]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/bluetooth/hci_core.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Merge branch 'misc' of git://git.kernel.org/pub/scm/linux/kernel/git/mmarek/kbuild
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_core.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2011 ProFUSION Embedded Systems
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth HCI core. */
27
28 #include <linux/export.h>
29 #include <linux/idr.h>
30 #include <linux/rfkill.h>
31 #include <linux/debugfs.h>
32 #include <linux/crypto.h>
33 #include <asm/unaligned.h>
34
35 #include <net/bluetooth/bluetooth.h>
36 #include <net/bluetooth/hci_core.h>
37 #include <net/bluetooth/l2cap.h>
38 #include <net/bluetooth/mgmt.h>
39
40 #include "hci_request.h"
41 #include "hci_debugfs.h"
42 #include "smp.h"
43
44 static void hci_rx_work(struct work_struct *work);
45 static void hci_cmd_work(struct work_struct *work);
46 static void hci_tx_work(struct work_struct *work);
47
48 /* HCI device list */
49 LIST_HEAD(hci_dev_list);
50 DEFINE_RWLOCK(hci_dev_list_lock);
51
52 /* HCI callback list */
53 LIST_HEAD(hci_cb_list);
54 DEFINE_MUTEX(hci_cb_list_lock);
55
56 /* HCI ID Numbering */
57 static DEFINE_IDA(hci_index_ida);
58
59 /* ----- HCI requests ----- */
60
61 #define HCI_REQ_DONE 0
62 #define HCI_REQ_PEND 1
63 #define HCI_REQ_CANCELED 2
64
65 #define hci_req_lock(d) mutex_lock(&d->req_lock)
66 #define hci_req_unlock(d) mutex_unlock(&d->req_lock)
67
68 /* ---- HCI notifications ---- */
69
70 static void hci_notify(struct hci_dev *hdev, int event)
71 {
72 hci_sock_dev_event(hdev, event);
73 }
74
75 /* ---- HCI debugfs entries ---- */
76
77 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
78 size_t count, loff_t *ppos)
79 {
80 struct hci_dev *hdev = file->private_data;
81 char buf[3];
82
83 buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y': 'N';
84 buf[1] = '\n';
85 buf[2] = '\0';
86 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
87 }
88
89 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
90 size_t count, loff_t *ppos)
91 {
92 struct hci_dev *hdev = file->private_data;
93 struct sk_buff *skb;
94 char buf[32];
95 size_t buf_size = min(count, (sizeof(buf)-1));
96 bool enable;
97 int err;
98
99 if (!test_bit(HCI_UP, &hdev->flags))
100 return -ENETDOWN;
101
102 if (copy_from_user(buf, user_buf, buf_size))
103 return -EFAULT;
104
105 buf[buf_size] = '\0';
106 if (strtobool(buf, &enable))
107 return -EINVAL;
108
109 if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
110 return -EALREADY;
111
112 hci_req_lock(hdev);
113 if (enable)
114 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
115 HCI_CMD_TIMEOUT);
116 else
117 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
118 HCI_CMD_TIMEOUT);
119 hci_req_unlock(hdev);
120
121 if (IS_ERR(skb))
122 return PTR_ERR(skb);
123
124 err = -bt_to_errno(skb->data[0]);
125 kfree_skb(skb);
126
127 if (err < 0)
128 return err;
129
130 hci_dev_change_flag(hdev, HCI_DUT_MODE);
131
132 return count;
133 }
134
135 static const struct file_operations dut_mode_fops = {
136 .open = simple_open,
137 .read = dut_mode_read,
138 .write = dut_mode_write,
139 .llseek = default_llseek,
140 };
141
142 /* ---- HCI requests ---- */
143
144 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
145 struct sk_buff *skb)
146 {
147 BT_DBG("%s result 0x%2.2x", hdev->name, result);
148
149 if (hdev->req_status == HCI_REQ_PEND) {
150 hdev->req_result = result;
151 hdev->req_status = HCI_REQ_DONE;
152 if (skb)
153 hdev->req_skb = skb_get(skb);
154 wake_up_interruptible(&hdev->req_wait_q);
155 }
156 }
157
158 static void hci_req_cancel(struct hci_dev *hdev, int err)
159 {
160 BT_DBG("%s err 0x%2.2x", hdev->name, err);
161
162 if (hdev->req_status == HCI_REQ_PEND) {
163 hdev->req_result = err;
164 hdev->req_status = HCI_REQ_CANCELED;
165 wake_up_interruptible(&hdev->req_wait_q);
166 }
167 }
168
169 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
170 const void *param, u8 event, u32 timeout)
171 {
172 DECLARE_WAITQUEUE(wait, current);
173 struct hci_request req;
174 struct sk_buff *skb;
175 int err = 0;
176
177 BT_DBG("%s", hdev->name);
178
179 hci_req_init(&req, hdev);
180
181 hci_req_add_ev(&req, opcode, plen, param, event);
182
183 hdev->req_status = HCI_REQ_PEND;
184
185 add_wait_queue(&hdev->req_wait_q, &wait);
186 set_current_state(TASK_INTERRUPTIBLE);
187
188 err = hci_req_run_skb(&req, hci_req_sync_complete);
189 if (err < 0) {
190 remove_wait_queue(&hdev->req_wait_q, &wait);
191 set_current_state(TASK_RUNNING);
192 return ERR_PTR(err);
193 }
194
195 schedule_timeout(timeout);
196
197 remove_wait_queue(&hdev->req_wait_q, &wait);
198
199 if (signal_pending(current))
200 return ERR_PTR(-EINTR);
201
202 switch (hdev->req_status) {
203 case HCI_REQ_DONE:
204 err = -bt_to_errno(hdev->req_result);
205 break;
206
207 case HCI_REQ_CANCELED:
208 err = -hdev->req_result;
209 break;
210
211 default:
212 err = -ETIMEDOUT;
213 break;
214 }
215
216 hdev->req_status = hdev->req_result = 0;
217 skb = hdev->req_skb;
218 hdev->req_skb = NULL;
219
220 BT_DBG("%s end: err %d", hdev->name, err);
221
222 if (err < 0) {
223 kfree_skb(skb);
224 return ERR_PTR(err);
225 }
226
227 if (!skb)
228 return ERR_PTR(-ENODATA);
229
230 return skb;
231 }
232 EXPORT_SYMBOL(__hci_cmd_sync_ev);
233
234 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
235 const void *param, u32 timeout)
236 {
237 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
238 }
239 EXPORT_SYMBOL(__hci_cmd_sync);
240
241 /* Execute request and wait for completion. */
242 static int __hci_req_sync(struct hci_dev *hdev,
243 void (*func)(struct hci_request *req,
244 unsigned long opt),
245 unsigned long opt, __u32 timeout)
246 {
247 struct hci_request req;
248 DECLARE_WAITQUEUE(wait, current);
249 int err = 0;
250
251 BT_DBG("%s start", hdev->name);
252
253 hci_req_init(&req, hdev);
254
255 hdev->req_status = HCI_REQ_PEND;
256
257 func(&req, opt);
258
259 add_wait_queue(&hdev->req_wait_q, &wait);
260 set_current_state(TASK_INTERRUPTIBLE);
261
262 err = hci_req_run_skb(&req, hci_req_sync_complete);
263 if (err < 0) {
264 hdev->req_status = 0;
265
266 remove_wait_queue(&hdev->req_wait_q, &wait);
267 set_current_state(TASK_RUNNING);
268
269 /* ENODATA means the HCI request command queue is empty.
270 * This can happen when a request with conditionals doesn't
271 * trigger any commands to be sent. This is normal behavior
272 * and should not trigger an error return.
273 */
274 if (err == -ENODATA)
275 return 0;
276
277 return err;
278 }
279
280 schedule_timeout(timeout);
281
282 remove_wait_queue(&hdev->req_wait_q, &wait);
283
284 if (signal_pending(current))
285 return -EINTR;
286
287 switch (hdev->req_status) {
288 case HCI_REQ_DONE:
289 err = -bt_to_errno(hdev->req_result);
290 break;
291
292 case HCI_REQ_CANCELED:
293 err = -hdev->req_result;
294 break;
295
296 default:
297 err = -ETIMEDOUT;
298 break;
299 }
300
301 hdev->req_status = hdev->req_result = 0;
302
303 BT_DBG("%s end: err %d", hdev->name, err);
304
305 return err;
306 }
307
308 static int hci_req_sync(struct hci_dev *hdev,
309 void (*req)(struct hci_request *req,
310 unsigned long opt),
311 unsigned long opt, __u32 timeout)
312 {
313 int ret;
314
315 if (!test_bit(HCI_UP, &hdev->flags))
316 return -ENETDOWN;
317
318 /* Serialize all requests */
319 hci_req_lock(hdev);
320 ret = __hci_req_sync(hdev, req, opt, timeout);
321 hci_req_unlock(hdev);
322
323 return ret;
324 }
325
326 static void hci_reset_req(struct hci_request *req, unsigned long opt)
327 {
328 BT_DBG("%s %ld", req->hdev->name, opt);
329
330 /* Reset device */
331 set_bit(HCI_RESET, &req->hdev->flags);
332 hci_req_add(req, HCI_OP_RESET, 0, NULL);
333 }
334
335 static void bredr_init(struct hci_request *req)
336 {
337 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
338
339 /* Read Local Supported Features */
340 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
341
342 /* Read Local Version */
343 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
344
345 /* Read BD Address */
346 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
347 }
348
349 static void amp_init1(struct hci_request *req)
350 {
351 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
352
353 /* Read Local Version */
354 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
355
356 /* Read Local Supported Commands */
357 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
358
359 /* Read Local AMP Info */
360 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
361
362 /* Read Data Blk size */
363 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
364
365 /* Read Flow Control Mode */
366 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
367
368 /* Read Location Data */
369 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
370 }
371
372 static void amp_init2(struct hci_request *req)
373 {
374 /* Read Local Supported Features. Not all AMP controllers
375 * support this so it's placed conditionally in the second
376 * stage init.
377 */
378 if (req->hdev->commands[14] & 0x20)
379 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
380 }
381
382 static void hci_init1_req(struct hci_request *req, unsigned long opt)
383 {
384 struct hci_dev *hdev = req->hdev;
385
386 BT_DBG("%s %ld", hdev->name, opt);
387
388 /* Reset */
389 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
390 hci_reset_req(req, 0);
391
392 switch (hdev->dev_type) {
393 case HCI_BREDR:
394 bredr_init(req);
395 break;
396
397 case HCI_AMP:
398 amp_init1(req);
399 break;
400
401 default:
402 BT_ERR("Unknown device type %d", hdev->dev_type);
403 break;
404 }
405 }
406
407 static void bredr_setup(struct hci_request *req)
408 {
409 __le16 param;
410 __u8 flt_type;
411
412 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
413 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
414
415 /* Read Class of Device */
416 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
417
418 /* Read Local Name */
419 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
420
421 /* Read Voice Setting */
422 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
423
424 /* Read Number of Supported IAC */
425 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
426
427 /* Read Current IAC LAP */
428 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
429
430 /* Clear Event Filters */
431 flt_type = HCI_FLT_CLEAR_ALL;
432 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
433
434 /* Connection accept timeout ~20 secs */
435 param = cpu_to_le16(0x7d00);
436 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
437 }
438
439 static void le_setup(struct hci_request *req)
440 {
441 struct hci_dev *hdev = req->hdev;
442
443 /* Read LE Buffer Size */
444 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
445
446 /* Read LE Local Supported Features */
447 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
448
449 /* Read LE Supported States */
450 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
451
452 /* Read LE White List Size */
453 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
454
455 /* Clear LE White List */
456 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
457
458 /* LE-only controllers have LE implicitly enabled */
459 if (!lmp_bredr_capable(hdev))
460 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
461 }
462
463 static void hci_setup_event_mask(struct hci_request *req)
464 {
465 struct hci_dev *hdev = req->hdev;
466
467 /* The second byte is 0xff instead of 0x9f (two reserved bits
468 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
469 * command otherwise.
470 */
471 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
472
473 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
474 * any event mask for pre 1.2 devices.
475 */
476 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
477 return;
478
479 if (lmp_bredr_capable(hdev)) {
480 events[4] |= 0x01; /* Flow Specification Complete */
481 events[4] |= 0x02; /* Inquiry Result with RSSI */
482 events[4] |= 0x04; /* Read Remote Extended Features Complete */
483 events[5] |= 0x08; /* Synchronous Connection Complete */
484 events[5] |= 0x10; /* Synchronous Connection Changed */
485 } else {
486 /* Use a different default for LE-only devices */
487 memset(events, 0, sizeof(events));
488 events[0] |= 0x10; /* Disconnection Complete */
489 events[1] |= 0x08; /* Read Remote Version Information Complete */
490 events[1] |= 0x20; /* Command Complete */
491 events[1] |= 0x40; /* Command Status */
492 events[1] |= 0x80; /* Hardware Error */
493 events[2] |= 0x04; /* Number of Completed Packets */
494 events[3] |= 0x02; /* Data Buffer Overflow */
495
496 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
497 events[0] |= 0x80; /* Encryption Change */
498 events[5] |= 0x80; /* Encryption Key Refresh Complete */
499 }
500 }
501
502 if (lmp_inq_rssi_capable(hdev))
503 events[4] |= 0x02; /* Inquiry Result with RSSI */
504
505 if (lmp_sniffsubr_capable(hdev))
506 events[5] |= 0x20; /* Sniff Subrating */
507
508 if (lmp_pause_enc_capable(hdev))
509 events[5] |= 0x80; /* Encryption Key Refresh Complete */
510
511 if (lmp_ext_inq_capable(hdev))
512 events[5] |= 0x40; /* Extended Inquiry Result */
513
514 if (lmp_no_flush_capable(hdev))
515 events[7] |= 0x01; /* Enhanced Flush Complete */
516
517 if (lmp_lsto_capable(hdev))
518 events[6] |= 0x80; /* Link Supervision Timeout Changed */
519
520 if (lmp_ssp_capable(hdev)) {
521 events[6] |= 0x01; /* IO Capability Request */
522 events[6] |= 0x02; /* IO Capability Response */
523 events[6] |= 0x04; /* User Confirmation Request */
524 events[6] |= 0x08; /* User Passkey Request */
525 events[6] |= 0x10; /* Remote OOB Data Request */
526 events[6] |= 0x20; /* Simple Pairing Complete */
527 events[7] |= 0x04; /* User Passkey Notification */
528 events[7] |= 0x08; /* Keypress Notification */
529 events[7] |= 0x10; /* Remote Host Supported
530 * Features Notification
531 */
532 }
533
534 if (lmp_le_capable(hdev))
535 events[7] |= 0x20; /* LE Meta-Event */
536
537 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
538 }
539
540 static void hci_init2_req(struct hci_request *req, unsigned long opt)
541 {
542 struct hci_dev *hdev = req->hdev;
543
544 if (hdev->dev_type == HCI_AMP)
545 return amp_init2(req);
546
547 if (lmp_bredr_capable(hdev))
548 bredr_setup(req);
549 else
550 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
551
552 if (lmp_le_capable(hdev))
553 le_setup(req);
554
555 /* All Bluetooth 1.2 and later controllers should support the
556 * HCI command for reading the local supported commands.
557 *
558 * Unfortunately some controllers indicate Bluetooth 1.2 support,
559 * but do not have support for this command. If that is the case,
560 * the driver can quirk the behavior and skip reading the local
561 * supported commands.
562 */
563 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
564 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
565 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
566
567 if (lmp_ssp_capable(hdev)) {
568 /* When SSP is available, then the host features page
569 * should also be available as well. However some
570 * controllers list the max_page as 0 as long as SSP
571 * has not been enabled. To achieve proper debugging
572 * output, force the minimum max_page to 1 at least.
573 */
574 hdev->max_page = 0x01;
575
576 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
577 u8 mode = 0x01;
578
579 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
580 sizeof(mode), &mode);
581 } else {
582 struct hci_cp_write_eir cp;
583
584 memset(hdev->eir, 0, sizeof(hdev->eir));
585 memset(&cp, 0, sizeof(cp));
586
587 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
588 }
589 }
590
591 if (lmp_inq_rssi_capable(hdev) ||
592 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
593 u8 mode;
594
595 /* If Extended Inquiry Result events are supported, then
596 * they are clearly preferred over Inquiry Result with RSSI
597 * events.
598 */
599 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
600
601 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
602 }
603
604 if (lmp_inq_tx_pwr_capable(hdev))
605 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
606
607 if (lmp_ext_feat_capable(hdev)) {
608 struct hci_cp_read_local_ext_features cp;
609
610 cp.page = 0x01;
611 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
612 sizeof(cp), &cp);
613 }
614
615 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
616 u8 enable = 1;
617 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
618 &enable);
619 }
620 }
621
622 static void hci_setup_link_policy(struct hci_request *req)
623 {
624 struct hci_dev *hdev = req->hdev;
625 struct hci_cp_write_def_link_policy cp;
626 u16 link_policy = 0;
627
628 if (lmp_rswitch_capable(hdev))
629 link_policy |= HCI_LP_RSWITCH;
630 if (lmp_hold_capable(hdev))
631 link_policy |= HCI_LP_HOLD;
632 if (lmp_sniff_capable(hdev))
633 link_policy |= HCI_LP_SNIFF;
634 if (lmp_park_capable(hdev))
635 link_policy |= HCI_LP_PARK;
636
637 cp.policy = cpu_to_le16(link_policy);
638 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
639 }
640
641 static void hci_set_le_support(struct hci_request *req)
642 {
643 struct hci_dev *hdev = req->hdev;
644 struct hci_cp_write_le_host_supported cp;
645
646 /* LE-only devices do not support explicit enablement */
647 if (!lmp_bredr_capable(hdev))
648 return;
649
650 memset(&cp, 0, sizeof(cp));
651
652 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
653 cp.le = 0x01;
654 cp.simul = 0x00;
655 }
656
657 if (cp.le != lmp_host_le_capable(hdev))
658 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
659 &cp);
660 }
661
662 static void hci_set_event_mask_page_2(struct hci_request *req)
663 {
664 struct hci_dev *hdev = req->hdev;
665 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
666
667 /* If Connectionless Slave Broadcast master role is supported
668 * enable all necessary events for it.
669 */
670 if (lmp_csb_master_capable(hdev)) {
671 events[1] |= 0x40; /* Triggered Clock Capture */
672 events[1] |= 0x80; /* Synchronization Train Complete */
673 events[2] |= 0x10; /* Slave Page Response Timeout */
674 events[2] |= 0x20; /* CSB Channel Map Change */
675 }
676
677 /* If Connectionless Slave Broadcast slave role is supported
678 * enable all necessary events for it.
679 */
680 if (lmp_csb_slave_capable(hdev)) {
681 events[2] |= 0x01; /* Synchronization Train Received */
682 events[2] |= 0x02; /* CSB Receive */
683 events[2] |= 0x04; /* CSB Timeout */
684 events[2] |= 0x08; /* Truncated Page Complete */
685 }
686
687 /* Enable Authenticated Payload Timeout Expired event if supported */
688 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
689 events[2] |= 0x80;
690
691 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
692 }
693
694 static void hci_init3_req(struct hci_request *req, unsigned long opt)
695 {
696 struct hci_dev *hdev = req->hdev;
697 u8 p;
698
699 hci_setup_event_mask(req);
700
701 if (hdev->commands[6] & 0x20) {
702 struct hci_cp_read_stored_link_key cp;
703
704 bacpy(&cp.bdaddr, BDADDR_ANY);
705 cp.read_all = 0x01;
706 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
707 }
708
709 if (hdev->commands[5] & 0x10)
710 hci_setup_link_policy(req);
711
712 if (hdev->commands[8] & 0x01)
713 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
714
715 /* Some older Broadcom based Bluetooth 1.2 controllers do not
716 * support the Read Page Scan Type command. Check support for
717 * this command in the bit mask of supported commands.
718 */
719 if (hdev->commands[13] & 0x01)
720 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
721
722 if (lmp_le_capable(hdev)) {
723 u8 events[8];
724
725 memset(events, 0, sizeof(events));
726 events[0] = 0x0f;
727
728 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
729 events[0] |= 0x10; /* LE Long Term Key Request */
730
731 /* If controller supports the Connection Parameters Request
732 * Link Layer Procedure, enable the corresponding event.
733 */
734 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
735 events[0] |= 0x20; /* LE Remote Connection
736 * Parameter Request
737 */
738
739 /* If the controller supports the Data Length Extension
740 * feature, enable the corresponding event.
741 */
742 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
743 events[0] |= 0x40; /* LE Data Length Change */
744
745 /* If the controller supports Extended Scanner Filter
746 * Policies, enable the correspondig event.
747 */
748 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
749 events[1] |= 0x04; /* LE Direct Advertising
750 * Report
751 */
752
753 /* If the controller supports the LE Read Local P-256
754 * Public Key command, enable the corresponding event.
755 */
756 if (hdev->commands[34] & 0x02)
757 events[0] |= 0x80; /* LE Read Local P-256
758 * Public Key Complete
759 */
760
761 /* If the controller supports the LE Generate DHKey
762 * command, enable the corresponding event.
763 */
764 if (hdev->commands[34] & 0x04)
765 events[1] |= 0x01; /* LE Generate DHKey Complete */
766
767 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
768 events);
769
770 if (hdev->commands[25] & 0x40) {
771 /* Read LE Advertising Channel TX Power */
772 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
773 }
774
775 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
776 /* Read LE Maximum Data Length */
777 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
778
779 /* Read LE Suggested Default Data Length */
780 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
781 }
782
783 hci_set_le_support(req);
784 }
785
786 /* Read features beyond page 1 if available */
787 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
788 struct hci_cp_read_local_ext_features cp;
789
790 cp.page = p;
791 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
792 sizeof(cp), &cp);
793 }
794 }
795
796 static void hci_init4_req(struct hci_request *req, unsigned long opt)
797 {
798 struct hci_dev *hdev = req->hdev;
799
800 /* Some Broadcom based Bluetooth controllers do not support the
801 * Delete Stored Link Key command. They are clearly indicating its
802 * absence in the bit mask of supported commands.
803 *
804 * Check the supported commands and only if the the command is marked
805 * as supported send it. If not supported assume that the controller
806 * does not have actual support for stored link keys which makes this
807 * command redundant anyway.
808 *
809 * Some controllers indicate that they support handling deleting
810 * stored link keys, but they don't. The quirk lets a driver
811 * just disable this command.
812 */
813 if (hdev->commands[6] & 0x80 &&
814 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
815 struct hci_cp_delete_stored_link_key cp;
816
817 bacpy(&cp.bdaddr, BDADDR_ANY);
818 cp.delete_all = 0x01;
819 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
820 sizeof(cp), &cp);
821 }
822
823 /* Set event mask page 2 if the HCI command for it is supported */
824 if (hdev->commands[22] & 0x04)
825 hci_set_event_mask_page_2(req);
826
827 /* Read local codec list if the HCI command is supported */
828 if (hdev->commands[29] & 0x20)
829 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
830
831 /* Get MWS transport configuration if the HCI command is supported */
832 if (hdev->commands[30] & 0x08)
833 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
834
835 /* Check for Synchronization Train support */
836 if (lmp_sync_train_capable(hdev))
837 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
838
839 /* Enable Secure Connections if supported and configured */
840 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
841 bredr_sc_enabled(hdev)) {
842 u8 support = 0x01;
843
844 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
845 sizeof(support), &support);
846 }
847 }
848
849 static int __hci_init(struct hci_dev *hdev)
850 {
851 int err;
852
853 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
854 if (err < 0)
855 return err;
856
857 /* The Device Under Test (DUT) mode is special and available for
858 * all controller types. So just create it early on.
859 */
860 if (hci_dev_test_flag(hdev, HCI_SETUP)) {
861 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
862 &dut_mode_fops);
863 }
864
865 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
866 if (err < 0)
867 return err;
868
869 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
870 * BR/EDR/LE type controllers. AMP controllers only need the
871 * first two stages of init.
872 */
873 if (hdev->dev_type != HCI_BREDR)
874 return 0;
875
876 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
877 if (err < 0)
878 return err;
879
880 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
881 if (err < 0)
882 return err;
883
884 /* This function is only called when the controller is actually in
885 * configured state. When the controller is marked as unconfigured,
886 * this initialization procedure is not run.
887 *
888 * It means that it is possible that a controller runs through its
889 * setup phase and then discovers missing settings. If that is the
890 * case, then this function will not be called. It then will only
891 * be called during the config phase.
892 *
893 * So only when in setup phase or config phase, create the debugfs
894 * entries and register the SMP channels.
895 */
896 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
897 !hci_dev_test_flag(hdev, HCI_CONFIG))
898 return 0;
899
900 hci_debugfs_create_common(hdev);
901
902 if (lmp_bredr_capable(hdev))
903 hci_debugfs_create_bredr(hdev);
904
905 if (lmp_le_capable(hdev))
906 hci_debugfs_create_le(hdev);
907
908 return 0;
909 }
910
911 static void hci_init0_req(struct hci_request *req, unsigned long opt)
912 {
913 struct hci_dev *hdev = req->hdev;
914
915 BT_DBG("%s %ld", hdev->name, opt);
916
917 /* Reset */
918 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
919 hci_reset_req(req, 0);
920
921 /* Read Local Version */
922 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
923
924 /* Read BD Address */
925 if (hdev->set_bdaddr)
926 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
927 }
928
929 static int __hci_unconf_init(struct hci_dev *hdev)
930 {
931 int err;
932
933 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
934 return 0;
935
936 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT);
937 if (err < 0)
938 return err;
939
940 return 0;
941 }
942
943 static void hci_scan_req(struct hci_request *req, unsigned long opt)
944 {
945 __u8 scan = opt;
946
947 BT_DBG("%s %x", req->hdev->name, scan);
948
949 /* Inquiry and Page scans */
950 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
951 }
952
953 static void hci_auth_req(struct hci_request *req, unsigned long opt)
954 {
955 __u8 auth = opt;
956
957 BT_DBG("%s %x", req->hdev->name, auth);
958
959 /* Authentication */
960 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
961 }
962
963 static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
964 {
965 __u8 encrypt = opt;
966
967 BT_DBG("%s %x", req->hdev->name, encrypt);
968
969 /* Encryption */
970 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
971 }
972
973 static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
974 {
975 __le16 policy = cpu_to_le16(opt);
976
977 BT_DBG("%s %x", req->hdev->name, policy);
978
979 /* Default link policy */
980 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
981 }
982
983 /* Get HCI device by index.
984 * Device is held on return. */
985 struct hci_dev *hci_dev_get(int index)
986 {
987 struct hci_dev *hdev = NULL, *d;
988
989 BT_DBG("%d", index);
990
991 if (index < 0)
992 return NULL;
993
994 read_lock(&hci_dev_list_lock);
995 list_for_each_entry(d, &hci_dev_list, list) {
996 if (d->id == index) {
997 hdev = hci_dev_hold(d);
998 break;
999 }
1000 }
1001 read_unlock(&hci_dev_list_lock);
1002 return hdev;
1003 }
1004
1005 /* ---- Inquiry support ---- */
1006
1007 bool hci_discovery_active(struct hci_dev *hdev)
1008 {
1009 struct discovery_state *discov = &hdev->discovery;
1010
1011 switch (discov->state) {
1012 case DISCOVERY_FINDING:
1013 case DISCOVERY_RESOLVING:
1014 return true;
1015
1016 default:
1017 return false;
1018 }
1019 }
1020
1021 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1022 {
1023 int old_state = hdev->discovery.state;
1024
1025 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1026
1027 if (old_state == state)
1028 return;
1029
1030 hdev->discovery.state = state;
1031
1032 switch (state) {
1033 case DISCOVERY_STOPPED:
1034 hci_update_background_scan(hdev);
1035
1036 if (old_state != DISCOVERY_STARTING)
1037 mgmt_discovering(hdev, 0);
1038 break;
1039 case DISCOVERY_STARTING:
1040 break;
1041 case DISCOVERY_FINDING:
1042 mgmt_discovering(hdev, 1);
1043 break;
1044 case DISCOVERY_RESOLVING:
1045 break;
1046 case DISCOVERY_STOPPING:
1047 break;
1048 }
1049 }
1050
1051 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1052 {
1053 struct discovery_state *cache = &hdev->discovery;
1054 struct inquiry_entry *p, *n;
1055
1056 list_for_each_entry_safe(p, n, &cache->all, all) {
1057 list_del(&p->all);
1058 kfree(p);
1059 }
1060
1061 INIT_LIST_HEAD(&cache->unknown);
1062 INIT_LIST_HEAD(&cache->resolve);
1063 }
1064
1065 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1066 bdaddr_t *bdaddr)
1067 {
1068 struct discovery_state *cache = &hdev->discovery;
1069 struct inquiry_entry *e;
1070
1071 BT_DBG("cache %p, %pMR", cache, bdaddr);
1072
1073 list_for_each_entry(e, &cache->all, all) {
1074 if (!bacmp(&e->data.bdaddr, bdaddr))
1075 return e;
1076 }
1077
1078 return NULL;
1079 }
1080
1081 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1082 bdaddr_t *bdaddr)
1083 {
1084 struct discovery_state *cache = &hdev->discovery;
1085 struct inquiry_entry *e;
1086
1087 BT_DBG("cache %p, %pMR", cache, bdaddr);
1088
1089 list_for_each_entry(e, &cache->unknown, list) {
1090 if (!bacmp(&e->data.bdaddr, bdaddr))
1091 return e;
1092 }
1093
1094 return NULL;
1095 }
1096
1097 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1098 bdaddr_t *bdaddr,
1099 int state)
1100 {
1101 struct discovery_state *cache = &hdev->discovery;
1102 struct inquiry_entry *e;
1103
1104 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1105
1106 list_for_each_entry(e, &cache->resolve, list) {
1107 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1108 return e;
1109 if (!bacmp(&e->data.bdaddr, bdaddr))
1110 return e;
1111 }
1112
1113 return NULL;
1114 }
1115
1116 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1117 struct inquiry_entry *ie)
1118 {
1119 struct discovery_state *cache = &hdev->discovery;
1120 struct list_head *pos = &cache->resolve;
1121 struct inquiry_entry *p;
1122
1123 list_del(&ie->list);
1124
1125 list_for_each_entry(p, &cache->resolve, list) {
1126 if (p->name_state != NAME_PENDING &&
1127 abs(p->data.rssi) >= abs(ie->data.rssi))
1128 break;
1129 pos = &p->list;
1130 }
1131
1132 list_add(&ie->list, pos);
1133 }
1134
1135 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1136 bool name_known)
1137 {
1138 struct discovery_state *cache = &hdev->discovery;
1139 struct inquiry_entry *ie;
1140 u32 flags = 0;
1141
1142 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1143
1144 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1145
1146 if (!data->ssp_mode)
1147 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1148
1149 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1150 if (ie) {
1151 if (!ie->data.ssp_mode)
1152 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1153
1154 if (ie->name_state == NAME_NEEDED &&
1155 data->rssi != ie->data.rssi) {
1156 ie->data.rssi = data->rssi;
1157 hci_inquiry_cache_update_resolve(hdev, ie);
1158 }
1159
1160 goto update;
1161 }
1162
1163 /* Entry not in the cache. Add new one. */
1164 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1165 if (!ie) {
1166 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1167 goto done;
1168 }
1169
1170 list_add(&ie->all, &cache->all);
1171
1172 if (name_known) {
1173 ie->name_state = NAME_KNOWN;
1174 } else {
1175 ie->name_state = NAME_NOT_KNOWN;
1176 list_add(&ie->list, &cache->unknown);
1177 }
1178
1179 update:
1180 if (name_known && ie->name_state != NAME_KNOWN &&
1181 ie->name_state != NAME_PENDING) {
1182 ie->name_state = NAME_KNOWN;
1183 list_del(&ie->list);
1184 }
1185
1186 memcpy(&ie->data, data, sizeof(*data));
1187 ie->timestamp = jiffies;
1188 cache->timestamp = jiffies;
1189
1190 if (ie->name_state == NAME_NOT_KNOWN)
1191 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1192
1193 done:
1194 return flags;
1195 }
1196
1197 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1198 {
1199 struct discovery_state *cache = &hdev->discovery;
1200 struct inquiry_info *info = (struct inquiry_info *) buf;
1201 struct inquiry_entry *e;
1202 int copied = 0;
1203
1204 list_for_each_entry(e, &cache->all, all) {
1205 struct inquiry_data *data = &e->data;
1206
1207 if (copied >= num)
1208 break;
1209
1210 bacpy(&info->bdaddr, &data->bdaddr);
1211 info->pscan_rep_mode = data->pscan_rep_mode;
1212 info->pscan_period_mode = data->pscan_period_mode;
1213 info->pscan_mode = data->pscan_mode;
1214 memcpy(info->dev_class, data->dev_class, 3);
1215 info->clock_offset = data->clock_offset;
1216
1217 info++;
1218 copied++;
1219 }
1220
1221 BT_DBG("cache %p, copied %d", cache, copied);
1222 return copied;
1223 }
1224
1225 static void hci_inq_req(struct hci_request *req, unsigned long opt)
1226 {
1227 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1228 struct hci_dev *hdev = req->hdev;
1229 struct hci_cp_inquiry cp;
1230
1231 BT_DBG("%s", hdev->name);
1232
1233 if (test_bit(HCI_INQUIRY, &hdev->flags))
1234 return;
1235
1236 /* Start Inquiry */
1237 memcpy(&cp.lap, &ir->lap, 3);
1238 cp.length = ir->length;
1239 cp.num_rsp = ir->num_rsp;
1240 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1241 }
1242
1243 int hci_inquiry(void __user *arg)
1244 {
1245 __u8 __user *ptr = arg;
1246 struct hci_inquiry_req ir;
1247 struct hci_dev *hdev;
1248 int err = 0, do_inquiry = 0, max_rsp;
1249 long timeo;
1250 __u8 *buf;
1251
1252 if (copy_from_user(&ir, ptr, sizeof(ir)))
1253 return -EFAULT;
1254
1255 hdev = hci_dev_get(ir.dev_id);
1256 if (!hdev)
1257 return -ENODEV;
1258
1259 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1260 err = -EBUSY;
1261 goto done;
1262 }
1263
1264 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1265 err = -EOPNOTSUPP;
1266 goto done;
1267 }
1268
1269 if (hdev->dev_type != HCI_BREDR) {
1270 err = -EOPNOTSUPP;
1271 goto done;
1272 }
1273
1274 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1275 err = -EOPNOTSUPP;
1276 goto done;
1277 }
1278
1279 hci_dev_lock(hdev);
1280 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1281 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1282 hci_inquiry_cache_flush(hdev);
1283 do_inquiry = 1;
1284 }
1285 hci_dev_unlock(hdev);
1286
1287 timeo = ir.length * msecs_to_jiffies(2000);
1288
1289 if (do_inquiry) {
1290 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1291 timeo);
1292 if (err < 0)
1293 goto done;
1294
1295 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1296 * cleared). If it is interrupted by a signal, return -EINTR.
1297 */
1298 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1299 TASK_INTERRUPTIBLE))
1300 return -EINTR;
1301 }
1302
1303 /* for unlimited number of responses we will use buffer with
1304 * 255 entries
1305 */
1306 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1307
1308 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1309 * copy it to the user space.
1310 */
1311 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
1312 if (!buf) {
1313 err = -ENOMEM;
1314 goto done;
1315 }
1316
1317 hci_dev_lock(hdev);
1318 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1319 hci_dev_unlock(hdev);
1320
1321 BT_DBG("num_rsp %d", ir.num_rsp);
1322
1323 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1324 ptr += sizeof(ir);
1325 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1326 ir.num_rsp))
1327 err = -EFAULT;
1328 } else
1329 err = -EFAULT;
1330
1331 kfree(buf);
1332
1333 done:
1334 hci_dev_put(hdev);
1335 return err;
1336 }
1337
1338 static int hci_dev_do_open(struct hci_dev *hdev)
1339 {
1340 int ret = 0;
1341
1342 BT_DBG("%s %p", hdev->name, hdev);
1343
1344 hci_req_lock(hdev);
1345
1346 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1347 ret = -ENODEV;
1348 goto done;
1349 }
1350
1351 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1352 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1353 /* Check for rfkill but allow the HCI setup stage to
1354 * proceed (which in itself doesn't cause any RF activity).
1355 */
1356 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1357 ret = -ERFKILL;
1358 goto done;
1359 }
1360
1361 /* Check for valid public address or a configured static
1362 * random adddress, but let the HCI setup proceed to
1363 * be able to determine if there is a public address
1364 * or not.
1365 *
1366 * In case of user channel usage, it is not important
1367 * if a public address or static random address is
1368 * available.
1369 *
1370 * This check is only valid for BR/EDR controllers
1371 * since AMP controllers do not have an address.
1372 */
1373 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1374 hdev->dev_type == HCI_BREDR &&
1375 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1376 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1377 ret = -EADDRNOTAVAIL;
1378 goto done;
1379 }
1380 }
1381
1382 if (test_bit(HCI_UP, &hdev->flags)) {
1383 ret = -EALREADY;
1384 goto done;
1385 }
1386
1387 if (hdev->open(hdev)) {
1388 ret = -EIO;
1389 goto done;
1390 }
1391
1392 atomic_set(&hdev->cmd_cnt, 1);
1393 set_bit(HCI_INIT, &hdev->flags);
1394
1395 if (hci_dev_test_flag(hdev, HCI_SETUP)) {
1396 if (hdev->setup)
1397 ret = hdev->setup(hdev);
1398
1399 /* The transport driver can set these quirks before
1400 * creating the HCI device or in its setup callback.
1401 *
1402 * In case any of them is set, the controller has to
1403 * start up as unconfigured.
1404 */
1405 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1406 test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
1407 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1408
1409 /* For an unconfigured controller it is required to
1410 * read at least the version information provided by
1411 * the Read Local Version Information command.
1412 *
1413 * If the set_bdaddr driver callback is provided, then
1414 * also the original Bluetooth public device address
1415 * will be read using the Read BD Address command.
1416 */
1417 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1418 ret = __hci_unconf_init(hdev);
1419 }
1420
1421 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1422 /* If public address change is configured, ensure that
1423 * the address gets programmed. If the driver does not
1424 * support changing the public address, fail the power
1425 * on procedure.
1426 */
1427 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1428 hdev->set_bdaddr)
1429 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1430 else
1431 ret = -EADDRNOTAVAIL;
1432 }
1433
1434 if (!ret) {
1435 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1436 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
1437 ret = __hci_init(hdev);
1438 }
1439
1440 clear_bit(HCI_INIT, &hdev->flags);
1441
1442 if (!ret) {
1443 hci_dev_hold(hdev);
1444 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1445 set_bit(HCI_UP, &hdev->flags);
1446 hci_notify(hdev, HCI_DEV_UP);
1447 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1448 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1449 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1450 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1451 hdev->dev_type == HCI_BREDR) {
1452 hci_dev_lock(hdev);
1453 mgmt_powered(hdev, 1);
1454 hci_dev_unlock(hdev);
1455 }
1456 } else {
1457 /* Init failed, cleanup */
1458 flush_work(&hdev->tx_work);
1459 flush_work(&hdev->cmd_work);
1460 flush_work(&hdev->rx_work);
1461
1462 skb_queue_purge(&hdev->cmd_q);
1463 skb_queue_purge(&hdev->rx_q);
1464
1465 if (hdev->flush)
1466 hdev->flush(hdev);
1467
1468 if (hdev->sent_cmd) {
1469 kfree_skb(hdev->sent_cmd);
1470 hdev->sent_cmd = NULL;
1471 }
1472
1473 hdev->close(hdev);
1474 hdev->flags &= BIT(HCI_RAW);
1475 }
1476
1477 done:
1478 hci_req_unlock(hdev);
1479 return ret;
1480 }
1481
1482 /* ---- HCI ioctl helpers ---- */
1483
1484 int hci_dev_open(__u16 dev)
1485 {
1486 struct hci_dev *hdev;
1487 int err;
1488
1489 hdev = hci_dev_get(dev);
1490 if (!hdev)
1491 return -ENODEV;
1492
1493 /* Devices that are marked as unconfigured can only be powered
1494 * up as user channel. Trying to bring them up as normal devices
1495 * will result into a failure. Only user channel operation is
1496 * possible.
1497 *
1498 * When this function is called for a user channel, the flag
1499 * HCI_USER_CHANNEL will be set first before attempting to
1500 * open the device.
1501 */
1502 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1503 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1504 err = -EOPNOTSUPP;
1505 goto done;
1506 }
1507
1508 /* We need to ensure that no other power on/off work is pending
1509 * before proceeding to call hci_dev_do_open. This is
1510 * particularly important if the setup procedure has not yet
1511 * completed.
1512 */
1513 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1514 cancel_delayed_work(&hdev->power_off);
1515
1516 /* After this call it is guaranteed that the setup procedure
1517 * has finished. This means that error conditions like RFKILL
1518 * or no valid public or static random address apply.
1519 */
1520 flush_workqueue(hdev->req_workqueue);
1521
1522 /* For controllers not using the management interface and that
1523 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1524 * so that pairing works for them. Once the management interface
1525 * is in use this bit will be cleared again and userspace has
1526 * to explicitly enable it.
1527 */
1528 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1529 !hci_dev_test_flag(hdev, HCI_MGMT))
1530 hci_dev_set_flag(hdev, HCI_BONDABLE);
1531
1532 err = hci_dev_do_open(hdev);
1533
1534 done:
1535 hci_dev_put(hdev);
1536 return err;
1537 }
1538
1539 /* This function requires the caller holds hdev->lock */
1540 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1541 {
1542 struct hci_conn_params *p;
1543
1544 list_for_each_entry(p, &hdev->le_conn_params, list) {
1545 if (p->conn) {
1546 hci_conn_drop(p->conn);
1547 hci_conn_put(p->conn);
1548 p->conn = NULL;
1549 }
1550 list_del_init(&p->action);
1551 }
1552
1553 BT_DBG("All LE pending actions cleared");
1554 }
1555
1556 static int hci_dev_do_close(struct hci_dev *hdev)
1557 {
1558 BT_DBG("%s %p", hdev->name, hdev);
1559
1560 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1561 /* Execute vendor specific shutdown routine */
1562 if (hdev->shutdown)
1563 hdev->shutdown(hdev);
1564 }
1565
1566 cancel_delayed_work(&hdev->power_off);
1567
1568 hci_req_cancel(hdev, ENODEV);
1569 hci_req_lock(hdev);
1570
1571 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1572 cancel_delayed_work_sync(&hdev->cmd_timer);
1573 hci_req_unlock(hdev);
1574 return 0;
1575 }
1576
1577 /* Flush RX and TX works */
1578 flush_work(&hdev->tx_work);
1579 flush_work(&hdev->rx_work);
1580
1581 if (hdev->discov_timeout > 0) {
1582 cancel_delayed_work(&hdev->discov_off);
1583 hdev->discov_timeout = 0;
1584 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1585 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1586 }
1587
1588 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1589 cancel_delayed_work(&hdev->service_cache);
1590
1591 cancel_delayed_work_sync(&hdev->le_scan_disable);
1592 cancel_delayed_work_sync(&hdev->le_scan_restart);
1593
1594 if (hci_dev_test_flag(hdev, HCI_MGMT))
1595 cancel_delayed_work_sync(&hdev->rpa_expired);
1596
1597 /* Avoid potential lockdep warnings from the *_flush() calls by
1598 * ensuring the workqueue is empty up front.
1599 */
1600 drain_workqueue(hdev->workqueue);
1601
1602 hci_dev_lock(hdev);
1603
1604 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1605
1606 if (!hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
1607 if (hdev->dev_type == HCI_BREDR)
1608 mgmt_powered(hdev, 0);
1609 }
1610
1611 hci_inquiry_cache_flush(hdev);
1612 hci_pend_le_actions_clear(hdev);
1613 hci_conn_hash_flush(hdev);
1614 hci_dev_unlock(hdev);
1615
1616 smp_unregister(hdev);
1617
1618 hci_notify(hdev, HCI_DEV_DOWN);
1619
1620 if (hdev->flush)
1621 hdev->flush(hdev);
1622
1623 /* Reset device */
1624 skb_queue_purge(&hdev->cmd_q);
1625 atomic_set(&hdev->cmd_cnt, 1);
1626 if (!hci_dev_test_flag(hdev, HCI_AUTO_OFF) &&
1627 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1628 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1629 set_bit(HCI_INIT, &hdev->flags);
1630 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1631 clear_bit(HCI_INIT, &hdev->flags);
1632 }
1633
1634 /* flush cmd work */
1635 flush_work(&hdev->cmd_work);
1636
1637 /* Drop queues */
1638 skb_queue_purge(&hdev->rx_q);
1639 skb_queue_purge(&hdev->cmd_q);
1640 skb_queue_purge(&hdev->raw_q);
1641
1642 /* Drop last sent command */
1643 if (hdev->sent_cmd) {
1644 cancel_delayed_work_sync(&hdev->cmd_timer);
1645 kfree_skb(hdev->sent_cmd);
1646 hdev->sent_cmd = NULL;
1647 }
1648
1649 /* After this point our queues are empty
1650 * and no tasks are scheduled. */
1651 hdev->close(hdev);
1652
1653 /* Clear flags */
1654 hdev->flags &= BIT(HCI_RAW);
1655 hci_dev_clear_volatile_flags(hdev);
1656
1657 /* Controller radio is available but is currently powered down */
1658 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1659
1660 memset(hdev->eir, 0, sizeof(hdev->eir));
1661 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1662 bacpy(&hdev->random_addr, BDADDR_ANY);
1663
1664 hci_req_unlock(hdev);
1665
1666 hci_dev_put(hdev);
1667 return 0;
1668 }
1669
1670 int hci_dev_close(__u16 dev)
1671 {
1672 struct hci_dev *hdev;
1673 int err;
1674
1675 hdev = hci_dev_get(dev);
1676 if (!hdev)
1677 return -ENODEV;
1678
1679 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1680 err = -EBUSY;
1681 goto done;
1682 }
1683
1684 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1685 cancel_delayed_work(&hdev->power_off);
1686
1687 err = hci_dev_do_close(hdev);
1688
1689 done:
1690 hci_dev_put(hdev);
1691 return err;
1692 }
1693
1694 static int hci_dev_do_reset(struct hci_dev *hdev)
1695 {
1696 int ret;
1697
1698 BT_DBG("%s %p", hdev->name, hdev);
1699
1700 hci_req_lock(hdev);
1701
1702 /* Drop queues */
1703 skb_queue_purge(&hdev->rx_q);
1704 skb_queue_purge(&hdev->cmd_q);
1705
1706 /* Avoid potential lockdep warnings from the *_flush() calls by
1707 * ensuring the workqueue is empty up front.
1708 */
1709 drain_workqueue(hdev->workqueue);
1710
1711 hci_dev_lock(hdev);
1712 hci_inquiry_cache_flush(hdev);
1713 hci_conn_hash_flush(hdev);
1714 hci_dev_unlock(hdev);
1715
1716 if (hdev->flush)
1717 hdev->flush(hdev);
1718
1719 atomic_set(&hdev->cmd_cnt, 1);
1720 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1721
1722 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1723
1724 hci_req_unlock(hdev);
1725 return ret;
1726 }
1727
1728 int hci_dev_reset(__u16 dev)
1729 {
1730 struct hci_dev *hdev;
1731 int err;
1732
1733 hdev = hci_dev_get(dev);
1734 if (!hdev)
1735 return -ENODEV;
1736
1737 if (!test_bit(HCI_UP, &hdev->flags)) {
1738 err = -ENETDOWN;
1739 goto done;
1740 }
1741
1742 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1743 err = -EBUSY;
1744 goto done;
1745 }
1746
1747 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1748 err = -EOPNOTSUPP;
1749 goto done;
1750 }
1751
1752 err = hci_dev_do_reset(hdev);
1753
1754 done:
1755 hci_dev_put(hdev);
1756 return err;
1757 }
1758
1759 int hci_dev_reset_stat(__u16 dev)
1760 {
1761 struct hci_dev *hdev;
1762 int ret = 0;
1763
1764 hdev = hci_dev_get(dev);
1765 if (!hdev)
1766 return -ENODEV;
1767
1768 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1769 ret = -EBUSY;
1770 goto done;
1771 }
1772
1773 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1774 ret = -EOPNOTSUPP;
1775 goto done;
1776 }
1777
1778 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1779
1780 done:
1781 hci_dev_put(hdev);
1782 return ret;
1783 }
1784
1785 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1786 {
1787 bool conn_changed, discov_changed;
1788
1789 BT_DBG("%s scan 0x%02x", hdev->name, scan);
1790
1791 if ((scan & SCAN_PAGE))
1792 conn_changed = !hci_dev_test_and_set_flag(hdev,
1793 HCI_CONNECTABLE);
1794 else
1795 conn_changed = hci_dev_test_and_clear_flag(hdev,
1796 HCI_CONNECTABLE);
1797
1798 if ((scan & SCAN_INQUIRY)) {
1799 discov_changed = !hci_dev_test_and_set_flag(hdev,
1800 HCI_DISCOVERABLE);
1801 } else {
1802 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1803 discov_changed = hci_dev_test_and_clear_flag(hdev,
1804 HCI_DISCOVERABLE);
1805 }
1806
1807 if (!hci_dev_test_flag(hdev, HCI_MGMT))
1808 return;
1809
1810 if (conn_changed || discov_changed) {
1811 /* In case this was disabled through mgmt */
1812 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
1813
1814 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1815 mgmt_update_adv_data(hdev);
1816
1817 mgmt_new_settings(hdev);
1818 }
1819 }
1820
1821 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1822 {
1823 struct hci_dev *hdev;
1824 struct hci_dev_req dr;
1825 int err = 0;
1826
1827 if (copy_from_user(&dr, arg, sizeof(dr)))
1828 return -EFAULT;
1829
1830 hdev = hci_dev_get(dr.dev_id);
1831 if (!hdev)
1832 return -ENODEV;
1833
1834 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1835 err = -EBUSY;
1836 goto done;
1837 }
1838
1839 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1840 err = -EOPNOTSUPP;
1841 goto done;
1842 }
1843
1844 if (hdev->dev_type != HCI_BREDR) {
1845 err = -EOPNOTSUPP;
1846 goto done;
1847 }
1848
1849 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1850 err = -EOPNOTSUPP;
1851 goto done;
1852 }
1853
1854 switch (cmd) {
1855 case HCISETAUTH:
1856 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1857 HCI_INIT_TIMEOUT);
1858 break;
1859
1860 case HCISETENCRYPT:
1861 if (!lmp_encrypt_capable(hdev)) {
1862 err = -EOPNOTSUPP;
1863 break;
1864 }
1865
1866 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1867 /* Auth must be enabled first */
1868 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1869 HCI_INIT_TIMEOUT);
1870 if (err)
1871 break;
1872 }
1873
1874 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1875 HCI_INIT_TIMEOUT);
1876 break;
1877
1878 case HCISETSCAN:
1879 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1880 HCI_INIT_TIMEOUT);
1881
1882 /* Ensure that the connectable and discoverable states
1883 * get correctly modified as this was a non-mgmt change.
1884 */
1885 if (!err)
1886 hci_update_scan_state(hdev, dr.dev_opt);
1887 break;
1888
1889 case HCISETLINKPOL:
1890 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1891 HCI_INIT_TIMEOUT);
1892 break;
1893
1894 case HCISETLINKMODE:
1895 hdev->link_mode = ((__u16) dr.dev_opt) &
1896 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1897 break;
1898
1899 case HCISETPTYPE:
1900 hdev->pkt_type = (__u16) dr.dev_opt;
1901 break;
1902
1903 case HCISETACLMTU:
1904 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1905 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1906 break;
1907
1908 case HCISETSCOMTU:
1909 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1910 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1911 break;
1912
1913 default:
1914 err = -EINVAL;
1915 break;
1916 }
1917
1918 done:
1919 hci_dev_put(hdev);
1920 return err;
1921 }
1922
1923 int hci_get_dev_list(void __user *arg)
1924 {
1925 struct hci_dev *hdev;
1926 struct hci_dev_list_req *dl;
1927 struct hci_dev_req *dr;
1928 int n = 0, size, err;
1929 __u16 dev_num;
1930
1931 if (get_user(dev_num, (__u16 __user *) arg))
1932 return -EFAULT;
1933
1934 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1935 return -EINVAL;
1936
1937 size = sizeof(*dl) + dev_num * sizeof(*dr);
1938
1939 dl = kzalloc(size, GFP_KERNEL);
1940 if (!dl)
1941 return -ENOMEM;
1942
1943 dr = dl->dev_req;
1944
1945 read_lock(&hci_dev_list_lock);
1946 list_for_each_entry(hdev, &hci_dev_list, list) {
1947 unsigned long flags = hdev->flags;
1948
1949 /* When the auto-off is configured it means the transport
1950 * is running, but in that case still indicate that the
1951 * device is actually down.
1952 */
1953 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
1954 flags &= ~BIT(HCI_UP);
1955
1956 (dr + n)->dev_id = hdev->id;
1957 (dr + n)->dev_opt = flags;
1958
1959 if (++n >= dev_num)
1960 break;
1961 }
1962 read_unlock(&hci_dev_list_lock);
1963
1964 dl->dev_num = n;
1965 size = sizeof(*dl) + n * sizeof(*dr);
1966
1967 err = copy_to_user(arg, dl, size);
1968 kfree(dl);
1969
1970 return err ? -EFAULT : 0;
1971 }
1972
1973 int hci_get_dev_info(void __user *arg)
1974 {
1975 struct hci_dev *hdev;
1976 struct hci_dev_info di;
1977 unsigned long flags;
1978 int err = 0;
1979
1980 if (copy_from_user(&di, arg, sizeof(di)))
1981 return -EFAULT;
1982
1983 hdev = hci_dev_get(di.dev_id);
1984 if (!hdev)
1985 return -ENODEV;
1986
1987 /* When the auto-off is configured it means the transport
1988 * is running, but in that case still indicate that the
1989 * device is actually down.
1990 */
1991 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
1992 flags = hdev->flags & ~BIT(HCI_UP);
1993 else
1994 flags = hdev->flags;
1995
1996 strcpy(di.name, hdev->name);
1997 di.bdaddr = hdev->bdaddr;
1998 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
1999 di.flags = flags;
2000 di.pkt_type = hdev->pkt_type;
2001 if (lmp_bredr_capable(hdev)) {
2002 di.acl_mtu = hdev->acl_mtu;
2003 di.acl_pkts = hdev->acl_pkts;
2004 di.sco_mtu = hdev->sco_mtu;
2005 di.sco_pkts = hdev->sco_pkts;
2006 } else {
2007 di.acl_mtu = hdev->le_mtu;
2008 di.acl_pkts = hdev->le_pkts;
2009 di.sco_mtu = 0;
2010 di.sco_pkts = 0;
2011 }
2012 di.link_policy = hdev->link_policy;
2013 di.link_mode = hdev->link_mode;
2014
2015 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2016 memcpy(&di.features, &hdev->features, sizeof(di.features));
2017
2018 if (copy_to_user(arg, &di, sizeof(di)))
2019 err = -EFAULT;
2020
2021 hci_dev_put(hdev);
2022
2023 return err;
2024 }
2025
2026 /* ---- Interface to HCI drivers ---- */
2027
2028 static int hci_rfkill_set_block(void *data, bool blocked)
2029 {
2030 struct hci_dev *hdev = data;
2031
2032 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2033
2034 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2035 return -EBUSY;
2036
2037 if (blocked) {
2038 hci_dev_set_flag(hdev, HCI_RFKILLED);
2039 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2040 !hci_dev_test_flag(hdev, HCI_CONFIG))
2041 hci_dev_do_close(hdev);
2042 } else {
2043 hci_dev_clear_flag(hdev, HCI_RFKILLED);
2044 }
2045
2046 return 0;
2047 }
2048
2049 static const struct rfkill_ops hci_rfkill_ops = {
2050 .set_block = hci_rfkill_set_block,
2051 };
2052
2053 static void hci_power_on(struct work_struct *work)
2054 {
2055 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2056 int err;
2057
2058 BT_DBG("%s", hdev->name);
2059
2060 err = hci_dev_do_open(hdev);
2061 if (err < 0) {
2062 hci_dev_lock(hdev);
2063 mgmt_set_powered_failed(hdev, err);
2064 hci_dev_unlock(hdev);
2065 return;
2066 }
2067
2068 /* During the HCI setup phase, a few error conditions are
2069 * ignored and they need to be checked now. If they are still
2070 * valid, it is important to turn the device back off.
2071 */
2072 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2073 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2074 (hdev->dev_type == HCI_BREDR &&
2075 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2076 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2077 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2078 hci_dev_do_close(hdev);
2079 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2080 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2081 HCI_AUTO_OFF_TIMEOUT);
2082 }
2083
2084 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2085 /* For unconfigured devices, set the HCI_RAW flag
2086 * so that userspace can easily identify them.
2087 */
2088 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2089 set_bit(HCI_RAW, &hdev->flags);
2090
2091 /* For fully configured devices, this will send
2092 * the Index Added event. For unconfigured devices,
2093 * it will send Unconfigued Index Added event.
2094 *
2095 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2096 * and no event will be send.
2097 */
2098 mgmt_index_added(hdev);
2099 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2100 /* When the controller is now configured, then it
2101 * is important to clear the HCI_RAW flag.
2102 */
2103 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2104 clear_bit(HCI_RAW, &hdev->flags);
2105
2106 /* Powering on the controller with HCI_CONFIG set only
2107 * happens with the transition from unconfigured to
2108 * configured. This will send the Index Added event.
2109 */
2110 mgmt_index_added(hdev);
2111 }
2112 }
2113
2114 static void hci_power_off(struct work_struct *work)
2115 {
2116 struct hci_dev *hdev = container_of(work, struct hci_dev,
2117 power_off.work);
2118
2119 BT_DBG("%s", hdev->name);
2120
2121 hci_dev_do_close(hdev);
2122 }
2123
2124 static void hci_error_reset(struct work_struct *work)
2125 {
2126 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2127
2128 BT_DBG("%s", hdev->name);
2129
2130 if (hdev->hw_error)
2131 hdev->hw_error(hdev, hdev->hw_error_code);
2132 else
2133 BT_ERR("%s hardware error 0x%2.2x", hdev->name,
2134 hdev->hw_error_code);
2135
2136 if (hci_dev_do_close(hdev))
2137 return;
2138
2139 hci_dev_do_open(hdev);
2140 }
2141
2142 static void hci_discov_off(struct work_struct *work)
2143 {
2144 struct hci_dev *hdev;
2145
2146 hdev = container_of(work, struct hci_dev, discov_off.work);
2147
2148 BT_DBG("%s", hdev->name);
2149
2150 mgmt_discoverable_timeout(hdev);
2151 }
2152
2153 void hci_uuids_clear(struct hci_dev *hdev)
2154 {
2155 struct bt_uuid *uuid, *tmp;
2156
2157 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2158 list_del(&uuid->list);
2159 kfree(uuid);
2160 }
2161 }
2162
2163 void hci_link_keys_clear(struct hci_dev *hdev)
2164 {
2165 struct link_key *key;
2166
2167 list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2168 list_del_rcu(&key->list);
2169 kfree_rcu(key, rcu);
2170 }
2171 }
2172
2173 void hci_smp_ltks_clear(struct hci_dev *hdev)
2174 {
2175 struct smp_ltk *k;
2176
2177 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2178 list_del_rcu(&k->list);
2179 kfree_rcu(k, rcu);
2180 }
2181 }
2182
2183 void hci_smp_irks_clear(struct hci_dev *hdev)
2184 {
2185 struct smp_irk *k;
2186
2187 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2188 list_del_rcu(&k->list);
2189 kfree_rcu(k, rcu);
2190 }
2191 }
2192
2193 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2194 {
2195 struct link_key *k;
2196
2197 rcu_read_lock();
2198 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2199 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2200 rcu_read_unlock();
2201 return k;
2202 }
2203 }
2204 rcu_read_unlock();
2205
2206 return NULL;
2207 }
2208
2209 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2210 u8 key_type, u8 old_key_type)
2211 {
2212 /* Legacy key */
2213 if (key_type < 0x03)
2214 return true;
2215
2216 /* Debug keys are insecure so don't store them persistently */
2217 if (key_type == HCI_LK_DEBUG_COMBINATION)
2218 return false;
2219
2220 /* Changed combination key and there's no previous one */
2221 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2222 return false;
2223
2224 /* Security mode 3 case */
2225 if (!conn)
2226 return true;
2227
2228 /* BR/EDR key derived using SC from an LE link */
2229 if (conn->type == LE_LINK)
2230 return true;
2231
2232 /* Neither local nor remote side had no-bonding as requirement */
2233 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2234 return true;
2235
2236 /* Local side had dedicated bonding as requirement */
2237 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2238 return true;
2239
2240 /* Remote side had dedicated bonding as requirement */
2241 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2242 return true;
2243
2244 /* If none of the above criteria match, then don't store the key
2245 * persistently */
2246 return false;
2247 }
2248
2249 static u8 ltk_role(u8 type)
2250 {
2251 if (type == SMP_LTK)
2252 return HCI_ROLE_MASTER;
2253
2254 return HCI_ROLE_SLAVE;
2255 }
2256
2257 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2258 u8 addr_type, u8 role)
2259 {
2260 struct smp_ltk *k;
2261
2262 rcu_read_lock();
2263 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2264 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2265 continue;
2266
2267 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2268 rcu_read_unlock();
2269 return k;
2270 }
2271 }
2272 rcu_read_unlock();
2273
2274 return NULL;
2275 }
2276
2277 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2278 {
2279 struct smp_irk *irk;
2280
2281 rcu_read_lock();
2282 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2283 if (!bacmp(&irk->rpa, rpa)) {
2284 rcu_read_unlock();
2285 return irk;
2286 }
2287 }
2288
2289 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2290 if (smp_irk_matches(hdev, irk->val, rpa)) {
2291 bacpy(&irk->rpa, rpa);
2292 rcu_read_unlock();
2293 return irk;
2294 }
2295 }
2296 rcu_read_unlock();
2297
2298 return NULL;
2299 }
2300
2301 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2302 u8 addr_type)
2303 {
2304 struct smp_irk *irk;
2305
2306 /* Identity Address must be public or static random */
2307 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2308 return NULL;
2309
2310 rcu_read_lock();
2311 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2312 if (addr_type == irk->addr_type &&
2313 bacmp(bdaddr, &irk->bdaddr) == 0) {
2314 rcu_read_unlock();
2315 return irk;
2316 }
2317 }
2318 rcu_read_unlock();
2319
2320 return NULL;
2321 }
2322
2323 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2324 bdaddr_t *bdaddr, u8 *val, u8 type,
2325 u8 pin_len, bool *persistent)
2326 {
2327 struct link_key *key, *old_key;
2328 u8 old_key_type;
2329
2330 old_key = hci_find_link_key(hdev, bdaddr);
2331 if (old_key) {
2332 old_key_type = old_key->type;
2333 key = old_key;
2334 } else {
2335 old_key_type = conn ? conn->key_type : 0xff;
2336 key = kzalloc(sizeof(*key), GFP_KERNEL);
2337 if (!key)
2338 return NULL;
2339 list_add_rcu(&key->list, &hdev->link_keys);
2340 }
2341
2342 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2343
2344 /* Some buggy controller combinations generate a changed
2345 * combination key for legacy pairing even when there's no
2346 * previous key */
2347 if (type == HCI_LK_CHANGED_COMBINATION &&
2348 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2349 type = HCI_LK_COMBINATION;
2350 if (conn)
2351 conn->key_type = type;
2352 }
2353
2354 bacpy(&key->bdaddr, bdaddr);
2355 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2356 key->pin_len = pin_len;
2357
2358 if (type == HCI_LK_CHANGED_COMBINATION)
2359 key->type = old_key_type;
2360 else
2361 key->type = type;
2362
2363 if (persistent)
2364 *persistent = hci_persistent_key(hdev, conn, type,
2365 old_key_type);
2366
2367 return key;
2368 }
2369
2370 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2371 u8 addr_type, u8 type, u8 authenticated,
2372 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2373 {
2374 struct smp_ltk *key, *old_key;
2375 u8 role = ltk_role(type);
2376
2377 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2378 if (old_key)
2379 key = old_key;
2380 else {
2381 key = kzalloc(sizeof(*key), GFP_KERNEL);
2382 if (!key)
2383 return NULL;
2384 list_add_rcu(&key->list, &hdev->long_term_keys);
2385 }
2386
2387 bacpy(&key->bdaddr, bdaddr);
2388 key->bdaddr_type = addr_type;
2389 memcpy(key->val, tk, sizeof(key->val));
2390 key->authenticated = authenticated;
2391 key->ediv = ediv;
2392 key->rand = rand;
2393 key->enc_size = enc_size;
2394 key->type = type;
2395
2396 return key;
2397 }
2398
2399 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2400 u8 addr_type, u8 val[16], bdaddr_t *rpa)
2401 {
2402 struct smp_irk *irk;
2403
2404 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2405 if (!irk) {
2406 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2407 if (!irk)
2408 return NULL;
2409
2410 bacpy(&irk->bdaddr, bdaddr);
2411 irk->addr_type = addr_type;
2412
2413 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2414 }
2415
2416 memcpy(irk->val, val, 16);
2417 bacpy(&irk->rpa, rpa);
2418
2419 return irk;
2420 }
2421
2422 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2423 {
2424 struct link_key *key;
2425
2426 key = hci_find_link_key(hdev, bdaddr);
2427 if (!key)
2428 return -ENOENT;
2429
2430 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2431
2432 list_del_rcu(&key->list);
2433 kfree_rcu(key, rcu);
2434
2435 return 0;
2436 }
2437
2438 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2439 {
2440 struct smp_ltk *k;
2441 int removed = 0;
2442
2443 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2444 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2445 continue;
2446
2447 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2448
2449 list_del_rcu(&k->list);
2450 kfree_rcu(k, rcu);
2451 removed++;
2452 }
2453
2454 return removed ? 0 : -ENOENT;
2455 }
2456
2457 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2458 {
2459 struct smp_irk *k;
2460
2461 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2462 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2463 continue;
2464
2465 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2466
2467 list_del_rcu(&k->list);
2468 kfree_rcu(k, rcu);
2469 }
2470 }
2471
2472 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2473 {
2474 struct smp_ltk *k;
2475 struct smp_irk *irk;
2476 u8 addr_type;
2477
2478 if (type == BDADDR_BREDR) {
2479 if (hci_find_link_key(hdev, bdaddr))
2480 return true;
2481 return false;
2482 }
2483
2484 /* Convert to HCI addr type which struct smp_ltk uses */
2485 if (type == BDADDR_LE_PUBLIC)
2486 addr_type = ADDR_LE_DEV_PUBLIC;
2487 else
2488 addr_type = ADDR_LE_DEV_RANDOM;
2489
2490 irk = hci_get_irk(hdev, bdaddr, addr_type);
2491 if (irk) {
2492 bdaddr = &irk->bdaddr;
2493 addr_type = irk->addr_type;
2494 }
2495
2496 rcu_read_lock();
2497 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2498 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2499 rcu_read_unlock();
2500 return true;
2501 }
2502 }
2503 rcu_read_unlock();
2504
2505 return false;
2506 }
2507
2508 /* HCI command timer function */
2509 static void hci_cmd_timeout(struct work_struct *work)
2510 {
2511 struct hci_dev *hdev = container_of(work, struct hci_dev,
2512 cmd_timer.work);
2513
2514 if (hdev->sent_cmd) {
2515 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2516 u16 opcode = __le16_to_cpu(sent->opcode);
2517
2518 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
2519 } else {
2520 BT_ERR("%s command tx timeout", hdev->name);
2521 }
2522
2523 atomic_set(&hdev->cmd_cnt, 1);
2524 queue_work(hdev->workqueue, &hdev->cmd_work);
2525 }
2526
2527 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2528 bdaddr_t *bdaddr, u8 bdaddr_type)
2529 {
2530 struct oob_data *data;
2531
2532 list_for_each_entry(data, &hdev->remote_oob_data, list) {
2533 if (bacmp(bdaddr, &data->bdaddr) != 0)
2534 continue;
2535 if (data->bdaddr_type != bdaddr_type)
2536 continue;
2537 return data;
2538 }
2539
2540 return NULL;
2541 }
2542
2543 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2544 u8 bdaddr_type)
2545 {
2546 struct oob_data *data;
2547
2548 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2549 if (!data)
2550 return -ENOENT;
2551
2552 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2553
2554 list_del(&data->list);
2555 kfree(data);
2556
2557 return 0;
2558 }
2559
2560 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2561 {
2562 struct oob_data *data, *n;
2563
2564 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2565 list_del(&data->list);
2566 kfree(data);
2567 }
2568 }
2569
2570 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2571 u8 bdaddr_type, u8 *hash192, u8 *rand192,
2572 u8 *hash256, u8 *rand256)
2573 {
2574 struct oob_data *data;
2575
2576 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2577 if (!data) {
2578 data = kmalloc(sizeof(*data), GFP_KERNEL);
2579 if (!data)
2580 return -ENOMEM;
2581
2582 bacpy(&data->bdaddr, bdaddr);
2583 data->bdaddr_type = bdaddr_type;
2584 list_add(&data->list, &hdev->remote_oob_data);
2585 }
2586
2587 if (hash192 && rand192) {
2588 memcpy(data->hash192, hash192, sizeof(data->hash192));
2589 memcpy(data->rand192, rand192, sizeof(data->rand192));
2590 if (hash256 && rand256)
2591 data->present = 0x03;
2592 } else {
2593 memset(data->hash192, 0, sizeof(data->hash192));
2594 memset(data->rand192, 0, sizeof(data->rand192));
2595 if (hash256 && rand256)
2596 data->present = 0x02;
2597 else
2598 data->present = 0x00;
2599 }
2600
2601 if (hash256 && rand256) {
2602 memcpy(data->hash256, hash256, sizeof(data->hash256));
2603 memcpy(data->rand256, rand256, sizeof(data->rand256));
2604 } else {
2605 memset(data->hash256, 0, sizeof(data->hash256));
2606 memset(data->rand256, 0, sizeof(data->rand256));
2607 if (hash192 && rand192)
2608 data->present = 0x01;
2609 }
2610
2611 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2612
2613 return 0;
2614 }
2615
2616 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2617 bdaddr_t *bdaddr, u8 type)
2618 {
2619 struct bdaddr_list *b;
2620
2621 list_for_each_entry(b, bdaddr_list, list) {
2622 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2623 return b;
2624 }
2625
2626 return NULL;
2627 }
2628
2629 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2630 {
2631 struct list_head *p, *n;
2632
2633 list_for_each_safe(p, n, bdaddr_list) {
2634 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
2635
2636 list_del(p);
2637 kfree(b);
2638 }
2639 }
2640
2641 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2642 {
2643 struct bdaddr_list *entry;
2644
2645 if (!bacmp(bdaddr, BDADDR_ANY))
2646 return -EBADF;
2647
2648 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2649 return -EEXIST;
2650
2651 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2652 if (!entry)
2653 return -ENOMEM;
2654
2655 bacpy(&entry->bdaddr, bdaddr);
2656 entry->bdaddr_type = type;
2657
2658 list_add(&entry->list, list);
2659
2660 return 0;
2661 }
2662
2663 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2664 {
2665 struct bdaddr_list *entry;
2666
2667 if (!bacmp(bdaddr, BDADDR_ANY)) {
2668 hci_bdaddr_list_clear(list);
2669 return 0;
2670 }
2671
2672 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2673 if (!entry)
2674 return -ENOENT;
2675
2676 list_del(&entry->list);
2677 kfree(entry);
2678
2679 return 0;
2680 }
2681
2682 /* This function requires the caller holds hdev->lock */
2683 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2684 bdaddr_t *addr, u8 addr_type)
2685 {
2686 struct hci_conn_params *params;
2687
2688 /* The conn params list only contains identity addresses */
2689 if (!hci_is_identity_address(addr, addr_type))
2690 return NULL;
2691
2692 list_for_each_entry(params, &hdev->le_conn_params, list) {
2693 if (bacmp(&params->addr, addr) == 0 &&
2694 params->addr_type == addr_type) {
2695 return params;
2696 }
2697 }
2698
2699 return NULL;
2700 }
2701
2702 /* This function requires the caller holds hdev->lock */
2703 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2704 bdaddr_t *addr, u8 addr_type)
2705 {
2706 struct hci_conn_params *param;
2707
2708 /* The list only contains identity addresses */
2709 if (!hci_is_identity_address(addr, addr_type))
2710 return NULL;
2711
2712 list_for_each_entry(param, list, action) {
2713 if (bacmp(&param->addr, addr) == 0 &&
2714 param->addr_type == addr_type)
2715 return param;
2716 }
2717
2718 return NULL;
2719 }
2720
2721 /* This function requires the caller holds hdev->lock */
2722 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2723 bdaddr_t *addr, u8 addr_type)
2724 {
2725 struct hci_conn_params *params;
2726
2727 if (!hci_is_identity_address(addr, addr_type))
2728 return NULL;
2729
2730 params = hci_conn_params_lookup(hdev, addr, addr_type);
2731 if (params)
2732 return params;
2733
2734 params = kzalloc(sizeof(*params), GFP_KERNEL);
2735 if (!params) {
2736 BT_ERR("Out of memory");
2737 return NULL;
2738 }
2739
2740 bacpy(&params->addr, addr);
2741 params->addr_type = addr_type;
2742
2743 list_add(&params->list, &hdev->le_conn_params);
2744 INIT_LIST_HEAD(&params->action);
2745
2746 params->conn_min_interval = hdev->le_conn_min_interval;
2747 params->conn_max_interval = hdev->le_conn_max_interval;
2748 params->conn_latency = hdev->le_conn_latency;
2749 params->supervision_timeout = hdev->le_supv_timeout;
2750 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2751
2752 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2753
2754 return params;
2755 }
2756
2757 static void hci_conn_params_free(struct hci_conn_params *params)
2758 {
2759 if (params->conn) {
2760 hci_conn_drop(params->conn);
2761 hci_conn_put(params->conn);
2762 }
2763
2764 list_del(&params->action);
2765 list_del(&params->list);
2766 kfree(params);
2767 }
2768
2769 /* This function requires the caller holds hdev->lock */
2770 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2771 {
2772 struct hci_conn_params *params;
2773
2774 params = hci_conn_params_lookup(hdev, addr, addr_type);
2775 if (!params)
2776 return;
2777
2778 hci_conn_params_free(params);
2779
2780 hci_update_background_scan(hdev);
2781
2782 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2783 }
2784
2785 /* This function requires the caller holds hdev->lock */
2786 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
2787 {
2788 struct hci_conn_params *params, *tmp;
2789
2790 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
2791 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2792 continue;
2793 list_del(&params->list);
2794 kfree(params);
2795 }
2796
2797 BT_DBG("All LE disabled connection parameters were removed");
2798 }
2799
2800 /* This function requires the caller holds hdev->lock */
2801 void hci_conn_params_clear_all(struct hci_dev *hdev)
2802 {
2803 struct hci_conn_params *params, *tmp;
2804
2805 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2806 hci_conn_params_free(params);
2807
2808 hci_update_background_scan(hdev);
2809
2810 BT_DBG("All LE connection parameters were removed");
2811 }
2812
2813 static void inquiry_complete(struct hci_dev *hdev, u8 status, u16 opcode)
2814 {
2815 if (status) {
2816 BT_ERR("Failed to start inquiry: status %d", status);
2817
2818 hci_dev_lock(hdev);
2819 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2820 hci_dev_unlock(hdev);
2821 return;
2822 }
2823 }
2824
2825 static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status,
2826 u16 opcode)
2827 {
2828 /* General inquiry access code (GIAC) */
2829 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2830 struct hci_cp_inquiry cp;
2831 int err;
2832
2833 if (status) {
2834 BT_ERR("Failed to disable LE scanning: status %d", status);
2835 return;
2836 }
2837
2838 hdev->discovery.scan_start = 0;
2839
2840 switch (hdev->discovery.type) {
2841 case DISCOV_TYPE_LE:
2842 hci_dev_lock(hdev);
2843 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2844 hci_dev_unlock(hdev);
2845 break;
2846
2847 case DISCOV_TYPE_INTERLEAVED:
2848 hci_dev_lock(hdev);
2849
2850 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
2851 &hdev->quirks)) {
2852 /* If we were running LE only scan, change discovery
2853 * state. If we were running both LE and BR/EDR inquiry
2854 * simultaneously, and BR/EDR inquiry is already
2855 * finished, stop discovery, otherwise BR/EDR inquiry
2856 * will stop discovery when finished.
2857 */
2858 if (!test_bit(HCI_INQUIRY, &hdev->flags))
2859 hci_discovery_set_state(hdev,
2860 DISCOVERY_STOPPED);
2861 } else {
2862 struct hci_request req;
2863
2864 hci_inquiry_cache_flush(hdev);
2865
2866 hci_req_init(&req, hdev);
2867
2868 memset(&cp, 0, sizeof(cp));
2869 memcpy(&cp.lap, lap, sizeof(cp.lap));
2870 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
2871 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
2872
2873 err = hci_req_run(&req, inquiry_complete);
2874 if (err) {
2875 BT_ERR("Inquiry request failed: err %d", err);
2876 hci_discovery_set_state(hdev,
2877 DISCOVERY_STOPPED);
2878 }
2879 }
2880
2881 hci_dev_unlock(hdev);
2882 break;
2883 }
2884 }
2885
2886 static void le_scan_disable_work(struct work_struct *work)
2887 {
2888 struct hci_dev *hdev = container_of(work, struct hci_dev,
2889 le_scan_disable.work);
2890 struct hci_request req;
2891 int err;
2892
2893 BT_DBG("%s", hdev->name);
2894
2895 cancel_delayed_work_sync(&hdev->le_scan_restart);
2896
2897 hci_req_init(&req, hdev);
2898
2899 hci_req_add_le_scan_disable(&req);
2900
2901 err = hci_req_run(&req, le_scan_disable_work_complete);
2902 if (err)
2903 BT_ERR("Disable LE scanning request failed: err %d", err);
2904 }
2905
2906 static void le_scan_restart_work_complete(struct hci_dev *hdev, u8 status,
2907 u16 opcode)
2908 {
2909 unsigned long timeout, duration, scan_start, now;
2910
2911 BT_DBG("%s", hdev->name);
2912
2913 if (status) {
2914 BT_ERR("Failed to restart LE scan: status %d", status);
2915 return;
2916 }
2917
2918 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
2919 !hdev->discovery.scan_start)
2920 return;
2921
2922 /* When the scan was started, hdev->le_scan_disable has been queued
2923 * after duration from scan_start. During scan restart this job
2924 * has been canceled, and we need to queue it again after proper
2925 * timeout, to make sure that scan does not run indefinitely.
2926 */
2927 duration = hdev->discovery.scan_duration;
2928 scan_start = hdev->discovery.scan_start;
2929 now = jiffies;
2930 if (now - scan_start <= duration) {
2931 int elapsed;
2932
2933 if (now >= scan_start)
2934 elapsed = now - scan_start;
2935 else
2936 elapsed = ULONG_MAX - scan_start + now;
2937
2938 timeout = duration - elapsed;
2939 } else {
2940 timeout = 0;
2941 }
2942 queue_delayed_work(hdev->workqueue,
2943 &hdev->le_scan_disable, timeout);
2944 }
2945
2946 static void le_scan_restart_work(struct work_struct *work)
2947 {
2948 struct hci_dev *hdev = container_of(work, struct hci_dev,
2949 le_scan_restart.work);
2950 struct hci_request req;
2951 struct hci_cp_le_set_scan_enable cp;
2952 int err;
2953
2954 BT_DBG("%s", hdev->name);
2955
2956 /* If controller is not scanning we are done. */
2957 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
2958 return;
2959
2960 hci_req_init(&req, hdev);
2961
2962 hci_req_add_le_scan_disable(&req);
2963
2964 memset(&cp, 0, sizeof(cp));
2965 cp.enable = LE_SCAN_ENABLE;
2966 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
2967 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2968
2969 err = hci_req_run(&req, le_scan_restart_work_complete);
2970 if (err)
2971 BT_ERR("Restart LE scan request failed: err %d", err);
2972 }
2973
2974 /* Copy the Identity Address of the controller.
2975 *
2976 * If the controller has a public BD_ADDR, then by default use that one.
2977 * If this is a LE only controller without a public address, default to
2978 * the static random address.
2979 *
2980 * For debugging purposes it is possible to force controllers with a
2981 * public address to use the static random address instead.
2982 *
2983 * In case BR/EDR has been disabled on a dual-mode controller and
2984 * userspace has configured a static address, then that address
2985 * becomes the identity address instead of the public BR/EDR address.
2986 */
2987 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2988 u8 *bdaddr_type)
2989 {
2990 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
2991 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
2992 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
2993 bacmp(&hdev->static_addr, BDADDR_ANY))) {
2994 bacpy(bdaddr, &hdev->static_addr);
2995 *bdaddr_type = ADDR_LE_DEV_RANDOM;
2996 } else {
2997 bacpy(bdaddr, &hdev->bdaddr);
2998 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
2999 }
3000 }
3001
3002 /* Alloc HCI device */
3003 struct hci_dev *hci_alloc_dev(void)
3004 {
3005 struct hci_dev *hdev;
3006
3007 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3008 if (!hdev)
3009 return NULL;
3010
3011 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3012 hdev->esco_type = (ESCO_HV1);
3013 hdev->link_mode = (HCI_LM_ACCEPT);
3014 hdev->num_iac = 0x01; /* One IAC support is mandatory */
3015 hdev->io_capability = 0x03; /* No Input No Output */
3016 hdev->manufacturer = 0xffff; /* Default to internal use */
3017 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3018 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3019
3020 hdev->sniff_max_interval = 800;
3021 hdev->sniff_min_interval = 80;
3022
3023 hdev->le_adv_channel_map = 0x07;
3024 hdev->le_adv_min_interval = 0x0800;
3025 hdev->le_adv_max_interval = 0x0800;
3026 hdev->le_scan_interval = 0x0060;
3027 hdev->le_scan_window = 0x0030;
3028 hdev->le_conn_min_interval = 0x0028;
3029 hdev->le_conn_max_interval = 0x0038;
3030 hdev->le_conn_latency = 0x0000;
3031 hdev->le_supv_timeout = 0x002a;
3032 hdev->le_def_tx_len = 0x001b;
3033 hdev->le_def_tx_time = 0x0148;
3034 hdev->le_max_tx_len = 0x001b;
3035 hdev->le_max_tx_time = 0x0148;
3036 hdev->le_max_rx_len = 0x001b;
3037 hdev->le_max_rx_time = 0x0148;
3038
3039 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3040 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3041 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3042 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3043
3044 mutex_init(&hdev->lock);
3045 mutex_init(&hdev->req_lock);
3046
3047 INIT_LIST_HEAD(&hdev->mgmt_pending);
3048 INIT_LIST_HEAD(&hdev->blacklist);
3049 INIT_LIST_HEAD(&hdev->whitelist);
3050 INIT_LIST_HEAD(&hdev->uuids);
3051 INIT_LIST_HEAD(&hdev->link_keys);
3052 INIT_LIST_HEAD(&hdev->long_term_keys);
3053 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3054 INIT_LIST_HEAD(&hdev->remote_oob_data);
3055 INIT_LIST_HEAD(&hdev->le_white_list);
3056 INIT_LIST_HEAD(&hdev->le_conn_params);
3057 INIT_LIST_HEAD(&hdev->pend_le_conns);
3058 INIT_LIST_HEAD(&hdev->pend_le_reports);
3059 INIT_LIST_HEAD(&hdev->conn_hash.list);
3060
3061 INIT_WORK(&hdev->rx_work, hci_rx_work);
3062 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3063 INIT_WORK(&hdev->tx_work, hci_tx_work);
3064 INIT_WORK(&hdev->power_on, hci_power_on);
3065 INIT_WORK(&hdev->error_reset, hci_error_reset);
3066
3067 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3068 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
3069 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
3070 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
3071
3072 skb_queue_head_init(&hdev->rx_q);
3073 skb_queue_head_init(&hdev->cmd_q);
3074 skb_queue_head_init(&hdev->raw_q);
3075
3076 init_waitqueue_head(&hdev->req_wait_q);
3077
3078 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3079
3080 hci_init_sysfs(hdev);
3081 discovery_init(hdev);
3082 adv_info_init(hdev);
3083
3084 return hdev;
3085 }
3086 EXPORT_SYMBOL(hci_alloc_dev);
3087
3088 /* Free HCI device */
3089 void hci_free_dev(struct hci_dev *hdev)
3090 {
3091 /* will free via device release */
3092 put_device(&hdev->dev);
3093 }
3094 EXPORT_SYMBOL(hci_free_dev);
3095
3096 /* Register HCI device */
3097 int hci_register_dev(struct hci_dev *hdev)
3098 {
3099 int id, error;
3100
3101 if (!hdev->open || !hdev->close || !hdev->send)
3102 return -EINVAL;
3103
3104 /* Do not allow HCI_AMP devices to register at index 0,
3105 * so the index can be used as the AMP controller ID.
3106 */
3107 switch (hdev->dev_type) {
3108 case HCI_BREDR:
3109 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3110 break;
3111 case HCI_AMP:
3112 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3113 break;
3114 default:
3115 return -EINVAL;
3116 }
3117
3118 if (id < 0)
3119 return id;
3120
3121 sprintf(hdev->name, "hci%d", id);
3122 hdev->id = id;
3123
3124 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3125
3126 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3127 WQ_MEM_RECLAIM, 1, hdev->name);
3128 if (!hdev->workqueue) {
3129 error = -ENOMEM;
3130 goto err;
3131 }
3132
3133 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3134 WQ_MEM_RECLAIM, 1, hdev->name);
3135 if (!hdev->req_workqueue) {
3136 destroy_workqueue(hdev->workqueue);
3137 error = -ENOMEM;
3138 goto err;
3139 }
3140
3141 if (!IS_ERR_OR_NULL(bt_debugfs))
3142 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3143
3144 dev_set_name(&hdev->dev, "%s", hdev->name);
3145
3146 error = device_add(&hdev->dev);
3147 if (error < 0)
3148 goto err_wqueue;
3149
3150 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3151 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3152 hdev);
3153 if (hdev->rfkill) {
3154 if (rfkill_register(hdev->rfkill) < 0) {
3155 rfkill_destroy(hdev->rfkill);
3156 hdev->rfkill = NULL;
3157 }
3158 }
3159
3160 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3161 hci_dev_set_flag(hdev, HCI_RFKILLED);
3162
3163 hci_dev_set_flag(hdev, HCI_SETUP);
3164 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3165
3166 if (hdev->dev_type == HCI_BREDR) {
3167 /* Assume BR/EDR support until proven otherwise (such as
3168 * through reading supported features during init.
3169 */
3170 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3171 }
3172
3173 write_lock(&hci_dev_list_lock);
3174 list_add(&hdev->list, &hci_dev_list);
3175 write_unlock(&hci_dev_list_lock);
3176
3177 /* Devices that are marked for raw-only usage are unconfigured
3178 * and should not be included in normal operation.
3179 */
3180 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3181 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3182
3183 hci_notify(hdev, HCI_DEV_REG);
3184 hci_dev_hold(hdev);
3185
3186 queue_work(hdev->req_workqueue, &hdev->power_on);
3187
3188 return id;
3189
3190 err_wqueue:
3191 destroy_workqueue(hdev->workqueue);
3192 destroy_workqueue(hdev->req_workqueue);
3193 err:
3194 ida_simple_remove(&hci_index_ida, hdev->id);
3195
3196 return error;
3197 }
3198 EXPORT_SYMBOL(hci_register_dev);
3199
3200 /* Unregister HCI device */
3201 void hci_unregister_dev(struct hci_dev *hdev)
3202 {
3203 int id;
3204
3205 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3206
3207 hci_dev_set_flag(hdev, HCI_UNREGISTER);
3208
3209 id = hdev->id;
3210
3211 write_lock(&hci_dev_list_lock);
3212 list_del(&hdev->list);
3213 write_unlock(&hci_dev_list_lock);
3214
3215 hci_dev_do_close(hdev);
3216
3217 cancel_work_sync(&hdev->power_on);
3218
3219 if (!test_bit(HCI_INIT, &hdev->flags) &&
3220 !hci_dev_test_flag(hdev, HCI_SETUP) &&
3221 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
3222 hci_dev_lock(hdev);
3223 mgmt_index_removed(hdev);
3224 hci_dev_unlock(hdev);
3225 }
3226
3227 /* mgmt_index_removed should take care of emptying the
3228 * pending list */
3229 BUG_ON(!list_empty(&hdev->mgmt_pending));
3230
3231 hci_notify(hdev, HCI_DEV_UNREG);
3232
3233 if (hdev->rfkill) {
3234 rfkill_unregister(hdev->rfkill);
3235 rfkill_destroy(hdev->rfkill);
3236 }
3237
3238 device_del(&hdev->dev);
3239
3240 debugfs_remove_recursive(hdev->debugfs);
3241
3242 destroy_workqueue(hdev->workqueue);
3243 destroy_workqueue(hdev->req_workqueue);
3244
3245 hci_dev_lock(hdev);
3246 hci_bdaddr_list_clear(&hdev->blacklist);
3247 hci_bdaddr_list_clear(&hdev->whitelist);
3248 hci_uuids_clear(hdev);
3249 hci_link_keys_clear(hdev);
3250 hci_smp_ltks_clear(hdev);
3251 hci_smp_irks_clear(hdev);
3252 hci_remote_oob_data_clear(hdev);
3253 hci_bdaddr_list_clear(&hdev->le_white_list);
3254 hci_conn_params_clear_all(hdev);
3255 hci_discovery_filter_clear(hdev);
3256 hci_dev_unlock(hdev);
3257
3258 hci_dev_put(hdev);
3259
3260 ida_simple_remove(&hci_index_ida, id);
3261 }
3262 EXPORT_SYMBOL(hci_unregister_dev);
3263
3264 /* Suspend HCI device */
3265 int hci_suspend_dev(struct hci_dev *hdev)
3266 {
3267 hci_notify(hdev, HCI_DEV_SUSPEND);
3268 return 0;
3269 }
3270 EXPORT_SYMBOL(hci_suspend_dev);
3271
3272 /* Resume HCI device */
3273 int hci_resume_dev(struct hci_dev *hdev)
3274 {
3275 hci_notify(hdev, HCI_DEV_RESUME);
3276 return 0;
3277 }
3278 EXPORT_SYMBOL(hci_resume_dev);
3279
3280 /* Reset HCI device */
3281 int hci_reset_dev(struct hci_dev *hdev)
3282 {
3283 const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3284 struct sk_buff *skb;
3285
3286 skb = bt_skb_alloc(3, GFP_ATOMIC);
3287 if (!skb)
3288 return -ENOMEM;
3289
3290 bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3291 memcpy(skb_put(skb, 3), hw_err, 3);
3292
3293 /* Send Hardware Error to upper stack */
3294 return hci_recv_frame(hdev, skb);
3295 }
3296 EXPORT_SYMBOL(hci_reset_dev);
3297
3298 /* Receive frame from HCI drivers */
3299 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
3300 {
3301 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
3302 && !test_bit(HCI_INIT, &hdev->flags))) {
3303 kfree_skb(skb);
3304 return -ENXIO;
3305 }
3306
3307 /* Incoming skb */
3308 bt_cb(skb)->incoming = 1;
3309
3310 /* Time stamp */
3311 __net_timestamp(skb);
3312
3313 skb_queue_tail(&hdev->rx_q, skb);
3314 queue_work(hdev->workqueue, &hdev->rx_work);
3315
3316 return 0;
3317 }
3318 EXPORT_SYMBOL(hci_recv_frame);
3319
3320 /* ---- Interface to upper protocols ---- */
3321
3322 int hci_register_cb(struct hci_cb *cb)
3323 {
3324 BT_DBG("%p name %s", cb, cb->name);
3325
3326 mutex_lock(&hci_cb_list_lock);
3327 list_add_tail(&cb->list, &hci_cb_list);
3328 mutex_unlock(&hci_cb_list_lock);
3329
3330 return 0;
3331 }
3332 EXPORT_SYMBOL(hci_register_cb);
3333
3334 int hci_unregister_cb(struct hci_cb *cb)
3335 {
3336 BT_DBG("%p name %s", cb, cb->name);
3337
3338 mutex_lock(&hci_cb_list_lock);
3339 list_del(&cb->list);
3340 mutex_unlock(&hci_cb_list_lock);
3341
3342 return 0;
3343 }
3344 EXPORT_SYMBOL(hci_unregister_cb);
3345
3346 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
3347 {
3348 int err;
3349
3350 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
3351
3352 /* Time stamp */
3353 __net_timestamp(skb);
3354
3355 /* Send copy to monitor */
3356 hci_send_to_monitor(hdev, skb);
3357
3358 if (atomic_read(&hdev->promisc)) {
3359 /* Send copy to the sockets */
3360 hci_send_to_sock(hdev, skb);
3361 }
3362
3363 /* Get rid of skb owner, prior to sending to the driver. */
3364 skb_orphan(skb);
3365
3366 err = hdev->send(hdev, skb);
3367 if (err < 0) {
3368 BT_ERR("%s sending frame failed (%d)", hdev->name, err);
3369 kfree_skb(skb);
3370 }
3371 }
3372
3373 /* Send HCI command */
3374 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3375 const void *param)
3376 {
3377 struct sk_buff *skb;
3378
3379 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3380
3381 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3382 if (!skb) {
3383 BT_ERR("%s no memory for command", hdev->name);
3384 return -ENOMEM;
3385 }
3386
3387 /* Stand-alone HCI commands must be flagged as
3388 * single-command requests.
3389 */
3390 bt_cb(skb)->req.start = true;
3391
3392 skb_queue_tail(&hdev->cmd_q, skb);
3393 queue_work(hdev->workqueue, &hdev->cmd_work);
3394
3395 return 0;
3396 }
3397
3398 /* Get data from the previously sent command */
3399 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
3400 {
3401 struct hci_command_hdr *hdr;
3402
3403 if (!hdev->sent_cmd)
3404 return NULL;
3405
3406 hdr = (void *) hdev->sent_cmd->data;
3407
3408 if (hdr->opcode != cpu_to_le16(opcode))
3409 return NULL;
3410
3411 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3412
3413 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3414 }
3415
3416 /* Send ACL data */
3417 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3418 {
3419 struct hci_acl_hdr *hdr;
3420 int len = skb->len;
3421
3422 skb_push(skb, HCI_ACL_HDR_SIZE);
3423 skb_reset_transport_header(skb);
3424 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3425 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3426 hdr->dlen = cpu_to_le16(len);
3427 }
3428
3429 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
3430 struct sk_buff *skb, __u16 flags)
3431 {
3432 struct hci_conn *conn = chan->conn;
3433 struct hci_dev *hdev = conn->hdev;
3434 struct sk_buff *list;
3435
3436 skb->len = skb_headlen(skb);
3437 skb->data_len = 0;
3438
3439 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
3440
3441 switch (hdev->dev_type) {
3442 case HCI_BREDR:
3443 hci_add_acl_hdr(skb, conn->handle, flags);
3444 break;
3445 case HCI_AMP:
3446 hci_add_acl_hdr(skb, chan->handle, flags);
3447 break;
3448 default:
3449 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3450 return;
3451 }
3452
3453 list = skb_shinfo(skb)->frag_list;
3454 if (!list) {
3455 /* Non fragmented */
3456 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3457
3458 skb_queue_tail(queue, skb);
3459 } else {
3460 /* Fragmented */
3461 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3462
3463 skb_shinfo(skb)->frag_list = NULL;
3464
3465 /* Queue all fragments atomically. We need to use spin_lock_bh
3466 * here because of 6LoWPAN links, as there this function is
3467 * called from softirq and using normal spin lock could cause
3468 * deadlocks.
3469 */
3470 spin_lock_bh(&queue->lock);
3471
3472 __skb_queue_tail(queue, skb);
3473
3474 flags &= ~ACL_START;
3475 flags |= ACL_CONT;
3476 do {
3477 skb = list; list = list->next;
3478
3479 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
3480 hci_add_acl_hdr(skb, conn->handle, flags);
3481
3482 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3483
3484 __skb_queue_tail(queue, skb);
3485 } while (list);
3486
3487 spin_unlock_bh(&queue->lock);
3488 }
3489 }
3490
3491 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3492 {
3493 struct hci_dev *hdev = chan->conn->hdev;
3494
3495 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
3496
3497 hci_queue_acl(chan, &chan->data_q, skb, flags);
3498
3499 queue_work(hdev->workqueue, &hdev->tx_work);
3500 }
3501
3502 /* Send SCO data */
3503 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
3504 {
3505 struct hci_dev *hdev = conn->hdev;
3506 struct hci_sco_hdr hdr;
3507
3508 BT_DBG("%s len %d", hdev->name, skb->len);
3509
3510 hdr.handle = cpu_to_le16(conn->handle);
3511 hdr.dlen = skb->len;
3512
3513 skb_push(skb, HCI_SCO_HDR_SIZE);
3514 skb_reset_transport_header(skb);
3515 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
3516
3517 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
3518
3519 skb_queue_tail(&conn->data_q, skb);
3520 queue_work(hdev->workqueue, &hdev->tx_work);
3521 }
3522
3523 /* ---- HCI TX task (outgoing data) ---- */
3524
3525 /* HCI Connection scheduler */
3526 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3527 int *quote)
3528 {
3529 struct hci_conn_hash *h = &hdev->conn_hash;
3530 struct hci_conn *conn = NULL, *c;
3531 unsigned int num = 0, min = ~0;
3532
3533 /* We don't have to lock device here. Connections are always
3534 * added and removed with TX task disabled. */
3535
3536 rcu_read_lock();
3537
3538 list_for_each_entry_rcu(c, &h->list, list) {
3539 if (c->type != type || skb_queue_empty(&c->data_q))
3540 continue;
3541
3542 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3543 continue;
3544
3545 num++;
3546
3547 if (c->sent < min) {
3548 min = c->sent;
3549 conn = c;
3550 }
3551
3552 if (hci_conn_num(hdev, type) == num)
3553 break;
3554 }
3555
3556 rcu_read_unlock();
3557
3558 if (conn) {
3559 int cnt, q;
3560
3561 switch (conn->type) {
3562 case ACL_LINK:
3563 cnt = hdev->acl_cnt;
3564 break;
3565 case SCO_LINK:
3566 case ESCO_LINK:
3567 cnt = hdev->sco_cnt;
3568 break;
3569 case LE_LINK:
3570 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3571 break;
3572 default:
3573 cnt = 0;
3574 BT_ERR("Unknown link type");
3575 }
3576
3577 q = cnt / num;
3578 *quote = q ? q : 1;
3579 } else
3580 *quote = 0;
3581
3582 BT_DBG("conn %p quote %d", conn, *quote);
3583 return conn;
3584 }
3585
3586 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
3587 {
3588 struct hci_conn_hash *h = &hdev->conn_hash;
3589 struct hci_conn *c;
3590
3591 BT_ERR("%s link tx timeout", hdev->name);
3592
3593 rcu_read_lock();
3594
3595 /* Kill stalled connections */
3596 list_for_each_entry_rcu(c, &h->list, list) {
3597 if (c->type == type && c->sent) {
3598 BT_ERR("%s killing stalled connection %pMR",
3599 hdev->name, &c->dst);
3600 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3601 }
3602 }
3603
3604 rcu_read_unlock();
3605 }
3606
3607 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3608 int *quote)
3609 {
3610 struct hci_conn_hash *h = &hdev->conn_hash;
3611 struct hci_chan *chan = NULL;
3612 unsigned int num = 0, min = ~0, cur_prio = 0;
3613 struct hci_conn *conn;
3614 int cnt, q, conn_num = 0;
3615
3616 BT_DBG("%s", hdev->name);
3617
3618 rcu_read_lock();
3619
3620 list_for_each_entry_rcu(conn, &h->list, list) {
3621 struct hci_chan *tmp;
3622
3623 if (conn->type != type)
3624 continue;
3625
3626 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3627 continue;
3628
3629 conn_num++;
3630
3631 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
3632 struct sk_buff *skb;
3633
3634 if (skb_queue_empty(&tmp->data_q))
3635 continue;
3636
3637 skb = skb_peek(&tmp->data_q);
3638 if (skb->priority < cur_prio)
3639 continue;
3640
3641 if (skb->priority > cur_prio) {
3642 num = 0;
3643 min = ~0;
3644 cur_prio = skb->priority;
3645 }
3646
3647 num++;
3648
3649 if (conn->sent < min) {
3650 min = conn->sent;
3651 chan = tmp;
3652 }
3653 }
3654
3655 if (hci_conn_num(hdev, type) == conn_num)
3656 break;
3657 }
3658
3659 rcu_read_unlock();
3660
3661 if (!chan)
3662 return NULL;
3663
3664 switch (chan->conn->type) {
3665 case ACL_LINK:
3666 cnt = hdev->acl_cnt;
3667 break;
3668 case AMP_LINK:
3669 cnt = hdev->block_cnt;
3670 break;
3671 case SCO_LINK:
3672 case ESCO_LINK:
3673 cnt = hdev->sco_cnt;
3674 break;
3675 case LE_LINK:
3676 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3677 break;
3678 default:
3679 cnt = 0;
3680 BT_ERR("Unknown link type");
3681 }
3682
3683 q = cnt / num;
3684 *quote = q ? q : 1;
3685 BT_DBG("chan %p quote %d", chan, *quote);
3686 return chan;
3687 }
3688
3689 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3690 {
3691 struct hci_conn_hash *h = &hdev->conn_hash;
3692 struct hci_conn *conn;
3693 int num = 0;
3694
3695 BT_DBG("%s", hdev->name);
3696
3697 rcu_read_lock();
3698
3699 list_for_each_entry_rcu(conn, &h->list, list) {
3700 struct hci_chan *chan;
3701
3702 if (conn->type != type)
3703 continue;
3704
3705 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3706 continue;
3707
3708 num++;
3709
3710 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
3711 struct sk_buff *skb;
3712
3713 if (chan->sent) {
3714 chan->sent = 0;
3715 continue;
3716 }
3717
3718 if (skb_queue_empty(&chan->data_q))
3719 continue;
3720
3721 skb = skb_peek(&chan->data_q);
3722 if (skb->priority >= HCI_PRIO_MAX - 1)
3723 continue;
3724
3725 skb->priority = HCI_PRIO_MAX - 1;
3726
3727 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
3728 skb->priority);
3729 }
3730
3731 if (hci_conn_num(hdev, type) == num)
3732 break;
3733 }
3734
3735 rcu_read_unlock();
3736
3737 }
3738
3739 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3740 {
3741 /* Calculate count of blocks used by this packet */
3742 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3743 }
3744
3745 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
3746 {
3747 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
3748 /* ACL tx timeout must be longer than maximum
3749 * link supervision timeout (40.9 seconds) */
3750 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
3751 HCI_ACL_TX_TIMEOUT))
3752 hci_link_tx_to(hdev, ACL_LINK);
3753 }
3754 }
3755
3756 static void hci_sched_acl_pkt(struct hci_dev *hdev)
3757 {
3758 unsigned int cnt = hdev->acl_cnt;
3759 struct hci_chan *chan;
3760 struct sk_buff *skb;
3761 int quote;
3762
3763 __check_timeout(hdev, cnt);
3764
3765 while (hdev->acl_cnt &&
3766 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3767 u32 priority = (skb_peek(&chan->data_q))->priority;
3768 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3769 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3770 skb->len, skb->priority);
3771
3772 /* Stop if priority has changed */
3773 if (skb->priority < priority)
3774 break;
3775
3776 skb = skb_dequeue(&chan->data_q);
3777
3778 hci_conn_enter_active_mode(chan->conn,
3779 bt_cb(skb)->force_active);
3780
3781 hci_send_frame(hdev, skb);
3782 hdev->acl_last_tx = jiffies;
3783
3784 hdev->acl_cnt--;
3785 chan->sent++;
3786 chan->conn->sent++;
3787 }
3788 }
3789
3790 if (cnt != hdev->acl_cnt)
3791 hci_prio_recalculate(hdev, ACL_LINK);
3792 }
3793
3794 static void hci_sched_acl_blk(struct hci_dev *hdev)
3795 {
3796 unsigned int cnt = hdev->block_cnt;
3797 struct hci_chan *chan;
3798 struct sk_buff *skb;
3799 int quote;
3800 u8 type;
3801
3802 __check_timeout(hdev, cnt);
3803
3804 BT_DBG("%s", hdev->name);
3805
3806 if (hdev->dev_type == HCI_AMP)
3807 type = AMP_LINK;
3808 else
3809 type = ACL_LINK;
3810
3811 while (hdev->block_cnt > 0 &&
3812 (chan = hci_chan_sent(hdev, type, &quote))) {
3813 u32 priority = (skb_peek(&chan->data_q))->priority;
3814 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3815 int blocks;
3816
3817 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3818 skb->len, skb->priority);
3819
3820 /* Stop if priority has changed */
3821 if (skb->priority < priority)
3822 break;
3823
3824 skb = skb_dequeue(&chan->data_q);
3825
3826 blocks = __get_blocks(hdev, skb);
3827 if (blocks > hdev->block_cnt)
3828 return;
3829
3830 hci_conn_enter_active_mode(chan->conn,
3831 bt_cb(skb)->force_active);
3832
3833 hci_send_frame(hdev, skb);
3834 hdev->acl_last_tx = jiffies;
3835
3836 hdev->block_cnt -= blocks;
3837 quote -= blocks;
3838
3839 chan->sent += blocks;
3840 chan->conn->sent += blocks;
3841 }
3842 }
3843
3844 if (cnt != hdev->block_cnt)
3845 hci_prio_recalculate(hdev, type);
3846 }
3847
3848 static void hci_sched_acl(struct hci_dev *hdev)
3849 {
3850 BT_DBG("%s", hdev->name);
3851
3852 /* No ACL link over BR/EDR controller */
3853 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3854 return;
3855
3856 /* No AMP link over AMP controller */
3857 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
3858 return;
3859
3860 switch (hdev->flow_ctl_mode) {
3861 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3862 hci_sched_acl_pkt(hdev);
3863 break;
3864
3865 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3866 hci_sched_acl_blk(hdev);
3867 break;
3868 }
3869 }
3870
3871 /* Schedule SCO */
3872 static void hci_sched_sco(struct hci_dev *hdev)
3873 {
3874 struct hci_conn *conn;
3875 struct sk_buff *skb;
3876 int quote;
3877
3878 BT_DBG("%s", hdev->name);
3879
3880 if (!hci_conn_num(hdev, SCO_LINK))
3881 return;
3882
3883 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3884 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3885 BT_DBG("skb %p len %d", skb, skb->len);
3886 hci_send_frame(hdev, skb);
3887
3888 conn->sent++;
3889 if (conn->sent == ~0)
3890 conn->sent = 0;
3891 }
3892 }
3893 }
3894
3895 static void hci_sched_esco(struct hci_dev *hdev)
3896 {
3897 struct hci_conn *conn;
3898 struct sk_buff *skb;
3899 int quote;
3900
3901 BT_DBG("%s", hdev->name);
3902
3903 if (!hci_conn_num(hdev, ESCO_LINK))
3904 return;
3905
3906 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3907 &quote))) {
3908 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3909 BT_DBG("skb %p len %d", skb, skb->len);
3910 hci_send_frame(hdev, skb);
3911
3912 conn->sent++;
3913 if (conn->sent == ~0)
3914 conn->sent = 0;
3915 }
3916 }
3917 }
3918
3919 static void hci_sched_le(struct hci_dev *hdev)
3920 {
3921 struct hci_chan *chan;
3922 struct sk_buff *skb;
3923 int quote, cnt, tmp;
3924
3925 BT_DBG("%s", hdev->name);
3926
3927 if (!hci_conn_num(hdev, LE_LINK))
3928 return;
3929
3930 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
3931 /* LE tx timeout must be longer than maximum
3932 * link supervision timeout (40.9 seconds) */
3933 if (!hdev->le_cnt && hdev->le_pkts &&
3934 time_after(jiffies, hdev->le_last_tx + HZ * 45))
3935 hci_link_tx_to(hdev, LE_LINK);
3936 }
3937
3938 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
3939 tmp = cnt;
3940 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
3941 u32 priority = (skb_peek(&chan->data_q))->priority;
3942 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3943 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3944 skb->len, skb->priority);
3945
3946 /* Stop if priority has changed */
3947 if (skb->priority < priority)
3948 break;
3949
3950 skb = skb_dequeue(&chan->data_q);
3951
3952 hci_send_frame(hdev, skb);
3953 hdev->le_last_tx = jiffies;
3954
3955 cnt--;
3956 chan->sent++;
3957 chan->conn->sent++;
3958 }
3959 }
3960
3961 if (hdev->le_pkts)
3962 hdev->le_cnt = cnt;
3963 else
3964 hdev->acl_cnt = cnt;
3965
3966 if (cnt != tmp)
3967 hci_prio_recalculate(hdev, LE_LINK);
3968 }
3969
3970 static void hci_tx_work(struct work_struct *work)
3971 {
3972 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
3973 struct sk_buff *skb;
3974
3975 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
3976 hdev->sco_cnt, hdev->le_cnt);
3977
3978 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
3979 /* Schedule queues and send stuff to HCI driver */
3980 hci_sched_acl(hdev);
3981 hci_sched_sco(hdev);
3982 hci_sched_esco(hdev);
3983 hci_sched_le(hdev);
3984 }
3985
3986 /* Send next queued raw (unknown type) packet */
3987 while ((skb = skb_dequeue(&hdev->raw_q)))
3988 hci_send_frame(hdev, skb);
3989 }
3990
3991 /* ----- HCI RX task (incoming data processing) ----- */
3992
3993 /* ACL data packet */
3994 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3995 {
3996 struct hci_acl_hdr *hdr = (void *) skb->data;
3997 struct hci_conn *conn;
3998 __u16 handle, flags;
3999
4000 skb_pull(skb, HCI_ACL_HDR_SIZE);
4001
4002 handle = __le16_to_cpu(hdr->handle);
4003 flags = hci_flags(handle);
4004 handle = hci_handle(handle);
4005
4006 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4007 handle, flags);
4008
4009 hdev->stat.acl_rx++;
4010
4011 hci_dev_lock(hdev);
4012 conn = hci_conn_hash_lookup_handle(hdev, handle);
4013 hci_dev_unlock(hdev);
4014
4015 if (conn) {
4016 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
4017
4018 /* Send to upper protocol */
4019 l2cap_recv_acldata(conn, skb, flags);
4020 return;
4021 } else {
4022 BT_ERR("%s ACL packet for unknown connection handle %d",
4023 hdev->name, handle);
4024 }
4025
4026 kfree_skb(skb);
4027 }
4028
4029 /* SCO data packet */
4030 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4031 {
4032 struct hci_sco_hdr *hdr = (void *) skb->data;
4033 struct hci_conn *conn;
4034 __u16 handle;
4035
4036 skb_pull(skb, HCI_SCO_HDR_SIZE);
4037
4038 handle = __le16_to_cpu(hdr->handle);
4039
4040 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
4041
4042 hdev->stat.sco_rx++;
4043
4044 hci_dev_lock(hdev);
4045 conn = hci_conn_hash_lookup_handle(hdev, handle);
4046 hci_dev_unlock(hdev);
4047
4048 if (conn) {
4049 /* Send to upper protocol */
4050 sco_recv_scodata(conn, skb);
4051 return;
4052 } else {
4053 BT_ERR("%s SCO packet for unknown connection handle %d",
4054 hdev->name, handle);
4055 }
4056
4057 kfree_skb(skb);
4058 }
4059
4060 static bool hci_req_is_complete(struct hci_dev *hdev)
4061 {
4062 struct sk_buff *skb;
4063
4064 skb = skb_peek(&hdev->cmd_q);
4065 if (!skb)
4066 return true;
4067
4068 return bt_cb(skb)->req.start;
4069 }
4070
4071 static void hci_resend_last(struct hci_dev *hdev)
4072 {
4073 struct hci_command_hdr *sent;
4074 struct sk_buff *skb;
4075 u16 opcode;
4076
4077 if (!hdev->sent_cmd)
4078 return;
4079
4080 sent = (void *) hdev->sent_cmd->data;
4081 opcode = __le16_to_cpu(sent->opcode);
4082 if (opcode == HCI_OP_RESET)
4083 return;
4084
4085 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4086 if (!skb)
4087 return;
4088
4089 skb_queue_head(&hdev->cmd_q, skb);
4090 queue_work(hdev->workqueue, &hdev->cmd_work);
4091 }
4092
4093 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4094 hci_req_complete_t *req_complete,
4095 hci_req_complete_skb_t *req_complete_skb)
4096 {
4097 struct sk_buff *skb;
4098 unsigned long flags;
4099
4100 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4101
4102 /* If the completed command doesn't match the last one that was
4103 * sent we need to do special handling of it.
4104 */
4105 if (!hci_sent_cmd_data(hdev, opcode)) {
4106 /* Some CSR based controllers generate a spontaneous
4107 * reset complete event during init and any pending
4108 * command will never be completed. In such a case we
4109 * need to resend whatever was the last sent
4110 * command.
4111 */
4112 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4113 hci_resend_last(hdev);
4114
4115 return;
4116 }
4117
4118 /* If the command succeeded and there's still more commands in
4119 * this request the request is not yet complete.
4120 */
4121 if (!status && !hci_req_is_complete(hdev))
4122 return;
4123
4124 /* If this was the last command in a request the complete
4125 * callback would be found in hdev->sent_cmd instead of the
4126 * command queue (hdev->cmd_q).
4127 */
4128 if (bt_cb(hdev->sent_cmd)->req.complete) {
4129 *req_complete = bt_cb(hdev->sent_cmd)->req.complete;
4130 return;
4131 }
4132
4133 if (bt_cb(hdev->sent_cmd)->req.complete_skb) {
4134 *req_complete_skb = bt_cb(hdev->sent_cmd)->req.complete_skb;
4135 return;
4136 }
4137
4138 /* Remove all pending commands belonging to this request */
4139 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4140 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4141 if (bt_cb(skb)->req.start) {
4142 __skb_queue_head(&hdev->cmd_q, skb);
4143 break;
4144 }
4145
4146 *req_complete = bt_cb(skb)->req.complete;
4147 *req_complete_skb = bt_cb(skb)->req.complete_skb;
4148 kfree_skb(skb);
4149 }
4150 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4151 }
4152
4153 static void hci_rx_work(struct work_struct *work)
4154 {
4155 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
4156 struct sk_buff *skb;
4157
4158 BT_DBG("%s", hdev->name);
4159
4160 while ((skb = skb_dequeue(&hdev->rx_q))) {
4161 /* Send copy to monitor */
4162 hci_send_to_monitor(hdev, skb);
4163
4164 if (atomic_read(&hdev->promisc)) {
4165 /* Send copy to the sockets */
4166 hci_send_to_sock(hdev, skb);
4167 }
4168
4169 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4170 kfree_skb(skb);
4171 continue;
4172 }
4173
4174 if (test_bit(HCI_INIT, &hdev->flags)) {
4175 /* Don't process data packets in this states. */
4176 switch (bt_cb(skb)->pkt_type) {
4177 case HCI_ACLDATA_PKT:
4178 case HCI_SCODATA_PKT:
4179 kfree_skb(skb);
4180 continue;
4181 }
4182 }
4183
4184 /* Process frame */
4185 switch (bt_cb(skb)->pkt_type) {
4186 case HCI_EVENT_PKT:
4187 BT_DBG("%s Event packet", hdev->name);
4188 hci_event_packet(hdev, skb);
4189 break;
4190
4191 case HCI_ACLDATA_PKT:
4192 BT_DBG("%s ACL data packet", hdev->name);
4193 hci_acldata_packet(hdev, skb);
4194 break;
4195
4196 case HCI_SCODATA_PKT:
4197 BT_DBG("%s SCO data packet", hdev->name);
4198 hci_scodata_packet(hdev, skb);
4199 break;
4200
4201 default:
4202 kfree_skb(skb);
4203 break;
4204 }
4205 }
4206 }
4207
4208 static void hci_cmd_work(struct work_struct *work)
4209 {
4210 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4211 struct sk_buff *skb;
4212
4213 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4214 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4215
4216 /* Send queued commands */
4217 if (atomic_read(&hdev->cmd_cnt)) {
4218 skb = skb_dequeue(&hdev->cmd_q);
4219 if (!skb)
4220 return;
4221
4222 kfree_skb(hdev->sent_cmd);
4223
4224 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4225 if (hdev->sent_cmd) {
4226 atomic_dec(&hdev->cmd_cnt);
4227 hci_send_frame(hdev, skb);
4228 if (test_bit(HCI_RESET, &hdev->flags))
4229 cancel_delayed_work(&hdev->cmd_timer);
4230 else
4231 schedule_delayed_work(&hdev->cmd_timer,
4232 HCI_CMD_TIMEOUT);
4233 } else {
4234 skb_queue_head(&hdev->cmd_q, skb);
4235 queue_work(hdev->workqueue, &hdev->cmd_work);
4236 }
4237 }
4238 }
ubuntu-bionic-kernel mirror