?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
perf bpf: Move perf_event_output() from stdio.h to bpf.h
[linux/fpc-iii.git] / net / bluetooth / hci_core.c
blob7352fe85674be5c3e73ef50ca3702caec7a69e6c
1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2011 ProFUSION Embedded Systems
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth HCI core. */
27
28 #include <linux/export.h>
29 #include <linux/idr.h>
30 #include <linux/rfkill.h>
31 #include <linux/debugfs.h>
32 #include <linux/crypto.h>
33 #include <asm/unaligned.h>
34
35 #include <net/bluetooth/bluetooth.h>
36 #include <net/bluetooth/hci_core.h>
37 #include <net/bluetooth/l2cap.h>
38 #include <net/bluetooth/mgmt.h>
39
40 #include "hci_request.h"
41 #include "hci_debugfs.h"
42 #include "smp.h"
43 #include "leds.h"
44
45 static void hci_rx_work(struct work_struct *work);
46 static void hci_cmd_work(struct work_struct *work);
47 static void hci_tx_work(struct work_struct *work);
48
49 /* HCI device list */
50 LIST_HEAD(hci_dev_list);
51 DEFINE_RWLOCK(hci_dev_list_lock);
52
53 /* HCI callback list */
54 LIST_HEAD(hci_cb_list);
55 DEFINE_MUTEX(hci_cb_list_lock);
56
57 /* HCI ID Numbering */
58 static DEFINE_IDA(hci_index_ida);
59
60 /* ---- HCI debugfs entries ---- */
61
62 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
63 size_t count, loff_t *ppos)
64 {
65 struct hci_dev *hdev = file->private_data;
66 char buf[3];
67
68 buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
69 buf[1] = '\n';
70 buf[2] = '\0';
71 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
72 }
73
74 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
75 size_t count, loff_t *ppos)
76 {
77 struct hci_dev *hdev = file->private_data;
78 struct sk_buff *skb;
79 bool enable;
80 int err;
81
82 if (!test_bit(HCI_UP, &hdev->flags))
83 return -ENETDOWN;
84
85 err = kstrtobool_from_user(user_buf, count, &enable);
86 if (err)
87 return err;
88
89 if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
90 return -EALREADY;
91
92 hci_req_sync_lock(hdev);
93 if (enable)
94 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
95 HCI_CMD_TIMEOUT);
96 else
97 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
98 HCI_CMD_TIMEOUT);
99 hci_req_sync_unlock(hdev);
100
101 if (IS_ERR(skb))
102 return PTR_ERR(skb);
103
104 kfree_skb(skb);
105
106 hci_dev_change_flag(hdev, HCI_DUT_MODE);
107
108 return count;
109 }
110
111 static const struct file_operations dut_mode_fops = {
112 .open = simple_open,
113 .read = dut_mode_read,
114 .write = dut_mode_write,
115 .llseek = default_llseek,
116 };
117
118 static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
119 size_t count, loff_t *ppos)
120 {
121 struct hci_dev *hdev = file->private_data;
122 char buf[3];
123
124 buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
125 buf[1] = '\n';
126 buf[2] = '\0';
127 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
128 }
129
130 static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
131 size_t count, loff_t *ppos)
132 {
133 struct hci_dev *hdev = file->private_data;
134 bool enable;
135 int err;
136
137 err = kstrtobool_from_user(user_buf, count, &enable);
138 if (err)
139 return err;
140
141 /* When the diagnostic flags are not persistent and the transport
142 * is not active or in user channel operation, then there is no need
143 * for the vendor callback. Instead just store the desired value and
144 * the setting will be programmed when the controller gets powered on.
145 */
146 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
147 (!test_bit(HCI_RUNNING, &hdev->flags) ||
148 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)))
149 goto done;
150
151 hci_req_sync_lock(hdev);
152 err = hdev->set_diag(hdev, enable);
153 hci_req_sync_unlock(hdev);
154
155 if (err < 0)
156 return err;
157
158 done:
159 if (enable)
160 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
161 else
162 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
163
164 return count;
165 }
166
167 static const struct file_operations vendor_diag_fops = {
168 .open = simple_open,
169 .read = vendor_diag_read,
170 .write = vendor_diag_write,
171 .llseek = default_llseek,
172 };
173
174 static void hci_debugfs_create_basic(struct hci_dev *hdev)
175 {
176 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
177 &dut_mode_fops);
178
179 if (hdev->set_diag)
180 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
181 &vendor_diag_fops);
182 }
183
184 static int hci_reset_req(struct hci_request *req, unsigned long opt)
185 {
186 BT_DBG("%s %ld", req->hdev->name, opt);
187
188 /* Reset device */
189 set_bit(HCI_RESET, &req->hdev->flags);
190 hci_req_add(req, HCI_OP_RESET, 0, NULL);
191 return 0;
192 }
193
194 static void bredr_init(struct hci_request *req)
195 {
196 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
197
198 /* Read Local Supported Features */
199 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
200
201 /* Read Local Version */
202 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
203
204 /* Read BD Address */
205 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
206 }
207
208 static void amp_init1(struct hci_request *req)
209 {
210 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
211
212 /* Read Local Version */
213 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
214
215 /* Read Local Supported Commands */
216 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
217
218 /* Read Local AMP Info */
219 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
220
221 /* Read Data Blk size */
222 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
223
224 /* Read Flow Control Mode */
225 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
226
227 /* Read Location Data */
228 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
229 }
230
231 static int amp_init2(struct hci_request *req)
232 {
233 /* Read Local Supported Features. Not all AMP controllers
234 * support this so it's placed conditionally in the second
235 * stage init.
236 */
237 if (req->hdev->commands[14] & 0x20)
238 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
239
240 return 0;
241 }
242
243 static int hci_init1_req(struct hci_request *req, unsigned long opt)
244 {
245 struct hci_dev *hdev = req->hdev;
246
247 BT_DBG("%s %ld", hdev->name, opt);
248
249 /* Reset */
250 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
251 hci_reset_req(req, 0);
252
253 switch (hdev->dev_type) {
254 case HCI_PRIMARY:
255 bredr_init(req);
256 break;
257 case HCI_AMP:
258 amp_init1(req);
259 break;
260 default:
261 bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
262 break;
263 }
264
265 return 0;
266 }
267
268 static void bredr_setup(struct hci_request *req)
269 {
270 __le16 param;
271 __u8 flt_type;
272
273 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
274 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
275
276 /* Read Class of Device */
277 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
278
279 /* Read Local Name */
280 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
281
282 /* Read Voice Setting */
283 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
284
285 /* Read Number of Supported IAC */
286 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
287
288 /* Read Current IAC LAP */
289 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
290
291 /* Clear Event Filters */
292 flt_type = HCI_FLT_CLEAR_ALL;
293 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
294
295 /* Connection accept timeout ~20 secs */
296 param = cpu_to_le16(0x7d00);
297 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
298 }
299
300 static void le_setup(struct hci_request *req)
301 {
302 struct hci_dev *hdev = req->hdev;
303
304 /* Read LE Buffer Size */
305 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
306
307 /* Read LE Local Supported Features */
308 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
309
310 /* Read LE Supported States */
311 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
312
313 /* LE-only controllers have LE implicitly enabled */
314 if (!lmp_bredr_capable(hdev))
315 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
316 }
317
318 static void hci_setup_event_mask(struct hci_request *req)
319 {
320 struct hci_dev *hdev = req->hdev;
321
322 /* The second byte is 0xff instead of 0x9f (two reserved bits
323 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
324 * command otherwise.
325 */
326 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
327
328 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
329 * any event mask for pre 1.2 devices.
330 */
331 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
332 return;
333
334 if (lmp_bredr_capable(hdev)) {
335 events[4] |= 0x01; /* Flow Specification Complete */
336 } else {
337 /* Use a different default for LE-only devices */
338 memset(events, 0, sizeof(events));
339 events[1] |= 0x20; /* Command Complete */
340 events[1] |= 0x40; /* Command Status */
341 events[1] |= 0x80; /* Hardware Error */
342
343 /* If the controller supports the Disconnect command, enable
344 * the corresponding event. In addition enable packet flow
345 * control related events.
346 */
347 if (hdev->commands[0] & 0x20) {
348 events[0] |= 0x10; /* Disconnection Complete */
349 events[2] |= 0x04; /* Number of Completed Packets */
350 events[3] |= 0x02; /* Data Buffer Overflow */
351 }
352
353 /* If the controller supports the Read Remote Version
354 * Information command, enable the corresponding event.
355 */
356 if (hdev->commands[2] & 0x80)
357 events[1] |= 0x08; /* Read Remote Version Information
358 * Complete
359 */
360
361 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
362 events[0] |= 0x80; /* Encryption Change */
363 events[5] |= 0x80; /* Encryption Key Refresh Complete */
364 }
365 }
366
367 if (lmp_inq_rssi_capable(hdev) ||
368 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
369 events[4] |= 0x02; /* Inquiry Result with RSSI */
370
371 if (lmp_ext_feat_capable(hdev))
372 events[4] |= 0x04; /* Read Remote Extended Features Complete */
373
374 if (lmp_esco_capable(hdev)) {
375 events[5] |= 0x08; /* Synchronous Connection Complete */
376 events[5] |= 0x10; /* Synchronous Connection Changed */
377 }
378
379 if (lmp_sniffsubr_capable(hdev))
380 events[5] |= 0x20; /* Sniff Subrating */
381
382 if (lmp_pause_enc_capable(hdev))
383 events[5] |= 0x80; /* Encryption Key Refresh Complete */
384
385 if (lmp_ext_inq_capable(hdev))
386 events[5] |= 0x40; /* Extended Inquiry Result */
387
388 if (lmp_no_flush_capable(hdev))
389 events[7] |= 0x01; /* Enhanced Flush Complete */
390
391 if (lmp_lsto_capable(hdev))
392 events[6] |= 0x80; /* Link Supervision Timeout Changed */
393
394 if (lmp_ssp_capable(hdev)) {
395 events[6] |= 0x01; /* IO Capability Request */
396 events[6] |= 0x02; /* IO Capability Response */
397 events[6] |= 0x04; /* User Confirmation Request */
398 events[6] |= 0x08; /* User Passkey Request */
399 events[6] |= 0x10; /* Remote OOB Data Request */
400 events[6] |= 0x20; /* Simple Pairing Complete */
401 events[7] |= 0x04; /* User Passkey Notification */
402 events[7] |= 0x08; /* Keypress Notification */
403 events[7] |= 0x10; /* Remote Host Supported
404 * Features Notification
405 */
406 }
407
408 if (lmp_le_capable(hdev))
409 events[7] |= 0x20; /* LE Meta-Event */
410
411 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
412 }
413
414 static int hci_init2_req(struct hci_request *req, unsigned long opt)
415 {
416 struct hci_dev *hdev = req->hdev;
417
418 if (hdev->dev_type == HCI_AMP)
419 return amp_init2(req);
420
421 if (lmp_bredr_capable(hdev))
422 bredr_setup(req);
423 else
424 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
425
426 if (lmp_le_capable(hdev))
427 le_setup(req);
428
429 /* All Bluetooth 1.2 and later controllers should support the
430 * HCI command for reading the local supported commands.
431 *
432 * Unfortunately some controllers indicate Bluetooth 1.2 support,
433 * but do not have support for this command. If that is the case,
434 * the driver can quirk the behavior and skip reading the local
435 * supported commands.
436 */
437 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
438 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
439 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
440
441 if (lmp_ssp_capable(hdev)) {
442 /* When SSP is available, then the host features page
443 * should also be available as well. However some
444 * controllers list the max_page as 0 as long as SSP
445 * has not been enabled. To achieve proper debugging
446 * output, force the minimum max_page to 1 at least.
447 */
448 hdev->max_page = 0x01;
449
450 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
451 u8 mode = 0x01;
452
453 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
454 sizeof(mode), &mode);
455 } else {
456 struct hci_cp_write_eir cp;
457
458 memset(hdev->eir, 0, sizeof(hdev->eir));
459 memset(&cp, 0, sizeof(cp));
460
461 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
462 }
463 }
464
465 if (lmp_inq_rssi_capable(hdev) ||
466 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
467 u8 mode;
468
469 /* If Extended Inquiry Result events are supported, then
470 * they are clearly preferred over Inquiry Result with RSSI
471 * events.
472 */
473 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
474
475 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
476 }
477
478 if (lmp_inq_tx_pwr_capable(hdev))
479 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
480
481 if (lmp_ext_feat_capable(hdev)) {
482 struct hci_cp_read_local_ext_features cp;
483
484 cp.page = 0x01;
485 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
486 sizeof(cp), &cp);
487 }
488
489 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
490 u8 enable = 1;
491 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
492 &enable);
493 }
494
495 return 0;
496 }
497
498 static void hci_setup_link_policy(struct hci_request *req)
499 {
500 struct hci_dev *hdev = req->hdev;
501 struct hci_cp_write_def_link_policy cp;
502 u16 link_policy = 0;
503
504 if (lmp_rswitch_capable(hdev))
505 link_policy |= HCI_LP_RSWITCH;
506 if (lmp_hold_capable(hdev))
507 link_policy |= HCI_LP_HOLD;
508 if (lmp_sniff_capable(hdev))
509 link_policy |= HCI_LP_SNIFF;
510 if (lmp_park_capable(hdev))
511 link_policy |= HCI_LP_PARK;
512
513 cp.policy = cpu_to_le16(link_policy);
514 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
515 }
516
517 static void hci_set_le_support(struct hci_request *req)
518 {
519 struct hci_dev *hdev = req->hdev;
520 struct hci_cp_write_le_host_supported cp;
521
522 /* LE-only devices do not support explicit enablement */
523 if (!lmp_bredr_capable(hdev))
524 return;
525
526 memset(&cp, 0, sizeof(cp));
527
528 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
529 cp.le = 0x01;
530 cp.simul = 0x00;
531 }
532
533 if (cp.le != lmp_host_le_capable(hdev))
534 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
535 &cp);
536 }
537
538 static void hci_set_event_mask_page_2(struct hci_request *req)
539 {
540 struct hci_dev *hdev = req->hdev;
541 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
542 bool changed = false;
543
544 /* If Connectionless Slave Broadcast master role is supported
545 * enable all necessary events for it.
546 */
547 if (lmp_csb_master_capable(hdev)) {
548 events[1] |= 0x40; /* Triggered Clock Capture */
549 events[1] |= 0x80; /* Synchronization Train Complete */
550 events[2] |= 0x10; /* Slave Page Response Timeout */
551 events[2] |= 0x20; /* CSB Channel Map Change */
552 changed = true;
553 }
554
555 /* If Connectionless Slave Broadcast slave role is supported
556 * enable all necessary events for it.
557 */
558 if (lmp_csb_slave_capable(hdev)) {
559 events[2] |= 0x01; /* Synchronization Train Received */
560 events[2] |= 0x02; /* CSB Receive */
561 events[2] |= 0x04; /* CSB Timeout */
562 events[2] |= 0x08; /* Truncated Page Complete */
563 changed = true;
564 }
565
566 /* Enable Authenticated Payload Timeout Expired event if supported */
567 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
568 events[2] |= 0x80;
569 changed = true;
570 }
571
572 /* Some Broadcom based controllers indicate support for Set Event
573 * Mask Page 2 command, but then actually do not support it. Since
574 * the default value is all bits set to zero, the command is only
575 * required if the event mask has to be changed. In case no change
576 * to the event mask is needed, skip this command.
577 */
578 if (changed)
579 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
580 sizeof(events), events);
581 }
582
583 static int hci_init3_req(struct hci_request *req, unsigned long opt)
584 {
585 struct hci_dev *hdev = req->hdev;
586 u8 p;
587
588 hci_setup_event_mask(req);
589
590 if (hdev->commands[6] & 0x20 &&
591 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
592 struct hci_cp_read_stored_link_key cp;
593
594 bacpy(&cp.bdaddr, BDADDR_ANY);
595 cp.read_all = 0x01;
596 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
597 }
598
599 if (hdev->commands[5] & 0x10)
600 hci_setup_link_policy(req);
601
602 if (hdev->commands[8] & 0x01)
603 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
604
605 /* Some older Broadcom based Bluetooth 1.2 controllers do not
606 * support the Read Page Scan Type command. Check support for
607 * this command in the bit mask of supported commands.
608 */
609 if (hdev->commands[13] & 0x01)
610 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
611
612 if (lmp_le_capable(hdev)) {
613 u8 events[8];
614
615 memset(events, 0, sizeof(events));
616
617 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
618 events[0] |= 0x10; /* LE Long Term Key Request */
619
620 /* If controller supports the Connection Parameters Request
621 * Link Layer Procedure, enable the corresponding event.
622 */
623 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
624 events[0] |= 0x20; /* LE Remote Connection
625 * Parameter Request
626 */
627
628 /* If the controller supports the Data Length Extension
629 * feature, enable the corresponding event.
630 */
631 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
632 events[0] |= 0x40; /* LE Data Length Change */
633
634 /* If the controller supports Extended Scanner Filter
635 * Policies, enable the correspondig event.
636 */
637 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
638 events[1] |= 0x04; /* LE Direct Advertising
639 * Report
640 */
641
642 /* If the controller supports Channel Selection Algorithm #2
643 * feature, enable the corresponding event.
644 */
645 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
646 events[2] |= 0x08; /* LE Channel Selection
647 * Algorithm
648 */
649
650 /* If the controller supports the LE Set Scan Enable command,
651 * enable the corresponding advertising report event.
652 */
653 if (hdev->commands[26] & 0x08)
654 events[0] |= 0x02; /* LE Advertising Report */
655
656 /* If the controller supports the LE Create Connection
657 * command, enable the corresponding event.
658 */
659 if (hdev->commands[26] & 0x10)
660 events[0] |= 0x01; /* LE Connection Complete */
661
662 /* If the controller supports the LE Connection Update
663 * command, enable the corresponding event.
664 */
665 if (hdev->commands[27] & 0x04)
666 events[0] |= 0x04; /* LE Connection Update
667 * Complete
668 */
669
670 /* If the controller supports the LE Read Remote Used Features
671 * command, enable the corresponding event.
672 */
673 if (hdev->commands[27] & 0x20)
674 events[0] |= 0x08; /* LE Read Remote Used
675 * Features Complete
676 */
677
678 /* If the controller supports the LE Read Local P-256
679 * Public Key command, enable the corresponding event.
680 */
681 if (hdev->commands[34] & 0x02)
682 events[0] |= 0x80; /* LE Read Local P-256
683 * Public Key Complete
684 */
685
686 /* If the controller supports the LE Generate DHKey
687 * command, enable the corresponding event.
688 */
689 if (hdev->commands[34] & 0x04)
690 events[1] |= 0x01; /* LE Generate DHKey Complete */
691
692 /* If the controller supports the LE Set Default PHY or
693 * LE Set PHY commands, enable the corresponding event.
694 */
695 if (hdev->commands[35] & (0x20 | 0x40))
696 events[1] |= 0x08; /* LE PHY Update Complete */
697
698 /* If the controller supports LE Set Extended Scan Parameters
699 * and LE Set Extended Scan Enable commands, enable the
700 * corresponding event.
701 */
702 if (use_ext_scan(hdev))
703 events[1] |= 0x10; /* LE Extended Advertising
704 * Report
705 */
706
707 /* If the controller supports the LE Extended Create Connection
708 * command, enable the corresponding event.
709 */
710 if (use_ext_conn(hdev))
711 events[1] |= 0x02; /* LE Enhanced Connection
712 * Complete
713 */
714
715 /* If the controller supports the LE Extended Advertising
716 * command, enable the corresponding event.
717 */
718 if (ext_adv_capable(hdev))
719 events[2] |= 0x02; /* LE Advertising Set
720 * Terminated
721 */
722
723 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
724 events);
725
726 /* Read LE Advertising Channel TX Power */
727 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
728 /* HCI TS spec forbids mixing of legacy and extended
729 * advertising commands wherein READ_ADV_TX_POWER is
730 * also included. So do not call it if extended adv
731 * is supported otherwise controller will return
732 * COMMAND_DISALLOWED for extended commands.
733 */
734 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
735 }
736
737 if (hdev->commands[26] & 0x40) {
738 /* Read LE White List Size */
739 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE,
740 0, NULL);
741 }
742
743 if (hdev->commands[26] & 0x80) {
744 /* Clear LE White List */
745 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
746 }
747
748 if (hdev->commands[34] & 0x40) {
749 /* Read LE Resolving List Size */
750 hci_req_add(req, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
751 0, NULL);
752 }
753
754 if (hdev->commands[34] & 0x20) {
755 /* Clear LE Resolving List */
756 hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL);
757 }
758
759 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
760 /* Read LE Maximum Data Length */
761 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
762
763 /* Read LE Suggested Default Data Length */
764 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
765 }
766
767 if (ext_adv_capable(hdev)) {
768 /* Read LE Number of Supported Advertising Sets */
769 hci_req_add(req, HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
770 0, NULL);
771 }
772
773 hci_set_le_support(req);
774 }
775
776 /* Read features beyond page 1 if available */
777 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
778 struct hci_cp_read_local_ext_features cp;
779
780 cp.page = p;
781 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
782 sizeof(cp), &cp);
783 }
784
785 return 0;
786 }
787
788 static int hci_init4_req(struct hci_request *req, unsigned long opt)
789 {
790 struct hci_dev *hdev = req->hdev;
791
792 /* Some Broadcom based Bluetooth controllers do not support the
793 * Delete Stored Link Key command. They are clearly indicating its
794 * absence in the bit mask of supported commands.
795 *
796 * Check the supported commands and only if the the command is marked
797 * as supported send it. If not supported assume that the controller
798 * does not have actual support for stored link keys which makes this
799 * command redundant anyway.
800 *
801 * Some controllers indicate that they support handling deleting
802 * stored link keys, but they don't. The quirk lets a driver
803 * just disable this command.
804 */
805 if (hdev->commands[6] & 0x80 &&
806 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
807 struct hci_cp_delete_stored_link_key cp;
808
809 bacpy(&cp.bdaddr, BDADDR_ANY);
810 cp.delete_all = 0x01;
811 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
812 sizeof(cp), &cp);
813 }
814
815 /* Set event mask page 2 if the HCI command for it is supported */
816 if (hdev->commands[22] & 0x04)
817 hci_set_event_mask_page_2(req);
818
819 /* Read local codec list if the HCI command is supported */
820 if (hdev->commands[29] & 0x20)
821 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
822
823 /* Get MWS transport configuration if the HCI command is supported */
824 if (hdev->commands[30] & 0x08)
825 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
826
827 /* Check for Synchronization Train support */
828 if (lmp_sync_train_capable(hdev))
829 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
830
831 /* Enable Secure Connections if supported and configured */
832 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
833 bredr_sc_enabled(hdev)) {
834 u8 support = 0x01;
835
836 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
837 sizeof(support), &support);
838 }
839
840 /* Set Suggested Default Data Length to maximum if supported */
841 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
842 struct hci_cp_le_write_def_data_len cp;
843
844 cp.tx_len = hdev->le_max_tx_len;
845 cp.tx_time = hdev->le_max_tx_time;
846 hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
847 }
848
849 /* Set Default PHY parameters if command is supported */
850 if (hdev->commands[35] & 0x20) {
851 struct hci_cp_le_set_default_phy cp;
852
853 cp.all_phys = 0x00;
854 cp.tx_phys = hdev->le_tx_def_phys;
855 cp.rx_phys = hdev->le_rx_def_phys;
856
857 hci_req_add(req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp), &cp);
858 }
859
860 return 0;
861 }
862
863 static int __hci_init(struct hci_dev *hdev)
864 {
865 int err;
866
867 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
868 if (err < 0)
869 return err;
870
871 if (hci_dev_test_flag(hdev, HCI_SETUP))
872 hci_debugfs_create_basic(hdev);
873
874 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
875 if (err < 0)
876 return err;
877
878 /* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
879 * BR/EDR/LE type controllers. AMP controllers only need the
880 * first two stages of init.
881 */
882 if (hdev->dev_type != HCI_PRIMARY)
883 return 0;
884
885 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
886 if (err < 0)
887 return err;
888
889 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
890 if (err < 0)
891 return err;
892
893 /* This function is only called when the controller is actually in
894 * configured state. When the controller is marked as unconfigured,
895 * this initialization procedure is not run.
896 *
897 * It means that it is possible that a controller runs through its
898 * setup phase and then discovers missing settings. If that is the
899 * case, then this function will not be called. It then will only
900 * be called during the config phase.
901 *
902 * So only when in setup phase or config phase, create the debugfs
903 * entries and register the SMP channels.
904 */
905 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
906 !hci_dev_test_flag(hdev, HCI_CONFIG))
907 return 0;
908
909 hci_debugfs_create_common(hdev);
910
911 if (lmp_bredr_capable(hdev))
912 hci_debugfs_create_bredr(hdev);
913
914 if (lmp_le_capable(hdev))
915 hci_debugfs_create_le(hdev);
916
917 return 0;
918 }
919
920 static int hci_init0_req(struct hci_request *req, unsigned long opt)
921 {
922 struct hci_dev *hdev = req->hdev;
923
924 BT_DBG("%s %ld", hdev->name, opt);
925
926 /* Reset */
927 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
928 hci_reset_req(req, 0);
929
930 /* Read Local Version */
931 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
932
933 /* Read BD Address */
934 if (hdev->set_bdaddr)
935 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
936
937 return 0;
938 }
939
940 static int __hci_unconf_init(struct hci_dev *hdev)
941 {
942 int err;
943
944 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
945 return 0;
946
947 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
948 if (err < 0)
949 return err;
950
951 if (hci_dev_test_flag(hdev, HCI_SETUP))
952 hci_debugfs_create_basic(hdev);
953
954 return 0;
955 }
956
957 static int hci_scan_req(struct hci_request *req, unsigned long opt)
958 {
959 __u8 scan = opt;
960
961 BT_DBG("%s %x", req->hdev->name, scan);
962
963 /* Inquiry and Page scans */
964 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
965 return 0;
966 }
967
968 static int hci_auth_req(struct hci_request *req, unsigned long opt)
969 {
970 __u8 auth = opt;
971
972 BT_DBG("%s %x", req->hdev->name, auth);
973
974 /* Authentication */
975 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
976 return 0;
977 }
978
979 static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
980 {
981 __u8 encrypt = opt;
982
983 BT_DBG("%s %x", req->hdev->name, encrypt);
984
985 /* Encryption */
986 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
987 return 0;
988 }
989
990 static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
991 {
992 __le16 policy = cpu_to_le16(opt);
993
994 BT_DBG("%s %x", req->hdev->name, policy);
995
996 /* Default link policy */
997 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
998 return 0;
999 }
1000
1001 /* Get HCI device by index.
1002 * Device is held on return. */
1003 struct hci_dev *hci_dev_get(int index)
1004 {
1005 struct hci_dev *hdev = NULL, *d;
1006
1007 BT_DBG("%d", index);
1008
1009 if (index < 0)
1010 return NULL;
1011
1012 read_lock(&hci_dev_list_lock);
1013 list_for_each_entry(d, &hci_dev_list, list) {
1014 if (d->id == index) {
1015 hdev = hci_dev_hold(d);
1016 break;
1017 }
1018 }
1019 read_unlock(&hci_dev_list_lock);
1020 return hdev;
1021 }
1022
1023 /* ---- Inquiry support ---- */
1024
1025 bool hci_discovery_active(struct hci_dev *hdev)
1026 {
1027 struct discovery_state *discov = &hdev->discovery;
1028
1029 switch (discov->state) {
1030 case DISCOVERY_FINDING:
1031 case DISCOVERY_RESOLVING:
1032 return true;
1033
1034 default:
1035 return false;
1036 }
1037 }
1038
1039 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1040 {
1041 int old_state = hdev->discovery.state;
1042
1043 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1044
1045 if (old_state == state)
1046 return;
1047
1048 hdev->discovery.state = state;
1049
1050 switch (state) {
1051 case DISCOVERY_STOPPED:
1052 hci_update_background_scan(hdev);
1053
1054 if (old_state != DISCOVERY_STARTING)
1055 mgmt_discovering(hdev, 0);
1056 break;
1057 case DISCOVERY_STARTING:
1058 break;
1059 case DISCOVERY_FINDING:
1060 mgmt_discovering(hdev, 1);
1061 break;
1062 case DISCOVERY_RESOLVING:
1063 break;
1064 case DISCOVERY_STOPPING:
1065 break;
1066 }
1067 }
1068
1069 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1070 {
1071 struct discovery_state *cache = &hdev->discovery;
1072 struct inquiry_entry *p, *n;
1073
1074 list_for_each_entry_safe(p, n, &cache->all, all) {
1075 list_del(&p->all);
1076 kfree(p);
1077 }
1078
1079 INIT_LIST_HEAD(&cache->unknown);
1080 INIT_LIST_HEAD(&cache->resolve);
1081 }
1082
1083 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1084 bdaddr_t *bdaddr)
1085 {
1086 struct discovery_state *cache = &hdev->discovery;
1087 struct inquiry_entry *e;
1088
1089 BT_DBG("cache %p, %pMR", cache, bdaddr);
1090
1091 list_for_each_entry(e, &cache->all, all) {
1092 if (!bacmp(&e->data.bdaddr, bdaddr))
1093 return e;
1094 }
1095
1096 return NULL;
1097 }
1098
1099 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1100 bdaddr_t *bdaddr)
1101 {
1102 struct discovery_state *cache = &hdev->discovery;
1103 struct inquiry_entry *e;
1104
1105 BT_DBG("cache %p, %pMR", cache, bdaddr);
1106
1107 list_for_each_entry(e, &cache->unknown, list) {
1108 if (!bacmp(&e->data.bdaddr, bdaddr))
1109 return e;
1110 }
1111
1112 return NULL;
1113 }
1114
1115 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1116 bdaddr_t *bdaddr,
1117 int state)
1118 {
1119 struct discovery_state *cache = &hdev->discovery;
1120 struct inquiry_entry *e;
1121
1122 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1123
1124 list_for_each_entry(e, &cache->resolve, list) {
1125 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1126 return e;
1127 if (!bacmp(&e->data.bdaddr, bdaddr))
1128 return e;
1129 }
1130
1131 return NULL;
1132 }
1133
1134 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1135 struct inquiry_entry *ie)
1136 {
1137 struct discovery_state *cache = &hdev->discovery;
1138 struct list_head *pos = &cache->resolve;
1139 struct inquiry_entry *p;
1140
1141 list_del(&ie->list);
1142
1143 list_for_each_entry(p, &cache->resolve, list) {
1144 if (p->name_state != NAME_PENDING &&
1145 abs(p->data.rssi) >= abs(ie->data.rssi))
1146 break;
1147 pos = &p->list;
1148 }
1149
1150 list_add(&ie->list, pos);
1151 }
1152
1153 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1154 bool name_known)
1155 {
1156 struct discovery_state *cache = &hdev->discovery;
1157 struct inquiry_entry *ie;
1158 u32 flags = 0;
1159
1160 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1161
1162 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1163
1164 if (!data->ssp_mode)
1165 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1166
1167 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1168 if (ie) {
1169 if (!ie->data.ssp_mode)
1170 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1171
1172 if (ie->name_state == NAME_NEEDED &&
1173 data->rssi != ie->data.rssi) {
1174 ie->data.rssi = data->rssi;
1175 hci_inquiry_cache_update_resolve(hdev, ie);
1176 }
1177
1178 goto update;
1179 }
1180
1181 /* Entry not in the cache. Add new one. */
1182 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1183 if (!ie) {
1184 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1185 goto done;
1186 }
1187
1188 list_add(&ie->all, &cache->all);
1189
1190 if (name_known) {
1191 ie->name_state = NAME_KNOWN;
1192 } else {
1193 ie->name_state = NAME_NOT_KNOWN;
1194 list_add(&ie->list, &cache->unknown);
1195 }
1196
1197 update:
1198 if (name_known && ie->name_state != NAME_KNOWN &&
1199 ie->name_state != NAME_PENDING) {
1200 ie->name_state = NAME_KNOWN;
1201 list_del(&ie->list);
1202 }
1203
1204 memcpy(&ie->data, data, sizeof(*data));
1205 ie->timestamp = jiffies;
1206 cache->timestamp = jiffies;
1207
1208 if (ie->name_state == NAME_NOT_KNOWN)
1209 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1210
1211 done:
1212 return flags;
1213 }
1214
1215 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1216 {
1217 struct discovery_state *cache = &hdev->discovery;
1218 struct inquiry_info *info = (struct inquiry_info *) buf;
1219 struct inquiry_entry *e;
1220 int copied = 0;
1221
1222 list_for_each_entry(e, &cache->all, all) {
1223 struct inquiry_data *data = &e->data;
1224
1225 if (copied >= num)
1226 break;
1227
1228 bacpy(&info->bdaddr, &data->bdaddr);
1229 info->pscan_rep_mode = data->pscan_rep_mode;
1230 info->pscan_period_mode = data->pscan_period_mode;
1231 info->pscan_mode = data->pscan_mode;
1232 memcpy(info->dev_class, data->dev_class, 3);
1233 info->clock_offset = data->clock_offset;
1234
1235 info++;
1236 copied++;
1237 }
1238
1239 BT_DBG("cache %p, copied %d", cache, copied);
1240 return copied;
1241 }
1242
1243 static int hci_inq_req(struct hci_request *req, unsigned long opt)
1244 {
1245 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1246 struct hci_dev *hdev = req->hdev;
1247 struct hci_cp_inquiry cp;
1248
1249 BT_DBG("%s", hdev->name);
1250
1251 if (test_bit(HCI_INQUIRY, &hdev->flags))
1252 return 0;
1253
1254 /* Start Inquiry */
1255 memcpy(&cp.lap, &ir->lap, 3);
1256 cp.length = ir->length;
1257 cp.num_rsp = ir->num_rsp;
1258 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1259
1260 return 0;
1261 }
1262
1263 int hci_inquiry(void __user *arg)
1264 {
1265 __u8 __user *ptr = arg;
1266 struct hci_inquiry_req ir;
1267 struct hci_dev *hdev;
1268 int err = 0, do_inquiry = 0, max_rsp;
1269 long timeo;
1270 __u8 *buf;
1271
1272 if (copy_from_user(&ir, ptr, sizeof(ir)))
1273 return -EFAULT;
1274
1275 hdev = hci_dev_get(ir.dev_id);
1276 if (!hdev)
1277 return -ENODEV;
1278
1279 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1280 err = -EBUSY;
1281 goto done;
1282 }
1283
1284 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1285 err = -EOPNOTSUPP;
1286 goto done;
1287 }
1288
1289 if (hdev->dev_type != HCI_PRIMARY) {
1290 err = -EOPNOTSUPP;
1291 goto done;
1292 }
1293
1294 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1295 err = -EOPNOTSUPP;
1296 goto done;
1297 }
1298
1299 hci_dev_lock(hdev);
1300 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1301 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1302 hci_inquiry_cache_flush(hdev);
1303 do_inquiry = 1;
1304 }
1305 hci_dev_unlock(hdev);
1306
1307 timeo = ir.length * msecs_to_jiffies(2000);
1308
1309 if (do_inquiry) {
1310 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1311 timeo, NULL);
1312 if (err < 0)
1313 goto done;
1314
1315 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1316 * cleared). If it is interrupted by a signal, return -EINTR.
1317 */
1318 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1319 TASK_INTERRUPTIBLE))
1320 return -EINTR;
1321 }
1322
1323 /* for unlimited number of responses we will use buffer with
1324 * 255 entries
1325 */
1326 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1327
1328 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1329 * copy it to the user space.
1330 */
1331 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
1332 if (!buf) {
1333 err = -ENOMEM;
1334 goto done;
1335 }
1336
1337 hci_dev_lock(hdev);
1338 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1339 hci_dev_unlock(hdev);
1340
1341 BT_DBG("num_rsp %d", ir.num_rsp);
1342
1343 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1344 ptr += sizeof(ir);
1345 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1346 ir.num_rsp))
1347 err = -EFAULT;
1348 } else
1349 err = -EFAULT;
1350
1351 kfree(buf);
1352
1353 done:
1354 hci_dev_put(hdev);
1355 return err;
1356 }
1357
1358 static int hci_dev_do_open(struct hci_dev *hdev)
1359 {
1360 int ret = 0;
1361
1362 BT_DBG("%s %p", hdev->name, hdev);
1363
1364 hci_req_sync_lock(hdev);
1365
1366 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1367 ret = -ENODEV;
1368 goto done;
1369 }
1370
1371 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1372 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1373 /* Check for rfkill but allow the HCI setup stage to
1374 * proceed (which in itself doesn't cause any RF activity).
1375 */
1376 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1377 ret = -ERFKILL;
1378 goto done;
1379 }
1380
1381 /* Check for valid public address or a configured static
1382 * random adddress, but let the HCI setup proceed to
1383 * be able to determine if there is a public address
1384 * or not.
1385 *
1386 * In case of user channel usage, it is not important
1387 * if a public address or static random address is
1388 * available.
1389 *
1390 * This check is only valid for BR/EDR controllers
1391 * since AMP controllers do not have an address.
1392 */
1393 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1394 hdev->dev_type == HCI_PRIMARY &&
1395 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1396 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1397 ret = -EADDRNOTAVAIL;
1398 goto done;
1399 }
1400 }
1401
1402 if (test_bit(HCI_UP, &hdev->flags)) {
1403 ret = -EALREADY;
1404 goto done;
1405 }
1406
1407 if (hdev->open(hdev)) {
1408 ret = -EIO;
1409 goto done;
1410 }
1411
1412 set_bit(HCI_RUNNING, &hdev->flags);
1413 hci_sock_dev_event(hdev, HCI_DEV_OPEN);
1414
1415 atomic_set(&hdev->cmd_cnt, 1);
1416 set_bit(HCI_INIT, &hdev->flags);
1417
1418 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1419 test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
1420 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1421
1422 if (hdev->setup)
1423 ret = hdev->setup(hdev);
1424
1425 /* The transport driver can set these quirks before
1426 * creating the HCI device or in its setup callback.
1427 *
1428 * In case any of them is set, the controller has to
1429 * start up as unconfigured.
1430 */
1431 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1432 test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
1433 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1434
1435 /* For an unconfigured controller it is required to
1436 * read at least the version information provided by
1437 * the Read Local Version Information command.
1438 *
1439 * If the set_bdaddr driver callback is provided, then
1440 * also the original Bluetooth public device address
1441 * will be read using the Read BD Address command.
1442 */
1443 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1444 ret = __hci_unconf_init(hdev);
1445 }
1446
1447 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1448 /* If public address change is configured, ensure that
1449 * the address gets programmed. If the driver does not
1450 * support changing the public address, fail the power
1451 * on procedure.
1452 */
1453 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1454 hdev->set_bdaddr)
1455 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1456 else
1457 ret = -EADDRNOTAVAIL;
1458 }
1459
1460 if (!ret) {
1461 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1462 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1463 ret = __hci_init(hdev);
1464 if (!ret && hdev->post_init)
1465 ret = hdev->post_init(hdev);
1466 }
1467 }
1468
1469 /* If the HCI Reset command is clearing all diagnostic settings,
1470 * then they need to be reprogrammed after the init procedure
1471 * completed.
1472 */
1473 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
1474 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1475 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1476 ret = hdev->set_diag(hdev, true);
1477
1478 clear_bit(HCI_INIT, &hdev->flags);
1479
1480 if (!ret) {
1481 hci_dev_hold(hdev);
1482 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1483 hci_adv_instances_set_rpa_expired(hdev, true);
1484 set_bit(HCI_UP, &hdev->flags);
1485 hci_sock_dev_event(hdev, HCI_DEV_UP);
1486 hci_leds_update_powered(hdev, true);
1487 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1488 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1489 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1490 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1491 hci_dev_test_flag(hdev, HCI_MGMT) &&
1492 hdev->dev_type == HCI_PRIMARY) {
1493 ret = __hci_req_hci_power_on(hdev);
1494 mgmt_power_on(hdev, ret);
1495 }
1496 } else {
1497 /* Init failed, cleanup */
1498 flush_work(&hdev->tx_work);
1499 flush_work(&hdev->cmd_work);
1500 flush_work(&hdev->rx_work);
1501
1502 skb_queue_purge(&hdev->cmd_q);
1503 skb_queue_purge(&hdev->rx_q);
1504
1505 if (hdev->flush)
1506 hdev->flush(hdev);
1507
1508 if (hdev->sent_cmd) {
1509 kfree_skb(hdev->sent_cmd);
1510 hdev->sent_cmd = NULL;
1511 }
1512
1513 clear_bit(HCI_RUNNING, &hdev->flags);
1514 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1515
1516 hdev->close(hdev);
1517 hdev->flags &= BIT(HCI_RAW);
1518 }
1519
1520 done:
1521 hci_req_sync_unlock(hdev);
1522 return ret;
1523 }
1524
1525 /* ---- HCI ioctl helpers ---- */
1526
1527 int hci_dev_open(__u16 dev)
1528 {
1529 struct hci_dev *hdev;
1530 int err;
1531
1532 hdev = hci_dev_get(dev);
1533 if (!hdev)
1534 return -ENODEV;
1535
1536 /* Devices that are marked as unconfigured can only be powered
1537 * up as user channel. Trying to bring them up as normal devices
1538 * will result into a failure. Only user channel operation is
1539 * possible.
1540 *
1541 * When this function is called for a user channel, the flag
1542 * HCI_USER_CHANNEL will be set first before attempting to
1543 * open the device.
1544 */
1545 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1546 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1547 err = -EOPNOTSUPP;
1548 goto done;
1549 }
1550
1551 /* We need to ensure that no other power on/off work is pending
1552 * before proceeding to call hci_dev_do_open. This is
1553 * particularly important if the setup procedure has not yet
1554 * completed.
1555 */
1556 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1557 cancel_delayed_work(&hdev->power_off);
1558
1559 /* After this call it is guaranteed that the setup procedure
1560 * has finished. This means that error conditions like RFKILL
1561 * or no valid public or static random address apply.
1562 */
1563 flush_workqueue(hdev->req_workqueue);
1564
1565 /* For controllers not using the management interface and that
1566 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1567 * so that pairing works for them. Once the management interface
1568 * is in use this bit will be cleared again and userspace has
1569 * to explicitly enable it.
1570 */
1571 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1572 !hci_dev_test_flag(hdev, HCI_MGMT))
1573 hci_dev_set_flag(hdev, HCI_BONDABLE);
1574
1575 err = hci_dev_do_open(hdev);
1576
1577 done:
1578 hci_dev_put(hdev);
1579 return err;
1580 }
1581
1582 /* This function requires the caller holds hdev->lock */
1583 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1584 {
1585 struct hci_conn_params *p;
1586
1587 list_for_each_entry(p, &hdev->le_conn_params, list) {
1588 if (p->conn) {
1589 hci_conn_drop(p->conn);
1590 hci_conn_put(p->conn);
1591 p->conn = NULL;
1592 }
1593 list_del_init(&p->action);
1594 }
1595
1596 BT_DBG("All LE pending actions cleared");
1597 }
1598
1599 int hci_dev_do_close(struct hci_dev *hdev)
1600 {
1601 bool auto_off;
1602
1603 BT_DBG("%s %p", hdev->name, hdev);
1604
1605 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
1606 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1607 test_bit(HCI_UP, &hdev->flags)) {
1608 /* Execute vendor specific shutdown routine */
1609 if (hdev->shutdown)
1610 hdev->shutdown(hdev);
1611 }
1612
1613 cancel_delayed_work(&hdev->power_off);
1614
1615 hci_request_cancel_all(hdev);
1616 hci_req_sync_lock(hdev);
1617
1618 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1619 cancel_delayed_work_sync(&hdev->cmd_timer);
1620 hci_req_sync_unlock(hdev);
1621 return 0;
1622 }
1623
1624 hci_leds_update_powered(hdev, false);
1625
1626 /* Flush RX and TX works */
1627 flush_work(&hdev->tx_work);
1628 flush_work(&hdev->rx_work);
1629
1630 if (hdev->discov_timeout > 0) {
1631 hdev->discov_timeout = 0;
1632 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1633 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1634 }
1635
1636 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1637 cancel_delayed_work(&hdev->service_cache);
1638
1639 if (hci_dev_test_flag(hdev, HCI_MGMT)) {
1640 struct adv_info *adv_instance;
1641
1642 cancel_delayed_work_sync(&hdev->rpa_expired);
1643
1644 list_for_each_entry(adv_instance, &hdev->adv_instances, list)
1645 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1646 }
1647
1648 /* Avoid potential lockdep warnings from the *_flush() calls by
1649 * ensuring the workqueue is empty up front.
1650 */
1651 drain_workqueue(hdev->workqueue);
1652
1653 hci_dev_lock(hdev);
1654
1655 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1656
1657 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1658
1659 if (!auto_off && hdev->dev_type == HCI_PRIMARY &&
1660 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1661 hci_dev_test_flag(hdev, HCI_MGMT))
1662 __mgmt_power_off(hdev);
1663
1664 hci_inquiry_cache_flush(hdev);
1665 hci_pend_le_actions_clear(hdev);
1666 hci_conn_hash_flush(hdev);
1667 hci_dev_unlock(hdev);
1668
1669 smp_unregister(hdev);
1670
1671 hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1672
1673 if (hdev->flush)
1674 hdev->flush(hdev);
1675
1676 /* Reset device */
1677 skb_queue_purge(&hdev->cmd_q);
1678 atomic_set(&hdev->cmd_cnt, 1);
1679 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1680 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1681 set_bit(HCI_INIT, &hdev->flags);
1682 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1683 clear_bit(HCI_INIT, &hdev->flags);
1684 }
1685
1686 /* flush cmd work */
1687 flush_work(&hdev->cmd_work);
1688
1689 /* Drop queues */
1690 skb_queue_purge(&hdev->rx_q);
1691 skb_queue_purge(&hdev->cmd_q);
1692 skb_queue_purge(&hdev->raw_q);
1693
1694 /* Drop last sent command */
1695 if (hdev->sent_cmd) {
1696 cancel_delayed_work_sync(&hdev->cmd_timer);
1697 kfree_skb(hdev->sent_cmd);
1698 hdev->sent_cmd = NULL;
1699 }
1700
1701 clear_bit(HCI_RUNNING, &hdev->flags);
1702 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1703
1704 /* After this point our queues are empty
1705 * and no tasks are scheduled. */
1706 hdev->close(hdev);
1707
1708 /* Clear flags */
1709 hdev->flags &= BIT(HCI_RAW);
1710 hci_dev_clear_volatile_flags(hdev);
1711
1712 /* Controller radio is available but is currently powered down */
1713 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1714
1715 memset(hdev->eir, 0, sizeof(hdev->eir));
1716 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1717 bacpy(&hdev->random_addr, BDADDR_ANY);
1718
1719 hci_req_sync_unlock(hdev);
1720
1721 hci_dev_put(hdev);
1722 return 0;
1723 }
1724
1725 int hci_dev_close(__u16 dev)
1726 {
1727 struct hci_dev *hdev;
1728 int err;
1729
1730 hdev = hci_dev_get(dev);
1731 if (!hdev)
1732 return -ENODEV;
1733
1734 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1735 err = -EBUSY;
1736 goto done;
1737 }
1738
1739 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1740 cancel_delayed_work(&hdev->power_off);
1741
1742 err = hci_dev_do_close(hdev);
1743
1744 done:
1745 hci_dev_put(hdev);
1746 return err;
1747 }
1748
1749 static int hci_dev_do_reset(struct hci_dev *hdev)
1750 {
1751 int ret;
1752
1753 BT_DBG("%s %p", hdev->name, hdev);
1754
1755 hci_req_sync_lock(hdev);
1756
1757 /* Drop queues */
1758 skb_queue_purge(&hdev->rx_q);
1759 skb_queue_purge(&hdev->cmd_q);
1760
1761 /* Avoid potential lockdep warnings from the *_flush() calls by
1762 * ensuring the workqueue is empty up front.
1763 */
1764 drain_workqueue(hdev->workqueue);
1765
1766 hci_dev_lock(hdev);
1767 hci_inquiry_cache_flush(hdev);
1768 hci_conn_hash_flush(hdev);
1769 hci_dev_unlock(hdev);
1770
1771 if (hdev->flush)
1772 hdev->flush(hdev);
1773
1774 atomic_set(&hdev->cmd_cnt, 1);
1775 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1776
1777 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1778
1779 hci_req_sync_unlock(hdev);
1780 return ret;
1781 }
1782
1783 int hci_dev_reset(__u16 dev)
1784 {
1785 struct hci_dev *hdev;
1786 int err;
1787
1788 hdev = hci_dev_get(dev);
1789 if (!hdev)
1790 return -ENODEV;
1791
1792 if (!test_bit(HCI_UP, &hdev->flags)) {
1793 err = -ENETDOWN;
1794 goto done;
1795 }
1796
1797 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1798 err = -EBUSY;
1799 goto done;
1800 }
1801
1802 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1803 err = -EOPNOTSUPP;
1804 goto done;
1805 }
1806
1807 err = hci_dev_do_reset(hdev);
1808
1809 done:
1810 hci_dev_put(hdev);
1811 return err;
1812 }
1813
1814 int hci_dev_reset_stat(__u16 dev)
1815 {
1816 struct hci_dev *hdev;
1817 int ret = 0;
1818
1819 hdev = hci_dev_get(dev);
1820 if (!hdev)
1821 return -ENODEV;
1822
1823 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1824 ret = -EBUSY;
1825 goto done;
1826 }
1827
1828 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1829 ret = -EOPNOTSUPP;
1830 goto done;
1831 }
1832
1833 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1834
1835 done:
1836 hci_dev_put(hdev);
1837 return ret;
1838 }
1839
1840 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1841 {
1842 bool conn_changed, discov_changed;
1843
1844 BT_DBG("%s scan 0x%02x", hdev->name, scan);
1845
1846 if ((scan & SCAN_PAGE))
1847 conn_changed = !hci_dev_test_and_set_flag(hdev,
1848 HCI_CONNECTABLE);
1849 else
1850 conn_changed = hci_dev_test_and_clear_flag(hdev,
1851 HCI_CONNECTABLE);
1852
1853 if ((scan & SCAN_INQUIRY)) {
1854 discov_changed = !hci_dev_test_and_set_flag(hdev,
1855 HCI_DISCOVERABLE);
1856 } else {
1857 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1858 discov_changed = hci_dev_test_and_clear_flag(hdev,
1859 HCI_DISCOVERABLE);
1860 }
1861
1862 if (!hci_dev_test_flag(hdev, HCI_MGMT))
1863 return;
1864
1865 if (conn_changed || discov_changed) {
1866 /* In case this was disabled through mgmt */
1867 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
1868
1869 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1870 hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1871
1872 mgmt_new_settings(hdev);
1873 }
1874 }
1875
1876 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1877 {
1878 struct hci_dev *hdev;
1879 struct hci_dev_req dr;
1880 int err = 0;
1881
1882 if (copy_from_user(&dr, arg, sizeof(dr)))
1883 return -EFAULT;
1884
1885 hdev = hci_dev_get(dr.dev_id);
1886 if (!hdev)
1887 return -ENODEV;
1888
1889 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1890 err = -EBUSY;
1891 goto done;
1892 }
1893
1894 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1895 err = -EOPNOTSUPP;
1896 goto done;
1897 }
1898
1899 if (hdev->dev_type != HCI_PRIMARY) {
1900 err = -EOPNOTSUPP;
1901 goto done;
1902 }
1903
1904 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1905 err = -EOPNOTSUPP;
1906 goto done;
1907 }
1908
1909 switch (cmd) {
1910 case HCISETAUTH:
1911 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1912 HCI_INIT_TIMEOUT, NULL);
1913 break;
1914
1915 case HCISETENCRYPT:
1916 if (!lmp_encrypt_capable(hdev)) {
1917 err = -EOPNOTSUPP;
1918 break;
1919 }
1920
1921 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1922 /* Auth must be enabled first */
1923 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1924 HCI_INIT_TIMEOUT, NULL);
1925 if (err)
1926 break;
1927 }
1928
1929 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1930 HCI_INIT_TIMEOUT, NULL);
1931 break;
1932
1933 case HCISETSCAN:
1934 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1935 HCI_INIT_TIMEOUT, NULL);
1936
1937 /* Ensure that the connectable and discoverable states
1938 * get correctly modified as this was a non-mgmt change.
1939 */
1940 if (!err)
1941 hci_update_scan_state(hdev, dr.dev_opt);
1942 break;
1943
1944 case HCISETLINKPOL:
1945 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1946 HCI_INIT_TIMEOUT, NULL);
1947 break;
1948
1949 case HCISETLINKMODE:
1950 hdev->link_mode = ((__u16) dr.dev_opt) &
1951 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1952 break;
1953
1954 case HCISETPTYPE:
1955 if (hdev->pkt_type == (__u16) dr.dev_opt)
1956 break;
1957
1958 hdev->pkt_type = (__u16) dr.dev_opt;
1959 mgmt_phy_configuration_changed(hdev, NULL);
1960 break;
1961
1962 case HCISETACLMTU:
1963 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1964 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1965 break;
1966
1967 case HCISETSCOMTU:
1968 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1969 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
1970 break;
1971
1972 default:
1973 err = -EINVAL;
1974 break;
1975 }
1976
1977 done:
1978 hci_dev_put(hdev);
1979 return err;
1980 }
1981
1982 int hci_get_dev_list(void __user *arg)
1983 {
1984 struct hci_dev *hdev;
1985 struct hci_dev_list_req *dl;
1986 struct hci_dev_req *dr;
1987 int n = 0, size, err;
1988 __u16 dev_num;
1989
1990 if (get_user(dev_num, (__u16 __user *) arg))
1991 return -EFAULT;
1992
1993 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
1994 return -EINVAL;
1995
1996 size = sizeof(*dl) + dev_num * sizeof(*dr);
1997
1998 dl = kzalloc(size, GFP_KERNEL);
1999 if (!dl)
2000 return -ENOMEM;
2001
2002 dr = dl->dev_req;
2003
2004 read_lock(&hci_dev_list_lock);
2005 list_for_each_entry(hdev, &hci_dev_list, list) {
2006 unsigned long flags = hdev->flags;
2007
2008 /* When the auto-off is configured it means the transport
2009 * is running, but in that case still indicate that the
2010 * device is actually down.
2011 */
2012 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2013 flags &= ~BIT(HCI_UP);
2014
2015 (dr + n)->dev_id = hdev->id;
2016 (dr + n)->dev_opt = flags;
2017
2018 if (++n >= dev_num)
2019 break;
2020 }
2021 read_unlock(&hci_dev_list_lock);
2022
2023 dl->dev_num = n;
2024 size = sizeof(*dl) + n * sizeof(*dr);
2025
2026 err = copy_to_user(arg, dl, size);
2027 kfree(dl);
2028
2029 return err ? -EFAULT : 0;
2030 }
2031
2032 int hci_get_dev_info(void __user *arg)
2033 {
2034 struct hci_dev *hdev;
2035 struct hci_dev_info di;
2036 unsigned long flags;
2037 int err = 0;
2038
2039 if (copy_from_user(&di, arg, sizeof(di)))
2040 return -EFAULT;
2041
2042 hdev = hci_dev_get(di.dev_id);
2043 if (!hdev)
2044 return -ENODEV;
2045
2046 /* When the auto-off is configured it means the transport
2047 * is running, but in that case still indicate that the
2048 * device is actually down.
2049 */
2050 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2051 flags = hdev->flags & ~BIT(HCI_UP);
2052 else
2053 flags = hdev->flags;
2054
2055 strcpy(di.name, hdev->name);
2056 di.bdaddr = hdev->bdaddr;
2057 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2058 di.flags = flags;
2059 di.pkt_type = hdev->pkt_type;
2060 if (lmp_bredr_capable(hdev)) {
2061 di.acl_mtu = hdev->acl_mtu;
2062 di.acl_pkts = hdev->acl_pkts;
2063 di.sco_mtu = hdev->sco_mtu;
2064 di.sco_pkts = hdev->sco_pkts;
2065 } else {
2066 di.acl_mtu = hdev->le_mtu;
2067 di.acl_pkts = hdev->le_pkts;
2068 di.sco_mtu = 0;
2069 di.sco_pkts = 0;
2070 }
2071 di.link_policy = hdev->link_policy;
2072 di.link_mode = hdev->link_mode;
2073
2074 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2075 memcpy(&di.features, &hdev->features, sizeof(di.features));
2076
2077 if (copy_to_user(arg, &di, sizeof(di)))
2078 err = -EFAULT;
2079
2080 hci_dev_put(hdev);
2081
2082 return err;
2083 }
2084
2085 /* ---- Interface to HCI drivers ---- */
2086
2087 static int hci_rfkill_set_block(void *data, bool blocked)
2088 {
2089 struct hci_dev *hdev = data;
2090
2091 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2092
2093 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2094 return -EBUSY;
2095
2096 if (blocked) {
2097 hci_dev_set_flag(hdev, HCI_RFKILLED);
2098 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2099 !hci_dev_test_flag(hdev, HCI_CONFIG))
2100 hci_dev_do_close(hdev);
2101 } else {
2102 hci_dev_clear_flag(hdev, HCI_RFKILLED);
2103 }
2104
2105 return 0;
2106 }
2107
2108 static const struct rfkill_ops hci_rfkill_ops = {
2109 .set_block = hci_rfkill_set_block,
2110 };
2111
2112 static void hci_power_on(struct work_struct *work)
2113 {
2114 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2115 int err;
2116
2117 BT_DBG("%s", hdev->name);
2118
2119 if (test_bit(HCI_UP, &hdev->flags) &&
2120 hci_dev_test_flag(hdev, HCI_MGMT) &&
2121 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
2122 cancel_delayed_work(&hdev->power_off);
2123 hci_req_sync_lock(hdev);
2124 err = __hci_req_hci_power_on(hdev);
2125 hci_req_sync_unlock(hdev);
2126 mgmt_power_on(hdev, err);
2127 return;
2128 }
2129
2130 err = hci_dev_do_open(hdev);
2131 if (err < 0) {
2132 hci_dev_lock(hdev);
2133 mgmt_set_powered_failed(hdev, err);
2134 hci_dev_unlock(hdev);
2135 return;
2136 }
2137
2138 /* During the HCI setup phase, a few error conditions are
2139 * ignored and they need to be checked now. If they are still
2140 * valid, it is important to turn the device back off.
2141 */
2142 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2143 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2144 (hdev->dev_type == HCI_PRIMARY &&
2145 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2146 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2147 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2148 hci_dev_do_close(hdev);
2149 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2150 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2151 HCI_AUTO_OFF_TIMEOUT);
2152 }
2153
2154 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2155 /* For unconfigured devices, set the HCI_RAW flag
2156 * so that userspace can easily identify them.
2157 */
2158 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2159 set_bit(HCI_RAW, &hdev->flags);
2160
2161 /* For fully configured devices, this will send
2162 * the Index Added event. For unconfigured devices,
2163 * it will send Unconfigued Index Added event.
2164 *
2165 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2166 * and no event will be send.
2167 */
2168 mgmt_index_added(hdev);
2169 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2170 /* When the controller is now configured, then it
2171 * is important to clear the HCI_RAW flag.
2172 */
2173 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2174 clear_bit(HCI_RAW, &hdev->flags);
2175
2176 /* Powering on the controller with HCI_CONFIG set only
2177 * happens with the transition from unconfigured to
2178 * configured. This will send the Index Added event.
2179 */
2180 mgmt_index_added(hdev);
2181 }
2182 }
2183
2184 static void hci_power_off(struct work_struct *work)
2185 {
2186 struct hci_dev *hdev = container_of(work, struct hci_dev,
2187 power_off.work);
2188
2189 BT_DBG("%s", hdev->name);
2190
2191 hci_dev_do_close(hdev);
2192 }
2193
2194 static void hci_error_reset(struct work_struct *work)
2195 {
2196 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2197
2198 BT_DBG("%s", hdev->name);
2199
2200 if (hdev->hw_error)
2201 hdev->hw_error(hdev, hdev->hw_error_code);
2202 else
2203 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
2204
2205 if (hci_dev_do_close(hdev))
2206 return;
2207
2208 hci_dev_do_open(hdev);
2209 }
2210
2211 void hci_uuids_clear(struct hci_dev *hdev)
2212 {
2213 struct bt_uuid *uuid, *tmp;
2214
2215 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2216 list_del(&uuid->list);
2217 kfree(uuid);
2218 }
2219 }
2220
2221 void hci_link_keys_clear(struct hci_dev *hdev)
2222 {
2223 struct link_key *key;
2224
2225 list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2226 list_del_rcu(&key->list);
2227 kfree_rcu(key, rcu);
2228 }
2229 }
2230
2231 void hci_smp_ltks_clear(struct hci_dev *hdev)
2232 {
2233 struct smp_ltk *k;
2234
2235 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2236 list_del_rcu(&k->list);
2237 kfree_rcu(k, rcu);
2238 }
2239 }
2240
2241 void hci_smp_irks_clear(struct hci_dev *hdev)
2242 {
2243 struct smp_irk *k;
2244
2245 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2246 list_del_rcu(&k->list);
2247 kfree_rcu(k, rcu);
2248 }
2249 }
2250
2251 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2252 {
2253 struct link_key *k;
2254
2255 rcu_read_lock();
2256 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2257 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2258 rcu_read_unlock();
2259 return k;
2260 }
2261 }
2262 rcu_read_unlock();
2263
2264 return NULL;
2265 }
2266
2267 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2268 u8 key_type, u8 old_key_type)
2269 {
2270 /* Legacy key */
2271 if (key_type < 0x03)
2272 return true;
2273
2274 /* Debug keys are insecure so don't store them persistently */
2275 if (key_type == HCI_LK_DEBUG_COMBINATION)
2276 return false;
2277
2278 /* Changed combination key and there's no previous one */
2279 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2280 return false;
2281
2282 /* Security mode 3 case */
2283 if (!conn)
2284 return true;
2285
2286 /* BR/EDR key derived using SC from an LE link */
2287 if (conn->type == LE_LINK)
2288 return true;
2289
2290 /* Neither local nor remote side had no-bonding as requirement */
2291 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2292 return true;
2293
2294 /* Local side had dedicated bonding as requirement */
2295 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2296 return true;
2297
2298 /* Remote side had dedicated bonding as requirement */
2299 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2300 return true;
2301
2302 /* If none of the above criteria match, then don't store the key
2303 * persistently */
2304 return false;
2305 }
2306
2307 static u8 ltk_role(u8 type)
2308 {
2309 if (type == SMP_LTK)
2310 return HCI_ROLE_MASTER;
2311
2312 return HCI_ROLE_SLAVE;
2313 }
2314
2315 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2316 u8 addr_type, u8 role)
2317 {
2318 struct smp_ltk *k;
2319
2320 rcu_read_lock();
2321 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2322 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2323 continue;
2324
2325 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2326 rcu_read_unlock();
2327 return k;
2328 }
2329 }
2330 rcu_read_unlock();
2331
2332 return NULL;
2333 }
2334
2335 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2336 {
2337 struct smp_irk *irk;
2338
2339 rcu_read_lock();
2340 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2341 if (!bacmp(&irk->rpa, rpa)) {
2342 rcu_read_unlock();
2343 return irk;
2344 }
2345 }
2346
2347 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2348 if (smp_irk_matches(hdev, irk->val, rpa)) {
2349 bacpy(&irk->rpa, rpa);
2350 rcu_read_unlock();
2351 return irk;
2352 }
2353 }
2354 rcu_read_unlock();
2355
2356 return NULL;
2357 }
2358
2359 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2360 u8 addr_type)
2361 {
2362 struct smp_irk *irk;
2363
2364 /* Identity Address must be public or static random */
2365 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2366 return NULL;
2367
2368 rcu_read_lock();
2369 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2370 if (addr_type == irk->addr_type &&
2371 bacmp(bdaddr, &irk->bdaddr) == 0) {
2372 rcu_read_unlock();
2373 return irk;
2374 }
2375 }
2376 rcu_read_unlock();
2377
2378 return NULL;
2379 }
2380
2381 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2382 bdaddr_t *bdaddr, u8 *val, u8 type,
2383 u8 pin_len, bool *persistent)
2384 {
2385 struct link_key *key, *old_key;
2386 u8 old_key_type;
2387
2388 old_key = hci_find_link_key(hdev, bdaddr);
2389 if (old_key) {
2390 old_key_type = old_key->type;
2391 key = old_key;
2392 } else {
2393 old_key_type = conn ? conn->key_type : 0xff;
2394 key = kzalloc(sizeof(*key), GFP_KERNEL);
2395 if (!key)
2396 return NULL;
2397 list_add_rcu(&key->list, &hdev->link_keys);
2398 }
2399
2400 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2401
2402 /* Some buggy controller combinations generate a changed
2403 * combination key for legacy pairing even when there's no
2404 * previous key */
2405 if (type == HCI_LK_CHANGED_COMBINATION &&
2406 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2407 type = HCI_LK_COMBINATION;
2408 if (conn)
2409 conn->key_type = type;
2410 }
2411
2412 bacpy(&key->bdaddr, bdaddr);
2413 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2414 key->pin_len = pin_len;
2415
2416 if (type == HCI_LK_CHANGED_COMBINATION)
2417 key->type = old_key_type;
2418 else
2419 key->type = type;
2420
2421 if (persistent)
2422 *persistent = hci_persistent_key(hdev, conn, type,
2423 old_key_type);
2424
2425 return key;
2426 }
2427
2428 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2429 u8 addr_type, u8 type, u8 authenticated,
2430 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2431 {
2432 struct smp_ltk *key, *old_key;
2433 u8 role = ltk_role(type);
2434
2435 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2436 if (old_key)
2437 key = old_key;
2438 else {
2439 key = kzalloc(sizeof(*key), GFP_KERNEL);
2440 if (!key)
2441 return NULL;
2442 list_add_rcu(&key->list, &hdev->long_term_keys);
2443 }
2444
2445 bacpy(&key->bdaddr, bdaddr);
2446 key->bdaddr_type = addr_type;
2447 memcpy(key->val, tk, sizeof(key->val));
2448 key->authenticated = authenticated;
2449 key->ediv = ediv;
2450 key->rand = rand;
2451 key->enc_size = enc_size;
2452 key->type = type;
2453
2454 return key;
2455 }
2456
2457 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2458 u8 addr_type, u8 val[16], bdaddr_t *rpa)
2459 {
2460 struct smp_irk *irk;
2461
2462 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2463 if (!irk) {
2464 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2465 if (!irk)
2466 return NULL;
2467
2468 bacpy(&irk->bdaddr, bdaddr);
2469 irk->addr_type = addr_type;
2470
2471 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2472 }
2473
2474 memcpy(irk->val, val, 16);
2475 bacpy(&irk->rpa, rpa);
2476
2477 return irk;
2478 }
2479
2480 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2481 {
2482 struct link_key *key;
2483
2484 key = hci_find_link_key(hdev, bdaddr);
2485 if (!key)
2486 return -ENOENT;
2487
2488 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2489
2490 list_del_rcu(&key->list);
2491 kfree_rcu(key, rcu);
2492
2493 return 0;
2494 }
2495
2496 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2497 {
2498 struct smp_ltk *k;
2499 int removed = 0;
2500
2501 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2502 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2503 continue;
2504
2505 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2506
2507 list_del_rcu(&k->list);
2508 kfree_rcu(k, rcu);
2509 removed++;
2510 }
2511
2512 return removed ? 0 : -ENOENT;
2513 }
2514
2515 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2516 {
2517 struct smp_irk *k;
2518
2519 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2520 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2521 continue;
2522
2523 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2524
2525 list_del_rcu(&k->list);
2526 kfree_rcu(k, rcu);
2527 }
2528 }
2529
2530 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2531 {
2532 struct smp_ltk *k;
2533 struct smp_irk *irk;
2534 u8 addr_type;
2535
2536 if (type == BDADDR_BREDR) {
2537 if (hci_find_link_key(hdev, bdaddr))
2538 return true;
2539 return false;
2540 }
2541
2542 /* Convert to HCI addr type which struct smp_ltk uses */
2543 if (type == BDADDR_LE_PUBLIC)
2544 addr_type = ADDR_LE_DEV_PUBLIC;
2545 else
2546 addr_type = ADDR_LE_DEV_RANDOM;
2547
2548 irk = hci_get_irk(hdev, bdaddr, addr_type);
2549 if (irk) {
2550 bdaddr = &irk->bdaddr;
2551 addr_type = irk->addr_type;
2552 }
2553
2554 rcu_read_lock();
2555 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2556 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2557 rcu_read_unlock();
2558 return true;
2559 }
2560 }
2561 rcu_read_unlock();
2562
2563 return false;
2564 }
2565
2566 /* HCI command timer function */
2567 static void hci_cmd_timeout(struct work_struct *work)
2568 {
2569 struct hci_dev *hdev = container_of(work, struct hci_dev,
2570 cmd_timer.work);
2571
2572 if (hdev->sent_cmd) {
2573 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2574 u16 opcode = __le16_to_cpu(sent->opcode);
2575
2576 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
2577 } else {
2578 bt_dev_err(hdev, "command tx timeout");
2579 }
2580
2581 atomic_set(&hdev->cmd_cnt, 1);
2582 queue_work(hdev->workqueue, &hdev->cmd_work);
2583 }
2584
2585 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2586 bdaddr_t *bdaddr, u8 bdaddr_type)
2587 {
2588 struct oob_data *data;
2589
2590 list_for_each_entry(data, &hdev->remote_oob_data, list) {
2591 if (bacmp(bdaddr, &data->bdaddr) != 0)
2592 continue;
2593 if (data->bdaddr_type != bdaddr_type)
2594 continue;
2595 return data;
2596 }
2597
2598 return NULL;
2599 }
2600
2601 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2602 u8 bdaddr_type)
2603 {
2604 struct oob_data *data;
2605
2606 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2607 if (!data)
2608 return -ENOENT;
2609
2610 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2611
2612 list_del(&data->list);
2613 kfree(data);
2614
2615 return 0;
2616 }
2617
2618 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2619 {
2620 struct oob_data *data, *n;
2621
2622 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2623 list_del(&data->list);
2624 kfree(data);
2625 }
2626 }
2627
2628 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2629 u8 bdaddr_type, u8 *hash192, u8 *rand192,
2630 u8 *hash256, u8 *rand256)
2631 {
2632 struct oob_data *data;
2633
2634 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2635 if (!data) {
2636 data = kmalloc(sizeof(*data), GFP_KERNEL);
2637 if (!data)
2638 return -ENOMEM;
2639
2640 bacpy(&data->bdaddr, bdaddr);
2641 data->bdaddr_type = bdaddr_type;
2642 list_add(&data->list, &hdev->remote_oob_data);
2643 }
2644
2645 if (hash192 && rand192) {
2646 memcpy(data->hash192, hash192, sizeof(data->hash192));
2647 memcpy(data->rand192, rand192, sizeof(data->rand192));
2648 if (hash256 && rand256)
2649 data->present = 0x03;
2650 } else {
2651 memset(data->hash192, 0, sizeof(data->hash192));
2652 memset(data->rand192, 0, sizeof(data->rand192));
2653 if (hash256 && rand256)
2654 data->present = 0x02;
2655 else
2656 data->present = 0x00;
2657 }
2658
2659 if (hash256 && rand256) {
2660 memcpy(data->hash256, hash256, sizeof(data->hash256));
2661 memcpy(data->rand256, rand256, sizeof(data->rand256));
2662 } else {
2663 memset(data->hash256, 0, sizeof(data->hash256));
2664 memset(data->rand256, 0, sizeof(data->rand256));
2665 if (hash192 && rand192)
2666 data->present = 0x01;
2667 }
2668
2669 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2670
2671 return 0;
2672 }
2673
2674 /* This function requires the caller holds hdev->lock */
2675 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2676 {
2677 struct adv_info *adv_instance;
2678
2679 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2680 if (adv_instance->instance == instance)
2681 return adv_instance;
2682 }
2683
2684 return NULL;
2685 }
2686
2687 /* This function requires the caller holds hdev->lock */
2688 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2689 {
2690 struct adv_info *cur_instance;
2691
2692 cur_instance = hci_find_adv_instance(hdev, instance);
2693 if (!cur_instance)
2694 return NULL;
2695
2696 if (cur_instance == list_last_entry(&hdev->adv_instances,
2697 struct adv_info, list))
2698 return list_first_entry(&hdev->adv_instances,
2699 struct adv_info, list);
2700 else
2701 return list_next_entry(cur_instance, list);
2702 }
2703
2704 /* This function requires the caller holds hdev->lock */
2705 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2706 {
2707 struct adv_info *adv_instance;
2708
2709 adv_instance = hci_find_adv_instance(hdev, instance);
2710 if (!adv_instance)
2711 return -ENOENT;
2712
2713 BT_DBG("%s removing %dMR", hdev->name, instance);
2714
2715 if (hdev->cur_adv_instance == instance) {
2716 if (hdev->adv_instance_timeout) {
2717 cancel_delayed_work(&hdev->adv_instance_expire);
2718 hdev->adv_instance_timeout = 0;
2719 }
2720 hdev->cur_adv_instance = 0x00;
2721 }
2722
2723 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2724
2725 list_del(&adv_instance->list);
2726 kfree(adv_instance);
2727
2728 hdev->adv_instance_cnt--;
2729
2730 return 0;
2731 }
2732
2733 void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
2734 {
2735 struct adv_info *adv_instance, *n;
2736
2737 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
2738 adv_instance->rpa_expired = rpa_expired;
2739 }
2740
2741 /* This function requires the caller holds hdev->lock */
2742 void hci_adv_instances_clear(struct hci_dev *hdev)
2743 {
2744 struct adv_info *adv_instance, *n;
2745
2746 if (hdev->adv_instance_timeout) {
2747 cancel_delayed_work(&hdev->adv_instance_expire);
2748 hdev->adv_instance_timeout = 0;
2749 }
2750
2751 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
2752 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2753 list_del(&adv_instance->list);
2754 kfree(adv_instance);
2755 }
2756
2757 hdev->adv_instance_cnt = 0;
2758 hdev->cur_adv_instance = 0x00;
2759 }
2760
2761 static void adv_instance_rpa_expired(struct work_struct *work)
2762 {
2763 struct adv_info *adv_instance = container_of(work, struct adv_info,
2764 rpa_expired_cb.work);
2765
2766 BT_DBG("");
2767
2768 adv_instance->rpa_expired = true;
2769 }
2770
2771 /* This function requires the caller holds hdev->lock */
2772 int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2773 u16 adv_data_len, u8 *adv_data,
2774 u16 scan_rsp_len, u8 *scan_rsp_data,
2775 u16 timeout, u16 duration)
2776 {
2777 struct adv_info *adv_instance;
2778
2779 adv_instance = hci_find_adv_instance(hdev, instance);
2780 if (adv_instance) {
2781 memset(adv_instance->adv_data, 0,
2782 sizeof(adv_instance->adv_data));
2783 memset(adv_instance->scan_rsp_data, 0,
2784 sizeof(adv_instance->scan_rsp_data));
2785 } else {
2786 if (hdev->adv_instance_cnt >= HCI_MAX_ADV_INSTANCES ||
2787 instance < 1 || instance > HCI_MAX_ADV_INSTANCES)
2788 return -EOVERFLOW;
2789
2790 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
2791 if (!adv_instance)
2792 return -ENOMEM;
2793
2794 adv_instance->pending = true;
2795 adv_instance->instance = instance;
2796 list_add(&adv_instance->list, &hdev->adv_instances);
2797 hdev->adv_instance_cnt++;
2798 }
2799
2800 adv_instance->flags = flags;
2801 adv_instance->adv_data_len = adv_data_len;
2802 adv_instance->scan_rsp_len = scan_rsp_len;
2803
2804 if (adv_data_len)
2805 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
2806
2807 if (scan_rsp_len)
2808 memcpy(adv_instance->scan_rsp_data,
2809 scan_rsp_data, scan_rsp_len);
2810
2811 adv_instance->timeout = timeout;
2812 adv_instance->remaining_time = timeout;
2813
2814 if (duration == 0)
2815 adv_instance->duration = HCI_DEFAULT_ADV_DURATION;
2816 else
2817 adv_instance->duration = duration;
2818
2819 adv_instance->tx_power = HCI_TX_POWER_INVALID;
2820
2821 INIT_DELAYED_WORK(&adv_instance->rpa_expired_cb,
2822 adv_instance_rpa_expired);
2823
2824 BT_DBG("%s for %dMR", hdev->name, instance);
2825
2826 return 0;
2827 }
2828
2829 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2830 bdaddr_t *bdaddr, u8 type)
2831 {
2832 struct bdaddr_list *b;
2833
2834 list_for_each_entry(b, bdaddr_list, list) {
2835 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2836 return b;
2837 }
2838
2839 return NULL;
2840 }
2841
2842 struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
2843 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
2844 u8 type)
2845 {
2846 struct bdaddr_list_with_irk *b;
2847
2848 list_for_each_entry(b, bdaddr_list, list) {
2849 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2850 return b;
2851 }
2852
2853 return NULL;
2854 }
2855
2856 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2857 {
2858 struct bdaddr_list *b, *n;
2859
2860 list_for_each_entry_safe(b, n, bdaddr_list, list) {
2861 list_del(&b->list);
2862 kfree(b);
2863 }
2864 }
2865
2866 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2867 {
2868 struct bdaddr_list *entry;
2869
2870 if (!bacmp(bdaddr, BDADDR_ANY))
2871 return -EBADF;
2872
2873 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2874 return -EEXIST;
2875
2876 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2877 if (!entry)
2878 return -ENOMEM;
2879
2880 bacpy(&entry->bdaddr, bdaddr);
2881 entry->bdaddr_type = type;
2882
2883 list_add(&entry->list, list);
2884
2885 return 0;
2886 }
2887
2888 int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2889 u8 type, u8 *peer_irk, u8 *local_irk)
2890 {
2891 struct bdaddr_list_with_irk *entry;
2892
2893 if (!bacmp(bdaddr, BDADDR_ANY))
2894 return -EBADF;
2895
2896 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2897 return -EEXIST;
2898
2899 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2900 if (!entry)
2901 return -ENOMEM;
2902
2903 bacpy(&entry->bdaddr, bdaddr);
2904 entry->bdaddr_type = type;
2905
2906 if (peer_irk)
2907 memcpy(entry->peer_irk, peer_irk, 16);
2908
2909 if (local_irk)
2910 memcpy(entry->local_irk, local_irk, 16);
2911
2912 list_add(&entry->list, list);
2913
2914 return 0;
2915 }
2916
2917 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2918 {
2919 struct bdaddr_list *entry;
2920
2921 if (!bacmp(bdaddr, BDADDR_ANY)) {
2922 hci_bdaddr_list_clear(list);
2923 return 0;
2924 }
2925
2926 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2927 if (!entry)
2928 return -ENOENT;
2929
2930 list_del(&entry->list);
2931 kfree(entry);
2932
2933 return 0;
2934 }
2935
2936 int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2937 u8 type)
2938 {
2939 struct bdaddr_list_with_irk *entry;
2940
2941 if (!bacmp(bdaddr, BDADDR_ANY)) {
2942 hci_bdaddr_list_clear(list);
2943 return 0;
2944 }
2945
2946 entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
2947 if (!entry)
2948 return -ENOENT;
2949
2950 list_del(&entry->list);
2951 kfree(entry);
2952
2953 return 0;
2954 }
2955
2956 /* This function requires the caller holds hdev->lock */
2957 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2958 bdaddr_t *addr, u8 addr_type)
2959 {
2960 struct hci_conn_params *params;
2961
2962 list_for_each_entry(params, &hdev->le_conn_params, list) {
2963 if (bacmp(&params->addr, addr) == 0 &&
2964 params->addr_type == addr_type) {
2965 return params;
2966 }
2967 }
2968
2969 return NULL;
2970 }
2971
2972 /* This function requires the caller holds hdev->lock */
2973 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2974 bdaddr_t *addr, u8 addr_type)
2975 {
2976 struct hci_conn_params *param;
2977
2978 list_for_each_entry(param, list, action) {
2979 if (bacmp(&param->addr, addr) == 0 &&
2980 param->addr_type == addr_type)
2981 return param;
2982 }
2983
2984 return NULL;
2985 }
2986
2987 /* This function requires the caller holds hdev->lock */
2988 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2989 bdaddr_t *addr, u8 addr_type)
2990 {
2991 struct hci_conn_params *params;
2992
2993 params = hci_conn_params_lookup(hdev, addr, addr_type);
2994 if (params)
2995 return params;
2996
2997 params = kzalloc(sizeof(*params), GFP_KERNEL);
2998 if (!params) {
2999 bt_dev_err(hdev, "out of memory");
3000 return NULL;
3001 }
3002
3003 bacpy(&params->addr, addr);
3004 params->addr_type = addr_type;
3005
3006 list_add(&params->list, &hdev->le_conn_params);
3007 INIT_LIST_HEAD(&params->action);
3008
3009 params->conn_min_interval = hdev->le_conn_min_interval;
3010 params->conn_max_interval = hdev->le_conn_max_interval;
3011 params->conn_latency = hdev->le_conn_latency;
3012 params->supervision_timeout = hdev->le_supv_timeout;
3013 params->auto_connect = HCI_AUTO_CONN_DISABLED;
3014
3015 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3016
3017 return params;
3018 }
3019
3020 static void hci_conn_params_free(struct hci_conn_params *params)
3021 {
3022 if (params->conn) {
3023 hci_conn_drop(params->conn);
3024 hci_conn_put(params->conn);
3025 }
3026
3027 list_del(&params->action);
3028 list_del(&params->list);
3029 kfree(params);
3030 }
3031
3032 /* This function requires the caller holds hdev->lock */
3033 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3034 {
3035 struct hci_conn_params *params;
3036
3037 params = hci_conn_params_lookup(hdev, addr, addr_type);
3038 if (!params)
3039 return;
3040
3041 hci_conn_params_free(params);
3042
3043 hci_update_background_scan(hdev);
3044
3045 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3046 }
3047
3048 /* This function requires the caller holds hdev->lock */
3049 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
3050 {
3051 struct hci_conn_params *params, *tmp;
3052
3053 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3054 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3055 continue;
3056
3057 /* If trying to estabilish one time connection to disabled
3058 * device, leave the params, but mark them as just once.
3059 */
3060 if (params->explicit_connect) {
3061 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3062 continue;
3063 }
3064
3065 list_del(&params->list);
3066 kfree(params);
3067 }
3068
3069 BT_DBG("All LE disabled connection parameters were removed");
3070 }
3071
3072 /* This function requires the caller holds hdev->lock */
3073 static void hci_conn_params_clear_all(struct hci_dev *hdev)
3074 {
3075 struct hci_conn_params *params, *tmp;
3076
3077 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
3078 hci_conn_params_free(params);
3079
3080 BT_DBG("All LE connection parameters were removed");
3081 }
3082
3083 /* Copy the Identity Address of the controller.
3084 *
3085 * If the controller has a public BD_ADDR, then by default use that one.
3086 * If this is a LE only controller without a public address, default to
3087 * the static random address.
3088 *
3089 * For debugging purposes it is possible to force controllers with a
3090 * public address to use the static random address instead.
3091 *
3092 * In case BR/EDR has been disabled on a dual-mode controller and
3093 * userspace has configured a static address, then that address
3094 * becomes the identity address instead of the public BR/EDR address.
3095 */
3096 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3097 u8 *bdaddr_type)
3098 {
3099 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
3100 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
3101 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3102 bacmp(&hdev->static_addr, BDADDR_ANY))) {
3103 bacpy(bdaddr, &hdev->static_addr);
3104 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3105 } else {
3106 bacpy(bdaddr, &hdev->bdaddr);
3107 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3108 }
3109 }
3110
3111 /* Alloc HCI device */
3112 struct hci_dev *hci_alloc_dev(void)
3113 {
3114 struct hci_dev *hdev;
3115
3116 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3117 if (!hdev)
3118 return NULL;
3119
3120 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3121 hdev->esco_type = (ESCO_HV1);
3122 hdev->link_mode = (HCI_LM_ACCEPT);
3123 hdev->num_iac = 0x01; /* One IAC support is mandatory */
3124 hdev->io_capability = 0x03; /* No Input No Output */
3125 hdev->manufacturer = 0xffff; /* Default to internal use */
3126 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3127 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3128 hdev->adv_instance_cnt = 0;
3129 hdev->cur_adv_instance = 0x00;
3130 hdev->adv_instance_timeout = 0;
3131
3132 hdev->sniff_max_interval = 800;
3133 hdev->sniff_min_interval = 80;
3134
3135 hdev->le_adv_channel_map = 0x07;
3136 hdev->le_adv_min_interval = 0x0800;
3137 hdev->le_adv_max_interval = 0x0800;
3138 hdev->le_scan_interval = 0x0060;
3139 hdev->le_scan_window = 0x0030;
3140 hdev->le_conn_min_interval = 0x0018;
3141 hdev->le_conn_max_interval = 0x0028;
3142 hdev->le_conn_latency = 0x0000;
3143 hdev->le_supv_timeout = 0x002a;
3144 hdev->le_def_tx_len = 0x001b;
3145 hdev->le_def_tx_time = 0x0148;
3146 hdev->le_max_tx_len = 0x001b;
3147 hdev->le_max_tx_time = 0x0148;
3148 hdev->le_max_rx_len = 0x001b;
3149 hdev->le_max_rx_time = 0x0148;
3150 hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
3151 hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
3152 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
3153 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
3154
3155 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3156 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3157 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3158 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3159
3160 mutex_init(&hdev->lock);
3161 mutex_init(&hdev->req_lock);
3162
3163 INIT_LIST_HEAD(&hdev->mgmt_pending);
3164 INIT_LIST_HEAD(&hdev->blacklist);
3165 INIT_LIST_HEAD(&hdev->whitelist);
3166 INIT_LIST_HEAD(&hdev->uuids);
3167 INIT_LIST_HEAD(&hdev->link_keys);
3168 INIT_LIST_HEAD(&hdev->long_term_keys);
3169 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3170 INIT_LIST_HEAD(&hdev->remote_oob_data);
3171 INIT_LIST_HEAD(&hdev->le_white_list);
3172 INIT_LIST_HEAD(&hdev->le_resolv_list);
3173 INIT_LIST_HEAD(&hdev->le_conn_params);
3174 INIT_LIST_HEAD(&hdev->pend_le_conns);
3175 INIT_LIST_HEAD(&hdev->pend_le_reports);
3176 INIT_LIST_HEAD(&hdev->conn_hash.list);
3177 INIT_LIST_HEAD(&hdev->adv_instances);
3178
3179 INIT_WORK(&hdev->rx_work, hci_rx_work);
3180 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3181 INIT_WORK(&hdev->tx_work, hci_tx_work);
3182 INIT_WORK(&hdev->power_on, hci_power_on);
3183 INIT_WORK(&hdev->error_reset, hci_error_reset);
3184
3185 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3186
3187 skb_queue_head_init(&hdev->rx_q);
3188 skb_queue_head_init(&hdev->cmd_q);
3189 skb_queue_head_init(&hdev->raw_q);
3190
3191 init_waitqueue_head(&hdev->req_wait_q);
3192
3193 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3194
3195 hci_request_setup(hdev);
3196
3197 hci_init_sysfs(hdev);
3198 discovery_init(hdev);
3199
3200 return hdev;
3201 }
3202 EXPORT_SYMBOL(hci_alloc_dev);
3203
3204 /* Free HCI device */
3205 void hci_free_dev(struct hci_dev *hdev)
3206 {
3207 /* will free via device release */
3208 put_device(&hdev->dev);
3209 }
3210 EXPORT_SYMBOL(hci_free_dev);
3211
3212 /* Register HCI device */
3213 int hci_register_dev(struct hci_dev *hdev)
3214 {
3215 int id, error;
3216
3217 if (!hdev->open || !hdev->close || !hdev->send)
3218 return -EINVAL;
3219
3220 /* Do not allow HCI_AMP devices to register at index 0,
3221 * so the index can be used as the AMP controller ID.
3222 */
3223 switch (hdev->dev_type) {
3224 case HCI_PRIMARY:
3225 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3226 break;
3227 case HCI_AMP:
3228 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3229 break;
3230 default:
3231 return -EINVAL;
3232 }
3233
3234 if (id < 0)
3235 return id;
3236
3237 sprintf(hdev->name, "hci%d", id);
3238 hdev->id = id;
3239
3240 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3241
3242 hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
3243 if (!hdev->workqueue) {
3244 error = -ENOMEM;
3245 goto err;
3246 }
3247
3248 hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
3249 hdev->name);
3250 if (!hdev->req_workqueue) {
3251 destroy_workqueue(hdev->workqueue);
3252 error = -ENOMEM;
3253 goto err;
3254 }
3255
3256 if (!IS_ERR_OR_NULL(bt_debugfs))
3257 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3258
3259 dev_set_name(&hdev->dev, "%s", hdev->name);
3260
3261 error = device_add(&hdev->dev);
3262 if (error < 0)
3263 goto err_wqueue;
3264
3265 hci_leds_init(hdev);
3266
3267 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3268 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3269 hdev);
3270 if (hdev->rfkill) {
3271 if (rfkill_register(hdev->rfkill) < 0) {
3272 rfkill_destroy(hdev->rfkill);
3273 hdev->rfkill = NULL;
3274 }
3275 }
3276
3277 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3278 hci_dev_set_flag(hdev, HCI_RFKILLED);
3279
3280 hci_dev_set_flag(hdev, HCI_SETUP);
3281 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3282
3283 if (hdev->dev_type == HCI_PRIMARY) {
3284 /* Assume BR/EDR support until proven otherwise (such as
3285 * through reading supported features during init.
3286 */
3287 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3288 }
3289
3290 write_lock(&hci_dev_list_lock);
3291 list_add(&hdev->list, &hci_dev_list);
3292 write_unlock(&hci_dev_list_lock);
3293
3294 /* Devices that are marked for raw-only usage are unconfigured
3295 * and should not be included in normal operation.
3296 */
3297 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3298 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3299
3300 hci_sock_dev_event(hdev, HCI_DEV_REG);
3301 hci_dev_hold(hdev);
3302
3303 queue_work(hdev->req_workqueue, &hdev->power_on);
3304
3305 return id;
3306
3307 err_wqueue:
3308 destroy_workqueue(hdev->workqueue);
3309 destroy_workqueue(hdev->req_workqueue);
3310 err:
3311 ida_simple_remove(&hci_index_ida, hdev->id);
3312
3313 return error;
3314 }
3315 EXPORT_SYMBOL(hci_register_dev);
3316
3317 /* Unregister HCI device */
3318 void hci_unregister_dev(struct hci_dev *hdev)
3319 {
3320 int id;
3321
3322 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3323
3324 hci_dev_set_flag(hdev, HCI_UNREGISTER);
3325
3326 id = hdev->id;
3327
3328 write_lock(&hci_dev_list_lock);
3329 list_del(&hdev->list);
3330 write_unlock(&hci_dev_list_lock);
3331
3332 cancel_work_sync(&hdev->power_on);
3333
3334 hci_dev_do_close(hdev);
3335
3336 if (!test_bit(HCI_INIT, &hdev->flags) &&
3337 !hci_dev_test_flag(hdev, HCI_SETUP) &&
3338 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
3339 hci_dev_lock(hdev);
3340 mgmt_index_removed(hdev);
3341 hci_dev_unlock(hdev);
3342 }
3343
3344 /* mgmt_index_removed should take care of emptying the
3345 * pending list */
3346 BUG_ON(!list_empty(&hdev->mgmt_pending));
3347
3348 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
3349
3350 if (hdev->rfkill) {
3351 rfkill_unregister(hdev->rfkill);
3352 rfkill_destroy(hdev->rfkill);
3353 }
3354
3355 device_del(&hdev->dev);
3356
3357 debugfs_remove_recursive(hdev->debugfs);
3358 kfree_const(hdev->hw_info);
3359 kfree_const(hdev->fw_info);
3360
3361 destroy_workqueue(hdev->workqueue);
3362 destroy_workqueue(hdev->req_workqueue);
3363
3364 hci_dev_lock(hdev);
3365 hci_bdaddr_list_clear(&hdev->blacklist);
3366 hci_bdaddr_list_clear(&hdev->whitelist);
3367 hci_uuids_clear(hdev);
3368 hci_link_keys_clear(hdev);
3369 hci_smp_ltks_clear(hdev);
3370 hci_smp_irks_clear(hdev);
3371 hci_remote_oob_data_clear(hdev);
3372 hci_adv_instances_clear(hdev);
3373 hci_bdaddr_list_clear(&hdev->le_white_list);
3374 hci_bdaddr_list_clear(&hdev->le_resolv_list);
3375 hci_conn_params_clear_all(hdev);
3376 hci_discovery_filter_clear(hdev);
3377 hci_dev_unlock(hdev);
3378
3379 hci_dev_put(hdev);
3380
3381 ida_simple_remove(&hci_index_ida, id);
3382 }
3383 EXPORT_SYMBOL(hci_unregister_dev);
3384
3385 /* Suspend HCI device */
3386 int hci_suspend_dev(struct hci_dev *hdev)
3387 {
3388 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
3389 return 0;
3390 }
3391 EXPORT_SYMBOL(hci_suspend_dev);
3392
3393 /* Resume HCI device */
3394 int hci_resume_dev(struct hci_dev *hdev)
3395 {
3396 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
3397 return 0;
3398 }
3399 EXPORT_SYMBOL(hci_resume_dev);
3400
3401 /* Reset HCI device */
3402 int hci_reset_dev(struct hci_dev *hdev)
3403 {
3404 const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3405 struct sk_buff *skb;
3406
3407 skb = bt_skb_alloc(3, GFP_ATOMIC);
3408 if (!skb)
3409 return -ENOMEM;
3410
3411 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
3412 skb_put_data(skb, hw_err, 3);
3413
3414 /* Send Hardware Error to upper stack */
3415 return hci_recv_frame(hdev, skb);
3416 }
3417 EXPORT_SYMBOL(hci_reset_dev);
3418
3419 /* Receive frame from HCI drivers */
3420 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
3421 {
3422 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
3423 && !test_bit(HCI_INIT, &hdev->flags))) {
3424 kfree_skb(skb);
3425 return -ENXIO;
3426 }
3427
3428 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
3429 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
3430 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
3431 kfree_skb(skb);
3432 return -EINVAL;
3433 }
3434
3435 /* Incoming skb */
3436 bt_cb(skb)->incoming = 1;
3437
3438 /* Time stamp */
3439 __net_timestamp(skb);
3440
3441 skb_queue_tail(&hdev->rx_q, skb);
3442 queue_work(hdev->workqueue, &hdev->rx_work);
3443
3444 return 0;
3445 }
3446 EXPORT_SYMBOL(hci_recv_frame);
3447
3448 /* Receive diagnostic message from HCI drivers */
3449 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
3450 {
3451 /* Mark as diagnostic packet */
3452 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
3453
3454 /* Time stamp */
3455 __net_timestamp(skb);
3456
3457 skb_queue_tail(&hdev->rx_q, skb);
3458 queue_work(hdev->workqueue, &hdev->rx_work);
3459
3460 return 0;
3461 }
3462 EXPORT_SYMBOL(hci_recv_diag);
3463
3464 void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
3465 {
3466 va_list vargs;
3467
3468 va_start(vargs, fmt);
3469 kfree_const(hdev->hw_info);
3470 hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3471 va_end(vargs);
3472 }
3473 EXPORT_SYMBOL(hci_set_hw_info);
3474
3475 void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
3476 {
3477 va_list vargs;
3478
3479 va_start(vargs, fmt);
3480 kfree_const(hdev->fw_info);
3481 hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3482 va_end(vargs);
3483 }
3484 EXPORT_SYMBOL(hci_set_fw_info);
3485
3486 /* ---- Interface to upper protocols ---- */
3487
3488 int hci_register_cb(struct hci_cb *cb)
3489 {
3490 BT_DBG("%p name %s", cb, cb->name);
3491
3492 mutex_lock(&hci_cb_list_lock);
3493 list_add_tail(&cb->list, &hci_cb_list);
3494 mutex_unlock(&hci_cb_list_lock);
3495
3496 return 0;
3497 }
3498 EXPORT_SYMBOL(hci_register_cb);
3499
3500 int hci_unregister_cb(struct hci_cb *cb)
3501 {
3502 BT_DBG("%p name %s", cb, cb->name);
3503
3504 mutex_lock(&hci_cb_list_lock);
3505 list_del(&cb->list);
3506 mutex_unlock(&hci_cb_list_lock);
3507
3508 return 0;
3509 }
3510 EXPORT_SYMBOL(hci_unregister_cb);
3511
3512 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
3513 {
3514 int err;
3515
3516 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3517 skb->len);
3518
3519 /* Time stamp */
3520 __net_timestamp(skb);
3521
3522 /* Send copy to monitor */
3523 hci_send_to_monitor(hdev, skb);
3524
3525 if (atomic_read(&hdev->promisc)) {
3526 /* Send copy to the sockets */
3527 hci_send_to_sock(hdev, skb);
3528 }
3529
3530 /* Get rid of skb owner, prior to sending to the driver. */
3531 skb_orphan(skb);
3532
3533 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3534 kfree_skb(skb);
3535 return;
3536 }
3537
3538 err = hdev->send(hdev, skb);
3539 if (err < 0) {
3540 bt_dev_err(hdev, "sending frame failed (%d)", err);
3541 kfree_skb(skb);
3542 }
3543 }
3544
3545 /* Send HCI command */
3546 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3547 const void *param)
3548 {
3549 struct sk_buff *skb;
3550
3551 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3552
3553 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3554 if (!skb) {
3555 bt_dev_err(hdev, "no memory for command");
3556 return -ENOMEM;
3557 }
3558
3559 /* Stand-alone HCI commands must be flagged as
3560 * single-command requests.
3561 */
3562 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
3563
3564 skb_queue_tail(&hdev->cmd_q, skb);
3565 queue_work(hdev->workqueue, &hdev->cmd_work);
3566
3567 return 0;
3568 }
3569
3570 int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
3571 const void *param)
3572 {
3573 struct sk_buff *skb;
3574
3575 if (hci_opcode_ogf(opcode) != 0x3f) {
3576 /* A controller receiving a command shall respond with either
3577 * a Command Status Event or a Command Complete Event.
3578 * Therefore, all standard HCI commands must be sent via the
3579 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
3580 * Some vendors do not comply with this rule for vendor-specific
3581 * commands and do not return any event. We want to support
3582 * unresponded commands for such cases only.
3583 */
3584 bt_dev_err(hdev, "unresponded command not supported");
3585 return -EINVAL;
3586 }
3587
3588 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3589 if (!skb) {
3590 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
3591 opcode);
3592 return -ENOMEM;
3593 }
3594
3595 hci_send_frame(hdev, skb);
3596
3597 return 0;
3598 }
3599 EXPORT_SYMBOL(__hci_cmd_send);
3600
3601 /* Get data from the previously sent command */
3602 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
3603 {
3604 struct hci_command_hdr *hdr;
3605
3606 if (!hdev->sent_cmd)
3607 return NULL;
3608
3609 hdr = (void *) hdev->sent_cmd->data;
3610
3611 if (hdr->opcode != cpu_to_le16(opcode))
3612 return NULL;
3613
3614 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3615
3616 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3617 }
3618
3619 /* Send HCI command and wait for command commplete event */
3620 struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
3621 const void *param, u32 timeout)
3622 {
3623 struct sk_buff *skb;
3624
3625 if (!test_bit(HCI_UP, &hdev->flags))
3626 return ERR_PTR(-ENETDOWN);
3627
3628 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
3629
3630 hci_req_sync_lock(hdev);
3631 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
3632 hci_req_sync_unlock(hdev);
3633
3634 return skb;
3635 }
3636 EXPORT_SYMBOL(hci_cmd_sync);
3637
3638 /* Send ACL data */
3639 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3640 {
3641 struct hci_acl_hdr *hdr;
3642 int len = skb->len;
3643
3644 skb_push(skb, HCI_ACL_HDR_SIZE);
3645 skb_reset_transport_header(skb);
3646 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3647 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3648 hdr->dlen = cpu_to_le16(len);
3649 }
3650
3651 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
3652 struct sk_buff *skb, __u16 flags)
3653 {
3654 struct hci_conn *conn = chan->conn;
3655 struct hci_dev *hdev = conn->hdev;
3656 struct sk_buff *list;
3657
3658 skb->len = skb_headlen(skb);
3659 skb->data_len = 0;
3660
3661 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3662
3663 switch (hdev->dev_type) {
3664 case HCI_PRIMARY:
3665 hci_add_acl_hdr(skb, conn->handle, flags);
3666 break;
3667 case HCI_AMP:
3668 hci_add_acl_hdr(skb, chan->handle, flags);
3669 break;
3670 default:
3671 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3672 return;
3673 }
3674
3675 list = skb_shinfo(skb)->frag_list;
3676 if (!list) {
3677 /* Non fragmented */
3678 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3679
3680 skb_queue_tail(queue, skb);
3681 } else {
3682 /* Fragmented */
3683 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3684
3685 skb_shinfo(skb)->frag_list = NULL;
3686
3687 /* Queue all fragments atomically. We need to use spin_lock_bh
3688 * here because of 6LoWPAN links, as there this function is
3689 * called from softirq and using normal spin lock could cause
3690 * deadlocks.
3691 */
3692 spin_lock_bh(&queue->lock);
3693
3694 __skb_queue_tail(queue, skb);
3695
3696 flags &= ~ACL_START;
3697 flags |= ACL_CONT;
3698 do {
3699 skb = list; list = list->next;
3700
3701 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3702 hci_add_acl_hdr(skb, conn->handle, flags);
3703
3704 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3705
3706 __skb_queue_tail(queue, skb);
3707 } while (list);
3708
3709 spin_unlock_bh(&queue->lock);
3710 }
3711 }
3712
3713 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3714 {
3715 struct hci_dev *hdev = chan->conn->hdev;
3716
3717 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
3718
3719 hci_queue_acl(chan, &chan->data_q, skb, flags);
3720
3721 queue_work(hdev->workqueue, &hdev->tx_work);
3722 }
3723
3724 /* Send SCO data */
3725 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
3726 {
3727 struct hci_dev *hdev = conn->hdev;
3728 struct hci_sco_hdr hdr;
3729
3730 BT_DBG("%s len %d", hdev->name, skb->len);
3731
3732 hdr.handle = cpu_to_le16(conn->handle);
3733 hdr.dlen = skb->len;
3734
3735 skb_push(skb, HCI_SCO_HDR_SIZE);
3736 skb_reset_transport_header(skb);
3737 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
3738
3739 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
3740
3741 skb_queue_tail(&conn->data_q, skb);
3742 queue_work(hdev->workqueue, &hdev->tx_work);
3743 }
3744
3745 /* ---- HCI TX task (outgoing data) ---- */
3746
3747 /* HCI Connection scheduler */
3748 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3749 int *quote)
3750 {
3751 struct hci_conn_hash *h = &hdev->conn_hash;
3752 struct hci_conn *conn = NULL, *c;
3753 unsigned int num = 0, min = ~0;
3754
3755 /* We don't have to lock device here. Connections are always
3756 * added and removed with TX task disabled. */
3757
3758 rcu_read_lock();
3759
3760 list_for_each_entry_rcu(c, &h->list, list) {
3761 if (c->type != type || skb_queue_empty(&c->data_q))
3762 continue;
3763
3764 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3765 continue;
3766
3767 num++;
3768
3769 if (c->sent < min) {
3770 min = c->sent;
3771 conn = c;
3772 }
3773
3774 if (hci_conn_num(hdev, type) == num)
3775 break;
3776 }
3777
3778 rcu_read_unlock();
3779
3780 if (conn) {
3781 int cnt, q;
3782
3783 switch (conn->type) {
3784 case ACL_LINK:
3785 cnt = hdev->acl_cnt;
3786 break;
3787 case SCO_LINK:
3788 case ESCO_LINK:
3789 cnt = hdev->sco_cnt;
3790 break;
3791 case LE_LINK:
3792 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3793 break;
3794 default:
3795 cnt = 0;
3796 bt_dev_err(hdev, "unknown link type %d", conn->type);
3797 }
3798
3799 q = cnt / num;
3800 *quote = q ? q : 1;
3801 } else
3802 *quote = 0;
3803
3804 BT_DBG("conn %p quote %d", conn, *quote);
3805 return conn;
3806 }
3807
3808 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
3809 {
3810 struct hci_conn_hash *h = &hdev->conn_hash;
3811 struct hci_conn *c;
3812
3813 bt_dev_err(hdev, "link tx timeout");
3814
3815 rcu_read_lock();
3816
3817 /* Kill stalled connections */
3818 list_for_each_entry_rcu(c, &h->list, list) {
3819 if (c->type == type && c->sent) {
3820 bt_dev_err(hdev, "killing stalled connection %pMR",
3821 &c->dst);
3822 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3823 }
3824 }
3825
3826 rcu_read_unlock();
3827 }
3828
3829 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3830 int *quote)
3831 {
3832 struct hci_conn_hash *h = &hdev->conn_hash;
3833 struct hci_chan *chan = NULL;
3834 unsigned int num = 0, min = ~0, cur_prio = 0;
3835 struct hci_conn *conn;
3836 int cnt, q, conn_num = 0;
3837
3838 BT_DBG("%s", hdev->name);
3839
3840 rcu_read_lock();
3841
3842 list_for_each_entry_rcu(conn, &h->list, list) {
3843 struct hci_chan *tmp;
3844
3845 if (conn->type != type)
3846 continue;
3847
3848 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3849 continue;
3850
3851 conn_num++;
3852
3853 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
3854 struct sk_buff *skb;
3855
3856 if (skb_queue_empty(&tmp->data_q))
3857 continue;
3858
3859 skb = skb_peek(&tmp->data_q);
3860 if (skb->priority < cur_prio)
3861 continue;
3862
3863 if (skb->priority > cur_prio) {
3864 num = 0;
3865 min = ~0;
3866 cur_prio = skb->priority;
3867 }
3868
3869 num++;
3870
3871 if (conn->sent < min) {
3872 min = conn->sent;
3873 chan = tmp;
3874 }
3875 }
3876
3877 if (hci_conn_num(hdev, type) == conn_num)
3878 break;
3879 }
3880
3881 rcu_read_unlock();
3882
3883 if (!chan)
3884 return NULL;
3885
3886 switch (chan->conn->type) {
3887 case ACL_LINK:
3888 cnt = hdev->acl_cnt;
3889 break;
3890 case AMP_LINK:
3891 cnt = hdev->block_cnt;
3892 break;
3893 case SCO_LINK:
3894 case ESCO_LINK:
3895 cnt = hdev->sco_cnt;
3896 break;
3897 case LE_LINK:
3898 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3899 break;
3900 default:
3901 cnt = 0;
3902 bt_dev_err(hdev, "unknown link type %d", chan->conn->type);
3903 }
3904
3905 q = cnt / num;
3906 *quote = q ? q : 1;
3907 BT_DBG("chan %p quote %d", chan, *quote);
3908 return chan;
3909 }
3910
3911 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3912 {
3913 struct hci_conn_hash *h = &hdev->conn_hash;
3914 struct hci_conn *conn;
3915 int num = 0;
3916
3917 BT_DBG("%s", hdev->name);
3918
3919 rcu_read_lock();
3920
3921 list_for_each_entry_rcu(conn, &h->list, list) {
3922 struct hci_chan *chan;
3923
3924 if (conn->type != type)
3925 continue;
3926
3927 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3928 continue;
3929
3930 num++;
3931
3932 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
3933 struct sk_buff *skb;
3934
3935 if (chan->sent) {
3936 chan->sent = 0;
3937 continue;
3938 }
3939
3940 if (skb_queue_empty(&chan->data_q))
3941 continue;
3942
3943 skb = skb_peek(&chan->data_q);
3944 if (skb->priority >= HCI_PRIO_MAX - 1)
3945 continue;
3946
3947 skb->priority = HCI_PRIO_MAX - 1;
3948
3949 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
3950 skb->priority);
3951 }
3952
3953 if (hci_conn_num(hdev, type) == num)
3954 break;
3955 }
3956
3957 rcu_read_unlock();
3958
3959 }
3960
3961 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
3962 {
3963 /* Calculate count of blocks used by this packet */
3964 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
3965 }
3966
3967 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
3968 {
3969 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
3970 /* ACL tx timeout must be longer than maximum
3971 * link supervision timeout (40.9 seconds) */
3972 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
3973 HCI_ACL_TX_TIMEOUT))
3974 hci_link_tx_to(hdev, ACL_LINK);
3975 }
3976 }
3977
3978 static void hci_sched_acl_pkt(struct hci_dev *hdev)
3979 {
3980 unsigned int cnt = hdev->acl_cnt;
3981 struct hci_chan *chan;
3982 struct sk_buff *skb;
3983 int quote;
3984
3985 __check_timeout(hdev, cnt);
3986
3987 while (hdev->acl_cnt &&
3988 (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3989 u32 priority = (skb_peek(&chan->data_q))->priority;
3990 while (quote-- && (skb = skb_peek(&chan->data_q))) {
3991 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3992 skb->len, skb->priority);
3993
3994 /* Stop if priority has changed */
3995 if (skb->priority < priority)
3996 break;
3997
3998 skb = skb_dequeue(&chan->data_q);
3999
4000 hci_conn_enter_active_mode(chan->conn,
4001 bt_cb(skb)->force_active);
4002
4003 hci_send_frame(hdev, skb);
4004 hdev->acl_last_tx = jiffies;
4005
4006 hdev->acl_cnt--;
4007 chan->sent++;
4008 chan->conn->sent++;
4009 }
4010 }
4011
4012 if (cnt != hdev->acl_cnt)
4013 hci_prio_recalculate(hdev, ACL_LINK);
4014 }
4015
4016 static void hci_sched_acl_blk(struct hci_dev *hdev)
4017 {
4018 unsigned int cnt = hdev->block_cnt;
4019 struct hci_chan *chan;
4020 struct sk_buff *skb;
4021 int quote;
4022 u8 type;
4023
4024 __check_timeout(hdev, cnt);
4025
4026 BT_DBG("%s", hdev->name);
4027
4028 if (hdev->dev_type == HCI_AMP)
4029 type = AMP_LINK;
4030 else
4031 type = ACL_LINK;
4032
4033 while (hdev->block_cnt > 0 &&
4034 (chan = hci_chan_sent(hdev, type, &quote))) {
4035 u32 priority = (skb_peek(&chan->data_q))->priority;
4036 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
4037 int blocks;
4038
4039 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4040 skb->len, skb->priority);
4041
4042 /* Stop if priority has changed */
4043 if (skb->priority < priority)
4044 break;
4045
4046 skb = skb_dequeue(&chan->data_q);
4047
4048 blocks = __get_blocks(hdev, skb);
4049 if (blocks > hdev->block_cnt)
4050 return;
4051
4052 hci_conn_enter_active_mode(chan->conn,
4053 bt_cb(skb)->force_active);
4054
4055 hci_send_frame(hdev, skb);
4056 hdev->acl_last_tx = jiffies;
4057
4058 hdev->block_cnt -= blocks;
4059 quote -= blocks;
4060
4061 chan->sent += blocks;
4062 chan->conn->sent += blocks;
4063 }
4064 }
4065
4066 if (cnt != hdev->block_cnt)
4067 hci_prio_recalculate(hdev, type);
4068 }
4069
4070 static void hci_sched_acl(struct hci_dev *hdev)
4071 {
4072 BT_DBG("%s", hdev->name);
4073
4074 /* No ACL link over BR/EDR controller */
4075 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
4076 return;
4077
4078 /* No AMP link over AMP controller */
4079 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4080 return;
4081
4082 switch (hdev->flow_ctl_mode) {
4083 case HCI_FLOW_CTL_MODE_PACKET_BASED:
4084 hci_sched_acl_pkt(hdev);
4085 break;
4086
4087 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4088 hci_sched_acl_blk(hdev);
4089 break;
4090 }
4091 }
4092
4093 /* Schedule SCO */
4094 static void hci_sched_sco(struct hci_dev *hdev)
4095 {
4096 struct hci_conn *conn;
4097 struct sk_buff *skb;
4098 int quote;
4099
4100 BT_DBG("%s", hdev->name);
4101
4102 if (!hci_conn_num(hdev, SCO_LINK))
4103 return;
4104
4105 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
4106 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4107 BT_DBG("skb %p len %d", skb, skb->len);
4108 hci_send_frame(hdev, skb);
4109
4110 conn->sent++;
4111 if (conn->sent == ~0)
4112 conn->sent = 0;
4113 }
4114 }
4115 }
4116
4117 static void hci_sched_esco(struct hci_dev *hdev)
4118 {
4119 struct hci_conn *conn;
4120 struct sk_buff *skb;
4121 int quote;
4122
4123 BT_DBG("%s", hdev->name);
4124
4125 if (!hci_conn_num(hdev, ESCO_LINK))
4126 return;
4127
4128 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4129 &quote))) {
4130 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4131 BT_DBG("skb %p len %d", skb, skb->len);
4132 hci_send_frame(hdev, skb);
4133
4134 conn->sent++;
4135 if (conn->sent == ~0)
4136 conn->sent = 0;
4137 }
4138 }
4139 }
4140
4141 static void hci_sched_le(struct hci_dev *hdev)
4142 {
4143 struct hci_chan *chan;
4144 struct sk_buff *skb;
4145 int quote, cnt, tmp;
4146
4147 BT_DBG("%s", hdev->name);
4148
4149 if (!hci_conn_num(hdev, LE_LINK))
4150 return;
4151
4152 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
4153 /* LE tx timeout must be longer than maximum
4154 * link supervision timeout (40.9 seconds) */
4155 if (!hdev->le_cnt && hdev->le_pkts &&
4156 time_after(jiffies, hdev->le_last_tx + HZ * 45))
4157 hci_link_tx_to(hdev, LE_LINK);
4158 }
4159
4160 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
4161 tmp = cnt;
4162 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
4163 u32 priority = (skb_peek(&chan->data_q))->priority;
4164 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4165 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4166 skb->len, skb->priority);
4167
4168 /* Stop if priority has changed */
4169 if (skb->priority < priority)
4170 break;
4171
4172 skb = skb_dequeue(&chan->data_q);
4173
4174 hci_send_frame(hdev, skb);
4175 hdev->le_last_tx = jiffies;
4176
4177 cnt--;
4178 chan->sent++;
4179 chan->conn->sent++;
4180 }
4181 }
4182
4183 if (hdev->le_pkts)
4184 hdev->le_cnt = cnt;
4185 else
4186 hdev->acl_cnt = cnt;
4187
4188 if (cnt != tmp)
4189 hci_prio_recalculate(hdev, LE_LINK);
4190 }
4191
4192 static void hci_tx_work(struct work_struct *work)
4193 {
4194 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
4195 struct sk_buff *skb;
4196
4197 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
4198 hdev->sco_cnt, hdev->le_cnt);
4199
4200 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4201 /* Schedule queues and send stuff to HCI driver */
4202 hci_sched_acl(hdev);
4203 hci_sched_sco(hdev);
4204 hci_sched_esco(hdev);
4205 hci_sched_le(hdev);
4206 }
4207
4208 /* Send next queued raw (unknown type) packet */
4209 while ((skb = skb_dequeue(&hdev->raw_q)))
4210 hci_send_frame(hdev, skb);
4211 }
4212
4213 /* ----- HCI RX task (incoming data processing) ----- */
4214
4215 /* ACL data packet */
4216 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4217 {
4218 struct hci_acl_hdr *hdr = (void *) skb->data;
4219 struct hci_conn *conn;
4220 __u16 handle, flags;
4221
4222 skb_pull(skb, HCI_ACL_HDR_SIZE);
4223
4224 handle = __le16_to_cpu(hdr->handle);
4225 flags = hci_flags(handle);
4226 handle = hci_handle(handle);
4227
4228 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4229 handle, flags);
4230
4231 hdev->stat.acl_rx++;
4232
4233 hci_dev_lock(hdev);
4234 conn = hci_conn_hash_lookup_handle(hdev, handle);
4235 hci_dev_unlock(hdev);
4236
4237 if (conn) {
4238 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
4239
4240 /* Send to upper protocol */
4241 l2cap_recv_acldata(conn, skb, flags);
4242 return;
4243 } else {
4244 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
4245 handle);
4246 }
4247
4248 kfree_skb(skb);
4249 }
4250
4251 /* SCO data packet */
4252 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4253 {
4254 struct hci_sco_hdr *hdr = (void *) skb->data;
4255 struct hci_conn *conn;
4256 __u16 handle;
4257
4258 skb_pull(skb, HCI_SCO_HDR_SIZE);
4259
4260 handle = __le16_to_cpu(hdr->handle);
4261
4262 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
4263
4264 hdev->stat.sco_rx++;
4265
4266 hci_dev_lock(hdev);
4267 conn = hci_conn_hash_lookup_handle(hdev, handle);
4268 hci_dev_unlock(hdev);
4269
4270 if (conn) {
4271 /* Send to upper protocol */
4272 sco_recv_scodata(conn, skb);
4273 return;
4274 } else {
4275 bt_dev_err(hdev, "SCO packet for unknown connection handle %d",
4276 handle);
4277 }
4278
4279 kfree_skb(skb);
4280 }
4281
4282 static bool hci_req_is_complete(struct hci_dev *hdev)
4283 {
4284 struct sk_buff *skb;
4285
4286 skb = skb_peek(&hdev->cmd_q);
4287 if (!skb)
4288 return true;
4289
4290 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
4291 }
4292
4293 static void hci_resend_last(struct hci_dev *hdev)
4294 {
4295 struct hci_command_hdr *sent;
4296 struct sk_buff *skb;
4297 u16 opcode;
4298
4299 if (!hdev->sent_cmd)
4300 return;
4301
4302 sent = (void *) hdev->sent_cmd->data;
4303 opcode = __le16_to_cpu(sent->opcode);
4304 if (opcode == HCI_OP_RESET)
4305 return;
4306
4307 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4308 if (!skb)
4309 return;
4310
4311 skb_queue_head(&hdev->cmd_q, skb);
4312 queue_work(hdev->workqueue, &hdev->cmd_work);
4313 }
4314
4315 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4316 hci_req_complete_t *req_complete,
4317 hci_req_complete_skb_t *req_complete_skb)
4318 {
4319 struct sk_buff *skb;
4320 unsigned long flags;
4321
4322 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4323
4324 /* If the completed command doesn't match the last one that was
4325 * sent we need to do special handling of it.
4326 */
4327 if (!hci_sent_cmd_data(hdev, opcode)) {
4328 /* Some CSR based controllers generate a spontaneous
4329 * reset complete event during init and any pending
4330 * command will never be completed. In such a case we
4331 * need to resend whatever was the last sent
4332 * command.
4333 */
4334 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4335 hci_resend_last(hdev);
4336
4337 return;
4338 }
4339
4340 /* If the command succeeded and there's still more commands in
4341 * this request the request is not yet complete.
4342 */
4343 if (!status && !hci_req_is_complete(hdev))
4344 return;
4345
4346 /* If this was the last command in a request the complete
4347 * callback would be found in hdev->sent_cmd instead of the
4348 * command queue (hdev->cmd_q).
4349 */
4350 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4351 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
4352 return;
4353 }
4354
4355 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4356 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
4357 return;
4358 }
4359
4360 /* Remove all pending commands belonging to this request */
4361 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4362 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4363 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
4364 __skb_queue_head(&hdev->cmd_q, skb);
4365 break;
4366 }
4367
4368 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4369 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4370 else
4371 *req_complete = bt_cb(skb)->hci.req_complete;
4372 kfree_skb(skb);
4373 }
4374 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4375 }
4376
4377 static void hci_rx_work(struct work_struct *work)
4378 {
4379 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
4380 struct sk_buff *skb;
4381
4382 BT_DBG("%s", hdev->name);
4383
4384 while ((skb = skb_dequeue(&hdev->rx_q))) {
4385 /* Send copy to monitor */
4386 hci_send_to_monitor(hdev, skb);
4387
4388 if (atomic_read(&hdev->promisc)) {
4389 /* Send copy to the sockets */
4390 hci_send_to_sock(hdev, skb);
4391 }
4392
4393 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4394 kfree_skb(skb);
4395 continue;
4396 }
4397
4398 if (test_bit(HCI_INIT, &hdev->flags)) {
4399 /* Don't process data packets in this states. */
4400 switch (hci_skb_pkt_type(skb)) {
4401 case HCI_ACLDATA_PKT:
4402 case HCI_SCODATA_PKT:
4403 kfree_skb(skb);
4404 continue;
4405 }
4406 }
4407
4408 /* Process frame */
4409 switch (hci_skb_pkt_type(skb)) {
4410 case HCI_EVENT_PKT:
4411 BT_DBG("%s Event packet", hdev->name);
4412 hci_event_packet(hdev, skb);
4413 break;
4414
4415 case HCI_ACLDATA_PKT:
4416 BT_DBG("%s ACL data packet", hdev->name);
4417 hci_acldata_packet(hdev, skb);
4418 break;
4419
4420 case HCI_SCODATA_PKT:
4421 BT_DBG("%s SCO data packet", hdev->name);
4422 hci_scodata_packet(hdev, skb);
4423 break;
4424
4425 default:
4426 kfree_skb(skb);
4427 break;
4428 }
4429 }
4430 }
4431
4432 static void hci_cmd_work(struct work_struct *work)
4433 {
4434 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4435 struct sk_buff *skb;
4436
4437 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4438 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4439
4440 /* Send queued commands */
4441 if (atomic_read(&hdev->cmd_cnt)) {
4442 skb = skb_dequeue(&hdev->cmd_q);
4443 if (!skb)
4444 return;
4445
4446 kfree_skb(hdev->sent_cmd);
4447
4448 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4449 if (hdev->sent_cmd) {
4450 atomic_dec(&hdev->cmd_cnt);
4451 hci_send_frame(hdev, skb);
4452 if (test_bit(HCI_RESET, &hdev->flags))
4453 cancel_delayed_work(&hdev->cmd_timer);
4454 else
4455 schedule_delayed_work(&hdev->cmd_timer,
4456 HCI_CMD_TIMEOUT);
4457 } else {
4458 skb_queue_head(&hdev->cmd_q, skb);
4459 queue_work(hdev->workqueue, &hdev->cmd_work);
4460 }
4461 }
4462 }
Linux with added FPC-III support