net/bluetooth/hci_core.c

   1 /*
   2    BlueZ - Bluetooth protocol stack for Linux
   3    Copyright (C) 2000-2001 Qualcomm Incorporated
   4    Copyright (C) 2011 ProFUSION Embedded Systems
   5
   6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8    This program is free software; you can redistribute it and/or modify
   9    it under the terms of the GNU General Public License version 2 as
  10    published by the Free Software Foundation;
  11
  12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23    SOFTWARE IS DISCLAIMED.
  24 */
  25
  26 /* Bluetooth HCI core. */
  27
  28 #include <linux/export.h>
  29 #include <linux/idr.h>
  30 #include <linux/rfkill.h>
  31 #include <linux/debugfs.h>
  32 #include <linux/crypto.h>
  33 #include <linux/property.h>
  34 #include <asm/unaligned.h>
  35
  36 #include <net/bluetooth/bluetooth.h>
  37 #include <net/bluetooth/hci_core.h>
  38 #include <net/bluetooth/l2cap.h>
  39 #include <net/bluetooth/mgmt.h>
  40
  41 #include "hci_request.h"
  42 #include "hci_debugfs.h"
  43 #include "smp.h"
  44 #include "leds.h"
  45
  46 static void hci_rx_work(struct work_struct *work);
  47 static void hci_cmd_work(struct work_struct *work);
  48 static void hci_tx_work(struct work_struct *work);
  49
  50 /* HCI device list */
  51 LIST_HEAD(hci_dev_list);
  52 DEFINE_RWLOCK(hci_dev_list_lock);
  53
  54 /* HCI callback list */
  55 LIST_HEAD(hci_cb_list);
  56 DEFINE_MUTEX(hci_cb_list_lock);
  57
  58 /* HCI ID Numbering */
  59 static DEFINE_IDA(hci_index_ida);
  60
  61 /* ---- HCI debugfs entries ---- */
  62
  63 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
  64                              size_t count, loff_t *ppos)
  65 {
  66         struct hci_dev *hdev = file->private_data;
  67         char buf[3];
  68
  69         buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
  70         buf[1] = '\n';
  71         buf[2] = '\0';
  72         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
  73 }
  74
  75 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
  76                               size_t count, loff_t *ppos)
  77 {
  78         struct hci_dev *hdev = file->private_data;
  79         struct sk_buff *skb;
  80         bool enable;
  81         int err;
  82
  83         if (!test_bit(HCI_UP, &hdev->flags))
  84                 return -ENETDOWN;
  85
  86         err = kstrtobool_from_user(user_buf, count, &enable);
  87         if (err)
  88                 return err;
  89
  90         if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
  91                 return -EALREADY;
  92
  93         hci_req_sync_lock(hdev);
  94         if (enable)
  95                 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
  96                                      HCI_CMD_TIMEOUT);
  97         else
  98                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
  99                                      HCI_CMD_TIMEOUT);
 100         hci_req_sync_unlock(hdev);
 101
 102         if (IS_ERR(skb))
 103                 return PTR_ERR(skb);
 104
 105         kfree_skb(skb);
 106
 107         hci_dev_change_flag(hdev, HCI_DUT_MODE);
 108
 109         return count;
 110 }
 111
 112 static const struct file_operations dut_mode_fops = {
 113         .open           = simple_open,
 114         .read           = dut_mode_read,
 115         .write          = dut_mode_write,
 116         .llseek         = default_llseek,
 117 };
 118
 119 static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
 120                                 size_t count, loff_t *ppos)
 121 {
 122         struct hci_dev *hdev = file->private_data;
 123         char buf[3];
 124
 125         buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
 126         buf[1] = '\n';
 127         buf[2] = '\0';
 128         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 129 }
 130
 131 static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
 132                                  size_t count, loff_t *ppos)
 133 {
 134         struct hci_dev *hdev = file->private_data;
 135         bool enable;
 136         int err;
 137
 138         err = kstrtobool_from_user(user_buf, count, &enable);
 139         if (err)
 140                 return err;
 141
 142         /* When the diagnostic flags are not persistent and the transport
 143          * is not active or in user channel operation, then there is no need
 144          * for the vendor callback. Instead just store the desired value and
 145          * the setting will be programmed when the controller gets powered on.
 146          */
 147         if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
 148             (!test_bit(HCI_RUNNING, &hdev->flags) ||
 149              hci_dev_test_flag(hdev, HCI_USER_CHANNEL)))
 150                 goto done;
 151
 152         hci_req_sync_lock(hdev);
 153         err = hdev->set_diag(hdev, enable);
 154         hci_req_sync_unlock(hdev);
 155
 156         if (err < 0)
 157                 return err;
 158
 159 done:
 160         if (enable)
 161                 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
 162         else
 163                 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
 164
 165         return count;
 166 }
 167
 168 static const struct file_operations vendor_diag_fops = {
 169         .open           = simple_open,
 170         .read           = vendor_diag_read,
 171         .write          = vendor_diag_write,
 172         .llseek         = default_llseek,
 173 };
 174
 175 static void hci_debugfs_create_basic(struct hci_dev *hdev)
 176 {
 177         debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
 178                             &dut_mode_fops);
 179
 180         if (hdev->set_diag)
 181                 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
 182                                     &vendor_diag_fops);
 183 }
 184
 185 static int hci_reset_req(struct hci_request *req, unsigned long opt)
 186 {
 187         BT_DBG("%s %ld", req->hdev->name, opt);
 188
 189         /* Reset device */
 190         set_bit(HCI_RESET, &req->hdev->flags);
 191         hci_req_add(req, HCI_OP_RESET, 0, NULL);
 192         return 0;
 193 }
 194
 195 static void bredr_init(struct hci_request *req)
 196 {
 197         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
 198
 199         /* Read Local Supported Features */
 200         hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 201
 202         /* Read Local Version */
 203         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 204
 205         /* Read BD Address */
 206         hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
 207 }
 208
 209 static void amp_init1(struct hci_request *req)
 210 {
 211         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
 212
 213         /* Read Local Version */
 214         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 215
 216         /* Read Local Supported Commands */
 217         hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 218
 219         /* Read Local AMP Info */
 220         hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 221
 222         /* Read Data Blk size */
 223         hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
 224
 225         /* Read Flow Control Mode */
 226         hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
 227
 228         /* Read Location Data */
 229         hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
 230 }
 231
 232 static int amp_init2(struct hci_request *req)
 233 {
 234         /* Read Local Supported Features. Not all AMP controllers
 235          * support this so it's placed conditionally in the second
 236          * stage init.
 237          */
 238         if (req->hdev->commands[14] & 0x20)
 239                 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 240
 241         return 0;
 242 }
 243
 244 static int hci_init1_req(struct hci_request *req, unsigned long opt)
 245 {
 246         struct hci_dev *hdev = req->hdev;
 247
 248         BT_DBG("%s %ld", hdev->name, opt);
 249
 250         /* Reset */
 251         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
 252                 hci_reset_req(req, 0);
 253
 254         switch (hdev->dev_type) {
 255         case HCI_PRIMARY:
 256                 bredr_init(req);
 257                 break;
 258         case HCI_AMP:
 259                 amp_init1(req);
 260                 break;
 261         default:
 262                 bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
 263                 break;
 264         }
 265
 266         return 0;
 267 }
 268
 269 static void bredr_setup(struct hci_request *req)
 270 {
 271         __le16 param;
 272         __u8 flt_type;
 273
 274         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 275         hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 276
 277         /* Read Class of Device */
 278         hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 279
 280         /* Read Local Name */
 281         hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 282
 283         /* Read Voice Setting */
 284         hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 285
 286         /* Read Number of Supported IAC */
 287         hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
 288
 289         /* Read Current IAC LAP */
 290         hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
 291
 292         /* Clear Event Filters */
 293         flt_type = HCI_FLT_CLEAR_ALL;
 294         hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 295
 296         /* Connection accept timeout ~20 secs */
 297         param = cpu_to_le16(0x7d00);
 298         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 299 }
 300
 301 static void le_setup(struct hci_request *req)
 302 {
 303         struct hci_dev *hdev = req->hdev;
 304
 305         /* Read LE Buffer Size */
 306         hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 307
 308         /* Read LE Local Supported Features */
 309         hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
 310
 311         /* Read LE Supported States */
 312         hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
 313
 314         /* LE-only controllers have LE implicitly enabled */
 315         if (!lmp_bredr_capable(hdev))
 316                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
 317 }
 318
 319 static void hci_setup_event_mask(struct hci_request *req)
 320 {
 321         struct hci_dev *hdev = req->hdev;
 322
 323         /* The second byte is 0xff instead of 0x9f (two reserved bits
 324          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 325          * command otherwise.
 326          */
 327         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 328
 329         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 330          * any event mask for pre 1.2 devices.
 331          */
 332         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 333                 return;
 334
 335         if (lmp_bredr_capable(hdev)) {
 336                 events[4] |= 0x01; /* Flow Specification Complete */
 337         } else {
 338                 /* Use a different default for LE-only devices */
 339                 memset(events, 0, sizeof(events));
 340                 events[1] |= 0x20; /* Command Complete */
 341                 events[1] |= 0x40; /* Command Status */
 342                 events[1] |= 0x80; /* Hardware Error */
 343
 344                 /* If the controller supports the Disconnect command, enable
 345                  * the corresponding event. In addition enable packet flow
 346                  * control related events.
 347                  */
 348                 if (hdev->commands[0] & 0x20) {
 349                         events[0] |= 0x10; /* Disconnection Complete */
 350                         events[2] |= 0x04; /* Number of Completed Packets */
 351                         events[3] |= 0x02; /* Data Buffer Overflow */
 352                 }
 353
 354                 /* If the controller supports the Read Remote Version
 355                  * Information command, enable the corresponding event.
 356                  */
 357                 if (hdev->commands[2] & 0x80)
 358                         events[1] |= 0x08; /* Read Remote Version Information
 359                                             * Complete
 360                                             */
 361
 362                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
 363                         events[0] |= 0x80; /* Encryption Change */
 364                         events[5] |= 0x80; /* Encryption Key Refresh Complete */
 365                 }
 366         }
 367
 368         if (lmp_inq_rssi_capable(hdev) ||
 369             test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
 370                 events[4] |= 0x02; /* Inquiry Result with RSSI */
 371
 372         if (lmp_ext_feat_capable(hdev))
 373                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
 374
 375         if (lmp_esco_capable(hdev)) {
 376                 events[5] |= 0x08; /* Synchronous Connection Complete */
 377                 events[5] |= 0x10; /* Synchronous Connection Changed */
 378         }
 379
 380         if (lmp_sniffsubr_capable(hdev))
 381                 events[5] |= 0x20; /* Sniff Subrating */
 382
 383         if (lmp_pause_enc_capable(hdev))
 384                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
 385
 386         if (lmp_ext_inq_capable(hdev))
 387                 events[5] |= 0x40; /* Extended Inquiry Result */
 388
 389         if (lmp_no_flush_capable(hdev))
 390                 events[7] |= 0x01; /* Enhanced Flush Complete */
 391
 392         if (lmp_lsto_capable(hdev))
 393                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
 394
 395         if (lmp_ssp_capable(hdev)) {
 396                 events[6] |= 0x01;      /* IO Capability Request */
 397                 events[6] |= 0x02;      /* IO Capability Response */
 398                 events[6] |= 0x04;      /* User Confirmation Request */
 399                 events[6] |= 0x08;      /* User Passkey Request */
 400                 events[6] |= 0x10;      /* Remote OOB Data Request */
 401                 events[6] |= 0x20;      /* Simple Pairing Complete */
 402                 events[7] |= 0x04;      /* User Passkey Notification */
 403                 events[7] |= 0x08;      /* Keypress Notification */
 404                 events[7] |= 0x10;      /* Remote Host Supported
 405                                          * Features Notification
 406                                          */
 407         }
 408
 409         if (lmp_le_capable(hdev))
 410                 events[7] |= 0x20;      /* LE Meta-Event */
 411
 412         hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 413 }
 414
 415 static int hci_init2_req(struct hci_request *req, unsigned long opt)
 416 {
 417         struct hci_dev *hdev = req->hdev;
 418
 419         if (hdev->dev_type == HCI_AMP)
 420                 return amp_init2(req);
 421
 422         if (lmp_bredr_capable(hdev))
 423                 bredr_setup(req);
 424         else
 425                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
 426
 427         if (lmp_le_capable(hdev))
 428                 le_setup(req);
 429
 430         /* All Bluetooth 1.2 and later controllers should support the
 431          * HCI command for reading the local supported commands.
 432          *
 433          * Unfortunately some controllers indicate Bluetooth 1.2 support,
 434          * but do not have support for this command. If that is the case,
 435          * the driver can quirk the behavior and skip reading the local
 436          * supported commands.
 437          */
 438         if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
 439             !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
 440                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 441
 442         if (lmp_ssp_capable(hdev)) {
 443                 /* When SSP is available, then the host features page
 444                  * should also be available as well. However some
 445                  * controllers list the max_page as 0 as long as SSP
 446                  * has not been enabled. To achieve proper debugging
 447                  * output, force the minimum max_page to 1 at least.
 448                  */
 449                 hdev->max_page = 0x01;
 450
 451                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
 452                         u8 mode = 0x01;
 453
 454                         hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
 455                                     sizeof(mode), &mode);
 456                 } else {
 457                         struct hci_cp_write_eir cp;
 458
 459                         memset(hdev->eir, 0, sizeof(hdev->eir));
 460                         memset(&cp, 0, sizeof(cp));
 461
 462                         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 463                 }
 464         }
 465
 466         if (lmp_inq_rssi_capable(hdev) ||
 467             test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
 468                 u8 mode;
 469
 470                 /* If Extended Inquiry Result events are supported, then
 471                  * they are clearly preferred over Inquiry Result with RSSI
 472                  * events.
 473                  */
 474                 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
 475
 476                 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 477         }
 478
 479         if (lmp_inq_tx_pwr_capable(hdev))
 480                 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 481
 482         if (lmp_ext_feat_capable(hdev)) {
 483                 struct hci_cp_read_local_ext_features cp;
 484
 485                 cp.page = 0x01;
 486                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
 487                             sizeof(cp), &cp);
 488         }
 489
 490         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
 491                 u8 enable = 1;
 492                 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
 493                             &enable);
 494         }
 495
 496         return 0;
 497 }
 498
 499 static void hci_setup_link_policy(struct hci_request *req)
 500 {
 501         struct hci_dev *hdev = req->hdev;
 502         struct hci_cp_write_def_link_policy cp;
 503         u16 link_policy = 0;
 504
 505         if (lmp_rswitch_capable(hdev))
 506                 link_policy |= HCI_LP_RSWITCH;
 507         if (lmp_hold_capable(hdev))
 508                 link_policy |= HCI_LP_HOLD;
 509         if (lmp_sniff_capable(hdev))
 510                 link_policy |= HCI_LP_SNIFF;
 511         if (lmp_park_capable(hdev))
 512                 link_policy |= HCI_LP_PARK;
 513
 514         cp.policy = cpu_to_le16(link_policy);
 515         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 516 }
 517
 518 static void hci_set_le_support(struct hci_request *req)
 519 {
 520         struct hci_dev *hdev = req->hdev;
 521         struct hci_cp_write_le_host_supported cp;
 522
 523         /* LE-only devices do not support explicit enablement */
 524         if (!lmp_bredr_capable(hdev))
 525                 return;
 526
 527         memset(&cp, 0, sizeof(cp));
 528
 529         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
 530                 cp.le = 0x01;
 531                 cp.simul = 0x00;
 532         }
 533
 534         if (cp.le != lmp_host_le_capable(hdev))
 535                 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
 536                             &cp);
 537 }
 538
 539 static void hci_set_event_mask_page_2(struct hci_request *req)
 540 {
 541         struct hci_dev *hdev = req->hdev;
 542         u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 543         bool changed = false;
 544
 545         /* If Connectionless Slave Broadcast master role is supported
 546          * enable all necessary events for it.
 547          */
 548         if (lmp_csb_master_capable(hdev)) {
 549                 events[1] |= 0x40;      /* Triggered Clock Capture */
 550                 events[1] |= 0x80;      /* Synchronization Train Complete */
 551                 events[2] |= 0x10;      /* Slave Page Response Timeout */
 552                 events[2] |= 0x20;      /* CSB Channel Map Change */
 553                 changed = true;
 554         }
 555
 556         /* If Connectionless Slave Broadcast slave role is supported
 557          * enable all necessary events for it.
 558          */
 559         if (lmp_csb_slave_capable(hdev)) {
 560                 events[2] |= 0x01;      /* Synchronization Train Received */
 561                 events[2] |= 0x02;      /* CSB Receive */
 562                 events[2] |= 0x04;      /* CSB Timeout */
 563                 events[2] |= 0x08;      /* Truncated Page Complete */
 564                 changed = true;
 565         }
 566
 567         /* Enable Authenticated Payload Timeout Expired event if supported */
 568         if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
 569                 events[2] |= 0x80;
 570                 changed = true;
 571         }
 572
 573         /* Some Broadcom based controllers indicate support for Set Event
 574          * Mask Page 2 command, but then actually do not support it. Since
 575          * the default value is all bits set to zero, the command is only
 576          * required if the event mask has to be changed. In case no change
 577          * to the event mask is needed, skip this command.
 578          */
 579         if (changed)
 580                 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
 581                             sizeof(events), events);
 582 }
 583
 584 static int hci_init3_req(struct hci_request *req, unsigned long opt)
 585 {
 586         struct hci_dev *hdev = req->hdev;
 587         u8 p;
 588
 589         hci_setup_event_mask(req);
 590
 591         if (hdev->commands[6] & 0x20 &&
 592             !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
 593                 struct hci_cp_read_stored_link_key cp;
 594
 595                 bacpy(&cp.bdaddr, BDADDR_ANY);
 596                 cp.read_all = 0x01;
 597                 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
 598         }
 599
 600         if (hdev->commands[5] & 0x10)
 601                 hci_setup_link_policy(req);
 602
 603         if (hdev->commands[8] & 0x01)
 604                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
 605
 606         /* Some older Broadcom based Bluetooth 1.2 controllers do not
 607          * support the Read Page Scan Type command. Check support for
 608          * this command in the bit mask of supported commands.
 609          */
 610         if (hdev->commands[13] & 0x01)
 611                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
 612
 613         if (lmp_le_capable(hdev)) {
 614                 u8 events[8];
 615
 616                 memset(events, 0, sizeof(events));
 617
 618                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
 619                         events[0] |= 0x10;      /* LE Long Term Key Request */
 620
 621                 /* If controller supports the Connection Parameters Request
 622                  * Link Layer Procedure, enable the corresponding event.
 623                  */
 624                 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
 625                         events[0] |= 0x20;      /* LE Remote Connection
 626                                                  * Parameter Request
 627                                                  */
 628
 629                 /* If the controller supports the Data Length Extension
 630                  * feature, enable the corresponding event.
 631                  */
 632                 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
 633                         events[0] |= 0x40;      /* LE Data Length Change */
 634
 635                 /* If the controller supports Extended Scanner Filter
 636                  * Policies, enable the correspondig event.
 637                  */
 638                 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
 639                         events[1] |= 0x04;      /* LE Direct Advertising
 640                                                  * Report
 641                                                  */
 642
 643                 /* If the controller supports Channel Selection Algorithm #2
 644                  * feature, enable the corresponding event.
 645                  */
 646                 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
 647                         events[2] |= 0x08;      /* LE Channel Selection
 648                                                  * Algorithm
 649                                                  */
 650
 651                 /* If the controller supports the LE Set Scan Enable command,
 652                  * enable the corresponding advertising report event.
 653                  */
 654                 if (hdev->commands[26] & 0x08)
 655                         events[0] |= 0x02;      /* LE Advertising Report */
 656
 657                 /* If the controller supports the LE Create Connection
 658                  * command, enable the corresponding event.
 659                  */
 660                 if (hdev->commands[26] & 0x10)
 661                         events[0] |= 0x01;      /* LE Connection Complete */
 662
 663                 /* If the controller supports the LE Connection Update
 664                  * command, enable the corresponding event.
 665                  */
 666                 if (hdev->commands[27] & 0x04)
 667                         events[0] |= 0x04;      /* LE Connection Update
 668                                                  * Complete
 669                                                  */
 670
 671                 /* If the controller supports the LE Read Remote Used Features
 672                  * command, enable the corresponding event.
 673                  */
 674                 if (hdev->commands[27] & 0x20)
 675                         events[0] |= 0x08;      /* LE Read Remote Used
 676                                                  * Features Complete
 677                                                  */
 678
 679                 /* If the controller supports the LE Read Local P-256
 680                  * Public Key command, enable the corresponding event.
 681                  */
 682                 if (hdev->commands[34] & 0x02)
 683                         events[0] |= 0x80;      /* LE Read Local P-256
 684                                                  * Public Key Complete
 685                                                  */
 686
 687                 /* If the controller supports the LE Generate DHKey
 688                  * command, enable the corresponding event.
 689                  */
 690                 if (hdev->commands[34] & 0x04)
 691                         events[1] |= 0x01;      /* LE Generate DHKey Complete */
 692
 693                 /* If the controller supports the LE Set Default PHY or
 694                  * LE Set PHY commands, enable the corresponding event.
 695                  */
 696                 if (hdev->commands[35] & (0x20 | 0x40))
 697                         events[1] |= 0x08;        /* LE PHY Update Complete */
 698
 699                 /* If the controller supports LE Set Extended Scan Parameters
 700                  * and LE Set Extended Scan Enable commands, enable the
 701                  * corresponding event.
 702                  */
 703                 if (use_ext_scan(hdev))
 704                         events[1] |= 0x10;      /* LE Extended Advertising
 705                                                  * Report
 706                                                  */
 707
 708                 /* If the controller supports the LE Extended Create Connection
 709                  * command, enable the corresponding event.
 710                  */
 711                 if (use_ext_conn(hdev))
 712                         events[1] |= 0x02;      /* LE Enhanced Connection
 713                                                  * Complete
 714                                                  */
 715
 716                 /* If the controller supports the LE Extended Advertising
 717                  * command, enable the corresponding event.
 718                  */
 719                 if (ext_adv_capable(hdev))
 720                         events[2] |= 0x02;      /* LE Advertising Set
 721                                                  * Terminated
 722                                                  */
 723
 724                 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
 725                             events);
 726
 727                 /* Read LE Advertising Channel TX Power */
 728                 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
 729                         /* HCI TS spec forbids mixing of legacy and extended
 730                          * advertising commands wherein READ_ADV_TX_POWER is
 731                          * also included. So do not call it if extended adv
 732                          * is supported otherwise controller will return
 733                          * COMMAND_DISALLOWED for extended commands.
 734                          */
 735                         hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
 736                 }
 737
 738                 if (hdev->commands[26] & 0x40) {
 739                         /* Read LE White List Size */
 740                         hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE,
 741                                     0, NULL);
 742                 }
 743
 744                 if (hdev->commands[26] & 0x80) {
 745                         /* Clear LE White List */
 746                         hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
 747                 }
 748
 749                 if (hdev->commands[34] & 0x40) {
 750                         /* Read LE Resolving List Size */
 751                         hci_req_add(req, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
 752                                     0, NULL);
 753                 }
 754
 755                 if (hdev->commands[34] & 0x20) {
 756                         /* Clear LE Resolving List */
 757                         hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL);
 758                 }
 759
 760                 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
 761                         /* Read LE Maximum Data Length */
 762                         hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
 763
 764                         /* Read LE Suggested Default Data Length */
 765                         hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
 766                 }
 767
 768                 if (ext_adv_capable(hdev)) {
 769                         /* Read LE Number of Supported Advertising Sets */
 770                         hci_req_add(req, HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
 771                                     0, NULL);
 772                 }
 773
 774                 hci_set_le_support(req);
 775         }
 776
 777         /* Read features beyond page 1 if available */
 778         for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
 779                 struct hci_cp_read_local_ext_features cp;
 780
 781                 cp.page = p;
 782                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
 783                             sizeof(cp), &cp);
 784         }
 785
 786         return 0;
 787 }
 788
 789 static int hci_init4_req(struct hci_request *req, unsigned long opt)
 790 {
 791         struct hci_dev *hdev = req->hdev;
 792
 793         /* Some Broadcom based Bluetooth controllers do not support the
 794          * Delete Stored Link Key command. They are clearly indicating its
 795          * absence in the bit mask of supported commands.
 796          *
 797          * Check the supported commands and only if the the command is marked
 798          * as supported send it. If not supported assume that the controller
 799          * does not have actual support for stored link keys which makes this
 800          * command redundant anyway.
 801          *
 802          * Some controllers indicate that they support handling deleting
 803          * stored link keys, but they don't. The quirk lets a driver
 804          * just disable this command.
 805          */
 806         if (hdev->commands[6] & 0x80 &&
 807             !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
 808                 struct hci_cp_delete_stored_link_key cp;
 809
 810                 bacpy(&cp.bdaddr, BDADDR_ANY);
 811                 cp.delete_all = 0x01;
 812                 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
 813                             sizeof(cp), &cp);
 814         }
 815
 816         /* Set event mask page 2 if the HCI command for it is supported */
 817         if (hdev->commands[22] & 0x04)
 818                 hci_set_event_mask_page_2(req);
 819
 820         /* Read local codec list if the HCI command is supported */
 821         if (hdev->commands[29] & 0x20)
 822                 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
 823
 824         /* Get MWS transport configuration if the HCI command is supported */
 825         if (hdev->commands[30] & 0x08)
 826                 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
 827
 828         /* Check for Synchronization Train support */
 829         if (lmp_sync_train_capable(hdev))
 830                 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
 831
 832         /* Enable Secure Connections if supported and configured */
 833         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
 834             bredr_sc_enabled(hdev)) {
 835                 u8 support = 0x01;
 836
 837                 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
 838                             sizeof(support), &support);
 839         }
 840
 841         /* Set Suggested Default Data Length to maximum if supported */
 842         if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
 843                 struct hci_cp_le_write_def_data_len cp;
 844
 845                 cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
 846                 cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
 847                 hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
 848         }
 849
 850         /* Set Default PHY parameters if command is supported */
 851         if (hdev->commands[35] & 0x20) {
 852                 struct hci_cp_le_set_default_phy cp;
 853
 854                 cp.all_phys = 0x00;
 855                 cp.tx_phys = hdev->le_tx_def_phys;
 856                 cp.rx_phys = hdev->le_rx_def_phys;
 857
 858                 hci_req_add(req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp), &cp);
 859         }
 860
 861         return 0;
 862 }
 863
 864 static int __hci_init(struct hci_dev *hdev)
 865 {
 866         int err;
 867
 868         err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
 869         if (err < 0)
 870                 return err;
 871
 872         if (hci_dev_test_flag(hdev, HCI_SETUP))
 873                 hci_debugfs_create_basic(hdev);
 874
 875         err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
 876         if (err < 0)
 877                 return err;
 878
 879         /* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
 880          * BR/EDR/LE type controllers. AMP controllers only need the
 881          * first two stages of init.
 882          */
 883         if (hdev->dev_type != HCI_PRIMARY)
 884                 return 0;
 885
 886         err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
 887         if (err < 0)
 888                 return err;
 889
 890         err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
 891         if (err < 0)
 892                 return err;
 893
 894         /* This function is only called when the controller is actually in
 895          * configured state. When the controller is marked as unconfigured,
 896          * this initialization procedure is not run.
 897          *
 898          * It means that it is possible that a controller runs through its
 899          * setup phase and then discovers missing settings. If that is the
 900          * case, then this function will not be called. It then will only
 901          * be called during the config phase.
 902          *
 903          * So only when in setup phase or config phase, create the debugfs
 904          * entries and register the SMP channels.
 905          */
 906         if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
 907             !hci_dev_test_flag(hdev, HCI_CONFIG))
 908                 return 0;
 909
 910         hci_debugfs_create_common(hdev);
 911
 912         if (lmp_bredr_capable(hdev))
 913                 hci_debugfs_create_bredr(hdev);
 914
 915         if (lmp_le_capable(hdev))
 916                 hci_debugfs_create_le(hdev);
 917
 918         return 0;
 919 }
 920
 921 static int hci_init0_req(struct hci_request *req, unsigned long opt)
 922 {
 923         struct hci_dev *hdev = req->hdev;
 924
 925         BT_DBG("%s %ld", hdev->name, opt);
 926
 927         /* Reset */
 928         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
 929                 hci_reset_req(req, 0);
 930
 931         /* Read Local Version */
 932         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 933
 934         /* Read BD Address */
 935         if (hdev->set_bdaddr)
 936                 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
 937
 938         return 0;
 939 }
 940
 941 static int __hci_unconf_init(struct hci_dev *hdev)
 942 {
 943         int err;
 944
 945         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 946                 return 0;
 947
 948         err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
 949         if (err < 0)
 950                 return err;
 951
 952         if (hci_dev_test_flag(hdev, HCI_SETUP))
 953                 hci_debugfs_create_basic(hdev);
 954
 955         return 0;
 956 }
 957
 958 static int hci_scan_req(struct hci_request *req, unsigned long opt)
 959 {
 960         __u8 scan = opt;
 961
 962         BT_DBG("%s %x", req->hdev->name, scan);
 963
 964         /* Inquiry and Page scans */
 965         hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
 966         return 0;
 967 }
 968
 969 static int hci_auth_req(struct hci_request *req, unsigned long opt)
 970 {
 971         __u8 auth = opt;
 972
 973         BT_DBG("%s %x", req->hdev->name, auth);
 974
 975         /* Authentication */
 976         hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
 977         return 0;
 978 }
 979
 980 static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
 981 {
 982         __u8 encrypt = opt;
 983
 984         BT_DBG("%s %x", req->hdev->name, encrypt);
 985
 986         /* Encryption */
 987         hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
 988         return 0;
 989 }
 990
 991 static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
 992 {
 993         __le16 policy = cpu_to_le16(opt);
 994
 995         BT_DBG("%s %x", req->hdev->name, policy);
 996
 997         /* Default link policy */
 998         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
 999         return 0;
1000 }
1001
1002 /* Get HCI device by index.
1003  * Device is held on return. */
1004 struct hci_dev *hci_dev_get(int index)
1005 {
1006         struct hci_dev *hdev = NULL, *d;
1007
1008         BT_DBG("%d", index);
1009
1010         if (index < 0)
1011                 return NULL;
1012
1013         read_lock(&hci_dev_list_lock);
1014         list_for_each_entry(d, &hci_dev_list, list) {
1015                 if (d->id == index) {
1016                         hdev = hci_dev_hold(d);
1017                         break;
1018                 }
1019         }
1020         read_unlock(&hci_dev_list_lock);
1021         return hdev;
1022 }
1023
1024 /* ---- Inquiry support ---- */
1025
1026 bool hci_discovery_active(struct hci_dev *hdev)
1027 {
1028         struct discovery_state *discov = &hdev->discovery;
1029
1030         switch (discov->state) {
1031         case DISCOVERY_FINDING:
1032         case DISCOVERY_RESOLVING:
1033                 return true;
1034
1035         default:
1036                 return false;
1037         }
1038 }
1039
1040 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1041 {
1042         int old_state = hdev->discovery.state;
1043
1044         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1045
1046         if (old_state == state)
1047                 return;
1048
1049         hdev->discovery.state = state;
1050
1051         switch (state) {
1052         case DISCOVERY_STOPPED:
1053                 hci_update_background_scan(hdev);
1054
1055                 if (old_state != DISCOVERY_STARTING)
1056                         mgmt_discovering(hdev, 0);
1057                 break;
1058         case DISCOVERY_STARTING:
1059                 break;
1060         case DISCOVERY_FINDING:
1061                 mgmt_discovering(hdev, 1);
1062                 break;
1063         case DISCOVERY_RESOLVING:
1064                 break;
1065         case DISCOVERY_STOPPING:
1066                 break;
1067         }
1068 }
1069
1070 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1071 {
1072         struct discovery_state *cache = &hdev->discovery;
1073         struct inquiry_entry *p, *n;
1074
1075         list_for_each_entry_safe(p, n, &cache->all, all) {
1076                 list_del(&p->all);
1077                 kfree(p);
1078         }
1079
1080         INIT_LIST_HEAD(&cache->unknown);
1081         INIT_LIST_HEAD(&cache->resolve);
1082 }
1083
1084 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1085                                                bdaddr_t *bdaddr)
1086 {
1087         struct discovery_state *cache = &hdev->discovery;
1088         struct inquiry_entry *e;
1089
1090         BT_DBG("cache %p, %pMR", cache, bdaddr);
1091
1092         list_for_each_entry(e, &cache->all, all) {
1093                 if (!bacmp(&e->data.bdaddr, bdaddr))
1094                         return e;
1095         }
1096
1097         return NULL;
1098 }
1099
1100 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1101                                                        bdaddr_t *bdaddr)
1102 {
1103         struct discovery_state *cache = &hdev->discovery;
1104         struct inquiry_entry *e;
1105
1106         BT_DBG("cache %p, %pMR", cache, bdaddr);
1107
1108         list_for_each_entry(e, &cache->unknown, list) {
1109                 if (!bacmp(&e->data.bdaddr, bdaddr))
1110                         return e;
1111         }
1112
1113         return NULL;
1114 }
1115
1116 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1117                                                        bdaddr_t *bdaddr,
1118                                                        int state)
1119 {
1120         struct discovery_state *cache = &hdev->discovery;
1121         struct inquiry_entry *e;
1122
1123         BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1124
1125         list_for_each_entry(e, &cache->resolve, list) {
1126                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1127                         return e;
1128                 if (!bacmp(&e->data.bdaddr, bdaddr))
1129                         return e;
1130         }
1131
1132         return NULL;
1133 }
1134
1135 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1136                                       struct inquiry_entry *ie)
1137 {
1138         struct discovery_state *cache = &hdev->discovery;
1139         struct list_head *pos = &cache->resolve;
1140         struct inquiry_entry *p;
1141
1142         list_del(&ie->list);
1143
1144         list_for_each_entry(p, &cache->resolve, list) {
1145                 if (p->name_state != NAME_PENDING &&
1146                     abs(p->data.rssi) >= abs(ie->data.rssi))
1147                         break;
1148                 pos = &p->list;
1149         }
1150
1151         list_add(&ie->list, pos);
1152 }
1153
1154 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1155                              bool name_known)
1156 {
1157         struct discovery_state *cache = &hdev->discovery;
1158         struct inquiry_entry *ie;
1159         u32 flags = 0;
1160
1161         BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1162
1163         hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1164
1165         if (!data->ssp_mode)
1166                 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1167
1168         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1169         if (ie) {
1170                 if (!ie->data.ssp_mode)
1171                         flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1172
1173                 if (ie->name_state == NAME_NEEDED &&
1174                     data->rssi != ie->data.rssi) {
1175                         ie->data.rssi = data->rssi;
1176                         hci_inquiry_cache_update_resolve(hdev, ie);
1177                 }
1178
1179                 goto update;
1180         }
1181
1182         /* Entry not in the cache. Add new one. */
1183         ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1184         if (!ie) {
1185                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1186                 goto done;
1187         }
1188
1189         list_add(&ie->all, &cache->all);
1190
1191         if (name_known) {
1192                 ie->name_state = NAME_KNOWN;
1193         } else {
1194                 ie->name_state = NAME_NOT_KNOWN;
1195                 list_add(&ie->list, &cache->unknown);
1196         }
1197
1198 update:
1199         if (name_known && ie->name_state != NAME_KNOWN &&
1200             ie->name_state != NAME_PENDING) {
1201                 ie->name_state = NAME_KNOWN;
1202                 list_del(&ie->list);
1203         }
1204
1205         memcpy(&ie->data, data, sizeof(*data));
1206         ie->timestamp = jiffies;
1207         cache->timestamp = jiffies;
1208
1209         if (ie->name_state == NAME_NOT_KNOWN)
1210                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1211
1212 done:
1213         return flags;
1214 }
1215
1216 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1217 {
1218         struct discovery_state *cache = &hdev->discovery;
1219         struct inquiry_info *info = (struct inquiry_info *) buf;
1220         struct inquiry_entry *e;
1221         int copied = 0;
1222
1223         list_for_each_entry(e, &cache->all, all) {
1224                 struct inquiry_data *data = &e->data;
1225
1226                 if (copied >= num)
1227                         break;
1228
1229                 bacpy(&info->bdaddr, &data->bdaddr);
1230                 info->pscan_rep_mode    = data->pscan_rep_mode;
1231                 info->pscan_period_mode = data->pscan_period_mode;
1232                 info->pscan_mode        = data->pscan_mode;
1233                 memcpy(info->dev_class, data->dev_class, 3);
1234                 info->clock_offset      = data->clock_offset;
1235
1236                 info++;
1237                 copied++;
1238         }
1239
1240         BT_DBG("cache %p, copied %d", cache, copied);
1241         return copied;
1242 }
1243
1244 static int hci_inq_req(struct hci_request *req, unsigned long opt)
1245 {
1246         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1247         struct hci_dev *hdev = req->hdev;
1248         struct hci_cp_inquiry cp;
1249
1250         BT_DBG("%s", hdev->name);
1251
1252         if (test_bit(HCI_INQUIRY, &hdev->flags))
1253                 return 0;
1254
1255         /* Start Inquiry */
1256         memcpy(&cp.lap, &ir->lap, 3);
1257         cp.length  = ir->length;
1258         cp.num_rsp = ir->num_rsp;
1259         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1260
1261         return 0;
1262 }
1263
1264 int hci_inquiry(void __user *arg)
1265 {
1266         __u8 __user *ptr = arg;
1267         struct hci_inquiry_req ir;
1268         struct hci_dev *hdev;
1269         int err = 0, do_inquiry = 0, max_rsp;
1270         long timeo;
1271         __u8 *buf;
1272
1273         if (copy_from_user(&ir, ptr, sizeof(ir)))
1274                 return -EFAULT;
1275
1276         hdev = hci_dev_get(ir.dev_id);
1277         if (!hdev)
1278                 return -ENODEV;
1279
1280         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1281                 err = -EBUSY;
1282                 goto done;
1283         }
1284
1285         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1286                 err = -EOPNOTSUPP;
1287                 goto done;
1288         }
1289
1290         if (hdev->dev_type != HCI_PRIMARY) {
1291                 err = -EOPNOTSUPP;
1292                 goto done;
1293         }
1294
1295         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1296                 err = -EOPNOTSUPP;
1297                 goto done;
1298         }
1299
1300         /* Restrict maximum inquiry length to 60 seconds */
1301         if (ir.length > 60) {
1302                 err = -EINVAL;
1303                 goto done;
1304         }
1305
1306         hci_dev_lock(hdev);
1307         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1308             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1309                 hci_inquiry_cache_flush(hdev);
1310                 do_inquiry = 1;
1311         }
1312         hci_dev_unlock(hdev);
1313
1314         timeo = ir.length * msecs_to_jiffies(2000);
1315
1316         if (do_inquiry) {
1317                 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1318                                    timeo, NULL);
1319                 if (err < 0)
1320                         goto done;
1321
1322                 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1323                  * cleared). If it is interrupted by a signal, return -EINTR.
1324                  */
1325                 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1326                                 TASK_INTERRUPTIBLE)) {
1327                         err = -EINTR;
1328                         goto done;
1329                 }
1330         }
1331
1332         /* for unlimited number of responses we will use buffer with
1333          * 255 entries
1334          */
1335         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1336
1337         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1338          * copy it to the user space.
1339          */
1340         buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
1341         if (!buf) {
1342                 err = -ENOMEM;
1343                 goto done;
1344         }
1345
1346         hci_dev_lock(hdev);
1347         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1348         hci_dev_unlock(hdev);
1349
1350         BT_DBG("num_rsp %d", ir.num_rsp);
1351
1352         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1353                 ptr += sizeof(ir);
1354                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1355                                  ir.num_rsp))
1356                         err = -EFAULT;
1357         } else
1358                 err = -EFAULT;
1359
1360         kfree(buf);
1361
1362 done:
1363         hci_dev_put(hdev);
1364         return err;
1365 }
1366
1367 /**
1368  * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address
1369  *                                     (BD_ADDR) for a HCI device from
1370  *                                     a firmware node property.
1371  * @hdev:       The HCI device
1372  *
1373  * Search the firmware node for 'local-bd-address'.
1374  *
1375  * All-zero BD addresses are rejected, because those could be properties
1376  * that exist in the firmware tables, but were not updated by the firmware. For
1377  * example, the DTS could define 'local-bd-address', with zero BD addresses.
1378  */
1379 static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev)
1380 {
1381         struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
1382         bdaddr_t ba;
1383         int ret;
1384
1385         ret = fwnode_property_read_u8_array(fwnode, "local-bd-address",
1386                                             (u8 *)&ba, sizeof(ba));
1387         if (ret < 0 || !bacmp(&ba, BDADDR_ANY))
1388                 return;
1389
1390         bacpy(&hdev->public_addr, &ba);
1391 }
1392
1393 static int hci_dev_do_open(struct hci_dev *hdev)
1394 {
1395         int ret = 0;
1396
1397         BT_DBG("%s %p", hdev->name, hdev);
1398
1399         hci_req_sync_lock(hdev);
1400
1401         if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1402                 ret = -ENODEV;
1403                 goto done;
1404         }
1405
1406         if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1407             !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1408                 /* Check for rfkill but allow the HCI setup stage to
1409                  * proceed (which in itself doesn't cause any RF activity).
1410                  */
1411                 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1412                         ret = -ERFKILL;
1413                         goto done;
1414                 }
1415
1416                 /* Check for valid public address or a configured static
1417                  * random adddress, but let the HCI setup proceed to
1418                  * be able to determine if there is a public address
1419                  * or not.
1420                  *
1421                  * In case of user channel usage, it is not important
1422                  * if a public address or static random address is
1423                  * available.
1424                  *
1425                  * This check is only valid for BR/EDR controllers
1426                  * since AMP controllers do not have an address.
1427                  */
1428                 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1429                     hdev->dev_type == HCI_PRIMARY &&
1430                     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1431                     !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1432                         ret = -EADDRNOTAVAIL;
1433                         goto done;
1434                 }
1435         }
1436
1437         if (test_bit(HCI_UP, &hdev->flags)) {
1438                 ret = -EALREADY;
1439                 goto done;
1440         }
1441
1442         if (hdev->open(hdev)) {
1443                 ret = -EIO;
1444                 goto done;
1445         }
1446
1447         set_bit(HCI_RUNNING, &hdev->flags);
1448         hci_sock_dev_event(hdev, HCI_DEV_OPEN);
1449
1450         atomic_set(&hdev->cmd_cnt, 1);
1451         set_bit(HCI_INIT, &hdev->flags);
1452
1453         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1454             test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
1455                 bool invalid_bdaddr;
1456
1457                 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1458
1459                 if (hdev->setup)
1460                         ret = hdev->setup(hdev);
1461
1462                 /* The transport driver can set the quirk to mark the
1463                  * BD_ADDR invalid before creating the HCI device or in
1464                  * its setup callback.
1465                  */
1466                 invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR,
1467                                           &hdev->quirks);
1468
1469                 if (ret)
1470                         goto setup_failed;
1471
1472                 if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
1473                         if (!bacmp(&hdev->public_addr, BDADDR_ANY))
1474                                 hci_dev_get_bd_addr_from_property(hdev);
1475
1476                         if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1477                             hdev->set_bdaddr) {
1478                                 ret = hdev->set_bdaddr(hdev,
1479                                                        &hdev->public_addr);
1480
1481                                 /* If setting of the BD_ADDR from the device
1482                                  * property succeeds, then treat the address
1483                                  * as valid even if the invalid BD_ADDR
1484                                  * quirk indicates otherwise.
1485                                  */
1486                                 if (!ret)
1487                                         invalid_bdaddr = false;
1488                         }
1489                 }
1490
1491 setup_failed:
1492                 /* The transport driver can set these quirks before
1493                  * creating the HCI device or in its setup callback.
1494                  *
1495                  * For the invalid BD_ADDR quirk it is possible that
1496                  * it becomes a valid address if the bootloader does
1497                  * provide it (see above).
1498                  *
1499                  * In case any of them is set, the controller has to
1500                  * start up as unconfigured.
1501                  */
1502                 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1503                     invalid_bdaddr)
1504                         hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1505
1506                 /* For an unconfigured controller it is required to
1507                  * read at least the version information provided by
1508                  * the Read Local Version Information command.
1509                  *
1510                  * If the set_bdaddr driver callback is provided, then
1511                  * also the original Bluetooth public device address
1512                  * will be read using the Read BD Address command.
1513                  */
1514                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1515                         ret = __hci_unconf_init(hdev);
1516         }
1517
1518         if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1519                 /* If public address change is configured, ensure that
1520                  * the address gets programmed. If the driver does not
1521                  * support changing the public address, fail the power
1522                  * on procedure.
1523                  */
1524                 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1525                     hdev->set_bdaddr)
1526                         ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1527                 else
1528                         ret = -EADDRNOTAVAIL;
1529         }
1530
1531         if (!ret) {
1532                 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1533                     !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1534                         ret = __hci_init(hdev);
1535                         if (!ret && hdev->post_init)
1536                                 ret = hdev->post_init(hdev);
1537                 }
1538         }
1539
1540         /* If the HCI Reset command is clearing all diagnostic settings,
1541          * then they need to be reprogrammed after the init procedure
1542          * completed.
1543          */
1544         if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
1545             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1546             hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1547                 ret = hdev->set_diag(hdev, true);
1548
1549         clear_bit(HCI_INIT, &hdev->flags);
1550
1551         if (!ret) {
1552                 hci_dev_hold(hdev);
1553                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1554                 hci_adv_instances_set_rpa_expired(hdev, true);
1555                 set_bit(HCI_UP, &hdev->flags);
1556                 hci_sock_dev_event(hdev, HCI_DEV_UP);
1557                 hci_leds_update_powered(hdev, true);
1558                 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1559                     !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1560                     !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1561                     !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1562                     hci_dev_test_flag(hdev, HCI_MGMT) &&
1563                     hdev->dev_type == HCI_PRIMARY) {
1564                         ret = __hci_req_hci_power_on(hdev);
1565                         mgmt_power_on(hdev, ret);
1566                 }
1567         } else {
1568                 /* Init failed, cleanup */
1569                 flush_work(&hdev->tx_work);
1570
1571                 /* Since hci_rx_work() is possible to awake new cmd_work
1572                  * it should be flushed first to avoid unexpected call of
1573                  * hci_cmd_work()
1574                  */
1575                 flush_work(&hdev->rx_work);
1576                 flush_work(&hdev->cmd_work);
1577
1578                 skb_queue_purge(&hdev->cmd_q);
1579                 skb_queue_purge(&hdev->rx_q);
1580
1581                 if (hdev->flush)
1582                         hdev->flush(hdev);
1583
1584                 if (hdev->sent_cmd) {
1585                         kfree_skb(hdev->sent_cmd);
1586                         hdev->sent_cmd = NULL;
1587                 }
1588
1589                 clear_bit(HCI_RUNNING, &hdev->flags);
1590                 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1591
1592                 hdev->close(hdev);
1593                 hdev->flags &= BIT(HCI_RAW);
1594         }
1595
1596 done:
1597         hci_req_sync_unlock(hdev);
1598         return ret;
1599 }
1600
1601 /* ---- HCI ioctl helpers ---- */
1602
1603 int hci_dev_open(__u16 dev)
1604 {
1605         struct hci_dev *hdev;
1606         int err;
1607
1608         hdev = hci_dev_get(dev);
1609         if (!hdev)
1610                 return -ENODEV;
1611
1612         /* Devices that are marked as unconfigured can only be powered
1613          * up as user channel. Trying to bring them up as normal devices
1614          * will result into a failure. Only user channel operation is
1615          * possible.
1616          *
1617          * When this function is called for a user channel, the flag
1618          * HCI_USER_CHANNEL will be set first before attempting to
1619          * open the device.
1620          */
1621         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1622             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1623                 err = -EOPNOTSUPP;
1624                 goto done;
1625         }
1626
1627         /* We need to ensure that no other power on/off work is pending
1628          * before proceeding to call hci_dev_do_open. This is
1629          * particularly important if the setup procedure has not yet
1630          * completed.
1631          */
1632         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1633                 cancel_delayed_work(&hdev->power_off);
1634
1635         /* After this call it is guaranteed that the setup procedure
1636          * has finished. This means that error conditions like RFKILL
1637          * or no valid public or static random address apply.
1638          */
1639         flush_workqueue(hdev->req_workqueue);
1640
1641         /* For controllers not using the management interface and that
1642          * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1643          * so that pairing works for them. Once the management interface
1644          * is in use this bit will be cleared again and userspace has
1645          * to explicitly enable it.
1646          */
1647         if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1648             !hci_dev_test_flag(hdev, HCI_MGMT))
1649                 hci_dev_set_flag(hdev, HCI_BONDABLE);
1650
1651         err = hci_dev_do_open(hdev);
1652
1653 done:
1654         hci_dev_put(hdev);
1655         return err;
1656 }
1657
1658 /* This function requires the caller holds hdev->lock */
1659 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1660 {
1661         struct hci_conn_params *p;
1662
1663         list_for_each_entry(p, &hdev->le_conn_params, list) {
1664                 if (p->conn) {
1665                         hci_conn_drop(p->conn);
1666                         hci_conn_put(p->conn);
1667                         p->conn = NULL;
1668                 }
1669                 list_del_init(&p->action);
1670         }
1671
1672         BT_DBG("All LE pending actions cleared");
1673 }
1674
1675 int hci_dev_do_close(struct hci_dev *hdev)
1676 {
1677         bool auto_off;
1678
1679         BT_DBG("%s %p", hdev->name, hdev);
1680
1681         if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
1682             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1683             test_bit(HCI_UP, &hdev->flags)) {
1684                 /* Execute vendor specific shutdown routine */
1685                 if (hdev->shutdown)
1686                         hdev->shutdown(hdev);
1687         }
1688
1689         cancel_delayed_work(&hdev->power_off);
1690
1691         hci_request_cancel_all(hdev);
1692         hci_req_sync_lock(hdev);
1693
1694         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1695                 cancel_delayed_work_sync(&hdev->cmd_timer);
1696                 hci_req_sync_unlock(hdev);
1697                 return 0;
1698         }
1699
1700         hci_leds_update_powered(hdev, false);
1701
1702         /* Flush RX and TX works */
1703         flush_work(&hdev->tx_work);
1704         flush_work(&hdev->rx_work);
1705
1706         if (hdev->discov_timeout > 0) {
1707                 hdev->discov_timeout = 0;
1708                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1709                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1710         }
1711
1712         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1713                 cancel_delayed_work(&hdev->service_cache);
1714
1715         if (hci_dev_test_flag(hdev, HCI_MGMT)) {
1716                 struct adv_info *adv_instance;
1717
1718                 cancel_delayed_work_sync(&hdev->rpa_expired);
1719
1720                 list_for_each_entry(adv_instance, &hdev->adv_instances, list)
1721                         cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1722         }
1723
1724         /* Avoid potential lockdep warnings from the *_flush() calls by
1725          * ensuring the workqueue is empty up front.
1726          */
1727         drain_workqueue(hdev->workqueue);
1728
1729         hci_dev_lock(hdev);
1730
1731         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1732
1733         auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1734
1735         if (!auto_off && hdev->dev_type == HCI_PRIMARY &&
1736             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1737             hci_dev_test_flag(hdev, HCI_MGMT))
1738                 __mgmt_power_off(hdev);
1739
1740         hci_inquiry_cache_flush(hdev);
1741         hci_pend_le_actions_clear(hdev);
1742         hci_conn_hash_flush(hdev);
1743         hci_dev_unlock(hdev);
1744
1745         smp_unregister(hdev);
1746
1747         hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1748
1749         if (hdev->flush)
1750                 hdev->flush(hdev);
1751
1752         /* Reset device */
1753         skb_queue_purge(&hdev->cmd_q);
1754         atomic_set(&hdev->cmd_cnt, 1);
1755         if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1756             !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1757                 set_bit(HCI_INIT, &hdev->flags);
1758                 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1759                 clear_bit(HCI_INIT, &hdev->flags);
1760         }
1761
1762         /* flush cmd  work */
1763         flush_work(&hdev->cmd_work);
1764
1765         /* Drop queues */
1766         skb_queue_purge(&hdev->rx_q);
1767         skb_queue_purge(&hdev->cmd_q);
1768         skb_queue_purge(&hdev->raw_q);
1769
1770         /* Drop last sent command */
1771         if (hdev->sent_cmd) {
1772                 cancel_delayed_work_sync(&hdev->cmd_timer);
1773                 kfree_skb(hdev->sent_cmd);
1774                 hdev->sent_cmd = NULL;
1775         }
1776
1777         clear_bit(HCI_RUNNING, &hdev->flags);
1778         hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1779
1780         /* After this point our queues are empty
1781          * and no tasks are scheduled. */
1782         hdev->close(hdev);
1783
1784         /* Clear flags */
1785         hdev->flags &= BIT(HCI_RAW);
1786         hci_dev_clear_volatile_flags(hdev);
1787
1788         /* Controller radio is available but is currently powered down */
1789         hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1790
1791         memset(hdev->eir, 0, sizeof(hdev->eir));
1792         memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1793         bacpy(&hdev->random_addr, BDADDR_ANY);
1794
1795         hci_req_sync_unlock(hdev);
1796
1797         hci_dev_put(hdev);
1798         return 0;
1799 }
1800
1801 int hci_dev_close(__u16 dev)
1802 {
1803         struct hci_dev *hdev;
1804         int err;
1805
1806         hdev = hci_dev_get(dev);
1807         if (!hdev)
1808                 return -ENODEV;
1809
1810         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1811                 err = -EBUSY;
1812                 goto done;
1813         }
1814
1815         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1816                 cancel_delayed_work(&hdev->power_off);
1817
1818         err = hci_dev_do_close(hdev);
1819
1820 done:
1821         hci_dev_put(hdev);
1822         return err;
1823 }
1824
1825 static int hci_dev_do_reset(struct hci_dev *hdev)
1826 {
1827         int ret;
1828
1829         BT_DBG("%s %p", hdev->name, hdev);
1830
1831         hci_req_sync_lock(hdev);
1832
1833         /* Drop queues */
1834         skb_queue_purge(&hdev->rx_q);
1835         skb_queue_purge(&hdev->cmd_q);
1836
1837         /* Avoid potential lockdep warnings from the *_flush() calls by
1838          * ensuring the workqueue is empty up front.
1839          */
1840         drain_workqueue(hdev->workqueue);
1841
1842         hci_dev_lock(hdev);
1843         hci_inquiry_cache_flush(hdev);
1844         hci_conn_hash_flush(hdev);
1845         hci_dev_unlock(hdev);
1846
1847         if (hdev->flush)
1848                 hdev->flush(hdev);
1849
1850         atomic_set(&hdev->cmd_cnt, 1);
1851         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1852
1853         ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1854
1855         hci_req_sync_unlock(hdev);
1856         return ret;
1857 }
1858
1859 int hci_dev_reset(__u16 dev)
1860 {
1861         struct hci_dev *hdev;
1862         int err;
1863
1864         hdev = hci_dev_get(dev);
1865         if (!hdev)
1866                 return -ENODEV;
1867
1868         if (!test_bit(HCI_UP, &hdev->flags)) {
1869                 err = -ENETDOWN;
1870                 goto done;
1871         }
1872
1873         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1874                 err = -EBUSY;
1875                 goto done;
1876         }
1877
1878         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1879                 err = -EOPNOTSUPP;
1880                 goto done;
1881         }
1882
1883         err = hci_dev_do_reset(hdev);
1884
1885 done:
1886         hci_dev_put(hdev);
1887         return err;
1888 }
1889
1890 int hci_dev_reset_stat(__u16 dev)
1891 {
1892         struct hci_dev *hdev;
1893         int ret = 0;
1894
1895         hdev = hci_dev_get(dev);
1896         if (!hdev)
1897                 return -ENODEV;
1898
1899         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1900                 ret = -EBUSY;
1901                 goto done;
1902         }
1903
1904         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1905                 ret = -EOPNOTSUPP;
1906                 goto done;
1907         }
1908
1909         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1910
1911 done:
1912         hci_dev_put(hdev);
1913         return ret;
1914 }
1915
1916 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1917 {
1918         bool conn_changed, discov_changed;
1919
1920         BT_DBG("%s scan 0x%02x", hdev->name, scan);
1921
1922         if ((scan & SCAN_PAGE))
1923                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1924                                                           HCI_CONNECTABLE);
1925         else
1926                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1927                                                            HCI_CONNECTABLE);
1928
1929         if ((scan & SCAN_INQUIRY)) {
1930                 discov_changed = !hci_dev_test_and_set_flag(hdev,
1931                                                             HCI_DISCOVERABLE);
1932         } else {
1933                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1934                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1935                                                              HCI_DISCOVERABLE);
1936         }
1937
1938         if (!hci_dev_test_flag(hdev, HCI_MGMT))
1939                 return;
1940
1941         if (conn_changed || discov_changed) {
1942                 /* In case this was disabled through mgmt */
1943                 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
1944
1945                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1946                         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1947
1948                 mgmt_new_settings(hdev);
1949         }
1950 }
1951
1952 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1953 {
1954         struct hci_dev *hdev;
1955         struct hci_dev_req dr;
1956         int err = 0;
1957
1958         if (copy_from_user(&dr, arg, sizeof(dr)))
1959                 return -EFAULT;
1960
1961         hdev = hci_dev_get(dr.dev_id);
1962         if (!hdev)
1963                 return -ENODEV;
1964
1965         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1966                 err = -EBUSY;
1967                 goto done;
1968         }
1969
1970         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1971                 err = -EOPNOTSUPP;
1972                 goto done;
1973         }
1974
1975         if (hdev->dev_type != HCI_PRIMARY) {
1976                 err = -EOPNOTSUPP;
1977                 goto done;
1978         }
1979
1980         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1981                 err = -EOPNOTSUPP;
1982                 goto done;
1983         }
1984
1985         switch (cmd) {
1986         case HCISETAUTH:
1987                 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1988                                    HCI_INIT_TIMEOUT, NULL);
1989                 break;
1990
1991         case HCISETENCRYPT:
1992                 if (!lmp_encrypt_capable(hdev)) {
1993                         err = -EOPNOTSUPP;
1994                         break;
1995                 }
1996
1997                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1998                         /* Auth must be enabled first */
1999                         err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2000                                            HCI_INIT_TIMEOUT, NULL);
2001                         if (err)
2002                                 break;
2003                 }
2004
2005                 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
2006                                    HCI_INIT_TIMEOUT, NULL);
2007                 break;
2008
2009         case HCISETSCAN:
2010                 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
2011                                    HCI_INIT_TIMEOUT, NULL);
2012
2013                 /* Ensure that the connectable and discoverable states
2014                  * get correctly modified as this was a non-mgmt change.
2015                  */
2016                 if (!err)
2017                         hci_update_scan_state(hdev, dr.dev_opt);
2018                 break;
2019
2020         case HCISETLINKPOL:
2021                 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
2022                                    HCI_INIT_TIMEOUT, NULL);
2023                 break;
2024
2025         case HCISETLINKMODE:
2026                 hdev->link_mode = ((__u16) dr.dev_opt) &
2027                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
2028                 break;
2029
2030         case HCISETPTYPE:
2031                 if (hdev->pkt_type == (__u16) dr.dev_opt)
2032                         break;
2033
2034                 hdev->pkt_type = (__u16) dr.dev_opt;
2035                 mgmt_phy_configuration_changed(hdev, NULL);
2036                 break;
2037
2038         case HCISETACLMTU:
2039                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
2040                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
2041                 break;
2042
2043         case HCISETSCOMTU:
2044                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
2045                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
2046                 break;
2047
2048         default:
2049                 err = -EINVAL;
2050                 break;
2051         }
2052
2053 done:
2054         hci_dev_put(hdev);
2055         return err;
2056 }
2057
2058 int hci_get_dev_list(void __user *arg)
2059 {
2060         struct hci_dev *hdev;
2061         struct hci_dev_list_req *dl;
2062         struct hci_dev_req *dr;
2063         int n = 0, size, err;
2064         __u16 dev_num;
2065
2066         if (get_user(dev_num, (__u16 __user *) arg))
2067                 return -EFAULT;
2068
2069         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2070                 return -EINVAL;
2071
2072         size = sizeof(*dl) + dev_num * sizeof(*dr);
2073
2074         dl = kzalloc(size, GFP_KERNEL);
2075         if (!dl)
2076                 return -ENOMEM;
2077
2078         dr = dl->dev_req;
2079
2080         read_lock(&hci_dev_list_lock);
2081         list_for_each_entry(hdev, &hci_dev_list, list) {
2082                 unsigned long flags = hdev->flags;
2083
2084                 /* When the auto-off is configured it means the transport
2085                  * is running, but in that case still indicate that the
2086                  * device is actually down.
2087                  */
2088                 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2089                         flags &= ~BIT(HCI_UP);
2090
2091                 (dr + n)->dev_id  = hdev->id;
2092                 (dr + n)->dev_opt = flags;
2093
2094                 if (++n >= dev_num)
2095                         break;
2096         }
2097         read_unlock(&hci_dev_list_lock);
2098
2099         dl->dev_num = n;
2100         size = sizeof(*dl) + n * sizeof(*dr);
2101
2102         err = copy_to_user(arg, dl, size);
2103         kfree(dl);
2104
2105         return err ? -EFAULT : 0;
2106 }
2107
2108 int hci_get_dev_info(void __user *arg)
2109 {
2110         struct hci_dev *hdev;
2111         struct hci_dev_info di;
2112         unsigned long flags;
2113         int err = 0;
2114
2115         if (copy_from_user(&di, arg, sizeof(di)))
2116                 return -EFAULT;
2117
2118         hdev = hci_dev_get(di.dev_id);
2119         if (!hdev)
2120                 return -ENODEV;
2121
2122         /* When the auto-off is configured it means the transport
2123          * is running, but in that case still indicate that the
2124          * device is actually down.
2125          */
2126         if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2127                 flags = hdev->flags & ~BIT(HCI_UP);
2128         else
2129                 flags = hdev->flags;
2130
2131         strcpy(di.name, hdev->name);
2132         di.bdaddr   = hdev->bdaddr;
2133         di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2134         di.flags    = flags;
2135         di.pkt_type = hdev->pkt_type;
2136         if (lmp_bredr_capable(hdev)) {
2137                 di.acl_mtu  = hdev->acl_mtu;
2138                 di.acl_pkts = hdev->acl_pkts;
2139                 di.sco_mtu  = hdev->sco_mtu;
2140                 di.sco_pkts = hdev->sco_pkts;
2141         } else {
2142                 di.acl_mtu  = hdev->le_mtu;
2143                 di.acl_pkts = hdev->le_pkts;
2144                 di.sco_mtu  = 0;
2145                 di.sco_pkts = 0;
2146         }
2147         di.link_policy = hdev->link_policy;
2148         di.link_mode   = hdev->link_mode;
2149
2150         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2151         memcpy(&di.features, &hdev->features, sizeof(di.features));
2152
2153         if (copy_to_user(arg, &di, sizeof(di)))
2154                 err = -EFAULT;
2155
2156         hci_dev_put(hdev);
2157
2158         return err;
2159 }
2160
2161 /* ---- Interface to HCI drivers ---- */
2162
2163 static int hci_rfkill_set_block(void *data, bool blocked)
2164 {
2165         struct hci_dev *hdev = data;
2166
2167         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2168
2169         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2170                 return -EBUSY;
2171
2172         if (blocked) {
2173                 hci_dev_set_flag(hdev, HCI_RFKILLED);
2174                 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2175                     !hci_dev_test_flag(hdev, HCI_CONFIG))
2176                         hci_dev_do_close(hdev);
2177         } else {
2178                 hci_dev_clear_flag(hdev, HCI_RFKILLED);
2179         }
2180
2181         return 0;
2182 }
2183
2184 static const struct rfkill_ops hci_rfkill_ops = {
2185         .set_block = hci_rfkill_set_block,
2186 };
2187
2188 static void hci_power_on(struct work_struct *work)
2189 {
2190         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2191         int err;
2192
2193         BT_DBG("%s", hdev->name);
2194
2195         if (test_bit(HCI_UP, &hdev->flags) &&
2196             hci_dev_test_flag(hdev, HCI_MGMT) &&
2197             hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
2198                 cancel_delayed_work(&hdev->power_off);
2199                 hci_req_sync_lock(hdev);
2200                 err = __hci_req_hci_power_on(hdev);
2201                 hci_req_sync_unlock(hdev);
2202                 mgmt_power_on(hdev, err);
2203                 return;
2204         }
2205
2206         err = hci_dev_do_open(hdev);
2207         if (err < 0) {
2208                 hci_dev_lock(hdev);
2209                 mgmt_set_powered_failed(hdev, err);
2210                 hci_dev_unlock(hdev);
2211                 return;
2212         }
2213
2214         /* During the HCI setup phase, a few error conditions are
2215          * ignored and they need to be checked now. If they are still
2216          * valid, it is important to turn the device back off.
2217          */
2218         if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2219             hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2220             (hdev->dev_type == HCI_PRIMARY &&
2221              !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2222              !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2223                 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2224                 hci_dev_do_close(hdev);
2225         } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2226                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2227                                    HCI_AUTO_OFF_TIMEOUT);
2228         }
2229
2230         if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2231                 /* For unconfigured devices, set the HCI_RAW flag
2232                  * so that userspace can easily identify them.
2233                  */
2234                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2235                         set_bit(HCI_RAW, &hdev->flags);
2236
2237                 /* For fully configured devices, this will send
2238                  * the Index Added event. For unconfigured devices,
2239                  * it will send Unconfigued Index Added event.
2240                  *
2241                  * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2242                  * and no event will be send.
2243                  */
2244                 mgmt_index_added(hdev);
2245         } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2246                 /* When the controller is now configured, then it
2247                  * is important to clear the HCI_RAW flag.
2248                  */
2249                 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2250                         clear_bit(HCI_RAW, &hdev->flags);
2251
2252                 /* Powering on the controller with HCI_CONFIG set only
2253                  * happens with the transition from unconfigured to
2254                  * configured. This will send the Index Added event.
2255                  */
2256                 mgmt_index_added(hdev);
2257         }
2258 }
2259
2260 static void hci_power_off(struct work_struct *work)
2261 {
2262         struct hci_dev *hdev = container_of(work, struct hci_dev,
2263                                             power_off.work);
2264
2265         BT_DBG("%s", hdev->name);
2266
2267         hci_dev_do_close(hdev);
2268 }
2269
2270 static void hci_error_reset(struct work_struct *work)
2271 {
2272         struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2273
2274         BT_DBG("%s", hdev->name);
2275
2276         if (hdev->hw_error)
2277                 hdev->hw_error(hdev, hdev->hw_error_code);
2278         else
2279                 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
2280
2281         if (hci_dev_do_close(hdev))
2282                 return;
2283
2284         hci_dev_do_open(hdev);
2285 }
2286
2287 void hci_uuids_clear(struct hci_dev *hdev)
2288 {
2289         struct bt_uuid *uuid, *tmp;
2290
2291         list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2292                 list_del(&uuid->list);
2293                 kfree(uuid);
2294         }
2295 }
2296
2297 void hci_link_keys_clear(struct hci_dev *hdev)
2298 {
2299         struct link_key *key;
2300
2301         list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2302                 list_del_rcu(&key->list);
2303                 kfree_rcu(key, rcu);
2304         }
2305 }
2306
2307 void hci_smp_ltks_clear(struct hci_dev *hdev)
2308 {
2309         struct smp_ltk *k;
2310
2311         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2312                 list_del_rcu(&k->list);
2313                 kfree_rcu(k, rcu);
2314         }
2315 }
2316
2317 void hci_smp_irks_clear(struct hci_dev *hdev)
2318 {
2319         struct smp_irk *k;
2320
2321         list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2322                 list_del_rcu(&k->list);
2323                 kfree_rcu(k, rcu);
2324         }
2325 }
2326
2327 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2328 {
2329         struct link_key *k;
2330
2331         rcu_read_lock();
2332         list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2333                 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2334                         rcu_read_unlock();
2335                         return k;
2336                 }
2337         }
2338         rcu_read_unlock();
2339
2340         return NULL;
2341 }
2342
2343 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2344                                u8 key_type, u8 old_key_type)
2345 {
2346         /* Legacy key */
2347         if (key_type < 0x03)
2348                 return true;
2349
2350         /* Debug keys are insecure so don't store them persistently */
2351         if (key_type == HCI_LK_DEBUG_COMBINATION)
2352                 return false;
2353
2354         /* Changed combination key and there's no previous one */
2355         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2356                 return false;
2357
2358         /* Security mode 3 case */
2359         if (!conn)
2360                 return true;
2361
2362         /* BR/EDR key derived using SC from an LE link */
2363         if (conn->type == LE_LINK)
2364                 return true;
2365
2366         /* Neither local nor remote side had no-bonding as requirement */
2367         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2368                 return true;
2369
2370         /* Local side had dedicated bonding as requirement */
2371         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2372                 return true;
2373
2374         /* Remote side had dedicated bonding as requirement */
2375         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2376                 return true;
2377
2378         /* If none of the above criteria match, then don't store the key
2379          * persistently */
2380         return false;
2381 }
2382
2383 static u8 ltk_role(u8 type)
2384 {
2385         if (type == SMP_LTK)
2386                 return HCI_ROLE_MASTER;
2387
2388         return HCI_ROLE_SLAVE;
2389 }
2390
2391 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2392                              u8 addr_type, u8 role)
2393 {
2394         struct smp_ltk *k;
2395
2396         rcu_read_lock();
2397         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2398                 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2399                         continue;
2400
2401                 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2402                         rcu_read_unlock();
2403                         return k;
2404                 }
2405         }
2406         rcu_read_unlock();
2407
2408         return NULL;
2409 }
2410
2411 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2412 {
2413         struct smp_irk *irk;
2414
2415         rcu_read_lock();
2416         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2417                 if (!bacmp(&irk->rpa, rpa)) {
2418                         rcu_read_unlock();
2419                         return irk;
2420                 }
2421         }
2422
2423         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2424                 if (smp_irk_matches(hdev, irk->val, rpa)) {
2425                         bacpy(&irk->rpa, rpa);
2426                         rcu_read_unlock();
2427                         return irk;
2428                 }
2429         }
2430         rcu_read_unlock();
2431
2432         return NULL;
2433 }
2434
2435 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2436                                      u8 addr_type)
2437 {
2438         struct smp_irk *irk;
2439
2440         /* Identity Address must be public or static random */
2441         if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2442                 return NULL;
2443
2444         rcu_read_lock();
2445         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2446                 if (addr_type == irk->addr_type &&
2447                     bacmp(bdaddr, &irk->bdaddr) == 0) {
2448                         rcu_read_unlock();
2449                         return irk;
2450                 }
2451         }
2452         rcu_read_unlock();
2453
2454         return NULL;
2455 }
2456
2457 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2458                                   bdaddr_t *bdaddr, u8 *val, u8 type,
2459                                   u8 pin_len, bool *persistent)
2460 {
2461         struct link_key *key, *old_key;
2462         u8 old_key_type;
2463
2464         old_key = hci_find_link_key(hdev, bdaddr);
2465         if (old_key) {
2466                 old_key_type = old_key->type;
2467                 key = old_key;
2468         } else {
2469                 old_key_type = conn ? conn->key_type : 0xff;
2470                 key = kzalloc(sizeof(*key), GFP_KERNEL);
2471                 if (!key)
2472                         return NULL;
2473                 list_add_rcu(&key->list, &hdev->link_keys);
2474         }
2475
2476         BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2477
2478         /* Some buggy controller combinations generate a changed
2479          * combination key for legacy pairing even when there's no
2480          * previous key */
2481         if (type == HCI_LK_CHANGED_COMBINATION &&
2482             (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2483                 type = HCI_LK_COMBINATION;
2484                 if (conn)
2485                         conn->key_type = type;
2486         }
2487
2488         bacpy(&key->bdaddr, bdaddr);
2489         memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2490         key->pin_len = pin_len;
2491
2492         if (type == HCI_LK_CHANGED_COMBINATION)
2493                 key->type = old_key_type;
2494         else
2495                 key->type = type;
2496
2497         if (persistent)
2498                 *persistent = hci_persistent_key(hdev, conn, type,
2499                                                  old_key_type);
2500
2501         return key;
2502 }
2503
2504 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2505                             u8 addr_type, u8 type, u8 authenticated,
2506                             u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2507 {
2508         struct smp_ltk *key, *old_key;
2509         u8 role = ltk_role(type);
2510
2511         old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2512         if (old_key)
2513                 key = old_key;
2514         else {
2515                 key = kzalloc(sizeof(*key), GFP_KERNEL);
2516                 if (!key)
2517                         return NULL;
2518                 list_add_rcu(&key->list, &hdev->long_term_keys);
2519         }
2520
2521         bacpy(&key->bdaddr, bdaddr);
2522         key->bdaddr_type = addr_type;
2523         memcpy(key->val, tk, sizeof(key->val));
2524         key->authenticated = authenticated;
2525         key->ediv = ediv;
2526         key->rand = rand;
2527         key->enc_size = enc_size;
2528         key->type = type;
2529
2530         return key;
2531 }
2532
2533 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2534                             u8 addr_type, u8 val[16], bdaddr_t *rpa)
2535 {
2536         struct smp_irk *irk;
2537
2538         irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2539         if (!irk) {
2540                 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2541                 if (!irk)
2542                         return NULL;
2543
2544                 bacpy(&irk->bdaddr, bdaddr);
2545                 irk->addr_type = addr_type;
2546
2547                 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2548         }
2549
2550         memcpy(irk->val, val, 16);
2551         bacpy(&irk->rpa, rpa);
2552
2553         return irk;
2554 }
2555
2556 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2557 {
2558         struct link_key *key;
2559
2560         key = hci_find_link_key(hdev, bdaddr);
2561         if (!key)
2562                 return -ENOENT;
2563
2564         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2565
2566         list_del_rcu(&key->list);
2567         kfree_rcu(key, rcu);
2568
2569         return 0;
2570 }
2571
2572 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2573 {
2574         struct smp_ltk *k;
2575         int removed = 0;
2576
2577         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2578                 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2579                         continue;
2580
2581                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2582
2583                 list_del_rcu(&k->list);
2584                 kfree_rcu(k, rcu);
2585                 removed++;
2586         }
2587
2588         return removed ? 0 : -ENOENT;
2589 }
2590
2591 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2592 {
2593         struct smp_irk *k;
2594
2595         list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2596                 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2597                         continue;
2598
2599                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2600
2601                 list_del_rcu(&k->list);
2602                 kfree_rcu(k, rcu);
2603         }
2604 }
2605
2606 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2607 {
2608         struct smp_ltk *k;
2609         struct smp_irk *irk;
2610         u8 addr_type;
2611
2612         if (type == BDADDR_BREDR) {
2613                 if (hci_find_link_key(hdev, bdaddr))
2614                         return true;
2615                 return false;
2616         }
2617
2618         /* Convert to HCI addr type which struct smp_ltk uses */
2619         if (type == BDADDR_LE_PUBLIC)
2620                 addr_type = ADDR_LE_DEV_PUBLIC;
2621         else
2622                 addr_type = ADDR_LE_DEV_RANDOM;
2623
2624         irk = hci_get_irk(hdev, bdaddr, addr_type);
2625         if (irk) {
2626                 bdaddr = &irk->bdaddr;
2627                 addr_type = irk->addr_type;
2628         }
2629
2630         rcu_read_lock();
2631         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2632                 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2633                         rcu_read_unlock();
2634                         return true;
2635                 }
2636         }
2637         rcu_read_unlock();
2638
2639         return false;
2640 }
2641
2642 /* HCI command timer function */
2643 static void hci_cmd_timeout(struct work_struct *work)
2644 {
2645         struct hci_dev *hdev = container_of(work, struct hci_dev,
2646                                             cmd_timer.work);
2647
2648         if (hdev->sent_cmd) {
2649                 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2650                 u16 opcode = __le16_to_cpu(sent->opcode);
2651
2652                 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
2653         } else {
2654                 bt_dev_err(hdev, "command tx timeout");
2655         }
2656
2657         if (hdev->cmd_timeout)
2658                 hdev->cmd_timeout(hdev);
2659
2660         atomic_set(&hdev->cmd_cnt, 1);
2661         queue_work(hdev->workqueue, &hdev->cmd_work);
2662 }
2663
2664 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2665                                           bdaddr_t *bdaddr, u8 bdaddr_type)
2666 {
2667         struct oob_data *data;
2668
2669         list_for_each_entry(data, &hdev->remote_oob_data, list) {
2670                 if (bacmp(bdaddr, &data->bdaddr) != 0)
2671                         continue;
2672                 if (data->bdaddr_type != bdaddr_type)
2673                         continue;
2674                 return data;
2675         }
2676
2677         return NULL;
2678 }
2679
2680 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2681                                u8 bdaddr_type)
2682 {
2683         struct oob_data *data;
2684
2685         data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2686         if (!data)
2687                 return -ENOENT;
2688
2689         BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2690
2691         list_del(&data->list);
2692         kfree(data);
2693
2694         return 0;
2695 }
2696
2697 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2698 {
2699         struct oob_data *data, *n;
2700
2701         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2702                 list_del(&data->list);
2703                 kfree(data);
2704         }
2705 }
2706
2707 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2708                             u8 bdaddr_type, u8 *hash192, u8 *rand192,
2709                             u8 *hash256, u8 *rand256)
2710 {
2711         struct oob_data *data;
2712
2713         data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2714         if (!data) {
2715                 data = kmalloc(sizeof(*data), GFP_KERNEL);
2716                 if (!data)
2717                         return -ENOMEM;
2718
2719                 bacpy(&data->bdaddr, bdaddr);
2720                 data->bdaddr_type = bdaddr_type;
2721                 list_add(&data->list, &hdev->remote_oob_data);
2722         }
2723
2724         if (hash192 && rand192) {
2725                 memcpy(data->hash192, hash192, sizeof(data->hash192));
2726                 memcpy(data->rand192, rand192, sizeof(data->rand192));
2727                 if (hash256 && rand256)
2728                         data->present = 0x03;
2729         } else {
2730                 memset(data->hash192, 0, sizeof(data->hash192));
2731                 memset(data->rand192, 0, sizeof(data->rand192));
2732                 if (hash256 && rand256)
2733                         data->present = 0x02;
2734                 else
2735                         data->present = 0x00;
2736         }
2737
2738         if (hash256 && rand256) {
2739                 memcpy(data->hash256, hash256, sizeof(data->hash256));
2740                 memcpy(data->rand256, rand256, sizeof(data->rand256));
2741         } else {
2742                 memset(data->hash256, 0, sizeof(data->hash256));
2743                 memset(data->rand256, 0, sizeof(data->rand256));
2744                 if (hash192 && rand192)
2745                         data->present = 0x01;
2746         }
2747
2748         BT_DBG("%s for %pMR", hdev->name, bdaddr);
2749
2750         return 0;
2751 }
2752
2753 /* This function requires the caller holds hdev->lock */
2754 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2755 {
2756         struct adv_info *adv_instance;
2757
2758         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2759                 if (adv_instance->instance == instance)
2760                         return adv_instance;
2761         }
2762
2763         return NULL;
2764 }
2765
2766 /* This function requires the caller holds hdev->lock */
2767 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2768 {
2769         struct adv_info *cur_instance;
2770
2771         cur_instance = hci_find_adv_instance(hdev, instance);
2772         if (!cur_instance)
2773                 return NULL;
2774
2775         if (cur_instance == list_last_entry(&hdev->adv_instances,
2776                                             struct adv_info, list))
2777                 return list_first_entry(&hdev->adv_instances,
2778                                                  struct adv_info, list);
2779         else
2780                 return list_next_entry(cur_instance, list);
2781 }
2782
2783 /* This function requires the caller holds hdev->lock */
2784 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2785 {
2786         struct adv_info *adv_instance;
2787
2788         adv_instance = hci_find_adv_instance(hdev, instance);
2789         if (!adv_instance)
2790                 return -ENOENT;
2791
2792         BT_DBG("%s removing %dMR", hdev->name, instance);
2793
2794         if (hdev->cur_adv_instance == instance) {
2795                 if (hdev->adv_instance_timeout) {
2796                         cancel_delayed_work(&hdev->adv_instance_expire);
2797                         hdev->adv_instance_timeout = 0;
2798                 }
2799                 hdev->cur_adv_instance = 0x00;
2800         }
2801
2802         cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2803
2804         list_del(&adv_instance->list);
2805         kfree(adv_instance);
2806
2807         hdev->adv_instance_cnt--;
2808
2809         return 0;
2810 }
2811
2812 void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
2813 {
2814         struct adv_info *adv_instance, *n;
2815
2816         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
2817                 adv_instance->rpa_expired = rpa_expired;
2818 }
2819
2820 /* This function requires the caller holds hdev->lock */
2821 void hci_adv_instances_clear(struct hci_dev *hdev)
2822 {
2823         struct adv_info *adv_instance, *n;
2824
2825         if (hdev->adv_instance_timeout) {
2826                 cancel_delayed_work(&hdev->adv_instance_expire);
2827                 hdev->adv_instance_timeout = 0;
2828         }
2829
2830         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
2831                 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2832                 list_del(&adv_instance->list);
2833                 kfree(adv_instance);
2834         }
2835
2836         hdev->adv_instance_cnt = 0;
2837         hdev->cur_adv_instance = 0x00;
2838 }
2839
2840 static void adv_instance_rpa_expired(struct work_struct *work)
2841 {
2842         struct adv_info *adv_instance = container_of(work, struct adv_info,
2843                                                      rpa_expired_cb.work);
2844
2845         BT_DBG("");
2846
2847         adv_instance->rpa_expired = true;
2848 }
2849
2850 /* This function requires the caller holds hdev->lock */
2851 int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2852                          u16 adv_data_len, u8 *adv_data,
2853                          u16 scan_rsp_len, u8 *scan_rsp_data,
2854                          u16 timeout, u16 duration)
2855 {
2856         struct adv_info *adv_instance;
2857
2858         adv_instance = hci_find_adv_instance(hdev, instance);
2859         if (adv_instance) {
2860                 memset(adv_instance->adv_data, 0,
2861                        sizeof(adv_instance->adv_data));
2862                 memset(adv_instance->scan_rsp_data, 0,
2863                        sizeof(adv_instance->scan_rsp_data));
2864         } else {
2865                 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
2866                     instance < 1 || instance > HCI_MAX_ADV_INSTANCES)
2867                         return -EOVERFLOW;
2868
2869                 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
2870                 if (!adv_instance)
2871                         return -ENOMEM;
2872
2873                 adv_instance->pending = true;
2874                 adv_instance->instance = instance;
2875                 list_add(&adv_instance->list, &hdev->adv_instances);
2876                 hdev->adv_instance_cnt++;
2877         }
2878
2879         adv_instance->flags = flags;
2880         adv_instance->adv_data_len = adv_data_len;
2881         adv_instance->scan_rsp_len = scan_rsp_len;
2882
2883         if (adv_data_len)
2884                 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
2885
2886         if (scan_rsp_len)
2887                 memcpy(adv_instance->scan_rsp_data,
2888                        scan_rsp_data, scan_rsp_len);
2889
2890         adv_instance->timeout = timeout;
2891         adv_instance->remaining_time = timeout;
2892
2893         if (duration == 0)
2894                 adv_instance->duration = HCI_DEFAULT_ADV_DURATION;
2895         else
2896                 adv_instance->duration = duration;
2897
2898         adv_instance->tx_power = HCI_TX_POWER_INVALID;
2899
2900         INIT_DELAYED_WORK(&adv_instance->rpa_expired_cb,
2901                           adv_instance_rpa_expired);
2902
2903         BT_DBG("%s for %dMR", hdev->name, instance);
2904
2905         return 0;
2906 }
2907
2908 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2909                                          bdaddr_t *bdaddr, u8 type)
2910 {
2911         struct bdaddr_list *b;
2912
2913         list_for_each_entry(b, bdaddr_list, list) {
2914                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2915                         return b;
2916         }
2917
2918         return NULL;
2919 }
2920
2921 struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
2922                                 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
2923                                 u8 type)
2924 {
2925         struct bdaddr_list_with_irk *b;
2926
2927         list_for_each_entry(b, bdaddr_list, list) {
2928                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2929                         return b;
2930         }
2931
2932         return NULL;
2933 }
2934
2935 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2936 {
2937         struct bdaddr_list *b, *n;
2938
2939         list_for_each_entry_safe(b, n, bdaddr_list, list) {
2940                 list_del(&b->list);
2941                 kfree(b);
2942         }
2943 }
2944
2945 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2946 {
2947         struct bdaddr_list *entry;
2948
2949         if (!bacmp(bdaddr, BDADDR_ANY))
2950                 return -EBADF;
2951
2952         if (hci_bdaddr_list_lookup(list, bdaddr, type))
2953                 return -EEXIST;
2954
2955         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2956         if (!entry)
2957                 return -ENOMEM;
2958
2959         bacpy(&entry->bdaddr, bdaddr);
2960         entry->bdaddr_type = type;
2961
2962         list_add(&entry->list, list);
2963
2964         return 0;
2965 }
2966
2967 int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2968                                         u8 type, u8 *peer_irk, u8 *local_irk)
2969 {
2970         struct bdaddr_list_with_irk *entry;
2971
2972         if (!bacmp(bdaddr, BDADDR_ANY))
2973                 return -EBADF;
2974
2975         if (hci_bdaddr_list_lookup(list, bdaddr, type))
2976                 return -EEXIST;
2977
2978         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2979         if (!entry)
2980                 return -ENOMEM;
2981
2982         bacpy(&entry->bdaddr, bdaddr);
2983         entry->bdaddr_type = type;
2984
2985         if (peer_irk)
2986                 memcpy(entry->peer_irk, peer_irk, 16);
2987
2988         if (local_irk)
2989                 memcpy(entry->local_irk, local_irk, 16);
2990
2991         list_add(&entry->list, list);
2992
2993         return 0;
2994 }
2995
2996 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2997 {
2998         struct bdaddr_list *entry;
2999
3000         if (!bacmp(bdaddr, BDADDR_ANY)) {
3001                 hci_bdaddr_list_clear(list);
3002                 return 0;
3003         }
3004
3005         entry = hci_bdaddr_list_lookup(list, bdaddr, type);
3006         if (!entry)
3007                 return -ENOENT;
3008
3009         list_del(&entry->list);
3010         kfree(entry);
3011
3012         return 0;
3013 }
3014
3015 int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3016                                                         u8 type)
3017 {
3018         struct bdaddr_list_with_irk *entry;
3019
3020         if (!bacmp(bdaddr, BDADDR_ANY)) {
3021                 hci_bdaddr_list_clear(list);
3022                 return 0;
3023         }
3024
3025         entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
3026         if (!entry)
3027                 return -ENOENT;
3028
3029         list_del(&entry->list);
3030         kfree(entry);
3031
3032         return 0;
3033 }
3034
3035 /* This function requires the caller holds hdev->lock */
3036 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
3037                                                bdaddr_t *addr, u8 addr_type)
3038 {
3039         struct hci_conn_params *params;
3040
3041         list_for_each_entry(params, &hdev->le_conn_params, list) {
3042                 if (bacmp(&params->addr, addr) == 0 &&
3043                     params->addr_type == addr_type) {
3044                         return params;
3045                 }
3046         }
3047
3048         return NULL;
3049 }
3050
3051 /* This function requires the caller holds hdev->lock */
3052 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
3053                                                   bdaddr_t *addr, u8 addr_type)
3054 {
3055         struct hci_conn_params *param;
3056
3057         list_for_each_entry(param, list, action) {
3058                 if (bacmp(&param->addr, addr) == 0 &&
3059                     param->addr_type == addr_type)
3060                         return param;
3061         }
3062
3063         return NULL;
3064 }
3065
3066 /* This function requires the caller holds hdev->lock */
3067 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
3068                                             bdaddr_t *addr, u8 addr_type)
3069 {
3070         struct hci_conn_params *params;
3071
3072         params = hci_conn_params_lookup(hdev, addr, addr_type);
3073         if (params)
3074                 return params;
3075
3076         params = kzalloc(sizeof(*params), GFP_KERNEL);
3077         if (!params) {
3078                 bt_dev_err(hdev, "out of memory");
3079                 return NULL;
3080         }
3081
3082         bacpy(&params->addr, addr);
3083         params->addr_type = addr_type;
3084
3085         list_add(&params->list, &hdev->le_conn_params);
3086         INIT_LIST_HEAD(&params->action);
3087
3088         params->conn_min_interval = hdev->le_conn_min_interval;
3089         params->conn_max_interval = hdev->le_conn_max_interval;
3090         params->conn_latency = hdev->le_conn_latency;
3091         params->supervision_timeout = hdev->le_supv_timeout;
3092         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3093
3094         BT_DBG("addr %pMR (type %u)", addr, addr_type);
3095
3096         return params;
3097 }
3098
3099 static void hci_conn_params_free(struct hci_conn_params *params)
3100 {
3101         if (params->conn) {
3102                 hci_conn_drop(params->conn);
3103                 hci_conn_put(params->conn);
3104         }
3105
3106         list_del(&params->action);
3107         list_del(&params->list);
3108         kfree(params);
3109 }
3110
3111 /* This function requires the caller holds hdev->lock */
3112 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3113 {
3114         struct hci_conn_params *params;
3115
3116         params = hci_conn_params_lookup(hdev, addr, addr_type);
3117         if (!params)
3118                 return;
3119
3120         hci_conn_params_free(params);
3121
3122         hci_update_background_scan(hdev);
3123
3124         BT_DBG("addr %pMR (type %u)", addr, addr_type);
3125 }
3126
3127 /* This function requires the caller holds hdev->lock */
3128 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
3129 {
3130         struct hci_conn_params *params, *tmp;
3131
3132         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3133                 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3134                         continue;
3135
3136                 /* If trying to estabilish one time connection to disabled
3137                  * device, leave the params, but mark them as just once.
3138                  */
3139                 if (params->explicit_connect) {
3140                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3141                         continue;
3142                 }
3143
3144                 list_del(&params->list);
3145                 kfree(params);
3146         }
3147
3148         BT_DBG("All LE disabled connection parameters were removed");
3149 }
3150
3151 /* This function requires the caller holds hdev->lock */
3152 static void hci_conn_params_clear_all(struct hci_dev *hdev)
3153 {
3154         struct hci_conn_params *params, *tmp;
3155
3156         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
3157                 hci_conn_params_free(params);
3158
3159         BT_DBG("All LE connection parameters were removed");
3160 }
3161
3162 /* Copy the Identity Address of the controller.
3163  *
3164  * If the controller has a public BD_ADDR, then by default use that one.
3165  * If this is a LE only controller without a public address, default to
3166  * the static random address.
3167  *
3168  * For debugging purposes it is possible to force controllers with a
3169  * public address to use the static random address instead.
3170  *
3171  * In case BR/EDR has been disabled on a dual-mode controller and
3172  * userspace has configured a static address, then that address
3173  * becomes the identity address instead of the public BR/EDR address.
3174  */
3175 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3176                                u8 *bdaddr_type)
3177 {
3178         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
3179             !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
3180             (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3181              bacmp(&hdev->static_addr, BDADDR_ANY))) {
3182                 bacpy(bdaddr, &hdev->static_addr);
3183                 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3184         } else {
3185                 bacpy(bdaddr, &hdev->bdaddr);
3186                 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3187         }
3188 }
3189
3190 /* Alloc HCI device */
3191 struct hci_dev *hci_alloc_dev(void)
3192 {
3193         struct hci_dev *hdev;
3194
3195         hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3196         if (!hdev)
3197                 return NULL;
3198
3199         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3200         hdev->esco_type = (ESCO_HV1);
3201         hdev->link_mode = (HCI_LM_ACCEPT);
3202         hdev->num_iac = 0x01;           /* One IAC support is mandatory */
3203         hdev->io_capability = 0x03;     /* No Input No Output */
3204         hdev->manufacturer = 0xffff;    /* Default to internal use */
3205         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3206         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3207         hdev->adv_instance_cnt = 0;
3208         hdev->cur_adv_instance = 0x00;
3209         hdev->adv_instance_timeout = 0;
3210
3211         hdev->sniff_max_interval = 800;
3212         hdev->sniff_min_interval = 80;
3213
3214         hdev->le_adv_channel_map = 0x07;
3215         hdev->le_adv_min_interval = 0x0800;
3216         hdev->le_adv_max_interval = 0x0800;
3217         hdev->le_scan_interval = 0x0060;
3218         hdev->le_scan_window = 0x0030;
3219         hdev->le_conn_min_interval = 0x0018;
3220         hdev->le_conn_max_interval = 0x0028;
3221         hdev->le_conn_latency = 0x0000;
3222         hdev->le_supv_timeout = 0x002a;
3223         hdev->le_def_tx_len = 0x001b;
3224         hdev->le_def_tx_time = 0x0148;
3225         hdev->le_max_tx_len = 0x001b;
3226         hdev->le_max_tx_time = 0x0148;
3227         hdev->le_max_rx_len = 0x001b;
3228         hdev->le_max_rx_time = 0x0148;
3229         hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
3230         hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
3231         hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
3232         hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
3233         hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
3234
3235         hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3236         hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3237         hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3238         hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3239         hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
3240         hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
3241
3242         mutex_init(&hdev->lock);
3243         mutex_init(&hdev->req_lock);
3244
3245         INIT_LIST_HEAD(&hdev->mgmt_pending);
3246         INIT_LIST_HEAD(&hdev->blacklist);
3247         INIT_LIST_HEAD(&hdev->whitelist);
3248         INIT_LIST_HEAD(&hdev->uuids);
3249         INIT_LIST_HEAD(&hdev->link_keys);
3250         INIT_LIST_HEAD(&hdev->long_term_keys);
3251         INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3252         INIT_LIST_HEAD(&hdev->remote_oob_data);
3253         INIT_LIST_HEAD(&hdev->le_white_list);
3254         INIT_LIST_HEAD(&hdev->le_resolv_list);
3255         INIT_LIST_HEAD(&hdev->le_conn_params);
3256         INIT_LIST_HEAD(&hdev->pend_le_conns);
3257         INIT_LIST_HEAD(&hdev->pend_le_reports);
3258         INIT_LIST_HEAD(&hdev->conn_hash.list);
3259         INIT_LIST_HEAD(&hdev->adv_instances);
3260
3261         INIT_WORK(&hdev->rx_work, hci_rx_work);
3262         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3263         INIT_WORK(&hdev->tx_work, hci_tx_work);
3264         INIT_WORK(&hdev->power_on, hci_power_on);
3265         INIT_WORK(&hdev->error_reset, hci_error_reset);
3266
3267         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3268
3269         skb_queue_head_init(&hdev->rx_q);
3270         skb_queue_head_init(&hdev->cmd_q);
3271         skb_queue_head_init(&hdev->raw_q);
3272
3273         init_waitqueue_head(&hdev->req_wait_q);
3274
3275         INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3276
3277         hci_request_setup(hdev);
3278
3279         hci_init_sysfs(hdev);
3280         discovery_init(hdev);
3281
3282         return hdev;
3283 }
3284 EXPORT_SYMBOL(hci_alloc_dev);
3285
3286 /* Free HCI device */
3287 void hci_free_dev(struct hci_dev *hdev)
3288 {
3289         /* will free via device release */
3290         put_device(&hdev->dev);
3291 }
3292 EXPORT_SYMBOL(hci_free_dev);
3293
3294 /* Register HCI device */
3295 int hci_register_dev(struct hci_dev *hdev)
3296 {
3297         int id, error;
3298
3299         if (!hdev->open || !hdev->close || !hdev->send)
3300                 return -EINVAL;
3301
3302         /* Do not allow HCI_AMP devices to register at index 0,
3303          * so the index can be used as the AMP controller ID.
3304          */
3305         switch (hdev->dev_type) {
3306         case HCI_PRIMARY:
3307                 id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
3308                 break;
3309         case HCI_AMP:
3310                 id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
3311                 break;
3312         default:
3313                 return -EINVAL;
3314         }
3315
3316         if (id < 0)
3317                 return id;
3318
3319         snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
3320         hdev->id = id;
3321
3322         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3323
3324         hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
3325         if (!hdev->workqueue) {
3326                 error = -ENOMEM;
3327                 goto err;
3328         }
3329
3330         hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
3331                                                       hdev->name);
3332         if (!hdev->req_workqueue) {
3333                 destroy_workqueue(hdev->workqueue);
3334                 error = -ENOMEM;
3335                 goto err;
3336         }
3337
3338         if (!IS_ERR_OR_NULL(bt_debugfs))
3339                 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3340
3341         dev_set_name(&hdev->dev, "%s", hdev->name);
3342
3343         error = device_add(&hdev->dev);
3344         if (error < 0)
3345                 goto err_wqueue;
3346
3347         hci_leds_init(hdev);
3348
3349         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3350                                     RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3351                                     hdev);
3352         if (hdev->rfkill) {
3353                 if (rfkill_register(hdev->rfkill) < 0) {
3354                         rfkill_destroy(hdev->rfkill);
3355                         hdev->rfkill = NULL;
3356                 }
3357         }
3358
3359         if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3360                 hci_dev_set_flag(hdev, HCI_RFKILLED);
3361
3362         hci_dev_set_flag(hdev, HCI_SETUP);
3363         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3364
3365         if (hdev->dev_type == HCI_PRIMARY) {
3366                 /* Assume BR/EDR support until proven otherwise (such as
3367                  * through reading supported features during init.
3368                  */
3369                 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3370         }
3371
3372         write_lock(&hci_dev_list_lock);
3373         list_add(&hdev->list, &hci_dev_list);
3374         write_unlock(&hci_dev_list_lock);
3375
3376         /* Devices that are marked for raw-only usage are unconfigured
3377          * and should not be included in normal operation.
3378          */
3379         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3380                 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3381
3382         hci_sock_dev_event(hdev, HCI_DEV_REG);
3383         hci_dev_hold(hdev);
3384
3385         queue_work(hdev->req_workqueue, &hdev->power_on);
3386
3387         return id;
3388
3389 err_wqueue:
3390         debugfs_remove_recursive(hdev->debugfs);
3391         destroy_workqueue(hdev->workqueue);
3392         destroy_workqueue(hdev->req_workqueue);
3393 err:
3394         ida_simple_remove(&hci_index_ida, hdev->id);
3395
3396         return error;
3397 }
3398 EXPORT_SYMBOL(hci_register_dev);
3399
3400 /* Unregister HCI device */
3401 void hci_unregister_dev(struct hci_dev *hdev)
3402 {
3403         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3404
3405         hci_dev_set_flag(hdev, HCI_UNREGISTER);
3406
3407         write_lock(&hci_dev_list_lock);
3408         list_del(&hdev->list);
3409         write_unlock(&hci_dev_list_lock);
3410
3411         cancel_work_sync(&hdev->power_on);
3412
3413         hci_dev_do_close(hdev);
3414
3415         if (!test_bit(HCI_INIT, &hdev->flags) &&
3416             !hci_dev_test_flag(hdev, HCI_SETUP) &&
3417             !hci_dev_test_flag(hdev, HCI_CONFIG)) {
3418                 hci_dev_lock(hdev);
3419                 mgmt_index_removed(hdev);
3420                 hci_dev_unlock(hdev);
3421         }
3422
3423         /* mgmt_index_removed should take care of emptying the
3424          * pending list */
3425         BUG_ON(!list_empty(&hdev->mgmt_pending));
3426
3427         hci_sock_dev_event(hdev, HCI_DEV_UNREG);
3428
3429         if (hdev->rfkill) {
3430                 rfkill_unregister(hdev->rfkill);
3431                 rfkill_destroy(hdev->rfkill);
3432         }
3433
3434         device_del(&hdev->dev);
3435         /* Actual cleanup is deferred until hci_cleanup_dev(). */
3436         hci_dev_put(hdev);
3437 }
3438 EXPORT_SYMBOL(hci_unregister_dev);
3439
3440 /* Cleanup HCI device */
3441 void hci_cleanup_dev(struct hci_dev *hdev)
3442 {
3443         debugfs_remove_recursive(hdev->debugfs);
3444         kfree_const(hdev->hw_info);
3445         kfree_const(hdev->fw_info);
3446
3447         destroy_workqueue(hdev->workqueue);
3448         destroy_workqueue(hdev->req_workqueue);
3449
3450         hci_dev_lock(hdev);
3451         hci_bdaddr_list_clear(&hdev->blacklist);
3452         hci_bdaddr_list_clear(&hdev->whitelist);
3453         hci_uuids_clear(hdev);
3454         hci_link_keys_clear(hdev);
3455         hci_smp_ltks_clear(hdev);
3456         hci_smp_irks_clear(hdev);
3457         hci_remote_oob_data_clear(hdev);
3458         hci_adv_instances_clear(hdev);
3459         hci_bdaddr_list_clear(&hdev->le_white_list);
3460         hci_bdaddr_list_clear(&hdev->le_resolv_list);
3461         hci_conn_params_clear_all(hdev);
3462         hci_discovery_filter_clear(hdev);
3463         hci_dev_unlock(hdev);
3464
3465         ida_simple_remove(&hci_index_ida, hdev->id);
3466 }
3467
3468 /* Suspend HCI device */
3469 int hci_suspend_dev(struct hci_dev *hdev)
3470 {
3471         hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
3472         return 0;
3473 }
3474 EXPORT_SYMBOL(hci_suspend_dev);
3475
3476 /* Resume HCI device */
3477 int hci_resume_dev(struct hci_dev *hdev)
3478 {
3479         hci_sock_dev_event(hdev, HCI_DEV_RESUME);
3480         return 0;
3481 }
3482 EXPORT_SYMBOL(hci_resume_dev);
3483
3484 /* Reset HCI device */
3485 int hci_reset_dev(struct hci_dev *hdev)
3486 {
3487         static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3488         struct sk_buff *skb;
3489
3490         skb = bt_skb_alloc(3, GFP_ATOMIC);
3491         if (!skb)
3492                 return -ENOMEM;
3493
3494         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
3495         skb_put_data(skb, hw_err, 3);
3496
3497         /* Send Hardware Error to upper stack */
3498         return hci_recv_frame(hdev, skb);
3499 }
3500 EXPORT_SYMBOL(hci_reset_dev);
3501
3502 /* Receive frame from HCI drivers */
3503 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
3504 {
3505         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
3506                       && !test_bit(HCI_INIT, &hdev->flags))) {
3507                 kfree_skb(skb);
3508                 return -ENXIO;
3509         }
3510
3511         if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
3512             hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
3513             hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
3514                 kfree_skb(skb);
3515                 return -EINVAL;
3516         }
3517
3518         /* Incoming skb */
3519         bt_cb(skb)->incoming = 1;
3520
3521         /* Time stamp */
3522         __net_timestamp(skb);
3523
3524         skb_queue_tail(&hdev->rx_q, skb);
3525         queue_work(hdev->workqueue, &hdev->rx_work);
3526
3527         return 0;
3528 }
3529 EXPORT_SYMBOL(hci_recv_frame);
3530
3531 /* Receive diagnostic message from HCI drivers */
3532 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
3533 {
3534         /* Mark as diagnostic packet */
3535         hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
3536
3537         /* Time stamp */
3538         __net_timestamp(skb);
3539
3540         skb_queue_tail(&hdev->rx_q, skb);
3541         queue_work(hdev->workqueue, &hdev->rx_work);
3542
3543         return 0;
3544 }
3545 EXPORT_SYMBOL(hci_recv_diag);
3546
3547 void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
3548 {
3549         va_list vargs;
3550
3551         va_start(vargs, fmt);
3552         kfree_const(hdev->hw_info);
3553         hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3554         va_end(vargs);
3555 }
3556 EXPORT_SYMBOL(hci_set_hw_info);
3557
3558 void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
3559 {
3560         va_list vargs;
3561
3562         va_start(vargs, fmt);
3563         kfree_const(hdev->fw_info);
3564         hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3565         va_end(vargs);
3566 }
3567 EXPORT_SYMBOL(hci_set_fw_info);
3568
3569 /* ---- Interface to upper protocols ---- */
3570
3571 int hci_register_cb(struct hci_cb *cb)
3572 {
3573         BT_DBG("%p name %s", cb, cb->name);
3574
3575         mutex_lock(&hci_cb_list_lock);
3576         list_add_tail(&cb->list, &hci_cb_list);
3577         mutex_unlock(&hci_cb_list_lock);
3578
3579         return 0;
3580 }
3581 EXPORT_SYMBOL(hci_register_cb);
3582
3583 int hci_unregister_cb(struct hci_cb *cb)
3584 {
3585         BT_DBG("%p name %s", cb, cb->name);
3586
3587         mutex_lock(&hci_cb_list_lock);
3588         list_del(&cb->list);
3589         mutex_unlock(&hci_cb_list_lock);
3590
3591         return 0;
3592 }
3593 EXPORT_SYMBOL(hci_unregister_cb);
3594
3595 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
3596 {
3597         int err;
3598
3599         BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3600                skb->len);
3601
3602         /* Time stamp */
3603         __net_timestamp(skb);
3604
3605         /* Send copy to monitor */
3606         hci_send_to_monitor(hdev, skb);
3607
3608         if (atomic_read(&hdev->promisc)) {
3609                 /* Send copy to the sockets */
3610                 hci_send_to_sock(hdev, skb);
3611         }
3612
3613         /* Get rid of skb owner, prior to sending to the driver. */
3614         skb_orphan(skb);
3615
3616         if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3617                 kfree_skb(skb);
3618                 return;
3619         }
3620
3621         err = hdev->send(hdev, skb);
3622         if (err < 0) {
3623                 bt_dev_err(hdev, "sending frame failed (%d)", err);
3624                 kfree_skb(skb);
3625         }
3626 }
3627
3628 /* Send HCI command */
3629 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3630                  const void *param)
3631 {
3632         struct sk_buff *skb;
3633
3634         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3635
3636         skb = hci_prepare_cmd(hdev, opcode, plen, param);
3637         if (!skb) {
3638                 bt_dev_err(hdev, "no memory for command");
3639                 return -ENOMEM;
3640         }
3641
3642         /* Stand-alone HCI commands must be flagged as
3643          * single-command requests.
3644          */
3645         bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
3646
3647         skb_queue_tail(&hdev->cmd_q, skb);
3648         queue_work(hdev->workqueue, &hdev->cmd_work);
3649
3650         return 0;
3651 }
3652
3653 int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
3654                    const void *param)
3655 {
3656         struct sk_buff *skb;
3657
3658         if (hci_opcode_ogf(opcode) != 0x3f) {
3659                 /* A controller receiving a command shall respond with either
3660                  * a Command Status Event or a Command Complete Event.
3661                  * Therefore, all standard HCI commands must be sent via the
3662                  * standard API, using hci_send_cmd or hci_cmd_sync helpers.
3663                  * Some vendors do not comply with this rule for vendor-specific
3664                  * commands and do not return any event. We want to support
3665                  * unresponded commands for such cases only.
3666                  */
3667                 bt_dev_err(hdev, "unresponded command not supported");
3668                 return -EINVAL;
3669         }
3670
3671         skb = hci_prepare_cmd(hdev, opcode, plen, param);
3672         if (!skb) {
3673                 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
3674                            opcode);
3675                 return -ENOMEM;
3676         }
3677
3678         hci_send_frame(hdev, skb);
3679
3680         return 0;
3681 }
3682 EXPORT_SYMBOL(__hci_cmd_send);
3683
3684 /* Get data from the previously sent command */
3685 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
3686 {
3687         struct hci_command_hdr *hdr;
3688
3689         if (!hdev->sent_cmd)
3690                 return NULL;
3691
3692         hdr = (void *) hdev->sent_cmd->data;
3693
3694         if (hdr->opcode != cpu_to_le16(opcode))
3695                 return NULL;
3696
3697         BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3698
3699         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3700 }
3701
3702 /* Send HCI command and wait for command commplete event */
3703 struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
3704                              const void *param, u32 timeout)
3705 {
3706         struct sk_buff *skb;
3707
3708         if (!test_bit(HCI_UP, &hdev->flags))
3709                 return ERR_PTR(-ENETDOWN);
3710
3711         bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
3712
3713         hci_req_sync_lock(hdev);
3714         skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
3715         hci_req_sync_unlock(hdev);
3716
3717         return skb;
3718 }
3719 EXPORT_SYMBOL(hci_cmd_sync);
3720
3721 /* Send ACL data */
3722 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3723 {
3724         struct hci_acl_hdr *hdr;
3725         int len = skb->len;
3726
3727         skb_push(skb, HCI_ACL_HDR_SIZE);
3728         skb_reset_transport_header(skb);
3729         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3730         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3731         hdr->dlen   = cpu_to_le16(len);
3732 }
3733
3734 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
3735                           struct sk_buff *skb, __u16 flags)
3736 {
3737         struct hci_conn *conn = chan->conn;
3738         struct hci_dev *hdev = conn->hdev;
3739         struct sk_buff *list;
3740
3741         skb->len = skb_headlen(skb);
3742         skb->data_len = 0;
3743
3744         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3745
3746         switch (hdev->dev_type) {
3747         case HCI_PRIMARY:
3748                 hci_add_acl_hdr(skb, conn->handle, flags);
3749                 break;
3750         case HCI_AMP:
3751                 hci_add_acl_hdr(skb, chan->handle, flags);
3752                 break;
3753         default:
3754                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3755                 return;
3756         }
3757
3758         list = skb_shinfo(skb)->frag_list;
3759         if (!list) {
3760                 /* Non fragmented */
3761                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3762
3763                 skb_queue_tail(queue, skb);
3764         } else {
3765                 /* Fragmented */
3766                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3767
3768                 skb_shinfo(skb)->frag_list = NULL;
3769
3770                 /* Queue all fragments atomically. We need to use spin_lock_bh
3771                  * here because of 6LoWPAN links, as there this function is
3772                  * called from softirq and using normal spin lock could cause
3773                  * deadlocks.
3774                  */
3775                 spin_lock_bh(&queue->lock);
3776
3777                 __skb_queue_tail(queue, skb);
3778
3779                 flags &= ~ACL_START;
3780                 flags |= ACL_CONT;
3781                 do {
3782                         skb = list; list = list->next;
3783
3784                         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3785                         hci_add_acl_hdr(skb, conn->handle, flags);
3786
3787                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3788
3789                         __skb_queue_tail(queue, skb);
3790                 } while (list);
3791
3792                 spin_unlock_bh(&queue->lock);
3793         }
3794 }
3795
3796 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3797 {
3798         struct hci_dev *hdev = chan->conn->hdev;
3799
3800         BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
3801
3802         hci_queue_acl(chan, &chan->data_q, skb, flags);
3803
3804         queue_work(hdev->workqueue, &hdev->tx_work);
3805 }
3806
3807 /* Send SCO data */
3808 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
3809 {
3810         struct hci_dev *hdev = conn->hdev;
3811         struct hci_sco_hdr hdr;
3812
3813         BT_DBG("%s len %d", hdev->name, skb->len);
3814
3815         hdr.handle = cpu_to_le16(conn->handle);
3816         hdr.dlen   = skb->len;
3817
3818         skb_push(skb, HCI_SCO_HDR_SIZE);
3819         skb_reset_transport_header(skb);
3820         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
3821
3822         hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
3823
3824         skb_queue_tail(&conn->data_q, skb);
3825         queue_work(hdev->workqueue, &hdev->tx_work);
3826 }
3827
3828 /* ---- HCI TX task (outgoing data) ---- */
3829
3830 /* HCI Connection scheduler */
3831 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3832                                      int *quote)
3833 {
3834         struct hci_conn_hash *h = &hdev->conn_hash;
3835         struct hci_conn *conn = NULL, *c;
3836         unsigned int num = 0, min = ~0;
3837
3838         /* We don't have to lock device here. Connections are always
3839          * added and removed with TX task disabled. */
3840
3841         rcu_read_lock();
3842
3843         list_for_each_entry_rcu(c, &h->list, list) {
3844                 if (c->type != type || skb_queue_empty(&c->data_q))
3845                         continue;
3846
3847                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3848                         continue;
3849
3850                 num++;
3851
3852                 if (c->sent < min) {
3853                         min  = c->sent;
3854                         conn = c;
3855                 }
3856
3857                 if (hci_conn_num(hdev, type) == num)
3858                         break;
3859         }
3860
3861         rcu_read_unlock();
3862
3863         if (conn) {
3864                 int cnt, q;
3865
3866                 switch (conn->type) {
3867                 case ACL_LINK:
3868                         cnt = hdev->acl_cnt;
3869                         break;
3870                 case SCO_LINK:
3871                 case ESCO_LINK:
3872                         cnt = hdev->sco_cnt;
3873                         break;
3874                 case LE_LINK:
3875                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3876                         break;
3877                 default:
3878                         cnt = 0;
3879                         bt_dev_err(hdev, "unknown link type %d", conn->type);
3880                 }
3881
3882                 q = cnt / num;
3883                 *quote = q ? q : 1;
3884         } else
3885                 *quote = 0;
3886
3887         BT_DBG("conn %p quote %d", conn, *quote);
3888         return conn;
3889 }
3890
3891 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
3892 {
3893         struct hci_conn_hash *h = &hdev->conn_hash;
3894         struct hci_conn *c;
3895
3896         bt_dev_err(hdev, "link tx timeout");
3897
3898         rcu_read_lock();
3899
3900         /* Kill stalled connections */
3901         list_for_each_entry_rcu(c, &h->list, list) {
3902                 if (c->type == type && c->sent) {
3903                         bt_dev_err(hdev, "killing stalled connection %pMR",
3904                                    &c->dst);
3905                         hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3906                 }
3907         }
3908
3909         rcu_read_unlock();
3910 }
3911
3912 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3913                                       int *quote)
3914 {
3915         struct hci_conn_hash *h = &hdev->conn_hash;
3916         struct hci_chan *chan = NULL;
3917         unsigned int num = 0, min = ~0, cur_prio = 0;
3918         struct hci_conn *conn;
3919         int cnt, q, conn_num = 0;
3920
3921         BT_DBG("%s", hdev->name);
3922
3923         rcu_read_lock();
3924
3925         list_for_each_entry_rcu(conn, &h->list, list) {
3926                 struct hci_chan *tmp;
3927
3928                 if (conn->type != type)
3929                         continue;
3930
3931                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3932                         continue;
3933
3934                 conn_num++;
3935
3936                 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
3937                         struct sk_buff *skb;
3938
3939                         if (skb_queue_empty(&tmp->data_q))
3940                                 continue;
3941
3942                         skb = skb_peek(&tmp->data_q);
3943                         if (skb->priority < cur_prio)
3944                                 continue;
3945
3946                         if (skb->priority > cur_prio) {
3947                                 num = 0;
3948                                 min = ~0;
3949                                 cur_prio = skb->priority;
3950                         }
3951
3952                         num++;
3953
3954                         if (conn->sent < min) {
3955                                 min  = conn->sent;
3956                                 chan = tmp;
3957                         }
3958                 }
3959
3960                 if (hci_conn_num(hdev, type) == conn_num)
3961                         break;
3962         }
3963
3964         rcu_read_unlock();
3965
3966         if (!chan)
3967                 return NULL;
3968
3969         switch (chan->conn->type) {
3970         case ACL_LINK:
3971                 cnt = hdev->acl_cnt;
3972                 break;
3973         case AMP_LINK:
3974                 cnt = hdev->block_cnt;
3975                 break;
3976         case SCO_LINK:
3977         case ESCO_LINK:
3978                 cnt = hdev->sco_cnt;
3979                 break;
3980         case LE_LINK:
3981                 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3982                 break;
3983         default:
3984                 cnt = 0;
3985                 bt_dev_err(hdev, "unknown link type %d", chan->conn->type);
3986         }
3987
3988         q = cnt / num;
3989         *quote = q ? q : 1;
3990         BT_DBG("chan %p quote %d", chan, *quote);
3991         return chan;
3992 }
3993
3994 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3995 {
3996         struct hci_conn_hash *h = &hdev->conn_hash;
3997         struct hci_conn *conn;
3998         int num = 0;
3999
4000         BT_DBG("%s", hdev->name);
4001
4002         rcu_read_lock();
4003
4004         list_for_each_entry_rcu(conn, &h->list, list) {
4005                 struct hci_chan *chan;
4006
4007                 if (conn->type != type)
4008                         continue;
4009
4010                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4011                         continue;
4012
4013                 num++;
4014
4015                 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
4016                         struct sk_buff *skb;
4017
4018                         if (chan->sent) {
4019                                 chan->sent = 0;
4020                                 continue;
4021                         }
4022
4023                         if (skb_queue_empty(&chan->data_q))
4024                                 continue;
4025
4026                         skb = skb_peek(&chan->data_q);
4027                         if (skb->priority >= HCI_PRIO_MAX - 1)
4028                                 continue;
4029
4030                         skb->priority = HCI_PRIO_MAX - 1;
4031
4032                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
4033                                skb->priority);
4034                 }
4035
4036                 if (hci_conn_num(hdev, type) == num)
4037                         break;
4038         }
4039
4040         rcu_read_unlock();
4041
4042 }
4043
4044 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
4045 {
4046         /* Calculate count of blocks used by this packet */
4047         return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
4048 }
4049
4050 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
4051 {
4052         if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
4053                 /* ACL tx timeout must be longer than maximum
4054                  * link supervision timeout (40.9 seconds) */
4055                 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
4056                                        HCI_ACL_TX_TIMEOUT))
4057                         hci_link_tx_to(hdev, ACL_LINK);
4058         }
4059 }
4060
4061 static void hci_sched_acl_pkt(struct hci_dev *hdev)
4062 {
4063         unsigned int cnt = hdev->acl_cnt;
4064         struct hci_chan *chan;
4065         struct sk_buff *skb;
4066         int quote;
4067
4068         __check_timeout(hdev, cnt);
4069
4070         while (hdev->acl_cnt &&
4071                (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
4072                 u32 priority = (skb_peek(&chan->data_q))->priority;
4073                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4074                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4075                                skb->len, skb->priority);
4076
4077                         /* Stop if priority has changed */
4078                         if (skb->priority < priority)
4079                                 break;
4080
4081                         skb = skb_dequeue(&chan->data_q);
4082
4083                         hci_conn_enter_active_mode(chan->conn,
4084                                                    bt_cb(skb)->force_active);
4085
4086                         hci_send_frame(hdev, skb);
4087                         hdev->acl_last_tx = jiffies;
4088
4089                         hdev->acl_cnt--;
4090                         chan->sent++;
4091                         chan->conn->sent++;
4092                 }
4093         }
4094
4095         if (cnt != hdev->acl_cnt)
4096                 hci_prio_recalculate(hdev, ACL_LINK);
4097 }
4098
4099 static void hci_sched_acl_blk(struct hci_dev *hdev)
4100 {
4101         unsigned int cnt = hdev->block_cnt;
4102         struct hci_chan *chan;
4103         struct sk_buff *skb;
4104         int quote;
4105         u8 type;
4106
4107         __check_timeout(hdev, cnt);
4108
4109         BT_DBG("%s", hdev->name);
4110
4111         if (hdev->dev_type == HCI_AMP)
4112                 type = AMP_LINK;
4113         else
4114                 type = ACL_LINK;
4115
4116         while (hdev->block_cnt > 0 &&
4117                (chan = hci_chan_sent(hdev, type, &quote))) {
4118                 u32 priority = (skb_peek(&chan->data_q))->priority;
4119                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
4120                         int blocks;
4121
4122                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4123                                skb->len, skb->priority);
4124
4125                         /* Stop if priority has changed */
4126                         if (skb->priority < priority)
4127                                 break;
4128
4129                         skb = skb_dequeue(&chan->data_q);
4130
4131                         blocks = __get_blocks(hdev, skb);
4132                         if (blocks > hdev->block_cnt)
4133                                 return;
4134
4135                         hci_conn_enter_active_mode(chan->conn,
4136                                                    bt_cb(skb)->force_active);
4137
4138                         hci_send_frame(hdev, skb);
4139                         hdev->acl_last_tx = jiffies;
4140
4141                         hdev->block_cnt -= blocks;
4142                         quote -= blocks;
4143
4144                         chan->sent += blocks;
4145                         chan->conn->sent += blocks;
4146                 }
4147         }
4148
4149         if (cnt != hdev->block_cnt)
4150                 hci_prio_recalculate(hdev, type);
4151 }
4152
4153 static void hci_sched_acl(struct hci_dev *hdev)
4154 {
4155         BT_DBG("%s", hdev->name);
4156
4157         /* No ACL link over BR/EDR controller */
4158         if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
4159                 return;
4160
4161         /* No AMP link over AMP controller */
4162         if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4163                 return;
4164
4165         switch (hdev->flow_ctl_mode) {
4166         case HCI_FLOW_CTL_MODE_PACKET_BASED:
4167                 hci_sched_acl_pkt(hdev);
4168                 break;
4169
4170         case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4171                 hci_sched_acl_blk(hdev);
4172                 break;
4173         }
4174 }
4175
4176 /* Schedule SCO */
4177 static void hci_sched_sco(struct hci_dev *hdev)
4178 {
4179         struct hci_conn *conn;
4180         struct sk_buff *skb;
4181         int quote;
4182
4183         BT_DBG("%s", hdev->name);
4184
4185         if (!hci_conn_num(hdev, SCO_LINK))
4186                 return;
4187
4188         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
4189                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4190                         BT_DBG("skb %p len %d", skb, skb->len);
4191                         hci_send_frame(hdev, skb);
4192
4193                         conn->sent++;
4194                         if (conn->sent == ~0)
4195                                 conn->sent = 0;
4196                 }
4197         }
4198 }
4199
4200 static void hci_sched_esco(struct hci_dev *hdev)
4201 {
4202         struct hci_conn *conn;
4203         struct sk_buff *skb;
4204         int quote;
4205
4206         BT_DBG("%s", hdev->name);
4207
4208         if (!hci_conn_num(hdev, ESCO_LINK))
4209                 return;
4210
4211         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4212                                                      &quote))) {
4213                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4214                         BT_DBG("skb %p len %d", skb, skb->len);
4215                         hci_send_frame(hdev, skb);
4216
4217                         conn->sent++;
4218                         if (conn->sent == ~0)
4219                                 conn->sent = 0;
4220                 }
4221         }
4222 }
4223
4224 static void hci_sched_le(struct hci_dev *hdev)
4225 {
4226         struct hci_chan *chan;
4227         struct sk_buff *skb;
4228         int quote, cnt, tmp;
4229
4230         BT_DBG("%s", hdev->name);
4231
4232         if (!hci_conn_num(hdev, LE_LINK))
4233                 return;
4234
4235         if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
4236                 /* LE tx timeout must be longer than maximum
4237                  * link supervision timeout (40.9 seconds) */
4238                 if (!hdev->le_cnt && hdev->le_pkts &&
4239                     time_after(jiffies, hdev->le_last_tx + HZ * 45))
4240                         hci_link_tx_to(hdev, LE_LINK);
4241         }
4242
4243         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
4244         tmp = cnt;
4245         while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
4246                 u32 priority = (skb_peek(&chan->data_q))->priority;
4247                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4248                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4249                                skb->len, skb->priority);
4250
4251                         /* Stop if priority has changed */
4252                         if (skb->priority < priority)
4253                                 break;
4254
4255                         skb = skb_dequeue(&chan->data_q);
4256
4257                         hci_send_frame(hdev, skb);
4258                         hdev->le_last_tx = jiffies;
4259
4260                         cnt--;
4261                         chan->sent++;
4262                         chan->conn->sent++;
4263                 }
4264         }
4265
4266         if (hdev->le_pkts)
4267                 hdev->le_cnt = cnt;
4268         else
4269                 hdev->acl_cnt = cnt;
4270
4271         if (cnt != tmp)
4272                 hci_prio_recalculate(hdev, LE_LINK);
4273 }
4274
4275 static void hci_tx_work(struct work_struct *work)
4276 {
4277         struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
4278         struct sk_buff *skb;
4279
4280         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
4281                hdev->sco_cnt, hdev->le_cnt);
4282
4283         if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4284                 /* Schedule queues and send stuff to HCI driver */
4285                 hci_sched_acl(hdev);
4286                 hci_sched_sco(hdev);
4287                 hci_sched_esco(hdev);
4288                 hci_sched_le(hdev);
4289         }
4290
4291         /* Send next queued raw (unknown type) packet */
4292         while ((skb = skb_dequeue(&hdev->raw_q)))
4293                 hci_send_frame(hdev, skb);
4294 }
4295
4296 /* ----- HCI RX task (incoming data processing) ----- */
4297
4298 /* ACL data packet */
4299 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4300 {
4301         struct hci_acl_hdr *hdr = (void *) skb->data;
4302         struct hci_conn *conn;
4303         __u16 handle, flags;
4304
4305         skb_pull(skb, HCI_ACL_HDR_SIZE);
4306
4307         handle = __le16_to_cpu(hdr->handle);
4308         flags  = hci_flags(handle);
4309         handle = hci_handle(handle);
4310
4311         BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4312                handle, flags);
4313
4314         hdev->stat.acl_rx++;
4315
4316         hci_dev_lock(hdev);
4317         conn = hci_conn_hash_lookup_handle(hdev, handle);
4318         hci_dev_unlock(hdev);
4319
4320         if (conn) {
4321                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
4322
4323                 /* Send to upper protocol */
4324                 l2cap_recv_acldata(conn, skb, flags);
4325                 return;
4326         } else {
4327                 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
4328                            handle);
4329         }
4330
4331         kfree_skb(skb);
4332 }
4333
4334 /* SCO data packet */
4335 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4336 {
4337         struct hci_sco_hdr *hdr = (void *) skb->data;
4338         struct hci_conn *conn;
4339         __u16 handle;
4340
4341         skb_pull(skb, HCI_SCO_HDR_SIZE);
4342
4343         handle = __le16_to_cpu(hdr->handle);
4344
4345         BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
4346
4347         hdev->stat.sco_rx++;
4348
4349         hci_dev_lock(hdev);
4350         conn = hci_conn_hash_lookup_handle(hdev, handle);
4351         hci_dev_unlock(hdev);
4352
4353         if (conn) {
4354                 /* Send to upper protocol */
4355                 sco_recv_scodata(conn, skb);
4356                 return;
4357         } else {
4358                 bt_dev_err(hdev, "SCO packet for unknown connection handle %d",
4359                            handle);
4360         }
4361
4362         kfree_skb(skb);
4363 }
4364
4365 static bool hci_req_is_complete(struct hci_dev *hdev)
4366 {
4367         struct sk_buff *skb;
4368
4369         skb = skb_peek(&hdev->cmd_q);
4370         if (!skb)
4371                 return true;
4372
4373         return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
4374 }
4375
4376 static void hci_resend_last(struct hci_dev *hdev)
4377 {
4378         struct hci_command_hdr *sent;
4379         struct sk_buff *skb;
4380         u16 opcode;
4381
4382         if (!hdev->sent_cmd)
4383                 return;
4384
4385         sent = (void *) hdev->sent_cmd->data;
4386         opcode = __le16_to_cpu(sent->opcode);
4387         if (opcode == HCI_OP_RESET)
4388                 return;
4389
4390         skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4391         if (!skb)
4392                 return;
4393
4394         skb_queue_head(&hdev->cmd_q, skb);
4395         queue_work(hdev->workqueue, &hdev->cmd_work);
4396 }
4397
4398 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4399                           hci_req_complete_t *req_complete,
4400                           hci_req_complete_skb_t *req_complete_skb)
4401 {
4402         struct sk_buff *skb;
4403         unsigned long flags;
4404
4405         BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4406
4407         /* If the completed command doesn't match the last one that was
4408          * sent we need to do special handling of it.
4409          */
4410         if (!hci_sent_cmd_data(hdev, opcode)) {
4411                 /* Some CSR based controllers generate a spontaneous
4412                  * reset complete event during init and any pending
4413                  * command will never be completed. In such a case we
4414                  * need to resend whatever was the last sent
4415                  * command.
4416                  */
4417                 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4418                         hci_resend_last(hdev);
4419
4420                 return;
4421         }
4422
4423         /* If we reach this point this event matches the last command sent */
4424         hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
4425
4426         /* If the command succeeded and there's still more commands in
4427          * this request the request is not yet complete.
4428          */
4429         if (!status && !hci_req_is_complete(hdev))
4430                 return;
4431
4432         /* If this was the last command in a request the complete
4433          * callback would be found in hdev->sent_cmd instead of the
4434          * command queue (hdev->cmd_q).
4435          */
4436         if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4437                 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
4438                 return;
4439         }
4440
4441         if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4442                 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
4443                 return;
4444         }
4445
4446         /* Remove all pending commands belonging to this request */
4447         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4448         while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4449                 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
4450                         __skb_queue_head(&hdev->cmd_q, skb);
4451                         break;
4452                 }
4453
4454                 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4455                         *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4456                 else
4457                         *req_complete = bt_cb(skb)->hci.req_complete;
4458                 kfree_skb(skb);
4459         }
4460         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4461 }
4462
4463 static void hci_rx_work(struct work_struct *work)
4464 {
4465         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
4466         struct sk_buff *skb;
4467
4468         BT_DBG("%s", hdev->name);
4469
4470         while ((skb = skb_dequeue(&hdev->rx_q))) {
4471                 /* Send copy to monitor */
4472                 hci_send_to_monitor(hdev, skb);
4473
4474                 if (atomic_read(&hdev->promisc)) {
4475                         /* Send copy to the sockets */
4476                         hci_send_to_sock(hdev, skb);
4477                 }
4478
4479                 /* If the device has been opened in HCI_USER_CHANNEL,
4480                  * the userspace has exclusive access to device.
4481                  * When device is HCI_INIT, we still need to process
4482                  * the data packets to the driver in order
4483                  * to complete its setup().
4484                  */
4485                 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4486                     !test_bit(HCI_INIT, &hdev->flags)) {
4487                         kfree_skb(skb);
4488                         continue;
4489                 }
4490
4491                 if (test_bit(HCI_INIT, &hdev->flags)) {
4492                         /* Don't process data packets in this states. */
4493                         switch (hci_skb_pkt_type(skb)) {
4494                         case HCI_ACLDATA_PKT:
4495                         case HCI_SCODATA_PKT:
4496                                 kfree_skb(skb);
4497                                 continue;
4498                         }
4499                 }
4500
4501                 /* Process frame */
4502                 switch (hci_skb_pkt_type(skb)) {
4503                 case HCI_EVENT_PKT:
4504                         BT_DBG("%s Event packet", hdev->name);
4505                         hci_event_packet(hdev, skb);
4506                         break;
4507
4508                 case HCI_ACLDATA_PKT:
4509                         BT_DBG("%s ACL data packet", hdev->name);
4510                         hci_acldata_packet(hdev, skb);
4511                         break;
4512
4513                 case HCI_SCODATA_PKT:
4514                         BT_DBG("%s SCO data packet", hdev->name);
4515                         hci_scodata_packet(hdev, skb);
4516                         break;
4517
4518                 default:
4519                         kfree_skb(skb);
4520                         break;
4521                 }
4522         }
4523 }
4524
4525 static void hci_cmd_work(struct work_struct *work)
4526 {
4527         struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4528         struct sk_buff *skb;
4529
4530         BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4531                atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4532
4533         /* Send queued commands */
4534         if (atomic_read(&hdev->cmd_cnt)) {
4535                 skb = skb_dequeue(&hdev->cmd_q);
4536                 if (!skb)
4537                         return;
4538
4539                 kfree_skb(hdev->sent_cmd);
4540
4541                 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4542                 if (hdev->sent_cmd) {
4543                         if (hci_req_status_pend(hdev))
4544                                 hci_dev_set_flag(hdev, HCI_CMD_PENDING);
4545                         atomic_dec(&hdev->cmd_cnt);
4546                         hci_send_frame(hdev, skb);
4547                         if (test_bit(HCI_RESET, &hdev->flags))
4548                                 cancel_delayed_work(&hdev->cmd_timer);
4549                         else
4550                                 schedule_delayed_work(&hdev->cmd_timer,
4551                                                       HCI_CMD_TIMEOUT);
4552                 } else {
4553                         skb_queue_head(&hdev->cmd_q, skb);
4554                         queue_work(hdev->workqueue, &hdev->cmd_work);
4555                 }
4556         }
4557 }