xref: /linux/net/bluetooth/hci_core.c (revision 195ef75e)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4    Copyright (C) 2011 ProFUSION Embedded Systems
5 
6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License version 2 as
10    published by the Free Software Foundation;
11 
12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 
21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23    SOFTWARE IS DISCLAIMED.
24 */
25 
26 /* Bluetooth HCI core. */
27 
28 #include <linux/export.h>
29 #include <linux/rfkill.h>
30 #include <linux/debugfs.h>
31 #include <linux/crypto.h>
32 #include <linux/kcov.h>
33 #include <linux/property.h>
34 #include <linux/suspend.h>
35 #include <linux/wait.h>
36 #include <asm/unaligned.h>
37 
38 #include <net/bluetooth/bluetooth.h>
39 #include <net/bluetooth/hci_core.h>
40 #include <net/bluetooth/l2cap.h>
41 #include <net/bluetooth/mgmt.h>
42 
43 #include "hci_request.h"
44 #include "hci_debugfs.h"
45 #include "smp.h"
46 #include "leds.h"
47 #include "msft.h"
48 #include "aosp.h"
49 #include "hci_codec.h"
50 
51 static void hci_rx_work(struct work_struct *work);
52 static void hci_cmd_work(struct work_struct *work);
53 static void hci_tx_work(struct work_struct *work);
54 
55 /* HCI device list */
56 LIST_HEAD(hci_dev_list);
57 DEFINE_RWLOCK(hci_dev_list_lock);
58 
59 /* HCI callback list */
60 LIST_HEAD(hci_cb_list);
61 DEFINE_MUTEX(hci_cb_list_lock);
62 
63 /* HCI ID Numbering */
64 static DEFINE_IDA(hci_index_ida);
65 
66 static int hci_scan_req(struct hci_request *req, unsigned long opt)
67 {
68 	__u8 scan = opt;
69 
70 	BT_DBG("%s %x", req->hdev->name, scan);
71 
72 	/* Inquiry and Page scans */
73 	hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
74 	return 0;
75 }
76 
77 static int hci_auth_req(struct hci_request *req, unsigned long opt)
78 {
79 	__u8 auth = opt;
80 
81 	BT_DBG("%s %x", req->hdev->name, auth);
82 
83 	/* Authentication */
84 	hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
85 	return 0;
86 }
87 
88 static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
89 {
90 	__u8 encrypt = opt;
91 
92 	BT_DBG("%s %x", req->hdev->name, encrypt);
93 
94 	/* Encryption */
95 	hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
96 	return 0;
97 }
98 
99 static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
100 {
101 	__le16 policy = cpu_to_le16(opt);
102 
103 	BT_DBG("%s %x", req->hdev->name, policy);
104 
105 	/* Default link policy */
106 	hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
107 	return 0;
108 }
109 
110 /* Get HCI device by index.
111  * Device is held on return. */
112 struct hci_dev *hci_dev_get(int index)
113 {
114 	struct hci_dev *hdev = NULL, *d;
115 
116 	BT_DBG("%d", index);
117 
118 	if (index < 0)
119 		return NULL;
120 
121 	read_lock(&hci_dev_list_lock);
122 	list_for_each_entry(d, &hci_dev_list, list) {
123 		if (d->id == index) {
124 			hdev = hci_dev_hold(d);
125 			break;
126 		}
127 	}
128 	read_unlock(&hci_dev_list_lock);
129 	return hdev;
130 }
131 
132 /* ---- Inquiry support ---- */
133 
134 bool hci_discovery_active(struct hci_dev *hdev)
135 {
136 	struct discovery_state *discov = &hdev->discovery;
137 
138 	switch (discov->state) {
139 	case DISCOVERY_FINDING:
140 	case DISCOVERY_RESOLVING:
141 		return true;
142 
143 	default:
144 		return false;
145 	}
146 }
147 
148 void hci_discovery_set_state(struct hci_dev *hdev, int state)
149 {
150 	int old_state = hdev->discovery.state;
151 
152 	BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
153 
154 	if (old_state == state)
155 		return;
156 
157 	hdev->discovery.state = state;
158 
159 	switch (state) {
160 	case DISCOVERY_STOPPED:
161 		hci_update_passive_scan(hdev);
162 
163 		if (old_state != DISCOVERY_STARTING)
164 			mgmt_discovering(hdev, 0);
165 		break;
166 	case DISCOVERY_STARTING:
167 		break;
168 	case DISCOVERY_FINDING:
169 		mgmt_discovering(hdev, 1);
170 		break;
171 	case DISCOVERY_RESOLVING:
172 		break;
173 	case DISCOVERY_STOPPING:
174 		break;
175 	}
176 }
177 
178 void hci_inquiry_cache_flush(struct hci_dev *hdev)
179 {
180 	struct discovery_state *cache = &hdev->discovery;
181 	struct inquiry_entry *p, *n;
182 
183 	list_for_each_entry_safe(p, n, &cache->all, all) {
184 		list_del(&p->all);
185 		kfree(p);
186 	}
187 
188 	INIT_LIST_HEAD(&cache->unknown);
189 	INIT_LIST_HEAD(&cache->resolve);
190 }
191 
192 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
193 					       bdaddr_t *bdaddr)
194 {
195 	struct discovery_state *cache = &hdev->discovery;
196 	struct inquiry_entry *e;
197 
198 	BT_DBG("cache %p, %pMR", cache, bdaddr);
199 
200 	list_for_each_entry(e, &cache->all, all) {
201 		if (!bacmp(&e->data.bdaddr, bdaddr))
202 			return e;
203 	}
204 
205 	return NULL;
206 }
207 
208 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
209 						       bdaddr_t *bdaddr)
210 {
211 	struct discovery_state *cache = &hdev->discovery;
212 	struct inquiry_entry *e;
213 
214 	BT_DBG("cache %p, %pMR", cache, bdaddr);
215 
216 	list_for_each_entry(e, &cache->unknown, list) {
217 		if (!bacmp(&e->data.bdaddr, bdaddr))
218 			return e;
219 	}
220 
221 	return NULL;
222 }
223 
224 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
225 						       bdaddr_t *bdaddr,
226 						       int state)
227 {
228 	struct discovery_state *cache = &hdev->discovery;
229 	struct inquiry_entry *e;
230 
231 	BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
232 
233 	list_for_each_entry(e, &cache->resolve, list) {
234 		if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
235 			return e;
236 		if (!bacmp(&e->data.bdaddr, bdaddr))
237 			return e;
238 	}
239 
240 	return NULL;
241 }
242 
243 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
244 				      struct inquiry_entry *ie)
245 {
246 	struct discovery_state *cache = &hdev->discovery;
247 	struct list_head *pos = &cache->resolve;
248 	struct inquiry_entry *p;
249 
250 	list_del(&ie->list);
251 
252 	list_for_each_entry(p, &cache->resolve, list) {
253 		if (p->name_state != NAME_PENDING &&
254 		    abs(p->data.rssi) >= abs(ie->data.rssi))
255 			break;
256 		pos = &p->list;
257 	}
258 
259 	list_add(&ie->list, pos);
260 }
261 
262 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
263 			     bool name_known)
264 {
265 	struct discovery_state *cache = &hdev->discovery;
266 	struct inquiry_entry *ie;
267 	u32 flags = 0;
268 
269 	BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
270 
271 	hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
272 
273 	if (!data->ssp_mode)
274 		flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
275 
276 	ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
277 	if (ie) {
278 		if (!ie->data.ssp_mode)
279 			flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
280 
281 		if (ie->name_state == NAME_NEEDED &&
282 		    data->rssi != ie->data.rssi) {
283 			ie->data.rssi = data->rssi;
284 			hci_inquiry_cache_update_resolve(hdev, ie);
285 		}
286 
287 		goto update;
288 	}
289 
290 	/* Entry not in the cache. Add new one. */
291 	ie = kzalloc(sizeof(*ie), GFP_KERNEL);
292 	if (!ie) {
293 		flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
294 		goto done;
295 	}
296 
297 	list_add(&ie->all, &cache->all);
298 
299 	if (name_known) {
300 		ie->name_state = NAME_KNOWN;
301 	} else {
302 		ie->name_state = NAME_NOT_KNOWN;
303 		list_add(&ie->list, &cache->unknown);
304 	}
305 
306 update:
307 	if (name_known && ie->name_state != NAME_KNOWN &&
308 	    ie->name_state != NAME_PENDING) {
309 		ie->name_state = NAME_KNOWN;
310 		list_del(&ie->list);
311 	}
312 
313 	memcpy(&ie->data, data, sizeof(*data));
314 	ie->timestamp = jiffies;
315 	cache->timestamp = jiffies;
316 
317 	if (ie->name_state == NAME_NOT_KNOWN)
318 		flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
319 
320 done:
321 	return flags;
322 }
323 
324 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
325 {
326 	struct discovery_state *cache = &hdev->discovery;
327 	struct inquiry_info *info = (struct inquiry_info *) buf;
328 	struct inquiry_entry *e;
329 	int copied = 0;
330 
331 	list_for_each_entry(e, &cache->all, all) {
332 		struct inquiry_data *data = &e->data;
333 
334 		if (copied >= num)
335 			break;
336 
337 		bacpy(&info->bdaddr, &data->bdaddr);
338 		info->pscan_rep_mode	= data->pscan_rep_mode;
339 		info->pscan_period_mode	= data->pscan_period_mode;
340 		info->pscan_mode	= data->pscan_mode;
341 		memcpy(info->dev_class, data->dev_class, 3);
342 		info->clock_offset	= data->clock_offset;
343 
344 		info++;
345 		copied++;
346 	}
347 
348 	BT_DBG("cache %p, copied %d", cache, copied);
349 	return copied;
350 }
351 
352 static int hci_inq_req(struct hci_request *req, unsigned long opt)
353 {
354 	struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
355 	struct hci_dev *hdev = req->hdev;
356 	struct hci_cp_inquiry cp;
357 
358 	BT_DBG("%s", hdev->name);
359 
360 	if (test_bit(HCI_INQUIRY, &hdev->flags))
361 		return 0;
362 
363 	/* Start Inquiry */
364 	memcpy(&cp.lap, &ir->lap, 3);
365 	cp.length  = ir->length;
366 	cp.num_rsp = ir->num_rsp;
367 	hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
368 
369 	return 0;
370 }
371 
372 int hci_inquiry(void __user *arg)
373 {
374 	__u8 __user *ptr = arg;
375 	struct hci_inquiry_req ir;
376 	struct hci_dev *hdev;
377 	int err = 0, do_inquiry = 0, max_rsp;
378 	long timeo;
379 	__u8 *buf;
380 
381 	if (copy_from_user(&ir, ptr, sizeof(ir)))
382 		return -EFAULT;
383 
384 	hdev = hci_dev_get(ir.dev_id);
385 	if (!hdev)
386 		return -ENODEV;
387 
388 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
389 		err = -EBUSY;
390 		goto done;
391 	}
392 
393 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
394 		err = -EOPNOTSUPP;
395 		goto done;
396 	}
397 
398 	if (hdev->dev_type != HCI_PRIMARY) {
399 		err = -EOPNOTSUPP;
400 		goto done;
401 	}
402 
403 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
404 		err = -EOPNOTSUPP;
405 		goto done;
406 	}
407 
408 	/* Restrict maximum inquiry length to 60 seconds */
409 	if (ir.length > 60) {
410 		err = -EINVAL;
411 		goto done;
412 	}
413 
414 	hci_dev_lock(hdev);
415 	if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
416 	    inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
417 		hci_inquiry_cache_flush(hdev);
418 		do_inquiry = 1;
419 	}
420 	hci_dev_unlock(hdev);
421 
422 	timeo = ir.length * msecs_to_jiffies(2000);
423 
424 	if (do_inquiry) {
425 		err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
426 				   timeo, NULL);
427 		if (err < 0)
428 			goto done;
429 
430 		/* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
431 		 * cleared). If it is interrupted by a signal, return -EINTR.
432 		 */
433 		if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
434 				TASK_INTERRUPTIBLE)) {
435 			err = -EINTR;
436 			goto done;
437 		}
438 	}
439 
440 	/* for unlimited number of responses we will use buffer with
441 	 * 255 entries
442 	 */
443 	max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
444 
445 	/* cache_dump can't sleep. Therefore we allocate temp buffer and then
446 	 * copy it to the user space.
447 	 */
448 	buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
449 	if (!buf) {
450 		err = -ENOMEM;
451 		goto done;
452 	}
453 
454 	hci_dev_lock(hdev);
455 	ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
456 	hci_dev_unlock(hdev);
457 
458 	BT_DBG("num_rsp %d", ir.num_rsp);
459 
460 	if (!copy_to_user(ptr, &ir, sizeof(ir))) {
461 		ptr += sizeof(ir);
462 		if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
463 				 ir.num_rsp))
464 			err = -EFAULT;
465 	} else
466 		err = -EFAULT;
467 
468 	kfree(buf);
469 
470 done:
471 	hci_dev_put(hdev);
472 	return err;
473 }
474 
475 static int hci_dev_do_open(struct hci_dev *hdev)
476 {
477 	int ret = 0;
478 
479 	BT_DBG("%s %p", hdev->name, hdev);
480 
481 	hci_req_sync_lock(hdev);
482 
483 	ret = hci_dev_open_sync(hdev);
484 
485 	hci_req_sync_unlock(hdev);
486 	return ret;
487 }
488 
489 /* ---- HCI ioctl helpers ---- */
490 
491 int hci_dev_open(__u16 dev)
492 {
493 	struct hci_dev *hdev;
494 	int err;
495 
496 	hdev = hci_dev_get(dev);
497 	if (!hdev)
498 		return -ENODEV;
499 
500 	/* Devices that are marked as unconfigured can only be powered
501 	 * up as user channel. Trying to bring them up as normal devices
502 	 * will result into a failure. Only user channel operation is
503 	 * possible.
504 	 *
505 	 * When this function is called for a user channel, the flag
506 	 * HCI_USER_CHANNEL will be set first before attempting to
507 	 * open the device.
508 	 */
509 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
510 	    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
511 		err = -EOPNOTSUPP;
512 		goto done;
513 	}
514 
515 	/* We need to ensure that no other power on/off work is pending
516 	 * before proceeding to call hci_dev_do_open. This is
517 	 * particularly important if the setup procedure has not yet
518 	 * completed.
519 	 */
520 	if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
521 		cancel_delayed_work(&hdev->power_off);
522 
523 	/* After this call it is guaranteed that the setup procedure
524 	 * has finished. This means that error conditions like RFKILL
525 	 * or no valid public or static random address apply.
526 	 */
527 	flush_workqueue(hdev->req_workqueue);
528 
529 	/* For controllers not using the management interface and that
530 	 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
531 	 * so that pairing works for them. Once the management interface
532 	 * is in use this bit will be cleared again and userspace has
533 	 * to explicitly enable it.
534 	 */
535 	if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
536 	    !hci_dev_test_flag(hdev, HCI_MGMT))
537 		hci_dev_set_flag(hdev, HCI_BONDABLE);
538 
539 	err = hci_dev_do_open(hdev);
540 
541 done:
542 	hci_dev_put(hdev);
543 	return err;
544 }
545 
546 int hci_dev_do_close(struct hci_dev *hdev)
547 {
548 	int err;
549 
550 	BT_DBG("%s %p", hdev->name, hdev);
551 
552 	hci_req_sync_lock(hdev);
553 
554 	err = hci_dev_close_sync(hdev);
555 
556 	hci_req_sync_unlock(hdev);
557 
558 	return err;
559 }
560 
561 int hci_dev_close(__u16 dev)
562 {
563 	struct hci_dev *hdev;
564 	int err;
565 
566 	hdev = hci_dev_get(dev);
567 	if (!hdev)
568 		return -ENODEV;
569 
570 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
571 		err = -EBUSY;
572 		goto done;
573 	}
574 
575 	cancel_work_sync(&hdev->power_on);
576 	if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
577 		cancel_delayed_work(&hdev->power_off);
578 
579 	err = hci_dev_do_close(hdev);
580 
581 done:
582 	hci_dev_put(hdev);
583 	return err;
584 }
585 
586 static int hci_dev_do_reset(struct hci_dev *hdev)
587 {
588 	int ret;
589 
590 	BT_DBG("%s %p", hdev->name, hdev);
591 
592 	hci_req_sync_lock(hdev);
593 
594 	/* Drop queues */
595 	skb_queue_purge(&hdev->rx_q);
596 	skb_queue_purge(&hdev->cmd_q);
597 
598 	/* Cancel these to avoid queueing non-chained pending work */
599 	hci_dev_set_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
600 	/* Wait for
601 	 *
602 	 *    if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
603 	 *        queue_delayed_work(&hdev->{cmd,ncmd}_timer)
604 	 *
605 	 * inside RCU section to see the flag or complete scheduling.
606 	 */
607 	synchronize_rcu();
608 	/* Explicitly cancel works in case scheduled after setting the flag. */
609 	cancel_delayed_work(&hdev->cmd_timer);
610 	cancel_delayed_work(&hdev->ncmd_timer);
611 
612 	/* Avoid potential lockdep warnings from the *_flush() calls by
613 	 * ensuring the workqueue is empty up front.
614 	 */
615 	drain_workqueue(hdev->workqueue);
616 
617 	hci_dev_lock(hdev);
618 	hci_inquiry_cache_flush(hdev);
619 	hci_conn_hash_flush(hdev);
620 	hci_dev_unlock(hdev);
621 
622 	if (hdev->flush)
623 		hdev->flush(hdev);
624 
625 	hci_dev_clear_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
626 
627 	atomic_set(&hdev->cmd_cnt, 1);
628 	hdev->acl_cnt = 0;
629 	hdev->sco_cnt = 0;
630 	hdev->le_cnt = 0;
631 	hdev->iso_cnt = 0;
632 
633 	ret = hci_reset_sync(hdev);
634 
635 	hci_req_sync_unlock(hdev);
636 	return ret;
637 }
638 
639 int hci_dev_reset(__u16 dev)
640 {
641 	struct hci_dev *hdev;
642 	int err;
643 
644 	hdev = hci_dev_get(dev);
645 	if (!hdev)
646 		return -ENODEV;
647 
648 	if (!test_bit(HCI_UP, &hdev->flags)) {
649 		err = -ENETDOWN;
650 		goto done;
651 	}
652 
653 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
654 		err = -EBUSY;
655 		goto done;
656 	}
657 
658 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
659 		err = -EOPNOTSUPP;
660 		goto done;
661 	}
662 
663 	err = hci_dev_do_reset(hdev);
664 
665 done:
666 	hci_dev_put(hdev);
667 	return err;
668 }
669 
670 int hci_dev_reset_stat(__u16 dev)
671 {
672 	struct hci_dev *hdev;
673 	int ret = 0;
674 
675 	hdev = hci_dev_get(dev);
676 	if (!hdev)
677 		return -ENODEV;
678 
679 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
680 		ret = -EBUSY;
681 		goto done;
682 	}
683 
684 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
685 		ret = -EOPNOTSUPP;
686 		goto done;
687 	}
688 
689 	memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
690 
691 done:
692 	hci_dev_put(hdev);
693 	return ret;
694 }
695 
696 static void hci_update_passive_scan_state(struct hci_dev *hdev, u8 scan)
697 {
698 	bool conn_changed, discov_changed;
699 
700 	BT_DBG("%s scan 0x%02x", hdev->name, scan);
701 
702 	if ((scan & SCAN_PAGE))
703 		conn_changed = !hci_dev_test_and_set_flag(hdev,
704 							  HCI_CONNECTABLE);
705 	else
706 		conn_changed = hci_dev_test_and_clear_flag(hdev,
707 							   HCI_CONNECTABLE);
708 
709 	if ((scan & SCAN_INQUIRY)) {
710 		discov_changed = !hci_dev_test_and_set_flag(hdev,
711 							    HCI_DISCOVERABLE);
712 	} else {
713 		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
714 		discov_changed = hci_dev_test_and_clear_flag(hdev,
715 							     HCI_DISCOVERABLE);
716 	}
717 
718 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
719 		return;
720 
721 	if (conn_changed || discov_changed) {
722 		/* In case this was disabled through mgmt */
723 		hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
724 
725 		if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
726 			hci_update_adv_data(hdev, hdev->cur_adv_instance);
727 
728 		mgmt_new_settings(hdev);
729 	}
730 }
731 
732 int hci_dev_cmd(unsigned int cmd, void __user *arg)
733 {
734 	struct hci_dev *hdev;
735 	struct hci_dev_req dr;
736 	int err = 0;
737 
738 	if (copy_from_user(&dr, arg, sizeof(dr)))
739 		return -EFAULT;
740 
741 	hdev = hci_dev_get(dr.dev_id);
742 	if (!hdev)
743 		return -ENODEV;
744 
745 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
746 		err = -EBUSY;
747 		goto done;
748 	}
749 
750 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
751 		err = -EOPNOTSUPP;
752 		goto done;
753 	}
754 
755 	if (hdev->dev_type != HCI_PRIMARY) {
756 		err = -EOPNOTSUPP;
757 		goto done;
758 	}
759 
760 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
761 		err = -EOPNOTSUPP;
762 		goto done;
763 	}
764 
765 	switch (cmd) {
766 	case HCISETAUTH:
767 		err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
768 				   HCI_INIT_TIMEOUT, NULL);
769 		break;
770 
771 	case HCISETENCRYPT:
772 		if (!lmp_encrypt_capable(hdev)) {
773 			err = -EOPNOTSUPP;
774 			break;
775 		}
776 
777 		if (!test_bit(HCI_AUTH, &hdev->flags)) {
778 			/* Auth must be enabled first */
779 			err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
780 					   HCI_INIT_TIMEOUT, NULL);
781 			if (err)
782 				break;
783 		}
784 
785 		err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
786 				   HCI_INIT_TIMEOUT, NULL);
787 		break;
788 
789 	case HCISETSCAN:
790 		err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
791 				   HCI_INIT_TIMEOUT, NULL);
792 
793 		/* Ensure that the connectable and discoverable states
794 		 * get correctly modified as this was a non-mgmt change.
795 		 */
796 		if (!err)
797 			hci_update_passive_scan_state(hdev, dr.dev_opt);
798 		break;
799 
800 	case HCISETLINKPOL:
801 		err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
802 				   HCI_INIT_TIMEOUT, NULL);
803 		break;
804 
805 	case HCISETLINKMODE:
806 		hdev->link_mode = ((__u16) dr.dev_opt) &
807 					(HCI_LM_MASTER | HCI_LM_ACCEPT);
808 		break;
809 
810 	case HCISETPTYPE:
811 		if (hdev->pkt_type == (__u16) dr.dev_opt)
812 			break;
813 
814 		hdev->pkt_type = (__u16) dr.dev_opt;
815 		mgmt_phy_configuration_changed(hdev, NULL);
816 		break;
817 
818 	case HCISETACLMTU:
819 		hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
820 		hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
821 		break;
822 
823 	case HCISETSCOMTU:
824 		hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
825 		hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
826 		break;
827 
828 	default:
829 		err = -EINVAL;
830 		break;
831 	}
832 
833 done:
834 	hci_dev_put(hdev);
835 	return err;
836 }
837 
838 int hci_get_dev_list(void __user *arg)
839 {
840 	struct hci_dev *hdev;
841 	struct hci_dev_list_req *dl;
842 	struct hci_dev_req *dr;
843 	int n = 0, size, err;
844 	__u16 dev_num;
845 
846 	if (get_user(dev_num, (__u16 __user *) arg))
847 		return -EFAULT;
848 
849 	if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
850 		return -EINVAL;
851 
852 	size = sizeof(*dl) + dev_num * sizeof(*dr);
853 
854 	dl = kzalloc(size, GFP_KERNEL);
855 	if (!dl)
856 		return -ENOMEM;
857 
858 	dr = dl->dev_req;
859 
860 	read_lock(&hci_dev_list_lock);
861 	list_for_each_entry(hdev, &hci_dev_list, list) {
862 		unsigned long flags = hdev->flags;
863 
864 		/* When the auto-off is configured it means the transport
865 		 * is running, but in that case still indicate that the
866 		 * device is actually down.
867 		 */
868 		if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
869 			flags &= ~BIT(HCI_UP);
870 
871 		(dr + n)->dev_id  = hdev->id;
872 		(dr + n)->dev_opt = flags;
873 
874 		if (++n >= dev_num)
875 			break;
876 	}
877 	read_unlock(&hci_dev_list_lock);
878 
879 	dl->dev_num = n;
880 	size = sizeof(*dl) + n * sizeof(*dr);
881 
882 	err = copy_to_user(arg, dl, size);
883 	kfree(dl);
884 
885 	return err ? -EFAULT : 0;
886 }
887 
888 int hci_get_dev_info(void __user *arg)
889 {
890 	struct hci_dev *hdev;
891 	struct hci_dev_info di;
892 	unsigned long flags;
893 	int err = 0;
894 
895 	if (copy_from_user(&di, arg, sizeof(di)))
896 		return -EFAULT;
897 
898 	hdev = hci_dev_get(di.dev_id);
899 	if (!hdev)
900 		return -ENODEV;
901 
902 	/* When the auto-off is configured it means the transport
903 	 * is running, but in that case still indicate that the
904 	 * device is actually down.
905 	 */
906 	if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
907 		flags = hdev->flags & ~BIT(HCI_UP);
908 	else
909 		flags = hdev->flags;
910 
911 	strcpy(di.name, hdev->name);
912 	di.bdaddr   = hdev->bdaddr;
913 	di.type     = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
914 	di.flags    = flags;
915 	di.pkt_type = hdev->pkt_type;
916 	if (lmp_bredr_capable(hdev)) {
917 		di.acl_mtu  = hdev->acl_mtu;
918 		di.acl_pkts = hdev->acl_pkts;
919 		di.sco_mtu  = hdev->sco_mtu;
920 		di.sco_pkts = hdev->sco_pkts;
921 	} else {
922 		di.acl_mtu  = hdev->le_mtu;
923 		di.acl_pkts = hdev->le_pkts;
924 		di.sco_mtu  = 0;
925 		di.sco_pkts = 0;
926 	}
927 	di.link_policy = hdev->link_policy;
928 	di.link_mode   = hdev->link_mode;
929 
930 	memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
931 	memcpy(&di.features, &hdev->features, sizeof(di.features));
932 
933 	if (copy_to_user(arg, &di, sizeof(di)))
934 		err = -EFAULT;
935 
936 	hci_dev_put(hdev);
937 
938 	return err;
939 }
940 
941 /* ---- Interface to HCI drivers ---- */
942 
943 static int hci_rfkill_set_block(void *data, bool blocked)
944 {
945 	struct hci_dev *hdev = data;
946 
947 	BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
948 
949 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
950 		return -EBUSY;
951 
952 	if (blocked) {
953 		hci_dev_set_flag(hdev, HCI_RFKILLED);
954 		if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
955 		    !hci_dev_test_flag(hdev, HCI_CONFIG))
956 			hci_dev_do_close(hdev);
957 	} else {
958 		hci_dev_clear_flag(hdev, HCI_RFKILLED);
959 	}
960 
961 	return 0;
962 }
963 
964 static const struct rfkill_ops hci_rfkill_ops = {
965 	.set_block = hci_rfkill_set_block,
966 };
967 
968 static void hci_power_on(struct work_struct *work)
969 {
970 	struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
971 	int err;
972 
973 	BT_DBG("%s", hdev->name);
974 
975 	if (test_bit(HCI_UP, &hdev->flags) &&
976 	    hci_dev_test_flag(hdev, HCI_MGMT) &&
977 	    hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
978 		cancel_delayed_work(&hdev->power_off);
979 		err = hci_powered_update_sync(hdev);
980 		mgmt_power_on(hdev, err);
981 		return;
982 	}
983 
984 	err = hci_dev_do_open(hdev);
985 	if (err < 0) {
986 		hci_dev_lock(hdev);
987 		mgmt_set_powered_failed(hdev, err);
988 		hci_dev_unlock(hdev);
989 		return;
990 	}
991 
992 	/* During the HCI setup phase, a few error conditions are
993 	 * ignored and they need to be checked now. If they are still
994 	 * valid, it is important to turn the device back off.
995 	 */
996 	if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
997 	    hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
998 	    (hdev->dev_type == HCI_PRIMARY &&
999 	     !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1000 	     !bacmp(&hdev->static_addr, BDADDR_ANY))) {
1001 		hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
1002 		hci_dev_do_close(hdev);
1003 	} else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
1004 		queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1005 				   HCI_AUTO_OFF_TIMEOUT);
1006 	}
1007 
1008 	if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
1009 		/* For unconfigured devices, set the HCI_RAW flag
1010 		 * so that userspace can easily identify them.
1011 		 */
1012 		if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1013 			set_bit(HCI_RAW, &hdev->flags);
1014 
1015 		/* For fully configured devices, this will send
1016 		 * the Index Added event. For unconfigured devices,
1017 		 * it will send Unconfigued Index Added event.
1018 		 *
1019 		 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
1020 		 * and no event will be send.
1021 		 */
1022 		mgmt_index_added(hdev);
1023 	} else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
1024 		/* When the controller is now configured, then it
1025 		 * is important to clear the HCI_RAW flag.
1026 		 */
1027 		if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1028 			clear_bit(HCI_RAW, &hdev->flags);
1029 
1030 		/* Powering on the controller with HCI_CONFIG set only
1031 		 * happens with the transition from unconfigured to
1032 		 * configured. This will send the Index Added event.
1033 		 */
1034 		mgmt_index_added(hdev);
1035 	}
1036 }
1037 
1038 static void hci_power_off(struct work_struct *work)
1039 {
1040 	struct hci_dev *hdev = container_of(work, struct hci_dev,
1041 					    power_off.work);
1042 
1043 	BT_DBG("%s", hdev->name);
1044 
1045 	hci_dev_do_close(hdev);
1046 }
1047 
1048 static void hci_error_reset(struct work_struct *work)
1049 {
1050 	struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
1051 
1052 	BT_DBG("%s", hdev->name);
1053 
1054 	if (hdev->hw_error)
1055 		hdev->hw_error(hdev, hdev->hw_error_code);
1056 	else
1057 		bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
1058 
1059 	if (hci_dev_do_close(hdev))
1060 		return;
1061 
1062 	hci_dev_do_open(hdev);
1063 }
1064 
1065 void hci_uuids_clear(struct hci_dev *hdev)
1066 {
1067 	struct bt_uuid *uuid, *tmp;
1068 
1069 	list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1070 		list_del(&uuid->list);
1071 		kfree(uuid);
1072 	}
1073 }
1074 
1075 void hci_link_keys_clear(struct hci_dev *hdev)
1076 {
1077 	struct link_key *key;
1078 
1079 	list_for_each_entry(key, &hdev->link_keys, list) {
1080 		list_del_rcu(&key->list);
1081 		kfree_rcu(key, rcu);
1082 	}
1083 }
1084 
1085 void hci_smp_ltks_clear(struct hci_dev *hdev)
1086 {
1087 	struct smp_ltk *k;
1088 
1089 	list_for_each_entry(k, &hdev->long_term_keys, list) {
1090 		list_del_rcu(&k->list);
1091 		kfree_rcu(k, rcu);
1092 	}
1093 }
1094 
1095 void hci_smp_irks_clear(struct hci_dev *hdev)
1096 {
1097 	struct smp_irk *k;
1098 
1099 	list_for_each_entry(k, &hdev->identity_resolving_keys, list) {
1100 		list_del_rcu(&k->list);
1101 		kfree_rcu(k, rcu);
1102 	}
1103 }
1104 
1105 void hci_blocked_keys_clear(struct hci_dev *hdev)
1106 {
1107 	struct blocked_key *b;
1108 
1109 	list_for_each_entry(b, &hdev->blocked_keys, list) {
1110 		list_del_rcu(&b->list);
1111 		kfree_rcu(b, rcu);
1112 	}
1113 }
1114 
1115 bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
1116 {
1117 	bool blocked = false;
1118 	struct blocked_key *b;
1119 
1120 	rcu_read_lock();
1121 	list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
1122 		if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
1123 			blocked = true;
1124 			break;
1125 		}
1126 	}
1127 
1128 	rcu_read_unlock();
1129 	return blocked;
1130 }
1131 
1132 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1133 {
1134 	struct link_key *k;
1135 
1136 	rcu_read_lock();
1137 	list_for_each_entry_rcu(k, &hdev->link_keys, list) {
1138 		if (bacmp(bdaddr, &k->bdaddr) == 0) {
1139 			rcu_read_unlock();
1140 
1141 			if (hci_is_blocked_key(hdev,
1142 					       HCI_BLOCKED_KEY_TYPE_LINKKEY,
1143 					       k->val)) {
1144 				bt_dev_warn_ratelimited(hdev,
1145 							"Link key blocked for %pMR",
1146 							&k->bdaddr);
1147 				return NULL;
1148 			}
1149 
1150 			return k;
1151 		}
1152 	}
1153 	rcu_read_unlock();
1154 
1155 	return NULL;
1156 }
1157 
1158 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1159 			       u8 key_type, u8 old_key_type)
1160 {
1161 	/* Legacy key */
1162 	if (key_type < 0x03)
1163 		return true;
1164 
1165 	/* Debug keys are insecure so don't store them persistently */
1166 	if (key_type == HCI_LK_DEBUG_COMBINATION)
1167 		return false;
1168 
1169 	/* Changed combination key and there's no previous one */
1170 	if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1171 		return false;
1172 
1173 	/* Security mode 3 case */
1174 	if (!conn)
1175 		return true;
1176 
1177 	/* BR/EDR key derived using SC from an LE link */
1178 	if (conn->type == LE_LINK)
1179 		return true;
1180 
1181 	/* Neither local nor remote side had no-bonding as requirement */
1182 	if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1183 		return true;
1184 
1185 	/* Local side had dedicated bonding as requirement */
1186 	if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1187 		return true;
1188 
1189 	/* Remote side had dedicated bonding as requirement */
1190 	if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1191 		return true;
1192 
1193 	/* If none of the above criteria match, then don't store the key
1194 	 * persistently */
1195 	return false;
1196 }
1197 
1198 static u8 ltk_role(u8 type)
1199 {
1200 	if (type == SMP_LTK)
1201 		return HCI_ROLE_MASTER;
1202 
1203 	return HCI_ROLE_SLAVE;
1204 }
1205 
1206 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1207 			     u8 addr_type, u8 role)
1208 {
1209 	struct smp_ltk *k;
1210 
1211 	rcu_read_lock();
1212 	list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
1213 		if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
1214 			continue;
1215 
1216 		if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
1217 			rcu_read_unlock();
1218 
1219 			if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
1220 					       k->val)) {
1221 				bt_dev_warn_ratelimited(hdev,
1222 							"LTK blocked for %pMR",
1223 							&k->bdaddr);
1224 				return NULL;
1225 			}
1226 
1227 			return k;
1228 		}
1229 	}
1230 	rcu_read_unlock();
1231 
1232 	return NULL;
1233 }
1234 
1235 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
1236 {
1237 	struct smp_irk *irk_to_return = NULL;
1238 	struct smp_irk *irk;
1239 
1240 	rcu_read_lock();
1241 	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
1242 		if (!bacmp(&irk->rpa, rpa)) {
1243 			irk_to_return = irk;
1244 			goto done;
1245 		}
1246 	}
1247 
1248 	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
1249 		if (smp_irk_matches(hdev, irk->val, rpa)) {
1250 			bacpy(&irk->rpa, rpa);
1251 			irk_to_return = irk;
1252 			goto done;
1253 		}
1254 	}
1255 
1256 done:
1257 	if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1258 						irk_to_return->val)) {
1259 		bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1260 					&irk_to_return->bdaddr);
1261 		irk_to_return = NULL;
1262 	}
1263 
1264 	rcu_read_unlock();
1265 
1266 	return irk_to_return;
1267 }
1268 
1269 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1270 				     u8 addr_type)
1271 {
1272 	struct smp_irk *irk_to_return = NULL;
1273 	struct smp_irk *irk;
1274 
1275 	/* Identity Address must be public or static random */
1276 	if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
1277 		return NULL;
1278 
1279 	rcu_read_lock();
1280 	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
1281 		if (addr_type == irk->addr_type &&
1282 		    bacmp(bdaddr, &irk->bdaddr) == 0) {
1283 			irk_to_return = irk;
1284 			goto done;
1285 		}
1286 	}
1287 
1288 done:
1289 
1290 	if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1291 						irk_to_return->val)) {
1292 		bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1293 					&irk_to_return->bdaddr);
1294 		irk_to_return = NULL;
1295 	}
1296 
1297 	rcu_read_unlock();
1298 
1299 	return irk_to_return;
1300 }
1301 
1302 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
1303 				  bdaddr_t *bdaddr, u8 *val, u8 type,
1304 				  u8 pin_len, bool *persistent)
1305 {
1306 	struct link_key *key, *old_key;
1307 	u8 old_key_type;
1308 
1309 	old_key = hci_find_link_key(hdev, bdaddr);
1310 	if (old_key) {
1311 		old_key_type = old_key->type;
1312 		key = old_key;
1313 	} else {
1314 		old_key_type = conn ? conn->key_type : 0xff;
1315 		key = kzalloc(sizeof(*key), GFP_KERNEL);
1316 		if (!key)
1317 			return NULL;
1318 		list_add_rcu(&key->list, &hdev->link_keys);
1319 	}
1320 
1321 	BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
1322 
1323 	/* Some buggy controller combinations generate a changed
1324 	 * combination key for legacy pairing even when there's no
1325 	 * previous key */
1326 	if (type == HCI_LK_CHANGED_COMBINATION &&
1327 	    (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
1328 		type = HCI_LK_COMBINATION;
1329 		if (conn)
1330 			conn->key_type = type;
1331 	}
1332 
1333 	bacpy(&key->bdaddr, bdaddr);
1334 	memcpy(key->val, val, HCI_LINK_KEY_SIZE);
1335 	key->pin_len = pin_len;
1336 
1337 	if (type == HCI_LK_CHANGED_COMBINATION)
1338 		key->type = old_key_type;
1339 	else
1340 		key->type = type;
1341 
1342 	if (persistent)
1343 		*persistent = hci_persistent_key(hdev, conn, type,
1344 						 old_key_type);
1345 
1346 	return key;
1347 }
1348 
1349 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1350 			    u8 addr_type, u8 type, u8 authenticated,
1351 			    u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
1352 {
1353 	struct smp_ltk *key, *old_key;
1354 	u8 role = ltk_role(type);
1355 
1356 	old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
1357 	if (old_key)
1358 		key = old_key;
1359 	else {
1360 		key = kzalloc(sizeof(*key), GFP_KERNEL);
1361 		if (!key)
1362 			return NULL;
1363 		list_add_rcu(&key->list, &hdev->long_term_keys);
1364 	}
1365 
1366 	bacpy(&key->bdaddr, bdaddr);
1367 	key->bdaddr_type = addr_type;
1368 	memcpy(key->val, tk, sizeof(key->val));
1369 	key->authenticated = authenticated;
1370 	key->ediv = ediv;
1371 	key->rand = rand;
1372 	key->enc_size = enc_size;
1373 	key->type = type;
1374 
1375 	return key;
1376 }
1377 
1378 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1379 			    u8 addr_type, u8 val[16], bdaddr_t *rpa)
1380 {
1381 	struct smp_irk *irk;
1382 
1383 	irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
1384 	if (!irk) {
1385 		irk = kzalloc(sizeof(*irk), GFP_KERNEL);
1386 		if (!irk)
1387 			return NULL;
1388 
1389 		bacpy(&irk->bdaddr, bdaddr);
1390 		irk->addr_type = addr_type;
1391 
1392 		list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
1393 	}
1394 
1395 	memcpy(irk->val, val, 16);
1396 	bacpy(&irk->rpa, rpa);
1397 
1398 	return irk;
1399 }
1400 
1401 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1402 {
1403 	struct link_key *key;
1404 
1405 	key = hci_find_link_key(hdev, bdaddr);
1406 	if (!key)
1407 		return -ENOENT;
1408 
1409 	BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1410 
1411 	list_del_rcu(&key->list);
1412 	kfree_rcu(key, rcu);
1413 
1414 	return 0;
1415 }
1416 
1417 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
1418 {
1419 	struct smp_ltk *k, *tmp;
1420 	int removed = 0;
1421 
1422 	list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1423 		if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
1424 			continue;
1425 
1426 		BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1427 
1428 		list_del_rcu(&k->list);
1429 		kfree_rcu(k, rcu);
1430 		removed++;
1431 	}
1432 
1433 	return removed ? 0 : -ENOENT;
1434 }
1435 
1436 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
1437 {
1438 	struct smp_irk *k, *tmp;
1439 
1440 	list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
1441 		if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
1442 			continue;
1443 
1444 		BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1445 
1446 		list_del_rcu(&k->list);
1447 		kfree_rcu(k, rcu);
1448 	}
1449 }
1450 
1451 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1452 {
1453 	struct smp_ltk *k;
1454 	struct smp_irk *irk;
1455 	u8 addr_type;
1456 
1457 	if (type == BDADDR_BREDR) {
1458 		if (hci_find_link_key(hdev, bdaddr))
1459 			return true;
1460 		return false;
1461 	}
1462 
1463 	/* Convert to HCI addr type which struct smp_ltk uses */
1464 	if (type == BDADDR_LE_PUBLIC)
1465 		addr_type = ADDR_LE_DEV_PUBLIC;
1466 	else
1467 		addr_type = ADDR_LE_DEV_RANDOM;
1468 
1469 	irk = hci_get_irk(hdev, bdaddr, addr_type);
1470 	if (irk) {
1471 		bdaddr = &irk->bdaddr;
1472 		addr_type = irk->addr_type;
1473 	}
1474 
1475 	rcu_read_lock();
1476 	list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
1477 		if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
1478 			rcu_read_unlock();
1479 			return true;
1480 		}
1481 	}
1482 	rcu_read_unlock();
1483 
1484 	return false;
1485 }
1486 
1487 /* HCI command timer function */
1488 static void hci_cmd_timeout(struct work_struct *work)
1489 {
1490 	struct hci_dev *hdev = container_of(work, struct hci_dev,
1491 					    cmd_timer.work);
1492 
1493 	if (hdev->sent_cmd) {
1494 		struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1495 		u16 opcode = __le16_to_cpu(sent->opcode);
1496 
1497 		bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
1498 	} else {
1499 		bt_dev_err(hdev, "command tx timeout");
1500 	}
1501 
1502 	if (hdev->cmd_timeout)
1503 		hdev->cmd_timeout(hdev);
1504 
1505 	atomic_set(&hdev->cmd_cnt, 1);
1506 	queue_work(hdev->workqueue, &hdev->cmd_work);
1507 }
1508 
1509 /* HCI ncmd timer function */
1510 static void hci_ncmd_timeout(struct work_struct *work)
1511 {
1512 	struct hci_dev *hdev = container_of(work, struct hci_dev,
1513 					    ncmd_timer.work);
1514 
1515 	bt_dev_err(hdev, "Controller not accepting commands anymore: ncmd = 0");
1516 
1517 	/* During HCI_INIT phase no events can be injected if the ncmd timer
1518 	 * triggers since the procedure has its own timeout handling.
1519 	 */
1520 	if (test_bit(HCI_INIT, &hdev->flags))
1521 		return;
1522 
1523 	/* This is an irrecoverable state, inject hardware error event */
1524 	hci_reset_dev(hdev);
1525 }
1526 
1527 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1528 					  bdaddr_t *bdaddr, u8 bdaddr_type)
1529 {
1530 	struct oob_data *data;
1531 
1532 	list_for_each_entry(data, &hdev->remote_oob_data, list) {
1533 		if (bacmp(bdaddr, &data->bdaddr) != 0)
1534 			continue;
1535 		if (data->bdaddr_type != bdaddr_type)
1536 			continue;
1537 		return data;
1538 	}
1539 
1540 	return NULL;
1541 }
1542 
1543 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
1544 			       u8 bdaddr_type)
1545 {
1546 	struct oob_data *data;
1547 
1548 	data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
1549 	if (!data)
1550 		return -ENOENT;
1551 
1552 	BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
1553 
1554 	list_del(&data->list);
1555 	kfree(data);
1556 
1557 	return 0;
1558 }
1559 
1560 void hci_remote_oob_data_clear(struct hci_dev *hdev)
1561 {
1562 	struct oob_data *data, *n;
1563 
1564 	list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1565 		list_del(&data->list);
1566 		kfree(data);
1567 	}
1568 }
1569 
1570 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
1571 			    u8 bdaddr_type, u8 *hash192, u8 *rand192,
1572 			    u8 *hash256, u8 *rand256)
1573 {
1574 	struct oob_data *data;
1575 
1576 	data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
1577 	if (!data) {
1578 		data = kmalloc(sizeof(*data), GFP_KERNEL);
1579 		if (!data)
1580 			return -ENOMEM;
1581 
1582 		bacpy(&data->bdaddr, bdaddr);
1583 		data->bdaddr_type = bdaddr_type;
1584 		list_add(&data->list, &hdev->remote_oob_data);
1585 	}
1586 
1587 	if (hash192 && rand192) {
1588 		memcpy(data->hash192, hash192, sizeof(data->hash192));
1589 		memcpy(data->rand192, rand192, sizeof(data->rand192));
1590 		if (hash256 && rand256)
1591 			data->present = 0x03;
1592 	} else {
1593 		memset(data->hash192, 0, sizeof(data->hash192));
1594 		memset(data->rand192, 0, sizeof(data->rand192));
1595 		if (hash256 && rand256)
1596 			data->present = 0x02;
1597 		else
1598 			data->present = 0x00;
1599 	}
1600 
1601 	if (hash256 && rand256) {
1602 		memcpy(data->hash256, hash256, sizeof(data->hash256));
1603 		memcpy(data->rand256, rand256, sizeof(data->rand256));
1604 	} else {
1605 		memset(data->hash256, 0, sizeof(data->hash256));
1606 		memset(data->rand256, 0, sizeof(data->rand256));
1607 		if (hash192 && rand192)
1608 			data->present = 0x01;
1609 	}
1610 
1611 	BT_DBG("%s for %pMR", hdev->name, bdaddr);
1612 
1613 	return 0;
1614 }
1615 
1616 /* This function requires the caller holds hdev->lock */
1617 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
1618 {
1619 	struct adv_info *adv_instance;
1620 
1621 	list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
1622 		if (adv_instance->instance == instance)
1623 			return adv_instance;
1624 	}
1625 
1626 	return NULL;
1627 }
1628 
1629 /* This function requires the caller holds hdev->lock */
1630 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
1631 {
1632 	struct adv_info *cur_instance;
1633 
1634 	cur_instance = hci_find_adv_instance(hdev, instance);
1635 	if (!cur_instance)
1636 		return NULL;
1637 
1638 	if (cur_instance == list_last_entry(&hdev->adv_instances,
1639 					    struct adv_info, list))
1640 		return list_first_entry(&hdev->adv_instances,
1641 						 struct adv_info, list);
1642 	else
1643 		return list_next_entry(cur_instance, list);
1644 }
1645 
1646 /* This function requires the caller holds hdev->lock */
1647 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
1648 {
1649 	struct adv_info *adv_instance;
1650 
1651 	adv_instance = hci_find_adv_instance(hdev, instance);
1652 	if (!adv_instance)
1653 		return -ENOENT;
1654 
1655 	BT_DBG("%s removing %dMR", hdev->name, instance);
1656 
1657 	if (hdev->cur_adv_instance == instance) {
1658 		if (hdev->adv_instance_timeout) {
1659 			cancel_delayed_work(&hdev->adv_instance_expire);
1660 			hdev->adv_instance_timeout = 0;
1661 		}
1662 		hdev->cur_adv_instance = 0x00;
1663 	}
1664 
1665 	cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1666 
1667 	list_del(&adv_instance->list);
1668 	kfree(adv_instance);
1669 
1670 	hdev->adv_instance_cnt--;
1671 
1672 	return 0;
1673 }
1674 
1675 void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
1676 {
1677 	struct adv_info *adv_instance, *n;
1678 
1679 	list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
1680 		adv_instance->rpa_expired = rpa_expired;
1681 }
1682 
1683 /* This function requires the caller holds hdev->lock */
1684 void hci_adv_instances_clear(struct hci_dev *hdev)
1685 {
1686 	struct adv_info *adv_instance, *n;
1687 
1688 	if (hdev->adv_instance_timeout) {
1689 		cancel_delayed_work(&hdev->adv_instance_expire);
1690 		hdev->adv_instance_timeout = 0;
1691 	}
1692 
1693 	list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
1694 		cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1695 		list_del(&adv_instance->list);
1696 		kfree(adv_instance);
1697 	}
1698 
1699 	hdev->adv_instance_cnt = 0;
1700 	hdev->cur_adv_instance = 0x00;
1701 }
1702 
1703 static void adv_instance_rpa_expired(struct work_struct *work)
1704 {
1705 	struct adv_info *adv_instance = container_of(work, struct adv_info,
1706 						     rpa_expired_cb.work);
1707 
1708 	BT_DBG("");
1709 
1710 	adv_instance->rpa_expired = true;
1711 }
1712 
1713 /* This function requires the caller holds hdev->lock */
1714 struct adv_info *hci_add_adv_instance(struct hci_dev *hdev, u8 instance,
1715 				      u32 flags, u16 adv_data_len, u8 *adv_data,
1716 				      u16 scan_rsp_len, u8 *scan_rsp_data,
1717 				      u16 timeout, u16 duration, s8 tx_power,
1718 				      u32 min_interval, u32 max_interval,
1719 				      u8 mesh_handle)
1720 {
1721 	struct adv_info *adv;
1722 
1723 	adv = hci_find_adv_instance(hdev, instance);
1724 	if (adv) {
1725 		memset(adv->adv_data, 0, sizeof(adv->adv_data));
1726 		memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1727 		memset(adv->per_adv_data, 0, sizeof(adv->per_adv_data));
1728 	} else {
1729 		if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
1730 		    instance < 1 || instance > hdev->le_num_of_adv_sets + 1)
1731 			return ERR_PTR(-EOVERFLOW);
1732 
1733 		adv = kzalloc(sizeof(*adv), GFP_KERNEL);
1734 		if (!adv)
1735 			return ERR_PTR(-ENOMEM);
1736 
1737 		adv->pending = true;
1738 		adv->instance = instance;
1739 		list_add(&adv->list, &hdev->adv_instances);
1740 		hdev->adv_instance_cnt++;
1741 	}
1742 
1743 	adv->flags = flags;
1744 	adv->min_interval = min_interval;
1745 	adv->max_interval = max_interval;
1746 	adv->tx_power = tx_power;
1747 	/* Defining a mesh_handle changes the timing units to ms,
1748 	 * rather than seconds, and ties the instance to the requested
1749 	 * mesh_tx queue.
1750 	 */
1751 	adv->mesh = mesh_handle;
1752 
1753 	hci_set_adv_instance_data(hdev, instance, adv_data_len, adv_data,
1754 				  scan_rsp_len, scan_rsp_data);
1755 
1756 	adv->timeout = timeout;
1757 	adv->remaining_time = timeout;
1758 
1759 	if (duration == 0)
1760 		adv->duration = hdev->def_multi_adv_rotation_duration;
1761 	else
1762 		adv->duration = duration;
1763 
1764 	INIT_DELAYED_WORK(&adv->rpa_expired_cb, adv_instance_rpa_expired);
1765 
1766 	BT_DBG("%s for %dMR", hdev->name, instance);
1767 
1768 	return adv;
1769 }
1770 
1771 /* This function requires the caller holds hdev->lock */
1772 struct adv_info *hci_add_per_instance(struct hci_dev *hdev, u8 instance,
1773 				      u32 flags, u8 data_len, u8 *data,
1774 				      u32 min_interval, u32 max_interval)
1775 {
1776 	struct adv_info *adv;
1777 
1778 	adv = hci_add_adv_instance(hdev, instance, flags, 0, NULL, 0, NULL,
1779 				   0, 0, HCI_ADV_TX_POWER_NO_PREFERENCE,
1780 				   min_interval, max_interval, 0);
1781 	if (IS_ERR(adv))
1782 		return adv;
1783 
1784 	adv->periodic = true;
1785 	adv->per_adv_data_len = data_len;
1786 
1787 	if (data)
1788 		memcpy(adv->per_adv_data, data, data_len);
1789 
1790 	return adv;
1791 }
1792 
1793 /* This function requires the caller holds hdev->lock */
1794 int hci_set_adv_instance_data(struct hci_dev *hdev, u8 instance,
1795 			      u16 adv_data_len, u8 *adv_data,
1796 			      u16 scan_rsp_len, u8 *scan_rsp_data)
1797 {
1798 	struct adv_info *adv;
1799 
1800 	adv = hci_find_adv_instance(hdev, instance);
1801 
1802 	/* If advertisement doesn't exist, we can't modify its data */
1803 	if (!adv)
1804 		return -ENOENT;
1805 
1806 	if (adv_data_len && ADV_DATA_CMP(adv, adv_data, adv_data_len)) {
1807 		memset(adv->adv_data, 0, sizeof(adv->adv_data));
1808 		memcpy(adv->adv_data, adv_data, adv_data_len);
1809 		adv->adv_data_len = adv_data_len;
1810 		adv->adv_data_changed = true;
1811 	}
1812 
1813 	if (scan_rsp_len && SCAN_RSP_CMP(adv, scan_rsp_data, scan_rsp_len)) {
1814 		memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1815 		memcpy(adv->scan_rsp_data, scan_rsp_data, scan_rsp_len);
1816 		adv->scan_rsp_len = scan_rsp_len;
1817 		adv->scan_rsp_changed = true;
1818 	}
1819 
1820 	/* Mark as changed if there are flags which would affect it */
1821 	if (((adv->flags & MGMT_ADV_FLAG_APPEARANCE) && hdev->appearance) ||
1822 	    adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1823 		adv->scan_rsp_changed = true;
1824 
1825 	return 0;
1826 }
1827 
1828 /* This function requires the caller holds hdev->lock */
1829 u32 hci_adv_instance_flags(struct hci_dev *hdev, u8 instance)
1830 {
1831 	u32 flags;
1832 	struct adv_info *adv;
1833 
1834 	if (instance == 0x00) {
1835 		/* Instance 0 always manages the "Tx Power" and "Flags"
1836 		 * fields
1837 		 */
1838 		flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
1839 
1840 		/* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
1841 		 * corresponds to the "connectable" instance flag.
1842 		 */
1843 		if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
1844 			flags |= MGMT_ADV_FLAG_CONNECTABLE;
1845 
1846 		if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1847 			flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
1848 		else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1849 			flags |= MGMT_ADV_FLAG_DISCOV;
1850 
1851 		return flags;
1852 	}
1853 
1854 	adv = hci_find_adv_instance(hdev, instance);
1855 
1856 	/* Return 0 when we got an invalid instance identifier. */
1857 	if (!adv)
1858 		return 0;
1859 
1860 	return adv->flags;
1861 }
1862 
1863 bool hci_adv_instance_is_scannable(struct hci_dev *hdev, u8 instance)
1864 {
1865 	struct adv_info *adv;
1866 
1867 	/* Instance 0x00 always set local name */
1868 	if (instance == 0x00)
1869 		return true;
1870 
1871 	adv = hci_find_adv_instance(hdev, instance);
1872 	if (!adv)
1873 		return false;
1874 
1875 	if (adv->flags & MGMT_ADV_FLAG_APPEARANCE ||
1876 	    adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1877 		return true;
1878 
1879 	return adv->scan_rsp_len ? true : false;
1880 }
1881 
1882 /* This function requires the caller holds hdev->lock */
1883 void hci_adv_monitors_clear(struct hci_dev *hdev)
1884 {
1885 	struct adv_monitor *monitor;
1886 	int handle;
1887 
1888 	idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
1889 		hci_free_adv_monitor(hdev, monitor);
1890 
1891 	idr_destroy(&hdev->adv_monitors_idr);
1892 }
1893 
1894 /* Frees the monitor structure and do some bookkeepings.
1895  * This function requires the caller holds hdev->lock.
1896  */
1897 void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
1898 {
1899 	struct adv_pattern *pattern;
1900 	struct adv_pattern *tmp;
1901 
1902 	if (!monitor)
1903 		return;
1904 
1905 	list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list) {
1906 		list_del(&pattern->list);
1907 		kfree(pattern);
1908 	}
1909 
1910 	if (monitor->handle)
1911 		idr_remove(&hdev->adv_monitors_idr, monitor->handle);
1912 
1913 	if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) {
1914 		hdev->adv_monitors_cnt--;
1915 		mgmt_adv_monitor_removed(hdev, monitor->handle);
1916 	}
1917 
1918 	kfree(monitor);
1919 }
1920 
1921 /* Assigns handle to a monitor, and if offloading is supported and power is on,
1922  * also attempts to forward the request to the controller.
1923  * This function requires the caller holds hci_req_sync_lock.
1924  */
1925 int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
1926 {
1927 	int min, max, handle;
1928 	int status = 0;
1929 
1930 	if (!monitor)
1931 		return -EINVAL;
1932 
1933 	hci_dev_lock(hdev);
1934 
1935 	min = HCI_MIN_ADV_MONITOR_HANDLE;
1936 	max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES;
1937 	handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max,
1938 			   GFP_KERNEL);
1939 
1940 	hci_dev_unlock(hdev);
1941 
1942 	if (handle < 0)
1943 		return handle;
1944 
1945 	monitor->handle = handle;
1946 
1947 	if (!hdev_is_powered(hdev))
1948 		return status;
1949 
1950 	switch (hci_get_adv_monitor_offload_ext(hdev)) {
1951 	case HCI_ADV_MONITOR_EXT_NONE:
1952 		bt_dev_dbg(hdev, "%s add monitor %d status %d", hdev->name,
1953 			   monitor->handle, status);
1954 		/* Message was not forwarded to controller - not an error */
1955 		break;
1956 
1957 	case HCI_ADV_MONITOR_EXT_MSFT:
1958 		status = msft_add_monitor_pattern(hdev, monitor);
1959 		bt_dev_dbg(hdev, "%s add monitor %d msft status %d", hdev->name,
1960 			   monitor->handle, status);
1961 		break;
1962 	}
1963 
1964 	return status;
1965 }
1966 
1967 /* Attempts to tell the controller and free the monitor. If somehow the
1968  * controller doesn't have a corresponding handle, remove anyway.
1969  * This function requires the caller holds hci_req_sync_lock.
1970  */
1971 static int hci_remove_adv_monitor(struct hci_dev *hdev,
1972 				  struct adv_monitor *monitor)
1973 {
1974 	int status = 0;
1975 
1976 	switch (hci_get_adv_monitor_offload_ext(hdev)) {
1977 	case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */
1978 		bt_dev_dbg(hdev, "%s remove monitor %d status %d", hdev->name,
1979 			   monitor->handle, status);
1980 		goto free_monitor;
1981 
1982 	case HCI_ADV_MONITOR_EXT_MSFT:
1983 		status = msft_remove_monitor(hdev, monitor);
1984 		bt_dev_dbg(hdev, "%s remove monitor %d msft status %d",
1985 			   hdev->name, monitor->handle, status);
1986 		break;
1987 	}
1988 
1989 	/* In case no matching handle registered, just free the monitor */
1990 	if (status == -ENOENT)
1991 		goto free_monitor;
1992 
1993 	return status;
1994 
1995 free_monitor:
1996 	if (status == -ENOENT)
1997 		bt_dev_warn(hdev, "Removing monitor with no matching handle %d",
1998 			    monitor->handle);
1999 	hci_free_adv_monitor(hdev, monitor);
2000 
2001 	return status;
2002 }
2003 
2004 /* This function requires the caller holds hci_req_sync_lock */
2005 int hci_remove_single_adv_monitor(struct hci_dev *hdev, u16 handle)
2006 {
2007 	struct adv_monitor *monitor = idr_find(&hdev->adv_monitors_idr, handle);
2008 
2009 	if (!monitor)
2010 		return -EINVAL;
2011 
2012 	return hci_remove_adv_monitor(hdev, monitor);
2013 }
2014 
2015 /* This function requires the caller holds hci_req_sync_lock */
2016 int hci_remove_all_adv_monitor(struct hci_dev *hdev)
2017 {
2018 	struct adv_monitor *monitor;
2019 	int idr_next_id = 0;
2020 	int status = 0;
2021 
2022 	while (1) {
2023 		monitor = idr_get_next(&hdev->adv_monitors_idr, &idr_next_id);
2024 		if (!monitor)
2025 			break;
2026 
2027 		status = hci_remove_adv_monitor(hdev, monitor);
2028 		if (status)
2029 			return status;
2030 
2031 		idr_next_id++;
2032 	}
2033 
2034 	return status;
2035 }
2036 
2037 /* This function requires the caller holds hdev->lock */
2038 bool hci_is_adv_monitoring(struct hci_dev *hdev)
2039 {
2040 	return !idr_is_empty(&hdev->adv_monitors_idr);
2041 }
2042 
2043 int hci_get_adv_monitor_offload_ext(struct hci_dev *hdev)
2044 {
2045 	if (msft_monitor_supported(hdev))
2046 		return HCI_ADV_MONITOR_EXT_MSFT;
2047 
2048 	return HCI_ADV_MONITOR_EXT_NONE;
2049 }
2050 
2051 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2052 					 bdaddr_t *bdaddr, u8 type)
2053 {
2054 	struct bdaddr_list *b;
2055 
2056 	list_for_each_entry(b, bdaddr_list, list) {
2057 		if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2058 			return b;
2059 	}
2060 
2061 	return NULL;
2062 }
2063 
2064 struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
2065 				struct list_head *bdaddr_list, bdaddr_t *bdaddr,
2066 				u8 type)
2067 {
2068 	struct bdaddr_list_with_irk *b;
2069 
2070 	list_for_each_entry(b, bdaddr_list, list) {
2071 		if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2072 			return b;
2073 	}
2074 
2075 	return NULL;
2076 }
2077 
2078 struct bdaddr_list_with_flags *
2079 hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list,
2080 				  bdaddr_t *bdaddr, u8 type)
2081 {
2082 	struct bdaddr_list_with_flags *b;
2083 
2084 	list_for_each_entry(b, bdaddr_list, list) {
2085 		if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2086 			return b;
2087 	}
2088 
2089 	return NULL;
2090 }
2091 
2092 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2093 {
2094 	struct bdaddr_list *b, *n;
2095 
2096 	list_for_each_entry_safe(b, n, bdaddr_list, list) {
2097 		list_del(&b->list);
2098 		kfree(b);
2099 	}
2100 }
2101 
2102 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2103 {
2104 	struct bdaddr_list *entry;
2105 
2106 	if (!bacmp(bdaddr, BDADDR_ANY))
2107 		return -EBADF;
2108 
2109 	if (hci_bdaddr_list_lookup(list, bdaddr, type))
2110 		return -EEXIST;
2111 
2112 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2113 	if (!entry)
2114 		return -ENOMEM;
2115 
2116 	bacpy(&entry->bdaddr, bdaddr);
2117 	entry->bdaddr_type = type;
2118 
2119 	list_add(&entry->list, list);
2120 
2121 	return 0;
2122 }
2123 
2124 int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2125 					u8 type, u8 *peer_irk, u8 *local_irk)
2126 {
2127 	struct bdaddr_list_with_irk *entry;
2128 
2129 	if (!bacmp(bdaddr, BDADDR_ANY))
2130 		return -EBADF;
2131 
2132 	if (hci_bdaddr_list_lookup(list, bdaddr, type))
2133 		return -EEXIST;
2134 
2135 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2136 	if (!entry)
2137 		return -ENOMEM;
2138 
2139 	bacpy(&entry->bdaddr, bdaddr);
2140 	entry->bdaddr_type = type;
2141 
2142 	if (peer_irk)
2143 		memcpy(entry->peer_irk, peer_irk, 16);
2144 
2145 	if (local_irk)
2146 		memcpy(entry->local_irk, local_irk, 16);
2147 
2148 	list_add(&entry->list, list);
2149 
2150 	return 0;
2151 }
2152 
2153 int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2154 				   u8 type, u32 flags)
2155 {
2156 	struct bdaddr_list_with_flags *entry;
2157 
2158 	if (!bacmp(bdaddr, BDADDR_ANY))
2159 		return -EBADF;
2160 
2161 	if (hci_bdaddr_list_lookup(list, bdaddr, type))
2162 		return -EEXIST;
2163 
2164 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2165 	if (!entry)
2166 		return -ENOMEM;
2167 
2168 	bacpy(&entry->bdaddr, bdaddr);
2169 	entry->bdaddr_type = type;
2170 	entry->flags = flags;
2171 
2172 	list_add(&entry->list, list);
2173 
2174 	return 0;
2175 }
2176 
2177 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2178 {
2179 	struct bdaddr_list *entry;
2180 
2181 	if (!bacmp(bdaddr, BDADDR_ANY)) {
2182 		hci_bdaddr_list_clear(list);
2183 		return 0;
2184 	}
2185 
2186 	entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2187 	if (!entry)
2188 		return -ENOENT;
2189 
2190 	list_del(&entry->list);
2191 	kfree(entry);
2192 
2193 	return 0;
2194 }
2195 
2196 int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2197 							u8 type)
2198 {
2199 	struct bdaddr_list_with_irk *entry;
2200 
2201 	if (!bacmp(bdaddr, BDADDR_ANY)) {
2202 		hci_bdaddr_list_clear(list);
2203 		return 0;
2204 	}
2205 
2206 	entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
2207 	if (!entry)
2208 		return -ENOENT;
2209 
2210 	list_del(&entry->list);
2211 	kfree(entry);
2212 
2213 	return 0;
2214 }
2215 
2216 int hci_bdaddr_list_del_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2217 				   u8 type)
2218 {
2219 	struct bdaddr_list_with_flags *entry;
2220 
2221 	if (!bacmp(bdaddr, BDADDR_ANY)) {
2222 		hci_bdaddr_list_clear(list);
2223 		return 0;
2224 	}
2225 
2226 	entry = hci_bdaddr_list_lookup_with_flags(list, bdaddr, type);
2227 	if (!entry)
2228 		return -ENOENT;
2229 
2230 	list_del(&entry->list);
2231 	kfree(entry);
2232 
2233 	return 0;
2234 }
2235 
2236 /* This function requires the caller holds hdev->lock */
2237 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2238 					       bdaddr_t *addr, u8 addr_type)
2239 {
2240 	struct hci_conn_params *params;
2241 
2242 	list_for_each_entry(params, &hdev->le_conn_params, list) {
2243 		if (bacmp(&params->addr, addr) == 0 &&
2244 		    params->addr_type == addr_type) {
2245 			return params;
2246 		}
2247 	}
2248 
2249 	return NULL;
2250 }
2251 
2252 /* This function requires the caller holds hdev->lock or rcu_read_lock */
2253 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2254 						  bdaddr_t *addr, u8 addr_type)
2255 {
2256 	struct hci_conn_params *param;
2257 
2258 	rcu_read_lock();
2259 
2260 	list_for_each_entry_rcu(param, list, action) {
2261 		if (bacmp(&param->addr, addr) == 0 &&
2262 		    param->addr_type == addr_type) {
2263 			rcu_read_unlock();
2264 			return param;
2265 		}
2266 	}
2267 
2268 	rcu_read_unlock();
2269 
2270 	return NULL;
2271 }
2272 
2273 /* This function requires the caller holds hdev->lock */
2274 void hci_pend_le_list_del_init(struct hci_conn_params *param)
2275 {
2276 	if (list_empty(&param->action))
2277 		return;
2278 
2279 	list_del_rcu(&param->action);
2280 	synchronize_rcu();
2281 	INIT_LIST_HEAD(&param->action);
2282 }
2283 
2284 /* This function requires the caller holds hdev->lock */
2285 void hci_pend_le_list_add(struct hci_conn_params *param,
2286 			  struct list_head *list)
2287 {
2288 	list_add_rcu(&param->action, list);
2289 }
2290 
2291 /* This function requires the caller holds hdev->lock */
2292 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2293 					    bdaddr_t *addr, u8 addr_type)
2294 {
2295 	struct hci_conn_params *params;
2296 
2297 	params = hci_conn_params_lookup(hdev, addr, addr_type);
2298 	if (params)
2299 		return params;
2300 
2301 	params = kzalloc(sizeof(*params), GFP_KERNEL);
2302 	if (!params) {
2303 		bt_dev_err(hdev, "out of memory");
2304 		return NULL;
2305 	}
2306 
2307 	bacpy(&params->addr, addr);
2308 	params->addr_type = addr_type;
2309 
2310 	list_add(&params->list, &hdev->le_conn_params);
2311 	INIT_LIST_HEAD(&params->action);
2312 
2313 	params->conn_min_interval = hdev->le_conn_min_interval;
2314 	params->conn_max_interval = hdev->le_conn_max_interval;
2315 	params->conn_latency = hdev->le_conn_latency;
2316 	params->supervision_timeout = hdev->le_supv_timeout;
2317 	params->auto_connect = HCI_AUTO_CONN_DISABLED;
2318 
2319 	BT_DBG("addr %pMR (type %u)", addr, addr_type);
2320 
2321 	return params;
2322 }
2323 
2324 void hci_conn_params_free(struct hci_conn_params *params)
2325 {
2326 	hci_pend_le_list_del_init(params);
2327 
2328 	if (params->conn) {
2329 		hci_conn_drop(params->conn);
2330 		hci_conn_put(params->conn);
2331 	}
2332 
2333 	list_del(&params->list);
2334 	kfree(params);
2335 }
2336 
2337 /* This function requires the caller holds hdev->lock */
2338 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2339 {
2340 	struct hci_conn_params *params;
2341 
2342 	params = hci_conn_params_lookup(hdev, addr, addr_type);
2343 	if (!params)
2344 		return;
2345 
2346 	hci_conn_params_free(params);
2347 
2348 	hci_update_passive_scan(hdev);
2349 
2350 	BT_DBG("addr %pMR (type %u)", addr, addr_type);
2351 }
2352 
2353 /* This function requires the caller holds hdev->lock */
2354 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
2355 {
2356 	struct hci_conn_params *params, *tmp;
2357 
2358 	list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
2359 		if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2360 			continue;
2361 
2362 		/* If trying to establish one time connection to disabled
2363 		 * device, leave the params, but mark them as just once.
2364 		 */
2365 		if (params->explicit_connect) {
2366 			params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2367 			continue;
2368 		}
2369 
2370 		hci_conn_params_free(params);
2371 	}
2372 
2373 	BT_DBG("All LE disabled connection parameters were removed");
2374 }
2375 
2376 /* This function requires the caller holds hdev->lock */
2377 static void hci_conn_params_clear_all(struct hci_dev *hdev)
2378 {
2379 	struct hci_conn_params *params, *tmp;
2380 
2381 	list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2382 		hci_conn_params_free(params);
2383 
2384 	BT_DBG("All LE connection parameters were removed");
2385 }
2386 
2387 /* Copy the Identity Address of the controller.
2388  *
2389  * If the controller has a public BD_ADDR, then by default use that one.
2390  * If this is a LE only controller without a public address, default to
2391  * the static random address.
2392  *
2393  * For debugging purposes it is possible to force controllers with a
2394  * public address to use the static random address instead.
2395  *
2396  * In case BR/EDR has been disabled on a dual-mode controller and
2397  * userspace has configured a static address, then that address
2398  * becomes the identity address instead of the public BR/EDR address.
2399  */
2400 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2401 			       u8 *bdaddr_type)
2402 {
2403 	if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
2404 	    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
2405 	    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
2406 	     bacmp(&hdev->static_addr, BDADDR_ANY))) {
2407 		bacpy(bdaddr, &hdev->static_addr);
2408 		*bdaddr_type = ADDR_LE_DEV_RANDOM;
2409 	} else {
2410 		bacpy(bdaddr, &hdev->bdaddr);
2411 		*bdaddr_type = ADDR_LE_DEV_PUBLIC;
2412 	}
2413 }
2414 
2415 static void hci_clear_wake_reason(struct hci_dev *hdev)
2416 {
2417 	hci_dev_lock(hdev);
2418 
2419 	hdev->wake_reason = 0;
2420 	bacpy(&hdev->wake_addr, BDADDR_ANY);
2421 	hdev->wake_addr_type = 0;
2422 
2423 	hci_dev_unlock(hdev);
2424 }
2425 
2426 static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
2427 				void *data)
2428 {
2429 	struct hci_dev *hdev =
2430 		container_of(nb, struct hci_dev, suspend_notifier);
2431 	int ret = 0;
2432 
2433 	/* Userspace has full control of this device. Do nothing. */
2434 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2435 		return NOTIFY_DONE;
2436 
2437 	if (action == PM_SUSPEND_PREPARE)
2438 		ret = hci_suspend_dev(hdev);
2439 	else if (action == PM_POST_SUSPEND)
2440 		ret = hci_resume_dev(hdev);
2441 
2442 	if (ret)
2443 		bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
2444 			   action, ret);
2445 
2446 	return NOTIFY_DONE;
2447 }
2448 
2449 /* Alloc HCI device */
2450 struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
2451 {
2452 	struct hci_dev *hdev;
2453 	unsigned int alloc_size;
2454 
2455 	alloc_size = sizeof(*hdev);
2456 	if (sizeof_priv) {
2457 		/* Fixme: May need ALIGN-ment? */
2458 		alloc_size += sizeof_priv;
2459 	}
2460 
2461 	hdev = kzalloc(alloc_size, GFP_KERNEL);
2462 	if (!hdev)
2463 		return NULL;
2464 
2465 	hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2466 	hdev->esco_type = (ESCO_HV1);
2467 	hdev->link_mode = (HCI_LM_ACCEPT);
2468 	hdev->num_iac = 0x01;		/* One IAC support is mandatory */
2469 	hdev->io_capability = 0x03;	/* No Input No Output */
2470 	hdev->manufacturer = 0xffff;	/* Default to internal use */
2471 	hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2472 	hdev->adv_tx_power = HCI_TX_POWER_INVALID;
2473 	hdev->adv_instance_cnt = 0;
2474 	hdev->cur_adv_instance = 0x00;
2475 	hdev->adv_instance_timeout = 0;
2476 
2477 	hdev->advmon_allowlist_duration = 300;
2478 	hdev->advmon_no_filter_duration = 500;
2479 	hdev->enable_advmon_interleave_scan = 0x00;	/* Default to disable */
2480 
2481 	hdev->sniff_max_interval = 800;
2482 	hdev->sniff_min_interval = 80;
2483 
2484 	hdev->le_adv_channel_map = 0x07;
2485 	hdev->le_adv_min_interval = 0x0800;
2486 	hdev->le_adv_max_interval = 0x0800;
2487 	hdev->le_scan_interval = 0x0060;
2488 	hdev->le_scan_window = 0x0030;
2489 	hdev->le_scan_int_suspend = 0x0400;
2490 	hdev->le_scan_window_suspend = 0x0012;
2491 	hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT;
2492 	hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN;
2493 	hdev->le_scan_int_adv_monitor = 0x0060;
2494 	hdev->le_scan_window_adv_monitor = 0x0030;
2495 	hdev->le_scan_int_connect = 0x0060;
2496 	hdev->le_scan_window_connect = 0x0060;
2497 	hdev->le_conn_min_interval = 0x0018;
2498 	hdev->le_conn_max_interval = 0x0028;
2499 	hdev->le_conn_latency = 0x0000;
2500 	hdev->le_supv_timeout = 0x002a;
2501 	hdev->le_def_tx_len = 0x001b;
2502 	hdev->le_def_tx_time = 0x0148;
2503 	hdev->le_max_tx_len = 0x001b;
2504 	hdev->le_max_tx_time = 0x0148;
2505 	hdev->le_max_rx_len = 0x001b;
2506 	hdev->le_max_rx_time = 0x0148;
2507 	hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
2508 	hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
2509 	hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
2510 	hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
2511 	hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
2512 	hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
2513 	hdev->def_le_autoconnect_timeout = HCI_LE_AUTOCONN_TIMEOUT;
2514 	hdev->min_le_tx_power = HCI_TX_POWER_INVALID;
2515 	hdev->max_le_tx_power = HCI_TX_POWER_INVALID;
2516 
2517 	hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
2518 	hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
2519 	hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
2520 	hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
2521 	hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
2522 	hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
2523 
2524 	/* default 1.28 sec page scan */
2525 	hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;
2526 	hdev->def_page_scan_int = 0x0800;
2527 	hdev->def_page_scan_window = 0x0012;
2528 
2529 	mutex_init(&hdev->lock);
2530 	mutex_init(&hdev->req_lock);
2531 
2532 	INIT_LIST_HEAD(&hdev->mesh_pending);
2533 	INIT_LIST_HEAD(&hdev->mgmt_pending);
2534 	INIT_LIST_HEAD(&hdev->reject_list);
2535 	INIT_LIST_HEAD(&hdev->accept_list);
2536 	INIT_LIST_HEAD(&hdev->uuids);
2537 	INIT_LIST_HEAD(&hdev->link_keys);
2538 	INIT_LIST_HEAD(&hdev->long_term_keys);
2539 	INIT_LIST_HEAD(&hdev->identity_resolving_keys);
2540 	INIT_LIST_HEAD(&hdev->remote_oob_data);
2541 	INIT_LIST_HEAD(&hdev->le_accept_list);
2542 	INIT_LIST_HEAD(&hdev->le_resolv_list);
2543 	INIT_LIST_HEAD(&hdev->le_conn_params);
2544 	INIT_LIST_HEAD(&hdev->pend_le_conns);
2545 	INIT_LIST_HEAD(&hdev->pend_le_reports);
2546 	INIT_LIST_HEAD(&hdev->conn_hash.list);
2547 	INIT_LIST_HEAD(&hdev->adv_instances);
2548 	INIT_LIST_HEAD(&hdev->blocked_keys);
2549 	INIT_LIST_HEAD(&hdev->monitored_devices);
2550 
2551 	INIT_LIST_HEAD(&hdev->local_codecs);
2552 	INIT_WORK(&hdev->rx_work, hci_rx_work);
2553 	INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2554 	INIT_WORK(&hdev->tx_work, hci_tx_work);
2555 	INIT_WORK(&hdev->power_on, hci_power_on);
2556 	INIT_WORK(&hdev->error_reset, hci_error_reset);
2557 
2558 	hci_cmd_sync_init(hdev);
2559 
2560 	INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
2561 
2562 	skb_queue_head_init(&hdev->rx_q);
2563 	skb_queue_head_init(&hdev->cmd_q);
2564 	skb_queue_head_init(&hdev->raw_q);
2565 
2566 	init_waitqueue_head(&hdev->req_wait_q);
2567 
2568 	INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
2569 	INIT_DELAYED_WORK(&hdev->ncmd_timer, hci_ncmd_timeout);
2570 
2571 	hci_devcd_setup(hdev);
2572 	hci_request_setup(hdev);
2573 
2574 	hci_init_sysfs(hdev);
2575 	discovery_init(hdev);
2576 
2577 	return hdev;
2578 }
2579 EXPORT_SYMBOL(hci_alloc_dev_priv);
2580 
2581 /* Free HCI device */
2582 void hci_free_dev(struct hci_dev *hdev)
2583 {
2584 	/* will free via device release */
2585 	put_device(&hdev->dev);
2586 }
2587 EXPORT_SYMBOL(hci_free_dev);
2588 
2589 /* Register HCI device */
2590 int hci_register_dev(struct hci_dev *hdev)
2591 {
2592 	int id, error;
2593 
2594 	if (!hdev->open || !hdev->close || !hdev->send)
2595 		return -EINVAL;
2596 
2597 	/* Do not allow HCI_AMP devices to register at index 0,
2598 	 * so the index can be used as the AMP controller ID.
2599 	 */
2600 	switch (hdev->dev_type) {
2601 	case HCI_PRIMARY:
2602 		id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
2603 		break;
2604 	case HCI_AMP:
2605 		id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
2606 		break;
2607 	default:
2608 		return -EINVAL;
2609 	}
2610 
2611 	if (id < 0)
2612 		return id;
2613 
2614 	snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
2615 	hdev->id = id;
2616 
2617 	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2618 
2619 	hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
2620 	if (!hdev->workqueue) {
2621 		error = -ENOMEM;
2622 		goto err;
2623 	}
2624 
2625 	hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
2626 						      hdev->name);
2627 	if (!hdev->req_workqueue) {
2628 		destroy_workqueue(hdev->workqueue);
2629 		error = -ENOMEM;
2630 		goto err;
2631 	}
2632 
2633 	if (!IS_ERR_OR_NULL(bt_debugfs))
2634 		hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
2635 
2636 	dev_set_name(&hdev->dev, "%s", hdev->name);
2637 
2638 	error = device_add(&hdev->dev);
2639 	if (error < 0)
2640 		goto err_wqueue;
2641 
2642 	hci_leds_init(hdev);
2643 
2644 	hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
2645 				    RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2646 				    hdev);
2647 	if (hdev->rfkill) {
2648 		if (rfkill_register(hdev->rfkill) < 0) {
2649 			rfkill_destroy(hdev->rfkill);
2650 			hdev->rfkill = NULL;
2651 		}
2652 	}
2653 
2654 	if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
2655 		hci_dev_set_flag(hdev, HCI_RFKILLED);
2656 
2657 	hci_dev_set_flag(hdev, HCI_SETUP);
2658 	hci_dev_set_flag(hdev, HCI_AUTO_OFF);
2659 
2660 	if (hdev->dev_type == HCI_PRIMARY) {
2661 		/* Assume BR/EDR support until proven otherwise (such as
2662 		 * through reading supported features during init.
2663 		 */
2664 		hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
2665 	}
2666 
2667 	write_lock(&hci_dev_list_lock);
2668 	list_add(&hdev->list, &hci_dev_list);
2669 	write_unlock(&hci_dev_list_lock);
2670 
2671 	/* Devices that are marked for raw-only usage are unconfigured
2672 	 * and should not be included in normal operation.
2673 	 */
2674 	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
2675 		hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
2676 
2677 	/* Mark Remote Wakeup connection flag as supported if driver has wakeup
2678 	 * callback.
2679 	 */
2680 	if (hdev->wakeup)
2681 		hdev->conn_flags |= HCI_CONN_FLAG_REMOTE_WAKEUP;
2682 
2683 	hci_sock_dev_event(hdev, HCI_DEV_REG);
2684 	hci_dev_hold(hdev);
2685 
2686 	error = hci_register_suspend_notifier(hdev);
2687 	if (error)
2688 		BT_WARN("register suspend notifier failed error:%d\n", error);
2689 
2690 	queue_work(hdev->req_workqueue, &hdev->power_on);
2691 
2692 	idr_init(&hdev->adv_monitors_idr);
2693 	msft_register(hdev);
2694 
2695 	return id;
2696 
2697 err_wqueue:
2698 	debugfs_remove_recursive(hdev->debugfs);
2699 	destroy_workqueue(hdev->workqueue);
2700 	destroy_workqueue(hdev->req_workqueue);
2701 err:
2702 	ida_simple_remove(&hci_index_ida, hdev->id);
2703 
2704 	return error;
2705 }
2706 EXPORT_SYMBOL(hci_register_dev);
2707 
2708 /* Unregister HCI device */
2709 void hci_unregister_dev(struct hci_dev *hdev)
2710 {
2711 	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2712 
2713 	mutex_lock(&hdev->unregister_lock);
2714 	hci_dev_set_flag(hdev, HCI_UNREGISTER);
2715 	mutex_unlock(&hdev->unregister_lock);
2716 
2717 	write_lock(&hci_dev_list_lock);
2718 	list_del(&hdev->list);
2719 	write_unlock(&hci_dev_list_lock);
2720 
2721 	cancel_work_sync(&hdev->power_on);
2722 
2723 	hci_cmd_sync_clear(hdev);
2724 
2725 	hci_unregister_suspend_notifier(hdev);
2726 
2727 	msft_unregister(hdev);
2728 
2729 	hci_dev_do_close(hdev);
2730 
2731 	if (!test_bit(HCI_INIT, &hdev->flags) &&
2732 	    !hci_dev_test_flag(hdev, HCI_SETUP) &&
2733 	    !hci_dev_test_flag(hdev, HCI_CONFIG)) {
2734 		hci_dev_lock(hdev);
2735 		mgmt_index_removed(hdev);
2736 		hci_dev_unlock(hdev);
2737 	}
2738 
2739 	/* mgmt_index_removed should take care of emptying the
2740 	 * pending list */
2741 	BUG_ON(!list_empty(&hdev->mgmt_pending));
2742 
2743 	hci_sock_dev_event(hdev, HCI_DEV_UNREG);
2744 
2745 	if (hdev->rfkill) {
2746 		rfkill_unregister(hdev->rfkill);
2747 		rfkill_destroy(hdev->rfkill);
2748 	}
2749 
2750 	device_del(&hdev->dev);
2751 	/* Actual cleanup is deferred until hci_release_dev(). */
2752 	hci_dev_put(hdev);
2753 }
2754 EXPORT_SYMBOL(hci_unregister_dev);
2755 
2756 /* Release HCI device */
2757 void hci_release_dev(struct hci_dev *hdev)
2758 {
2759 	debugfs_remove_recursive(hdev->debugfs);
2760 	kfree_const(hdev->hw_info);
2761 	kfree_const(hdev->fw_info);
2762 
2763 	destroy_workqueue(hdev->workqueue);
2764 	destroy_workqueue(hdev->req_workqueue);
2765 
2766 	hci_dev_lock(hdev);
2767 	hci_bdaddr_list_clear(&hdev->reject_list);
2768 	hci_bdaddr_list_clear(&hdev->accept_list);
2769 	hci_uuids_clear(hdev);
2770 	hci_link_keys_clear(hdev);
2771 	hci_smp_ltks_clear(hdev);
2772 	hci_smp_irks_clear(hdev);
2773 	hci_remote_oob_data_clear(hdev);
2774 	hci_adv_instances_clear(hdev);
2775 	hci_adv_monitors_clear(hdev);
2776 	hci_bdaddr_list_clear(&hdev->le_accept_list);
2777 	hci_bdaddr_list_clear(&hdev->le_resolv_list);
2778 	hci_conn_params_clear_all(hdev);
2779 	hci_discovery_filter_clear(hdev);
2780 	hci_blocked_keys_clear(hdev);
2781 	hci_dev_unlock(hdev);
2782 
2783 	ida_simple_remove(&hci_index_ida, hdev->id);
2784 	kfree_skb(hdev->sent_cmd);
2785 	kfree_skb(hdev->recv_event);
2786 	kfree(hdev);
2787 }
2788 EXPORT_SYMBOL(hci_release_dev);
2789 
2790 int hci_register_suspend_notifier(struct hci_dev *hdev)
2791 {
2792 	int ret = 0;
2793 
2794 	if (!hdev->suspend_notifier.notifier_call &&
2795 	    !test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
2796 		hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
2797 		ret = register_pm_notifier(&hdev->suspend_notifier);
2798 	}
2799 
2800 	return ret;
2801 }
2802 
2803 int hci_unregister_suspend_notifier(struct hci_dev *hdev)
2804 {
2805 	int ret = 0;
2806 
2807 	if (hdev->suspend_notifier.notifier_call) {
2808 		ret = unregister_pm_notifier(&hdev->suspend_notifier);
2809 		if (!ret)
2810 			hdev->suspend_notifier.notifier_call = NULL;
2811 	}
2812 
2813 	return ret;
2814 }
2815 
2816 /* Suspend HCI device */
2817 int hci_suspend_dev(struct hci_dev *hdev)
2818 {
2819 	int ret;
2820 
2821 	bt_dev_dbg(hdev, "");
2822 
2823 	/* Suspend should only act on when powered. */
2824 	if (!hdev_is_powered(hdev) ||
2825 	    hci_dev_test_flag(hdev, HCI_UNREGISTER))
2826 		return 0;
2827 
2828 	/* If powering down don't attempt to suspend */
2829 	if (mgmt_powering_down(hdev))
2830 		return 0;
2831 
2832 	/* Cancel potentially blocking sync operation before suspend */
2833 	__hci_cmd_sync_cancel(hdev, -EHOSTDOWN);
2834 
2835 	hci_req_sync_lock(hdev);
2836 	ret = hci_suspend_sync(hdev);
2837 	hci_req_sync_unlock(hdev);
2838 
2839 	hci_clear_wake_reason(hdev);
2840 	mgmt_suspending(hdev, hdev->suspend_state);
2841 
2842 	hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
2843 	return ret;
2844 }
2845 EXPORT_SYMBOL(hci_suspend_dev);
2846 
2847 /* Resume HCI device */
2848 int hci_resume_dev(struct hci_dev *hdev)
2849 {
2850 	int ret;
2851 
2852 	bt_dev_dbg(hdev, "");
2853 
2854 	/* Resume should only act on when powered. */
2855 	if (!hdev_is_powered(hdev) ||
2856 	    hci_dev_test_flag(hdev, HCI_UNREGISTER))
2857 		return 0;
2858 
2859 	/* If powering down don't attempt to resume */
2860 	if (mgmt_powering_down(hdev))
2861 		return 0;
2862 
2863 	hci_req_sync_lock(hdev);
2864 	ret = hci_resume_sync(hdev);
2865 	hci_req_sync_unlock(hdev);
2866 
2867 	mgmt_resuming(hdev, hdev->wake_reason, &hdev->wake_addr,
2868 		      hdev->wake_addr_type);
2869 
2870 	hci_sock_dev_event(hdev, HCI_DEV_RESUME);
2871 	return ret;
2872 }
2873 EXPORT_SYMBOL(hci_resume_dev);
2874 
2875 /* Reset HCI device */
2876 int hci_reset_dev(struct hci_dev *hdev)
2877 {
2878 	static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
2879 	struct sk_buff *skb;
2880 
2881 	skb = bt_skb_alloc(3, GFP_ATOMIC);
2882 	if (!skb)
2883 		return -ENOMEM;
2884 
2885 	hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2886 	skb_put_data(skb, hw_err, 3);
2887 
2888 	bt_dev_err(hdev, "Injecting HCI hardware error event");
2889 
2890 	/* Send Hardware Error to upper stack */
2891 	return hci_recv_frame(hdev, skb);
2892 }
2893 EXPORT_SYMBOL(hci_reset_dev);
2894 
2895 /* Receive frame from HCI drivers */
2896 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
2897 {
2898 	if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
2899 		      && !test_bit(HCI_INIT, &hdev->flags))) {
2900 		kfree_skb(skb);
2901 		return -ENXIO;
2902 	}
2903 
2904 	switch (hci_skb_pkt_type(skb)) {
2905 	case HCI_EVENT_PKT:
2906 		break;
2907 	case HCI_ACLDATA_PKT:
2908 		/* Detect if ISO packet has been sent as ACL */
2909 		if (hci_conn_num(hdev, ISO_LINK)) {
2910 			__u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
2911 			__u8 type;
2912 
2913 			type = hci_conn_lookup_type(hdev, hci_handle(handle));
2914 			if (type == ISO_LINK)
2915 				hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
2916 		}
2917 		break;
2918 	case HCI_SCODATA_PKT:
2919 		break;
2920 	case HCI_ISODATA_PKT:
2921 		break;
2922 	default:
2923 		kfree_skb(skb);
2924 		return -EINVAL;
2925 	}
2926 
2927 	/* Incoming skb */
2928 	bt_cb(skb)->incoming = 1;
2929 
2930 	/* Time stamp */
2931 	__net_timestamp(skb);
2932 
2933 	skb_queue_tail(&hdev->rx_q, skb);
2934 	queue_work(hdev->workqueue, &hdev->rx_work);
2935 
2936 	return 0;
2937 }
2938 EXPORT_SYMBOL(hci_recv_frame);
2939 
2940 /* Receive diagnostic message from HCI drivers */
2941 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
2942 {
2943 	/* Mark as diagnostic packet */
2944 	hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
2945 
2946 	/* Time stamp */
2947 	__net_timestamp(skb);
2948 
2949 	skb_queue_tail(&hdev->rx_q, skb);
2950 	queue_work(hdev->workqueue, &hdev->rx_work);
2951 
2952 	return 0;
2953 }
2954 EXPORT_SYMBOL(hci_recv_diag);
2955 
2956 void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
2957 {
2958 	va_list vargs;
2959 
2960 	va_start(vargs, fmt);
2961 	kfree_const(hdev->hw_info);
2962 	hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2963 	va_end(vargs);
2964 }
2965 EXPORT_SYMBOL(hci_set_hw_info);
2966 
2967 void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
2968 {
2969 	va_list vargs;
2970 
2971 	va_start(vargs, fmt);
2972 	kfree_const(hdev->fw_info);
2973 	hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2974 	va_end(vargs);
2975 }
2976 EXPORT_SYMBOL(hci_set_fw_info);
2977 
2978 /* ---- Interface to upper protocols ---- */
2979 
2980 int hci_register_cb(struct hci_cb *cb)
2981 {
2982 	BT_DBG("%p name %s", cb, cb->name);
2983 
2984 	mutex_lock(&hci_cb_list_lock);
2985 	list_add_tail(&cb->list, &hci_cb_list);
2986 	mutex_unlock(&hci_cb_list_lock);
2987 
2988 	return 0;
2989 }
2990 EXPORT_SYMBOL(hci_register_cb);
2991 
2992 int hci_unregister_cb(struct hci_cb *cb)
2993 {
2994 	BT_DBG("%p name %s", cb, cb->name);
2995 
2996 	mutex_lock(&hci_cb_list_lock);
2997 	list_del(&cb->list);
2998 	mutex_unlock(&hci_cb_list_lock);
2999 
3000 	return 0;
3001 }
3002 EXPORT_SYMBOL(hci_unregister_cb);
3003 
3004 static int hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
3005 {
3006 	int err;
3007 
3008 	BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3009 	       skb->len);
3010 
3011 	/* Time stamp */
3012 	__net_timestamp(skb);
3013 
3014 	/* Send copy to monitor */
3015 	hci_send_to_monitor(hdev, skb);
3016 
3017 	if (atomic_read(&hdev->promisc)) {
3018 		/* Send copy to the sockets */
3019 		hci_send_to_sock(hdev, skb);
3020 	}
3021 
3022 	/* Get rid of skb owner, prior to sending to the driver. */
3023 	skb_orphan(skb);
3024 
3025 	if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3026 		kfree_skb(skb);
3027 		return -EINVAL;
3028 	}
3029 
3030 	err = hdev->send(hdev, skb);
3031 	if (err < 0) {
3032 		bt_dev_err(hdev, "sending frame failed (%d)", err);
3033 		kfree_skb(skb);
3034 		return err;
3035 	}
3036 
3037 	return 0;
3038 }
3039 
3040 /* Send HCI command */
3041 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3042 		 const void *param)
3043 {
3044 	struct sk_buff *skb;
3045 
3046 	BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3047 
3048 	skb = hci_prepare_cmd(hdev, opcode, plen, param);
3049 	if (!skb) {
3050 		bt_dev_err(hdev, "no memory for command");
3051 		return -ENOMEM;
3052 	}
3053 
3054 	/* Stand-alone HCI commands must be flagged as
3055 	 * single-command requests.
3056 	 */
3057 	bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
3058 
3059 	skb_queue_tail(&hdev->cmd_q, skb);
3060 	queue_work(hdev->workqueue, &hdev->cmd_work);
3061 
3062 	return 0;
3063 }
3064 
3065 int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
3066 		   const void *param)
3067 {
3068 	struct sk_buff *skb;
3069 
3070 	if (hci_opcode_ogf(opcode) != 0x3f) {
3071 		/* A controller receiving a command shall respond with either
3072 		 * a Command Status Event or a Command Complete Event.
3073 		 * Therefore, all standard HCI commands must be sent via the
3074 		 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
3075 		 * Some vendors do not comply with this rule for vendor-specific
3076 		 * commands and do not return any event. We want to support
3077 		 * unresponded commands for such cases only.
3078 		 */
3079 		bt_dev_err(hdev, "unresponded command not supported");
3080 		return -EINVAL;
3081 	}
3082 
3083 	skb = hci_prepare_cmd(hdev, opcode, plen, param);
3084 	if (!skb) {
3085 		bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
3086 			   opcode);
3087 		return -ENOMEM;
3088 	}
3089 
3090 	hci_send_frame(hdev, skb);
3091 
3092 	return 0;
3093 }
3094 EXPORT_SYMBOL(__hci_cmd_send);
3095 
3096 /* Get data from the previously sent command */
3097 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
3098 {
3099 	struct hci_command_hdr *hdr;
3100 
3101 	if (!hdev->sent_cmd)
3102 		return NULL;
3103 
3104 	hdr = (void *) hdev->sent_cmd->data;
3105 
3106 	if (hdr->opcode != cpu_to_le16(opcode))
3107 		return NULL;
3108 
3109 	BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3110 
3111 	return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3112 }
3113 
3114 /* Get data from last received event */
3115 void *hci_recv_event_data(struct hci_dev *hdev, __u8 event)
3116 {
3117 	struct hci_event_hdr *hdr;
3118 	int offset;
3119 
3120 	if (!hdev->recv_event)
3121 		return NULL;
3122 
3123 	hdr = (void *)hdev->recv_event->data;
3124 	offset = sizeof(*hdr);
3125 
3126 	if (hdr->evt != event) {
3127 		/* In case of LE metaevent check the subevent match */
3128 		if (hdr->evt == HCI_EV_LE_META) {
3129 			struct hci_ev_le_meta *ev;
3130 
3131 			ev = (void *)hdev->recv_event->data + offset;
3132 			offset += sizeof(*ev);
3133 			if (ev->subevent == event)
3134 				goto found;
3135 		}
3136 		return NULL;
3137 	}
3138 
3139 found:
3140 	bt_dev_dbg(hdev, "event 0x%2.2x", event);
3141 
3142 	return hdev->recv_event->data + offset;
3143 }
3144 
3145 /* Send ACL data */
3146 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3147 {
3148 	struct hci_acl_hdr *hdr;
3149 	int len = skb->len;
3150 
3151 	skb_push(skb, HCI_ACL_HDR_SIZE);
3152 	skb_reset_transport_header(skb);
3153 	hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3154 	hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3155 	hdr->dlen   = cpu_to_le16(len);
3156 }
3157 
3158 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
3159 			  struct sk_buff *skb, __u16 flags)
3160 {
3161 	struct hci_conn *conn = chan->conn;
3162 	struct hci_dev *hdev = conn->hdev;
3163 	struct sk_buff *list;
3164 
3165 	skb->len = skb_headlen(skb);
3166 	skb->data_len = 0;
3167 
3168 	hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3169 
3170 	switch (hdev->dev_type) {
3171 	case HCI_PRIMARY:
3172 		hci_add_acl_hdr(skb, conn->handle, flags);
3173 		break;
3174 	case HCI_AMP:
3175 		hci_add_acl_hdr(skb, chan->handle, flags);
3176 		break;
3177 	default:
3178 		bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3179 		return;
3180 	}
3181 
3182 	list = skb_shinfo(skb)->frag_list;
3183 	if (!list) {
3184 		/* Non fragmented */
3185 		BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3186 
3187 		skb_queue_tail(queue, skb);
3188 	} else {
3189 		/* Fragmented */
3190 		BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3191 
3192 		skb_shinfo(skb)->frag_list = NULL;
3193 
3194 		/* Queue all fragments atomically. We need to use spin_lock_bh
3195 		 * here because of 6LoWPAN links, as there this function is
3196 		 * called from softirq and using normal spin lock could cause
3197 		 * deadlocks.
3198 		 */
3199 		spin_lock_bh(&queue->lock);
3200 
3201 		__skb_queue_tail(queue, skb);
3202 
3203 		flags &= ~ACL_START;
3204 		flags |= ACL_CONT;
3205 		do {
3206 			skb = list; list = list->next;
3207 
3208 			hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3209 			hci_add_acl_hdr(skb, conn->handle, flags);
3210 
3211 			BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3212 
3213 			__skb_queue_tail(queue, skb);
3214 		} while (list);
3215 
3216 		spin_unlock_bh(&queue->lock);
3217 	}
3218 }
3219 
3220 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3221 {
3222 	struct hci_dev *hdev = chan->conn->hdev;
3223 
3224 	BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
3225 
3226 	hci_queue_acl(chan, &chan->data_q, skb, flags);
3227 
3228 	queue_work(hdev->workqueue, &hdev->tx_work);
3229 }
3230 
3231 /* Send SCO data */
3232 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
3233 {
3234 	struct hci_dev *hdev = conn->hdev;
3235 	struct hci_sco_hdr hdr;
3236 
3237 	BT_DBG("%s len %d", hdev->name, skb->len);
3238 
3239 	hdr.handle = cpu_to_le16(conn->handle);
3240 	hdr.dlen   = skb->len;
3241 
3242 	skb_push(skb, HCI_SCO_HDR_SIZE);
3243 	skb_reset_transport_header(skb);
3244 	memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
3245 
3246 	hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
3247 
3248 	skb_queue_tail(&conn->data_q, skb);
3249 	queue_work(hdev->workqueue, &hdev->tx_work);
3250 }
3251 
3252 /* Send ISO data */
3253 static void hci_add_iso_hdr(struct sk_buff *skb, __u16 handle, __u8 flags)
3254 {
3255 	struct hci_iso_hdr *hdr;
3256 	int len = skb->len;
3257 
3258 	skb_push(skb, HCI_ISO_HDR_SIZE);
3259 	skb_reset_transport_header(skb);
3260 	hdr = (struct hci_iso_hdr *)skb_transport_header(skb);
3261 	hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3262 	hdr->dlen   = cpu_to_le16(len);
3263 }
3264 
3265 static void hci_queue_iso(struct hci_conn *conn, struct sk_buff_head *queue,
3266 			  struct sk_buff *skb)
3267 {
3268 	struct hci_dev *hdev = conn->hdev;
3269 	struct sk_buff *list;
3270 	__u16 flags;
3271 
3272 	skb->len = skb_headlen(skb);
3273 	skb->data_len = 0;
3274 
3275 	hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3276 
3277 	list = skb_shinfo(skb)->frag_list;
3278 
3279 	flags = hci_iso_flags_pack(list ? ISO_START : ISO_SINGLE, 0x00);
3280 	hci_add_iso_hdr(skb, conn->handle, flags);
3281 
3282 	if (!list) {
3283 		/* Non fragmented */
3284 		BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3285 
3286 		skb_queue_tail(queue, skb);
3287 	} else {
3288 		/* Fragmented */
3289 		BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3290 
3291 		skb_shinfo(skb)->frag_list = NULL;
3292 
3293 		__skb_queue_tail(queue, skb);
3294 
3295 		do {
3296 			skb = list; list = list->next;
3297 
3298 			hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3299 			flags = hci_iso_flags_pack(list ? ISO_CONT : ISO_END,
3300 						   0x00);
3301 			hci_add_iso_hdr(skb, conn->handle, flags);
3302 
3303 			BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3304 
3305 			__skb_queue_tail(queue, skb);
3306 		} while (list);
3307 	}
3308 }
3309 
3310 void hci_send_iso(struct hci_conn *conn, struct sk_buff *skb)
3311 {
3312 	struct hci_dev *hdev = conn->hdev;
3313 
3314 	BT_DBG("%s len %d", hdev->name, skb->len);
3315 
3316 	hci_queue_iso(conn, &conn->data_q, skb);
3317 
3318 	queue_work(hdev->workqueue, &hdev->tx_work);
3319 }
3320 
3321 /* ---- HCI TX task (outgoing data) ---- */
3322 
3323 /* HCI Connection scheduler */
3324 static inline void hci_quote_sent(struct hci_conn *conn, int num, int *quote)
3325 {
3326 	struct hci_dev *hdev;
3327 	int cnt, q;
3328 
3329 	if (!conn) {
3330 		*quote = 0;
3331 		return;
3332 	}
3333 
3334 	hdev = conn->hdev;
3335 
3336 	switch (conn->type) {
3337 	case ACL_LINK:
3338 		cnt = hdev->acl_cnt;
3339 		break;
3340 	case AMP_LINK:
3341 		cnt = hdev->block_cnt;
3342 		break;
3343 	case SCO_LINK:
3344 	case ESCO_LINK:
3345 		cnt = hdev->sco_cnt;
3346 		break;
3347 	case LE_LINK:
3348 		cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3349 		break;
3350 	case ISO_LINK:
3351 		cnt = hdev->iso_mtu ? hdev->iso_cnt :
3352 			hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3353 		break;
3354 	default:
3355 		cnt = 0;
3356 		bt_dev_err(hdev, "unknown link type %d", conn->type);
3357 	}
3358 
3359 	q = cnt / num;
3360 	*quote = q ? q : 1;
3361 }
3362 
3363 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3364 				     int *quote)
3365 {
3366 	struct hci_conn_hash *h = &hdev->conn_hash;
3367 	struct hci_conn *conn = NULL, *c;
3368 	unsigned int num = 0, min = ~0;
3369 
3370 	/* We don't have to lock device here. Connections are always
3371 	 * added and removed with TX task disabled. */
3372 
3373 	rcu_read_lock();
3374 
3375 	list_for_each_entry_rcu(c, &h->list, list) {
3376 		if (c->type != type || skb_queue_empty(&c->data_q))
3377 			continue;
3378 
3379 		if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3380 			continue;
3381 
3382 		num++;
3383 
3384 		if (c->sent < min) {
3385 			min  = c->sent;
3386 			conn = c;
3387 		}
3388 
3389 		if (hci_conn_num(hdev, type) == num)
3390 			break;
3391 	}
3392 
3393 	rcu_read_unlock();
3394 
3395 	hci_quote_sent(conn, num, quote);
3396 
3397 	BT_DBG("conn %p quote %d", conn, *quote);
3398 	return conn;
3399 }
3400 
3401 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
3402 {
3403 	struct hci_conn_hash *h = &hdev->conn_hash;
3404 	struct hci_conn *c;
3405 
3406 	bt_dev_err(hdev, "link tx timeout");
3407 
3408 	rcu_read_lock();
3409 
3410 	/* Kill stalled connections */
3411 	list_for_each_entry_rcu(c, &h->list, list) {
3412 		if (c->type == type && c->sent) {
3413 			bt_dev_err(hdev, "killing stalled connection %pMR",
3414 				   &c->dst);
3415 			hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3416 		}
3417 	}
3418 
3419 	rcu_read_unlock();
3420 }
3421 
3422 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3423 				      int *quote)
3424 {
3425 	struct hci_conn_hash *h = &hdev->conn_hash;
3426 	struct hci_chan *chan = NULL;
3427 	unsigned int num = 0, min = ~0, cur_prio = 0;
3428 	struct hci_conn *conn;
3429 	int conn_num = 0;
3430 
3431 	BT_DBG("%s", hdev->name);
3432 
3433 	rcu_read_lock();
3434 
3435 	list_for_each_entry_rcu(conn, &h->list, list) {
3436 		struct hci_chan *tmp;
3437 
3438 		if (conn->type != type)
3439 			continue;
3440 
3441 		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3442 			continue;
3443 
3444 		conn_num++;
3445 
3446 		list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
3447 			struct sk_buff *skb;
3448 
3449 			if (skb_queue_empty(&tmp->data_q))
3450 				continue;
3451 
3452 			skb = skb_peek(&tmp->data_q);
3453 			if (skb->priority < cur_prio)
3454 				continue;
3455 
3456 			if (skb->priority > cur_prio) {
3457 				num = 0;
3458 				min = ~0;
3459 				cur_prio = skb->priority;
3460 			}
3461 
3462 			num++;
3463 
3464 			if (conn->sent < min) {
3465 				min  = conn->sent;
3466 				chan = tmp;
3467 			}
3468 		}
3469 
3470 		if (hci_conn_num(hdev, type) == conn_num)
3471 			break;
3472 	}
3473 
3474 	rcu_read_unlock();
3475 
3476 	if (!chan)
3477 		return NULL;
3478 
3479 	hci_quote_sent(chan->conn, num, quote);
3480 
3481 	BT_DBG("chan %p quote %d", chan, *quote);
3482 	return chan;
3483 }
3484 
3485 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3486 {
3487 	struct hci_conn_hash *h = &hdev->conn_hash;
3488 	struct hci_conn *conn;
3489 	int num = 0;
3490 
3491 	BT_DBG("%s", hdev->name);
3492 
3493 	rcu_read_lock();
3494 
3495 	list_for_each_entry_rcu(conn, &h->list, list) {
3496 		struct hci_chan *chan;
3497 
3498 		if (conn->type != type)
3499 			continue;
3500 
3501 		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3502 			continue;
3503 
3504 		num++;
3505 
3506 		list_for_each_entry_rcu(chan, &conn->chan_list, list) {
3507 			struct sk_buff *skb;
3508 
3509 			if (chan->sent) {
3510 				chan->sent = 0;
3511 				continue;
3512 			}
3513 
3514 			if (skb_queue_empty(&chan->data_q))
3515 				continue;
3516 
3517 			skb = skb_peek(&chan->data_q);
3518 			if (skb->priority >= HCI_PRIO_MAX - 1)
3519 				continue;
3520 
3521 			skb->priority = HCI_PRIO_MAX - 1;
3522 
3523 			BT_DBG("chan %p skb %p promoted to %d", chan, skb,
3524 			       skb->priority);
3525 		}
3526 
3527 		if (hci_conn_num(hdev, type) == num)
3528 			break;
3529 	}
3530 
3531 	rcu_read_unlock();
3532 
3533 }
3534 
3535 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3536 {
3537 	/* Calculate count of blocks used by this packet */
3538 	return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3539 }
3540 
3541 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type)
3542 {
3543 	unsigned long last_tx;
3544 
3545 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
3546 		return;
3547 
3548 	switch (type) {
3549 	case LE_LINK:
3550 		last_tx = hdev->le_last_tx;
3551 		break;
3552 	default:
3553 		last_tx = hdev->acl_last_tx;
3554 		break;
3555 	}
3556 
3557 	/* tx timeout must be longer than maximum link supervision timeout
3558 	 * (40.9 seconds)
3559 	 */
3560 	if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT))
3561 		hci_link_tx_to(hdev, type);
3562 }
3563 
3564 /* Schedule SCO */
3565 static void hci_sched_sco(struct hci_dev *hdev)
3566 {
3567 	struct hci_conn *conn;
3568 	struct sk_buff *skb;
3569 	int quote;
3570 
3571 	BT_DBG("%s", hdev->name);
3572 
3573 	if (!hci_conn_num(hdev, SCO_LINK))
3574 		return;
3575 
3576 	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3577 		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3578 			BT_DBG("skb %p len %d", skb, skb->len);
3579 			hci_send_frame(hdev, skb);
3580 
3581 			conn->sent++;
3582 			if (conn->sent == ~0)
3583 				conn->sent = 0;
3584 		}
3585 	}
3586 }
3587 
3588 static void hci_sched_esco(struct hci_dev *hdev)
3589 {
3590 	struct hci_conn *conn;
3591 	struct sk_buff *skb;
3592 	int quote;
3593 
3594 	BT_DBG("%s", hdev->name);
3595 
3596 	if (!hci_conn_num(hdev, ESCO_LINK))
3597 		return;
3598 
3599 	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3600 						     &quote))) {
3601 		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3602 			BT_DBG("skb %p len %d", skb, skb->len);
3603 			hci_send_frame(hdev, skb);
3604 
3605 			conn->sent++;
3606 			if (conn->sent == ~0)
3607 				conn->sent = 0;
3608 		}
3609 	}
3610 }
3611 
3612 static void hci_sched_acl_pkt(struct hci_dev *hdev)
3613 {
3614 	unsigned int cnt = hdev->acl_cnt;
3615 	struct hci_chan *chan;
3616 	struct sk_buff *skb;
3617 	int quote;
3618 
3619 	__check_timeout(hdev, cnt, ACL_LINK);
3620 
3621 	while (hdev->acl_cnt &&
3622 	       (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3623 		u32 priority = (skb_peek(&chan->data_q))->priority;
3624 		while (quote-- && (skb = skb_peek(&chan->data_q))) {
3625 			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3626 			       skb->len, skb->priority);
3627 
3628 			/* Stop if priority has changed */
3629 			if (skb->priority < priority)
3630 				break;
3631 
3632 			skb = skb_dequeue(&chan->data_q);
3633 
3634 			hci_conn_enter_active_mode(chan->conn,
3635 						   bt_cb(skb)->force_active);
3636 
3637 			hci_send_frame(hdev, skb);
3638 			hdev->acl_last_tx = jiffies;
3639 
3640 			hdev->acl_cnt--;
3641 			chan->sent++;
3642 			chan->conn->sent++;
3643 
3644 			/* Send pending SCO packets right away */
3645 			hci_sched_sco(hdev);
3646 			hci_sched_esco(hdev);
3647 		}
3648 	}
3649 
3650 	if (cnt != hdev->acl_cnt)
3651 		hci_prio_recalculate(hdev, ACL_LINK);
3652 }
3653 
3654 static void hci_sched_acl_blk(struct hci_dev *hdev)
3655 {
3656 	unsigned int cnt = hdev->block_cnt;
3657 	struct hci_chan *chan;
3658 	struct sk_buff *skb;
3659 	int quote;
3660 	u8 type;
3661 
3662 	BT_DBG("%s", hdev->name);
3663 
3664 	if (hdev->dev_type == HCI_AMP)
3665 		type = AMP_LINK;
3666 	else
3667 		type = ACL_LINK;
3668 
3669 	__check_timeout(hdev, cnt, type);
3670 
3671 	while (hdev->block_cnt > 0 &&
3672 	       (chan = hci_chan_sent(hdev, type, &quote))) {
3673 		u32 priority = (skb_peek(&chan->data_q))->priority;
3674 		while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3675 			int blocks;
3676 
3677 			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3678 			       skb->len, skb->priority);
3679 
3680 			/* Stop if priority has changed */
3681 			if (skb->priority < priority)
3682 				break;
3683 
3684 			skb = skb_dequeue(&chan->data_q);
3685 
3686 			blocks = __get_blocks(hdev, skb);
3687 			if (blocks > hdev->block_cnt)
3688 				return;
3689 
3690 			hci_conn_enter_active_mode(chan->conn,
3691 						   bt_cb(skb)->force_active);
3692 
3693 			hci_send_frame(hdev, skb);
3694 			hdev->acl_last_tx = jiffies;
3695 
3696 			hdev->block_cnt -= blocks;
3697 			quote -= blocks;
3698 
3699 			chan->sent += blocks;
3700 			chan->conn->sent += blocks;
3701 		}
3702 	}
3703 
3704 	if (cnt != hdev->block_cnt)
3705 		hci_prio_recalculate(hdev, type);
3706 }
3707 
3708 static void hci_sched_acl(struct hci_dev *hdev)
3709 {
3710 	BT_DBG("%s", hdev->name);
3711 
3712 	/* No ACL link over BR/EDR controller */
3713 	if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
3714 		return;
3715 
3716 	/* No AMP link over AMP controller */
3717 	if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
3718 		return;
3719 
3720 	switch (hdev->flow_ctl_mode) {
3721 	case HCI_FLOW_CTL_MODE_PACKET_BASED:
3722 		hci_sched_acl_pkt(hdev);
3723 		break;
3724 
3725 	case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3726 		hci_sched_acl_blk(hdev);
3727 		break;
3728 	}
3729 }
3730 
3731 static void hci_sched_le(struct hci_dev *hdev)
3732 {
3733 	struct hci_chan *chan;
3734 	struct sk_buff *skb;
3735 	int quote, cnt, tmp;
3736 
3737 	BT_DBG("%s", hdev->name);
3738 
3739 	if (!hci_conn_num(hdev, LE_LINK))
3740 		return;
3741 
3742 	cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
3743 
3744 	__check_timeout(hdev, cnt, LE_LINK);
3745 
3746 	tmp = cnt;
3747 	while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
3748 		u32 priority = (skb_peek(&chan->data_q))->priority;
3749 		while (quote-- && (skb = skb_peek(&chan->data_q))) {
3750 			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3751 			       skb->len, skb->priority);
3752 
3753 			/* Stop if priority has changed */
3754 			if (skb->priority < priority)
3755 				break;
3756 
3757 			skb = skb_dequeue(&chan->data_q);
3758 
3759 			hci_send_frame(hdev, skb);
3760 			hdev->le_last_tx = jiffies;
3761 
3762 			cnt--;
3763 			chan->sent++;
3764 			chan->conn->sent++;
3765 
3766 			/* Send pending SCO packets right away */
3767 			hci_sched_sco(hdev);
3768 			hci_sched_esco(hdev);
3769 		}
3770 	}
3771 
3772 	if (hdev->le_pkts)
3773 		hdev->le_cnt = cnt;
3774 	else
3775 		hdev->acl_cnt = cnt;
3776 
3777 	if (cnt != tmp)
3778 		hci_prio_recalculate(hdev, LE_LINK);
3779 }
3780 
3781 /* Schedule CIS */
3782 static void hci_sched_iso(struct hci_dev *hdev)
3783 {
3784 	struct hci_conn *conn;
3785 	struct sk_buff *skb;
3786 	int quote, *cnt;
3787 
3788 	BT_DBG("%s", hdev->name);
3789 
3790 	if (!hci_conn_num(hdev, ISO_LINK))
3791 		return;
3792 
3793 	cnt = hdev->iso_pkts ? &hdev->iso_cnt :
3794 		hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
3795 	while (*cnt && (conn = hci_low_sent(hdev, ISO_LINK, &quote))) {
3796 		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3797 			BT_DBG("skb %p len %d", skb, skb->len);
3798 			hci_send_frame(hdev, skb);
3799 
3800 			conn->sent++;
3801 			if (conn->sent == ~0)
3802 				conn->sent = 0;
3803 			(*cnt)--;
3804 		}
3805 	}
3806 }
3807 
3808 static void hci_tx_work(struct work_struct *work)
3809 {
3810 	struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
3811 	struct sk_buff *skb;
3812 
3813 	BT_DBG("%s acl %d sco %d le %d iso %d", hdev->name, hdev->acl_cnt,
3814 	       hdev->sco_cnt, hdev->le_cnt, hdev->iso_cnt);
3815 
3816 	if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
3817 		/* Schedule queues and send stuff to HCI driver */
3818 		hci_sched_sco(hdev);
3819 		hci_sched_esco(hdev);
3820 		hci_sched_iso(hdev);
3821 		hci_sched_acl(hdev);
3822 		hci_sched_le(hdev);
3823 	}
3824 
3825 	/* Send next queued raw (unknown type) packet */
3826 	while ((skb = skb_dequeue(&hdev->raw_q)))
3827 		hci_send_frame(hdev, skb);
3828 }
3829 
3830 /* ----- HCI RX task (incoming data processing) ----- */
3831 
3832 /* ACL data packet */
3833 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3834 {
3835 	struct hci_acl_hdr *hdr = (void *) skb->data;
3836 	struct hci_conn *conn;
3837 	__u16 handle, flags;
3838 
3839 	skb_pull(skb, HCI_ACL_HDR_SIZE);
3840 
3841 	handle = __le16_to_cpu(hdr->handle);
3842 	flags  = hci_flags(handle);
3843 	handle = hci_handle(handle);
3844 
3845 	BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
3846 	       handle, flags);
3847 
3848 	hdev->stat.acl_rx++;
3849 
3850 	hci_dev_lock(hdev);
3851 	conn = hci_conn_hash_lookup_handle(hdev, handle);
3852 	hci_dev_unlock(hdev);
3853 
3854 	if (conn) {
3855 		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
3856 
3857 		/* Send to upper protocol */
3858 		l2cap_recv_acldata(conn, skb, flags);
3859 		return;
3860 	} else {
3861 		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
3862 			   handle);
3863 	}
3864 
3865 	kfree_skb(skb);
3866 }
3867 
3868 /* SCO data packet */
3869 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3870 {
3871 	struct hci_sco_hdr *hdr = (void *) skb->data;
3872 	struct hci_conn *conn;
3873 	__u16 handle, flags;
3874 
3875 	skb_pull(skb, HCI_SCO_HDR_SIZE);
3876 
3877 	handle = __le16_to_cpu(hdr->handle);
3878 	flags  = hci_flags(handle);
3879 	handle = hci_handle(handle);
3880 
3881 	BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
3882 	       handle, flags);
3883 
3884 	hdev->stat.sco_rx++;
3885 
3886 	hci_dev_lock(hdev);
3887 	conn = hci_conn_hash_lookup_handle(hdev, handle);
3888 	hci_dev_unlock(hdev);
3889 
3890 	if (conn) {
3891 		/* Send to upper protocol */
3892 		bt_cb(skb)->sco.pkt_status = flags & 0x03;
3893 		sco_recv_scodata(conn, skb);
3894 		return;
3895 	} else {
3896 		bt_dev_err_ratelimited(hdev, "SCO packet for unknown connection handle %d",
3897 				       handle);
3898 	}
3899 
3900 	kfree_skb(skb);
3901 }
3902 
3903 static void hci_isodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3904 {
3905 	struct hci_iso_hdr *hdr;
3906 	struct hci_conn *conn;
3907 	__u16 handle, flags;
3908 
3909 	hdr = skb_pull_data(skb, sizeof(*hdr));
3910 	if (!hdr) {
3911 		bt_dev_err(hdev, "ISO packet too small");
3912 		goto drop;
3913 	}
3914 
3915 	handle = __le16_to_cpu(hdr->handle);
3916 	flags  = hci_flags(handle);
3917 	handle = hci_handle(handle);
3918 
3919 	bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
3920 		   handle, flags);
3921 
3922 	hci_dev_lock(hdev);
3923 	conn = hci_conn_hash_lookup_handle(hdev, handle);
3924 	hci_dev_unlock(hdev);
3925 
3926 	if (!conn) {
3927 		bt_dev_err(hdev, "ISO packet for unknown connection handle %d",
3928 			   handle);
3929 		goto drop;
3930 	}
3931 
3932 	/* Send to upper protocol */
3933 	iso_recv(conn, skb, flags);
3934 	return;
3935 
3936 drop:
3937 	kfree_skb(skb);
3938 }
3939 
3940 static bool hci_req_is_complete(struct hci_dev *hdev)
3941 {
3942 	struct sk_buff *skb;
3943 
3944 	skb = skb_peek(&hdev->cmd_q);
3945 	if (!skb)
3946 		return true;
3947 
3948 	return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
3949 }
3950 
3951 static void hci_resend_last(struct hci_dev *hdev)
3952 {
3953 	struct hci_command_hdr *sent;
3954 	struct sk_buff *skb;
3955 	u16 opcode;
3956 
3957 	if (!hdev->sent_cmd)
3958 		return;
3959 
3960 	sent = (void *) hdev->sent_cmd->data;
3961 	opcode = __le16_to_cpu(sent->opcode);
3962 	if (opcode == HCI_OP_RESET)
3963 		return;
3964 
3965 	skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3966 	if (!skb)
3967 		return;
3968 
3969 	skb_queue_head(&hdev->cmd_q, skb);
3970 	queue_work(hdev->workqueue, &hdev->cmd_work);
3971 }
3972 
3973 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
3974 			  hci_req_complete_t *req_complete,
3975 			  hci_req_complete_skb_t *req_complete_skb)
3976 {
3977 	struct sk_buff *skb;
3978 	unsigned long flags;
3979 
3980 	BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3981 
3982 	/* If the completed command doesn't match the last one that was
3983 	 * sent we need to do special handling of it.
3984 	 */
3985 	if (!hci_sent_cmd_data(hdev, opcode)) {
3986 		/* Some CSR based controllers generate a spontaneous
3987 		 * reset complete event during init and any pending
3988 		 * command will never be completed. In such a case we
3989 		 * need to resend whatever was the last sent
3990 		 * command.
3991 		 */
3992 		if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3993 			hci_resend_last(hdev);
3994 
3995 		return;
3996 	}
3997 
3998 	/* If we reach this point this event matches the last command sent */
3999 	hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
4000 
4001 	/* If the command succeeded and there's still more commands in
4002 	 * this request the request is not yet complete.
4003 	 */
4004 	if (!status && !hci_req_is_complete(hdev))
4005 		return;
4006 
4007 	/* If this was the last command in a request the complete
4008 	 * callback would be found in hdev->sent_cmd instead of the
4009 	 * command queue (hdev->cmd_q).
4010 	 */
4011 	if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4012 		*req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
4013 		return;
4014 	}
4015 
4016 	if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4017 		*req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
4018 		return;
4019 	}
4020 
4021 	/* Remove all pending commands belonging to this request */
4022 	spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4023 	while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4024 		if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
4025 			__skb_queue_head(&hdev->cmd_q, skb);
4026 			break;
4027 		}
4028 
4029 		if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4030 			*req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4031 		else
4032 			*req_complete = bt_cb(skb)->hci.req_complete;
4033 		dev_kfree_skb_irq(skb);
4034 	}
4035 	spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4036 }
4037 
4038 static void hci_rx_work(struct work_struct *work)
4039 {
4040 	struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
4041 	struct sk_buff *skb;
4042 
4043 	BT_DBG("%s", hdev->name);
4044 
4045 	/* The kcov_remote functions used for collecting packet parsing
4046 	 * coverage information from this background thread and associate
4047 	 * the coverage with the syscall's thread which originally injected
4048 	 * the packet. This helps fuzzing the kernel.
4049 	 */
4050 	for (; (skb = skb_dequeue(&hdev->rx_q)); kcov_remote_stop()) {
4051 		kcov_remote_start_common(skb_get_kcov_handle(skb));
4052 
4053 		/* Send copy to monitor */
4054 		hci_send_to_monitor(hdev, skb);
4055 
4056 		if (atomic_read(&hdev->promisc)) {
4057 			/* Send copy to the sockets */
4058 			hci_send_to_sock(hdev, skb);
4059 		}
4060 
4061 		/* If the device has been opened in HCI_USER_CHANNEL,
4062 		 * the userspace has exclusive access to device.
4063 		 * When device is HCI_INIT, we still need to process
4064 		 * the data packets to the driver in order
4065 		 * to complete its setup().
4066 		 */
4067 		if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4068 		    !test_bit(HCI_INIT, &hdev->flags)) {
4069 			kfree_skb(skb);
4070 			continue;
4071 		}
4072 
4073 		if (test_bit(HCI_INIT, &hdev->flags)) {
4074 			/* Don't process data packets in this states. */
4075 			switch (hci_skb_pkt_type(skb)) {
4076 			case HCI_ACLDATA_PKT:
4077 			case HCI_SCODATA_PKT:
4078 			case HCI_ISODATA_PKT:
4079 				kfree_skb(skb);
4080 				continue;
4081 			}
4082 		}
4083 
4084 		/* Process frame */
4085 		switch (hci_skb_pkt_type(skb)) {
4086 		case HCI_EVENT_PKT:
4087 			BT_DBG("%s Event packet", hdev->name);
4088 			hci_event_packet(hdev, skb);
4089 			break;
4090 
4091 		case HCI_ACLDATA_PKT:
4092 			BT_DBG("%s ACL data packet", hdev->name);
4093 			hci_acldata_packet(hdev, skb);
4094 			break;
4095 
4096 		case HCI_SCODATA_PKT:
4097 			BT_DBG("%s SCO data packet", hdev->name);
4098 			hci_scodata_packet(hdev, skb);
4099 			break;
4100 
4101 		case HCI_ISODATA_PKT:
4102 			BT_DBG("%s ISO data packet", hdev->name);
4103 			hci_isodata_packet(hdev, skb);
4104 			break;
4105 
4106 		default:
4107 			kfree_skb(skb);
4108 			break;
4109 		}
4110 	}
4111 }
4112 
4113 static void hci_cmd_work(struct work_struct *work)
4114 {
4115 	struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4116 	struct sk_buff *skb;
4117 
4118 	BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4119 	       atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4120 
4121 	/* Send queued commands */
4122 	if (atomic_read(&hdev->cmd_cnt)) {
4123 		skb = skb_dequeue(&hdev->cmd_q);
4124 		if (!skb)
4125 			return;
4126 
4127 		kfree_skb(hdev->sent_cmd);
4128 
4129 		hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4130 		if (hdev->sent_cmd) {
4131 			int res;
4132 			if (hci_req_status_pend(hdev))
4133 				hci_dev_set_flag(hdev, HCI_CMD_PENDING);
4134 			atomic_dec(&hdev->cmd_cnt);
4135 
4136 			res = hci_send_frame(hdev, skb);
4137 			if (res < 0)
4138 				__hci_cmd_sync_cancel(hdev, -res);
4139 
4140 			rcu_read_lock();
4141 			if (test_bit(HCI_RESET, &hdev->flags) ||
4142 			    hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
4143 				cancel_delayed_work(&hdev->cmd_timer);
4144 			else
4145 				queue_delayed_work(hdev->workqueue, &hdev->cmd_timer,
4146 						   HCI_CMD_TIMEOUT);
4147 			rcu_read_unlock();
4148 		} else {
4149 			skb_queue_head(&hdev->cmd_q, skb);
4150 			queue_work(hdev->workqueue, &hdev->cmd_work);
4151 		}
4152 	}
4153 }
4154