]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/bluetooth/hci_core.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Bluetooth: Convert hci_cb_list_lock to a mutex
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_core.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2011 ProFUSION Embedded Systems
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth HCI core. */
27
28 #include <linux/export.h>
29 #include <linux/idr.h>
30 #include <linux/rfkill.h>
31 #include <linux/debugfs.h>
32 #include <linux/crypto.h>
33 #include <asm/unaligned.h>
34
35 #include <net/bluetooth/bluetooth.h>
36 #include <net/bluetooth/hci_core.h>
37 #include <net/bluetooth/l2cap.h>
38 #include <net/bluetooth/mgmt.h>
39
40 #include "hci_request.h"
41 #include "hci_debugfs.h"
42 #include "smp.h"
43
44 static void hci_rx_work(struct work_struct *work);
45 static void hci_cmd_work(struct work_struct *work);
46 static void hci_tx_work(struct work_struct *work);
47
48 /* HCI device list */
49 LIST_HEAD(hci_dev_list);
50 DEFINE_RWLOCK(hci_dev_list_lock);
51
52 /* HCI callback list */
53 LIST_HEAD(hci_cb_list);
54 DEFINE_MUTEX(hci_cb_list_lock);
55
56 /* HCI ID Numbering */
57 static DEFINE_IDA(hci_index_ida);
58
59 /* ----- HCI requests ----- */
60
61 #define HCI_REQ_DONE 0
62 #define HCI_REQ_PEND 1
63 #define HCI_REQ_CANCELED 2
64
65 #define hci_req_lock(d) mutex_lock(&d->req_lock)
66 #define hci_req_unlock(d) mutex_unlock(&d->req_lock)
67
68 /* ---- HCI notifications ---- */
69
70 static void hci_notify(struct hci_dev *hdev, int event)
71 {
72 hci_sock_dev_event(hdev, event);
73 }
74
75 /* ---- HCI debugfs entries ---- */
76
77 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
78 size_t count, loff_t *ppos)
79 {
80 struct hci_dev *hdev = file->private_data;
81 char buf[3];
82
83 buf[0] = test_bit(HCI_DUT_MODE, &hdev->dbg_flags) ? 'Y': 'N';
84 buf[1] = '\n';
85 buf[2] = '\0';
86 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
87 }
88
89 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
90 size_t count, loff_t *ppos)
91 {
92 struct hci_dev *hdev = file->private_data;
93 struct sk_buff *skb;
94 char buf[32];
95 size_t buf_size = min(count, (sizeof(buf)-1));
96 bool enable;
97 int err;
98
99 if (!test_bit(HCI_UP, &hdev->flags))
100 return -ENETDOWN;
101
102 if (copy_from_user(buf, user_buf, buf_size))
103 return -EFAULT;
104
105 buf[buf_size] = '\0';
106 if (strtobool(buf, &enable))
107 return -EINVAL;
108
109 if (enable == test_bit(HCI_DUT_MODE, &hdev->dbg_flags))
110 return -EALREADY;
111
112 hci_req_lock(hdev);
113 if (enable)
114 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
115 HCI_CMD_TIMEOUT);
116 else
117 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
118 HCI_CMD_TIMEOUT);
119 hci_req_unlock(hdev);
120
121 if (IS_ERR(skb))
122 return PTR_ERR(skb);
123
124 err = -bt_to_errno(skb->data[0]);
125 kfree_skb(skb);
126
127 if (err < 0)
128 return err;
129
130 change_bit(HCI_DUT_MODE, &hdev->dbg_flags);
131
132 return count;
133 }
134
135 static const struct file_operations dut_mode_fops = {
136 .open = simple_open,
137 .read = dut_mode_read,
138 .write = dut_mode_write,
139 .llseek = default_llseek,
140 };
141
142 /* ---- HCI requests ---- */
143
144 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode)
145 {
146 BT_DBG("%s result 0x%2.2x", hdev->name, result);
147
148 if (hdev->req_status == HCI_REQ_PEND) {
149 hdev->req_result = result;
150 hdev->req_status = HCI_REQ_DONE;
151 wake_up_interruptible(&hdev->req_wait_q);
152 }
153 }
154
155 static void hci_req_cancel(struct hci_dev *hdev, int err)
156 {
157 BT_DBG("%s err 0x%2.2x", hdev->name, err);
158
159 if (hdev->req_status == HCI_REQ_PEND) {
160 hdev->req_result = err;
161 hdev->req_status = HCI_REQ_CANCELED;
162 wake_up_interruptible(&hdev->req_wait_q);
163 }
164 }
165
166 static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
167 u8 event)
168 {
169 struct hci_ev_cmd_complete *ev;
170 struct hci_event_hdr *hdr;
171 struct sk_buff *skb;
172
173 hci_dev_lock(hdev);
174
175 skb = hdev->recv_evt;
176 hdev->recv_evt = NULL;
177
178 hci_dev_unlock(hdev);
179
180 if (!skb)
181 return ERR_PTR(-ENODATA);
182
183 if (skb->len < sizeof(*hdr)) {
184 BT_ERR("Too short HCI event");
185 goto failed;
186 }
187
188 hdr = (void *) skb->data;
189 skb_pull(skb, HCI_EVENT_HDR_SIZE);
190
191 if (event) {
192 if (hdr->evt != event)
193 goto failed;
194 return skb;
195 }
196
197 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
198 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
199 goto failed;
200 }
201
202 if (skb->len < sizeof(*ev)) {
203 BT_ERR("Too short cmd_complete event");
204 goto failed;
205 }
206
207 ev = (void *) skb->data;
208 skb_pull(skb, sizeof(*ev));
209
210 if (opcode == __le16_to_cpu(ev->opcode))
211 return skb;
212
213 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
214 __le16_to_cpu(ev->opcode));
215
216 failed:
217 kfree_skb(skb);
218 return ERR_PTR(-ENODATA);
219 }
220
221 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
222 const void *param, u8 event, u32 timeout)
223 {
224 DECLARE_WAITQUEUE(wait, current);
225 struct hci_request req;
226 int err = 0;
227
228 BT_DBG("%s", hdev->name);
229
230 hci_req_init(&req, hdev);
231
232 hci_req_add_ev(&req, opcode, plen, param, event);
233
234 hdev->req_status = HCI_REQ_PEND;
235
236 add_wait_queue(&hdev->req_wait_q, &wait);
237 set_current_state(TASK_INTERRUPTIBLE);
238
239 err = hci_req_run(&req, hci_req_sync_complete);
240 if (err < 0) {
241 remove_wait_queue(&hdev->req_wait_q, &wait);
242 set_current_state(TASK_RUNNING);
243 return ERR_PTR(err);
244 }
245
246 schedule_timeout(timeout);
247
248 remove_wait_queue(&hdev->req_wait_q, &wait);
249
250 if (signal_pending(current))
251 return ERR_PTR(-EINTR);
252
253 switch (hdev->req_status) {
254 case HCI_REQ_DONE:
255 err = -bt_to_errno(hdev->req_result);
256 break;
257
258 case HCI_REQ_CANCELED:
259 err = -hdev->req_result;
260 break;
261
262 default:
263 err = -ETIMEDOUT;
264 break;
265 }
266
267 hdev->req_status = hdev->req_result = 0;
268
269 BT_DBG("%s end: err %d", hdev->name, err);
270
271 if (err < 0)
272 return ERR_PTR(err);
273
274 return hci_get_cmd_complete(hdev, opcode, event);
275 }
276 EXPORT_SYMBOL(__hci_cmd_sync_ev);
277
278 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
279 const void *param, u32 timeout)
280 {
281 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
282 }
283 EXPORT_SYMBOL(__hci_cmd_sync);
284
285 /* Execute request and wait for completion. */
286 static int __hci_req_sync(struct hci_dev *hdev,
287 void (*func)(struct hci_request *req,
288 unsigned long opt),
289 unsigned long opt, __u32 timeout)
290 {
291 struct hci_request req;
292 DECLARE_WAITQUEUE(wait, current);
293 int err = 0;
294
295 BT_DBG("%s start", hdev->name);
296
297 hci_req_init(&req, hdev);
298
299 hdev->req_status = HCI_REQ_PEND;
300
301 func(&req, opt);
302
303 add_wait_queue(&hdev->req_wait_q, &wait);
304 set_current_state(TASK_INTERRUPTIBLE);
305
306 err = hci_req_run(&req, hci_req_sync_complete);
307 if (err < 0) {
308 hdev->req_status = 0;
309
310 remove_wait_queue(&hdev->req_wait_q, &wait);
311 set_current_state(TASK_RUNNING);
312
313 /* ENODATA means the HCI request command queue is empty.
314 * This can happen when a request with conditionals doesn't
315 * trigger any commands to be sent. This is normal behavior
316 * and should not trigger an error return.
317 */
318 if (err == -ENODATA)
319 return 0;
320
321 return err;
322 }
323
324 schedule_timeout(timeout);
325
326 remove_wait_queue(&hdev->req_wait_q, &wait);
327
328 if (signal_pending(current))
329 return -EINTR;
330
331 switch (hdev->req_status) {
332 case HCI_REQ_DONE:
333 err = -bt_to_errno(hdev->req_result);
334 break;
335
336 case HCI_REQ_CANCELED:
337 err = -hdev->req_result;
338 break;
339
340 default:
341 err = -ETIMEDOUT;
342 break;
343 }
344
345 hdev->req_status = hdev->req_result = 0;
346
347 BT_DBG("%s end: err %d", hdev->name, err);
348
349 return err;
350 }
351
352 static int hci_req_sync(struct hci_dev *hdev,
353 void (*req)(struct hci_request *req,
354 unsigned long opt),
355 unsigned long opt, __u32 timeout)
356 {
357 int ret;
358
359 if (!test_bit(HCI_UP, &hdev->flags))
360 return -ENETDOWN;
361
362 /* Serialize all requests */
363 hci_req_lock(hdev);
364 ret = __hci_req_sync(hdev, req, opt, timeout);
365 hci_req_unlock(hdev);
366
367 return ret;
368 }
369
370 static void hci_reset_req(struct hci_request *req, unsigned long opt)
371 {
372 BT_DBG("%s %ld", req->hdev->name, opt);
373
374 /* Reset device */
375 set_bit(HCI_RESET, &req->hdev->flags);
376 hci_req_add(req, HCI_OP_RESET, 0, NULL);
377 }
378
379 static void bredr_init(struct hci_request *req)
380 {
381 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
382
383 /* Read Local Supported Features */
384 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
385
386 /* Read Local Version */
387 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
388
389 /* Read BD Address */
390 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
391 }
392
393 static void amp_init1(struct hci_request *req)
394 {
395 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
396
397 /* Read Local Version */
398 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
399
400 /* Read Local Supported Commands */
401 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
402
403 /* Read Local AMP Info */
404 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
405
406 /* Read Data Blk size */
407 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
408
409 /* Read Flow Control Mode */
410 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
411
412 /* Read Location Data */
413 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
414 }
415
416 static void amp_init2(struct hci_request *req)
417 {
418 /* Read Local Supported Features. Not all AMP controllers
419 * support this so it's placed conditionally in the second
420 * stage init.
421 */
422 if (req->hdev->commands[14] & 0x20)
423 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
424 }
425
426 static void hci_init1_req(struct hci_request *req, unsigned long opt)
427 {
428 struct hci_dev *hdev = req->hdev;
429
430 BT_DBG("%s %ld", hdev->name, opt);
431
432 /* Reset */
433 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
434 hci_reset_req(req, 0);
435
436 switch (hdev->dev_type) {
437 case HCI_BREDR:
438 bredr_init(req);
439 break;
440
441 case HCI_AMP:
442 amp_init1(req);
443 break;
444
445 default:
446 BT_ERR("Unknown device type %d", hdev->dev_type);
447 break;
448 }
449 }
450
451 static void bredr_setup(struct hci_request *req)
452 {
453 __le16 param;
454 __u8 flt_type;
455
456 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
457 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
458
459 /* Read Class of Device */
460 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
461
462 /* Read Local Name */
463 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
464
465 /* Read Voice Setting */
466 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
467
468 /* Read Number of Supported IAC */
469 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
470
471 /* Read Current IAC LAP */
472 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
473
474 /* Clear Event Filters */
475 flt_type = HCI_FLT_CLEAR_ALL;
476 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
477
478 /* Connection accept timeout ~20 secs */
479 param = cpu_to_le16(0x7d00);
480 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
481 }
482
483 static void le_setup(struct hci_request *req)
484 {
485 struct hci_dev *hdev = req->hdev;
486
487 /* Read LE Buffer Size */
488 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
489
490 /* Read LE Local Supported Features */
491 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
492
493 /* Read LE Supported States */
494 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
495
496 /* Read LE White List Size */
497 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
498
499 /* Clear LE White List */
500 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
501
502 /* LE-only controllers have LE implicitly enabled */
503 if (!lmp_bredr_capable(hdev))
504 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
505 }
506
507 static void hci_setup_event_mask(struct hci_request *req)
508 {
509 struct hci_dev *hdev = req->hdev;
510
511 /* The second byte is 0xff instead of 0x9f (two reserved bits
512 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
513 * command otherwise.
514 */
515 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
516
517 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
518 * any event mask for pre 1.2 devices.
519 */
520 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
521 return;
522
523 if (lmp_bredr_capable(hdev)) {
524 events[4] |= 0x01; /* Flow Specification Complete */
525 events[4] |= 0x02; /* Inquiry Result with RSSI */
526 events[4] |= 0x04; /* Read Remote Extended Features Complete */
527 events[5] |= 0x08; /* Synchronous Connection Complete */
528 events[5] |= 0x10; /* Synchronous Connection Changed */
529 } else {
530 /* Use a different default for LE-only devices */
531 memset(events, 0, sizeof(events));
532 events[0] |= 0x10; /* Disconnection Complete */
533 events[1] |= 0x08; /* Read Remote Version Information Complete */
534 events[1] |= 0x20; /* Command Complete */
535 events[1] |= 0x40; /* Command Status */
536 events[1] |= 0x80; /* Hardware Error */
537 events[2] |= 0x04; /* Number of Completed Packets */
538 events[3] |= 0x02; /* Data Buffer Overflow */
539
540 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
541 events[0] |= 0x80; /* Encryption Change */
542 events[5] |= 0x80; /* Encryption Key Refresh Complete */
543 }
544 }
545
546 if (lmp_inq_rssi_capable(hdev))
547 events[4] |= 0x02; /* Inquiry Result with RSSI */
548
549 if (lmp_sniffsubr_capable(hdev))
550 events[5] |= 0x20; /* Sniff Subrating */
551
552 if (lmp_pause_enc_capable(hdev))
553 events[5] |= 0x80; /* Encryption Key Refresh Complete */
554
555 if (lmp_ext_inq_capable(hdev))
556 events[5] |= 0x40; /* Extended Inquiry Result */
557
558 if (lmp_no_flush_capable(hdev))
559 events[7] |= 0x01; /* Enhanced Flush Complete */
560
561 if (lmp_lsto_capable(hdev))
562 events[6] |= 0x80; /* Link Supervision Timeout Changed */
563
564 if (lmp_ssp_capable(hdev)) {
565 events[6] |= 0x01; /* IO Capability Request */
566 events[6] |= 0x02; /* IO Capability Response */
567 events[6] |= 0x04; /* User Confirmation Request */
568 events[6] |= 0x08; /* User Passkey Request */
569 events[6] |= 0x10; /* Remote OOB Data Request */
570 events[6] |= 0x20; /* Simple Pairing Complete */
571 events[7] |= 0x04; /* User Passkey Notification */
572 events[7] |= 0x08; /* Keypress Notification */
573 events[7] |= 0x10; /* Remote Host Supported
574 * Features Notification
575 */
576 }
577
578 if (lmp_le_capable(hdev))
579 events[7] |= 0x20; /* LE Meta-Event */
580
581 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
582 }
583
584 static void hci_init2_req(struct hci_request *req, unsigned long opt)
585 {
586 struct hci_dev *hdev = req->hdev;
587
588 if (hdev->dev_type == HCI_AMP)
589 return amp_init2(req);
590
591 if (lmp_bredr_capable(hdev))
592 bredr_setup(req);
593 else
594 clear_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
595
596 if (lmp_le_capable(hdev))
597 le_setup(req);
598
599 /* All Bluetooth 1.2 and later controllers should support the
600 * HCI command for reading the local supported commands.
601 *
602 * Unfortunately some controllers indicate Bluetooth 1.2 support,
603 * but do not have support for this command. If that is the case,
604 * the driver can quirk the behavior and skip reading the local
605 * supported commands.
606 */
607 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
608 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
609 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
610
611 if (lmp_ssp_capable(hdev)) {
612 /* When SSP is available, then the host features page
613 * should also be available as well. However some
614 * controllers list the max_page as 0 as long as SSP
615 * has not been enabled. To achieve proper debugging
616 * output, force the minimum max_page to 1 at least.
617 */
618 hdev->max_page = 0x01;
619
620 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
621 u8 mode = 0x01;
622
623 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
624 sizeof(mode), &mode);
625 } else {
626 struct hci_cp_write_eir cp;
627
628 memset(hdev->eir, 0, sizeof(hdev->eir));
629 memset(&cp, 0, sizeof(cp));
630
631 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
632 }
633 }
634
635 if (lmp_inq_rssi_capable(hdev) ||
636 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
637 u8 mode;
638
639 /* If Extended Inquiry Result events are supported, then
640 * they are clearly preferred over Inquiry Result with RSSI
641 * events.
642 */
643 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
644
645 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
646 }
647
648 if (lmp_inq_tx_pwr_capable(hdev))
649 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
650
651 if (lmp_ext_feat_capable(hdev)) {
652 struct hci_cp_read_local_ext_features cp;
653
654 cp.page = 0x01;
655 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
656 sizeof(cp), &cp);
657 }
658
659 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
660 u8 enable = 1;
661 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
662 &enable);
663 }
664 }
665
666 static void hci_setup_link_policy(struct hci_request *req)
667 {
668 struct hci_dev *hdev = req->hdev;
669 struct hci_cp_write_def_link_policy cp;
670 u16 link_policy = 0;
671
672 if (lmp_rswitch_capable(hdev))
673 link_policy |= HCI_LP_RSWITCH;
674 if (lmp_hold_capable(hdev))
675 link_policy |= HCI_LP_HOLD;
676 if (lmp_sniff_capable(hdev))
677 link_policy |= HCI_LP_SNIFF;
678 if (lmp_park_capable(hdev))
679 link_policy |= HCI_LP_PARK;
680
681 cp.policy = cpu_to_le16(link_policy);
682 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
683 }
684
685 static void hci_set_le_support(struct hci_request *req)
686 {
687 struct hci_dev *hdev = req->hdev;
688 struct hci_cp_write_le_host_supported cp;
689
690 /* LE-only devices do not support explicit enablement */
691 if (!lmp_bredr_capable(hdev))
692 return;
693
694 memset(&cp, 0, sizeof(cp));
695
696 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
697 cp.le = 0x01;
698 cp.simul = 0x00;
699 }
700
701 if (cp.le != lmp_host_le_capable(hdev))
702 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
703 &cp);
704 }
705
706 static void hci_set_event_mask_page_2(struct hci_request *req)
707 {
708 struct hci_dev *hdev = req->hdev;
709 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
710
711 /* If Connectionless Slave Broadcast master role is supported
712 * enable all necessary events for it.
713 */
714 if (lmp_csb_master_capable(hdev)) {
715 events[1] |= 0x40; /* Triggered Clock Capture */
716 events[1] |= 0x80; /* Synchronization Train Complete */
717 events[2] |= 0x10; /* Slave Page Response Timeout */
718 events[2] |= 0x20; /* CSB Channel Map Change */
719 }
720
721 /* If Connectionless Slave Broadcast slave role is supported
722 * enable all necessary events for it.
723 */
724 if (lmp_csb_slave_capable(hdev)) {
725 events[2] |= 0x01; /* Synchronization Train Received */
726 events[2] |= 0x02; /* CSB Receive */
727 events[2] |= 0x04; /* CSB Timeout */
728 events[2] |= 0x08; /* Truncated Page Complete */
729 }
730
731 /* Enable Authenticated Payload Timeout Expired event if supported */
732 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
733 events[2] |= 0x80;
734
735 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
736 }
737
738 static void hci_init3_req(struct hci_request *req, unsigned long opt)
739 {
740 struct hci_dev *hdev = req->hdev;
741 u8 p;
742
743 hci_setup_event_mask(req);
744
745 if (hdev->commands[6] & 0x20) {
746 struct hci_cp_read_stored_link_key cp;
747
748 bacpy(&cp.bdaddr, BDADDR_ANY);
749 cp.read_all = 0x01;
750 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
751 }
752
753 if (hdev->commands[5] & 0x10)
754 hci_setup_link_policy(req);
755
756 if (hdev->commands[8] & 0x01)
757 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
758
759 /* Some older Broadcom based Bluetooth 1.2 controllers do not
760 * support the Read Page Scan Type command. Check support for
761 * this command in the bit mask of supported commands.
762 */
763 if (hdev->commands[13] & 0x01)
764 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
765
766 if (lmp_le_capable(hdev)) {
767 u8 events[8];
768
769 memset(events, 0, sizeof(events));
770 events[0] = 0x0f;
771
772 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
773 events[0] |= 0x10; /* LE Long Term Key Request */
774
775 /* If controller supports the Connection Parameters Request
776 * Link Layer Procedure, enable the corresponding event.
777 */
778 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
779 events[0] |= 0x20; /* LE Remote Connection
780 * Parameter Request
781 */
782
783 /* If the controller supports the Data Length Extension
784 * feature, enable the corresponding event.
785 */
786 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
787 events[0] |= 0x40; /* LE Data Length Change */
788
789 /* If the controller supports Extended Scanner Filter
790 * Policies, enable the correspondig event.
791 */
792 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
793 events[1] |= 0x04; /* LE Direct Advertising
794 * Report
795 */
796
797 /* If the controller supports the LE Read Local P-256
798 * Public Key command, enable the corresponding event.
799 */
800 if (hdev->commands[34] & 0x02)
801 events[0] |= 0x80; /* LE Read Local P-256
802 * Public Key Complete
803 */
804
805 /* If the controller supports the LE Generate DHKey
806 * command, enable the corresponding event.
807 */
808 if (hdev->commands[34] & 0x04)
809 events[1] |= 0x01; /* LE Generate DHKey Complete */
810
811 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
812 events);
813
814 if (hdev->commands[25] & 0x40) {
815 /* Read LE Advertising Channel TX Power */
816 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
817 }
818
819 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
820 /* Read LE Maximum Data Length */
821 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
822
823 /* Read LE Suggested Default Data Length */
824 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
825 }
826
827 hci_set_le_support(req);
828 }
829
830 /* Read features beyond page 1 if available */
831 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
832 struct hci_cp_read_local_ext_features cp;
833
834 cp.page = p;
835 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
836 sizeof(cp), &cp);
837 }
838 }
839
840 static void hci_init4_req(struct hci_request *req, unsigned long opt)
841 {
842 struct hci_dev *hdev = req->hdev;
843
844 /* Some Broadcom based Bluetooth controllers do not support the
845 * Delete Stored Link Key command. They are clearly indicating its
846 * absence in the bit mask of supported commands.
847 *
848 * Check the supported commands and only if the the command is marked
849 * as supported send it. If not supported assume that the controller
850 * does not have actual support for stored link keys which makes this
851 * command redundant anyway.
852 *
853 * Some controllers indicate that they support handling deleting
854 * stored link keys, but they don't. The quirk lets a driver
855 * just disable this command.
856 */
857 if (hdev->commands[6] & 0x80 &&
858 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
859 struct hci_cp_delete_stored_link_key cp;
860
861 bacpy(&cp.bdaddr, BDADDR_ANY);
862 cp.delete_all = 0x01;
863 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
864 sizeof(cp), &cp);
865 }
866
867 /* Set event mask page 2 if the HCI command for it is supported */
868 if (hdev->commands[22] & 0x04)
869 hci_set_event_mask_page_2(req);
870
871 /* Read local codec list if the HCI command is supported */
872 if (hdev->commands[29] & 0x20)
873 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
874
875 /* Get MWS transport configuration if the HCI command is supported */
876 if (hdev->commands[30] & 0x08)
877 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
878
879 /* Check for Synchronization Train support */
880 if (lmp_sync_train_capable(hdev))
881 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
882
883 /* Enable Secure Connections if supported and configured */
884 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags) &&
885 bredr_sc_enabled(hdev)) {
886 u8 support = 0x01;
887
888 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
889 sizeof(support), &support);
890 }
891 }
892
893 static int __hci_init(struct hci_dev *hdev)
894 {
895 int err;
896
897 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
898 if (err < 0)
899 return err;
900
901 /* The Device Under Test (DUT) mode is special and available for
902 * all controller types. So just create it early on.
903 */
904 if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
905 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
906 &dut_mode_fops);
907 }
908
909 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
910 if (err < 0)
911 return err;
912
913 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
914 * BR/EDR/LE type controllers. AMP controllers only need the
915 * first two stages of init.
916 */
917 if (hdev->dev_type != HCI_BREDR)
918 return 0;
919
920 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
921 if (err < 0)
922 return err;
923
924 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
925 if (err < 0)
926 return err;
927
928 /* This function is only called when the controller is actually in
929 * configured state. When the controller is marked as unconfigured,
930 * this initialization procedure is not run.
931 *
932 * It means that it is possible that a controller runs through its
933 * setup phase and then discovers missing settings. If that is the
934 * case, then this function will not be called. It then will only
935 * be called during the config phase.
936 *
937 * So only when in setup phase or config phase, create the debugfs
938 * entries and register the SMP channels.
939 */
940 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
941 !test_bit(HCI_CONFIG, &hdev->dev_flags))
942 return 0;
943
944 hci_debugfs_create_common(hdev);
945
946 if (lmp_bredr_capable(hdev))
947 hci_debugfs_create_bredr(hdev);
948
949 if (lmp_le_capable(hdev))
950 hci_debugfs_create_le(hdev);
951
952 return 0;
953 }
954
955 static void hci_init0_req(struct hci_request *req, unsigned long opt)
956 {
957 struct hci_dev *hdev = req->hdev;
958
959 BT_DBG("%s %ld", hdev->name, opt);
960
961 /* Reset */
962 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
963 hci_reset_req(req, 0);
964
965 /* Read Local Version */
966 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
967
968 /* Read BD Address */
969 if (hdev->set_bdaddr)
970 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
971 }
972
973 static int __hci_unconf_init(struct hci_dev *hdev)
974 {
975 int err;
976
977 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
978 return 0;
979
980 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT);
981 if (err < 0)
982 return err;
983
984 return 0;
985 }
986
987 static void hci_scan_req(struct hci_request *req, unsigned long opt)
988 {
989 __u8 scan = opt;
990
991 BT_DBG("%s %x", req->hdev->name, scan);
992
993 /* Inquiry and Page scans */
994 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
995 }
996
997 static void hci_auth_req(struct hci_request *req, unsigned long opt)
998 {
999 __u8 auth = opt;
1000
1001 BT_DBG("%s %x", req->hdev->name, auth);
1002
1003 /* Authentication */
1004 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1005 }
1006
1007 static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
1008 {
1009 __u8 encrypt = opt;
1010
1011 BT_DBG("%s %x", req->hdev->name, encrypt);
1012
1013 /* Encryption */
1014 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1015 }
1016
1017 static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
1018 {
1019 __le16 policy = cpu_to_le16(opt);
1020
1021 BT_DBG("%s %x", req->hdev->name, policy);
1022
1023 /* Default link policy */
1024 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
1025 }
1026
1027 /* Get HCI device by index.
1028 * Device is held on return. */
1029 struct hci_dev *hci_dev_get(int index)
1030 {
1031 struct hci_dev *hdev = NULL, *d;
1032
1033 BT_DBG("%d", index);
1034
1035 if (index < 0)
1036 return NULL;
1037
1038 read_lock(&hci_dev_list_lock);
1039 list_for_each_entry(d, &hci_dev_list, list) {
1040 if (d->id == index) {
1041 hdev = hci_dev_hold(d);
1042 break;
1043 }
1044 }
1045 read_unlock(&hci_dev_list_lock);
1046 return hdev;
1047 }
1048
1049 /* ---- Inquiry support ---- */
1050
1051 bool hci_discovery_active(struct hci_dev *hdev)
1052 {
1053 struct discovery_state *discov = &hdev->discovery;
1054
1055 switch (discov->state) {
1056 case DISCOVERY_FINDING:
1057 case DISCOVERY_RESOLVING:
1058 return true;
1059
1060 default:
1061 return false;
1062 }
1063 }
1064
1065 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1066 {
1067 int old_state = hdev->discovery.state;
1068
1069 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1070
1071 if (old_state == state)
1072 return;
1073
1074 hdev->discovery.state = state;
1075
1076 switch (state) {
1077 case DISCOVERY_STOPPED:
1078 hci_update_background_scan(hdev);
1079
1080 if (old_state != DISCOVERY_STARTING)
1081 mgmt_discovering(hdev, 0);
1082 break;
1083 case DISCOVERY_STARTING:
1084 break;
1085 case DISCOVERY_FINDING:
1086 mgmt_discovering(hdev, 1);
1087 break;
1088 case DISCOVERY_RESOLVING:
1089 break;
1090 case DISCOVERY_STOPPING:
1091 break;
1092 }
1093 }
1094
1095 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1096 {
1097 struct discovery_state *cache = &hdev->discovery;
1098 struct inquiry_entry *p, *n;
1099
1100 list_for_each_entry_safe(p, n, &cache->all, all) {
1101 list_del(&p->all);
1102 kfree(p);
1103 }
1104
1105 INIT_LIST_HEAD(&cache->unknown);
1106 INIT_LIST_HEAD(&cache->resolve);
1107 }
1108
1109 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1110 bdaddr_t *bdaddr)
1111 {
1112 struct discovery_state *cache = &hdev->discovery;
1113 struct inquiry_entry *e;
1114
1115 BT_DBG("cache %p, %pMR", cache, bdaddr);
1116
1117 list_for_each_entry(e, &cache->all, all) {
1118 if (!bacmp(&e->data.bdaddr, bdaddr))
1119 return e;
1120 }
1121
1122 return NULL;
1123 }
1124
1125 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1126 bdaddr_t *bdaddr)
1127 {
1128 struct discovery_state *cache = &hdev->discovery;
1129 struct inquiry_entry *e;
1130
1131 BT_DBG("cache %p, %pMR", cache, bdaddr);
1132
1133 list_for_each_entry(e, &cache->unknown, list) {
1134 if (!bacmp(&e->data.bdaddr, bdaddr))
1135 return e;
1136 }
1137
1138 return NULL;
1139 }
1140
1141 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1142 bdaddr_t *bdaddr,
1143 int state)
1144 {
1145 struct discovery_state *cache = &hdev->discovery;
1146 struct inquiry_entry *e;
1147
1148 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1149
1150 list_for_each_entry(e, &cache->resolve, list) {
1151 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1152 return e;
1153 if (!bacmp(&e->data.bdaddr, bdaddr))
1154 return e;
1155 }
1156
1157 return NULL;
1158 }
1159
1160 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1161 struct inquiry_entry *ie)
1162 {
1163 struct discovery_state *cache = &hdev->discovery;
1164 struct list_head *pos = &cache->resolve;
1165 struct inquiry_entry *p;
1166
1167 list_del(&ie->list);
1168
1169 list_for_each_entry(p, &cache->resolve, list) {
1170 if (p->name_state != NAME_PENDING &&
1171 abs(p->data.rssi) >= abs(ie->data.rssi))
1172 break;
1173 pos = &p->list;
1174 }
1175
1176 list_add(&ie->list, pos);
1177 }
1178
1179 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1180 bool name_known)
1181 {
1182 struct discovery_state *cache = &hdev->discovery;
1183 struct inquiry_entry *ie;
1184 u32 flags = 0;
1185
1186 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1187
1188 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1189
1190 if (!data->ssp_mode)
1191 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1192
1193 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1194 if (ie) {
1195 if (!ie->data.ssp_mode)
1196 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1197
1198 if (ie->name_state == NAME_NEEDED &&
1199 data->rssi != ie->data.rssi) {
1200 ie->data.rssi = data->rssi;
1201 hci_inquiry_cache_update_resolve(hdev, ie);
1202 }
1203
1204 goto update;
1205 }
1206
1207 /* Entry not in the cache. Add new one. */
1208 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1209 if (!ie) {
1210 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1211 goto done;
1212 }
1213
1214 list_add(&ie->all, &cache->all);
1215
1216 if (name_known) {
1217 ie->name_state = NAME_KNOWN;
1218 } else {
1219 ie->name_state = NAME_NOT_KNOWN;
1220 list_add(&ie->list, &cache->unknown);
1221 }
1222
1223 update:
1224 if (name_known && ie->name_state != NAME_KNOWN &&
1225 ie->name_state != NAME_PENDING) {
1226 ie->name_state = NAME_KNOWN;
1227 list_del(&ie->list);
1228 }
1229
1230 memcpy(&ie->data, data, sizeof(*data));
1231 ie->timestamp = jiffies;
1232 cache->timestamp = jiffies;
1233
1234 if (ie->name_state == NAME_NOT_KNOWN)
1235 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1236
1237 done:
1238 return flags;
1239 }
1240
1241 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1242 {
1243 struct discovery_state *cache = &hdev->discovery;
1244 struct inquiry_info *info = (struct inquiry_info *) buf;
1245 struct inquiry_entry *e;
1246 int copied = 0;
1247
1248 list_for_each_entry(e, &cache->all, all) {
1249 struct inquiry_data *data = &e->data;
1250
1251 if (copied >= num)
1252 break;
1253
1254 bacpy(&info->bdaddr, &data->bdaddr);
1255 info->pscan_rep_mode = data->pscan_rep_mode;
1256 info->pscan_period_mode = data->pscan_period_mode;
1257 info->pscan_mode = data->pscan_mode;
1258 memcpy(info->dev_class, data->dev_class, 3);
1259 info->clock_offset = data->clock_offset;
1260
1261 info++;
1262 copied++;
1263 }
1264
1265 BT_DBG("cache %p, copied %d", cache, copied);
1266 return copied;
1267 }
1268
1269 static void hci_inq_req(struct hci_request *req, unsigned long opt)
1270 {
1271 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1272 struct hci_dev *hdev = req->hdev;
1273 struct hci_cp_inquiry cp;
1274
1275 BT_DBG("%s", hdev->name);
1276
1277 if (test_bit(HCI_INQUIRY, &hdev->flags))
1278 return;
1279
1280 /* Start Inquiry */
1281 memcpy(&cp.lap, &ir->lap, 3);
1282 cp.length = ir->length;
1283 cp.num_rsp = ir->num_rsp;
1284 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1285 }
1286
1287 int hci_inquiry(void __user *arg)
1288 {
1289 __u8 __user *ptr = arg;
1290 struct hci_inquiry_req ir;
1291 struct hci_dev *hdev;
1292 int err = 0, do_inquiry = 0, max_rsp;
1293 long timeo;
1294 __u8 *buf;
1295
1296 if (copy_from_user(&ir, ptr, sizeof(ir)))
1297 return -EFAULT;
1298
1299 hdev = hci_dev_get(ir.dev_id);
1300 if (!hdev)
1301 return -ENODEV;
1302
1303 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1304 err = -EBUSY;
1305 goto done;
1306 }
1307
1308 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
1309 err = -EOPNOTSUPP;
1310 goto done;
1311 }
1312
1313 if (hdev->dev_type != HCI_BREDR) {
1314 err = -EOPNOTSUPP;
1315 goto done;
1316 }
1317
1318 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1319 err = -EOPNOTSUPP;
1320 goto done;
1321 }
1322
1323 hci_dev_lock(hdev);
1324 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1325 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1326 hci_inquiry_cache_flush(hdev);
1327 do_inquiry = 1;
1328 }
1329 hci_dev_unlock(hdev);
1330
1331 timeo = ir.length * msecs_to_jiffies(2000);
1332
1333 if (do_inquiry) {
1334 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1335 timeo);
1336 if (err < 0)
1337 goto done;
1338
1339 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1340 * cleared). If it is interrupted by a signal, return -EINTR.
1341 */
1342 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1343 TASK_INTERRUPTIBLE))
1344 return -EINTR;
1345 }
1346
1347 /* for unlimited number of responses we will use buffer with
1348 * 255 entries
1349 */
1350 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1351
1352 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1353 * copy it to the user space.
1354 */
1355 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
1356 if (!buf) {
1357 err = -ENOMEM;
1358 goto done;
1359 }
1360
1361 hci_dev_lock(hdev);
1362 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1363 hci_dev_unlock(hdev);
1364
1365 BT_DBG("num_rsp %d", ir.num_rsp);
1366
1367 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1368 ptr += sizeof(ir);
1369 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1370 ir.num_rsp))
1371 err = -EFAULT;
1372 } else
1373 err = -EFAULT;
1374
1375 kfree(buf);
1376
1377 done:
1378 hci_dev_put(hdev);
1379 return err;
1380 }
1381
1382 static int hci_dev_do_open(struct hci_dev *hdev)
1383 {
1384 int ret = 0;
1385
1386 BT_DBG("%s %p", hdev->name, hdev);
1387
1388 hci_req_lock(hdev);
1389
1390 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
1391 ret = -ENODEV;
1392 goto done;
1393 }
1394
1395 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
1396 !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
1397 /* Check for rfkill but allow the HCI setup stage to
1398 * proceed (which in itself doesn't cause any RF activity).
1399 */
1400 if (test_bit(HCI_RFKILLED, &hdev->dev_flags)) {
1401 ret = -ERFKILL;
1402 goto done;
1403 }
1404
1405 /* Check for valid public address or a configured static
1406 * random adddress, but let the HCI setup proceed to
1407 * be able to determine if there is a public address
1408 * or not.
1409 *
1410 * In case of user channel usage, it is not important
1411 * if a public address or static random address is
1412 * available.
1413 *
1414 * This check is only valid for BR/EDR controllers
1415 * since AMP controllers do not have an address.
1416 */
1417 if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
1418 hdev->dev_type == HCI_BREDR &&
1419 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1420 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1421 ret = -EADDRNOTAVAIL;
1422 goto done;
1423 }
1424 }
1425
1426 if (test_bit(HCI_UP, &hdev->flags)) {
1427 ret = -EALREADY;
1428 goto done;
1429 }
1430
1431 if (hdev->open(hdev)) {
1432 ret = -EIO;
1433 goto done;
1434 }
1435
1436 atomic_set(&hdev->cmd_cnt, 1);
1437 set_bit(HCI_INIT, &hdev->flags);
1438
1439 if (test_bit(HCI_SETUP, &hdev->dev_flags)) {
1440 if (hdev->setup)
1441 ret = hdev->setup(hdev);
1442
1443 /* The transport driver can set these quirks before
1444 * creating the HCI device or in its setup callback.
1445 *
1446 * In case any of them is set, the controller has to
1447 * start up as unconfigured.
1448 */
1449 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1450 test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
1451 set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
1452
1453 /* For an unconfigured controller it is required to
1454 * read at least the version information provided by
1455 * the Read Local Version Information command.
1456 *
1457 * If the set_bdaddr driver callback is provided, then
1458 * also the original Bluetooth public device address
1459 * will be read using the Read BD Address command.
1460 */
1461 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
1462 ret = __hci_unconf_init(hdev);
1463 }
1464
1465 if (test_bit(HCI_CONFIG, &hdev->dev_flags)) {
1466 /* If public address change is configured, ensure that
1467 * the address gets programmed. If the driver does not
1468 * support changing the public address, fail the power
1469 * on procedure.
1470 */
1471 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1472 hdev->set_bdaddr)
1473 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1474 else
1475 ret = -EADDRNOTAVAIL;
1476 }
1477
1478 if (!ret) {
1479 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
1480 !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
1481 ret = __hci_init(hdev);
1482 }
1483
1484 clear_bit(HCI_INIT, &hdev->flags);
1485
1486 if (!ret) {
1487 hci_dev_hold(hdev);
1488 set_bit(HCI_RPA_EXPIRED, &hdev->dev_flags);
1489 set_bit(HCI_UP, &hdev->flags);
1490 hci_notify(hdev, HCI_DEV_UP);
1491 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
1492 !test_bit(HCI_CONFIG, &hdev->dev_flags) &&
1493 !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
1494 !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
1495 hdev->dev_type == HCI_BREDR) {
1496 hci_dev_lock(hdev);
1497 mgmt_powered(hdev, 1);
1498 hci_dev_unlock(hdev);
1499 }
1500 } else {
1501 /* Init failed, cleanup */
1502 flush_work(&hdev->tx_work);
1503 flush_work(&hdev->cmd_work);
1504 flush_work(&hdev->rx_work);
1505
1506 skb_queue_purge(&hdev->cmd_q);
1507 skb_queue_purge(&hdev->rx_q);
1508
1509 if (hdev->flush)
1510 hdev->flush(hdev);
1511
1512 if (hdev->sent_cmd) {
1513 kfree_skb(hdev->sent_cmd);
1514 hdev->sent_cmd = NULL;
1515 }
1516
1517 hdev->close(hdev);
1518 hdev->flags &= BIT(HCI_RAW);
1519 }
1520
1521 done:
1522 hci_req_unlock(hdev);
1523 return ret;
1524 }
1525
1526 /* ---- HCI ioctl helpers ---- */
1527
1528 int hci_dev_open(__u16 dev)
1529 {
1530 struct hci_dev *hdev;
1531 int err;
1532
1533 hdev = hci_dev_get(dev);
1534 if (!hdev)
1535 return -ENODEV;
1536
1537 /* Devices that are marked as unconfigured can only be powered
1538 * up as user channel. Trying to bring them up as normal devices
1539 * will result into a failure. Only user channel operation is
1540 * possible.
1541 *
1542 * When this function is called for a user channel, the flag
1543 * HCI_USER_CHANNEL will be set first before attempting to
1544 * open the device.
1545 */
1546 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
1547 !test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1548 err = -EOPNOTSUPP;
1549 goto done;
1550 }
1551
1552 /* We need to ensure that no other power on/off work is pending
1553 * before proceeding to call hci_dev_do_open. This is
1554 * particularly important if the setup procedure has not yet
1555 * completed.
1556 */
1557 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1558 cancel_delayed_work(&hdev->power_off);
1559
1560 /* After this call it is guaranteed that the setup procedure
1561 * has finished. This means that error conditions like RFKILL
1562 * or no valid public or static random address apply.
1563 */
1564 flush_workqueue(hdev->req_workqueue);
1565
1566 /* For controllers not using the management interface and that
1567 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1568 * so that pairing works for them. Once the management interface
1569 * is in use this bit will be cleared again and userspace has
1570 * to explicitly enable it.
1571 */
1572 if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags) &&
1573 !test_bit(HCI_MGMT, &hdev->dev_flags))
1574 set_bit(HCI_BONDABLE, &hdev->dev_flags);
1575
1576 err = hci_dev_do_open(hdev);
1577
1578 done:
1579 hci_dev_put(hdev);
1580 return err;
1581 }
1582
1583 /* This function requires the caller holds hdev->lock */
1584 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1585 {
1586 struct hci_conn_params *p;
1587
1588 list_for_each_entry(p, &hdev->le_conn_params, list) {
1589 if (p->conn) {
1590 hci_conn_drop(p->conn);
1591 hci_conn_put(p->conn);
1592 p->conn = NULL;
1593 }
1594 list_del_init(&p->action);
1595 }
1596
1597 BT_DBG("All LE pending actions cleared");
1598 }
1599
1600 static int hci_dev_do_close(struct hci_dev *hdev)
1601 {
1602 BT_DBG("%s %p", hdev->name, hdev);
1603
1604 if (!test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
1605 /* Execute vendor specific shutdown routine */
1606 if (hdev->shutdown)
1607 hdev->shutdown(hdev);
1608 }
1609
1610 cancel_delayed_work(&hdev->power_off);
1611
1612 hci_req_cancel(hdev, ENODEV);
1613 hci_req_lock(hdev);
1614
1615 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1616 cancel_delayed_work_sync(&hdev->cmd_timer);
1617 hci_req_unlock(hdev);
1618 return 0;
1619 }
1620
1621 /* Flush RX and TX works */
1622 flush_work(&hdev->tx_work);
1623 flush_work(&hdev->rx_work);
1624
1625 if (hdev->discov_timeout > 0) {
1626 cancel_delayed_work(&hdev->discov_off);
1627 hdev->discov_timeout = 0;
1628 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1629 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1630 }
1631
1632 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1633 cancel_delayed_work(&hdev->service_cache);
1634
1635 cancel_delayed_work_sync(&hdev->le_scan_disable);
1636 cancel_delayed_work_sync(&hdev->le_scan_restart);
1637
1638 if (test_bit(HCI_MGMT, &hdev->dev_flags))
1639 cancel_delayed_work_sync(&hdev->rpa_expired);
1640
1641 /* Avoid potential lockdep warnings from the *_flush() calls by
1642 * ensuring the workqueue is empty up front.
1643 */
1644 drain_workqueue(hdev->workqueue);
1645
1646 hci_dev_lock(hdev);
1647
1648 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1649
1650 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
1651 if (hdev->dev_type == HCI_BREDR)
1652 mgmt_powered(hdev, 0);
1653 }
1654
1655 hci_inquiry_cache_flush(hdev);
1656 hci_pend_le_actions_clear(hdev);
1657 hci_conn_hash_flush(hdev);
1658 hci_dev_unlock(hdev);
1659
1660 smp_unregister(hdev);
1661
1662 hci_notify(hdev, HCI_DEV_DOWN);
1663
1664 if (hdev->flush)
1665 hdev->flush(hdev);
1666
1667 /* Reset device */
1668 skb_queue_purge(&hdev->cmd_q);
1669 atomic_set(&hdev->cmd_cnt, 1);
1670 if (!test_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
1671 !test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) &&
1672 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1673 set_bit(HCI_INIT, &hdev->flags);
1674 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1675 clear_bit(HCI_INIT, &hdev->flags);
1676 }
1677
1678 /* flush cmd work */
1679 flush_work(&hdev->cmd_work);
1680
1681 /* Drop queues */
1682 skb_queue_purge(&hdev->rx_q);
1683 skb_queue_purge(&hdev->cmd_q);
1684 skb_queue_purge(&hdev->raw_q);
1685
1686 /* Drop last sent command */
1687 if (hdev->sent_cmd) {
1688 cancel_delayed_work_sync(&hdev->cmd_timer);
1689 kfree_skb(hdev->sent_cmd);
1690 hdev->sent_cmd = NULL;
1691 }
1692
1693 kfree_skb(hdev->recv_evt);
1694 hdev->recv_evt = NULL;
1695
1696 /* After this point our queues are empty
1697 * and no tasks are scheduled. */
1698 hdev->close(hdev);
1699
1700 /* Clear flags */
1701 hdev->flags &= BIT(HCI_RAW);
1702 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
1703
1704 /* Controller radio is available but is currently powered down */
1705 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1706
1707 memset(hdev->eir, 0, sizeof(hdev->eir));
1708 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1709 bacpy(&hdev->random_addr, BDADDR_ANY);
1710
1711 hci_req_unlock(hdev);
1712
1713 hci_dev_put(hdev);
1714 return 0;
1715 }
1716
1717 int hci_dev_close(__u16 dev)
1718 {
1719 struct hci_dev *hdev;
1720 int err;
1721
1722 hdev = hci_dev_get(dev);
1723 if (!hdev)
1724 return -ENODEV;
1725
1726 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1727 err = -EBUSY;
1728 goto done;
1729 }
1730
1731 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1732 cancel_delayed_work(&hdev->power_off);
1733
1734 err = hci_dev_do_close(hdev);
1735
1736 done:
1737 hci_dev_put(hdev);
1738 return err;
1739 }
1740
1741 static int hci_dev_do_reset(struct hci_dev *hdev)
1742 {
1743 int ret;
1744
1745 BT_DBG("%s %p", hdev->name, hdev);
1746
1747 hci_req_lock(hdev);
1748
1749 /* Drop queues */
1750 skb_queue_purge(&hdev->rx_q);
1751 skb_queue_purge(&hdev->cmd_q);
1752
1753 /* Avoid potential lockdep warnings from the *_flush() calls by
1754 * ensuring the workqueue is empty up front.
1755 */
1756 drain_workqueue(hdev->workqueue);
1757
1758 hci_dev_lock(hdev);
1759 hci_inquiry_cache_flush(hdev);
1760 hci_conn_hash_flush(hdev);
1761 hci_dev_unlock(hdev);
1762
1763 if (hdev->flush)
1764 hdev->flush(hdev);
1765
1766 atomic_set(&hdev->cmd_cnt, 1);
1767 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1768
1769 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1770
1771 hci_req_unlock(hdev);
1772 return ret;
1773 }
1774
1775 int hci_dev_reset(__u16 dev)
1776 {
1777 struct hci_dev *hdev;
1778 int err;
1779
1780 hdev = hci_dev_get(dev);
1781 if (!hdev)
1782 return -ENODEV;
1783
1784 if (!test_bit(HCI_UP, &hdev->flags)) {
1785 err = -ENETDOWN;
1786 goto done;
1787 }
1788
1789 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1790 err = -EBUSY;
1791 goto done;
1792 }
1793
1794 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
1795 err = -EOPNOTSUPP;
1796 goto done;
1797 }
1798
1799 err = hci_dev_do_reset(hdev);
1800
1801 done:
1802 hci_dev_put(hdev);
1803 return err;
1804 }
1805
1806 int hci_dev_reset_stat(__u16 dev)
1807 {
1808 struct hci_dev *hdev;
1809 int ret = 0;
1810
1811 hdev = hci_dev_get(dev);
1812 if (!hdev)
1813 return -ENODEV;
1814
1815 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1816 ret = -EBUSY;
1817 goto done;
1818 }
1819
1820 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
1821 ret = -EOPNOTSUPP;
1822 goto done;
1823 }
1824
1825 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1826
1827 done:
1828 hci_dev_put(hdev);
1829 return ret;
1830 }
1831
1832 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1833 {
1834 bool conn_changed, discov_changed;
1835
1836 BT_DBG("%s scan 0x%02x", hdev->name, scan);
1837
1838 if ((scan & SCAN_PAGE))
1839 conn_changed = !test_and_set_bit(HCI_CONNECTABLE,
1840 &hdev->dev_flags);
1841 else
1842 conn_changed = test_and_clear_bit(HCI_CONNECTABLE,
1843 &hdev->dev_flags);
1844
1845 if ((scan & SCAN_INQUIRY)) {
1846 discov_changed = !test_and_set_bit(HCI_DISCOVERABLE,
1847 &hdev->dev_flags);
1848 } else {
1849 clear_bit(HCI_LIMITED_DISCOVERABLE, &hdev->dev_flags);
1850 discov_changed = test_and_clear_bit(HCI_DISCOVERABLE,
1851 &hdev->dev_flags);
1852 }
1853
1854 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1855 return;
1856
1857 if (conn_changed || discov_changed) {
1858 /* In case this was disabled through mgmt */
1859 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
1860
1861 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags))
1862 mgmt_update_adv_data(hdev);
1863
1864 mgmt_new_settings(hdev);
1865 }
1866 }
1867
1868 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1869 {
1870 struct hci_dev *hdev;
1871 struct hci_dev_req dr;
1872 int err = 0;
1873
1874 if (copy_from_user(&dr, arg, sizeof(dr)))
1875 return -EFAULT;
1876
1877 hdev = hci_dev_get(dr.dev_id);
1878 if (!hdev)
1879 return -ENODEV;
1880
1881 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
1882 err = -EBUSY;
1883 goto done;
1884 }
1885
1886 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
1887 err = -EOPNOTSUPP;
1888 goto done;
1889 }
1890
1891 if (hdev->dev_type != HCI_BREDR) {
1892 err = -EOPNOTSUPP;
1893 goto done;
1894 }
1895
1896 if (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags)) {
1897 err = -EOPNOTSUPP;
1898 goto done;
1899 }
1900
1901 switch (cmd) {
1902 case HCISETAUTH:
1903 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1904 HCI_INIT_TIMEOUT);
1905 break;
1906
1907 case HCISETENCRYPT:
1908 if (!lmp_encrypt_capable(hdev)) {
1909 err = -EOPNOTSUPP;
1910 break;
1911 }
1912
1913 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1914 /* Auth must be enabled first */
1915 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1916 HCI_INIT_TIMEOUT);
1917 if (err)
1918 break;
1919 }
1920
1921 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1922 HCI_INIT_TIMEOUT);
1923 break;
1924
1925 case HCISETSCAN:
1926 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1927 HCI_INIT_TIMEOUT);
1928
1929 /* Ensure that the connectable and discoverable states
1930 * get correctly modified as this was a non-mgmt change.
1931 */
1932 if (!err)
1933 hci_update_scan_state(hdev, dr.dev_opt);
1934 break;
1935
1936 case HCISETLINKPOL:
1937 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1938 HCI_INIT_TIMEOUT);
1939 break;
1940
1941 case HCISETLINKMODE:
1942 hdev->link_mode = ((__u16) dr.dev_opt) &
1943 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1944 break;
1945
1946 case HCISETPTYPE:
1947 hdev->pkt_type = (__u16) dr.dev_opt;
1948 break;
1949
1950 case HCISETACLMTU:
1951 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1952 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1953 break;
1954
1955 case HCISETSCOMTU:
1956 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1957 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1958 break;
1959
1960 default:
1961 err = -EINVAL;
1962 break;
1963 }
1964
1965 done:
1966 hci_dev_put(hdev);
1967 return err;
1968 }
1969
1970 int hci_get_dev_list(void __user *arg)
1971 {
1972 struct hci_dev *hdev;
1973 struct hci_dev_list_req *dl;
1974 struct hci_dev_req *dr;
1975 int n = 0, size, err;
1976 __u16 dev_num;
1977
1978 if (get_user(dev_num, (__u16 __user *) arg))
1979 return -EFAULT;
1980
1981 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1982 return -EINVAL;
1983
1984 size = sizeof(*dl) + dev_num * sizeof(*dr);
1985
1986 dl = kzalloc(size, GFP_KERNEL);
1987 if (!dl)
1988 return -ENOMEM;
1989
1990 dr = dl->dev_req;
1991
1992 read_lock(&hci_dev_list_lock);
1993 list_for_each_entry(hdev, &hci_dev_list, list) {
1994 unsigned long flags = hdev->flags;
1995
1996 /* When the auto-off is configured it means the transport
1997 * is running, but in that case still indicate that the
1998 * device is actually down.
1999 */
2000 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2001 flags &= ~BIT(HCI_UP);
2002
2003 (dr + n)->dev_id = hdev->id;
2004 (dr + n)->dev_opt = flags;
2005
2006 if (++n >= dev_num)
2007 break;
2008 }
2009 read_unlock(&hci_dev_list_lock);
2010
2011 dl->dev_num = n;
2012 size = sizeof(*dl) + n * sizeof(*dr);
2013
2014 err = copy_to_user(arg, dl, size);
2015 kfree(dl);
2016
2017 return err ? -EFAULT : 0;
2018 }
2019
2020 int hci_get_dev_info(void __user *arg)
2021 {
2022 struct hci_dev *hdev;
2023 struct hci_dev_info di;
2024 unsigned long flags;
2025 int err = 0;
2026
2027 if (copy_from_user(&di, arg, sizeof(di)))
2028 return -EFAULT;
2029
2030 hdev = hci_dev_get(di.dev_id);
2031 if (!hdev)
2032 return -ENODEV;
2033
2034 /* When the auto-off is configured it means the transport
2035 * is running, but in that case still indicate that the
2036 * device is actually down.
2037 */
2038 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
2039 flags = hdev->flags & ~BIT(HCI_UP);
2040 else
2041 flags = hdev->flags;
2042
2043 strcpy(di.name, hdev->name);
2044 di.bdaddr = hdev->bdaddr;
2045 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2046 di.flags = flags;
2047 di.pkt_type = hdev->pkt_type;
2048 if (lmp_bredr_capable(hdev)) {
2049 di.acl_mtu = hdev->acl_mtu;
2050 di.acl_pkts = hdev->acl_pkts;
2051 di.sco_mtu = hdev->sco_mtu;
2052 di.sco_pkts = hdev->sco_pkts;
2053 } else {
2054 di.acl_mtu = hdev->le_mtu;
2055 di.acl_pkts = hdev->le_pkts;
2056 di.sco_mtu = 0;
2057 di.sco_pkts = 0;
2058 }
2059 di.link_policy = hdev->link_policy;
2060 di.link_mode = hdev->link_mode;
2061
2062 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2063 memcpy(&di.features, &hdev->features, sizeof(di.features));
2064
2065 if (copy_to_user(arg, &di, sizeof(di)))
2066 err = -EFAULT;
2067
2068 hci_dev_put(hdev);
2069
2070 return err;
2071 }
2072
2073 /* ---- Interface to HCI drivers ---- */
2074
2075 static int hci_rfkill_set_block(void *data, bool blocked)
2076 {
2077 struct hci_dev *hdev = data;
2078
2079 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2080
2081 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags))
2082 return -EBUSY;
2083
2084 if (blocked) {
2085 set_bit(HCI_RFKILLED, &hdev->dev_flags);
2086 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
2087 !test_bit(HCI_CONFIG, &hdev->dev_flags))
2088 hci_dev_do_close(hdev);
2089 } else {
2090 clear_bit(HCI_RFKILLED, &hdev->dev_flags);
2091 }
2092
2093 return 0;
2094 }
2095
2096 static const struct rfkill_ops hci_rfkill_ops = {
2097 .set_block = hci_rfkill_set_block,
2098 };
2099
2100 static void hci_power_on(struct work_struct *work)
2101 {
2102 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2103 int err;
2104
2105 BT_DBG("%s", hdev->name);
2106
2107 err = hci_dev_do_open(hdev);
2108 if (err < 0) {
2109 hci_dev_lock(hdev);
2110 mgmt_set_powered_failed(hdev, err);
2111 hci_dev_unlock(hdev);
2112 return;
2113 }
2114
2115 /* During the HCI setup phase, a few error conditions are
2116 * ignored and they need to be checked now. If they are still
2117 * valid, it is important to turn the device back off.
2118 */
2119 if (test_bit(HCI_RFKILLED, &hdev->dev_flags) ||
2120 test_bit(HCI_UNCONFIGURED, &hdev->dev_flags) ||
2121 (hdev->dev_type == HCI_BREDR &&
2122 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2123 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2124 clear_bit(HCI_AUTO_OFF, &hdev->dev_flags);
2125 hci_dev_do_close(hdev);
2126 } else if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags)) {
2127 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2128 HCI_AUTO_OFF_TIMEOUT);
2129 }
2130
2131 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags)) {
2132 /* For unconfigured devices, set the HCI_RAW flag
2133 * so that userspace can easily identify them.
2134 */
2135 if (test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
2136 set_bit(HCI_RAW, &hdev->flags);
2137
2138 /* For fully configured devices, this will send
2139 * the Index Added event. For unconfigured devices,
2140 * it will send Unconfigued Index Added event.
2141 *
2142 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2143 * and no event will be send.
2144 */
2145 mgmt_index_added(hdev);
2146 } else if (test_and_clear_bit(HCI_CONFIG, &hdev->dev_flags)) {
2147 /* When the controller is now configured, then it
2148 * is important to clear the HCI_RAW flag.
2149 */
2150 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags))
2151 clear_bit(HCI_RAW, &hdev->flags);
2152
2153 /* Powering on the controller with HCI_CONFIG set only
2154 * happens with the transition from unconfigured to
2155 * configured. This will send the Index Added event.
2156 */
2157 mgmt_index_added(hdev);
2158 }
2159 }
2160
2161 static void hci_power_off(struct work_struct *work)
2162 {
2163 struct hci_dev *hdev = container_of(work, struct hci_dev,
2164 power_off.work);
2165
2166 BT_DBG("%s", hdev->name);
2167
2168 hci_dev_do_close(hdev);
2169 }
2170
2171 static void hci_error_reset(struct work_struct *work)
2172 {
2173 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2174
2175 BT_DBG("%s", hdev->name);
2176
2177 if (hdev->hw_error)
2178 hdev->hw_error(hdev, hdev->hw_error_code);
2179 else
2180 BT_ERR("%s hardware error 0x%2.2x", hdev->name,
2181 hdev->hw_error_code);
2182
2183 if (hci_dev_do_close(hdev))
2184 return;
2185
2186 hci_dev_do_open(hdev);
2187 }
2188
2189 static void hci_discov_off(struct work_struct *work)
2190 {
2191 struct hci_dev *hdev;
2192
2193 hdev = container_of(work, struct hci_dev, discov_off.work);
2194
2195 BT_DBG("%s", hdev->name);
2196
2197 mgmt_discoverable_timeout(hdev);
2198 }
2199
2200 void hci_uuids_clear(struct hci_dev *hdev)
2201 {
2202 struct bt_uuid *uuid, *tmp;
2203
2204 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2205 list_del(&uuid->list);
2206 kfree(uuid);
2207 }
2208 }
2209
2210 void hci_link_keys_clear(struct hci_dev *hdev)
2211 {
2212 struct link_key *key;
2213
2214 list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2215 list_del_rcu(&key->list);
2216 kfree_rcu(key, rcu);
2217 }
2218 }
2219
2220 void hci_smp_ltks_clear(struct hci_dev *hdev)
2221 {
2222 struct smp_ltk *k;
2223
2224 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2225 list_del_rcu(&k->list);
2226 kfree_rcu(k, rcu);
2227 }
2228 }
2229
2230 void hci_smp_irks_clear(struct hci_dev *hdev)
2231 {
2232 struct smp_irk *k;
2233
2234 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2235 list_del_rcu(&k->list);
2236 kfree_rcu(k, rcu);
2237 }
2238 }
2239
2240 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2241 {
2242 struct link_key *k;
2243
2244 rcu_read_lock();
2245 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2246 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2247 rcu_read_unlock();
2248 return k;
2249 }
2250 }
2251 rcu_read_unlock();
2252
2253 return NULL;
2254 }
2255
2256 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2257 u8 key_type, u8 old_key_type)
2258 {
2259 /* Legacy key */
2260 if (key_type < 0x03)
2261 return true;
2262
2263 /* Debug keys are insecure so don't store them persistently */
2264 if (key_type == HCI_LK_DEBUG_COMBINATION)
2265 return false;
2266
2267 /* Changed combination key and there's no previous one */
2268 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2269 return false;
2270
2271 /* Security mode 3 case */
2272 if (!conn)
2273 return true;
2274
2275 /* BR/EDR key derived using SC from an LE link */
2276 if (conn->type == LE_LINK)
2277 return true;
2278
2279 /* Neither local nor remote side had no-bonding as requirement */
2280 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2281 return true;
2282
2283 /* Local side had dedicated bonding as requirement */
2284 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2285 return true;
2286
2287 /* Remote side had dedicated bonding as requirement */
2288 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2289 return true;
2290
2291 /* If none of the above criteria match, then don't store the key
2292 * persistently */
2293 return false;
2294 }
2295
2296 static u8 ltk_role(u8 type)
2297 {
2298 if (type == SMP_LTK)
2299 return HCI_ROLE_MASTER;
2300
2301 return HCI_ROLE_SLAVE;
2302 }
2303
2304 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2305 u8 addr_type, u8 role)
2306 {
2307 struct smp_ltk *k;
2308
2309 rcu_read_lock();
2310 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2311 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2312 continue;
2313
2314 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2315 rcu_read_unlock();
2316 return k;
2317 }
2318 }
2319 rcu_read_unlock();
2320
2321 return NULL;
2322 }
2323
2324 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2325 {
2326 struct smp_irk *irk;
2327
2328 rcu_read_lock();
2329 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2330 if (!bacmp(&irk->rpa, rpa)) {
2331 rcu_read_unlock();
2332 return irk;
2333 }
2334 }
2335
2336 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2337 if (smp_irk_matches(hdev, irk->val, rpa)) {
2338 bacpy(&irk->rpa, rpa);
2339 rcu_read_unlock();
2340 return irk;
2341 }
2342 }
2343 rcu_read_unlock();
2344
2345 return NULL;
2346 }
2347
2348 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2349 u8 addr_type)
2350 {
2351 struct smp_irk *irk;
2352
2353 /* Identity Address must be public or static random */
2354 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2355 return NULL;
2356
2357 rcu_read_lock();
2358 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2359 if (addr_type == irk->addr_type &&
2360 bacmp(bdaddr, &irk->bdaddr) == 0) {
2361 rcu_read_unlock();
2362 return irk;
2363 }
2364 }
2365 rcu_read_unlock();
2366
2367 return NULL;
2368 }
2369
2370 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2371 bdaddr_t *bdaddr, u8 *val, u8 type,
2372 u8 pin_len, bool *persistent)
2373 {
2374 struct link_key *key, *old_key;
2375 u8 old_key_type;
2376
2377 old_key = hci_find_link_key(hdev, bdaddr);
2378 if (old_key) {
2379 old_key_type = old_key->type;
2380 key = old_key;
2381 } else {
2382 old_key_type = conn ? conn->key_type : 0xff;
2383 key = kzalloc(sizeof(*key), GFP_KERNEL);
2384 if (!key)
2385 return NULL;
2386 list_add_rcu(&key->list, &hdev->link_keys);
2387 }
2388
2389 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2390
2391 /* Some buggy controller combinations generate a changed
2392 * combination key for legacy pairing even when there's no
2393 * previous key */
2394 if (type == HCI_LK_CHANGED_COMBINATION &&
2395 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2396 type = HCI_LK_COMBINATION;
2397 if (conn)
2398 conn->key_type = type;
2399 }
2400
2401 bacpy(&key->bdaddr, bdaddr);
2402 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2403 key->pin_len = pin_len;
2404
2405 if (type == HCI_LK_CHANGED_COMBINATION)
2406 key->type = old_key_type;
2407 else
2408 key->type = type;
2409
2410 if (persistent)
2411 *persistent = hci_persistent_key(hdev, conn, type,
2412 old_key_type);
2413
2414 return key;
2415 }
2416
2417 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2418 u8 addr_type, u8 type, u8 authenticated,
2419 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2420 {
2421 struct smp_ltk *key, *old_key;
2422 u8 role = ltk_role(type);
2423
2424 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2425 if (old_key)
2426 key = old_key;
2427 else {
2428 key = kzalloc(sizeof(*key), GFP_KERNEL);
2429 if (!key)
2430 return NULL;
2431 list_add_rcu(&key->list, &hdev->long_term_keys);
2432 }
2433
2434 bacpy(&key->bdaddr, bdaddr);
2435 key->bdaddr_type = addr_type;
2436 memcpy(key->val, tk, sizeof(key->val));
2437 key->authenticated = authenticated;
2438 key->ediv = ediv;
2439 key->rand = rand;
2440 key->enc_size = enc_size;
2441 key->type = type;
2442
2443 return key;
2444 }
2445
2446 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2447 u8 addr_type, u8 val[16], bdaddr_t *rpa)
2448 {
2449 struct smp_irk *irk;
2450
2451 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2452 if (!irk) {
2453 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2454 if (!irk)
2455 return NULL;
2456
2457 bacpy(&irk->bdaddr, bdaddr);
2458 irk->addr_type = addr_type;
2459
2460 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2461 }
2462
2463 memcpy(irk->val, val, 16);
2464 bacpy(&irk->rpa, rpa);
2465
2466 return irk;
2467 }
2468
2469 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2470 {
2471 struct link_key *key;
2472
2473 key = hci_find_link_key(hdev, bdaddr);
2474 if (!key)
2475 return -ENOENT;
2476
2477 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2478
2479 list_del_rcu(&key->list);
2480 kfree_rcu(key, rcu);
2481
2482 return 0;
2483 }
2484
2485 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2486 {
2487 struct smp_ltk *k;
2488 int removed = 0;
2489
2490 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2491 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2492 continue;
2493
2494 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2495
2496 list_del_rcu(&k->list);
2497 kfree_rcu(k, rcu);
2498 removed++;
2499 }
2500
2501 return removed ? 0 : -ENOENT;
2502 }
2503
2504 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2505 {
2506 struct smp_irk *k;
2507
2508 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2509 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2510 continue;
2511
2512 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2513
2514 list_del_rcu(&k->list);
2515 kfree_rcu(k, rcu);
2516 }
2517 }
2518
2519 /* HCI command timer function */
2520 static void hci_cmd_timeout(struct work_struct *work)
2521 {
2522 struct hci_dev *hdev = container_of(work, struct hci_dev,
2523 cmd_timer.work);
2524
2525 if (hdev->sent_cmd) {
2526 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2527 u16 opcode = __le16_to_cpu(sent->opcode);
2528
2529 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
2530 } else {
2531 BT_ERR("%s command tx timeout", hdev->name);
2532 }
2533
2534 atomic_set(&hdev->cmd_cnt, 1);
2535 queue_work(hdev->workqueue, &hdev->cmd_work);
2536 }
2537
2538 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2539 bdaddr_t *bdaddr, u8 bdaddr_type)
2540 {
2541 struct oob_data *data;
2542
2543 list_for_each_entry(data, &hdev->remote_oob_data, list) {
2544 if (bacmp(bdaddr, &data->bdaddr) != 0)
2545 continue;
2546 if (data->bdaddr_type != bdaddr_type)
2547 continue;
2548 return data;
2549 }
2550
2551 return NULL;
2552 }
2553
2554 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2555 u8 bdaddr_type)
2556 {
2557 struct oob_data *data;
2558
2559 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2560 if (!data)
2561 return -ENOENT;
2562
2563 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2564
2565 list_del(&data->list);
2566 kfree(data);
2567
2568 return 0;
2569 }
2570
2571 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2572 {
2573 struct oob_data *data, *n;
2574
2575 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2576 list_del(&data->list);
2577 kfree(data);
2578 }
2579 }
2580
2581 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2582 u8 bdaddr_type, u8 *hash192, u8 *rand192,
2583 u8 *hash256, u8 *rand256)
2584 {
2585 struct oob_data *data;
2586
2587 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2588 if (!data) {
2589 data = kmalloc(sizeof(*data), GFP_KERNEL);
2590 if (!data)
2591 return -ENOMEM;
2592
2593 bacpy(&data->bdaddr, bdaddr);
2594 data->bdaddr_type = bdaddr_type;
2595 list_add(&data->list, &hdev->remote_oob_data);
2596 }
2597
2598 if (hash192 && rand192) {
2599 memcpy(data->hash192, hash192, sizeof(data->hash192));
2600 memcpy(data->rand192, rand192, sizeof(data->rand192));
2601 if (hash256 && rand256)
2602 data->present = 0x03;
2603 } else {
2604 memset(data->hash192, 0, sizeof(data->hash192));
2605 memset(data->rand192, 0, sizeof(data->rand192));
2606 if (hash256 && rand256)
2607 data->present = 0x02;
2608 else
2609 data->present = 0x00;
2610 }
2611
2612 if (hash256 && rand256) {
2613 memcpy(data->hash256, hash256, sizeof(data->hash256));
2614 memcpy(data->rand256, rand256, sizeof(data->rand256));
2615 } else {
2616 memset(data->hash256, 0, sizeof(data->hash256));
2617 memset(data->rand256, 0, sizeof(data->rand256));
2618 if (hash192 && rand192)
2619 data->present = 0x01;
2620 }
2621
2622 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2623
2624 return 0;
2625 }
2626
2627 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2628 bdaddr_t *bdaddr, u8 type)
2629 {
2630 struct bdaddr_list *b;
2631
2632 list_for_each_entry(b, bdaddr_list, list) {
2633 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2634 return b;
2635 }
2636
2637 return NULL;
2638 }
2639
2640 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2641 {
2642 struct list_head *p, *n;
2643
2644 list_for_each_safe(p, n, bdaddr_list) {
2645 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
2646
2647 list_del(p);
2648 kfree(b);
2649 }
2650 }
2651
2652 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2653 {
2654 struct bdaddr_list *entry;
2655
2656 if (!bacmp(bdaddr, BDADDR_ANY))
2657 return -EBADF;
2658
2659 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2660 return -EEXIST;
2661
2662 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2663 if (!entry)
2664 return -ENOMEM;
2665
2666 bacpy(&entry->bdaddr, bdaddr);
2667 entry->bdaddr_type = type;
2668
2669 list_add(&entry->list, list);
2670
2671 return 0;
2672 }
2673
2674 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2675 {
2676 struct bdaddr_list *entry;
2677
2678 if (!bacmp(bdaddr, BDADDR_ANY)) {
2679 hci_bdaddr_list_clear(list);
2680 return 0;
2681 }
2682
2683 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2684 if (!entry)
2685 return -ENOENT;
2686
2687 list_del(&entry->list);
2688 kfree(entry);
2689
2690 return 0;
2691 }
2692
2693 /* This function requires the caller holds hdev->lock */
2694 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2695 bdaddr_t *addr, u8 addr_type)
2696 {
2697 struct hci_conn_params *params;
2698
2699 /* The conn params list only contains identity addresses */
2700 if (!hci_is_identity_address(addr, addr_type))
2701 return NULL;
2702
2703 list_for_each_entry(params, &hdev->le_conn_params, list) {
2704 if (bacmp(&params->addr, addr) == 0 &&
2705 params->addr_type == addr_type) {
2706 return params;
2707 }
2708 }
2709
2710 return NULL;
2711 }
2712
2713 /* This function requires the caller holds hdev->lock */
2714 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2715 bdaddr_t *addr, u8 addr_type)
2716 {
2717 struct hci_conn_params *param;
2718
2719 /* The list only contains identity addresses */
2720 if (!hci_is_identity_address(addr, addr_type))
2721 return NULL;
2722
2723 list_for_each_entry(param, list, action) {
2724 if (bacmp(&param->addr, addr) == 0 &&
2725 param->addr_type == addr_type)
2726 return param;
2727 }
2728
2729 return NULL;
2730 }
2731
2732 /* This function requires the caller holds hdev->lock */
2733 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2734 bdaddr_t *addr, u8 addr_type)
2735 {
2736 struct hci_conn_params *params;
2737
2738 if (!hci_is_identity_address(addr, addr_type))
2739 return NULL;
2740
2741 params = hci_conn_params_lookup(hdev, addr, addr_type);
2742 if (params)
2743 return params;
2744
2745 params = kzalloc(sizeof(*params), GFP_KERNEL);
2746 if (!params) {
2747 BT_ERR("Out of memory");
2748 return NULL;
2749 }
2750
2751 bacpy(&params->addr, addr);
2752 params->addr_type = addr_type;
2753
2754 list_add(&params->list, &hdev->le_conn_params);
2755 INIT_LIST_HEAD(&params->action);
2756
2757 params->conn_min_interval = hdev->le_conn_min_interval;
2758 params->conn_max_interval = hdev->le_conn_max_interval;
2759 params->conn_latency = hdev->le_conn_latency;
2760 params->supervision_timeout = hdev->le_supv_timeout;
2761 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2762
2763 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2764
2765 return params;
2766 }
2767
2768 static void hci_conn_params_free(struct hci_conn_params *params)
2769 {
2770 if (params->conn) {
2771 hci_conn_drop(params->conn);
2772 hci_conn_put(params->conn);
2773 }
2774
2775 list_del(&params->action);
2776 list_del(&params->list);
2777 kfree(params);
2778 }
2779
2780 /* This function requires the caller holds hdev->lock */
2781 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2782 {
2783 struct hci_conn_params *params;
2784
2785 params = hci_conn_params_lookup(hdev, addr, addr_type);
2786 if (!params)
2787 return;
2788
2789 hci_conn_params_free(params);
2790
2791 hci_update_background_scan(hdev);
2792
2793 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2794 }
2795
2796 /* This function requires the caller holds hdev->lock */
2797 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
2798 {
2799 struct hci_conn_params *params, *tmp;
2800
2801 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
2802 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2803 continue;
2804 list_del(&params->list);
2805 kfree(params);
2806 }
2807
2808 BT_DBG("All LE disabled connection parameters were removed");
2809 }
2810
2811 /* This function requires the caller holds hdev->lock */
2812 void hci_conn_params_clear_all(struct hci_dev *hdev)
2813 {
2814 struct hci_conn_params *params, *tmp;
2815
2816 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2817 hci_conn_params_free(params);
2818
2819 hci_update_background_scan(hdev);
2820
2821 BT_DBG("All LE connection parameters were removed");
2822 }
2823
2824 static void inquiry_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2825 {
2826 if (status) {
2827 BT_ERR("Failed to start inquiry: status %d", status);
2828
2829 hci_dev_lock(hdev);
2830 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2831 hci_dev_unlock(hdev);
2832 return;
2833 }
2834 }
2835
2836 static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status,
2837 u16 opcode)
2838 {
2839 /* General inquiry access code (GIAC) */
2840 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2841 struct hci_request req;
2842 struct hci_cp_inquiry cp;
2843 int err;
2844
2845 if (status) {
2846 BT_ERR("Failed to disable LE scanning: status %d", status);
2847 return;
2848 }
2849
2850 hdev->discovery.scan_start = 0;
2851
2852 switch (hdev->discovery.type) {
2853 case DISCOV_TYPE_LE:
2854 hci_dev_lock(hdev);
2855 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2856 hci_dev_unlock(hdev);
2857 break;
2858
2859 case DISCOV_TYPE_INTERLEAVED:
2860 hci_req_init(&req, hdev);
2861
2862 memset(&cp, 0, sizeof(cp));
2863 memcpy(&cp.lap, lap, sizeof(cp.lap));
2864 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
2865 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
2866
2867 hci_dev_lock(hdev);
2868
2869 hci_inquiry_cache_flush(hdev);
2870
2871 err = hci_req_run(&req, inquiry_complete);
2872 if (err) {
2873 BT_ERR("Inquiry request failed: err %d", err);
2874 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2875 }
2876
2877 hci_dev_unlock(hdev);
2878 break;
2879 }
2880 }
2881
2882 static void le_scan_disable_work(struct work_struct *work)
2883 {
2884 struct hci_dev *hdev = container_of(work, struct hci_dev,
2885 le_scan_disable.work);
2886 struct hci_request req;
2887 int err;
2888
2889 BT_DBG("%s", hdev->name);
2890
2891 cancel_delayed_work_sync(&hdev->le_scan_restart);
2892
2893 hci_req_init(&req, hdev);
2894
2895 hci_req_add_le_scan_disable(&req);
2896
2897 err = hci_req_run(&req, le_scan_disable_work_complete);
2898 if (err)
2899 BT_ERR("Disable LE scanning request failed: err %d", err);
2900 }
2901
2902 static void le_scan_restart_work_complete(struct hci_dev *hdev, u8 status,
2903 u16 opcode)
2904 {
2905 unsigned long timeout, duration, scan_start, now;
2906
2907 BT_DBG("%s", hdev->name);
2908
2909 if (status) {
2910 BT_ERR("Failed to restart LE scan: status %d", status);
2911 return;
2912 }
2913
2914 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
2915 !hdev->discovery.scan_start)
2916 return;
2917
2918 /* When the scan was started, hdev->le_scan_disable has been queued
2919 * after duration from scan_start. During scan restart this job
2920 * has been canceled, and we need to queue it again after proper
2921 * timeout, to make sure that scan does not run indefinitely.
2922 */
2923 duration = hdev->discovery.scan_duration;
2924 scan_start = hdev->discovery.scan_start;
2925 now = jiffies;
2926 if (now - scan_start <= duration) {
2927 int elapsed;
2928
2929 if (now >= scan_start)
2930 elapsed = now - scan_start;
2931 else
2932 elapsed = ULONG_MAX - scan_start + now;
2933
2934 timeout = duration - elapsed;
2935 } else {
2936 timeout = 0;
2937 }
2938 queue_delayed_work(hdev->workqueue,
2939 &hdev->le_scan_disable, timeout);
2940 }
2941
2942 static void le_scan_restart_work(struct work_struct *work)
2943 {
2944 struct hci_dev *hdev = container_of(work, struct hci_dev,
2945 le_scan_restart.work);
2946 struct hci_request req;
2947 struct hci_cp_le_set_scan_enable cp;
2948 int err;
2949
2950 BT_DBG("%s", hdev->name);
2951
2952 /* If controller is not scanning we are done. */
2953 if (!test_bit(HCI_LE_SCAN, &hdev->dev_flags))
2954 return;
2955
2956 hci_req_init(&req, hdev);
2957
2958 hci_req_add_le_scan_disable(&req);
2959
2960 memset(&cp, 0, sizeof(cp));
2961 cp.enable = LE_SCAN_ENABLE;
2962 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2963 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2964
2965 err = hci_req_run(&req, le_scan_restart_work_complete);
2966 if (err)
2967 BT_ERR("Restart LE scan request failed: err %d", err);
2968 }
2969
2970 /* Copy the Identity Address of the controller.
2971 *
2972 * If the controller has a public BD_ADDR, then by default use that one.
2973 * If this is a LE only controller without a public address, default to
2974 * the static random address.
2975 *
2976 * For debugging purposes it is possible to force controllers with a
2977 * public address to use the static random address instead.
2978 *
2979 * In case BR/EDR has been disabled on a dual-mode controller and
2980 * userspace has configured a static address, then that address
2981 * becomes the identity address instead of the public BR/EDR address.
2982 */
2983 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2984 u8 *bdaddr_type)
2985 {
2986 if (test_bit(HCI_FORCE_STATIC_ADDR, &hdev->dbg_flags) ||
2987 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
2988 (!test_bit(HCI_BREDR_ENABLED, &hdev->dev_flags) &&
2989 bacmp(&hdev->static_addr, BDADDR_ANY))) {
2990 bacpy(bdaddr, &hdev->static_addr);
2991 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2992 } else {
2993 bacpy(bdaddr, &hdev->bdaddr);
2994 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
2995 }
2996 }
2997
2998 /* Alloc HCI device */
2999 struct hci_dev *hci_alloc_dev(void)
3000 {
3001 struct hci_dev *hdev;
3002
3003 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3004 if (!hdev)
3005 return NULL;
3006
3007 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3008 hdev->esco_type = (ESCO_HV1);
3009 hdev->link_mode = (HCI_LM_ACCEPT);
3010 hdev->num_iac = 0x01; /* One IAC support is mandatory */
3011 hdev->io_capability = 0x03; /* No Input No Output */
3012 hdev->manufacturer = 0xffff; /* Default to internal use */
3013 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3014 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3015
3016 hdev->sniff_max_interval = 800;
3017 hdev->sniff_min_interval = 80;
3018
3019 hdev->le_adv_channel_map = 0x07;
3020 hdev->le_adv_min_interval = 0x0800;
3021 hdev->le_adv_max_interval = 0x0800;
3022 hdev->le_scan_interval = 0x0060;
3023 hdev->le_scan_window = 0x0030;
3024 hdev->le_conn_min_interval = 0x0028;
3025 hdev->le_conn_max_interval = 0x0038;
3026 hdev->le_conn_latency = 0x0000;
3027 hdev->le_supv_timeout = 0x002a;
3028 hdev->le_def_tx_len = 0x001b;
3029 hdev->le_def_tx_time = 0x0148;
3030 hdev->le_max_tx_len = 0x001b;
3031 hdev->le_max_tx_time = 0x0148;
3032 hdev->le_max_rx_len = 0x001b;
3033 hdev->le_max_rx_time = 0x0148;
3034
3035 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3036 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3037 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3038 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3039
3040 mutex_init(&hdev->lock);
3041 mutex_init(&hdev->req_lock);
3042
3043 INIT_LIST_HEAD(&hdev->mgmt_pending);
3044 INIT_LIST_HEAD(&hdev->blacklist);
3045 INIT_LIST_HEAD(&hdev->whitelist);
3046 INIT_LIST_HEAD(&hdev->uuids);
3047 INIT_LIST_HEAD(&hdev->link_keys);
3048 INIT_LIST_HEAD(&hdev->long_term_keys);
3049 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3050 INIT_LIST_HEAD(&hdev->remote_oob_data);
3051 INIT_LIST_HEAD(&hdev->le_white_list);
3052 INIT_LIST_HEAD(&hdev->le_conn_params);
3053 INIT_LIST_HEAD(&hdev->pend_le_conns);
3054 INIT_LIST_HEAD(&hdev->pend_le_reports);
3055 INIT_LIST_HEAD(&hdev->conn_hash.list);
3056
3057 INIT_WORK(&hdev->rx_work, hci_rx_work);
3058 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3059 INIT_WORK(&hdev->tx_work, hci_tx_work);
3060 INIT_WORK(&hdev->power_on, hci_power_on);
3061 INIT_WORK(&hdev->error_reset, hci_error_reset);
3062
3063 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3064 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
3065 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
3066 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
3067
3068 skb_queue_head_init(&hdev->rx_q);
3069 skb_queue_head_init(&hdev->cmd_q);
3070 skb_queue_head_init(&hdev->raw_q);
3071
3072 init_waitqueue_head(&hdev->req_wait_q);
3073
3074 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3075
3076 hci_init_sysfs(hdev);
3077 discovery_init(hdev);
3078
3079 return hdev;
3080 }
3081 EXPORT_SYMBOL(hci_alloc_dev);
3082
3083 /* Free HCI device */
3084 void hci_free_dev(struct hci_dev *hdev)
3085 {
3086 /* will free via device release */
3087 put_device(&hdev->dev);
3088 }
3089 EXPORT_SYMBOL(hci_free_dev);
3090
3091 /* Register HCI device */
3092 int hci_register_dev(struct hci_dev *hdev)
3093 {
3094 int id, error;
3095
3096 if (!hdev->open || !hdev->close || !hdev->send)
3097 return -EINVAL;
3098
3099 /* Do not allow HCI_AMP devices to register at index 0,
3100 * so the index can be used as the AMP controller ID.
3101 */
3102 switch (hdev->dev_type) {
3103 case HCI_BREDR:
3104 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3105 break;
3106 case HCI_AMP:
3107 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3108 break;
3109 default:
3110 return -EINVAL;
3111 }
3112
3113 if (id < 0)
3114 return id;
3115
3116 sprintf(hdev->name, "hci%d", id);
3117 hdev->id = id;
3118
3119 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3120
3121 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3122 WQ_MEM_RECLAIM, 1, hdev->name);
3123 if (!hdev->workqueue) {
3124 error = -ENOMEM;
3125 goto err;
3126 }
3127
3128 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3129 WQ_MEM_RECLAIM, 1, hdev->name);
3130 if (!hdev->req_workqueue) {
3131 destroy_workqueue(hdev->workqueue);
3132 error = -ENOMEM;
3133 goto err;
3134 }
3135
3136 if (!IS_ERR_OR_NULL(bt_debugfs))
3137 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3138
3139 dev_set_name(&hdev->dev, "%s", hdev->name);
3140
3141 error = device_add(&hdev->dev);
3142 if (error < 0)
3143 goto err_wqueue;
3144
3145 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3146 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3147 hdev);
3148 if (hdev->rfkill) {
3149 if (rfkill_register(hdev->rfkill) < 0) {
3150 rfkill_destroy(hdev->rfkill);
3151 hdev->rfkill = NULL;
3152 }
3153 }
3154
3155 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3156 set_bit(HCI_RFKILLED, &hdev->dev_flags);
3157
3158 set_bit(HCI_SETUP, &hdev->dev_flags);
3159 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
3160
3161 if (hdev->dev_type == HCI_BREDR) {
3162 /* Assume BR/EDR support until proven otherwise (such as
3163 * through reading supported features during init.
3164 */
3165 set_bit(HCI_BREDR_ENABLED, &hdev->dev_flags);
3166 }
3167
3168 write_lock(&hci_dev_list_lock);
3169 list_add(&hdev->list, &hci_dev_list);
3170 write_unlock(&hci_dev_list_lock);
3171
3172 /* Devices that are marked for raw-only usage are unconfigured
3173 * and should not be included in normal operation.
3174 */
3175 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3176 set_bit(HCI_UNCONFIGURED, &hdev->dev_flags);
3177
3178 hci_notify(hdev, HCI_DEV_REG);
3179 hci_dev_hold(hdev);
3180
3181 queue_work(hdev->req_workqueue, &hdev->power_on);
3182
3183 return id;
3184
3185 err_wqueue:
3186 destroy_workqueue(hdev->workqueue);
3187 destroy_workqueue(hdev->req_workqueue);
3188 err:
3189 ida_simple_remove(&hci_index_ida, hdev->id);
3190
3191 return error;
3192 }
3193 EXPORT_SYMBOL(hci_register_dev);
3194
3195 /* Unregister HCI device */
3196 void hci_unregister_dev(struct hci_dev *hdev)
3197 {
3198 int i, id;
3199
3200 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3201
3202 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
3203
3204 id = hdev->id;
3205
3206 write_lock(&hci_dev_list_lock);
3207 list_del(&hdev->list);
3208 write_unlock(&hci_dev_list_lock);
3209
3210 hci_dev_do_close(hdev);
3211
3212 for (i = 0; i < NUM_REASSEMBLY; i++)
3213 kfree_skb(hdev->reassembly[i]);
3214
3215 cancel_work_sync(&hdev->power_on);
3216
3217 if (!test_bit(HCI_INIT, &hdev->flags) &&
3218 !test_bit(HCI_SETUP, &hdev->dev_flags) &&
3219 !test_bit(HCI_CONFIG, &hdev->dev_flags)) {
3220 hci_dev_lock(hdev);
3221 mgmt_index_removed(hdev);
3222 hci_dev_unlock(hdev);
3223 }
3224
3225 /* mgmt_index_removed should take care of emptying the
3226 * pending list */
3227 BUG_ON(!list_empty(&hdev->mgmt_pending));
3228
3229 hci_notify(hdev, HCI_DEV_UNREG);
3230
3231 if (hdev->rfkill) {
3232 rfkill_unregister(hdev->rfkill);
3233 rfkill_destroy(hdev->rfkill);
3234 }
3235
3236 device_del(&hdev->dev);
3237
3238 debugfs_remove_recursive(hdev->debugfs);
3239
3240 destroy_workqueue(hdev->workqueue);
3241 destroy_workqueue(hdev->req_workqueue);
3242
3243 hci_dev_lock(hdev);
3244 hci_bdaddr_list_clear(&hdev->blacklist);
3245 hci_bdaddr_list_clear(&hdev->whitelist);
3246 hci_uuids_clear(hdev);
3247 hci_link_keys_clear(hdev);
3248 hci_smp_ltks_clear(hdev);
3249 hci_smp_irks_clear(hdev);
3250 hci_remote_oob_data_clear(hdev);
3251 hci_bdaddr_list_clear(&hdev->le_white_list);
3252 hci_conn_params_clear_all(hdev);
3253 hci_discovery_filter_clear(hdev);
3254 hci_dev_unlock(hdev);
3255
3256 hci_dev_put(hdev);
3257
3258 ida_simple_remove(&hci_index_ida, id);
3259 }
3260 EXPORT_SYMBOL(hci_unregister_dev);
3261
3262 /* Suspend HCI device */
3263 int hci_suspend_dev(struct hci_dev *hdev)
3264 {
3265 hci_notify(hdev, HCI_DEV_SUSPEND);
3266 return 0;
3267 }
3268 EXPORT_SYMBOL(hci_suspend_dev);
3269
3270 /* Resume HCI device */
3271 int hci_resume_dev(struct hci_dev *hdev)
3272 {
3273 hci_notify(hdev, HCI_DEV_RESUME);
3274 return 0;
3275 }
3276 EXPORT_SYMBOL(hci_resume_dev);
3277
3278 /* Reset HCI device */
3279 int hci_reset_dev(struct hci_dev *hdev)
3280 {
3281 const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3282 struct sk_buff *skb;
3283
3284 skb = bt_skb_alloc(3, GFP_ATOMIC);
3285 if (!skb)
3286 return -ENOMEM;
3287
3288 bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3289 memcpy(skb_put(skb, 3), hw_err, 3);
3290
3291 /* Send Hardware Error to upper stack */
3292 return hci_recv_frame(hdev, skb);
3293 }
3294 EXPORT_SYMBOL(hci_reset_dev);
3295
3296 /* Receive frame from HCI drivers */
3297 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
3298 {
3299 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
3300 && !test_bit(HCI_INIT, &hdev->flags))) {
3301 kfree_skb(skb);
3302 return -ENXIO;
3303 }
3304
3305 /* Incoming skb */
3306 bt_cb(skb)->incoming = 1;
3307
3308 /* Time stamp */
3309 __net_timestamp(skb);
3310
3311 skb_queue_tail(&hdev->rx_q, skb);
3312 queue_work(hdev->workqueue, &hdev->rx_work);
3313
3314 return 0;
3315 }
3316 EXPORT_SYMBOL(hci_recv_frame);
3317
3318 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
3319 int count, __u8 index)
3320 {
3321 int len = 0;
3322 int hlen = 0;
3323 int remain = count;
3324 struct sk_buff *skb;
3325 struct bt_skb_cb *scb;
3326
3327 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
3328 index >= NUM_REASSEMBLY)
3329 return -EILSEQ;
3330
3331 skb = hdev->reassembly[index];
3332
3333 if (!skb) {
3334 switch (type) {
3335 case HCI_ACLDATA_PKT:
3336 len = HCI_MAX_FRAME_SIZE;
3337 hlen = HCI_ACL_HDR_SIZE;
3338 break;
3339 case HCI_EVENT_PKT:
3340 len = HCI_MAX_EVENT_SIZE;
3341 hlen = HCI_EVENT_HDR_SIZE;
3342 break;
3343 case HCI_SCODATA_PKT:
3344 len = HCI_MAX_SCO_SIZE;
3345 hlen = HCI_SCO_HDR_SIZE;
3346 break;
3347 }
3348
3349 skb = bt_skb_alloc(len, GFP_ATOMIC);
3350 if (!skb)
3351 return -ENOMEM;
3352
3353 scb = (void *) skb->cb;
3354 scb->expect = hlen;
3355 scb->pkt_type = type;
3356
3357 hdev->reassembly[index] = skb;
3358 }
3359
3360 while (count) {
3361 scb = (void *) skb->cb;
3362 len = min_t(uint, scb->expect, count);
3363
3364 memcpy(skb_put(skb, len), data, len);
3365
3366 count -= len;
3367 data += len;
3368 scb->expect -= len;
3369 remain = count;
3370
3371 switch (type) {
3372 case HCI_EVENT_PKT:
3373 if (skb->len == HCI_EVENT_HDR_SIZE) {
3374 struct hci_event_hdr *h = hci_event_hdr(skb);
3375 scb->expect = h->plen;
3376
3377 if (skb_tailroom(skb) < scb->expect) {
3378 kfree_skb(skb);
3379 hdev->reassembly[index] = NULL;
3380 return -ENOMEM;
3381 }
3382 }
3383 break;
3384
3385 case HCI_ACLDATA_PKT:
3386 if (skb->len == HCI_ACL_HDR_SIZE) {
3387 struct hci_acl_hdr *h = hci_acl_hdr(skb);
3388 scb->expect = __le16_to_cpu(h->dlen);
3389
3390 if (skb_tailroom(skb) < scb->expect) {
3391 kfree_skb(skb);
3392 hdev->reassembly[index] = NULL;
3393 return -ENOMEM;
3394 }
3395 }
3396 break;
3397
3398 case HCI_SCODATA_PKT:
3399 if (skb->len == HCI_SCO_HDR_SIZE) {
3400 struct hci_sco_hdr *h = hci_sco_hdr(skb);
3401 scb->expect = h->dlen;
3402
3403 if (skb_tailroom(skb) < scb->expect) {
3404 kfree_skb(skb);
3405 hdev->reassembly[index] = NULL;
3406 return -ENOMEM;
3407 }
3408 }
3409 break;
3410 }
3411
3412 if (scb->expect == 0) {
3413 /* Complete frame */
3414
3415 bt_cb(skb)->pkt_type = type;
3416 hci_recv_frame(hdev, skb);
3417
3418 hdev->reassembly[index] = NULL;
3419 return remain;
3420 }
3421 }
3422
3423 return remain;
3424 }
3425
3426 #define STREAM_REASSEMBLY 0
3427
3428 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
3429 {
3430 int type;
3431 int rem = 0;
3432
3433 while (count) {
3434 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
3435
3436 if (!skb) {
3437 struct { char type; } *pkt;
3438
3439 /* Start of the frame */
3440 pkt = data;
3441 type = pkt->type;
3442
3443 data++;
3444 count--;
3445 } else
3446 type = bt_cb(skb)->pkt_type;
3447
3448 rem = hci_reassembly(hdev, type, data, count,
3449 STREAM_REASSEMBLY);
3450 if (rem < 0)
3451 return rem;
3452
3453 data += (count - rem);
3454 count = rem;
3455 }
3456
3457 return rem;
3458 }
3459 EXPORT_SYMBOL(hci_recv_stream_fragment);
3460
3461 /* ---- Interface to upper protocols ---- */
3462
3463 int hci_register_cb(struct hci_cb *cb)
3464 {
3465 BT_DBG("%p name %s", cb, cb->name);
3466
3467 mutex_lock(&hci_cb_list_lock);
3468 list_add_tail(&cb->list, &hci_cb_list);
3469 mutex_unlock(&hci_cb_list_lock);
3470
3471 return 0;
3472 }
3473 EXPORT_SYMBOL(hci_register_cb);
3474
3475 int hci_unregister_cb(struct hci_cb *cb)
3476 {
3477 BT_DBG("%p name %s", cb, cb->name);
3478
3479 mutex_lock(&hci_cb_list_lock);
3480 list_del(&cb->list);
3481 mutex_unlock(&hci_cb_list_lock);
3482
3483 return 0;
3484 }
3485 EXPORT_SYMBOL(hci_unregister_cb);
3486
3487 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
3488 {
3489 int err;
3490
3491 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
3492
3493 /* Time stamp */
3494 __net_timestamp(skb);
3495
3496 /* Send copy to monitor */
3497 hci_send_to_monitor(hdev, skb);
3498
3499 if (atomic_read(&hdev->promisc)) {
3500 /* Send copy to the sockets */
3501 hci_send_to_sock(hdev, skb);
3502 }
3503
3504 /* Get rid of skb owner, prior to sending to the driver. */
3505 skb_orphan(skb);
3506
3507 err = hdev->send(hdev, skb);
3508 if (err < 0) {
3509 BT_ERR("%s sending frame failed (%d)", hdev->name, err);
3510 kfree_skb(skb);
3511 }
3512 }
3513
3514 bool hci_req_pending(struct hci_dev *hdev)
3515 {
3516 return (hdev->req_status == HCI_REQ_PEND);
3517 }
3518
3519 /* Send HCI command */
3520 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3521 const void *param)
3522 {
3523 struct sk_buff *skb;
3524
3525 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3526
3527 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3528 if (!skb) {
3529 BT_ERR("%s no memory for command", hdev->name);
3530 return -ENOMEM;
3531 }
3532
3533 /* Stand-alone HCI commands must be flagged as
3534 * single-command requests.
3535 */
3536 bt_cb(skb)->req.start = true;
3537
3538 skb_queue_tail(&hdev->cmd_q, skb);
3539 queue_work(hdev->workqueue, &hdev->cmd_work);
3540
3541 return 0;
3542 }
3543
3544 /* Get data from the previously sent command */
3545 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
3546 {
3547 struct hci_command_hdr *hdr;
3548
3549 if (!hdev->sent_cmd)
3550 return NULL;
3551
3552 hdr = (void *) hdev->sent_cmd->data;
3553
3554 if (hdr->opcode != cpu_to_le16(opcode))
3555 return NULL;
3556
3557 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3558
3559 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3560 }
3561
3562 /* Send ACL data */
3563 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3564 {
3565 struct hci_acl_hdr *hdr;
3566 int len = skb->len;
3567
3568 skb_push(skb, HCI_ACL_HDR_SIZE);
3569 skb_reset_transport_header(skb);
3570 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3571 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3572 hdr->dlen = cpu_to_le16(len);
3573 }
3574
3575 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
3576 struct sk_buff *skb, __u16 flags)
3577 {
3578 struct hci_conn *conn = chan->conn;
3579 struct hci_dev *hdev = conn->hdev;
3580 struct sk_buff *list;
3581
3582 skb->len = skb_headlen(skb);
3583 skb->data_len = 0;
3584
3585 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
3586
3587 switch (hdev->dev_type) {
3588 case HCI_BREDR:
3589 hci_add_acl_hdr(skb, conn->handle, flags);
3590 break;
3591 case HCI_AMP:
3592 hci_add_acl_hdr(skb, chan->handle, flags);
3593 break;
3594 default:
3595 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3596 return;
3597 }
3598
3599 list = skb_shinfo(skb)->frag_list;
3600 if (!list) {
3601 /* Non fragmented */
3602 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3603
3604 skb_queue_tail(queue, skb);
3605 } else {
3606 /* Fragmented */
3607 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3608
3609 skb_shinfo(skb)->frag_list = NULL;
3610
3611 /* Queue all fragments atomically. We need to use spin_lock_bh
3612 * here because of 6LoWPAN links, as there this function is
3613 * called from softirq and using normal spin lock could cause
3614 * deadlocks.
3615 */
3616 spin_lock_bh(&queue->lock);
3617
3618 __skb_queue_tail(queue, skb);
3619
3620 flags &= ~ACL_START;
3621 flags |= ACL_CONT;
3622 do {
3623 skb = list; list = list->next;
3624
3625 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
3626 hci_add_acl_hdr(skb, conn->handle, flags);
3627
3628 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3629
3630 __skb_queue_tail(queue, skb);
3631 } while (list);
3632
3633 spin_unlock_bh(&queue->lock);
3634 }
3635 }
3636
3637 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3638 {
3639 struct hci_dev *hdev = chan->conn->hdev;
3640
3641 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
3642
3643 hci_queue_acl(chan, &chan->data_q, skb, flags);
3644
3645 queue_work(hdev->workqueue, &hdev->tx_work);
3646 }
3647
3648 /* Send SCO data */
3649 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
3650 {
3651 struct hci_dev *hdev = conn->hdev;
3652 struct hci_sco_hdr hdr;
3653
3654 BT_DBG("%s len %d", hdev->name, skb->len);
3655
3656 hdr.handle = cpu_to_le16(conn->handle);
3657 hdr.dlen = skb->len;
3658
3659 skb_push(skb, HCI_SCO_HDR_SIZE);
3660 skb_reset_transport_header(skb);
3661 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
3662
3663 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
3664
3665 skb_queue_tail(&conn->data_q, skb);
3666 queue_work(hdev->workqueue, &hdev->tx_work);
3667 }
3668
3669 /* ---- HCI TX task (outgoing data) ---- */
3670
3671 /* HCI Connection scheduler */
3672 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3673 int *quote)
3674 {
3675 struct hci_conn_hash *h = &hdev->conn_hash;
3676 struct hci_conn *conn = NULL, *c;
3677 unsigned int num = 0, min = ~0;
3678
3679 /* We don't have to lock device here. Connections are always
3680 * added and removed with TX task disabled. */
3681
3682 rcu_read_lock();
3683
3684 list_for_each_entry_rcu(c, &h->list, list) {
3685 if (c->type != type || skb_queue_empty(&c->data_q))
3686 continue;
3687
3688 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3689 continue;
3690
3691 num++;
3692
3693 if (c->sent < min) {
3694 min = c->sent;
3695 conn = c;
3696 }
3697
3698 if (hci_conn_num(hdev, type) == num)
3699 break;
3700 }
3701
3702 rcu_read_unlock();
3703
3704 if (conn) {
3705 int cnt, q;
3706
3707 switch (conn->type) {
3708 case ACL_LINK:
3709 cnt = hdev->acl_cnt;
3710 break;
3711 case SCO_LINK:
3712 case ESCO_LINK:
3713 cnt = hdev->sco_cnt;
3714 break;
3715 case LE_LINK:
3716 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3717 break;
3718 default:
3719 cnt = 0;
3720 BT_ERR("Unknown link type");
3721 }
3722
3723 q = cnt / num;
3724 *quote = q ? q : 1;
3725 } else
3726 *quote = 0;
3727
3728 BT_DBG("conn %p quote %d", conn, *quote);
3729 return conn;
3730 }
3731
3732 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
3733 {
3734 struct hci_conn_hash *h = &hdev->conn_hash;
3735 struct hci_conn *c;
3736
3737 BT_ERR("%s link tx timeout", hdev->name);
3738
3739 rcu_read_lock();
3740
3741 /* Kill stalled connections */
3742 list_for_each_entry_rcu(c, &h->list, list) {
3743 if (c->type == type && c->sent) {
3744 BT_ERR("%s killing stalled connection %pMR",
3745 hdev->name, &c->dst);
3746 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3747 }
3748 }
3749
3750 rcu_read_unlock();
3751 }
3752
3753 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3754 int *quote)
3755 {
3756 struct hci_conn_hash *h = &hdev->conn_hash;
3757 struct hci_chan *chan = NULL;
3758 unsigned int num = 0, min = ~0, cur_prio = 0;
3759 struct hci_conn *conn;
3760 int cnt, q, conn_num = 0;
3761
3762 BT_DBG("%s", hdev->name);
3763
3764 rcu_read_lock();
3765
3766 list_for_each_entry_rcu(conn, &h->list, list) {
3767 struct hci_chan *tmp;
3768
3769 if (conn->type != type)
3770 continue;
3771
3772 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3773 continue;
3774
3775 conn_num++;
3776
3777 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
3778 struct sk_buff *skb;
3779
3780 if (skb_queue_empty(&tmp->data_q))
3781 continue;
3782
3783 skb = skb_peek(&tmp->data_q);
3784 if (skb->priority < cur_prio)
3785 continue;
3786
3787 if (skb->priority > cur_prio) {
3788 num = 0;
3789 min = ~0;
3790 cur_prio = skb->priority;
3791 }
3792
3793 num++;
3794
3795 if (conn->sent < min) {
3796 min = conn->sent;
3797 chan = tmp;
3798 }
3799 }
3800
3801 if (hci_conn_num(hdev, type) == conn_num)
3802 break;
3803 }
3804
3805 rcu_read_unlock();
3806
3807 if (!chan)
3808 return NULL;
3809
3810 switch (chan->conn->type) {
3811 case ACL_LINK:
3812 cnt = hdev->acl_cnt;
3813 break;
3814 case AMP_LINK:
3815 cnt = hdev->block_cnt;
3816 break;
3817 case SCO_LINK:
3818 case ESCO_LINK:
3819 cnt = hdev->sco_cnt;
3820 break;
3821 case LE_LINK:
3822 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3823 break;
3824 default:
3825 cnt = 0;
3826 BT_ERR("Unknown link type");
3827 }
3828
3829 q = cnt / num;
3830 *quote = q ? q : 1;
3831 BT_DBG("chan %p quote %d", chan, *quote);
3832 return chan;
3833 }
3834
3835 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3836 {
3837 struct hci_conn_hash *h = &hdev->conn_hash;
3838 struct hci_conn *conn;
3839 int num = 0;
3840
3841 BT_DBG("%s", hdev->name);
3842
3843 rcu_read_lock();
3844
3845 list_for_each_entry_rcu(conn, &h->list, list) {
3846 struct hci_chan *chan;
3847
3848 if (conn->type != type)
3849 continue;
3850
3851 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3852 continue;
3853
3854 num++;
3855
3856 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
3857 struct sk_buff *skb;
3858
3859 if (chan->sent) {
3860 chan->sent = 0;
3861 continue;
3862 }
3863
3864 if (skb_queue_empty(&chan->data_q))
3865 continue;
3866
3867 skb = skb_peek(&chan->data_q);
3868 if (skb->priority >= HCI_PRIO_MAX - 1)
3869 continue;
3870
3871 skb->priority = HCI_PRIO_MAX - 1;
3872
3873 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
3874 skb->priority);
3875 }
3876
3877 if (hci_conn_num(hdev, type) == num)
3878 break;
3879 }
3880
3881 rcu_read_unlock();
3882
3883 }
3884
3885 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3886 {
3887 /* Calculate count of blocks used by this packet */
3888 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3889 }
3890
3891 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
3892 {
3893 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
3894 /* ACL tx timeout must be longer than maximum
3895 * link supervision timeout (40.9 seconds) */
3896 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
3897 HCI_ACL_TX_TIMEOUT))
3898 hci_link_tx_to(hdev, ACL_LINK);
3899 }
3900 }
3901
3902 static void hci_sched_acl_pkt(struct hci_dev *hdev)
3903 {
3904 unsigned int cnt = hdev->acl_cnt;
3905 struct hci_chan *chan;
3906 struct sk_buff *skb;
3907 int quote;
3908
3909 __check_timeout(hdev, cnt);
3910
3911 while (hdev->acl_cnt &&
3912 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3913 u32 priority = (skb_peek(&chan->data_q))->priority;
3914 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3915 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3916 skb->len, skb->priority);
3917
3918 /* Stop if priority has changed */
3919 if (skb->priority < priority)
3920 break;
3921
3922 skb = skb_dequeue(&chan->data_q);
3923
3924 hci_conn_enter_active_mode(chan->conn,
3925 bt_cb(skb)->force_active);
3926
3927 hci_send_frame(hdev, skb);
3928 hdev->acl_last_tx = jiffies;
3929
3930 hdev->acl_cnt--;
3931 chan->sent++;
3932 chan->conn->sent++;
3933 }
3934 }
3935
3936 if (cnt != hdev->acl_cnt)
3937 hci_prio_recalculate(hdev, ACL_LINK);
3938 }
3939
3940 static void hci_sched_acl_blk(struct hci_dev *hdev)
3941 {
3942 unsigned int cnt = hdev->block_cnt;
3943 struct hci_chan *chan;
3944 struct sk_buff *skb;
3945 int quote;
3946 u8 type;
3947
3948 __check_timeout(hdev, cnt);
3949
3950 BT_DBG("%s", hdev->name);
3951
3952 if (hdev->dev_type == HCI_AMP)
3953 type = AMP_LINK;
3954 else
3955 type = ACL_LINK;
3956
3957 while (hdev->block_cnt > 0 &&
3958 (chan = hci_chan_sent(hdev, type, &quote))) {
3959 u32 priority = (skb_peek(&chan->data_q))->priority;
3960 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3961 int blocks;
3962
3963 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3964 skb->len, skb->priority);
3965
3966 /* Stop if priority has changed */
3967 if (skb->priority < priority)
3968 break;
3969
3970 skb = skb_dequeue(&chan->data_q);
3971
3972 blocks = __get_blocks(hdev, skb);
3973 if (blocks > hdev->block_cnt)
3974 return;
3975
3976 hci_conn_enter_active_mode(chan->conn,
3977 bt_cb(skb)->force_active);
3978
3979 hci_send_frame(hdev, skb);
3980 hdev->acl_last_tx = jiffies;
3981
3982 hdev->block_cnt -= blocks;
3983 quote -= blocks;
3984
3985 chan->sent += blocks;
3986 chan->conn->sent += blocks;
3987 }
3988 }
3989
3990 if (cnt != hdev->block_cnt)
3991 hci_prio_recalculate(hdev, type);
3992 }
3993
3994 static void hci_sched_acl(struct hci_dev *hdev)
3995 {
3996 BT_DBG("%s", hdev->name);
3997
3998 /* No ACL link over BR/EDR controller */
3999 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
4000 return;
4001
4002 /* No AMP link over AMP controller */
4003 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4004 return;
4005
4006 switch (hdev->flow_ctl_mode) {
4007 case HCI_FLOW_CTL_MODE_PACKET_BASED:
4008 hci_sched_acl_pkt(hdev);
4009 break;
4010
4011 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4012 hci_sched_acl_blk(hdev);
4013 break;
4014 }
4015 }
4016
4017 /* Schedule SCO */
4018 static void hci_sched_sco(struct hci_dev *hdev)
4019 {
4020 struct hci_conn *conn;
4021 struct sk_buff *skb;
4022 int quote;
4023
4024 BT_DBG("%s", hdev->name);
4025
4026 if (!hci_conn_num(hdev, SCO_LINK))
4027 return;
4028
4029 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
4030 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4031 BT_DBG("skb %p len %d", skb, skb->len);
4032 hci_send_frame(hdev, skb);
4033
4034 conn->sent++;
4035 if (conn->sent == ~0)
4036 conn->sent = 0;
4037 }
4038 }
4039 }
4040
4041 static void hci_sched_esco(struct hci_dev *hdev)
4042 {
4043 struct hci_conn *conn;
4044 struct sk_buff *skb;
4045 int quote;
4046
4047 BT_DBG("%s", hdev->name);
4048
4049 if (!hci_conn_num(hdev, ESCO_LINK))
4050 return;
4051
4052 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4053 &quote))) {
4054 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4055 BT_DBG("skb %p len %d", skb, skb->len);
4056 hci_send_frame(hdev, skb);
4057
4058 conn->sent++;
4059 if (conn->sent == ~0)
4060 conn->sent = 0;
4061 }
4062 }
4063 }
4064
4065 static void hci_sched_le(struct hci_dev *hdev)
4066 {
4067 struct hci_chan *chan;
4068 struct sk_buff *skb;
4069 int quote, cnt, tmp;
4070
4071 BT_DBG("%s", hdev->name);
4072
4073 if (!hci_conn_num(hdev, LE_LINK))
4074 return;
4075
4076 if (!test_bit(HCI_UNCONFIGURED, &hdev->dev_flags)) {
4077 /* LE tx timeout must be longer than maximum
4078 * link supervision timeout (40.9 seconds) */
4079 if (!hdev->le_cnt && hdev->le_pkts &&
4080 time_after(jiffies, hdev->le_last_tx + HZ * 45))
4081 hci_link_tx_to(hdev, LE_LINK);
4082 }
4083
4084 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
4085 tmp = cnt;
4086 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
4087 u32 priority = (skb_peek(&chan->data_q))->priority;
4088 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4089 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4090 skb->len, skb->priority);
4091
4092 /* Stop if priority has changed */
4093 if (skb->priority < priority)
4094 break;
4095
4096 skb = skb_dequeue(&chan->data_q);
4097
4098 hci_send_frame(hdev, skb);
4099 hdev->le_last_tx = jiffies;
4100
4101 cnt--;
4102 chan->sent++;
4103 chan->conn->sent++;
4104 }
4105 }
4106
4107 if (hdev->le_pkts)
4108 hdev->le_cnt = cnt;
4109 else
4110 hdev->acl_cnt = cnt;
4111
4112 if (cnt != tmp)
4113 hci_prio_recalculate(hdev, LE_LINK);
4114 }
4115
4116 static void hci_tx_work(struct work_struct *work)
4117 {
4118 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
4119 struct sk_buff *skb;
4120
4121 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
4122 hdev->sco_cnt, hdev->le_cnt);
4123
4124 if (!test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4125 /* Schedule queues and send stuff to HCI driver */
4126 hci_sched_acl(hdev);
4127 hci_sched_sco(hdev);
4128 hci_sched_esco(hdev);
4129 hci_sched_le(hdev);
4130 }
4131
4132 /* Send next queued raw (unknown type) packet */
4133 while ((skb = skb_dequeue(&hdev->raw_q)))
4134 hci_send_frame(hdev, skb);
4135 }
4136
4137 /* ----- HCI RX task (incoming data processing) ----- */
4138
4139 /* ACL data packet */
4140 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4141 {
4142 struct hci_acl_hdr *hdr = (void *) skb->data;
4143 struct hci_conn *conn;
4144 __u16 handle, flags;
4145
4146 skb_pull(skb, HCI_ACL_HDR_SIZE);
4147
4148 handle = __le16_to_cpu(hdr->handle);
4149 flags = hci_flags(handle);
4150 handle = hci_handle(handle);
4151
4152 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4153 handle, flags);
4154
4155 hdev->stat.acl_rx++;
4156
4157 hci_dev_lock(hdev);
4158 conn = hci_conn_hash_lookup_handle(hdev, handle);
4159 hci_dev_unlock(hdev);
4160
4161 if (conn) {
4162 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
4163
4164 /* Send to upper protocol */
4165 l2cap_recv_acldata(conn, skb, flags);
4166 return;
4167 } else {
4168 BT_ERR("%s ACL packet for unknown connection handle %d",
4169 hdev->name, handle);
4170 }
4171
4172 kfree_skb(skb);
4173 }
4174
4175 /* SCO data packet */
4176 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4177 {
4178 struct hci_sco_hdr *hdr = (void *) skb->data;
4179 struct hci_conn *conn;
4180 __u16 handle;
4181
4182 skb_pull(skb, HCI_SCO_HDR_SIZE);
4183
4184 handle = __le16_to_cpu(hdr->handle);
4185
4186 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
4187
4188 hdev->stat.sco_rx++;
4189
4190 hci_dev_lock(hdev);
4191 conn = hci_conn_hash_lookup_handle(hdev, handle);
4192 hci_dev_unlock(hdev);
4193
4194 if (conn) {
4195 /* Send to upper protocol */
4196 sco_recv_scodata(conn, skb);
4197 return;
4198 } else {
4199 BT_ERR("%s SCO packet for unknown connection handle %d",
4200 hdev->name, handle);
4201 }
4202
4203 kfree_skb(skb);
4204 }
4205
4206 static bool hci_req_is_complete(struct hci_dev *hdev)
4207 {
4208 struct sk_buff *skb;
4209
4210 skb = skb_peek(&hdev->cmd_q);
4211 if (!skb)
4212 return true;
4213
4214 return bt_cb(skb)->req.start;
4215 }
4216
4217 static void hci_resend_last(struct hci_dev *hdev)
4218 {
4219 struct hci_command_hdr *sent;
4220 struct sk_buff *skb;
4221 u16 opcode;
4222
4223 if (!hdev->sent_cmd)
4224 return;
4225
4226 sent = (void *) hdev->sent_cmd->data;
4227 opcode = __le16_to_cpu(sent->opcode);
4228 if (opcode == HCI_OP_RESET)
4229 return;
4230
4231 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4232 if (!skb)
4233 return;
4234
4235 skb_queue_head(&hdev->cmd_q, skb);
4236 queue_work(hdev->workqueue, &hdev->cmd_work);
4237 }
4238
4239 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
4240 {
4241 hci_req_complete_t req_complete = NULL;
4242 struct sk_buff *skb;
4243 unsigned long flags;
4244
4245 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4246
4247 /* If the completed command doesn't match the last one that was
4248 * sent we need to do special handling of it.
4249 */
4250 if (!hci_sent_cmd_data(hdev, opcode)) {
4251 /* Some CSR based controllers generate a spontaneous
4252 * reset complete event during init and any pending
4253 * command will never be completed. In such a case we
4254 * need to resend whatever was the last sent
4255 * command.
4256 */
4257 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4258 hci_resend_last(hdev);
4259
4260 return;
4261 }
4262
4263 /* If the command succeeded and there's still more commands in
4264 * this request the request is not yet complete.
4265 */
4266 if (!status && !hci_req_is_complete(hdev))
4267 return;
4268
4269 /* If this was the last command in a request the complete
4270 * callback would be found in hdev->sent_cmd instead of the
4271 * command queue (hdev->cmd_q).
4272 */
4273 if (hdev->sent_cmd) {
4274 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
4275
4276 if (req_complete) {
4277 /* We must set the complete callback to NULL to
4278 * avoid calling the callback more than once if
4279 * this function gets called again.
4280 */
4281 bt_cb(hdev->sent_cmd)->req.complete = NULL;
4282
4283 goto call_complete;
4284 }
4285 }
4286
4287 /* Remove all pending commands belonging to this request */
4288 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4289 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4290 if (bt_cb(skb)->req.start) {
4291 __skb_queue_head(&hdev->cmd_q, skb);
4292 break;
4293 }
4294
4295 req_complete = bt_cb(skb)->req.complete;
4296 kfree_skb(skb);
4297 }
4298 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4299
4300 call_complete:
4301 if (req_complete)
4302 req_complete(hdev, status, status ? opcode : HCI_OP_NOP);
4303 }
4304
4305 static void hci_rx_work(struct work_struct *work)
4306 {
4307 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
4308 struct sk_buff *skb;
4309
4310 BT_DBG("%s", hdev->name);
4311
4312 while ((skb = skb_dequeue(&hdev->rx_q))) {
4313 /* Send copy to monitor */
4314 hci_send_to_monitor(hdev, skb);
4315
4316 if (atomic_read(&hdev->promisc)) {
4317 /* Send copy to the sockets */
4318 hci_send_to_sock(hdev, skb);
4319 }
4320
4321 if (test_bit(HCI_USER_CHANNEL, &hdev->dev_flags)) {
4322 kfree_skb(skb);
4323 continue;
4324 }
4325
4326 if (test_bit(HCI_INIT, &hdev->flags)) {
4327 /* Don't process data packets in this states. */
4328 switch (bt_cb(skb)->pkt_type) {
4329 case HCI_ACLDATA_PKT:
4330 case HCI_SCODATA_PKT:
4331 kfree_skb(skb);
4332 continue;
4333 }
4334 }
4335
4336 /* Process frame */
4337 switch (bt_cb(skb)->pkt_type) {
4338 case HCI_EVENT_PKT:
4339 BT_DBG("%s Event packet", hdev->name);
4340 hci_event_packet(hdev, skb);
4341 break;
4342
4343 case HCI_ACLDATA_PKT:
4344 BT_DBG("%s ACL data packet", hdev->name);
4345 hci_acldata_packet(hdev, skb);
4346 break;
4347
4348 case HCI_SCODATA_PKT:
4349 BT_DBG("%s SCO data packet", hdev->name);
4350 hci_scodata_packet(hdev, skb);
4351 break;
4352
4353 default:
4354 kfree_skb(skb);
4355 break;
4356 }
4357 }
4358 }
4359
4360 static void hci_cmd_work(struct work_struct *work)
4361 {
4362 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4363 struct sk_buff *skb;
4364
4365 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4366 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4367
4368 /* Send queued commands */
4369 if (atomic_read(&hdev->cmd_cnt)) {
4370 skb = skb_dequeue(&hdev->cmd_q);
4371 if (!skb)
4372 return;
4373
4374 kfree_skb(hdev->sent_cmd);
4375
4376 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4377 if (hdev->sent_cmd) {
4378 atomic_dec(&hdev->cmd_cnt);
4379 hci_send_frame(hdev, skb);
4380 if (test_bit(HCI_RESET, &hdev->flags))
4381 cancel_delayed_work(&hdev->cmd_timer);
4382 else
4383 schedule_delayed_work(&hdev->cmd_timer,
4384 HCI_CMD_TIMEOUT);
4385 } else {
4386 skb_queue_head(&hdev->cmd_q, skb);
4387 queue_work(hdev->workqueue, &hdev->cmd_work);
4388 }
4389 }
4390 }
ubuntu-bionic-kernel mirror