]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blobdiff - net/bluetooth/hci_core.c
Bluetooth: Introduce a whitelist for BR/EDR devices
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_core.c
index 5788e031b869c41472235da7a830ce7d3354164d..728a6ee471eac45255b011739aef8873a6ba88ad 100644 (file)
@@ -191,6 +191,31 @@ static const struct file_operations blacklist_fops = {
        .release        = single_release,
 };
 
+static int whitelist_show(struct seq_file *f, void *p)
+{
+       struct hci_dev *hdev = f->private;
+       struct bdaddr_list *b;
+
+       hci_dev_lock(hdev);
+       list_for_each_entry(b, &hdev->whitelist, list)
+               seq_printf(f, "%pMR (type %u)\n", &b->bdaddr, b->bdaddr_type);
+       hci_dev_unlock(hdev);
+
+       return 0;
+}
+
+static int whitelist_open(struct inode *inode, struct file *file)
+{
+       return single_open(file, whitelist_show, inode->i_private);
+}
+
+static const struct file_operations whitelist_fops = {
+       .open           = whitelist_open,
+       .read           = seq_read,
+       .llseek         = seq_lseek,
+       .release        = single_release,
+};
+
 static int uuids_show(struct seq_file *f, void *p)
 {
        struct hci_dev *hdev = f->private;
@@ -1569,7 +1594,7 @@ static void hci_set_event_mask_page_2(struct hci_request *req)
        }
 
        /* Enable Authenticated Payload Timeout Expired event if supported */
-       if (lmp_ping_capable(hdev))
+       if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
                events[2] |= 0x80;
 
        hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
@@ -1611,6 +1636,15 @@ static void hci_init3_req(struct hci_request *req, unsigned long opt)
 
                memset(events, 0, sizeof(events));
                events[0] = 0x1f;
+
+               /* If controller supports the Connection Parameters Request
+                * Link Layer Procedure, enable the corresponding event.
+                */
+               if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
+                       events[0] |= 0x20;      /* LE Remote Connection
+                                                * Parameter Request
+                                                */
+
                hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
                            events);
 
@@ -1698,6 +1732,8 @@ static int __hci_init(struct hci_dev *hdev)
        debugfs_create_u16("hci_revision", 0444, hdev->debugfs, &hdev->hci_rev);
        debugfs_create_file("blacklist", 0444, hdev->debugfs, hdev,
                            &blacklist_fops);
+       debugfs_create_file("whitelist", 0444, hdev->debugfs, hdev,
+                           &whitelist_fops);
        debugfs_create_file("uuids", 0444, hdev->debugfs, hdev, &uuids_fops);
 
        debugfs_create_file("conn_info_min_age", 0644, hdev->debugfs, hdev,
@@ -1782,6 +1818,38 @@ static int __hci_init(struct hci_dev *hdev)
        return 0;
 }
 
+static void hci_init0_req(struct hci_request *req, unsigned long opt)
+{
+       struct hci_dev *hdev = req->hdev;
+
+       BT_DBG("%s %ld", hdev->name, opt);
+
+       /* Reset */
+       if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
+               hci_reset_req(req, 0);
+
+       /* Read Local Version */
+       hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
+
+       /* Read BD Address */
+       if (hdev->set_bdaddr)
+               hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
+}
+
+static int __hci_unconf_init(struct hci_dev *hdev)
+{
+       int err;
+
+       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
+               return 0;
+
+       err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT);
+       if (err < 0)
+               return err;
+
+       return 0;
+}
+
 static void hci_scan_req(struct hci_request *req, unsigned long opt)
 {
        __u8 scan = opt;
@@ -1862,16 +1930,20 @@ bool hci_discovery_active(struct hci_dev *hdev)
 
 void hci_discovery_set_state(struct hci_dev *hdev, int state)
 {
+       int old_state = hdev->discovery.state;
+
        BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
 
-       if (hdev->discovery.state == state)
+       if (old_state == state)
                return;
 
+       hdev->discovery.state = state;
+
        switch (state) {
        case DISCOVERY_STOPPED:
                hci_update_background_scan(hdev);
 
-               if (hdev->discovery.state != DISCOVERY_STARTING)
+               if (old_state != DISCOVERY_STARTING)
                        mgmt_discovering(hdev, 0);
                break;
        case DISCOVERY_STARTING:
@@ -1884,8 +1956,6 @@ void hci_discovery_set_state(struct hci_dev *hdev, int state)
        case DISCOVERY_STOPPING:
                break;
        }
-
-       hdev->discovery.state = state;
 }
 
 void hci_inquiry_cache_flush(struct hci_dev *hdev)
@@ -2107,7 +2177,7 @@ int hci_inquiry(void __user *arg)
                goto done;
        }
 
-       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) {
+       if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
                err = -EOPNOTSUPP;
                goto done;
        }
@@ -2194,7 +2264,8 @@ static int hci_dev_do_open(struct hci_dev *hdev)
                goto done;
        }
 
-       if (!test_bit(HCI_SETUP, &hdev->dev_flags)) {
+       if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
+           !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
                /* Check for rfkill but allow the HCI setup stage to
                 * proceed (which in itself doesn't cause any RF activity).
                 */
@@ -2237,11 +2308,47 @@ static int hci_dev_do_open(struct hci_dev *hdev)
        atomic_set(&hdev->cmd_cnt, 1);
        set_bit(HCI_INIT, &hdev->flags);
 
-       if (hdev->setup && test_bit(HCI_SETUP, &hdev->dev_flags))
-               ret = hdev->setup(hdev);
+       if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
+               if (hdev->setup)
+                       ret = hdev->setup(hdev);
+
+               /* The transport driver can set these quirks before
+                * creating the HCI device or in its setup callback.
+                *
+                * In case any of them is set, the controller has to
+                * start up as unconfigured.
+                */
+               if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
+                   test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
+                       set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
+
+               /* For an unconfigured controller it is required to
+                * read at least the version information provided by
+                * the Read Local Version Information command.
+                *
+                * If the set_bdaddr driver callback is provided, then
+                * also the original Bluetooth public device address
+                * will be read using the Read BD Address command.
+                */
+               if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
+                       ret = __hci_unconf_init(hdev);
+       }
+
+       if (test_bit(HCI_CONFIG, &hdev->dev_flags)) {
+               /* If public address change is configured, ensure that
+                * the address gets programmed. If the driver does not
+                * support changing the public address, fail the power
+                * on procedure.
+                */
+               if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
+                   hdev->set_bdaddr)
+                       ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
+               else
+                       ret = -EADDRNOTAVAIL;
+       }
 
        if (!ret) {
-               if (!test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks) &&
+               if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
                    !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
                        ret = __hci_init(hdev);
        }
@@ -2254,6 +2361,8 @@ static int hci_dev_do_open(struct hci_dev *hdev)
                set_bit(HCI_UP, &hdev->flags);
                hci_notify(hdev, HCI_DEV_UP);
                if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
+                   !test_bit(HCI_CONFIG, &hdev->dev_flags) &&
+                   !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
                    !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
                    hdev->dev_type == HCI_BREDR) {
                        hci_dev_lock(hdev);
@@ -2297,7 +2406,7 @@ int hci_dev_open(__u16 dev)
        if (!hdev)
                return -ENODEV;
 
-       /* Devices that are marked for raw-only usage can only be powered
+       /* Devices that are marked as unconfigured can only be powered
         * up as user channel. Trying to bring them up as normal devices
         * will result into a failure. Only user channel operation is
         * possible.
@@ -2306,7 +2415,7 @@ int hci_dev_open(__u16 dev)
         * HCI_USER_CHANNEL will be set first before attempting to
         * open the device.
         */
-       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks) &&
+       if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
            !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
                err = -EOPNOTSUPP;
                goto done;
@@ -2333,6 +2442,17 @@ done:
        return err;
 }
 
+/* This function requires the caller holds hdev->lock */
+static void hci_pend_le_actions_clear(struct hci_dev *hdev)
+{
+       struct hci_conn_params *p;
+
+       list_for_each_entry(p, &hdev->le_conn_params, list)
+               list_del_init(&p->action);
+
+       BT_DBG("All LE pending actions cleared");
+}
+
 static int hci_dev_do_close(struct hci_dev *hdev)
 {
        BT_DBG("%s %p", hdev->name, hdev);
@@ -2370,7 +2490,7 @@ static int hci_dev_do_close(struct hci_dev *hdev)
        hci_dev_lock(hdev);
        hci_inquiry_cache_flush(hdev);
        hci_conn_hash_flush(hdev);
-       hci_pend_le_conns_clear(hdev);
+       hci_pend_le_actions_clear(hdev);
        hci_dev_unlock(hdev);
 
        hci_notify(hdev, HCI_DEV_DOWN);
@@ -2381,8 +2501,8 @@ static int hci_dev_do_close(struct hci_dev *hdev)
        /* Reset device */
        skb_queue_purge(&hdev->cmd_q);
        atomic_set(&hdev->cmd_cnt, 1);
-       if (!test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks) &&
-           !test_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
+       if (!test_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
+           !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
            test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
                set_bit(HCI_INIT, &hdev->flags);
                __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
@@ -2481,7 +2601,7 @@ int hci_dev_reset(__u16 dev)
                goto done;
        }
 
-       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) {
+       if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
                ret = -EOPNOTSUPP;
                goto done;
        }
@@ -2523,7 +2643,7 @@ int hci_dev_reset_stat(__u16 dev)
                goto done;
        }
 
-       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) {
+       if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
                ret = -EOPNOTSUPP;
                goto done;
        }
@@ -2553,7 +2673,7 @@ int hci_dev_cmd(unsigned int cmd, void __user *arg)
                goto done;
        }
 
-       if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) {
+       if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
                err = -EOPNOTSUPP;
                goto done;
        }
@@ -2740,7 +2860,8 @@ static int hci_rfkill_set_block(void *data, bool blocked)
 
        if (blocked) {
                set_bit(HCI_RFKILLED, &hdev->dev_flags);
-               if (!test_bit(HCI_SETUP, &hdev->dev_flags))
+               if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
+                   !test_bit(HCI_CONFIG, &hdev->dev_flags))
                        hci_dev_do_close(hdev);
        } else {
                clear_bit(HCI_RFKILLED, &hdev->dev_flags);
@@ -2771,6 +2892,7 @@ static void hci_power_on(struct work_struct *work)
         * valid, it is important to turn the device back off.
         */
        if (test_bit(HCI_RFKILLED, &hdev->dev_flags) ||
+           test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
            (hdev->dev_type == HCI_BREDR &&
             !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
             !bacmp(&hdev->static_addr, BDADDR_ANY))) {
@@ -2782,8 +2904,32 @@ static void hci_power_on(struct work_struct *work)
        }
 
        if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags)) {
-               if (!test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
-                       mgmt_index_added(hdev);
+               /* For unconfigured devices, set the HCI_RAW flag
+                * so that userspace can easily identify them.
+                */
+               if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
+                       set_bit(HCI_RAW, &hdev->flags);
+
+               /* For fully configured devices, this will send
+                * the Index Added event. For unconfigured devices,
+                * it will send Unconfigued Index Added event.
+                *
+                * Devices with HCI_QUIRK_RAW_DEVICE are ignored
+                * and no event will be send.
+                */
+               mgmt_index_added(hdev);
+       } else if (test_and_clear_bit(HCI_CONFIG, &hdev->dev_flags)) {
+               /* When the controller is now configured, then it
+                * is important to clear the HCI_RAW flag.
+                */
+               if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
+                       clear_bit(HCI_RAW, &hdev->flags);
+
+               /* Powering on the controller with HCI_CONFIG set only
+                * happens with the transition from unconfigured to
+                * configured. This will send the Index Added event.
+                */
+               mgmt_index_added(hdev);
        }
 }
 
@@ -3232,12 +3378,12 @@ int hci_add_remote_oob_ext_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
        return 0;
 }
 
-struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
+struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
                                         bdaddr_t *bdaddr, u8 type)
 {
        struct bdaddr_list *b;
 
-       list_for_each_entry(b, &hdev->blacklist, list) {
+       list_for_each_entry(b, bdaddr_list, list) {
                if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
                        return b;
        }
@@ -3245,11 +3391,11 @@ struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev,
        return NULL;
 }
 
-static void hci_blacklist_clear(struct hci_dev *hdev)
+void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
 {
        struct list_head *p, *n;
 
-       list_for_each_safe(p, n, &hdev->blacklist) {
+       list_for_each_safe(p, n, bdaddr_list) {
                struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
 
                list_del(p);
@@ -3257,14 +3403,14 @@ static void hci_blacklist_clear(struct hci_dev *hdev)
        }
 }
 
-int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
+int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
 {
        struct bdaddr_list *entry;
 
        if (!bacmp(bdaddr, BDADDR_ANY))
                return -EBADF;
 
-       if (hci_blacklist_lookup(hdev, bdaddr, type))
+       if (hci_bdaddr_list_lookup(list, bdaddr, type))
                return -EEXIST;
 
        entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
@@ -3274,82 +3420,21 @@ int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
        bacpy(&entry->bdaddr, bdaddr);
        entry->bdaddr_type = type;
 
-       list_add(&entry->list, &hdev->blacklist);
+       list_add(&entry->list, list);
 
        return 0;
 }
 
-int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
+int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
 {
        struct bdaddr_list *entry;
 
        if (!bacmp(bdaddr, BDADDR_ANY)) {
-               hci_blacklist_clear(hdev);
+               hci_bdaddr_list_clear(list);
                return 0;
        }
 
-       entry = hci_blacklist_lookup(hdev, bdaddr, type);
-       if (!entry)
-               return -ENOENT;
-
-       list_del(&entry->list);
-       kfree(entry);
-
-       return 0;
-}
-
-struct bdaddr_list *hci_white_list_lookup(struct hci_dev *hdev,
-                                         bdaddr_t *bdaddr, u8 type)
-{
-       struct bdaddr_list *b;
-
-       list_for_each_entry(b, &hdev->le_white_list, list) {
-               if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
-                       return b;
-       }
-
-       return NULL;
-}
-
-void hci_white_list_clear(struct hci_dev *hdev)
-{
-       struct list_head *p, *n;
-
-       list_for_each_safe(p, n, &hdev->le_white_list) {
-               struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
-
-               list_del(p);
-               kfree(b);
-       }
-}
-
-int hci_white_list_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
-{
-       struct bdaddr_list *entry;
-
-       if (!bacmp(bdaddr, BDADDR_ANY))
-               return -EBADF;
-
-       entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
-       if (!entry)
-               return -ENOMEM;
-
-       bacpy(&entry->bdaddr, bdaddr);
-       entry->bdaddr_type = type;
-
-       list_add(&entry->list, &hdev->le_white_list);
-
-       return 0;
-}
-
-int hci_white_list_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
-{
-       struct bdaddr_list *entry;
-
-       if (!bacmp(bdaddr, BDADDR_ANY))
-               return -EBADF;
-
-       entry = hci_white_list_lookup(hdev, bdaddr, type);
+       entry = hci_bdaddr_list_lookup(list, bdaddr, type);
        if (!entry)
                return -ENOENT;
 
@@ -3365,6 +3450,10 @@ struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
 {
        struct hci_conn_params *params;
 
+       /* The conn params list only contains identity addresses */
+       if (!hci_is_identity_address(addr, addr_type))
+               return NULL;
+
        list_for_each_entry(params, &hdev->le_conn_params, list) {
                if (bacmp(&params->addr, addr) == 0 &&
                    params->addr_type == addr_type) {
@@ -3392,90 +3481,23 @@ static bool is_connected(struct hci_dev *hdev, bdaddr_t *addr, u8 type)
        return true;
 }
 
-static bool is_identity_address(bdaddr_t *addr, u8 addr_type)
-{
-       if (addr_type == ADDR_LE_DEV_PUBLIC)
-               return true;
-
-       /* Check for Random Static address type */
-       if ((addr->b[5] & 0xc0) == 0xc0)
-               return true;
-
-       return false;
-}
-
-/* This function requires the caller holds hdev->lock */
-struct bdaddr_list *hci_pend_le_conn_lookup(struct hci_dev *hdev,
-                                           bdaddr_t *addr, u8 addr_type)
-{
-       struct bdaddr_list *entry;
-
-       list_for_each_entry(entry, &hdev->pend_le_conns, list) {
-               if (bacmp(&entry->bdaddr, addr) == 0 &&
-                   entry->bdaddr_type == addr_type)
-                       return entry;
-       }
-
-       return NULL;
-}
-
-/* This function requires the caller holds hdev->lock */
-void hci_pend_le_conn_add(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
-{
-       struct bdaddr_list *entry;
-
-       entry = hci_pend_le_conn_lookup(hdev, addr, addr_type);
-       if (entry)
-               goto done;
-
-       entry = kzalloc(sizeof(*entry), GFP_KERNEL);
-       if (!entry) {
-               BT_ERR("Out of memory");
-               return;
-       }
-
-       bacpy(&entry->bdaddr, addr);
-       entry->bdaddr_type = addr_type;
-
-       list_add(&entry->list, &hdev->pend_le_conns);
-
-       BT_DBG("addr %pMR (type %u)", addr, addr_type);
-
-done:
-       hci_update_background_scan(hdev);
-}
-
 /* This function requires the caller holds hdev->lock */
-void hci_pend_le_conn_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
+struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
+                                                 bdaddr_t *addr, u8 addr_type)
 {
-       struct bdaddr_list *entry;
-
-       entry = hci_pend_le_conn_lookup(hdev, addr, addr_type);
-       if (!entry)
-               goto done;
-
-       list_del(&entry->list);
-       kfree(entry);
-
-       BT_DBG("addr %pMR (type %u)", addr, addr_type);
-
-done:
-       hci_update_background_scan(hdev);
-}
+       struct hci_conn_params *param;
 
-/* This function requires the caller holds hdev->lock */
-void hci_pend_le_conns_clear(struct hci_dev *hdev)
-{
-       struct bdaddr_list *entry, *tmp;
+       /* The list only contains identity addresses */
+       if (!hci_is_identity_address(addr, addr_type))
+               return NULL;
 
-       list_for_each_entry_safe(entry, tmp, &hdev->pend_le_conns, list) {
-               list_del(&entry->list);
-               kfree(entry);
+       list_for_each_entry(param, list, action) {
+               if (bacmp(&param->addr, addr) == 0 &&
+                   param->addr_type == addr_type)
+                       return param;
        }
 
-       BT_DBG("All LE pending connections cleared");
-
-       hci_update_background_scan(hdev);
+       return NULL;
 }
 
 /* This function requires the caller holds hdev->lock */
@@ -3484,7 +3506,7 @@ struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
 {
        struct hci_conn_params *params;
 
-       if (!is_identity_address(addr, addr_type))
+       if (!hci_is_identity_address(addr, addr_type))
                return NULL;
 
        params = hci_conn_params_lookup(hdev, addr, addr_type);
@@ -3501,6 +3523,7 @@ struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
        params->addr_type = addr_type;
 
        list_add(&params->list, &hdev->le_conn_params);
+       INIT_LIST_HEAD(&params->action);
 
        params->conn_min_interval = hdev->le_conn_min_interval;
        params->conn_max_interval = hdev->le_conn_max_interval;
@@ -3523,19 +3546,30 @@ int hci_conn_params_set(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type,
        if (!params)
                return -EIO;
 
-       params->auto_connect = auto_connect;
+       if (params->auto_connect == auto_connect)
+               return 0;
+
+       list_del_init(&params->action);
 
        switch (auto_connect) {
        case HCI_AUTO_CONN_DISABLED:
        case HCI_AUTO_CONN_LINK_LOSS:
-               hci_pend_le_conn_del(hdev, addr, addr_type);
+               hci_update_background_scan(hdev);
+               break;
+       case HCI_AUTO_CONN_REPORT:
+               list_add(&params->action, &hdev->pend_le_reports);
+               hci_update_background_scan(hdev);
                break;
        case HCI_AUTO_CONN_ALWAYS:
-               if (!is_connected(hdev, addr, addr_type))
-                       hci_pend_le_conn_add(hdev, addr, addr_type);
+               if (!is_connected(hdev, addr, addr_type)) {
+                       list_add(&params->action, &hdev->pend_le_conns);
+                       hci_update_background_scan(hdev);
+               }
                break;
        }
 
+       params->auto_connect = auto_connect;
+
        BT_DBG("addr %pMR (type %u) auto_connect %u", addr, addr_type,
               auto_connect);
 
@@ -3551,25 +3585,42 @@ void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
        if (!params)
                return;
 
-       hci_pend_le_conn_del(hdev, addr, addr_type);
-
+       list_del(&params->action);
        list_del(&params->list);
        kfree(params);
 
+       hci_update_background_scan(hdev);
+
        BT_DBG("addr %pMR (type %u)", addr, addr_type);
 }
 
 /* This function requires the caller holds hdev->lock */
-void hci_conn_params_clear(struct hci_dev *hdev)
+void hci_conn_params_clear_disabled(struct hci_dev *hdev)
+{
+       struct hci_conn_params *params, *tmp;
+
+       list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
+               if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
+                       continue;
+               list_del(&params->list);
+               kfree(params);
+       }
+
+       BT_DBG("All LE disabled connection parameters were removed");
+}
+
+/* This function requires the caller holds hdev->lock */
+void hci_conn_params_clear_all(struct hci_dev *hdev)
 {
        struct hci_conn_params *params, *tmp;
 
        list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
+               list_del(&params->action);
                list_del(&params->list);
                kfree(params);
        }
 
-       hci_pend_le_conns_clear(hdev);
+       hci_update_background_scan(hdev);
 
        BT_DBG("All LE connection parameters were removed");
 }
@@ -3661,7 +3712,7 @@ static void set_random_addr(struct hci_request *req, bdaddr_t *rpa)
         * In this kind of scenario skip the update and let the random
         * address be updated at the next cycle.
         */
-       if (test_bit(HCI_ADVERTISING, &hdev->dev_flags) ||
+       if (test_bit(HCI_LE_ADV, &hdev->dev_flags) ||
            hci_conn_hash_lookup_state(hdev, LE_LINK, BT_CONNECT)) {
                BT_DBG("Deferring random address update");
                return;
@@ -3776,6 +3827,7 @@ struct hci_dev *hci_alloc_dev(void)
        hdev->link_mode = (HCI_LM_ACCEPT);
        hdev->num_iac = 0x01;           /* One IAC support is mandatory */
        hdev->io_capability = 0x03;     /* No Input No Output */
+       hdev->manufacturer = 0xffff;    /* Default to internal use */
        hdev->inq_tx_power = HCI_TX_POWER_INVALID;
        hdev->adv_tx_power = HCI_TX_POWER_INVALID;
 
@@ -3800,6 +3852,7 @@ struct hci_dev *hci_alloc_dev(void)
 
        INIT_LIST_HEAD(&hdev->mgmt_pending);
        INIT_LIST_HEAD(&hdev->blacklist);
+       INIT_LIST_HEAD(&hdev->whitelist);
        INIT_LIST_HEAD(&hdev->uuids);
        INIT_LIST_HEAD(&hdev->link_keys);
        INIT_LIST_HEAD(&hdev->long_term_keys);
@@ -3808,6 +3861,7 @@ struct hci_dev *hci_alloc_dev(void)
        INIT_LIST_HEAD(&hdev->le_white_list);
        INIT_LIST_HEAD(&hdev->le_conn_params);
        INIT_LIST_HEAD(&hdev->pend_le_conns);
+       INIT_LIST_HEAD(&hdev->pend_le_reports);
        INIT_LIST_HEAD(&hdev->conn_hash.list);
 
        INIT_WORK(&hdev->rx_work, hci_rx_work);
@@ -3847,7 +3901,7 @@ int hci_register_dev(struct hci_dev *hdev)
 {
        int id, error;
 
-       if (!hdev->open || !hdev->close)
+       if (!hdev->open || !hdev->close || !hdev->send)
                return -EINVAL;
 
        /* Do not allow HCI_AMP devices to register at index 0,
@@ -3932,12 +3986,11 @@ int hci_register_dev(struct hci_dev *hdev)
        list_add(&hdev->list, &hci_dev_list);
        write_unlock(&hci_dev_list_lock);
 
-       /* Devices that are marked for raw-only usage need to set
-        * the HCI_RAW flag to indicate that only user channel is
-        * supported.
+       /* Devices that are marked for raw-only usage are unconfigured
+        * and should not be included in normal operation.
         */
        if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
-               set_bit(HCI_RAW, &hdev->flags);
+               set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
 
        hci_notify(hdev, HCI_DEV_REG);
        hci_dev_hold(hdev);
@@ -3982,7 +4035,7 @@ void hci_unregister_dev(struct hci_dev *hdev)
 
        if (!test_bit(HCI_INIT, &hdev->flags) &&
            !test_bit(HCI_SETUP, &hdev->dev_flags) &&
-           !test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) {
+           !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
                hci_dev_lock(hdev);
                mgmt_index_removed(hdev);
                hci_dev_unlock(hdev);
@@ -4010,14 +4063,15 @@ void hci_unregister_dev(struct hci_dev *hdev)
        destroy_workqueue(hdev->req_workqueue);
 
        hci_dev_lock(hdev);
-       hci_blacklist_clear(hdev);
+       hci_bdaddr_list_clear(&hdev->blacklist);
+       hci_bdaddr_list_clear(&hdev->whitelist);
        hci_uuids_clear(hdev);
        hci_link_keys_clear(hdev);
        hci_smp_ltks_clear(hdev);
        hci_smp_irks_clear(hdev);
        hci_remote_oob_data_clear(hdev);
-       hci_white_list_clear(hdev);
-       hci_conn_params_clear(hdev);
+       hci_bdaddr_list_clear(&hdev->le_white_list);
+       hci_conn_params_clear_all(hdev);
        hci_dev_unlock(hdev);
 
        hci_dev_put(hdev);
@@ -4255,6 +4309,8 @@ EXPORT_SYMBOL(hci_unregister_cb);
 
 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
 {
+       int err;
+
        BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
 
        /* Time stamp */
@@ -4271,8 +4327,11 @@ static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
        /* Get rid of skb owner, prior to sending to the driver. */
        skb_orphan(skb);
 
-       if (hdev->send(hdev, skb) < 0)
-               BT_ERR("%s sending frame failed", hdev->name);
+       err = hdev->send(hdev, skb);
+       if (err < 0) {
+               BT_ERR("%s sending frame failed (%d)", hdev->name, err);
+               kfree_skb(skb);
+       }
 }
 
 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
@@ -4746,7 +4805,7 @@ static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
 
 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
 {
-       if (!test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) {
+       if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
                /* ACL tx timeout must be longer than maximum
                 * link supervision timeout (40.9 seconds) */
                if (!cnt && time_after(jiffies, hdev->acl_last_tx +
@@ -4929,7 +4988,7 @@ static void hci_sched_le(struct hci_dev *hdev)
        if (!hci_conn_num(hdev, LE_LINK))
                return;
 
-       if (!test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) {
+       if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
                /* LE tx timeout must be longer than maximum
                 * link supervision timeout (40.9 seconds) */
                if (!hdev->le_cnt && hdev->le_pkts &&
@@ -5307,15 +5366,27 @@ void hci_update_background_scan(struct hci_dev *hdev)
        if (!test_bit(HCI_UP, &hdev->flags) ||
            test_bit(HCI_INIT, &hdev->flags) ||
            test_bit(HCI_SETUP, &hdev->dev_flags) ||
+           test_bit(HCI_CONFIG, &hdev->dev_flags) ||
            test_bit(HCI_AUTO_OFF, &hdev->dev_flags) ||
            test_bit(HCI_UNREGISTER, &hdev->dev_flags))
                return;
 
+       /* No point in doing scanning if LE support hasn't been enabled */
+       if (!test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
+               return;
+
+       /* If discovery is active don't interfere with it */
+       if (hdev->discovery.state != DISCOVERY_STOPPED)
+               return;
+
        hci_req_init(&req, hdev);
 
-       if (list_empty(&hdev->pend_le_conns)) {
-               /* If there is no pending LE connections, we should stop
-                * the background scanning.
+       if (!test_bit(HCI_CONNECTABLE, &hdev->dev_flags) &&
+           list_empty(&hdev->pend_le_conns) &&
+           list_empty(&hdev->pend_le_reports)) {
+               /* If there is no pending LE connections or devices
+                * to be scanned for, we should stop the background
+                * scanning.
                 */
 
                /* If controller is not scanning we are done. */