xref: /openbmc/linux/net/bluetooth/hci_core.c (revision 00629e0f)
11da177e4SLinus Torvalds /*
21da177e4SLinus Torvalds    BlueZ - Bluetooth protocol stack for Linux
31da177e4SLinus Torvalds    Copyright (C) 2000-2001 Qualcomm Incorporated
4590051deSGustavo F. Padovan    Copyright (C) 2011 ProFUSION Embedded Systems
51da177e4SLinus Torvalds 
61da177e4SLinus Torvalds    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
71da177e4SLinus Torvalds 
81da177e4SLinus Torvalds    This program is free software; you can redistribute it and/or modify
91da177e4SLinus Torvalds    it under the terms of the GNU General Public License version 2 as
101da177e4SLinus Torvalds    published by the Free Software Foundation;
111da177e4SLinus Torvalds 
121da177e4SLinus Torvalds    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
131da177e4SLinus Torvalds    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
141da177e4SLinus Torvalds    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
151da177e4SLinus Torvalds    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
161da177e4SLinus Torvalds    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
171da177e4SLinus Torvalds    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
181da177e4SLinus Torvalds    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
191da177e4SLinus Torvalds    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
201da177e4SLinus Torvalds 
211da177e4SLinus Torvalds    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
221da177e4SLinus Torvalds    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
231da177e4SLinus Torvalds    SOFTWARE IS DISCLAIMED.
241da177e4SLinus Torvalds */
251da177e4SLinus Torvalds 
261da177e4SLinus Torvalds /* Bluetooth HCI core. */
271da177e4SLinus Torvalds 
288c520a59SGustavo Padovan #include <linux/export.h>
293df92b31SSasha Levin #include <linux/idr.h>
30611b30f7SMarcel Holtmann #include <linux/rfkill.h>
31baf27f6eSMarcel Holtmann #include <linux/debugfs.h>
3299780a7bSJohan Hedberg #include <linux/crypto.h>
3347219839SMarcel Holtmann #include <asm/unaligned.h>
341da177e4SLinus Torvalds 
351da177e4SLinus Torvalds #include <net/bluetooth/bluetooth.h>
361da177e4SLinus Torvalds #include <net/bluetooth/hci_core.h>
374bc58f51SJohan Hedberg #include <net/bluetooth/l2cap.h>
38af58925cSMarcel Holtmann #include <net/bluetooth/mgmt.h>
391da177e4SLinus Torvalds 
400857dd3bSJohan Hedberg #include "hci_request.h"
4160c5f5fbSMarcel Holtmann #include "hci_debugfs.h"
42970c4e46SJohan Hedberg #include "smp.h"
43970c4e46SJohan Hedberg 
44b78752ccSMarcel Holtmann static void hci_rx_work(struct work_struct *work);
45c347b765SGustavo F. Padovan static void hci_cmd_work(struct work_struct *work);
463eff45eaSGustavo F. Padovan static void hci_tx_work(struct work_struct *work);
471da177e4SLinus Torvalds 
481da177e4SLinus Torvalds /* HCI device list */
491da177e4SLinus Torvalds LIST_HEAD(hci_dev_list);
501da177e4SLinus Torvalds DEFINE_RWLOCK(hci_dev_list_lock);
511da177e4SLinus Torvalds 
521da177e4SLinus Torvalds /* HCI callback list */
531da177e4SLinus Torvalds LIST_HEAD(hci_cb_list);
541da177e4SLinus Torvalds DEFINE_RWLOCK(hci_cb_list_lock);
551da177e4SLinus Torvalds 
563df92b31SSasha Levin /* HCI ID Numbering */
573df92b31SSasha Levin static DEFINE_IDA(hci_index_ida);
583df92b31SSasha Levin 
59899de765SMarcel Holtmann /* ----- HCI requests ----- */
60899de765SMarcel Holtmann 
61899de765SMarcel Holtmann #define HCI_REQ_DONE	  0
62899de765SMarcel Holtmann #define HCI_REQ_PEND	  1
63899de765SMarcel Holtmann #define HCI_REQ_CANCELED  2
64899de765SMarcel Holtmann 
65899de765SMarcel Holtmann #define hci_req_lock(d)		mutex_lock(&d->req_lock)
66899de765SMarcel Holtmann #define hci_req_unlock(d)	mutex_unlock(&d->req_lock)
67899de765SMarcel Holtmann 
681da177e4SLinus Torvalds /* ---- HCI notifications ---- */
691da177e4SLinus Torvalds 
706516455dSMarcel Holtmann static void hci_notify(struct hci_dev *hdev, int event)
711da177e4SLinus Torvalds {
72040030efSMarcel Holtmann 	hci_sock_dev_event(hdev, event);
731da177e4SLinus Torvalds }
741da177e4SLinus Torvalds 
75baf27f6eSMarcel Holtmann /* ---- HCI debugfs entries ---- */
76baf27f6eSMarcel Holtmann 
774b4148e9SMarcel Holtmann static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
784b4148e9SMarcel Holtmann 			     size_t count, loff_t *ppos)
794b4148e9SMarcel Holtmann {
804b4148e9SMarcel Holtmann 	struct hci_dev *hdev = file->private_data;
814b4148e9SMarcel Holtmann 	char buf[3];
824b4148e9SMarcel Holtmann 
83111902f7SMarcel Holtmann 	buf[0] = test_bit(HCI_DUT_MODE, &hdev->dbg_flags) ? 'Y': 'N';
844b4148e9SMarcel Holtmann 	buf[1] = '\n';
854b4148e9SMarcel Holtmann 	buf[2] = '\0';
864b4148e9SMarcel Holtmann 	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
874b4148e9SMarcel Holtmann }
884b4148e9SMarcel Holtmann 
894b4148e9SMarcel Holtmann static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
904b4148e9SMarcel Holtmann 			      size_t count, loff_t *ppos)
914b4148e9SMarcel Holtmann {
924b4148e9SMarcel Holtmann 	struct hci_dev *hdev = file->private_data;
934b4148e9SMarcel Holtmann 	struct sk_buff *skb;
944b4148e9SMarcel Holtmann 	char buf[32];
954b4148e9SMarcel Holtmann 	size_t buf_size = min(count, (sizeof(buf)-1));
964b4148e9SMarcel Holtmann 	bool enable;
974b4148e9SMarcel Holtmann 	int err;
984b4148e9SMarcel Holtmann 
994b4148e9SMarcel Holtmann 	if (!test_bit(HCI_UP, &hdev->flags))
1004b4148e9SMarcel Holtmann 		return -ENETDOWN;
1014b4148e9SMarcel Holtmann 
1024b4148e9SMarcel Holtmann 	if (copy_from_user(buf, user_buf, buf_size))
1034b4148e9SMarcel Holtmann 		return -EFAULT;
1044b4148e9SMarcel Holtmann 
1054b4148e9SMarcel Holtmann 	buf[buf_size] = '\0';
1064b4148e9SMarcel Holtmann 	if (strtobool(buf, &enable))
1074b4148e9SMarcel Holtmann 		return -EINVAL;
1084b4148e9SMarcel Holtmann 
109111902f7SMarcel Holtmann 	if (enable == test_bit(HCI_DUT_MODE, &hdev->dbg_flags))
1104b4148e9SMarcel Holtmann 		return -EALREADY;
1114b4148e9SMarcel Holtmann 
1124b4148e9SMarcel Holtmann 	hci_req_lock(hdev);
1134b4148e9SMarcel Holtmann 	if (enable)
1144b4148e9SMarcel Holtmann 		skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
1154b4148e9SMarcel Holtmann 				     HCI_CMD_TIMEOUT);
1164b4148e9SMarcel Holtmann 	else
1174b4148e9SMarcel Holtmann 		skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
1184b4148e9SMarcel Holtmann 				     HCI_CMD_TIMEOUT);
1194b4148e9SMarcel Holtmann 	hci_req_unlock(hdev);
1204b4148e9SMarcel Holtmann 
1214b4148e9SMarcel Holtmann 	if (IS_ERR(skb))
1224b4148e9SMarcel Holtmann 		return PTR_ERR(skb);
1234b4148e9SMarcel Holtmann 
1244b4148e9SMarcel Holtmann 	err = -bt_to_errno(skb->data[0]);
1254b4148e9SMarcel Holtmann 	kfree_skb(skb);
1264b4148e9SMarcel Holtmann 
1274b4148e9SMarcel Holtmann 	if (err < 0)
1284b4148e9SMarcel Holtmann 		return err;
1294b4148e9SMarcel Holtmann 
130111902f7SMarcel Holtmann 	change_bit(HCI_DUT_MODE, &hdev->dbg_flags);
1314b4148e9SMarcel Holtmann 
1324b4148e9SMarcel Holtmann 	return count;
1334b4148e9SMarcel Holtmann }
1344b4148e9SMarcel Holtmann 
1354b4148e9SMarcel Holtmann static const struct file_operations dut_mode_fops = {
1364b4148e9SMarcel Holtmann 	.open		= simple_open,
1374b4148e9SMarcel Holtmann 	.read		= dut_mode_read,
1384b4148e9SMarcel Holtmann 	.write		= dut_mode_write,
1394b4148e9SMarcel Holtmann 	.llseek		= default_llseek,
1404b4148e9SMarcel Holtmann };
1414b4148e9SMarcel Holtmann 
1421da177e4SLinus Torvalds /* ---- HCI requests ---- */
1431da177e4SLinus Torvalds 
1441904a853SMarcel Holtmann static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode)
1451da177e4SLinus Torvalds {
14642c6b129SJohan Hedberg 	BT_DBG("%s result 0x%2.2x", hdev->name, result);
14775fb0e32SJohan Hedberg 
1481da177e4SLinus Torvalds 	if (hdev->req_status == HCI_REQ_PEND) {
1491da177e4SLinus Torvalds 		hdev->req_result = result;
1501da177e4SLinus Torvalds 		hdev->req_status = HCI_REQ_DONE;
1511da177e4SLinus Torvalds 		wake_up_interruptible(&hdev->req_wait_q);
1521da177e4SLinus Torvalds 	}
1531da177e4SLinus Torvalds }
1541da177e4SLinus Torvalds 
1551da177e4SLinus Torvalds static void hci_req_cancel(struct hci_dev *hdev, int err)
1561da177e4SLinus Torvalds {
1571da177e4SLinus Torvalds 	BT_DBG("%s err 0x%2.2x", hdev->name, err);
1581da177e4SLinus Torvalds 
1591da177e4SLinus Torvalds 	if (hdev->req_status == HCI_REQ_PEND) {
1601da177e4SLinus Torvalds 		hdev->req_result = err;
1611da177e4SLinus Torvalds 		hdev->req_status = HCI_REQ_CANCELED;
1621da177e4SLinus Torvalds 		wake_up_interruptible(&hdev->req_wait_q);
1631da177e4SLinus Torvalds 	}
1641da177e4SLinus Torvalds }
1651da177e4SLinus Torvalds 
16677a63e0aSFengguang Wu static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
16777a63e0aSFengguang Wu 					    u8 event)
16875e84b7cSJohan Hedberg {
16975e84b7cSJohan Hedberg 	struct hci_ev_cmd_complete *ev;
17075e84b7cSJohan Hedberg 	struct hci_event_hdr *hdr;
17175e84b7cSJohan Hedberg 	struct sk_buff *skb;
17275e84b7cSJohan Hedberg 
17375e84b7cSJohan Hedberg 	hci_dev_lock(hdev);
17475e84b7cSJohan Hedberg 
17575e84b7cSJohan Hedberg 	skb = hdev->recv_evt;
17675e84b7cSJohan Hedberg 	hdev->recv_evt = NULL;
17775e84b7cSJohan Hedberg 
17875e84b7cSJohan Hedberg 	hci_dev_unlock(hdev);
17975e84b7cSJohan Hedberg 
18075e84b7cSJohan Hedberg 	if (!skb)
18175e84b7cSJohan Hedberg 		return ERR_PTR(-ENODATA);
18275e84b7cSJohan Hedberg 
18375e84b7cSJohan Hedberg 	if (skb->len < sizeof(*hdr)) {
18475e84b7cSJohan Hedberg 		BT_ERR("Too short HCI event");
18575e84b7cSJohan Hedberg 		goto failed;
18675e84b7cSJohan Hedberg 	}
18775e84b7cSJohan Hedberg 
18875e84b7cSJohan Hedberg 	hdr = (void *) skb->data;
18975e84b7cSJohan Hedberg 	skb_pull(skb, HCI_EVENT_HDR_SIZE);
19075e84b7cSJohan Hedberg 
1917b1abbbeSJohan Hedberg 	if (event) {
1927b1abbbeSJohan Hedberg 		if (hdr->evt != event)
1937b1abbbeSJohan Hedberg 			goto failed;
1947b1abbbeSJohan Hedberg 		return skb;
1957b1abbbeSJohan Hedberg 	}
1967b1abbbeSJohan Hedberg 
19775e84b7cSJohan Hedberg 	if (hdr->evt != HCI_EV_CMD_COMPLETE) {
19875e84b7cSJohan Hedberg 		BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
19975e84b7cSJohan Hedberg 		goto failed;
20075e84b7cSJohan Hedberg 	}
20175e84b7cSJohan Hedberg 
20275e84b7cSJohan Hedberg 	if (skb->len < sizeof(*ev)) {
20375e84b7cSJohan Hedberg 		BT_ERR("Too short cmd_complete event");
20475e84b7cSJohan Hedberg 		goto failed;
20575e84b7cSJohan Hedberg 	}
20675e84b7cSJohan Hedberg 
20775e84b7cSJohan Hedberg 	ev = (void *) skb->data;
20875e84b7cSJohan Hedberg 	skb_pull(skb, sizeof(*ev));
20975e84b7cSJohan Hedberg 
21075e84b7cSJohan Hedberg 	if (opcode == __le16_to_cpu(ev->opcode))
21175e84b7cSJohan Hedberg 		return skb;
21275e84b7cSJohan Hedberg 
21375e84b7cSJohan Hedberg 	BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
21475e84b7cSJohan Hedberg 	       __le16_to_cpu(ev->opcode));
21575e84b7cSJohan Hedberg 
21675e84b7cSJohan Hedberg failed:
21775e84b7cSJohan Hedberg 	kfree_skb(skb);
21875e84b7cSJohan Hedberg 	return ERR_PTR(-ENODATA);
21975e84b7cSJohan Hedberg }
22075e84b7cSJohan Hedberg 
2217b1abbbeSJohan Hedberg struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
22207dc93ddSJohan Hedberg 				  const void *param, u8 event, u32 timeout)
22375e84b7cSJohan Hedberg {
22475e84b7cSJohan Hedberg 	DECLARE_WAITQUEUE(wait, current);
22575e84b7cSJohan Hedberg 	struct hci_request req;
22675e84b7cSJohan Hedberg 	int err = 0;
22775e84b7cSJohan Hedberg 
22875e84b7cSJohan Hedberg 	BT_DBG("%s", hdev->name);
22975e84b7cSJohan Hedberg 
23075e84b7cSJohan Hedberg 	hci_req_init(&req, hdev);
23175e84b7cSJohan Hedberg 
2327b1abbbeSJohan Hedberg 	hci_req_add_ev(&req, opcode, plen, param, event);
23375e84b7cSJohan Hedberg 
23475e84b7cSJohan Hedberg 	hdev->req_status = HCI_REQ_PEND;
23575e84b7cSJohan Hedberg 
23675e84b7cSJohan Hedberg 	add_wait_queue(&hdev->req_wait_q, &wait);
23775e84b7cSJohan Hedberg 	set_current_state(TASK_INTERRUPTIBLE);
23875e84b7cSJohan Hedberg 
239039fada5SChan-yeol Park 	err = hci_req_run(&req, hci_req_sync_complete);
240039fada5SChan-yeol Park 	if (err < 0) {
241039fada5SChan-yeol Park 		remove_wait_queue(&hdev->req_wait_q, &wait);
24222a3ceabSJohan Hedberg 		set_current_state(TASK_RUNNING);
243039fada5SChan-yeol Park 		return ERR_PTR(err);
244039fada5SChan-yeol Park 	}
245039fada5SChan-yeol Park 
24675e84b7cSJohan Hedberg 	schedule_timeout(timeout);
24775e84b7cSJohan Hedberg 
24875e84b7cSJohan Hedberg 	remove_wait_queue(&hdev->req_wait_q, &wait);
24975e84b7cSJohan Hedberg 
25075e84b7cSJohan Hedberg 	if (signal_pending(current))
25175e84b7cSJohan Hedberg 		return ERR_PTR(-EINTR);
25275e84b7cSJohan Hedberg 
25375e84b7cSJohan Hedberg 	switch (hdev->req_status) {
25475e84b7cSJohan Hedberg 	case HCI_REQ_DONE:
25575e84b7cSJohan Hedberg 		err = -bt_to_errno(hdev->req_result);
25675e84b7cSJohan Hedberg 		break;
25775e84b7cSJohan Hedberg 
25875e84b7cSJohan Hedberg 	case HCI_REQ_CANCELED:
25975e84b7cSJohan Hedberg 		err = -hdev->req_result;
26075e84b7cSJohan Hedberg 		break;
26175e84b7cSJohan Hedberg 
26275e84b7cSJohan Hedberg 	default:
26375e84b7cSJohan Hedberg 		err = -ETIMEDOUT;
26475e84b7cSJohan Hedberg 		break;
26575e84b7cSJohan Hedberg 	}
26675e84b7cSJohan Hedberg 
26775e84b7cSJohan Hedberg 	hdev->req_status = hdev->req_result = 0;
26875e84b7cSJohan Hedberg 
26975e84b7cSJohan Hedberg 	BT_DBG("%s end: err %d", hdev->name, err);
27075e84b7cSJohan Hedberg 
27175e84b7cSJohan Hedberg 	if (err < 0)
27275e84b7cSJohan Hedberg 		return ERR_PTR(err);
27375e84b7cSJohan Hedberg 
2747b1abbbeSJohan Hedberg 	return hci_get_cmd_complete(hdev, opcode, event);
2757b1abbbeSJohan Hedberg }
2767b1abbbeSJohan Hedberg EXPORT_SYMBOL(__hci_cmd_sync_ev);
2777b1abbbeSJohan Hedberg 
2787b1abbbeSJohan Hedberg struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
27907dc93ddSJohan Hedberg 			       const void *param, u32 timeout)
2807b1abbbeSJohan Hedberg {
2817b1abbbeSJohan Hedberg 	return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
28275e84b7cSJohan Hedberg }
28375e84b7cSJohan Hedberg EXPORT_SYMBOL(__hci_cmd_sync);
28475e84b7cSJohan Hedberg 
2851da177e4SLinus Torvalds /* Execute request and wait for completion. */
28601178cd4SJohan Hedberg static int __hci_req_sync(struct hci_dev *hdev,
28742c6b129SJohan Hedberg 			  void (*func)(struct hci_request *req,
28842c6b129SJohan Hedberg 				      unsigned long opt),
2891da177e4SLinus Torvalds 			  unsigned long opt, __u32 timeout)
2901da177e4SLinus Torvalds {
29142c6b129SJohan Hedberg 	struct hci_request req;
2921da177e4SLinus Torvalds 	DECLARE_WAITQUEUE(wait, current);
2931da177e4SLinus Torvalds 	int err = 0;
2941da177e4SLinus Torvalds 
2951da177e4SLinus Torvalds 	BT_DBG("%s start", hdev->name);
2961da177e4SLinus Torvalds 
29742c6b129SJohan Hedberg 	hci_req_init(&req, hdev);
29842c6b129SJohan Hedberg 
2991da177e4SLinus Torvalds 	hdev->req_status = HCI_REQ_PEND;
3001da177e4SLinus Torvalds 
30142c6b129SJohan Hedberg 	func(&req, opt);
30253cce22dSJohan Hedberg 
303039fada5SChan-yeol Park 	add_wait_queue(&hdev->req_wait_q, &wait);
304039fada5SChan-yeol Park 	set_current_state(TASK_INTERRUPTIBLE);
305039fada5SChan-yeol Park 
30642c6b129SJohan Hedberg 	err = hci_req_run(&req, hci_req_sync_complete);
30742c6b129SJohan Hedberg 	if (err < 0) {
30853cce22dSJohan Hedberg 		hdev->req_status = 0;
309920c8300SAndre Guedes 
310039fada5SChan-yeol Park 		remove_wait_queue(&hdev->req_wait_q, &wait);
31122a3ceabSJohan Hedberg 		set_current_state(TASK_RUNNING);
312039fada5SChan-yeol Park 
313920c8300SAndre Guedes 		/* ENODATA means the HCI request command queue is empty.
314920c8300SAndre Guedes 		 * This can happen when a request with conditionals doesn't
315920c8300SAndre Guedes 		 * trigger any commands to be sent. This is normal behavior
316920c8300SAndre Guedes 		 * and should not trigger an error return.
31742c6b129SJohan Hedberg 		 */
318920c8300SAndre Guedes 		if (err == -ENODATA)
31942c6b129SJohan Hedberg 			return 0;
320920c8300SAndre Guedes 
321920c8300SAndre Guedes 		return err;
32253cce22dSJohan Hedberg 	}
32353cce22dSJohan Hedberg 
3241da177e4SLinus Torvalds 	schedule_timeout(timeout);
3251da177e4SLinus Torvalds 
3261da177e4SLinus Torvalds 	remove_wait_queue(&hdev->req_wait_q, &wait);
3271da177e4SLinus Torvalds 
3281da177e4SLinus Torvalds 	if (signal_pending(current))
3291da177e4SLinus Torvalds 		return -EINTR;
3301da177e4SLinus Torvalds 
3311da177e4SLinus Torvalds 	switch (hdev->req_status) {
3321da177e4SLinus Torvalds 	case HCI_REQ_DONE:
333e175072fSJoe Perches 		err = -bt_to_errno(hdev->req_result);
3341da177e4SLinus Torvalds 		break;
3351da177e4SLinus Torvalds 
3361da177e4SLinus Torvalds 	case HCI_REQ_CANCELED:
3371da177e4SLinus Torvalds 		err = -hdev->req_result;
3381da177e4SLinus Torvalds 		break;
3391da177e4SLinus Torvalds 
3401da177e4SLinus Torvalds 	default:
3411da177e4SLinus Torvalds 		err = -ETIMEDOUT;
3421da177e4SLinus Torvalds 		break;
3433ff50b79SStephen Hemminger 	}
3441da177e4SLinus Torvalds 
345a5040efaSJohan Hedberg 	hdev->req_status = hdev->req_result = 0;
3461da177e4SLinus Torvalds 
3471da177e4SLinus Torvalds 	BT_DBG("%s end: err %d", hdev->name, err);
3481da177e4SLinus Torvalds 
3491da177e4SLinus Torvalds 	return err;
3501da177e4SLinus Torvalds }
3511da177e4SLinus Torvalds 
35201178cd4SJohan Hedberg static int hci_req_sync(struct hci_dev *hdev,
35342c6b129SJohan Hedberg 			void (*req)(struct hci_request *req,
35442c6b129SJohan Hedberg 				    unsigned long opt),
3551da177e4SLinus Torvalds 			unsigned long opt, __u32 timeout)
3561da177e4SLinus Torvalds {
3571da177e4SLinus Torvalds 	int ret;
3581da177e4SLinus Torvalds 
3597c6a329eSMarcel Holtmann 	if (!test_bit(HCI_UP, &hdev->flags))
3607c6a329eSMarcel Holtmann 		return -ENETDOWN;
3617c6a329eSMarcel Holtmann 
3621da177e4SLinus Torvalds 	/* Serialize all requests */
3631da177e4SLinus Torvalds 	hci_req_lock(hdev);
36401178cd4SJohan Hedberg 	ret = __hci_req_sync(hdev, req, opt, timeout);
3651da177e4SLinus Torvalds 	hci_req_unlock(hdev);
3661da177e4SLinus Torvalds 
3671da177e4SLinus Torvalds 	return ret;
3681da177e4SLinus Torvalds }
3691da177e4SLinus Torvalds 
37042c6b129SJohan Hedberg static void hci_reset_req(struct hci_request *req, unsigned long opt)
3711da177e4SLinus Torvalds {
37242c6b129SJohan Hedberg 	BT_DBG("%s %ld", req->hdev->name, opt);
3731da177e4SLinus Torvalds 
3741da177e4SLinus Torvalds 	/* Reset device */
37542c6b129SJohan Hedberg 	set_bit(HCI_RESET, &req->hdev->flags);
37642c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_RESET, 0, NULL);
3771da177e4SLinus Torvalds }
3781da177e4SLinus Torvalds 
37942c6b129SJohan Hedberg static void bredr_init(struct hci_request *req)
3801da177e4SLinus Torvalds {
38142c6b129SJohan Hedberg 	req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
3822455a3eaSAndrei Emeltchenko 
3831da177e4SLinus Torvalds 	/* Read Local Supported Features */
38442c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
3851da177e4SLinus Torvalds 
3861143e5a6SMarcel Holtmann 	/* Read Local Version */
38742c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
3882177bab5SJohan Hedberg 
3892177bab5SJohan Hedberg 	/* Read BD Address */
39042c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
3911da177e4SLinus Torvalds }
3921da177e4SLinus Torvalds 
3930af801b9SJohan Hedberg static void amp_init1(struct hci_request *req)
394e61ef499SAndrei Emeltchenko {
39542c6b129SJohan Hedberg 	req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
3962455a3eaSAndrei Emeltchenko 
397e61ef499SAndrei Emeltchenko 	/* Read Local Version */
39842c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
3996bcbc489SAndrei Emeltchenko 
400f6996cfeSMarcel Holtmann 	/* Read Local Supported Commands */
401f6996cfeSMarcel Holtmann 	hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
402f6996cfeSMarcel Holtmann 
4036bcbc489SAndrei Emeltchenko 	/* Read Local AMP Info */
40442c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
405e71dfabaSAndrei Emeltchenko 
406e71dfabaSAndrei Emeltchenko 	/* Read Data Blk size */
40742c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
4087528ca1cSMarcel Holtmann 
409f38ba941SMarcel Holtmann 	/* Read Flow Control Mode */
410f38ba941SMarcel Holtmann 	hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
411f38ba941SMarcel Holtmann 
4127528ca1cSMarcel Holtmann 	/* Read Location Data */
4137528ca1cSMarcel Holtmann 	hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
414e61ef499SAndrei Emeltchenko }
415e61ef499SAndrei Emeltchenko 
4160af801b9SJohan Hedberg static void amp_init2(struct hci_request *req)
4170af801b9SJohan Hedberg {
4180af801b9SJohan Hedberg 	/* Read Local Supported Features. Not all AMP controllers
4190af801b9SJohan Hedberg 	 * support this so it's placed conditionally in the second
4200af801b9SJohan Hedberg 	 * stage init.
4210af801b9SJohan Hedberg 	 */
4220af801b9SJohan Hedberg 	if (req->hdev->commands[14] & 0x20)
4230af801b9SJohan Hedberg 		hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
4240af801b9SJohan Hedberg }
4250af801b9SJohan Hedberg 
42642c6b129SJohan Hedberg static void hci_init1_req(struct hci_request *req, unsigned long opt)
427e61ef499SAndrei Emeltchenko {
42842c6b129SJohan Hedberg 	struct hci_dev *hdev = req->hdev;
429e61ef499SAndrei Emeltchenko 
430e61ef499SAndrei Emeltchenko 	BT_DBG("%s %ld", hdev->name, opt);
431e61ef499SAndrei Emeltchenko 
43211778716SAndrei Emeltchenko 	/* Reset */
43311778716SAndrei Emeltchenko 	if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
43442c6b129SJohan Hedberg 		hci_reset_req(req, 0);
43511778716SAndrei Emeltchenko 
436e61ef499SAndrei Emeltchenko 	switch (hdev->dev_type) {
437e61ef499SAndrei Emeltchenko 	case HCI_BREDR:
43842c6b129SJohan Hedberg 		bredr_init(req);
439e61ef499SAndrei Emeltchenko 		break;
440e61ef499SAndrei Emeltchenko 
441e61ef499SAndrei Emeltchenko 	case HCI_AMP:
4420af801b9SJohan Hedberg 		amp_init1(req);
443e61ef499SAndrei Emeltchenko 		break;
444e61ef499SAndrei Emeltchenko 
445e61ef499SAndrei Emeltchenko 	default:
446e61ef499SAndrei Emeltchenko 		BT_ERR("Unknown device type %d", hdev->dev_type);
447e61ef499SAndrei Emeltchenko 		break;
448e61ef499SAndrei Emeltchenko 	}
449e61ef499SAndrei Emeltchenko }
450e61ef499SAndrei Emeltchenko 
45142c6b129SJohan Hedberg static void bredr_setup(struct hci_request *req)
4522177bab5SJohan Hedberg {
4532177bab5SJohan Hedberg 	__le16 param;
4542177bab5SJohan Hedberg 	__u8 flt_type;
4552177bab5SJohan Hedberg 
4562177bab5SJohan Hedberg 	/* Read Buffer Size (ACL mtu, max pkt, etc.) */
45742c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
4582177bab5SJohan Hedberg 
4592177bab5SJohan Hedberg 	/* Read Class of Device */
46042c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
4612177bab5SJohan Hedberg 
4622177bab5SJohan Hedberg 	/* Read Local Name */
46342c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
4642177bab5SJohan Hedberg 
4652177bab5SJohan Hedberg 	/* Read Voice Setting */
46642c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
4672177bab5SJohan Hedberg 
468b4cb9fb2SMarcel Holtmann 	/* Read Number of Supported IAC */
469b4cb9fb2SMarcel Holtmann 	hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
470b4cb9fb2SMarcel Holtmann 
4714b836f39SMarcel Holtmann 	/* Read Current IAC LAP */
4724b836f39SMarcel Holtmann 	hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
4734b836f39SMarcel Holtmann 
4742177bab5SJohan Hedberg 	/* Clear Event Filters */
4752177bab5SJohan Hedberg 	flt_type = HCI_FLT_CLEAR_ALL;
47642c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
4772177bab5SJohan Hedberg 
4782177bab5SJohan Hedberg 	/* Connection accept timeout ~20 secs */
479dcf4adbfSJoe Perches 	param = cpu_to_le16(0x7d00);
48042c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
4812177bab5SJohan Hedberg }
4822177bab5SJohan Hedberg 
48342c6b129SJohan Hedberg static void le_setup(struct hci_request *req)
4842177bab5SJohan Hedberg {
485c73eee91SJohan Hedberg 	struct hci_dev *hdev = req->hdev;
486c73eee91SJohan Hedberg 
4872177bab5SJohan Hedberg 	/* Read LE Buffer Size */
48842c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
4892177bab5SJohan Hedberg 
4902177bab5SJohan Hedberg 	/* Read LE Local Supported Features */
49142c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
4922177bab5SJohan Hedberg 
493747d3f03SMarcel Holtmann 	/* Read LE Supported States */
494747d3f03SMarcel Holtmann 	hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
495747d3f03SMarcel Holtmann 
4962177bab5SJohan Hedberg 	/* Read LE White List Size */
49742c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
4982177bab5SJohan Hedberg 
499747d3f03SMarcel Holtmann 	/* Clear LE White List */
500747d3f03SMarcel Holtmann 	hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
501c73eee91SJohan Hedberg 
502c73eee91SJohan Hedberg 	/* LE-only controllers have LE implicitly enabled */
503c73eee91SJohan Hedberg 	if (!lmp_bredr_capable(hdev))
504c73eee91SJohan Hedberg 		set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
5052177bab5SJohan Hedberg }
5062177bab5SJohan Hedberg 
50742c6b129SJohan Hedberg static void hci_setup_event_mask(struct hci_request *req)
5082177bab5SJohan Hedberg {
50942c6b129SJohan Hedberg 	struct hci_dev *hdev = req->hdev;
51042c6b129SJohan Hedberg 
5112177bab5SJohan Hedberg 	/* The second byte is 0xff instead of 0x9f (two reserved bits
5122177bab5SJohan Hedberg 	 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
5132177bab5SJohan Hedberg 	 * command otherwise.
5142177bab5SJohan Hedberg 	 */
5152177bab5SJohan Hedberg 	u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
5162177bab5SJohan Hedberg 
5172177bab5SJohan Hedberg 	/* CSR 1.1 dongles does not accept any bitfield so don't try to set
5182177bab5SJohan Hedberg 	 * any event mask for pre 1.2 devices.
5192177bab5SJohan Hedberg 	 */
5202177bab5SJohan Hedberg 	if (hdev->hci_ver < BLUETOOTH_VER_1_2)
5212177bab5SJohan Hedberg 		return;
5222177bab5SJohan Hedberg 
5232177bab5SJohan Hedberg 	if (lmp_bredr_capable(hdev)) {
5242177bab5SJohan Hedberg 		events[4] |= 0x01; /* Flow Specification Complete */
5252177bab5SJohan Hedberg 		events[4] |= 0x02; /* Inquiry Result with RSSI */
5262177bab5SJohan Hedberg 		events[4] |= 0x04; /* Read Remote Extended Features Complete */
5272177bab5SJohan Hedberg 		events[5] |= 0x08; /* Synchronous Connection Complete */
5282177bab5SJohan Hedberg 		events[5] |= 0x10; /* Synchronous Connection Changed */
529c7882cbdSMarcel Holtmann 	} else {
530c7882cbdSMarcel Holtmann 		/* Use a different default for LE-only devices */
531c7882cbdSMarcel Holtmann 		memset(events, 0, sizeof(events));
532c7882cbdSMarcel Holtmann 		events[0] |= 0x10; /* Disconnection Complete */
533c7882cbdSMarcel Holtmann 		events[1] |= 0x08; /* Read Remote Version Information Complete */
534c7882cbdSMarcel Holtmann 		events[1] |= 0x20; /* Command Complete */
535c7882cbdSMarcel Holtmann 		events[1] |= 0x40; /* Command Status */
536c7882cbdSMarcel Holtmann 		events[1] |= 0x80; /* Hardware Error */
537c7882cbdSMarcel Holtmann 		events[2] |= 0x04; /* Number of Completed Packets */
538c7882cbdSMarcel Holtmann 		events[3] |= 0x02; /* Data Buffer Overflow */
5390da71f1bSMarcel Holtmann 
5400da71f1bSMarcel Holtmann 		if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
5410da71f1bSMarcel Holtmann 			events[0] |= 0x80; /* Encryption Change */
542c7882cbdSMarcel Holtmann 			events[5] |= 0x80; /* Encryption Key Refresh Complete */
5432177bab5SJohan Hedberg 		}
5440da71f1bSMarcel Holtmann 	}
5452177bab5SJohan Hedberg 
5462177bab5SJohan Hedberg 	if (lmp_inq_rssi_capable(hdev))
5472177bab5SJohan Hedberg 		events[4] |= 0x02; /* Inquiry Result with RSSI */
5482177bab5SJohan Hedberg 
5492177bab5SJohan Hedberg 	if (lmp_sniffsubr_capable(hdev))
5502177bab5SJohan Hedberg 		events[5] |= 0x20; /* Sniff Subrating */
5512177bab5SJohan Hedberg 
5522177bab5SJohan Hedberg 	if (lmp_pause_enc_capable(hdev))
5532177bab5SJohan Hedberg 		events[5] |= 0x80; /* Encryption Key Refresh Complete */
5542177bab5SJohan Hedberg 
5552177bab5SJohan Hedberg 	if (lmp_ext_inq_capable(hdev))
5562177bab5SJohan Hedberg 		events[5] |= 0x40; /* Extended Inquiry Result */
5572177bab5SJohan Hedberg 
5582177bab5SJohan Hedberg 	if (lmp_no_flush_capable(hdev))
5592177bab5SJohan Hedberg 		events[7] |= 0x01; /* Enhanced Flush Complete */
5602177bab5SJohan Hedberg 
5612177bab5SJohan Hedberg 	if (lmp_lsto_capable(hdev))
5622177bab5SJohan Hedberg 		events[6] |= 0x80; /* Link Supervision Timeout Changed */
5632177bab5SJohan Hedberg 
5642177bab5SJohan Hedberg 	if (lmp_ssp_capable(hdev)) {
5652177bab5SJohan Hedberg 		events[6] |= 0x01;	/* IO Capability Request */
5662177bab5SJohan Hedberg 		events[6] |= 0x02;	/* IO Capability Response */
5672177bab5SJohan Hedberg 		events[6] |= 0x04;	/* User Confirmation Request */
5682177bab5SJohan Hedberg 		events[6] |= 0x08;	/* User Passkey Request */
5692177bab5SJohan Hedberg 		events[6] |= 0x10;	/* Remote OOB Data Request */
5702177bab5SJohan Hedberg 		events[6] |= 0x20;	/* Simple Pairing Complete */
5712177bab5SJohan Hedberg 		events[7] |= 0x04;	/* User Passkey Notification */
5722177bab5SJohan Hedberg 		events[7] |= 0x08;	/* Keypress Notification */
5732177bab5SJohan Hedberg 		events[7] |= 0x10;	/* Remote Host Supported
5742177bab5SJohan Hedberg 					 * Features Notification
5752177bab5SJohan Hedberg 					 */
5762177bab5SJohan Hedberg 	}
5772177bab5SJohan Hedberg 
5782177bab5SJohan Hedberg 	if (lmp_le_capable(hdev))
5792177bab5SJohan Hedberg 		events[7] |= 0x20;	/* LE Meta-Event */
5802177bab5SJohan Hedberg 
58142c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
5822177bab5SJohan Hedberg }
5832177bab5SJohan Hedberg 
58442c6b129SJohan Hedberg static void hci_init2_req(struct hci_request *req, unsigned long opt)
5852177bab5SJohan Hedberg {
58642c6b129SJohan Hedberg 	struct hci_dev *hdev = req->hdev;
58742c6b129SJohan Hedberg 
5880af801b9SJohan Hedberg 	if (hdev->dev_type == HCI_AMP)
5890af801b9SJohan Hedberg 		return amp_init2(req);
5900af801b9SJohan Hedberg 
5912177bab5SJohan Hedberg 	if (lmp_bredr_capable(hdev))
59242c6b129SJohan Hedberg 		bredr_setup(req);
59356f87901SJohan Hedberg 	else
59456f87901SJohan Hedberg 		clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
5952177bab5SJohan Hedberg 
5962177bab5SJohan Hedberg 	if (lmp_le_capable(hdev))
59742c6b129SJohan Hedberg 		le_setup(req);
5982177bab5SJohan Hedberg 
5990f3adeaeSMarcel Holtmann 	/* All Bluetooth 1.2 and later controllers should support the
6000f3adeaeSMarcel Holtmann 	 * HCI command for reading the local supported commands.
6010f3adeaeSMarcel Holtmann 	 *
6020f3adeaeSMarcel Holtmann 	 * Unfortunately some controllers indicate Bluetooth 1.2 support,
6030f3adeaeSMarcel Holtmann 	 * but do not have support for this command. If that is the case,
6040f3adeaeSMarcel Holtmann 	 * the driver can quirk the behavior and skip reading the local
6050f3adeaeSMarcel Holtmann 	 * supported commands.
6063f8e2d75SJohan Hedberg 	 */
6070f3adeaeSMarcel Holtmann 	if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
6080f3adeaeSMarcel Holtmann 	    !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
60942c6b129SJohan Hedberg 		hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
6102177bab5SJohan Hedberg 
6112177bab5SJohan Hedberg 	if (lmp_ssp_capable(hdev)) {
61257af75a8SMarcel Holtmann 		/* When SSP is available, then the host features page
61357af75a8SMarcel Holtmann 		 * should also be available as well. However some
61457af75a8SMarcel Holtmann 		 * controllers list the max_page as 0 as long as SSP
61557af75a8SMarcel Holtmann 		 * has not been enabled. To achieve proper debugging
61657af75a8SMarcel Holtmann 		 * output, force the minimum max_page to 1 at least.
61757af75a8SMarcel Holtmann 		 */
61857af75a8SMarcel Holtmann 		hdev->max_page = 0x01;
61957af75a8SMarcel Holtmann 
6202177bab5SJohan Hedberg 		if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
6212177bab5SJohan Hedberg 			u8 mode = 0x01;
622574ea3c7SMarcel Holtmann 
62342c6b129SJohan Hedberg 			hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
6242177bab5SJohan Hedberg 				    sizeof(mode), &mode);
6252177bab5SJohan Hedberg 		} else {
6262177bab5SJohan Hedberg 			struct hci_cp_write_eir cp;
6272177bab5SJohan Hedberg 
6282177bab5SJohan Hedberg 			memset(hdev->eir, 0, sizeof(hdev->eir));
6292177bab5SJohan Hedberg 			memset(&cp, 0, sizeof(cp));
6302177bab5SJohan Hedberg 
63142c6b129SJohan Hedberg 			hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
6322177bab5SJohan Hedberg 		}
6332177bab5SJohan Hedberg 	}
6342177bab5SJohan Hedberg 
635043ec9bfSMarcel Holtmann 	if (lmp_inq_rssi_capable(hdev) ||
636043ec9bfSMarcel Holtmann 	    test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
63704422da9SMarcel Holtmann 		u8 mode;
63804422da9SMarcel Holtmann 
63904422da9SMarcel Holtmann 		/* If Extended Inquiry Result events are supported, then
64004422da9SMarcel Holtmann 		 * they are clearly preferred over Inquiry Result with RSSI
64104422da9SMarcel Holtmann 		 * events.
64204422da9SMarcel Holtmann 		 */
64304422da9SMarcel Holtmann 		mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
64404422da9SMarcel Holtmann 
64504422da9SMarcel Holtmann 		hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
64604422da9SMarcel Holtmann 	}
6472177bab5SJohan Hedberg 
6482177bab5SJohan Hedberg 	if (lmp_inq_tx_pwr_capable(hdev))
64942c6b129SJohan Hedberg 		hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
6502177bab5SJohan Hedberg 
6512177bab5SJohan Hedberg 	if (lmp_ext_feat_capable(hdev)) {
6522177bab5SJohan Hedberg 		struct hci_cp_read_local_ext_features cp;
6532177bab5SJohan Hedberg 
6542177bab5SJohan Hedberg 		cp.page = 0x01;
65542c6b129SJohan Hedberg 		hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
65642c6b129SJohan Hedberg 			    sizeof(cp), &cp);
6572177bab5SJohan Hedberg 	}
6582177bab5SJohan Hedberg 
6592177bab5SJohan Hedberg 	if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
6602177bab5SJohan Hedberg 		u8 enable = 1;
66142c6b129SJohan Hedberg 		hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
6622177bab5SJohan Hedberg 			    &enable);
6632177bab5SJohan Hedberg 	}
6642177bab5SJohan Hedberg }
6652177bab5SJohan Hedberg 
66642c6b129SJohan Hedberg static void hci_setup_link_policy(struct hci_request *req)
6672177bab5SJohan Hedberg {
66842c6b129SJohan Hedberg 	struct hci_dev *hdev = req->hdev;
6692177bab5SJohan Hedberg 	struct hci_cp_write_def_link_policy cp;
6702177bab5SJohan Hedberg 	u16 link_policy = 0;
6712177bab5SJohan Hedberg 
6722177bab5SJohan Hedberg 	if (lmp_rswitch_capable(hdev))
6732177bab5SJohan Hedberg 		link_policy |= HCI_LP_RSWITCH;
6742177bab5SJohan Hedberg 	if (lmp_hold_capable(hdev))
6752177bab5SJohan Hedberg 		link_policy |= HCI_LP_HOLD;
6762177bab5SJohan Hedberg 	if (lmp_sniff_capable(hdev))
6772177bab5SJohan Hedberg 		link_policy |= HCI_LP_SNIFF;
6782177bab5SJohan Hedberg 	if (lmp_park_capable(hdev))
6792177bab5SJohan Hedberg 		link_policy |= HCI_LP_PARK;
6802177bab5SJohan Hedberg 
6812177bab5SJohan Hedberg 	cp.policy = cpu_to_le16(link_policy);
68242c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
6832177bab5SJohan Hedberg }
6842177bab5SJohan Hedberg 
68542c6b129SJohan Hedberg static void hci_set_le_support(struct hci_request *req)
6862177bab5SJohan Hedberg {
68742c6b129SJohan Hedberg 	struct hci_dev *hdev = req->hdev;
6882177bab5SJohan Hedberg 	struct hci_cp_write_le_host_supported cp;
6892177bab5SJohan Hedberg 
690c73eee91SJohan Hedberg 	/* LE-only devices do not support explicit enablement */
691c73eee91SJohan Hedberg 	if (!lmp_bredr_capable(hdev))
692c73eee91SJohan Hedberg 		return;
693c73eee91SJohan Hedberg 
6942177bab5SJohan Hedberg 	memset(&cp, 0, sizeof(cp));
6952177bab5SJohan Hedberg 
6962177bab5SJohan Hedberg 	if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
6972177bab5SJohan Hedberg 		cp.le = 0x01;
69832226e4fSMarcel Holtmann 		cp.simul = 0x00;
6992177bab5SJohan Hedberg 	}
7002177bab5SJohan Hedberg 
7012177bab5SJohan Hedberg 	if (cp.le != lmp_host_le_capable(hdev))
70242c6b129SJohan Hedberg 		hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
7032177bab5SJohan Hedberg 			    &cp);
7042177bab5SJohan Hedberg }
7052177bab5SJohan Hedberg 
706d62e6d67SJohan Hedberg static void hci_set_event_mask_page_2(struct hci_request *req)
707d62e6d67SJohan Hedberg {
708d62e6d67SJohan Hedberg 	struct hci_dev *hdev = req->hdev;
709d62e6d67SJohan Hedberg 	u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
710d62e6d67SJohan Hedberg 
711d62e6d67SJohan Hedberg 	/* If Connectionless Slave Broadcast master role is supported
712d62e6d67SJohan Hedberg 	 * enable all necessary events for it.
713d62e6d67SJohan Hedberg 	 */
71453b834d2SMarcel Holtmann 	if (lmp_csb_master_capable(hdev)) {
715d62e6d67SJohan Hedberg 		events[1] |= 0x40;	/* Triggered Clock Capture */
716d62e6d67SJohan Hedberg 		events[1] |= 0x80;	/* Synchronization Train Complete */
717d62e6d67SJohan Hedberg 		events[2] |= 0x10;	/* Slave Page Response Timeout */
718d62e6d67SJohan Hedberg 		events[2] |= 0x20;	/* CSB Channel Map Change */
719d62e6d67SJohan Hedberg 	}
720d62e6d67SJohan Hedberg 
721d62e6d67SJohan Hedberg 	/* If Connectionless Slave Broadcast slave role is supported
722d62e6d67SJohan Hedberg 	 * enable all necessary events for it.
723d62e6d67SJohan Hedberg 	 */
72453b834d2SMarcel Holtmann 	if (lmp_csb_slave_capable(hdev)) {
725d62e6d67SJohan Hedberg 		events[2] |= 0x01;	/* Synchronization Train Received */
726d62e6d67SJohan Hedberg 		events[2] |= 0x02;	/* CSB Receive */
727d62e6d67SJohan Hedberg 		events[2] |= 0x04;	/* CSB Timeout */
728d62e6d67SJohan Hedberg 		events[2] |= 0x08;	/* Truncated Page Complete */
729d62e6d67SJohan Hedberg 	}
730d62e6d67SJohan Hedberg 
73140c59fcbSMarcel Holtmann 	/* Enable Authenticated Payload Timeout Expired event if supported */
732cd7ca0ecSMarcel Holtmann 	if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
73340c59fcbSMarcel Holtmann 		events[2] |= 0x80;
73440c59fcbSMarcel Holtmann 
735d62e6d67SJohan Hedberg 	hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
736d62e6d67SJohan Hedberg }
737d62e6d67SJohan Hedberg 
73842c6b129SJohan Hedberg static void hci_init3_req(struct hci_request *req, unsigned long opt)
7392177bab5SJohan Hedberg {
74042c6b129SJohan Hedberg 	struct hci_dev *hdev = req->hdev;
741d2c5d77fSJohan Hedberg 	u8 p;
74242c6b129SJohan Hedberg 
7430da71f1bSMarcel Holtmann 	hci_setup_event_mask(req);
7440da71f1bSMarcel Holtmann 
74548ce62c4SMarcel Holtmann 	if (hdev->commands[6] & 0x20) {
74648ce62c4SMarcel Holtmann 		struct hci_cp_read_stored_link_key cp;
74748ce62c4SMarcel Holtmann 
74848ce62c4SMarcel Holtmann 		bacpy(&cp.bdaddr, BDADDR_ANY);
74948ce62c4SMarcel Holtmann 		cp.read_all = 0x01;
75048ce62c4SMarcel Holtmann 		hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
75148ce62c4SMarcel Holtmann 	}
75248ce62c4SMarcel Holtmann 
7532177bab5SJohan Hedberg 	if (hdev->commands[5] & 0x10)
75442c6b129SJohan Hedberg 		hci_setup_link_policy(req);
7552177bab5SJohan Hedberg 
756417287deSMarcel Holtmann 	if (hdev->commands[8] & 0x01)
757417287deSMarcel Holtmann 		hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
758417287deSMarcel Holtmann 
759417287deSMarcel Holtmann 	/* Some older Broadcom based Bluetooth 1.2 controllers do not
760417287deSMarcel Holtmann 	 * support the Read Page Scan Type command. Check support for
761417287deSMarcel Holtmann 	 * this command in the bit mask of supported commands.
762417287deSMarcel Holtmann 	 */
763417287deSMarcel Holtmann 	if (hdev->commands[13] & 0x01)
764417287deSMarcel Holtmann 		hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
765417287deSMarcel Holtmann 
7669193c6e8SAndre Guedes 	if (lmp_le_capable(hdev)) {
7679193c6e8SAndre Guedes 		u8 events[8];
7689193c6e8SAndre Guedes 
7699193c6e8SAndre Guedes 		memset(events, 0, sizeof(events));
7704d6c705bSMarcel Holtmann 		events[0] = 0x0f;
7714d6c705bSMarcel Holtmann 
7724d6c705bSMarcel Holtmann 		if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
7734d6c705bSMarcel Holtmann 			events[0] |= 0x10;	/* LE Long Term Key Request */
774662bc2e6SAndre Guedes 
775662bc2e6SAndre Guedes 		/* If controller supports the Connection Parameters Request
776662bc2e6SAndre Guedes 		 * Link Layer Procedure, enable the corresponding event.
777662bc2e6SAndre Guedes 		 */
778662bc2e6SAndre Guedes 		if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
779662bc2e6SAndre Guedes 			events[0] |= 0x20;	/* LE Remote Connection
780662bc2e6SAndre Guedes 						 * Parameter Request
781662bc2e6SAndre Guedes 						 */
782662bc2e6SAndre Guedes 
783a9f6068eSMarcel Holtmann 		/* If the controller supports the Data Length Extension
784a9f6068eSMarcel Holtmann 		 * feature, enable the corresponding event.
785a9f6068eSMarcel Holtmann 		 */
786a9f6068eSMarcel Holtmann 		if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
787a9f6068eSMarcel Holtmann 			events[0] |= 0x40;	/* LE Data Length Change */
788a9f6068eSMarcel Holtmann 
7894b71bba4SMarcel Holtmann 		/* If the controller supports Extended Scanner Filter
7904b71bba4SMarcel Holtmann 		 * Policies, enable the correspondig event.
7914b71bba4SMarcel Holtmann 		 */
7924b71bba4SMarcel Holtmann 		if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
7934b71bba4SMarcel Holtmann 			events[1] |= 0x04;	/* LE Direct Advertising
7944b71bba4SMarcel Holtmann 						 * Report
7954b71bba4SMarcel Holtmann 						 */
7964b71bba4SMarcel Holtmann 
7975a34bd5fSMarcel Holtmann 		/* If the controller supports the LE Read Local P-256
7985a34bd5fSMarcel Holtmann 		 * Public Key command, enable the corresponding event.
7995a34bd5fSMarcel Holtmann 		 */
8005a34bd5fSMarcel Holtmann 		if (hdev->commands[34] & 0x02)
8015a34bd5fSMarcel Holtmann 			events[0] |= 0x80;	/* LE Read Local P-256
8025a34bd5fSMarcel Holtmann 						 * Public Key Complete
8035a34bd5fSMarcel Holtmann 						 */
8045a34bd5fSMarcel Holtmann 
8055a34bd5fSMarcel Holtmann 		/* If the controller supports the LE Generate DHKey
8065a34bd5fSMarcel Holtmann 		 * command, enable the corresponding event.
8075a34bd5fSMarcel Holtmann 		 */
8085a34bd5fSMarcel Holtmann 		if (hdev->commands[34] & 0x04)
8095a34bd5fSMarcel Holtmann 			events[1] |= 0x01;	/* LE Generate DHKey Complete */
8105a34bd5fSMarcel Holtmann 
8119193c6e8SAndre Guedes 		hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
8129193c6e8SAndre Guedes 			    events);
8139193c6e8SAndre Guedes 
81415a49ccaSMarcel Holtmann 		if (hdev->commands[25] & 0x40) {
81515a49ccaSMarcel Holtmann 			/* Read LE Advertising Channel TX Power */
81615a49ccaSMarcel Holtmann 			hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
81715a49ccaSMarcel Holtmann 		}
81815a49ccaSMarcel Holtmann 
819a9f6068eSMarcel Holtmann 		if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
820a9f6068eSMarcel Holtmann 			/* Read LE Maximum Data Length */
821a9f6068eSMarcel Holtmann 			hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
822a9f6068eSMarcel Holtmann 
823a9f6068eSMarcel Holtmann 			/* Read LE Suggested Default Data Length */
824a9f6068eSMarcel Holtmann 			hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
825a9f6068eSMarcel Holtmann 		}
826a9f6068eSMarcel Holtmann 
82742c6b129SJohan Hedberg 		hci_set_le_support(req);
8289193c6e8SAndre Guedes 	}
829d2c5d77fSJohan Hedberg 
830d2c5d77fSJohan Hedberg 	/* Read features beyond page 1 if available */
831d2c5d77fSJohan Hedberg 	for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
832d2c5d77fSJohan Hedberg 		struct hci_cp_read_local_ext_features cp;
833d2c5d77fSJohan Hedberg 
834d2c5d77fSJohan Hedberg 		cp.page = p;
835d2c5d77fSJohan Hedberg 		hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
836d2c5d77fSJohan Hedberg 			    sizeof(cp), &cp);
837d2c5d77fSJohan Hedberg 	}
8382177bab5SJohan Hedberg }
8392177bab5SJohan Hedberg 
8405d4e7e8dSJohan Hedberg static void hci_init4_req(struct hci_request *req, unsigned long opt)
8415d4e7e8dSJohan Hedberg {
8425d4e7e8dSJohan Hedberg 	struct hci_dev *hdev = req->hdev;
8435d4e7e8dSJohan Hedberg 
84436f260ceSMarcel Holtmann 	/* Some Broadcom based Bluetooth controllers do not support the
84536f260ceSMarcel Holtmann 	 * Delete Stored Link Key command. They are clearly indicating its
84636f260ceSMarcel Holtmann 	 * absence in the bit mask of supported commands.
84736f260ceSMarcel Holtmann 	 *
84836f260ceSMarcel Holtmann 	 * Check the supported commands and only if the the command is marked
84936f260ceSMarcel Holtmann 	 * as supported send it. If not supported assume that the controller
85036f260ceSMarcel Holtmann 	 * does not have actual support for stored link keys which makes this
85136f260ceSMarcel Holtmann 	 * command redundant anyway.
85236f260ceSMarcel Holtmann 	 *
85336f260ceSMarcel Holtmann 	 * Some controllers indicate that they support handling deleting
85436f260ceSMarcel Holtmann 	 * stored link keys, but they don't. The quirk lets a driver
85536f260ceSMarcel Holtmann 	 * just disable this command.
85636f260ceSMarcel Holtmann 	 */
85736f260ceSMarcel Holtmann 	if (hdev->commands[6] & 0x80 &&
85836f260ceSMarcel Holtmann 	    !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
85936f260ceSMarcel Holtmann 		struct hci_cp_delete_stored_link_key cp;
86036f260ceSMarcel Holtmann 
86136f260ceSMarcel Holtmann 		bacpy(&cp.bdaddr, BDADDR_ANY);
86236f260ceSMarcel Holtmann 		cp.delete_all = 0x01;
86336f260ceSMarcel Holtmann 		hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
86436f260ceSMarcel Holtmann 			    sizeof(cp), &cp);
86536f260ceSMarcel Holtmann 	}
86636f260ceSMarcel Holtmann 
867d62e6d67SJohan Hedberg 	/* Set event mask page 2 if the HCI command for it is supported */
868d62e6d67SJohan Hedberg 	if (hdev->commands[22] & 0x04)
869d62e6d67SJohan Hedberg 		hci_set_event_mask_page_2(req);
870d62e6d67SJohan Hedberg 
871109e3191SMarcel Holtmann 	/* Read local codec list if the HCI command is supported */
872109e3191SMarcel Holtmann 	if (hdev->commands[29] & 0x20)
873109e3191SMarcel Holtmann 		hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
874109e3191SMarcel Holtmann 
875f4fe73edSMarcel Holtmann 	/* Get MWS transport configuration if the HCI command is supported */
876f4fe73edSMarcel Holtmann 	if (hdev->commands[30] & 0x08)
877f4fe73edSMarcel Holtmann 		hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
878f4fe73edSMarcel Holtmann 
8795d4e7e8dSJohan Hedberg 	/* Check for Synchronization Train support */
88053b834d2SMarcel Holtmann 	if (lmp_sync_train_capable(hdev))
8815d4e7e8dSJohan Hedberg 		hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
882a6d0d690SMarcel Holtmann 
883a6d0d690SMarcel Holtmann 	/* Enable Secure Connections if supported and configured */
884574ea3c7SMarcel Holtmann 	if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
885574ea3c7SMarcel Holtmann 	    bredr_sc_enabled(hdev)) {
886a6d0d690SMarcel Holtmann 		u8 support = 0x01;
887574ea3c7SMarcel Holtmann 
888a6d0d690SMarcel Holtmann 		hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
889a6d0d690SMarcel Holtmann 			    sizeof(support), &support);
890a6d0d690SMarcel Holtmann 	}
8915d4e7e8dSJohan Hedberg }
8925d4e7e8dSJohan Hedberg 
8932177bab5SJohan Hedberg static int __hci_init(struct hci_dev *hdev)
8942177bab5SJohan Hedberg {
8952177bab5SJohan Hedberg 	int err;
8962177bab5SJohan Hedberg 
8972177bab5SJohan Hedberg 	err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
8982177bab5SJohan Hedberg 	if (err < 0)
8992177bab5SJohan Hedberg 		return err;
9002177bab5SJohan Hedberg 
9014b4148e9SMarcel Holtmann 	/* The Device Under Test (DUT) mode is special and available for
9024b4148e9SMarcel Holtmann 	 * all controller types. So just create it early on.
9034b4148e9SMarcel Holtmann 	 */
9044b4148e9SMarcel Holtmann 	if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
9054b4148e9SMarcel Holtmann 		debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
9064b4148e9SMarcel Holtmann 				    &dut_mode_fops);
9074b4148e9SMarcel Holtmann 	}
9084b4148e9SMarcel Holtmann 
9092177bab5SJohan Hedberg 	err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
9102177bab5SJohan Hedberg 	if (err < 0)
9112177bab5SJohan Hedberg 		return err;
9122177bab5SJohan Hedberg 
9130af801b9SJohan Hedberg 	/* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
9140af801b9SJohan Hedberg 	 * BR/EDR/LE type controllers. AMP controllers only need the
9150af801b9SJohan Hedberg 	 * first two stages of init.
9160af801b9SJohan Hedberg 	 */
9170af801b9SJohan Hedberg 	if (hdev->dev_type != HCI_BREDR)
9180af801b9SJohan Hedberg 		return 0;
9190af801b9SJohan Hedberg 
9205d4e7e8dSJohan Hedberg 	err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
9215d4e7e8dSJohan Hedberg 	if (err < 0)
9225d4e7e8dSJohan Hedberg 		return err;
9235d4e7e8dSJohan Hedberg 
924baf27f6eSMarcel Holtmann 	err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
925baf27f6eSMarcel Holtmann 	if (err < 0)
926baf27f6eSMarcel Holtmann 		return err;
927baf27f6eSMarcel Holtmann 
928ec6cef9cSMarcel Holtmann 	/* This function is only called when the controller is actually in
929ec6cef9cSMarcel Holtmann 	 * configured state. When the controller is marked as unconfigured,
930ec6cef9cSMarcel Holtmann 	 * this initialization procedure is not run.
931ec6cef9cSMarcel Holtmann 	 *
932ec6cef9cSMarcel Holtmann 	 * It means that it is possible that a controller runs through its
933ec6cef9cSMarcel Holtmann 	 * setup phase and then discovers missing settings. If that is the
934ec6cef9cSMarcel Holtmann 	 * case, then this function will not be called. It then will only
935ec6cef9cSMarcel Holtmann 	 * be called during the config phase.
936ec6cef9cSMarcel Holtmann 	 *
937ec6cef9cSMarcel Holtmann 	 * So only when in setup phase or config phase, create the debugfs
938ec6cef9cSMarcel Holtmann 	 * entries and register the SMP channels.
939baf27f6eSMarcel Holtmann 	 */
940ec6cef9cSMarcel Holtmann 	if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
941ec6cef9cSMarcel Holtmann 	    !test_bit(HCI_CONFIG, &hdev->dev_flags))
942baf27f6eSMarcel Holtmann 		return 0;
943baf27f6eSMarcel Holtmann 
94460c5f5fbSMarcel Holtmann 	hci_debugfs_create_common(hdev);
94560c5f5fbSMarcel Holtmann 
94671c3b60eSMarcel Holtmann 	if (lmp_bredr_capable(hdev))
94760c5f5fbSMarcel Holtmann 		hci_debugfs_create_bredr(hdev);
9482bfa3531SMarcel Holtmann 
949162a3bacSMarcel Holtmann 	if (lmp_le_capable(hdev))
95060c5f5fbSMarcel Holtmann 		hci_debugfs_create_le(hdev);
951e7b8fc92SMarcel Holtmann 
952baf27f6eSMarcel Holtmann 	return 0;
9532177bab5SJohan Hedberg }
9542177bab5SJohan Hedberg 
9550ebca7d6SMarcel Holtmann static void hci_init0_req(struct hci_request *req, unsigned long opt)
9560ebca7d6SMarcel Holtmann {
9570ebca7d6SMarcel Holtmann 	struct hci_dev *hdev = req->hdev;
9580ebca7d6SMarcel Holtmann 
9590ebca7d6SMarcel Holtmann 	BT_DBG("%s %ld", hdev->name, opt);
9600ebca7d6SMarcel Holtmann 
9610ebca7d6SMarcel Holtmann 	/* Reset */
9620ebca7d6SMarcel Holtmann 	if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
9630ebca7d6SMarcel Holtmann 		hci_reset_req(req, 0);
9640ebca7d6SMarcel Holtmann 
9650ebca7d6SMarcel Holtmann 	/* Read Local Version */
9660ebca7d6SMarcel Holtmann 	hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
9670ebca7d6SMarcel Holtmann 
9680ebca7d6SMarcel Holtmann 	/* Read BD Address */
9690ebca7d6SMarcel Holtmann 	if (hdev->set_bdaddr)
9700ebca7d6SMarcel Holtmann 		hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
9710ebca7d6SMarcel Holtmann }
9720ebca7d6SMarcel Holtmann 
9730ebca7d6SMarcel Holtmann static int __hci_unconf_init(struct hci_dev *hdev)
9740ebca7d6SMarcel Holtmann {
9750ebca7d6SMarcel Holtmann 	int err;
9760ebca7d6SMarcel Holtmann 
977cc78b44bSMarcel Holtmann 	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
978cc78b44bSMarcel Holtmann 		return 0;
979cc78b44bSMarcel Holtmann 
9800ebca7d6SMarcel Holtmann 	err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT);
9810ebca7d6SMarcel Holtmann 	if (err < 0)
9820ebca7d6SMarcel Holtmann 		return err;
9830ebca7d6SMarcel Holtmann 
9840ebca7d6SMarcel Holtmann 	return 0;
9850ebca7d6SMarcel Holtmann }
9860ebca7d6SMarcel Holtmann 
98742c6b129SJohan Hedberg static void hci_scan_req(struct hci_request *req, unsigned long opt)
9881da177e4SLinus Torvalds {
9891da177e4SLinus Torvalds 	__u8 scan = opt;
9901da177e4SLinus Torvalds 
99142c6b129SJohan Hedberg 	BT_DBG("%s %x", req->hdev->name, scan);
9921da177e4SLinus Torvalds 
9931da177e4SLinus Torvalds 	/* Inquiry and Page scans */
99442c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
9951da177e4SLinus Torvalds }
9961da177e4SLinus Torvalds 
99742c6b129SJohan Hedberg static void hci_auth_req(struct hci_request *req, unsigned long opt)
9981da177e4SLinus Torvalds {
9991da177e4SLinus Torvalds 	__u8 auth = opt;
10001da177e4SLinus Torvalds 
100142c6b129SJohan Hedberg 	BT_DBG("%s %x", req->hdev->name, auth);
10021da177e4SLinus Torvalds 
10031da177e4SLinus Torvalds 	/* Authentication */
100442c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
10051da177e4SLinus Torvalds }
10061da177e4SLinus Torvalds 
100742c6b129SJohan Hedberg static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
10081da177e4SLinus Torvalds {
10091da177e4SLinus Torvalds 	__u8 encrypt = opt;
10101da177e4SLinus Torvalds 
101142c6b129SJohan Hedberg 	BT_DBG("%s %x", req->hdev->name, encrypt);
10121da177e4SLinus Torvalds 
1013e4e8e37cSMarcel Holtmann 	/* Encryption */
101442c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
10151da177e4SLinus Torvalds }
10161da177e4SLinus Torvalds 
101742c6b129SJohan Hedberg static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
1018e4e8e37cSMarcel Holtmann {
1019e4e8e37cSMarcel Holtmann 	__le16 policy = cpu_to_le16(opt);
1020e4e8e37cSMarcel Holtmann 
102142c6b129SJohan Hedberg 	BT_DBG("%s %x", req->hdev->name, policy);
1022e4e8e37cSMarcel Holtmann 
1023e4e8e37cSMarcel Holtmann 	/* Default link policy */
102442c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
1025e4e8e37cSMarcel Holtmann }
1026e4e8e37cSMarcel Holtmann 
10271da177e4SLinus Torvalds /* Get HCI device by index.
10281da177e4SLinus Torvalds  * Device is held on return. */
10291da177e4SLinus Torvalds struct hci_dev *hci_dev_get(int index)
10301da177e4SLinus Torvalds {
10318035ded4SLuiz Augusto von Dentz 	struct hci_dev *hdev = NULL, *d;
10321da177e4SLinus Torvalds 
10331da177e4SLinus Torvalds 	BT_DBG("%d", index);
10341da177e4SLinus Torvalds 
10351da177e4SLinus Torvalds 	if (index < 0)
10361da177e4SLinus Torvalds 		return NULL;
10371da177e4SLinus Torvalds 
10381da177e4SLinus Torvalds 	read_lock(&hci_dev_list_lock);
10398035ded4SLuiz Augusto von Dentz 	list_for_each_entry(d, &hci_dev_list, list) {
10401da177e4SLinus Torvalds 		if (d->id == index) {
10411da177e4SLinus Torvalds 			hdev = hci_dev_hold(d);
10421da177e4SLinus Torvalds 			break;
10431da177e4SLinus Torvalds 		}
10441da177e4SLinus Torvalds 	}
10451da177e4SLinus Torvalds 	read_unlock(&hci_dev_list_lock);
10461da177e4SLinus Torvalds 	return hdev;
10471da177e4SLinus Torvalds }
10481da177e4SLinus Torvalds 
10491da177e4SLinus Torvalds /* ---- Inquiry support ---- */
1050ff9ef578SJohan Hedberg 
105130dc78e1SJohan Hedberg bool hci_discovery_active(struct hci_dev *hdev)
105230dc78e1SJohan Hedberg {
105330dc78e1SJohan Hedberg 	struct discovery_state *discov = &hdev->discovery;
105430dc78e1SJohan Hedberg 
10556fbe195dSAndre Guedes 	switch (discov->state) {
1056343f935bSAndre Guedes 	case DISCOVERY_FINDING:
10576fbe195dSAndre Guedes 	case DISCOVERY_RESOLVING:
105830dc78e1SJohan Hedberg 		return true;
105930dc78e1SJohan Hedberg 
10606fbe195dSAndre Guedes 	default:
106130dc78e1SJohan Hedberg 		return false;
106230dc78e1SJohan Hedberg 	}
10636fbe195dSAndre Guedes }
106430dc78e1SJohan Hedberg 
1065ff9ef578SJohan Hedberg void hci_discovery_set_state(struct hci_dev *hdev, int state)
1066ff9ef578SJohan Hedberg {
1067bb3e0a33SJohan Hedberg 	int old_state = hdev->discovery.state;
1068bb3e0a33SJohan Hedberg 
1069ff9ef578SJohan Hedberg 	BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1070ff9ef578SJohan Hedberg 
1071bb3e0a33SJohan Hedberg 	if (old_state == state)
1072ff9ef578SJohan Hedberg 		return;
1073ff9ef578SJohan Hedberg 
1074bb3e0a33SJohan Hedberg 	hdev->discovery.state = state;
1075bb3e0a33SJohan Hedberg 
1076ff9ef578SJohan Hedberg 	switch (state) {
1077ff9ef578SJohan Hedberg 	case DISCOVERY_STOPPED:
1078c54c3860SAndre Guedes 		hci_update_background_scan(hdev);
1079c54c3860SAndre Guedes 
1080bb3e0a33SJohan Hedberg 		if (old_state != DISCOVERY_STARTING)
1081ff9ef578SJohan Hedberg 			mgmt_discovering(hdev, 0);
1082ff9ef578SJohan Hedberg 		break;
1083ff9ef578SJohan Hedberg 	case DISCOVERY_STARTING:
1084ff9ef578SJohan Hedberg 		break;
1085343f935bSAndre Guedes 	case DISCOVERY_FINDING:
1086ff9ef578SJohan Hedberg 		mgmt_discovering(hdev, 1);
1087ff9ef578SJohan Hedberg 		break;
108830dc78e1SJohan Hedberg 	case DISCOVERY_RESOLVING:
108930dc78e1SJohan Hedberg 		break;
1090ff9ef578SJohan Hedberg 	case DISCOVERY_STOPPING:
1091ff9ef578SJohan Hedberg 		break;
1092ff9ef578SJohan Hedberg 	}
1093ff9ef578SJohan Hedberg }
1094ff9ef578SJohan Hedberg 
10951f9b9a5dSAndre Guedes void hci_inquiry_cache_flush(struct hci_dev *hdev)
10961da177e4SLinus Torvalds {
109730883512SJohan Hedberg 	struct discovery_state *cache = &hdev->discovery;
1098b57c1a56SJohan Hedberg 	struct inquiry_entry *p, *n;
10991da177e4SLinus Torvalds 
1100561aafbcSJohan Hedberg 	list_for_each_entry_safe(p, n, &cache->all, all) {
1101561aafbcSJohan Hedberg 		list_del(&p->all);
1102b57c1a56SJohan Hedberg 		kfree(p);
11031da177e4SLinus Torvalds 	}
1104561aafbcSJohan Hedberg 
1105561aafbcSJohan Hedberg 	INIT_LIST_HEAD(&cache->unknown);
1106561aafbcSJohan Hedberg 	INIT_LIST_HEAD(&cache->resolve);
11071da177e4SLinus Torvalds }
11081da177e4SLinus Torvalds 
1109a8c5fb1aSGustavo Padovan struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1110a8c5fb1aSGustavo Padovan 					       bdaddr_t *bdaddr)
11111da177e4SLinus Torvalds {
111230883512SJohan Hedberg 	struct discovery_state *cache = &hdev->discovery;
11131da177e4SLinus Torvalds 	struct inquiry_entry *e;
11141da177e4SLinus Torvalds 
11156ed93dc6SAndrei Emeltchenko 	BT_DBG("cache %p, %pMR", cache, bdaddr);
11161da177e4SLinus Torvalds 
1117561aafbcSJohan Hedberg 	list_for_each_entry(e, &cache->all, all) {
11181da177e4SLinus Torvalds 		if (!bacmp(&e->data.bdaddr, bdaddr))
11191da177e4SLinus Torvalds 			return e;
11201da177e4SLinus Torvalds 	}
11211da177e4SLinus Torvalds 
1122b57c1a56SJohan Hedberg 	return NULL;
1123b57c1a56SJohan Hedberg }
1124b57c1a56SJohan Hedberg 
1125561aafbcSJohan Hedberg struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1126561aafbcSJohan Hedberg 						       bdaddr_t *bdaddr)
1127561aafbcSJohan Hedberg {
112830883512SJohan Hedberg 	struct discovery_state *cache = &hdev->discovery;
1129561aafbcSJohan Hedberg 	struct inquiry_entry *e;
1130561aafbcSJohan Hedberg 
11316ed93dc6SAndrei Emeltchenko 	BT_DBG("cache %p, %pMR", cache, bdaddr);
1132561aafbcSJohan Hedberg 
1133561aafbcSJohan Hedberg 	list_for_each_entry(e, &cache->unknown, list) {
1134561aafbcSJohan Hedberg 		if (!bacmp(&e->data.bdaddr, bdaddr))
1135561aafbcSJohan Hedberg 			return e;
1136561aafbcSJohan Hedberg 	}
1137561aafbcSJohan Hedberg 
1138561aafbcSJohan Hedberg 	return NULL;
1139561aafbcSJohan Hedberg }
1140561aafbcSJohan Hedberg 
114130dc78e1SJohan Hedberg struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
114230dc78e1SJohan Hedberg 						       bdaddr_t *bdaddr,
114330dc78e1SJohan Hedberg 						       int state)
114430dc78e1SJohan Hedberg {
114530dc78e1SJohan Hedberg 	struct discovery_state *cache = &hdev->discovery;
114630dc78e1SJohan Hedberg 	struct inquiry_entry *e;
114730dc78e1SJohan Hedberg 
11486ed93dc6SAndrei Emeltchenko 	BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
114930dc78e1SJohan Hedberg 
115030dc78e1SJohan Hedberg 	list_for_each_entry(e, &cache->resolve, list) {
115130dc78e1SJohan Hedberg 		if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
115230dc78e1SJohan Hedberg 			return e;
115330dc78e1SJohan Hedberg 		if (!bacmp(&e->data.bdaddr, bdaddr))
115430dc78e1SJohan Hedberg 			return e;
115530dc78e1SJohan Hedberg 	}
115630dc78e1SJohan Hedberg 
115730dc78e1SJohan Hedberg 	return NULL;
115830dc78e1SJohan Hedberg }
115930dc78e1SJohan Hedberg 
1160a3d4e20aSJohan Hedberg void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1161a3d4e20aSJohan Hedberg 				      struct inquiry_entry *ie)
1162a3d4e20aSJohan Hedberg {
1163a3d4e20aSJohan Hedberg 	struct discovery_state *cache = &hdev->discovery;
1164a3d4e20aSJohan Hedberg 	struct list_head *pos = &cache->resolve;
1165a3d4e20aSJohan Hedberg 	struct inquiry_entry *p;
1166a3d4e20aSJohan Hedberg 
1167a3d4e20aSJohan Hedberg 	list_del(&ie->list);
1168a3d4e20aSJohan Hedberg 
1169a3d4e20aSJohan Hedberg 	list_for_each_entry(p, &cache->resolve, list) {
1170a3d4e20aSJohan Hedberg 		if (p->name_state != NAME_PENDING &&
1171a3d4e20aSJohan Hedberg 		    abs(p->data.rssi) >= abs(ie->data.rssi))
1172a3d4e20aSJohan Hedberg 			break;
1173a3d4e20aSJohan Hedberg 		pos = &p->list;
1174a3d4e20aSJohan Hedberg 	}
1175a3d4e20aSJohan Hedberg 
1176a3d4e20aSJohan Hedberg 	list_add(&ie->list, pos);
1177a3d4e20aSJohan Hedberg }
1178a3d4e20aSJohan Hedberg 
1179af58925cSMarcel Holtmann u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1180af58925cSMarcel Holtmann 			     bool name_known)
11811da177e4SLinus Torvalds {
118230883512SJohan Hedberg 	struct discovery_state *cache = &hdev->discovery;
118370f23020SAndrei Emeltchenko 	struct inquiry_entry *ie;
1184af58925cSMarcel Holtmann 	u32 flags = 0;
11851da177e4SLinus Torvalds 
11866ed93dc6SAndrei Emeltchenko 	BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
11871da177e4SLinus Torvalds 
11886928a924SJohan Hedberg 	hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
11892b2fec4dSSzymon Janc 
1190af58925cSMarcel Holtmann 	if (!data->ssp_mode)
1191af58925cSMarcel Holtmann 		flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1192388fc8faSJohan Hedberg 
119370f23020SAndrei Emeltchenko 	ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1194a3d4e20aSJohan Hedberg 	if (ie) {
1195af58925cSMarcel Holtmann 		if (!ie->data.ssp_mode)
1196af58925cSMarcel Holtmann 			flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1197388fc8faSJohan Hedberg 
1198a3d4e20aSJohan Hedberg 		if (ie->name_state == NAME_NEEDED &&
1199a3d4e20aSJohan Hedberg 		    data->rssi != ie->data.rssi) {
1200a3d4e20aSJohan Hedberg 			ie->data.rssi = data->rssi;
1201a3d4e20aSJohan Hedberg 			hci_inquiry_cache_update_resolve(hdev, ie);
1202a3d4e20aSJohan Hedberg 		}
1203a3d4e20aSJohan Hedberg 
1204561aafbcSJohan Hedberg 		goto update;
1205a3d4e20aSJohan Hedberg 	}
1206561aafbcSJohan Hedberg 
12071da177e4SLinus Torvalds 	/* Entry not in the cache. Add new one. */
120827f70f3eSJohan Hedberg 	ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1209af58925cSMarcel Holtmann 	if (!ie) {
1210af58925cSMarcel Holtmann 		flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1211af58925cSMarcel Holtmann 		goto done;
1212af58925cSMarcel Holtmann 	}
121370f23020SAndrei Emeltchenko 
1214561aafbcSJohan Hedberg 	list_add(&ie->all, &cache->all);
1215561aafbcSJohan Hedberg 
1216561aafbcSJohan Hedberg 	if (name_known) {
1217561aafbcSJohan Hedberg 		ie->name_state = NAME_KNOWN;
1218561aafbcSJohan Hedberg 	} else {
1219561aafbcSJohan Hedberg 		ie->name_state = NAME_NOT_KNOWN;
1220561aafbcSJohan Hedberg 		list_add(&ie->list, &cache->unknown);
1221561aafbcSJohan Hedberg 	}
1222561aafbcSJohan Hedberg 
1223561aafbcSJohan Hedberg update:
1224561aafbcSJohan Hedberg 	if (name_known && ie->name_state != NAME_KNOWN &&
1225561aafbcSJohan Hedberg 	    ie->name_state != NAME_PENDING) {
1226561aafbcSJohan Hedberg 		ie->name_state = NAME_KNOWN;
1227561aafbcSJohan Hedberg 		list_del(&ie->list);
12281da177e4SLinus Torvalds 	}
12291da177e4SLinus Torvalds 
123070f23020SAndrei Emeltchenko 	memcpy(&ie->data, data, sizeof(*data));
123170f23020SAndrei Emeltchenko 	ie->timestamp = jiffies;
12321da177e4SLinus Torvalds 	cache->timestamp = jiffies;
12333175405bSJohan Hedberg 
12343175405bSJohan Hedberg 	if (ie->name_state == NAME_NOT_KNOWN)
1235af58925cSMarcel Holtmann 		flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
12363175405bSJohan Hedberg 
1237af58925cSMarcel Holtmann done:
1238af58925cSMarcel Holtmann 	return flags;
12391da177e4SLinus Torvalds }
12401da177e4SLinus Torvalds 
12411da177e4SLinus Torvalds static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
12421da177e4SLinus Torvalds {
124330883512SJohan Hedberg 	struct discovery_state *cache = &hdev->discovery;
12441da177e4SLinus Torvalds 	struct inquiry_info *info = (struct inquiry_info *) buf;
12451da177e4SLinus Torvalds 	struct inquiry_entry *e;
12461da177e4SLinus Torvalds 	int copied = 0;
12471da177e4SLinus Torvalds 
1248561aafbcSJohan Hedberg 	list_for_each_entry(e, &cache->all, all) {
12491da177e4SLinus Torvalds 		struct inquiry_data *data = &e->data;
1250b57c1a56SJohan Hedberg 
1251b57c1a56SJohan Hedberg 		if (copied >= num)
1252b57c1a56SJohan Hedberg 			break;
1253b57c1a56SJohan Hedberg 
12541da177e4SLinus Torvalds 		bacpy(&info->bdaddr, &data->bdaddr);
12551da177e4SLinus Torvalds 		info->pscan_rep_mode	= data->pscan_rep_mode;
12561da177e4SLinus Torvalds 		info->pscan_period_mode	= data->pscan_period_mode;
12571da177e4SLinus Torvalds 		info->pscan_mode	= data->pscan_mode;
12581da177e4SLinus Torvalds 		memcpy(info->dev_class, data->dev_class, 3);
12591da177e4SLinus Torvalds 		info->clock_offset	= data->clock_offset;
1260b57c1a56SJohan Hedberg 
12611da177e4SLinus Torvalds 		info++;
1262b57c1a56SJohan Hedberg 		copied++;
12631da177e4SLinus Torvalds 	}
12641da177e4SLinus Torvalds 
12651da177e4SLinus Torvalds 	BT_DBG("cache %p, copied %d", cache, copied);
12661da177e4SLinus Torvalds 	return copied;
12671da177e4SLinus Torvalds }
12681da177e4SLinus Torvalds 
126942c6b129SJohan Hedberg static void hci_inq_req(struct hci_request *req, unsigned long opt)
12701da177e4SLinus Torvalds {
12711da177e4SLinus Torvalds 	struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
127242c6b129SJohan Hedberg 	struct hci_dev *hdev = req->hdev;
12731da177e4SLinus Torvalds 	struct hci_cp_inquiry cp;
12741da177e4SLinus Torvalds 
12751da177e4SLinus Torvalds 	BT_DBG("%s", hdev->name);
12761da177e4SLinus Torvalds 
12771da177e4SLinus Torvalds 	if (test_bit(HCI_INQUIRY, &hdev->flags))
12781da177e4SLinus Torvalds 		return;
12791da177e4SLinus Torvalds 
12801da177e4SLinus Torvalds 	/* Start Inquiry */
12811da177e4SLinus Torvalds 	memcpy(&cp.lap, &ir->lap, 3);
12821da177e4SLinus Torvalds 	cp.length  = ir->length;
12831da177e4SLinus Torvalds 	cp.num_rsp = ir->num_rsp;
128442c6b129SJohan Hedberg 	hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
12851da177e4SLinus Torvalds }
12861da177e4SLinus Torvalds 
12871da177e4SLinus Torvalds int hci_inquiry(void __user *arg)
12881da177e4SLinus Torvalds {
12891da177e4SLinus Torvalds 	__u8 __user *ptr = arg;
12901da177e4SLinus Torvalds 	struct hci_inquiry_req ir;
12911da177e4SLinus Torvalds 	struct hci_dev *hdev;
12921da177e4SLinus Torvalds 	int err = 0, do_inquiry = 0, max_rsp;
12931da177e4SLinus Torvalds 	long timeo;
12941da177e4SLinus Torvalds 	__u8 *buf;
12951da177e4SLinus Torvalds 
12961da177e4SLinus Torvalds 	if (copy_from_user(&ir, ptr, sizeof(ir)))
12971da177e4SLinus Torvalds 		return -EFAULT;
12981da177e4SLinus Torvalds 
12995a08ecceSAndrei Emeltchenko 	hdev = hci_dev_get(ir.dev_id);
13005a08ecceSAndrei Emeltchenko 	if (!hdev)
13011da177e4SLinus Torvalds 		return -ENODEV;
13021da177e4SLinus Torvalds 
13030736cfa8SMarcel Holtmann 	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
13040736cfa8SMarcel Holtmann 		err = -EBUSY;
13050736cfa8SMarcel Holtmann 		goto done;
13060736cfa8SMarcel Holtmann 	}
13070736cfa8SMarcel Holtmann 
13084a964404SMarcel Holtmann 	if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
1309fee746b0SMarcel Holtmann 		err = -EOPNOTSUPP;
1310fee746b0SMarcel Holtmann 		goto done;
1311fee746b0SMarcel Holtmann 	}
1312fee746b0SMarcel Holtmann 
13135b69bef5SMarcel Holtmann 	if (hdev->dev_type != HCI_BREDR) {
13145b69bef5SMarcel Holtmann 		err = -EOPNOTSUPP;
13155b69bef5SMarcel Holtmann 		goto done;
13165b69bef5SMarcel Holtmann 	}
13175b69bef5SMarcel Holtmann 
131856f87901SJohan Hedberg 	if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
131956f87901SJohan Hedberg 		err = -EOPNOTSUPP;
132056f87901SJohan Hedberg 		goto done;
132156f87901SJohan Hedberg 	}
132256f87901SJohan Hedberg 
132309fd0de5SGustavo F. Padovan 	hci_dev_lock(hdev);
13241da177e4SLinus Torvalds 	if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1325a8c5fb1aSGustavo Padovan 	    inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
13261f9b9a5dSAndre Guedes 		hci_inquiry_cache_flush(hdev);
13271da177e4SLinus Torvalds 		do_inquiry = 1;
13281da177e4SLinus Torvalds 	}
132909fd0de5SGustavo F. Padovan 	hci_dev_unlock(hdev);
13301da177e4SLinus Torvalds 
133104837f64SMarcel Holtmann 	timeo = ir.length * msecs_to_jiffies(2000);
133270f23020SAndrei Emeltchenko 
133370f23020SAndrei Emeltchenko 	if (do_inquiry) {
133401178cd4SJohan Hedberg 		err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
133501178cd4SJohan Hedberg 				   timeo);
133670f23020SAndrei Emeltchenko 		if (err < 0)
13371da177e4SLinus Torvalds 			goto done;
13383e13fa1eSAndre Guedes 
13393e13fa1eSAndre Guedes 		/* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
13403e13fa1eSAndre Guedes 		 * cleared). If it is interrupted by a signal, return -EINTR.
13413e13fa1eSAndre Guedes 		 */
134274316201SNeilBrown 		if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
13433e13fa1eSAndre Guedes 				TASK_INTERRUPTIBLE))
13443e13fa1eSAndre Guedes 			return -EINTR;
134570f23020SAndrei Emeltchenko 	}
13461da177e4SLinus Torvalds 
13478fc9ced3SGustavo Padovan 	/* for unlimited number of responses we will use buffer with
13488fc9ced3SGustavo Padovan 	 * 255 entries
13498fc9ced3SGustavo Padovan 	 */
13501da177e4SLinus Torvalds 	max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
13511da177e4SLinus Torvalds 
13521da177e4SLinus Torvalds 	/* cache_dump can't sleep. Therefore we allocate temp buffer and then
13531da177e4SLinus Torvalds 	 * copy it to the user space.
13541da177e4SLinus Torvalds 	 */
135570f23020SAndrei Emeltchenko 	buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
135670f23020SAndrei Emeltchenko 	if (!buf) {
13571da177e4SLinus Torvalds 		err = -ENOMEM;
13581da177e4SLinus Torvalds 		goto done;
13591da177e4SLinus Torvalds 	}
13601da177e4SLinus Torvalds 
136109fd0de5SGustavo F. Padovan 	hci_dev_lock(hdev);
13621da177e4SLinus Torvalds 	ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
136309fd0de5SGustavo F. Padovan 	hci_dev_unlock(hdev);
13641da177e4SLinus Torvalds 
13651da177e4SLinus Torvalds 	BT_DBG("num_rsp %d", ir.num_rsp);
13661da177e4SLinus Torvalds 
13671da177e4SLinus Torvalds 	if (!copy_to_user(ptr, &ir, sizeof(ir))) {
13681da177e4SLinus Torvalds 		ptr += sizeof(ir);
13691da177e4SLinus Torvalds 		if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
13701da177e4SLinus Torvalds 				 ir.num_rsp))
13711da177e4SLinus Torvalds 			err = -EFAULT;
13721da177e4SLinus Torvalds 	} else
13731da177e4SLinus Torvalds 		err = -EFAULT;
13741da177e4SLinus Torvalds 
13751da177e4SLinus Torvalds 	kfree(buf);
13761da177e4SLinus Torvalds 
13771da177e4SLinus Torvalds done:
13781da177e4SLinus Torvalds 	hci_dev_put(hdev);
13791da177e4SLinus Torvalds 	return err;
13801da177e4SLinus Torvalds }
13811da177e4SLinus Torvalds 
1382cbed0ca1SJohan Hedberg static int hci_dev_do_open(struct hci_dev *hdev)
13831da177e4SLinus Torvalds {
13841da177e4SLinus Torvalds 	int ret = 0;
13851da177e4SLinus Torvalds 
13861da177e4SLinus Torvalds 	BT_DBG("%s %p", hdev->name, hdev);
13871da177e4SLinus Torvalds 
13881da177e4SLinus Torvalds 	hci_req_lock(hdev);
13891da177e4SLinus Torvalds 
139094324962SJohan Hovold 	if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
139194324962SJohan Hovold 		ret = -ENODEV;
139294324962SJohan Hovold 		goto done;
139394324962SJohan Hovold 	}
139494324962SJohan Hovold 
1395d603b76bSMarcel Holtmann 	if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
1396d603b76bSMarcel Holtmann 	    !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
1397a5c8f270SMarcel Holtmann 		/* Check for rfkill but allow the HCI setup stage to
1398a5c8f270SMarcel Holtmann 		 * proceed (which in itself doesn't cause any RF activity).
1399bf543036SJohan Hedberg 		 */
1400a5c8f270SMarcel Holtmann 		if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
1401611b30f7SMarcel Holtmann 			ret = -ERFKILL;
1402611b30f7SMarcel Holtmann 			goto done;
1403611b30f7SMarcel Holtmann 		}
1404611b30f7SMarcel Holtmann 
1405a5c8f270SMarcel Holtmann 		/* Check for valid public address or a configured static
1406a5c8f270SMarcel Holtmann 		 * random adddress, but let the HCI setup proceed to
1407a5c8f270SMarcel Holtmann 		 * be able to determine if there is a public address
1408a5c8f270SMarcel Holtmann 		 * or not.
1409a5c8f270SMarcel Holtmann 		 *
1410c6beca0eSMarcel Holtmann 		 * In case of user channel usage, it is not important
1411c6beca0eSMarcel Holtmann 		 * if a public address or static random address is
1412c6beca0eSMarcel Holtmann 		 * available.
1413c6beca0eSMarcel Holtmann 		 *
1414a5c8f270SMarcel Holtmann 		 * This check is only valid for BR/EDR controllers
1415a5c8f270SMarcel Holtmann 		 * since AMP controllers do not have an address.
1416a5c8f270SMarcel Holtmann 		 */
1417c6beca0eSMarcel Holtmann 		if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
1418c6beca0eSMarcel Holtmann 		    hdev->dev_type == HCI_BREDR &&
1419a5c8f270SMarcel Holtmann 		    !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1420a5c8f270SMarcel Holtmann 		    !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1421a5c8f270SMarcel Holtmann 			ret = -EADDRNOTAVAIL;
1422a5c8f270SMarcel Holtmann 			goto done;
1423a5c8f270SMarcel Holtmann 		}
1424a5c8f270SMarcel Holtmann 	}
1425a5c8f270SMarcel Holtmann 
14261da177e4SLinus Torvalds 	if (test_bit(HCI_UP, &hdev->flags)) {
14271da177e4SLinus Torvalds 		ret = -EALREADY;
14281da177e4SLinus Torvalds 		goto done;
14291da177e4SLinus Torvalds 	}
14301da177e4SLinus Torvalds 
14311da177e4SLinus Torvalds 	if (hdev->open(hdev)) {
14321da177e4SLinus Torvalds 		ret = -EIO;
14331da177e4SLinus Torvalds 		goto done;
14341da177e4SLinus Torvalds 	}
14351da177e4SLinus Torvalds 
14361da177e4SLinus Torvalds 	atomic_set(&hdev->cmd_cnt, 1);
14371da177e4SLinus Torvalds 	set_bit(HCI_INIT, &hdev->flags);
1438f41c70c4SMarcel Holtmann 
1439af202f84SMarcel Holtmann 	if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
1440af202f84SMarcel Holtmann 		if (hdev->setup)
1441f41c70c4SMarcel Holtmann 			ret = hdev->setup(hdev);
1442f41c70c4SMarcel Holtmann 
1443af202f84SMarcel Holtmann 		/* The transport driver can set these quirks before
1444af202f84SMarcel Holtmann 		 * creating the HCI device or in its setup callback.
1445af202f84SMarcel Holtmann 		 *
1446af202f84SMarcel Holtmann 		 * In case any of them is set, the controller has to
1447af202f84SMarcel Holtmann 		 * start up as unconfigured.
1448af202f84SMarcel Holtmann 		 */
1449eb1904f4SMarcel Holtmann 		if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1450eb1904f4SMarcel Holtmann 		    test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
145189bc22d2SMarcel Holtmann 			set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
1452f41c70c4SMarcel Holtmann 
14530ebca7d6SMarcel Holtmann 		/* For an unconfigured controller it is required to
14540ebca7d6SMarcel Holtmann 		 * read at least the version information provided by
14550ebca7d6SMarcel Holtmann 		 * the Read Local Version Information command.
14560ebca7d6SMarcel Holtmann 		 *
14570ebca7d6SMarcel Holtmann 		 * If the set_bdaddr driver callback is provided, then
14580ebca7d6SMarcel Holtmann 		 * also the original Bluetooth public device address
14590ebca7d6SMarcel Holtmann 		 * will be read using the Read BD Address command.
14600ebca7d6SMarcel Holtmann 		 */
14610ebca7d6SMarcel Holtmann 		if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
14620ebca7d6SMarcel Holtmann 			ret = __hci_unconf_init(hdev);
146389bc22d2SMarcel Holtmann 	}
146489bc22d2SMarcel Holtmann 
14659713c17bSMarcel Holtmann 	if (test_bit(HCI_CONFIG, &hdev->dev_flags)) {
14669713c17bSMarcel Holtmann 		/* If public address change is configured, ensure that
14679713c17bSMarcel Holtmann 		 * the address gets programmed. If the driver does not
14689713c17bSMarcel Holtmann 		 * support changing the public address, fail the power
14699713c17bSMarcel Holtmann 		 * on procedure.
147024c457e2SMarcel Holtmann 		 */
14719713c17bSMarcel Holtmann 		if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
14729713c17bSMarcel Holtmann 		    hdev->set_bdaddr)
147324c457e2SMarcel Holtmann 			ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
147424c457e2SMarcel Holtmann 		else
147524c457e2SMarcel Holtmann 			ret = -EADDRNOTAVAIL;
147624c457e2SMarcel Holtmann 	}
147724c457e2SMarcel Holtmann 
1478f41c70c4SMarcel Holtmann 	if (!ret) {
14794a964404SMarcel Holtmann 		if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
14800736cfa8SMarcel Holtmann 		    !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
14812177bab5SJohan Hedberg 			ret = __hci_init(hdev);
14821da177e4SLinus Torvalds 	}
14831da177e4SLinus Torvalds 
1484f41c70c4SMarcel Holtmann 	clear_bit(HCI_INIT, &hdev->flags);
1485f41c70c4SMarcel Holtmann 
14861da177e4SLinus Torvalds 	if (!ret) {
14871da177e4SLinus Torvalds 		hci_dev_hold(hdev);
1488d6bfd59cSJohan Hedberg 		set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
14891da177e4SLinus Torvalds 		set_bit(HCI_UP, &hdev->flags);
14901da177e4SLinus Torvalds 		hci_notify(hdev, HCI_DEV_UP);
1491bb4b2a9aSAndrei Emeltchenko 		if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
1492d603b76bSMarcel Holtmann 		    !test_bit(HCI_CONFIG, &hdev->dev_flags) &&
14934a964404SMarcel Holtmann 		    !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
14940736cfa8SMarcel Holtmann 		    !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
14951514b892SMarcel Holtmann 		    hdev->dev_type == HCI_BREDR) {
149609fd0de5SGustavo F. Padovan 			hci_dev_lock(hdev);
1497744cf19eSJohan Hedberg 			mgmt_powered(hdev, 1);
149809fd0de5SGustavo F. Padovan 			hci_dev_unlock(hdev);
149956e5cb86SJohan Hedberg 		}
15001da177e4SLinus Torvalds 	} else {
15011da177e4SLinus Torvalds 		/* Init failed, cleanup */
15023eff45eaSGustavo F. Padovan 		flush_work(&hdev->tx_work);
1503c347b765SGustavo F. Padovan 		flush_work(&hdev->cmd_work);
1504b78752ccSMarcel Holtmann 		flush_work(&hdev->rx_work);
15051da177e4SLinus Torvalds 
15061da177e4SLinus Torvalds 		skb_queue_purge(&hdev->cmd_q);
15071da177e4SLinus Torvalds 		skb_queue_purge(&hdev->rx_q);
15081da177e4SLinus Torvalds 
15091da177e4SLinus Torvalds 		if (hdev->flush)
15101da177e4SLinus Torvalds 			hdev->flush(hdev);
15111da177e4SLinus Torvalds 
15121da177e4SLinus Torvalds 		if (hdev->sent_cmd) {
15131da177e4SLinus Torvalds 			kfree_skb(hdev->sent_cmd);
15141da177e4SLinus Torvalds 			hdev->sent_cmd = NULL;
15151da177e4SLinus Torvalds 		}
15161da177e4SLinus Torvalds 
15171da177e4SLinus Torvalds 		hdev->close(hdev);
1518fee746b0SMarcel Holtmann 		hdev->flags &= BIT(HCI_RAW);
15191da177e4SLinus Torvalds 	}
15201da177e4SLinus Torvalds 
15211da177e4SLinus Torvalds done:
15221da177e4SLinus Torvalds 	hci_req_unlock(hdev);
15231da177e4SLinus Torvalds 	return ret;
15241da177e4SLinus Torvalds }
15251da177e4SLinus Torvalds 
1526cbed0ca1SJohan Hedberg /* ---- HCI ioctl helpers ---- */
1527cbed0ca1SJohan Hedberg 
1528cbed0ca1SJohan Hedberg int hci_dev_open(__u16 dev)
1529cbed0ca1SJohan Hedberg {
1530cbed0ca1SJohan Hedberg 	struct hci_dev *hdev;
1531cbed0ca1SJohan Hedberg 	int err;
1532cbed0ca1SJohan Hedberg 
1533cbed0ca1SJohan Hedberg 	hdev = hci_dev_get(dev);
1534cbed0ca1SJohan Hedberg 	if (!hdev)
1535cbed0ca1SJohan Hedberg 		return -ENODEV;
1536cbed0ca1SJohan Hedberg 
15374a964404SMarcel Holtmann 	/* Devices that are marked as unconfigured can only be powered
1538fee746b0SMarcel Holtmann 	 * up as user channel. Trying to bring them up as normal devices
1539fee746b0SMarcel Holtmann 	 * will result into a failure. Only user channel operation is
1540fee746b0SMarcel Holtmann 	 * possible.
1541fee746b0SMarcel Holtmann 	 *
1542fee746b0SMarcel Holtmann 	 * When this function is called for a user channel, the flag
1543fee746b0SMarcel Holtmann 	 * HCI_USER_CHANNEL will be set first before attempting to
1544fee746b0SMarcel Holtmann 	 * open the device.
1545fee746b0SMarcel Holtmann 	 */
15464a964404SMarcel Holtmann 	if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
1547fee746b0SMarcel Holtmann 	    !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1548fee746b0SMarcel Holtmann 		err = -EOPNOTSUPP;
1549fee746b0SMarcel Holtmann 		goto done;
1550fee746b0SMarcel Holtmann 	}
1551fee746b0SMarcel Holtmann 
1552e1d08f40SJohan Hedberg 	/* We need to ensure that no other power on/off work is pending
1553e1d08f40SJohan Hedberg 	 * before proceeding to call hci_dev_do_open. This is
1554e1d08f40SJohan Hedberg 	 * particularly important if the setup procedure has not yet
1555e1d08f40SJohan Hedberg 	 * completed.
1556e1d08f40SJohan Hedberg 	 */
1557e1d08f40SJohan Hedberg 	if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1558e1d08f40SJohan Hedberg 		cancel_delayed_work(&hdev->power_off);
1559e1d08f40SJohan Hedberg 
1560a5c8f270SMarcel Holtmann 	/* After this call it is guaranteed that the setup procedure
1561a5c8f270SMarcel Holtmann 	 * has finished. This means that error conditions like RFKILL
1562a5c8f270SMarcel Holtmann 	 * or no valid public or static random address apply.
1563a5c8f270SMarcel Holtmann 	 */
1564e1d08f40SJohan Hedberg 	flush_workqueue(hdev->req_workqueue);
1565e1d08f40SJohan Hedberg 
156612aa4f0aSMarcel Holtmann 	/* For controllers not using the management interface and that
1567b6ae8457SJohan Hedberg 	 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
156812aa4f0aSMarcel Holtmann 	 * so that pairing works for them. Once the management interface
156912aa4f0aSMarcel Holtmann 	 * is in use this bit will be cleared again and userspace has
157012aa4f0aSMarcel Holtmann 	 * to explicitly enable it.
157112aa4f0aSMarcel Holtmann 	 */
157212aa4f0aSMarcel Holtmann 	if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
157312aa4f0aSMarcel Holtmann 	    !test_bit(HCI_MGMT, &hdev->dev_flags))
1574b6ae8457SJohan Hedberg 		set_bit(HCI_BONDABLE, &hdev->dev_flags);
157512aa4f0aSMarcel Holtmann 
1576cbed0ca1SJohan Hedberg 	err = hci_dev_do_open(hdev);
1577cbed0ca1SJohan Hedberg 
1578fee746b0SMarcel Holtmann done:
1579cbed0ca1SJohan Hedberg 	hci_dev_put(hdev);
1580cbed0ca1SJohan Hedberg 	return err;
1581cbed0ca1SJohan Hedberg }
1582cbed0ca1SJohan Hedberg 
1583d7347f3cSJohan Hedberg /* This function requires the caller holds hdev->lock */
1584d7347f3cSJohan Hedberg static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1585d7347f3cSJohan Hedberg {
1586d7347f3cSJohan Hedberg 	struct hci_conn_params *p;
1587d7347f3cSJohan Hedberg 
1588f161dd41SJohan Hedberg 	list_for_each_entry(p, &hdev->le_conn_params, list) {
1589f161dd41SJohan Hedberg 		if (p->conn) {
1590f161dd41SJohan Hedberg 			hci_conn_drop(p->conn);
1591f8aaf9b6SJohan Hedberg 			hci_conn_put(p->conn);
1592f161dd41SJohan Hedberg 			p->conn = NULL;
1593f161dd41SJohan Hedberg 		}
1594d7347f3cSJohan Hedberg 		list_del_init(&p->action);
1595f161dd41SJohan Hedberg 	}
1596d7347f3cSJohan Hedberg 
1597d7347f3cSJohan Hedberg 	BT_DBG("All LE pending actions cleared");
1598d7347f3cSJohan Hedberg }
1599d7347f3cSJohan Hedberg 
16001da177e4SLinus Torvalds static int hci_dev_do_close(struct hci_dev *hdev)
16011da177e4SLinus Torvalds {
16021da177e4SLinus Torvalds 	BT_DBG("%s %p", hdev->name, hdev);
16031da177e4SLinus Torvalds 
1604a44fecbdSTedd Ho-Jeong An 	if (!test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
1605a44fecbdSTedd Ho-Jeong An 		/* Execute vendor specific shutdown routine */
1606a44fecbdSTedd Ho-Jeong An 		if (hdev->shutdown)
1607a44fecbdSTedd Ho-Jeong An 			hdev->shutdown(hdev);
1608a44fecbdSTedd Ho-Jeong An 	}
1609a44fecbdSTedd Ho-Jeong An 
161078c04c0bSVinicius Costa Gomes 	cancel_delayed_work(&hdev->power_off);
161178c04c0bSVinicius Costa Gomes 
16121da177e4SLinus Torvalds 	hci_req_cancel(hdev, ENODEV);
16131da177e4SLinus Torvalds 	hci_req_lock(hdev);
16141da177e4SLinus Torvalds 
16151da177e4SLinus Torvalds 	if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
161665cc2b49SMarcel Holtmann 		cancel_delayed_work_sync(&hdev->cmd_timer);
16171da177e4SLinus Torvalds 		hci_req_unlock(hdev);
16181da177e4SLinus Torvalds 		return 0;
16191da177e4SLinus Torvalds 	}
16201da177e4SLinus Torvalds 
16213eff45eaSGustavo F. Padovan 	/* Flush RX and TX works */
16223eff45eaSGustavo F. Padovan 	flush_work(&hdev->tx_work);
1623b78752ccSMarcel Holtmann 	flush_work(&hdev->rx_work);
16241da177e4SLinus Torvalds 
162516ab91abSJohan Hedberg 	if (hdev->discov_timeout > 0) {
1626e0f9309fSJohan Hedberg 		cancel_delayed_work(&hdev->discov_off);
162716ab91abSJohan Hedberg 		hdev->discov_timeout = 0;
16285e5282bbSJohan Hedberg 		clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1629310a3d48SMarcel Holtmann 		clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
163016ab91abSJohan Hedberg 	}
163116ab91abSJohan Hedberg 
1632a8b2d5c2SJohan Hedberg 	if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
16337d78525dSJohan Hedberg 		cancel_delayed_work(&hdev->service_cache);
16347d78525dSJohan Hedberg 
16357ba8b4beSAndre Guedes 	cancel_delayed_work_sync(&hdev->le_scan_disable);
16362d28cfe7SJakub Pawlowski 	cancel_delayed_work_sync(&hdev->le_scan_restart);
16374518bb0fSJohan Hedberg 
16384518bb0fSJohan Hedberg 	if (test_bit(HCI_MGMT, &hdev->dev_flags))
1639d6bfd59cSJohan Hedberg 		cancel_delayed_work_sync(&hdev->rpa_expired);
16407ba8b4beSAndre Guedes 
164176727c02SJohan Hedberg 	/* Avoid potential lockdep warnings from the *_flush() calls by
164276727c02SJohan Hedberg 	 * ensuring the workqueue is empty up front.
164376727c02SJohan Hedberg 	 */
164476727c02SJohan Hedberg 	drain_workqueue(hdev->workqueue);
164576727c02SJohan Hedberg 
164609fd0de5SGustavo F. Padovan 	hci_dev_lock(hdev);
16471aeb9c65SJohan Hedberg 
16488f502f84SJohan Hedberg 	hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
16498f502f84SJohan Hedberg 
16501aeb9c65SJohan Hedberg 	if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
16511aeb9c65SJohan Hedberg 		if (hdev->dev_type == HCI_BREDR)
16521aeb9c65SJohan Hedberg 			mgmt_powered(hdev, 0);
16531aeb9c65SJohan Hedberg 	}
16541aeb9c65SJohan Hedberg 
16551f9b9a5dSAndre Guedes 	hci_inquiry_cache_flush(hdev);
1656d7347f3cSJohan Hedberg 	hci_pend_le_actions_clear(hdev);
1657f161dd41SJohan Hedberg 	hci_conn_hash_flush(hdev);
165809fd0de5SGustavo F. Padovan 	hci_dev_unlock(hdev);
16591da177e4SLinus Torvalds 
166064dae967SMarcel Holtmann 	smp_unregister(hdev);
166164dae967SMarcel Holtmann 
16621da177e4SLinus Torvalds 	hci_notify(hdev, HCI_DEV_DOWN);
16631da177e4SLinus Torvalds 
16641da177e4SLinus Torvalds 	if (hdev->flush)
16651da177e4SLinus Torvalds 		hdev->flush(hdev);
16661da177e4SLinus Torvalds 
16671da177e4SLinus Torvalds 	/* Reset device */
16681da177e4SLinus Torvalds 	skb_queue_purge(&hdev->cmd_q);
16691da177e4SLinus Torvalds 	atomic_set(&hdev->cmd_cnt, 1);
16704a964404SMarcel Holtmann 	if (!test_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
16714a964404SMarcel Holtmann 	    !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
1672a6c511c6SSzymon Janc 	    test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
16731da177e4SLinus Torvalds 		set_bit(HCI_INIT, &hdev->flags);
167401178cd4SJohan Hedberg 		__hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
16751da177e4SLinus Torvalds 		clear_bit(HCI_INIT, &hdev->flags);
16761da177e4SLinus Torvalds 	}
16771da177e4SLinus Torvalds 
1678c347b765SGustavo F. Padovan 	/* flush cmd  work */
1679c347b765SGustavo F. Padovan 	flush_work(&hdev->cmd_work);
16801da177e4SLinus Torvalds 
16811da177e4SLinus Torvalds 	/* Drop queues */
16821da177e4SLinus Torvalds 	skb_queue_purge(&hdev->rx_q);
16831da177e4SLinus Torvalds 	skb_queue_purge(&hdev->cmd_q);
16841da177e4SLinus Torvalds 	skb_queue_purge(&hdev->raw_q);
16851da177e4SLinus Torvalds 
16861da177e4SLinus Torvalds 	/* Drop last sent command */
16871da177e4SLinus Torvalds 	if (hdev->sent_cmd) {
168865cc2b49SMarcel Holtmann 		cancel_delayed_work_sync(&hdev->cmd_timer);
16891da177e4SLinus Torvalds 		kfree_skb(hdev->sent_cmd);
16901da177e4SLinus Torvalds 		hdev->sent_cmd = NULL;
16911da177e4SLinus Torvalds 	}
16921da177e4SLinus Torvalds 
1693b6ddb638SJohan Hedberg 	kfree_skb(hdev->recv_evt);
1694b6ddb638SJohan Hedberg 	hdev->recv_evt = NULL;
1695b6ddb638SJohan Hedberg 
16961da177e4SLinus Torvalds 	/* After this point our queues are empty
16971da177e4SLinus Torvalds 	 * and no tasks are scheduled. */
16981da177e4SLinus Torvalds 	hdev->close(hdev);
16991da177e4SLinus Torvalds 
170035b973c9SJohan Hedberg 	/* Clear flags */
1701fee746b0SMarcel Holtmann 	hdev->flags &= BIT(HCI_RAW);
170235b973c9SJohan Hedberg 	hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
170335b973c9SJohan Hedberg 
1704ced5c338SAndrei Emeltchenko 	/* Controller radio is available but is currently powered down */
1705536619e8SMarcel Holtmann 	hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1706ced5c338SAndrei Emeltchenko 
1707e59fda8dSJohan Hedberg 	memset(hdev->eir, 0, sizeof(hdev->eir));
170809b3c3fbSJohan Hedberg 	memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
17097a4cd51dSMarcel Holtmann 	bacpy(&hdev->random_addr, BDADDR_ANY);
1710e59fda8dSJohan Hedberg 
17111da177e4SLinus Torvalds 	hci_req_unlock(hdev);
17121da177e4SLinus Torvalds 
17131da177e4SLinus Torvalds 	hci_dev_put(hdev);
17141da177e4SLinus Torvalds 	return 0;
17151da177e4SLinus Torvalds }
17161da177e4SLinus Torvalds 
17171da177e4SLinus Torvalds int hci_dev_close(__u16 dev)
17181da177e4SLinus Torvalds {
17191da177e4SLinus Torvalds 	struct hci_dev *hdev;
17201da177e4SLinus Torvalds 	int err;
17211da177e4SLinus Torvalds 
172270f23020SAndrei Emeltchenko 	hdev = hci_dev_get(dev);
172370f23020SAndrei Emeltchenko 	if (!hdev)
17241da177e4SLinus Torvalds 		return -ENODEV;
17258ee56540SMarcel Holtmann 
17260736cfa8SMarcel Holtmann 	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
17270736cfa8SMarcel Holtmann 		err = -EBUSY;
17280736cfa8SMarcel Holtmann 		goto done;
17290736cfa8SMarcel Holtmann 	}
17300736cfa8SMarcel Holtmann 
17318ee56540SMarcel Holtmann 	if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
17328ee56540SMarcel Holtmann 		cancel_delayed_work(&hdev->power_off);
17338ee56540SMarcel Holtmann 
17341da177e4SLinus Torvalds 	err = hci_dev_do_close(hdev);
17358ee56540SMarcel Holtmann 
17360736cfa8SMarcel Holtmann done:
17371da177e4SLinus Torvalds 	hci_dev_put(hdev);
17381da177e4SLinus Torvalds 	return err;
17391da177e4SLinus Torvalds }
17401da177e4SLinus Torvalds 
17415c912495SMarcel Holtmann static int hci_dev_do_reset(struct hci_dev *hdev)
17421da177e4SLinus Torvalds {
17435c912495SMarcel Holtmann 	int ret;
17441da177e4SLinus Torvalds 
17455c912495SMarcel Holtmann 	BT_DBG("%s %p", hdev->name, hdev);
17461da177e4SLinus Torvalds 
17471da177e4SLinus Torvalds 	hci_req_lock(hdev);
17481da177e4SLinus Torvalds 
17491da177e4SLinus Torvalds 	/* Drop queues */
17501da177e4SLinus Torvalds 	skb_queue_purge(&hdev->rx_q);
17511da177e4SLinus Torvalds 	skb_queue_purge(&hdev->cmd_q);
17521da177e4SLinus Torvalds 
175376727c02SJohan Hedberg 	/* Avoid potential lockdep warnings from the *_flush() calls by
175476727c02SJohan Hedberg 	 * ensuring the workqueue is empty up front.
175576727c02SJohan Hedberg 	 */
175676727c02SJohan Hedberg 	drain_workqueue(hdev->workqueue);
175776727c02SJohan Hedberg 
175809fd0de5SGustavo F. Padovan 	hci_dev_lock(hdev);
17591f9b9a5dSAndre Guedes 	hci_inquiry_cache_flush(hdev);
17601da177e4SLinus Torvalds 	hci_conn_hash_flush(hdev);
176109fd0de5SGustavo F. Padovan 	hci_dev_unlock(hdev);
17621da177e4SLinus Torvalds 
17631da177e4SLinus Torvalds 	if (hdev->flush)
17641da177e4SLinus Torvalds 		hdev->flush(hdev);
17651da177e4SLinus Torvalds 
17661da177e4SLinus Torvalds 	atomic_set(&hdev->cmd_cnt, 1);
17676ed58ec5SVille Tervo 	hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
17681da177e4SLinus Torvalds 
176901178cd4SJohan Hedberg 	ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
17701da177e4SLinus Torvalds 
17711da177e4SLinus Torvalds 	hci_req_unlock(hdev);
17721da177e4SLinus Torvalds 	return ret;
17731da177e4SLinus Torvalds }
17741da177e4SLinus Torvalds 
17755c912495SMarcel Holtmann int hci_dev_reset(__u16 dev)
17765c912495SMarcel Holtmann {
17775c912495SMarcel Holtmann 	struct hci_dev *hdev;
17785c912495SMarcel Holtmann 	int err;
17795c912495SMarcel Holtmann 
17805c912495SMarcel Holtmann 	hdev = hci_dev_get(dev);
17815c912495SMarcel Holtmann 	if (!hdev)
17825c912495SMarcel Holtmann 		return -ENODEV;
17835c912495SMarcel Holtmann 
17845c912495SMarcel Holtmann 	if (!test_bit(HCI_UP, &hdev->flags)) {
17855c912495SMarcel Holtmann 		err = -ENETDOWN;
17865c912495SMarcel Holtmann 		goto done;
17875c912495SMarcel Holtmann 	}
17885c912495SMarcel Holtmann 
17895c912495SMarcel Holtmann 	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
17905c912495SMarcel Holtmann 		err = -EBUSY;
17915c912495SMarcel Holtmann 		goto done;
17925c912495SMarcel Holtmann 	}
17935c912495SMarcel Holtmann 
17945c912495SMarcel Holtmann 	if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
17955c912495SMarcel Holtmann 		err = -EOPNOTSUPP;
17965c912495SMarcel Holtmann 		goto done;
17975c912495SMarcel Holtmann 	}
17985c912495SMarcel Holtmann 
17995c912495SMarcel Holtmann 	err = hci_dev_do_reset(hdev);
18005c912495SMarcel Holtmann 
18015c912495SMarcel Holtmann done:
18025c912495SMarcel Holtmann 	hci_dev_put(hdev);
18035c912495SMarcel Holtmann 	return err;
18045c912495SMarcel Holtmann }
18055c912495SMarcel Holtmann 
18061da177e4SLinus Torvalds int hci_dev_reset_stat(__u16 dev)
18071da177e4SLinus Torvalds {
18081da177e4SLinus Torvalds 	struct hci_dev *hdev;
18091da177e4SLinus Torvalds 	int ret = 0;
18101da177e4SLinus Torvalds 
181170f23020SAndrei Emeltchenko 	hdev = hci_dev_get(dev);
181270f23020SAndrei Emeltchenko 	if (!hdev)
18131da177e4SLinus Torvalds 		return -ENODEV;
18141da177e4SLinus Torvalds 
18150736cfa8SMarcel Holtmann 	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
18160736cfa8SMarcel Holtmann 		ret = -EBUSY;
18170736cfa8SMarcel Holtmann 		goto done;
18180736cfa8SMarcel Holtmann 	}
18190736cfa8SMarcel Holtmann 
18204a964404SMarcel Holtmann 	if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
1821fee746b0SMarcel Holtmann 		ret = -EOPNOTSUPP;
1822fee746b0SMarcel Holtmann 		goto done;
1823fee746b0SMarcel Holtmann 	}
1824fee746b0SMarcel Holtmann 
18251da177e4SLinus Torvalds 	memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
18261da177e4SLinus Torvalds 
18270736cfa8SMarcel Holtmann done:
18281da177e4SLinus Torvalds 	hci_dev_put(hdev);
18291da177e4SLinus Torvalds 	return ret;
18301da177e4SLinus Torvalds }
18311da177e4SLinus Torvalds 
1832123abc08SJohan Hedberg static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1833123abc08SJohan Hedberg {
1834bc6d2d04SJohan Hedberg 	bool conn_changed, discov_changed;
1835123abc08SJohan Hedberg 
1836123abc08SJohan Hedberg 	BT_DBG("%s scan 0x%02x", hdev->name, scan);
1837123abc08SJohan Hedberg 
1838123abc08SJohan Hedberg 	if ((scan & SCAN_PAGE))
1839123abc08SJohan Hedberg 		conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1840123abc08SJohan Hedberg 						 &hdev->dev_flags);
1841123abc08SJohan Hedberg 	else
1842123abc08SJohan Hedberg 		conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1843123abc08SJohan Hedberg 						  &hdev->dev_flags);
1844123abc08SJohan Hedberg 
1845bc6d2d04SJohan Hedberg 	if ((scan & SCAN_INQUIRY)) {
1846bc6d2d04SJohan Hedberg 		discov_changed = !test_and_set_bit(HCI_DISCOVERABLE,
1847bc6d2d04SJohan Hedberg 						   &hdev->dev_flags);
1848bc6d2d04SJohan Hedberg 	} else {
1849bc6d2d04SJohan Hedberg 		clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1850bc6d2d04SJohan Hedberg 		discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1851bc6d2d04SJohan Hedberg 						    &hdev->dev_flags);
1852bc6d2d04SJohan Hedberg 	}
1853bc6d2d04SJohan Hedberg 
1854123abc08SJohan Hedberg 	if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1855123abc08SJohan Hedberg 		return;
1856123abc08SJohan Hedberg 
1857bc6d2d04SJohan Hedberg 	if (conn_changed || discov_changed) {
1858bc6d2d04SJohan Hedberg 		/* In case this was disabled through mgmt */
1859bc6d2d04SJohan Hedberg 		set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
1860bc6d2d04SJohan Hedberg 
1861bc6d2d04SJohan Hedberg 		if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1862bc6d2d04SJohan Hedberg 			mgmt_update_adv_data(hdev);
1863bc6d2d04SJohan Hedberg 
1864123abc08SJohan Hedberg 		mgmt_new_settings(hdev);
1865123abc08SJohan Hedberg 	}
1866bc6d2d04SJohan Hedberg }
1867123abc08SJohan Hedberg 
18681da177e4SLinus Torvalds int hci_dev_cmd(unsigned int cmd, void __user *arg)
18691da177e4SLinus Torvalds {
18701da177e4SLinus Torvalds 	struct hci_dev *hdev;
18711da177e4SLinus Torvalds 	struct hci_dev_req dr;
18721da177e4SLinus Torvalds 	int err = 0;
18731da177e4SLinus Torvalds 
18741da177e4SLinus Torvalds 	if (copy_from_user(&dr, arg, sizeof(dr)))
18751da177e4SLinus Torvalds 		return -EFAULT;
18761da177e4SLinus Torvalds 
187770f23020SAndrei Emeltchenko 	hdev = hci_dev_get(dr.dev_id);
187870f23020SAndrei Emeltchenko 	if (!hdev)
18791da177e4SLinus Torvalds 		return -ENODEV;
18801da177e4SLinus Torvalds 
18810736cfa8SMarcel Holtmann 	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
18820736cfa8SMarcel Holtmann 		err = -EBUSY;
18830736cfa8SMarcel Holtmann 		goto done;
18840736cfa8SMarcel Holtmann 	}
18850736cfa8SMarcel Holtmann 
18864a964404SMarcel Holtmann 	if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
1887fee746b0SMarcel Holtmann 		err = -EOPNOTSUPP;
1888fee746b0SMarcel Holtmann 		goto done;
1889fee746b0SMarcel Holtmann 	}
1890fee746b0SMarcel Holtmann 
18915b69bef5SMarcel Holtmann 	if (hdev->dev_type != HCI_BREDR) {
18925b69bef5SMarcel Holtmann 		err = -EOPNOTSUPP;
18935b69bef5SMarcel Holtmann 		goto done;
18945b69bef5SMarcel Holtmann 	}
18955b69bef5SMarcel Holtmann 
189656f87901SJohan Hedberg 	if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
189756f87901SJohan Hedberg 		err = -EOPNOTSUPP;
189856f87901SJohan Hedberg 		goto done;
189956f87901SJohan Hedberg 	}
190056f87901SJohan Hedberg 
19011da177e4SLinus Torvalds 	switch (cmd) {
19021da177e4SLinus Torvalds 	case HCISETAUTH:
190301178cd4SJohan Hedberg 		err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
19045f246e89SAndrei Emeltchenko 				   HCI_INIT_TIMEOUT);
19051da177e4SLinus Torvalds 		break;
19061da177e4SLinus Torvalds 
19071da177e4SLinus Torvalds 	case HCISETENCRYPT:
19081da177e4SLinus Torvalds 		if (!lmp_encrypt_capable(hdev)) {
19091da177e4SLinus Torvalds 			err = -EOPNOTSUPP;
19101da177e4SLinus Torvalds 			break;
19111da177e4SLinus Torvalds 		}
19121da177e4SLinus Torvalds 
19131da177e4SLinus Torvalds 		if (!test_bit(HCI_AUTH, &hdev->flags)) {
19141da177e4SLinus Torvalds 			/* Auth must be enabled first */
191501178cd4SJohan Hedberg 			err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
19165f246e89SAndrei Emeltchenko 					   HCI_INIT_TIMEOUT);
19171da177e4SLinus Torvalds 			if (err)
19181da177e4SLinus Torvalds 				break;
19191da177e4SLinus Torvalds 		}
19201da177e4SLinus Torvalds 
192101178cd4SJohan Hedberg 		err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
19225f246e89SAndrei Emeltchenko 				   HCI_INIT_TIMEOUT);
19231da177e4SLinus Torvalds 		break;
19241da177e4SLinus Torvalds 
19251da177e4SLinus Torvalds 	case HCISETSCAN:
192601178cd4SJohan Hedberg 		err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
19275f246e89SAndrei Emeltchenko 				   HCI_INIT_TIMEOUT);
192891a668b0SJohan Hedberg 
1929bc6d2d04SJohan Hedberg 		/* Ensure that the connectable and discoverable states
1930bc6d2d04SJohan Hedberg 		 * get correctly modified as this was a non-mgmt change.
193191a668b0SJohan Hedberg 		 */
1932123abc08SJohan Hedberg 		if (!err)
1933123abc08SJohan Hedberg 			hci_update_scan_state(hdev, dr.dev_opt);
19341da177e4SLinus Torvalds 		break;
19351da177e4SLinus Torvalds 
19361da177e4SLinus Torvalds 	case HCISETLINKPOL:
193701178cd4SJohan Hedberg 		err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
19385f246e89SAndrei Emeltchenko 				   HCI_INIT_TIMEOUT);
19391da177e4SLinus Torvalds 		break;
19401da177e4SLinus Torvalds 
19411da177e4SLinus Torvalds 	case HCISETLINKMODE:
1942e4e8e37cSMarcel Holtmann 		hdev->link_mode = ((__u16) dr.dev_opt) &
1943e4e8e37cSMarcel Holtmann 					(HCI_LM_MASTER | HCI_LM_ACCEPT);
1944e4e8e37cSMarcel Holtmann 		break;
1945e4e8e37cSMarcel Holtmann 
1946e4e8e37cSMarcel Holtmann 	case HCISETPTYPE:
1947e4e8e37cSMarcel Holtmann 		hdev->pkt_type = (__u16) dr.dev_opt;
19481da177e4SLinus Torvalds 		break;
19491da177e4SLinus Torvalds 
19501da177e4SLinus Torvalds 	case HCISETACLMTU:
19511da177e4SLinus Torvalds 		hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
19521da177e4SLinus Torvalds 		hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
19531da177e4SLinus Torvalds 		break;
19541da177e4SLinus Torvalds 
19551da177e4SLinus Torvalds 	case HCISETSCOMTU:
19561da177e4SLinus Torvalds 		hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
19571da177e4SLinus Torvalds 		hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
19581da177e4SLinus Torvalds 		break;
19591da177e4SLinus Torvalds 
19601da177e4SLinus Torvalds 	default:
19611da177e4SLinus Torvalds 		err = -EINVAL;
19621da177e4SLinus Torvalds 		break;
19631da177e4SLinus Torvalds 	}
1964e4e8e37cSMarcel Holtmann 
19650736cfa8SMarcel Holtmann done:
19661da177e4SLinus Torvalds 	hci_dev_put(hdev);
19671da177e4SLinus Torvalds 	return err;
19681da177e4SLinus Torvalds }
19691da177e4SLinus Torvalds 
19701da177e4SLinus Torvalds int hci_get_dev_list(void __user *arg)
19711da177e4SLinus Torvalds {
19728035ded4SLuiz Augusto von Dentz 	struct hci_dev *hdev;
19731da177e4SLinus Torvalds 	struct hci_dev_list_req *dl;
19741da177e4SLinus Torvalds 	struct hci_dev_req *dr;
19751da177e4SLinus Torvalds 	int n = 0, size, err;
19761da177e4SLinus Torvalds 	__u16 dev_num;
19771da177e4SLinus Torvalds 
19781da177e4SLinus Torvalds 	if (get_user(dev_num, (__u16 __user *) arg))
19791da177e4SLinus Torvalds 		return -EFAULT;
19801da177e4SLinus Torvalds 
19811da177e4SLinus Torvalds 	if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
19821da177e4SLinus Torvalds 		return -EINVAL;
19831da177e4SLinus Torvalds 
19841da177e4SLinus Torvalds 	size = sizeof(*dl) + dev_num * sizeof(*dr);
19851da177e4SLinus Torvalds 
198670f23020SAndrei Emeltchenko 	dl = kzalloc(size, GFP_KERNEL);
198770f23020SAndrei Emeltchenko 	if (!dl)
19881da177e4SLinus Torvalds 		return -ENOMEM;
19891da177e4SLinus Torvalds 
19901da177e4SLinus Torvalds 	dr = dl->dev_req;
19911da177e4SLinus Torvalds 
1992f20d09d5SGustavo F. Padovan 	read_lock(&hci_dev_list_lock);
19938035ded4SLuiz Augusto von Dentz 	list_for_each_entry(hdev, &hci_dev_list, list) {
19942e84d8dbSMarcel Holtmann 		unsigned long flags = hdev->flags;
1995c542a06cSJohan Hedberg 
19962e84d8dbSMarcel Holtmann 		/* When the auto-off is configured it means the transport
19972e84d8dbSMarcel Holtmann 		 * is running, but in that case still indicate that the
19982e84d8dbSMarcel Holtmann 		 * device is actually down.
19992e84d8dbSMarcel Holtmann 		 */
20002e84d8dbSMarcel Holtmann 		if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
20012e84d8dbSMarcel Holtmann 			flags &= ~BIT(HCI_UP);
2002c542a06cSJohan Hedberg 
20031da177e4SLinus Torvalds 		(dr + n)->dev_id  = hdev->id;
20042e84d8dbSMarcel Holtmann 		(dr + n)->dev_opt = flags;
2005c542a06cSJohan Hedberg 
20061da177e4SLinus Torvalds 		if (++n >= dev_num)
20071da177e4SLinus Torvalds 			break;
20081da177e4SLinus Torvalds 	}
2009f20d09d5SGustavo F. Padovan 	read_unlock(&hci_dev_list_lock);
20101da177e4SLinus Torvalds 
20111da177e4SLinus Torvalds 	dl->dev_num = n;
20121da177e4SLinus Torvalds 	size = sizeof(*dl) + n * sizeof(*dr);
20131da177e4SLinus Torvalds 
20141da177e4SLinus Torvalds 	err = copy_to_user(arg, dl, size);
20151da177e4SLinus Torvalds 	kfree(dl);
20161da177e4SLinus Torvalds 
20171da177e4SLinus Torvalds 	return err ? -EFAULT : 0;
20181da177e4SLinus Torvalds }
20191da177e4SLinus Torvalds 
20201da177e4SLinus Torvalds int hci_get_dev_info(void __user *arg)
20211da177e4SLinus Torvalds {
20221da177e4SLinus Torvalds 	struct hci_dev *hdev;
20231da177e4SLinus Torvalds 	struct hci_dev_info di;
20242e84d8dbSMarcel Holtmann 	unsigned long flags;
20251da177e4SLinus Torvalds 	int err = 0;
20261da177e4SLinus Torvalds 
20271da177e4SLinus Torvalds 	if (copy_from_user(&di, arg, sizeof(di)))
20281da177e4SLinus Torvalds 		return -EFAULT;
20291da177e4SLinus Torvalds 
203070f23020SAndrei Emeltchenko 	hdev = hci_dev_get(di.dev_id);
203170f23020SAndrei Emeltchenko 	if (!hdev)
20321da177e4SLinus Torvalds 		return -ENODEV;
20331da177e4SLinus Torvalds 
20342e84d8dbSMarcel Holtmann 	/* When the auto-off is configured it means the transport
20352e84d8dbSMarcel Holtmann 	 * is running, but in that case still indicate that the
20362e84d8dbSMarcel Holtmann 	 * device is actually down.
20372e84d8dbSMarcel Holtmann 	 */
20382e84d8dbSMarcel Holtmann 	if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
20392e84d8dbSMarcel Holtmann 		flags = hdev->flags & ~BIT(HCI_UP);
20402e84d8dbSMarcel Holtmann 	else
20412e84d8dbSMarcel Holtmann 		flags = hdev->flags;
2042c542a06cSJohan Hedberg 
20431da177e4SLinus Torvalds 	strcpy(di.name, hdev->name);
20441da177e4SLinus Torvalds 	di.bdaddr   = hdev->bdaddr;
204560f2a3edSMarcel Holtmann 	di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
20462e84d8dbSMarcel Holtmann 	di.flags    = flags;
20471da177e4SLinus Torvalds 	di.pkt_type = hdev->pkt_type;
2048572c7f84SJohan Hedberg 	if (lmp_bredr_capable(hdev)) {
20491da177e4SLinus Torvalds 		di.acl_mtu  = hdev->acl_mtu;
20501da177e4SLinus Torvalds 		di.acl_pkts = hdev->acl_pkts;
20511da177e4SLinus Torvalds 		di.sco_mtu  = hdev->sco_mtu;
20521da177e4SLinus Torvalds 		di.sco_pkts = hdev->sco_pkts;
2053572c7f84SJohan Hedberg 	} else {
2054572c7f84SJohan Hedberg 		di.acl_mtu  = hdev->le_mtu;
2055572c7f84SJohan Hedberg 		di.acl_pkts = hdev->le_pkts;
2056572c7f84SJohan Hedberg 		di.sco_mtu  = 0;
2057572c7f84SJohan Hedberg 		di.sco_pkts = 0;
2058572c7f84SJohan Hedberg 	}
20591da177e4SLinus Torvalds 	di.link_policy = hdev->link_policy;
20601da177e4SLinus Torvalds 	di.link_mode   = hdev->link_mode;
20611da177e4SLinus Torvalds 
20621da177e4SLinus Torvalds 	memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
20631da177e4SLinus Torvalds 	memcpy(&di.features, &hdev->features, sizeof(di.features));
20641da177e4SLinus Torvalds 
20651da177e4SLinus Torvalds 	if (copy_to_user(arg, &di, sizeof(di)))
20661da177e4SLinus Torvalds 		err = -EFAULT;
20671da177e4SLinus Torvalds 
20681da177e4SLinus Torvalds 	hci_dev_put(hdev);
20691da177e4SLinus Torvalds 
20701da177e4SLinus Torvalds 	return err;
20711da177e4SLinus Torvalds }
20721da177e4SLinus Torvalds 
20731da177e4SLinus Torvalds /* ---- Interface to HCI drivers ---- */
20741da177e4SLinus Torvalds 
2075611b30f7SMarcel Holtmann static int hci_rfkill_set_block(void *data, bool blocked)
2076611b30f7SMarcel Holtmann {
2077611b30f7SMarcel Holtmann 	struct hci_dev *hdev = data;
2078611b30f7SMarcel Holtmann 
2079611b30f7SMarcel Holtmann 	BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2080611b30f7SMarcel Holtmann 
20810736cfa8SMarcel Holtmann 	if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
20820736cfa8SMarcel Holtmann 		return -EBUSY;
20830736cfa8SMarcel Holtmann 
20845e130367SJohan Hedberg 	if (blocked) {
20855e130367SJohan Hedberg 		set_bit(HCI_RFKILLED, &hdev->dev_flags);
2086d603b76bSMarcel Holtmann 		if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
2087d603b76bSMarcel Holtmann 		    !test_bit(HCI_CONFIG, &hdev->dev_flags))
2088611b30f7SMarcel Holtmann 			hci_dev_do_close(hdev);
20895e130367SJohan Hedberg 	} else {
20905e130367SJohan Hedberg 		clear_bit(HCI_RFKILLED, &hdev->dev_flags);
20915e130367SJohan Hedberg 	}
2092611b30f7SMarcel Holtmann 
2093611b30f7SMarcel Holtmann 	return 0;
2094611b30f7SMarcel Holtmann }
2095611b30f7SMarcel Holtmann 
2096611b30f7SMarcel Holtmann static const struct rfkill_ops hci_rfkill_ops = {
2097611b30f7SMarcel Holtmann 	.set_block = hci_rfkill_set_block,
2098611b30f7SMarcel Holtmann };
2099611b30f7SMarcel Holtmann 
2100ab81cbf9SJohan Hedberg static void hci_power_on(struct work_struct *work)
2101ab81cbf9SJohan Hedberg {
2102ab81cbf9SJohan Hedberg 	struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
210396570ffcSJohan Hedberg 	int err;
2104ab81cbf9SJohan Hedberg 
2105ab81cbf9SJohan Hedberg 	BT_DBG("%s", hdev->name);
2106ab81cbf9SJohan Hedberg 
2107cbed0ca1SJohan Hedberg 	err = hci_dev_do_open(hdev);
210896570ffcSJohan Hedberg 	if (err < 0) {
21093ad67582SJaganath Kanakkassery 		hci_dev_lock(hdev);
211096570ffcSJohan Hedberg 		mgmt_set_powered_failed(hdev, err);
21113ad67582SJaganath Kanakkassery 		hci_dev_unlock(hdev);
2112ab81cbf9SJohan Hedberg 		return;
211396570ffcSJohan Hedberg 	}
2114ab81cbf9SJohan Hedberg 
2115a5c8f270SMarcel Holtmann 	/* During the HCI setup phase, a few error conditions are
2116a5c8f270SMarcel Holtmann 	 * ignored and they need to be checked now. If they are still
2117a5c8f270SMarcel Holtmann 	 * valid, it is important to turn the device back off.
2118a5c8f270SMarcel Holtmann 	 */
2119a5c8f270SMarcel Holtmann 	if (test_bit(HCI_RFKILLED, &hdev->dev_flags) ||
21204a964404SMarcel Holtmann 	    test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
2121a5c8f270SMarcel Holtmann 	    (hdev->dev_type == HCI_BREDR &&
2122a5c8f270SMarcel Holtmann 	     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2123a5c8f270SMarcel Holtmann 	     !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2124bf543036SJohan Hedberg 		clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
2125bf543036SJohan Hedberg 		hci_dev_do_close(hdev);
2126bf543036SJohan Hedberg 	} else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
212719202573SJohan Hedberg 		queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
212819202573SJohan Hedberg 				   HCI_AUTO_OFF_TIMEOUT);
2129bf543036SJohan Hedberg 	}
2130ab81cbf9SJohan Hedberg 
2131fee746b0SMarcel Holtmann 	if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags)) {
21324a964404SMarcel Holtmann 		/* For unconfigured devices, set the HCI_RAW flag
21334a964404SMarcel Holtmann 		 * so that userspace can easily identify them.
21344a964404SMarcel Holtmann 		 */
21354a964404SMarcel Holtmann 		if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
21364a964404SMarcel Holtmann 			set_bit(HCI_RAW, &hdev->flags);
21370602a8adSMarcel Holtmann 
21380602a8adSMarcel Holtmann 		/* For fully configured devices, this will send
21390602a8adSMarcel Holtmann 		 * the Index Added event. For unconfigured devices,
21400602a8adSMarcel Holtmann 		 * it will send Unconfigued Index Added event.
21410602a8adSMarcel Holtmann 		 *
21420602a8adSMarcel Holtmann 		 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
21430602a8adSMarcel Holtmann 		 * and no event will be send.
21440602a8adSMarcel Holtmann 		 */
2145744cf19eSJohan Hedberg 		mgmt_index_added(hdev);
2146d603b76bSMarcel Holtmann 	} else if (test_and_clear_bit(HCI_CONFIG, &hdev->dev_flags)) {
21475ea234d3SMarcel Holtmann 		/* When the controller is now configured, then it
21485ea234d3SMarcel Holtmann 		 * is important to clear the HCI_RAW flag.
21495ea234d3SMarcel Holtmann 		 */
21505ea234d3SMarcel Holtmann 		if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
21515ea234d3SMarcel Holtmann 			clear_bit(HCI_RAW, &hdev->flags);
21525ea234d3SMarcel Holtmann 
2153d603b76bSMarcel Holtmann 		/* Powering on the controller with HCI_CONFIG set only
2154d603b76bSMarcel Holtmann 		 * happens with the transition from unconfigured to
2155d603b76bSMarcel Holtmann 		 * configured. This will send the Index Added event.
2156d603b76bSMarcel Holtmann 		 */
2157d603b76bSMarcel Holtmann 		mgmt_index_added(hdev);
2158ab81cbf9SJohan Hedberg 	}
2159ab81cbf9SJohan Hedberg }
2160ab81cbf9SJohan Hedberg 
2161ab81cbf9SJohan Hedberg static void hci_power_off(struct work_struct *work)
2162ab81cbf9SJohan Hedberg {
21633243553fSJohan Hedberg 	struct hci_dev *hdev = container_of(work, struct hci_dev,
21643243553fSJohan Hedberg 					    power_off.work);
2165ab81cbf9SJohan Hedberg 
2166ab81cbf9SJohan Hedberg 	BT_DBG("%s", hdev->name);
2167ab81cbf9SJohan Hedberg 
21688ee56540SMarcel Holtmann 	hci_dev_do_close(hdev);
2169ab81cbf9SJohan Hedberg }
2170ab81cbf9SJohan Hedberg 
2171c7741d16SMarcel Holtmann static void hci_error_reset(struct work_struct *work)
2172c7741d16SMarcel Holtmann {
2173c7741d16SMarcel Holtmann 	struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2174c7741d16SMarcel Holtmann 
2175c7741d16SMarcel Holtmann 	BT_DBG("%s", hdev->name);
2176c7741d16SMarcel Holtmann 
2177c7741d16SMarcel Holtmann 	if (hdev->hw_error)
2178c7741d16SMarcel Holtmann 		hdev->hw_error(hdev, hdev->hw_error_code);
2179c7741d16SMarcel Holtmann 	else
2180c7741d16SMarcel Holtmann 		BT_ERR("%s hardware error 0x%2.2x", hdev->name,
2181c7741d16SMarcel Holtmann 		       hdev->hw_error_code);
2182c7741d16SMarcel Holtmann 
2183c7741d16SMarcel Holtmann 	if (hci_dev_do_close(hdev))
2184c7741d16SMarcel Holtmann 		return;
2185c7741d16SMarcel Holtmann 
2186c7741d16SMarcel Holtmann 	hci_dev_do_open(hdev);
2187c7741d16SMarcel Holtmann }
2188c7741d16SMarcel Holtmann 
218916ab91abSJohan Hedberg static void hci_discov_off(struct work_struct *work)
219016ab91abSJohan Hedberg {
219116ab91abSJohan Hedberg 	struct hci_dev *hdev;
219216ab91abSJohan Hedberg 
219316ab91abSJohan Hedberg 	hdev = container_of(work, struct hci_dev, discov_off.work);
219416ab91abSJohan Hedberg 
219516ab91abSJohan Hedberg 	BT_DBG("%s", hdev->name);
219616ab91abSJohan Hedberg 
2197d1967ff8SMarcel Holtmann 	mgmt_discoverable_timeout(hdev);
219816ab91abSJohan Hedberg }
219916ab91abSJohan Hedberg 
220035f7498aSJohan Hedberg void hci_uuids_clear(struct hci_dev *hdev)
22012aeb9a1aSJohan Hedberg {
22024821002cSJohan Hedberg 	struct bt_uuid *uuid, *tmp;
22032aeb9a1aSJohan Hedberg 
22044821002cSJohan Hedberg 	list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
22054821002cSJohan Hedberg 		list_del(&uuid->list);
22062aeb9a1aSJohan Hedberg 		kfree(uuid);
22072aeb9a1aSJohan Hedberg 	}
22082aeb9a1aSJohan Hedberg }
22092aeb9a1aSJohan Hedberg 
221035f7498aSJohan Hedberg void hci_link_keys_clear(struct hci_dev *hdev)
221155ed8ca1SJohan Hedberg {
221255ed8ca1SJohan Hedberg 	struct link_key *key;
221355ed8ca1SJohan Hedberg 
22140378b597SJohan Hedberg 	list_for_each_entry_rcu(key, &hdev->link_keys, list) {
22150378b597SJohan Hedberg 		list_del_rcu(&key->list);
22160378b597SJohan Hedberg 		kfree_rcu(key, rcu);
221755ed8ca1SJohan Hedberg 	}
221855ed8ca1SJohan Hedberg }
221955ed8ca1SJohan Hedberg 
222035f7498aSJohan Hedberg void hci_smp_ltks_clear(struct hci_dev *hdev)
2221b899efafSVinicius Costa Gomes {
2222970d0f1bSJohan Hedberg 	struct smp_ltk *k;
2223b899efafSVinicius Costa Gomes 
2224970d0f1bSJohan Hedberg 	list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2225970d0f1bSJohan Hedberg 		list_del_rcu(&k->list);
2226970d0f1bSJohan Hedberg 		kfree_rcu(k, rcu);
2227b899efafSVinicius Costa Gomes 	}
2228b899efafSVinicius Costa Gomes }
2229b899efafSVinicius Costa Gomes 
2230970c4e46SJohan Hedberg void hci_smp_irks_clear(struct hci_dev *hdev)
2231970c4e46SJohan Hedberg {
2232adae20cbSJohan Hedberg 	struct smp_irk *k;
2233970c4e46SJohan Hedberg 
2234adae20cbSJohan Hedberg 	list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2235adae20cbSJohan Hedberg 		list_del_rcu(&k->list);
2236adae20cbSJohan Hedberg 		kfree_rcu(k, rcu);
2237970c4e46SJohan Hedberg 	}
2238970c4e46SJohan Hedberg }
2239970c4e46SJohan Hedberg 
224055ed8ca1SJohan Hedberg struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
224155ed8ca1SJohan Hedberg {
224255ed8ca1SJohan Hedberg 	struct link_key *k;
224355ed8ca1SJohan Hedberg 
22440378b597SJohan Hedberg 	rcu_read_lock();
22450378b597SJohan Hedberg 	list_for_each_entry_rcu(k, &hdev->link_keys, list) {
22460378b597SJohan Hedberg 		if (bacmp(bdaddr, &k->bdaddr) == 0) {
22470378b597SJohan Hedberg 			rcu_read_unlock();
224855ed8ca1SJohan Hedberg 			return k;
22490378b597SJohan Hedberg 		}
22500378b597SJohan Hedberg 	}
22510378b597SJohan Hedberg 	rcu_read_unlock();
225255ed8ca1SJohan Hedberg 
225355ed8ca1SJohan Hedberg 	return NULL;
225455ed8ca1SJohan Hedberg }
225555ed8ca1SJohan Hedberg 
2256745c0ce3SVishal Agarwal static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2257d25e28abSJohan Hedberg 			       u8 key_type, u8 old_key_type)
2258d25e28abSJohan Hedberg {
2259d25e28abSJohan Hedberg 	/* Legacy key */
2260d25e28abSJohan Hedberg 	if (key_type < 0x03)
2261745c0ce3SVishal Agarwal 		return true;
2262d25e28abSJohan Hedberg 
2263d25e28abSJohan Hedberg 	/* Debug keys are insecure so don't store them persistently */
2264d25e28abSJohan Hedberg 	if (key_type == HCI_LK_DEBUG_COMBINATION)
2265745c0ce3SVishal Agarwal 		return false;
2266d25e28abSJohan Hedberg 
2267d25e28abSJohan Hedberg 	/* Changed combination key and there's no previous one */
2268d25e28abSJohan Hedberg 	if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2269745c0ce3SVishal Agarwal 		return false;
2270d25e28abSJohan Hedberg 
2271d25e28abSJohan Hedberg 	/* Security mode 3 case */
2272d25e28abSJohan Hedberg 	if (!conn)
2273745c0ce3SVishal Agarwal 		return true;
2274d25e28abSJohan Hedberg 
2275e3befab9SJohan Hedberg 	/* BR/EDR key derived using SC from an LE link */
2276e3befab9SJohan Hedberg 	if (conn->type == LE_LINK)
2277e3befab9SJohan Hedberg 		return true;
2278e3befab9SJohan Hedberg 
2279d25e28abSJohan Hedberg 	/* Neither local nor remote side had no-bonding as requirement */
2280d25e28abSJohan Hedberg 	if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2281745c0ce3SVishal Agarwal 		return true;
2282d25e28abSJohan Hedberg 
2283d25e28abSJohan Hedberg 	/* Local side had dedicated bonding as requirement */
2284d25e28abSJohan Hedberg 	if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2285745c0ce3SVishal Agarwal 		return true;
2286d25e28abSJohan Hedberg 
2287d25e28abSJohan Hedberg 	/* Remote side had dedicated bonding as requirement */
2288d25e28abSJohan Hedberg 	if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2289745c0ce3SVishal Agarwal 		return true;
2290d25e28abSJohan Hedberg 
2291d25e28abSJohan Hedberg 	/* If none of the above criteria match, then don't store the key
2292d25e28abSJohan Hedberg 	 * persistently */
2293745c0ce3SVishal Agarwal 	return false;
2294d25e28abSJohan Hedberg }
2295d25e28abSJohan Hedberg 
2296e804d25dSJohan Hedberg static u8 ltk_role(u8 type)
229798a0b845SJohan Hedberg {
2298e804d25dSJohan Hedberg 	if (type == SMP_LTK)
2299e804d25dSJohan Hedberg 		return HCI_ROLE_MASTER;
230098a0b845SJohan Hedberg 
2301e804d25dSJohan Hedberg 	return HCI_ROLE_SLAVE;
230298a0b845SJohan Hedberg }
230398a0b845SJohan Hedberg 
2304f3a73d97SJohan Hedberg struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2305e804d25dSJohan Hedberg 			     u8 addr_type, u8 role)
230675d262c2SVinicius Costa Gomes {
2307c9839a11SVinicius Costa Gomes 	struct smp_ltk *k;
230875d262c2SVinicius Costa Gomes 
2309970d0f1bSJohan Hedberg 	rcu_read_lock();
2310970d0f1bSJohan Hedberg 	list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
23115378bc56SJohan Hedberg 		if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
23125378bc56SJohan Hedberg 			continue;
23135378bc56SJohan Hedberg 
2314923e2414SJohan Hedberg 		if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2315970d0f1bSJohan Hedberg 			rcu_read_unlock();
231675d262c2SVinicius Costa Gomes 			return k;
2317970d0f1bSJohan Hedberg 		}
2318970d0f1bSJohan Hedberg 	}
2319970d0f1bSJohan Hedberg 	rcu_read_unlock();
232075d262c2SVinicius Costa Gomes 
232175d262c2SVinicius Costa Gomes 	return NULL;
232275d262c2SVinicius Costa Gomes }
232375d262c2SVinicius Costa Gomes 
2324970c4e46SJohan Hedberg struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2325970c4e46SJohan Hedberg {
2326970c4e46SJohan Hedberg 	struct smp_irk *irk;
2327970c4e46SJohan Hedberg 
2328adae20cbSJohan Hedberg 	rcu_read_lock();
2329adae20cbSJohan Hedberg 	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2330adae20cbSJohan Hedberg 		if (!bacmp(&irk->rpa, rpa)) {
2331adae20cbSJohan Hedberg 			rcu_read_unlock();
2332970c4e46SJohan Hedberg 			return irk;
2333970c4e46SJohan Hedberg 		}
2334adae20cbSJohan Hedberg 	}
2335970c4e46SJohan Hedberg 
2336adae20cbSJohan Hedberg 	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2337defce9e8SJohan Hedberg 		if (smp_irk_matches(hdev, irk->val, rpa)) {
2338970c4e46SJohan Hedberg 			bacpy(&irk->rpa, rpa);
2339adae20cbSJohan Hedberg 			rcu_read_unlock();
2340970c4e46SJohan Hedberg 			return irk;
2341970c4e46SJohan Hedberg 		}
2342970c4e46SJohan Hedberg 	}
2343adae20cbSJohan Hedberg 	rcu_read_unlock();
2344970c4e46SJohan Hedberg 
2345970c4e46SJohan Hedberg 	return NULL;
2346970c4e46SJohan Hedberg }
2347970c4e46SJohan Hedberg 
2348970c4e46SJohan Hedberg struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2349970c4e46SJohan Hedberg 				     u8 addr_type)
2350970c4e46SJohan Hedberg {
2351970c4e46SJohan Hedberg 	struct smp_irk *irk;
2352970c4e46SJohan Hedberg 
23536cfc9988SJohan Hedberg 	/* Identity Address must be public or static random */
23546cfc9988SJohan Hedberg 	if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
23556cfc9988SJohan Hedberg 		return NULL;
23566cfc9988SJohan Hedberg 
2357adae20cbSJohan Hedberg 	rcu_read_lock();
2358adae20cbSJohan Hedberg 	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2359970c4e46SJohan Hedberg 		if (addr_type == irk->addr_type &&
2360adae20cbSJohan Hedberg 		    bacmp(bdaddr, &irk->bdaddr) == 0) {
2361adae20cbSJohan Hedberg 			rcu_read_unlock();
2362970c4e46SJohan Hedberg 			return irk;
2363970c4e46SJohan Hedberg 		}
2364adae20cbSJohan Hedberg 	}
2365adae20cbSJohan Hedberg 	rcu_read_unlock();
2366970c4e46SJohan Hedberg 
2367970c4e46SJohan Hedberg 	return NULL;
2368970c4e46SJohan Hedberg }
2369970c4e46SJohan Hedberg 
2370567fa2aaSJohan Hedberg struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
23717652ff6aSJohan Hedberg 				  bdaddr_t *bdaddr, u8 *val, u8 type,
23727652ff6aSJohan Hedberg 				  u8 pin_len, bool *persistent)
237355ed8ca1SJohan Hedberg {
237455ed8ca1SJohan Hedberg 	struct link_key *key, *old_key;
2375745c0ce3SVishal Agarwal 	u8 old_key_type;
237655ed8ca1SJohan Hedberg 
237755ed8ca1SJohan Hedberg 	old_key = hci_find_link_key(hdev, bdaddr);
237855ed8ca1SJohan Hedberg 	if (old_key) {
237955ed8ca1SJohan Hedberg 		old_key_type = old_key->type;
238055ed8ca1SJohan Hedberg 		key = old_key;
238155ed8ca1SJohan Hedberg 	} else {
238212adcf3aSJohan Hedberg 		old_key_type = conn ? conn->key_type : 0xff;
23830a14ab41SJohan Hedberg 		key = kzalloc(sizeof(*key), GFP_KERNEL);
238455ed8ca1SJohan Hedberg 		if (!key)
2385567fa2aaSJohan Hedberg 			return NULL;
23860378b597SJohan Hedberg 		list_add_rcu(&key->list, &hdev->link_keys);
238755ed8ca1SJohan Hedberg 	}
238855ed8ca1SJohan Hedberg 
23896ed93dc6SAndrei Emeltchenko 	BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
239055ed8ca1SJohan Hedberg 
2391d25e28abSJohan Hedberg 	/* Some buggy controller combinations generate a changed
2392d25e28abSJohan Hedberg 	 * combination key for legacy pairing even when there's no
2393d25e28abSJohan Hedberg 	 * previous key */
2394d25e28abSJohan Hedberg 	if (type == HCI_LK_CHANGED_COMBINATION &&
2395a8c5fb1aSGustavo Padovan 	    (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2396d25e28abSJohan Hedberg 		type = HCI_LK_COMBINATION;
2397655fe6ecSJohan Hedberg 		if (conn)
2398655fe6ecSJohan Hedberg 			conn->key_type = type;
2399655fe6ecSJohan Hedberg 	}
2400d25e28abSJohan Hedberg 
240155ed8ca1SJohan Hedberg 	bacpy(&key->bdaddr, bdaddr);
24029b3b4460SAndrei Emeltchenko 	memcpy(key->val, val, HCI_LINK_KEY_SIZE);
240355ed8ca1SJohan Hedberg 	key->pin_len = pin_len;
240455ed8ca1SJohan Hedberg 
2405b6020ba0SWaldemar Rymarkiewicz 	if (type == HCI_LK_CHANGED_COMBINATION)
240655ed8ca1SJohan Hedberg 		key->type = old_key_type;
24074748fed2SJohan Hedberg 	else
24084748fed2SJohan Hedberg 		key->type = type;
24094748fed2SJohan Hedberg 
24107652ff6aSJohan Hedberg 	if (persistent)
24117652ff6aSJohan Hedberg 		*persistent = hci_persistent_key(hdev, conn, type,
24127652ff6aSJohan Hedberg 						 old_key_type);
24134df378a1SJohan Hedberg 
2414567fa2aaSJohan Hedberg 	return key;
241555ed8ca1SJohan Hedberg }
241655ed8ca1SJohan Hedberg 
2417ca9142b8SJohan Hedberg struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
241835d70271SJohan Hedberg 			    u8 addr_type, u8 type, u8 authenticated,
2419fe39c7b2SMarcel Holtmann 			    u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
242075d262c2SVinicius Costa Gomes {
2421c9839a11SVinicius Costa Gomes 	struct smp_ltk *key, *old_key;
2422e804d25dSJohan Hedberg 	u8 role = ltk_role(type);
242375d262c2SVinicius Costa Gomes 
2424f3a73d97SJohan Hedberg 	old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2425c9839a11SVinicius Costa Gomes 	if (old_key)
242675d262c2SVinicius Costa Gomes 		key = old_key;
2427c9839a11SVinicius Costa Gomes 	else {
24280a14ab41SJohan Hedberg 		key = kzalloc(sizeof(*key), GFP_KERNEL);
242975d262c2SVinicius Costa Gomes 		if (!key)
2430ca9142b8SJohan Hedberg 			return NULL;
2431970d0f1bSJohan Hedberg 		list_add_rcu(&key->list, &hdev->long_term_keys);
243275d262c2SVinicius Costa Gomes 	}
243375d262c2SVinicius Costa Gomes 
243475d262c2SVinicius Costa Gomes 	bacpy(&key->bdaddr, bdaddr);
2435c9839a11SVinicius Costa Gomes 	key->bdaddr_type = addr_type;
2436c9839a11SVinicius Costa Gomes 	memcpy(key->val, tk, sizeof(key->val));
2437c9839a11SVinicius Costa Gomes 	key->authenticated = authenticated;
2438c9839a11SVinicius Costa Gomes 	key->ediv = ediv;
2439fe39c7b2SMarcel Holtmann 	key->rand = rand;
2440c9839a11SVinicius Costa Gomes 	key->enc_size = enc_size;
2441c9839a11SVinicius Costa Gomes 	key->type = type;
244275d262c2SVinicius Costa Gomes 
2443ca9142b8SJohan Hedberg 	return key;
244475d262c2SVinicius Costa Gomes }
244575d262c2SVinicius Costa Gomes 
2446ca9142b8SJohan Hedberg struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2447ca9142b8SJohan Hedberg 			    u8 addr_type, u8 val[16], bdaddr_t *rpa)
2448970c4e46SJohan Hedberg {
2449970c4e46SJohan Hedberg 	struct smp_irk *irk;
2450970c4e46SJohan Hedberg 
2451970c4e46SJohan Hedberg 	irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2452970c4e46SJohan Hedberg 	if (!irk) {
2453970c4e46SJohan Hedberg 		irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2454970c4e46SJohan Hedberg 		if (!irk)
2455ca9142b8SJohan Hedberg 			return NULL;
2456970c4e46SJohan Hedberg 
2457970c4e46SJohan Hedberg 		bacpy(&irk->bdaddr, bdaddr);
2458970c4e46SJohan Hedberg 		irk->addr_type = addr_type;
2459970c4e46SJohan Hedberg 
2460adae20cbSJohan Hedberg 		list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2461970c4e46SJohan Hedberg 	}
2462970c4e46SJohan Hedberg 
2463970c4e46SJohan Hedberg 	memcpy(irk->val, val, 16);
2464970c4e46SJohan Hedberg 	bacpy(&irk->rpa, rpa);
2465970c4e46SJohan Hedberg 
2466ca9142b8SJohan Hedberg 	return irk;
2467970c4e46SJohan Hedberg }
2468970c4e46SJohan Hedberg 
246955ed8ca1SJohan Hedberg int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
247055ed8ca1SJohan Hedberg {
247155ed8ca1SJohan Hedberg 	struct link_key *key;
247255ed8ca1SJohan Hedberg 
247355ed8ca1SJohan Hedberg 	key = hci_find_link_key(hdev, bdaddr);
247455ed8ca1SJohan Hedberg 	if (!key)
247555ed8ca1SJohan Hedberg 		return -ENOENT;
247655ed8ca1SJohan Hedberg 
24776ed93dc6SAndrei Emeltchenko 	BT_DBG("%s removing %pMR", hdev->name, bdaddr);
247855ed8ca1SJohan Hedberg 
24790378b597SJohan Hedberg 	list_del_rcu(&key->list);
24800378b597SJohan Hedberg 	kfree_rcu(key, rcu);
248155ed8ca1SJohan Hedberg 
248255ed8ca1SJohan Hedberg 	return 0;
248355ed8ca1SJohan Hedberg }
248455ed8ca1SJohan Hedberg 
2485e0b2b27eSJohan Hedberg int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2486b899efafSVinicius Costa Gomes {
2487970d0f1bSJohan Hedberg 	struct smp_ltk *k;
2488c51ffa0bSJohan Hedberg 	int removed = 0;
2489b899efafSVinicius Costa Gomes 
2490970d0f1bSJohan Hedberg 	list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2491e0b2b27eSJohan Hedberg 		if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2492b899efafSVinicius Costa Gomes 			continue;
2493b899efafSVinicius Costa Gomes 
24946ed93dc6SAndrei Emeltchenko 		BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2495b899efafSVinicius Costa Gomes 
2496970d0f1bSJohan Hedberg 		list_del_rcu(&k->list);
2497970d0f1bSJohan Hedberg 		kfree_rcu(k, rcu);
2498c51ffa0bSJohan Hedberg 		removed++;
2499b899efafSVinicius Costa Gomes 	}
2500b899efafSVinicius Costa Gomes 
2501c51ffa0bSJohan Hedberg 	return removed ? 0 : -ENOENT;
2502b899efafSVinicius Costa Gomes }
2503b899efafSVinicius Costa Gomes 
2504a7ec7338SJohan Hedberg void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2505a7ec7338SJohan Hedberg {
2506adae20cbSJohan Hedberg 	struct smp_irk *k;
2507a7ec7338SJohan Hedberg 
2508adae20cbSJohan Hedberg 	list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2509a7ec7338SJohan Hedberg 		if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2510a7ec7338SJohan Hedberg 			continue;
2511a7ec7338SJohan Hedberg 
2512a7ec7338SJohan Hedberg 		BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2513a7ec7338SJohan Hedberg 
2514adae20cbSJohan Hedberg 		list_del_rcu(&k->list);
2515adae20cbSJohan Hedberg 		kfree_rcu(k, rcu);
2516a7ec7338SJohan Hedberg 	}
2517a7ec7338SJohan Hedberg }
2518a7ec7338SJohan Hedberg 
25196bd32326SVille Tervo /* HCI command timer function */
252065cc2b49SMarcel Holtmann static void hci_cmd_timeout(struct work_struct *work)
25216bd32326SVille Tervo {
252265cc2b49SMarcel Holtmann 	struct hci_dev *hdev = container_of(work, struct hci_dev,
252365cc2b49SMarcel Holtmann 					    cmd_timer.work);
25246bd32326SVille Tervo 
2525bda4f23aSAndrei Emeltchenko 	if (hdev->sent_cmd) {
2526bda4f23aSAndrei Emeltchenko 		struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2527bda4f23aSAndrei Emeltchenko 		u16 opcode = __le16_to_cpu(sent->opcode);
2528bda4f23aSAndrei Emeltchenko 
2529bda4f23aSAndrei Emeltchenko 		BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
2530bda4f23aSAndrei Emeltchenko 	} else {
25316bd32326SVille Tervo 		BT_ERR("%s command tx timeout", hdev->name);
2532bda4f23aSAndrei Emeltchenko 	}
2533bda4f23aSAndrei Emeltchenko 
25346bd32326SVille Tervo 	atomic_set(&hdev->cmd_cnt, 1);
2535c347b765SGustavo F. Padovan 	queue_work(hdev->workqueue, &hdev->cmd_work);
25366bd32326SVille Tervo }
25376bd32326SVille Tervo 
25382763eda6SSzymon Janc struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
25396928a924SJohan Hedberg 					  bdaddr_t *bdaddr, u8 bdaddr_type)
25402763eda6SSzymon Janc {
25412763eda6SSzymon Janc 	struct oob_data *data;
25422763eda6SSzymon Janc 
25436928a924SJohan Hedberg 	list_for_each_entry(data, &hdev->remote_oob_data, list) {
25446928a924SJohan Hedberg 		if (bacmp(bdaddr, &data->bdaddr) != 0)
25456928a924SJohan Hedberg 			continue;
25466928a924SJohan Hedberg 		if (data->bdaddr_type != bdaddr_type)
25476928a924SJohan Hedberg 			continue;
25482763eda6SSzymon Janc 		return data;
25496928a924SJohan Hedberg 	}
25502763eda6SSzymon Janc 
25512763eda6SSzymon Janc 	return NULL;
25522763eda6SSzymon Janc }
25532763eda6SSzymon Janc 
25546928a924SJohan Hedberg int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
25556928a924SJohan Hedberg 			       u8 bdaddr_type)
25562763eda6SSzymon Janc {
25572763eda6SSzymon Janc 	struct oob_data *data;
25582763eda6SSzymon Janc 
25596928a924SJohan Hedberg 	data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
25602763eda6SSzymon Janc 	if (!data)
25612763eda6SSzymon Janc 		return -ENOENT;
25622763eda6SSzymon Janc 
25636928a924SJohan Hedberg 	BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
25642763eda6SSzymon Janc 
25652763eda6SSzymon Janc 	list_del(&data->list);
25662763eda6SSzymon Janc 	kfree(data);
25672763eda6SSzymon Janc 
25682763eda6SSzymon Janc 	return 0;
25692763eda6SSzymon Janc }
25702763eda6SSzymon Janc 
257135f7498aSJohan Hedberg void hci_remote_oob_data_clear(struct hci_dev *hdev)
25722763eda6SSzymon Janc {
25732763eda6SSzymon Janc 	struct oob_data *data, *n;
25742763eda6SSzymon Janc 
25752763eda6SSzymon Janc 	list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
25762763eda6SSzymon Janc 		list_del(&data->list);
25772763eda6SSzymon Janc 		kfree(data);
25782763eda6SSzymon Janc 	}
25792763eda6SSzymon Janc }
25802763eda6SSzymon Janc 
25810798872eSMarcel Holtmann int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
25826928a924SJohan Hedberg 			    u8 bdaddr_type, u8 *hash192, u8 *rand192,
258338da1703SJohan Hedberg 			    u8 *hash256, u8 *rand256)
25840798872eSMarcel Holtmann {
25850798872eSMarcel Holtmann 	struct oob_data *data;
25860798872eSMarcel Holtmann 
25876928a924SJohan Hedberg 	data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
25880798872eSMarcel Holtmann 	if (!data) {
25890a14ab41SJohan Hedberg 		data = kmalloc(sizeof(*data), GFP_KERNEL);
25900798872eSMarcel Holtmann 		if (!data)
25910798872eSMarcel Holtmann 			return -ENOMEM;
25920798872eSMarcel Holtmann 
25930798872eSMarcel Holtmann 		bacpy(&data->bdaddr, bdaddr);
25946928a924SJohan Hedberg 		data->bdaddr_type = bdaddr_type;
25950798872eSMarcel Holtmann 		list_add(&data->list, &hdev->remote_oob_data);
25960798872eSMarcel Holtmann 	}
25970798872eSMarcel Holtmann 
259881328d5cSJohan Hedberg 	if (hash192 && rand192) {
25990798872eSMarcel Holtmann 		memcpy(data->hash192, hash192, sizeof(data->hash192));
260038da1703SJohan Hedberg 		memcpy(data->rand192, rand192, sizeof(data->rand192));
2601f7697b16SMarcel Holtmann 		if (hash256 && rand256)
2602f7697b16SMarcel Holtmann 			data->present = 0x03;
260381328d5cSJohan Hedberg 	} else {
260481328d5cSJohan Hedberg 		memset(data->hash192, 0, sizeof(data->hash192));
260581328d5cSJohan Hedberg 		memset(data->rand192, 0, sizeof(data->rand192));
2606f7697b16SMarcel Holtmann 		if (hash256 && rand256)
2607f7697b16SMarcel Holtmann 			data->present = 0x02;
2608f7697b16SMarcel Holtmann 		else
2609f7697b16SMarcel Holtmann 			data->present = 0x00;
261081328d5cSJohan Hedberg 	}
26110798872eSMarcel Holtmann 
261281328d5cSJohan Hedberg 	if (hash256 && rand256) {
26130798872eSMarcel Holtmann 		memcpy(data->hash256, hash256, sizeof(data->hash256));
261438da1703SJohan Hedberg 		memcpy(data->rand256, rand256, sizeof(data->rand256));
261581328d5cSJohan Hedberg 	} else {
261681328d5cSJohan Hedberg 		memset(data->hash256, 0, sizeof(data->hash256));
261781328d5cSJohan Hedberg 		memset(data->rand256, 0, sizeof(data->rand256));
2618f7697b16SMarcel Holtmann 		if (hash192 && rand192)
2619f7697b16SMarcel Holtmann 			data->present = 0x01;
262081328d5cSJohan Hedberg 	}
26210798872eSMarcel Holtmann 
26226ed93dc6SAndrei Emeltchenko 	BT_DBG("%s for %pMR", hdev->name, bdaddr);
26232763eda6SSzymon Janc 
26242763eda6SSzymon Janc 	return 0;
26252763eda6SSzymon Janc }
26262763eda6SSzymon Janc 
2627dcc36c16SJohan Hedberg struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2628b9ee0a78SMarcel Holtmann 					 bdaddr_t *bdaddr, u8 type)
2629b2a66aadSAntti Julku {
2630b2a66aadSAntti Julku 	struct bdaddr_list *b;
2631b2a66aadSAntti Julku 
2632dcc36c16SJohan Hedberg 	list_for_each_entry(b, bdaddr_list, list) {
2633b9ee0a78SMarcel Holtmann 		if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2634b2a66aadSAntti Julku 			return b;
2635b9ee0a78SMarcel Holtmann 	}
2636b2a66aadSAntti Julku 
2637b2a66aadSAntti Julku 	return NULL;
2638b2a66aadSAntti Julku }
2639b2a66aadSAntti Julku 
2640dcc36c16SJohan Hedberg void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2641b2a66aadSAntti Julku {
2642b2a66aadSAntti Julku 	struct list_head *p, *n;
2643b2a66aadSAntti Julku 
2644dcc36c16SJohan Hedberg 	list_for_each_safe(p, n, bdaddr_list) {
2645b9ee0a78SMarcel Holtmann 		struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
2646b2a66aadSAntti Julku 
2647b2a66aadSAntti Julku 		list_del(p);
2648b2a66aadSAntti Julku 		kfree(b);
2649b2a66aadSAntti Julku 	}
2650b2a66aadSAntti Julku }
2651b2a66aadSAntti Julku 
2652dcc36c16SJohan Hedberg int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2653b2a66aadSAntti Julku {
2654b2a66aadSAntti Julku 	struct bdaddr_list *entry;
2655b2a66aadSAntti Julku 
2656b9ee0a78SMarcel Holtmann 	if (!bacmp(bdaddr, BDADDR_ANY))
2657b2a66aadSAntti Julku 		return -EBADF;
2658b2a66aadSAntti Julku 
2659dcc36c16SJohan Hedberg 	if (hci_bdaddr_list_lookup(list, bdaddr, type))
26605e762444SAntti Julku 		return -EEXIST;
2661b2a66aadSAntti Julku 
266227f70f3eSJohan Hedberg 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
26635e762444SAntti Julku 	if (!entry)
26645e762444SAntti Julku 		return -ENOMEM;
2665b2a66aadSAntti Julku 
2666b2a66aadSAntti Julku 	bacpy(&entry->bdaddr, bdaddr);
2667b9ee0a78SMarcel Holtmann 	entry->bdaddr_type = type;
2668b2a66aadSAntti Julku 
2669dcc36c16SJohan Hedberg 	list_add(&entry->list, list);
2670b2a66aadSAntti Julku 
26712a8357f2SJohan Hedberg 	return 0;
2672b2a66aadSAntti Julku }
2673b2a66aadSAntti Julku 
2674dcc36c16SJohan Hedberg int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2675b2a66aadSAntti Julku {
2676b2a66aadSAntti Julku 	struct bdaddr_list *entry;
2677b2a66aadSAntti Julku 
267835f7498aSJohan Hedberg 	if (!bacmp(bdaddr, BDADDR_ANY)) {
2679dcc36c16SJohan Hedberg 		hci_bdaddr_list_clear(list);
268035f7498aSJohan Hedberg 		return 0;
268135f7498aSJohan Hedberg 	}
2682b2a66aadSAntti Julku 
2683dcc36c16SJohan Hedberg 	entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2684d2ab0ac1SMarcel Holtmann 	if (!entry)
2685d2ab0ac1SMarcel Holtmann 		return -ENOENT;
2686d2ab0ac1SMarcel Holtmann 
2687d2ab0ac1SMarcel Holtmann 	list_del(&entry->list);
2688d2ab0ac1SMarcel Holtmann 	kfree(entry);
2689d2ab0ac1SMarcel Holtmann 
2690d2ab0ac1SMarcel Holtmann 	return 0;
2691d2ab0ac1SMarcel Holtmann }
2692d2ab0ac1SMarcel Holtmann 
269315819a70SAndre Guedes /* This function requires the caller holds hdev->lock */
269415819a70SAndre Guedes struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
269515819a70SAndre Guedes 					       bdaddr_t *addr, u8 addr_type)
269615819a70SAndre Guedes {
269715819a70SAndre Guedes 	struct hci_conn_params *params;
269815819a70SAndre Guedes 
2699738f6185SJohan Hedberg 	/* The conn params list only contains identity addresses */
2700738f6185SJohan Hedberg 	if (!hci_is_identity_address(addr, addr_type))
2701738f6185SJohan Hedberg 		return NULL;
2702738f6185SJohan Hedberg 
270315819a70SAndre Guedes 	list_for_each_entry(params, &hdev->le_conn_params, list) {
270415819a70SAndre Guedes 		if (bacmp(&params->addr, addr) == 0 &&
270515819a70SAndre Guedes 		    params->addr_type == addr_type) {
270615819a70SAndre Guedes 			return params;
270715819a70SAndre Guedes 		}
270815819a70SAndre Guedes 	}
270915819a70SAndre Guedes 
271015819a70SAndre Guedes 	return NULL;
271115819a70SAndre Guedes }
271215819a70SAndre Guedes 
271315819a70SAndre Guedes /* This function requires the caller holds hdev->lock */
2714501f8827SJohan Hedberg struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
27154b10966fSMarcel Holtmann 						  bdaddr_t *addr, u8 addr_type)
271615819a70SAndre Guedes {
2717912b42efSJohan Hedberg 	struct hci_conn_params *param;
271815819a70SAndre Guedes 
2719738f6185SJohan Hedberg 	/* The list only contains identity addresses */
2720738f6185SJohan Hedberg 	if (!hci_is_identity_address(addr, addr_type))
2721738f6185SJohan Hedberg 		return NULL;
272215819a70SAndre Guedes 
2723501f8827SJohan Hedberg 	list_for_each_entry(param, list, action) {
2724912b42efSJohan Hedberg 		if (bacmp(&param->addr, addr) == 0 &&
2725912b42efSJohan Hedberg 		    param->addr_type == addr_type)
2726912b42efSJohan Hedberg 			return param;
27274b10966fSMarcel Holtmann 	}
27284b10966fSMarcel Holtmann 
27294b10966fSMarcel Holtmann 	return NULL;
273015819a70SAndre Guedes }
273115819a70SAndre Guedes 
273215819a70SAndre Guedes /* This function requires the caller holds hdev->lock */
273351d167c0SMarcel Holtmann struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
273451d167c0SMarcel Holtmann 					    bdaddr_t *addr, u8 addr_type)
273515819a70SAndre Guedes {
273615819a70SAndre Guedes 	struct hci_conn_params *params;
273715819a70SAndre Guedes 
2738c46245b3SJohan Hedberg 	if (!hci_is_identity_address(addr, addr_type))
273951d167c0SMarcel Holtmann 		return NULL;
2740a9b0a04cSAndre Guedes 
274115819a70SAndre Guedes 	params = hci_conn_params_lookup(hdev, addr, addr_type);
2742cef952ceSAndre Guedes 	if (params)
274351d167c0SMarcel Holtmann 		return params;
274415819a70SAndre Guedes 
274515819a70SAndre Guedes 	params = kzalloc(sizeof(*params), GFP_KERNEL);
274615819a70SAndre Guedes 	if (!params) {
274715819a70SAndre Guedes 		BT_ERR("Out of memory");
274851d167c0SMarcel Holtmann 		return NULL;
274915819a70SAndre Guedes 	}
275015819a70SAndre Guedes 
275115819a70SAndre Guedes 	bacpy(&params->addr, addr);
275215819a70SAndre Guedes 	params->addr_type = addr_type;
2753cef952ceSAndre Guedes 
2754cef952ceSAndre Guedes 	list_add(&params->list, &hdev->le_conn_params);
275593450c75SJohan Hedberg 	INIT_LIST_HEAD(&params->action);
2756cef952ceSAndre Guedes 
2757bf5b3c8bSMarcel Holtmann 	params->conn_min_interval = hdev->le_conn_min_interval;
2758bf5b3c8bSMarcel Holtmann 	params->conn_max_interval = hdev->le_conn_max_interval;
2759bf5b3c8bSMarcel Holtmann 	params->conn_latency = hdev->le_conn_latency;
2760bf5b3c8bSMarcel Holtmann 	params->supervision_timeout = hdev->le_supv_timeout;
2761bf5b3c8bSMarcel Holtmann 	params->auto_connect = HCI_AUTO_CONN_DISABLED;
2762bf5b3c8bSMarcel Holtmann 
2763bf5b3c8bSMarcel Holtmann 	BT_DBG("addr %pMR (type %u)", addr, addr_type);
2764bf5b3c8bSMarcel Holtmann 
276551d167c0SMarcel Holtmann 	return params;
2766bf5b3c8bSMarcel Holtmann }
2767bf5b3c8bSMarcel Holtmann 
2768f6c63249SJohan Hedberg static void hci_conn_params_free(struct hci_conn_params *params)
2769f6c63249SJohan Hedberg {
2770f6c63249SJohan Hedberg 	if (params->conn) {
2771f6c63249SJohan Hedberg 		hci_conn_drop(params->conn);
2772f6c63249SJohan Hedberg 		hci_conn_put(params->conn);
2773f6c63249SJohan Hedberg 	}
2774f6c63249SJohan Hedberg 
2775f6c63249SJohan Hedberg 	list_del(&params->action);
2776f6c63249SJohan Hedberg 	list_del(&params->list);
2777f6c63249SJohan Hedberg 	kfree(params);
2778f6c63249SJohan Hedberg }
2779f6c63249SJohan Hedberg 
278015819a70SAndre Guedes /* This function requires the caller holds hdev->lock */
278115819a70SAndre Guedes void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
278215819a70SAndre Guedes {
278315819a70SAndre Guedes 	struct hci_conn_params *params;
278415819a70SAndre Guedes 
278515819a70SAndre Guedes 	params = hci_conn_params_lookup(hdev, addr, addr_type);
278615819a70SAndre Guedes 	if (!params)
278715819a70SAndre Guedes 		return;
278815819a70SAndre Guedes 
2789f6c63249SJohan Hedberg 	hci_conn_params_free(params);
279015819a70SAndre Guedes 
279195305baaSJohan Hedberg 	hci_update_background_scan(hdev);
279295305baaSJohan Hedberg 
279315819a70SAndre Guedes 	BT_DBG("addr %pMR (type %u)", addr, addr_type);
279415819a70SAndre Guedes }
279515819a70SAndre Guedes 
279615819a70SAndre Guedes /* This function requires the caller holds hdev->lock */
279755af49a8SJohan Hedberg void hci_conn_params_clear_disabled(struct hci_dev *hdev)
279815819a70SAndre Guedes {
279915819a70SAndre Guedes 	struct hci_conn_params *params, *tmp;
280015819a70SAndre Guedes 
280115819a70SAndre Guedes 	list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
280255af49a8SJohan Hedberg 		if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
280355af49a8SJohan Hedberg 			continue;
280415819a70SAndre Guedes 		list_del(&params->list);
280515819a70SAndre Guedes 		kfree(params);
280615819a70SAndre Guedes 	}
280715819a70SAndre Guedes 
280855af49a8SJohan Hedberg 	BT_DBG("All LE disabled connection parameters were removed");
280955af49a8SJohan Hedberg }
281055af49a8SJohan Hedberg 
281155af49a8SJohan Hedberg /* This function requires the caller holds hdev->lock */
2812373110c5SJohan Hedberg void hci_conn_params_clear_all(struct hci_dev *hdev)
281315819a70SAndre Guedes {
281415819a70SAndre Guedes 	struct hci_conn_params *params, *tmp;
281515819a70SAndre Guedes 
2816f6c63249SJohan Hedberg 	list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2817f6c63249SJohan Hedberg 		hci_conn_params_free(params);
281815819a70SAndre Guedes 
2819a2f41a8fSJohan Hedberg 	hci_update_background_scan(hdev);
28201089b67dSMarcel Holtmann 
282115819a70SAndre Guedes 	BT_DBG("All LE connection parameters were removed");
282215819a70SAndre Guedes }
282315819a70SAndre Guedes 
28241904a853SMarcel Holtmann static void inquiry_complete(struct hci_dev *hdev, u8 status, u16 opcode)
28257ba8b4beSAndre Guedes {
28264c87eaabSAndre Guedes 	if (status) {
28274c87eaabSAndre Guedes 		BT_ERR("Failed to start inquiry: status %d", status);
28287ba8b4beSAndre Guedes 
28294c87eaabSAndre Guedes 		hci_dev_lock(hdev);
28304c87eaabSAndre Guedes 		hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
28314c87eaabSAndre Guedes 		hci_dev_unlock(hdev);
28324c87eaabSAndre Guedes 		return;
28334c87eaabSAndre Guedes 	}
28347ba8b4beSAndre Guedes }
28357ba8b4beSAndre Guedes 
28361904a853SMarcel Holtmann static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status,
28371904a853SMarcel Holtmann 					  u16 opcode)
28387ba8b4beSAndre Guedes {
28394c87eaabSAndre Guedes 	/* General inquiry access code (GIAC) */
28404c87eaabSAndre Guedes 	u8 lap[3] = { 0x33, 0x8b, 0x9e };
28414c87eaabSAndre Guedes 	struct hci_request req;
28424c87eaabSAndre Guedes 	struct hci_cp_inquiry cp;
28437ba8b4beSAndre Guedes 	int err;
28447ba8b4beSAndre Guedes 
28454c87eaabSAndre Guedes 	if (status) {
28464c87eaabSAndre Guedes 		BT_ERR("Failed to disable LE scanning: status %d", status);
28474c87eaabSAndre Guedes 		return;
28487ba8b4beSAndre Guedes 	}
28497ba8b4beSAndre Guedes 
28502d28cfe7SJakub Pawlowski 	hdev->discovery.scan_start = 0;
28512d28cfe7SJakub Pawlowski 
28524c87eaabSAndre Guedes 	switch (hdev->discovery.type) {
28534c87eaabSAndre Guedes 	case DISCOV_TYPE_LE:
28544c87eaabSAndre Guedes 		hci_dev_lock(hdev);
28554c87eaabSAndre Guedes 		hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
28564c87eaabSAndre Guedes 		hci_dev_unlock(hdev);
28574c87eaabSAndre Guedes 		break;
28587dbfac1dSAndre Guedes 
28594c87eaabSAndre Guedes 	case DISCOV_TYPE_INTERLEAVED:
28604c87eaabSAndre Guedes 		hci_req_init(&req, hdev);
28617dbfac1dSAndre Guedes 
28627dbfac1dSAndre Guedes 		memset(&cp, 0, sizeof(cp));
28634c87eaabSAndre Guedes 		memcpy(&cp.lap, lap, sizeof(cp.lap));
28644c87eaabSAndre Guedes 		cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
28654c87eaabSAndre Guedes 		hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
28664c87eaabSAndre Guedes 
28674c87eaabSAndre Guedes 		hci_dev_lock(hdev);
28684c87eaabSAndre Guedes 
28694c87eaabSAndre Guedes 		hci_inquiry_cache_flush(hdev);
28704c87eaabSAndre Guedes 
28714c87eaabSAndre Guedes 		err = hci_req_run(&req, inquiry_complete);
28724c87eaabSAndre Guedes 		if (err) {
28734c87eaabSAndre Guedes 			BT_ERR("Inquiry request failed: err %d", err);
28744c87eaabSAndre Guedes 			hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
28757dbfac1dSAndre Guedes 		}
28767dbfac1dSAndre Guedes 
28774c87eaabSAndre Guedes 		hci_dev_unlock(hdev);
28784c87eaabSAndre Guedes 		break;
28794c87eaabSAndre Guedes 	}
28807dbfac1dSAndre Guedes }
28817dbfac1dSAndre Guedes 
28827ba8b4beSAndre Guedes static void le_scan_disable_work(struct work_struct *work)
28837ba8b4beSAndre Guedes {
28847ba8b4beSAndre Guedes 	struct hci_dev *hdev = container_of(work, struct hci_dev,
28857ba8b4beSAndre Guedes 					    le_scan_disable.work);
28864c87eaabSAndre Guedes 	struct hci_request req;
28874c87eaabSAndre Guedes 	int err;
28887ba8b4beSAndre Guedes 
28897ba8b4beSAndre Guedes 	BT_DBG("%s", hdev->name);
28907ba8b4beSAndre Guedes 
28912d28cfe7SJakub Pawlowski 	cancel_delayed_work_sync(&hdev->le_scan_restart);
28922d28cfe7SJakub Pawlowski 
28934c87eaabSAndre Guedes 	hci_req_init(&req, hdev);
28947ba8b4beSAndre Guedes 
2895b1efcc28SAndre Guedes 	hci_req_add_le_scan_disable(&req);
28967ba8b4beSAndre Guedes 
28974c87eaabSAndre Guedes 	err = hci_req_run(&req, le_scan_disable_work_complete);
28984c87eaabSAndre Guedes 	if (err)
28994c87eaabSAndre Guedes 		BT_ERR("Disable LE scanning request failed: err %d", err);
290028b75a89SAndre Guedes }
290128b75a89SAndre Guedes 
29022d28cfe7SJakub Pawlowski static void le_scan_restart_work_complete(struct hci_dev *hdev, u8 status,
29032d28cfe7SJakub Pawlowski 					  u16 opcode)
29042d28cfe7SJakub Pawlowski {
29052d28cfe7SJakub Pawlowski 	unsigned long timeout, duration, scan_start, now;
29062d28cfe7SJakub Pawlowski 
29072d28cfe7SJakub Pawlowski 	BT_DBG("%s", hdev->name);
29082d28cfe7SJakub Pawlowski 
29092d28cfe7SJakub Pawlowski 	if (status) {
29102d28cfe7SJakub Pawlowski 		BT_ERR("Failed to restart LE scan: status %d", status);
29112d28cfe7SJakub Pawlowski 		return;
29122d28cfe7SJakub Pawlowski 	}
29132d28cfe7SJakub Pawlowski 
29142d28cfe7SJakub Pawlowski 	if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
29152d28cfe7SJakub Pawlowski 	    !hdev->discovery.scan_start)
29162d28cfe7SJakub Pawlowski 		return;
29172d28cfe7SJakub Pawlowski 
29182d28cfe7SJakub Pawlowski 	/* When the scan was started, hdev->le_scan_disable has been queued
29192d28cfe7SJakub Pawlowski 	 * after duration from scan_start. During scan restart this job
29202d28cfe7SJakub Pawlowski 	 * has been canceled, and we need to queue it again after proper
29212d28cfe7SJakub Pawlowski 	 * timeout, to make sure that scan does not run indefinitely.
29222d28cfe7SJakub Pawlowski 	 */
29232d28cfe7SJakub Pawlowski 	duration = hdev->discovery.scan_duration;
29242d28cfe7SJakub Pawlowski 	scan_start = hdev->discovery.scan_start;
29252d28cfe7SJakub Pawlowski 	now = jiffies;
29262d28cfe7SJakub Pawlowski 	if (now - scan_start <= duration) {
29272d28cfe7SJakub Pawlowski 		int elapsed;
29282d28cfe7SJakub Pawlowski 
29292d28cfe7SJakub Pawlowski 		if (now >= scan_start)
29302d28cfe7SJakub Pawlowski 			elapsed = now - scan_start;
29312d28cfe7SJakub Pawlowski 		else
29322d28cfe7SJakub Pawlowski 			elapsed = ULONG_MAX - scan_start + now;
29332d28cfe7SJakub Pawlowski 
29342d28cfe7SJakub Pawlowski 		timeout = duration - elapsed;
29352d28cfe7SJakub Pawlowski 	} else {
29362d28cfe7SJakub Pawlowski 		timeout = 0;
29372d28cfe7SJakub Pawlowski 	}
29382d28cfe7SJakub Pawlowski 	queue_delayed_work(hdev->workqueue,
29392d28cfe7SJakub Pawlowski 			   &hdev->le_scan_disable, timeout);
29402d28cfe7SJakub Pawlowski }
29412d28cfe7SJakub Pawlowski 
29422d28cfe7SJakub Pawlowski static void le_scan_restart_work(struct work_struct *work)
29432d28cfe7SJakub Pawlowski {
29442d28cfe7SJakub Pawlowski 	struct hci_dev *hdev = container_of(work, struct hci_dev,
29452d28cfe7SJakub Pawlowski 					    le_scan_restart.work);
29462d28cfe7SJakub Pawlowski 	struct hci_request req;
29472d28cfe7SJakub Pawlowski 	struct hci_cp_le_set_scan_enable cp;
29482d28cfe7SJakub Pawlowski 	int err;
29492d28cfe7SJakub Pawlowski 
29502d28cfe7SJakub Pawlowski 	BT_DBG("%s", hdev->name);
29512d28cfe7SJakub Pawlowski 
29522d28cfe7SJakub Pawlowski 	/* If controller is not scanning we are done. */
29532d28cfe7SJakub Pawlowski 	if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
29542d28cfe7SJakub Pawlowski 		return;
29552d28cfe7SJakub Pawlowski 
29562d28cfe7SJakub Pawlowski 	hci_req_init(&req, hdev);
29572d28cfe7SJakub Pawlowski 
29582d28cfe7SJakub Pawlowski 	hci_req_add_le_scan_disable(&req);
29592d28cfe7SJakub Pawlowski 
29602d28cfe7SJakub Pawlowski 	memset(&cp, 0, sizeof(cp));
29612d28cfe7SJakub Pawlowski 	cp.enable = LE_SCAN_ENABLE;
29622d28cfe7SJakub Pawlowski 	cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
29632d28cfe7SJakub Pawlowski 	hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
29642d28cfe7SJakub Pawlowski 
29652d28cfe7SJakub Pawlowski 	err = hci_req_run(&req, le_scan_restart_work_complete);
29662d28cfe7SJakub Pawlowski 	if (err)
29672d28cfe7SJakub Pawlowski 		BT_ERR("Restart LE scan request failed: err %d", err);
29682d28cfe7SJakub Pawlowski }
29692d28cfe7SJakub Pawlowski 
2970a1f4c318SJohan Hedberg /* Copy the Identity Address of the controller.
2971a1f4c318SJohan Hedberg  *
2972a1f4c318SJohan Hedberg  * If the controller has a public BD_ADDR, then by default use that one.
2973a1f4c318SJohan Hedberg  * If this is a LE only controller without a public address, default to
2974a1f4c318SJohan Hedberg  * the static random address.
2975a1f4c318SJohan Hedberg  *
2976a1f4c318SJohan Hedberg  * For debugging purposes it is possible to force controllers with a
2977a1f4c318SJohan Hedberg  * public address to use the static random address instead.
297850b5b952SMarcel Holtmann  *
297950b5b952SMarcel Holtmann  * In case BR/EDR has been disabled on a dual-mode controller and
298050b5b952SMarcel Holtmann  * userspace has configured a static address, then that address
298150b5b952SMarcel Holtmann  * becomes the identity address instead of the public BR/EDR address.
2982a1f4c318SJohan Hedberg  */
2983a1f4c318SJohan Hedberg void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2984a1f4c318SJohan Hedberg 			       u8 *bdaddr_type)
2985a1f4c318SJohan Hedberg {
2986111902f7SMarcel Holtmann 	if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
298750b5b952SMarcel Holtmann 	    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
298850b5b952SMarcel Holtmann 	    (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
298950b5b952SMarcel Holtmann 	     bacmp(&hdev->static_addr, BDADDR_ANY))) {
2990a1f4c318SJohan Hedberg 		bacpy(bdaddr, &hdev->static_addr);
2991a1f4c318SJohan Hedberg 		*bdaddr_type = ADDR_LE_DEV_RANDOM;
2992a1f4c318SJohan Hedberg 	} else {
2993a1f4c318SJohan Hedberg 		bacpy(bdaddr, &hdev->bdaddr);
2994a1f4c318SJohan Hedberg 		*bdaddr_type = ADDR_LE_DEV_PUBLIC;
2995a1f4c318SJohan Hedberg 	}
2996a1f4c318SJohan Hedberg }
2997a1f4c318SJohan Hedberg 
29989be0dab7SDavid Herrmann /* Alloc HCI device */
29999be0dab7SDavid Herrmann struct hci_dev *hci_alloc_dev(void)
30009be0dab7SDavid Herrmann {
30019be0dab7SDavid Herrmann 	struct hci_dev *hdev;
30029be0dab7SDavid Herrmann 
300327f70f3eSJohan Hedberg 	hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
30049be0dab7SDavid Herrmann 	if (!hdev)
30059be0dab7SDavid Herrmann 		return NULL;
30069be0dab7SDavid Herrmann 
3007b1b813d4SDavid Herrmann 	hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3008b1b813d4SDavid Herrmann 	hdev->esco_type = (ESCO_HV1);
3009b1b813d4SDavid Herrmann 	hdev->link_mode = (HCI_LM_ACCEPT);
3010b4cb9fb2SMarcel Holtmann 	hdev->num_iac = 0x01;		/* One IAC support is mandatory */
3011b1b813d4SDavid Herrmann 	hdev->io_capability = 0x03;	/* No Input No Output */
301296c2103aSMarcel Holtmann 	hdev->manufacturer = 0xffff;	/* Default to internal use */
3013bbaf444aSJohan Hedberg 	hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3014bbaf444aSJohan Hedberg 	hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3015b1b813d4SDavid Herrmann 
3016b1b813d4SDavid Herrmann 	hdev->sniff_max_interval = 800;
3017b1b813d4SDavid Herrmann 	hdev->sniff_min_interval = 80;
3018b1b813d4SDavid Herrmann 
30193f959d46SMarcel Holtmann 	hdev->le_adv_channel_map = 0x07;
3020628531c9SGeorg Lukas 	hdev->le_adv_min_interval = 0x0800;
3021628531c9SGeorg Lukas 	hdev->le_adv_max_interval = 0x0800;
3022bef64738SMarcel Holtmann 	hdev->le_scan_interval = 0x0060;
3023bef64738SMarcel Holtmann 	hdev->le_scan_window = 0x0030;
30244e70c7e7SMarcel Holtmann 	hdev->le_conn_min_interval = 0x0028;
30254e70c7e7SMarcel Holtmann 	hdev->le_conn_max_interval = 0x0038;
302604fb7d90SMarcel Holtmann 	hdev->le_conn_latency = 0x0000;
302704fb7d90SMarcel Holtmann 	hdev->le_supv_timeout = 0x002a;
3028a8e1bfaaSMarcel Holtmann 	hdev->le_def_tx_len = 0x001b;
3029a8e1bfaaSMarcel Holtmann 	hdev->le_def_tx_time = 0x0148;
3030a8e1bfaaSMarcel Holtmann 	hdev->le_max_tx_len = 0x001b;
3031a8e1bfaaSMarcel Holtmann 	hdev->le_max_tx_time = 0x0148;
3032a8e1bfaaSMarcel Holtmann 	hdev->le_max_rx_len = 0x001b;
3033a8e1bfaaSMarcel Holtmann 	hdev->le_max_rx_time = 0x0148;
3034bef64738SMarcel Holtmann 
3035d6bfd59cSJohan Hedberg 	hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3036b9a7a61eSLukasz Rymanowski 	hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
303731ad1691SAndrzej Kaczmarek 	hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
303831ad1691SAndrzej Kaczmarek 	hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3039d6bfd59cSJohan Hedberg 
3040b1b813d4SDavid Herrmann 	mutex_init(&hdev->lock);
3041b1b813d4SDavid Herrmann 	mutex_init(&hdev->req_lock);
3042b1b813d4SDavid Herrmann 
3043b1b813d4SDavid Herrmann 	INIT_LIST_HEAD(&hdev->mgmt_pending);
3044b1b813d4SDavid Herrmann 	INIT_LIST_HEAD(&hdev->blacklist);
30456659358eSJohan Hedberg 	INIT_LIST_HEAD(&hdev->whitelist);
3046b1b813d4SDavid Herrmann 	INIT_LIST_HEAD(&hdev->uuids);
3047b1b813d4SDavid Herrmann 	INIT_LIST_HEAD(&hdev->link_keys);
3048b1b813d4SDavid Herrmann 	INIT_LIST_HEAD(&hdev->long_term_keys);
3049970c4e46SJohan Hedberg 	INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3050b1b813d4SDavid Herrmann 	INIT_LIST_HEAD(&hdev->remote_oob_data);
3051d2ab0ac1SMarcel Holtmann 	INIT_LIST_HEAD(&hdev->le_white_list);
305215819a70SAndre Guedes 	INIT_LIST_HEAD(&hdev->le_conn_params);
305377a77a30SAndre Guedes 	INIT_LIST_HEAD(&hdev->pend_le_conns);
305466f8455aSJohan Hedberg 	INIT_LIST_HEAD(&hdev->pend_le_reports);
30556b536b5eSAndrei Emeltchenko 	INIT_LIST_HEAD(&hdev->conn_hash.list);
3056b1b813d4SDavid Herrmann 
3057b1b813d4SDavid Herrmann 	INIT_WORK(&hdev->rx_work, hci_rx_work);
3058b1b813d4SDavid Herrmann 	INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3059b1b813d4SDavid Herrmann 	INIT_WORK(&hdev->tx_work, hci_tx_work);
3060b1b813d4SDavid Herrmann 	INIT_WORK(&hdev->power_on, hci_power_on);
3061c7741d16SMarcel Holtmann 	INIT_WORK(&hdev->error_reset, hci_error_reset);
3062b1b813d4SDavid Herrmann 
3063b1b813d4SDavid Herrmann 	INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3064b1b813d4SDavid Herrmann 	INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
3065b1b813d4SDavid Herrmann 	INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
30662d28cfe7SJakub Pawlowski 	INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
3067b1b813d4SDavid Herrmann 
3068b1b813d4SDavid Herrmann 	skb_queue_head_init(&hdev->rx_q);
3069b1b813d4SDavid Herrmann 	skb_queue_head_init(&hdev->cmd_q);
3070b1b813d4SDavid Herrmann 	skb_queue_head_init(&hdev->raw_q);
3071b1b813d4SDavid Herrmann 
3072b1b813d4SDavid Herrmann 	init_waitqueue_head(&hdev->req_wait_q);
3073b1b813d4SDavid Herrmann 
307465cc2b49SMarcel Holtmann 	INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3075b1b813d4SDavid Herrmann 
3076b1b813d4SDavid Herrmann 	hci_init_sysfs(hdev);
3077b1b813d4SDavid Herrmann 	discovery_init(hdev);
30789be0dab7SDavid Herrmann 
30799be0dab7SDavid Herrmann 	return hdev;
30809be0dab7SDavid Herrmann }
30819be0dab7SDavid Herrmann EXPORT_SYMBOL(hci_alloc_dev);
30829be0dab7SDavid Herrmann 
30839be0dab7SDavid Herrmann /* Free HCI device */
30849be0dab7SDavid Herrmann void hci_free_dev(struct hci_dev *hdev)
30859be0dab7SDavid Herrmann {
30869be0dab7SDavid Herrmann 	/* will free via device release */
30879be0dab7SDavid Herrmann 	put_device(&hdev->dev);
30889be0dab7SDavid Herrmann }
30899be0dab7SDavid Herrmann EXPORT_SYMBOL(hci_free_dev);
30909be0dab7SDavid Herrmann 
30911da177e4SLinus Torvalds /* Register HCI device */
30921da177e4SLinus Torvalds int hci_register_dev(struct hci_dev *hdev)
30931da177e4SLinus Torvalds {
3094b1b813d4SDavid Herrmann 	int id, error;
30951da177e4SLinus Torvalds 
309674292d5aSMarcel Holtmann 	if (!hdev->open || !hdev->close || !hdev->send)
30971da177e4SLinus Torvalds 		return -EINVAL;
30981da177e4SLinus Torvalds 
309908add513SMat Martineau 	/* Do not allow HCI_AMP devices to register at index 0,
310008add513SMat Martineau 	 * so the index can be used as the AMP controller ID.
310108add513SMat Martineau 	 */
31023df92b31SSasha Levin 	switch (hdev->dev_type) {
31033df92b31SSasha Levin 	case HCI_BREDR:
31043df92b31SSasha Levin 		id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
31051da177e4SLinus Torvalds 		break;
31063df92b31SSasha Levin 	case HCI_AMP:
31073df92b31SSasha Levin 		id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
31083df92b31SSasha Levin 		break;
31093df92b31SSasha Levin 	default:
31103df92b31SSasha Levin 		return -EINVAL;
31111da177e4SLinus Torvalds 	}
31121da177e4SLinus Torvalds 
31133df92b31SSasha Levin 	if (id < 0)
31143df92b31SSasha Levin 		return id;
31153df92b31SSasha Levin 
31161da177e4SLinus Torvalds 	sprintf(hdev->name, "hci%d", id);
31171da177e4SLinus Torvalds 	hdev->id = id;
31182d8b3a11SAndrei Emeltchenko 
31192d8b3a11SAndrei Emeltchenko 	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
31202d8b3a11SAndrei Emeltchenko 
3121d8537548SKees Cook 	hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3122d8537548SKees Cook 					  WQ_MEM_RECLAIM, 1, hdev->name);
312333ca954dSDavid Herrmann 	if (!hdev->workqueue) {
312433ca954dSDavid Herrmann 		error = -ENOMEM;
312533ca954dSDavid Herrmann 		goto err;
312633ca954dSDavid Herrmann 	}
3127f48fd9c8SMarcel Holtmann 
3128d8537548SKees Cook 	hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3129d8537548SKees Cook 					      WQ_MEM_RECLAIM, 1, hdev->name);
31306ead1bbcSJohan Hedberg 	if (!hdev->req_workqueue) {
31316ead1bbcSJohan Hedberg 		destroy_workqueue(hdev->workqueue);
31326ead1bbcSJohan Hedberg 		error = -ENOMEM;
31336ead1bbcSJohan Hedberg 		goto err;
31346ead1bbcSJohan Hedberg 	}
31356ead1bbcSJohan Hedberg 
31360153e2ecSMarcel Holtmann 	if (!IS_ERR_OR_NULL(bt_debugfs))
31370153e2ecSMarcel Holtmann 		hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
31380153e2ecSMarcel Holtmann 
3139bdc3e0f1SMarcel Holtmann 	dev_set_name(&hdev->dev, "%s", hdev->name);
3140bdc3e0f1SMarcel Holtmann 
3141bdc3e0f1SMarcel Holtmann 	error = device_add(&hdev->dev);
314233ca954dSDavid Herrmann 	if (error < 0)
314354506918SJohan Hedberg 		goto err_wqueue;
31441da177e4SLinus Torvalds 
3145611b30f7SMarcel Holtmann 	hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3146a8c5fb1aSGustavo Padovan 				    RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3147a8c5fb1aSGustavo Padovan 				    hdev);
3148611b30f7SMarcel Holtmann 	if (hdev->rfkill) {
3149611b30f7SMarcel Holtmann 		if (rfkill_register(hdev->rfkill) < 0) {
3150611b30f7SMarcel Holtmann 			rfkill_destroy(hdev->rfkill);
3151611b30f7SMarcel Holtmann 			hdev->rfkill = NULL;
3152611b30f7SMarcel Holtmann 		}
3153611b30f7SMarcel Holtmann 	}
3154611b30f7SMarcel Holtmann 
31555e130367SJohan Hedberg 	if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
31565e130367SJohan Hedberg 		set_bit(HCI_RFKILLED, &hdev->dev_flags);
31575e130367SJohan Hedberg 
3158a8b2d5c2SJohan Hedberg 	set_bit(HCI_SETUP, &hdev->dev_flags);
3159004b0258SMarcel Holtmann 	set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
3160ce2be9acSAndrei Emeltchenko 
316101cd3404SMarcel Holtmann 	if (hdev->dev_type == HCI_BREDR) {
316256f87901SJohan Hedberg 		/* Assume BR/EDR support until proven otherwise (such as
316356f87901SJohan Hedberg 		 * through reading supported features during init.
316456f87901SJohan Hedberg 		 */
316556f87901SJohan Hedberg 		set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
316656f87901SJohan Hedberg 	}
3167ce2be9acSAndrei Emeltchenko 
3168fcee3377SGustavo Padovan 	write_lock(&hci_dev_list_lock);
3169fcee3377SGustavo Padovan 	list_add(&hdev->list, &hci_dev_list);
3170fcee3377SGustavo Padovan 	write_unlock(&hci_dev_list_lock);
3171fcee3377SGustavo Padovan 
31724a964404SMarcel Holtmann 	/* Devices that are marked for raw-only usage are unconfigured
31734a964404SMarcel Holtmann 	 * and should not be included in normal operation.
3174fee746b0SMarcel Holtmann 	 */
3175fee746b0SMarcel Holtmann 	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
31764a964404SMarcel Holtmann 		set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
3177fee746b0SMarcel Holtmann 
31781da177e4SLinus Torvalds 	hci_notify(hdev, HCI_DEV_REG);
3179dc946bd8SDavid Herrmann 	hci_dev_hold(hdev);
31801da177e4SLinus Torvalds 
318119202573SJohan Hedberg 	queue_work(hdev->req_workqueue, &hdev->power_on);
3182fbe96d6fSMarcel Holtmann 
31831da177e4SLinus Torvalds 	return id;
3184f48fd9c8SMarcel Holtmann 
318533ca954dSDavid Herrmann err_wqueue:
318633ca954dSDavid Herrmann 	destroy_workqueue(hdev->workqueue);
31876ead1bbcSJohan Hedberg 	destroy_workqueue(hdev->req_workqueue);
318833ca954dSDavid Herrmann err:
31893df92b31SSasha Levin 	ida_simple_remove(&hci_index_ida, hdev->id);
3190f48fd9c8SMarcel Holtmann 
319133ca954dSDavid Herrmann 	return error;
31921da177e4SLinus Torvalds }
31931da177e4SLinus Torvalds EXPORT_SYMBOL(hci_register_dev);
31941da177e4SLinus Torvalds 
31951da177e4SLinus Torvalds /* Unregister HCI device */
319659735631SDavid Herrmann void hci_unregister_dev(struct hci_dev *hdev)
31971da177e4SLinus Torvalds {
31983df92b31SSasha Levin 	int i, id;
3199ef222013SMarcel Holtmann 
3200c13854ceSMarcel Holtmann 	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
32011da177e4SLinus Torvalds 
320294324962SJohan Hovold 	set_bit(HCI_UNREGISTER, &hdev->dev_flags);
320394324962SJohan Hovold 
32043df92b31SSasha Levin 	id = hdev->id;
32053df92b31SSasha Levin 
3206f20d09d5SGustavo F. Padovan 	write_lock(&hci_dev_list_lock);
32071da177e4SLinus Torvalds 	list_del(&hdev->list);
3208f20d09d5SGustavo F. Padovan 	write_unlock(&hci_dev_list_lock);
32091da177e4SLinus Torvalds 
32101da177e4SLinus Torvalds 	hci_dev_do_close(hdev);
32111da177e4SLinus Torvalds 
3212cd4c5391SSuraj Sumangala 	for (i = 0; i < NUM_REASSEMBLY; i++)
3213ef222013SMarcel Holtmann 		kfree_skb(hdev->reassembly[i]);
3214ef222013SMarcel Holtmann 
3215b9b5ef18SGustavo Padovan 	cancel_work_sync(&hdev->power_on);
3216b9b5ef18SGustavo Padovan 
3217ab81cbf9SJohan Hedberg 	if (!test_bit(HCI_INIT, &hdev->flags) &&
3218d603b76bSMarcel Holtmann 	    !test_bit(HCI_SETUP, &hdev->dev_flags) &&
3219d603b76bSMarcel Holtmann 	    !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
322009fd0de5SGustavo F. Padovan 		hci_dev_lock(hdev);
3221744cf19eSJohan Hedberg 		mgmt_index_removed(hdev);
322209fd0de5SGustavo F. Padovan 		hci_dev_unlock(hdev);
322356e5cb86SJohan Hedberg 	}
3224ab81cbf9SJohan Hedberg 
32252e58ef3eSJohan Hedberg 	/* mgmt_index_removed should take care of emptying the
32262e58ef3eSJohan Hedberg 	 * pending list */
32272e58ef3eSJohan Hedberg 	BUG_ON(!list_empty(&hdev->mgmt_pending));
32282e58ef3eSJohan Hedberg 
32291da177e4SLinus Torvalds 	hci_notify(hdev, HCI_DEV_UNREG);
32301da177e4SLinus Torvalds 
3231611b30f7SMarcel Holtmann 	if (hdev->rfkill) {
3232611b30f7SMarcel Holtmann 		rfkill_unregister(hdev->rfkill);
3233611b30f7SMarcel Holtmann 		rfkill_destroy(hdev->rfkill);
3234611b30f7SMarcel Holtmann 	}
3235611b30f7SMarcel Holtmann 
3236bdc3e0f1SMarcel Holtmann 	device_del(&hdev->dev);
3237147e2d59SDave Young 
32380153e2ecSMarcel Holtmann 	debugfs_remove_recursive(hdev->debugfs);
32390153e2ecSMarcel Holtmann 
3240f48fd9c8SMarcel Holtmann 	destroy_workqueue(hdev->workqueue);
32416ead1bbcSJohan Hedberg 	destroy_workqueue(hdev->req_workqueue);
3242f48fd9c8SMarcel Holtmann 
324309fd0de5SGustavo F. Padovan 	hci_dev_lock(hdev);
3244dcc36c16SJohan Hedberg 	hci_bdaddr_list_clear(&hdev->blacklist);
32456659358eSJohan Hedberg 	hci_bdaddr_list_clear(&hdev->whitelist);
32462aeb9a1aSJohan Hedberg 	hci_uuids_clear(hdev);
324755ed8ca1SJohan Hedberg 	hci_link_keys_clear(hdev);
3248b899efafSVinicius Costa Gomes 	hci_smp_ltks_clear(hdev);
3249970c4e46SJohan Hedberg 	hci_smp_irks_clear(hdev);
32502763eda6SSzymon Janc 	hci_remote_oob_data_clear(hdev);
3251dcc36c16SJohan Hedberg 	hci_bdaddr_list_clear(&hdev->le_white_list);
3252373110c5SJohan Hedberg 	hci_conn_params_clear_all(hdev);
325322078800SMarcel Holtmann 	hci_discovery_filter_clear(hdev);
325409fd0de5SGustavo F. Padovan 	hci_dev_unlock(hdev);
3255e2e0cacbSJohan Hedberg 
3256dc946bd8SDavid Herrmann 	hci_dev_put(hdev);
32573df92b31SSasha Levin 
32583df92b31SSasha Levin 	ida_simple_remove(&hci_index_ida, id);
32591da177e4SLinus Torvalds }
32601da177e4SLinus Torvalds EXPORT_SYMBOL(hci_unregister_dev);
32611da177e4SLinus Torvalds 
32621da177e4SLinus Torvalds /* Suspend HCI device */
32631da177e4SLinus Torvalds int hci_suspend_dev(struct hci_dev *hdev)
32641da177e4SLinus Torvalds {
32651da177e4SLinus Torvalds 	hci_notify(hdev, HCI_DEV_SUSPEND);
32661da177e4SLinus Torvalds 	return 0;
32671da177e4SLinus Torvalds }
32681da177e4SLinus Torvalds EXPORT_SYMBOL(hci_suspend_dev);
32691da177e4SLinus Torvalds 
32701da177e4SLinus Torvalds /* Resume HCI device */
32711da177e4SLinus Torvalds int hci_resume_dev(struct hci_dev *hdev)
32721da177e4SLinus Torvalds {
32731da177e4SLinus Torvalds 	hci_notify(hdev, HCI_DEV_RESUME);
32741da177e4SLinus Torvalds 	return 0;
32751da177e4SLinus Torvalds }
32761da177e4SLinus Torvalds EXPORT_SYMBOL(hci_resume_dev);
32771da177e4SLinus Torvalds 
327875e0569fSMarcel Holtmann /* Reset HCI device */
327975e0569fSMarcel Holtmann int hci_reset_dev(struct hci_dev *hdev)
328075e0569fSMarcel Holtmann {
328175e0569fSMarcel Holtmann 	const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
328275e0569fSMarcel Holtmann 	struct sk_buff *skb;
328375e0569fSMarcel Holtmann 
328475e0569fSMarcel Holtmann 	skb = bt_skb_alloc(3, GFP_ATOMIC);
328575e0569fSMarcel Holtmann 	if (!skb)
328675e0569fSMarcel Holtmann 		return -ENOMEM;
328775e0569fSMarcel Holtmann 
328875e0569fSMarcel Holtmann 	bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
328975e0569fSMarcel Holtmann 	memcpy(skb_put(skb, 3), hw_err, 3);
329075e0569fSMarcel Holtmann 
329175e0569fSMarcel Holtmann 	/* Send Hardware Error to upper stack */
329275e0569fSMarcel Holtmann 	return hci_recv_frame(hdev, skb);
329375e0569fSMarcel Holtmann }
329475e0569fSMarcel Holtmann EXPORT_SYMBOL(hci_reset_dev);
329575e0569fSMarcel Holtmann 
329676bca880SMarcel Holtmann /* Receive frame from HCI drivers */
3297e1a26170SMarcel Holtmann int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
329876bca880SMarcel Holtmann {
329976bca880SMarcel Holtmann 	if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
330076bca880SMarcel Holtmann 		      && !test_bit(HCI_INIT, &hdev->flags))) {
330176bca880SMarcel Holtmann 		kfree_skb(skb);
330276bca880SMarcel Holtmann 		return -ENXIO;
330376bca880SMarcel Holtmann 	}
330476bca880SMarcel Holtmann 
3305d82603c6SJorrit Schippers 	/* Incoming skb */
330676bca880SMarcel Holtmann 	bt_cb(skb)->incoming = 1;
330776bca880SMarcel Holtmann 
330876bca880SMarcel Holtmann 	/* Time stamp */
330976bca880SMarcel Holtmann 	__net_timestamp(skb);
331076bca880SMarcel Holtmann 
331176bca880SMarcel Holtmann 	skb_queue_tail(&hdev->rx_q, skb);
3312b78752ccSMarcel Holtmann 	queue_work(hdev->workqueue, &hdev->rx_work);
3313c78ae283SMarcel Holtmann 
331476bca880SMarcel Holtmann 	return 0;
331576bca880SMarcel Holtmann }
331676bca880SMarcel Holtmann EXPORT_SYMBOL(hci_recv_frame);
331776bca880SMarcel Holtmann 
331833e882a5SSuraj Sumangala static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
33191e429f38SGustavo F. Padovan 			  int count, __u8 index)
332033e882a5SSuraj Sumangala {
332133e882a5SSuraj Sumangala 	int len = 0;
332233e882a5SSuraj Sumangala 	int hlen = 0;
332333e882a5SSuraj Sumangala 	int remain = count;
332433e882a5SSuraj Sumangala 	struct sk_buff *skb;
332533e882a5SSuraj Sumangala 	struct bt_skb_cb *scb;
332633e882a5SSuraj Sumangala 
332733e882a5SSuraj Sumangala 	if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
332833e882a5SSuraj Sumangala 	    index >= NUM_REASSEMBLY)
332933e882a5SSuraj Sumangala 		return -EILSEQ;
333033e882a5SSuraj Sumangala 
333133e882a5SSuraj Sumangala 	skb = hdev->reassembly[index];
333233e882a5SSuraj Sumangala 
333333e882a5SSuraj Sumangala 	if (!skb) {
333433e882a5SSuraj Sumangala 		switch (type) {
333533e882a5SSuraj Sumangala 		case HCI_ACLDATA_PKT:
333633e882a5SSuraj Sumangala 			len = HCI_MAX_FRAME_SIZE;
333733e882a5SSuraj Sumangala 			hlen = HCI_ACL_HDR_SIZE;
333833e882a5SSuraj Sumangala 			break;
333933e882a5SSuraj Sumangala 		case HCI_EVENT_PKT:
334033e882a5SSuraj Sumangala 			len = HCI_MAX_EVENT_SIZE;
334133e882a5SSuraj Sumangala 			hlen = HCI_EVENT_HDR_SIZE;
334233e882a5SSuraj Sumangala 			break;
334333e882a5SSuraj Sumangala 		case HCI_SCODATA_PKT:
334433e882a5SSuraj Sumangala 			len = HCI_MAX_SCO_SIZE;
334533e882a5SSuraj Sumangala 			hlen = HCI_SCO_HDR_SIZE;
334633e882a5SSuraj Sumangala 			break;
334733e882a5SSuraj Sumangala 		}
334833e882a5SSuraj Sumangala 
33491e429f38SGustavo F. Padovan 		skb = bt_skb_alloc(len, GFP_ATOMIC);
335033e882a5SSuraj Sumangala 		if (!skb)
335133e882a5SSuraj Sumangala 			return -ENOMEM;
335233e882a5SSuraj Sumangala 
335333e882a5SSuraj Sumangala 		scb = (void *) skb->cb;
335433e882a5SSuraj Sumangala 		scb->expect = hlen;
335533e882a5SSuraj Sumangala 		scb->pkt_type = type;
335633e882a5SSuraj Sumangala 
335733e882a5SSuraj Sumangala 		hdev->reassembly[index] = skb;
335833e882a5SSuraj Sumangala 	}
335933e882a5SSuraj Sumangala 
336033e882a5SSuraj Sumangala 	while (count) {
336133e882a5SSuraj Sumangala 		scb = (void *) skb->cb;
336289bb46d0SDan Carpenter 		len = min_t(uint, scb->expect, count);
336333e882a5SSuraj Sumangala 
336433e882a5SSuraj Sumangala 		memcpy(skb_put(skb, len), data, len);
336533e882a5SSuraj Sumangala 
336633e882a5SSuraj Sumangala 		count -= len;
336733e882a5SSuraj Sumangala 		data += len;
336833e882a5SSuraj Sumangala 		scb->expect -= len;
336933e882a5SSuraj Sumangala 		remain = count;
337033e882a5SSuraj Sumangala 
337133e882a5SSuraj Sumangala 		switch (type) {
337233e882a5SSuraj Sumangala 		case HCI_EVENT_PKT:
337333e882a5SSuraj Sumangala 			if (skb->len == HCI_EVENT_HDR_SIZE) {
337433e882a5SSuraj Sumangala 				struct hci_event_hdr *h = hci_event_hdr(skb);
337533e882a5SSuraj Sumangala 				scb->expect = h->plen;
337633e882a5SSuraj Sumangala 
337733e882a5SSuraj Sumangala 				if (skb_tailroom(skb) < scb->expect) {
337833e882a5SSuraj Sumangala 					kfree_skb(skb);
337933e882a5SSuraj Sumangala 					hdev->reassembly[index] = NULL;
338033e882a5SSuraj Sumangala 					return -ENOMEM;
338133e882a5SSuraj Sumangala 				}
338233e882a5SSuraj Sumangala 			}
338333e882a5SSuraj Sumangala 			break;
338433e882a5SSuraj Sumangala 
338533e882a5SSuraj Sumangala 		case HCI_ACLDATA_PKT:
338633e882a5SSuraj Sumangala 			if (skb->len  == HCI_ACL_HDR_SIZE) {
338733e882a5SSuraj Sumangala 				struct hci_acl_hdr *h = hci_acl_hdr(skb);
338833e882a5SSuraj Sumangala 				scb->expect = __le16_to_cpu(h->dlen);
338933e882a5SSuraj Sumangala 
339033e882a5SSuraj Sumangala 				if (skb_tailroom(skb) < scb->expect) {
339133e882a5SSuraj Sumangala 					kfree_skb(skb);
339233e882a5SSuraj Sumangala 					hdev->reassembly[index] = NULL;
339333e882a5SSuraj Sumangala 					return -ENOMEM;
339433e882a5SSuraj Sumangala 				}
339533e882a5SSuraj Sumangala 			}
339633e882a5SSuraj Sumangala 			break;
339733e882a5SSuraj Sumangala 
339833e882a5SSuraj Sumangala 		case HCI_SCODATA_PKT:
339933e882a5SSuraj Sumangala 			if (skb->len == HCI_SCO_HDR_SIZE) {
340033e882a5SSuraj Sumangala 				struct hci_sco_hdr *h = hci_sco_hdr(skb);
340133e882a5SSuraj Sumangala 				scb->expect = h->dlen;
340233e882a5SSuraj Sumangala 
340333e882a5SSuraj Sumangala 				if (skb_tailroom(skb) < scb->expect) {
340433e882a5SSuraj Sumangala 					kfree_skb(skb);
340533e882a5SSuraj Sumangala 					hdev->reassembly[index] = NULL;
340633e882a5SSuraj Sumangala 					return -ENOMEM;
340733e882a5SSuraj Sumangala 				}
340833e882a5SSuraj Sumangala 			}
340933e882a5SSuraj Sumangala 			break;
341033e882a5SSuraj Sumangala 		}
341133e882a5SSuraj Sumangala 
341233e882a5SSuraj Sumangala 		if (scb->expect == 0) {
341333e882a5SSuraj Sumangala 			/* Complete frame */
341433e882a5SSuraj Sumangala 
341533e882a5SSuraj Sumangala 			bt_cb(skb)->pkt_type = type;
3416e1a26170SMarcel Holtmann 			hci_recv_frame(hdev, skb);
341733e882a5SSuraj Sumangala 
341833e882a5SSuraj Sumangala 			hdev->reassembly[index] = NULL;
341933e882a5SSuraj Sumangala 			return remain;
342033e882a5SSuraj Sumangala 		}
342133e882a5SSuraj Sumangala 	}
342233e882a5SSuraj Sumangala 
342333e882a5SSuraj Sumangala 	return remain;
342433e882a5SSuraj Sumangala }
342533e882a5SSuraj Sumangala 
342699811510SSuraj Sumangala #define STREAM_REASSEMBLY 0
342799811510SSuraj Sumangala 
342899811510SSuraj Sumangala int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
342999811510SSuraj Sumangala {
343099811510SSuraj Sumangala 	int type;
343199811510SSuraj Sumangala 	int rem = 0;
343299811510SSuraj Sumangala 
3433da5f6c37SGustavo F. Padovan 	while (count) {
343499811510SSuraj Sumangala 		struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
343599811510SSuraj Sumangala 
343699811510SSuraj Sumangala 		if (!skb) {
343799811510SSuraj Sumangala 			struct { char type; } *pkt;
343899811510SSuraj Sumangala 
343999811510SSuraj Sumangala 			/* Start of the frame */
344099811510SSuraj Sumangala 			pkt = data;
344199811510SSuraj Sumangala 			type = pkt->type;
344299811510SSuraj Sumangala 
344399811510SSuraj Sumangala 			data++;
344499811510SSuraj Sumangala 			count--;
344599811510SSuraj Sumangala 		} else
344699811510SSuraj Sumangala 			type = bt_cb(skb)->pkt_type;
344799811510SSuraj Sumangala 
34481e429f38SGustavo F. Padovan 		rem = hci_reassembly(hdev, type, data, count,
34491e429f38SGustavo F. Padovan 				     STREAM_REASSEMBLY);
345099811510SSuraj Sumangala 		if (rem < 0)
345199811510SSuraj Sumangala 			return rem;
345299811510SSuraj Sumangala 
345399811510SSuraj Sumangala 		data += (count - rem);
345499811510SSuraj Sumangala 		count = rem;
3455f81c6224SJoe Perches 	}
345699811510SSuraj Sumangala 
345799811510SSuraj Sumangala 	return rem;
345899811510SSuraj Sumangala }
345999811510SSuraj Sumangala EXPORT_SYMBOL(hci_recv_stream_fragment);
346099811510SSuraj Sumangala 
34611da177e4SLinus Torvalds /* ---- Interface to upper protocols ---- */
34621da177e4SLinus Torvalds 
34631da177e4SLinus Torvalds int hci_register_cb(struct hci_cb *cb)
34641da177e4SLinus Torvalds {
34651da177e4SLinus Torvalds 	BT_DBG("%p name %s", cb, cb->name);
34661da177e4SLinus Torvalds 
3467f20d09d5SGustavo F. Padovan 	write_lock(&hci_cb_list_lock);
346800629e0fSJohan Hedberg 	list_add_tail(&cb->list, &hci_cb_list);
3469f20d09d5SGustavo F. Padovan 	write_unlock(&hci_cb_list_lock);
34701da177e4SLinus Torvalds 
34711da177e4SLinus Torvalds 	return 0;
34721da177e4SLinus Torvalds }
34731da177e4SLinus Torvalds EXPORT_SYMBOL(hci_register_cb);
34741da177e4SLinus Torvalds 
34751da177e4SLinus Torvalds int hci_unregister_cb(struct hci_cb *cb)
34761da177e4SLinus Torvalds {
34771da177e4SLinus Torvalds 	BT_DBG("%p name %s", cb, cb->name);
34781da177e4SLinus Torvalds 
3479f20d09d5SGustavo F. Padovan 	write_lock(&hci_cb_list_lock);
34801da177e4SLinus Torvalds 	list_del(&cb->list);
3481f20d09d5SGustavo F. Padovan 	write_unlock(&hci_cb_list_lock);
34821da177e4SLinus Torvalds 
34831da177e4SLinus Torvalds 	return 0;
34841da177e4SLinus Torvalds }
34851da177e4SLinus Torvalds EXPORT_SYMBOL(hci_unregister_cb);
34861da177e4SLinus Torvalds 
348751086991SMarcel Holtmann static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
34881da177e4SLinus Torvalds {
3489cdc52faaSMarcel Holtmann 	int err;
3490cdc52faaSMarcel Holtmann 
34910d48d939SMarcel Holtmann 	BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
34921da177e4SLinus Torvalds 
34931da177e4SLinus Torvalds 	/* Time stamp */
3494a61bbcf2SPatrick McHardy 	__net_timestamp(skb);
34951da177e4SLinus Torvalds 
3496cd82e61cSMarcel Holtmann 	/* Send copy to monitor */
3497cd82e61cSMarcel Holtmann 	hci_send_to_monitor(hdev, skb);
3498cd82e61cSMarcel Holtmann 
3499cd82e61cSMarcel Holtmann 	if (atomic_read(&hdev->promisc)) {
3500cd82e61cSMarcel Holtmann 		/* Send copy to the sockets */
3501470fe1b5SMarcel Holtmann 		hci_send_to_sock(hdev, skb);
35021da177e4SLinus Torvalds 	}
35031da177e4SLinus Torvalds 
35041da177e4SLinus Torvalds 	/* Get rid of skb owner, prior to sending to the driver. */
35051da177e4SLinus Torvalds 	skb_orphan(skb);
35061da177e4SLinus Torvalds 
3507cdc52faaSMarcel Holtmann 	err = hdev->send(hdev, skb);
3508cdc52faaSMarcel Holtmann 	if (err < 0) {
3509cdc52faaSMarcel Holtmann 		BT_ERR("%s sending frame failed (%d)", hdev->name, err);
3510cdc52faaSMarcel Holtmann 		kfree_skb(skb);
3511cdc52faaSMarcel Holtmann 	}
35121da177e4SLinus Torvalds }
35131da177e4SLinus Torvalds 
3514899de765SMarcel Holtmann bool hci_req_pending(struct hci_dev *hdev)
3515899de765SMarcel Holtmann {
3516899de765SMarcel Holtmann 	return (hdev->req_status == HCI_REQ_PEND);
3517899de765SMarcel Holtmann }
3518899de765SMarcel Holtmann 
35191ca3a9d0SJohan Hedberg /* Send HCI command */
352007dc93ddSJohan Hedberg int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
352107dc93ddSJohan Hedberg 		 const void *param)
35221ca3a9d0SJohan Hedberg {
35231ca3a9d0SJohan Hedberg 	struct sk_buff *skb;
35241ca3a9d0SJohan Hedberg 
35251ca3a9d0SJohan Hedberg 	BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
35261ca3a9d0SJohan Hedberg 
35271ca3a9d0SJohan Hedberg 	skb = hci_prepare_cmd(hdev, opcode, plen, param);
35281ca3a9d0SJohan Hedberg 	if (!skb) {
35291ca3a9d0SJohan Hedberg 		BT_ERR("%s no memory for command", hdev->name);
35301ca3a9d0SJohan Hedberg 		return -ENOMEM;
35311ca3a9d0SJohan Hedberg 	}
35321ca3a9d0SJohan Hedberg 
353349c922bbSStephen Hemminger 	/* Stand-alone HCI commands must be flagged as
353411714b3dSJohan Hedberg 	 * single-command requests.
353511714b3dSJohan Hedberg 	 */
353611714b3dSJohan Hedberg 	bt_cb(skb)->req.start = true;
353711714b3dSJohan Hedberg 
35381da177e4SLinus Torvalds 	skb_queue_tail(&hdev->cmd_q, skb);
3539c347b765SGustavo F. Padovan 	queue_work(hdev->workqueue, &hdev->cmd_work);
35401da177e4SLinus Torvalds 
35411da177e4SLinus Torvalds 	return 0;
35421da177e4SLinus Torvalds }
35431da177e4SLinus Torvalds 
35441da177e4SLinus Torvalds /* Get data from the previously sent command */
3545a9de9248SMarcel Holtmann void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
35461da177e4SLinus Torvalds {
35471da177e4SLinus Torvalds 	struct hci_command_hdr *hdr;
35481da177e4SLinus Torvalds 
35491da177e4SLinus Torvalds 	if (!hdev->sent_cmd)
35501da177e4SLinus Torvalds 		return NULL;
35511da177e4SLinus Torvalds 
35521da177e4SLinus Torvalds 	hdr = (void *) hdev->sent_cmd->data;
35531da177e4SLinus Torvalds 
3554a9de9248SMarcel Holtmann 	if (hdr->opcode != cpu_to_le16(opcode))
35551da177e4SLinus Torvalds 		return NULL;
35561da177e4SLinus Torvalds 
3557f0e09510SAndrei Emeltchenko 	BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
35581da177e4SLinus Torvalds 
35591da177e4SLinus Torvalds 	return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
35601da177e4SLinus Torvalds }
35611da177e4SLinus Torvalds 
35621da177e4SLinus Torvalds /* Send ACL data */
35631da177e4SLinus Torvalds static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
35641da177e4SLinus Torvalds {
35651da177e4SLinus Torvalds 	struct hci_acl_hdr *hdr;
35661da177e4SLinus Torvalds 	int len = skb->len;
35671da177e4SLinus Torvalds 
3568badff6d0SArnaldo Carvalho de Melo 	skb_push(skb, HCI_ACL_HDR_SIZE);
3569badff6d0SArnaldo Carvalho de Melo 	skb_reset_transport_header(skb);
35709c70220bSArnaldo Carvalho de Melo 	hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3571aca3192cSYOSHIFUJI Hideaki 	hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3572aca3192cSYOSHIFUJI Hideaki 	hdr->dlen   = cpu_to_le16(len);
35731da177e4SLinus Torvalds }
35741da177e4SLinus Torvalds 
3575ee22be7eSAndrei Emeltchenko static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
357673d80debSLuiz Augusto von Dentz 			  struct sk_buff *skb, __u16 flags)
35771da177e4SLinus Torvalds {
3578ee22be7eSAndrei Emeltchenko 	struct hci_conn *conn = chan->conn;
35791da177e4SLinus Torvalds 	struct hci_dev *hdev = conn->hdev;
35801da177e4SLinus Torvalds 	struct sk_buff *list;
35811da177e4SLinus Torvalds 
3582087bfd99SGustavo Padovan 	skb->len = skb_headlen(skb);
3583087bfd99SGustavo Padovan 	skb->data_len = 0;
3584087bfd99SGustavo Padovan 
3585087bfd99SGustavo Padovan 	bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
3586204a6e54SAndrei Emeltchenko 
3587204a6e54SAndrei Emeltchenko 	switch (hdev->dev_type) {
3588204a6e54SAndrei Emeltchenko 	case HCI_BREDR:
3589087bfd99SGustavo Padovan 		hci_add_acl_hdr(skb, conn->handle, flags);
3590204a6e54SAndrei Emeltchenko 		break;
3591204a6e54SAndrei Emeltchenko 	case HCI_AMP:
3592204a6e54SAndrei Emeltchenko 		hci_add_acl_hdr(skb, chan->handle, flags);
3593204a6e54SAndrei Emeltchenko 		break;
3594204a6e54SAndrei Emeltchenko 	default:
3595204a6e54SAndrei Emeltchenko 		BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3596204a6e54SAndrei Emeltchenko 		return;
3597204a6e54SAndrei Emeltchenko 	}
3598087bfd99SGustavo Padovan 
359970f23020SAndrei Emeltchenko 	list = skb_shinfo(skb)->frag_list;
360070f23020SAndrei Emeltchenko 	if (!list) {
36011da177e4SLinus Torvalds 		/* Non fragmented */
36021da177e4SLinus Torvalds 		BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
36031da177e4SLinus Torvalds 
360473d80debSLuiz Augusto von Dentz 		skb_queue_tail(queue, skb);
36051da177e4SLinus Torvalds 	} else {
36061da177e4SLinus Torvalds 		/* Fragmented */
36071da177e4SLinus Torvalds 		BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
36081da177e4SLinus Torvalds 
36091da177e4SLinus Torvalds 		skb_shinfo(skb)->frag_list = NULL;
36101da177e4SLinus Torvalds 
36119cfd5a23SJukka Rissanen 		/* Queue all fragments atomically. We need to use spin_lock_bh
36129cfd5a23SJukka Rissanen 		 * here because of 6LoWPAN links, as there this function is
36139cfd5a23SJukka Rissanen 		 * called from softirq and using normal spin lock could cause
36149cfd5a23SJukka Rissanen 		 * deadlocks.
36159cfd5a23SJukka Rissanen 		 */
36169cfd5a23SJukka Rissanen 		spin_lock_bh(&queue->lock);
36171da177e4SLinus Torvalds 
361873d80debSLuiz Augusto von Dentz 		__skb_queue_tail(queue, skb);
3619e702112fSAndrei Emeltchenko 
3620e702112fSAndrei Emeltchenko 		flags &= ~ACL_START;
3621e702112fSAndrei Emeltchenko 		flags |= ACL_CONT;
36221da177e4SLinus Torvalds 		do {
36231da177e4SLinus Torvalds 			skb = list; list = list->next;
36241da177e4SLinus Torvalds 
36250d48d939SMarcel Holtmann 			bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
3626e702112fSAndrei Emeltchenko 			hci_add_acl_hdr(skb, conn->handle, flags);
36271da177e4SLinus Torvalds 
36281da177e4SLinus Torvalds 			BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
36291da177e4SLinus Torvalds 
363073d80debSLuiz Augusto von Dentz 			__skb_queue_tail(queue, skb);
36311da177e4SLinus Torvalds 		} while (list);
36321da177e4SLinus Torvalds 
36339cfd5a23SJukka Rissanen 		spin_unlock_bh(&queue->lock);
36341da177e4SLinus Torvalds 	}
363573d80debSLuiz Augusto von Dentz }
363673d80debSLuiz Augusto von Dentz 
363773d80debSLuiz Augusto von Dentz void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
363873d80debSLuiz Augusto von Dentz {
3639ee22be7eSAndrei Emeltchenko 	struct hci_dev *hdev = chan->conn->hdev;
364073d80debSLuiz Augusto von Dentz 
3641f0e09510SAndrei Emeltchenko 	BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
364273d80debSLuiz Augusto von Dentz 
3643ee22be7eSAndrei Emeltchenko 	hci_queue_acl(chan, &chan->data_q, skb, flags);
36441da177e4SLinus Torvalds 
36453eff45eaSGustavo F. Padovan 	queue_work(hdev->workqueue, &hdev->tx_work);
36461da177e4SLinus Torvalds }
36471da177e4SLinus Torvalds 
36481da177e4SLinus Torvalds /* Send SCO data */
36490d861d8bSGustavo F. Padovan void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
36501da177e4SLinus Torvalds {
36511da177e4SLinus Torvalds 	struct hci_dev *hdev = conn->hdev;
36521da177e4SLinus Torvalds 	struct hci_sco_hdr hdr;
36531da177e4SLinus Torvalds 
36541da177e4SLinus Torvalds 	BT_DBG("%s len %d", hdev->name, skb->len);
36551da177e4SLinus Torvalds 
3656aca3192cSYOSHIFUJI Hideaki 	hdr.handle = cpu_to_le16(conn->handle);
36571da177e4SLinus Torvalds 	hdr.dlen   = skb->len;
36581da177e4SLinus Torvalds 
3659badff6d0SArnaldo Carvalho de Melo 	skb_push(skb, HCI_SCO_HDR_SIZE);
3660badff6d0SArnaldo Carvalho de Melo 	skb_reset_transport_header(skb);
36619c70220bSArnaldo Carvalho de Melo 	memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
36621da177e4SLinus Torvalds 
36630d48d939SMarcel Holtmann 	bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
3664c78ae283SMarcel Holtmann 
36651da177e4SLinus Torvalds 	skb_queue_tail(&conn->data_q, skb);
36663eff45eaSGustavo F. Padovan 	queue_work(hdev->workqueue, &hdev->tx_work);
36671da177e4SLinus Torvalds }
36681da177e4SLinus Torvalds 
36691da177e4SLinus Torvalds /* ---- HCI TX task (outgoing data) ---- */
36701da177e4SLinus Torvalds 
36711da177e4SLinus Torvalds /* HCI Connection scheduler */
36726039aa73SGustavo Padovan static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3673a8c5fb1aSGustavo Padovan 				     int *quote)
36741da177e4SLinus Torvalds {
36751da177e4SLinus Torvalds 	struct hci_conn_hash *h = &hdev->conn_hash;
36768035ded4SLuiz Augusto von Dentz 	struct hci_conn *conn = NULL, *c;
3677abc5de8fSMikel Astiz 	unsigned int num = 0, min = ~0;
36781da177e4SLinus Torvalds 
36791da177e4SLinus Torvalds 	/* We don't have to lock device here. Connections are always
36801da177e4SLinus Torvalds 	 * added and removed with TX task disabled. */
3681bf4c6325SGustavo F. Padovan 
3682bf4c6325SGustavo F. Padovan 	rcu_read_lock();
3683bf4c6325SGustavo F. Padovan 
3684bf4c6325SGustavo F. Padovan 	list_for_each_entry_rcu(c, &h->list, list) {
3685769be974SMarcel Holtmann 		if (c->type != type || skb_queue_empty(&c->data_q))
36861da177e4SLinus Torvalds 			continue;
3687769be974SMarcel Holtmann 
3688769be974SMarcel Holtmann 		if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3689769be974SMarcel Holtmann 			continue;
3690769be974SMarcel Holtmann 
36911da177e4SLinus Torvalds 		num++;
36921da177e4SLinus Torvalds 
36931da177e4SLinus Torvalds 		if (c->sent < min) {
36941da177e4SLinus Torvalds 			min  = c->sent;
36951da177e4SLinus Torvalds 			conn = c;
36961da177e4SLinus Torvalds 		}
369752087a79SLuiz Augusto von Dentz 
369852087a79SLuiz Augusto von Dentz 		if (hci_conn_num(hdev, type) == num)
369952087a79SLuiz Augusto von Dentz 			break;
37001da177e4SLinus Torvalds 	}
37011da177e4SLinus Torvalds 
3702bf4c6325SGustavo F. Padovan 	rcu_read_unlock();
3703bf4c6325SGustavo F. Padovan 
37041da177e4SLinus Torvalds 	if (conn) {
37056ed58ec5SVille Tervo 		int cnt, q;
37066ed58ec5SVille Tervo 
37076ed58ec5SVille Tervo 		switch (conn->type) {
37086ed58ec5SVille Tervo 		case ACL_LINK:
37096ed58ec5SVille Tervo 			cnt = hdev->acl_cnt;
37106ed58ec5SVille Tervo 			break;
37116ed58ec5SVille Tervo 		case SCO_LINK:
37126ed58ec5SVille Tervo 		case ESCO_LINK:
37136ed58ec5SVille Tervo 			cnt = hdev->sco_cnt;
37146ed58ec5SVille Tervo 			break;
37156ed58ec5SVille Tervo 		case LE_LINK:
37166ed58ec5SVille Tervo 			cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
37176ed58ec5SVille Tervo 			break;
37186ed58ec5SVille Tervo 		default:
37196ed58ec5SVille Tervo 			cnt = 0;
37206ed58ec5SVille Tervo 			BT_ERR("Unknown link type");
37216ed58ec5SVille Tervo 		}
37226ed58ec5SVille Tervo 
37236ed58ec5SVille Tervo 		q = cnt / num;
37241da177e4SLinus Torvalds 		*quote = q ? q : 1;
37251da177e4SLinus Torvalds 	} else
37261da177e4SLinus Torvalds 		*quote = 0;
37271da177e4SLinus Torvalds 
37281da177e4SLinus Torvalds 	BT_DBG("conn %p quote %d", conn, *quote);
37291da177e4SLinus Torvalds 	return conn;
37301da177e4SLinus Torvalds }
37311da177e4SLinus Torvalds 
37326039aa73SGustavo Padovan static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
37331da177e4SLinus Torvalds {
37341da177e4SLinus Torvalds 	struct hci_conn_hash *h = &hdev->conn_hash;
37351da177e4SLinus Torvalds 	struct hci_conn *c;
37361da177e4SLinus Torvalds 
3737bae1f5d9SVille Tervo 	BT_ERR("%s link tx timeout", hdev->name);
37381da177e4SLinus Torvalds 
3739bf4c6325SGustavo F. Padovan 	rcu_read_lock();
3740bf4c6325SGustavo F. Padovan 
37411da177e4SLinus Torvalds 	/* Kill stalled connections */
3742bf4c6325SGustavo F. Padovan 	list_for_each_entry_rcu(c, &h->list, list) {
3743bae1f5d9SVille Tervo 		if (c->type == type && c->sent) {
37446ed93dc6SAndrei Emeltchenko 			BT_ERR("%s killing stalled connection %pMR",
37456ed93dc6SAndrei Emeltchenko 			       hdev->name, &c->dst);
3746bed71748SAndre Guedes 			hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
37471da177e4SLinus Torvalds 		}
37481da177e4SLinus Torvalds 	}
3749bf4c6325SGustavo F. Padovan 
3750bf4c6325SGustavo F. Padovan 	rcu_read_unlock();
37511da177e4SLinus Torvalds }
37521da177e4SLinus Torvalds 
37536039aa73SGustavo Padovan static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
375473d80debSLuiz Augusto von Dentz 				      int *quote)
375573d80debSLuiz Augusto von Dentz {
375673d80debSLuiz Augusto von Dentz 	struct hci_conn_hash *h = &hdev->conn_hash;
375773d80debSLuiz Augusto von Dentz 	struct hci_chan *chan = NULL;
3758abc5de8fSMikel Astiz 	unsigned int num = 0, min = ~0, cur_prio = 0;
375973d80debSLuiz Augusto von Dentz 	struct hci_conn *conn;
376073d80debSLuiz Augusto von Dentz 	int cnt, q, conn_num = 0;
376173d80debSLuiz Augusto von Dentz 
376273d80debSLuiz Augusto von Dentz 	BT_DBG("%s", hdev->name);
376373d80debSLuiz Augusto von Dentz 
3764bf4c6325SGustavo F. Padovan 	rcu_read_lock();
3765bf4c6325SGustavo F. Padovan 
3766bf4c6325SGustavo F. Padovan 	list_for_each_entry_rcu(conn, &h->list, list) {
376773d80debSLuiz Augusto von Dentz 		struct hci_chan *tmp;
376873d80debSLuiz Augusto von Dentz 
376973d80debSLuiz Augusto von Dentz 		if (conn->type != type)
377073d80debSLuiz Augusto von Dentz 			continue;
377173d80debSLuiz Augusto von Dentz 
377273d80debSLuiz Augusto von Dentz 		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
377373d80debSLuiz Augusto von Dentz 			continue;
377473d80debSLuiz Augusto von Dentz 
377573d80debSLuiz Augusto von Dentz 		conn_num++;
377673d80debSLuiz Augusto von Dentz 
37778192edefSGustavo F. Padovan 		list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
377873d80debSLuiz Augusto von Dentz 			struct sk_buff *skb;
377973d80debSLuiz Augusto von Dentz 
378073d80debSLuiz Augusto von Dentz 			if (skb_queue_empty(&tmp->data_q))
378173d80debSLuiz Augusto von Dentz 				continue;
378273d80debSLuiz Augusto von Dentz 
378373d80debSLuiz Augusto von Dentz 			skb = skb_peek(&tmp->data_q);
378473d80debSLuiz Augusto von Dentz 			if (skb->priority < cur_prio)
378573d80debSLuiz Augusto von Dentz 				continue;
378673d80debSLuiz Augusto von Dentz 
378773d80debSLuiz Augusto von Dentz 			if (skb->priority > cur_prio) {
378873d80debSLuiz Augusto von Dentz 				num = 0;
378973d80debSLuiz Augusto von Dentz 				min = ~0;
379073d80debSLuiz Augusto von Dentz 				cur_prio = skb->priority;
379173d80debSLuiz Augusto von Dentz 			}
379273d80debSLuiz Augusto von Dentz 
379373d80debSLuiz Augusto von Dentz 			num++;
379473d80debSLuiz Augusto von Dentz 
379573d80debSLuiz Augusto von Dentz 			if (conn->sent < min) {
379673d80debSLuiz Augusto von Dentz 				min  = conn->sent;
379773d80debSLuiz Augusto von Dentz 				chan = tmp;
379873d80debSLuiz Augusto von Dentz 			}
379973d80debSLuiz Augusto von Dentz 		}
380073d80debSLuiz Augusto von Dentz 
380173d80debSLuiz Augusto von Dentz 		if (hci_conn_num(hdev, type) == conn_num)
380273d80debSLuiz Augusto von Dentz 			break;
380373d80debSLuiz Augusto von Dentz 	}
380473d80debSLuiz Augusto von Dentz 
3805bf4c6325SGustavo F. Padovan 	rcu_read_unlock();
3806bf4c6325SGustavo F. Padovan 
380773d80debSLuiz Augusto von Dentz 	if (!chan)
380873d80debSLuiz Augusto von Dentz 		return NULL;
380973d80debSLuiz Augusto von Dentz 
381073d80debSLuiz Augusto von Dentz 	switch (chan->conn->type) {
381173d80debSLuiz Augusto von Dentz 	case ACL_LINK:
381273d80debSLuiz Augusto von Dentz 		cnt = hdev->acl_cnt;
381373d80debSLuiz Augusto von Dentz 		break;
3814bd1eb66bSAndrei Emeltchenko 	case AMP_LINK:
3815bd1eb66bSAndrei Emeltchenko 		cnt = hdev->block_cnt;
3816bd1eb66bSAndrei Emeltchenko 		break;
381773d80debSLuiz Augusto von Dentz 	case SCO_LINK:
381873d80debSLuiz Augusto von Dentz 	case ESCO_LINK:
381973d80debSLuiz Augusto von Dentz 		cnt = hdev->sco_cnt;
382073d80debSLuiz Augusto von Dentz 		break;
382173d80debSLuiz Augusto von Dentz 	case LE_LINK:
382273d80debSLuiz Augusto von Dentz 		cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
382373d80debSLuiz Augusto von Dentz 		break;
382473d80debSLuiz Augusto von Dentz 	default:
382573d80debSLuiz Augusto von Dentz 		cnt = 0;
382673d80debSLuiz Augusto von Dentz 		BT_ERR("Unknown link type");
382773d80debSLuiz Augusto von Dentz 	}
382873d80debSLuiz Augusto von Dentz 
382973d80debSLuiz Augusto von Dentz 	q = cnt / num;
383073d80debSLuiz Augusto von Dentz 	*quote = q ? q : 1;
383173d80debSLuiz Augusto von Dentz 	BT_DBG("chan %p quote %d", chan, *quote);
383273d80debSLuiz Augusto von Dentz 	return chan;
383373d80debSLuiz Augusto von Dentz }
383473d80debSLuiz Augusto von Dentz 
383502b20f0bSLuiz Augusto von Dentz static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
383602b20f0bSLuiz Augusto von Dentz {
383702b20f0bSLuiz Augusto von Dentz 	struct hci_conn_hash *h = &hdev->conn_hash;
383802b20f0bSLuiz Augusto von Dentz 	struct hci_conn *conn;
383902b20f0bSLuiz Augusto von Dentz 	int num = 0;
384002b20f0bSLuiz Augusto von Dentz 
384102b20f0bSLuiz Augusto von Dentz 	BT_DBG("%s", hdev->name);
384202b20f0bSLuiz Augusto von Dentz 
3843bf4c6325SGustavo F. Padovan 	rcu_read_lock();
3844bf4c6325SGustavo F. Padovan 
3845bf4c6325SGustavo F. Padovan 	list_for_each_entry_rcu(conn, &h->list, list) {
384602b20f0bSLuiz Augusto von Dentz 		struct hci_chan *chan;
384702b20f0bSLuiz Augusto von Dentz 
384802b20f0bSLuiz Augusto von Dentz 		if (conn->type != type)
384902b20f0bSLuiz Augusto von Dentz 			continue;
385002b20f0bSLuiz Augusto von Dentz 
385102b20f0bSLuiz Augusto von Dentz 		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
385202b20f0bSLuiz Augusto von Dentz 			continue;
385302b20f0bSLuiz Augusto von Dentz 
385402b20f0bSLuiz Augusto von Dentz 		num++;
385502b20f0bSLuiz Augusto von Dentz 
38568192edefSGustavo F. Padovan 		list_for_each_entry_rcu(chan, &conn->chan_list, list) {
385702b20f0bSLuiz Augusto von Dentz 			struct sk_buff *skb;
385802b20f0bSLuiz Augusto von Dentz 
385902b20f0bSLuiz Augusto von Dentz 			if (chan->sent) {
386002b20f0bSLuiz Augusto von Dentz 				chan->sent = 0;
386102b20f0bSLuiz Augusto von Dentz 				continue;
386202b20f0bSLuiz Augusto von Dentz 			}
386302b20f0bSLuiz Augusto von Dentz 
386402b20f0bSLuiz Augusto von Dentz 			if (skb_queue_empty(&chan->data_q))
386502b20f0bSLuiz Augusto von Dentz 				continue;
386602b20f0bSLuiz Augusto von Dentz 
386702b20f0bSLuiz Augusto von Dentz 			skb = skb_peek(&chan->data_q);
386802b20f0bSLuiz Augusto von Dentz 			if (skb->priority >= HCI_PRIO_MAX - 1)
386902b20f0bSLuiz Augusto von Dentz 				continue;
387002b20f0bSLuiz Augusto von Dentz 
387102b20f0bSLuiz Augusto von Dentz 			skb->priority = HCI_PRIO_MAX - 1;
387202b20f0bSLuiz Augusto von Dentz 
387302b20f0bSLuiz Augusto von Dentz 			BT_DBG("chan %p skb %p promoted to %d", chan, skb,
387402b20f0bSLuiz Augusto von Dentz 			       skb->priority);
387502b20f0bSLuiz Augusto von Dentz 		}
387602b20f0bSLuiz Augusto von Dentz 
387702b20f0bSLuiz Augusto von Dentz 		if (hci_conn_num(hdev, type) == num)
387802b20f0bSLuiz Augusto von Dentz 			break;
387902b20f0bSLuiz Augusto von Dentz 	}
3880bf4c6325SGustavo F. Padovan 
3881bf4c6325SGustavo F. Padovan 	rcu_read_unlock();
3882bf4c6325SGustavo F. Padovan 
388302b20f0bSLuiz Augusto von Dentz }
388402b20f0bSLuiz Augusto von Dentz 
3885b71d385aSAndrei Emeltchenko static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3886b71d385aSAndrei Emeltchenko {
3887b71d385aSAndrei Emeltchenko 	/* Calculate count of blocks used by this packet */
3888b71d385aSAndrei Emeltchenko 	return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3889b71d385aSAndrei Emeltchenko }
3890b71d385aSAndrei Emeltchenko 
38916039aa73SGustavo Padovan static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
38921da177e4SLinus Torvalds {
38934a964404SMarcel Holtmann 	if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
38941da177e4SLinus Torvalds 		/* ACL tx timeout must be longer than maximum
38951da177e4SLinus Torvalds 		 * link supervision timeout (40.9 seconds) */
389663d2bc1bSAndrei Emeltchenko 		if (!cnt && time_after(jiffies, hdev->acl_last_tx +
38975f246e89SAndrei Emeltchenko 				       HCI_ACL_TX_TIMEOUT))
3898bae1f5d9SVille Tervo 			hci_link_tx_to(hdev, ACL_LINK);
38991da177e4SLinus Torvalds 	}
390063d2bc1bSAndrei Emeltchenko }
39011da177e4SLinus Torvalds 
39026039aa73SGustavo Padovan static void hci_sched_acl_pkt(struct hci_dev *hdev)
390363d2bc1bSAndrei Emeltchenko {
390463d2bc1bSAndrei Emeltchenko 	unsigned int cnt = hdev->acl_cnt;
390563d2bc1bSAndrei Emeltchenko 	struct hci_chan *chan;
390663d2bc1bSAndrei Emeltchenko 	struct sk_buff *skb;
390763d2bc1bSAndrei Emeltchenko 	int quote;
390863d2bc1bSAndrei Emeltchenko 
390963d2bc1bSAndrei Emeltchenko 	__check_timeout(hdev, cnt);
391004837f64SMarcel Holtmann 
391173d80debSLuiz Augusto von Dentz 	while (hdev->acl_cnt &&
391273d80debSLuiz Augusto von Dentz 	       (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3913ec1cce24SLuiz Augusto von Dentz 		u32 priority = (skb_peek(&chan->data_q))->priority;
3914ec1cce24SLuiz Augusto von Dentz 		while (quote-- && (skb = skb_peek(&chan->data_q))) {
391573d80debSLuiz Augusto von Dentz 			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
391673d80debSLuiz Augusto von Dentz 			       skb->len, skb->priority);
391773d80debSLuiz Augusto von Dentz 
3918ec1cce24SLuiz Augusto von Dentz 			/* Stop if priority has changed */
3919ec1cce24SLuiz Augusto von Dentz 			if (skb->priority < priority)
3920ec1cce24SLuiz Augusto von Dentz 				break;
3921ec1cce24SLuiz Augusto von Dentz 
3922ec1cce24SLuiz Augusto von Dentz 			skb = skb_dequeue(&chan->data_q);
3923ec1cce24SLuiz Augusto von Dentz 
392473d80debSLuiz Augusto von Dentz 			hci_conn_enter_active_mode(chan->conn,
392573d80debSLuiz Augusto von Dentz 						   bt_cb(skb)->force_active);
392604837f64SMarcel Holtmann 
392757d17d70SMarcel Holtmann 			hci_send_frame(hdev, skb);
39281da177e4SLinus Torvalds 			hdev->acl_last_tx = jiffies;
39291da177e4SLinus Torvalds 
39301da177e4SLinus Torvalds 			hdev->acl_cnt--;
393173d80debSLuiz Augusto von Dentz 			chan->sent++;
393273d80debSLuiz Augusto von Dentz 			chan->conn->sent++;
39331da177e4SLinus Torvalds 		}
39341da177e4SLinus Torvalds 	}
393502b20f0bSLuiz Augusto von Dentz 
393602b20f0bSLuiz Augusto von Dentz 	if (cnt != hdev->acl_cnt)
393702b20f0bSLuiz Augusto von Dentz 		hci_prio_recalculate(hdev, ACL_LINK);
39381da177e4SLinus Torvalds }
39391da177e4SLinus Torvalds 
39406039aa73SGustavo Padovan static void hci_sched_acl_blk(struct hci_dev *hdev)
3941b71d385aSAndrei Emeltchenko {
394263d2bc1bSAndrei Emeltchenko 	unsigned int cnt = hdev->block_cnt;
3943b71d385aSAndrei Emeltchenko 	struct hci_chan *chan;
3944b71d385aSAndrei Emeltchenko 	struct sk_buff *skb;
3945b71d385aSAndrei Emeltchenko 	int quote;
3946bd1eb66bSAndrei Emeltchenko 	u8 type;
3947b71d385aSAndrei Emeltchenko 
394863d2bc1bSAndrei Emeltchenko 	__check_timeout(hdev, cnt);
3949b71d385aSAndrei Emeltchenko 
3950bd1eb66bSAndrei Emeltchenko 	BT_DBG("%s", hdev->name);
3951bd1eb66bSAndrei Emeltchenko 
3952bd1eb66bSAndrei Emeltchenko 	if (hdev->dev_type == HCI_AMP)
3953bd1eb66bSAndrei Emeltchenko 		type = AMP_LINK;
3954bd1eb66bSAndrei Emeltchenko 	else
3955bd1eb66bSAndrei Emeltchenko 		type = ACL_LINK;
3956bd1eb66bSAndrei Emeltchenko 
3957b71d385aSAndrei Emeltchenko 	while (hdev->block_cnt > 0 &&
3958bd1eb66bSAndrei Emeltchenko 	       (chan = hci_chan_sent(hdev, type, &quote))) {
3959b71d385aSAndrei Emeltchenko 		u32 priority = (skb_peek(&chan->data_q))->priority;
3960b71d385aSAndrei Emeltchenko 		while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3961b71d385aSAndrei Emeltchenko 			int blocks;
3962b71d385aSAndrei Emeltchenko 
3963b71d385aSAndrei Emeltchenko 			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3964b71d385aSAndrei Emeltchenko 			       skb->len, skb->priority);
3965b71d385aSAndrei Emeltchenko 
3966b71d385aSAndrei Emeltchenko 			/* Stop if priority has changed */
3967b71d385aSAndrei Emeltchenko 			if (skb->priority < priority)
3968b71d385aSAndrei Emeltchenko 				break;
3969b71d385aSAndrei Emeltchenko 
3970b71d385aSAndrei Emeltchenko 			skb = skb_dequeue(&chan->data_q);
3971b71d385aSAndrei Emeltchenko 
3972b71d385aSAndrei Emeltchenko 			blocks = __get_blocks(hdev, skb);
3973b71d385aSAndrei Emeltchenko 			if (blocks > hdev->block_cnt)
3974b71d385aSAndrei Emeltchenko 				return;
3975b71d385aSAndrei Emeltchenko 
3976b71d385aSAndrei Emeltchenko 			hci_conn_enter_active_mode(chan->conn,
3977b71d385aSAndrei Emeltchenko 						   bt_cb(skb)->force_active);
3978b71d385aSAndrei Emeltchenko 
397957d17d70SMarcel Holtmann 			hci_send_frame(hdev, skb);
3980b71d385aSAndrei Emeltchenko 			hdev->acl_last_tx = jiffies;
3981b71d385aSAndrei Emeltchenko 
3982b71d385aSAndrei Emeltchenko 			hdev->block_cnt -= blocks;
3983b71d385aSAndrei Emeltchenko 			quote -= blocks;
3984b71d385aSAndrei Emeltchenko 
3985b71d385aSAndrei Emeltchenko 			chan->sent += blocks;
3986b71d385aSAndrei Emeltchenko 			chan->conn->sent += blocks;
3987b71d385aSAndrei Emeltchenko 		}
3988b71d385aSAndrei Emeltchenko 	}
3989b71d385aSAndrei Emeltchenko 
3990b71d385aSAndrei Emeltchenko 	if (cnt != hdev->block_cnt)
3991bd1eb66bSAndrei Emeltchenko 		hci_prio_recalculate(hdev, type);
3992b71d385aSAndrei Emeltchenko }
3993b71d385aSAndrei Emeltchenko 
39946039aa73SGustavo Padovan static void hci_sched_acl(struct hci_dev *hdev)
3995b71d385aSAndrei Emeltchenko {
3996b71d385aSAndrei Emeltchenko 	BT_DBG("%s", hdev->name);
3997b71d385aSAndrei Emeltchenko 
3998bd1eb66bSAndrei Emeltchenko 	/* No ACL link over BR/EDR controller */
3999bd1eb66bSAndrei Emeltchenko 	if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
4000bd1eb66bSAndrei Emeltchenko 		return;
4001bd1eb66bSAndrei Emeltchenko 
4002bd1eb66bSAndrei Emeltchenko 	/* No AMP link over AMP controller */
4003bd1eb66bSAndrei Emeltchenko 	if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4004b71d385aSAndrei Emeltchenko 		return;
4005b71d385aSAndrei Emeltchenko 
4006b71d385aSAndrei Emeltchenko 	switch (hdev->flow_ctl_mode) {
4007b71d385aSAndrei Emeltchenko 	case HCI_FLOW_CTL_MODE_PACKET_BASED:
4008b71d385aSAndrei Emeltchenko 		hci_sched_acl_pkt(hdev);
4009b71d385aSAndrei Emeltchenko 		break;
4010b71d385aSAndrei Emeltchenko 
4011b71d385aSAndrei Emeltchenko 	case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4012b71d385aSAndrei Emeltchenko 		hci_sched_acl_blk(hdev);
4013b71d385aSAndrei Emeltchenko 		break;
4014b71d385aSAndrei Emeltchenko 	}
4015b71d385aSAndrei Emeltchenko }
4016b71d385aSAndrei Emeltchenko 
40171da177e4SLinus Torvalds /* Schedule SCO */
40186039aa73SGustavo Padovan static void hci_sched_sco(struct hci_dev *hdev)
40191da177e4SLinus Torvalds {
40201da177e4SLinus Torvalds 	struct hci_conn *conn;
40211da177e4SLinus Torvalds 	struct sk_buff *skb;
40221da177e4SLinus Torvalds 	int quote;
40231da177e4SLinus Torvalds 
40241da177e4SLinus Torvalds 	BT_DBG("%s", hdev->name);
40251da177e4SLinus Torvalds 
402652087a79SLuiz Augusto von Dentz 	if (!hci_conn_num(hdev, SCO_LINK))
402752087a79SLuiz Augusto von Dentz 		return;
402852087a79SLuiz Augusto von Dentz 
40291da177e4SLinus Torvalds 	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
40301da177e4SLinus Torvalds 		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
40311da177e4SLinus Torvalds 			BT_DBG("skb %p len %d", skb, skb->len);
403257d17d70SMarcel Holtmann 			hci_send_frame(hdev, skb);
40331da177e4SLinus Torvalds 
40341da177e4SLinus Torvalds 			conn->sent++;
40351da177e4SLinus Torvalds 			if (conn->sent == ~0)
40361da177e4SLinus Torvalds 				conn->sent = 0;
40371da177e4SLinus Torvalds 		}
40381da177e4SLinus Torvalds 	}
40391da177e4SLinus Torvalds }
40401da177e4SLinus Torvalds 
40416039aa73SGustavo Padovan static void hci_sched_esco(struct hci_dev *hdev)
4042b6a0dc82SMarcel Holtmann {
4043b6a0dc82SMarcel Holtmann 	struct hci_conn *conn;
4044b6a0dc82SMarcel Holtmann 	struct sk_buff *skb;
4045b6a0dc82SMarcel Holtmann 	int quote;
4046b6a0dc82SMarcel Holtmann 
4047b6a0dc82SMarcel Holtmann 	BT_DBG("%s", hdev->name);
4048b6a0dc82SMarcel Holtmann 
404952087a79SLuiz Augusto von Dentz 	if (!hci_conn_num(hdev, ESCO_LINK))
405052087a79SLuiz Augusto von Dentz 		return;
405152087a79SLuiz Augusto von Dentz 
40528fc9ced3SGustavo Padovan 	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
40538fc9ced3SGustavo Padovan 						     &quote))) {
4054b6a0dc82SMarcel Holtmann 		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4055b6a0dc82SMarcel Holtmann 			BT_DBG("skb %p len %d", skb, skb->len);
405657d17d70SMarcel Holtmann 			hci_send_frame(hdev, skb);
4057b6a0dc82SMarcel Holtmann 
4058b6a0dc82SMarcel Holtmann 			conn->sent++;
4059b6a0dc82SMarcel Holtmann 			if (conn->sent == ~0)
4060b6a0dc82SMarcel Holtmann 				conn->sent = 0;
4061b6a0dc82SMarcel Holtmann 		}
4062b6a0dc82SMarcel Holtmann 	}
4063b6a0dc82SMarcel Holtmann }
4064b6a0dc82SMarcel Holtmann 
40656039aa73SGustavo Padovan static void hci_sched_le(struct hci_dev *hdev)
40666ed58ec5SVille Tervo {
406773d80debSLuiz Augusto von Dentz 	struct hci_chan *chan;
40686ed58ec5SVille Tervo 	struct sk_buff *skb;
406902b20f0bSLuiz Augusto von Dentz 	int quote, cnt, tmp;
40706ed58ec5SVille Tervo 
40716ed58ec5SVille Tervo 	BT_DBG("%s", hdev->name);
40726ed58ec5SVille Tervo 
407352087a79SLuiz Augusto von Dentz 	if (!hci_conn_num(hdev, LE_LINK))
407452087a79SLuiz Augusto von Dentz 		return;
407552087a79SLuiz Augusto von Dentz 
40764a964404SMarcel Holtmann 	if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
40776ed58ec5SVille Tervo 		/* LE tx timeout must be longer than maximum
40786ed58ec5SVille Tervo 		 * link supervision timeout (40.9 seconds) */
4079bae1f5d9SVille Tervo 		if (!hdev->le_cnt && hdev->le_pkts &&
40806ed58ec5SVille Tervo 		    time_after(jiffies, hdev->le_last_tx + HZ * 45))
4081bae1f5d9SVille Tervo 			hci_link_tx_to(hdev, LE_LINK);
40826ed58ec5SVille Tervo 	}
40836ed58ec5SVille Tervo 
40846ed58ec5SVille Tervo 	cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
408502b20f0bSLuiz Augusto von Dentz 	tmp = cnt;
408673d80debSLuiz Augusto von Dentz 	while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
4087ec1cce24SLuiz Augusto von Dentz 		u32 priority = (skb_peek(&chan->data_q))->priority;
4088ec1cce24SLuiz Augusto von Dentz 		while (quote-- && (skb = skb_peek(&chan->data_q))) {
408973d80debSLuiz Augusto von Dentz 			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
409073d80debSLuiz Augusto von Dentz 			       skb->len, skb->priority);
40916ed58ec5SVille Tervo 
4092ec1cce24SLuiz Augusto von Dentz 			/* Stop if priority has changed */
4093ec1cce24SLuiz Augusto von Dentz 			if (skb->priority < priority)
4094ec1cce24SLuiz Augusto von Dentz 				break;
4095ec1cce24SLuiz Augusto von Dentz 
4096ec1cce24SLuiz Augusto von Dentz 			skb = skb_dequeue(&chan->data_q);
4097ec1cce24SLuiz Augusto von Dentz 
409857d17d70SMarcel Holtmann 			hci_send_frame(hdev, skb);
40996ed58ec5SVille Tervo 			hdev->le_last_tx = jiffies;
41006ed58ec5SVille Tervo 
41016ed58ec5SVille Tervo 			cnt--;
410273d80debSLuiz Augusto von Dentz 			chan->sent++;
410373d80debSLuiz Augusto von Dentz 			chan->conn->sent++;
41046ed58ec5SVille Tervo 		}
41056ed58ec5SVille Tervo 	}
410673d80debSLuiz Augusto von Dentz 
41076ed58ec5SVille Tervo 	if (hdev->le_pkts)
41086ed58ec5SVille Tervo 		hdev->le_cnt = cnt;
41096ed58ec5SVille Tervo 	else
41106ed58ec5SVille Tervo 		hdev->acl_cnt = cnt;
411102b20f0bSLuiz Augusto von Dentz 
411202b20f0bSLuiz Augusto von Dentz 	if (cnt != tmp)
411302b20f0bSLuiz Augusto von Dentz 		hci_prio_recalculate(hdev, LE_LINK);
41146ed58ec5SVille Tervo }
41156ed58ec5SVille Tervo 
41163eff45eaSGustavo F. Padovan static void hci_tx_work(struct work_struct *work)
41171da177e4SLinus Torvalds {
41183eff45eaSGustavo F. Padovan 	struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
41191da177e4SLinus Torvalds 	struct sk_buff *skb;
41201da177e4SLinus Torvalds 
41216ed58ec5SVille Tervo 	BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
41226ed58ec5SVille Tervo 	       hdev->sco_cnt, hdev->le_cnt);
41231da177e4SLinus Torvalds 
412452de599eSMarcel Holtmann 	if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
41251da177e4SLinus Torvalds 		/* Schedule queues and send stuff to HCI driver */
41261da177e4SLinus Torvalds 		hci_sched_acl(hdev);
41271da177e4SLinus Torvalds 		hci_sched_sco(hdev);
4128b6a0dc82SMarcel Holtmann 		hci_sched_esco(hdev);
41296ed58ec5SVille Tervo 		hci_sched_le(hdev);
413052de599eSMarcel Holtmann 	}
41316ed58ec5SVille Tervo 
41321da177e4SLinus Torvalds 	/* Send next queued raw (unknown type) packet */
41331da177e4SLinus Torvalds 	while ((skb = skb_dequeue(&hdev->raw_q)))
413457d17d70SMarcel Holtmann 		hci_send_frame(hdev, skb);
41351da177e4SLinus Torvalds }
41361da177e4SLinus Torvalds 
413725985edcSLucas De Marchi /* ----- HCI RX task (incoming data processing) ----- */
41381da177e4SLinus Torvalds 
41391da177e4SLinus Torvalds /* ACL data packet */
41406039aa73SGustavo Padovan static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
41411da177e4SLinus Torvalds {
41421da177e4SLinus Torvalds 	struct hci_acl_hdr *hdr = (void *) skb->data;
41431da177e4SLinus Torvalds 	struct hci_conn *conn;
41441da177e4SLinus Torvalds 	__u16 handle, flags;
41451da177e4SLinus Torvalds 
41461da177e4SLinus Torvalds 	skb_pull(skb, HCI_ACL_HDR_SIZE);
41471da177e4SLinus Torvalds 
41481da177e4SLinus Torvalds 	handle = __le16_to_cpu(hdr->handle);
41491da177e4SLinus Torvalds 	flags  = hci_flags(handle);
41501da177e4SLinus Torvalds 	handle = hci_handle(handle);
41511da177e4SLinus Torvalds 
4152f0e09510SAndrei Emeltchenko 	BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4153a8c5fb1aSGustavo Padovan 	       handle, flags);
41541da177e4SLinus Torvalds 
41551da177e4SLinus Torvalds 	hdev->stat.acl_rx++;
41561da177e4SLinus Torvalds 
41571da177e4SLinus Torvalds 	hci_dev_lock(hdev);
41581da177e4SLinus Torvalds 	conn = hci_conn_hash_lookup_handle(hdev, handle);
41591da177e4SLinus Torvalds 	hci_dev_unlock(hdev);
41601da177e4SLinus Torvalds 
41611da177e4SLinus Torvalds 	if (conn) {
416265983fc7SMat Martineau 		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
416304837f64SMarcel Holtmann 
41641da177e4SLinus Torvalds 		/* Send to upper protocol */
4165686ebf28SUlisses Furquim 		l2cap_recv_acldata(conn, skb, flags);
41661da177e4SLinus Torvalds 		return;
41671da177e4SLinus Torvalds 	} else {
41681da177e4SLinus Torvalds 		BT_ERR("%s ACL packet for unknown connection handle %d",
41691da177e4SLinus Torvalds 		       hdev->name, handle);
41701da177e4SLinus Torvalds 	}
41711da177e4SLinus Torvalds 
41721da177e4SLinus Torvalds 	kfree_skb(skb);
41731da177e4SLinus Torvalds }
41741da177e4SLinus Torvalds 
41751da177e4SLinus Torvalds /* SCO data packet */
41766039aa73SGustavo Padovan static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
41771da177e4SLinus Torvalds {
41781da177e4SLinus Torvalds 	struct hci_sco_hdr *hdr = (void *) skb->data;
41791da177e4SLinus Torvalds 	struct hci_conn *conn;
41801da177e4SLinus Torvalds 	__u16 handle;
41811da177e4SLinus Torvalds 
41821da177e4SLinus Torvalds 	skb_pull(skb, HCI_SCO_HDR_SIZE);
41831da177e4SLinus Torvalds 
41841da177e4SLinus Torvalds 	handle = __le16_to_cpu(hdr->handle);
41851da177e4SLinus Torvalds 
4186f0e09510SAndrei Emeltchenko 	BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
41871da177e4SLinus Torvalds 
41881da177e4SLinus Torvalds 	hdev->stat.sco_rx++;
41891da177e4SLinus Torvalds 
41901da177e4SLinus Torvalds 	hci_dev_lock(hdev);
41911da177e4SLinus Torvalds 	conn = hci_conn_hash_lookup_handle(hdev, handle);
41921da177e4SLinus Torvalds 	hci_dev_unlock(hdev);
41931da177e4SLinus Torvalds 
41941da177e4SLinus Torvalds 	if (conn) {
41951da177e4SLinus Torvalds 		/* Send to upper protocol */
4196686ebf28SUlisses Furquim 		sco_recv_scodata(conn, skb);
41971da177e4SLinus Torvalds 		return;
41981da177e4SLinus Torvalds 	} else {
41991da177e4SLinus Torvalds 		BT_ERR("%s SCO packet for unknown connection handle %d",
42001da177e4SLinus Torvalds 		       hdev->name, handle);
42011da177e4SLinus Torvalds 	}
42021da177e4SLinus Torvalds 
42031da177e4SLinus Torvalds 	kfree_skb(skb);
42041da177e4SLinus Torvalds }
42051da177e4SLinus Torvalds 
42069238f36aSJohan Hedberg static bool hci_req_is_complete(struct hci_dev *hdev)
42079238f36aSJohan Hedberg {
42089238f36aSJohan Hedberg 	struct sk_buff *skb;
42099238f36aSJohan Hedberg 
42109238f36aSJohan Hedberg 	skb = skb_peek(&hdev->cmd_q);
42119238f36aSJohan Hedberg 	if (!skb)
42129238f36aSJohan Hedberg 		return true;
42139238f36aSJohan Hedberg 
42149238f36aSJohan Hedberg 	return bt_cb(skb)->req.start;
42159238f36aSJohan Hedberg }
42169238f36aSJohan Hedberg 
421742c6b129SJohan Hedberg static void hci_resend_last(struct hci_dev *hdev)
421842c6b129SJohan Hedberg {
421942c6b129SJohan Hedberg 	struct hci_command_hdr *sent;
422042c6b129SJohan Hedberg 	struct sk_buff *skb;
422142c6b129SJohan Hedberg 	u16 opcode;
422242c6b129SJohan Hedberg 
422342c6b129SJohan Hedberg 	if (!hdev->sent_cmd)
422442c6b129SJohan Hedberg 		return;
422542c6b129SJohan Hedberg 
422642c6b129SJohan Hedberg 	sent = (void *) hdev->sent_cmd->data;
422742c6b129SJohan Hedberg 	opcode = __le16_to_cpu(sent->opcode);
422842c6b129SJohan Hedberg 	if (opcode == HCI_OP_RESET)
422942c6b129SJohan Hedberg 		return;
423042c6b129SJohan Hedberg 
423142c6b129SJohan Hedberg 	skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
423242c6b129SJohan Hedberg 	if (!skb)
423342c6b129SJohan Hedberg 		return;
423442c6b129SJohan Hedberg 
423542c6b129SJohan Hedberg 	skb_queue_head(&hdev->cmd_q, skb);
423642c6b129SJohan Hedberg 	queue_work(hdev->workqueue, &hdev->cmd_work);
423742c6b129SJohan Hedberg }
423842c6b129SJohan Hedberg 
42399238f36aSJohan Hedberg void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
42409238f36aSJohan Hedberg {
42419238f36aSJohan Hedberg 	hci_req_complete_t req_complete = NULL;
42429238f36aSJohan Hedberg 	struct sk_buff *skb;
42439238f36aSJohan Hedberg 	unsigned long flags;
42449238f36aSJohan Hedberg 
42459238f36aSJohan Hedberg 	BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
42469238f36aSJohan Hedberg 
424742c6b129SJohan Hedberg 	/* If the completed command doesn't match the last one that was
424842c6b129SJohan Hedberg 	 * sent we need to do special handling of it.
42499238f36aSJohan Hedberg 	 */
425042c6b129SJohan Hedberg 	if (!hci_sent_cmd_data(hdev, opcode)) {
425142c6b129SJohan Hedberg 		/* Some CSR based controllers generate a spontaneous
425242c6b129SJohan Hedberg 		 * reset complete event during init and any pending
425342c6b129SJohan Hedberg 		 * command will never be completed. In such a case we
425442c6b129SJohan Hedberg 		 * need to resend whatever was the last sent
425542c6b129SJohan Hedberg 		 * command.
425642c6b129SJohan Hedberg 		 */
425742c6b129SJohan Hedberg 		if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
425842c6b129SJohan Hedberg 			hci_resend_last(hdev);
425942c6b129SJohan Hedberg 
42609238f36aSJohan Hedberg 		return;
426142c6b129SJohan Hedberg 	}
42629238f36aSJohan Hedberg 
42639238f36aSJohan Hedberg 	/* If the command succeeded and there's still more commands in
42649238f36aSJohan Hedberg 	 * this request the request is not yet complete.
42659238f36aSJohan Hedberg 	 */
42669238f36aSJohan Hedberg 	if (!status && !hci_req_is_complete(hdev))
42679238f36aSJohan Hedberg 		return;
42689238f36aSJohan Hedberg 
42699238f36aSJohan Hedberg 	/* If this was the last command in a request the complete
42709238f36aSJohan Hedberg 	 * callback would be found in hdev->sent_cmd instead of the
42719238f36aSJohan Hedberg 	 * command queue (hdev->cmd_q).
42729238f36aSJohan Hedberg 	 */
42739238f36aSJohan Hedberg 	if (hdev->sent_cmd) {
42749238f36aSJohan Hedberg 		req_complete = bt_cb(hdev->sent_cmd)->req.complete;
427553e21fbcSJohan Hedberg 
427653e21fbcSJohan Hedberg 		if (req_complete) {
427753e21fbcSJohan Hedberg 			/* We must set the complete callback to NULL to
427853e21fbcSJohan Hedberg 			 * avoid calling the callback more than once if
427953e21fbcSJohan Hedberg 			 * this function gets called again.
428053e21fbcSJohan Hedberg 			 */
428153e21fbcSJohan Hedberg 			bt_cb(hdev->sent_cmd)->req.complete = NULL;
428253e21fbcSJohan Hedberg 
42839238f36aSJohan Hedberg 			goto call_complete;
42849238f36aSJohan Hedberg 		}
428553e21fbcSJohan Hedberg 	}
42869238f36aSJohan Hedberg 
42879238f36aSJohan Hedberg 	/* Remove all pending commands belonging to this request */
42889238f36aSJohan Hedberg 	spin_lock_irqsave(&hdev->cmd_q.lock, flags);
42899238f36aSJohan Hedberg 	while ((skb = __skb_dequeue(&hdev->cmd_q))) {
42909238f36aSJohan Hedberg 		if (bt_cb(skb)->req.start) {
42919238f36aSJohan Hedberg 			__skb_queue_head(&hdev->cmd_q, skb);
42929238f36aSJohan Hedberg 			break;
42939238f36aSJohan Hedberg 		}
42949238f36aSJohan Hedberg 
42959238f36aSJohan Hedberg 		req_complete = bt_cb(skb)->req.complete;
42969238f36aSJohan Hedberg 		kfree_skb(skb);
42979238f36aSJohan Hedberg 	}
42989238f36aSJohan Hedberg 	spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
42999238f36aSJohan Hedberg 
43009238f36aSJohan Hedberg call_complete:
43019238f36aSJohan Hedberg 	if (req_complete)
43021904a853SMarcel Holtmann 		req_complete(hdev, status, status ? opcode : HCI_OP_NOP);
43039238f36aSJohan Hedberg }
43049238f36aSJohan Hedberg 
4305b78752ccSMarcel Holtmann static void hci_rx_work(struct work_struct *work)
43061da177e4SLinus Torvalds {
4307b78752ccSMarcel Holtmann 	struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
43081da177e4SLinus Torvalds 	struct sk_buff *skb;
43091da177e4SLinus Torvalds 
43101da177e4SLinus Torvalds 	BT_DBG("%s", hdev->name);
43111da177e4SLinus Torvalds 
43121da177e4SLinus Torvalds 	while ((skb = skb_dequeue(&hdev->rx_q))) {
4313cd82e61cSMarcel Holtmann 		/* Send copy to monitor */
4314cd82e61cSMarcel Holtmann 		hci_send_to_monitor(hdev, skb);
4315cd82e61cSMarcel Holtmann 
43161da177e4SLinus Torvalds 		if (atomic_read(&hdev->promisc)) {
43171da177e4SLinus Torvalds 			/* Send copy to the sockets */
4318470fe1b5SMarcel Holtmann 			hci_send_to_sock(hdev, skb);
43191da177e4SLinus Torvalds 		}
43201da177e4SLinus Torvalds 
4321fee746b0SMarcel Holtmann 		if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
43221da177e4SLinus Torvalds 			kfree_skb(skb);
43231da177e4SLinus Torvalds 			continue;
43241da177e4SLinus Torvalds 		}
43251da177e4SLinus Torvalds 
43261da177e4SLinus Torvalds 		if (test_bit(HCI_INIT, &hdev->flags)) {
43271da177e4SLinus Torvalds 			/* Don't process data packets in this states. */
43280d48d939SMarcel Holtmann 			switch (bt_cb(skb)->pkt_type) {
43291da177e4SLinus Torvalds 			case HCI_ACLDATA_PKT:
43301da177e4SLinus Torvalds 			case HCI_SCODATA_PKT:
43311da177e4SLinus Torvalds 				kfree_skb(skb);
43321da177e4SLinus Torvalds 				continue;
43333ff50b79SStephen Hemminger 			}
43341da177e4SLinus Torvalds 		}
43351da177e4SLinus Torvalds 
43361da177e4SLinus Torvalds 		/* Process frame */
43370d48d939SMarcel Holtmann 		switch (bt_cb(skb)->pkt_type) {
43381da177e4SLinus Torvalds 		case HCI_EVENT_PKT:
4339b78752ccSMarcel Holtmann 			BT_DBG("%s Event packet", hdev->name);
43401da177e4SLinus Torvalds 			hci_event_packet(hdev, skb);
43411da177e4SLinus Torvalds 			break;
43421da177e4SLinus Torvalds 
43431da177e4SLinus Torvalds 		case HCI_ACLDATA_PKT:
43441da177e4SLinus Torvalds 			BT_DBG("%s ACL data packet", hdev->name);
43451da177e4SLinus Torvalds 			hci_acldata_packet(hdev, skb);
43461da177e4SLinus Torvalds 			break;
43471da177e4SLinus Torvalds 
43481da177e4SLinus Torvalds 		case HCI_SCODATA_PKT:
43491da177e4SLinus Torvalds 			BT_DBG("%s SCO data packet", hdev->name);
43501da177e4SLinus Torvalds 			hci_scodata_packet(hdev, skb);
43511da177e4SLinus Torvalds 			break;
43521da177e4SLinus Torvalds 
43531da177e4SLinus Torvalds 		default:
43541da177e4SLinus Torvalds 			kfree_skb(skb);
43551da177e4SLinus Torvalds 			break;
43561da177e4SLinus Torvalds 		}
43571da177e4SLinus Torvalds 	}
43581da177e4SLinus Torvalds }
43591da177e4SLinus Torvalds 
4360c347b765SGustavo F. Padovan static void hci_cmd_work(struct work_struct *work)
43611da177e4SLinus Torvalds {
4362c347b765SGustavo F. Padovan 	struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
43631da177e4SLinus Torvalds 	struct sk_buff *skb;
43641da177e4SLinus Torvalds 
43652104786bSAndrei Emeltchenko 	BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
43662104786bSAndrei Emeltchenko 	       atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
43671da177e4SLinus Torvalds 
43681da177e4SLinus Torvalds 	/* Send queued commands */
43695a08ecceSAndrei Emeltchenko 	if (atomic_read(&hdev->cmd_cnt)) {
43705a08ecceSAndrei Emeltchenko 		skb = skb_dequeue(&hdev->cmd_q);
43715a08ecceSAndrei Emeltchenko 		if (!skb)
43725a08ecceSAndrei Emeltchenko 			return;
43735a08ecceSAndrei Emeltchenko 
43741da177e4SLinus Torvalds 		kfree_skb(hdev->sent_cmd);
43751da177e4SLinus Torvalds 
4376a675d7f1SMarcel Holtmann 		hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
437770f23020SAndrei Emeltchenko 		if (hdev->sent_cmd) {
43781da177e4SLinus Torvalds 			atomic_dec(&hdev->cmd_cnt);
437957d17d70SMarcel Holtmann 			hci_send_frame(hdev, skb);
43807bdb8a5cSSzymon Janc 			if (test_bit(HCI_RESET, &hdev->flags))
438165cc2b49SMarcel Holtmann 				cancel_delayed_work(&hdev->cmd_timer);
43827bdb8a5cSSzymon Janc 			else
438365cc2b49SMarcel Holtmann 				schedule_delayed_work(&hdev->cmd_timer,
438465cc2b49SMarcel Holtmann 						      HCI_CMD_TIMEOUT);
43851da177e4SLinus Torvalds 		} else {
43861da177e4SLinus Torvalds 			skb_queue_head(&hdev->cmd_q, skb);
4387c347b765SGustavo F. Padovan 			queue_work(hdev->workqueue, &hdev->cmd_work);
43881da177e4SLinus Torvalds 		}
43891da177e4SLinus Torvalds 	}
43901da177e4SLinus Torvalds }
4391