Merge branches 'arm/rockchip', 'arm/exynos', 'arm/smmu', 'x86/vt-d', 'x86/amd', ...
[sfrench/cifs-2.6.git] / net / bluetooth / hci_core.c
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4    Copyright (C) 2011 ProFUSION Embedded Systems
5
6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License version 2 as
10    published by the Free Software Foundation;
11
12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23    SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth HCI core. */
27
28 #include <linux/export.h>
29 #include <linux/idr.h>
30 #include <linux/rfkill.h>
31 #include <linux/debugfs.h>
32 #include <linux/crypto.h>
33 #include <asm/unaligned.h>
34
35 #include <net/bluetooth/bluetooth.h>
36 #include <net/bluetooth/hci_core.h>
37 #include <net/bluetooth/l2cap.h>
38 #include <net/bluetooth/mgmt.h>
39
40 #include "hci_request.h"
41 #include "hci_debugfs.h"
42 #include "smp.h"
43
44 static void hci_rx_work(struct work_struct *work);
45 static void hci_cmd_work(struct work_struct *work);
46 static void hci_tx_work(struct work_struct *work);
47
48 /* HCI device list */
49 LIST_HEAD(hci_dev_list);
50 DEFINE_RWLOCK(hci_dev_list_lock);
51
52 /* HCI callback list */
53 LIST_HEAD(hci_cb_list);
54 DEFINE_MUTEX(hci_cb_list_lock);
55
56 /* HCI ID Numbering */
57 static DEFINE_IDA(hci_index_ida);
58
59 /* ----- HCI requests ----- */
60
61 #define HCI_REQ_DONE      0
62 #define HCI_REQ_PEND      1
63 #define HCI_REQ_CANCELED  2
64
65 #define hci_req_lock(d)         mutex_lock(&d->req_lock)
66 #define hci_req_unlock(d)       mutex_unlock(&d->req_lock)
67
68 /* ---- HCI notifications ---- */
69
70 static void hci_notify(struct hci_dev *hdev, int event)
71 {
72         hci_sock_dev_event(hdev, event);
73 }
74
75 /* ---- HCI debugfs entries ---- */
76
77 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
78                              size_t count, loff_t *ppos)
79 {
80         struct hci_dev *hdev = file->private_data;
81         char buf[3];
82
83         buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y': 'N';
84         buf[1] = '\n';
85         buf[2] = '\0';
86         return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
87 }
88
89 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
90                               size_t count, loff_t *ppos)
91 {
92         struct hci_dev *hdev = file->private_data;
93         struct sk_buff *skb;
94         char buf[32];
95         size_t buf_size = min(count, (sizeof(buf)-1));
96         bool enable;
97         int err;
98
99         if (!test_bit(HCI_UP, &hdev->flags))
100                 return -ENETDOWN;
101
102         if (copy_from_user(buf, user_buf, buf_size))
103                 return -EFAULT;
104
105         buf[buf_size] = '\0';
106         if (strtobool(buf, &enable))
107                 return -EINVAL;
108
109         if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
110                 return -EALREADY;
111
112         hci_req_lock(hdev);
113         if (enable)
114                 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
115                                      HCI_CMD_TIMEOUT);
116         else
117                 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
118                                      HCI_CMD_TIMEOUT);
119         hci_req_unlock(hdev);
120
121         if (IS_ERR(skb))
122                 return PTR_ERR(skb);
123
124         err = -bt_to_errno(skb->data[0]);
125         kfree_skb(skb);
126
127         if (err < 0)
128                 return err;
129
130         hci_dev_change_flag(hdev, HCI_DUT_MODE);
131
132         return count;
133 }
134
135 static const struct file_operations dut_mode_fops = {
136         .open           = simple_open,
137         .read           = dut_mode_read,
138         .write          = dut_mode_write,
139         .llseek         = default_llseek,
140 };
141
142 /* ---- HCI requests ---- */
143
144 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
145                                   struct sk_buff *skb)
146 {
147         BT_DBG("%s result 0x%2.2x", hdev->name, result);
148
149         if (hdev->req_status == HCI_REQ_PEND) {
150                 hdev->req_result = result;
151                 hdev->req_status = HCI_REQ_DONE;
152                 if (skb)
153                         hdev->req_skb = skb_get(skb);
154                 wake_up_interruptible(&hdev->req_wait_q);
155         }
156 }
157
158 static void hci_req_cancel(struct hci_dev *hdev, int err)
159 {
160         BT_DBG("%s err 0x%2.2x", hdev->name, err);
161
162         if (hdev->req_status == HCI_REQ_PEND) {
163                 hdev->req_result = err;
164                 hdev->req_status = HCI_REQ_CANCELED;
165                 wake_up_interruptible(&hdev->req_wait_q);
166         }
167 }
168
169 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
170                                   const void *param, u8 event, u32 timeout)
171 {
172         DECLARE_WAITQUEUE(wait, current);
173         struct hci_request req;
174         struct sk_buff *skb;
175         int err = 0;
176
177         BT_DBG("%s", hdev->name);
178
179         hci_req_init(&req, hdev);
180
181         hci_req_add_ev(&req, opcode, plen, param, event);
182
183         hdev->req_status = HCI_REQ_PEND;
184
185         add_wait_queue(&hdev->req_wait_q, &wait);
186         set_current_state(TASK_INTERRUPTIBLE);
187
188         err = hci_req_run_skb(&req, hci_req_sync_complete);
189         if (err < 0) {
190                 remove_wait_queue(&hdev->req_wait_q, &wait);
191                 set_current_state(TASK_RUNNING);
192                 return ERR_PTR(err);
193         }
194
195         schedule_timeout(timeout);
196
197         remove_wait_queue(&hdev->req_wait_q, &wait);
198
199         if (signal_pending(current))
200                 return ERR_PTR(-EINTR);
201
202         switch (hdev->req_status) {
203         case HCI_REQ_DONE:
204                 err = -bt_to_errno(hdev->req_result);
205                 break;
206
207         case HCI_REQ_CANCELED:
208                 err = -hdev->req_result;
209                 break;
210
211         default:
212                 err = -ETIMEDOUT;
213                 break;
214         }
215
216         hdev->req_status = hdev->req_result = 0;
217         skb = hdev->req_skb;
218         hdev->req_skb = NULL;
219
220         BT_DBG("%s end: err %d", hdev->name, err);
221
222         if (err < 0) {
223                 kfree_skb(skb);
224                 return ERR_PTR(err);
225         }
226
227         if (!skb)
228                 return ERR_PTR(-ENODATA);
229
230         return skb;
231 }
232 EXPORT_SYMBOL(__hci_cmd_sync_ev);
233
234 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
235                                const void *param, u32 timeout)
236 {
237         return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
238 }
239 EXPORT_SYMBOL(__hci_cmd_sync);
240
241 /* Execute request and wait for completion. */
242 static int __hci_req_sync(struct hci_dev *hdev,
243                           void (*func)(struct hci_request *req,
244                                       unsigned long opt),
245                           unsigned long opt, __u32 timeout)
246 {
247         struct hci_request req;
248         DECLARE_WAITQUEUE(wait, current);
249         int err = 0;
250
251         BT_DBG("%s start", hdev->name);
252
253         hci_req_init(&req, hdev);
254
255         hdev->req_status = HCI_REQ_PEND;
256
257         func(&req, opt);
258
259         add_wait_queue(&hdev->req_wait_q, &wait);
260         set_current_state(TASK_INTERRUPTIBLE);
261
262         err = hci_req_run_skb(&req, hci_req_sync_complete);
263         if (err < 0) {
264                 hdev->req_status = 0;
265
266                 remove_wait_queue(&hdev->req_wait_q, &wait);
267                 set_current_state(TASK_RUNNING);
268
269                 /* ENODATA means the HCI request command queue is empty.
270                  * This can happen when a request with conditionals doesn't
271                  * trigger any commands to be sent. This is normal behavior
272                  * and should not trigger an error return.
273                  */
274                 if (err == -ENODATA)
275                         return 0;
276
277                 return err;
278         }
279
280         schedule_timeout(timeout);
281
282         remove_wait_queue(&hdev->req_wait_q, &wait);
283
284         if (signal_pending(current))
285                 return -EINTR;
286
287         switch (hdev->req_status) {
288         case HCI_REQ_DONE:
289                 err = -bt_to_errno(hdev->req_result);
290                 break;
291
292         case HCI_REQ_CANCELED:
293                 err = -hdev->req_result;
294                 break;
295
296         default:
297                 err = -ETIMEDOUT;
298                 break;
299         }
300
301         hdev->req_status = hdev->req_result = 0;
302
303         BT_DBG("%s end: err %d", hdev->name, err);
304
305         return err;
306 }
307
308 static int hci_req_sync(struct hci_dev *hdev,
309                         void (*req)(struct hci_request *req,
310                                     unsigned long opt),
311                         unsigned long opt, __u32 timeout)
312 {
313         int ret;
314
315         if (!test_bit(HCI_UP, &hdev->flags))
316                 return -ENETDOWN;
317
318         /* Serialize all requests */
319         hci_req_lock(hdev);
320         ret = __hci_req_sync(hdev, req, opt, timeout);
321         hci_req_unlock(hdev);
322
323         return ret;
324 }
325
326 static void hci_reset_req(struct hci_request *req, unsigned long opt)
327 {
328         BT_DBG("%s %ld", req->hdev->name, opt);
329
330         /* Reset device */
331         set_bit(HCI_RESET, &req->hdev->flags);
332         hci_req_add(req, HCI_OP_RESET, 0, NULL);
333 }
334
335 static void bredr_init(struct hci_request *req)
336 {
337         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
338
339         /* Read Local Supported Features */
340         hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
341
342         /* Read Local Version */
343         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
344
345         /* Read BD Address */
346         hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
347 }
348
349 static void amp_init1(struct hci_request *req)
350 {
351         req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
352
353         /* Read Local Version */
354         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
355
356         /* Read Local Supported Commands */
357         hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
358
359         /* Read Local AMP Info */
360         hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
361
362         /* Read Data Blk size */
363         hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
364
365         /* Read Flow Control Mode */
366         hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
367
368         /* Read Location Data */
369         hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
370 }
371
372 static void amp_init2(struct hci_request *req)
373 {
374         /* Read Local Supported Features. Not all AMP controllers
375          * support this so it's placed conditionally in the second
376          * stage init.
377          */
378         if (req->hdev->commands[14] & 0x20)
379                 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
380 }
381
382 static void hci_init1_req(struct hci_request *req, unsigned long opt)
383 {
384         struct hci_dev *hdev = req->hdev;
385
386         BT_DBG("%s %ld", hdev->name, opt);
387
388         /* Reset */
389         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
390                 hci_reset_req(req, 0);
391
392         switch (hdev->dev_type) {
393         case HCI_BREDR:
394                 bredr_init(req);
395                 break;
396
397         case HCI_AMP:
398                 amp_init1(req);
399                 break;
400
401         default:
402                 BT_ERR("Unknown device type %d", hdev->dev_type);
403                 break;
404         }
405 }
406
407 static void bredr_setup(struct hci_request *req)
408 {
409         __le16 param;
410         __u8 flt_type;
411
412         /* Read Buffer Size (ACL mtu, max pkt, etc.) */
413         hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
414
415         /* Read Class of Device */
416         hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
417
418         /* Read Local Name */
419         hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
420
421         /* Read Voice Setting */
422         hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
423
424         /* Read Number of Supported IAC */
425         hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
426
427         /* Read Current IAC LAP */
428         hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
429
430         /* Clear Event Filters */
431         flt_type = HCI_FLT_CLEAR_ALL;
432         hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
433
434         /* Connection accept timeout ~20 secs */
435         param = cpu_to_le16(0x7d00);
436         hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
437 }
438
439 static void le_setup(struct hci_request *req)
440 {
441         struct hci_dev *hdev = req->hdev;
442
443         /* Read LE Buffer Size */
444         hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
445
446         /* Read LE Local Supported Features */
447         hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
448
449         /* Read LE Supported States */
450         hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
451
452         /* Read LE White List Size */
453         hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
454
455         /* Clear LE White List */
456         hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
457
458         /* LE-only controllers have LE implicitly enabled */
459         if (!lmp_bredr_capable(hdev))
460                 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
461 }
462
463 static void hci_setup_event_mask(struct hci_request *req)
464 {
465         struct hci_dev *hdev = req->hdev;
466
467         /* The second byte is 0xff instead of 0x9f (two reserved bits
468          * disabled) since a Broadcom 1.2 dongle doesn't respond to the
469          * command otherwise.
470          */
471         u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
472
473         /* CSR 1.1 dongles does not accept any bitfield so don't try to set
474          * any event mask for pre 1.2 devices.
475          */
476         if (hdev->hci_ver < BLUETOOTH_VER_1_2)
477                 return;
478
479         if (lmp_bredr_capable(hdev)) {
480                 events[4] |= 0x01; /* Flow Specification Complete */
481                 events[4] |= 0x02; /* Inquiry Result with RSSI */
482                 events[4] |= 0x04; /* Read Remote Extended Features Complete */
483                 events[5] |= 0x08; /* Synchronous Connection Complete */
484                 events[5] |= 0x10; /* Synchronous Connection Changed */
485         } else {
486                 /* Use a different default for LE-only devices */
487                 memset(events, 0, sizeof(events));
488                 events[0] |= 0x10; /* Disconnection Complete */
489                 events[1] |= 0x08; /* Read Remote Version Information Complete */
490                 events[1] |= 0x20; /* Command Complete */
491                 events[1] |= 0x40; /* Command Status */
492                 events[1] |= 0x80; /* Hardware Error */
493                 events[2] |= 0x04; /* Number of Completed Packets */
494                 events[3] |= 0x02; /* Data Buffer Overflow */
495
496                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
497                         events[0] |= 0x80; /* Encryption Change */
498                         events[5] |= 0x80; /* Encryption Key Refresh Complete */
499                 }
500         }
501
502         if (lmp_inq_rssi_capable(hdev))
503                 events[4] |= 0x02; /* Inquiry Result with RSSI */
504
505         if (lmp_sniffsubr_capable(hdev))
506                 events[5] |= 0x20; /* Sniff Subrating */
507
508         if (lmp_pause_enc_capable(hdev))
509                 events[5] |= 0x80; /* Encryption Key Refresh Complete */
510
511         if (lmp_ext_inq_capable(hdev))
512                 events[5] |= 0x40; /* Extended Inquiry Result */
513
514         if (lmp_no_flush_capable(hdev))
515                 events[7] |= 0x01; /* Enhanced Flush Complete */
516
517         if (lmp_lsto_capable(hdev))
518                 events[6] |= 0x80; /* Link Supervision Timeout Changed */
519
520         if (lmp_ssp_capable(hdev)) {
521                 events[6] |= 0x01;      /* IO Capability Request */
522                 events[6] |= 0x02;      /* IO Capability Response */
523                 events[6] |= 0x04;      /* User Confirmation Request */
524                 events[6] |= 0x08;      /* User Passkey Request */
525                 events[6] |= 0x10;      /* Remote OOB Data Request */
526                 events[6] |= 0x20;      /* Simple Pairing Complete */
527                 events[7] |= 0x04;      /* User Passkey Notification */
528                 events[7] |= 0x08;      /* Keypress Notification */
529                 events[7] |= 0x10;      /* Remote Host Supported
530                                          * Features Notification
531                                          */
532         }
533
534         if (lmp_le_capable(hdev))
535                 events[7] |= 0x20;      /* LE Meta-Event */
536
537         hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
538 }
539
540 static void hci_init2_req(struct hci_request *req, unsigned long opt)
541 {
542         struct hci_dev *hdev = req->hdev;
543
544         if (hdev->dev_type == HCI_AMP)
545                 return amp_init2(req);
546
547         if (lmp_bredr_capable(hdev))
548                 bredr_setup(req);
549         else
550                 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
551
552         if (lmp_le_capable(hdev))
553                 le_setup(req);
554
555         /* All Bluetooth 1.2 and later controllers should support the
556          * HCI command for reading the local supported commands.
557          *
558          * Unfortunately some controllers indicate Bluetooth 1.2 support,
559          * but do not have support for this command. If that is the case,
560          * the driver can quirk the behavior and skip reading the local
561          * supported commands.
562          */
563         if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
564             !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
565                 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
566
567         if (lmp_ssp_capable(hdev)) {
568                 /* When SSP is available, then the host features page
569                  * should also be available as well. However some
570                  * controllers list the max_page as 0 as long as SSP
571                  * has not been enabled. To achieve proper debugging
572                  * output, force the minimum max_page to 1 at least.
573                  */
574                 hdev->max_page = 0x01;
575
576                 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
577                         u8 mode = 0x01;
578
579                         hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
580                                     sizeof(mode), &mode);
581                 } else {
582                         struct hci_cp_write_eir cp;
583
584                         memset(hdev->eir, 0, sizeof(hdev->eir));
585                         memset(&cp, 0, sizeof(cp));
586
587                         hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
588                 }
589         }
590
591         if (lmp_inq_rssi_capable(hdev) ||
592             test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
593                 u8 mode;
594
595                 /* If Extended Inquiry Result events are supported, then
596                  * they are clearly preferred over Inquiry Result with RSSI
597                  * events.
598                  */
599                 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
600
601                 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
602         }
603
604         if (lmp_inq_tx_pwr_capable(hdev))
605                 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
606
607         if (lmp_ext_feat_capable(hdev)) {
608                 struct hci_cp_read_local_ext_features cp;
609
610                 cp.page = 0x01;
611                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
612                             sizeof(cp), &cp);
613         }
614
615         if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
616                 u8 enable = 1;
617                 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
618                             &enable);
619         }
620 }
621
622 static void hci_setup_link_policy(struct hci_request *req)
623 {
624         struct hci_dev *hdev = req->hdev;
625         struct hci_cp_write_def_link_policy cp;
626         u16 link_policy = 0;
627
628         if (lmp_rswitch_capable(hdev))
629                 link_policy |= HCI_LP_RSWITCH;
630         if (lmp_hold_capable(hdev))
631                 link_policy |= HCI_LP_HOLD;
632         if (lmp_sniff_capable(hdev))
633                 link_policy |= HCI_LP_SNIFF;
634         if (lmp_park_capable(hdev))
635                 link_policy |= HCI_LP_PARK;
636
637         cp.policy = cpu_to_le16(link_policy);
638         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
639 }
640
641 static void hci_set_le_support(struct hci_request *req)
642 {
643         struct hci_dev *hdev = req->hdev;
644         struct hci_cp_write_le_host_supported cp;
645
646         /* LE-only devices do not support explicit enablement */
647         if (!lmp_bredr_capable(hdev))
648                 return;
649
650         memset(&cp, 0, sizeof(cp));
651
652         if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
653                 cp.le = 0x01;
654                 cp.simul = 0x00;
655         }
656
657         if (cp.le != lmp_host_le_capable(hdev))
658                 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
659                             &cp);
660 }
661
662 static void hci_set_event_mask_page_2(struct hci_request *req)
663 {
664         struct hci_dev *hdev = req->hdev;
665         u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
666
667         /* If Connectionless Slave Broadcast master role is supported
668          * enable all necessary events for it.
669          */
670         if (lmp_csb_master_capable(hdev)) {
671                 events[1] |= 0x40;      /* Triggered Clock Capture */
672                 events[1] |= 0x80;      /* Synchronization Train Complete */
673                 events[2] |= 0x10;      /* Slave Page Response Timeout */
674                 events[2] |= 0x20;      /* CSB Channel Map Change */
675         }
676
677         /* If Connectionless Slave Broadcast slave role is supported
678          * enable all necessary events for it.
679          */
680         if (lmp_csb_slave_capable(hdev)) {
681                 events[2] |= 0x01;      /* Synchronization Train Received */
682                 events[2] |= 0x02;      /* CSB Receive */
683                 events[2] |= 0x04;      /* CSB Timeout */
684                 events[2] |= 0x08;      /* Truncated Page Complete */
685         }
686
687         /* Enable Authenticated Payload Timeout Expired event if supported */
688         if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
689                 events[2] |= 0x80;
690
691         hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
692 }
693
694 static void hci_init3_req(struct hci_request *req, unsigned long opt)
695 {
696         struct hci_dev *hdev = req->hdev;
697         u8 p;
698
699         hci_setup_event_mask(req);
700
701         if (hdev->commands[6] & 0x20) {
702                 struct hci_cp_read_stored_link_key cp;
703
704                 bacpy(&cp.bdaddr, BDADDR_ANY);
705                 cp.read_all = 0x01;
706                 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
707         }
708
709         if (hdev->commands[5] & 0x10)
710                 hci_setup_link_policy(req);
711
712         if (hdev->commands[8] & 0x01)
713                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
714
715         /* Some older Broadcom based Bluetooth 1.2 controllers do not
716          * support the Read Page Scan Type command. Check support for
717          * this command in the bit mask of supported commands.
718          */
719         if (hdev->commands[13] & 0x01)
720                 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
721
722         if (lmp_le_capable(hdev)) {
723                 u8 events[8];
724
725                 memset(events, 0, sizeof(events));
726                 events[0] = 0x0f;
727
728                 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
729                         events[0] |= 0x10;      /* LE Long Term Key Request */
730
731                 /* If controller supports the Connection Parameters Request
732                  * Link Layer Procedure, enable the corresponding event.
733                  */
734                 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
735                         events[0] |= 0x20;      /* LE Remote Connection
736                                                  * Parameter Request
737                                                  */
738
739                 /* If the controller supports the Data Length Extension
740                  * feature, enable the corresponding event.
741                  */
742                 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
743                         events[0] |= 0x40;      /* LE Data Length Change */
744
745                 /* If the controller supports Extended Scanner Filter
746                  * Policies, enable the correspondig event.
747                  */
748                 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
749                         events[1] |= 0x04;      /* LE Direct Advertising
750                                                  * Report
751                                                  */
752
753                 /* If the controller supports the LE Read Local P-256
754                  * Public Key command, enable the corresponding event.
755                  */
756                 if (hdev->commands[34] & 0x02)
757                         events[0] |= 0x80;      /* LE Read Local P-256
758                                                  * Public Key Complete
759                                                  */
760
761                 /* If the controller supports the LE Generate DHKey
762                  * command, enable the corresponding event.
763                  */
764                 if (hdev->commands[34] & 0x04)
765                         events[1] |= 0x01;      /* LE Generate DHKey Complete */
766
767                 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
768                             events);
769
770                 if (hdev->commands[25] & 0x40) {
771                         /* Read LE Advertising Channel TX Power */
772                         hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
773                 }
774
775                 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
776                         /* Read LE Maximum Data Length */
777                         hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
778
779                         /* Read LE Suggested Default Data Length */
780                         hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
781                 }
782
783                 hci_set_le_support(req);
784         }
785
786         /* Read features beyond page 1 if available */
787         for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
788                 struct hci_cp_read_local_ext_features cp;
789
790                 cp.page = p;
791                 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
792                             sizeof(cp), &cp);
793         }
794 }
795
796 static void hci_init4_req(struct hci_request *req, unsigned long opt)
797 {
798         struct hci_dev *hdev = req->hdev;
799
800         /* Some Broadcom based Bluetooth controllers do not support the
801          * Delete Stored Link Key command. They are clearly indicating its
802          * absence in the bit mask of supported commands.
803          *
804          * Check the supported commands and only if the the command is marked
805          * as supported send it. If not supported assume that the controller
806          * does not have actual support for stored link keys which makes this
807          * command redundant anyway.
808          *
809          * Some controllers indicate that they support handling deleting
810          * stored link keys, but they don't. The quirk lets a driver
811          * just disable this command.
812          */
813         if (hdev->commands[6] & 0x80 &&
814             !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
815                 struct hci_cp_delete_stored_link_key cp;
816
817                 bacpy(&cp.bdaddr, BDADDR_ANY);
818                 cp.delete_all = 0x01;
819                 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
820                             sizeof(cp), &cp);
821         }
822
823         /* Set event mask page 2 if the HCI command for it is supported */
824         if (hdev->commands[22] & 0x04)
825                 hci_set_event_mask_page_2(req);
826
827         /* Read local codec list if the HCI command is supported */
828         if (hdev->commands[29] & 0x20)
829                 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
830
831         /* Get MWS transport configuration if the HCI command is supported */
832         if (hdev->commands[30] & 0x08)
833                 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
834
835         /* Check for Synchronization Train support */
836         if (lmp_sync_train_capable(hdev))
837                 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
838
839         /* Enable Secure Connections if supported and configured */
840         if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
841             bredr_sc_enabled(hdev)) {
842                 u8 support = 0x01;
843
844                 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
845                             sizeof(support), &support);
846         }
847 }
848
849 static int __hci_init(struct hci_dev *hdev)
850 {
851         int err;
852
853         err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
854         if (err < 0)
855                 return err;
856
857         /* The Device Under Test (DUT) mode is special and available for
858          * all controller types. So just create it early on.
859          */
860         if (hci_dev_test_flag(hdev, HCI_SETUP)) {
861                 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
862                                     &dut_mode_fops);
863         }
864
865         err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
866         if (err < 0)
867                 return err;
868
869         /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
870          * BR/EDR/LE type controllers. AMP controllers only need the
871          * first two stages of init.
872          */
873         if (hdev->dev_type != HCI_BREDR)
874                 return 0;
875
876         err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
877         if (err < 0)
878                 return err;
879
880         err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
881         if (err < 0)
882                 return err;
883
884         /* This function is only called when the controller is actually in
885          * configured state. When the controller is marked as unconfigured,
886          * this initialization procedure is not run.
887          *
888          * It means that it is possible that a controller runs through its
889          * setup phase and then discovers missing settings. If that is the
890          * case, then this function will not be called. It then will only
891          * be called during the config phase.
892          *
893          * So only when in setup phase or config phase, create the debugfs
894          * entries and register the SMP channels.
895          */
896         if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
897             !hci_dev_test_flag(hdev, HCI_CONFIG))
898                 return 0;
899
900         hci_debugfs_create_common(hdev);
901
902         if (lmp_bredr_capable(hdev))
903                 hci_debugfs_create_bredr(hdev);
904
905         if (lmp_le_capable(hdev))
906                 hci_debugfs_create_le(hdev);
907
908         return 0;
909 }
910
911 static void hci_init0_req(struct hci_request *req, unsigned long opt)
912 {
913         struct hci_dev *hdev = req->hdev;
914
915         BT_DBG("%s %ld", hdev->name, opt);
916
917         /* Reset */
918         if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
919                 hci_reset_req(req, 0);
920
921         /* Read Local Version */
922         hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
923
924         /* Read BD Address */
925         if (hdev->set_bdaddr)
926                 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
927 }
928
929 static int __hci_unconf_init(struct hci_dev *hdev)
930 {
931         int err;
932
933         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
934                 return 0;
935
936         err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT);
937         if (err < 0)
938                 return err;
939
940         return 0;
941 }
942
943 static void hci_scan_req(struct hci_request *req, unsigned long opt)
944 {
945         __u8 scan = opt;
946
947         BT_DBG("%s %x", req->hdev->name, scan);
948
949         /* Inquiry and Page scans */
950         hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
951 }
952
953 static void hci_auth_req(struct hci_request *req, unsigned long opt)
954 {
955         __u8 auth = opt;
956
957         BT_DBG("%s %x", req->hdev->name, auth);
958
959         /* Authentication */
960         hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
961 }
962
963 static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
964 {
965         __u8 encrypt = opt;
966
967         BT_DBG("%s %x", req->hdev->name, encrypt);
968
969         /* Encryption */
970         hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
971 }
972
973 static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
974 {
975         __le16 policy = cpu_to_le16(opt);
976
977         BT_DBG("%s %x", req->hdev->name, policy);
978
979         /* Default link policy */
980         hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
981 }
982
983 /* Get HCI device by index.
984  * Device is held on return. */
985 struct hci_dev *hci_dev_get(int index)
986 {
987         struct hci_dev *hdev = NULL, *d;
988
989         BT_DBG("%d", index);
990
991         if (index < 0)
992                 return NULL;
993
994         read_lock(&hci_dev_list_lock);
995         list_for_each_entry(d, &hci_dev_list, list) {
996                 if (d->id == index) {
997                         hdev = hci_dev_hold(d);
998                         break;
999                 }
1000         }
1001         read_unlock(&hci_dev_list_lock);
1002         return hdev;
1003 }
1004
1005 /* ---- Inquiry support ---- */
1006
1007 bool hci_discovery_active(struct hci_dev *hdev)
1008 {
1009         struct discovery_state *discov = &hdev->discovery;
1010
1011         switch (discov->state) {
1012         case DISCOVERY_FINDING:
1013         case DISCOVERY_RESOLVING:
1014                 return true;
1015
1016         default:
1017                 return false;
1018         }
1019 }
1020
1021 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1022 {
1023         int old_state = hdev->discovery.state;
1024
1025         BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1026
1027         if (old_state == state)
1028                 return;
1029
1030         hdev->discovery.state = state;
1031
1032         switch (state) {
1033         case DISCOVERY_STOPPED:
1034                 hci_update_background_scan(hdev);
1035
1036                 if (old_state != DISCOVERY_STARTING)
1037                         mgmt_discovering(hdev, 0);
1038                 break;
1039         case DISCOVERY_STARTING:
1040                 break;
1041         case DISCOVERY_FINDING:
1042                 mgmt_discovering(hdev, 1);
1043                 break;
1044         case DISCOVERY_RESOLVING:
1045                 break;
1046         case DISCOVERY_STOPPING:
1047                 break;
1048         }
1049 }
1050
1051 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1052 {
1053         struct discovery_state *cache = &hdev->discovery;
1054         struct inquiry_entry *p, *n;
1055
1056         list_for_each_entry_safe(p, n, &cache->all, all) {
1057                 list_del(&p->all);
1058                 kfree(p);
1059         }
1060
1061         INIT_LIST_HEAD(&cache->unknown);
1062         INIT_LIST_HEAD(&cache->resolve);
1063 }
1064
1065 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1066                                                bdaddr_t *bdaddr)
1067 {
1068         struct discovery_state *cache = &hdev->discovery;
1069         struct inquiry_entry *e;
1070
1071         BT_DBG("cache %p, %pMR", cache, bdaddr);
1072
1073         list_for_each_entry(e, &cache->all, all) {
1074                 if (!bacmp(&e->data.bdaddr, bdaddr))
1075                         return e;
1076         }
1077
1078         return NULL;
1079 }
1080
1081 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1082                                                        bdaddr_t *bdaddr)
1083 {
1084         struct discovery_state *cache = &hdev->discovery;
1085         struct inquiry_entry *e;
1086
1087         BT_DBG("cache %p, %pMR", cache, bdaddr);
1088
1089         list_for_each_entry(e, &cache->unknown, list) {
1090                 if (!bacmp(&e->data.bdaddr, bdaddr))
1091                         return e;
1092         }
1093
1094         return NULL;
1095 }
1096
1097 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1098                                                        bdaddr_t *bdaddr,
1099                                                        int state)
1100 {
1101         struct discovery_state *cache = &hdev->discovery;
1102         struct inquiry_entry *e;
1103
1104         BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1105
1106         list_for_each_entry(e, &cache->resolve, list) {
1107                 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1108                         return e;
1109                 if (!bacmp(&e->data.bdaddr, bdaddr))
1110                         return e;
1111         }
1112
1113         return NULL;
1114 }
1115
1116 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1117                                       struct inquiry_entry *ie)
1118 {
1119         struct discovery_state *cache = &hdev->discovery;
1120         struct list_head *pos = &cache->resolve;
1121         struct inquiry_entry *p;
1122
1123         list_del(&ie->list);
1124
1125         list_for_each_entry(p, &cache->resolve, list) {
1126                 if (p->name_state != NAME_PENDING &&
1127                     abs(p->data.rssi) >= abs(ie->data.rssi))
1128                         break;
1129                 pos = &p->list;
1130         }
1131
1132         list_add(&ie->list, pos);
1133 }
1134
1135 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1136                              bool name_known)
1137 {
1138         struct discovery_state *cache = &hdev->discovery;
1139         struct inquiry_entry *ie;
1140         u32 flags = 0;
1141
1142         BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1143
1144         hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1145
1146         if (!data->ssp_mode)
1147                 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1148
1149         ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1150         if (ie) {
1151                 if (!ie->data.ssp_mode)
1152                         flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1153
1154                 if (ie->name_state == NAME_NEEDED &&
1155                     data->rssi != ie->data.rssi) {
1156                         ie->data.rssi = data->rssi;
1157                         hci_inquiry_cache_update_resolve(hdev, ie);
1158                 }
1159
1160                 goto update;
1161         }
1162
1163         /* Entry not in the cache. Add new one. */
1164         ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1165         if (!ie) {
1166                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1167                 goto done;
1168         }
1169
1170         list_add(&ie->all, &cache->all);
1171
1172         if (name_known) {
1173                 ie->name_state = NAME_KNOWN;
1174         } else {
1175                 ie->name_state = NAME_NOT_KNOWN;
1176                 list_add(&ie->list, &cache->unknown);
1177         }
1178
1179 update:
1180         if (name_known && ie->name_state != NAME_KNOWN &&
1181             ie->name_state != NAME_PENDING) {
1182                 ie->name_state = NAME_KNOWN;
1183                 list_del(&ie->list);
1184         }
1185
1186         memcpy(&ie->data, data, sizeof(*data));
1187         ie->timestamp = jiffies;
1188         cache->timestamp = jiffies;
1189
1190         if (ie->name_state == NAME_NOT_KNOWN)
1191                 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1192
1193 done:
1194         return flags;
1195 }
1196
1197 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1198 {
1199         struct discovery_state *cache = &hdev->discovery;
1200         struct inquiry_info *info = (struct inquiry_info *) buf;
1201         struct inquiry_entry *e;
1202         int copied = 0;
1203
1204         list_for_each_entry(e, &cache->all, all) {
1205                 struct inquiry_data *data = &e->data;
1206
1207                 if (copied >= num)
1208                         break;
1209
1210                 bacpy(&info->bdaddr, &data->bdaddr);
1211                 info->pscan_rep_mode    = data->pscan_rep_mode;
1212                 info->pscan_period_mode = data->pscan_period_mode;
1213                 info->pscan_mode        = data->pscan_mode;
1214                 memcpy(info->dev_class, data->dev_class, 3);
1215                 info->clock_offset      = data->clock_offset;
1216
1217                 info++;
1218                 copied++;
1219         }
1220
1221         BT_DBG("cache %p, copied %d", cache, copied);
1222         return copied;
1223 }
1224
1225 static void hci_inq_req(struct hci_request *req, unsigned long opt)
1226 {
1227         struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1228         struct hci_dev *hdev = req->hdev;
1229         struct hci_cp_inquiry cp;
1230
1231         BT_DBG("%s", hdev->name);
1232
1233         if (test_bit(HCI_INQUIRY, &hdev->flags))
1234                 return;
1235
1236         /* Start Inquiry */
1237         memcpy(&cp.lap, &ir->lap, 3);
1238         cp.length  = ir->length;
1239         cp.num_rsp = ir->num_rsp;
1240         hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1241 }
1242
1243 int hci_inquiry(void __user *arg)
1244 {
1245         __u8 __user *ptr = arg;
1246         struct hci_inquiry_req ir;
1247         struct hci_dev *hdev;
1248         int err = 0, do_inquiry = 0, max_rsp;
1249         long timeo;
1250         __u8 *buf;
1251
1252         if (copy_from_user(&ir, ptr, sizeof(ir)))
1253                 return -EFAULT;
1254
1255         hdev = hci_dev_get(ir.dev_id);
1256         if (!hdev)
1257                 return -ENODEV;
1258
1259         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1260                 err = -EBUSY;
1261                 goto done;
1262         }
1263
1264         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1265                 err = -EOPNOTSUPP;
1266                 goto done;
1267         }
1268
1269         if (hdev->dev_type != HCI_BREDR) {
1270                 err = -EOPNOTSUPP;
1271                 goto done;
1272         }
1273
1274         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1275                 err = -EOPNOTSUPP;
1276                 goto done;
1277         }
1278
1279         hci_dev_lock(hdev);
1280         if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1281             inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1282                 hci_inquiry_cache_flush(hdev);
1283                 do_inquiry = 1;
1284         }
1285         hci_dev_unlock(hdev);
1286
1287         timeo = ir.length * msecs_to_jiffies(2000);
1288
1289         if (do_inquiry) {
1290                 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1291                                    timeo);
1292                 if (err < 0)
1293                         goto done;
1294
1295                 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1296                  * cleared). If it is interrupted by a signal, return -EINTR.
1297                  */
1298                 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1299                                 TASK_INTERRUPTIBLE))
1300                         return -EINTR;
1301         }
1302
1303         /* for unlimited number of responses we will use buffer with
1304          * 255 entries
1305          */
1306         max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1307
1308         /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1309          * copy it to the user space.
1310          */
1311         buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
1312         if (!buf) {
1313                 err = -ENOMEM;
1314                 goto done;
1315         }
1316
1317         hci_dev_lock(hdev);
1318         ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1319         hci_dev_unlock(hdev);
1320
1321         BT_DBG("num_rsp %d", ir.num_rsp);
1322
1323         if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1324                 ptr += sizeof(ir);
1325                 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1326                                  ir.num_rsp))
1327                         err = -EFAULT;
1328         } else
1329                 err = -EFAULT;
1330
1331         kfree(buf);
1332
1333 done:
1334         hci_dev_put(hdev);
1335         return err;
1336 }
1337
1338 static int hci_dev_do_open(struct hci_dev *hdev)
1339 {
1340         int ret = 0;
1341
1342         BT_DBG("%s %p", hdev->name, hdev);
1343
1344         hci_req_lock(hdev);
1345
1346         if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1347                 ret = -ENODEV;
1348                 goto done;
1349         }
1350
1351         if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1352             !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1353                 /* Check for rfkill but allow the HCI setup stage to
1354                  * proceed (which in itself doesn't cause any RF activity).
1355                  */
1356                 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1357                         ret = -ERFKILL;
1358                         goto done;
1359                 }
1360
1361                 /* Check for valid public address or a configured static
1362                  * random adddress, but let the HCI setup proceed to
1363                  * be able to determine if there is a public address
1364                  * or not.
1365                  *
1366                  * In case of user channel usage, it is not important
1367                  * if a public address or static random address is
1368                  * available.
1369                  *
1370                  * This check is only valid for BR/EDR controllers
1371                  * since AMP controllers do not have an address.
1372                  */
1373                 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1374                     hdev->dev_type == HCI_BREDR &&
1375                     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1376                     !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1377                         ret = -EADDRNOTAVAIL;
1378                         goto done;
1379                 }
1380         }
1381
1382         if (test_bit(HCI_UP, &hdev->flags)) {
1383                 ret = -EALREADY;
1384                 goto done;
1385         }
1386
1387         if (hdev->open(hdev)) {
1388                 ret = -EIO;
1389                 goto done;
1390         }
1391
1392         atomic_set(&hdev->cmd_cnt, 1);
1393         set_bit(HCI_INIT, &hdev->flags);
1394
1395         if (hci_dev_test_flag(hdev, HCI_SETUP)) {
1396                 if (hdev->setup)
1397                         ret = hdev->setup(hdev);
1398
1399                 /* The transport driver can set these quirks before
1400                  * creating the HCI device or in its setup callback.
1401                  *
1402                  * In case any of them is set, the controller has to
1403                  * start up as unconfigured.
1404                  */
1405                 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1406                     test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
1407                         hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1408
1409                 /* For an unconfigured controller it is required to
1410                  * read at least the version information provided by
1411                  * the Read Local Version Information command.
1412                  *
1413                  * If the set_bdaddr driver callback is provided, then
1414                  * also the original Bluetooth public device address
1415                  * will be read using the Read BD Address command.
1416                  */
1417                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1418                         ret = __hci_unconf_init(hdev);
1419         }
1420
1421         if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1422                 /* If public address change is configured, ensure that
1423                  * the address gets programmed. If the driver does not
1424                  * support changing the public address, fail the power
1425                  * on procedure.
1426                  */
1427                 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1428                     hdev->set_bdaddr)
1429                         ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1430                 else
1431                         ret = -EADDRNOTAVAIL;
1432         }
1433
1434         if (!ret) {
1435                 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1436                     !hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
1437                         ret = __hci_init(hdev);
1438         }
1439
1440         clear_bit(HCI_INIT, &hdev->flags);
1441
1442         if (!ret) {
1443                 hci_dev_hold(hdev);
1444                 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1445                 set_bit(HCI_UP, &hdev->flags);
1446                 hci_notify(hdev, HCI_DEV_UP);
1447                 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1448                     !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1449                     !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1450                     !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1451                     hdev->dev_type == HCI_BREDR) {
1452                         hci_dev_lock(hdev);
1453                         mgmt_powered(hdev, 1);
1454                         hci_dev_unlock(hdev);
1455                 }
1456         } else {
1457                 /* Init failed, cleanup */
1458                 flush_work(&hdev->tx_work);
1459                 flush_work(&hdev->cmd_work);
1460                 flush_work(&hdev->rx_work);
1461
1462                 skb_queue_purge(&hdev->cmd_q);
1463                 skb_queue_purge(&hdev->rx_q);
1464
1465                 if (hdev->flush)
1466                         hdev->flush(hdev);
1467
1468                 if (hdev->sent_cmd) {
1469                         kfree_skb(hdev->sent_cmd);
1470                         hdev->sent_cmd = NULL;
1471                 }
1472
1473                 hdev->close(hdev);
1474                 hdev->flags &= BIT(HCI_RAW);
1475         }
1476
1477 done:
1478         hci_req_unlock(hdev);
1479         return ret;
1480 }
1481
1482 /* ---- HCI ioctl helpers ---- */
1483
1484 int hci_dev_open(__u16 dev)
1485 {
1486         struct hci_dev *hdev;
1487         int err;
1488
1489         hdev = hci_dev_get(dev);
1490         if (!hdev)
1491                 return -ENODEV;
1492
1493         /* Devices that are marked as unconfigured can only be powered
1494          * up as user channel. Trying to bring them up as normal devices
1495          * will result into a failure. Only user channel operation is
1496          * possible.
1497          *
1498          * When this function is called for a user channel, the flag
1499          * HCI_USER_CHANNEL will be set first before attempting to
1500          * open the device.
1501          */
1502         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1503             !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1504                 err = -EOPNOTSUPP;
1505                 goto done;
1506         }
1507
1508         /* We need to ensure that no other power on/off work is pending
1509          * before proceeding to call hci_dev_do_open. This is
1510          * particularly important if the setup procedure has not yet
1511          * completed.
1512          */
1513         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1514                 cancel_delayed_work(&hdev->power_off);
1515
1516         /* After this call it is guaranteed that the setup procedure
1517          * has finished. This means that error conditions like RFKILL
1518          * or no valid public or static random address apply.
1519          */
1520         flush_workqueue(hdev->req_workqueue);
1521
1522         /* For controllers not using the management interface and that
1523          * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1524          * so that pairing works for them. Once the management interface
1525          * is in use this bit will be cleared again and userspace has
1526          * to explicitly enable it.
1527          */
1528         if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1529             !hci_dev_test_flag(hdev, HCI_MGMT))
1530                 hci_dev_set_flag(hdev, HCI_BONDABLE);
1531
1532         err = hci_dev_do_open(hdev);
1533
1534 done:
1535         hci_dev_put(hdev);
1536         return err;
1537 }
1538
1539 /* This function requires the caller holds hdev->lock */
1540 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1541 {
1542         struct hci_conn_params *p;
1543
1544         list_for_each_entry(p, &hdev->le_conn_params, list) {
1545                 if (p->conn) {
1546                         hci_conn_drop(p->conn);
1547                         hci_conn_put(p->conn);
1548                         p->conn = NULL;
1549                 }
1550                 list_del_init(&p->action);
1551         }
1552
1553         BT_DBG("All LE pending actions cleared");
1554 }
1555
1556 static int hci_dev_do_close(struct hci_dev *hdev)
1557 {
1558         BT_DBG("%s %p", hdev->name, hdev);
1559
1560         if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
1561             test_bit(HCI_UP, &hdev->flags)) {
1562                 /* Execute vendor specific shutdown routine */
1563                 if (hdev->shutdown)
1564                         hdev->shutdown(hdev);
1565         }
1566
1567         cancel_delayed_work(&hdev->power_off);
1568
1569         hci_req_cancel(hdev, ENODEV);
1570         hci_req_lock(hdev);
1571
1572         if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1573                 cancel_delayed_work_sync(&hdev->cmd_timer);
1574                 hci_req_unlock(hdev);
1575                 return 0;
1576         }
1577
1578         /* Flush RX and TX works */
1579         flush_work(&hdev->tx_work);
1580         flush_work(&hdev->rx_work);
1581
1582         if (hdev->discov_timeout > 0) {
1583                 cancel_delayed_work(&hdev->discov_off);
1584                 hdev->discov_timeout = 0;
1585                 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1586                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1587         }
1588
1589         if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1590                 cancel_delayed_work(&hdev->service_cache);
1591
1592         cancel_delayed_work_sync(&hdev->le_scan_disable);
1593         cancel_delayed_work_sync(&hdev->le_scan_restart);
1594
1595         if (hci_dev_test_flag(hdev, HCI_MGMT))
1596                 cancel_delayed_work_sync(&hdev->rpa_expired);
1597
1598         /* Avoid potential lockdep warnings from the *_flush() calls by
1599          * ensuring the workqueue is empty up front.
1600          */
1601         drain_workqueue(hdev->workqueue);
1602
1603         hci_dev_lock(hdev);
1604
1605         hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1606
1607         if (!hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1608                 if (hdev->dev_type == HCI_BREDR)
1609                         mgmt_powered(hdev, 0);
1610         }
1611
1612         hci_inquiry_cache_flush(hdev);
1613         hci_pend_le_actions_clear(hdev);
1614         hci_conn_hash_flush(hdev);
1615         hci_dev_unlock(hdev);
1616
1617         smp_unregister(hdev);
1618
1619         hci_notify(hdev, HCI_DEV_DOWN);
1620
1621         if (hdev->flush)
1622                 hdev->flush(hdev);
1623
1624         /* Reset device */
1625         skb_queue_purge(&hdev->cmd_q);
1626         atomic_set(&hdev->cmd_cnt, 1);
1627         if (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
1628             !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1629             test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1630                 set_bit(HCI_INIT, &hdev->flags);
1631                 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1632                 clear_bit(HCI_INIT, &hdev->flags);
1633         }
1634
1635         /* flush cmd  work */
1636         flush_work(&hdev->cmd_work);
1637
1638         /* Drop queues */
1639         skb_queue_purge(&hdev->rx_q);
1640         skb_queue_purge(&hdev->cmd_q);
1641         skb_queue_purge(&hdev->raw_q);
1642
1643         /* Drop last sent command */
1644         if (hdev->sent_cmd) {
1645                 cancel_delayed_work_sync(&hdev->cmd_timer);
1646                 kfree_skb(hdev->sent_cmd);
1647                 hdev->sent_cmd = NULL;
1648         }
1649
1650         /* After this point our queues are empty
1651          * and no tasks are scheduled. */
1652         hdev->close(hdev);
1653
1654         /* Clear flags */
1655         hdev->flags &= BIT(HCI_RAW);
1656         hci_dev_clear_volatile_flags(hdev);
1657
1658         /* Controller radio is available but is currently powered down */
1659         hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1660
1661         memset(hdev->eir, 0, sizeof(hdev->eir));
1662         memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1663         bacpy(&hdev->random_addr, BDADDR_ANY);
1664
1665         hci_req_unlock(hdev);
1666
1667         hci_dev_put(hdev);
1668         return 0;
1669 }
1670
1671 int hci_dev_close(__u16 dev)
1672 {
1673         struct hci_dev *hdev;
1674         int err;
1675
1676         hdev = hci_dev_get(dev);
1677         if (!hdev)
1678                 return -ENODEV;
1679
1680         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1681                 err = -EBUSY;
1682                 goto done;
1683         }
1684
1685         if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1686                 cancel_delayed_work(&hdev->power_off);
1687
1688         err = hci_dev_do_close(hdev);
1689
1690 done:
1691         hci_dev_put(hdev);
1692         return err;
1693 }
1694
1695 static int hci_dev_do_reset(struct hci_dev *hdev)
1696 {
1697         int ret;
1698
1699         BT_DBG("%s %p", hdev->name, hdev);
1700
1701         hci_req_lock(hdev);
1702
1703         /* Drop queues */
1704         skb_queue_purge(&hdev->rx_q);
1705         skb_queue_purge(&hdev->cmd_q);
1706
1707         /* Avoid potential lockdep warnings from the *_flush() calls by
1708          * ensuring the workqueue is empty up front.
1709          */
1710         drain_workqueue(hdev->workqueue);
1711
1712         hci_dev_lock(hdev);
1713         hci_inquiry_cache_flush(hdev);
1714         hci_conn_hash_flush(hdev);
1715         hci_dev_unlock(hdev);
1716
1717         if (hdev->flush)
1718                 hdev->flush(hdev);
1719
1720         atomic_set(&hdev->cmd_cnt, 1);
1721         hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1722
1723         ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1724
1725         hci_req_unlock(hdev);
1726         return ret;
1727 }
1728
1729 int hci_dev_reset(__u16 dev)
1730 {
1731         struct hci_dev *hdev;
1732         int err;
1733
1734         hdev = hci_dev_get(dev);
1735         if (!hdev)
1736                 return -ENODEV;
1737
1738         if (!test_bit(HCI_UP, &hdev->flags)) {
1739                 err = -ENETDOWN;
1740                 goto done;
1741         }
1742
1743         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1744                 err = -EBUSY;
1745                 goto done;
1746         }
1747
1748         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1749                 err = -EOPNOTSUPP;
1750                 goto done;
1751         }
1752
1753         err = hci_dev_do_reset(hdev);
1754
1755 done:
1756         hci_dev_put(hdev);
1757         return err;
1758 }
1759
1760 int hci_dev_reset_stat(__u16 dev)
1761 {
1762         struct hci_dev *hdev;
1763         int ret = 0;
1764
1765         hdev = hci_dev_get(dev);
1766         if (!hdev)
1767                 return -ENODEV;
1768
1769         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1770                 ret = -EBUSY;
1771                 goto done;
1772         }
1773
1774         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1775                 ret = -EOPNOTSUPP;
1776                 goto done;
1777         }
1778
1779         memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1780
1781 done:
1782         hci_dev_put(hdev);
1783         return ret;
1784 }
1785
1786 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1787 {
1788         bool conn_changed, discov_changed;
1789
1790         BT_DBG("%s scan 0x%02x", hdev->name, scan);
1791
1792         if ((scan & SCAN_PAGE))
1793                 conn_changed = !hci_dev_test_and_set_flag(hdev,
1794                                                           HCI_CONNECTABLE);
1795         else
1796                 conn_changed = hci_dev_test_and_clear_flag(hdev,
1797                                                            HCI_CONNECTABLE);
1798
1799         if ((scan & SCAN_INQUIRY)) {
1800                 discov_changed = !hci_dev_test_and_set_flag(hdev,
1801                                                             HCI_DISCOVERABLE);
1802         } else {
1803                 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1804                 discov_changed = hci_dev_test_and_clear_flag(hdev,
1805                                                              HCI_DISCOVERABLE);
1806         }
1807
1808         if (!hci_dev_test_flag(hdev, HCI_MGMT))
1809                 return;
1810
1811         if (conn_changed || discov_changed) {
1812                 /* In case this was disabled through mgmt */
1813                 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
1814
1815                 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1816                         mgmt_update_adv_data(hdev);
1817
1818                 mgmt_new_settings(hdev);
1819         }
1820 }
1821
1822 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1823 {
1824         struct hci_dev *hdev;
1825         struct hci_dev_req dr;
1826         int err = 0;
1827
1828         if (copy_from_user(&dr, arg, sizeof(dr)))
1829                 return -EFAULT;
1830
1831         hdev = hci_dev_get(dr.dev_id);
1832         if (!hdev)
1833                 return -ENODEV;
1834
1835         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1836                 err = -EBUSY;
1837                 goto done;
1838         }
1839
1840         if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1841                 err = -EOPNOTSUPP;
1842                 goto done;
1843         }
1844
1845         if (hdev->dev_type != HCI_BREDR) {
1846                 err = -EOPNOTSUPP;
1847                 goto done;
1848         }
1849
1850         if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1851                 err = -EOPNOTSUPP;
1852                 goto done;
1853         }
1854
1855         switch (cmd) {
1856         case HCISETAUTH:
1857                 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1858                                    HCI_INIT_TIMEOUT);
1859                 break;
1860
1861         case HCISETENCRYPT:
1862                 if (!lmp_encrypt_capable(hdev)) {
1863                         err = -EOPNOTSUPP;
1864                         break;
1865                 }
1866
1867                 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1868                         /* Auth must be enabled first */
1869                         err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1870                                            HCI_INIT_TIMEOUT);
1871                         if (err)
1872                                 break;
1873                 }
1874
1875                 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1876                                    HCI_INIT_TIMEOUT);
1877                 break;
1878
1879         case HCISETSCAN:
1880                 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1881                                    HCI_INIT_TIMEOUT);
1882
1883                 /* Ensure that the connectable and discoverable states
1884                  * get correctly modified as this was a non-mgmt change.
1885                  */
1886                 if (!err)
1887                         hci_update_scan_state(hdev, dr.dev_opt);
1888                 break;
1889
1890         case HCISETLINKPOL:
1891                 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1892                                    HCI_INIT_TIMEOUT);
1893                 break;
1894
1895         case HCISETLINKMODE:
1896                 hdev->link_mode = ((__u16) dr.dev_opt) &
1897                                         (HCI_LM_MASTER | HCI_LM_ACCEPT);
1898                 break;
1899
1900         case HCISETPTYPE:
1901                 hdev->pkt_type = (__u16) dr.dev_opt;
1902                 break;
1903
1904         case HCISETACLMTU:
1905                 hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
1906                 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1907                 break;
1908
1909         case HCISETSCOMTU:
1910                 hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
1911                 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1912                 break;
1913
1914         default:
1915                 err = -EINVAL;
1916                 break;
1917         }
1918
1919 done:
1920         hci_dev_put(hdev);
1921         return err;
1922 }
1923
1924 int hci_get_dev_list(void __user *arg)
1925 {
1926         struct hci_dev *hdev;
1927         struct hci_dev_list_req *dl;
1928         struct hci_dev_req *dr;
1929         int n = 0, size, err;
1930         __u16 dev_num;
1931
1932         if (get_user(dev_num, (__u16 __user *) arg))
1933                 return -EFAULT;
1934
1935         if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1936                 return -EINVAL;
1937
1938         size = sizeof(*dl) + dev_num * sizeof(*dr);
1939
1940         dl = kzalloc(size, GFP_KERNEL);
1941         if (!dl)
1942                 return -ENOMEM;
1943
1944         dr = dl->dev_req;
1945
1946         read_lock(&hci_dev_list_lock);
1947         list_for_each_entry(hdev, &hci_dev_list, list) {
1948                 unsigned long flags = hdev->flags;
1949
1950                 /* When the auto-off is configured it means the transport
1951                  * is running, but in that case still indicate that the
1952                  * device is actually down.
1953                  */
1954                 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
1955                         flags &= ~BIT(HCI_UP);
1956
1957                 (dr + n)->dev_id  = hdev->id;
1958                 (dr + n)->dev_opt = flags;
1959
1960                 if (++n >= dev_num)
1961                         break;
1962         }
1963         read_unlock(&hci_dev_list_lock);
1964
1965         dl->dev_num = n;
1966         size = sizeof(*dl) + n * sizeof(*dr);
1967
1968         err = copy_to_user(arg, dl, size);
1969         kfree(dl);
1970
1971         return err ? -EFAULT : 0;
1972 }
1973
1974 int hci_get_dev_info(void __user *arg)
1975 {
1976         struct hci_dev *hdev;
1977         struct hci_dev_info di;
1978         unsigned long flags;
1979         int err = 0;
1980
1981         if (copy_from_user(&di, arg, sizeof(di)))
1982                 return -EFAULT;
1983
1984         hdev = hci_dev_get(di.dev_id);
1985         if (!hdev)
1986                 return -ENODEV;
1987
1988         /* When the auto-off is configured it means the transport
1989          * is running, but in that case still indicate that the
1990          * device is actually down.
1991          */
1992         if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
1993                 flags = hdev->flags & ~BIT(HCI_UP);
1994         else
1995                 flags = hdev->flags;
1996
1997         strcpy(di.name, hdev->name);
1998         di.bdaddr   = hdev->bdaddr;
1999         di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2000         di.flags    = flags;
2001         di.pkt_type = hdev->pkt_type;
2002         if (lmp_bredr_capable(hdev)) {
2003                 di.acl_mtu  = hdev->acl_mtu;
2004                 di.acl_pkts = hdev->acl_pkts;
2005                 di.sco_mtu  = hdev->sco_mtu;
2006                 di.sco_pkts = hdev->sco_pkts;
2007         } else {
2008                 di.acl_mtu  = hdev->le_mtu;
2009                 di.acl_pkts = hdev->le_pkts;
2010                 di.sco_mtu  = 0;
2011                 di.sco_pkts = 0;
2012         }
2013         di.link_policy = hdev->link_policy;
2014         di.link_mode   = hdev->link_mode;
2015
2016         memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2017         memcpy(&di.features, &hdev->features, sizeof(di.features));
2018
2019         if (copy_to_user(arg, &di, sizeof(di)))
2020                 err = -EFAULT;
2021
2022         hci_dev_put(hdev);
2023
2024         return err;
2025 }
2026
2027 /* ---- Interface to HCI drivers ---- */
2028
2029 static int hci_rfkill_set_block(void *data, bool blocked)
2030 {
2031         struct hci_dev *hdev = data;
2032
2033         BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2034
2035         if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2036                 return -EBUSY;
2037
2038         if (blocked) {
2039                 hci_dev_set_flag(hdev, HCI_RFKILLED);
2040                 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2041                     !hci_dev_test_flag(hdev, HCI_CONFIG))
2042                         hci_dev_do_close(hdev);
2043         } else {
2044                 hci_dev_clear_flag(hdev, HCI_RFKILLED);
2045         }
2046
2047         return 0;
2048 }
2049
2050 static const struct rfkill_ops hci_rfkill_ops = {
2051         .set_block = hci_rfkill_set_block,
2052 };
2053
2054 static void hci_power_on(struct work_struct *work)
2055 {
2056         struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2057         int err;
2058
2059         BT_DBG("%s", hdev->name);
2060
2061         err = hci_dev_do_open(hdev);
2062         if (err < 0) {
2063                 hci_dev_lock(hdev);
2064                 mgmt_set_powered_failed(hdev, err);
2065                 hci_dev_unlock(hdev);
2066                 return;
2067         }
2068
2069         /* During the HCI setup phase, a few error conditions are
2070          * ignored and they need to be checked now. If they are still
2071          * valid, it is important to turn the device back off.
2072          */
2073         if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2074             hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2075             (hdev->dev_type == HCI_BREDR &&
2076              !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2077              !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2078                 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2079                 hci_dev_do_close(hdev);
2080         } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2081                 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2082                                    HCI_AUTO_OFF_TIMEOUT);
2083         }
2084
2085         if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2086                 /* For unconfigured devices, set the HCI_RAW flag
2087                  * so that userspace can easily identify them.
2088                  */
2089                 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2090                         set_bit(HCI_RAW, &hdev->flags);
2091
2092                 /* For fully configured devices, this will send
2093                  * the Index Added event. For unconfigured devices,
2094                  * it will send Unconfigued Index Added event.
2095                  *
2096                  * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2097                  * and no event will be send.
2098                  */
2099                 mgmt_index_added(hdev);
2100         } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2101                 /* When the controller is now configured, then it
2102                  * is important to clear the HCI_RAW flag.
2103                  */
2104                 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2105                         clear_bit(HCI_RAW, &hdev->flags);
2106
2107                 /* Powering on the controller with HCI_CONFIG set only
2108                  * happens with the transition from unconfigured to
2109                  * configured. This will send the Index Added event.
2110                  */
2111                 mgmt_index_added(hdev);
2112         }
2113 }
2114
2115 static void hci_power_off(struct work_struct *work)
2116 {
2117         struct hci_dev *hdev = container_of(work, struct hci_dev,
2118                                             power_off.work);
2119
2120         BT_DBG("%s", hdev->name);
2121
2122         hci_dev_do_close(hdev);
2123 }
2124
2125 static void hci_error_reset(struct work_struct *work)
2126 {
2127         struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2128
2129         BT_DBG("%s", hdev->name);
2130
2131         if (hdev->hw_error)
2132                 hdev->hw_error(hdev, hdev->hw_error_code);
2133         else
2134                 BT_ERR("%s hardware error 0x%2.2x", hdev->name,
2135                        hdev->hw_error_code);
2136
2137         if (hci_dev_do_close(hdev))
2138                 return;
2139
2140         hci_dev_do_open(hdev);
2141 }
2142
2143 static void hci_discov_off(struct work_struct *work)
2144 {
2145         struct hci_dev *hdev;
2146
2147         hdev = container_of(work, struct hci_dev, discov_off.work);
2148
2149         BT_DBG("%s", hdev->name);
2150
2151         mgmt_discoverable_timeout(hdev);
2152 }
2153
2154 void hci_uuids_clear(struct hci_dev *hdev)
2155 {
2156         struct bt_uuid *uuid, *tmp;
2157
2158         list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2159                 list_del(&uuid->list);
2160                 kfree(uuid);
2161         }
2162 }
2163
2164 void hci_link_keys_clear(struct hci_dev *hdev)
2165 {
2166         struct link_key *key;
2167
2168         list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2169                 list_del_rcu(&key->list);
2170                 kfree_rcu(key, rcu);
2171         }
2172 }
2173
2174 void hci_smp_ltks_clear(struct hci_dev *hdev)
2175 {
2176         struct smp_ltk *k;
2177
2178         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2179                 list_del_rcu(&k->list);
2180                 kfree_rcu(k, rcu);
2181         }
2182 }
2183
2184 void hci_smp_irks_clear(struct hci_dev *hdev)
2185 {
2186         struct smp_irk *k;
2187
2188         list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2189                 list_del_rcu(&k->list);
2190                 kfree_rcu(k, rcu);
2191         }
2192 }
2193
2194 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2195 {
2196         struct link_key *k;
2197
2198         rcu_read_lock();
2199         list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2200                 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2201                         rcu_read_unlock();
2202                         return k;
2203                 }
2204         }
2205         rcu_read_unlock();
2206
2207         return NULL;
2208 }
2209
2210 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2211                                u8 key_type, u8 old_key_type)
2212 {
2213         /* Legacy key */
2214         if (key_type < 0x03)
2215                 return true;
2216
2217         /* Debug keys are insecure so don't store them persistently */
2218         if (key_type == HCI_LK_DEBUG_COMBINATION)
2219                 return false;
2220
2221         /* Changed combination key and there's no previous one */
2222         if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2223                 return false;
2224
2225         /* Security mode 3 case */
2226         if (!conn)
2227                 return true;
2228
2229         /* BR/EDR key derived using SC from an LE link */
2230         if (conn->type == LE_LINK)
2231                 return true;
2232
2233         /* Neither local nor remote side had no-bonding as requirement */
2234         if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2235                 return true;
2236
2237         /* Local side had dedicated bonding as requirement */
2238         if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2239                 return true;
2240
2241         /* Remote side had dedicated bonding as requirement */
2242         if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2243                 return true;
2244
2245         /* If none of the above criteria match, then don't store the key
2246          * persistently */
2247         return false;
2248 }
2249
2250 static u8 ltk_role(u8 type)
2251 {
2252         if (type == SMP_LTK)
2253                 return HCI_ROLE_MASTER;
2254
2255         return HCI_ROLE_SLAVE;
2256 }
2257
2258 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2259                              u8 addr_type, u8 role)
2260 {
2261         struct smp_ltk *k;
2262
2263         rcu_read_lock();
2264         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2265                 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2266                         continue;
2267
2268                 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2269                         rcu_read_unlock();
2270                         return k;
2271                 }
2272         }
2273         rcu_read_unlock();
2274
2275         return NULL;
2276 }
2277
2278 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2279 {
2280         struct smp_irk *irk;
2281
2282         rcu_read_lock();
2283         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2284                 if (!bacmp(&irk->rpa, rpa)) {
2285                         rcu_read_unlock();
2286                         return irk;
2287                 }
2288         }
2289
2290         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2291                 if (smp_irk_matches(hdev, irk->val, rpa)) {
2292                         bacpy(&irk->rpa, rpa);
2293                         rcu_read_unlock();
2294                         return irk;
2295                 }
2296         }
2297         rcu_read_unlock();
2298
2299         return NULL;
2300 }
2301
2302 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2303                                      u8 addr_type)
2304 {
2305         struct smp_irk *irk;
2306
2307         /* Identity Address must be public or static random */
2308         if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2309                 return NULL;
2310
2311         rcu_read_lock();
2312         list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2313                 if (addr_type == irk->addr_type &&
2314                     bacmp(bdaddr, &irk->bdaddr) == 0) {
2315                         rcu_read_unlock();
2316                         return irk;
2317                 }
2318         }
2319         rcu_read_unlock();
2320
2321         return NULL;
2322 }
2323
2324 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2325                                   bdaddr_t *bdaddr, u8 *val, u8 type,
2326                                   u8 pin_len, bool *persistent)
2327 {
2328         struct link_key *key, *old_key;
2329         u8 old_key_type;
2330
2331         old_key = hci_find_link_key(hdev, bdaddr);
2332         if (old_key) {
2333                 old_key_type = old_key->type;
2334                 key = old_key;
2335         } else {
2336                 old_key_type = conn ? conn->key_type : 0xff;
2337                 key = kzalloc(sizeof(*key), GFP_KERNEL);
2338                 if (!key)
2339                         return NULL;
2340                 list_add_rcu(&key->list, &hdev->link_keys);
2341         }
2342
2343         BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2344
2345         /* Some buggy controller combinations generate a changed
2346          * combination key for legacy pairing even when there's no
2347          * previous key */
2348         if (type == HCI_LK_CHANGED_COMBINATION &&
2349             (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2350                 type = HCI_LK_COMBINATION;
2351                 if (conn)
2352                         conn->key_type = type;
2353         }
2354
2355         bacpy(&key->bdaddr, bdaddr);
2356         memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2357         key->pin_len = pin_len;
2358
2359         if (type == HCI_LK_CHANGED_COMBINATION)
2360                 key->type = old_key_type;
2361         else
2362                 key->type = type;
2363
2364         if (persistent)
2365                 *persistent = hci_persistent_key(hdev, conn, type,
2366                                                  old_key_type);
2367
2368         return key;
2369 }
2370
2371 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2372                             u8 addr_type, u8 type, u8 authenticated,
2373                             u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2374 {
2375         struct smp_ltk *key, *old_key;
2376         u8 role = ltk_role(type);
2377
2378         old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2379         if (old_key)
2380                 key = old_key;
2381         else {
2382                 key = kzalloc(sizeof(*key), GFP_KERNEL);
2383                 if (!key)
2384                         return NULL;
2385                 list_add_rcu(&key->list, &hdev->long_term_keys);
2386         }
2387
2388         bacpy(&key->bdaddr, bdaddr);
2389         key->bdaddr_type = addr_type;
2390         memcpy(key->val, tk, sizeof(key->val));
2391         key->authenticated = authenticated;
2392         key->ediv = ediv;
2393         key->rand = rand;
2394         key->enc_size = enc_size;
2395         key->type = type;
2396
2397         return key;
2398 }
2399
2400 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2401                             u8 addr_type, u8 val[16], bdaddr_t *rpa)
2402 {
2403         struct smp_irk *irk;
2404
2405         irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2406         if (!irk) {
2407                 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2408                 if (!irk)
2409                         return NULL;
2410
2411                 bacpy(&irk->bdaddr, bdaddr);
2412                 irk->addr_type = addr_type;
2413
2414                 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2415         }
2416
2417         memcpy(irk->val, val, 16);
2418         bacpy(&irk->rpa, rpa);
2419
2420         return irk;
2421 }
2422
2423 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2424 {
2425         struct link_key *key;
2426
2427         key = hci_find_link_key(hdev, bdaddr);
2428         if (!key)
2429                 return -ENOENT;
2430
2431         BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2432
2433         list_del_rcu(&key->list);
2434         kfree_rcu(key, rcu);
2435
2436         return 0;
2437 }
2438
2439 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2440 {
2441         struct smp_ltk *k;
2442         int removed = 0;
2443
2444         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2445                 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2446                         continue;
2447
2448                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2449
2450                 list_del_rcu(&k->list);
2451                 kfree_rcu(k, rcu);
2452                 removed++;
2453         }
2454
2455         return removed ? 0 : -ENOENT;
2456 }
2457
2458 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2459 {
2460         struct smp_irk *k;
2461
2462         list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2463                 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2464                         continue;
2465
2466                 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2467
2468                 list_del_rcu(&k->list);
2469                 kfree_rcu(k, rcu);
2470         }
2471 }
2472
2473 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2474 {
2475         struct smp_ltk *k;
2476         struct smp_irk *irk;
2477         u8 addr_type;
2478
2479         if (type == BDADDR_BREDR) {
2480                 if (hci_find_link_key(hdev, bdaddr))
2481                         return true;
2482                 return false;
2483         }
2484
2485         /* Convert to HCI addr type which struct smp_ltk uses */
2486         if (type == BDADDR_LE_PUBLIC)
2487                 addr_type = ADDR_LE_DEV_PUBLIC;
2488         else
2489                 addr_type = ADDR_LE_DEV_RANDOM;
2490
2491         irk = hci_get_irk(hdev, bdaddr, addr_type);
2492         if (irk) {
2493                 bdaddr = &irk->bdaddr;
2494                 addr_type = irk->addr_type;
2495         }
2496
2497         rcu_read_lock();
2498         list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2499                 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2500                         rcu_read_unlock();
2501                         return true;
2502                 }
2503         }
2504         rcu_read_unlock();
2505
2506         return false;
2507 }
2508
2509 /* HCI command timer function */
2510 static void hci_cmd_timeout(struct work_struct *work)
2511 {
2512         struct hci_dev *hdev = container_of(work, struct hci_dev,
2513                                             cmd_timer.work);
2514
2515         if (hdev->sent_cmd) {
2516                 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2517                 u16 opcode = __le16_to_cpu(sent->opcode);
2518
2519                 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
2520         } else {
2521                 BT_ERR("%s command tx timeout", hdev->name);
2522         }
2523
2524         atomic_set(&hdev->cmd_cnt, 1);
2525         queue_work(hdev->workqueue, &hdev->cmd_work);
2526 }
2527
2528 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2529                                           bdaddr_t *bdaddr, u8 bdaddr_type)
2530 {
2531         struct oob_data *data;
2532
2533         list_for_each_entry(data, &hdev->remote_oob_data, list) {
2534                 if (bacmp(bdaddr, &data->bdaddr) != 0)
2535                         continue;
2536                 if (data->bdaddr_type != bdaddr_type)
2537                         continue;
2538                 return data;
2539         }
2540
2541         return NULL;
2542 }
2543
2544 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2545                                u8 bdaddr_type)
2546 {
2547         struct oob_data *data;
2548
2549         data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2550         if (!data)
2551                 return -ENOENT;
2552
2553         BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2554
2555         list_del(&data->list);
2556         kfree(data);
2557
2558         return 0;
2559 }
2560
2561 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2562 {
2563         struct oob_data *data, *n;
2564
2565         list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2566                 list_del(&data->list);
2567                 kfree(data);
2568         }
2569 }
2570
2571 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2572                             u8 bdaddr_type, u8 *hash192, u8 *rand192,
2573                             u8 *hash256, u8 *rand256)
2574 {
2575         struct oob_data *data;
2576
2577         data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2578         if (!data) {
2579                 data = kmalloc(sizeof(*data), GFP_KERNEL);
2580                 if (!data)
2581                         return -ENOMEM;
2582
2583                 bacpy(&data->bdaddr, bdaddr);
2584                 data->bdaddr_type = bdaddr_type;
2585                 list_add(&data->list, &hdev->remote_oob_data);
2586         }
2587
2588         if (hash192 && rand192) {
2589                 memcpy(data->hash192, hash192, sizeof(data->hash192));
2590                 memcpy(data->rand192, rand192, sizeof(data->rand192));
2591                 if (hash256 && rand256)
2592                         data->present = 0x03;
2593         } else {
2594                 memset(data->hash192, 0, sizeof(data->hash192));
2595                 memset(data->rand192, 0, sizeof(data->rand192));
2596                 if (hash256 && rand256)
2597                         data->present = 0x02;
2598                 else
2599                         data->present = 0x00;
2600         }
2601
2602         if (hash256 && rand256) {
2603                 memcpy(data->hash256, hash256, sizeof(data->hash256));
2604                 memcpy(data->rand256, rand256, sizeof(data->rand256));
2605         } else {
2606                 memset(data->hash256, 0, sizeof(data->hash256));
2607                 memset(data->rand256, 0, sizeof(data->rand256));
2608                 if (hash192 && rand192)
2609                         data->present = 0x01;
2610         }
2611
2612         BT_DBG("%s for %pMR", hdev->name, bdaddr);
2613
2614         return 0;
2615 }
2616
2617 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2618                                          bdaddr_t *bdaddr, u8 type)
2619 {
2620         struct bdaddr_list *b;
2621
2622         list_for_each_entry(b, bdaddr_list, list) {
2623                 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2624                         return b;
2625         }
2626
2627         return NULL;
2628 }
2629
2630 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2631 {
2632         struct list_head *p, *n;
2633
2634         list_for_each_safe(p, n, bdaddr_list) {
2635                 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
2636
2637                 list_del(p);
2638                 kfree(b);
2639         }
2640 }
2641
2642 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2643 {
2644         struct bdaddr_list *entry;
2645
2646         if (!bacmp(bdaddr, BDADDR_ANY))
2647                 return -EBADF;
2648
2649         if (hci_bdaddr_list_lookup(list, bdaddr, type))
2650                 return -EEXIST;
2651
2652         entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2653         if (!entry)
2654                 return -ENOMEM;
2655
2656         bacpy(&entry->bdaddr, bdaddr);
2657         entry->bdaddr_type = type;
2658
2659         list_add(&entry->list, list);
2660
2661         return 0;
2662 }
2663
2664 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2665 {
2666         struct bdaddr_list *entry;
2667
2668         if (!bacmp(bdaddr, BDADDR_ANY)) {
2669                 hci_bdaddr_list_clear(list);
2670                 return 0;
2671         }
2672
2673         entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2674         if (!entry)
2675                 return -ENOENT;
2676
2677         list_del(&entry->list);
2678         kfree(entry);
2679
2680         return 0;
2681 }
2682
2683 /* This function requires the caller holds hdev->lock */
2684 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2685                                                bdaddr_t *addr, u8 addr_type)
2686 {
2687         struct hci_conn_params *params;
2688
2689         /* The conn params list only contains identity addresses */
2690         if (!hci_is_identity_address(addr, addr_type))
2691                 return NULL;
2692
2693         list_for_each_entry(params, &hdev->le_conn_params, list) {
2694                 if (bacmp(&params->addr, addr) == 0 &&
2695                     params->addr_type == addr_type) {
2696                         return params;
2697                 }
2698         }
2699
2700         return NULL;
2701 }
2702
2703 /* This function requires the caller holds hdev->lock */
2704 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2705                                                   bdaddr_t *addr, u8 addr_type)
2706 {
2707         struct hci_conn_params *param;
2708
2709         /* The list only contains identity addresses */
2710         if (!hci_is_identity_address(addr, addr_type))
2711                 return NULL;
2712
2713         list_for_each_entry(param, list, action) {
2714                 if (bacmp(&param->addr, addr) == 0 &&
2715                     param->addr_type == addr_type)
2716                         return param;
2717         }
2718
2719         return NULL;
2720 }
2721
2722 /* This function requires the caller holds hdev->lock */
2723 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2724                                             bdaddr_t *addr, u8 addr_type)
2725 {
2726         struct hci_conn_params *params;
2727
2728         if (!hci_is_identity_address(addr, addr_type))
2729                 return NULL;
2730
2731         params = hci_conn_params_lookup(hdev, addr, addr_type);
2732         if (params)
2733                 return params;
2734
2735         params = kzalloc(sizeof(*params), GFP_KERNEL);
2736         if (!params) {
2737                 BT_ERR("Out of memory");
2738                 return NULL;
2739         }
2740
2741         bacpy(&params->addr, addr);
2742         params->addr_type = addr_type;
2743
2744         list_add(&params->list, &hdev->le_conn_params);
2745         INIT_LIST_HEAD(&params->action);
2746
2747         params->conn_min_interval = hdev->le_conn_min_interval;
2748         params->conn_max_interval = hdev->le_conn_max_interval;
2749         params->conn_latency = hdev->le_conn_latency;
2750         params->supervision_timeout = hdev->le_supv_timeout;
2751         params->auto_connect = HCI_AUTO_CONN_DISABLED;
2752
2753         BT_DBG("addr %pMR (type %u)", addr, addr_type);
2754
2755         return params;
2756 }
2757
2758 static void hci_conn_params_free(struct hci_conn_params *params)
2759 {
2760         if (params->conn) {
2761                 hci_conn_drop(params->conn);
2762                 hci_conn_put(params->conn);
2763         }
2764
2765         list_del(&params->action);
2766         list_del(&params->list);
2767         kfree(params);
2768 }
2769
2770 /* This function requires the caller holds hdev->lock */
2771 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2772 {
2773         struct hci_conn_params *params;
2774
2775         params = hci_conn_params_lookup(hdev, addr, addr_type);
2776         if (!params)
2777                 return;
2778
2779         hci_conn_params_free(params);
2780
2781         hci_update_background_scan(hdev);
2782
2783         BT_DBG("addr %pMR (type %u)", addr, addr_type);
2784 }
2785
2786 /* This function requires the caller holds hdev->lock */
2787 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
2788 {
2789         struct hci_conn_params *params, *tmp;
2790
2791         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
2792                 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2793                         continue;
2794                 list_del(&params->list);
2795                 kfree(params);
2796         }
2797
2798         BT_DBG("All LE disabled connection parameters were removed");
2799 }
2800
2801 /* This function requires the caller holds hdev->lock */
2802 void hci_conn_params_clear_all(struct hci_dev *hdev)
2803 {
2804         struct hci_conn_params *params, *tmp;
2805
2806         list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2807                 hci_conn_params_free(params);
2808
2809         hci_update_background_scan(hdev);
2810
2811         BT_DBG("All LE connection parameters were removed");
2812 }
2813
2814 static void inquiry_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2815 {
2816         if (status) {
2817                 BT_ERR("Failed to start inquiry: status %d", status);
2818
2819                 hci_dev_lock(hdev);
2820                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2821                 hci_dev_unlock(hdev);
2822                 return;
2823         }
2824 }
2825
2826 static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status,
2827                                           u16 opcode)
2828 {
2829         /* General inquiry access code (GIAC) */
2830         u8 lap[3] = { 0x33, 0x8b, 0x9e };
2831         struct hci_cp_inquiry cp;
2832         int err;
2833
2834         if (status) {
2835                 BT_ERR("Failed to disable LE scanning: status %d", status);
2836                 return;
2837         }
2838
2839         hdev->discovery.scan_start = 0;
2840
2841         switch (hdev->discovery.type) {
2842         case DISCOV_TYPE_LE:
2843                 hci_dev_lock(hdev);
2844                 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2845                 hci_dev_unlock(hdev);
2846                 break;
2847
2848         case DISCOV_TYPE_INTERLEAVED:
2849                 hci_dev_lock(hdev);
2850
2851                 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
2852                              &hdev->quirks)) {
2853                         /* If we were running LE only scan, change discovery
2854                          * state. If we were running both LE and BR/EDR inquiry
2855                          * simultaneously, and BR/EDR inquiry is already
2856                          * finished, stop discovery, otherwise BR/EDR inquiry
2857                          * will stop discovery when finished. If we will resolve
2858                          * remote device name, do not change discovery state.
2859                          */
2860                         if (!test_bit(HCI_INQUIRY, &hdev->flags) &&
2861                             hdev->discovery.state != DISCOVERY_RESOLVING)
2862                                 hci_discovery_set_state(hdev,
2863                                                         DISCOVERY_STOPPED);
2864                 } else {
2865                         struct hci_request req;
2866
2867                         hci_inquiry_cache_flush(hdev);
2868
2869                         hci_req_init(&req, hdev);
2870
2871                         memset(&cp, 0, sizeof(cp));
2872                         memcpy(&cp.lap, lap, sizeof(cp.lap));
2873                         cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
2874                         hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
2875
2876                         err = hci_req_run(&req, inquiry_complete);
2877                         if (err) {
2878                                 BT_ERR("Inquiry request failed: err %d", err);
2879                                 hci_discovery_set_state(hdev,
2880                                                         DISCOVERY_STOPPED);
2881                         }
2882                 }
2883
2884                 hci_dev_unlock(hdev);
2885                 break;
2886         }
2887 }
2888
2889 static void le_scan_disable_work(struct work_struct *work)
2890 {
2891         struct hci_dev *hdev = container_of(work, struct hci_dev,
2892                                             le_scan_disable.work);
2893         struct hci_request req;
2894         int err;
2895
2896         BT_DBG("%s", hdev->name);
2897
2898         cancel_delayed_work_sync(&hdev->le_scan_restart);
2899
2900         hci_req_init(&req, hdev);
2901
2902         hci_req_add_le_scan_disable(&req);
2903
2904         err = hci_req_run(&req, le_scan_disable_work_complete);
2905         if (err)
2906                 BT_ERR("Disable LE scanning request failed: err %d", err);
2907 }
2908
2909 static void le_scan_restart_work_complete(struct hci_dev *hdev, u8 status,
2910                                           u16 opcode)
2911 {
2912         unsigned long timeout, duration, scan_start, now;
2913
2914         BT_DBG("%s", hdev->name);
2915
2916         if (status) {
2917                 BT_ERR("Failed to restart LE scan: status %d", status);
2918                 return;
2919         }
2920
2921         if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
2922             !hdev->discovery.scan_start)
2923                 return;
2924
2925         /* When the scan was started, hdev->le_scan_disable has been queued
2926          * after duration from scan_start. During scan restart this job
2927          * has been canceled, and we need to queue it again after proper
2928          * timeout, to make sure that scan does not run indefinitely.
2929          */
2930         duration = hdev->discovery.scan_duration;
2931         scan_start = hdev->discovery.scan_start;
2932         now = jiffies;
2933         if (now - scan_start <= duration) {
2934                 int elapsed;
2935
2936                 if (now >= scan_start)
2937                         elapsed = now - scan_start;
2938                 else
2939                         elapsed = ULONG_MAX - scan_start + now;
2940
2941                 timeout = duration - elapsed;
2942         } else {
2943                 timeout = 0;
2944         }
2945         queue_delayed_work(hdev->workqueue,
2946                            &hdev->le_scan_disable, timeout);
2947 }
2948
2949 static void le_scan_restart_work(struct work_struct *work)
2950 {
2951         struct hci_dev *hdev = container_of(work, struct hci_dev,
2952                                             le_scan_restart.work);
2953         struct hci_request req;
2954         struct hci_cp_le_set_scan_enable cp;
2955         int err;
2956
2957         BT_DBG("%s", hdev->name);
2958
2959         /* If controller is not scanning we are done. */
2960         if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
2961                 return;
2962
2963         hci_req_init(&req, hdev);
2964
2965         hci_req_add_le_scan_disable(&req);
2966
2967         memset(&cp, 0, sizeof(cp));
2968         cp.enable = LE_SCAN_ENABLE;
2969         cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2970         hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2971
2972         err = hci_req_run(&req, le_scan_restart_work_complete);
2973         if (err)
2974                 BT_ERR("Restart LE scan request failed: err %d", err);
2975 }
2976
2977 /* Copy the Identity Address of the controller.
2978  *
2979  * If the controller has a public BD_ADDR, then by default use that one.
2980  * If this is a LE only controller without a public address, default to
2981  * the static random address.
2982  *
2983  * For debugging purposes it is possible to force controllers with a
2984  * public address to use the static random address instead.
2985  *
2986  * In case BR/EDR has been disabled on a dual-mode controller and
2987  * userspace has configured a static address, then that address
2988  * becomes the identity address instead of the public BR/EDR address.
2989  */
2990 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2991                                u8 *bdaddr_type)
2992 {
2993         if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
2994             !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
2995             (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
2996              bacmp(&hdev->static_addr, BDADDR_ANY))) {
2997                 bacpy(bdaddr, &hdev->static_addr);
2998                 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2999         } else {
3000                 bacpy(bdaddr, &hdev->bdaddr);
3001                 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3002         }
3003 }
3004
3005 /* Alloc HCI device */
3006 struct hci_dev *hci_alloc_dev(void)
3007 {
3008         struct hci_dev *hdev;
3009
3010         hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3011         if (!hdev)
3012                 return NULL;
3013
3014         hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3015         hdev->esco_type = (ESCO_HV1);
3016         hdev->link_mode = (HCI_LM_ACCEPT);
3017         hdev->num_iac = 0x01;           /* One IAC support is mandatory */
3018         hdev->io_capability = 0x03;     /* No Input No Output */
3019         hdev->manufacturer = 0xffff;    /* Default to internal use */
3020         hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3021         hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3022
3023         hdev->sniff_max_interval = 800;
3024         hdev->sniff_min_interval = 80;
3025
3026         hdev->le_adv_channel_map = 0x07;
3027         hdev->le_adv_min_interval = 0x0800;
3028         hdev->le_adv_max_interval = 0x0800;
3029         hdev->le_scan_interval = 0x0060;
3030         hdev->le_scan_window = 0x0030;
3031         hdev->le_conn_min_interval = 0x0028;
3032         hdev->le_conn_max_interval = 0x0038;
3033         hdev->le_conn_latency = 0x0000;
3034         hdev->le_supv_timeout = 0x002a;
3035         hdev->le_def_tx_len = 0x001b;
3036         hdev->le_def_tx_time = 0x0148;
3037         hdev->le_max_tx_len = 0x001b;
3038         hdev->le_max_tx_time = 0x0148;
3039         hdev->le_max_rx_len = 0x001b;
3040         hdev->le_max_rx_time = 0x0148;
3041
3042         hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3043         hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3044         hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3045         hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3046
3047         mutex_init(&hdev->lock);
3048         mutex_init(&hdev->req_lock);
3049
3050         INIT_LIST_HEAD(&hdev->mgmt_pending);
3051         INIT_LIST_HEAD(&hdev->blacklist);
3052         INIT_LIST_HEAD(&hdev->whitelist);
3053         INIT_LIST_HEAD(&hdev->uuids);
3054         INIT_LIST_HEAD(&hdev->link_keys);
3055         INIT_LIST_HEAD(&hdev->long_term_keys);
3056         INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3057         INIT_LIST_HEAD(&hdev->remote_oob_data);
3058         INIT_LIST_HEAD(&hdev->le_white_list);
3059         INIT_LIST_HEAD(&hdev->le_conn_params);
3060         INIT_LIST_HEAD(&hdev->pend_le_conns);
3061         INIT_LIST_HEAD(&hdev->pend_le_reports);
3062         INIT_LIST_HEAD(&hdev->conn_hash.list);
3063
3064         INIT_WORK(&hdev->rx_work, hci_rx_work);
3065         INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3066         INIT_WORK(&hdev->tx_work, hci_tx_work);
3067         INIT_WORK(&hdev->power_on, hci_power_on);
3068         INIT_WORK(&hdev->error_reset, hci_error_reset);
3069
3070         INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3071         INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
3072         INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
3073         INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
3074
3075         skb_queue_head_init(&hdev->rx_q);
3076         skb_queue_head_init(&hdev->cmd_q);
3077         skb_queue_head_init(&hdev->raw_q);
3078
3079         init_waitqueue_head(&hdev->req_wait_q);
3080
3081         INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3082
3083         hci_init_sysfs(hdev);
3084         discovery_init(hdev);
3085         adv_info_init(hdev);
3086
3087         return hdev;
3088 }
3089 EXPORT_SYMBOL(hci_alloc_dev);
3090
3091 /* Free HCI device */
3092 void hci_free_dev(struct hci_dev *hdev)
3093 {
3094         /* will free via device release */
3095         put_device(&hdev->dev);
3096 }
3097 EXPORT_SYMBOL(hci_free_dev);
3098
3099 /* Register HCI device */
3100 int hci_register_dev(struct hci_dev *hdev)
3101 {
3102         int id, error;
3103
3104         if (!hdev->open || !hdev->close || !hdev->send)
3105                 return -EINVAL;
3106
3107         /* Do not allow HCI_AMP devices to register at index 0,
3108          * so the index can be used as the AMP controller ID.
3109          */
3110         switch (hdev->dev_type) {
3111         case HCI_BREDR:
3112                 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3113                 break;
3114         case HCI_AMP:
3115                 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3116                 break;
3117         default:
3118                 return -EINVAL;
3119         }
3120
3121         if (id < 0)
3122                 return id;
3123
3124         sprintf(hdev->name, "hci%d", id);
3125         hdev->id = id;
3126
3127         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3128
3129         hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3130                                           WQ_MEM_RECLAIM, 1, hdev->name);
3131         if (!hdev->workqueue) {
3132                 error = -ENOMEM;
3133                 goto err;
3134         }
3135
3136         hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3137                                               WQ_MEM_RECLAIM, 1, hdev->name);
3138         if (!hdev->req_workqueue) {
3139                 destroy_workqueue(hdev->workqueue);
3140                 error = -ENOMEM;
3141                 goto err;
3142         }
3143
3144         if (!IS_ERR_OR_NULL(bt_debugfs))
3145                 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3146
3147         dev_set_name(&hdev->dev, "%s", hdev->name);
3148
3149         error = device_add(&hdev->dev);
3150         if (error < 0)
3151                 goto err_wqueue;
3152
3153         hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3154                                     RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3155                                     hdev);
3156         if (hdev->rfkill) {
3157                 if (rfkill_register(hdev->rfkill) < 0) {
3158                         rfkill_destroy(hdev->rfkill);
3159                         hdev->rfkill = NULL;
3160                 }
3161         }
3162
3163         if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3164                 hci_dev_set_flag(hdev, HCI_RFKILLED);
3165
3166         hci_dev_set_flag(hdev, HCI_SETUP);
3167         hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3168
3169         if (hdev->dev_type == HCI_BREDR) {
3170                 /* Assume BR/EDR support until proven otherwise (such as
3171                  * through reading supported features during init.
3172                  */
3173                 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3174         }
3175
3176         write_lock(&hci_dev_list_lock);
3177         list_add(&hdev->list, &hci_dev_list);
3178         write_unlock(&hci_dev_list_lock);
3179
3180         /* Devices that are marked for raw-only usage are unconfigured
3181          * and should not be included in normal operation.
3182          */
3183         if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3184                 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3185
3186         hci_notify(hdev, HCI_DEV_REG);
3187         hci_dev_hold(hdev);
3188
3189         queue_work(hdev->req_workqueue, &hdev->power_on);
3190
3191         return id;
3192
3193 err_wqueue:
3194         destroy_workqueue(hdev->workqueue);
3195         destroy_workqueue(hdev->req_workqueue);
3196 err:
3197         ida_simple_remove(&hci_index_ida, hdev->id);
3198
3199         return error;
3200 }
3201 EXPORT_SYMBOL(hci_register_dev);
3202
3203 /* Unregister HCI device */
3204 void hci_unregister_dev(struct hci_dev *hdev)
3205 {
3206         int id;
3207
3208         BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3209
3210         hci_dev_set_flag(hdev, HCI_UNREGISTER);
3211
3212         id = hdev->id;
3213
3214         write_lock(&hci_dev_list_lock);
3215         list_del(&hdev->list);
3216         write_unlock(&hci_dev_list_lock);
3217
3218         hci_dev_do_close(hdev);
3219
3220         cancel_work_sync(&hdev->power_on);
3221
3222         if (!test_bit(HCI_INIT, &hdev->flags) &&
3223             !hci_dev_test_flag(hdev, HCI_SETUP) &&
3224             !hci_dev_test_flag(hdev, HCI_CONFIG)) {
3225                 hci_dev_lock(hdev);
3226                 mgmt_index_removed(hdev);
3227                 hci_dev_unlock(hdev);
3228         }
3229
3230         /* mgmt_index_removed should take care of emptying the
3231          * pending list */
3232         BUG_ON(!list_empty(&hdev->mgmt_pending));
3233
3234         hci_notify(hdev, HCI_DEV_UNREG);
3235
3236         if (hdev->rfkill) {
3237                 rfkill_unregister(hdev->rfkill);
3238                 rfkill_destroy(hdev->rfkill);
3239         }
3240
3241         device_del(&hdev->dev);
3242
3243         debugfs_remove_recursive(hdev->debugfs);
3244
3245         destroy_workqueue(hdev->workqueue);
3246         destroy_workqueue(hdev->req_workqueue);
3247
3248         hci_dev_lock(hdev);
3249         hci_bdaddr_list_clear(&hdev->blacklist);
3250         hci_bdaddr_list_clear(&hdev->whitelist);
3251         hci_uuids_clear(hdev);
3252         hci_link_keys_clear(hdev);
3253         hci_smp_ltks_clear(hdev);
3254         hci_smp_irks_clear(hdev);
3255         hci_remote_oob_data_clear(hdev);
3256         hci_bdaddr_list_clear(&hdev->le_white_list);
3257         hci_conn_params_clear_all(hdev);
3258         hci_discovery_filter_clear(hdev);
3259         hci_dev_unlock(hdev);
3260
3261         hci_dev_put(hdev);
3262
3263         ida_simple_remove(&hci_index_ida, id);
3264 }
3265 EXPORT_SYMBOL(hci_unregister_dev);
3266
3267 /* Suspend HCI device */
3268 int hci_suspend_dev(struct hci_dev *hdev)
3269 {
3270         hci_notify(hdev, HCI_DEV_SUSPEND);
3271         return 0;
3272 }
3273 EXPORT_SYMBOL(hci_suspend_dev);
3274
3275 /* Resume HCI device */
3276 int hci_resume_dev(struct hci_dev *hdev)
3277 {
3278         hci_notify(hdev, HCI_DEV_RESUME);
3279         return 0;
3280 }
3281 EXPORT_SYMBOL(hci_resume_dev);
3282
3283 /* Reset HCI device */
3284 int hci_reset_dev(struct hci_dev *hdev)
3285 {
3286         const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3287         struct sk_buff *skb;
3288
3289         skb = bt_skb_alloc(3, GFP_ATOMIC);
3290         if (!skb)
3291                 return -ENOMEM;
3292
3293         bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3294         memcpy(skb_put(skb, 3), hw_err, 3);
3295
3296         /* Send Hardware Error to upper stack */
3297         return hci_recv_frame(hdev, skb);
3298 }
3299 EXPORT_SYMBOL(hci_reset_dev);
3300
3301 /* Receive frame from HCI drivers */
3302 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
3303 {
3304         if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
3305                       && !test_bit(HCI_INIT, &hdev->flags))) {
3306                 kfree_skb(skb);
3307                 return -ENXIO;
3308         }
3309
3310         /* Incoming skb */
3311         bt_cb(skb)->incoming = 1;
3312
3313         /* Time stamp */
3314         __net_timestamp(skb);
3315
3316         skb_queue_tail(&hdev->rx_q, skb);
3317         queue_work(hdev->workqueue, &hdev->rx_work);
3318
3319         return 0;
3320 }
3321 EXPORT_SYMBOL(hci_recv_frame);
3322
3323 /* ---- Interface to upper protocols