~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

TOMOYO Linux Cross Reference
Linux/net/bluetooth/hci_core.c

Version: ~ [ linux-6.2-rc3 ] ~ [ linux-6.1.5 ] ~ [ linux-6.0.19 ] ~ [ linux-5.19.17 ] ~ [ linux-5.18.19 ] ~ [ linux-5.17.15 ] ~ [ linux-5.16.20 ] ~ [ linux-5.15.87 ] ~ [ linux-5.14.21 ] ~ [ linux-5.13.19 ] ~ [ linux-5.12.19 ] ~ [ linux-5.11.22 ] ~ [ linux-5.10.162 ] ~ [ linux-5.9.16 ] ~ [ linux-5.8.18 ] ~ [ linux-5.7.19 ] ~ [ linux-5.6.19 ] ~ [ linux-5.5.19 ] ~ [ linux-5.4.228 ] ~ [ linux-5.3.18 ] ~ [ linux-5.2.21 ] ~ [ linux-5.1.21 ] ~ [ linux-5.0.21 ] ~ [ linux-4.20.17 ] ~ [ linux-4.19.269 ] ~ [ linux-4.18.20 ] ~ [ linux-4.17.19 ] ~ [ linux-4.16.18 ] ~ [ linux-4.15.18 ] ~ [ linux-4.14.302 ] ~ [ linux-4.13.16 ] ~ [ linux-4.12.14 ] ~ [ linux-4.11.12 ] ~ [ linux-4.10.17 ] ~ [ linux-4.9.337 ] ~ [ linux-4.8.17 ] ~ [ linux-4.7.10 ] ~ [ linux-4.6.7 ] ~ [ linux-4.5.7 ] ~ [ linux-4.4.302 ] ~ [ linux-4.3.6 ] ~ [ linux-4.2.8 ] ~ [ linux-4.1.52 ] ~ [ linux-4.0.9 ] ~ [ linux-3.10.108 ] ~ [ linux-2.6.32.71 ] ~ [ linux-2.6.0 ] ~ [ linux-2.4.37.11 ] ~ [ unix-v6-master ] ~ [ ccs-tools-1.8.9 ] ~ [ policy-sample ] ~
Architecture: ~ [ i386 ] ~ [ alpha ] ~ [ m68k ] ~ [ mips ] ~ [ ppc ] ~ [ sparc ] ~ [ sparc64 ] ~

  1 /*
  2    BlueZ - Bluetooth protocol stack for Linux
  3    Copyright (C) 2000-2001 Qualcomm Incorporated
  4    Copyright (C) 2011 ProFUSION Embedded Systems
  5 
  6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
  7 
  8    This program is free software; you can redistribute it and/or modify
  9    it under the terms of the GNU General Public License version 2 as
 10    published by the Free Software Foundation;
 11 
 12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
 13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
 15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
 16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
 17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
 18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
 19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
 20 
 21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
 22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
 23    SOFTWARE IS DISCLAIMED.
 24 */
 25 
 26 /* Bluetooth HCI core. */
 27 
 28 #include <linux/export.h>
 29 #include <linux/rfkill.h>
 30 #include <linux/debugfs.h>
 31 #include <linux/crypto.h>
 32 #include <linux/property.h>
 33 #include <linux/suspend.h>
 34 #include <linux/wait.h>
 35 #include <asm/unaligned.h>
 36 
 37 #include <net/bluetooth/bluetooth.h>
 38 #include <net/bluetooth/hci_core.h>
 39 #include <net/bluetooth/l2cap.h>
 40 #include <net/bluetooth/mgmt.h>
 41 
 42 #include "hci_request.h"
 43 #include "hci_debugfs.h"
 44 #include "smp.h"
 45 #include "leds.h"
 46 #include "msft.h"
 47 #include "aosp.h"
 48 
 49 static void hci_rx_work(struct work_struct *work);
 50 static void hci_cmd_work(struct work_struct *work);
 51 static void hci_tx_work(struct work_struct *work);
 52 
 53 /* HCI device list */
 54 LIST_HEAD(hci_dev_list);
 55 DEFINE_RWLOCK(hci_dev_list_lock);
 56 
 57 /* HCI callback list */
 58 LIST_HEAD(hci_cb_list);
 59 DEFINE_MUTEX(hci_cb_list_lock);
 60 
 61 /* HCI ID Numbering */
 62 static DEFINE_IDA(hci_index_ida);
 63 
 64 /* ---- HCI debugfs entries ---- */
 65 
 66 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
 67                              size_t count, loff_t *ppos)
 68 {
 69         struct hci_dev *hdev = file->private_data;
 70         char buf[3];
 71 
 72         buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
 73         buf[1] = '\n';
 74         buf[2] = '\0';
 75         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 76 }
 77 
 78 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
 79                               size_t count, loff_t *ppos)
 80 {
 81         struct hci_dev *hdev = file->private_data;
 82         struct sk_buff *skb;
 83         bool enable;
 84         int err;
 85 
 86         if (!test_bit(HCI_UP, &hdev->flags))
 87                 return -ENETDOWN;
 88 
 89         err = kstrtobool_from_user(user_buf, count, &enable);
 90         if (err)
 91                 return err;
 92 
 93         if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
 94                 return -EALREADY;
 95 
 96         hci_req_sync_lock(hdev);
 97         if (enable)
 98                 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
 99                                      HCI_CMD_TIMEOUT);
100         else
101                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
102                                      HCI_CMD_TIMEOUT);
103         hci_req_sync_unlock(hdev);
104 
105         if (IS_ERR(skb))
106                 return PTR_ERR(skb);
107 
108         kfree_skb(skb);
109 
110         hci_dev_change_flag(hdev, HCI_DUT_MODE);
111 
112         return count;
113 }
114 
115 static const struct file_operations dut_mode_fops = {
116         .open           = simple_open,
117         .read           = dut_mode_read,
118         .write          = dut_mode_write,
119         .llseek         = default_llseek,
120 };
121 
122 static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
123                                 size_t count, loff_t *ppos)
124 {
125         struct hci_dev *hdev = file->private_data;
126         char buf[3];
127 
128         buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
129         buf[1] = '\n';
130         buf[2] = '\0';
131         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
132 }
133 
134 static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
135                                  size_t count, loff_t *ppos)
136 {
137         struct hci_dev *hdev = file->private_data;
138         bool enable;
139         int err;
140 
141         err = kstrtobool_from_user(user_buf, count, &enable);
142         if (err)
143                 return err;
144 
145         /* When the diagnostic flags are not persistent and the transport
146          * is not active or in user channel operation, then there is no need
147          * for the vendor callback. Instead just store the desired value and
148          * the setting will be programmed when the controller gets powered on.
149          */
150         if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
151             (!test_bit(HCI_RUNNING, &hdev->flags) ||
152              hci_dev_test_flag(hdev, HCI_USER_CHANNEL)))
153                 goto done;
154 
155         hci_req_sync_lock(hdev);
156         err = hdev->set_diag(hdev, enable);
157         hci_req_sync_unlock(hdev);
158 
159         if (err < 0)
160                 return err;
161 
162 done:
163         if (enable)
164                 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
165         else
166                 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
167 
168         return count;
169 }
170 
171 static const struct file_operations vendor_diag_fops = {
172         .open           = simple_open,
173         .read           = vendor_diag_read,
174         .write          = vendor_diag_write,
175         .llseek         = default_llseek,
176 };
177 
178 static void hci_debugfs_create_basic(struct hci_dev *hdev)
179 {
180         debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
181                             &dut_mode_fops);
182 
183         if (hdev->set_diag)
184                 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
185                                     &vendor_diag_fops);
186 }
187 
188 static int hci_reset_req(struct hci_request *req, unsigned long opt)
189 {
190         BT_DBG("%s %ld", req->hdev->name, opt);
191 
192         /* Reset device */
193         set_bit(HCI_RESET, &req->hdev->flags);
194         hci_req_add(req, HCI_OP_RESET, 0, NULL);
195         return 0;
196 }
197 
198 static void bredr_init(struct hci_request *req)
199 {
200         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
201 
202         /* Read Local Supported Features */
203         hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
204 
205         /* Read Local Version */
206         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
207 
208         /* Read BD Address */
209         hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
210 }
211 
212 static void amp_init1(struct hci_request *req)
213 {
214         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
215 
216         /* Read Local Version */
217         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
218 
219         /* Read Local Supported Commands */
220         hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
221 
222         /* Read Local AMP Info */
223         hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
224 
225         /* Read Data Blk size */
226         hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
227 
228         /* Read Flow Control Mode */
229         hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
230 
231         /* Read Location Data */
232         hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
233 }
234 
235 static int amp_init2(struct hci_request *req)
236 {
237         /* Read Local Supported Features. Not all AMP controllers
238          * support this so it's placed conditionally in the second
239          * stage init.
240          */
241         if (req->hdev->commands[14] & 0x20)
242                 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
243 
244         return 0;
245 }
246 
247 static int hci_init1_req(struct hci_request *req, unsigned long opt)
248 {
249         struct hci_dev *hdev = req->hdev;
250 
251         BT_DBG("%s %ld", hdev->name, opt);
252 
253         /* Reset */
254         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
255                 hci_reset_req(req, 0);
256 
257         switch (hdev->dev_type) {
258         case HCI_PRIMARY:
259                 bredr_init(req);
260                 break;
261         case HCI_AMP:
262                 amp_init1(req);
263                 break;
264         default:
265                 bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
266                 break;
267         }
268 
269         return 0;
270 }
271 
272 static void bredr_setup(struct hci_request *req)
273 {
274         __le16 param;
275         __u8 flt_type;
276 
277         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
278         hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
279 
280         /* Read Class of Device */
281         hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
282 
283         /* Read Local Name */
284         hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
285 
286         /* Read Voice Setting */
287         hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
288 
289         /* Read Number of Supported IAC */
290         hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
291 
292         /* Read Current IAC LAP */
293         hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
294 
295         /* Clear Event Filters */
296         flt_type = HCI_FLT_CLEAR_ALL;
297         hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
298 
299         /* Connection accept timeout ~20 secs */
300         param = cpu_to_le16(0x7d00);
301         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
302 }
303 
304 static void le_setup(struct hci_request *req)
305 {
306         struct hci_dev *hdev = req->hdev;
307 
308         /* Read LE Buffer Size */
309         hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
310 
311         /* Read LE Local Supported Features */
312         hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
313 
314         /* Read LE Supported States */
315         hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
316 
317         /* LE-only controllers have LE implicitly enabled */
318         if (!lmp_bredr_capable(hdev))
319                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
320 }
321 
322 static void hci_setup_event_mask(struct hci_request *req)
323 {
324         struct hci_dev *hdev = req->hdev;
325 
326         /* The second byte is 0xff instead of 0x9f (two reserved bits
327          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
328          * command otherwise.
329          */
330         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
331 
332         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
333          * any event mask for pre 1.2 devices.
334          */
335         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
336                 return;
337 
338         if (lmp_bredr_capable(hdev)) {
339                 events[4] |= 0x01; /* Flow Specification Complete */
340         } else {
341                 /* Use a different default for LE-only devices */
342                 memset(events, 0, sizeof(events));
343                 events[1] |= 0x20; /* Command Complete */
344                 events[1] |= 0x40; /* Command Status */
345                 events[1] |= 0x80; /* Hardware Error */
346 
347                 /* If the controller supports the Disconnect command, enable
348                  * the corresponding event. In addition enable packet flow
349                  * control related events.
350                  */
351                 if (hdev->commands[0] & 0x20) {
352                         events[0] |= 0x10; /* Disconnection Complete */
353                         events[2] |= 0x04; /* Number of Completed Packets */
354                         events[3] |= 0x02; /* Data Buffer Overflow */
355                 }
356 
357                 /* If the controller supports the Read Remote Version
358                  * Information command, enable the corresponding event.
359                  */
360                 if (hdev->commands[2] & 0x80)
361                         events[1] |= 0x08; /* Read Remote Version Information
362                                             * Complete
363                                             */
364 
365                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
366                         events[0] |= 0x80; /* Encryption Change */
367                         events[5] |= 0x80; /* Encryption Key Refresh Complete */
368                 }
369         }
370 
371         if (lmp_inq_rssi_capable(hdev) ||
372             test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
373                 events[4] |= 0x02; /* Inquiry Result with RSSI */
374 
375         if (lmp_ext_feat_capable(hdev))
376                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
377 
378         if (lmp_esco_capable(hdev)) {
379                 events[5] |= 0x08; /* Synchronous Connection Complete */
380                 events[5] |= 0x10; /* Synchronous Connection Changed */
381         }
382 
383         if (lmp_sniffsubr_capable(hdev))
384                 events[5] |= 0x20; /* Sniff Subrating */
385 
386         if (lmp_pause_enc_capable(hdev))
387                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
388 
389         if (lmp_ext_inq_capable(hdev))
390                 events[5] |= 0x40; /* Extended Inquiry Result */
391 
392         if (lmp_no_flush_capable(hdev))
393                 events[7] |= 0x01; /* Enhanced Flush Complete */
394 
395         if (lmp_lsto_capable(hdev))
396                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
397 
398         if (lmp_ssp_capable(hdev)) {
399                 events[6] |= 0x01;      /* IO Capability Request */
400                 events[6] |= 0x02;      /* IO Capability Response */
401                 events[6] |= 0x04;      /* User Confirmation Request */
402                 events[6] |= 0x08;      /* User Passkey Request */
403                 events[6] |= 0x10;      /* Remote OOB Data Request */
404                 events[6] |= 0x20;      /* Simple Pairing Complete */
405                 events[7] |= 0x04;      /* User Passkey Notification */
406                 events[7] |= 0x08;      /* Keypress Notification */
407                 events[7] |= 0x10;      /* Remote Host Supported
408                                          * Features Notification
409                                          */
410         }
411 
412         if (lmp_le_capable(hdev))
413                 events[7] |= 0x20;      /* LE Meta-Event */
414 
415         hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
416 }
417 
418 static int hci_init2_req(struct hci_request *req, unsigned long opt)
419 {
420         struct hci_dev *hdev = req->hdev;
421 
422         if (hdev->dev_type == HCI_AMP)
423                 return amp_init2(req);
424 
425         if (lmp_bredr_capable(hdev))
426                 bredr_setup(req);
427         else
428                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
429 
430         if (lmp_le_capable(hdev))
431                 le_setup(req);
432 
433         /* All Bluetooth 1.2 and later controllers should support the
434          * HCI command for reading the local supported commands.
435          *
436          * Unfortunately some controllers indicate Bluetooth 1.2 support,
437          * but do not have support for this command. If that is the case,
438          * the driver can quirk the behavior and skip reading the local
439          * supported commands.
440          */
441         if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
442             !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
443                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
444 
445         if (lmp_ssp_capable(hdev)) {
446                 /* When SSP is available, then the host features page
447                  * should also be available as well. However some
448                  * controllers list the max_page as 0 as long as SSP
449                  * has not been enabled. To achieve proper debugging
450                  * output, force the minimum max_page to 1 at least.
451                  */
452                 hdev->max_page = 0x01;
453 
454                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
455                         u8 mode = 0x01;
456 
457                         hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
458                                     sizeof(mode), &mode);
459                 } else {
460                         struct hci_cp_write_eir cp;
461 
462                         memset(hdev->eir, 0, sizeof(hdev->eir));
463                         memset(&cp, 0, sizeof(cp));
464 
465                         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
466                 }
467         }
468 
469         if (lmp_inq_rssi_capable(hdev) ||
470             test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
471                 u8 mode;
472 
473                 /* If Extended Inquiry Result events are supported, then
474                  * they are clearly preferred over Inquiry Result with RSSI
475                  * events.
476                  */
477                 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
478 
479                 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
480         }
481 
482         if (lmp_inq_tx_pwr_capable(hdev))
483                 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
484 
485         if (lmp_ext_feat_capable(hdev)) {
486                 struct hci_cp_read_local_ext_features cp;
487 
488                 cp.page = 0x01;
489                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
490                             sizeof(cp), &cp);
491         }
492 
493         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
494                 u8 enable = 1;
495                 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
496                             &enable);
497         }
498 
499         return 0;
500 }
501 
502 static void hci_setup_link_policy(struct hci_request *req)
503 {
504         struct hci_dev *hdev = req->hdev;
505         struct hci_cp_write_def_link_policy cp;
506         u16 link_policy = 0;
507 
508         if (lmp_rswitch_capable(hdev))
509                 link_policy |= HCI_LP_RSWITCH;
510         if (lmp_hold_capable(hdev))
511                 link_policy |= HCI_LP_HOLD;
512         if (lmp_sniff_capable(hdev))
513                 link_policy |= HCI_LP_SNIFF;
514         if (lmp_park_capable(hdev))
515                 link_policy |= HCI_LP_PARK;
516 
517         cp.policy = cpu_to_le16(link_policy);
518         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
519 }
520 
521 static void hci_set_le_support(struct hci_request *req)
522 {
523         struct hci_dev *hdev = req->hdev;
524         struct hci_cp_write_le_host_supported cp;
525 
526         /* LE-only devices do not support explicit enablement */
527         if (!lmp_bredr_capable(hdev))
528                 return;
529 
530         memset(&cp, 0, sizeof(cp));
531 
532         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
533                 cp.le = 0x01;
534                 cp.simul = 0x00;
535         }
536 
537         if (cp.le != lmp_host_le_capable(hdev))
538                 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
539                             &cp);
540 }
541 
542 static void hci_set_event_mask_page_2(struct hci_request *req)
543 {
544         struct hci_dev *hdev = req->hdev;
545         u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
546         bool changed = false;
547 
548         /* If Connectionless Peripheral Broadcast central role is supported
549          * enable all necessary events for it.
550          */
551         if (lmp_cpb_central_capable(hdev)) {
552                 events[1] |= 0x40;      /* Triggered Clock Capture */
553                 events[1] |= 0x80;      /* Synchronization Train Complete */
554                 events[2] |= 0x10;      /* Peripheral Page Response Timeout */
555                 events[2] |= 0x20;      /* CPB Channel Map Change */
556                 changed = true;
557         }
558 
559         /* If Connectionless Peripheral Broadcast peripheral role is supported
560          * enable all necessary events for it.
561          */
562         if (lmp_cpb_peripheral_capable(hdev)) {
563                 events[2] |= 0x01;      /* Synchronization Train Received */
564                 events[2] |= 0x02;      /* CPB Receive */
565                 events[2] |= 0x04;      /* CPB Timeout */
566                 events[2] |= 0x08;      /* Truncated Page Complete */
567                 changed = true;
568         }
569 
570         /* Enable Authenticated Payload Timeout Expired event if supported */
571         if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
572                 events[2] |= 0x80;
573                 changed = true;
574         }
575 
576         /* Some Broadcom based controllers indicate support for Set Event
577          * Mask Page 2 command, but then actually do not support it. Since
578          * the default value is all bits set to zero, the command is only
579          * required if the event mask has to be changed. In case no change
580          * to the event mask is needed, skip this command.
581          */
582         if (changed)
583                 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
584                             sizeof(events), events);
585 }
586 
587 static int hci_init3_req(struct hci_request *req, unsigned long opt)
588 {
589         struct hci_dev *hdev = req->hdev;
590         u8 p;
591 
592         hci_setup_event_mask(req);
593 
594         if (hdev->commands[6] & 0x20 &&
595             !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
596                 struct hci_cp_read_stored_link_key cp;
597 
598                 bacpy(&cp.bdaddr, BDADDR_ANY);
599                 cp.read_all = 0x01;
600                 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
601         }
602 
603         if (hdev->commands[5] & 0x10)
604                 hci_setup_link_policy(req);
605 
606         if (hdev->commands[8] & 0x01)
607                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
608 
609         if (hdev->commands[18] & 0x04 &&
610             !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
611                 hci_req_add(req, HCI_OP_READ_DEF_ERR_DATA_REPORTING, 0, NULL);
612 
613         /* Some older Broadcom based Bluetooth 1.2 controllers do not
614          * support the Read Page Scan Type command. Check support for
615          * this command in the bit mask of supported commands.
616          */
617         if (hdev->commands[13] & 0x01)
618                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
619 
620         if (lmp_le_capable(hdev)) {
621                 u8 events[8];
622 
623                 memset(events, 0, sizeof(events));
624 
625                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
626                         events[0] |= 0x10;      /* LE Long Term Key Request */
627 
628                 /* If controller supports the Connection Parameters Request
629                  * Link Layer Procedure, enable the corresponding event.
630                  */
631                 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
632                         events[0] |= 0x20;      /* LE Remote Connection
633                                                  * Parameter Request
634                                                  */
635 
636                 /* If the controller supports the Data Length Extension
637                  * feature, enable the corresponding event.
638                  */
639                 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
640                         events[0] |= 0x40;      /* LE Data Length Change */
641 
642                 /* If the controller supports LL Privacy feature, enable
643                  * the corresponding event.
644                  */
645                 if (hdev->le_features[0] & HCI_LE_LL_PRIVACY)
646                         events[1] |= 0x02;      /* LE Enhanced Connection
647                                                  * Complete
648                                                  */
649 
650                 /* If the controller supports Extended Scanner Filter
651                  * Policies, enable the corresponding event.
652                  */
653                 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
654                         events[1] |= 0x04;      /* LE Direct Advertising
655                                                  * Report
656                                                  */
657 
658                 /* If the controller supports Channel Selection Algorithm #2
659                  * feature, enable the corresponding event.
660                  */
661                 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
662                         events[2] |= 0x08;      /* LE Channel Selection
663                                                  * Algorithm
664                                                  */
665 
666                 /* If the controller supports the LE Set Scan Enable command,
667                  * enable the corresponding advertising report event.
668                  */
669                 if (hdev->commands[26] & 0x08)
670                         events[0] |= 0x02;      /* LE Advertising Report */
671 
672                 /* If the controller supports the LE Create Connection
673                  * command, enable the corresponding event.
674                  */
675                 if (hdev->commands[26] & 0x10)
676                         events[0] |= 0x01;      /* LE Connection Complete */
677 
678                 /* If the controller supports the LE Connection Update
679                  * command, enable the corresponding event.
680                  */
681                 if (hdev->commands[27] & 0x04)
682                         events[0] |= 0x04;      /* LE Connection Update
683                                                  * Complete
684                                                  */
685 
686                 /* If the controller supports the LE Read Remote Used Features
687                  * command, enable the corresponding event.
688                  */
689                 if (hdev->commands[27] & 0x20)
690                         events[0] |= 0x08;      /* LE Read Remote Used
691                                                  * Features Complete
692                                                  */
693 
694                 /* If the controller supports the LE Read Local P-256
695                  * Public Key command, enable the corresponding event.
696                  */
697                 if (hdev->commands[34] & 0x02)
698                         events[0] |= 0x80;      /* LE Read Local P-256
699                                                  * Public Key Complete
700                                                  */
701 
702                 /* If the controller supports the LE Generate DHKey
703                  * command, enable the corresponding event.
704                  */
705                 if (hdev->commands[34] & 0x04)
706                         events[1] |= 0x01;      /* LE Generate DHKey Complete */
707 
708                 /* If the controller supports the LE Set Default PHY or
709                  * LE Set PHY commands, enable the corresponding event.
710                  */
711                 if (hdev->commands[35] & (0x20 | 0x40))
712                         events[1] |= 0x08;        /* LE PHY Update Complete */
713 
714                 /* If the controller supports LE Set Extended Scan Parameters
715                  * and LE Set Extended Scan Enable commands, enable the
716                  * corresponding event.
717                  */
718                 if (use_ext_scan(hdev))
719                         events[1] |= 0x10;      /* LE Extended Advertising
720                                                  * Report
721                                                  */
722 
723                 /* If the controller supports the LE Extended Advertising
724                  * command, enable the corresponding event.
725                  */
726                 if (ext_adv_capable(hdev))
727                         events[2] |= 0x02;      /* LE Advertising Set
728                                                  * Terminated
729                                                  */
730 
731                 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
732                             events);
733 
734                 /* Read LE Advertising Channel TX Power */
735                 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
736                         /* HCI TS spec forbids mixing of legacy and extended
737                          * advertising commands wherein READ_ADV_TX_POWER is
738                          * also included. So do not call it if extended adv
739                          * is supported otherwise controller will return
740                          * COMMAND_DISALLOWED for extended commands.
741                          */
742                         hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
743                 }
744 
745                 if (hdev->commands[38] & 0x80) {
746                         /* Read LE Min/Max Tx Power*/
747                         hci_req_add(req, HCI_OP_LE_READ_TRANSMIT_POWER,
748                                     0, NULL);
749                 }
750 
751                 if (hdev->commands[26] & 0x40) {
752                         /* Read LE Accept List Size */
753                         hci_req_add(req, HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
754                                     0, NULL);
755                 }
756 
757                 if (hdev->commands[26] & 0x80) {
758                         /* Clear LE Accept List */
759                         hci_req_add(req, HCI_OP_LE_CLEAR_ACCEPT_LIST, 0, NULL);
760                 }
761 
762                 if (hdev->commands[34] & 0x40) {
763                         /* Read LE Resolving List Size */
764                         hci_req_add(req, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
765                                     0, NULL);
766                 }
767 
768                 if (hdev->commands[34] & 0x20) {
769                         /* Clear LE Resolving List */
770                         hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL);
771                 }
772 
773                 if (hdev->commands[35] & 0x04) {
774                         __le16 rpa_timeout = cpu_to_le16(hdev->rpa_timeout);
775 
776                         /* Set RPA timeout */
777                         hci_req_add(req, HCI_OP_LE_SET_RPA_TIMEOUT, 2,
778                                     &rpa_timeout);
779                 }
780 
781                 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
782                         /* Read LE Maximum Data Length */
783                         hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
784 
785                         /* Read LE Suggested Default Data Length */
786                         hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
787                 }
788 
789                 if (ext_adv_capable(hdev)) {
790                         /* Read LE Number of Supported Advertising Sets */
791                         hci_req_add(req, HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
792                                     0, NULL);
793                 }
794 
795                 hci_set_le_support(req);
796         }
797 
798         /* Read features beyond page 1 if available */
799         for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
800                 struct hci_cp_read_local_ext_features cp;
801 
802                 cp.page = p;
803                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
804                             sizeof(cp), &cp);
805         }
806 
807         return 0;
808 }
809 
810 static int hci_init4_req(struct hci_request *req, unsigned long opt)
811 {
812         struct hci_dev *hdev = req->hdev;
813 
814         /* Some Broadcom based Bluetooth controllers do not support the
815          * Delete Stored Link Key command. They are clearly indicating its
816          * absence in the bit mask of supported commands.
817          *
818          * Check the supported commands and only if the command is marked
819          * as supported send it. If not supported assume that the controller
820          * does not have actual support for stored link keys which makes this
821          * command redundant anyway.
822          *
823          * Some controllers indicate that they support handling deleting
824          * stored link keys, but they don't. The quirk lets a driver
825          * just disable this command.
826          */
827         if (hdev->commands[6] & 0x80 &&
828             !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
829                 struct hci_cp_delete_stored_link_key cp;
830 
831                 bacpy(&cp.bdaddr, BDADDR_ANY);
832                 cp.delete_all = 0x01;
833                 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
834                             sizeof(cp), &cp);
835         }
836 
837         /* Set event mask page 2 if the HCI command for it is supported */
838         if (hdev->commands[22] & 0x04)
839                 hci_set_event_mask_page_2(req);
840 
841         /* Read local codec list if the HCI command is supported */
842         if (hdev->commands[29] & 0x20)
843                 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
844 
845         /* Read local pairing options if the HCI command is supported */
846         if (hdev->commands[41] & 0x08)
847                 hci_req_add(req, HCI_OP_READ_LOCAL_PAIRING_OPTS, 0, NULL);
848 
849         /* Get MWS transport configuration if the HCI command is supported */
850         if (hdev->commands[30] & 0x08)
851                 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
852 
853         /* Check for Synchronization Train support */
854         if (lmp_sync_train_capable(hdev))
855                 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
856 
857         /* Enable Secure Connections if supported and configured */
858         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
859             bredr_sc_enabled(hdev)) {
860                 u8 support = 0x01;
861 
862                 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
863                             sizeof(support), &support);
864         }
865 
866         /* Set erroneous data reporting if supported to the wideband speech
867          * setting value
868          */
869         if (hdev->commands[18] & 0x08 &&
870             !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks)) {
871                 bool enabled = hci_dev_test_flag(hdev,
872                                                  HCI_WIDEBAND_SPEECH_ENABLED);
873 
874                 if (enabled !=
875                     (hdev->err_data_reporting == ERR_DATA_REPORTING_ENABLED)) {
876                         struct hci_cp_write_def_err_data_reporting cp;
877 
878                         cp.err_data_reporting = enabled ?
879                                                 ERR_DATA_REPORTING_ENABLED :
880                                                 ERR_DATA_REPORTING_DISABLED;
881 
882                         hci_req_add(req, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
883                                     sizeof(cp), &cp);
884                 }
885         }
886 
887         /* Set Suggested Default Data Length to maximum if supported */
888         if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
889                 struct hci_cp_le_write_def_data_len cp;
890 
891                 cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
892                 cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
893                 hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
894         }
895 
896         /* Set Default PHY parameters if command is supported */
897         if (hdev->commands[35] & 0x20) {
898                 struct hci_cp_le_set_default_phy cp;
899 
900                 cp.all_phys = 0x00;
901                 cp.tx_phys = hdev->le_tx_def_phys;
902                 cp.rx_phys = hdev->le_rx_def_phys;
903 
904                 hci_req_add(req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp), &cp);
905         }
906 
907         return 0;
908 }
909 
910 static int __hci_init(struct hci_dev *hdev)
911 {
912         int err;
913 
914         err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
915         if (err < 0)
916                 return err;
917 
918         if (hci_dev_test_flag(hdev, HCI_SETUP))
919                 hci_debugfs_create_basic(hdev);
920 
921         err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
922         if (err < 0)
923                 return err;
924 
925         /* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
926          * BR/EDR/LE type controllers. AMP controllers only need the
927          * first two stages of init.
928          */
929         if (hdev->dev_type != HCI_PRIMARY)
930                 return 0;
931 
932         err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
933         if (err < 0)
934                 return err;
935 
936         err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
937         if (err < 0)
938                 return err;
939 
940         /* This function is only called when the controller is actually in
941          * configured state. When the controller is marked as unconfigured,
942          * this initialization procedure is not run.
943          *
944          * It means that it is possible that a controller runs through its
945          * setup phase and then discovers missing settings. If that is the
946          * case, then this function will not be called. It then will only
947          * be called during the config phase.
948          *
949          * So only when in setup phase or config phase, create the debugfs
950          * entries and register the SMP channels.
951          */
952         if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
953             !hci_dev_test_flag(hdev, HCI_CONFIG))
954                 return 0;
955 
956         hci_debugfs_create_common(hdev);
957 
958         if (lmp_bredr_capable(hdev))
959                 hci_debugfs_create_bredr(hdev);
960 
961         if (lmp_le_capable(hdev))
962                 hci_debugfs_create_le(hdev);
963 
964         return 0;
965 }
966 
967 static int hci_init0_req(struct hci_request *req, unsigned long opt)
968 {
969         struct hci_dev *hdev = req->hdev;
970 
971         BT_DBG("%s %ld", hdev->name, opt);
972 
973         /* Reset */
974         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
975                 hci_reset_req(req, 0);
976 
977         /* Read Local Version */
978         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
979 
980         /* Read BD Address */
981         if (hdev->set_bdaddr)
982                 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
983 
984         return 0;
985 }
986 
987 static int __hci_unconf_init(struct hci_dev *hdev)
988 {
989         int err;
990 
991         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
992                 return 0;
993 
994         err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
995         if (err < 0)
996                 return err;
997 
998         if (hci_dev_test_flag(hdev, HCI_SETUP))
999                 hci_debugfs_create_basic(hdev);
1000 
1001         return 0;
1002 }
1003 
1004 static int hci_scan_req(struct hci_request *req, unsigned long opt)
1005 {
1006         __u8 scan = opt;
1007 
1008         BT_DBG("%s %x", req->hdev->name, scan);
1009 
1010         /* Inquiry and Page scans */
1011         hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1012         return 0;
1013 }
1014 
1015 static int hci_auth_req(struct hci_request *req, unsigned long opt)
1016 {
1017         __u8 auth = opt;
1018 
1019         BT_DBG("%s %x", req->hdev->name, auth);
1020 
1021         /* Authentication */
1022         hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1023         return 0;
1024 }
1025 
1026 static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1027 {
1028         __u8 encrypt = opt;
1029 
1030         BT_DBG("%s %x", req->hdev->name, encrypt);
1031 
1032         /* Encryption */
1033         hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1034         return 0;
1035 }
1036 
1037 static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
1038 {
1039         __le16 policy = cpu_to_le16(opt);
1040 
1041         BT_DBG("%s %x", req->hdev->name, policy);
1042 
1043         /* Default link policy */
1044         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
1045         return 0;
1046 }
1047 
1048 /* Get HCI device by index.
1049  * Device is held on return. */
1050 struct hci_dev *hci_dev_get(int index)
1051 {
1052         struct hci_dev *hdev = NULL, *d;
1053 
1054         BT_DBG("%d", index);
1055 
1056         if (index < 0)
1057                 return NULL;
1058 
1059         read_lock(&hci_dev_list_lock);
1060         list_for_each_entry(d, &hci_dev_list, list) {
1061                 if (d->id == index) {
1062                         hdev = hci_dev_hold(d);
1063                         break;
1064                 }
1065         }
1066         read_unlock(&hci_dev_list_lock);
1067         return hdev;
1068 }
1069 
1070 /* ---- Inquiry support ---- */
1071 
1072 bool hci_discovery_active(struct hci_dev *hdev)
1073 {
1074         struct discovery_state *discov = &hdev->discovery;
1075 
1076         switch (discov->state) {
1077         case DISCOVERY_FINDING:
1078         case DISCOVERY_RESOLVING:
1079                 return true;
1080 
1081         default:
1082                 return false;
1083         }
1084 }
1085 
1086 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1087 {
1088         int old_state = hdev->discovery.state;
1089 
1090         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1091 
1092         if (old_state == state)
1093                 return;
1094 
1095         hdev->discovery.state = state;
1096 
1097         switch (state) {
1098         case DISCOVERY_STOPPED:
1099                 hci_update_background_scan(hdev);
1100 
1101                 if (old_state != DISCOVERY_STARTING)
1102                         mgmt_discovering(hdev, 0);
1103                 break;
1104         case DISCOVERY_STARTING:
1105                 break;
1106         case DISCOVERY_FINDING:
1107                 mgmt_discovering(hdev, 1);
1108                 break;
1109         case DISCOVERY_RESOLVING:
1110                 break;
1111         case DISCOVERY_STOPPING:
1112                 break;
1113         }
1114 }
1115 
1116 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1117 {
1118         struct discovery_state *cache = &hdev->discovery;
1119         struct inquiry_entry *p, *n;
1120 
1121         list_for_each_entry_safe(p, n, &cache->all, all) {
1122                 list_del(&p->all);
1123                 kfree(p);
1124         }
1125 
1126         INIT_LIST_HEAD(&cache->unknown);
1127         INIT_LIST_HEAD(&cache->resolve);
1128 }
1129 
1130 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1131                                                bdaddr_t *bdaddr)
1132 {
1133         struct discovery_state *cache = &hdev->discovery;
1134         struct inquiry_entry *e;
1135 
1136         BT_DBG("cache %p, %pMR", cache, bdaddr);
1137 
1138         list_for_each_entry(e, &cache->all, all) {
1139                 if (!bacmp(&e->data.bdaddr, bdaddr))
1140                         return e;
1141         }
1142 
1143         return NULL;
1144 }
1145 
1146 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1147                                                        bdaddr_t *bdaddr)
1148 {
1149         struct discovery_state *cache = &hdev->discovery;
1150         struct inquiry_entry *e;
1151 
1152         BT_DBG("cache %p, %pMR", cache, bdaddr);
1153 
1154         list_for_each_entry(e, &cache->unknown, list) {
1155                 if (!bacmp(&e->data.bdaddr, bdaddr))
1156                         return e;
1157         }
1158 
1159         return NULL;
1160 }
1161 
1162 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1163                                                        bdaddr_t *bdaddr,
1164                                                        int state)
1165 {
1166         struct discovery_state *cache = &hdev->discovery;
1167         struct inquiry_entry *e;
1168 
1169         BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1170 
1171         list_for_each_entry(e, &cache->resolve, list) {
1172                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1173                         return e;
1174                 if (!bacmp(&e->data.bdaddr, bdaddr))
1175                         return e;
1176         }
1177 
1178         return NULL;
1179 }
1180 
1181 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1182                                       struct inquiry_entry *ie)
1183 {
1184         struct discovery_state *cache = &hdev->discovery;
1185         struct list_head *pos = &cache->resolve;
1186         struct inquiry_entry *p;
1187 
1188         list_del(&ie->list);
1189 
1190         list_for_each_entry(p, &cache->resolve, list) {
1191                 if (p->name_state != NAME_PENDING &&
1192                     abs(p->data.rssi) >= abs(ie->data.rssi))
1193                         break;
1194                 pos = &p->list;
1195         }
1196 
1197         list_add(&ie->list, pos);
1198 }
1199 
1200 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1201                              bool name_known)
1202 {
1203         struct discovery_state *cache = &hdev->discovery;
1204         struct inquiry_entry *ie;
1205         u32 flags = 0;
1206 
1207         BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1208 
1209         hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1210 
1211         if (!data->ssp_mode)
1212                 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1213 
1214         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1215         if (ie) {
1216                 if (!ie->data.ssp_mode)
1217                         flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1218 
1219                 if (ie->name_state == NAME_NEEDED &&
1220                     data->rssi != ie->data.rssi) {
1221                         ie->data.rssi = data->rssi;
1222                         hci_inquiry_cache_update_resolve(hdev, ie);
1223                 }
1224 
1225                 goto update;
1226         }
1227 
1228         /* Entry not in the cache. Add new one. */
1229         ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1230         if (!ie) {
1231                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1232                 goto done;
1233         }
1234 
1235         list_add(&ie->all, &cache->all);
1236 
1237         if (name_known) {
1238                 ie->name_state = NAME_KNOWN;
1239         } else {
1240                 ie->name_state = NAME_NOT_KNOWN;
1241                 list_add(&ie->list, &cache->unknown);
1242         }
1243 
1244 update:
1245         if (name_known && ie->name_state != NAME_KNOWN &&
1246             ie->name_state != NAME_PENDING) {
1247                 ie->name_state = NAME_KNOWN;
1248                 list_del(&ie->list);
1249         }
1250 
1251         memcpy(&ie->data, data, sizeof(*data));
1252         ie->timestamp = jiffies;
1253         cache->timestamp = jiffies;
1254 
1255         if (ie->name_state == NAME_NOT_KNOWN)
1256                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1257 
1258 done:
1259         return flags;
1260 }
1261 
1262 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1263 {
1264         struct discovery_state *cache = &hdev->discovery;
1265         struct inquiry_info *info = (struct inquiry_info *) buf;
1266         struct inquiry_entry *e;
1267         int copied = 0;
1268 
1269         list_for_each_entry(e, &cache->all, all) {
1270                 struct inquiry_data *data = &e->data;
1271 
1272                 if (copied >= num)
1273                         break;
1274 
1275                 bacpy(&info->bdaddr, &data->bdaddr);
1276                 info->pscan_rep_mode    = data->pscan_rep_mode;
1277                 info->pscan_period_mode = data->pscan_period_mode;
1278                 info->pscan_mode        = data->pscan_mode;
1279                 memcpy(info->dev_class, data->dev_class, 3);
1280                 info->clock_offset      = data->clock_offset;
1281 
1282                 info++;
1283                 copied++;
1284         }
1285 
1286         BT_DBG("cache %p, copied %d", cache, copied);
1287         return copied;
1288 }
1289 
1290 static int hci_inq_req(struct hci_request *req, unsigned long opt)
1291 {
1292         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1293         struct hci_dev *hdev = req->hdev;
1294         struct hci_cp_inquiry cp;
1295 
1296         BT_DBG("%s", hdev->name);
1297 
1298         if (test_bit(HCI_INQUIRY, &hdev->flags))
1299                 return 0;
1300 
1301         /* Start Inquiry */
1302         memcpy(&cp.lap, &ir->lap, 3);
1303         cp.length  = ir->length;
1304         cp.num_rsp = ir->num_rsp;
1305         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1306 
1307         return 0;
1308 }
1309 
1310 int hci_inquiry(void __user *arg)
1311 {
1312         __u8 __user *ptr = arg;
1313         struct hci_inquiry_req ir;
1314         struct hci_dev *hdev;
1315         int err = 0, do_inquiry = 0, max_rsp;
1316         long timeo;
1317         __u8 *buf;
1318 
1319         if (copy_from_user(&ir, ptr, sizeof(ir)))
1320                 return -EFAULT;
1321 
1322         hdev = hci_dev_get(ir.dev_id);
1323         if (!hdev)
1324                 return -ENODEV;
1325 
1326         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1327                 err = -EBUSY;
1328                 goto done;
1329         }
1330 
1331         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1332                 err = -EOPNOTSUPP;
1333                 goto done;
1334         }
1335 
1336         if (hdev->dev_type != HCI_PRIMARY) {
1337                 err = -EOPNOTSUPP;
1338                 goto done;
1339         }
1340 
1341         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1342                 err = -EOPNOTSUPP;
1343                 goto done;
1344         }
1345 
1346         /* Restrict maximum inquiry length to 60 seconds */
1347         if (ir.length > 60) {
1348                 err = -EINVAL;
1349                 goto done;
1350         }
1351 
1352         hci_dev_lock(hdev);
1353         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1354             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1355                 hci_inquiry_cache_flush(hdev);
1356                 do_inquiry = 1;
1357         }
1358         hci_dev_unlock(hdev);
1359 
1360         timeo = ir.length * msecs_to_jiffies(2000);
1361 
1362         if (do_inquiry) {
1363                 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1364                                    timeo, NULL);
1365                 if (err < 0)
1366                         goto done;
1367 
1368                 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1369                  * cleared). If it is interrupted by a signal, return -EINTR.
1370                  */
1371                 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1372                                 TASK_INTERRUPTIBLE)) {
1373                         err = -EINTR;
1374                         goto done;
1375                 }
1376         }
1377 
1378         /* for unlimited number of responses we will use buffer with
1379          * 255 entries
1380          */
1381         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1382 
1383         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1384          * copy it to the user space.
1385          */
1386         buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
1387         if (!buf) {
1388                 err = -ENOMEM;
1389                 goto done;
1390         }
1391 
1392         hci_dev_lock(hdev);
1393         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1394         hci_dev_unlock(hdev);
1395 
1396         BT_DBG("num_rsp %d", ir.num_rsp);
1397 
1398         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1399                 ptr += sizeof(ir);
1400                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1401                                  ir.num_rsp))
1402                         err = -EFAULT;
1403         } else
1404                 err = -EFAULT;
1405 
1406         kfree(buf);
1407 
1408 done:
1409         hci_dev_put(hdev);
1410         return err;
1411 }
1412 
1413 /**
1414  * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address
1415  *                                     (BD_ADDR) for a HCI device from
1416  *                                     a firmware node property.
1417  * @hdev:       The HCI device
1418  *
1419  * Search the firmware node for 'local-bd-address'.
1420  *
1421  * All-zero BD addresses are rejected, because those could be properties
1422  * that exist in the firmware tables, but were not updated by the firmware. For
1423  * example, the DTS could define 'local-bd-address', with zero BD addresses.
1424  */
1425 static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev)
1426 {
1427         struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
1428         bdaddr_t ba;
1429         int ret;
1430 
1431         ret = fwnode_property_read_u8_array(fwnode, "local-bd-address",
1432                                             (u8 *)&ba, sizeof(ba));
1433         if (ret < 0 || !bacmp(&ba, BDADDR_ANY))
1434                 return;
1435 
1436         bacpy(&hdev->public_addr, &ba);
1437 }
1438 
1439 static int hci_dev_do_open(struct hci_dev *hdev)
1440 {
1441         int ret = 0;
1442 
1443         BT_DBG("%s %p", hdev->name, hdev);
1444 
1445         hci_req_sync_lock(hdev);
1446 
1447         if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1448                 ret = -ENODEV;
1449                 goto done;
1450         }
1451 
1452         if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1453             !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1454                 /* Check for rfkill but allow the HCI setup stage to
1455                  * proceed (which in itself doesn't cause any RF activity).
1456                  */
1457                 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1458                         ret = -ERFKILL;
1459                         goto done;
1460                 }
1461 
1462                 /* Check for valid public address or a configured static
1463                  * random address, but let the HCI setup proceed to
1464                  * be able to determine if there is a public address
1465                  * or not.
1466                  *
1467                  * In case of user channel usage, it is not important
1468                  * if a public address or static random address is
1469                  * available.
1470                  *
1471                  * This check is only valid for BR/EDR controllers
1472                  * since AMP controllers do not have an address.
1473                  */
1474                 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1475                     hdev->dev_type == HCI_PRIMARY &&
1476                     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1477                     !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1478                         ret = -EADDRNOTAVAIL;
1479                         goto done;
1480                 }
1481         }
1482 
1483         if (test_bit(HCI_UP, &hdev->flags)) {
1484                 ret = -EALREADY;
1485                 goto done;
1486         }
1487 
1488         if (hdev->open(hdev)) {
1489                 ret = -EIO;
1490                 goto done;
1491         }
1492 
1493         set_bit(HCI_RUNNING, &hdev->flags);
1494         hci_sock_dev_event(hdev, HCI_DEV_OPEN);
1495 
1496         atomic_set(&hdev->cmd_cnt, 1);
1497         set_bit(HCI_INIT, &hdev->flags);
1498 
1499         if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1500             test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
1501                 bool invalid_bdaddr;
1502 
1503                 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1504 
1505                 if (hdev->setup)
1506                         ret = hdev->setup(hdev);
1507 
1508                 /* The transport driver can set the quirk to mark the
1509                  * BD_ADDR invalid before creating the HCI device or in
1510                  * its setup callback.
1511                  */
1512                 invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR,
1513                                           &hdev->quirks);
1514 
1515                 if (ret)
1516                         goto setup_failed;
1517 
1518                 if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
1519                         if (!bacmp(&hdev->public_addr, BDADDR_ANY))
1520                                 hci_dev_get_bd_addr_from_property(hdev);
1521 
1522                         if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1523                             hdev->set_bdaddr) {
1524                                 ret = hdev->set_bdaddr(hdev,
1525                                                        &hdev->public_addr);
1526 
1527                                 /* If setting of the BD_ADDR from the device
1528                                  * property succeeds, then treat the address
1529                                  * as valid even if the invalid BD_ADDR
1530                                  * quirk indicates otherwise.
1531                                  */
1532                                 if (!ret)
1533                                         invalid_bdaddr = false;
1534                         }
1535                 }
1536 
1537 setup_failed:
1538                 /* The transport driver can set these quirks before
1539                  * creating the HCI device or in its setup callback.
1540                  *
1541                  * For the invalid BD_ADDR quirk it is possible that
1542                  * it becomes a valid address if the bootloader does
1543                  * provide it (see above).
1544                  *
1545                  * In case any of them is set, the controller has to
1546                  * start up as unconfigured.
1547                  */
1548                 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1549                     invalid_bdaddr)
1550                         hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1551 
1552                 /* For an unconfigured controller it is required to
1553                  * read at least the version information provided by
1554                  * the Read Local Version Information command.
1555                  *
1556                  * If the set_bdaddr driver callback is provided, then
1557                  * also the original Bluetooth public device address
1558                  * will be read using the Read BD Address command.
1559                  */
1560                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1561                         ret = __hci_unconf_init(hdev);
1562         }
1563 
1564         if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1565                 /* If public address change is configured, ensure that
1566                  * the address gets programmed. If the driver does not
1567                  * support changing the public address, fail the power
1568                  * on procedure.
1569                  */
1570                 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1571                     hdev->set_bdaddr)
1572                         ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1573                 else
1574                         ret = -EADDRNOTAVAIL;
1575         }
1576 
1577         if (!ret) {
1578                 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1579                     !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1580                         ret = __hci_init(hdev);
1581                         if (!ret && hdev->post_init)
1582                                 ret = hdev->post_init(hdev);
1583                 }
1584         }
1585 
1586         /* If the HCI Reset command is clearing all diagnostic settings,
1587          * then they need to be reprogrammed after the init procedure
1588          * completed.
1589          */
1590         if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
1591             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1592             hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1593                 ret = hdev->set_diag(hdev, true);
1594 
1595         msft_do_open(hdev);
1596         aosp_do_open(hdev);
1597 
1598         clear_bit(HCI_INIT, &hdev->flags);
1599 
1600         if (!ret) {
1601                 hci_dev_hold(hdev);
1602                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1603                 hci_adv_instances_set_rpa_expired(hdev, true);
1604                 set_bit(HCI_UP, &hdev->flags);
1605                 hci_sock_dev_event(hdev, HCI_DEV_UP);
1606                 hci_leds_update_powered(hdev, true);
1607                 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1608                     !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1609                     !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1610                     !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1611                     hci_dev_test_flag(hdev, HCI_MGMT) &&
1612                     hdev->dev_type == HCI_PRIMARY) {
1613                         ret = __hci_req_hci_power_on(hdev);
1614                         mgmt_power_on(hdev, ret);
1615                 }
1616         } else {
1617                 /* Init failed, cleanup */
1618                 flush_work(&hdev->tx_work);
1619 
1620                 /* Since hci_rx_work() is possible to awake new cmd_work
1621                  * it should be flushed first to avoid unexpected call of
1622                  * hci_cmd_work()
1623                  */
1624                 flush_work(&hdev->rx_work);
1625                 flush_work(&hdev->cmd_work);
1626 
1627                 skb_queue_purge(&hdev->cmd_q);
1628                 skb_queue_purge(&hdev->rx_q);
1629 
1630                 if (hdev->flush)
1631                         hdev->flush(hdev);
1632 
1633                 if (hdev->sent_cmd) {
1634                         kfree_skb(hdev->sent_cmd);
1635                         hdev->sent_cmd = NULL;
1636                 }
1637 
1638                 clear_bit(HCI_RUNNING, &hdev->flags);
1639                 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1640 
1641                 hdev->close(hdev);
1642                 hdev->flags &= BIT(HCI_RAW);
1643         }
1644 
1645 done:
1646         hci_req_sync_unlock(hdev);
1647         return ret;
1648 }
1649 
1650 /* ---- HCI ioctl helpers ---- */
1651 
1652 int hci_dev_open(__u16 dev)
1653 {
1654         struct hci_dev *hdev;
1655         int err;
1656 
1657         hdev = hci_dev_get(dev);
1658         if (!hdev)
1659                 return -ENODEV;
1660 
1661         /* Devices that are marked as unconfigured can only be powered
1662          * up as user channel. Trying to bring them up as normal devices
1663          * will result into a failure. Only user channel operation is
1664          * possible.
1665          *
1666          * When this function is called for a user channel, the flag
1667          * HCI_USER_CHANNEL will be set first before attempting to
1668          * open the device.
1669          */
1670         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1671             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1672                 err = -EOPNOTSUPP;
1673                 goto done;
1674         }
1675 
1676         /* We need to ensure that no other power on/off work is pending
1677          * before proceeding to call hci_dev_do_open. This is
1678          * particularly important if the setup procedure has not yet
1679          * completed.
1680          */
1681         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1682                 cancel_delayed_work(&hdev->power_off);
1683 
1684         /* After this call it is guaranteed that the setup procedure
1685          * has finished. This means that error conditions like RFKILL
1686          * or no valid public or static random address apply.
1687          */
1688         flush_workqueue(hdev->req_workqueue);
1689 
1690         /* For controllers not using the management interface and that
1691          * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1692          * so that pairing works for them. Once the management interface
1693          * is in use this bit will be cleared again and userspace has
1694          * to explicitly enable it.
1695          */
1696         if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1697             !hci_dev_test_flag(hdev, HCI_MGMT))
1698                 hci_dev_set_flag(hdev, HCI_BONDABLE);
1699 
1700         err = hci_dev_do_open(hdev);
1701 
1702 done:
1703         hci_dev_put(hdev);
1704         return err;
1705 }
1706 
1707 /* This function requires the caller holds hdev->lock */
1708 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1709 {
1710         struct hci_conn_params *p;
1711 
1712         list_for_each_entry(p, &hdev->le_conn_params, list) {
1713                 if (p->conn) {
1714                         hci_conn_drop(p->conn);
1715                         hci_conn_put(p->conn);
1716                         p->conn = NULL;
1717                 }
1718                 list_del_init(&p->action);
1719         }
1720 
1721         BT_DBG("All LE pending actions cleared");
1722 }
1723 
1724 int hci_dev_do_close(struct hci_dev *hdev)
1725 {
1726         bool auto_off;
1727 
1728         BT_DBG("%s %p", hdev->name, hdev);
1729 
1730         cancel_delayed_work(&hdev->power_off);
1731         cancel_delayed_work(&hdev->ncmd_timer);
1732 
1733         hci_request_cancel_all(hdev);
1734         hci_req_sync_lock(hdev);
1735 
1736         if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
1737             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1738             test_bit(HCI_UP, &hdev->flags)) {
1739                 /* Execute vendor specific shutdown routine */
1740                 if (hdev->shutdown)
1741                         hdev->shutdown(hdev);
1742         }
1743 
1744         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1745                 cancel_delayed_work_sync(&hdev->cmd_timer);
1746                 hci_req_sync_unlock(hdev);
1747                 return 0;
1748         }
1749 
1750         hci_leds_update_powered(hdev, false);
1751 
1752         /* Flush RX and TX works */
1753         flush_work(&hdev->tx_work);
1754         flush_work(&hdev->rx_work);
1755 
1756         if (hdev->discov_timeout > 0) {
1757                 hdev->discov_timeout = 0;
1758                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1759                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1760         }
1761 
1762         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1763                 cancel_delayed_work(&hdev->service_cache);
1764 
1765         if (hci_dev_test_flag(hdev, HCI_MGMT)) {
1766                 struct adv_info *adv_instance;
1767 
1768                 cancel_delayed_work_sync(&hdev->rpa_expired);
1769 
1770                 list_for_each_entry(adv_instance, &hdev->adv_instances, list)
1771                         cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1772         }
1773 
1774         /* Avoid potential lockdep warnings from the *_flush() calls by
1775          * ensuring the workqueue is empty up front.
1776          */
1777         drain_workqueue(hdev->workqueue);
1778 
1779         hci_dev_lock(hdev);
1780 
1781         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1782 
1783         auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1784 
1785         if (!auto_off && hdev->dev_type == HCI_PRIMARY &&
1786             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1787             hci_dev_test_flag(hdev, HCI_MGMT))
1788                 __mgmt_power_off(hdev);
1789 
1790         hci_inquiry_cache_flush(hdev);
1791         hci_pend_le_actions_clear(hdev);
1792         hci_conn_hash_flush(hdev);
1793         hci_dev_unlock(hdev);
1794 
1795         smp_unregister(hdev);
1796 
1797         hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1798 
1799         aosp_do_close(hdev);
1800         msft_do_close(hdev);
1801 
1802         if (hdev->flush)
1803                 hdev->flush(hdev);
1804 
1805         /* Reset device */
1806         skb_queue_purge(&hdev->cmd_q);
1807         atomic_set(&hdev->cmd_cnt, 1);
1808         if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1809             !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1810                 set_bit(HCI_INIT, &hdev->flags);
1811                 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1812                 clear_bit(HCI_INIT, &hdev->flags);
1813         }
1814 
1815         /* flush cmd  work */
1816         flush_work(&hdev->cmd_work);
1817 
1818         /* Drop queues */
1819         skb_queue_purge(&hdev->rx_q);
1820         skb_queue_purge(&hdev->cmd_q);
1821         skb_queue_purge(&hdev->raw_q);
1822 
1823         /* Drop last sent command */
1824         if (hdev->sent_cmd) {
1825                 cancel_delayed_work_sync(&hdev->cmd_timer);
1826                 kfree_skb(hdev->sent_cmd);
1827                 hdev->sent_cmd = NULL;
1828         }
1829 
1830         clear_bit(HCI_RUNNING, &hdev->flags);
1831         hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1832 
1833         if (test_and_clear_bit(SUSPEND_POWERING_DOWN, hdev->suspend_tasks))
1834                 wake_up(&hdev->suspend_wait_q);
1835 
1836         /* After this point our queues are empty
1837          * and no tasks are scheduled. */
1838         hdev->close(hdev);
1839 
1840         /* Clear flags */
1841         hdev->flags &= BIT(HCI_RAW);
1842         hci_dev_clear_volatile_flags(hdev);
1843 
1844         /* Controller radio is available but is currently powered down */
1845         hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1846 
1847         memset(hdev->eir, 0, sizeof(hdev->eir));
1848         memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1849         bacpy(&hdev->random_addr, BDADDR_ANY);
1850 
1851         hci_req_sync_unlock(hdev);
1852 
1853         hci_dev_put(hdev);
1854         return 0;
1855 }
1856 
1857 int hci_dev_close(__u16 dev)
1858 {
1859         struct hci_dev *hdev;
1860         int err;
1861 
1862         hdev = hci_dev_get(dev);
1863         if (!hdev)
1864                 return -ENODEV;
1865 
1866         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1867                 err = -EBUSY;
1868                 goto done;
1869         }
1870 
1871         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1872                 cancel_delayed_work(&hdev->power_off);
1873 
1874         err = hci_dev_do_close(hdev);
1875 
1876 done:
1877         hci_dev_put(hdev);
1878         return err;
1879 }
1880 
1881 static int hci_dev_do_reset(struct hci_dev *hdev)
1882 {
1883         int ret;
1884 
1885         BT_DBG("%s %p", hdev->name, hdev);
1886 
1887         hci_req_sync_lock(hdev);
1888 
1889         /* Drop queues */
1890         skb_queue_purge(&hdev->rx_q);
1891         skb_queue_purge(&hdev->cmd_q);
1892 
1893         /* Avoid potential lockdep warnings from the *_flush() calls by
1894          * ensuring the workqueue is empty up front.
1895          */
1896         drain_workqueue(hdev->workqueue);
1897 
1898         hci_dev_lock(hdev);
1899         hci_inquiry_cache_flush(hdev);
1900         hci_conn_hash_flush(hdev);
1901         hci_dev_unlock(hdev);
1902 
1903         if (hdev->flush)
1904                 hdev->flush(hdev);
1905 
1906         atomic_set(&hdev->cmd_cnt, 1);
1907         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1908 
1909         ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1910 
1911         hci_req_sync_unlock(hdev);
1912         return ret;
1913 }
1914 
1915 int hci_dev_reset(__u16 dev)
1916 {
1917         struct hci_dev *hdev;
1918         int err;
1919 
1920         hdev = hci_dev_get(dev);
1921         if (!hdev)
1922                 return -ENODEV;
1923 
1924         if (!test_bit(HCI_UP, &hdev->flags)) {
1925                 err = -ENETDOWN;
1926                 goto done;
1927         }
1928 
1929         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1930                 err = -EBUSY;
1931                 goto done;
1932         }
1933 
1934         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1935                 err = -EOPNOTSUPP;
1936                 goto done;
1937         }
1938 
1939         err = hci_dev_do_reset(hdev);
1940 
1941 done:
1942         hci_dev_put(hdev);
1943         return err;
1944 }
1945 
1946 int hci_dev_reset_stat(__u16 dev)
1947 {
1948         struct hci_dev *hdev;
1949         int ret = 0;
1950 
1951         hdev = hci_dev_get(dev);
1952         if (!hdev)
1953                 return -ENODEV;
1954 
1955         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1956                 ret = -EBUSY;
1957                 goto done;
1958         }
1959 
1960         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1961                 ret = -EOPNOTSUPP;
1962                 goto done;
1963         }
1964 
1965         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1966 
1967 done:
1968         hci_dev_put(hdev);
1969         return ret;
1970 }
1971 
1972 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1973 {
1974         bool conn_changed, discov_changed;
1975 
1976         BT_DBG("%s scan 0x%02x", hdev->name, scan);
1977 
1978         if ((scan & SCAN_PAGE))
1979                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1980                                                           HCI_CONNECTABLE);
1981         else
1982                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1983                                                            HCI_CONNECTABLE);
1984 
1985         if ((scan & SCAN_INQUIRY)) {
1986                 discov_changed = !hci_dev_test_and_set_flag(hdev,
1987                                                             HCI_DISCOVERABLE);
1988         } else {
1989                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1990                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1991                                                              HCI_DISCOVERABLE);
1992         }
1993 
1994         if (!hci_dev_test_flag(hdev, HCI_MGMT))
1995                 return;
1996 
1997         if (conn_changed || discov_changed) {
1998                 /* In case this was disabled through mgmt */
1999                 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
2000 
2001                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2002                         hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
2003 
2004                 mgmt_new_settings(hdev);
2005         }
2006 }
2007 
2008 int hci_dev_cmd(unsigned int cmd, void __user *arg)
2009 {
2010         struct hci_dev *hdev;
2011         struct hci_dev_req dr;
2012         int err = 0;
2013 
2014         if (copy_from_user(&dr, arg, sizeof(dr)))
2015                 return -EFAULT;
2016 
2017         hdev = hci_dev_get(dr.dev_id);
2018         if (!hdev)
2019                 return -ENODEV;
2020 
2021         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
2022                 err = -EBUSY;
2023                 goto done;
2024         }
2025 
2026         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
2027                 err = -EOPNOTSUPP;
2028                 goto done;
2029         }
2030 
2031         if (hdev->dev_type != HCI_PRIMARY) {
2032                 err = -EOPNOTSUPP;
2033                 goto done;
2034         }
2035 
2036         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2037                 err = -EOPNOTSUPP;
2038                 goto done;
2039         }
2040 
2041         switch (cmd) {
2042         case HCISETAUTH:
2043                 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2044                                    HCI_INIT_TIMEOUT, NULL);
2045                 break;
2046 
2047         case HCISETENCRYPT:
2048                 if (!lmp_encrypt_capable(hdev)) {
2049                         err = -EOPNOTSUPP;
2050                         break;
2051                 }
2052 
2053                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
2054                         /* Auth must be enabled first */
2055                         err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2056                                            HCI_INIT_TIMEOUT, NULL);
2057                         if (err)
2058                                 break;
2059                 }
2060 
2061                 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
2062                                    HCI_INIT_TIMEOUT, NULL);
2063                 break;
2064 
2065         case HCISETSCAN:
2066                 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
2067                                    HCI_INIT_TIMEOUT, NULL);
2068 
2069                 /* Ensure that the connectable and discoverable states
2070                  * get correctly modified as this was a non-mgmt change.
2071                  */
2072                 if (!err)
2073                         hci_update_scan_state(hdev, dr.dev_opt);
2074                 break;
2075 
2076         case HCISETLINKPOL:
2077                 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
2078                                    HCI_INIT_TIMEOUT, NULL);
2079                 break;
2080 
2081         case HCISETLINKMODE:
2082                 hdev->link_mode = ((__u16) dr.dev_opt) &
2083                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
2084                 break;
2085 
2086         case HCISETPTYPE:
2087                 if (hdev->pkt_type == (__u16) dr.dev_opt)
2088                         break;
2089 
2090                 hdev->pkt_type = (__u16) dr.dev_opt;
2091                 mgmt_phy_configuration_changed(hdev, NULL);
2092                 break;
2093 
2094         case HCISETACLMTU:
2095                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
2096                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
2097                 break;
2098 
2099         case HCISETSCOMTU:
2100                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
2101                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
2102                 break;
2103 
2104         default:
2105                 err = -EINVAL;
2106                 break;
2107         }
2108 
2109 done:
2110         hci_dev_put(hdev);
2111         return err;
2112 }
2113 
2114 int hci_get_dev_list(void __user *arg)
2115 {
2116         struct hci_dev *hdev;
2117         struct hci_dev_list_req *dl;
2118         struct hci_dev_req *dr;
2119         int n = 0, size, err;
2120         __u16 dev_num;
2121 
2122         if (get_user(dev_num, (__u16 __user *) arg))
2123                 return -EFAULT;
2124 
2125         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2126                 return -EINVAL;
2127 
2128         size = sizeof(*dl) + dev_num * sizeof(*dr);
2129 
2130         dl = kzalloc(size, GFP_KERNEL);
2131         if (!dl)
2132                 return -ENOMEM;
2133 
2134         dr = dl->dev_req;
2135 
2136         read_lock(&hci_dev_list_lock);
2137         list_for_each_entry(hdev, &hci_dev_list, list) {
2138                 unsigned long flags = hdev->flags;
2139 
2140                 /* When the auto-off is configured it means the transport
2141                  * is running, but in that case still indicate that the
2142                  * device is actually down.
2143                  */
2144                 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2145                         flags &= ~BIT(HCI_UP);
2146 
2147                 (dr + n)->dev_id  = hdev->id;
2148                 (dr + n)->dev_opt = flags;
2149 
2150                 if (++n >= dev_num)
2151                         break;
2152         }
2153         read_unlock(&hci_dev_list_lock);
2154 
2155         dl->dev_num = n;
2156         size = sizeof(*dl) + n * sizeof(*dr);
2157 
2158         err = copy_to_user(arg, dl, size);
2159         kfree(dl);
2160 
2161         return err ? -EFAULT : 0;
2162 }
2163 
2164 int hci_get_dev_info(void __user *arg)
2165 {
2166         struct hci_dev *hdev;
2167         struct hci_dev_info di;
2168         unsigned long flags;
2169         int err = 0;
2170 
2171         if (copy_from_user(&di, arg, sizeof(di)))
2172                 return -EFAULT;
2173 
2174         hdev = hci_dev_get(di.dev_id);
2175         if (!hdev)
2176                 return -ENODEV;
2177 
2178         /* When the auto-off is configured it means the transport
2179          * is running, but in that case still indicate that the
2180          * device is actually down.
2181          */
2182         if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2183                 flags = hdev->flags & ~BIT(HCI_UP);
2184         else
2185                 flags = hdev->flags;
2186 
2187         strcpy(di.name, hdev->name);
2188         di.bdaddr   = hdev->bdaddr;
2189         di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2190         di.flags    = flags;
2191         di.pkt_type = hdev->pkt_type;
2192         if (lmp_bredr_capable(hdev)) {
2193                 di.acl_mtu  = hdev->acl_mtu;
2194                 di.acl_pkts = hdev->acl_pkts;
2195                 di.sco_mtu  = hdev->sco_mtu;
2196                 di.sco_pkts = hdev->sco_pkts;
2197         } else {
2198                 di.acl_mtu  = hdev->le_mtu;
2199                 di.acl_pkts = hdev->le_pkts;
2200                 di.sco_mtu  = 0;
2201                 di.sco_pkts = 0;
2202         }
2203         di.link_policy = hdev->link_policy;
2204         di.link_mode   = hdev->link_mode;
2205 
2206         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2207         memcpy(&di.features, &hdev->features, sizeof(di.features));
2208 
2209         if (copy_to_user(arg, &di, sizeof(di)))
2210                 err = -EFAULT;
2211 
2212         hci_dev_put(hdev);
2213 
2214         return err;
2215 }
2216 
2217 /* ---- Interface to HCI drivers ---- */
2218 
2219 static int hci_rfkill_set_block(void *data, bool blocked)
2220 {
2221         struct hci_dev *hdev = data;
2222 
2223         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2224 
2225         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2226                 return -EBUSY;
2227 
2228         if (blocked) {
2229                 hci_dev_set_flag(hdev, HCI_RFKILLED);
2230                 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2231                     !hci_dev_test_flag(hdev, HCI_CONFIG))
2232                         hci_dev_do_close(hdev);
2233         } else {
2234                 hci_dev_clear_flag(hdev, HCI_RFKILLED);
2235         }
2236 
2237         return 0;
2238 }
2239 
2240 static const struct rfkill_ops hci_rfkill_ops = {
2241         .set_block = hci_rfkill_set_block,
2242 };
2243 
2244 static void hci_power_on(struct work_struct *work)
2245 {
2246         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2247         int err;
2248 
2249         BT_DBG("%s", hdev->name);
2250 
2251         if (test_bit(HCI_UP, &hdev->flags) &&
2252             hci_dev_test_flag(hdev, HCI_MGMT) &&
2253             hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
2254                 cancel_delayed_work(&hdev->power_off);
2255                 hci_req_sync_lock(hdev);
2256                 err = __hci_req_hci_power_on(hdev);
2257                 hci_req_sync_unlock(hdev);
2258                 mgmt_power_on(hdev, err);
2259                 return;
2260         }
2261 
2262         err = hci_dev_do_open(hdev);
2263         if (err < 0) {
2264                 hci_dev_lock(hdev);
2265                 mgmt_set_powered_failed(hdev, err);
2266                 hci_dev_unlock(hdev);
2267                 return;
2268         }
2269 
2270         /* During the HCI setup phase, a few error conditions are
2271          * ignored and they need to be checked now. If they are still
2272          * valid, it is important to turn the device back off.
2273          */
2274         if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2275             hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2276             (hdev->dev_type == HCI_PRIMARY &&
2277              !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2278              !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2279                 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2280                 hci_dev_do_close(hdev);
2281         } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2282                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2283                                    HCI_AUTO_OFF_TIMEOUT);
2284         }
2285 
2286         if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2287                 /* For unconfigured devices, set the HCI_RAW flag
2288                  * so that userspace can easily identify them.
2289                  */
2290                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2291                         set_bit(HCI_RAW, &hdev->flags);
2292 
2293                 /* For fully configured devices, this will send
2294                  * the Index Added event. For unconfigured devices,
2295                  * it will send Unconfigued Index Added event.
2296                  *
2297                  * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2298                  * and no event will be send.
2299                  */
2300                 mgmt_index_added(hdev);
2301         } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2302                 /* When the controller is now configured, then it
2303                  * is important to clear the HCI_RAW flag.
2304                  */
2305                 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2306                         clear_bit(HCI_RAW, &hdev->flags);
2307 
2308                 /* Powering on the controller with HCI_CONFIG set only
2309                  * happens with the transition from unconfigured to
2310                  * configured. This will send the Index Added event.
2311                  */
2312                 mgmt_index_added(hdev);
2313         }
2314 }
2315 
2316 static void hci_power_off(struct work_struct *work)
2317 {
2318         struct hci_dev *hdev = container_of(work, struct hci_dev,
2319                                             power_off.work);
2320 
2321         BT_DBG("%s", hdev->name);
2322 
2323         hci_dev_do_close(hdev);
2324 }
2325 
2326 static void hci_error_reset(struct work_struct *work)
2327 {
2328         struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2329 
2330         BT_DBG("%s", hdev->name);
2331 
2332         if (hdev->hw_error)
2333                 hdev->hw_error(hdev, hdev->hw_error_code);
2334         else
2335                 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
2336 
2337         if (hci_dev_do_close(hdev))
2338                 return;
2339 
2340         hci_dev_do_open(hdev);
2341 }
2342 
2343 void hci_uuids_clear(struct hci_dev *hdev)
2344 {
2345         struct bt_uuid *uuid, *tmp;
2346 
2347         list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2348                 list_del(&uuid->list);
2349                 kfree(uuid);
2350         }
2351 }
2352 
2353 void hci_link_keys_clear(struct hci_dev *hdev)
2354 {
2355         struct link_key *key;
2356 
2357         list_for_each_entry(key, &hdev->link_keys, list) {
2358                 list_del_rcu(&key->list);
2359                 kfree_rcu(key, rcu);
2360         }
2361 }
2362 
2363 void hci_smp_ltks_clear(struct hci_dev *hdev)
2364 {
2365         struct smp_ltk *k;
2366 
2367         list_for_each_entry(k, &hdev->long_term_keys, list) {
2368                 list_del_rcu(&k->list);
2369                 kfree_rcu(k, rcu);
2370         }
2371 }
2372 
2373 void hci_smp_irks_clear(struct hci_dev *hdev)
2374 {
2375         struct smp_irk *k;
2376 
2377         list_for_each_entry(k, &hdev->identity_resolving_keys, list) {
2378                 list_del_rcu(&k->list);
2379                 kfree_rcu(k, rcu);
2380         }
2381 }
2382 
2383 void hci_blocked_keys_clear(struct hci_dev *hdev)
2384 {
2385         struct blocked_key *b;
2386 
2387         list_for_each_entry(b, &hdev->blocked_keys, list) {
2388                 list_del_rcu(&b->list);
2389                 kfree_rcu(b, rcu);
2390         }
2391 }
2392 
2393 bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
2394 {
2395         bool blocked = false;
2396         struct blocked_key *b;
2397 
2398         rcu_read_lock();
2399         list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
2400                 if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
2401                         blocked = true;
2402                         break;
2403                 }
2404         }
2405 
2406         rcu_read_unlock();
2407         return blocked;
2408 }
2409 
2410 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2411 {
2412         struct link_key *k;
2413 
2414         rcu_read_lock();
2415         list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2416                 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2417                         rcu_read_unlock();
2418 
2419                         if (hci_is_blocked_key(hdev,
2420                                                HCI_BLOCKED_KEY_TYPE_LINKKEY,
2421                                                k->val)) {
2422                                 bt_dev_warn_ratelimited(hdev,
2423                                                         "Link key blocked for %pMR",
2424                                                         &k->bdaddr);
2425                                 return NULL;
2426                         }
2427 
2428                         return k;
2429                 }
2430         }
2431         rcu_read_unlock();
2432 
2433         return NULL;
2434 }
2435 
2436 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2437                                u8 key_type, u8 old_key_type)
2438 {
2439         /* Legacy key */
2440         if (key_type < 0x03)
2441                 return true;
2442 
2443         /* Debug keys are insecure so don't store them persistently */
2444         if (key_type == HCI_LK_DEBUG_COMBINATION)
2445                 return false;
2446 
2447         /* Changed combination key and there's no previous one */
2448         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2449                 return false;
2450 
2451         /* Security mode 3 case */
2452         if (!conn)
2453                 return true;
2454 
2455         /* BR/EDR key derived using SC from an LE link */
2456         if (conn->type == LE_LINK)
2457                 return true;
2458 
2459         /* Neither local nor remote side had no-bonding as requirement */
2460         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2461                 return true;
2462 
2463         /* Local side had dedicated bonding as requirement */
2464         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2465                 return true;
2466 
2467         /* Remote side had dedicated bonding as requirement */
2468         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2469                 return true;
2470 
2471         /* If none of the above criteria match, then don't store the key
2472          * persistently */
2473         return false;
2474 }
2475 
2476 static u8 ltk_role(u8 type)
2477 {
2478         if (type == SMP_LTK)
2479                 return HCI_ROLE_MASTER;
2480 
2481         return HCI_ROLE_SLAVE;
2482 }
2483 
2484 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2485                              u8 addr_type, u8 role)
2486 {
2487         struct smp_ltk *k;
2488 
2489         rcu_read_lock();
2490         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2491                 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2492                         continue;
2493 
2494                 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2495                         rcu_read_unlock();
2496 
2497                         if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
2498                                                k->val)) {
2499                                 bt_dev_warn_ratelimited(hdev,
2500                                                         "LTK blocked for %pMR",
2501                                                         &k->bdaddr);
2502                                 return NULL;
2503                         }
2504 
2505                         return k;
2506                 }
2507         }
2508         rcu_read_unlock();
2509 
2510         return NULL;
2511 }
2512 
2513 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2514 {
2515         struct smp_irk *irk_to_return = NULL;
2516         struct smp_irk *irk;
2517 
2518         rcu_read_lock();
2519         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2520                 if (!bacmp(&irk->rpa, rpa)) {
2521                         irk_to_return = irk;
2522                         goto done;
2523                 }
2524         }
2525 
2526         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2527                 if (smp_irk_matches(hdev, irk->val, rpa)) {
2528                         bacpy(&irk->rpa, rpa);
2529                         irk_to_return = irk;
2530                         goto done;
2531                 }
2532         }
2533 
2534 done:
2535         if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2536                                                 irk_to_return->val)) {
2537                 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
2538                                         &irk_to_return->bdaddr);
2539                 irk_to_return = NULL;
2540         }
2541 
2542         rcu_read_unlock();
2543 
2544         return irk_to_return;
2545 }
2546 
2547 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2548                                      u8 addr_type)
2549 {
2550         struct smp_irk *irk_to_return = NULL;
2551         struct smp_irk *irk;
2552 
2553         /* Identity Address must be public or static random */
2554         if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2555                 return NULL;
2556 
2557         rcu_read_lock();
2558         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2559                 if (addr_type == irk->addr_type &&
2560                     bacmp(bdaddr, &irk->bdaddr) == 0) {
2561                         irk_to_return = irk;
2562                         goto done;
2563                 }
2564         }
2565 
2566 done:
2567 
2568         if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2569                                                 irk_to_return->val)) {
2570                 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
2571                                         &irk_to_return->bdaddr);
2572                 irk_to_return = NULL;
2573         }
2574 
2575         rcu_read_unlock();
2576 
2577         return irk_to_return;
2578 }
2579 
2580 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2581                                   bdaddr_t *bdaddr, u8 *val, u8 type,
2582                                   u8 pin_len, bool *persistent)
2583 {
2584         struct link_key *key, *old_key;
2585         u8 old_key_type;
2586 
2587         old_key = hci_find_link_key(hdev, bdaddr);
2588         if (old_key) {
2589                 old_key_type = old_key->type;
2590                 key = old_key;
2591         } else {
2592                 old_key_type = conn ? conn->key_type : 0xff;
2593                 key = kzalloc(sizeof(*key), GFP_KERNEL);
2594                 if (!key)
2595                         return NULL;
2596                 list_add_rcu(&key->list, &hdev->link_keys);
2597         }
2598 
2599         BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2600 
2601         /* Some buggy controller combinations generate a changed
2602          * combination key for legacy pairing even when there's no
2603          * previous key */
2604         if (type == HCI_LK_CHANGED_COMBINATION &&
2605             (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2606                 type = HCI_LK_COMBINATION;
2607                 if (conn)
2608                         conn->key_type = type;
2609         }
2610 
2611         bacpy(&key->bdaddr, bdaddr);
2612         memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2613         key->pin_len = pin_len;
2614 
2615         if (type == HCI_LK_CHANGED_COMBINATION)
2616                 key->type = old_key_type;
2617         else
2618                 key->type = type;
2619 
2620         if (persistent)
2621                 *persistent = hci_persistent_key(hdev, conn, type,
2622                                                  old_key_type);
2623 
2624         return key;
2625 }
2626 
2627 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2628                             u8 addr_type, u8 type, u8 authenticated,
2629                             u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2630 {
2631         struct smp_ltk *key, *old_key;
2632         u8 role = ltk_role(type);
2633 
2634         old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2635         if (old_key)
2636                 key = old_key;
2637         else {
2638                 key = kzalloc(sizeof(*key), GFP_KERNEL);
2639                 if (!key)
2640                         return NULL;
2641                 list_add_rcu(&key->list, &hdev->long_term_keys);
2642         }
2643 
2644         bacpy(&key->bdaddr, bdaddr);
2645         key->bdaddr_type = addr_type;
2646         memcpy(key->val, tk, sizeof(key->val));
2647         key->authenticated = authenticated;
2648         key->ediv = ediv;
2649         key->rand = rand;
2650         key->enc_size = enc_size;
2651         key->type = type;
2652 
2653         return key;
2654 }
2655 
2656 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2657                             u8 addr_type, u8 val[16], bdaddr_t *rpa)
2658 {
2659         struct smp_irk *irk;
2660 
2661         irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2662         if (!irk) {
2663                 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2664                 if (!irk)
2665                         return NULL;
2666 
2667                 bacpy(&irk->bdaddr, bdaddr);
2668                 irk->addr_type = addr_type;
2669 
2670                 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2671         }
2672 
2673         memcpy(irk->val, val, 16);
2674         bacpy(&irk->rpa, rpa);
2675 
2676         return irk;
2677 }
2678 
2679 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2680 {
2681         struct link_key *key;
2682 
2683         key = hci_find_link_key(hdev, bdaddr);
2684         if (!key)
2685                 return -ENOENT;
2686 
2687         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2688 
2689         list_del_rcu(&key->list);
2690         kfree_rcu(key, rcu);
2691 
2692         return 0;
2693 }
2694 
2695 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2696 {
2697         struct smp_ltk *k;
2698         int removed = 0;
2699 
2700         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2701                 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2702                         continue;
2703 
2704                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2705 
2706                 list_del_rcu(&k->list);
2707                 kfree_rcu(k, rcu);
2708                 removed++;
2709         }
2710 
2711         return removed ? 0 : -ENOENT;
2712 }
2713 
2714 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2715 {
2716         struct smp_irk *k;
2717 
2718         list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2719                 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2720                         continue;
2721 
2722                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2723 
2724                 list_del_rcu(&k->list);
2725                 kfree_rcu(k, rcu);
2726         }
2727 }
2728 
2729 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2730 {
2731         struct smp_ltk *k;
2732         struct smp_irk *irk;
2733         u8 addr_type;
2734 
2735         if (type == BDADDR_BREDR) {
2736                 if (hci_find_link_key(hdev, bdaddr))
2737                         return true;
2738                 return false;
2739         }
2740 
2741         /* Convert to HCI addr type which struct smp_ltk uses */
2742         if (type == BDADDR_LE_PUBLIC)
2743                 addr_type = ADDR_LE_DEV_PUBLIC;
2744         else
2745                 addr_type = ADDR_LE_DEV_RANDOM;
2746 
2747         irk = hci_get_irk(hdev, bdaddr, addr_type);
2748         if (irk) {
2749                 bdaddr = &irk->bdaddr;
2750                 addr_type = irk->addr_type;
2751         }
2752 
2753         rcu_read_lock();
2754         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2755                 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2756                         rcu_read_unlock();
2757                         return true;
2758                 }
2759         }
2760         rcu_read_unlock();
2761 
2762         return false;
2763 }
2764 
2765 /* HCI command timer function */
2766 static void hci_cmd_timeout(struct work_struct *work)
2767 {
2768         struct hci_dev *hdev = container_of(work, struct hci_dev,
2769                                             cmd_timer.work);
2770 
2771         if (hdev->sent_cmd) {
2772                 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2773                 u16 opcode = __le16_to_cpu(sent->opcode);
2774 
2775                 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
2776         } else {
2777                 bt_dev_err(hdev, "command tx timeout");
2778         }
2779 
2780         if (hdev->cmd_timeout)
2781                 hdev->cmd_timeout(hdev);
2782 
2783         atomic_set(&hdev->cmd_cnt, 1);
2784         queue_work(hdev->workqueue, &hdev->cmd_work);
2785 }
2786 
2787 /* HCI ncmd timer function */
2788 static void hci_ncmd_timeout(struct work_struct *work)
2789 {
2790         struct hci_dev *hdev = container_of(work, struct hci_dev,
2791                                             ncmd_timer.work);
2792 
2793         bt_dev_err(hdev, "Controller not accepting commands anymore: ncmd = 0");
2794 
2795         /* During HCI_INIT phase no events can be injected if the ncmd timer
2796          * triggers since the procedure has its own timeout handling.
2797          */
2798         if (test_bit(HCI_INIT, &hdev->flags))
2799                 return;
2800 
2801         /* This is an irrecoverable state, inject hardware error event */
2802         hci_reset_dev(hdev);
2803 }
2804 
2805 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2806                                           bdaddr_t *bdaddr, u8 bdaddr_type)
2807 {
2808         struct oob_data *data;
2809 
2810         list_for_each_entry(data, &hdev->remote_oob_data, list) {
2811                 if (bacmp(bdaddr, &data->bdaddr) != 0)
2812                         continue;
2813                 if (data->bdaddr_type != bdaddr_type)
2814                         continue;
2815                 return data;
2816         }
2817 
2818         return NULL;
2819 }
2820 
2821 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2822                                u8 bdaddr_type)
2823 {
2824         struct oob_data *data;
2825 
2826         data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2827         if (!data)
2828                 return -ENOENT;
2829 
2830         BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2831 
2832         list_del(&data->list);
2833         kfree(data);
2834 
2835         return 0;
2836 }
2837 
2838 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2839 {
2840         struct oob_data *data, *n;
2841 
2842         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2843                 list_del(&data->list);
2844                 kfree(data);
2845         }
2846 }
2847 
2848 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2849                             u8 bdaddr_type, u8 *hash192, u8 *rand192,
2850                             u8 *hash256, u8 *rand256)
2851 {
2852         struct oob_data *data;
2853 
2854         data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2855         if (!data) {
2856                 data = kmalloc(sizeof(*data), GFP_KERNEL);
2857                 if (!data)
2858                         return -ENOMEM;
2859 
2860                 bacpy(&data->bdaddr, bdaddr);
2861                 data->bdaddr_type = bdaddr_type;
2862                 list_add(&data->list, &hdev->remote_oob_data);
2863         }
2864 
2865         if (hash192 && rand192) {
2866                 memcpy(data->hash192, hash192, sizeof(data->hash192));
2867                 memcpy(data->rand192, rand192, sizeof(data->rand192));
2868                 if (hash256 && rand256)
2869                         data->present = 0x03;
2870         } else {
2871                 memset(data->hash192, 0, sizeof(data->hash192));
2872                 memset(data->rand192, 0, sizeof(data->rand192));
2873                 if (hash256 && rand256)
2874                         data->present = 0x02;
2875                 else
2876                         data->present = 0x00;
2877         }
2878 
2879         if (hash256 && rand256) {
2880                 memcpy(data->hash256, hash256, sizeof(data->hash256));
2881                 memcpy(data->rand256, rand256, sizeof(data->rand256));
2882         } else {
2883                 memset(data->hash256, 0, sizeof(data->hash256));
2884                 memset(data->rand256, 0, sizeof(data->rand256));
2885                 if (hash192 && rand192)
2886                         data->present = 0x01;
2887         }
2888 
2889         BT_DBG("%s for %pMR", hdev->name, bdaddr);
2890 
2891         return 0;
2892 }
2893 
2894 /* This function requires the caller holds hdev->lock */
2895 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2896 {
2897         struct adv_info *adv_instance;
2898 
2899         list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2900                 if (adv_instance->instance == instance)
2901                         return adv_instance;
2902         }
2903 
2904         return NULL;
2905 }
2906 
2907 /* This function requires the caller holds hdev->lock */
2908 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2909 {
2910         struct adv_info *cur_instance;
2911 
2912         cur_instance = hci_find_adv_instance(hdev, instance);
2913         if (!cur_instance)
2914                 return NULL;
2915 
2916         if (cur_instance == list_last_entry(&hdev->adv_instances,
2917                                             struct adv_info, list))
2918                 return list_first_entry(&hdev->adv_instances,
2919                                                  struct adv_info, list);
2920         else
2921                 return list_next_entry(cur_instance, list);
2922 }
2923 
2924 /* This function requires the caller holds hdev->lock */
2925 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2926 {
2927         struct adv_info *adv_instance;
2928 
2929         adv_instance = hci_find_adv_instance(hdev, instance);
2930         if (!adv_instance)
2931                 return -ENOENT;
2932 
2933         BT_DBG("%s removing %dMR", hdev->name, instance);
2934 
2935         if (hdev->cur_adv_instance == instance) {
2936                 if (hdev->adv_instance_timeout) {
2937                         cancel_delayed_work(&hdev->adv_instance_expire);
2938                         hdev->adv_instance_timeout = 0;
2939                 }
2940                 hdev->cur_adv_instance = 0x00;
2941         }
2942 
2943         cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2944 
2945         list_del(&adv_instance->list);
2946         kfree(adv_instance);
2947 
2948         hdev->adv_instance_cnt--;
2949 
2950         return 0;
2951 }
2952 
2953 void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
2954 {
2955         struct adv_info *adv_instance, *n;
2956 
2957         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
2958                 adv_instance->rpa_expired = rpa_expired;
2959 }
2960 
2961 /* This function requires the caller holds hdev->lock */
2962 void hci_adv_instances_clear(struct hci_dev *hdev)
2963 {
2964         struct adv_info *adv_instance, *n;
2965 
2966         if (hdev->adv_instance_timeout) {
2967                 cancel_delayed_work(&hdev->adv_instance_expire);
2968                 hdev->adv_instance_timeout = 0;
2969         }
2970 
2971         list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
2972                 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2973                 list_del(&adv_instance->list);
2974                 kfree(adv_instance);
2975         }
2976 
2977         hdev->adv_instance_cnt = 0;
2978         hdev->cur_adv_instance = 0x00;
2979 }
2980 
2981 static void adv_instance_rpa_expired(struct work_struct *work)
2982 {
2983         struct adv_info *adv_instance = container_of(work, struct adv_info,
2984                                                      rpa_expired_cb.work);
2985 
2986         BT_DBG("");
2987 
2988         adv_instance->rpa_expired = true;
2989 }
2990 
2991 /* This function requires the caller holds hdev->lock */
2992 int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2993                          u16 adv_data_len, u8 *adv_data,
2994                          u16 scan_rsp_len, u8 *scan_rsp_data,
2995                          u16 timeout, u16 duration, s8 tx_power,
2996                          u32 min_interval, u32 max_interval)
2997 {
2998         struct adv_info *adv_instance;
2999 
3000         adv_instance = hci_find_adv_instance(hdev, instance);
3001         if (adv_instance) {
3002                 memset(adv_instance->adv_data, 0,
3003                        sizeof(adv_instance->adv_data));
3004                 memset(adv_instance->scan_rsp_data, 0,
3005                        sizeof(adv_instance->scan_rsp_data));
3006         } else {
3007                 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
3008                     instance < 1 || instance > hdev->le_num_of_adv_sets)
3009                         return -EOVERFLOW;
3010 
3011                 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
3012                 if (!adv_instance)
3013                         return -ENOMEM;
3014 
3015                 adv_instance->pending = true;
3016                 adv_instance->instance = instance;
3017                 list_add(&adv_instance->list, &hdev->adv_instances);
3018                 hdev->adv_instance_cnt++;
3019         }
3020 
3021         adv_instance->flags = flags;
3022         adv_instance->adv_data_len = adv_data_len;
3023         adv_instance->scan_rsp_len = scan_rsp_len;
3024         adv_instance->min_interval = min_interval;
3025         adv_instance->max_interval = max_interval;
3026         adv_instance->tx_power = tx_power;
3027 
3028         if (adv_data_len)
3029                 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
3030 
3031         if (scan_rsp_len)
3032                 memcpy(adv_instance->scan_rsp_data,
3033                        scan_rsp_data, scan_rsp_len);
3034 
3035         adv_instance->timeout = timeout;
3036         adv_instance->remaining_time = timeout;
3037 
3038         if (duration == 0)
3039                 adv_instance->duration = hdev->def_multi_adv_rotation_duration;
3040         else
3041                 adv_instance->duration = duration;
3042 
3043         INIT_DELAYED_WORK(&adv_instance->rpa_expired_cb,
3044                           adv_instance_rpa_expired);
3045 
3046         BT_DBG("%s for %dMR", hdev->name, instance);
3047 
3048         return 0;
3049 }
3050 
3051 /* This function requires the caller holds hdev->lock */
3052 int hci_set_adv_instance_data(struct hci_dev *hdev, u8 instance,
3053                               u16 adv_data_len, u8 *adv_data,
3054                               u16 scan_rsp_len, u8 *scan_rsp_data)
3055 {
3056         struct adv_info *adv_instance;
3057 
3058         adv_instance = hci_find_adv_instance(hdev, instance);
3059 
3060         /* If advertisement doesn't exist, we can't modify its data */
3061         if (!adv_instance)
3062                 return -ENOENT;
3063 
3064         if (adv_data_len) {
3065                 memset(adv_instance->adv_data, 0,
3066                        sizeof(adv_instance->adv_data));
3067                 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
3068                 adv_instance->adv_data_len = adv_data_len;
3069         }
3070 
3071         if (scan_rsp_len) {
3072                 memset(adv_instance->scan_rsp_data, 0,
3073                        sizeof(adv_instance->scan_rsp_data));
3074                 memcpy(adv_instance->scan_rsp_data,
3075                        scan_rsp_data, scan_rsp_len);
3076                 adv_instance->scan_rsp_len = scan_rsp_len;
3077         }
3078 
3079         return 0;
3080 }
3081 
3082 /* This function requires the caller holds hdev->lock */
3083 void hci_adv_monitors_clear(struct hci_dev *hdev)
3084 {
3085         struct adv_monitor *monitor;
3086         int handle;
3087 
3088         idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
3089                 hci_free_adv_monitor(hdev, monitor);
3090 
3091         idr_destroy(&hdev->adv_monitors_idr);
3092 }
3093 
3094 /* Frees the monitor structure and do some bookkeepings.
3095  * This function requires the caller holds hdev->lock.
3096  */
3097 void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
3098 {
3099         struct adv_pattern *pattern;
3100         struct adv_pattern *tmp;
3101 
3102         if (!monitor)
3103                 return;
3104 
3105         list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list) {
3106                 list_del(&pattern->list);
3107                 kfree(pattern);
3108         }
3109 
3110         if (monitor->handle)
3111                 idr_remove(&hdev->adv_monitors_idr, monitor->handle);
3112 
3113         if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) {
3114                 hdev->adv_monitors_cnt--;
3115                 mgmt_adv_monitor_removed(hdev, monitor->handle);
3116         }
3117 
3118         kfree(monitor);
3119 }
3120 
3121 int hci_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
3122 {
3123         return mgmt_add_adv_patterns_monitor_complete(hdev, status);
3124 }
3125 
3126 int hci_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
3127 {
3128         return mgmt_remove_adv_monitor_complete(hdev, status);
3129 }
3130 
3131 /* Assigns handle to a monitor, and if offloading is supported and power is on,
3132  * also attempts to forward the request to the controller.
3133  * Returns true if request is forwarded (result is pending), false otherwise.
3134  * This function requires the caller holds hdev->lock.
3135  */
3136 bool hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor,
3137                          int *err)
3138 {
3139         int min, max, handle;
3140 
3141         *err = 0;
3142 
3143         if (!monitor) {
3144                 *err = -EINVAL;
3145                 return false;
3146         }
3147 
3148         min = HCI_MIN_ADV_MONITOR_HANDLE;
3149         max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES;
3150         handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max,
3151                            GFP_KERNEL);
3152         if (handle < 0) {
3153                 *err = handle;
3154                 return false;
3155         }
3156 
3157         monitor->handle = handle;
3158 
3159         if (!hdev_is_powered(hdev))
3160                 return false;
3161 
3162         switch (hci_get_adv_monitor_offload_ext(hdev)) {
3163         case HCI_ADV_MONITOR_EXT_NONE:
3164                 hci_update_background_scan(hdev);
3165                 bt_dev_dbg(hdev, "%s add monitor status %d", hdev->name, *err);
3166                 /* Message was not forwarded to controller - not an error */
3167                 return false;
3168         case HCI_ADV_MONITOR_EXT_MSFT:
3169                 *err = msft_add_monitor_pattern(hdev, monitor);
3170                 bt_dev_dbg(hdev, "%s add monitor msft status %d", hdev->name,
3171                            *err);
3172                 break;
3173         }
3174 
3175         return (*err == 0);
3176 }
3177 
3178 /* Attempts to tell the controller and free the monitor. If somehow the
3179  * controller doesn't have a corresponding handle, remove anyway.
3180  * Returns true if request is forwarded (result is pending), false otherwise.
3181  * This function requires the caller holds hdev->lock.
3182  */
3183 static bool hci_remove_adv_monitor(struct hci_dev *hdev,
3184                                    struct adv_monitor *monitor,
3185                                    u16 handle, int *err)
3186 {
3187         *err = 0;
3188 
3189         switch (hci_get_adv_monitor_offload_ext(hdev)) {
3190         case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */
3191                 goto free_monitor;
3192         case HCI_ADV_MONITOR_EXT_MSFT:
3193                 *err = msft_remove_monitor(hdev, monitor, handle);
3194                 break;
3195         }
3196 
3197         /* In case no matching handle registered, just free the monitor */
3198         if (*err == -ENOENT)
3199                 goto free_monitor;
3200 
3201         return (*err == 0);
3202 
3203 free_monitor:
3204         if (*err == -ENOENT)
3205                 bt_dev_warn(hdev, "Removing monitor with no matching handle %d",
3206                             monitor->handle);
3207         hci_free_adv_monitor(hdev, monitor);
3208 
3209         *err = 0;
3210         return false;
3211 }
3212 
3213 /* Returns true if request is forwarded (result is pending), false otherwise.
3214  * This function requires the caller holds hdev->lock.
3215  */
3216 bool hci_remove_single_adv_monitor(struct hci_dev *hdev, u16 handle, int *err)
3217 {
3218         struct adv_monitor *monitor = idr_find(&hdev->adv_monitors_idr, handle);
3219         bool pending;
3220 
3221         if (!monitor) {
3222                 *err = -EINVAL;
3223                 return false;
3224         }
3225 
3226         pending = hci_remove_adv_monitor(hdev, monitor, handle, err);
3227         if (!*err && !pending)
3228                 hci_update_background_scan(hdev);
3229 
3230         bt_dev_dbg(hdev, "%s remove monitor handle %d, status %d, %spending",
3231                    hdev->name, handle, *err, pending ? "" : "not ");
3232 
3233         return pending;
3234 }
3235 
3236 /* Returns true if request is forwarded (result is pending), false otherwise.
3237  * This function requires the caller holds hdev->lock.
3238  */
3239 bool hci_remove_all_adv_monitor(struct hci_dev *hdev, int *err)
3240 {
3241         struct adv_monitor *monitor;
3242         int idr_next_id = 0;
3243         bool pending = false;
3244         bool update = false;
3245 
3246         *err = 0;
3247 
3248         while (!*err && !pending) {
3249                 monitor = idr_get_next(&hdev->adv_monitors_idr, &idr_next_id);
3250                 if (!monitor)
3251                         break;
3252 
3253                 pending = hci_remove_adv_monitor(hdev, monitor, 0, err);
3254 
3255                 if (!*err && !pending)
3256                         update = true;
3257         }
3258 
3259         if (update)
3260                 hci_update_background_scan(hdev);
3261 
3262         bt_dev_dbg(hdev, "%s remove all monitors status %d, %spending",
3263                    hdev->name, *err, pending ? "" : "not ");
3264 
3265         return pending;
3266 }
3267 
3268 /* This function requires the caller holds hdev->lock */
3269 bool hci_is_adv_monitoring(struct hci_dev *hdev)
3270 {
3271         return !idr_is_empty(&hdev->adv_monitors_idr);
3272 }
3273 
3274 int hci_get_adv_monitor_offload_ext(struct hci_dev *hdev)
3275 {
3276         if (msft_monitor_supported(hdev))
3277                 return HCI_ADV_MONITOR_EXT_MSFT;
3278 
3279         return HCI_ADV_MONITOR_EXT_NONE;
3280 }
3281 
3282 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
3283                                          bdaddr_t *bdaddr, u8 type)
3284 {
3285         struct bdaddr_list *b;
3286 
3287         list_for_each_entry(b, bdaddr_list, list) {
3288                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3289                         return b;
3290         }
3291 
3292         return NULL;
3293 }
3294 
3295 struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
3296                                 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
3297                                 u8 type)
3298 {
3299         struct bdaddr_list_with_irk *b;
3300 
3301         list_for_each_entry(b, bdaddr_list, list) {
3302                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3303                         return b;
3304         }
3305 
3306         return NULL;
3307 }
3308 
3309 struct bdaddr_list_with_flags *
3310 hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list,
3311                                   bdaddr_t *bdaddr, u8 type)
3312 {
3313         struct bdaddr_list_with_flags *b;
3314 
3315         list_for_each_entry(b, bdaddr_list, list) {
3316                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3317                         return b;
3318         }
3319 
3320         return NULL;
3321 }
3322 
3323 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
3324 {
3325         struct bdaddr_list *b, *n;
3326 
3327         list_for_each_entry_safe(b, n, bdaddr_list, list) {
3328                 list_del(&b->list);
3329                 kfree(b);
3330         }
3331 }
3332 
3333 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
3334 {
3335         struct bdaddr_list *entry;
3336 
3337         if (!bacmp(bdaddr, BDADDR_ANY))
3338                 return -EBADF;
3339 
3340         if (hci_bdaddr_list_lookup(list, bdaddr, type))
3341                 return -EEXIST;
3342 
3343         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3344         if (!entry)
3345                 return -ENOMEM;
3346 
3347         bacpy(&entry->bdaddr, bdaddr);
3348         entry->bdaddr_type = type;
3349 
3350         list_add(&entry->list, list);
3351 
3352         return 0;
3353 }
3354 
3355 int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3356                                         u8 type, u8 *peer_irk, u8 *local_irk)
3357 {
3358         struct bdaddr_list_with_irk *entry;
3359 
3360         if (!bacmp(bdaddr, BDADDR_ANY))
3361                 return -EBADF;
3362 
3363         if (hci_bdaddr_list_lookup(list, bdaddr, type))
3364                 return -EEXIST;
3365 
3366         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3367         if (!entry)
3368                 return -ENOMEM;
3369 
3370         bacpy(&entry->bdaddr, bdaddr);
3371         entry->bdaddr_type = type;
3372 
3373         if (peer_irk)
3374                 memcpy(entry->peer_irk, peer_irk, 16);
3375 
3376         if (local_irk)
3377                 memcpy(entry->local_irk, local_irk, 16);
3378 
3379         list_add(&entry->list, list);
3380 
3381         return 0;
3382 }
3383 
3384 int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr,
3385                                    u8 type, u32 flags)
3386 {
3387         struct bdaddr_list_with_flags *entry;
3388 
3389         if (!bacmp(bdaddr, BDADDR_ANY))
3390                 return -EBADF;
3391 
3392         if (hci_bdaddr_list_lookup(list, bdaddr, type))
3393                 return -EEXIST;
3394 
3395         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3396         if (!entry)
3397                 return -ENOMEM;
3398 
3399         bacpy(&entry->bdaddr, bdaddr);
3400         entry->bdaddr_type = type;
3401         entry->current_flags = flags;
3402 
3403         list_add(&entry->list, list);
3404 
3405         return 0;
3406 }
3407 
3408 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
3409 {
3410         struct bdaddr_list *entry;
3411 
3412         if (!bacmp(bdaddr, BDADDR_ANY)) {
3413                 hci_bdaddr_list_clear(list);
3414                 return 0;
3415         }
3416 
3417         entry = hci_bdaddr_list_lookup(list, bdaddr, type);
3418         if (!entry)
3419                 return -ENOENT;
3420 
3421         list_del(&entry->list);
3422         kfree(entry);
3423 
3424         return 0;
3425 }
3426 
3427 int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3428                                                         u8 type)
3429 {
3430         struct bdaddr_list_with_irk *entry;
3431 
3432         if (!bacmp(bdaddr, BDADDR_ANY)) {
3433                 hci_bdaddr_list_clear(list);
3434                 return 0;
3435         }
3436 
3437         entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
3438         if (!entry)
3439                 return -ENOENT;
3440 
3441         list_del(&entry->list);
3442         kfree(entry);
3443 
3444         return 0;
3445 }
3446 
3447 int hci_bdaddr_list_del_with_flags(struct list_head *list, bdaddr_t *bdaddr,
3448                                    u8 type)
3449 {
3450         struct bdaddr_list_with_flags *entry;
3451 
3452         if (!bacmp(bdaddr, BDADDR_ANY)) {
3453                 hci_bdaddr_list_clear(list);
3454                 return 0;
3455         }
3456 
3457         entry = hci_bdaddr_list_lookup_with_flags(list, bdaddr, type);
3458         if (!entry)
3459                 return -ENOENT;
3460 
3461         list_del(&entry->list);
3462         kfree(entry);
3463 
3464         return 0;
3465 }
3466 
3467 /* This function requires the caller holds hdev->lock */
3468 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
3469                                                bdaddr_t *addr, u8 addr_type)
3470 {
3471         struct hci_conn_params *params;
3472 
3473         list_for_each_entry(params, &hdev->le_conn_params, list) {
3474                 if (bacmp(&params->addr, addr) == 0 &&
3475                     params->addr_type == addr_type) {
3476                         return params;
3477                 }
3478         }
3479 
3480         return NULL;
3481 }
3482 
3483 /* This function requires the caller holds hdev->lock */
3484 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
3485                                                   bdaddr_t *addr, u8 addr_type)
3486 {
3487         struct hci_conn_params *param;
3488 
3489         switch (addr_type) {
3490         case ADDR_LE_DEV_PUBLIC_RESOLVED:
3491                 addr_type = ADDR_LE_DEV_PUBLIC;
3492                 break;
3493         case ADDR_LE_DEV_RANDOM_RESOLVED:
3494                 addr_type = ADDR_LE_DEV_RANDOM;
3495                 break;
3496         }
3497 
3498         list_for_each_entry(param, list, action) {
3499                 if (bacmp(&param->addr, addr) == 0 &&
3500                     param->addr_type == addr_type)
3501                         return param;
3502         }
3503 
3504         return NULL;
3505 }
3506 
3507 /* This function requires the caller holds hdev->lock */
3508 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
3509                                             bdaddr_t *addr, u8 addr_type)
3510 {
3511         struct hci_conn_params *params;
3512 
3513         params = hci_conn_params_lookup(hdev, addr, addr_type);
3514         if (params)
3515                 return params;
3516 
3517         params = kzalloc(sizeof(*params), GFP_KERNEL);
3518         if (!params) {
3519                 bt_dev_err(hdev, "out of memory");
3520                 return NULL;
3521         }
3522 
3523         bacpy(&params->addr, addr);
3524         params->addr_type = addr_type;
3525 
3526         list_add(&params->list, &hdev->le_conn_params);
3527         INIT_LIST_HEAD(&params->action);
3528 
3529         params->conn_min_interval = hdev->le_conn_min_interval;
3530         params->conn_max_interval = hdev->le_conn_max_interval;
3531         params->conn_latency = hdev->le_conn_latency;
3532         params->supervision_timeout = hdev->le_supv_timeout;
3533         params->auto_connect = HCI_AUTO_CONN_DISABLED;
3534 
3535         BT_DBG("addr %pMR (type %u)", addr, addr_type);
3536 
3537         return params;
3538 }
3539 
3540 static void hci_conn_params_free(struct hci_conn_params *params)
3541 {
3542         if (params->conn) {
3543                 hci_conn_drop(params->conn);
3544                 hci_conn_put(params->conn);
3545         }
3546 
3547         list_del(&params->action);
3548         list_del(&params->list);
3549         kfree(params);
3550 }
3551 
3552 /* This function requires the caller holds hdev->lock */
3553 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3554 {
3555         struct hci_conn_params *params;
3556 
3557         params = hci_conn_params_lookup(hdev, addr, addr_type);
3558         if (!params)
3559                 return;
3560 
3561         hci_conn_params_free(params);
3562 
3563         hci_update_background_scan(hdev);
3564 
3565         BT_DBG("addr %pMR (type %u)", addr, addr_type);
3566 }
3567 
3568 /* This function requires the caller holds hdev->lock */
3569 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
3570 {
3571         struct hci_conn_params *params, *tmp;
3572 
3573         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3574                 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3575                         continue;
3576 
3577                 /* If trying to establish one time connection to disabled
3578                  * device, leave the params, but mark them as just once.
3579                  */
3580                 if (params->explicit_connect) {
3581                         params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3582                         continue;
3583                 }
3584 
3585                 list_del(&params->list);
3586                 kfree(params);
3587         }
3588 
3589         BT_DBG("All LE disabled connection parameters were removed");
3590 }
3591 
3592 /* This function requires the caller holds hdev->lock */
3593 static void hci_conn_params_clear_all(struct hci_dev *hdev)
3594 {
3595         struct hci_conn_params *params, *tmp;
3596 
3597         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
3598                 hci_conn_params_free(params);
3599 
3600         BT_DBG("All LE connection parameters were removed");
3601 }
3602 
3603 /* Copy the Identity Address of the controller.
3604  *
3605  * If the controller has a public BD_ADDR, then by default use that one.
3606  * If this is a LE only controller without a public address, default to
3607  * the static random address.
3608  *
3609  * For debugging purposes it is possible to force controllers with a
3610  * public address to use the static random address instead.
3611  *
3612  * In case BR/EDR has been disabled on a dual-mode controller and
3613  * userspace has configured a static address, then that address
3614  * becomes the identity address instead of the public BR/EDR address.
3615  */
3616 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3617                                u8 *bdaddr_type)
3618 {
3619         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
3620             !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
3621             (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3622              bacmp(&hdev->static_addr, BDADDR_ANY))) {
3623                 bacpy(bdaddr, &hdev->static_addr);
3624                 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3625         } else {
3626                 bacpy(bdaddr, &hdev->bdaddr);
3627                 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3628         }
3629 }
3630 
3631 static void hci_suspend_clear_tasks(struct hci_dev *hdev)
3632 {
3633         int i;
3634 
3635         for (i = 0; i < __SUSPEND_NUM_TASKS; i++)
3636                 clear_bit(i, hdev->suspend_tasks);
3637 
3638         wake_up(&hdev->suspend_wait_q);
3639 }
3640 
3641 static int hci_suspend_wait_event(struct hci_dev *hdev)
3642 {
3643 #define WAKE_COND                                                              \
3644         (find_first_bit(hdev->suspend_tasks, __SUSPEND_NUM_TASKS) ==           \
3645          __SUSPEND_NUM_TASKS)
3646 
3647         int i;
3648         int ret = wait_event_timeout(hdev->suspend_wait_q,
3649                                      WAKE_COND, SUSPEND_NOTIFIER_TIMEOUT);
3650 
3651         if (ret == 0) {
3652                 bt_dev_err(hdev, "Timed out waiting for suspend events");
3653                 for (i = 0; i < __SUSPEND_NUM_TASKS; ++i) {
3654                         if (test_bit(i, hdev->suspend_tasks))
3655                                 bt_dev_err(hdev, "Suspend timeout bit: %d", i);
3656                         clear_bit(i, hdev->suspend_tasks);
3657                 }
3658 
3659                 ret = -ETIMEDOUT;
3660         } else {
3661                 ret = 0;
3662         }
3663 
3664         return ret;
3665 }
3666 
3667 static void hci_prepare_suspend(struct work_struct *work)
3668 {
3669         struct hci_dev *hdev =
3670                 container_of(work, struct hci_dev, suspend_prepare);
3671 
3672         hci_dev_lock(hdev);
3673         hci_req_prepare_suspend(hdev, hdev->suspend_state_next);
3674         hci_dev_unlock(hdev);
3675 }
3676 
3677 static int hci_change_suspend_state(struct hci_dev *hdev,
3678                                     enum suspended_state next)
3679 {
3680         hdev->suspend_state_next = next;
3681         set_bit(SUSPEND_PREPARE_NOTIFIER, hdev->suspend_tasks);
3682         queue_work(hdev->req_workqueue, &hdev->suspend_prepare);
3683         return hci_suspend_wait_event(hdev);
3684 }
3685 
3686 static void hci_clear_wake_reason(struct hci_dev *hdev)
3687 {
3688         hci_dev_lock(hdev);
3689 
3690         hdev->wake_reason = 0;
3691         bacpy(&hdev->wake_addr, BDADDR_ANY);
3692         hdev->wake_addr_type = 0;
3693 
3694         hci_dev_unlock(hdev);
3695 }
3696 
3697 static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
3698                                 void *data)
3699 {
3700         struct hci_dev *hdev =
3701                 container_of(nb, struct hci_dev, suspend_notifier);
3702         int ret = 0;
3703         u8 state = BT_RUNNING;
3704 
3705         /* If powering down, wait for completion. */
3706         if (mgmt_powering_down(hdev)) {
3707                 set_bit(SUSPEND_POWERING_DOWN, hdev->suspend_tasks);
3708                 ret = hci_suspend_wait_event(hdev);
3709                 if (ret)
3710                         goto done;
3711         }
3712 
3713         /* Suspend notifier should only act on events when powered. */
3714         if (!hdev_is_powered(hdev) ||
3715             hci_dev_test_flag(hdev, HCI_UNREGISTER))
3716                 goto done;
3717 
3718         if (action == PM_SUSPEND_PREPARE) {
3719                 /* Suspend consists of two actions:
3720                  *  - First, disconnect everything and make the controller not
3721                  *    connectable (disabling scanning)
3722                  *  - Second, program event filter/accept list and enable scan
3723                  */
3724                 ret = hci_change_suspend_state(hdev, BT_SUSPEND_DISCONNECT);
3725                 if (!ret)
3726                         state = BT_SUSPEND_DISCONNECT;
3727 
3728                 /* Only configure accept list if disconnect succeeded and wake
3729                  * isn't being prevented.
3730                  */
3731                 if (!ret && !(hdev->prevent_wake && hdev->prevent_wake(hdev))) {
3732                         ret = hci_change_suspend_state(hdev,
3733                                                 BT_SUSPEND_CONFIGURE_WAKE);
3734                         if (!ret)
3735                                 state = BT_SUSPEND_CONFIGURE_WAKE;
3736                 }
3737 
3738                 hci_clear_wake_reason(hdev);
3739                 mgmt_suspending(hdev, state);
3740 
3741         } else if (action == PM_POST_SUSPEND) {
3742                 ret = hci_change_suspend_state(hdev, BT_RUNNING);
3743 
3744                 mgmt_resuming(hdev, hdev->wake_reason, &hdev->wake_addr,
3745                               hdev->wake_addr_type);
3746         }
3747 
3748 done:
3749         /* We always allow suspend even if suspend preparation failed and
3750          * attempt to recover in resume.
3751          */
3752         if (ret)
3753                 bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
3754                            action, ret);
3755 
3756         return NOTIFY_DONE;
3757 }
3758 
3759 /* Alloc HCI device */
3760 struct hci_dev *hci_alloc_dev(void)
3761 {
3762         struct hci_dev *hdev;
3763 
3764         hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3765         if (!hdev)
3766                 return NULL;
3767 
3768         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3769         hdev->esco_type = (ESCO_HV1);
3770         hdev->link_mode = (HCI_LM_ACCEPT);
3771         hdev->num_iac = 0x01;           /* One IAC support is mandatory */
3772         hdev->io_capability = 0x03;     /* No Input No Output */
3773         hdev->manufacturer = 0xffff;    /* Default to internal use */
3774         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3775         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3776         hdev->adv_instance_cnt = 0;
3777         hdev->cur_adv_instance = 0x00;
3778         hdev->adv_instance_timeout = 0;
3779 
3780         hdev->advmon_allowlist_duration = 300;
3781         hdev->advmon_no_filter_duration = 500;
3782         hdev->enable_advmon_interleave_scan = 0x00;     /* Default to disable */
3783 
3784         hdev->sniff_max_interval = 800;
3785         hdev->sniff_min_interval = 80;
3786 
3787         hdev->le_adv_channel_map = 0x07;
3788         hdev->le_adv_min_interval = 0x0800;
3789         hdev->le_adv_max_interval = 0x0800;
3790         hdev->le_scan_interval = 0x0060;
3791         hdev->le_scan_window = 0x0030;
3792         hdev->le_scan_int_suspend = 0x0400;
3793         hdev->le_scan_window_suspend = 0x0012;
3794         hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT;
3795         hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN;
3796         hdev->le_scan_int_adv_monitor = 0x0060;
3797         hdev->le_scan_window_adv_monitor = 0x0030;
3798         hdev->le_scan_int_connect = 0x0060;
3799         hdev->le_scan_window_connect = 0x0060;
3800         hdev->le_conn_min_interval = 0x0018;
3801         hdev->le_conn_max_interval = 0x0028;
3802         hdev->le_conn_latency = 0x0000;
3803         hdev->le_supv_timeout = 0x002a;
3804         hdev->le_def_tx_len = 0x001b;
3805         hdev->le_def_tx_time = 0x0148;
3806         hdev->le_max_tx_len = 0x001b;
3807         hdev->le_max_tx_time = 0x0148;
3808         hdev->le_max_rx_len = 0x001b;
3809         hdev->le_max_rx_time = 0x0148;
3810         hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
3811         hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
3812         hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
3813         hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
3814         hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
3815         hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
3816         hdev->def_le_autoconnect_timeout = HCI_LE_AUTOCONN_TIMEOUT;
3817         hdev->min_le_tx_power = HCI_TX_POWER_INVALID;
3818         hdev->max_le_tx_power = HCI_TX_POWER_INVALID;
3819 
3820         hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3821         hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3822         hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3823         hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3824         hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
3825         hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
3826 
3827         /* default 1.28 sec page scan */
3828         hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;
3829         hdev->def_page_scan_int = 0x0800;
3830         hdev->def_page_scan_window = 0x0012;
3831 
3832         mutex_init(&hdev->lock);
3833         mutex_init(&hdev->req_lock);
3834 
3835         INIT_LIST_HEAD(&hdev->mgmt_pending);
3836         INIT_LIST_HEAD(&hdev->reject_list);
3837         INIT_LIST_HEAD(&hdev->accept_list);
3838         INIT_LIST_HEAD(&hdev->uuids);
3839         INIT_LIST_HEAD(&hdev->link_keys);
3840         INIT_LIST_HEAD(&hdev->long_term_keys);
3841         INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3842         INIT_LIST_HEAD(&hdev->remote_oob_data);
3843         INIT_LIST_HEAD(&hdev->le_accept_list);
3844         INIT_LIST_HEAD(&hdev->le_resolv_list);
3845         INIT_LIST_HEAD(&hdev->le_conn_params);
3846         INIT_LIST_HEAD(&hdev->pend_le_conns);
3847         INIT_LIST_HEAD(&hdev->pend_le_reports);
3848         INIT_LIST_HEAD(&hdev->conn_hash.list);
3849         INIT_LIST_HEAD(&hdev->adv_instances);
3850         INIT_LIST_HEAD(&hdev->blocked_keys);
3851 
3852         INIT_WORK(&hdev->rx_work, hci_rx_work);
3853         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3854         INIT_WORK(&hdev->tx_work, hci_tx_work);
3855         INIT_WORK(&hdev->power_on, hci_power_on);
3856         INIT_WORK(&hdev->error_reset, hci_error_reset);
3857         INIT_WORK(&hdev->suspend_prepare, hci_prepare_suspend);
3858 
3859         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3860 
3861         skb_queue_head_init(&hdev->rx_q);
3862         skb_queue_head_init(&hdev->cmd_q);
3863         skb_queue_head_init(&hdev->raw_q);
3864 
3865         init_waitqueue_head(&hdev->req_wait_q);
3866         init_waitqueue_head(&hdev->suspend_wait_q);
3867 
3868         INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3869         INIT_DELAYED_WORK(&hdev->ncmd_timer, hci_ncmd_timeout);
3870 
3871         hci_request_setup(hdev);
3872 
3873         hci_init_sysfs(hdev);
3874         discovery_init(hdev);
3875 
3876         return hdev;
3877 }
3878 EXPORT_SYMBOL(hci_alloc_dev);
3879 
3880 /* Free HCI device */
3881 void hci_free_dev(struct hci_dev *hdev)
3882 {
3883         /* will free via device release */
3884         put_device(&hdev->dev);
3885 }
3886 EXPORT_SYMBOL(hci_free_dev);
3887 
3888 /* Register HCI device */
3889 int hci_register_dev(struct hci_dev *hdev)
3890 {
3891         int id, error;
3892 
3893         if (!hdev->open || !hdev->close || !hdev->send)
3894                 return -EINVAL;
3895 
3896         /* Do not allow HCI_AMP devices to register at index 0,
3897          * so the index can be used as the AMP controller ID.
3898          */
3899         switch (hdev->dev_type) {
3900         case HCI_PRIMARY:
3901                 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3902                 break;
3903         case HCI_AMP:
3904                 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3905                 break;
3906         default:
3907                 return -EINVAL;
3908         }
3909 
3910         if (id < 0)
3911                 return id;
3912 
3913         sprintf(hdev->name, "hci%d", id);
3914         hdev->id = id;
3915 
3916         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3917 
3918         hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
3919         if (!hdev->workqueue) {
3920                 error = -ENOMEM;
3921                 goto err;
3922         }
3923 
3924         hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
3925                                                       hdev->name);
3926         if (!hdev->req_workqueue) {
3927                 destroy_workqueue(hdev->workqueue);
3928                 error = -ENOMEM;
3929                 goto err;
3930         }
3931 
3932         if (!IS_ERR_OR_NULL(bt_debugfs))
3933                 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3934 
3935         dev_set_name(&hdev->dev, "%s", hdev->name);
3936 
3937         error = device_add(&hdev->dev);
3938         if (error < 0)
3939                 goto err_wqueue;
3940 
3941         hci_leds_init(hdev);
3942 
3943         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3944                                     RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3945                                     hdev);
3946         if (hdev->rfkill) {
3947                 if (rfkill_register(hdev->rfkill) < 0) {
3948                         rfkill_destroy(hdev->rfkill);
3949                         hdev->rfkill = NULL;
3950                 }
3951         }
3952 
3953         if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3954                 hci_dev_set_flag(hdev, HCI_RFKILLED);
3955 
3956         hci_dev_set_flag(hdev, HCI_SETUP);
3957         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3958 
3959         if (hdev->dev_type == HCI_PRIMARY) {
3960                 /* Assume BR/EDR support until proven otherwise (such as
3961                  * through reading supported features during init.
3962                  */
3963                 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3964         }
3965 
3966         write_lock(&hci_dev_list_lock);
3967         list_add(&hdev->list, &hci_dev_list);
3968         write_unlock(&hci_dev_list_lock);
3969 
3970         /* Devices that are marked for raw-only usage are unconfigured
3971          * and should not be included in normal operation.
3972          */
3973         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3974                 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3975 
3976         hci_sock_dev_event(hdev, HCI_DEV_REG);
3977         hci_dev_hold(hdev);
3978 
3979         if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
3980                 hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
3981                 error = register_pm_notifier(&hdev->suspend_notifier);
3982                 if (error)
3983                         goto err_wqueue;
3984         }
3985 
3986         queue_work(hdev->req_workqueue, &hdev->power_on);
3987 
3988         idr_init(&hdev->adv_monitors_idr);
3989 
3990         return id;
3991 
3992 err_wqueue:
3993         destroy_workqueue(hdev->workqueue);
3994         destroy_workqueue(hdev->req_workqueue);
3995 err:
3996         ida_simple_remove(&hci_index_ida, hdev->id);
3997 
3998         return error;
3999 }
4000 EXPORT_SYMBOL(hci_register_dev);
4001 
4002 /* Unregister HCI device */
4003 void hci_unregister_dev(struct hci_dev *hdev)
4004 {
4005         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
4006 
4007         hci_dev_set_flag(hdev, HCI_UNREGISTER);
4008 
4009         write_lock(&hci_dev_list_lock);
4010         list_del(&hdev->list);
4011         write_unlock(&hci_dev_list_lock);
4012 
4013         cancel_work_sync(&hdev->power_on);
4014 
4015         if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
4016                 hci_suspend_clear_tasks(hdev);
4017                 unregister_pm_notifier(&hdev->suspend_notifier);
4018                 cancel_work_sync(&hdev->suspend_prepare);
4019         }
4020 
4021         hci_dev_do_close(hdev);
4022 
4023         if (!test_bit(HCI_INIT, &hdev->flags) &&
4024             !hci_dev_test_flag(hdev, HCI_SETUP) &&
4025             !hci_dev_test_flag(hdev, HCI_CONFIG)) {
4026                 hci_dev_lock(hdev);
4027                 mgmt_index_removed(hdev);
4028                 hci_dev_unlock(hdev);
4029         }
4030 
4031         /* mgmt_index_removed should take care of emptying the
4032          * pending list */
4033         BUG_ON(!list_empty(&hdev->mgmt_pending));
4034 
4035         hci_sock_dev_event(hdev, HCI_DEV_UNREG);
4036 
4037         if (hdev->rfkill) {
4038                 rfkill_unregister(hdev->rfkill);
4039                 rfkill_destroy(hdev->rfkill);
4040         }
4041 
4042         device_del(&hdev->dev);
4043         /* Actual cleanup is deferred until hci_cleanup_dev(). */
4044         hci_dev_put(hdev);
4045 }
4046 EXPORT_SYMBOL(hci_unregister_dev);
4047 
4048 /* Cleanup HCI device */
4049 void hci_cleanup_dev(struct hci_dev *hdev)
4050 {
4051         debugfs_remove_recursive(hdev->debugfs);
4052         kfree_const(hdev->hw_info);
4053         kfree_const(hdev->fw_info);
4054 
4055         destroy_workqueue(hdev->workqueue);
4056         destroy_workqueue(hdev->req_workqueue);
4057 
4058         hci_dev_lock(hdev);
4059         hci_bdaddr_list_clear(&hdev->reject_list);
4060         hci_bdaddr_list_clear(&hdev->accept_list);
4061         hci_uuids_clear(hdev);
4062         hci_link_keys_clear(hdev);
4063         hci_smp_ltks_clear(hdev);
4064         hci_smp_irks_clear(hdev);
4065         hci_remote_oob_data_clear(hdev);
4066         hci_adv_instances_clear(hdev);
4067         hci_adv_monitors_clear(hdev);
4068         hci_bdaddr_list_clear(&hdev->le_accept_list);
4069         hci_bdaddr_list_clear(&hdev->le_resolv_list);
4070         hci_conn_params_clear_all(hdev);
4071         hci_discovery_filter_clear(hdev);
4072         hci_blocked_keys_clear(hdev);
4073         hci_dev_unlock(hdev);
4074 
4075         ida_simple_remove(&hci_index_ida, hdev->id);
4076 }
4077 
4078 /* Suspend HCI device */
4079 int hci_suspend_dev(struct hci_dev *hdev)
4080 {
4081         hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
4082         return 0;
4083 }
4084 EXPORT_SYMBOL(hci_suspend_dev);
4085 
4086 /* Resume HCI device */
4087 int hci_resume_dev(struct hci_dev *hdev)
4088 {
4089         hci_sock_dev_event(hdev, HCI_DEV_RESUME);
4090         return 0;
4091 }
4092 EXPORT_SYMBOL(hci_resume_dev);
4093 
4094 /* Reset HCI device */
4095 int hci_reset_dev(struct hci_dev *hdev)
4096 {
4097         static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
4098         struct sk_buff *skb;
4099 
4100         skb = bt_skb_alloc(3, GFP_ATOMIC);
4101         if (!skb)
4102                 return -ENOMEM;
4103 
4104         hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
4105         skb_put_data(skb, hw_err, 3);
4106 
4107         bt_dev_err(hdev, "Injecting HCI hardware error event");
4108 
4109         /* Send Hardware Error to upper stack */
4110         return hci_recv_frame(hdev, skb);
4111 }
4112 EXPORT_SYMBOL(hci_reset_dev);
4113 
4114 /* Receive frame from HCI drivers */
4115 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
4116 {
4117         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
4118                       && !test_bit(HCI_INIT, &hdev->flags))) {
4119                 kfree_skb(skb);
4120                 return -ENXIO;
4121         }
4122 
4123         if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
4124             hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
4125             hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
4126             hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) {
4127                 kfree_skb(skb);
4128                 return -EINVAL;
4129         }
4130 
4131         /* Incoming skb */
4132         bt_cb(skb)->incoming = 1;
4133 
4134         /* Time stamp */
4135         __net_timestamp(skb);
4136 
4137         skb_queue_tail(&hdev->rx_q, skb);
4138         queue_work(hdev->workqueue, &hdev->rx_work);
4139 
4140         return 0;
4141 }
4142 EXPORT_SYMBOL(hci_recv_frame);
4143 
4144 /* Receive diagnostic message from HCI drivers */
4145 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
4146 {
4147         /* Mark as diagnostic packet */
4148         hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
4149 
4150         /* Time stamp */
4151         __net_timestamp(skb);
4152 
4153         skb_queue_tail(&hdev->rx_q, skb);
4154         queue_work(hdev->workqueue, &hdev->rx_work);
4155 
4156         return 0;
4157 }
4158 EXPORT_SYMBOL(hci_recv_diag);
4159 
4160 void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
4161 {
4162         va_list vargs;
4163 
4164         va_start(vargs, fmt);
4165         kfree_const(hdev->hw_info);
4166         hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
4167         va_end(vargs);
4168 }
4169 EXPORT_SYMBOL(hci_set_hw_info);
4170 
4171 void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
4172 {
4173         va_list vargs;
4174 
4175         va_start(vargs, fmt);
4176         kfree_const(hdev->fw_info);
4177         hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
4178         va_end(vargs);
4179 }
4180 EXPORT_SYMBOL(hci_set_fw_info);
4181 
4182 /* ---- Interface to upper protocols ---- */
4183 
4184 int hci_register_cb(struct hci_cb *cb)
4185 {
4186         BT_DBG("%p name %s", cb, cb->name);
4187 
4188         mutex_lock(&hci_cb_list_lock);
4189         list_add_tail(&cb->list, &hci_cb_list);
4190         mutex_unlock(&hci_cb_list_lock);
4191 
4192         return 0;
4193 }
4194 EXPORT_SYMBOL(hci_register_cb);
4195 
4196 int hci_unregister_cb(struct hci_cb *cb)
4197 {
4198         BT_DBG("%p name %s", cb, cb->name);
4199 
4200         mutex_lock(&hci_cb_list_lock);
4201         list_del(&cb->list);
4202         mutex_unlock(&hci_cb_list_lock);
4203 
4204         return 0;
4205 }
4206 EXPORT_SYMBOL(hci_unregister_cb);
4207 
4208 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
4209 {
4210         int err;
4211 
4212         BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
4213                skb->len);
4214 
4215         /* Time stamp */
4216         __net_timestamp(skb);
4217 
4218         /* Send copy to monitor */
4219         hci_send_to_monitor(hdev, skb);
4220 
4221         if (atomic_read(&hdev->promisc)) {
4222                 /* Send copy to the sockets */
4223                 hci_send_to_sock(hdev, skb);
4224         }
4225 
4226         /* Get rid of skb owner, prior to sending to the driver. */
4227         skb_orphan(skb);
4228 
4229         if (!test_bit(HCI_RUNNING, &hdev->flags)) {
4230                 kfree_skb(skb);
4231                 return;
4232         }
4233 
4234         err = hdev->send(hdev, skb);
4235         if (err < 0) {
4236                 bt_dev_err(hdev, "sending frame failed (%d)", err);
4237                 kfree_skb(skb);
4238         }
4239 }
4240 
4241 /* Send HCI command */
4242 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
4243                  const void *param)
4244 {
4245         struct sk_buff *skb;
4246 
4247         BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
4248 
4249         skb = hci_prepare_cmd(hdev, opcode, plen, param);
4250         if (!skb) {
4251                 bt_dev_err(hdev, "no memory for command");
4252                 return -ENOMEM;
4253         }
4254 
4255         /* Stand-alone HCI commands must be flagged as
4256          * single-command requests.
4257          */
4258         bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
4259 
4260         skb_queue_tail(&hdev->cmd_q, skb);
4261         queue_work(hdev->workqueue, &hdev->cmd_work);
4262 
4263         return 0;
4264 }
4265 
4266 int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
4267                    const void *param)
4268 {
4269         struct sk_buff *skb;
4270 
4271         if (hci_opcode_ogf(opcode) != 0x3f) {
4272                 /* A controller receiving a command shall respond with either
4273                  * a Command Status Event or a Command Complete Event.
4274                  * Therefore, all standard HCI commands must be sent via the
4275                  * standard API, using hci_send_cmd or hci_cmd_sync helpers.
4276                  * Some vendors do not comply with this rule for vendor-specific
4277                  * commands and do not return any event. We want to support
4278                  * unresponded commands for such cases only.
4279                  */
4280                 bt_dev_err(hdev, "unresponded command not supported");
4281                 return -EINVAL;
4282         }
4283 
4284         skb = hci_prepare_cmd(hdev, opcode, plen, param);
4285         if (!skb) {
4286                 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
4287                            opcode);
4288                 return -ENOMEM;
4289         }
4290 
4291         hci_send_frame(hdev, skb);
4292 
4293         return 0;
4294 }
4295 EXPORT_SYMBOL(__hci_cmd_send);
4296 
4297 /* Get data from the previously sent command */
4298 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
4299 {
4300         struct hci_command_hdr *hdr;
4301 
4302         if (!hdev->sent_cmd)
4303                 return NULL;
4304 
4305         hdr = (void *) hdev->sent_cmd->data;
4306 
4307         if (hdr->opcode != cpu_to_le16(opcode))
4308                 return NULL;
4309 
4310         BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
4311 
4312         return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
4313 }
4314 
4315 /* Send HCI command and wait for command complete event */
4316 struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
4317                              const void *param, u32 timeout)
4318 {
4319         struct sk_buff *skb;
4320 
4321         if (!test_bit(HCI_UP, &hdev->flags))
4322                 return ERR_PTR(-ENETDOWN);
4323 
4324         bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
4325 
4326         hci_req_sync_lock(hdev);
4327         skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
4328         hci_req_sync_unlock(hdev);
4329 
4330         return skb;
4331 }
4332 EXPORT_SYMBOL(hci_cmd_sync);
4333 
4334 /* Send ACL data */
4335 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
4336 {
4337         struct hci_acl_hdr *hdr;
4338         int len = skb->len;
4339 
4340         skb_push(skb, HCI_ACL_HDR_SIZE);
4341         skb_reset_transport_header(skb);
4342         hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
4343         hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
4344         hdr->dlen   = cpu_to_le16(len);
4345 }
4346 
4347 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
4348                           struct sk_buff *skb, __u16 flags)
4349 {
4350         struct hci_conn *conn = chan->conn;
4351         struct hci_dev *hdev = conn->hdev;
4352         struct sk_buff *list;
4353 
4354         skb->len = skb_headlen(skb);
4355         skb->data_len = 0;
4356 
4357         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
4358 
4359         switch (hdev->dev_type) {
4360         case HCI_PRIMARY:
4361                 hci_add_acl_hdr(skb, conn->handle, flags);
4362                 break;
4363         case HCI_AMP:
4364                 hci_add_acl_hdr(skb, chan->handle, flags);
4365                 break;
4366         default:
4367                 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4368                 return;
4369         }
4370 
4371         list = skb_shinfo(skb)->frag_list;
4372         if (!list) {
4373                 /* Non fragmented */
4374                 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
4375 
4376                 skb_queue_tail(queue, skb);
4377         } else {
4378                 /* Fragmented */
4379                 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4380 
4381                 skb_shinfo(skb)->frag_list = NULL;
4382 
4383                 /* Queue all fragments atomically. We need to use spin_lock_bh
4384                  * here because of 6LoWPAN links, as there this function is
4385                  * called from softirq and using normal spin lock could cause
4386                  * deadlocks.
4387                  */
4388                 spin_lock_bh(&queue->lock);
4389 
4390                 __skb_queue_tail(queue, skb);
4391 
4392                 flags &= ~ACL_START;
4393                 flags |= ACL_CONT;
4394                 do {
4395                         skb = list; list = list->next;
4396 
4397                         hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
4398                         hci_add_acl_hdr(skb, conn->handle, flags);
4399 
4400                         BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4401 
4402                         __skb_queue_tail(queue, skb);
4403                 } while (list);
4404 
4405                 spin_unlock_bh(&queue->lock);
4406         }
4407 }
4408 
4409 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
4410 {
4411         struct hci_dev *hdev = chan->conn->hdev;
4412 
4413         BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
4414 
4415         hci_queue_acl(chan, &chan->data_q, skb, flags);
4416 
4417         queue_work(hdev->workqueue, &hdev->tx_work);
4418 }
4419 
4420 /* Send SCO data */
4421 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
4422 {
4423         struct hci_dev *hdev = conn->hdev;
4424         struct hci_sco_hdr hdr;
4425 
4426         BT_DBG("%s len %d", hdev->name, skb->len);
4427 
4428         hdr.handle = cpu_to_le16(conn->handle);
4429         hdr.dlen   = skb->len;
4430 
4431         skb_push(skb, HCI_SCO_HDR_SIZE);
4432         skb_reset_transport_header(skb);
4433         memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
4434 
4435         hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
4436 
4437         skb_queue_tail(&conn->data_q, skb);
4438         queue_work(hdev->workqueue, &hdev->tx_work);
4439 }
4440 
4441 /* ---- HCI TX task (outgoing data) ---- */
4442 
4443 /* HCI Connection scheduler */
4444 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
4445                                      int *quote)
4446 {
4447         struct hci_conn_hash *h = &hdev->conn_hash;
4448         struct hci_conn *conn = NULL, *c;
4449         unsigned int num = 0, min = ~0;
4450 
4451         /* We don't have to lock device here. Connections are always
4452          * added and removed with TX task disabled. */
4453 
4454         rcu_read_lock();
4455 
4456         list_for_each_entry_rcu(c, &h->list, list) {
4457                 if (c->type != type || skb_queue_empty(&c->data_q))
4458                         continue;
4459 
4460                 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
4461                         continue;
4462 
4463                 num++;
4464 
4465                 if (c->sent < min) {
4466                         min  = c->sent;
4467                         conn = c;
4468                 }
4469 
4470                 if (hci_conn_num(hdev, type) == num)
4471                         break;
4472         }
4473 
4474         rcu_read_unlock();
4475 
4476         if (conn) {
4477                 int cnt, q;
4478 
4479                 switch (conn->type) {
4480                 case ACL_LINK:
4481                         cnt = hdev->acl_cnt;
4482                         break;
4483                 case SCO_LINK:
4484                 case ESCO_LINK:
4485                         cnt = hdev->sco_cnt;
4486                         break;
4487                 case LE_LINK:
4488                         cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4489                         break;
4490                 default:
4491                         cnt = 0;
4492                         bt_dev_err(hdev, "unknown link type %d", conn->type);
4493                 }
4494 
4495                 q = cnt / num;
4496                 *quote = q ? q : 1;
4497         } else
4498                 *quote = 0;
4499 
4500         BT_DBG("conn %p quote %d", conn, *quote);
4501         return conn;
4502 }
4503 
4504 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
4505 {
4506         struct hci_conn_hash *h = &hdev->conn_hash;
4507         struct hci_conn *c;
4508 
4509         bt_dev_err(hdev, "link tx timeout");
4510 
4511         rcu_read_lock();
4512 
4513         /* Kill stalled connections */
4514         list_for_each_entry_rcu(c, &h->list, list) {
4515                 if (c->type == type && c->sent) {
4516                         bt_dev_err(hdev, "killing stalled connection %pMR",
4517                                    &c->dst);
4518                         hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
4519                 }
4520         }
4521 
4522         rcu_read_unlock();
4523 }
4524 
4525 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
4526                                       int *quote)
4527 {
4528         struct hci_conn_hash *h = &hdev->conn_hash;
4529         struct hci_chan *chan = NULL;
4530         unsigned int num = 0, min = ~0, cur_prio = 0;
4531         struct hci_conn *conn;
4532         int cnt, q, conn_num = 0;
4533 
4534         BT_DBG("%s", hdev->name);
4535 
4536         rcu_read_lock();
4537 
4538         list_for_each_entry_rcu(conn, &h->list, list) {
4539                 struct hci_chan *tmp;
4540 
4541                 if (conn->type != type)
4542                         continue;
4543 
4544                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4545                         continue;
4546 
4547                 conn_num++;
4548 
4549                 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
4550                         struct sk_buff *skb;
4551 
4552                         if (skb_queue_empty(&tmp->data_q))
4553                                 continue;
4554 
4555                         skb = skb_peek(&tmp->data_q);
4556                         if (skb->priority < cur_prio)
4557                                 continue;
4558 
4559                         if (skb->priority > cur_prio) {
4560                                 num = 0;
4561                                 min = ~0;
4562                                 cur_prio = skb->priority;
4563                         }
4564 
4565                         num++;
4566 
4567                         if (conn->sent < min) {
4568                                 min  = conn->sent;
4569                                 chan = tmp;
4570                         }
4571                 }
4572 
4573                 if (hci_conn_num(hdev, type) == conn_num)
4574                         break;
4575         }
4576 
4577         rcu_read_unlock();
4578 
4579         if (!chan)
4580                 return NULL;
4581 
4582         switch (chan->conn->type) {
4583         case ACL_LINK:
4584                 cnt = hdev->acl_cnt;
4585                 break;
4586         case AMP_LINK:
4587                 cnt = hdev->block_cnt;
4588                 break;
4589         case SCO_LINK:
4590         case ESCO_LINK:
4591                 cnt = hdev->sco_cnt;
4592                 break;
4593         case LE_LINK:
4594                 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4595                 break;
4596         default:
4597                 cnt = 0;
4598                 bt_dev_err(hdev, "unknown link type %d", chan->conn->type);
4599         }
4600 
4601         q = cnt / num;
4602         *quote = q ? q : 1;
4603         BT_DBG("chan %p quote %d", chan, *quote);
4604         return chan;
4605 }
4606 
4607 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
4608 {
4609         struct hci_conn_hash *h = &hdev->conn_hash;
4610         struct hci_conn *conn;
4611         int num = 0;
4612 
4613         BT_DBG("%s", hdev->name);
4614 
4615         rcu_read_lock();
4616 
4617         list_for_each_entry_rcu(conn, &h->list, list) {
4618                 struct hci_chan *chan;
4619 
4620                 if (conn->type != type)
4621                         continue;
4622 
4623                 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4624                         continue;
4625 
4626                 num++;
4627 
4628                 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
4629                         struct sk_buff *skb;
4630 
4631                         if (chan->sent) {
4632                                 chan->sent = 0;
4633                                 continue;
4634                         }
4635 
4636                         if (skb_queue_empty(&chan->data_q))
4637                                 continue;
4638 
4639                         skb = skb_peek(&chan->data_q);
4640                         if (skb->priority >= HCI_PRIO_MAX - 1)
4641                                 continue;
4642 
4643                         skb->priority = HCI_PRIO_MAX - 1;
4644 
4645                         BT_DBG("chan %p skb %p promoted to %d", chan, skb,
4646                                skb->priority);
4647                 }
4648 
4649                 if (hci_conn_num(hdev, type) == num)
4650                         break;
4651         }
4652 
4653         rcu_read_unlock();
4654 
4655 }
4656 
4657 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
4658 {
4659         /* Calculate count of blocks used by this packet */
4660         return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
4661 }
4662 
4663 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
4664 {
4665         if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
4666                 /* ACL tx timeout must be longer than maximum
4667                  * link supervision timeout (40.9 seconds) */
4668                 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
4669                                        HCI_ACL_TX_TIMEOUT))
4670                         hci_link_tx_to(hdev, ACL_LINK);
4671         }
4672 }
4673 
4674 /* Schedule SCO */
4675 static void hci_sched_sco(struct hci_dev *hdev)
4676 {
4677         struct hci_conn *conn;
4678         struct sk_buff *skb;
4679         int quote;
4680 
4681         BT_DBG("%s", hdev->name);
4682 
4683         if (!hci_conn_num(hdev, SCO_LINK))
4684                 return;
4685 
4686         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
4687                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4688                         BT_DBG("skb %p len %d", skb, skb->len);
4689                         hci_send_frame(hdev, skb);
4690 
4691                         conn->sent++;
4692                         if (conn->sent == ~0)
4693                                 conn->sent = 0;
4694                 }
4695         }
4696 }
4697 
4698 static void hci_sched_esco(struct hci_dev *hdev)
4699 {
4700         struct hci_conn *conn;
4701         struct sk_buff *skb;
4702         int quote;
4703 
4704         BT_DBG("%s", hdev->name);
4705 
4706         if (!hci_conn_num(hdev, ESCO_LINK))
4707                 return;
4708 
4709         while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4710                                                      &quote))) {
4711                 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4712                         BT_DBG("skb %p len %d", skb, skb->len);
4713                         hci_send_frame(hdev, skb);
4714 
4715                         conn->sent++;
4716                         if (conn->sent == ~0)
4717                                 conn->sent = 0;
4718                 }
4719         }
4720 }
4721 
4722 static void hci_sched_acl_pkt(struct hci_dev *hdev)
4723 {
4724         unsigned int cnt = hdev->acl_cnt;
4725         struct hci_chan *chan;
4726         struct sk_buff *skb;
4727         int quote;
4728 
4729         __check_timeout(hdev, cnt);
4730 
4731         while (hdev->acl_cnt &&
4732                (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
4733                 u32 priority = (skb_peek(&chan->data_q))->priority;
4734                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4735                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4736                                skb->len, skb->priority);
4737 
4738                         /* Stop if priority has changed */
4739                         if (skb->priority < priority)
4740                                 break;
4741 
4742                         skb = skb_dequeue(&chan->data_q);
4743 
4744                         hci_conn_enter_active_mode(chan->conn,
4745                                                    bt_cb(skb)->force_active);
4746 
4747                         hci_send_frame(hdev, skb);
4748                         hdev->acl_last_tx = jiffies;
4749 
4750                         hdev->acl_cnt--;
4751                         chan->sent++;
4752                         chan->conn->sent++;
4753 
4754                         /* Send pending SCO packets right away */
4755                         hci_sched_sco(hdev);
4756                         hci_sched_esco(hdev);
4757                 }
4758         }
4759 
4760         if (cnt != hdev->acl_cnt)
4761                 hci_prio_recalculate(hdev, ACL_LINK);
4762 }
4763 
4764 static void hci_sched_acl_blk(struct hci_dev *hdev)
4765 {
4766         unsigned int cnt = hdev->block_cnt;
4767         struct hci_chan *chan;
4768         struct sk_buff *skb;
4769         int quote;
4770         u8 type;
4771 
4772         __check_timeout(hdev, cnt);
4773 
4774         BT_DBG("%s", hdev->name);
4775 
4776         if (hdev->dev_type == HCI_AMP)
4777                 type = AMP_LINK;
4778         else
4779                 type = ACL_LINK;
4780 
4781         while (hdev->block_cnt > 0 &&
4782                (chan = hci_chan_sent(hdev, type, &quote))) {
4783                 u32 priority = (skb_peek(&chan->data_q))->priority;
4784                 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
4785                         int blocks;
4786 
4787                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4788                                skb->len, skb->priority);
4789 
4790                         /* Stop if priority has changed */
4791                         if (skb->priority < priority)
4792                                 break;
4793 
4794                         skb = skb_dequeue(&chan->data_q);
4795 
4796                         blocks = __get_blocks(hdev, skb);
4797                         if (blocks > hdev->block_cnt)
4798                                 return;
4799 
4800                         hci_conn_enter_active_mode(chan->conn,
4801                                                    bt_cb(skb)->force_active);
4802 
4803                         hci_send_frame(hdev, skb);
4804                         hdev->acl_last_tx = jiffies;
4805 
4806                         hdev->block_cnt -= blocks;
4807                         quote -= blocks;
4808 
4809                         chan->sent += blocks;
4810                         chan->conn->sent += blocks;
4811                 }
4812         }
4813 
4814         if (cnt != hdev->block_cnt)
4815                 hci_prio_recalculate(hdev, type);
4816 }
4817 
4818 static void hci_sched_acl(struct hci_dev *hdev)
4819 {
4820         BT_DBG("%s", hdev->name);
4821 
4822         /* No ACL link over BR/EDR controller */
4823         if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
4824                 return;
4825 
4826         /* No AMP link over AMP controller */
4827         if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4828                 return;
4829 
4830         switch (hdev->flow_ctl_mode) {
4831         case HCI_FLOW_CTL_MODE_PACKET_BASED:
4832                 hci_sched_acl_pkt(hdev);
4833                 break;
4834 
4835         case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4836                 hci_sched_acl_blk(hdev);
4837                 break;
4838         }
4839 }
4840 
4841 static void hci_sched_le(struct hci_dev *hdev)
4842 {
4843         struct hci_chan *chan;
4844         struct sk_buff *skb;
4845         int quote, cnt, tmp;
4846 
4847         BT_DBG("%s", hdev->name);
4848 
4849         if (!hci_conn_num(hdev, LE_LINK))
4850                 return;
4851 
4852         cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
4853 
4854         __check_timeout(hdev, cnt);
4855 
4856         tmp = cnt;
4857         while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
4858                 u32 priority = (skb_peek(&chan->data_q))->priority;
4859                 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4860                         BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4861                                skb->len, skb->priority);
4862 
4863                         /* Stop if priority has changed */
4864                         if (skb->priority < priority)
4865                                 break;
4866 
4867                         skb = skb_dequeue(&chan->data_q);
4868 
4869                         hci_send_frame(hdev, skb);
4870                         hdev->le_last_tx = jiffies;
4871 
4872                         cnt--;
4873                         chan->sent++;
4874                         chan->conn->sent++;
4875 
4876                         /* Send pending SCO packets right away */
4877                         hci_sched_sco(hdev);
4878                         hci_sched_esco(hdev);
4879                 }
4880         }
4881 
4882         if (hdev->le_pkts)
4883                 hdev->le_cnt = cnt;
4884         else
4885                 hdev->acl_cnt = cnt;
4886 
4887         if (cnt != tmp)
4888                 hci_prio_recalculate(hdev, LE_LINK);
4889 }
4890 
4891 static void hci_tx_work(struct work_struct *work)
4892 {
4893         struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
4894         struct sk_buff *skb;
4895 
4896         BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
4897                hdev->sco_cnt, hdev->le_cnt);
4898 
4899         if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4900                 /* Schedule queues and send stuff to HCI driver */
4901                 hci_sched_sco(hdev);
4902                 hci_sched_esco(hdev);
4903                 hci_sched_acl(hdev);
4904                 hci_sched_le(hdev);
4905         }
4906 
4907         /* Send next queued raw (unknown type) packet */
4908         while ((skb = skb_dequeue(&hdev->raw_q)))
4909                 hci_send_frame(hdev, skb);
4910 }
4911 
4912 /* ----- HCI RX task (incoming data processing) ----- */
4913 
4914 /* ACL data packet */
4915 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4916 {
4917         struct hci_acl_hdr *hdr = (void *) skb->data;
4918         struct hci_conn *conn;
4919         __u16 handle, flags;
4920 
4921         skb_pull(skb, HCI_ACL_HDR_SIZE);
4922 
4923         handle = __le16_to_cpu(hdr->handle);
4924         flags  = hci_flags(handle);
4925         handle = hci_handle(handle);
4926 
4927         BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4928                handle, flags);
4929 
4930         hdev->stat.acl_rx++;
4931 
4932         hci_dev_lock(hdev);
4933         conn = hci_conn_hash_lookup_handle(hdev, handle);
4934         hci_dev_unlock(hdev);
4935 
4936         if (conn) {
4937                 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
4938 
4939                 /* Send to upper protocol */
4940                 l2cap_recv_acldata(conn, skb, flags);
4941                 return;
4942         } else {
4943                 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
4944                            handle);
4945         }
4946 
4947         kfree_skb(skb);
4948 }
4949 
4950 /* SCO data packet */
4951 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4952 {
4953         struct hci_sco_hdr *hdr = (void *) skb->data;
4954         struct hci_conn *conn;
4955         __u16 handle, flags;
4956 
4957         skb_pull(skb, HCI_SCO_HDR_SIZE);
4958 
4959         handle = __le16_to_cpu(hdr->handle);
4960         flags  = hci_flags(handle);
4961         handle = hci_handle(handle);
4962 
4963         BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4964                handle, flags);
4965 
4966         hdev->stat.sco_rx++;
4967 
4968         hci_dev_lock(hdev);
4969         conn = hci_conn_hash_lookup_handle(hdev, handle);
4970         hci_dev_unlock(hdev);
4971 
4972         if (conn) {
4973                 /* Send to upper protocol */
4974                 bt_cb(skb)->sco.pkt_status = flags & 0x03;
4975                 sco_recv_scodata(conn, skb);
4976                 return;
4977         } else {
4978                 bt_dev_err(hdev, "SCO packet for unknown connection handle %d",
4979                            handle);
4980         }
4981 
4982         kfree_skb(skb);
4983 }
4984 
4985 static bool hci_req_is_complete(struct hci_dev *hdev)
4986 {
4987         struct sk_buff *skb;
4988 
4989         skb = skb_peek(&hdev->cmd_q);
4990         if (!skb)
4991                 return true;
4992 
4993         return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
4994 }
4995 
4996 static void hci_resend_last(struct hci_dev *hdev)
4997 {
4998         struct hci_command_hdr *sent;
4999         struct sk_buff *skb;
5000         u16 opcode;
5001 
5002         if (!hdev->sent_cmd)
5003                 return;
5004 
5005         sent = (void *) hdev->sent_cmd->data;
5006         opcode = __le16_to_cpu(sent->opcode);
5007         if (opcode == HCI_OP_RESET)
5008                 return;
5009 
5010         skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
5011         if (!skb)
5012                 return;
5013 
5014         skb_queue_head(&hdev->cmd_q, skb);
5015         queue_work(hdev->workqueue, &hdev->cmd_work);
5016 }
5017 
5018 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
5019                           hci_req_complete_t *req_complete,
5020                           hci_req_complete_skb_t *req_complete_skb)
5021 {
5022         struct sk_buff *skb;
5023         unsigned long flags;
5024 
5025         BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
5026 
5027         /* If the completed command doesn't match the last one that was
5028          * sent we need to do special handling of it.
5029          */
5030         if (!hci_sent_cmd_data(hdev, opcode)) {
5031                 /* Some CSR based controllers generate a spontaneous
5032                  * reset complete event during init and any pending
5033                  * command will never be completed. In such a case we
5034                  * need to resend whatever was the last sent
5035                  * command.
5036                  */
5037                 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
5038                         hci_resend_last(hdev);
5039 
5040                 return;
5041         }
5042 
5043         /* If we reach this point this event matches the last command sent */
5044         hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
5045 
5046         /* If the command succeeded and there's still more commands in
5047          * this request the request is not yet complete.
5048          */
5049         if (!status && !hci_req_is_complete(hdev))
5050                 return;
5051 
5052         /* If this was the last command in a request the complete
5053          * callback would be found in hdev->sent_cmd instead of the
5054          * command queue (hdev->cmd_q).
5055          */
5056         if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
5057                 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
5058                 return;
5059         }
5060 
5061         if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
5062                 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
5063                 return;
5064         }
5065 
5066         /* Remove all pending commands belonging to this request */
5067         spin_lock_irqsave(&hdev->cmd_q.lock, flags);
5068         while ((skb = __skb_dequeue(&hdev->cmd_q))) {
5069                 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
5070                         __skb_queue_head(&hdev->cmd_q, skb);
5071                         break;
5072                 }
5073 
5074                 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
5075                         *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
5076                 else
5077                         *req_complete = bt_cb(skb)->hci.req_complete;
5078                 kfree_skb(skb);
5079         }
5080         spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
5081 }
5082 
5083 static void hci_rx_work(struct work_struct *work)
5084 {
5085         struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
5086         struct sk_buff *skb;
5087 
5088         BT_DBG("%s", hdev->name);
5089 
5090         while ((skb = skb_dequeue(&hdev->rx_q))) {
5091                 /* Send copy to monitor */
5092                 hci_send_to_monitor(hdev, skb);
5093 
5094                 if (atomic_read(&hdev->promisc)) {
5095                         /* Send copy to the sockets */
5096                         hci_send_to_sock(hdev, skb);
5097                 }
5098 
5099                 /* If the device has been opened in HCI_USER_CHANNEL,
5100                  * the userspace has exclusive access to device.
5101                  * When device is HCI_INIT, we still need to process
5102                  * the data packets to the driver in order
5103                  * to complete its setup().
5104                  */
5105                 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
5106                     !test_bit(HCI_INIT, &hdev->flags)) {
5107                         kfree_skb(skb);
5108                         continue;
5109                 }
5110 
5111                 if (test_bit(HCI_INIT, &hdev->flags)) {
5112                         /* Don't process data packets in this states. */
5113                         switch (hci_skb_pkt_type(skb)) {
5114                         case HCI_ACLDATA_PKT:
5115                         case HCI_SCODATA_PKT:
5116                         case HCI_ISODATA_PKT:
5117                                 kfree_skb(skb);
5118                                 continue;
5119                         }
5120                 }
5121 
5122                 /* Process frame */
5123                 switch (hci_skb_pkt_type(skb)) {
5124                 case HCI_EVENT_PKT:
5125                         BT_DBG("%s Event packet", hdev->name);
5126                         hci_event_packet(hdev, skb);
5127                         break;
5128 
5129                 case HCI_ACLDATA_PKT:
5130                         BT_DBG("%s ACL data packet", hdev->name);
5131                         hci_acldata_packet(hdev, skb);
5132                         break;
5133 
5134                 case HCI_SCODATA_PKT:
5135                         BT_DBG("%s SCO data packet", hdev->name);
5136                         hci_scodata_packet(hdev, skb);
5137                         break;
5138 
5139                 default:
5140                         kfree_skb(skb);
5141                         break;
5142                 }
5143         }
5144 }
5145 
5146 static void hci_cmd_work(struct work_struct *work)
5147 {
5148         struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
5149         struct sk_buff *skb;
5150 
5151         BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
5152                atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
5153 
5154         /* Send queued commands */
5155         if (atomic_read(&hdev->cmd_cnt)) {
5156                 skb = skb_dequeue(&hdev->cmd_q);
5157                 if (!skb)
5158                         return;
5159 
5160                 kfree_skb(hdev->sent_cmd);
5161 
5162                 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
5163                 if (hdev->sent_cmd) {
5164                         if (hci_req_status_pend(hdev))
5165                                 hci_dev_set_flag(hdev, HCI_CMD_PENDING);
5166                         atomic_dec(&hdev->cmd_cnt);
5167                         hci_send_frame(hdev, skb);
5168                         if (test_bit(HCI_RESET, &hdev->flags))
5169                                 cancel_delayed_work(&hdev->cmd_timer);
5170                         else
5171                                 schedule_delayed_work(&hdev->cmd_timer,
5172                                                       HCI_CMD_TIMEOUT);
5173                 } else {
5174                         skb_queue_head(&hdev->cmd_q, skb);
5175                         queue_work(hdev->workqueue, &hdev->cmd_work);
5176                 }
5177         }
5178 }
5179 

~ [ source navigation ] ~ [ diff markup ] ~ [ identifier search ] ~

kernel.org | git.kernel.org | LWN.net | Project Home | Wiki (Japanese) | Wiki (English) | SVN repository | Mail admin

Linux® is a registered trademark of Linus Torvalds in the United States and other countries.
TOMOYO® is a registered trademark of NTT DATA CORPORATION.

osdn.jp