linux/net/bluetooth/hci_core.c
<<
>>
Prefs
   1/*
   2   BlueZ - Bluetooth protocol stack for Linux
   3   Copyright (C) 2000-2001 Qualcomm Incorporated
   4   Copyright (C) 2011 ProFUSION Embedded Systems
   5
   6   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
   7
   8   This program is free software; you can redistribute it and/or modify
   9   it under the terms of the GNU General Public License version 2 as
  10   published by the Free Software Foundation;
  11
  12   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
  13   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  14   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
  15   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
  16   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
  17   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
  18   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
  19   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
  20
  21   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
  22   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
  23   SOFTWARE IS DISCLAIMED.
  24*/
  25
  26/* Bluetooth HCI core. */
  27
  28#include <linux/export.h>
  29#include <linux/rfkill.h>
  30#include <linux/debugfs.h>
  31#include <linux/crypto.h>
  32#include <linux/property.h>
  33#include <linux/suspend.h>
  34#include <linux/wait.h>
  35#include <asm/unaligned.h>
  36
  37#include <net/bluetooth/bluetooth.h>
  38#include <net/bluetooth/hci_core.h>
  39#include <net/bluetooth/l2cap.h>
  40#include <net/bluetooth/mgmt.h>
  41
  42#include "hci_request.h"
  43#include "hci_debugfs.h"
  44#include "smp.h"
  45#include "leds.h"
  46#include "msft.h"
  47#include "aosp.h"
  48
  49static void hci_rx_work(struct work_struct *work);
  50static void hci_cmd_work(struct work_struct *work);
  51static void hci_tx_work(struct work_struct *work);
  52
  53/* HCI device list */
  54LIST_HEAD(hci_dev_list);
  55DEFINE_RWLOCK(hci_dev_list_lock);
  56
  57/* HCI callback list */
  58LIST_HEAD(hci_cb_list);
  59DEFINE_MUTEX(hci_cb_list_lock);
  60
  61/* HCI ID Numbering */
  62static DEFINE_IDA(hci_index_ida);
  63
  64/* ---- HCI debugfs entries ---- */
  65
  66static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
  67                             size_t count, loff_t *ppos)
  68{
  69        struct hci_dev *hdev = file->private_data;
  70        char buf[3];
  71
  72        buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
  73        buf[1] = '\n';
  74        buf[2] = '\0';
  75        return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
  76}
  77
  78static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
  79                              size_t count, loff_t *ppos)
  80{
  81        struct hci_dev *hdev = file->private_data;
  82        struct sk_buff *skb;
  83        bool enable;
  84        int err;
  85
  86        if (!test_bit(HCI_UP, &hdev->flags))
  87                return -ENETDOWN;
  88
  89        err = kstrtobool_from_user(user_buf, count, &enable);
  90        if (err)
  91                return err;
  92
  93        if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
  94                return -EALREADY;
  95
  96        hci_req_sync_lock(hdev);
  97        if (enable)
  98                skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
  99                                     HCI_CMD_TIMEOUT);
 100        else
 101                skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
 102                                     HCI_CMD_TIMEOUT);
 103        hci_req_sync_unlock(hdev);
 104
 105        if (IS_ERR(skb))
 106                return PTR_ERR(skb);
 107
 108        kfree_skb(skb);
 109
 110        hci_dev_change_flag(hdev, HCI_DUT_MODE);
 111
 112        return count;
 113}
 114
 115static const struct file_operations dut_mode_fops = {
 116        .open           = simple_open,
 117        .read           = dut_mode_read,
 118        .write          = dut_mode_write,
 119        .llseek         = default_llseek,
 120};
 121
 122static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
 123                                size_t count, loff_t *ppos)
 124{
 125        struct hci_dev *hdev = file->private_data;
 126        char buf[3];
 127
 128        buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
 129        buf[1] = '\n';
 130        buf[2] = '\0';
 131        return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
 132}
 133
 134static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
 135                                 size_t count, loff_t *ppos)
 136{
 137        struct hci_dev *hdev = file->private_data;
 138        bool enable;
 139        int err;
 140
 141        err = kstrtobool_from_user(user_buf, count, &enable);
 142        if (err)
 143                return err;
 144
 145        /* When the diagnostic flags are not persistent and the transport
 146         * is not active or in user channel operation, then there is no need
 147         * for the vendor callback. Instead just store the desired value and
 148         * the setting will be programmed when the controller gets powered on.
 149         */
 150        if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
 151            (!test_bit(HCI_RUNNING, &hdev->flags) ||
 152             hci_dev_test_flag(hdev, HCI_USER_CHANNEL)))
 153                goto done;
 154
 155        hci_req_sync_lock(hdev);
 156        err = hdev->set_diag(hdev, enable);
 157        hci_req_sync_unlock(hdev);
 158
 159        if (err < 0)
 160                return err;
 161
 162done:
 163        if (enable)
 164                hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
 165        else
 166                hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
 167
 168        return count;
 169}
 170
 171static const struct file_operations vendor_diag_fops = {
 172        .open           = simple_open,
 173        .read           = vendor_diag_read,
 174        .write          = vendor_diag_write,
 175        .llseek         = default_llseek,
 176};
 177
 178static void hci_debugfs_create_basic(struct hci_dev *hdev)
 179{
 180        debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
 181                            &dut_mode_fops);
 182
 183        if (hdev->set_diag)
 184                debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
 185                                    &vendor_diag_fops);
 186}
 187
 188static int hci_reset_req(struct hci_request *req, unsigned long opt)
 189{
 190        BT_DBG("%s %ld", req->hdev->name, opt);
 191
 192        /* Reset device */
 193        set_bit(HCI_RESET, &req->hdev->flags);
 194        hci_req_add(req, HCI_OP_RESET, 0, NULL);
 195        return 0;
 196}
 197
 198static void bredr_init(struct hci_request *req)
 199{
 200        req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
 201
 202        /* Read Local Supported Features */
 203        hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 204
 205        /* Read Local Version */
 206        hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 207
 208        /* Read BD Address */
 209        hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
 210}
 211
 212static void amp_init1(struct hci_request *req)
 213{
 214        req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
 215
 216        /* Read Local Version */
 217        hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 218
 219        /* Read Local Supported Commands */
 220        hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 221
 222        /* Read Local AMP Info */
 223        hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
 224
 225        /* Read Data Blk size */
 226        hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
 227
 228        /* Read Flow Control Mode */
 229        hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
 230
 231        /* Read Location Data */
 232        hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
 233}
 234
 235static int amp_init2(struct hci_request *req)
 236{
 237        /* Read Local Supported Features. Not all AMP controllers
 238         * support this so it's placed conditionally in the second
 239         * stage init.
 240         */
 241        if (req->hdev->commands[14] & 0x20)
 242                hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
 243
 244        return 0;
 245}
 246
 247static int hci_init1_req(struct hci_request *req, unsigned long opt)
 248{
 249        struct hci_dev *hdev = req->hdev;
 250
 251        BT_DBG("%s %ld", hdev->name, opt);
 252
 253        /* Reset */
 254        if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
 255                hci_reset_req(req, 0);
 256
 257        switch (hdev->dev_type) {
 258        case HCI_PRIMARY:
 259                bredr_init(req);
 260                break;
 261        case HCI_AMP:
 262                amp_init1(req);
 263                break;
 264        default:
 265                bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
 266                break;
 267        }
 268
 269        return 0;
 270}
 271
 272static void bredr_setup(struct hci_request *req)
 273{
 274        __le16 param;
 275        __u8 flt_type;
 276
 277        /* Read Buffer Size (ACL mtu, max pkt, etc.) */
 278        hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
 279
 280        /* Read Class of Device */
 281        hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
 282
 283        /* Read Local Name */
 284        hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
 285
 286        /* Read Voice Setting */
 287        hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
 288
 289        /* Read Number of Supported IAC */
 290        hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
 291
 292        /* Read Current IAC LAP */
 293        hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
 294
 295        /* Clear Event Filters */
 296        flt_type = HCI_FLT_CLEAR_ALL;
 297        hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
 298
 299        /* Connection accept timeout ~20 secs */
 300        param = cpu_to_le16(0x7d00);
 301        hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
 302}
 303
 304static void le_setup(struct hci_request *req)
 305{
 306        struct hci_dev *hdev = req->hdev;
 307
 308        /* Read LE Buffer Size */
 309        hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
 310
 311        /* Read LE Local Supported Features */
 312        hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
 313
 314        /* Read LE Supported States */
 315        hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
 316
 317        /* LE-only controllers have LE implicitly enabled */
 318        if (!lmp_bredr_capable(hdev))
 319                hci_dev_set_flag(hdev, HCI_LE_ENABLED);
 320}
 321
 322static void hci_setup_event_mask(struct hci_request *req)
 323{
 324        struct hci_dev *hdev = req->hdev;
 325
 326        /* The second byte is 0xff instead of 0x9f (two reserved bits
 327         * disabled) since a Broadcom 1.2 dongle doesn't respond to the
 328         * command otherwise.
 329         */
 330        u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
 331
 332        /* CSR 1.1 dongles does not accept any bitfield so don't try to set
 333         * any event mask for pre 1.2 devices.
 334         */
 335        if (hdev->hci_ver < BLUETOOTH_VER_1_2)
 336                return;
 337
 338        if (lmp_bredr_capable(hdev)) {
 339                events[4] |= 0x01; /* Flow Specification Complete */
 340        } else {
 341                /* Use a different default for LE-only devices */
 342                memset(events, 0, sizeof(events));
 343                events[1] |= 0x20; /* Command Complete */
 344                events[1] |= 0x40; /* Command Status */
 345                events[1] |= 0x80; /* Hardware Error */
 346
 347                /* If the controller supports the Disconnect command, enable
 348                 * the corresponding event. In addition enable packet flow
 349                 * control related events.
 350                 */
 351                if (hdev->commands[0] & 0x20) {
 352                        events[0] |= 0x10; /* Disconnection Complete */
 353                        events[2] |= 0x04; /* Number of Completed Packets */
 354                        events[3] |= 0x02; /* Data Buffer Overflow */
 355                }
 356
 357                /* If the controller supports the Read Remote Version
 358                 * Information command, enable the corresponding event.
 359                 */
 360                if (hdev->commands[2] & 0x80)
 361                        events[1] |= 0x08; /* Read Remote Version Information
 362                                            * Complete
 363                                            */
 364
 365                if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
 366                        events[0] |= 0x80; /* Encryption Change */
 367                        events[5] |= 0x80; /* Encryption Key Refresh Complete */
 368                }
 369        }
 370
 371        if (lmp_inq_rssi_capable(hdev) ||
 372            test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
 373                events[4] |= 0x02; /* Inquiry Result with RSSI */
 374
 375        if (lmp_ext_feat_capable(hdev))
 376                events[4] |= 0x04; /* Read Remote Extended Features Complete */
 377
 378        if (lmp_esco_capable(hdev)) {
 379                events[5] |= 0x08; /* Synchronous Connection Complete */
 380                events[5] |= 0x10; /* Synchronous Connection Changed */
 381        }
 382
 383        if (lmp_sniffsubr_capable(hdev))
 384                events[5] |= 0x20; /* Sniff Subrating */
 385
 386        if (lmp_pause_enc_capable(hdev))
 387                events[5] |= 0x80; /* Encryption Key Refresh Complete */
 388
 389        if (lmp_ext_inq_capable(hdev))
 390                events[5] |= 0x40; /* Extended Inquiry Result */
 391
 392        if (lmp_no_flush_capable(hdev))
 393                events[7] |= 0x01; /* Enhanced Flush Complete */
 394
 395        if (lmp_lsto_capable(hdev))
 396                events[6] |= 0x80; /* Link Supervision Timeout Changed */
 397
 398        if (lmp_ssp_capable(hdev)) {
 399                events[6] |= 0x01;      /* IO Capability Request */
 400                events[6] |= 0x02;      /* IO Capability Response */
 401                events[6] |= 0x04;      /* User Confirmation Request */
 402                events[6] |= 0x08;      /* User Passkey Request */
 403                events[6] |= 0x10;      /* Remote OOB Data Request */
 404                events[6] |= 0x20;      /* Simple Pairing Complete */
 405                events[7] |= 0x04;      /* User Passkey Notification */
 406                events[7] |= 0x08;      /* Keypress Notification */
 407                events[7] |= 0x10;      /* Remote Host Supported
 408                                         * Features Notification
 409                                         */
 410        }
 411
 412        if (lmp_le_capable(hdev))
 413                events[7] |= 0x20;      /* LE Meta-Event */
 414
 415        hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
 416}
 417
 418static int hci_init2_req(struct hci_request *req, unsigned long opt)
 419{
 420        struct hci_dev *hdev = req->hdev;
 421
 422        if (hdev->dev_type == HCI_AMP)
 423                return amp_init2(req);
 424
 425        if (lmp_bredr_capable(hdev))
 426                bredr_setup(req);
 427        else
 428                hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
 429
 430        if (lmp_le_capable(hdev))
 431                le_setup(req);
 432
 433        /* All Bluetooth 1.2 and later controllers should support the
 434         * HCI command for reading the local supported commands.
 435         *
 436         * Unfortunately some controllers indicate Bluetooth 1.2 support,
 437         * but do not have support for this command. If that is the case,
 438         * the driver can quirk the behavior and skip reading the local
 439         * supported commands.
 440         */
 441        if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
 442            !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
 443                hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
 444
 445        if (lmp_ssp_capable(hdev)) {
 446                /* When SSP is available, then the host features page
 447                 * should also be available as well. However some
 448                 * controllers list the max_page as 0 as long as SSP
 449                 * has not been enabled. To achieve proper debugging
 450                 * output, force the minimum max_page to 1 at least.
 451                 */
 452                hdev->max_page = 0x01;
 453
 454                if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
 455                        u8 mode = 0x01;
 456
 457                        hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
 458                                    sizeof(mode), &mode);
 459                } else {
 460                        struct hci_cp_write_eir cp;
 461
 462                        memset(hdev->eir, 0, sizeof(hdev->eir));
 463                        memset(&cp, 0, sizeof(cp));
 464
 465                        hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
 466                }
 467        }
 468
 469        if (lmp_inq_rssi_capable(hdev) ||
 470            test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
 471                u8 mode;
 472
 473                /* If Extended Inquiry Result events are supported, then
 474                 * they are clearly preferred over Inquiry Result with RSSI
 475                 * events.
 476                 */
 477                mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
 478
 479                hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
 480        }
 481
 482        if (lmp_inq_tx_pwr_capable(hdev))
 483                hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
 484
 485        if (lmp_ext_feat_capable(hdev)) {
 486                struct hci_cp_read_local_ext_features cp;
 487
 488                cp.page = 0x01;
 489                hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
 490                            sizeof(cp), &cp);
 491        }
 492
 493        if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
 494                u8 enable = 1;
 495                hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
 496                            &enable);
 497        }
 498
 499        return 0;
 500}
 501
 502static void hci_setup_link_policy(struct hci_request *req)
 503{
 504        struct hci_dev *hdev = req->hdev;
 505        struct hci_cp_write_def_link_policy cp;
 506        u16 link_policy = 0;
 507
 508        if (lmp_rswitch_capable(hdev))
 509                link_policy |= HCI_LP_RSWITCH;
 510        if (lmp_hold_capable(hdev))
 511                link_policy |= HCI_LP_HOLD;
 512        if (lmp_sniff_capable(hdev))
 513                link_policy |= HCI_LP_SNIFF;
 514        if (lmp_park_capable(hdev))
 515                link_policy |= HCI_LP_PARK;
 516
 517        cp.policy = cpu_to_le16(link_policy);
 518        hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
 519}
 520
 521static void hci_set_le_support(struct hci_request *req)
 522{
 523        struct hci_dev *hdev = req->hdev;
 524        struct hci_cp_write_le_host_supported cp;
 525
 526        /* LE-only devices do not support explicit enablement */
 527        if (!lmp_bredr_capable(hdev))
 528                return;
 529
 530        memset(&cp, 0, sizeof(cp));
 531
 532        if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
 533                cp.le = 0x01;
 534                cp.simul = 0x00;
 535        }
 536
 537        if (cp.le != lmp_host_le_capable(hdev))
 538                hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
 539                            &cp);
 540}
 541
 542static void hci_set_event_mask_page_2(struct hci_request *req)
 543{
 544        struct hci_dev *hdev = req->hdev;
 545        u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
 546        bool changed = false;
 547
 548        /* If Connectionless Peripheral Broadcast central role is supported
 549         * enable all necessary events for it.
 550         */
 551        if (lmp_cpb_central_capable(hdev)) {
 552                events[1] |= 0x40;      /* Triggered Clock Capture */
 553                events[1] |= 0x80;      /* Synchronization Train Complete */
 554                events[2] |= 0x10;      /* Peripheral Page Response Timeout */
 555                events[2] |= 0x20;      /* CPB Channel Map Change */
 556                changed = true;
 557        }
 558
 559        /* If Connectionless Peripheral Broadcast peripheral role is supported
 560         * enable all necessary events for it.
 561         */
 562        if (lmp_cpb_peripheral_capable(hdev)) {
 563                events[2] |= 0x01;      /* Synchronization Train Received */
 564                events[2] |= 0x02;      /* CPB Receive */
 565                events[2] |= 0x04;      /* CPB Timeout */
 566                events[2] |= 0x08;      /* Truncated Page Complete */
 567                changed = true;
 568        }
 569
 570        /* Enable Authenticated Payload Timeout Expired event if supported */
 571        if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
 572                events[2] |= 0x80;
 573                changed = true;
 574        }
 575
 576        /* Some Broadcom based controllers indicate support for Set Event
 577         * Mask Page 2 command, but then actually do not support it. Since
 578         * the default value is all bits set to zero, the command is only
 579         * required if the event mask has to be changed. In case no change
 580         * to the event mask is needed, skip this command.
 581         */
 582        if (changed)
 583                hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
 584                            sizeof(events), events);
 585}
 586
 587static int hci_init3_req(struct hci_request *req, unsigned long opt)
 588{
 589        struct hci_dev *hdev = req->hdev;
 590        u8 p;
 591
 592        hci_setup_event_mask(req);
 593
 594        if (hdev->commands[6] & 0x20 &&
 595            !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
 596                struct hci_cp_read_stored_link_key cp;
 597
 598                bacpy(&cp.bdaddr, BDADDR_ANY);
 599                cp.read_all = 0x01;
 600                hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
 601        }
 602
 603        if (hdev->commands[5] & 0x10)
 604                hci_setup_link_policy(req);
 605
 606        if (hdev->commands[8] & 0x01)
 607                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
 608
 609        if (hdev->commands[18] & 0x04 &&
 610            !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
 611                hci_req_add(req, HCI_OP_READ_DEF_ERR_DATA_REPORTING, 0, NULL);
 612
 613        /* Some older Broadcom based Bluetooth 1.2 controllers do not
 614         * support the Read Page Scan Type command. Check support for
 615         * this command in the bit mask of supported commands.
 616         */
 617        if (hdev->commands[13] & 0x01)
 618                hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
 619
 620        if (lmp_le_capable(hdev)) {
 621                u8 events[8];
 622
 623                memset(events, 0, sizeof(events));
 624
 625                if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
 626                        events[0] |= 0x10;      /* LE Long Term Key Request */
 627
 628                /* If controller supports the Connection Parameters Request
 629                 * Link Layer Procedure, enable the corresponding event.
 630                 */
 631                if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
 632                        events[0] |= 0x20;      /* LE Remote Connection
 633                                                 * Parameter Request
 634                                                 */
 635
 636                /* If the controller supports the Data Length Extension
 637                 * feature, enable the corresponding event.
 638                 */
 639                if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
 640                        events[0] |= 0x40;      /* LE Data Length Change */
 641
 642                /* If the controller supports LL Privacy feature, enable
 643                 * the corresponding event.
 644                 */
 645                if (hdev->le_features[0] & HCI_LE_LL_PRIVACY)
 646                        events[1] |= 0x02;      /* LE Enhanced Connection
 647                                                 * Complete
 648                                                 */
 649
 650                /* If the controller supports Extended Scanner Filter
 651                 * Policies, enable the corresponding event.
 652                 */
 653                if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
 654                        events[1] |= 0x04;      /* LE Direct Advertising
 655                                                 * Report
 656                                                 */
 657
 658                /* If the controller supports Channel Selection Algorithm #2
 659                 * feature, enable the corresponding event.
 660                 */
 661                if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
 662                        events[2] |= 0x08;      /* LE Channel Selection
 663                                                 * Algorithm
 664                                                 */
 665
 666                /* If the controller supports the LE Set Scan Enable command,
 667                 * enable the corresponding advertising report event.
 668                 */
 669                if (hdev->commands[26] & 0x08)
 670                        events[0] |= 0x02;      /* LE Advertising Report */
 671
 672                /* If the controller supports the LE Create Connection
 673                 * command, enable the corresponding event.
 674                 */
 675                if (hdev->commands[26] & 0x10)
 676                        events[0] |= 0x01;      /* LE Connection Complete */
 677
 678                /* If the controller supports the LE Connection Update
 679                 * command, enable the corresponding event.
 680                 */
 681                if (hdev->commands[27] & 0x04)
 682                        events[0] |= 0x04;      /* LE Connection Update
 683                                                 * Complete
 684                                                 */
 685
 686                /* If the controller supports the LE Read Remote Used Features
 687                 * command, enable the corresponding event.
 688                 */
 689                if (hdev->commands[27] & 0x20)
 690                        events[0] |= 0x08;      /* LE Read Remote Used
 691                                                 * Features Complete
 692                                                 */
 693
 694                /* If the controller supports the LE Read Local P-256
 695                 * Public Key command, enable the corresponding event.
 696                 */
 697                if (hdev->commands[34] & 0x02)
 698                        events[0] |= 0x80;      /* LE Read Local P-256
 699                                                 * Public Key Complete
 700                                                 */
 701
 702                /* If the controller supports the LE Generate DHKey
 703                 * command, enable the corresponding event.
 704                 */
 705                if (hdev->commands[34] & 0x04)
 706                        events[1] |= 0x01;      /* LE Generate DHKey Complete */
 707
 708                /* If the controller supports the LE Set Default PHY or
 709                 * LE Set PHY commands, enable the corresponding event.
 710                 */
 711                if (hdev->commands[35] & (0x20 | 0x40))
 712                        events[1] |= 0x08;        /* LE PHY Update Complete */
 713
 714                /* If the controller supports LE Set Extended Scan Parameters
 715                 * and LE Set Extended Scan Enable commands, enable the
 716                 * corresponding event.
 717                 */
 718                if (use_ext_scan(hdev))
 719                        events[1] |= 0x10;      /* LE Extended Advertising
 720                                                 * Report
 721                                                 */
 722
 723                /* If the controller supports the LE Extended Advertising
 724                 * command, enable the corresponding event.
 725                 */
 726                if (ext_adv_capable(hdev))
 727                        events[2] |= 0x02;      /* LE Advertising Set
 728                                                 * Terminated
 729                                                 */
 730
 731                hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
 732                            events);
 733
 734                /* Read LE Advertising Channel TX Power */
 735                if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
 736                        /* HCI TS spec forbids mixing of legacy and extended
 737                         * advertising commands wherein READ_ADV_TX_POWER is
 738                         * also included. So do not call it if extended adv
 739                         * is supported otherwise controller will return
 740                         * COMMAND_DISALLOWED for extended commands.
 741                         */
 742                        hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
 743                }
 744
 745                if (hdev->commands[38] & 0x80) {
 746                        /* Read LE Min/Max Tx Power*/
 747                        hci_req_add(req, HCI_OP_LE_READ_TRANSMIT_POWER,
 748                                    0, NULL);
 749                }
 750
 751                if (hdev->commands[26] & 0x40) {
 752                        /* Read LE Accept List Size */
 753                        hci_req_add(req, HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
 754                                    0, NULL);
 755                }
 756
 757                if (hdev->commands[26] & 0x80) {
 758                        /* Clear LE Accept List */
 759                        hci_req_add(req, HCI_OP_LE_CLEAR_ACCEPT_LIST, 0, NULL);
 760                }
 761
 762                if (hdev->commands[34] & 0x40) {
 763                        /* Read LE Resolving List Size */
 764                        hci_req_add(req, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
 765                                    0, NULL);
 766                }
 767
 768                if (hdev->commands[34] & 0x20) {
 769                        /* Clear LE Resolving List */
 770                        hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL);
 771                }
 772
 773                if (hdev->commands[35] & 0x04) {
 774                        __le16 rpa_timeout = cpu_to_le16(hdev->rpa_timeout);
 775
 776                        /* Set RPA timeout */
 777                        hci_req_add(req, HCI_OP_LE_SET_RPA_TIMEOUT, 2,
 778                                    &rpa_timeout);
 779                }
 780
 781                if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
 782                        /* Read LE Maximum Data Length */
 783                        hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
 784
 785                        /* Read LE Suggested Default Data Length */
 786                        hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
 787                }
 788
 789                if (ext_adv_capable(hdev)) {
 790                        /* Read LE Number of Supported Advertising Sets */
 791                        hci_req_add(req, HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
 792                                    0, NULL);
 793                }
 794
 795                hci_set_le_support(req);
 796        }
 797
 798        /* Read features beyond page 1 if available */
 799        for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
 800                struct hci_cp_read_local_ext_features cp;
 801
 802                cp.page = p;
 803                hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
 804                            sizeof(cp), &cp);
 805        }
 806
 807        return 0;
 808}
 809
 810static int hci_init4_req(struct hci_request *req, unsigned long opt)
 811{
 812        struct hci_dev *hdev = req->hdev;
 813
 814        /* Some Broadcom based Bluetooth controllers do not support the
 815         * Delete Stored Link Key command. They are clearly indicating its
 816         * absence in the bit mask of supported commands.
 817         *
 818         * Check the supported commands and only if the command is marked
 819         * as supported send it. If not supported assume that the controller
 820         * does not have actual support for stored link keys which makes this
 821         * command redundant anyway.
 822         *
 823         * Some controllers indicate that they support handling deleting
 824         * stored link keys, but they don't. The quirk lets a driver
 825         * just disable this command.
 826         */
 827        if (hdev->commands[6] & 0x80 &&
 828            !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
 829                struct hci_cp_delete_stored_link_key cp;
 830
 831                bacpy(&cp.bdaddr, BDADDR_ANY);
 832                cp.delete_all = 0x01;
 833                hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
 834                            sizeof(cp), &cp);
 835        }
 836
 837        /* Set event mask page 2 if the HCI command for it is supported */
 838        if (hdev->commands[22] & 0x04)
 839                hci_set_event_mask_page_2(req);
 840
 841        /* Read local codec list if the HCI command is supported */
 842        if (hdev->commands[29] & 0x20)
 843                hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
 844
 845        /* Read local pairing options if the HCI command is supported */
 846        if (hdev->commands[41] & 0x08)
 847                hci_req_add(req, HCI_OP_READ_LOCAL_PAIRING_OPTS, 0, NULL);
 848
 849        /* Get MWS transport configuration if the HCI command is supported */
 850        if (hdev->commands[30] & 0x08)
 851                hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
 852
 853        /* Check for Synchronization Train support */
 854        if (lmp_sync_train_capable(hdev))
 855                hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
 856
 857        /* Enable Secure Connections if supported and configured */
 858        if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
 859            bredr_sc_enabled(hdev)) {
 860                u8 support = 0x01;
 861
 862                hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
 863                            sizeof(support), &support);
 864        }
 865
 866        /* Set erroneous data reporting if supported to the wideband speech
 867         * setting value
 868         */
 869        if (hdev->commands[18] & 0x08 &&
 870            !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks)) {
 871                bool enabled = hci_dev_test_flag(hdev,
 872                                                 HCI_WIDEBAND_SPEECH_ENABLED);
 873
 874                if (enabled !=
 875                    (hdev->err_data_reporting == ERR_DATA_REPORTING_ENABLED)) {
 876                        struct hci_cp_write_def_err_data_reporting cp;
 877
 878                        cp.err_data_reporting = enabled ?
 879                                                ERR_DATA_REPORTING_ENABLED :
 880                                                ERR_DATA_REPORTING_DISABLED;
 881
 882                        hci_req_add(req, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
 883                                    sizeof(cp), &cp);
 884                }
 885        }
 886
 887        /* Set Suggested Default Data Length to maximum if supported */
 888        if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
 889                struct hci_cp_le_write_def_data_len cp;
 890
 891                cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
 892                cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
 893                hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
 894        }
 895
 896        /* Set Default PHY parameters if command is supported */
 897        if (hdev->commands[35] & 0x20) {
 898                struct hci_cp_le_set_default_phy cp;
 899
 900                cp.all_phys = 0x00;
 901                cp.tx_phys = hdev->le_tx_def_phys;
 902                cp.rx_phys = hdev->le_rx_def_phys;
 903
 904                hci_req_add(req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp), &cp);
 905        }
 906
 907        return 0;
 908}
 909
 910static int __hci_init(struct hci_dev *hdev)
 911{
 912        int err;
 913
 914        err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
 915        if (err < 0)
 916                return err;
 917
 918        if (hci_dev_test_flag(hdev, HCI_SETUP))
 919                hci_debugfs_create_basic(hdev);
 920
 921        err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
 922        if (err < 0)
 923                return err;
 924
 925        /* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
 926         * BR/EDR/LE type controllers. AMP controllers only need the
 927         * first two stages of init.
 928         */
 929        if (hdev->dev_type != HCI_PRIMARY)
 930                return 0;
 931
 932        err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
 933        if (err < 0)
 934                return err;
 935
 936        err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
 937        if (err < 0)
 938                return err;
 939
 940        /* This function is only called when the controller is actually in
 941         * configured state. When the controller is marked as unconfigured,
 942         * this initialization procedure is not run.
 943         *
 944         * It means that it is possible that a controller runs through its
 945         * setup phase and then discovers missing settings. If that is the
 946         * case, then this function will not be called. It then will only
 947         * be called during the config phase.
 948         *
 949         * So only when in setup phase or config phase, create the debugfs
 950         * entries and register the SMP channels.
 951         */
 952        if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
 953            !hci_dev_test_flag(hdev, HCI_CONFIG))
 954                return 0;
 955
 956        hci_debugfs_create_common(hdev);
 957
 958        if (lmp_bredr_capable(hdev))
 959                hci_debugfs_create_bredr(hdev);
 960
 961        if (lmp_le_capable(hdev))
 962                hci_debugfs_create_le(hdev);
 963
 964        return 0;
 965}
 966
 967static int hci_init0_req(struct hci_request *req, unsigned long opt)
 968{
 969        struct hci_dev *hdev = req->hdev;
 970
 971        BT_DBG("%s %ld", hdev->name, opt);
 972
 973        /* Reset */
 974        if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
 975                hci_reset_req(req, 0);
 976
 977        /* Read Local Version */
 978        hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
 979
 980        /* Read BD Address */
 981        if (hdev->set_bdaddr)
 982                hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
 983
 984        return 0;
 985}
 986
 987static int __hci_unconf_init(struct hci_dev *hdev)
 988{
 989        int err;
 990
 991        if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
 992                return 0;
 993
 994        err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
 995        if (err < 0)
 996                return err;
 997
 998        if (hci_dev_test_flag(hdev, HCI_SETUP))
 999                hci_debugfs_create_basic(hdev);
1000
1001        return 0;
1002}
1003
1004static int hci_scan_req(struct hci_request *req, unsigned long opt)
1005{
1006        __u8 scan = opt;
1007
1008        BT_DBG("%s %x", req->hdev->name, scan);
1009
1010        /* Inquiry and Page scans */
1011        hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1012        return 0;
1013}
1014
1015static int hci_auth_req(struct hci_request *req, unsigned long opt)
1016{
1017        __u8 auth = opt;
1018
1019        BT_DBG("%s %x", req->hdev->name, auth);
1020
1021        /* Authentication */
1022        hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1023        return 0;
1024}
1025
1026static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1027{
1028        __u8 encrypt = opt;
1029
1030        BT_DBG("%s %x", req->hdev->name, encrypt);
1031
1032        /* Encryption */
1033        hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1034        return 0;
1035}
1036
1037static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
1038{
1039        __le16 policy = cpu_to_le16(opt);
1040
1041        BT_DBG("%s %x", req->hdev->name, policy);
1042
1043        /* Default link policy */
1044        hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
1045        return 0;
1046}
1047
1048/* Get HCI device by index.
1049 * Device is held on return. */
1050struct hci_dev *hci_dev_get(int index)
1051{
1052        struct hci_dev *hdev = NULL, *d;
1053
1054        BT_DBG("%d", index);
1055
1056        if (index < 0)
1057                return NULL;
1058
1059        read_lock(&hci_dev_list_lock);
1060        list_for_each_entry(d, &hci_dev_list, list) {
1061                if (d->id == index) {
1062                        hdev = hci_dev_hold(d);
1063                        break;
1064                }
1065        }
1066        read_unlock(&hci_dev_list_lock);
1067        return hdev;
1068}
1069
1070/* ---- Inquiry support ---- */
1071
1072bool hci_discovery_active(struct hci_dev *hdev)
1073{
1074        struct discovery_state *discov = &hdev->discovery;
1075
1076        switch (discov->state) {
1077        case DISCOVERY_FINDING:
1078        case DISCOVERY_RESOLVING:
1079                return true;
1080
1081        default:
1082                return false;
1083        }
1084}
1085
1086void hci_discovery_set_state(struct hci_dev *hdev, int state)
1087{
1088        int old_state = hdev->discovery.state;
1089
1090        BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1091
1092        if (old_state == state)
1093                return;
1094
1095        hdev->discovery.state = state;
1096
1097        switch (state) {
1098        case DISCOVERY_STOPPED:
1099                hci_update_background_scan(hdev);
1100
1101                if (old_state != DISCOVERY_STARTING)
1102                        mgmt_discovering(hdev, 0);
1103                break;
1104        case DISCOVERY_STARTING:
1105                break;
1106        case DISCOVERY_FINDING:
1107                mgmt_discovering(hdev, 1);
1108                break;
1109        case DISCOVERY_RESOLVING:
1110                break;
1111        case DISCOVERY_STOPPING:
1112                break;
1113        }
1114}
1115
1116void hci_inquiry_cache_flush(struct hci_dev *hdev)
1117{
1118        struct discovery_state *cache = &hdev->discovery;
1119        struct inquiry_entry *p, *n;
1120
1121        list_for_each_entry_safe(p, n, &cache->all, all) {
1122                list_del(&p->all);
1123                kfree(p);
1124        }
1125
1126        INIT_LIST_HEAD(&cache->unknown);
1127        INIT_LIST_HEAD(&cache->resolve);
1128}
1129
1130struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1131                                               bdaddr_t *bdaddr)
1132{
1133        struct discovery_state *cache = &hdev->discovery;
1134        struct inquiry_entry *e;
1135
1136        BT_DBG("cache %p, %pMR", cache, bdaddr);
1137
1138        list_for_each_entry(e, &cache->all, all) {
1139                if (!bacmp(&e->data.bdaddr, bdaddr))
1140                        return e;
1141        }
1142
1143        return NULL;
1144}
1145
1146struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1147                                                       bdaddr_t *bdaddr)
1148{
1149        struct discovery_state *cache = &hdev->discovery;
1150        struct inquiry_entry *e;
1151
1152        BT_DBG("cache %p, %pMR", cache, bdaddr);
1153
1154        list_for_each_entry(e, &cache->unknown, list) {
1155                if (!bacmp(&e->data.bdaddr, bdaddr))
1156                        return e;
1157        }
1158
1159        return NULL;
1160}
1161
1162struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1163                                                       bdaddr_t *bdaddr,
1164                                                       int state)
1165{
1166        struct discovery_state *cache = &hdev->discovery;
1167        struct inquiry_entry *e;
1168
1169        BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1170
1171        list_for_each_entry(e, &cache->resolve, list) {
1172                if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1173                        return e;
1174                if (!bacmp(&e->data.bdaddr, bdaddr))
1175                        return e;
1176        }
1177
1178        return NULL;
1179}
1180
1181void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1182                                      struct inquiry_entry *ie)
1183{
1184        struct discovery_state *cache = &hdev->discovery;
1185        struct list_head *pos = &cache->resolve;
1186        struct inquiry_entry *p;
1187
1188        list_del(&ie->list);
1189
1190        list_for_each_entry(p, &cache->resolve, list) {
1191                if (p->name_state != NAME_PENDING &&
1192                    abs(p->data.rssi) >= abs(ie->data.rssi))
1193                        break;
1194                pos = &p->list;
1195        }
1196
1197        list_add(&ie->list, pos);
1198}
1199
1200u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1201                             bool name_known)
1202{
1203        struct discovery_state *cache = &hdev->discovery;
1204        struct inquiry_entry *ie;
1205        u32 flags = 0;
1206
1207        BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1208
1209        hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1210
1211        if (!data->ssp_mode)
1212                flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1213
1214        ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1215        if (ie) {
1216                if (!ie->data.ssp_mode)
1217                        flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1218
1219                if (ie->name_state == NAME_NEEDED &&
1220                    data->rssi != ie->data.rssi) {
1221                        ie->data.rssi = data->rssi;
1222                        hci_inquiry_cache_update_resolve(hdev, ie);
1223                }
1224
1225                goto update;
1226        }
1227
1228        /* Entry not in the cache. Add new one. */
1229        ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1230        if (!ie) {
1231                flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1232                goto done;
1233        }
1234
1235        list_add(&ie->all, &cache->all);
1236
1237        if (name_known) {
1238                ie->name_state = NAME_KNOWN;
1239        } else {
1240                ie->name_state = NAME_NOT_KNOWN;
1241                list_add(&ie->list, &cache->unknown);
1242        }
1243
1244update:
1245        if (name_known && ie->name_state != NAME_KNOWN &&
1246            ie->name_state != NAME_PENDING) {
1247                ie->name_state = NAME_KNOWN;
1248                list_del(&ie->list);
1249        }
1250
1251        memcpy(&ie->data, data, sizeof(*data));
1252        ie->timestamp = jiffies;
1253        cache->timestamp = jiffies;
1254
1255        if (ie->name_state == NAME_NOT_KNOWN)
1256                flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1257
1258done:
1259        return flags;
1260}
1261
1262static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1263{
1264        struct discovery_state *cache = &hdev->discovery;
1265        struct inquiry_info *info = (struct inquiry_info *) buf;
1266        struct inquiry_entry *e;
1267        int copied = 0;
1268
1269        list_for_each_entry(e, &cache->all, all) {
1270                struct inquiry_data *data = &e->data;
1271
1272                if (copied >= num)
1273                        break;
1274
1275                bacpy(&info->bdaddr, &data->bdaddr);
1276                info->pscan_rep_mode    = data->pscan_rep_mode;
1277                info->pscan_period_mode = data->pscan_period_mode;
1278                info->pscan_mode        = data->pscan_mode;
1279                memcpy(info->dev_class, data->dev_class, 3);
1280                info->clock_offset      = data->clock_offset;
1281
1282                info++;
1283                copied++;
1284        }
1285
1286        BT_DBG("cache %p, copied %d", cache, copied);
1287        return copied;
1288}
1289
1290static int hci_inq_req(struct hci_request *req, unsigned long opt)
1291{
1292        struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1293        struct hci_dev *hdev = req->hdev;
1294        struct hci_cp_inquiry cp;
1295
1296        BT_DBG("%s", hdev->name);
1297
1298        if (test_bit(HCI_INQUIRY, &hdev->flags))
1299                return 0;
1300
1301        /* Start Inquiry */
1302        memcpy(&cp.lap, &ir->lap, 3);
1303        cp.length  = ir->length;
1304        cp.num_rsp = ir->num_rsp;
1305        hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1306
1307        return 0;
1308}
1309
1310int hci_inquiry(void __user *arg)
1311{
1312        __u8 __user *ptr = arg;
1313        struct hci_inquiry_req ir;
1314        struct hci_dev *hdev;
1315        int err = 0, do_inquiry = 0, max_rsp;
1316        long timeo;
1317        __u8 *buf;
1318
1319        if (copy_from_user(&ir, ptr, sizeof(ir)))
1320                return -EFAULT;
1321
1322        hdev = hci_dev_get(ir.dev_id);
1323        if (!hdev)
1324                return -ENODEV;
1325
1326        if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1327                err = -EBUSY;
1328                goto done;
1329        }
1330
1331        if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1332                err = -EOPNOTSUPP;
1333                goto done;
1334        }
1335
1336        if (hdev->dev_type != HCI_PRIMARY) {
1337                err = -EOPNOTSUPP;
1338                goto done;
1339        }
1340
1341        if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1342                err = -EOPNOTSUPP;
1343                goto done;
1344        }
1345
1346        /* Restrict maximum inquiry length to 60 seconds */
1347        if (ir.length > 60) {
1348                err = -EINVAL;
1349                goto done;
1350        }
1351
1352        hci_dev_lock(hdev);
1353        if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1354            inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1355                hci_inquiry_cache_flush(hdev);
1356                do_inquiry = 1;
1357        }
1358        hci_dev_unlock(hdev);
1359
1360        timeo = ir.length * msecs_to_jiffies(2000);
1361
1362        if (do_inquiry) {
1363                err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1364                                   timeo, NULL);
1365                if (err < 0)
1366                        goto done;
1367
1368                /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1369                 * cleared). If it is interrupted by a signal, return -EINTR.
1370                 */
1371                if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1372                                TASK_INTERRUPTIBLE)) {
1373                        err = -EINTR;
1374                        goto done;
1375                }
1376        }
1377
1378        /* for unlimited number of responses we will use buffer with
1379         * 255 entries
1380         */
1381        max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1382
1383        /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1384         * copy it to the user space.
1385         */
1386        buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
1387        if (!buf) {
1388                err = -ENOMEM;
1389                goto done;
1390        }
1391
1392        hci_dev_lock(hdev);
1393        ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1394        hci_dev_unlock(hdev);
1395
1396        BT_DBG("num_rsp %d", ir.num_rsp);
1397
1398        if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1399                ptr += sizeof(ir);
1400                if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1401                                 ir.num_rsp))
1402                        err = -EFAULT;
1403        } else
1404                err = -EFAULT;
1405
1406        kfree(buf);
1407
1408done:
1409        hci_dev_put(hdev);
1410        return err;
1411}
1412
1413/**
1414 * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address
1415 *                                     (BD_ADDR) for a HCI device from
1416 *                                     a firmware node property.
1417 * @hdev:       The HCI device
1418 *
1419 * Search the firmware node for 'local-bd-address'.
1420 *
1421 * All-zero BD addresses are rejected, because those could be properties
1422 * that exist in the firmware tables, but were not updated by the firmware. For
1423 * example, the DTS could define 'local-bd-address', with zero BD addresses.
1424 */
1425static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev)
1426{
1427        struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
1428        bdaddr_t ba;
1429        int ret;
1430
1431        ret = fwnode_property_read_u8_array(fwnode, "local-bd-address",
1432                                            (u8 *)&ba, sizeof(ba));
1433        if (ret < 0 || !bacmp(&ba, BDADDR_ANY))
1434                return;
1435
1436        bacpy(&hdev->public_addr, &ba);
1437}
1438
1439static int hci_dev_do_open(struct hci_dev *hdev)
1440{
1441        int ret = 0;
1442
1443        BT_DBG("%s %p", hdev->name, hdev);
1444
1445        hci_req_sync_lock(hdev);
1446
1447        if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1448                ret = -ENODEV;
1449                goto done;
1450        }
1451
1452        if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1453            !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1454                /* Check for rfkill but allow the HCI setup stage to
1455                 * proceed (which in itself doesn't cause any RF activity).
1456                 */
1457                if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1458                        ret = -ERFKILL;
1459                        goto done;
1460                }
1461
1462                /* Check for valid public address or a configured static
1463                 * random address, but let the HCI setup proceed to
1464                 * be able to determine if there is a public address
1465                 * or not.
1466                 *
1467                 * In case of user channel usage, it is not important
1468                 * if a public address or static random address is
1469                 * available.
1470                 *
1471                 * This check is only valid for BR/EDR controllers
1472                 * since AMP controllers do not have an address.
1473                 */
1474                if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1475                    hdev->dev_type == HCI_PRIMARY &&
1476                    !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1477                    !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1478                        ret = -EADDRNOTAVAIL;
1479                        goto done;
1480                }
1481        }
1482
1483        if (test_bit(HCI_UP, &hdev->flags)) {
1484                ret = -EALREADY;
1485                goto done;
1486        }
1487
1488        if (hdev->open(hdev)) {
1489                ret = -EIO;
1490                goto done;
1491        }
1492
1493        set_bit(HCI_RUNNING, &hdev->flags);
1494        hci_sock_dev_event(hdev, HCI_DEV_OPEN);
1495
1496        atomic_set(&hdev->cmd_cnt, 1);
1497        set_bit(HCI_INIT, &hdev->flags);
1498
1499        if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1500            test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
1501                bool invalid_bdaddr;
1502
1503                hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1504
1505                if (hdev->setup)
1506                        ret = hdev->setup(hdev);
1507
1508                /* The transport driver can set the quirk to mark the
1509                 * BD_ADDR invalid before creating the HCI device or in
1510                 * its setup callback.
1511                 */
1512                invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR,
1513                                          &hdev->quirks);
1514
1515                if (ret)
1516                        goto setup_failed;
1517
1518                if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
1519                        if (!bacmp(&hdev->public_addr, BDADDR_ANY))
1520                                hci_dev_get_bd_addr_from_property(hdev);
1521
1522                        if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1523                            hdev->set_bdaddr) {
1524                                ret = hdev->set_bdaddr(hdev,
1525                                                       &hdev->public_addr);
1526
1527                                /* If setting of the BD_ADDR from the device
1528                                 * property succeeds, then treat the address
1529                                 * as valid even if the invalid BD_ADDR
1530                                 * quirk indicates otherwise.
1531                                 */
1532                                if (!ret)
1533                                        invalid_bdaddr = false;
1534                        }
1535                }
1536
1537setup_failed:
1538                /* The transport driver can set these quirks before
1539                 * creating the HCI device or in its setup callback.
1540                 *
1541                 * For the invalid BD_ADDR quirk it is possible that
1542                 * it becomes a valid address if the bootloader does
1543                 * provide it (see above).
1544                 *
1545                 * In case any of them is set, the controller has to
1546                 * start up as unconfigured.
1547                 */
1548                if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1549                    invalid_bdaddr)
1550                        hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1551
1552                /* For an unconfigured controller it is required to
1553                 * read at least the version information provided by
1554                 * the Read Local Version Information command.
1555                 *
1556                 * If the set_bdaddr driver callback is provided, then
1557                 * also the original Bluetooth public device address
1558                 * will be read using the Read BD Address command.
1559                 */
1560                if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1561                        ret = __hci_unconf_init(hdev);
1562        }
1563
1564        if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1565                /* If public address change is configured, ensure that
1566                 * the address gets programmed. If the driver does not
1567                 * support changing the public address, fail the power
1568                 * on procedure.
1569                 */
1570                if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1571                    hdev->set_bdaddr)
1572                        ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1573                else
1574                        ret = -EADDRNOTAVAIL;
1575        }
1576
1577        if (!ret) {
1578                if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1579                    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1580                        ret = __hci_init(hdev);
1581                        if (!ret && hdev->post_init)
1582                                ret = hdev->post_init(hdev);
1583                }
1584        }
1585
1586        /* If the HCI Reset command is clearing all diagnostic settings,
1587         * then they need to be reprogrammed after the init procedure
1588         * completed.
1589         */
1590        if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
1591            !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1592            hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1593                ret = hdev->set_diag(hdev, true);
1594
1595        msft_do_open(hdev);
1596        aosp_do_open(hdev);
1597
1598        clear_bit(HCI_INIT, &hdev->flags);
1599
1600        if (!ret) {
1601                hci_dev_hold(hdev);
1602                hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1603                hci_adv_instances_set_rpa_expired(hdev, true);
1604                set_bit(HCI_UP, &hdev->flags);
1605                hci_sock_dev_event(hdev, HCI_DEV_UP);
1606                hci_leds_update_powered(hdev, true);
1607                if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1608                    !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1609                    !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1610                    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1611                    hci_dev_test_flag(hdev, HCI_MGMT) &&
1612                    hdev->dev_type == HCI_PRIMARY) {
1613                        ret = __hci_req_hci_power_on(hdev);
1614                        mgmt_power_on(hdev, ret);
1615                }
1616        } else {
1617                /* Init failed, cleanup */
1618                flush_work(&hdev->tx_work);
1619
1620                /* Since hci_rx_work() is possible to awake new cmd_work
1621                 * it should be flushed first to avoid unexpected call of
1622                 * hci_cmd_work()
1623                 */
1624                flush_work(&hdev->rx_work);
1625                flush_work(&hdev->cmd_work);
1626
1627                skb_queue_purge(&hdev->cmd_q);
1628                skb_queue_purge(&hdev->rx_q);
1629
1630                if (hdev->flush)
1631                        hdev->flush(hdev);
1632
1633                if (hdev->sent_cmd) {
1634                        kfree_skb(hdev->sent_cmd);
1635                        hdev->sent_cmd = NULL;
1636                }
1637
1638                clear_bit(HCI_RUNNING, &hdev->flags);
1639                hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1640
1641                hdev->close(hdev);
1642                hdev->flags &= BIT(HCI_RAW);
1643        }
1644
1645done:
1646        hci_req_sync_unlock(hdev);
1647        return ret;
1648}
1649
1650/* ---- HCI ioctl helpers ---- */
1651
1652int hci_dev_open(__u16 dev)
1653{
1654        struct hci_dev *hdev;
1655        int err;
1656
1657        hdev = hci_dev_get(dev);
1658        if (!hdev)
1659                return -ENODEV;
1660
1661        /* Devices that are marked as unconfigured can only be powered
1662         * up as user channel. Trying to bring them up as normal devices
1663         * will result into a failure. Only user channel operation is
1664         * possible.
1665         *
1666         * When this function is called for a user channel, the flag
1667         * HCI_USER_CHANNEL will be set first before attempting to
1668         * open the device.
1669         */
1670        if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1671            !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1672                err = -EOPNOTSUPP;
1673                goto done;
1674        }
1675
1676        /* We need to ensure that no other power on/off work is pending
1677         * before proceeding to call hci_dev_do_open. This is
1678         * particularly important if the setup procedure has not yet
1679         * completed.
1680         */
1681        if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1682                cancel_delayed_work(&hdev->power_off);
1683
1684        /* After this call it is guaranteed that the setup procedure
1685         * has finished. This means that error conditions like RFKILL
1686         * or no valid public or static random address apply.
1687         */
1688        flush_workqueue(hdev->req_workqueue);
1689
1690        /* For controllers not using the management interface and that
1691         * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1692         * so that pairing works for them. Once the management interface
1693         * is in use this bit will be cleared again and userspace has
1694         * to explicitly enable it.
1695         */
1696        if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1697            !hci_dev_test_flag(hdev, HCI_MGMT))
1698                hci_dev_set_flag(hdev, HCI_BONDABLE);
1699
1700        err = hci_dev_do_open(hdev);
1701
1702done:
1703        hci_dev_put(hdev);
1704        return err;
1705}
1706
1707/* This function requires the caller holds hdev->lock */
1708static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1709{
1710        struct hci_conn_params *p;
1711
1712        list_for_each_entry(p, &hdev->le_conn_params, list) {
1713                if (p->conn) {
1714                        hci_conn_drop(p->conn);
1715                        hci_conn_put(p->conn);
1716                        p->conn = NULL;
1717                }
1718                list_del_init(&p->action);
1719        }
1720
1721        BT_DBG("All LE pending actions cleared");
1722}
1723
1724int hci_dev_do_close(struct hci_dev *hdev)
1725{
1726        bool auto_off;
1727
1728        BT_DBG("%s %p", hdev->name, hdev);
1729
1730        cancel_delayed_work(&hdev->power_off);
1731        cancel_delayed_work(&hdev->ncmd_timer);
1732
1733        hci_request_cancel_all(hdev);
1734        hci_req_sync_lock(hdev);
1735
1736        if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
1737            !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1738            test_bit(HCI_UP, &hdev->flags)) {
1739                /* Execute vendor specific shutdown routine */
1740                if (hdev->shutdown)
1741                        hdev->shutdown(hdev);
1742        }
1743
1744        if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1745                cancel_delayed_work_sync(&hdev->cmd_timer);
1746                hci_req_sync_unlock(hdev);
1747                return 0;
1748        }
1749
1750        hci_leds_update_powered(hdev, false);
1751
1752        /* Flush RX and TX works */
1753        flush_work(&hdev->tx_work);
1754        flush_work(&hdev->rx_work);
1755
1756        if (hdev->discov_timeout > 0) {
1757                hdev->discov_timeout = 0;
1758                hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1759                hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1760        }
1761
1762        if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1763                cancel_delayed_work(&hdev->service_cache);
1764
1765        if (hci_dev_test_flag(hdev, HCI_MGMT)) {
1766                struct adv_info *adv_instance;
1767
1768                cancel_delayed_work_sync(&hdev->rpa_expired);
1769
1770                list_for_each_entry(adv_instance, &hdev->adv_instances, list)
1771                        cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1772        }
1773
1774        /* Avoid potential lockdep warnings from the *_flush() calls by
1775         * ensuring the workqueue is empty up front.
1776         */
1777        drain_workqueue(hdev->workqueue);
1778
1779        hci_dev_lock(hdev);
1780
1781        hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1782
1783        auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1784
1785        if (!auto_off && hdev->dev_type == HCI_PRIMARY &&
1786            !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1787            hci_dev_test_flag(hdev, HCI_MGMT))
1788                __mgmt_power_off(hdev);
1789
1790        hci_inquiry_cache_flush(hdev);
1791        hci_pend_le_actions_clear(hdev);
1792        hci_conn_hash_flush(hdev);
1793        hci_dev_unlock(hdev);
1794
1795        smp_unregister(hdev);
1796
1797        hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1798
1799        aosp_do_close(hdev);
1800        msft_do_close(hdev);
1801
1802        if (hdev->flush)
1803                hdev->flush(hdev);
1804
1805        /* Reset device */
1806        skb_queue_purge(&hdev->cmd_q);
1807        atomic_set(&hdev->cmd_cnt, 1);
1808        if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1809            !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1810                set_bit(HCI_INIT, &hdev->flags);
1811                __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1812                clear_bit(HCI_INIT, &hdev->flags);
1813        }
1814
1815        /* flush cmd  work */
1816        flush_work(&hdev->cmd_work);
1817
1818        /* Drop queues */
1819        skb_queue_purge(&hdev->rx_q);
1820        skb_queue_purge(&hdev->cmd_q);
1821        skb_queue_purge(&hdev->raw_q);
1822
1823        /* Drop last sent command */
1824        if (hdev->sent_cmd) {
1825                cancel_delayed_work_sync(&hdev->cmd_timer);
1826                kfree_skb(hdev->sent_cmd);
1827                hdev->sent_cmd = NULL;
1828        }
1829
1830        clear_bit(HCI_RUNNING, &hdev->flags);
1831        hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1832
1833        if (test_and_clear_bit(SUSPEND_POWERING_DOWN, hdev->suspend_tasks))
1834                wake_up(&hdev->suspend_wait_q);
1835
1836        /* After this point our queues are empty
1837         * and no tasks are scheduled. */
1838        hdev->close(hdev);
1839
1840        /* Clear flags */
1841        hdev->flags &= BIT(HCI_RAW);
1842        hci_dev_clear_volatile_flags(hdev);
1843
1844        /* Controller radio is available but is currently powered down */
1845        hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1846
1847        memset(hdev->eir, 0, sizeof(hdev->eir));
1848        memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1849        bacpy(&hdev->random_addr, BDADDR_ANY);
1850
1851        hci_req_sync_unlock(hdev);
1852
1853        hci_dev_put(hdev);
1854        return 0;
1855}
1856
1857int hci_dev_close(__u16 dev)
1858{
1859        struct hci_dev *hdev;
1860        int err;
1861
1862        hdev = hci_dev_get(dev);
1863        if (!hdev)
1864                return -ENODEV;
1865
1866        if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1867                err = -EBUSY;
1868                goto done;
1869        }
1870
1871        if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1872                cancel_delayed_work(&hdev->power_off);
1873
1874        err = hci_dev_do_close(hdev);
1875
1876done:
1877        hci_dev_put(hdev);
1878        return err;
1879}
1880
1881static int hci_dev_do_reset(struct hci_dev *hdev)
1882{
1883        int ret;
1884
1885        BT_DBG("%s %p", hdev->name, hdev);
1886
1887        hci_req_sync_lock(hdev);
1888
1889        /* Drop queues */
1890        skb_queue_purge(&hdev->rx_q);
1891        skb_queue_purge(&hdev->cmd_q);
1892
1893        /* Avoid potential lockdep warnings from the *_flush() calls by
1894         * ensuring the workqueue is empty up front.
1895         */
1896        drain_workqueue(hdev->workqueue);
1897
1898        hci_dev_lock(hdev);
1899        hci_inquiry_cache_flush(hdev);
1900        hci_conn_hash_flush(hdev);
1901        hci_dev_unlock(hdev);
1902
1903        if (hdev->flush)
1904                hdev->flush(hdev);
1905
1906        atomic_set(&hdev->cmd_cnt, 1);
1907        hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1908
1909        ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1910
1911        hci_req_sync_unlock(hdev);
1912        return ret;
1913}
1914
1915int hci_dev_reset(__u16 dev)
1916{
1917        struct hci_dev *hdev;
1918        int err;
1919
1920        hdev = hci_dev_get(dev);
1921        if (!hdev)
1922                return -ENODEV;
1923
1924        if (!test_bit(HCI_UP, &hdev->flags)) {
1925                err = -ENETDOWN;
1926                goto done;
1927        }
1928
1929        if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1930                err = -EBUSY;
1931                goto done;
1932        }
1933
1934        if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1935                err = -EOPNOTSUPP;
1936                goto done;
1937        }
1938
1939        err = hci_dev_do_reset(hdev);
1940
1941done:
1942        hci_dev_put(hdev);
1943        return err;
1944}
1945
1946int hci_dev_reset_stat(__u16 dev)
1947{
1948        struct hci_dev *hdev;
1949        int ret = 0;
1950
1951        hdev = hci_dev_get(dev);
1952        if (!hdev)
1953                return -ENODEV;
1954
1955        if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1956                ret = -EBUSY;
1957                goto done;
1958        }
1959
1960        if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1961                ret = -EOPNOTSUPP;
1962                goto done;
1963        }
1964
1965        memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1966
1967done:
1968        hci_dev_put(hdev);
1969        return ret;
1970}
1971
1972static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1973{
1974        bool conn_changed, discov_changed;
1975
1976        BT_DBG("%s scan 0x%02x", hdev->name, scan);
1977
1978        if ((scan & SCAN_PAGE))
1979                conn_changed = !hci_dev_test_and_set_flag(hdev,
1980                                                          HCI_CONNECTABLE);
1981        else
1982                conn_changed = hci_dev_test_and_clear_flag(hdev,
1983                                                           HCI_CONNECTABLE);
1984
1985        if ((scan & SCAN_INQUIRY)) {
1986                discov_changed = !hci_dev_test_and_set_flag(hdev,
1987                                                            HCI_DISCOVERABLE);
1988        } else {
1989                hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1990                discov_changed = hci_dev_test_and_clear_flag(hdev,
1991                                                             HCI_DISCOVERABLE);
1992        }
1993
1994        if (!hci_dev_test_flag(hdev, HCI_MGMT))
1995                return;
1996
1997        if (conn_changed || discov_changed) {
1998                /* In case this was disabled through mgmt */
1999                hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
2000
2001                if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
2002                        hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
2003
2004                mgmt_new_settings(hdev);
2005        }
2006}
2007
2008int hci_dev_cmd(unsigned int cmd, void __user *arg)
2009{
2010        struct hci_dev *hdev;
2011        struct hci_dev_req dr;
2012        int err = 0;
2013
2014        if (copy_from_user(&dr, arg, sizeof(dr)))
2015                return -EFAULT;
2016
2017        hdev = hci_dev_get(dr.dev_id);
2018        if (!hdev)
2019                return -ENODEV;
2020
2021        if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
2022                err = -EBUSY;
2023                goto done;
2024        }
2025
2026        if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
2027                err = -EOPNOTSUPP;
2028                goto done;
2029        }
2030
2031        if (hdev->dev_type != HCI_PRIMARY) {
2032                err = -EOPNOTSUPP;
2033                goto done;
2034        }
2035
2036        if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2037                err = -EOPNOTSUPP;
2038                goto done;
2039        }
2040
2041        switch (cmd) {
2042        case HCISETAUTH:
2043                err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2044                                   HCI_INIT_TIMEOUT, NULL);
2045                break;
2046
2047        case HCISETENCRYPT:
2048                if (!lmp_encrypt_capable(hdev)) {
2049                        err = -EOPNOTSUPP;
2050                        break;
2051                }
2052
2053                if (!test_bit(HCI_AUTH, &hdev->flags)) {
2054                        /* Auth must be enabled first */
2055                        err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2056                                           HCI_INIT_TIMEOUT, NULL);
2057                        if (err)
2058                                break;
2059                }
2060
2061                err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
2062                                   HCI_INIT_TIMEOUT, NULL);
2063                break;
2064
2065        case HCISETSCAN:
2066                err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
2067                                   HCI_INIT_TIMEOUT, NULL);
2068
2069                /* Ensure that the connectable and discoverable states
2070                 * get correctly modified as this was a non-mgmt change.
2071                 */
2072                if (!err)
2073                        hci_update_scan_state(hdev, dr.dev_opt);
2074                break;
2075
2076        case HCISETLINKPOL:
2077                err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
2078                                   HCI_INIT_TIMEOUT, NULL);
2079                break;
2080
2081        case HCISETLINKMODE:
2082                hdev->link_mode = ((__u16) dr.dev_opt) &
2083                                        (HCI_LM_MASTER | HCI_LM_ACCEPT);
2084                break;
2085
2086        case HCISETPTYPE:
2087                if (hdev->pkt_type == (__u16) dr.dev_opt)
2088                        break;
2089
2090                hdev->pkt_type = (__u16) dr.dev_opt;
2091                mgmt_phy_configuration_changed(hdev, NULL);
2092                break;
2093
2094        case HCISETACLMTU:
2095                hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
2096                hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
2097                break;
2098
2099        case HCISETSCOMTU:
2100                hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
2101                hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
2102                break;
2103
2104        default:
2105                err = -EINVAL;
2106                break;
2107        }
2108
2109done:
2110        hci_dev_put(hdev);
2111        return err;
2112}
2113
2114int hci_get_dev_list(void __user *arg)
2115{
2116        struct hci_dev *hdev;
2117        struct hci_dev_list_req *dl;
2118        struct hci_dev_req *dr;
2119        int n = 0, size, err;
2120        __u16 dev_num;
2121
2122        if (get_user(dev_num, (__u16 __user *) arg))
2123                return -EFAULT;
2124
2125        if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2126                return -EINVAL;
2127
2128        size = sizeof(*dl) + dev_num * sizeof(*dr);
2129
2130        dl = kzalloc(size, GFP_KERNEL);
2131        if (!dl)
2132                return -ENOMEM;
2133
2134        dr = dl->dev_req;
2135
2136        read_lock(&hci_dev_list_lock);
2137        list_for_each_entry(hdev, &hci_dev_list, list) {
2138                unsigned long flags = hdev->flags;
2139
2140                /* When the auto-off is configured it means the transport
2141                 * is running, but in that case still indicate that the
2142                 * device is actually down.
2143                 */
2144                if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2145                        flags &= ~BIT(HCI_UP);
2146
2147                (dr + n)->dev_id  = hdev->id;
2148                (dr + n)->dev_opt = flags;
2149
2150                if (++n >= dev_num)
2151                        break;
2152        }
2153        read_unlock(&hci_dev_list_lock);
2154
2155        dl->dev_num = n;
2156        size = sizeof(*dl) + n * sizeof(*dr);
2157
2158        err = copy_to_user(arg, dl, size);
2159        kfree(dl);
2160
2161        return err ? -EFAULT : 0;
2162}
2163
2164int hci_get_dev_info(void __user *arg)
2165{
2166        struct hci_dev *hdev;
2167        struct hci_dev_info di;
2168        unsigned long flags;
2169        int err = 0;
2170
2171        if (copy_from_user(&di, arg, sizeof(di)))
2172                return -EFAULT;
2173
2174        hdev = hci_dev_get(di.dev_id);
2175        if (!hdev)
2176                return -ENODEV;
2177
2178        /* When the auto-off is configured it means the transport
2179         * is running, but in that case still indicate that the
2180         * device is actually down.
2181         */
2182        if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2183                flags = hdev->flags & ~BIT(HCI_UP);
2184        else
2185                flags = hdev->flags;
2186
2187        strcpy(di.name, hdev->name);
2188        di.bdaddr   = hdev->bdaddr;
2189        di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2190        di.flags    = flags;
2191        di.pkt_type = hdev->pkt_type;
2192        if (lmp_bredr_capable(hdev)) {
2193                di.acl_mtu  = hdev->acl_mtu;
2194                di.acl_pkts = hdev->acl_pkts;
2195                di.sco_mtu  = hdev->sco_mtu;
2196                di.sco_pkts = hdev->sco_pkts;
2197        } else {
2198                di.acl_mtu  = hdev->le_mtu;
2199                di.acl_pkts = hdev->le_pkts;
2200                di.sco_mtu  = 0;
2201                di.sco_pkts = 0;
2202        }
2203        di.link_policy = hdev->link_policy;
2204        di.link_mode   = hdev->link_mode;
2205
2206        memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2207        memcpy(&di.features, &hdev->features, sizeof(di.features));
2208
2209        if (copy_to_user(arg, &di, sizeof(di)))
2210                err = -EFAULT;
2211
2212        hci_dev_put(hdev);
2213
2214        return err;
2215}
2216
2217/* ---- Interface to HCI drivers ---- */
2218
2219static int hci_rfkill_set_block(void *data, bool blocked)
2220{
2221        struct hci_dev *hdev = data;
2222
2223        BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2224
2225        if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2226                return -EBUSY;
2227
2228        if (blocked) {
2229                hci_dev_set_flag(hdev, HCI_RFKILLED);
2230                if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2231                    !hci_dev_test_flag(hdev, HCI_CONFIG))
2232                        hci_dev_do_close(hdev);
2233        } else {
2234                hci_dev_clear_flag(hdev, HCI_RFKILLED);
2235        }
2236
2237        return 0;
2238}
2239
2240static const struct rfkill_ops hci_rfkill_ops = {
2241        .set_block = hci_rfkill_set_block,
2242};
2243
2244static void hci_power_on(struct work_struct *work)
2245{
2246        struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2247        int err;
2248
2249        BT_DBG("%s", hdev->name);
2250
2251        if (test_bit(HCI_UP, &hdev->flags) &&
2252            hci_dev_test_flag(hdev, HCI_MGMT) &&
2253            hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
2254                cancel_delayed_work(&hdev->power_off);
2255                hci_req_sync_lock(hdev);
2256                err = __hci_req_hci_power_on(hdev);
2257                hci_req_sync_unlock(hdev);
2258                mgmt_power_on(hdev, err);
2259                return;
2260        }
2261
2262        err = hci_dev_do_open(hdev);
2263        if (err < 0) {
2264                hci_dev_lock(hdev);
2265                mgmt_set_powered_failed(hdev, err);
2266                hci_dev_unlock(hdev);
2267                return;
2268        }
2269
2270        /* During the HCI setup phase, a few error conditions are
2271         * ignored and they need to be checked now. If they are still
2272         * valid, it is important to turn the device back off.
2273         */
2274        if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2275            hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2276            (hdev->dev_type == HCI_PRIMARY &&
2277             !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2278             !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2279                hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2280                hci_dev_do_close(hdev);
2281        } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2282                queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2283                                   HCI_AUTO_OFF_TIMEOUT);
2284        }
2285
2286        if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2287                /* For unconfigured devices, set the HCI_RAW flag
2288                 * so that userspace can easily identify them.
2289                 */
2290                if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2291                        set_bit(HCI_RAW, &hdev->flags);
2292
2293                /* For fully configured devices, this will send
2294                 * the Index Added event. For unconfigured devices,
2295                 * it will send Unconfigued Index Added event.
2296                 *
2297                 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2298                 * and no event will be send.
2299                 */
2300                mgmt_index_added(hdev);
2301        } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2302                /* When the controller is now configured, then it
2303                 * is important to clear the HCI_RAW flag.
2304                 */
2305                if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2306                        clear_bit(HCI_RAW, &hdev->flags);
2307
2308                /* Powering on the controller with HCI_CONFIG set only
2309                 * happens with the transition from unconfigured to
2310                 * configured. This will send the Index Added event.
2311                 */
2312                mgmt_index_added(hdev);
2313        }
2314}
2315
2316static void hci_power_off(struct work_struct *work)
2317{
2318        struct hci_dev *hdev = container_of(work, struct hci_dev,
2319                                            power_off.work);
2320
2321        BT_DBG("%s", hdev->name);
2322
2323        hci_dev_do_close(hdev);
2324}
2325
2326static void hci_error_reset(struct work_struct *work)
2327{
2328        struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2329
2330        BT_DBG("%s", hdev->name);
2331
2332        if (hdev->hw_error)
2333                hdev->hw_error(hdev, hdev->hw_error_code);
2334        else
2335                bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
2336
2337        if (hci_dev_do_close(hdev))
2338                return;
2339
2340        hci_dev_do_open(hdev);
2341}
2342
2343void hci_uuids_clear(struct hci_dev *hdev)
2344{
2345        struct bt_uuid *uuid, *tmp;
2346
2347        list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2348                list_del(&uuid->list);
2349                kfree(uuid);
2350        }
2351}
2352
2353void hci_link_keys_clear(struct hci_dev *hdev)
2354{
2355        struct link_key *key;
2356
2357        list_for_each_entry(key, &hdev->link_keys, list) {
2358                list_del_rcu(&key->list);
2359                kfree_rcu(key, rcu);
2360        }
2361}
2362
2363void hci_smp_ltks_clear(struct hci_dev *hdev)
2364{
2365        struct smp_ltk *k;
2366
2367        list_for_each_entry(k, &hdev->long_term_keys, list) {
2368                list_del_rcu(&k->list);
2369                kfree_rcu(k, rcu);
2370        }
2371}
2372
2373void hci_smp_irks_clear(struct hci_dev *hdev)
2374{
2375        struct smp_irk *k;
2376
2377        list_for_each_entry(k, &hdev->identity_resolving_keys, list) {
2378                list_del_rcu(&k->list);
2379                kfree_rcu(k, rcu);
2380        }
2381}
2382
2383void hci_blocked_keys_clear(struct hci_dev *hdev)
2384{
2385        struct blocked_key *b;
2386
2387        list_for_each_entry(b, &hdev->blocked_keys, list) {
2388                list_del_rcu(&b->list);
2389                kfree_rcu(b, rcu);
2390        }
2391}
2392
2393bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
2394{
2395        bool blocked = false;
2396        struct blocked_key *b;
2397
2398        rcu_read_lock();
2399        list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
2400                if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
2401                        blocked = true;
2402                        break;
2403                }
2404        }
2405
2406        rcu_read_unlock();
2407        return blocked;
2408}
2409
2410struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2411{
2412        struct link_key *k;
2413
2414        rcu_read_lock();
2415        list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2416                if (bacmp(bdaddr, &k->bdaddr) == 0) {
2417                        rcu_read_unlock();
2418
2419                        if (hci_is_blocked_key(hdev,
2420                                               HCI_BLOCKED_KEY_TYPE_LINKKEY,
2421                                               k->val)) {
2422                                bt_dev_warn_ratelimited(hdev,
2423                                                        "Link key blocked for %pMR",
2424                                                        &k->bdaddr);
2425                                return NULL;
2426                        }
2427
2428                        return k;
2429                }
2430        }
2431        rcu_read_unlock();
2432
2433        return NULL;
2434}
2435
2436static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2437                               u8 key_type, u8 old_key_type)
2438{
2439        /* Legacy key */
2440        if (key_type < 0x03)
2441                return true;
2442
2443        /* Debug keys are insecure so don't store them persistently */
2444        if (key_type == HCI_LK_DEBUG_COMBINATION)
2445                return false;
2446
2447        /* Changed combination key and there's no previous one */
2448        if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2449                return false;
2450
2451        /* Security mode 3 case */
2452        if (!conn)
2453                return true;
2454
2455        /* BR/EDR key derived using SC from an LE link */
2456        if (conn->type == LE_LINK)
2457                return true;
2458
2459        /* Neither local nor remote side had no-bonding as requirement */
2460        if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2461                return true;
2462
2463        /* Local side had dedicated bonding as requirement */
2464        if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2465                return true;
2466
2467        /* Remote side had dedicated bonding as requirement */
2468        if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2469                return true;
2470
2471        /* If none of the above criteria match, then don't store the key
2472         * persistently */
2473        return false;
2474}
2475
2476static u8 ltk_role(u8 type)
2477{
2478        if (type == SMP_LTK)
2479                return HCI_ROLE_MASTER;
2480
2481        return HCI_ROLE_SLAVE;
2482}
2483
2484struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2485                             u8 addr_type, u8 role)
2486{
2487        struct smp_ltk *k;
2488
2489        rcu_read_lock();
2490        list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2491                if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2492                        continue;
2493
2494                if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2495                        rcu_read_unlock();
2496
2497                        if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
2498                                               k->val)) {
2499                                bt_dev_warn_ratelimited(hdev,
2500                                                        "LTK blocked for %pMR",
2501                                                        &k->bdaddr);
2502                                return NULL;
2503                        }
2504
2505                        return k;
2506                }
2507        }
2508        rcu_read_unlock();
2509
2510        return NULL;
2511}
2512
2513struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2514{
2515        struct smp_irk *irk_to_return = NULL;
2516        struct smp_irk *irk;
2517
2518        rcu_read_lock();
2519        list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2520                if (!bacmp(&irk->rpa, rpa)) {
2521                        irk_to_return = irk;
2522                        goto done;
2523                }
2524        }
2525
2526        list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2527                if (smp_irk_matches(hdev, irk->val, rpa)) {
2528                        bacpy(&irk->rpa, rpa);
2529                        irk_to_return = irk;
2530                        goto done;
2531                }
2532        }
2533
2534done:
2535        if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2536                                                irk_to_return->val)) {
2537                bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
2538                                        &irk_to_return->bdaddr);
2539                irk_to_return = NULL;
2540        }
2541
2542        rcu_read_unlock();
2543
2544        return irk_to_return;
2545}
2546
2547struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2548                                     u8 addr_type)
2549{
2550        struct smp_irk *irk_to_return = NULL;
2551        struct smp_irk *irk;
2552
2553        /* Identity Address must be public or static random */
2554        if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2555                return NULL;
2556
2557        rcu_read_lock();
2558        list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2559                if (addr_type == irk->addr_type &&
2560                    bacmp(bdaddr, &irk->bdaddr) == 0) {
2561                        irk_to_return = irk;
2562                        goto done;
2563                }
2564        }
2565
2566done:
2567
2568        if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2569                                                irk_to_return->val)) {
2570                bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
2571                                        &irk_to_return->bdaddr);
2572                irk_to_return = NULL;
2573        }
2574
2575        rcu_read_unlock();
2576
2577        return irk_to_return;
2578}
2579
2580struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2581                                  bdaddr_t *bdaddr, u8 *val, u8 type,
2582                                  u8 pin_len, bool *persistent)
2583{
2584        struct link_key *key, *old_key;
2585        u8 old_key_type;
2586
2587        old_key = hci_find_link_key(hdev, bdaddr);
2588        if (old_key) {
2589                old_key_type = old_key->type;
2590                key = old_key;
2591        } else {
2592                old_key_type = conn ? conn->key_type : 0xff;
2593                key = kzalloc(sizeof(*key), GFP_KERNEL);
2594                if (!key)
2595                        return NULL;
2596                list_add_rcu(&key->list, &hdev->link_keys);
2597        }
2598
2599        BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2600
2601        /* Some buggy controller combinations generate a changed
2602         * combination key for legacy pairing even when there's no
2603         * previous key */
2604        if (type == HCI_LK_CHANGED_COMBINATION &&
2605            (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2606                type = HCI_LK_COMBINATION;
2607                if (conn)
2608                        conn->key_type = type;
2609        }
2610
2611        bacpy(&key->bdaddr, bdaddr);
2612        memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2613        key->pin_len = pin_len;
2614
2615        if (type == HCI_LK_CHANGED_COMBINATION)
2616                key->type = old_key_type;
2617        else
2618                key->type = type;
2619
2620        if (persistent)
2621                *persistent = hci_persistent_key(hdev, conn, type,
2622                                                 old_key_type);
2623
2624        return key;
2625}
2626
2627struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2628                            u8 addr_type, u8 type, u8 authenticated,
2629                            u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2630{
2631        struct smp_ltk *key, *old_key;
2632        u8 role = ltk_role(type);
2633
2634        old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2635        if (old_key)
2636                key = old_key;
2637        else {
2638                key = kzalloc(sizeof(*key), GFP_KERNEL);
2639                if (!key)
2640                        return NULL;
2641                list_add_rcu(&key->list, &hdev->long_term_keys);
2642        }
2643
2644        bacpy(&key->bdaddr, bdaddr);
2645        key->bdaddr_type = addr_type;
2646        memcpy(key->val, tk, sizeof(key->val));
2647        key->authenticated = authenticated;
2648        key->ediv = ediv;
2649        key->rand = rand;
2650        key->enc_size = enc_size;
2651        key->type = type;
2652
2653        return key;
2654}
2655
2656struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2657                            u8 addr_type, u8 val[16], bdaddr_t *rpa)
2658{
2659        struct smp_irk *irk;
2660
2661        irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2662        if (!irk) {
2663                irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2664                if (!irk)
2665                        return NULL;
2666
2667                bacpy(&irk->bdaddr, bdaddr);
2668                irk->addr_type = addr_type;
2669
2670                list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2671        }
2672
2673        memcpy(irk->val, val, 16);
2674        bacpy(&irk->rpa, rpa);
2675
2676        return irk;
2677}
2678
2679int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2680{
2681        struct link_key *key;
2682
2683        key = hci_find_link_key(hdev, bdaddr);
2684        if (!key)
2685                return -ENOENT;
2686
2687        BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2688
2689        list_del_rcu(&key->list);
2690        kfree_rcu(key, rcu);
2691
2692        return 0;
2693}
2694
2695int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2696{
2697        struct smp_ltk *k;
2698        int removed = 0;
2699
2700        list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2701                if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2702                        continue;
2703
2704                BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2705
2706                list_del_rcu(&k->list);
2707                kfree_rcu(k, rcu);
2708                removed++;
2709        }
2710
2711        return removed ? 0 : -ENOENT;
2712}
2713
2714void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2715{
2716        struct smp_irk *k;
2717
2718        list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2719                if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2720                        continue;
2721
2722                BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2723
2724                list_del_rcu(&k->list);
2725                kfree_rcu(k, rcu);
2726        }
2727}
2728
2729bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2730{
2731        struct smp_ltk *k;
2732        struct smp_irk *irk;
2733        u8 addr_type;
2734
2735        if (type == BDADDR_BREDR) {
2736                if (hci_find_link_key(hdev, bdaddr))
2737                        return true;
2738                return false;
2739        }
2740
2741        /* Convert to HCI addr type which struct smp_ltk uses */
2742        if (type == BDADDR_LE_PUBLIC)
2743                addr_type = ADDR_LE_DEV_PUBLIC;
2744        else
2745                addr_type = ADDR_LE_DEV_RANDOM;
2746
2747        irk = hci_get_irk(hdev, bdaddr, addr_type);
2748        if (irk) {
2749                bdaddr = &irk->bdaddr;
2750                addr_type = irk->addr_type;
2751        }
2752
2753        rcu_read_lock();
2754        list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2755                if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2756                        rcu_read_unlock();
2757                        return true;
2758                }
2759        }
2760        rcu_read_unlock();
2761
2762        return false;
2763}
2764
2765/* HCI command timer function */
2766static void hci_cmd_timeout(struct work_struct *work)
2767{
2768        struct hci_dev *hdev = container_of(work, struct hci_dev,
2769                                            cmd_timer.work);
2770
2771        if (hdev->sent_cmd) {
2772                struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2773                u16 opcode = __le16_to_cpu(sent->opcode);
2774
2775                bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
2776        } else {
2777                bt_dev_err(hdev, "command tx timeout");
2778        }
2779
2780        if (hdev->cmd_timeout)
2781                hdev->cmd_timeout(hdev);
2782
2783        atomic_set(&hdev->cmd_cnt, 1);
2784        queue_work(hdev->workqueue, &hdev->cmd_work);
2785}
2786
2787/* HCI ncmd timer function */
2788static void hci_ncmd_timeout(struct work_struct *work)
2789{
2790        struct hci_dev *hdev = container_of(work, struct hci_dev,
2791                                            ncmd_timer.work);
2792
2793        bt_dev_err(hdev, "Controller not accepting commands anymore: ncmd = 0");
2794
2795        /* During HCI_INIT phase no events can be injected if the ncmd timer
2796         * triggers since the procedure has its own timeout handling.
2797         */
2798        if (test_bit(HCI_INIT, &hdev->flags))
2799                return;
2800
2801        /* This is an irrecoverable state, inject hardware error event */
2802        hci_reset_dev(hdev);
2803}
2804
2805struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2806                                          bdaddr_t *bdaddr, u8 bdaddr_type)
2807{
2808        struct oob_data *data;
2809
2810        list_for_each_entry(data, &hdev->remote_oob_data, list) {
2811                if (bacmp(bdaddr, &data->bdaddr) != 0)
2812                        continue;
2813                if (data->bdaddr_type != bdaddr_type)
2814                        continue;
2815                return data;
2816        }
2817
2818        return NULL;
2819}
2820
2821int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2822                               u8 bdaddr_type)
2823{
2824        struct oob_data *data;
2825
2826        data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2827        if (!data)
2828                return -ENOENT;
2829
2830        BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2831
2832        list_del(&data->list);
2833        kfree(data);
2834
2835        return 0;
2836}
2837
2838void hci_remote_oob_data_clear(struct hci_dev *hdev)
2839{
2840        struct oob_data *data, *n;
2841
2842        list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2843                list_del(&data->list);
2844                kfree(data);
2845        }
2846}
2847
2848int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2849                            u8 bdaddr_type, u8 *hash192, u8 *rand192,
2850                            u8 *hash256, u8 *rand256)
2851{
2852        struct oob_data *data;
2853
2854        data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2855        if (!data) {
2856                data = kmalloc(sizeof(*data), GFP_KERNEL);
2857                if (!data)
2858                        return -ENOMEM;
2859
2860                bacpy(&data->bdaddr, bdaddr);
2861                data->bdaddr_type = bdaddr_type;
2862                list_add(&data->list, &hdev->remote_oob_data);
2863        }
2864
2865        if (hash192 && rand192) {
2866                memcpy(data->hash192, hash192, sizeof(data->hash192));
2867                memcpy(data->rand192, rand192, sizeof(data->rand192));
2868                if (hash256 && rand256)
2869                        data->present = 0x03;
2870        } else {
2871                memset(data->hash192, 0, sizeof(data->hash192));
2872                memset(data->rand192, 0, sizeof(data->rand192));
2873                if (hash256 && rand256)
2874                        data->present = 0x02;
2875                else
2876                        data->present = 0x00;
2877        }
2878
2879        if (hash256 && rand256) {
2880                memcpy(data->hash256, hash256, sizeof(data->hash256));
2881                memcpy(data->rand256, rand256, sizeof(data->rand256));
2882        } else {
2883                memset(data->hash256, 0, sizeof(data->hash256));
2884                memset(data->rand256, 0, sizeof(data->rand256));
2885                if (hash192 && rand192)
2886                        data->present = 0x01;
2887        }
2888
2889        BT_DBG("%s for %pMR", hdev->name, bdaddr);
2890
2891        return 0;
2892}
2893
2894/* This function requires the caller holds hdev->lock */
2895struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2896{
2897        struct adv_info *adv_instance;
2898
2899        list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2900                if (adv_instance->instance == instance)
2901                        return adv_instance;
2902        }
2903
2904        return NULL;
2905}
2906
2907/* This function requires the caller holds hdev->lock */
2908struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2909{
2910        struct adv_info *cur_instance;
2911
2912        cur_instance = hci_find_adv_instance(hdev, instance);
2913        if (!cur_instance)
2914                return NULL;
2915
2916        if (cur_instance == list_last_entry(&hdev->adv_instances,
2917                                            struct adv_info, list))
2918                return list_first_entry(&hdev->adv_instances,
2919                                                 struct adv_info, list);
2920        else
2921                return list_next_entry(cur_instance, list);
2922}
2923
2924/* This function requires the caller holds hdev->lock */
2925int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2926{
2927        struct adv_info *adv_instance;
2928
2929        adv_instance = hci_find_adv_instance(hdev, instance);
2930        if (!adv_instance)
2931                return -ENOENT;
2932
2933        BT_DBG("%s removing %dMR", hdev->name, instance);
2934
2935        if (hdev->cur_adv_instance == instance) {
2936                if (hdev->adv_instance_timeout) {
2937                        cancel_delayed_work(&hdev->adv_instance_expire);
2938                        hdev->adv_instance_timeout = 0;
2939                }
2940                hdev->cur_adv_instance = 0x00;
2941        }
2942
2943        cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2944
2945        list_del(&adv_instance->list);
2946        kfree(adv_instance);
2947
2948        hdev->adv_instance_cnt--;
2949
2950        return 0;
2951}
2952
2953void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
2954{
2955        struct adv_info *adv_instance, *n;
2956
2957        list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
2958                adv_instance->rpa_expired = rpa_expired;
2959}
2960
2961/* This function requires the caller holds hdev->lock */
2962void hci_adv_instances_clear(struct hci_dev *hdev)
2963{
2964        struct adv_info *adv_instance, *n;
2965
2966        if (hdev->adv_instance_timeout) {
2967                cancel_delayed_work(&hdev->adv_instance_expire);
2968                hdev->adv_instance_timeout = 0;
2969        }
2970
2971        list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
2972                cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2973                list_del(&adv_instance->list);
2974                kfree(adv_instance);
2975        }
2976
2977        hdev->adv_instance_cnt = 0;
2978        hdev->cur_adv_instance = 0x00;
2979}
2980
2981static void adv_instance_rpa_expired(struct work_struct *work)
2982{
2983        struct adv_info *adv_instance = container_of(work, struct adv_info,
2984                                                     rpa_expired_cb.work);
2985
2986        BT_DBG("");
2987
2988        adv_instance->rpa_expired = true;
2989}
2990
2991/* This function requires the caller holds hdev->lock */
2992int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2993                         u16 adv_data_len, u8 *adv_data,
2994                         u16 scan_rsp_len, u8 *scan_rsp_data,
2995                         u16 timeout, u16 duration, s8 tx_power,
2996                         u32 min_interval, u32 max_interval)
2997{
2998        struct adv_info *adv_instance;
2999
3000        adv_instance = hci_find_adv_instance(hdev, instance);
3001        if (adv_instance) {
3002                memset(adv_instance->adv_data, 0,
3003                       sizeof(adv_instance->adv_data));
3004                memset(adv_instance->scan_rsp_data, 0,
3005                       sizeof(adv_instance->scan_rsp_data));
3006        } else {
3007                if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
3008                    instance < 1 || instance > hdev->le_num_of_adv_sets)
3009                        return -EOVERFLOW;
3010
3011                adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
3012                if (!adv_instance)
3013                        return -ENOMEM;
3014
3015                adv_instance->pending = true;
3016                adv_instance->instance = instance;
3017                list_add(&adv_instance->list, &hdev->adv_instances);
3018                hdev->adv_instance_cnt++;
3019        }
3020
3021        adv_instance->flags = flags;
3022        adv_instance->adv_data_len = adv_data_len;
3023        adv_instance->scan_rsp_len = scan_rsp_len;
3024        adv_instance->min_interval = min_interval;
3025        adv_instance->max_interval = max_interval;
3026        adv_instance->tx_power = tx_power;
3027
3028        if (adv_data_len)
3029                memcpy(adv_instance->adv_data, adv_data, adv_data_len);
3030
3031        if (scan_rsp_len)
3032                memcpy(adv_instance->scan_rsp_data,
3033                       scan_rsp_data, scan_rsp_len);
3034
3035        adv_instance->timeout = timeout;
3036        adv_instance->remaining_time = timeout;
3037
3038        if (duration == 0)
3039                adv_instance->duration = hdev->def_multi_adv_rotation_duration;
3040        else
3041                adv_instance->duration = duration;
3042
3043        INIT_DELAYED_WORK(&adv_instance->rpa_expired_cb,
3044                          adv_instance_rpa_expired);
3045
3046        BT_DBG("%s for %dMR", hdev->name, instance);
3047
3048        return 0;
3049}
3050
3051/* This function requires the caller holds hdev->lock */
3052int hci_set_adv_instance_data(struct hci_dev *hdev, u8 instance,
3053                              u16 adv_data_len, u8 *adv_data,
3054                              u16 scan_rsp_len, u8 *scan_rsp_data)
3055{
3056        struct adv_info *adv_instance;
3057
3058        adv_instance = hci_find_adv_instance(hdev, instance);
3059
3060        /* If advertisement doesn't exist, we can't modify its data */
3061        if (!adv_instance)
3062                return -ENOENT;
3063
3064        if (adv_data_len) {
3065                memset(adv_instance->adv_data, 0,
3066                       sizeof(adv_instance->adv_data));
3067                memcpy(adv_instance->adv_data, adv_data, adv_data_len);
3068                adv_instance->adv_data_len = adv_data_len;
3069        }
3070
3071        if (scan_rsp_len) {
3072                memset(adv_instance->scan_rsp_data, 0,
3073                       sizeof(adv_instance->scan_rsp_data));
3074                memcpy(adv_instance->scan_rsp_data,
3075                       scan_rsp_data, scan_rsp_len);
3076                adv_instance->scan_rsp_len = scan_rsp_len;
3077        }
3078
3079        return 0;
3080}
3081
3082/* This function requires the caller holds hdev->lock */
3083void hci_adv_monitors_clear(struct hci_dev *hdev)
3084{
3085        struct adv_monitor *monitor;
3086        int handle;
3087
3088        idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
3089                hci_free_adv_monitor(hdev, monitor);
3090
3091        idr_destroy(&hdev->adv_monitors_idr);
3092}
3093
3094/* Frees the monitor structure and do some bookkeepings.
3095 * This function requires the caller holds hdev->lock.
3096 */
3097void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
3098{
3099        struct adv_pattern *pattern;
3100        struct adv_pattern *tmp;
3101
3102        if (!monitor)
3103                return;
3104
3105        list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list) {
3106                list_del(&pattern->list);
3107                kfree(pattern);
3108        }
3109
3110        if (monitor->handle)
3111                idr_remove(&hdev->adv_monitors_idr, monitor->handle);
3112
3113        if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) {
3114                hdev->adv_monitors_cnt--;
3115                mgmt_adv_monitor_removed(hdev, monitor->handle);
3116        }
3117
3118        kfree(monitor);
3119}
3120
3121int hci_add_adv_patterns_monitor_complete(struct hci_dev *hdev, u8 status)
3122{
3123        return mgmt_add_adv_patterns_monitor_complete(hdev, status);
3124}
3125
3126int hci_remove_adv_monitor_complete(struct hci_dev *hdev, u8 status)
3127{
3128        return mgmt_remove_adv_monitor_complete(hdev, status);
3129}
3130
3131/* Assigns handle to a monitor, and if offloading is supported and power is on,
3132 * also attempts to forward the request to the controller.
3133 * Returns true if request is forwarded (result is pending), false otherwise.
3134 * This function requires the caller holds hdev->lock.
3135 */
3136bool hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor,
3137                         int *err)
3138{
3139        int min, max, handle;
3140
3141        *err = 0;
3142
3143        if (!monitor) {
3144                *err = -EINVAL;
3145                return false;
3146        }
3147
3148        min = HCI_MIN_ADV_MONITOR_HANDLE;
3149        max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES;
3150        handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max,
3151                           GFP_KERNEL);
3152        if (handle < 0) {
3153                *err = handle;
3154                return false;
3155        }
3156
3157        monitor->handle = handle;
3158
3159        if (!hdev_is_powered(hdev))
3160                return false;
3161
3162        switch (hci_get_adv_monitor_offload_ext(hdev)) {
3163        case HCI_ADV_MONITOR_EXT_NONE:
3164                hci_update_background_scan(hdev);
3165                bt_dev_dbg(hdev, "%s add monitor status %d", hdev->name, *err);
3166                /* Message was not forwarded to controller - not an error */
3167                return false;
3168        case HCI_ADV_MONITOR_EXT_MSFT:
3169                *err = msft_add_monitor_pattern(hdev, monitor);
3170                bt_dev_dbg(hdev, "%s add monitor msft status %d", hdev->name,
3171                           *err);
3172                break;
3173        }
3174
3175        return (*err == 0);
3176}
3177
3178/* Attempts to tell the controller and free the monitor. If somehow the
3179 * controller doesn't have a corresponding handle, remove anyway.
3180 * Returns true if request is forwarded (result is pending), false otherwise.
3181 * This function requires the caller holds hdev->lock.
3182 */
3183static bool hci_remove_adv_monitor(struct hci_dev *hdev,
3184                                   struct adv_monitor *monitor,
3185                                   u16 handle, int *err)
3186{
3187        *err = 0;
3188
3189        switch (hci_get_adv_monitor_offload_ext(hdev)) {
3190        case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */
3191                goto free_monitor;
3192        case HCI_ADV_MONITOR_EXT_MSFT:
3193                *err = msft_remove_monitor(hdev, monitor, handle);
3194                break;
3195        }
3196
3197        /* In case no matching handle registered, just free the monitor */
3198        if (*err == -ENOENT)
3199                goto free_monitor;
3200
3201        return (*err == 0);
3202
3203free_monitor:
3204        if (*err == -ENOENT)
3205                bt_dev_warn(hdev, "Removing monitor with no matching handle %d",
3206                            monitor->handle);
3207        hci_free_adv_monitor(hdev, monitor);
3208
3209        *err = 0;
3210        return false;
3211}
3212
3213/* Returns true if request is forwarded (result is pending), false otherwise.
3214 * This function requires the caller holds hdev->lock.
3215 */
3216bool hci_remove_single_adv_monitor(struct hci_dev *hdev, u16 handle, int *err)
3217{
3218        struct adv_monitor *monitor = idr_find(&hdev->adv_monitors_idr, handle);
3219        bool pending;
3220
3221        if (!monitor) {
3222                *err = -EINVAL;
3223                return false;
3224        }
3225
3226        pending = hci_remove_adv_monitor(hdev, monitor, handle, err);
3227        if (!*err && !pending)
3228                hci_update_background_scan(hdev);
3229
3230        bt_dev_dbg(hdev, "%s remove monitor handle %d, status %d, %spending",
3231                   hdev->name, handle, *err, pending ? "" : "not ");
3232
3233        return pending;
3234}
3235
3236/* Returns true if request is forwarded (result is pending), false otherwise.
3237 * This function requires the caller holds hdev->lock.
3238 */
3239bool hci_remove_all_adv_monitor(struct hci_dev *hdev, int *err)
3240{
3241        struct adv_monitor *monitor;
3242        int idr_next_id = 0;
3243        bool pending = false;
3244        bool update = false;
3245
3246        *err = 0;
3247
3248        while (!*err && !pending) {
3249                monitor = idr_get_next(&hdev->adv_monitors_idr, &idr_next_id);
3250                if (!monitor)
3251                        break;
3252
3253                pending = hci_remove_adv_monitor(hdev, monitor, 0, err);
3254
3255                if (!*err && !pending)
3256                        update = true;
3257        }
3258
3259        if (update)
3260                hci_update_background_scan(hdev);
3261
3262        bt_dev_dbg(hdev, "%s remove all monitors status %d, %spending",
3263                   hdev->name, *err, pending ? "" : "not ");
3264
3265        return pending;
3266}
3267
3268/* This function requires the caller holds hdev->lock */
3269bool hci_is_adv_monitoring(struct hci_dev *hdev)
3270{
3271        return !idr_is_empty(&hdev->adv_monitors_idr);
3272}
3273
3274int hci_get_adv_monitor_offload_ext(struct hci_dev *hdev)
3275{
3276        if (msft_monitor_supported(hdev))
3277                return HCI_ADV_MONITOR_EXT_MSFT;
3278
3279        return HCI_ADV_MONITOR_EXT_NONE;
3280}
3281
3282struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
3283                                         bdaddr_t *bdaddr, u8 type)
3284{
3285        struct bdaddr_list *b;
3286
3287        list_for_each_entry(b, bdaddr_list, list) {
3288                if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3289                        return b;
3290        }
3291
3292        return NULL;
3293}
3294
3295struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
3296                                struct list_head *bdaddr_list, bdaddr_t *bdaddr,
3297                                u8 type)
3298{
3299        struct bdaddr_list_with_irk *b;
3300
3301        list_for_each_entry(b, bdaddr_list, list) {
3302                if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3303                        return b;
3304        }
3305
3306        return NULL;
3307}
3308
3309struct bdaddr_list_with_flags *
3310hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list,
3311                                  bdaddr_t *bdaddr, u8 type)
3312{
3313        struct bdaddr_list_with_flags *b;
3314
3315        list_for_each_entry(b, bdaddr_list, list) {
3316                if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3317                        return b;
3318        }
3319
3320        return NULL;
3321}
3322
3323void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
3324{
3325        struct bdaddr_list *b, *n;
3326
3327        list_for_each_entry_safe(b, n, bdaddr_list, list) {
3328                list_del(&b->list);
3329                kfree(b);
3330        }
3331}
3332
3333int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
3334{
3335        struct bdaddr_list *entry;
3336
3337        if (!bacmp(bdaddr, BDADDR_ANY))
3338                return -EBADF;
3339
3340        if (hci_bdaddr_list_lookup(list, bdaddr, type))
3341                return -EEXIST;
3342
3343        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3344        if (!entry)
3345                return -ENOMEM;
3346
3347        bacpy(&entry->bdaddr, bdaddr);
3348        entry->bdaddr_type = type;
3349
3350        list_add(&entry->list, list);
3351
3352        return 0;
3353}
3354
3355int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3356                                        u8 type, u8 *peer_irk, u8 *local_irk)
3357{
3358        struct bdaddr_list_with_irk *entry;
3359
3360        if (!bacmp(bdaddr, BDADDR_ANY))
3361                return -EBADF;
3362
3363        if (hci_bdaddr_list_lookup(list, bdaddr, type))
3364                return -EEXIST;
3365
3366        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3367        if (!entry)
3368                return -ENOMEM;
3369
3370        bacpy(&entry->bdaddr, bdaddr);
3371        entry->bdaddr_type = type;
3372
3373        if (peer_irk)
3374                memcpy(entry->peer_irk, peer_irk, 16);
3375
3376        if (local_irk)
3377                memcpy(entry->local_irk, local_irk, 16);
3378
3379        list_add(&entry->list, list);
3380
3381        return 0;
3382}
3383
3384int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr,
3385                                   u8 type, u32 flags)
3386{
3387        struct bdaddr_list_with_flags *entry;
3388
3389        if (!bacmp(bdaddr, BDADDR_ANY))
3390                return -EBADF;
3391
3392        if (hci_bdaddr_list_lookup(list, bdaddr, type))
3393                return -EEXIST;
3394
3395        entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3396        if (!entry)
3397                return -ENOMEM;
3398
3399        bacpy(&entry->bdaddr, bdaddr);
3400        entry->bdaddr_type = type;
3401        entry->current_flags = flags;
3402
3403        list_add(&entry->list, list);
3404
3405        return 0;
3406}
3407
3408int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
3409{
3410        struct bdaddr_list *entry;
3411
3412        if (!bacmp(bdaddr, BDADDR_ANY)) {
3413                hci_bdaddr_list_clear(list);
3414                return 0;
3415        }
3416
3417        entry = hci_bdaddr_list_lookup(list, bdaddr, type);
3418        if (!entry)
3419                return -ENOENT;
3420
3421        list_del(&entry->list);
3422        kfree(entry);
3423
3424        return 0;
3425}
3426
3427int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3428                                                        u8 type)
3429{
3430        struct bdaddr_list_with_irk *entry;
3431
3432        if (!bacmp(bdaddr, BDADDR_ANY)) {
3433                hci_bdaddr_list_clear(list);
3434                return 0;
3435        }
3436
3437        entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
3438        if (!entry)
3439                return -ENOENT;
3440
3441        list_del(&entry->list);
3442        kfree(entry);
3443
3444        return 0;
3445}
3446
3447int hci_bdaddr_list_del_with_flags(struct list_head *list, bdaddr_t *bdaddr,
3448                                   u8 type)
3449{
3450        struct bdaddr_list_with_flags *entry;
3451
3452        if (!bacmp(bdaddr, BDADDR_ANY)) {
3453                hci_bdaddr_list_clear(list);
3454                return 0;
3455        }
3456
3457        entry = hci_bdaddr_list_lookup_with_flags(list, bdaddr, type);
3458        if (!entry)
3459                return -ENOENT;
3460
3461        list_del(&entry->list);
3462        kfree(entry);
3463
3464        return 0;
3465}
3466
3467/* This function requires the caller holds hdev->lock */
3468struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
3469                                               bdaddr_t *addr, u8 addr_type)
3470{
3471        struct hci_conn_params *params;
3472
3473        list_for_each_entry(params, &hdev->le_conn_params, list) {
3474                if (bacmp(&params->addr, addr) == 0 &&
3475                    params->addr_type == addr_type) {
3476                        return params;
3477                }
3478        }
3479
3480        return NULL;
3481}
3482
3483/* This function requires the caller holds hdev->lock */
3484struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
3485                                                  bdaddr_t *addr, u8 addr_type)
3486{
3487        struct hci_conn_params *param;
3488
3489        switch (addr_type) {
3490        case ADDR_LE_DEV_PUBLIC_RESOLVED:
3491                addr_type = ADDR_LE_DEV_PUBLIC;
3492                break;
3493        case ADDR_LE_DEV_RANDOM_RESOLVED:
3494                addr_type = ADDR_LE_DEV_RANDOM;
3495                break;
3496        }
3497
3498        list_for_each_entry(param, list, action) {
3499                if (bacmp(&param->addr, addr) == 0 &&
3500                    param->addr_type == addr_type)
3501                        return param;
3502        }
3503
3504        return NULL;
3505}
3506
3507/* This function requires the caller holds hdev->lock */
3508struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
3509                                            bdaddr_t *addr, u8 addr_type)
3510{
3511        struct hci_conn_params *params;
3512
3513        params = hci_conn_params_lookup(hdev, addr, addr_type);
3514        if (params)
3515                return params;
3516
3517        params = kzalloc(sizeof(*params), GFP_KERNEL);
3518        if (!params) {
3519                bt_dev_err(hdev, "out of memory");
3520                return NULL;
3521        }
3522
3523        bacpy(&params->addr, addr);
3524        params->addr_type = addr_type;
3525
3526        list_add(&params->list, &hdev->le_conn_params);
3527        INIT_LIST_HEAD(&params->action);
3528
3529        params->conn_min_interval = hdev->le_conn_min_interval;
3530        params->conn_max_interval = hdev->le_conn_max_interval;
3531        params->conn_latency = hdev->le_conn_latency;
3532        params->supervision_timeout = hdev->le_supv_timeout;
3533        params->auto_connect = HCI_AUTO_CONN_DISABLED;
3534
3535        BT_DBG("addr %pMR (type %u)", addr, addr_type);
3536
3537        return params;
3538}
3539
3540static void hci_conn_params_free(struct hci_conn_params *params)
3541{
3542        if (params->conn) {
3543                hci_conn_drop(params->conn);
3544                hci_conn_put(params->conn);
3545        }
3546
3547        list_del(&params->action);
3548        list_del(&params->list);
3549        kfree(params);
3550}
3551
3552/* This function requires the caller holds hdev->lock */
3553void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3554{
3555        struct hci_conn_params *params;
3556
3557        params = hci_conn_params_lookup(hdev, addr, addr_type);
3558        if (!params)
3559                return;
3560
3561        hci_conn_params_free(params);
3562
3563        hci_update_background_scan(hdev);
3564
3565        BT_DBG("addr %pMR (type %u)", addr, addr_type);
3566}
3567
3568/* This function requires the caller holds hdev->lock */
3569void hci_conn_params_clear_disabled(struct hci_dev *hdev)
3570{
3571        struct hci_conn_params *params, *tmp;
3572
3573        list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3574                if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3575                        continue;
3576
3577                /* If trying to establish one time connection to disabled
3578                 * device, leave the params, but mark them as just once.
3579                 */
3580                if (params->explicit_connect) {
3581                        params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3582                        continue;
3583                }
3584
3585                list_del(&params->list);
3586                kfree(params);
3587        }
3588
3589        BT_DBG("All LE disabled connection parameters were removed");
3590}
3591
3592/* This function requires the caller holds hdev->lock */
3593static void hci_conn_params_clear_all(struct hci_dev *hdev)
3594{
3595        struct hci_conn_params *params, *tmp;
3596
3597        list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
3598                hci_conn_params_free(params);
3599
3600        BT_DBG("All LE connection parameters were removed");
3601}
3602
3603/* Copy the Identity Address of the controller.
3604 *
3605 * If the controller has a public BD_ADDR, then by default use that one.
3606 * If this is a LE only controller without a public address, default to
3607 * the static random address.
3608 *
3609 * For debugging purposes it is possible to force controllers with a
3610 * public address to use the static random address instead.
3611 *
3612 * In case BR/EDR has been disabled on a dual-mode controller and
3613 * userspace has configured a static address, then that address
3614 * becomes the identity address instead of the public BR/EDR address.
3615 */
3616void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3617                               u8 *bdaddr_type)
3618{
3619        if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
3620            !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
3621            (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3622             bacmp(&hdev->static_addr, BDADDR_ANY))) {
3623                bacpy(bdaddr, &hdev->static_addr);
3624                *bdaddr_type = ADDR_LE_DEV_RANDOM;
3625        } else {
3626                bacpy(bdaddr, &hdev->bdaddr);
3627                *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3628        }
3629}
3630
3631static void hci_suspend_clear_tasks(struct hci_dev *hdev)
3632{
3633        int i;
3634
3635        for (i = 0; i < __SUSPEND_NUM_TASKS; i++)
3636                clear_bit(i, hdev->suspend_tasks);
3637
3638        wake_up(&hdev->suspend_wait_q);
3639}
3640
3641static int hci_suspend_wait_event(struct hci_dev *hdev)
3642{
3643#define WAKE_COND                                                              \
3644        (find_first_bit(hdev->suspend_tasks, __SUSPEND_NUM_TASKS) ==           \
3645         __SUSPEND_NUM_TASKS)
3646
3647        int i;
3648        int ret = wait_event_timeout(hdev->suspend_wait_q,
3649                                     WAKE_COND, SUSPEND_NOTIFIER_TIMEOUT);
3650
3651        if (ret == 0) {
3652                bt_dev_err(hdev, "Timed out waiting for suspend events");
3653                for (i = 0; i < __SUSPEND_NUM_TASKS; ++i) {
3654                        if (test_bit(i, hdev->suspend_tasks))
3655                                bt_dev_err(hdev, "Suspend timeout bit: %d", i);
3656                        clear_bit(i, hdev->suspend_tasks);
3657                }
3658
3659                ret = -ETIMEDOUT;
3660        } else {
3661                ret = 0;
3662        }
3663
3664        return ret;
3665}
3666
3667static void hci_prepare_suspend(struct work_struct *work)
3668{
3669        struct hci_dev *hdev =
3670                container_of(work, struct hci_dev, suspend_prepare);
3671
3672        hci_dev_lock(hdev);
3673        hci_req_prepare_suspend(hdev, hdev->suspend_state_next);
3674        hci_dev_unlock(hdev);
3675}
3676
3677static int hci_change_suspend_state(struct hci_dev *hdev,
3678                                    enum suspended_state next)
3679{
3680        hdev->suspend_state_next = next;
3681        set_bit(SUSPEND_PREPARE_NOTIFIER, hdev->suspend_tasks);
3682        queue_work(hdev->req_workqueue, &hdev->suspend_prepare);
3683        return hci_suspend_wait_event(hdev);
3684}
3685
3686static void hci_clear_wake_reason(struct hci_dev *hdev)
3687{
3688        hci_dev_lock(hdev);
3689
3690        hdev->wake_reason = 0;
3691        bacpy(&hdev->wake_addr, BDADDR_ANY);
3692        hdev->wake_addr_type = 0;
3693
3694        hci_dev_unlock(hdev);
3695}
3696
3697static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
3698                                void *data)
3699{
3700        struct hci_dev *hdev =
3701                container_of(nb, struct hci_dev, suspend_notifier);
3702        int ret = 0;
3703        u8 state = BT_RUNNING;
3704
3705        /* If powering down, wait for completion. */
3706        if (mgmt_powering_down(hdev)) {
3707                set_bit(SUSPEND_POWERING_DOWN, hdev->suspend_tasks);
3708                ret = hci_suspend_wait_event(hdev);
3709                if (ret)
3710                        goto done;
3711        }
3712
3713        /* Suspend notifier should only act on events when powered. */
3714        if (!hdev_is_powered(hdev) ||
3715            hci_dev_test_flag(hdev, HCI_UNREGISTER))
3716                goto done;
3717
3718        if (action == PM_SUSPEND_PREPARE) {
3719                /* Suspend consists of two actions:
3720                 *  - First, disconnect everything and make the controller not
3721                 *    connectable (disabling scanning)
3722                 *  - Second, program event filter/accept list and enable scan
3723                 */
3724                ret = hci_change_suspend_state(hdev, BT_SUSPEND_DISCONNECT);
3725                if (!ret)
3726                        state = BT_SUSPEND_DISCONNECT;
3727
3728                /* Only configure accept list if disconnect succeeded and wake
3729                 * isn't being prevented.
3730                 */
3731                if (!ret && !(hdev->prevent_wake && hdev->prevent_wake(hdev))) {
3732                        ret = hci_change_suspend_state(hdev,
3733                                                BT_SUSPEND_CONFIGURE_WAKE);
3734                        if (!ret)
3735                                state = BT_SUSPEND_CONFIGURE_WAKE;
3736                }
3737
3738                hci_clear_wake_reason(hdev);
3739                mgmt_suspending(hdev, state);
3740
3741        } else if (action == PM_POST_SUSPEND) {
3742                ret = hci_change_suspend_state(hdev, BT_RUNNING);
3743
3744                mgmt_resuming(hdev, hdev->wake_reason, &hdev->wake_addr,
3745                              hdev->wake_addr_type);
3746        }
3747
3748done:
3749        /* We always allow suspend even if suspend preparation failed and
3750         * attempt to recover in resume.
3751         */
3752        if (ret)
3753                bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
3754                           action, ret);
3755
3756        return NOTIFY_DONE;
3757}
3758
3759/* Alloc HCI device */
3760struct hci_dev *hci_alloc_dev(void)
3761{
3762        struct hci_dev *hdev;
3763
3764        hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3765        if (!hdev)
3766                return NULL;
3767
3768        hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3769        hdev->esco_type = (ESCO_HV1);
3770        hdev->link_mode = (HCI_LM_ACCEPT);
3771        hdev->num_iac = 0x01;           /* One IAC support is mandatory */
3772        hdev->io_capability = 0x03;     /* No Input No Output */
3773        hdev->manufacturer = 0xffff;    /* Default to internal use */
3774        hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3775        hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3776        hdev->adv_instance_cnt = 0;
3777        hdev->cur_adv_instance = 0x00;
3778        hdev->adv_instance_timeout = 0;
3779
3780        hdev->advmon_allowlist_duration = 300;
3781        hdev->advmon_no_filter_duration = 500;
3782        hdev->enable_advmon_interleave_scan = 0x00;     /* Default to disable */
3783
3784        hdev->sniff_max_interval = 800;
3785        hdev->sniff_min_interval = 80;
3786
3787        hdev->le_adv_channel_map = 0x07;
3788        hdev->le_adv_min_interval = 0x0800;
3789        hdev->le_adv_max_interval = 0x0800;
3790        hdev->le_scan_interval = 0x0060;
3791        hdev->le_scan_window = 0x0030;
3792        hdev->le_scan_int_suspend = 0x0400;
3793        hdev->le_scan_window_suspend = 0x0012;
3794        hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT;
3795        hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN;
3796        hdev->le_scan_int_adv_monitor = 0x0060;
3797        hdev->le_scan_window_adv_monitor = 0x0030;
3798        hdev->le_scan_int_connect = 0x0060;
3799        hdev->le_scan_window_connect = 0x0060;
3800        hdev->le_conn_min_interval = 0x0018;
3801        hdev->le_conn_max_interval = 0x0028;
3802        hdev->le_conn_latency = 0x0000;
3803        hdev->le_supv_timeout = 0x002a;
3804        hdev->le_def_tx_len = 0x001b;
3805        hdev->le_def_tx_time = 0x0148;
3806        hdev->le_max_tx_len = 0x001b;
3807        hdev->le_max_tx_time = 0x0148;
3808        hdev->le_max_rx_len = 0x001b;
3809        hdev->le_max_rx_time = 0x0148;
3810        hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
3811        hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
3812        hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
3813        hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
3814        hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
3815        hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
3816        hdev->def_le_autoconnect_timeout = HCI_LE_AUTOCONN_TIMEOUT;
3817        hdev->min_le_tx_power = HCI_TX_POWER_INVALID;
3818        hdev->max_le_tx_power = HCI_TX_POWER_INVALID;
3819
3820        hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3821        hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3822        hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3823        hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3824        hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
3825        hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
3826
3827        /* default 1.28 sec page scan */
3828        hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;
3829        hdev->def_page_scan_int = 0x0800;
3830        hdev->def_page_scan_window = 0x0012;
3831
3832        mutex_init(&hdev->lock);
3833        mutex_init(&hdev->req_lock);
3834
3835        INIT_LIST_HEAD(&hdev->mgmt_pending);
3836        INIT_LIST_HEAD(&hdev->reject_list);
3837        INIT_LIST_HEAD(&hdev->accept_list);
3838        INIT_LIST_HEAD(&hdev->uuids);
3839        INIT_LIST_HEAD(&hdev->link_keys);
3840        INIT_LIST_HEAD(&hdev->long_term_keys);
3841        INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3842        INIT_LIST_HEAD(&hdev->remote_oob_data);
3843        INIT_LIST_HEAD(&hdev->le_accept_list);
3844        INIT_LIST_HEAD(&hdev->le_resolv_list);
3845        INIT_LIST_HEAD(&hdev->le_conn_params);
3846        INIT_LIST_HEAD(&hdev->pend_le_conns);
3847        INIT_LIST_HEAD(&hdev->pend_le_reports);
3848        INIT_LIST_HEAD(&hdev->conn_hash.list);
3849        INIT_LIST_HEAD(&hdev->adv_instances);
3850        INIT_LIST_HEAD(&hdev->blocked_keys);
3851
3852        INIT_WORK(&hdev->rx_work, hci_rx_work);
3853        INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3854        INIT_WORK(&hdev->tx_work, hci_tx_work);
3855        INIT_WORK(&hdev->power_on, hci_power_on);
3856        INIT_WORK(&hdev->error_reset, hci_error_reset);
3857        INIT_WORK(&hdev->suspend_prepare, hci_prepare_suspend);
3858
3859        INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3860
3861        skb_queue_head_init(&hdev->rx_q);
3862        skb_queue_head_init(&hdev->cmd_q);
3863        skb_queue_head_init(&hdev->raw_q);
3864
3865        init_waitqueue_head(&hdev->req_wait_q);
3866        init_waitqueue_head(&hdev->suspend_wait_q);
3867
3868        INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3869        INIT_DELAYED_WORK(&hdev->ncmd_timer, hci_ncmd_timeout);
3870
3871        hci_request_setup(hdev);
3872
3873        hci_init_sysfs(hdev);
3874        discovery_init(hdev);
3875
3876        return hdev;
3877}
3878EXPORT_SYMBOL(hci_alloc_dev);
3879
3880/* Free HCI device */
3881void hci_free_dev(struct hci_dev *hdev)
3882{
3883        /* will free via device release */
3884        put_device(&hdev->dev);
3885}
3886EXPORT_SYMBOL(hci_free_dev);
3887
3888/* Register HCI device */
3889int hci_register_dev(struct hci_dev *hdev)
3890{
3891        int id, error;
3892
3893        if (!hdev->open || !hdev->close || !hdev->send)
3894                return -EINVAL;
3895
3896        /* Do not allow HCI_AMP devices to register at index 0,
3897         * so the index can be used as the AMP controller ID.
3898         */
3899        switch (hdev->dev_type) {
3900        case HCI_PRIMARY:
3901                id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3902                break;
3903        case HCI_AMP:
3904                id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3905                break;
3906        default:
3907                return -EINVAL;
3908        }
3909
3910        if (id < 0)
3911                return id;
3912
3913        sprintf(hdev->name, "hci%d", id);
3914        hdev->id = id;
3915
3916        BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3917
3918        hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
3919        if (!hdev->workqueue) {
3920                error = -ENOMEM;
3921                goto err;
3922        }
3923
3924        hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
3925                                                      hdev->name);
3926        if (!hdev->req_workqueue) {
3927                destroy_workqueue(hdev->workqueue);
3928                error = -ENOMEM;
3929                goto err;
3930        }
3931
3932        if (!IS_ERR_OR_NULL(bt_debugfs))
3933                hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3934
3935        dev_set_name(&hdev->dev, "%s", hdev->name);
3936
3937        error = device_add(&hdev->dev);
3938        if (error < 0)
3939                goto err_wqueue;
3940
3941        hci_leds_init(hdev);
3942
3943        hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3944                                    RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3945                                    hdev);
3946        if (hdev->rfkill) {
3947                if (rfkill_register(hdev->rfkill) < 0) {
3948                        rfkill_destroy(hdev->rfkill);
3949                        hdev->rfkill = NULL;
3950                }
3951        }
3952
3953        if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3954                hci_dev_set_flag(hdev, HCI_RFKILLED);
3955
3956        hci_dev_set_flag(hdev, HCI_SETUP);
3957        hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3958
3959        if (hdev->dev_type == HCI_PRIMARY) {
3960                /* Assume BR/EDR support until proven otherwise (such as
3961                 * through reading supported features during init.
3962                 */
3963                hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3964        }
3965
3966        write_lock(&hci_dev_list_lock);
3967        list_add(&hdev->list, &hci_dev_list);
3968        write_unlock(&hci_dev_list_lock);
3969
3970        /* Devices that are marked for raw-only usage are unconfigured
3971         * and should not be included in normal operation.
3972         */
3973        if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3974                hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3975
3976        hci_sock_dev_event(hdev, HCI_DEV_REG);
3977        hci_dev_hold(hdev);
3978
3979        if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
3980                hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
3981                error = register_pm_notifier(&hdev->suspend_notifier);
3982                if (error)
3983                        goto err_wqueue;
3984        }
3985
3986        queue_work(hdev->req_workqueue, &hdev->power_on);
3987
3988        idr_init(&hdev->adv_monitors_idr);
3989
3990        return id;
3991
3992err_wqueue:
3993        destroy_workqueue(hdev->workqueue);
3994        destroy_workqueue(hdev->req_workqueue);
3995err:
3996        ida_simple_remove(&hci_index_ida, hdev->id);
3997
3998        return error;
3999}
4000EXPORT_SYMBOL(hci_register_dev);
4001
4002/* Unregister HCI device */
4003void hci_unregister_dev(struct hci_dev *hdev)
4004{
4005        BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
4006
4007        hci_dev_set_flag(hdev, HCI_UNREGISTER);
4008
4009        write_lock(&hci_dev_list_lock);
4010        list_del(&hdev->list);
4011        write_unlock(&hci_dev_list_lock);
4012
4013        cancel_work_sync(&hdev->power_on);
4014
4015        if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
4016                hci_suspend_clear_tasks(hdev);
4017                unregister_pm_notifier(&hdev->suspend_notifier);
4018                cancel_work_sync(&hdev->suspend_prepare);
4019        }
4020
4021        hci_dev_do_close(hdev);
4022
4023        if (!test_bit(HCI_INIT, &hdev->flags) &&
4024            !hci_dev_test_flag(hdev, HCI_SETUP) &&
4025            !hci_dev_test_flag(hdev, HCI_CONFIG)) {
4026                hci_dev_lock(hdev);
4027                mgmt_index_removed(hdev);
4028                hci_dev_unlock(hdev);
4029        }
4030
4031        /* mgmt_index_removed should take care of emptying the
4032         * pending list */
4033        BUG_ON(!list_empty(&hdev->mgmt_pending));
4034
4035        hci_sock_dev_event(hdev, HCI_DEV_UNREG);
4036
4037        if (hdev->rfkill) {
4038                rfkill_unregister(hdev->rfkill);
4039                rfkill_destroy(hdev->rfkill);
4040        }
4041
4042        device_del(&hdev->dev);
4043        /* Actual cleanup is deferred until hci_cleanup_dev(). */
4044        hci_dev_put(hdev);
4045}
4046EXPORT_SYMBOL(hci_unregister_dev);
4047
4048/* Cleanup HCI device */
4049void hci_cleanup_dev(struct hci_dev *hdev)
4050{
4051        debugfs_remove_recursive(hdev->debugfs);
4052        kfree_const(hdev->hw_info);
4053        kfree_const(hdev->fw_info);
4054
4055        destroy_workqueue(hdev->workqueue);
4056        destroy_workqueue(hdev->req_workqueue);
4057
4058        hci_dev_lock(hdev);
4059        hci_bdaddr_list_clear(&hdev->reject_list);
4060        hci_bdaddr_list_clear(&hdev->accept_list);
4061        hci_uuids_clear(hdev);
4062        hci_link_keys_clear(hdev);
4063        hci_smp_ltks_clear(hdev);
4064        hci_smp_irks_clear(hdev);
4065        hci_remote_oob_data_clear(hdev);
4066        hci_adv_instances_clear(hdev);
4067        hci_adv_monitors_clear(hdev);
4068        hci_bdaddr_list_clear(&hdev->le_accept_list);
4069        hci_bdaddr_list_clear(&hdev->le_resolv_list);
4070        hci_conn_params_clear_all(hdev);
4071        hci_discovery_filter_clear(hdev);
4072        hci_blocked_keys_clear(hdev);
4073        hci_dev_unlock(hdev);
4074
4075        ida_simple_remove(&hci_index_ida, hdev->id);
4076}
4077
4078/* Suspend HCI device */
4079int hci_suspend_dev(struct hci_dev *hdev)
4080{
4081        hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
4082        return 0;
4083}
4084EXPORT_SYMBOL(hci_suspend_dev);
4085
4086/* Resume HCI device */
4087int hci_resume_dev(struct hci_dev *hdev)
4088{
4089        hci_sock_dev_event(hdev, HCI_DEV_RESUME);
4090        return 0;
4091}
4092EXPORT_SYMBOL(hci_resume_dev);
4093
4094/* Reset HCI device */
4095int hci_reset_dev(struct hci_dev *hdev)
4096{
4097        static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
4098        struct sk_buff *skb;
4099
4100        skb = bt_skb_alloc(3, GFP_ATOMIC);
4101        if (!skb)
4102                return -ENOMEM;
4103
4104        hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
4105        skb_put_data(skb, hw_err, 3);
4106
4107        bt_dev_err(hdev, "Injecting HCI hardware error event");
4108
4109        /* Send Hardware Error to upper stack */
4110        return hci_recv_frame(hdev, skb);
4111}
4112EXPORT_SYMBOL(hci_reset_dev);
4113
4114/* Receive frame from HCI drivers */
4115int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
4116{
4117        if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
4118                      && !test_bit(HCI_INIT, &hdev->flags))) {
4119                kfree_skb(skb);
4120                return -ENXIO;
4121        }
4122
4123        if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
4124            hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
4125            hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
4126            hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) {
4127                kfree_skb(skb);
4128                return -EINVAL;
4129        }
4130
4131        /* Incoming skb */
4132        bt_cb(skb)->incoming = 1;
4133
4134        /* Time stamp */
4135        __net_timestamp(skb);
4136
4137        skb_queue_tail(&hdev->rx_q, skb);
4138        queue_work(hdev->workqueue, &hdev->rx_work);
4139
4140        return 0;
4141}
4142EXPORT_SYMBOL(hci_recv_frame);
4143
4144/* Receive diagnostic message from HCI drivers */
4145int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
4146{
4147        /* Mark as diagnostic packet */
4148        hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
4149
4150        /* Time stamp */
4151        __net_timestamp(skb);
4152
4153        skb_queue_tail(&hdev->rx_q, skb);
4154        queue_work(hdev->workqueue, &hdev->rx_work);
4155
4156        return 0;
4157}
4158EXPORT_SYMBOL(hci_recv_diag);
4159
4160void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
4161{
4162        va_list vargs;
4163
4164        va_start(vargs, fmt);
4165        kfree_const(hdev->hw_info);
4166        hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
4167        va_end(vargs);
4168}
4169EXPORT_SYMBOL(hci_set_hw_info);
4170
4171void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
4172{
4173        va_list vargs;
4174
4175        va_start(vargs, fmt);
4176        kfree_const(hdev->fw_info);
4177        hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
4178        va_end(vargs);
4179}
4180EXPORT_SYMBOL(hci_set_fw_info);
4181
4182/* ---- Interface to upper protocols ---- */
4183
4184int hci_register_cb(struct hci_cb *cb)
4185{
4186        BT_DBG("%p name %s", cb, cb->name);
4187
4188        mutex_lock(&hci_cb_list_lock);
4189        list_add_tail(&cb->list, &hci_cb_list);
4190        mutex_unlock(&hci_cb_list_lock);
4191
4192        return 0;
4193}
4194EXPORT_SYMBOL(hci_register_cb);
4195
4196int hci_unregister_cb(struct hci_cb *cb)
4197{
4198        BT_DBG("%p name %s", cb, cb->name);
4199
4200        mutex_lock(&hci_cb_list_lock);
4201        list_del(&cb->list);
4202        mutex_unlock(&hci_cb_list_lock);
4203
4204        return 0;
4205}
4206EXPORT_SYMBOL(hci_unregister_cb);
4207
4208static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
4209{
4210        int err;
4211
4212        BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
4213               skb->len);
4214
4215        /* Time stamp */
4216        __net_timestamp(skb);
4217
4218        /* Send copy to monitor */
4219        hci_send_to_monitor(hdev, skb);
4220
4221        if (atomic_read(&hdev->promisc)) {
4222                /* Send copy to the sockets */
4223                hci_send_to_sock(hdev, skb);
4224        }
4225
4226        /* Get rid of skb owner, prior to sending to the driver. */
4227        skb_orphan(skb);
4228
4229        if (!test_bit(HCI_RUNNING, &hdev->flags)) {
4230                kfree_skb(skb);
4231                return;
4232        }
4233
4234        err = hdev->send(hdev, skb);
4235        if (err < 0) {
4236                bt_dev_err(hdev, "sending frame failed (%d)", err);
4237                kfree_skb(skb);
4238        }
4239}
4240
4241/* Send HCI command */
4242int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
4243                 const void *param)
4244{
4245        struct sk_buff *skb;
4246
4247        BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
4248
4249        skb = hci_prepare_cmd(hdev, opcode, plen, param);
4250        if (!skb) {
4251                bt_dev_err(hdev, "no memory for command");
4252                return -ENOMEM;
4253        }
4254
4255        /* Stand-alone HCI commands must be flagged as
4256         * single-command requests.
4257         */
4258        bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
4259
4260        skb_queue_tail(&hdev->cmd_q, skb);
4261        queue_work(hdev->workqueue, &hdev->cmd_work);
4262
4263        return 0;
4264}
4265
4266int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
4267                   const void *param)
4268{
4269        struct sk_buff *skb;
4270
4271        if (hci_opcode_ogf(opcode) != 0x3f) {
4272                /* A controller receiving a command shall respond with either
4273                 * a Command Status Event or a Command Complete Event.
4274                 * Therefore, all standard HCI commands must be sent via the
4275                 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
4276                 * Some vendors do not comply with this rule for vendor-specific
4277                 * commands and do not return any event. We want to support
4278                 * unresponded commands for such cases only.
4279                 */
4280                bt_dev_err(hdev, "unresponded command not supported");
4281                return -EINVAL;
4282        }
4283
4284        skb = hci_prepare_cmd(hdev, opcode, plen, param);
4285        if (!skb) {
4286                bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
4287                           opcode);
4288                return -ENOMEM;
4289        }
4290
4291        hci_send_frame(hdev, skb);
4292
4293        return 0;
4294}
4295EXPORT_SYMBOL(__hci_cmd_send);
4296
4297/* Get data from the previously sent command */
4298void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
4299{
4300        struct hci_command_hdr *hdr;
4301
4302        if (!hdev->sent_cmd)
4303                return NULL;
4304
4305        hdr = (void *) hdev->sent_cmd->data;
4306
4307        if (hdr->opcode != cpu_to_le16(opcode))
4308                return NULL;
4309
4310        BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
4311
4312        return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
4313}
4314
4315/* Send HCI command and wait for command complete event */
4316struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
4317                             const void *param, u32 timeout)
4318{
4319        struct sk_buff *skb;
4320
4321        if (!test_bit(HCI_UP, &hdev->flags))
4322                return ERR_PTR(-ENETDOWN);
4323
4324        bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
4325
4326        hci_req_sync_lock(hdev);
4327        skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
4328        hci_req_sync_unlock(hdev);
4329
4330        return skb;
4331}
4332EXPORT_SYMBOL(hci_cmd_sync);
4333
4334/* Send ACL data */
4335static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
4336{
4337        struct hci_acl_hdr *hdr;
4338        int len = skb->len;
4339
4340        skb_push(skb, HCI_ACL_HDR_SIZE);
4341        skb_reset_transport_header(skb);
4342        hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
4343        hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
4344        hdr->dlen   = cpu_to_le16(len);
4345}
4346
4347static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
4348                          struct sk_buff *skb, __u16 flags)
4349{
4350        struct hci_conn *conn = chan->conn;
4351        struct hci_dev *hdev = conn->hdev;
4352        struct sk_buff *list;
4353
4354        skb->len = skb_headlen(skb);
4355        skb->data_len = 0;
4356
4357        hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
4358
4359        switch (hdev->dev_type) {
4360        case HCI_PRIMARY:
4361                hci_add_acl_hdr(skb, conn->handle, flags);
4362                break;
4363        case HCI_AMP:
4364                hci_add_acl_hdr(skb, chan->handle, flags);
4365                break;
4366        default:
4367                bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4368                return;
4369        }
4370
4371        list = skb_shinfo(skb)->frag_list;
4372        if (!list) {
4373                /* Non fragmented */
4374                BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
4375
4376                skb_queue_tail(queue, skb);
4377        } else {
4378                /* Fragmented */
4379                BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4380
4381                skb_shinfo(skb)->frag_list = NULL;
4382
4383                /* Queue all fragments atomically. We need to use spin_lock_bh
4384                 * here because of 6LoWPAN links, as there this function is
4385                 * called from softirq and using normal spin lock could cause