]> git.proxmox.com Git - mirror_ubuntu-bionic-kernel.git/blob - net/bluetooth/hci_core.c
projects / mirror_ubuntu-bionic-kernel.git / blob
? search:
summary | shortlog | log | commit | commitdiff | tree
blame | history | raw | HEAD
Bluetooth: Restrict ioctls to HCI raw channel sockets
[mirror_ubuntu-bionic-kernel.git] / net / bluetooth / hci_core.c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2011 ProFUSION Embedded Systems
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth HCI core. */
27
28 #include <linux/export.h>
29 #include <linux/idr.h>
30
31 #include <linux/rfkill.h>
32
33 #include <net/bluetooth/bluetooth.h>
34 #include <net/bluetooth/hci_core.h>
35
36 static void hci_rx_work(struct work_struct *work);
37 static void hci_cmd_work(struct work_struct *work);
38 static void hci_tx_work(struct work_struct *work);
39
40 /* HCI device list */
41 LIST_HEAD(hci_dev_list);
42 DEFINE_RWLOCK(hci_dev_list_lock);
43
44 /* HCI callback list */
45 LIST_HEAD(hci_cb_list);
46 DEFINE_RWLOCK(hci_cb_list_lock);
47
48 /* HCI ID Numbering */
49 static DEFINE_IDA(hci_index_ida);
50
51 /* ---- HCI notifications ---- */
52
53 static void hci_notify(struct hci_dev *hdev, int event)
54 {
55 hci_sock_dev_event(hdev, event);
56 }
57
58 /* ---- HCI requests ---- */
59
60 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result)
61 {
62 BT_DBG("%s result 0x%2.2x", hdev->name, result);
63
64 if (hdev->req_status == HCI_REQ_PEND) {
65 hdev->req_result = result;
66 hdev->req_status = HCI_REQ_DONE;
67 wake_up_interruptible(&hdev->req_wait_q);
68 }
69 }
70
71 static void hci_req_cancel(struct hci_dev *hdev, int err)
72 {
73 BT_DBG("%s err 0x%2.2x", hdev->name, err);
74
75 if (hdev->req_status == HCI_REQ_PEND) {
76 hdev->req_result = err;
77 hdev->req_status = HCI_REQ_CANCELED;
78 wake_up_interruptible(&hdev->req_wait_q);
79 }
80 }
81
82 static struct sk_buff *hci_get_cmd_complete(struct hci_dev *hdev, u16 opcode,
83 u8 event)
84 {
85 struct hci_ev_cmd_complete *ev;
86 struct hci_event_hdr *hdr;
87 struct sk_buff *skb;
88
89 hci_dev_lock(hdev);
90
91 skb = hdev->recv_evt;
92 hdev->recv_evt = NULL;
93
94 hci_dev_unlock(hdev);
95
96 if (!skb)
97 return ERR_PTR(-ENODATA);
98
99 if (skb->len < sizeof(*hdr)) {
100 BT_ERR("Too short HCI event");
101 goto failed;
102 }
103
104 hdr = (void *) skb->data;
105 skb_pull(skb, HCI_EVENT_HDR_SIZE);
106
107 if (event) {
108 if (hdr->evt != event)
109 goto failed;
110 return skb;
111 }
112
113 if (hdr->evt != HCI_EV_CMD_COMPLETE) {
114 BT_DBG("Last event is not cmd complete (0x%2.2x)", hdr->evt);
115 goto failed;
116 }
117
118 if (skb->len < sizeof(*ev)) {
119 BT_ERR("Too short cmd_complete event");
120 goto failed;
121 }
122
123 ev = (void *) skb->data;
124 skb_pull(skb, sizeof(*ev));
125
126 if (opcode == __le16_to_cpu(ev->opcode))
127 return skb;
128
129 BT_DBG("opcode doesn't match (0x%2.2x != 0x%2.2x)", opcode,
130 __le16_to_cpu(ev->opcode));
131
132 failed:
133 kfree_skb(skb);
134 return ERR_PTR(-ENODATA);
135 }
136
137 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
138 const void *param, u8 event, u32 timeout)
139 {
140 DECLARE_WAITQUEUE(wait, current);
141 struct hci_request req;
142 int err = 0;
143
144 BT_DBG("%s", hdev->name);
145
146 hci_req_init(&req, hdev);
147
148 hci_req_add_ev(&req, opcode, plen, param, event);
149
150 hdev->req_status = HCI_REQ_PEND;
151
152 err = hci_req_run(&req, hci_req_sync_complete);
153 if (err < 0)
154 return ERR_PTR(err);
155
156 add_wait_queue(&hdev->req_wait_q, &wait);
157 set_current_state(TASK_INTERRUPTIBLE);
158
159 schedule_timeout(timeout);
160
161 remove_wait_queue(&hdev->req_wait_q, &wait);
162
163 if (signal_pending(current))
164 return ERR_PTR(-EINTR);
165
166 switch (hdev->req_status) {
167 case HCI_REQ_DONE:
168 err = -bt_to_errno(hdev->req_result);
169 break;
170
171 case HCI_REQ_CANCELED:
172 err = -hdev->req_result;
173 break;
174
175 default:
176 err = -ETIMEDOUT;
177 break;
178 }
179
180 hdev->req_status = hdev->req_result = 0;
181
182 BT_DBG("%s end: err %d", hdev->name, err);
183
184 if (err < 0)
185 return ERR_PTR(err);
186
187 return hci_get_cmd_complete(hdev, opcode, event);
188 }
189 EXPORT_SYMBOL(__hci_cmd_sync_ev);
190
191 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
192 const void *param, u32 timeout)
193 {
194 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
195 }
196 EXPORT_SYMBOL(__hci_cmd_sync);
197
198 /* Execute request and wait for completion. */
199 static int __hci_req_sync(struct hci_dev *hdev,
200 void (*func)(struct hci_request *req,
201 unsigned long opt),
202 unsigned long opt, __u32 timeout)
203 {
204 struct hci_request req;
205 DECLARE_WAITQUEUE(wait, current);
206 int err = 0;
207
208 BT_DBG("%s start", hdev->name);
209
210 hci_req_init(&req, hdev);
211
212 hdev->req_status = HCI_REQ_PEND;
213
214 func(&req, opt);
215
216 err = hci_req_run(&req, hci_req_sync_complete);
217 if (err < 0) {
218 hdev->req_status = 0;
219
220 /* ENODATA means the HCI request command queue is empty.
221 * This can happen when a request with conditionals doesn't
222 * trigger any commands to be sent. This is normal behavior
223 * and should not trigger an error return.
224 */
225 if (err == -ENODATA)
226 return 0;
227
228 return err;
229 }
230
231 add_wait_queue(&hdev->req_wait_q, &wait);
232 set_current_state(TASK_INTERRUPTIBLE);
233
234 schedule_timeout(timeout);
235
236 remove_wait_queue(&hdev->req_wait_q, &wait);
237
238 if (signal_pending(current))
239 return -EINTR;
240
241 switch (hdev->req_status) {
242 case HCI_REQ_DONE:
243 err = -bt_to_errno(hdev->req_result);
244 break;
245
246 case HCI_REQ_CANCELED:
247 err = -hdev->req_result;
248 break;
249
250 default:
251 err = -ETIMEDOUT;
252 break;
253 }
254
255 hdev->req_status = hdev->req_result = 0;
256
257 BT_DBG("%s end: err %d", hdev->name, err);
258
259 return err;
260 }
261
262 static int hci_req_sync(struct hci_dev *hdev,
263 void (*req)(struct hci_request *req,
264 unsigned long opt),
265 unsigned long opt, __u32 timeout)
266 {
267 int ret;
268
269 if (!test_bit(HCI_UP, &hdev->flags))
270 return -ENETDOWN;
271
272 /* Serialize all requests */
273 hci_req_lock(hdev);
274 ret = __hci_req_sync(hdev, req, opt, timeout);
275 hci_req_unlock(hdev);
276
277 return ret;
278 }
279
280 static void hci_reset_req(struct hci_request *req, unsigned long opt)
281 {
282 BT_DBG("%s %ld", req->hdev->name, opt);
283
284 /* Reset device */
285 set_bit(HCI_RESET, &req->hdev->flags);
286 hci_req_add(req, HCI_OP_RESET, 0, NULL);
287 }
288
289 static void bredr_init(struct hci_request *req)
290 {
291 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
292
293 /* Read Local Supported Features */
294 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
295
296 /* Read Local Version */
297 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
298
299 /* Read BD Address */
300 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
301 }
302
303 static void amp_init(struct hci_request *req)
304 {
305 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
306
307 /* Read Local Version */
308 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
309
310 /* Read Local AMP Info */
311 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
312
313 /* Read Data Blk size */
314 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
315 }
316
317 static void hci_init1_req(struct hci_request *req, unsigned long opt)
318 {
319 struct hci_dev *hdev = req->hdev;
320
321 BT_DBG("%s %ld", hdev->name, opt);
322
323 /* Reset */
324 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
325 hci_reset_req(req, 0);
326
327 switch (hdev->dev_type) {
328 case HCI_BREDR:
329 bredr_init(req);
330 break;
331
332 case HCI_AMP:
333 amp_init(req);
334 break;
335
336 default:
337 BT_ERR("Unknown device type %d", hdev->dev_type);
338 break;
339 }
340 }
341
342 static void bredr_setup(struct hci_request *req)
343 {
344 __le16 param;
345 __u8 flt_type;
346
347 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
348 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
349
350 /* Read Class of Device */
351 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
352
353 /* Read Local Name */
354 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
355
356 /* Read Voice Setting */
357 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
358
359 /* Clear Event Filters */
360 flt_type = HCI_FLT_CLEAR_ALL;
361 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
362
363 /* Connection accept timeout ~20 secs */
364 param = __constant_cpu_to_le16(0x7d00);
365 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
366
367 /* Read page scan parameters */
368 if (req->hdev->hci_ver > BLUETOOTH_VER_1_1) {
369 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
370 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
371 }
372 }
373
374 static void le_setup(struct hci_request *req)
375 {
376 struct hci_dev *hdev = req->hdev;
377
378 /* Read LE Buffer Size */
379 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
380
381 /* Read LE Local Supported Features */
382 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
383
384 /* Read LE Advertising Channel TX Power */
385 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
386
387 /* Read LE White List Size */
388 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
389
390 /* Read LE Supported States */
391 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
392
393 /* LE-only controllers have LE implicitly enabled */
394 if (!lmp_bredr_capable(hdev))
395 set_bit(HCI_LE_ENABLED, &hdev->dev_flags);
396 }
397
398 static u8 hci_get_inquiry_mode(struct hci_dev *hdev)
399 {
400 if (lmp_ext_inq_capable(hdev))
401 return 0x02;
402
403 if (lmp_inq_rssi_capable(hdev))
404 return 0x01;
405
406 if (hdev->manufacturer == 11 && hdev->hci_rev == 0x00 &&
407 hdev->lmp_subver == 0x0757)
408 return 0x01;
409
410 if (hdev->manufacturer == 15) {
411 if (hdev->hci_rev == 0x03 && hdev->lmp_subver == 0x6963)
412 return 0x01;
413 if (hdev->hci_rev == 0x09 && hdev->lmp_subver == 0x6963)
414 return 0x01;
415 if (hdev->hci_rev == 0x00 && hdev->lmp_subver == 0x6965)
416 return 0x01;
417 }
418
419 if (hdev->manufacturer == 31 && hdev->hci_rev == 0x2005 &&
420 hdev->lmp_subver == 0x1805)
421 return 0x01;
422
423 return 0x00;
424 }
425
426 static void hci_setup_inquiry_mode(struct hci_request *req)
427 {
428 u8 mode;
429
430 mode = hci_get_inquiry_mode(req->hdev);
431
432 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
433 }
434
435 static void hci_setup_event_mask(struct hci_request *req)
436 {
437 struct hci_dev *hdev = req->hdev;
438
439 /* The second byte is 0xff instead of 0x9f (two reserved bits
440 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
441 * command otherwise.
442 */
443 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
444
445 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
446 * any event mask for pre 1.2 devices.
447 */
448 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
449 return;
450
451 if (lmp_bredr_capable(hdev)) {
452 events[4] |= 0x01; /* Flow Specification Complete */
453 events[4] |= 0x02; /* Inquiry Result with RSSI */
454 events[4] |= 0x04; /* Read Remote Extended Features Complete */
455 events[5] |= 0x08; /* Synchronous Connection Complete */
456 events[5] |= 0x10; /* Synchronous Connection Changed */
457 } else {
458 /* Use a different default for LE-only devices */
459 memset(events, 0, sizeof(events));
460 events[0] |= 0x10; /* Disconnection Complete */
461 events[0] |= 0x80; /* Encryption Change */
462 events[1] |= 0x08; /* Read Remote Version Information Complete */
463 events[1] |= 0x20; /* Command Complete */
464 events[1] |= 0x40; /* Command Status */
465 events[1] |= 0x80; /* Hardware Error */
466 events[2] |= 0x04; /* Number of Completed Packets */
467 events[3] |= 0x02; /* Data Buffer Overflow */
468 events[5] |= 0x80; /* Encryption Key Refresh Complete */
469 }
470
471 if (lmp_inq_rssi_capable(hdev))
472 events[4] |= 0x02; /* Inquiry Result with RSSI */
473
474 if (lmp_sniffsubr_capable(hdev))
475 events[5] |= 0x20; /* Sniff Subrating */
476
477 if (lmp_pause_enc_capable(hdev))
478 events[5] |= 0x80; /* Encryption Key Refresh Complete */
479
480 if (lmp_ext_inq_capable(hdev))
481 events[5] |= 0x40; /* Extended Inquiry Result */
482
483 if (lmp_no_flush_capable(hdev))
484 events[7] |= 0x01; /* Enhanced Flush Complete */
485
486 if (lmp_lsto_capable(hdev))
487 events[6] |= 0x80; /* Link Supervision Timeout Changed */
488
489 if (lmp_ssp_capable(hdev)) {
490 events[6] |= 0x01; /* IO Capability Request */
491 events[6] |= 0x02; /* IO Capability Response */
492 events[6] |= 0x04; /* User Confirmation Request */
493 events[6] |= 0x08; /* User Passkey Request */
494 events[6] |= 0x10; /* Remote OOB Data Request */
495 events[6] |= 0x20; /* Simple Pairing Complete */
496 events[7] |= 0x04; /* User Passkey Notification */
497 events[7] |= 0x08; /* Keypress Notification */
498 events[7] |= 0x10; /* Remote Host Supported
499 * Features Notification
500 */
501 }
502
503 if (lmp_le_capable(hdev))
504 events[7] |= 0x20; /* LE Meta-Event */
505
506 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
507
508 if (lmp_le_capable(hdev)) {
509 memset(events, 0, sizeof(events));
510 events[0] = 0x1f;
511 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK,
512 sizeof(events), events);
513 }
514 }
515
516 static void hci_init2_req(struct hci_request *req, unsigned long opt)
517 {
518 struct hci_dev *hdev = req->hdev;
519
520 if (lmp_bredr_capable(hdev))
521 bredr_setup(req);
522
523 if (lmp_le_capable(hdev))
524 le_setup(req);
525
526 hci_setup_event_mask(req);
527
528 /* AVM Berlin (31), aka "BlueFRITZ!", doesn't support the read
529 * local supported commands HCI command.
530 */
531 if (hdev->manufacturer != 31 && hdev->hci_ver > BLUETOOTH_VER_1_1)
532 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
533
534 if (lmp_ssp_capable(hdev)) {
535 if (test_bit(HCI_SSP_ENABLED, &hdev->dev_flags)) {
536 u8 mode = 0x01;
537 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
538 sizeof(mode), &mode);
539 } else {
540 struct hci_cp_write_eir cp;
541
542 memset(hdev->eir, 0, sizeof(hdev->eir));
543 memset(&cp, 0, sizeof(cp));
544
545 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
546 }
547 }
548
549 if (lmp_inq_rssi_capable(hdev))
550 hci_setup_inquiry_mode(req);
551
552 if (lmp_inq_tx_pwr_capable(hdev))
553 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
554
555 if (lmp_ext_feat_capable(hdev)) {
556 struct hci_cp_read_local_ext_features cp;
557
558 cp.page = 0x01;
559 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
560 sizeof(cp), &cp);
561 }
562
563 if (test_bit(HCI_LINK_SECURITY, &hdev->dev_flags)) {
564 u8 enable = 1;
565 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
566 &enable);
567 }
568 }
569
570 static void hci_setup_link_policy(struct hci_request *req)
571 {
572 struct hci_dev *hdev = req->hdev;
573 struct hci_cp_write_def_link_policy cp;
574 u16 link_policy = 0;
575
576 if (lmp_rswitch_capable(hdev))
577 link_policy |= HCI_LP_RSWITCH;
578 if (lmp_hold_capable(hdev))
579 link_policy |= HCI_LP_HOLD;
580 if (lmp_sniff_capable(hdev))
581 link_policy |= HCI_LP_SNIFF;
582 if (lmp_park_capable(hdev))
583 link_policy |= HCI_LP_PARK;
584
585 cp.policy = cpu_to_le16(link_policy);
586 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
587 }
588
589 static void hci_set_le_support(struct hci_request *req)
590 {
591 struct hci_dev *hdev = req->hdev;
592 struct hci_cp_write_le_host_supported cp;
593
594 /* LE-only devices do not support explicit enablement */
595 if (!lmp_bredr_capable(hdev))
596 return;
597
598 memset(&cp, 0, sizeof(cp));
599
600 if (test_bit(HCI_LE_ENABLED, &hdev->dev_flags)) {
601 cp.le = 0x01;
602 cp.simul = lmp_le_br_capable(hdev);
603 }
604
605 if (cp.le != lmp_host_le_capable(hdev))
606 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
607 &cp);
608 }
609
610 static void hci_init3_req(struct hci_request *req, unsigned long opt)
611 {
612 struct hci_dev *hdev = req->hdev;
613 u8 p;
614
615 /* Some Broadcom based Bluetooth controllers do not support the
616 * Delete Stored Link Key command. They are clearly indicating its
617 * absence in the bit mask of supported commands.
618 *
619 * Check the supported commands and only if the the command is marked
620 * as supported send it. If not supported assume that the controller
621 * does not have actual support for stored link keys which makes this
622 * command redundant anyway.
623 */
624 if (hdev->commands[6] & 0x80) {
625 struct hci_cp_delete_stored_link_key cp;
626
627 bacpy(&cp.bdaddr, BDADDR_ANY);
628 cp.delete_all = 0x01;
629 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
630 sizeof(cp), &cp);
631 }
632
633 if (hdev->commands[5] & 0x10)
634 hci_setup_link_policy(req);
635
636 if (lmp_le_capable(hdev)) {
637 hci_set_le_support(req);
638 hci_update_ad(req);
639 }
640
641 /* Read features beyond page 1 if available */
642 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
643 struct hci_cp_read_local_ext_features cp;
644
645 cp.page = p;
646 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
647 sizeof(cp), &cp);
648 }
649 }
650
651 static int __hci_init(struct hci_dev *hdev)
652 {
653 int err;
654
655 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
656 if (err < 0)
657 return err;
658
659 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
660 * BR/EDR/LE type controllers. AMP controllers only need the
661 * first stage init.
662 */
663 if (hdev->dev_type != HCI_BREDR)
664 return 0;
665
666 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
667 if (err < 0)
668 return err;
669
670 return __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
671 }
672
673 static void hci_scan_req(struct hci_request *req, unsigned long opt)
674 {
675 __u8 scan = opt;
676
677 BT_DBG("%s %x", req->hdev->name, scan);
678
679 /* Inquiry and Page scans */
680 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
681 }
682
683 static void hci_auth_req(struct hci_request *req, unsigned long opt)
684 {
685 __u8 auth = opt;
686
687 BT_DBG("%s %x", req->hdev->name, auth);
688
689 /* Authentication */
690 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
691 }
692
693 static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
694 {
695 __u8 encrypt = opt;
696
697 BT_DBG("%s %x", req->hdev->name, encrypt);
698
699 /* Encryption */
700 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
701 }
702
703 static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
704 {
705 __le16 policy = cpu_to_le16(opt);
706
707 BT_DBG("%s %x", req->hdev->name, policy);
708
709 /* Default link policy */
710 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
711 }
712
713 /* Get HCI device by index.
714 * Device is held on return. */
715 struct hci_dev *hci_dev_get(int index)
716 {
717 struct hci_dev *hdev = NULL, *d;
718
719 BT_DBG("%d", index);
720
721 if (index < 0)
722 return NULL;
723
724 read_lock(&hci_dev_list_lock);
725 list_for_each_entry(d, &hci_dev_list, list) {
726 if (d->id == index) {
727 hdev = hci_dev_hold(d);
728 break;
729 }
730 }
731 read_unlock(&hci_dev_list_lock);
732 return hdev;
733 }
734
735 /* ---- Inquiry support ---- */
736
737 bool hci_discovery_active(struct hci_dev *hdev)
738 {
739 struct discovery_state *discov = &hdev->discovery;
740
741 switch (discov->state) {
742 case DISCOVERY_FINDING:
743 case DISCOVERY_RESOLVING:
744 return true;
745
746 default:
747 return false;
748 }
749 }
750
751 void hci_discovery_set_state(struct hci_dev *hdev, int state)
752 {
753 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
754
755 if (hdev->discovery.state == state)
756 return;
757
758 switch (state) {
759 case DISCOVERY_STOPPED:
760 if (hdev->discovery.state != DISCOVERY_STARTING)
761 mgmt_discovering(hdev, 0);
762 break;
763 case DISCOVERY_STARTING:
764 break;
765 case DISCOVERY_FINDING:
766 mgmt_discovering(hdev, 1);
767 break;
768 case DISCOVERY_RESOLVING:
769 break;
770 case DISCOVERY_STOPPING:
771 break;
772 }
773
774 hdev->discovery.state = state;
775 }
776
777 void hci_inquiry_cache_flush(struct hci_dev *hdev)
778 {
779 struct discovery_state *cache = &hdev->discovery;
780 struct inquiry_entry *p, *n;
781
782 list_for_each_entry_safe(p, n, &cache->all, all) {
783 list_del(&p->all);
784 kfree(p);
785 }
786
787 INIT_LIST_HEAD(&cache->unknown);
788 INIT_LIST_HEAD(&cache->resolve);
789 }
790
791 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
792 bdaddr_t *bdaddr)
793 {
794 struct discovery_state *cache = &hdev->discovery;
795 struct inquiry_entry *e;
796
797 BT_DBG("cache %p, %pMR", cache, bdaddr);
798
799 list_for_each_entry(e, &cache->all, all) {
800 if (!bacmp(&e->data.bdaddr, bdaddr))
801 return e;
802 }
803
804 return NULL;
805 }
806
807 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
808 bdaddr_t *bdaddr)
809 {
810 struct discovery_state *cache = &hdev->discovery;
811 struct inquiry_entry *e;
812
813 BT_DBG("cache %p, %pMR", cache, bdaddr);
814
815 list_for_each_entry(e, &cache->unknown, list) {
816 if (!bacmp(&e->data.bdaddr, bdaddr))
817 return e;
818 }
819
820 return NULL;
821 }
822
823 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
824 bdaddr_t *bdaddr,
825 int state)
826 {
827 struct discovery_state *cache = &hdev->discovery;
828 struct inquiry_entry *e;
829
830 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
831
832 list_for_each_entry(e, &cache->resolve, list) {
833 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
834 return e;
835 if (!bacmp(&e->data.bdaddr, bdaddr))
836 return e;
837 }
838
839 return NULL;
840 }
841
842 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
843 struct inquiry_entry *ie)
844 {
845 struct discovery_state *cache = &hdev->discovery;
846 struct list_head *pos = &cache->resolve;
847 struct inquiry_entry *p;
848
849 list_del(&ie->list);
850
851 list_for_each_entry(p, &cache->resolve, list) {
852 if (p->name_state != NAME_PENDING &&
853 abs(p->data.rssi) >= abs(ie->data.rssi))
854 break;
855 pos = &p->list;
856 }
857
858 list_add(&ie->list, pos);
859 }
860
861 bool hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
862 bool name_known, bool *ssp)
863 {
864 struct discovery_state *cache = &hdev->discovery;
865 struct inquiry_entry *ie;
866
867 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
868
869 hci_remove_remote_oob_data(hdev, &data->bdaddr);
870
871 if (ssp)
872 *ssp = data->ssp_mode;
873
874 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
875 if (ie) {
876 if (ie->data.ssp_mode && ssp)
877 *ssp = true;
878
879 if (ie->name_state == NAME_NEEDED &&
880 data->rssi != ie->data.rssi) {
881 ie->data.rssi = data->rssi;
882 hci_inquiry_cache_update_resolve(hdev, ie);
883 }
884
885 goto update;
886 }
887
888 /* Entry not in the cache. Add new one. */
889 ie = kzalloc(sizeof(struct inquiry_entry), GFP_ATOMIC);
890 if (!ie)
891 return false;
892
893 list_add(&ie->all, &cache->all);
894
895 if (name_known) {
896 ie->name_state = NAME_KNOWN;
897 } else {
898 ie->name_state = NAME_NOT_KNOWN;
899 list_add(&ie->list, &cache->unknown);
900 }
901
902 update:
903 if (name_known && ie->name_state != NAME_KNOWN &&
904 ie->name_state != NAME_PENDING) {
905 ie->name_state = NAME_KNOWN;
906 list_del(&ie->list);
907 }
908
909 memcpy(&ie->data, data, sizeof(*data));
910 ie->timestamp = jiffies;
911 cache->timestamp = jiffies;
912
913 if (ie->name_state == NAME_NOT_KNOWN)
914 return false;
915
916 return true;
917 }
918
919 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
920 {
921 struct discovery_state *cache = &hdev->discovery;
922 struct inquiry_info *info = (struct inquiry_info *) buf;
923 struct inquiry_entry *e;
924 int copied = 0;
925
926 list_for_each_entry(e, &cache->all, all) {
927 struct inquiry_data *data = &e->data;
928
929 if (copied >= num)
930 break;
931
932 bacpy(&info->bdaddr, &data->bdaddr);
933 info->pscan_rep_mode = data->pscan_rep_mode;
934 info->pscan_period_mode = data->pscan_period_mode;
935 info->pscan_mode = data->pscan_mode;
936 memcpy(info->dev_class, data->dev_class, 3);
937 info->clock_offset = data->clock_offset;
938
939 info++;
940 copied++;
941 }
942
943 BT_DBG("cache %p, copied %d", cache, copied);
944 return copied;
945 }
946
947 static void hci_inq_req(struct hci_request *req, unsigned long opt)
948 {
949 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
950 struct hci_dev *hdev = req->hdev;
951 struct hci_cp_inquiry cp;
952
953 BT_DBG("%s", hdev->name);
954
955 if (test_bit(HCI_INQUIRY, &hdev->flags))
956 return;
957
958 /* Start Inquiry */
959 memcpy(&cp.lap, &ir->lap, 3);
960 cp.length = ir->length;
961 cp.num_rsp = ir->num_rsp;
962 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
963 }
964
965 static int wait_inquiry(void *word)
966 {
967 schedule();
968 return signal_pending(current);
969 }
970
971 int hci_inquiry(void __user *arg)
972 {
973 __u8 __user *ptr = arg;
974 struct hci_inquiry_req ir;
975 struct hci_dev *hdev;
976 int err = 0, do_inquiry = 0, max_rsp;
977 long timeo;
978 __u8 *buf;
979
980 if (copy_from_user(&ir, ptr, sizeof(ir)))
981 return -EFAULT;
982
983 hdev = hci_dev_get(ir.dev_id);
984 if (!hdev)
985 return -ENODEV;
986
987 hci_dev_lock(hdev);
988 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
989 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
990 hci_inquiry_cache_flush(hdev);
991 do_inquiry = 1;
992 }
993 hci_dev_unlock(hdev);
994
995 timeo = ir.length * msecs_to_jiffies(2000);
996
997 if (do_inquiry) {
998 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
999 timeo);
1000 if (err < 0)
1001 goto done;
1002
1003 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1004 * cleared). If it is interrupted by a signal, return -EINTR.
1005 */
1006 if (wait_on_bit(&hdev->flags, HCI_INQUIRY, wait_inquiry,
1007 TASK_INTERRUPTIBLE))
1008 return -EINTR;
1009 }
1010
1011 /* for unlimited number of responses we will use buffer with
1012 * 255 entries
1013 */
1014 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1015
1016 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1017 * copy it to the user space.
1018 */
1019 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
1020 if (!buf) {
1021 err = -ENOMEM;
1022 goto done;
1023 }
1024
1025 hci_dev_lock(hdev);
1026 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1027 hci_dev_unlock(hdev);
1028
1029 BT_DBG("num_rsp %d", ir.num_rsp);
1030
1031 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1032 ptr += sizeof(ir);
1033 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1034 ir.num_rsp))
1035 err = -EFAULT;
1036 } else
1037 err = -EFAULT;
1038
1039 kfree(buf);
1040
1041 done:
1042 hci_dev_put(hdev);
1043 return err;
1044 }
1045
1046 static u8 create_ad(struct hci_dev *hdev, u8 *ptr)
1047 {
1048 u8 ad_len = 0, flags = 0;
1049 size_t name_len;
1050
1051 if (test_bit(HCI_LE_PERIPHERAL, &hdev->dev_flags))
1052 flags |= LE_AD_GENERAL;
1053
1054 if (!lmp_bredr_capable(hdev))
1055 flags |= LE_AD_NO_BREDR;
1056
1057 if (lmp_le_br_capable(hdev))
1058 flags |= LE_AD_SIM_LE_BREDR_CTRL;
1059
1060 if (lmp_host_le_br_capable(hdev))
1061 flags |= LE_AD_SIM_LE_BREDR_HOST;
1062
1063 if (flags) {
1064 BT_DBG("adv flags 0x%02x", flags);
1065
1066 ptr[0] = 2;
1067 ptr[1] = EIR_FLAGS;
1068 ptr[2] = flags;
1069
1070 ad_len += 3;
1071 ptr += 3;
1072 }
1073
1074 if (hdev->adv_tx_power != HCI_TX_POWER_INVALID) {
1075 ptr[0] = 2;
1076 ptr[1] = EIR_TX_POWER;
1077 ptr[2] = (u8) hdev->adv_tx_power;
1078
1079 ad_len += 3;
1080 ptr += 3;
1081 }
1082
1083 name_len = strlen(hdev->dev_name);
1084 if (name_len > 0) {
1085 size_t max_len = HCI_MAX_AD_LENGTH - ad_len - 2;
1086
1087 if (name_len > max_len) {
1088 name_len = max_len;
1089 ptr[1] = EIR_NAME_SHORT;
1090 } else
1091 ptr[1] = EIR_NAME_COMPLETE;
1092
1093 ptr[0] = name_len + 1;
1094
1095 memcpy(ptr + 2, hdev->dev_name, name_len);
1096
1097 ad_len += (name_len + 2);
1098 ptr += (name_len + 2);
1099 }
1100
1101 return ad_len;
1102 }
1103
1104 void hci_update_ad(struct hci_request *req)
1105 {
1106 struct hci_dev *hdev = req->hdev;
1107 struct hci_cp_le_set_adv_data cp;
1108 u8 len;
1109
1110 if (!lmp_le_capable(hdev))
1111 return;
1112
1113 memset(&cp, 0, sizeof(cp));
1114
1115 len = create_ad(hdev, cp.data);
1116
1117 if (hdev->adv_data_len == len &&
1118 memcmp(cp.data, hdev->adv_data, len) == 0)
1119 return;
1120
1121 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1122 hdev->adv_data_len = len;
1123
1124 cp.length = len;
1125
1126 hci_req_add(req, HCI_OP_LE_SET_ADV_DATA, sizeof(cp), &cp);
1127 }
1128
1129 /* ---- HCI ioctl helpers ---- */
1130
1131 int hci_dev_open(__u16 dev)
1132 {
1133 struct hci_dev *hdev;
1134 int ret = 0;
1135
1136 hdev = hci_dev_get(dev);
1137 if (!hdev)
1138 return -ENODEV;
1139
1140 BT_DBG("%s %p", hdev->name, hdev);
1141
1142 hci_req_lock(hdev);
1143
1144 if (test_bit(HCI_UNREGISTER, &hdev->dev_flags)) {
1145 ret = -ENODEV;
1146 goto done;
1147 }
1148
1149 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) {
1150 ret = -ERFKILL;
1151 goto done;
1152 }
1153
1154 if (test_bit(HCI_UP, &hdev->flags)) {
1155 ret = -EALREADY;
1156 goto done;
1157 }
1158
1159 if (hdev->open(hdev)) {
1160 ret = -EIO;
1161 goto done;
1162 }
1163
1164 atomic_set(&hdev->cmd_cnt, 1);
1165 set_bit(HCI_INIT, &hdev->flags);
1166
1167 if (hdev->setup && test_bit(HCI_SETUP, &hdev->dev_flags))
1168 ret = hdev->setup(hdev);
1169
1170 if (!ret) {
1171 /* Treat all non BR/EDR controllers as raw devices if
1172 * enable_hs is not set.
1173 */
1174 if (hdev->dev_type != HCI_BREDR && !enable_hs)
1175 set_bit(HCI_RAW, &hdev->flags);
1176
1177 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
1178 set_bit(HCI_RAW, &hdev->flags);
1179
1180 if (!test_bit(HCI_RAW, &hdev->flags))
1181 ret = __hci_init(hdev);
1182 }
1183
1184 clear_bit(HCI_INIT, &hdev->flags);
1185
1186 if (!ret) {
1187 hci_dev_hold(hdev);
1188 set_bit(HCI_UP, &hdev->flags);
1189 hci_notify(hdev, HCI_DEV_UP);
1190 if (!test_bit(HCI_SETUP, &hdev->dev_flags) &&
1191 mgmt_valid_hdev(hdev)) {
1192 hci_dev_lock(hdev);
1193 mgmt_powered(hdev, 1);
1194 hci_dev_unlock(hdev);
1195 }
1196 } else {
1197 /* Init failed, cleanup */
1198 flush_work(&hdev->tx_work);
1199 flush_work(&hdev->cmd_work);
1200 flush_work(&hdev->rx_work);
1201
1202 skb_queue_purge(&hdev->cmd_q);
1203 skb_queue_purge(&hdev->rx_q);
1204
1205 if (hdev->flush)
1206 hdev->flush(hdev);
1207
1208 if (hdev->sent_cmd) {
1209 kfree_skb(hdev->sent_cmd);
1210 hdev->sent_cmd = NULL;
1211 }
1212
1213 hdev->close(hdev);
1214 hdev->flags = 0;
1215 }
1216
1217 done:
1218 hci_req_unlock(hdev);
1219 hci_dev_put(hdev);
1220 return ret;
1221 }
1222
1223 static int hci_dev_do_close(struct hci_dev *hdev)
1224 {
1225 BT_DBG("%s %p", hdev->name, hdev);
1226
1227 cancel_delayed_work(&hdev->power_off);
1228
1229 hci_req_cancel(hdev, ENODEV);
1230 hci_req_lock(hdev);
1231
1232 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1233 del_timer_sync(&hdev->cmd_timer);
1234 hci_req_unlock(hdev);
1235 return 0;
1236 }
1237
1238 /* Flush RX and TX works */
1239 flush_work(&hdev->tx_work);
1240 flush_work(&hdev->rx_work);
1241
1242 if (hdev->discov_timeout > 0) {
1243 cancel_delayed_work(&hdev->discov_off);
1244 hdev->discov_timeout = 0;
1245 clear_bit(HCI_DISCOVERABLE, &hdev->dev_flags);
1246 }
1247
1248 if (test_and_clear_bit(HCI_SERVICE_CACHE, &hdev->dev_flags))
1249 cancel_delayed_work(&hdev->service_cache);
1250
1251 cancel_delayed_work_sync(&hdev->le_scan_disable);
1252
1253 hci_dev_lock(hdev);
1254 hci_inquiry_cache_flush(hdev);
1255 hci_conn_hash_flush(hdev);
1256 hci_dev_unlock(hdev);
1257
1258 hci_notify(hdev, HCI_DEV_DOWN);
1259
1260 if (hdev->flush)
1261 hdev->flush(hdev);
1262
1263 /* Reset device */
1264 skb_queue_purge(&hdev->cmd_q);
1265 atomic_set(&hdev->cmd_cnt, 1);
1266 if (!test_bit(HCI_RAW, &hdev->flags) &&
1267 test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
1268 set_bit(HCI_INIT, &hdev->flags);
1269 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1270 clear_bit(HCI_INIT, &hdev->flags);
1271 }
1272
1273 /* flush cmd work */
1274 flush_work(&hdev->cmd_work);
1275
1276 /* Drop queues */
1277 skb_queue_purge(&hdev->rx_q);
1278 skb_queue_purge(&hdev->cmd_q);
1279 skb_queue_purge(&hdev->raw_q);
1280
1281 /* Drop last sent command */
1282 if (hdev->sent_cmd) {
1283 del_timer_sync(&hdev->cmd_timer);
1284 kfree_skb(hdev->sent_cmd);
1285 hdev->sent_cmd = NULL;
1286 }
1287
1288 kfree_skb(hdev->recv_evt);
1289 hdev->recv_evt = NULL;
1290
1291 /* After this point our queues are empty
1292 * and no tasks are scheduled. */
1293 hdev->close(hdev);
1294
1295 /* Clear flags */
1296 hdev->flags = 0;
1297 hdev->dev_flags &= ~HCI_PERSISTENT_MASK;
1298
1299 if (!test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags) &&
1300 mgmt_valid_hdev(hdev)) {
1301 hci_dev_lock(hdev);
1302 mgmt_powered(hdev, 0);
1303 hci_dev_unlock(hdev);
1304 }
1305
1306 /* Controller radio is available but is currently powered down */
1307 hdev->amp_status = 0;
1308
1309 memset(hdev->eir, 0, sizeof(hdev->eir));
1310 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1311
1312 hci_req_unlock(hdev);
1313
1314 hci_dev_put(hdev);
1315 return 0;
1316 }
1317
1318 int hci_dev_close(__u16 dev)
1319 {
1320 struct hci_dev *hdev;
1321 int err;
1322
1323 hdev = hci_dev_get(dev);
1324 if (!hdev)
1325 return -ENODEV;
1326
1327 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1328 cancel_delayed_work(&hdev->power_off);
1329
1330 err = hci_dev_do_close(hdev);
1331
1332 hci_dev_put(hdev);
1333 return err;
1334 }
1335
1336 int hci_dev_reset(__u16 dev)
1337 {
1338 struct hci_dev *hdev;
1339 int ret = 0;
1340
1341 hdev = hci_dev_get(dev);
1342 if (!hdev)
1343 return -ENODEV;
1344
1345 hci_req_lock(hdev);
1346
1347 if (!test_bit(HCI_UP, &hdev->flags)) {
1348 ret = -ENETDOWN;
1349 goto done;
1350 }
1351
1352 /* Drop queues */
1353 skb_queue_purge(&hdev->rx_q);
1354 skb_queue_purge(&hdev->cmd_q);
1355
1356 hci_dev_lock(hdev);
1357 hci_inquiry_cache_flush(hdev);
1358 hci_conn_hash_flush(hdev);
1359 hci_dev_unlock(hdev);
1360
1361 if (hdev->flush)
1362 hdev->flush(hdev);
1363
1364 atomic_set(&hdev->cmd_cnt, 1);
1365 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1366
1367 if (!test_bit(HCI_RAW, &hdev->flags))
1368 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1369
1370 done:
1371 hci_req_unlock(hdev);
1372 hci_dev_put(hdev);
1373 return ret;
1374 }
1375
1376 int hci_dev_reset_stat(__u16 dev)
1377 {
1378 struct hci_dev *hdev;
1379 int ret = 0;
1380
1381 hdev = hci_dev_get(dev);
1382 if (!hdev)
1383 return -ENODEV;
1384
1385 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1386
1387 hci_dev_put(hdev);
1388
1389 return ret;
1390 }
1391
1392 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1393 {
1394 struct hci_dev *hdev;
1395 struct hci_dev_req dr;
1396 int err = 0;
1397
1398 if (copy_from_user(&dr, arg, sizeof(dr)))
1399 return -EFAULT;
1400
1401 hdev = hci_dev_get(dr.dev_id);
1402 if (!hdev)
1403 return -ENODEV;
1404
1405 switch (cmd) {
1406 case HCISETAUTH:
1407 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1408 HCI_INIT_TIMEOUT);
1409 break;
1410
1411 case HCISETENCRYPT:
1412 if (!lmp_encrypt_capable(hdev)) {
1413 err = -EOPNOTSUPP;
1414 break;
1415 }
1416
1417 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1418 /* Auth must be enabled first */
1419 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1420 HCI_INIT_TIMEOUT);
1421 if (err)
1422 break;
1423 }
1424
1425 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1426 HCI_INIT_TIMEOUT);
1427 break;
1428
1429 case HCISETSCAN:
1430 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1431 HCI_INIT_TIMEOUT);
1432 break;
1433
1434 case HCISETLINKPOL:
1435 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1436 HCI_INIT_TIMEOUT);
1437 break;
1438
1439 case HCISETLINKMODE:
1440 hdev->link_mode = ((__u16) dr.dev_opt) &
1441 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1442 break;
1443
1444 case HCISETPTYPE:
1445 hdev->pkt_type = (__u16) dr.dev_opt;
1446 break;
1447
1448 case HCISETACLMTU:
1449 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1450 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1451 break;
1452
1453 case HCISETSCOMTU:
1454 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1455 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1456 break;
1457
1458 default:
1459 err = -EINVAL;
1460 break;
1461 }
1462
1463 hci_dev_put(hdev);
1464 return err;
1465 }
1466
1467 int hci_get_dev_list(void __user *arg)
1468 {
1469 struct hci_dev *hdev;
1470 struct hci_dev_list_req *dl;
1471 struct hci_dev_req *dr;
1472 int n = 0, size, err;
1473 __u16 dev_num;
1474
1475 if (get_user(dev_num, (__u16 __user *) arg))
1476 return -EFAULT;
1477
1478 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1479 return -EINVAL;
1480
1481 size = sizeof(*dl) + dev_num * sizeof(*dr);
1482
1483 dl = kzalloc(size, GFP_KERNEL);
1484 if (!dl)
1485 return -ENOMEM;
1486
1487 dr = dl->dev_req;
1488
1489 read_lock(&hci_dev_list_lock);
1490 list_for_each_entry(hdev, &hci_dev_list, list) {
1491 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1492 cancel_delayed_work(&hdev->power_off);
1493
1494 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1495 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1496
1497 (dr + n)->dev_id = hdev->id;
1498 (dr + n)->dev_opt = hdev->flags;
1499
1500 if (++n >= dev_num)
1501 break;
1502 }
1503 read_unlock(&hci_dev_list_lock);
1504
1505 dl->dev_num = n;
1506 size = sizeof(*dl) + n * sizeof(*dr);
1507
1508 err = copy_to_user(arg, dl, size);
1509 kfree(dl);
1510
1511 return err ? -EFAULT : 0;
1512 }
1513
1514 int hci_get_dev_info(void __user *arg)
1515 {
1516 struct hci_dev *hdev;
1517 struct hci_dev_info di;
1518 int err = 0;
1519
1520 if (copy_from_user(&di, arg, sizeof(di)))
1521 return -EFAULT;
1522
1523 hdev = hci_dev_get(di.dev_id);
1524 if (!hdev)
1525 return -ENODEV;
1526
1527 if (test_and_clear_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1528 cancel_delayed_work_sync(&hdev->power_off);
1529
1530 if (!test_bit(HCI_MGMT, &hdev->dev_flags))
1531 set_bit(HCI_PAIRABLE, &hdev->dev_flags);
1532
1533 strcpy(di.name, hdev->name);
1534 di.bdaddr = hdev->bdaddr;
1535 di.type = (hdev->bus & 0x0f) | (hdev->dev_type << 4);
1536 di.flags = hdev->flags;
1537 di.pkt_type = hdev->pkt_type;
1538 if (lmp_bredr_capable(hdev)) {
1539 di.acl_mtu = hdev->acl_mtu;
1540 di.acl_pkts = hdev->acl_pkts;
1541 di.sco_mtu = hdev->sco_mtu;
1542 di.sco_pkts = hdev->sco_pkts;
1543 } else {
1544 di.acl_mtu = hdev->le_mtu;
1545 di.acl_pkts = hdev->le_pkts;
1546 di.sco_mtu = 0;
1547 di.sco_pkts = 0;
1548 }
1549 di.link_policy = hdev->link_policy;
1550 di.link_mode = hdev->link_mode;
1551
1552 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
1553 memcpy(&di.features, &hdev->features, sizeof(di.features));
1554
1555 if (copy_to_user(arg, &di, sizeof(di)))
1556 err = -EFAULT;
1557
1558 hci_dev_put(hdev);
1559
1560 return err;
1561 }
1562
1563 /* ---- Interface to HCI drivers ---- */
1564
1565 static int hci_rfkill_set_block(void *data, bool blocked)
1566 {
1567 struct hci_dev *hdev = data;
1568
1569 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
1570
1571 if (!blocked)
1572 return 0;
1573
1574 hci_dev_do_close(hdev);
1575
1576 return 0;
1577 }
1578
1579 static const struct rfkill_ops hci_rfkill_ops = {
1580 .set_block = hci_rfkill_set_block,
1581 };
1582
1583 static void hci_power_on(struct work_struct *work)
1584 {
1585 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
1586 int err;
1587
1588 BT_DBG("%s", hdev->name);
1589
1590 err = hci_dev_open(hdev->id);
1591 if (err < 0) {
1592 mgmt_set_powered_failed(hdev, err);
1593 return;
1594 }
1595
1596 if (test_bit(HCI_AUTO_OFF, &hdev->dev_flags))
1597 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
1598 HCI_AUTO_OFF_TIMEOUT);
1599
1600 if (test_and_clear_bit(HCI_SETUP, &hdev->dev_flags))
1601 mgmt_index_added(hdev);
1602 }
1603
1604 static void hci_power_off(struct work_struct *work)
1605 {
1606 struct hci_dev *hdev = container_of(work, struct hci_dev,
1607 power_off.work);
1608
1609 BT_DBG("%s", hdev->name);
1610
1611 hci_dev_do_close(hdev);
1612 }
1613
1614 static void hci_discov_off(struct work_struct *work)
1615 {
1616 struct hci_dev *hdev;
1617 u8 scan = SCAN_PAGE;
1618
1619 hdev = container_of(work, struct hci_dev, discov_off.work);
1620
1621 BT_DBG("%s", hdev->name);
1622
1623 hci_dev_lock(hdev);
1624
1625 hci_send_cmd(hdev, HCI_OP_WRITE_SCAN_ENABLE, sizeof(scan), &scan);
1626
1627 hdev->discov_timeout = 0;
1628
1629 hci_dev_unlock(hdev);
1630 }
1631
1632 int hci_uuids_clear(struct hci_dev *hdev)
1633 {
1634 struct bt_uuid *uuid, *tmp;
1635
1636 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1637 list_del(&uuid->list);
1638 kfree(uuid);
1639 }
1640
1641 return 0;
1642 }
1643
1644 int hci_link_keys_clear(struct hci_dev *hdev)
1645 {
1646 struct list_head *p, *n;
1647
1648 list_for_each_safe(p, n, &hdev->link_keys) {
1649 struct link_key *key;
1650
1651 key = list_entry(p, struct link_key, list);
1652
1653 list_del(p);
1654 kfree(key);
1655 }
1656
1657 return 0;
1658 }
1659
1660 int hci_smp_ltks_clear(struct hci_dev *hdev)
1661 {
1662 struct smp_ltk *k, *tmp;
1663
1664 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1665 list_del(&k->list);
1666 kfree(k);
1667 }
1668
1669 return 0;
1670 }
1671
1672 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1673 {
1674 struct link_key *k;
1675
1676 list_for_each_entry(k, &hdev->link_keys, list)
1677 if (bacmp(bdaddr, &k->bdaddr) == 0)
1678 return k;
1679
1680 return NULL;
1681 }
1682
1683 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1684 u8 key_type, u8 old_key_type)
1685 {
1686 /* Legacy key */
1687 if (key_type < 0x03)
1688 return true;
1689
1690 /* Debug keys are insecure so don't store them persistently */
1691 if (key_type == HCI_LK_DEBUG_COMBINATION)
1692 return false;
1693
1694 /* Changed combination key and there's no previous one */
1695 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1696 return false;
1697
1698 /* Security mode 3 case */
1699 if (!conn)
1700 return true;
1701
1702 /* Neither local nor remote side had no-bonding as requirement */
1703 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1704 return true;
1705
1706 /* Local side had dedicated bonding as requirement */
1707 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1708 return true;
1709
1710 /* Remote side had dedicated bonding as requirement */
1711 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1712 return true;
1713
1714 /* If none of the above criteria match, then don't store the key
1715 * persistently */
1716 return false;
1717 }
1718
1719 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, __le16 ediv, u8 rand[8])
1720 {
1721 struct smp_ltk *k;
1722
1723 list_for_each_entry(k, &hdev->long_term_keys, list) {
1724 if (k->ediv != ediv ||
1725 memcmp(rand, k->rand, sizeof(k->rand)))
1726 continue;
1727
1728 return k;
1729 }
1730
1731 return NULL;
1732 }
1733
1734 struct smp_ltk *hci_find_ltk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1735 u8 addr_type)
1736 {
1737 struct smp_ltk *k;
1738
1739 list_for_each_entry(k, &hdev->long_term_keys, list)
1740 if (addr_type == k->bdaddr_type &&
1741 bacmp(bdaddr, &k->bdaddr) == 0)
1742 return k;
1743
1744 return NULL;
1745 }
1746
1747 int hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, int new_key,
1748 bdaddr_t *bdaddr, u8 *val, u8 type, u8 pin_len)
1749 {
1750 struct link_key *key, *old_key;
1751 u8 old_key_type;
1752 bool persistent;
1753
1754 old_key = hci_find_link_key(hdev, bdaddr);
1755 if (old_key) {
1756 old_key_type = old_key->type;
1757 key = old_key;
1758 } else {
1759 old_key_type = conn ? conn->key_type : 0xff;
1760 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1761 if (!key)
1762 return -ENOMEM;
1763 list_add(&key->list, &hdev->link_keys);
1764 }
1765
1766 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
1767
1768 /* Some buggy controller combinations generate a changed
1769 * combination key for legacy pairing even when there's no
1770 * previous key */
1771 if (type == HCI_LK_CHANGED_COMBINATION &&
1772 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
1773 type = HCI_LK_COMBINATION;
1774 if (conn)
1775 conn->key_type = type;
1776 }
1777
1778 bacpy(&key->bdaddr, bdaddr);
1779 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
1780 key->pin_len = pin_len;
1781
1782 if (type == HCI_LK_CHANGED_COMBINATION)
1783 key->type = old_key_type;
1784 else
1785 key->type = type;
1786
1787 if (!new_key)
1788 return 0;
1789
1790 persistent = hci_persistent_key(hdev, conn, type, old_key_type);
1791
1792 mgmt_new_link_key(hdev, key, persistent);
1793
1794 if (conn)
1795 conn->flush_key = !persistent;
1796
1797 return 0;
1798 }
1799
1800 int hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type, u8 type,
1801 int new_key, u8 authenticated, u8 tk[16], u8 enc_size, __le16
1802 ediv, u8 rand[8])
1803 {
1804 struct smp_ltk *key, *old_key;
1805
1806 if (!(type & HCI_SMP_STK) && !(type & HCI_SMP_LTK))
1807 return 0;
1808
1809 old_key = hci_find_ltk_by_addr(hdev, bdaddr, addr_type);
1810 if (old_key)
1811 key = old_key;
1812 else {
1813 key = kzalloc(sizeof(*key), GFP_ATOMIC);
1814 if (!key)
1815 return -ENOMEM;
1816 list_add(&key->list, &hdev->long_term_keys);
1817 }
1818
1819 bacpy(&key->bdaddr, bdaddr);
1820 key->bdaddr_type = addr_type;
1821 memcpy(key->val, tk, sizeof(key->val));
1822 key->authenticated = authenticated;
1823 key->ediv = ediv;
1824 key->enc_size = enc_size;
1825 key->type = type;
1826 memcpy(key->rand, rand, sizeof(key->rand));
1827
1828 if (!new_key)
1829 return 0;
1830
1831 if (type & HCI_SMP_LTK)
1832 mgmt_new_ltk(hdev, key, 1);
1833
1834 return 0;
1835 }
1836
1837 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1838 {
1839 struct link_key *key;
1840
1841 key = hci_find_link_key(hdev, bdaddr);
1842 if (!key)
1843 return -ENOENT;
1844
1845 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1846
1847 list_del(&key->list);
1848 kfree(key);
1849
1850 return 0;
1851 }
1852
1853 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr)
1854 {
1855 struct smp_ltk *k, *tmp;
1856
1857 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1858 if (bacmp(bdaddr, &k->bdaddr))
1859 continue;
1860
1861 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1862
1863 list_del(&k->list);
1864 kfree(k);
1865 }
1866
1867 return 0;
1868 }
1869
1870 /* HCI command timer function */
1871 static void hci_cmd_timeout(unsigned long arg)
1872 {
1873 struct hci_dev *hdev = (void *) arg;
1874
1875 if (hdev->sent_cmd) {
1876 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
1877 u16 opcode = __le16_to_cpu(sent->opcode);
1878
1879 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
1880 } else {
1881 BT_ERR("%s command tx timeout", hdev->name);
1882 }
1883
1884 atomic_set(&hdev->cmd_cnt, 1);
1885 queue_work(hdev->workqueue, &hdev->cmd_work);
1886 }
1887
1888 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1889 bdaddr_t *bdaddr)
1890 {
1891 struct oob_data *data;
1892
1893 list_for_each_entry(data, &hdev->remote_oob_data, list)
1894 if (bacmp(bdaddr, &data->bdaddr) == 0)
1895 return data;
1896
1897 return NULL;
1898 }
1899
1900 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr)
1901 {
1902 struct oob_data *data;
1903
1904 data = hci_find_remote_oob_data(hdev, bdaddr);
1905 if (!data)
1906 return -ENOENT;
1907
1908 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1909
1910 list_del(&data->list);
1911 kfree(data);
1912
1913 return 0;
1914 }
1915
1916 int hci_remote_oob_data_clear(struct hci_dev *hdev)
1917 {
1918 struct oob_data *data, *n;
1919
1920 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1921 list_del(&data->list);
1922 kfree(data);
1923 }
1924
1925 return 0;
1926 }
1927
1928 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 *hash,
1929 u8 *randomizer)
1930 {
1931 struct oob_data *data;
1932
1933 data = hci_find_remote_oob_data(hdev, bdaddr);
1934
1935 if (!data) {
1936 data = kmalloc(sizeof(*data), GFP_ATOMIC);
1937 if (!data)
1938 return -ENOMEM;
1939
1940 bacpy(&data->bdaddr, bdaddr);
1941 list_add(&data->list, &hdev->remote_oob_data);
1942 }
1943
1944 memcpy(data->hash, hash, sizeof(data->hash));
1945 memcpy(data->randomizer, randomizer, sizeof(data->randomizer));
1946
1947 BT_DBG("%s for %pMR", hdev->name, bdaddr);
1948
1949 return 0;
1950 }
1951
1952 struct bdaddr_list *hci_blacklist_lookup(struct hci_dev *hdev, bdaddr_t *bdaddr)
1953 {
1954 struct bdaddr_list *b;
1955
1956 list_for_each_entry(b, &hdev->blacklist, list)
1957 if (bacmp(bdaddr, &b->bdaddr) == 0)
1958 return b;
1959
1960 return NULL;
1961 }
1962
1963 int hci_blacklist_clear(struct hci_dev *hdev)
1964 {
1965 struct list_head *p, *n;
1966
1967 list_for_each_safe(p, n, &hdev->blacklist) {
1968 struct bdaddr_list *b;
1969
1970 b = list_entry(p, struct bdaddr_list, list);
1971
1972 list_del(p);
1973 kfree(b);
1974 }
1975
1976 return 0;
1977 }
1978
1979 int hci_blacklist_add(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1980 {
1981 struct bdaddr_list *entry;
1982
1983 if (bacmp(bdaddr, BDADDR_ANY) == 0)
1984 return -EBADF;
1985
1986 if (hci_blacklist_lookup(hdev, bdaddr))
1987 return -EEXIST;
1988
1989 entry = kzalloc(sizeof(struct bdaddr_list), GFP_KERNEL);
1990 if (!entry)
1991 return -ENOMEM;
1992
1993 bacpy(&entry->bdaddr, bdaddr);
1994
1995 list_add(&entry->list, &hdev->blacklist);
1996
1997 return mgmt_device_blocked(hdev, bdaddr, type);
1998 }
1999
2000 int hci_blacklist_del(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2001 {
2002 struct bdaddr_list *entry;
2003
2004 if (bacmp(bdaddr, BDADDR_ANY) == 0)
2005 return hci_blacklist_clear(hdev);
2006
2007 entry = hci_blacklist_lookup(hdev, bdaddr);
2008 if (!entry)
2009 return -ENOENT;
2010
2011 list_del(&entry->list);
2012 kfree(entry);
2013
2014 return mgmt_device_unblocked(hdev, bdaddr, type);
2015 }
2016
2017 static void inquiry_complete(struct hci_dev *hdev, u8 status)
2018 {
2019 if (status) {
2020 BT_ERR("Failed to start inquiry: status %d", status);
2021
2022 hci_dev_lock(hdev);
2023 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2024 hci_dev_unlock(hdev);
2025 return;
2026 }
2027 }
2028
2029 static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status)
2030 {
2031 /* General inquiry access code (GIAC) */
2032 u8 lap[3] = { 0x33, 0x8b, 0x9e };
2033 struct hci_request req;
2034 struct hci_cp_inquiry cp;
2035 int err;
2036
2037 if (status) {
2038 BT_ERR("Failed to disable LE scanning: status %d", status);
2039 return;
2040 }
2041
2042 switch (hdev->discovery.type) {
2043 case DISCOV_TYPE_LE:
2044 hci_dev_lock(hdev);
2045 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2046 hci_dev_unlock(hdev);
2047 break;
2048
2049 case DISCOV_TYPE_INTERLEAVED:
2050 hci_req_init(&req, hdev);
2051
2052 memset(&cp, 0, sizeof(cp));
2053 memcpy(&cp.lap, lap, sizeof(cp.lap));
2054 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
2055 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
2056
2057 hci_dev_lock(hdev);
2058
2059 hci_inquiry_cache_flush(hdev);
2060
2061 err = hci_req_run(&req, inquiry_complete);
2062 if (err) {
2063 BT_ERR("Inquiry request failed: err %d", err);
2064 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
2065 }
2066
2067 hci_dev_unlock(hdev);
2068 break;
2069 }
2070 }
2071
2072 static void le_scan_disable_work(struct work_struct *work)
2073 {
2074 struct hci_dev *hdev = container_of(work, struct hci_dev,
2075 le_scan_disable.work);
2076 struct hci_cp_le_set_scan_enable cp;
2077 struct hci_request req;
2078 int err;
2079
2080 BT_DBG("%s", hdev->name);
2081
2082 hci_req_init(&req, hdev);
2083
2084 memset(&cp, 0, sizeof(cp));
2085 cp.enable = LE_SCAN_DISABLE;
2086 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
2087
2088 err = hci_req_run(&req, le_scan_disable_work_complete);
2089 if (err)
2090 BT_ERR("Disable LE scanning request failed: err %d", err);
2091 }
2092
2093 /* Alloc HCI device */
2094 struct hci_dev *hci_alloc_dev(void)
2095 {
2096 struct hci_dev *hdev;
2097
2098 hdev = kzalloc(sizeof(struct hci_dev), GFP_KERNEL);
2099 if (!hdev)
2100 return NULL;
2101
2102 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2103 hdev->esco_type = (ESCO_HV1);
2104 hdev->link_mode = (HCI_LM_ACCEPT);
2105 hdev->io_capability = 0x03; /* No Input No Output */
2106 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2107 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
2108
2109 hdev->sniff_max_interval = 800;
2110 hdev->sniff_min_interval = 80;
2111
2112 mutex_init(&hdev->lock);
2113 mutex_init(&hdev->req_lock);
2114
2115 INIT_LIST_HEAD(&hdev->mgmt_pending);
2116 INIT_LIST_HEAD(&hdev->blacklist);
2117 INIT_LIST_HEAD(&hdev->uuids);
2118 INIT_LIST_HEAD(&hdev->link_keys);
2119 INIT_LIST_HEAD(&hdev->long_term_keys);
2120 INIT_LIST_HEAD(&hdev->remote_oob_data);
2121 INIT_LIST_HEAD(&hdev->conn_hash.list);
2122
2123 INIT_WORK(&hdev->rx_work, hci_rx_work);
2124 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2125 INIT_WORK(&hdev->tx_work, hci_tx_work);
2126 INIT_WORK(&hdev->power_on, hci_power_on);
2127
2128 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
2129 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
2130 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
2131
2132 skb_queue_head_init(&hdev->rx_q);
2133 skb_queue_head_init(&hdev->cmd_q);
2134 skb_queue_head_init(&hdev->raw_q);
2135
2136 init_waitqueue_head(&hdev->req_wait_q);
2137
2138 setup_timer(&hdev->cmd_timer, hci_cmd_timeout, (unsigned long) hdev);
2139
2140 hci_init_sysfs(hdev);
2141 discovery_init(hdev);
2142
2143 return hdev;
2144 }
2145 EXPORT_SYMBOL(hci_alloc_dev);
2146
2147 /* Free HCI device */
2148 void hci_free_dev(struct hci_dev *hdev)
2149 {
2150 /* will free via device release */
2151 put_device(&hdev->dev);
2152 }
2153 EXPORT_SYMBOL(hci_free_dev);
2154
2155 /* Register HCI device */
2156 int hci_register_dev(struct hci_dev *hdev)
2157 {
2158 int id, error;
2159
2160 if (!hdev->open || !hdev->close)
2161 return -EINVAL;
2162
2163 /* Do not allow HCI_AMP devices to register at index 0,
2164 * so the index can be used as the AMP controller ID.
2165 */
2166 switch (hdev->dev_type) {
2167 case HCI_BREDR:
2168 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
2169 break;
2170 case HCI_AMP:
2171 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
2172 break;
2173 default:
2174 return -EINVAL;
2175 }
2176
2177 if (id < 0)
2178 return id;
2179
2180 sprintf(hdev->name, "hci%d", id);
2181 hdev->id = id;
2182
2183 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2184
2185 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
2186 WQ_MEM_RECLAIM, 1, hdev->name);
2187 if (!hdev->workqueue) {
2188 error = -ENOMEM;
2189 goto err;
2190 }
2191
2192 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
2193 WQ_MEM_RECLAIM, 1, hdev->name);
2194 if (!hdev->req_workqueue) {
2195 destroy_workqueue(hdev->workqueue);
2196 error = -ENOMEM;
2197 goto err;
2198 }
2199
2200 error = hci_add_sysfs(hdev);
2201 if (error < 0)
2202 goto err_wqueue;
2203
2204 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
2205 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2206 hdev);
2207 if (hdev->rfkill) {
2208 if (rfkill_register(hdev->rfkill) < 0) {
2209 rfkill_destroy(hdev->rfkill);
2210 hdev->rfkill = NULL;
2211 }
2212 }
2213
2214 set_bit(HCI_SETUP, &hdev->dev_flags);
2215
2216 if (hdev->dev_type != HCI_AMP)
2217 set_bit(HCI_AUTO_OFF, &hdev->dev_flags);
2218
2219 write_lock(&hci_dev_list_lock);
2220 list_add(&hdev->list, &hci_dev_list);
2221 write_unlock(&hci_dev_list_lock);
2222
2223 hci_notify(hdev, HCI_DEV_REG);
2224 hci_dev_hold(hdev);
2225
2226 queue_work(hdev->req_workqueue, &hdev->power_on);
2227
2228 return id;
2229
2230 err_wqueue:
2231 destroy_workqueue(hdev->workqueue);
2232 destroy_workqueue(hdev->req_workqueue);
2233 err:
2234 ida_simple_remove(&hci_index_ida, hdev->id);
2235
2236 return error;
2237 }
2238 EXPORT_SYMBOL(hci_register_dev);
2239
2240 /* Unregister HCI device */
2241 void hci_unregister_dev(struct hci_dev *hdev)
2242 {
2243 int i, id;
2244
2245 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2246
2247 set_bit(HCI_UNREGISTER, &hdev->dev_flags);
2248
2249 id = hdev->id;
2250
2251 write_lock(&hci_dev_list_lock);
2252 list_del(&hdev->list);
2253 write_unlock(&hci_dev_list_lock);
2254
2255 hci_dev_do_close(hdev);
2256
2257 for (i = 0; i < NUM_REASSEMBLY; i++)
2258 kfree_skb(hdev->reassembly[i]);
2259
2260 cancel_work_sync(&hdev->power_on);
2261
2262 if (!test_bit(HCI_INIT, &hdev->flags) &&
2263 !test_bit(HCI_SETUP, &hdev->dev_flags)) {
2264 hci_dev_lock(hdev);
2265 mgmt_index_removed(hdev);
2266 hci_dev_unlock(hdev);
2267 }
2268
2269 /* mgmt_index_removed should take care of emptying the
2270 * pending list */
2271 BUG_ON(!list_empty(&hdev->mgmt_pending));
2272
2273 hci_notify(hdev, HCI_DEV_UNREG);
2274
2275 if (hdev->rfkill) {
2276 rfkill_unregister(hdev->rfkill);
2277 rfkill_destroy(hdev->rfkill);
2278 }
2279
2280 hci_del_sysfs(hdev);
2281
2282 destroy_workqueue(hdev->workqueue);
2283 destroy_workqueue(hdev->req_workqueue);
2284
2285 hci_dev_lock(hdev);
2286 hci_blacklist_clear(hdev);
2287 hci_uuids_clear(hdev);
2288 hci_link_keys_clear(hdev);
2289 hci_smp_ltks_clear(hdev);
2290 hci_remote_oob_data_clear(hdev);
2291 hci_dev_unlock(hdev);
2292
2293 hci_dev_put(hdev);
2294
2295 ida_simple_remove(&hci_index_ida, id);
2296 }
2297 EXPORT_SYMBOL(hci_unregister_dev);
2298
2299 /* Suspend HCI device */
2300 int hci_suspend_dev(struct hci_dev *hdev)
2301 {
2302 hci_notify(hdev, HCI_DEV_SUSPEND);
2303 return 0;
2304 }
2305 EXPORT_SYMBOL(hci_suspend_dev);
2306
2307 /* Resume HCI device */
2308 int hci_resume_dev(struct hci_dev *hdev)
2309 {
2310 hci_notify(hdev, HCI_DEV_RESUME);
2311 return 0;
2312 }
2313 EXPORT_SYMBOL(hci_resume_dev);
2314
2315 /* Receive frame from HCI drivers */
2316 int hci_recv_frame(struct sk_buff *skb)
2317 {
2318 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2319 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
2320 && !test_bit(HCI_INIT, &hdev->flags))) {
2321 kfree_skb(skb);
2322 return -ENXIO;
2323 }
2324
2325 /* Incoming skb */
2326 bt_cb(skb)->incoming = 1;
2327
2328 /* Time stamp */
2329 __net_timestamp(skb);
2330
2331 skb_queue_tail(&hdev->rx_q, skb);
2332 queue_work(hdev->workqueue, &hdev->rx_work);
2333
2334 return 0;
2335 }
2336 EXPORT_SYMBOL(hci_recv_frame);
2337
2338 static int hci_reassembly(struct hci_dev *hdev, int type, void *data,
2339 int count, __u8 index)
2340 {
2341 int len = 0;
2342 int hlen = 0;
2343 int remain = count;
2344 struct sk_buff *skb;
2345 struct bt_skb_cb *scb;
2346
2347 if ((type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT) ||
2348 index >= NUM_REASSEMBLY)
2349 return -EILSEQ;
2350
2351 skb = hdev->reassembly[index];
2352
2353 if (!skb) {
2354 switch (type) {
2355 case HCI_ACLDATA_PKT:
2356 len = HCI_MAX_FRAME_SIZE;
2357 hlen = HCI_ACL_HDR_SIZE;
2358 break;
2359 case HCI_EVENT_PKT:
2360 len = HCI_MAX_EVENT_SIZE;
2361 hlen = HCI_EVENT_HDR_SIZE;
2362 break;
2363 case HCI_SCODATA_PKT:
2364 len = HCI_MAX_SCO_SIZE;
2365 hlen = HCI_SCO_HDR_SIZE;
2366 break;
2367 }
2368
2369 skb = bt_skb_alloc(len, GFP_ATOMIC);
2370 if (!skb)
2371 return -ENOMEM;
2372
2373 scb = (void *) skb->cb;
2374 scb->expect = hlen;
2375 scb->pkt_type = type;
2376
2377 skb->dev = (void *) hdev;
2378 hdev->reassembly[index] = skb;
2379 }
2380
2381 while (count) {
2382 scb = (void *) skb->cb;
2383 len = min_t(uint, scb->expect, count);
2384
2385 memcpy(skb_put(skb, len), data, len);
2386
2387 count -= len;
2388 data += len;
2389 scb->expect -= len;
2390 remain = count;
2391
2392 switch (type) {
2393 case HCI_EVENT_PKT:
2394 if (skb->len == HCI_EVENT_HDR_SIZE) {
2395 struct hci_event_hdr *h = hci_event_hdr(skb);
2396 scb->expect = h->plen;
2397
2398 if (skb_tailroom(skb) < scb->expect) {
2399 kfree_skb(skb);
2400 hdev->reassembly[index] = NULL;
2401 return -ENOMEM;
2402 }
2403 }
2404 break;
2405
2406 case HCI_ACLDATA_PKT:
2407 if (skb->len == HCI_ACL_HDR_SIZE) {
2408 struct hci_acl_hdr *h = hci_acl_hdr(skb);
2409 scb->expect = __le16_to_cpu(h->dlen);
2410
2411 if (skb_tailroom(skb) < scb->expect) {
2412 kfree_skb(skb);
2413 hdev->reassembly[index] = NULL;
2414 return -ENOMEM;
2415 }
2416 }
2417 break;
2418
2419 case HCI_SCODATA_PKT:
2420 if (skb->len == HCI_SCO_HDR_SIZE) {
2421 struct hci_sco_hdr *h = hci_sco_hdr(skb);
2422 scb->expect = h->dlen;
2423
2424 if (skb_tailroom(skb) < scb->expect) {
2425 kfree_skb(skb);
2426 hdev->reassembly[index] = NULL;
2427 return -ENOMEM;
2428 }
2429 }
2430 break;
2431 }
2432
2433 if (scb->expect == 0) {
2434 /* Complete frame */
2435
2436 bt_cb(skb)->pkt_type = type;
2437 hci_recv_frame(skb);
2438
2439 hdev->reassembly[index] = NULL;
2440 return remain;
2441 }
2442 }
2443
2444 return remain;
2445 }
2446
2447 int hci_recv_fragment(struct hci_dev *hdev, int type, void *data, int count)
2448 {
2449 int rem = 0;
2450
2451 if (type < HCI_ACLDATA_PKT || type > HCI_EVENT_PKT)
2452 return -EILSEQ;
2453
2454 while (count) {
2455 rem = hci_reassembly(hdev, type, data, count, type - 1);
2456 if (rem < 0)
2457 return rem;
2458
2459 data += (count - rem);
2460 count = rem;
2461 }
2462
2463 return rem;
2464 }
2465 EXPORT_SYMBOL(hci_recv_fragment);
2466
2467 #define STREAM_REASSEMBLY 0
2468
2469 int hci_recv_stream_fragment(struct hci_dev *hdev, void *data, int count)
2470 {
2471 int type;
2472 int rem = 0;
2473
2474 while (count) {
2475 struct sk_buff *skb = hdev->reassembly[STREAM_REASSEMBLY];
2476
2477 if (!skb) {
2478 struct { char type; } *pkt;
2479
2480 /* Start of the frame */
2481 pkt = data;
2482 type = pkt->type;
2483
2484 data++;
2485 count--;
2486 } else
2487 type = bt_cb(skb)->pkt_type;
2488
2489 rem = hci_reassembly(hdev, type, data, count,
2490 STREAM_REASSEMBLY);
2491 if (rem < 0)
2492 return rem;
2493
2494 data += (count - rem);
2495 count = rem;
2496 }
2497
2498 return rem;
2499 }
2500 EXPORT_SYMBOL(hci_recv_stream_fragment);
2501
2502 /* ---- Interface to upper protocols ---- */
2503
2504 int hci_register_cb(struct hci_cb *cb)
2505 {
2506 BT_DBG("%p name %s", cb, cb->name);
2507
2508 write_lock(&hci_cb_list_lock);
2509 list_add(&cb->list, &hci_cb_list);
2510 write_unlock(&hci_cb_list_lock);
2511
2512 return 0;
2513 }
2514 EXPORT_SYMBOL(hci_register_cb);
2515
2516 int hci_unregister_cb(struct hci_cb *cb)
2517 {
2518 BT_DBG("%p name %s", cb, cb->name);
2519
2520 write_lock(&hci_cb_list_lock);
2521 list_del(&cb->list);
2522 write_unlock(&hci_cb_list_lock);
2523
2524 return 0;
2525 }
2526 EXPORT_SYMBOL(hci_unregister_cb);
2527
2528 static int hci_send_frame(struct sk_buff *skb)
2529 {
2530 struct hci_dev *hdev = (struct hci_dev *) skb->dev;
2531
2532 if (!hdev) {
2533 kfree_skb(skb);
2534 return -ENODEV;
2535 }
2536
2537 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
2538
2539 /* Time stamp */
2540 __net_timestamp(skb);
2541
2542 /* Send copy to monitor */
2543 hci_send_to_monitor(hdev, skb);
2544
2545 if (atomic_read(&hdev->promisc)) {
2546 /* Send copy to the sockets */
2547 hci_send_to_sock(hdev, skb);
2548 }
2549
2550 /* Get rid of skb owner, prior to sending to the driver. */
2551 skb_orphan(skb);
2552
2553 return hdev->send(skb);
2554 }
2555
2556 void hci_req_init(struct hci_request *req, struct hci_dev *hdev)
2557 {
2558 skb_queue_head_init(&req->cmd_q);
2559 req->hdev = hdev;
2560 req->err = 0;
2561 }
2562
2563 int hci_req_run(struct hci_request *req, hci_req_complete_t complete)
2564 {
2565 struct hci_dev *hdev = req->hdev;
2566 struct sk_buff *skb;
2567 unsigned long flags;
2568
2569 BT_DBG("length %u", skb_queue_len(&req->cmd_q));
2570
2571 /* If an error occured during request building, remove all HCI
2572 * commands queued on the HCI request queue.
2573 */
2574 if (req->err) {
2575 skb_queue_purge(&req->cmd_q);
2576 return req->err;
2577 }
2578
2579 /* Do not allow empty requests */
2580 if (skb_queue_empty(&req->cmd_q))
2581 return -ENODATA;
2582
2583 skb = skb_peek_tail(&req->cmd_q);
2584 bt_cb(skb)->req.complete = complete;
2585
2586 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
2587 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
2588 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
2589
2590 queue_work(hdev->workqueue, &hdev->cmd_work);
2591
2592 return 0;
2593 }
2594
2595 static struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode,
2596 u32 plen, const void *param)
2597 {
2598 int len = HCI_COMMAND_HDR_SIZE + plen;
2599 struct hci_command_hdr *hdr;
2600 struct sk_buff *skb;
2601
2602 skb = bt_skb_alloc(len, GFP_ATOMIC);
2603 if (!skb)
2604 return NULL;
2605
2606 hdr = (struct hci_command_hdr *) skb_put(skb, HCI_COMMAND_HDR_SIZE);
2607 hdr->opcode = cpu_to_le16(opcode);
2608 hdr->plen = plen;
2609
2610 if (plen)
2611 memcpy(skb_put(skb, plen), param, plen);
2612
2613 BT_DBG("skb len %d", skb->len);
2614
2615 bt_cb(skb)->pkt_type = HCI_COMMAND_PKT;
2616 skb->dev = (void *) hdev;
2617
2618 return skb;
2619 }
2620
2621 /* Send HCI command */
2622 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
2623 const void *param)
2624 {
2625 struct sk_buff *skb;
2626
2627 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2628
2629 skb = hci_prepare_cmd(hdev, opcode, plen, param);
2630 if (!skb) {
2631 BT_ERR("%s no memory for command", hdev->name);
2632 return -ENOMEM;
2633 }
2634
2635 /* Stand-alone HCI commands must be flaged as
2636 * single-command requests.
2637 */
2638 bt_cb(skb)->req.start = true;
2639
2640 skb_queue_tail(&hdev->cmd_q, skb);
2641 queue_work(hdev->workqueue, &hdev->cmd_work);
2642
2643 return 0;
2644 }
2645
2646 /* Queue a command to an asynchronous HCI request */
2647 void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
2648 const void *param, u8 event)
2649 {
2650 struct hci_dev *hdev = req->hdev;
2651 struct sk_buff *skb;
2652
2653 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
2654
2655 /* If an error occured during request building, there is no point in
2656 * queueing the HCI command. We can simply return.
2657 */
2658 if (req->err)
2659 return;
2660
2661 skb = hci_prepare_cmd(hdev, opcode, plen, param);
2662 if (!skb) {
2663 BT_ERR("%s no memory for command (opcode 0x%4.4x)",
2664 hdev->name, opcode);
2665 req->err = -ENOMEM;
2666 return;
2667 }
2668
2669 if (skb_queue_empty(&req->cmd_q))
2670 bt_cb(skb)->req.start = true;
2671
2672 bt_cb(skb)->req.event = event;
2673
2674 skb_queue_tail(&req->cmd_q, skb);
2675 }
2676
2677 void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
2678 const void *param)
2679 {
2680 hci_req_add_ev(req, opcode, plen, param, 0);
2681 }
2682
2683 /* Get data from the previously sent command */
2684 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
2685 {
2686 struct hci_command_hdr *hdr;
2687
2688 if (!hdev->sent_cmd)
2689 return NULL;
2690
2691 hdr = (void *) hdev->sent_cmd->data;
2692
2693 if (hdr->opcode != cpu_to_le16(opcode))
2694 return NULL;
2695
2696 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
2697
2698 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
2699 }
2700
2701 /* Send ACL data */
2702 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
2703 {
2704 struct hci_acl_hdr *hdr;
2705 int len = skb->len;
2706
2707 skb_push(skb, HCI_ACL_HDR_SIZE);
2708 skb_reset_transport_header(skb);
2709 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
2710 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
2711 hdr->dlen = cpu_to_le16(len);
2712 }
2713
2714 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
2715 struct sk_buff *skb, __u16 flags)
2716 {
2717 struct hci_conn *conn = chan->conn;
2718 struct hci_dev *hdev = conn->hdev;
2719 struct sk_buff *list;
2720
2721 skb->len = skb_headlen(skb);
2722 skb->data_len = 0;
2723
2724 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2725
2726 switch (hdev->dev_type) {
2727 case HCI_BREDR:
2728 hci_add_acl_hdr(skb, conn->handle, flags);
2729 break;
2730 case HCI_AMP:
2731 hci_add_acl_hdr(skb, chan->handle, flags);
2732 break;
2733 default:
2734 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
2735 return;
2736 }
2737
2738 list = skb_shinfo(skb)->frag_list;
2739 if (!list) {
2740 /* Non fragmented */
2741 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
2742
2743 skb_queue_tail(queue, skb);
2744 } else {
2745 /* Fragmented */
2746 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2747
2748 skb_shinfo(skb)->frag_list = NULL;
2749
2750 /* Queue all fragments atomically */
2751 spin_lock(&queue->lock);
2752
2753 __skb_queue_tail(queue, skb);
2754
2755 flags &= ~ACL_START;
2756 flags |= ACL_CONT;
2757 do {
2758 skb = list; list = list->next;
2759
2760 skb->dev = (void *) hdev;
2761 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
2762 hci_add_acl_hdr(skb, conn->handle, flags);
2763
2764 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
2765
2766 __skb_queue_tail(queue, skb);
2767 } while (list);
2768
2769 spin_unlock(&queue->lock);
2770 }
2771 }
2772
2773 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
2774 {
2775 struct hci_dev *hdev = chan->conn->hdev;
2776
2777 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
2778
2779 skb->dev = (void *) hdev;
2780
2781 hci_queue_acl(chan, &chan->data_q, skb, flags);
2782
2783 queue_work(hdev->workqueue, &hdev->tx_work);
2784 }
2785
2786 /* Send SCO data */
2787 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
2788 {
2789 struct hci_dev *hdev = conn->hdev;
2790 struct hci_sco_hdr hdr;
2791
2792 BT_DBG("%s len %d", hdev->name, skb->len);
2793
2794 hdr.handle = cpu_to_le16(conn->handle);
2795 hdr.dlen = skb->len;
2796
2797 skb_push(skb, HCI_SCO_HDR_SIZE);
2798 skb_reset_transport_header(skb);
2799 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
2800
2801 skb->dev = (void *) hdev;
2802 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
2803
2804 skb_queue_tail(&conn->data_q, skb);
2805 queue_work(hdev->workqueue, &hdev->tx_work);
2806 }
2807
2808 /* ---- HCI TX task (outgoing data) ---- */
2809
2810 /* HCI Connection scheduler */
2811 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
2812 int *quote)
2813 {
2814 struct hci_conn_hash *h = &hdev->conn_hash;
2815 struct hci_conn *conn = NULL, *c;
2816 unsigned int num = 0, min = ~0;
2817
2818 /* We don't have to lock device here. Connections are always
2819 * added and removed with TX task disabled. */
2820
2821 rcu_read_lock();
2822
2823 list_for_each_entry_rcu(c, &h->list, list) {
2824 if (c->type != type || skb_queue_empty(&c->data_q))
2825 continue;
2826
2827 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
2828 continue;
2829
2830 num++;
2831
2832 if (c->sent < min) {
2833 min = c->sent;
2834 conn = c;
2835 }
2836
2837 if (hci_conn_num(hdev, type) == num)
2838 break;
2839 }
2840
2841 rcu_read_unlock();
2842
2843 if (conn) {
2844 int cnt, q;
2845
2846 switch (conn->type) {
2847 case ACL_LINK:
2848 cnt = hdev->acl_cnt;
2849 break;
2850 case SCO_LINK:
2851 case ESCO_LINK:
2852 cnt = hdev->sco_cnt;
2853 break;
2854 case LE_LINK:
2855 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2856 break;
2857 default:
2858 cnt = 0;
2859 BT_ERR("Unknown link type");
2860 }
2861
2862 q = cnt / num;
2863 *quote = q ? q : 1;
2864 } else
2865 *quote = 0;
2866
2867 BT_DBG("conn %p quote %d", conn, *quote);
2868 return conn;
2869 }
2870
2871 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
2872 {
2873 struct hci_conn_hash *h = &hdev->conn_hash;
2874 struct hci_conn *c;
2875
2876 BT_ERR("%s link tx timeout", hdev->name);
2877
2878 rcu_read_lock();
2879
2880 /* Kill stalled connections */
2881 list_for_each_entry_rcu(c, &h->list, list) {
2882 if (c->type == type && c->sent) {
2883 BT_ERR("%s killing stalled connection %pMR",
2884 hdev->name, &c->dst);
2885 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
2886 }
2887 }
2888
2889 rcu_read_unlock();
2890 }
2891
2892 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
2893 int *quote)
2894 {
2895 struct hci_conn_hash *h = &hdev->conn_hash;
2896 struct hci_chan *chan = NULL;
2897 unsigned int num = 0, min = ~0, cur_prio = 0;
2898 struct hci_conn *conn;
2899 int cnt, q, conn_num = 0;
2900
2901 BT_DBG("%s", hdev->name);
2902
2903 rcu_read_lock();
2904
2905 list_for_each_entry_rcu(conn, &h->list, list) {
2906 struct hci_chan *tmp;
2907
2908 if (conn->type != type)
2909 continue;
2910
2911 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2912 continue;
2913
2914 conn_num++;
2915
2916 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
2917 struct sk_buff *skb;
2918
2919 if (skb_queue_empty(&tmp->data_q))
2920 continue;
2921
2922 skb = skb_peek(&tmp->data_q);
2923 if (skb->priority < cur_prio)
2924 continue;
2925
2926 if (skb->priority > cur_prio) {
2927 num = 0;
2928 min = ~0;
2929 cur_prio = skb->priority;
2930 }
2931
2932 num++;
2933
2934 if (conn->sent < min) {
2935 min = conn->sent;
2936 chan = tmp;
2937 }
2938 }
2939
2940 if (hci_conn_num(hdev, type) == conn_num)
2941 break;
2942 }
2943
2944 rcu_read_unlock();
2945
2946 if (!chan)
2947 return NULL;
2948
2949 switch (chan->conn->type) {
2950 case ACL_LINK:
2951 cnt = hdev->acl_cnt;
2952 break;
2953 case AMP_LINK:
2954 cnt = hdev->block_cnt;
2955 break;
2956 case SCO_LINK:
2957 case ESCO_LINK:
2958 cnt = hdev->sco_cnt;
2959 break;
2960 case LE_LINK:
2961 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
2962 break;
2963 default:
2964 cnt = 0;
2965 BT_ERR("Unknown link type");
2966 }
2967
2968 q = cnt / num;
2969 *quote = q ? q : 1;
2970 BT_DBG("chan %p quote %d", chan, *quote);
2971 return chan;
2972 }
2973
2974 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
2975 {
2976 struct hci_conn_hash *h = &hdev->conn_hash;
2977 struct hci_conn *conn;
2978 int num = 0;
2979
2980 BT_DBG("%s", hdev->name);
2981
2982 rcu_read_lock();
2983
2984 list_for_each_entry_rcu(conn, &h->list, list) {
2985 struct hci_chan *chan;
2986
2987 if (conn->type != type)
2988 continue;
2989
2990 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
2991 continue;
2992
2993 num++;
2994
2995 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
2996 struct sk_buff *skb;
2997
2998 if (chan->sent) {
2999 chan->sent = 0;
3000 continue;
3001 }
3002
3003 if (skb_queue_empty(&chan->data_q))
3004 continue;
3005
3006 skb = skb_peek(&chan->data_q);
3007 if (skb->priority >= HCI_PRIO_MAX - 1)
3008 continue;
3009
3010 skb->priority = HCI_PRIO_MAX - 1;
3011
3012 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
3013 skb->priority);
3014 }
3015
3016 if (hci_conn_num(hdev, type) == num)
3017 break;
3018 }
3019
3020 rcu_read_unlock();
3021
3022 }
3023
3024 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3025 {
3026 /* Calculate count of blocks used by this packet */
3027 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3028 }
3029
3030 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
3031 {
3032 if (!test_bit(HCI_RAW, &hdev->flags)) {
3033 /* ACL tx timeout must be longer than maximum
3034 * link supervision timeout (40.9 seconds) */
3035 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
3036 HCI_ACL_TX_TIMEOUT))
3037 hci_link_tx_to(hdev, ACL_LINK);
3038 }
3039 }
3040
3041 static void hci_sched_acl_pkt(struct hci_dev *hdev)
3042 {
3043 unsigned int cnt = hdev->acl_cnt;
3044 struct hci_chan *chan;
3045 struct sk_buff *skb;
3046 int quote;
3047
3048 __check_timeout(hdev, cnt);
3049
3050 while (hdev->acl_cnt &&
3051 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3052 u32 priority = (skb_peek(&chan->data_q))->priority;
3053 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3054 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3055 skb->len, skb->priority);
3056
3057 /* Stop if priority has changed */
3058 if (skb->priority < priority)
3059 break;
3060
3061 skb = skb_dequeue(&chan->data_q);
3062
3063 hci_conn_enter_active_mode(chan->conn,
3064 bt_cb(skb)->force_active);
3065
3066 hci_send_frame(skb);
3067 hdev->acl_last_tx = jiffies;
3068
3069 hdev->acl_cnt--;
3070 chan->sent++;
3071 chan->conn->sent++;
3072 }
3073 }
3074
3075 if (cnt != hdev->acl_cnt)
3076 hci_prio_recalculate(hdev, ACL_LINK);
3077 }
3078
3079 static void hci_sched_acl_blk(struct hci_dev *hdev)
3080 {
3081 unsigned int cnt = hdev->block_cnt;
3082 struct hci_chan *chan;
3083 struct sk_buff *skb;
3084 int quote;
3085 u8 type;
3086
3087 __check_timeout(hdev, cnt);
3088
3089 BT_DBG("%s", hdev->name);
3090
3091 if (hdev->dev_type == HCI_AMP)
3092 type = AMP_LINK;
3093 else
3094 type = ACL_LINK;
3095
3096 while (hdev->block_cnt > 0 &&
3097 (chan = hci_chan_sent(hdev, type, &quote))) {
3098 u32 priority = (skb_peek(&chan->data_q))->priority;
3099 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
3100 int blocks;
3101
3102 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3103 skb->len, skb->priority);
3104
3105 /* Stop if priority has changed */
3106 if (skb->priority < priority)
3107 break;
3108
3109 skb = skb_dequeue(&chan->data_q);
3110
3111 blocks = __get_blocks(hdev, skb);
3112 if (blocks > hdev->block_cnt)
3113 return;
3114
3115 hci_conn_enter_active_mode(chan->conn,
3116 bt_cb(skb)->force_active);
3117
3118 hci_send_frame(skb);
3119 hdev->acl_last_tx = jiffies;
3120
3121 hdev->block_cnt -= blocks;
3122 quote -= blocks;
3123
3124 chan->sent += blocks;
3125 chan->conn->sent += blocks;
3126 }
3127 }
3128
3129 if (cnt != hdev->block_cnt)
3130 hci_prio_recalculate(hdev, type);
3131 }
3132
3133 static void hci_sched_acl(struct hci_dev *hdev)
3134 {
3135 BT_DBG("%s", hdev->name);
3136
3137 /* No ACL link over BR/EDR controller */
3138 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
3139 return;
3140
3141 /* No AMP link over AMP controller */
3142 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
3143 return;
3144
3145 switch (hdev->flow_ctl_mode) {
3146 case HCI_FLOW_CTL_MODE_PACKET_BASED:
3147 hci_sched_acl_pkt(hdev);
3148 break;
3149
3150 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
3151 hci_sched_acl_blk(hdev);
3152 break;
3153 }
3154 }
3155
3156 /* Schedule SCO */
3157 static void hci_sched_sco(struct hci_dev *hdev)
3158 {
3159 struct hci_conn *conn;
3160 struct sk_buff *skb;
3161 int quote;
3162
3163 BT_DBG("%s", hdev->name);
3164
3165 if (!hci_conn_num(hdev, SCO_LINK))
3166 return;
3167
3168 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3169 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3170 BT_DBG("skb %p len %d", skb, skb->len);
3171 hci_send_frame(skb);
3172
3173 conn->sent++;
3174 if (conn->sent == ~0)
3175 conn->sent = 0;
3176 }
3177 }
3178 }
3179
3180 static void hci_sched_esco(struct hci_dev *hdev)
3181 {
3182 struct hci_conn *conn;
3183 struct sk_buff *skb;
3184 int quote;
3185
3186 BT_DBG("%s", hdev->name);
3187
3188 if (!hci_conn_num(hdev, ESCO_LINK))
3189 return;
3190
3191 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3192 &quote))) {
3193 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3194 BT_DBG("skb %p len %d", skb, skb->len);
3195 hci_send_frame(skb);
3196
3197 conn->sent++;
3198 if (conn->sent == ~0)
3199 conn->sent = 0;
3200 }
3201 }
3202 }
3203
3204 static void hci_sched_le(struct hci_dev *hdev)
3205 {
3206 struct hci_chan *chan;
3207 struct sk_buff *skb;
3208 int quote, cnt, tmp;
3209
3210 BT_DBG("%s", hdev->name);
3211
3212 if (!hci_conn_num(hdev, LE_LINK))
3213 return;
3214
3215 if (!test_bit(HCI_RAW, &hdev->flags)) {
3216 /* LE tx timeout must be longer than maximum
3217 * link supervision timeout (40.9 seconds) */
3218 if (!hdev->le_cnt && hdev->le_pkts &&
3219 time_after(jiffies, hdev->le_last_tx + HZ * 45))
3220 hci_link_tx_to(hdev, LE_LINK);
3221 }
3222
3223 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
3224 tmp = cnt;
3225 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
3226 u32 priority = (skb_peek(&chan->data_q))->priority;
3227 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3228 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3229 skb->len, skb->priority);
3230
3231 /* Stop if priority has changed */
3232 if (skb->priority < priority)
3233 break;
3234
3235 skb = skb_dequeue(&chan->data_q);
3236
3237 hci_send_frame(skb);
3238 hdev->le_last_tx = jiffies;
3239
3240 cnt--;
3241 chan->sent++;
3242 chan->conn->sent++;
3243 }
3244 }
3245
3246 if (hdev->le_pkts)
3247 hdev->le_cnt = cnt;
3248 else
3249 hdev->acl_cnt = cnt;
3250
3251 if (cnt != tmp)
3252 hci_prio_recalculate(hdev, LE_LINK);
3253 }
3254
3255 static void hci_tx_work(struct work_struct *work)
3256 {
3257 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
3258 struct sk_buff *skb;
3259
3260 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
3261 hdev->sco_cnt, hdev->le_cnt);
3262
3263 /* Schedule queues and send stuff to HCI driver */
3264
3265 hci_sched_acl(hdev);
3266
3267 hci_sched_sco(hdev);
3268
3269 hci_sched_esco(hdev);
3270
3271 hci_sched_le(hdev);
3272
3273 /* Send next queued raw (unknown type) packet */
3274 while ((skb = skb_dequeue(&hdev->raw_q)))
3275 hci_send_frame(skb);
3276 }
3277
3278 /* ----- HCI RX task (incoming data processing) ----- */
3279
3280 /* ACL data packet */
3281 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3282 {
3283 struct hci_acl_hdr *hdr = (void *) skb->data;
3284 struct hci_conn *conn;
3285 __u16 handle, flags;
3286
3287 skb_pull(skb, HCI_ACL_HDR_SIZE);
3288
3289 handle = __le16_to_cpu(hdr->handle);
3290 flags = hci_flags(handle);
3291 handle = hci_handle(handle);
3292
3293 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
3294 handle, flags);
3295
3296 hdev->stat.acl_rx++;
3297
3298 hci_dev_lock(hdev);
3299 conn = hci_conn_hash_lookup_handle(hdev, handle);
3300 hci_dev_unlock(hdev);
3301
3302 if (conn) {
3303 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
3304
3305 /* Send to upper protocol */
3306 l2cap_recv_acldata(conn, skb, flags);
3307 return;
3308 } else {
3309 BT_ERR("%s ACL packet for unknown connection handle %d",
3310 hdev->name, handle);
3311 }
3312
3313 kfree_skb(skb);
3314 }
3315
3316 /* SCO data packet */
3317 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3318 {
3319 struct hci_sco_hdr *hdr = (void *) skb->data;
3320 struct hci_conn *conn;
3321 __u16 handle;
3322
3323 skb_pull(skb, HCI_SCO_HDR_SIZE);
3324
3325 handle = __le16_to_cpu(hdr->handle);
3326
3327 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
3328
3329 hdev->stat.sco_rx++;
3330
3331 hci_dev_lock(hdev);
3332 conn = hci_conn_hash_lookup_handle(hdev, handle);
3333 hci_dev_unlock(hdev);
3334
3335 if (conn) {
3336 /* Send to upper protocol */
3337 sco_recv_scodata(conn, skb);
3338 return;
3339 } else {
3340 BT_ERR("%s SCO packet for unknown connection handle %d",
3341 hdev->name, handle);
3342 }
3343
3344 kfree_skb(skb);
3345 }
3346
3347 static bool hci_req_is_complete(struct hci_dev *hdev)
3348 {
3349 struct sk_buff *skb;
3350
3351 skb = skb_peek(&hdev->cmd_q);
3352 if (!skb)
3353 return true;
3354
3355 return bt_cb(skb)->req.start;
3356 }
3357
3358 static void hci_resend_last(struct hci_dev *hdev)
3359 {
3360 struct hci_command_hdr *sent;
3361 struct sk_buff *skb;
3362 u16 opcode;
3363
3364 if (!hdev->sent_cmd)
3365 return;
3366
3367 sent = (void *) hdev->sent_cmd->data;
3368 opcode = __le16_to_cpu(sent->opcode);
3369 if (opcode == HCI_OP_RESET)
3370 return;
3371
3372 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3373 if (!skb)
3374 return;
3375
3376 skb_queue_head(&hdev->cmd_q, skb);
3377 queue_work(hdev->workqueue, &hdev->cmd_work);
3378 }
3379
3380 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status)
3381 {
3382 hci_req_complete_t req_complete = NULL;
3383 struct sk_buff *skb;
3384 unsigned long flags;
3385
3386 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3387
3388 /* If the completed command doesn't match the last one that was
3389 * sent we need to do special handling of it.
3390 */
3391 if (!hci_sent_cmd_data(hdev, opcode)) {
3392 /* Some CSR based controllers generate a spontaneous
3393 * reset complete event during init and any pending
3394 * command will never be completed. In such a case we
3395 * need to resend whatever was the last sent
3396 * command.
3397 */
3398 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3399 hci_resend_last(hdev);
3400
3401 return;
3402 }
3403
3404 /* If the command succeeded and there's still more commands in
3405 * this request the request is not yet complete.
3406 */
3407 if (!status && !hci_req_is_complete(hdev))
3408 return;
3409
3410 /* If this was the last command in a request the complete
3411 * callback would be found in hdev->sent_cmd instead of the
3412 * command queue (hdev->cmd_q).
3413 */
3414 if (hdev->sent_cmd) {
3415 req_complete = bt_cb(hdev->sent_cmd)->req.complete;
3416
3417 if (req_complete) {
3418 /* We must set the complete callback to NULL to
3419 * avoid calling the callback more than once if
3420 * this function gets called again.
3421 */
3422 bt_cb(hdev->sent_cmd)->req.complete = NULL;
3423
3424 goto call_complete;
3425 }
3426 }
3427
3428 /* Remove all pending commands belonging to this request */
3429 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
3430 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
3431 if (bt_cb(skb)->req.start) {
3432 __skb_queue_head(&hdev->cmd_q, skb);
3433 break;
3434 }
3435
3436 req_complete = bt_cb(skb)->req.complete;
3437 kfree_skb(skb);
3438 }
3439 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
3440
3441 call_complete:
3442 if (req_complete)
3443 req_complete(hdev, status);
3444 }
3445
3446 static void hci_rx_work(struct work_struct *work)
3447 {
3448 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
3449 struct sk_buff *skb;
3450
3451 BT_DBG("%s", hdev->name);
3452
3453 while ((skb = skb_dequeue(&hdev->rx_q))) {
3454 /* Send copy to monitor */
3455 hci_send_to_monitor(hdev, skb);
3456
3457 if (atomic_read(&hdev->promisc)) {
3458 /* Send copy to the sockets */
3459 hci_send_to_sock(hdev, skb);
3460 }
3461
3462 if (test_bit(HCI_RAW, &hdev->flags)) {
3463 kfree_skb(skb);
3464 continue;
3465 }
3466
3467 if (test_bit(HCI_INIT, &hdev->flags)) {
3468 /* Don't process data packets in this states. */
3469 switch (bt_cb(skb)->pkt_type) {
3470 case HCI_ACLDATA_PKT:
3471 case HCI_SCODATA_PKT:
3472 kfree_skb(skb);
3473 continue;
3474 }
3475 }
3476
3477 /* Process frame */
3478 switch (bt_cb(skb)->pkt_type) {
3479 case HCI_EVENT_PKT:
3480 BT_DBG("%s Event packet", hdev->name);
3481 hci_event_packet(hdev, skb);
3482 break;
3483
3484 case HCI_ACLDATA_PKT:
3485 BT_DBG("%s ACL data packet", hdev->name);
3486 hci_acldata_packet(hdev, skb);
3487 break;
3488
3489 case HCI_SCODATA_PKT:
3490 BT_DBG("%s SCO data packet", hdev->name);
3491 hci_scodata_packet(hdev, skb);
3492 break;
3493
3494 default:
3495 kfree_skb(skb);
3496 break;
3497 }
3498 }
3499 }
3500
3501 static void hci_cmd_work(struct work_struct *work)
3502 {
3503 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
3504 struct sk_buff *skb;
3505
3506 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
3507 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
3508
3509 /* Send queued commands */
3510 if (atomic_read(&hdev->cmd_cnt)) {
3511 skb = skb_dequeue(&hdev->cmd_q);
3512 if (!skb)
3513 return;
3514
3515 kfree_skb(hdev->sent_cmd);
3516
3517 hdev->sent_cmd = skb_clone(skb, GFP_ATOMIC);
3518 if (hdev->sent_cmd) {
3519 atomic_dec(&hdev->cmd_cnt);
3520 hci_send_frame(skb);
3521 if (test_bit(HCI_RESET, &hdev->flags))
3522 del_timer(&hdev->cmd_timer);
3523 else
3524 mod_timer(&hdev->cmd_timer,
3525 jiffies + HCI_CMD_TIMEOUT);
3526 } else {
3527 skb_queue_head(&hdev->cmd_q, skb);
3528 queue_work(hdev->workqueue, &hdev->cmd_work);
3529 }
3530 }
3531 }
3532
3533 u8 bdaddr_to_le(u8 bdaddr_type)
3534 {
3535 switch (bdaddr_type) {
3536 case BDADDR_LE_PUBLIC:
3537 return ADDR_LE_DEV_PUBLIC;
3538
3539 default:
3540 /* Fallback to LE Random address type */
3541 return ADDR_LE_DEV_RANDOM;
3542 }
3543 }
ubuntu-bionic-kernel mirror