto err;
	}

3999 4000 4001
	if (!IS_ERR_OR_NULL(bt_debugfs))
		hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);

4002 4003 4004
	dev_set_name(&hdev->dev, "%s", hdev->name);

	error = device_add(&hdev->dev);
4005
	if (error < 0)
4006
		goto err_wqueue;
L
Linus Torvalds 已提交
4007

4008
	hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
4009 4010
				    RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
				    hdev);
4011 4012 4013 4014 4015 4016 4017
	if (hdev->rfkill) {
		if (rfkill_register(hdev->rfkill) < 0) {
			rfkill_destroy(hdev->rfkill);
			hdev->rfkill = NULL;
		}
	}

4018 4019 4020
	if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
		set_bit(HCI_RFKILLED, &hdev->dev_flags);

4021
	set_bit(HCI_SETUP, &hdev->dev_flags);
4022
	set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
4023

4024
	if (hdev->dev_type == HCI_BREDR) {
4025 4026 4027 4028 4029
		/* Assume BR/EDR support until proven otherwise (such as
		 * through reading supported features during init.
		 */
		set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
	}
4030

4031 4032 4033 4034
	write_lock(&hci_dev_list_lock);
	list_add(&hdev->list, &hci_dev_list);
	write_unlock(&hci_dev_list_lock);

4035 4036
	/* Devices that are marked for raw-only usage are unconfigured
	 * and should not be included in normal operation.
4037 4038
	 */
	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
4039
		set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
4040

L
Linus Torvalds 已提交
4041
	hci_notify(hdev, HCI_DEV_REG);
4042
	hci_dev_hold(hdev);
L
Linus Torvalds 已提交
4043

4044
	queue_work(hdev->req_workqueue, &hdev->power_on);
4045

L
Linus Torvalds 已提交
4046
	return id;
4047

4048 4049
err_wqueue:
	destroy_workqueue(hdev->workqueue);
4050
	destroy_workqueue(hdev->req_workqueue);
4051
err:
4052
	ida_simple_remove(&hci_index_ida, hdev->id);
4053

4054
	return error;
L
Linus Torvalds 已提交
4055 4056 4057 4058
}
EXPORT_SYMBOL(hci_register_dev);

/* Unregister HCI device */
4059
void hci_unregister_dev(struct hci_dev *hdev)
L
Linus Torvalds 已提交
4060
{
4061
	int i, id;
4062

4063
	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
L
Linus Torvalds 已提交
4064

4065 4066
	set_bit(HCI_UNREGISTER, &hdev->dev_flags);

4067 4068
	id = hdev->id;

4069
	write_lock(&hci_dev_list_lock);
L
Linus Torvalds 已提交
4070
	list_del(&hdev->list);
4071
	write_unlock(&hci_dev_list_lock);
L
Linus Torvalds 已提交
4072 4073 4074

	hci_dev_do_close(hdev);

4075
	for (i = 0; i < NUM_REASSEMBLY; i++)
4076 4077
		kfree_skb(hdev->reassembly[i]);

4078 4079
	cancel_work_sync(&hdev->power_on);

4080
	if (!test_bit(HCI_INIT, &hdev->flags) &&
4081 4082
	    !test_bit(HCI_SETUP, &hdev->dev_flags) &&
	    !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
4083
		hci_dev_lock(hdev);
4084
		mgmt_index_removed(hdev);
4085
		hci_dev_unlock(hdev);
4086
	}
4087

4088 4089 4090 4091
	/* mgmt_index_removed should take care of emptying the
	 * pending list */
	BUG_ON(!list_empty(&hdev->mgmt_pending));

L
Linus Torvalds 已提交
4092 4093
	hci_notify(hdev, HCI_DEV_UNREG);

4094 4095 4096 4097 4098
	if (hdev->rfkill) {
		rfkill_unregister(hdev->rfkill);
		rfkill_destroy(hdev->rfkill);
	}

4099
	smp_unregister(hdev);
4100

4101
	device_del(&hdev->dev);
4102

4103 4104
	debugfs_remove_recursive(hdev->debugfs);

4105
	destroy_workqueue(hdev->workqueue);
4106
	destroy_workqueue(hdev->req_workqueue);
4107

4108
	hci_dev_lock(hdev);
4109
	hci_bdaddr_list_clear(&hdev->blacklist);
4110
	hci_bdaddr_list_clear(&hdev->whitelist);
4111
	hci_uuids_clear(hdev);
4112
	hci_link_keys_clear(hdev);
4113
	hci_smp_ltks_clear(hdev);
4114
	hci_smp_irks_clear(hdev);
4115
	hci_remote_oob_data_clear(hdev);
4116
	hci_bdaddr_list_clear(&hdev->le_white_list);
4117
	hci_conn_params_clear_all(hdev);
4118
	hci_discovery_filter_clear(hdev);
4119
	hci_dev_unlock(hdev);
4120

4121
	hci_dev_put(hdev);
4122 4123

	ida_simple_remove(&hci_index_ida, id);
L
Linus Torvalds 已提交
4124 4125 4126 4127 4128 4129 4130 4131 4132 4133 4134 4135 4136 4137 4138 4139 4140 4141 4142
}
EXPORT_SYMBOL(hci_unregister_dev);

/* Suspend HCI device */
int hci_suspend_dev(struct hci_dev *hdev)
{
	hci_notify(hdev, HCI_DEV_SUSPEND);
	return 0;
}
EXPORT_SYMBOL(hci_suspend_dev);

/* Resume HCI device */
int hci_resume_dev(struct hci_dev *hdev)
{
	hci_notify(hdev, HCI_DEV_RESUME);
	return 0;
}
EXPORT_SYMBOL(hci_resume_dev);

4143 4144 4145 4146 4147 4148 4149 4150 4151 4152 4153 4154 4155 4156 4157 4158 4159 4160
/* Reset HCI device */
int hci_reset_dev(struct hci_dev *hdev)
{
	const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
	struct sk_buff *skb;

	skb = bt_skb_alloc(3, GFP_ATOMIC);
	if (!skb)
		return -ENOMEM;

	bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
	memcpy(skb_put(skb, 3), hw_err, 3);

	/* Send Hardware Error to upper stack */
	return hci_recv_frame(hdev, skb);
}
EXPORT_SYMBOL(hci_reset_dev);

4161
/* Receive frame from HCI drivers */
4162
int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
4163 4164
{
	if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
4165
		      && !test_bit(HCI_INIT, &hdev->flags))) {
4166 4167 4168 4169
		kfree_skb(skb);
		return -ENXIO;
	}

4170
	/* Incoming skb */
4171 4172 4173 4174 4175 4176
	bt_cb(skb)->incoming = 1;

	/* Time stamp */
	__net_timestamp(skb);

	skb_queue_tail(&hdev->rx_q, skb);
4177
	queue_work(hdev->workqueue, &hdev->rx_work);
4178

4179 4180 4181 4182
	return 0;
}
EXPORT_SYMBOL(hci_recv_frame);

4183
static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
4184
			  int count, __u8 index)
4185 4186 4187 4188 4189 4190 4191 4192
{
	int len = 0;
	int hlen = 0;
	int remain = count;
	struct sk_buff *skb;
	struct bt_skb_cb *scb;

	if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
4193
	    index >= NUM_REASSEMBLY)
4194 4195 4196 4197 4198 4199 4200 4201 4202 4203 4204 4205 4206 4207 4208 4209 4210 4211 4212 4213
		return -EILSEQ;

	skb = hdev->reassembly[index];

	if (!skb) {
		switch (type) {
		case HCI_ACLDATA_PKT:
			len = HCI_MAX_FRAME_SIZE;
			hlen = HCI_ACL_HDR_SIZE;
			break;
		case HCI_EVENT_PKT:
			len = HCI_MAX_EVENT_SIZE;
			hlen = HCI_EVENT_HDR_SIZE;
			break;
		case HCI_SCODATA_PKT:
			len = HCI_MAX_SCO_SIZE;
			hlen = HCI_SCO_HDR_SIZE;
			break;
		}

4214
		skb = bt_skb_alloc(len, GFP_ATOMIC);
4215 4216 4217 4218 4219 4220 4221 4222 4223 4224 4225 4226
		if (!skb)
			return -ENOMEM;

		scb = (void *) skb->cb;
		scb->expect = hlen;
		scb->pkt_type = type;

		hdev->reassembly[index] = skb;
	}

	while (count) {
		scb = (void *) skb->cb;
4227
		len = min_t(uint, scb->expect, count);
4228 4229 4230 4231 4232 4233 4234 4235 4236 4237 4238 4239 4240 4241 4242 4243 4244 4245 4246 4247 4248 4249 4250 4251 4252 4253 4254 4255 4256 4257 4258 4259 4260 4261 4262 4263 4264 4265 4266 4267 4268 4269 4270 4271 4272 4273 4274 4275 4276 4277 4278 4279 4280

		memcpy(skb_put(skb, len), data, len);

		count -= len;
		data += len;
		scb->expect -= len;
		remain = count;

		switch (type) {
		case HCI_EVENT_PKT:
			if (skb->len == HCI_EVENT_HDR_SIZE) {
				struct hci_event_hdr *h = hci_event_hdr(skb);
				scb->expect = h->plen;

				if (skb_tailroom(skb) < scb->expect) {
					kfree_skb(skb);
					hdev->reassembly[index] = NULL;
					return -ENOMEM;
				}
			}
			break;

		case HCI_ACLDATA_PKT:
			if (skb->len  == HCI_ACL_HDR_SIZE) {
				struct hci_acl_hdr *h = hci_acl_hdr(skb);
				scb->expect = __le16_to_cpu(h->dlen);

				if (skb_tailroom(skb) < scb->expect) {
					kfree_skb(skb);
					hdev->reassembly[index] = NULL;
					return -ENOMEM;
				}
			}
			break;

		case HCI_SCODATA_PKT:
			if (skb->len == HCI_SCO_HDR_SIZE) {
				struct hci_sco_hdr *h = hci_sco_hdr(skb);
				scb->expect = h->dlen;

				if (skb_tailroom(skb) < scb->expect) {
					kfree_skb(skb);
					hdev->reassembly[index] = NULL;
					return -ENOMEM;
				}
			}
			break;
		}

		if (scb->expect == 0) {
			/* Complete frame */

			bt_cb(skb)->pkt_type = type;
4281
			hci_recv_frame(hdev, skb);
4282 4283 4284 4285 4286 4287 4288 4289 4290

			hdev->reassembly[index] = NULL;
			return remain;
		}
	}

	return remain;
}

4291 4292 4293 4294 4295 4296 4297
#define STREAM_REASSEMBLY 0

int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
{
	int type;
	int rem = 0;

4298
	while (count) {
4299 4300 4301 4302 4303 4304 4305 4306 4307 4308 4309 4310 4311 4312
		struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];

		if (!skb) {
			struct { char type; } *pkt;

			/* Start of the frame */
			pkt = data;
			type = pkt->type;

			data++;
			count--;
		} else
			type = bt_cb(skb)->pkt_type;

4313
		rem = hci_reassembly(hdev, type, data, count,
4314
				     STREAM_REASSEMBLY);
4315 4316 4317 4318 4319
		if (rem < 0)
			return rem;

		data += (count - rem);
		count = rem;
J
Joe Perches 已提交
4320
	}
4321 4322 4323 4324 4325

	return rem;
}
EXPORT_SYMBOL(hci_recv_stream_fragment);

L
Linus Torvalds 已提交
4326 4327 4328 4329 4330 4331
/* ---- Interface to upper protocols ---- */

int hci_register_cb(struct hci_cb *cb)
{
	BT_DBG("%p name %s", cb, cb->name);

4332
	write_lock(&hci_cb_list_lock);
L
Linus Torvalds 已提交
4333
	list_add(&cb->list, &hci_cb_list);
4334
	write_unlock(&hci_cb_list_lock);
L
Linus Torvalds 已提交
4335 4336 4337 4338 4339 4340 4341 4342 4343

	return 0;
}
EXPORT_SYMBOL(hci_register_cb);

int hci_unregister_cb(struct hci_cb *cb)
{
	BT_DBG("%p name %s", cb, cb->name);

4344
	write_lock(&hci_cb_list_lock);
L
Linus Torvalds 已提交
4345
	list_del(&cb->list);
4346
	write_unlock(&hci_cb_list_lock);
L
Linus Torvalds 已提交
4347 4348 4349 4350 4351

	return 0;
}
EXPORT_SYMBOL(hci_unregister_cb);

4352
static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
4353
{
4354 4355
	int err;

4356
	BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
L
Linus Torvalds 已提交
4357

4358 4359
	/* Time stamp */
	__net_timestamp(skb);
L
Linus Torvalds 已提交
4360

4361 4362 4363 4364 4365
	/* Send copy to monitor */
	hci_send_to_monitor(hdev, skb);

	if (atomic_read(&hdev->promisc)) {
		/* Send copy to the sockets */
4366
		hci_send_to_sock(hdev, skb);
L
Linus Torvalds 已提交
4367 4368 4369 4370 4371
	}

	/* Get rid of skb owner, prior to sending to the driver. */
	skb_orphan(skb);

4372 4373 4374 4375 4376
	err = hdev->send(hdev, skb);
	if (err < 0) {
		BT_ERR("%s sending frame failed (%d)", hdev->name, err);
		kfree_skb(skb);
	}
L
Linus Torvalds 已提交
4377 4378
}

4379 4380 4381 4382 4383
bool hci_req_pending(struct hci_dev *hdev)
{
	return (hdev->req_status == HCI_REQ_PEND);
}

4384
/* Send HCI command */
4385 4386
int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
		 const void *param)
4387 4388 4389 4390 4391 4392 4393 4394 4395 4396 4397
{
	struct sk_buff *skb;

	BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);

	skb = hci_prepare_cmd(hdev, opcode, plen, param);
	if (!skb) {
		BT_ERR("%s no memory for command", hdev->name);
		return -ENOMEM;
	}

S
Stephen Hemminger 已提交
4398
	/* Stand-alone HCI commands must be flagged as
4399 4400 4401 4402
	 * single-command requests.
	 */
	bt_cb(skb)->req.start = true;

L
Linus Torvalds 已提交
4403
	skb_queue_tail(&hdev->cmd_q, skb);
4404
	queue_work(hdev->workqueue, &hdev->cmd_work);
L
Linus Torvalds 已提交
4405 4406 4407 4408 4409

	return 0;
}

/* Get data from the previously sent command */
4410
void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
L
Linus Torvalds 已提交
4411 4412 4413 4414 4415 4416 4417 4418
{
	struct hci_command_hdr *hdr;

	if (!hdev->sent_cmd)
		return NULL;

	hdr = (void *) hdev->sent_cmd->data;

4419
	if (hdr->opcode != cpu_to_le16(opcode))
L
Linus Torvalds 已提交
4420 4421
		return NULL;

4422
	BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
L
Linus Torvalds 已提交
4423 4424 4425 4426 4427 4428 4429 4430 4431 4432

	return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
}

/* Send ACL data */
static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
{
	struct hci_acl_hdr *hdr;
	int len = skb->len;

4433 4434
	skb_push(skb, HCI_ACL_HDR_SIZE);
	skb_reset_transport_header(skb);
4435
	hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
4436 4437
	hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
	hdr->dlen   = cpu_to_le16(len);
L
Linus Torvalds 已提交
4438 4439
}

4440
static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
4441
			  struct sk_buff *skb, __u16 flags)
L
Linus Torvalds 已提交
4442
{
4443
	struct hci_conn *conn = chan->conn;
L
Linus Torvalds 已提交
4444 4445 4446
	struct hci_dev *hdev = conn->hdev;
	struct sk_buff *list;

4447 4448 4449 4450
	skb->len = skb_headlen(skb);
	skb->data_len = 0;

	bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
4451 4452 4453 4454 4455 4456 4457 4458 4459 4460 4461 4462

	switch (hdev->dev_type) {
	case HCI_BREDR:
		hci_add_acl_hdr(skb, conn->handle, flags);
		break;
	case HCI_AMP:
		hci_add_acl_hdr(skb, chan->handle, flags);
		break;
	default:
		BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
		return;
	}
4463

A
Andrei Emeltchenko 已提交
4464 4465
	list = skb_shinfo(skb)->frag_list;
	if (!list) {
L
Linus Torvalds 已提交
4466 4467 4468
		/* Non fragmented */
		BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);

4469
		skb_queue_tail(queue, skb);
L
Linus Torvalds 已提交
4470 4471 4472 4473 4474 4475
	} else {
		/* Fragmented */
		BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);

		skb_shinfo(skb)->frag_list = NULL;

4476 4477 4478 4479 4480 4481
		/* Queue all fragments atomically. We need to use spin_lock_bh
		 * here because of 6LoWPAN links, as there this function is
		 * called from softirq and using normal spin lock could cause
		 * deadlocks.
		 */
		spin_lock_bh(&queue->lock);
L
Linus Torvalds 已提交
4482

4483
		__skb_queue_tail(queue, skb);
4484 4485 4486

		flags &= ~ACL_START;
		flags |= ACL_CONT;
L
Linus Torvalds 已提交
4487 4488
		do {
			skb = list; list = list->next;
4489

4490
			bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
4491
			hci_add_acl_hdr(skb, conn->handle, flags);
L
Linus Torvalds 已提交
4492 4493 4494

			BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);

4495
			__skb_queue_tail(queue, skb);
L
Linus Torvalds 已提交
4496 4497
		} while (list);

4498
		spin_unlock_bh(&queue->lock);
L
Linus Torvalds 已提交
4499
	}
4500 4501 4502 4503
}

void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
{
4504
	struct hci_dev *hdev = chan->conn->hdev;
4505

4506
	BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
4507

4508
	hci_queue_acl(chan, &chan->data_q, skb, flags);
L
Linus Torvalds 已提交
4509

4510
	queue_work(hdev->workqueue, &hdev->tx_work);
L
Linus Torvalds 已提交
4511 4512 4513
}

/* Send SCO data */
4514
void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
L
Linus Torvalds 已提交
4515 4516 4517 4518 4519 4520
{
	struct hci_dev *hdev = conn->hdev;
	struct hci_sco_hdr hdr;

	BT_DBG("%s len %d", hdev->name, skb->len);

4521
	hdr.handle = cpu_to_le16(conn->handle);
L
Linus Torvalds 已提交
4522 4523
	hdr.dlen   = skb->len;

4524 4525
	skb_push(skb, HCI_SCO_HDR_SIZE);
	skb_reset_transport_header(skb);
4526
	memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
L
Linus Torvalds 已提交
4527

4528
	bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
4529

L
Linus Torvalds 已提交
4530
	skb_queue_tail(&conn->data_q, skb);
4531
	queue_work(hdev->workqueue, &hdev->tx_work);
L
Linus Torvalds 已提交
4532 4533 4534 4535 4536
}

/* ---- HCI TX task (outgoing data) ---- */

/* HCI Connection scheduler */
4537 4538
static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
				     int *quote)
L
Linus Torvalds 已提交
4539 4540
{
	struct hci_conn_hash *h = &hdev->conn_hash;
4541
	struct hci_conn *conn = NULL, *c;
4542
	unsigned int num = 0, min = ~0;
L
Linus Torvalds 已提交
4543

4544
	/* We don't have to lock device here. Connections are always
L
Linus Torvalds 已提交
4545
	 * added and removed with TX task disabled. */
4546 4547 4548 4549

	rcu_read_lock();

	list_for_each_entry_rcu(c, &h->list, list) {
4550
		if (c->type != type || skb_queue_empty(&c->data_q))
L
Linus Torvalds 已提交
4551
			continue;
4552 4553 4554 4555

		if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
			continue;

L
Linus Torvalds 已提交
4556 4557 4558 4559 4560 4561
		num++;

		if (c->sent < min) {
			min  = c->sent;
			conn = c;
		}
4562 4563 4564

		if (hci_conn_num(hdev, type) == num)
			break;
L
Linus Torvalds 已提交
4565 4566
	}

4567 4568
	rcu_read_unlock();

L
Linus Torvalds 已提交
4569
	if (conn) {
4570 4571 4572 4573 4574 4575 4576 4577 4578 4579 4580 4581 4582 4583 4584 4585 4586 4587 4588
		int cnt, q;

		switch (conn->type) {
		case ACL_LINK:
			cnt = hdev->acl_cnt;
			break;
		case SCO_LINK:
		case ESCO_LINK:
			cnt = hdev->sco_cnt;
			break;
		case LE_LINK:
			cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
			break;
		default:
			cnt = 0;
			BT_ERR("Unknown link type");
		}

		q = cnt / num;
L
Linus Torvalds 已提交
4589 4590 4591 4592 4593 4594 4595 4596
		*quote = q ? q : 1;
	} else
		*quote = 0;

	BT_DBG("conn %p quote %d", conn, *quote);
	return conn;
}

4597
static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
L
Linus Torvalds 已提交
4598 4599
{
	struct hci_conn_hash *h = &hdev->conn_hash;
4600
	struct hci_conn *c;
L
Linus Torvalds 已提交
4601

4602
	BT_ERR("%s link tx timeout", hdev->name);
L
Linus Torvalds 已提交
4603

4604 4605
	rcu_read_lock();

L
Linus Torvalds 已提交
4606
	/* Kill stalled connections */
4607
	list_for_each_entry_rcu(c, &h->list, list) {
4608
		if (c->type == type && c->sent) {
4609 4610
			BT_ERR("%s killing stalled connection %pMR",
			       hdev->name, &c->dst);
A
Andre Guedes 已提交
4611
			hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
L
Linus Torvalds 已提交
4612 4613
		}
	}
4614 4615

	rcu_read_unlock();
L
Linus Torvalds 已提交
4616 4617
}

4618 4619
static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
				      int *quote)
L
Linus Torvalds 已提交
4620
{
4621 4622
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct hci_chan *chan = NULL;
4623
	unsigned int num = 0, min = ~0, cur_prio = 0;
L
Linus Torvalds 已提交
4624
	struct hci_conn *conn;
4625 4626 4627 4628
	int cnt, q, conn_num = 0;

	BT_DBG("%s", hdev->name);

4629 4630 4631
	rcu_read_lock();

	list_for_each_entry_rcu(conn, &h->list, list) {
4632 4633 4634 4635 4636 4637 4638 4639 4640 4641
		struct hci_chan *tmp;

		if (conn->type != type)
			continue;

		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
			continue;

		conn_num++;

4642
		list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
4643 4644 4645 4646 4647 4648 4649 4650 4651 4652 4653 4654 4655 4656 4657 4658 4659 4660 4661 4662 4663 4664 4665 4666 4667 4668 4669
			struct sk_buff *skb;

			if (skb_queue_empty(&tmp->data_q))
				continue;

			skb = skb_peek(&tmp->data_q);
			if (skb->priority < cur_prio)
				continue;

			if (skb->priority > cur_prio) {
				num = 0;
				min = ~0;
				cur_prio = skb->priority;
			}

			num++;

			if (conn->sent < min) {
				min  = conn->sent;
				chan = tmp;
			}
		}

		if (hci_conn_num(hdev, type) == conn_num)
			break;
	}

4670 4671
	rcu_read_unlock();

4672 4673 4674 4675 4676 4677 4678
	if (!chan)
		return NULL;

	switch (chan->conn->type) {
	case ACL_LINK:
		cnt = hdev->acl_cnt;
		break;
4679 4680 4681
	case AMP_LINK:
		cnt = hdev->block_cnt;
		break;
4682 4683 4684 4685 4686 4687 4688 4689 4690 4691 4692 4693 4694 4695 4696 4697 4698 4699
	case SCO_LINK:
	case ESCO_LINK:
		cnt = hdev->sco_cnt;
		break;
	case LE_LINK:
		cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
		break;
	default:
		cnt = 0;
		BT_ERR("Unknown link type");
	}

	q = cnt / num;
	*quote = q ? q : 1;
	BT_DBG("chan %p quote %d", chan, *quote);
	return chan;
}

4700 4701 4702 4703 4704 4705 4706 4707
static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
{
	struct hci_conn_hash *h = &hdev->conn_hash;
	struct hci_conn *conn;
	int num = 0;

	BT_DBG("%s", hdev->name);

4708 4709 4710
	rcu_read_lock();

	list_for_each_entry_rcu(conn, &h->list, list) {
4711 4712 4713 4714 4715 4716 4717 4718 4719 4720
		struct hci_chan *chan;

		if (conn->type != type)
			continue;

		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
			continue;

		num++;

4721
		list_for_each_entry_rcu(chan, &conn->chan_list, list) {
4722 4723 4724 4725 4726 4727 4728 4729 4730 4731 4732 4733 4734 4735 4736 4737 4738
			struct sk_buff *skb;

			if (chan->sent) {
				chan->sent = 0;
				continue;
			}

			if (skb_queue_empty(&chan->data_q))
				continue;

			skb = skb_peek(&chan->data_q);
			if (skb->priority >= HCI_PRIO_MAX - 1)
				continue;

			skb->priority = HCI_PRIO_MAX - 1;

			BT_DBG("chan %p skb %p promoted to %d", chan, skb,
4739
			       skb->priority);
4740 4741 4742 4743 4744
		}

		if (hci_conn_num(hdev, type) == num)
			break;
	}
4745 4746 4747

	rcu_read_unlock();

4748 4749
}

4750 4751 4752 4753 4754 4755
static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
{
	/* Calculate count of blocks used by this packet */
	return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
}

4756
static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
4757
{
4758
	if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
L
Linus Torvalds 已提交
4759 4760
		/* ACL tx timeout must be longer than maximum
		 * link supervision timeout (40.9 seconds) */
4761
		if (!cnt && time_after(jiffies, hdev->acl_last_tx +
4762
				       HCI_ACL_TX_TIMEOUT))
4763
			hci_link_tx_to(hdev, ACL_LINK);
L
Linus Torvalds 已提交
4764
	}
4765
}
L
Linus Torvalds 已提交
4766

4767
static void hci_sched_acl_pkt(struct hci_dev *hdev)
4768 4769 4770 4771 4772 4773 4774
{
	unsigned int cnt = hdev->acl_cnt;
	struct hci_chan *chan;
	struct sk_buff *skb;
	int quote;

	__check_timeout(hdev, cnt);
4775

4776
	while (hdev->acl_cnt &&
4777
	       (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
4778 4779
		u32 priority = (skb_peek(&chan->data_q))->priority;
		while (quote-- && (skb = skb_peek(&chan->data_q))) {
4780
			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4781
			       skb->len, skb->priority);
4782

4783 4784 4785 4786 4787 4788
			/* Stop if priority has changed */
			if (skb->priority < priority)
				break;

			skb = skb_dequeue(&chan->data_q);

4789
			hci_conn_enter_active_mode(chan->conn,
4790
						   bt_cb(skb)->force_active);
4791

4792
			hci_send_frame(hdev, skb);
L
Linus Torvalds 已提交
4793 4794 4795
			hdev->acl_last_tx = jiffies;

			hdev->acl_cnt--;
4796 4797
			chan->sent++;
			chan->conn->sent++;
L
Linus Torvalds 已提交
4798 4799
		}
	}
4800 4801 4802

	if (cnt != hdev->acl_cnt)
		hci_prio_recalculate(hdev, ACL_LINK);
L
Linus Torvalds 已提交
4803 4804
}

4805
static void hci_sched_acl_blk(struct hci_dev *hdev)
4806
{
4807
	unsigned int cnt = hdev->block_cnt;
4808 4809 4810
	struct hci_chan *chan;
	struct sk_buff *skb;
	int quote;
4811
	u8 type;
4812

4813
	__check_timeout(hdev, cnt);
4814

4815 4816 4817 4818 4819 4820 4821
	BT_DBG("%s", hdev->name);

	if (hdev->dev_type == HCI_AMP)
		type = AMP_LINK;
	else
		type = ACL_LINK;

4822
	while (hdev->block_cnt > 0 &&
4823
	       (chan = hci_chan_sent(hdev, type, &quote))) {
4824 4825 4826 4827 4828
		u32 priority = (skb_peek(&chan->data_q))->priority;
		while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
			int blocks;

			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4829
			       skb->len, skb->priority);
4830 4831 4832 4833 4834 4835 4836 4837 4838 4839 4840 4841

			/* Stop if priority has changed */
			if (skb->priority < priority)
				break;

			skb = skb_dequeue(&chan->data_q);

			blocks = __get_blocks(hdev, skb);
			if (blocks > hdev->block_cnt)
				return;

			hci_conn_enter_active_mode(chan->conn,
4842
						   bt_cb(skb)->force_active);
4843

4844
			hci_send_frame(hdev, skb);
4845 4846 4847 4848 4849 4850 4851 4852 4853 4854 4855
			hdev->acl_last_tx = jiffies;

			hdev->block_cnt -= blocks;
			quote -= blocks;

			chan->sent += blocks;
			chan->conn->sent += blocks;
		}
	}

	if (cnt != hdev->block_cnt)
4856
		hci_prio_recalculate(hdev, type);
4857 4858
}

4859
static void hci_sched_acl(struct hci_dev *hdev)
4860 4861 4862
{
	BT_DBG("%s", hdev->name);

4863 4864 4865 4866 4867 4868
	/* No ACL link over BR/EDR controller */
	if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
		return;

	/* No AMP link over AMP controller */
	if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4869 4870 4871 4872 4873 4874 4875 4876 4877 4878 4879 4880 4881
		return;

	switch (hdev->flow_ctl_mode) {
	case HCI_FLOW_CTL_MODE_PACKET_BASED:
		hci_sched_acl_pkt(hdev);
		break;

	case HCI_FLOW_CTL_MODE_BLOCK_BASED:
		hci_sched_acl_blk(hdev);
		break;
	}
}

L
Linus Torvalds 已提交
4882
/* Schedule SCO */
4883
static void hci_sched_sco(struct hci_dev *hdev)
L
Linus Torvalds 已提交
4884 4885 4886 4887 4888 4889 4890
{
	struct hci_conn *conn;
	struct sk_buff *skb;
	int quote;

	BT_DBG("%s", hdev->name);

4891 4892 4893
	if (!hci_conn_num(hdev, SCO_LINK))
		return;

L
Linus Torvalds 已提交
4894 4895 4896
	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
			BT_DBG("skb %p len %d", skb, skb->len);
4897
			hci_send_frame(hdev, skb);
L
Linus Torvalds 已提交
4898 4899 4900 4901 4902 4903 4904 4905

			conn->sent++;
			if (conn->sent == ~0)
				conn->sent = 0;
		}
	}
}

4906
static void hci_sched_esco(struct hci_dev *hdev)
4907 4908 4909 4910 4911 4912 4913
{
	struct hci_conn *conn;
	struct sk_buff *skb;
	int quote;

	BT_DBG("%s", hdev->name);

4914 4915 4916
	if (!hci_conn_num(hdev, ESCO_LINK))
		return;

4917 4918
	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
						     &quote))) {
4919 4920
		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
			BT_DBG("skb %p len %d", skb, skb->len);
4921
			hci_send_frame(hdev, skb);
4922 4923 4924 4925 4926 4927 4928 4929

			conn->sent++;
			if (conn->sent == ~0)
				conn->sent = 0;
		}
	}
}

4930
static void hci_sched_le(struct hci_dev *hdev)
4931
{
4932
	struct hci_chan *chan;
4933
	struct sk_buff *skb;
4934
	int quote, cnt, tmp;
4935 4936 4937

	BT_DBG("%s", hdev->name);

4938 4939 4940
	if (!hci_conn_num(hdev, LE_LINK))
		return;

4941
	if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
4942 4943
		/* LE tx timeout must be longer than maximum
		 * link supervision timeout (40.9 seconds) */
4944
		if (!hdev->le_cnt && hdev->le_pkts &&
4945
		    time_after(jiffies, hdev->le_last_tx + HZ * 45))
4946
			hci_link_tx_to(hdev, LE_LINK);
4947 4948 4949
	}

	cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
4950
	tmp = cnt;
4951
	while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
4952 4953
		u32 priority = (skb_peek(&chan->data_q))->priority;
		while (quote-- && (skb = skb_peek(&chan->data_q))) {
4954
			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4955
			       skb->len, skb->priority);
4956

4957 4958 4959 4960 4961 4962
			/* Stop if priority has changed */
			if (skb->priority < priority)
				break;

			skb = skb_dequeue(&chan->data_q);

4963
			hci_send_frame(hdev, skb);
4964 4965 4966
			hdev->le_last_tx = jiffies;

			cnt--;
4967 4968
			chan->sent++;
			chan->conn->sent++;
4969 4970
		}
	}
4971

4972 4973 4974 4975
	if (hdev->le_pkts)
		hdev->le_cnt = cnt;
	else
		hdev->acl_cnt = cnt;
4976 4977 4978

	if (cnt != tmp)
		hci_prio_recalculate(hdev, LE_LINK);
4979 4980
}

4981
static void hci_tx_work(struct work_struct *work)
L
Linus Torvalds 已提交
4982
{
4983
	struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
L
Linus Torvalds 已提交
4984 4985
	struct sk_buff *skb;

4986
	BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
4987
	       hdev->sco_cnt, hdev->le_cnt);
L
Linus Torvalds 已提交
4988

4989 4990 4991 4992 4993 4994 4995
	if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
		/* Schedule queues and send stuff to HCI driver */
		hci_sched_acl(hdev);
		hci_sched_sco(hdev);
		hci_sched_esco(hdev);
		hci_sched_le(hdev);
	}
4996

L
Linus Torvalds 已提交
4997 4998
	/* Send next queued raw (unknown type) packet */
	while ((skb = skb_dequeue(&hdev->raw_q)))
4999
		hci_send_frame(hdev, skb);
L
Linus Torvalds 已提交
5000 5001
}

L
Lucas De Marchi 已提交
5002
/* ----- HCI RX task (incoming data processing) ----- */
L
Linus Torvalds 已提交
5003 5004

/* ACL data packet */
5005
static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
5006 5007 5008 5009 5010 5011 5012 5013 5014 5015 5016
{
	struct hci_acl_hdr *hdr = (void *) skb->data;
	struct hci_conn *conn;
	__u16 handle, flags;

	skb_pull(skb, HCI_ACL_HDR_SIZE);

	handle = __le16_to_cpu(hdr->handle);
	flags  = hci_flags(handle);
	handle = hci_handle(handle);

5017
	BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
5018
	       handle, flags);
L
Linus Torvalds 已提交
5019 5020 5021 5022 5023 5024

	hdev->stat.acl_rx++;

	hci_dev_lock(hdev);
	conn = hci_conn_hash_lookup_handle(hdev, handle);
	hci_dev_unlock(hdev);
5025

L
Linus Torvalds 已提交
5026
	if (conn) {
5027
		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
5028

L
Linus Torvalds 已提交
5029
		/* Send to upper protocol */
5030 5031
		l2cap_recv_acldata(conn, skb, flags);
		return;
L
Linus Torvalds 已提交
5032
	} else {
5033
		BT_ERR("%s ACL packet for unknown connection handle %d",
5034
		       hdev->name, handle);
L
Linus Torvalds 已提交
5035 5036 5037 5038 5039 5040
	}

	kfree_skb(skb);
}

/* SCO data packet */
5041
static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
L
Linus Torvalds 已提交
5042 5043 5044 5045 5046 5047 5048 5049 5050
{
	struct hci_sco_hdr *hdr = (void *) skb->data;
	struct hci_conn *conn;
	__u16 handle;

	skb_pull(skb, HCI_SCO_HDR_SIZE);

	handle = __le16_to_cpu(hdr->handle);

5051
	BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
L
Linus Torvalds 已提交
5052 5053 5054 5055 5056 5057 5058 5059 5060

	hdev->stat.sco_rx++;

	hci_dev_lock(hdev);
	conn = hci_conn_hash_lookup_handle(hdev, handle);
	hci_dev_unlock(hdev);

	if (conn) {
		/* Send to upper protocol */
5061 5062
		sco_recv_scodata(conn, skb);
		return;
L
Linus Torvalds 已提交
5063
	} else {
5064
		BT_ERR("%s SCO packet for unknown connection handle %d",
5065
		       hdev->name, handle);
L
Linus Torvalds 已提交
5066 5067 5068 5069 5070
	}

	kfree_skb(skb);
}

5071 5072 5073 5074 5075 5076 5077 5078 5079 5080 5081
static bool hci_req_is_complete(struct hci_dev *hdev)
{
	struct sk_buff *skb;

	skb = skb_peek(&hdev->cmd_q);
	if (!skb)
		return true;

	return bt_cb(skb)->req.start;
}

5082 5083 5084 5085 5086 5087 5088 5089 5090 5091 5092 5093 5094 5095 5096 5097 5098 5099 5100 5101 5102 5103
static void hci_resend_last(struct hci_dev *hdev)
{
	struct hci_command_hdr *sent;
	struct sk_buff *skb;
	u16 opcode;

	if (!hdev->sent_cmd)
		return;

	sent = (void *) hdev->sent_cmd->data;
	opcode = __le16_to_cpu(sent->opcode);
	if (opcode == HCI_OP_RESET)
		return;

	skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
	if (!skb)
		return;

	skb_queue_head(&hdev->cmd_q, skb);
	queue_work(hdev->workqueue, &hdev->cmd_work);
}

5104 5105 5106 5107 5108 5109 5110 5111
void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
{
	hci_req_complete_t req_complete = NULL;
	struct sk_buff *skb;
	unsigned long flags;

	BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);

5112 5113
	/* If the completed command doesn't match the last one that was
	 * sent we need to do special handling of it.
5114
	 */
5115 5116 5117 5118 5119 5120 5121 5122 5123 5124
	if (!hci_sent_cmd_data(hdev, opcode)) {
		/* Some CSR based controllers generate a spontaneous
		 * reset complete event during init and any pending
		 * command will never be completed. In such a case we
		 * need to resend whatever was the last sent
		 * command.
		 */
		if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
			hci_resend_last(hdev);

5125
		return;
5126
	}
5127 5128 5129 5130 5131 5132 5133 5134 5135 5136 5137 5138 5139

	/* If the command succeeded and there's still more commands in
	 * this request the request is not yet complete.
	 */
	if (!status && !hci_req_is_complete(hdev))
		return;

	/* If this was the last command in a request the complete
	 * callback would be found in hdev->sent_cmd instead of the
	 * command queue (hdev->cmd_q).
	 */
	if (hdev->sent_cmd) {
		req_complete = bt_cb(hdev->sent_cmd)->req.complete;
5140 5141 5142 5143 5144 5145 5146 5147

		if (req_complete) {
			/* We must set the complete callback to NULL to
			 * avoid calling the callback more than once if
			 * this function gets called again.
			 */
			bt_cb(hdev->sent_cmd)->req.complete = NULL;

5148
			goto call_complete;
5149
		}
5150 5151 5152 5153 5154 5155 5156 5157 5158 5159 5160 5161 5162 5163 5164 5165 5166 5167 5168 5169
	}

	/* Remove all pending commands belonging to this request */
	spin_lock_irqsave(&hdev->cmd_q.lock, flags);
	while ((skb = __skb_dequeue(&hdev->cmd_q))) {
		if (bt_cb(skb)->req.start) {
			__skb_queue_head(&hdev->cmd_q, skb);
			break;
		}

		req_complete = bt_cb(skb)->req.complete;
		kfree_skb(skb);
	}
	spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);

call_complete:
	if (req_complete)
		req_complete(hdev, status);
}

5170
static void hci_rx_work(struct work_struct *work)
L
Linus Torvalds 已提交
5171
{
5172
	struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
L
Linus Torvalds 已提交
5173 5174 5175 5176 5177
	struct sk_buff *skb;

	BT_DBG("%s", hdev->name);

	while ((skb = skb_dequeue(&hdev->rx_q))) {
5178 5179 5180
		/* Send copy to monitor */
		hci_send_to_monitor(hdev, skb);

L
Linus Torvalds 已提交
5181 5182
		if (atomic_read(&hdev->promisc)) {
			/* Send copy to the sockets */
5183
			hci_send_to_sock(hdev, skb);
L
Linus Torvalds 已提交
5184 5185
		}

5186
		if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
L
Linus Torvalds 已提交
5187 5188 5189 5190 5191 5192
			kfree_skb(skb);
			continue;
		}

		if (test_bit(HCI_INIT, &hdev->flags)) {
			/* Don't process data packets in this states. */
5193
			switch (bt_cb(skb)->pkt_type) {
L
Linus Torvalds 已提交
5194 5195 5196 5197
			case HCI_ACLDATA_PKT:
			case HCI_SCODATA_PKT:
				kfree_skb(skb);
				continue;
5198
			}
L
Linus Torvalds 已提交
5199 5200 5201
		}

		/* Process frame */
5202
		switch (bt_cb(skb)->pkt_type) {
L
Linus Torvalds 已提交
5203
		case HCI_EVENT_PKT:
5204
			BT_DBG("%s Event packet", hdev->name);
L
Linus Torvalds 已提交
5205 5206 5207 5208 5209 5210 5211 5212 5213 5214 5215 5216 5217 5218 5219 5220 5221 5222 5223 5224
			hci_event_packet(hdev, skb);
			break;

		case HCI_ACLDATA_PKT:
			BT_DBG("%s ACL data packet", hdev->name);
			hci_acldata_packet(hdev, skb);
			break;

		case HCI_SCODATA_PKT:
			BT_DBG("%s SCO data packet", hdev->name);
			hci_scodata_packet(hdev, skb);
			break;

		default:
			kfree_skb(skb);
			break;
		}
	}
}

5225
static void hci_cmd_work(struct work_struct *work)
L
Linus Torvalds 已提交
5226
{
5227
	struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
L
Linus Torvalds 已提交
5228 5229
	struct sk_buff *skb;

5230 5231
	BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
	       atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
L
Linus Torvalds 已提交
5232 5233

	/* Send queued commands */
5234 5235 5236 5237 5238
	if (atomic_read(&hdev->cmd_cnt)) {
		skb = skb_dequeue(&hdev->cmd_q);
		if (!skb)
			return;

5239
		kfree_skb(hdev->sent_cmd);
L
Linus Torvalds 已提交
5240

5241
		hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
A
Andrei Emeltchenko 已提交
5242
		if (hdev->sent_cmd) {
L
Linus Torvalds 已提交
5243
			atomic_dec(&hdev->cmd_cnt);
5244
			hci_send_frame(hdev, skb);
5245
			if (test_bit(HCI_RESET, &hdev->flags))
5246
				cancel_delayed_work(&hdev->cmd_timer);
5247
			else
5248 5249
				schedule_delayed_work(&hdev->cmd_timer,
						      HCI_CMD_TIMEOUT);
L
Linus Torvalds 已提交
5250 5251
		} else {
			skb_queue_head(&hdev->cmd_q, skb);
5252
			queue_work(hdev->workqueue, &hdev->cmd_work);
L
Linus Torvalds 已提交
5253 5254 5255
		}
	}
}