1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 Copyright (C) 2011 ProFUSION Embedded Systems 5 6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 7 8 This program is free software; you can redistribute it and/or modify 9 it under the terms of the GNU General Public License version 2 as 10 published by the Free Software Foundation; 11 12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 20 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 23 SOFTWARE IS DISCLAIMED. 24 */ 25 26 /* Bluetooth HCI core. */ 27 28 #include <linux/export.h> 29 #include <linux/idr.h> 30 #include <linux/rfkill.h> 31 #include <linux/debugfs.h> 32 #include <linux/crypto.h> 33 #include <asm/unaligned.h> 34 35 #include <net/bluetooth/bluetooth.h> 36 #include <net/bluetooth/hci_core.h> 37 #include <net/bluetooth/l2cap.h> 38 #include <net/bluetooth/mgmt.h> 39 40 #include "hci_request.h" 41 #include "hci_debugfs.h" 42 #include "smp.h" 43 44 static void hci_rx_work(struct work_struct *work); 45 static void hci_cmd_work(struct work_struct *work); 46 static void hci_tx_work(struct work_struct *work); 47 48 /* HCI device list */ 49 LIST_HEAD(hci_dev_list); 50 DEFINE_RWLOCK(hci_dev_list_lock); 51 52 /* HCI callback list */ 53 LIST_HEAD(hci_cb_list); 54 DEFINE_MUTEX(hci_cb_list_lock); 55 56 /* HCI ID Numbering */ 57 static DEFINE_IDA(hci_index_ida); 58 59 /* ----- HCI requests ----- */ 60 61 #define HCI_REQ_DONE 0 62 #define HCI_REQ_PEND 1 63 #define HCI_REQ_CANCELED 2 64 65 #define hci_req_lock(d) mutex_lock(&d->req_lock) 66 #define hci_req_unlock(d) mutex_unlock(&d->req_lock) 67 68 /* ---- HCI debugfs entries ---- */ 69 70 static ssize_t dut_mode_read(struct file *file, char __user *user_buf, 71 size_t count, loff_t *ppos) 72 { 73 struct hci_dev *hdev = file->private_data; 74 char buf[3]; 75 76 buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y': 'N'; 77 buf[1] = '\n'; 78 buf[2] = '\0'; 79 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 80 } 81 82 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf, 83 size_t count, loff_t *ppos) 84 { 85 struct hci_dev *hdev = file->private_data; 86 struct sk_buff *skb; 87 char buf[32]; 88 size_t buf_size = min(count, (sizeof(buf)-1)); 89 bool enable; 90 91 if (!test_bit(HCI_UP, &hdev->flags)) 92 return -ENETDOWN; 93 94 if (copy_from_user(buf, user_buf, buf_size)) 95 return -EFAULT; 96 97 buf[buf_size] = '\0'; 98 if (strtobool(buf, &enable)) 99 return -EINVAL; 100 101 if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE)) 102 return -EALREADY; 103 104 hci_req_lock(hdev); 105 if (enable) 106 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL, 107 HCI_CMD_TIMEOUT); 108 else 109 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL, 110 HCI_CMD_TIMEOUT); 111 hci_req_unlock(hdev); 112 113 if (IS_ERR(skb)) 114 return PTR_ERR(skb); 115 116 kfree_skb(skb); 117 118 hci_dev_change_flag(hdev, HCI_DUT_MODE); 119 120 return count; 121 } 122 123 static const struct file_operations dut_mode_fops = { 124 .open = simple_open, 125 .read = dut_mode_read, 126 .write = dut_mode_write, 127 .llseek = default_llseek, 128 }; 129 130 static ssize_t vendor_diag_read(struct file *file, char __user *user_buf, 131 size_t count, loff_t *ppos) 132 { 133 struct hci_dev *hdev = file->private_data; 134 char buf[3]; 135 136 buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y': 'N'; 137 buf[1] = '\n'; 138 buf[2] = '\0'; 139 return simple_read_from_buffer(user_buf, count, ppos, buf, 2); 140 } 141 142 static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf, 143 size_t count, loff_t *ppos) 144 { 145 struct hci_dev *hdev = file->private_data; 146 char buf[32]; 147 size_t buf_size = min(count, (sizeof(buf)-1)); 148 bool enable; 149 int err; 150 151 if (copy_from_user(buf, user_buf, buf_size)) 152 return -EFAULT; 153 154 buf[buf_size] = '\0'; 155 if (strtobool(buf, &enable)) 156 return -EINVAL; 157 158 /* When the diagnostic flags are not persistent and the transport 159 * is not active, then there is no need for the vendor callback. 160 * 161 * Instead just store the desired value. If needed the setting 162 * will be programmed when the controller gets powered on. 163 */ 164 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) && 165 !test_bit(HCI_RUNNING, &hdev->flags)) 166 goto done; 167 168 hci_req_lock(hdev); 169 err = hdev->set_diag(hdev, enable); 170 hci_req_unlock(hdev); 171 172 if (err < 0) 173 return err; 174 175 done: 176 if (enable) 177 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG); 178 else 179 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG); 180 181 return count; 182 } 183 184 static const struct file_operations vendor_diag_fops = { 185 .open = simple_open, 186 .read = vendor_diag_read, 187 .write = vendor_diag_write, 188 .llseek = default_llseek, 189 }; 190 191 static void hci_debugfs_create_basic(struct hci_dev *hdev) 192 { 193 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev, 194 &dut_mode_fops); 195 196 if (hdev->set_diag) 197 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev, 198 &vendor_diag_fops); 199 } 200 201 /* ---- HCI requests ---- */ 202 203 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode, 204 struct sk_buff *skb) 205 { 206 BT_DBG("%s result 0x%2.2x", hdev->name, result); 207 208 if (hdev->req_status == HCI_REQ_PEND) { 209 hdev->req_result = result; 210 hdev->req_status = HCI_REQ_DONE; 211 if (skb) 212 hdev->req_skb = skb_get(skb); 213 wake_up_interruptible(&hdev->req_wait_q); 214 } 215 } 216 217 static void hci_req_cancel(struct hci_dev *hdev, int err) 218 { 219 BT_DBG("%s err 0x%2.2x", hdev->name, err); 220 221 if (hdev->req_status == HCI_REQ_PEND) { 222 hdev->req_result = err; 223 hdev->req_status = HCI_REQ_CANCELED; 224 wake_up_interruptible(&hdev->req_wait_q); 225 } 226 } 227 228 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen, 229 const void *param, u8 event, u32 timeout) 230 { 231 DECLARE_WAITQUEUE(wait, current); 232 struct hci_request req; 233 struct sk_buff *skb; 234 int err = 0; 235 236 BT_DBG("%s", hdev->name); 237 238 hci_req_init(&req, hdev); 239 240 hci_req_add_ev(&req, opcode, plen, param, event); 241 242 hdev->req_status = HCI_REQ_PEND; 243 244 add_wait_queue(&hdev->req_wait_q, &wait); 245 set_current_state(TASK_INTERRUPTIBLE); 246 247 err = hci_req_run_skb(&req, hci_req_sync_complete); 248 if (err < 0) { 249 remove_wait_queue(&hdev->req_wait_q, &wait); 250 set_current_state(TASK_RUNNING); 251 return ERR_PTR(err); 252 } 253 254 schedule_timeout(timeout); 255 256 remove_wait_queue(&hdev->req_wait_q, &wait); 257 258 if (signal_pending(current)) 259 return ERR_PTR(-EINTR); 260 261 switch (hdev->req_status) { 262 case HCI_REQ_DONE: 263 err = -bt_to_errno(hdev->req_result); 264 break; 265 266 case HCI_REQ_CANCELED: 267 err = -hdev->req_result; 268 break; 269 270 default: 271 err = -ETIMEDOUT; 272 break; 273 } 274 275 hdev->req_status = hdev->req_result = 0; 276 skb = hdev->req_skb; 277 hdev->req_skb = NULL; 278 279 BT_DBG("%s end: err %d", hdev->name, err); 280 281 if (err < 0) { 282 kfree_skb(skb); 283 return ERR_PTR(err); 284 } 285 286 if (!skb) 287 return ERR_PTR(-ENODATA); 288 289 return skb; 290 } 291 EXPORT_SYMBOL(__hci_cmd_sync_ev); 292 293 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen, 294 const void *param, u32 timeout) 295 { 296 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout); 297 } 298 EXPORT_SYMBOL(__hci_cmd_sync); 299 300 /* Execute request and wait for completion. */ 301 static int __hci_req_sync(struct hci_dev *hdev, 302 void (*func)(struct hci_request *req, 303 unsigned long opt), 304 unsigned long opt, __u32 timeout) 305 { 306 struct hci_request req; 307 DECLARE_WAITQUEUE(wait, current); 308 int err = 0; 309 310 BT_DBG("%s start", hdev->name); 311 312 hci_req_init(&req, hdev); 313 314 hdev->req_status = HCI_REQ_PEND; 315 316 func(&req, opt); 317 318 add_wait_queue(&hdev->req_wait_q, &wait); 319 set_current_state(TASK_INTERRUPTIBLE); 320 321 err = hci_req_run_skb(&req, hci_req_sync_complete); 322 if (err < 0) { 323 hdev->req_status = 0; 324 325 remove_wait_queue(&hdev->req_wait_q, &wait); 326 set_current_state(TASK_RUNNING); 327 328 /* ENODATA means the HCI request command queue is empty. 329 * This can happen when a request with conditionals doesn't 330 * trigger any commands to be sent. This is normal behavior 331 * and should not trigger an error return. 332 */ 333 if (err == -ENODATA) 334 return 0; 335 336 return err; 337 } 338 339 schedule_timeout(timeout); 340 341 remove_wait_queue(&hdev->req_wait_q, &wait); 342 343 if (signal_pending(current)) 344 return -EINTR; 345 346 switch (hdev->req_status) { 347 case HCI_REQ_DONE: 348 err = -bt_to_errno(hdev->req_result); 349 break; 350 351 case HCI_REQ_CANCELED: 352 err = -hdev->req_result; 353 break; 354 355 default: 356 err = -ETIMEDOUT; 357 break; 358 } 359 360 hdev->req_status = hdev->req_result = 0; 361 362 BT_DBG("%s end: err %d", hdev->name, err); 363 364 return err; 365 } 366 367 static int hci_req_sync(struct hci_dev *hdev, 368 void (*req)(struct hci_request *req, 369 unsigned long opt), 370 unsigned long opt, __u32 timeout) 371 { 372 int ret; 373 374 if (!test_bit(HCI_UP, &hdev->flags)) 375 return -ENETDOWN; 376 377 /* Serialize all requests */ 378 hci_req_lock(hdev); 379 ret = __hci_req_sync(hdev, req, opt, timeout); 380 hci_req_unlock(hdev); 381 382 return ret; 383 } 384 385 static void hci_reset_req(struct hci_request *req, unsigned long opt) 386 { 387 BT_DBG("%s %ld", req->hdev->name, opt); 388 389 /* Reset device */ 390 set_bit(HCI_RESET, &req->hdev->flags); 391 hci_req_add(req, HCI_OP_RESET, 0, NULL); 392 } 393 394 static void bredr_init(struct hci_request *req) 395 { 396 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED; 397 398 /* Read Local Supported Features */ 399 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL); 400 401 /* Read Local Version */ 402 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL); 403 404 /* Read BD Address */ 405 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL); 406 } 407 408 static void amp_init1(struct hci_request *req) 409 { 410 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED; 411 412 /* Read Local Version */ 413 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL); 414 415 /* Read Local Supported Commands */ 416 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL); 417 418 /* Read Local AMP Info */ 419 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL); 420 421 /* Read Data Blk size */ 422 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL); 423 424 /* Read Flow Control Mode */ 425 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL); 426 427 /* Read Location Data */ 428 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL); 429 } 430 431 static void amp_init2(struct hci_request *req) 432 { 433 /* Read Local Supported Features. Not all AMP controllers 434 * support this so it's placed conditionally in the second 435 * stage init. 436 */ 437 if (req->hdev->commands[14] & 0x20) 438 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL); 439 } 440 441 static void hci_init1_req(struct hci_request *req, unsigned long opt) 442 { 443 struct hci_dev *hdev = req->hdev; 444 445 BT_DBG("%s %ld", hdev->name, opt); 446 447 /* Reset */ 448 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) 449 hci_reset_req(req, 0); 450 451 switch (hdev->dev_type) { 452 case HCI_BREDR: 453 bredr_init(req); 454 break; 455 456 case HCI_AMP: 457 amp_init1(req); 458 break; 459 460 default: 461 BT_ERR("Unknown device type %d", hdev->dev_type); 462 break; 463 } 464 } 465 466 static void bredr_setup(struct hci_request *req) 467 { 468 __le16 param; 469 __u8 flt_type; 470 471 /* Read Buffer Size (ACL mtu, max pkt, etc.) */ 472 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL); 473 474 /* Read Class of Device */ 475 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL); 476 477 /* Read Local Name */ 478 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL); 479 480 /* Read Voice Setting */ 481 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL); 482 483 /* Read Number of Supported IAC */ 484 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL); 485 486 /* Read Current IAC LAP */ 487 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL); 488 489 /* Clear Event Filters */ 490 flt_type = HCI_FLT_CLEAR_ALL; 491 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type); 492 493 /* Connection accept timeout ~20 secs */ 494 param = cpu_to_le16(0x7d00); 495 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, ¶m); 496 } 497 498 static void le_setup(struct hci_request *req) 499 { 500 struct hci_dev *hdev = req->hdev; 501 502 /* Read LE Buffer Size */ 503 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL); 504 505 /* Read LE Local Supported Features */ 506 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL); 507 508 /* Read LE Supported States */ 509 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL); 510 511 /* Read LE White List Size */ 512 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL); 513 514 /* Clear LE White List */ 515 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL); 516 517 /* LE-only controllers have LE implicitly enabled */ 518 if (!lmp_bredr_capable(hdev)) 519 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 520 } 521 522 static void hci_setup_event_mask(struct hci_request *req) 523 { 524 struct hci_dev *hdev = req->hdev; 525 526 /* The second byte is 0xff instead of 0x9f (two reserved bits 527 * disabled) since a Broadcom 1.2 dongle doesn't respond to the 528 * command otherwise. 529 */ 530 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 }; 531 532 /* CSR 1.1 dongles does not accept any bitfield so don't try to set 533 * any event mask for pre 1.2 devices. 534 */ 535 if (hdev->hci_ver < BLUETOOTH_VER_1_2) 536 return; 537 538 if (lmp_bredr_capable(hdev)) { 539 events[4] |= 0x01; /* Flow Specification Complete */ 540 events[4] |= 0x02; /* Inquiry Result with RSSI */ 541 events[4] |= 0x04; /* Read Remote Extended Features Complete */ 542 events[5] |= 0x08; /* Synchronous Connection Complete */ 543 events[5] |= 0x10; /* Synchronous Connection Changed */ 544 } else { 545 /* Use a different default for LE-only devices */ 546 memset(events, 0, sizeof(events)); 547 events[0] |= 0x10; /* Disconnection Complete */ 548 events[1] |= 0x08; /* Read Remote Version Information Complete */ 549 events[1] |= 0x20; /* Command Complete */ 550 events[1] |= 0x40; /* Command Status */ 551 events[1] |= 0x80; /* Hardware Error */ 552 events[2] |= 0x04; /* Number of Completed Packets */ 553 events[3] |= 0x02; /* Data Buffer Overflow */ 554 555 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) { 556 events[0] |= 0x80; /* Encryption Change */ 557 events[5] |= 0x80; /* Encryption Key Refresh Complete */ 558 } 559 } 560 561 if (lmp_inq_rssi_capable(hdev)) 562 events[4] |= 0x02; /* Inquiry Result with RSSI */ 563 564 if (lmp_sniffsubr_capable(hdev)) 565 events[5] |= 0x20; /* Sniff Subrating */ 566 567 if (lmp_pause_enc_capable(hdev)) 568 events[5] |= 0x80; /* Encryption Key Refresh Complete */ 569 570 if (lmp_ext_inq_capable(hdev)) 571 events[5] |= 0x40; /* Extended Inquiry Result */ 572 573 if (lmp_no_flush_capable(hdev)) 574 events[7] |= 0x01; /* Enhanced Flush Complete */ 575 576 if (lmp_lsto_capable(hdev)) 577 events[6] |= 0x80; /* Link Supervision Timeout Changed */ 578 579 if (lmp_ssp_capable(hdev)) { 580 events[6] |= 0x01; /* IO Capability Request */ 581 events[6] |= 0x02; /* IO Capability Response */ 582 events[6] |= 0x04; /* User Confirmation Request */ 583 events[6] |= 0x08; /* User Passkey Request */ 584 events[6] |= 0x10; /* Remote OOB Data Request */ 585 events[6] |= 0x20; /* Simple Pairing Complete */ 586 events[7] |= 0x04; /* User Passkey Notification */ 587 events[7] |= 0x08; /* Keypress Notification */ 588 events[7] |= 0x10; /* Remote Host Supported 589 * Features Notification 590 */ 591 } 592 593 if (lmp_le_capable(hdev)) 594 events[7] |= 0x20; /* LE Meta-Event */ 595 596 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events); 597 } 598 599 static void hci_init2_req(struct hci_request *req, unsigned long opt) 600 { 601 struct hci_dev *hdev = req->hdev; 602 603 if (hdev->dev_type == HCI_AMP) 604 return amp_init2(req); 605 606 if (lmp_bredr_capable(hdev)) 607 bredr_setup(req); 608 else 609 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 610 611 if (lmp_le_capable(hdev)) 612 le_setup(req); 613 614 /* All Bluetooth 1.2 and later controllers should support the 615 * HCI command for reading the local supported commands. 616 * 617 * Unfortunately some controllers indicate Bluetooth 1.2 support, 618 * but do not have support for this command. If that is the case, 619 * the driver can quirk the behavior and skip reading the local 620 * supported commands. 621 */ 622 if (hdev->hci_ver > BLUETOOTH_VER_1_1 && 623 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks)) 624 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL); 625 626 if (lmp_ssp_capable(hdev)) { 627 /* When SSP is available, then the host features page 628 * should also be available as well. However some 629 * controllers list the max_page as 0 as long as SSP 630 * has not been enabled. To achieve proper debugging 631 * output, force the minimum max_page to 1 at least. 632 */ 633 hdev->max_page = 0x01; 634 635 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) { 636 u8 mode = 0x01; 637 638 hci_req_add(req, HCI_OP_WRITE_SSP_MODE, 639 sizeof(mode), &mode); 640 } else { 641 struct hci_cp_write_eir cp; 642 643 memset(hdev->eir, 0, sizeof(hdev->eir)); 644 memset(&cp, 0, sizeof(cp)); 645 646 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp); 647 } 648 } 649 650 if (lmp_inq_rssi_capable(hdev) || 651 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) { 652 u8 mode; 653 654 /* If Extended Inquiry Result events are supported, then 655 * they are clearly preferred over Inquiry Result with RSSI 656 * events. 657 */ 658 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01; 659 660 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode); 661 } 662 663 if (lmp_inq_tx_pwr_capable(hdev)) 664 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL); 665 666 if (lmp_ext_feat_capable(hdev)) { 667 struct hci_cp_read_local_ext_features cp; 668 669 cp.page = 0x01; 670 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES, 671 sizeof(cp), &cp); 672 } 673 674 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) { 675 u8 enable = 1; 676 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable), 677 &enable); 678 } 679 } 680 681 static void hci_setup_link_policy(struct hci_request *req) 682 { 683 struct hci_dev *hdev = req->hdev; 684 struct hci_cp_write_def_link_policy cp; 685 u16 link_policy = 0; 686 687 if (lmp_rswitch_capable(hdev)) 688 link_policy |= HCI_LP_RSWITCH; 689 if (lmp_hold_capable(hdev)) 690 link_policy |= HCI_LP_HOLD; 691 if (lmp_sniff_capable(hdev)) 692 link_policy |= HCI_LP_SNIFF; 693 if (lmp_park_capable(hdev)) 694 link_policy |= HCI_LP_PARK; 695 696 cp.policy = cpu_to_le16(link_policy); 697 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp); 698 } 699 700 static void hci_set_le_support(struct hci_request *req) 701 { 702 struct hci_dev *hdev = req->hdev; 703 struct hci_cp_write_le_host_supported cp; 704 705 /* LE-only devices do not support explicit enablement */ 706 if (!lmp_bredr_capable(hdev)) 707 return; 708 709 memset(&cp, 0, sizeof(cp)); 710 711 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 712 cp.le = 0x01; 713 cp.simul = 0x00; 714 } 715 716 if (cp.le != lmp_host_le_capable(hdev)) 717 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp), 718 &cp); 719 } 720 721 static void hci_set_event_mask_page_2(struct hci_request *req) 722 { 723 struct hci_dev *hdev = req->hdev; 724 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 725 726 /* If Connectionless Slave Broadcast master role is supported 727 * enable all necessary events for it. 728 */ 729 if (lmp_csb_master_capable(hdev)) { 730 events[1] |= 0x40; /* Triggered Clock Capture */ 731 events[1] |= 0x80; /* Synchronization Train Complete */ 732 events[2] |= 0x10; /* Slave Page Response Timeout */ 733 events[2] |= 0x20; /* CSB Channel Map Change */ 734 } 735 736 /* If Connectionless Slave Broadcast slave role is supported 737 * enable all necessary events for it. 738 */ 739 if (lmp_csb_slave_capable(hdev)) { 740 events[2] |= 0x01; /* Synchronization Train Received */ 741 events[2] |= 0x02; /* CSB Receive */ 742 events[2] |= 0x04; /* CSB Timeout */ 743 events[2] |= 0x08; /* Truncated Page Complete */ 744 } 745 746 /* Enable Authenticated Payload Timeout Expired event if supported */ 747 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) 748 events[2] |= 0x80; 749 750 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events); 751 } 752 753 static void hci_init3_req(struct hci_request *req, unsigned long opt) 754 { 755 struct hci_dev *hdev = req->hdev; 756 u8 p; 757 758 hci_setup_event_mask(req); 759 760 if (hdev->commands[6] & 0x20 && 761 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) { 762 struct hci_cp_read_stored_link_key cp; 763 764 bacpy(&cp.bdaddr, BDADDR_ANY); 765 cp.read_all = 0x01; 766 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp); 767 } 768 769 if (hdev->commands[5] & 0x10) 770 hci_setup_link_policy(req); 771 772 if (hdev->commands[8] & 0x01) 773 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL); 774 775 /* Some older Broadcom based Bluetooth 1.2 controllers do not 776 * support the Read Page Scan Type command. Check support for 777 * this command in the bit mask of supported commands. 778 */ 779 if (hdev->commands[13] & 0x01) 780 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL); 781 782 if (lmp_le_capable(hdev)) { 783 u8 events[8]; 784 785 memset(events, 0, sizeof(events)); 786 events[0] = 0x0f; 787 788 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) 789 events[0] |= 0x10; /* LE Long Term Key Request */ 790 791 /* If controller supports the Connection Parameters Request 792 * Link Layer Procedure, enable the corresponding event. 793 */ 794 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC) 795 events[0] |= 0x20; /* LE Remote Connection 796 * Parameter Request 797 */ 798 799 /* If the controller supports the Data Length Extension 800 * feature, enable the corresponding event. 801 */ 802 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) 803 events[0] |= 0x40; /* LE Data Length Change */ 804 805 /* If the controller supports Extended Scanner Filter 806 * Policies, enable the correspondig event. 807 */ 808 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY) 809 events[1] |= 0x04; /* LE Direct Advertising 810 * Report 811 */ 812 813 /* If the controller supports the LE Read Local P-256 814 * Public Key command, enable the corresponding event. 815 */ 816 if (hdev->commands[34] & 0x02) 817 events[0] |= 0x80; /* LE Read Local P-256 818 * Public Key Complete 819 */ 820 821 /* If the controller supports the LE Generate DHKey 822 * command, enable the corresponding event. 823 */ 824 if (hdev->commands[34] & 0x04) 825 events[1] |= 0x01; /* LE Generate DHKey Complete */ 826 827 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events), 828 events); 829 830 if (hdev->commands[25] & 0x40) { 831 /* Read LE Advertising Channel TX Power */ 832 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL); 833 } 834 835 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) { 836 /* Read LE Maximum Data Length */ 837 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL); 838 839 /* Read LE Suggested Default Data Length */ 840 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL); 841 } 842 843 hci_set_le_support(req); 844 } 845 846 /* Read features beyond page 1 if available */ 847 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) { 848 struct hci_cp_read_local_ext_features cp; 849 850 cp.page = p; 851 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES, 852 sizeof(cp), &cp); 853 } 854 } 855 856 static void hci_init4_req(struct hci_request *req, unsigned long opt) 857 { 858 struct hci_dev *hdev = req->hdev; 859 860 /* Some Broadcom based Bluetooth controllers do not support the 861 * Delete Stored Link Key command. They are clearly indicating its 862 * absence in the bit mask of supported commands. 863 * 864 * Check the supported commands and only if the the command is marked 865 * as supported send it. If not supported assume that the controller 866 * does not have actual support for stored link keys which makes this 867 * command redundant anyway. 868 * 869 * Some controllers indicate that they support handling deleting 870 * stored link keys, but they don't. The quirk lets a driver 871 * just disable this command. 872 */ 873 if (hdev->commands[6] & 0x80 && 874 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) { 875 struct hci_cp_delete_stored_link_key cp; 876 877 bacpy(&cp.bdaddr, BDADDR_ANY); 878 cp.delete_all = 0x01; 879 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY, 880 sizeof(cp), &cp); 881 } 882 883 /* Set event mask page 2 if the HCI command for it is supported */ 884 if (hdev->commands[22] & 0x04) 885 hci_set_event_mask_page_2(req); 886 887 /* Read local codec list if the HCI command is supported */ 888 if (hdev->commands[29] & 0x20) 889 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL); 890 891 /* Get MWS transport configuration if the HCI command is supported */ 892 if (hdev->commands[30] & 0x08) 893 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL); 894 895 /* Check for Synchronization Train support */ 896 if (lmp_sync_train_capable(hdev)) 897 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL); 898 899 /* Enable Secure Connections if supported and configured */ 900 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) && 901 bredr_sc_enabled(hdev)) { 902 u8 support = 0x01; 903 904 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT, 905 sizeof(support), &support); 906 } 907 } 908 909 static int __hci_init(struct hci_dev *hdev) 910 { 911 int err; 912 913 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT); 914 if (err < 0) 915 return err; 916 917 if (hci_dev_test_flag(hdev, HCI_SETUP)) 918 hci_debugfs_create_basic(hdev); 919 920 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT); 921 if (err < 0) 922 return err; 923 924 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode 925 * BR/EDR/LE type controllers. AMP controllers only need the 926 * first two stages of init. 927 */ 928 if (hdev->dev_type != HCI_BREDR) 929 return 0; 930 931 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT); 932 if (err < 0) 933 return err; 934 935 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT); 936 if (err < 0) 937 return err; 938 939 /* This function is only called when the controller is actually in 940 * configured state. When the controller is marked as unconfigured, 941 * this initialization procedure is not run. 942 * 943 * It means that it is possible that a controller runs through its 944 * setup phase and then discovers missing settings. If that is the 945 * case, then this function will not be called. It then will only 946 * be called during the config phase. 947 * 948 * So only when in setup phase or config phase, create the debugfs 949 * entries and register the SMP channels. 950 */ 951 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 952 !hci_dev_test_flag(hdev, HCI_CONFIG)) 953 return 0; 954 955 hci_debugfs_create_common(hdev); 956 957 if (lmp_bredr_capable(hdev)) 958 hci_debugfs_create_bredr(hdev); 959 960 if (lmp_le_capable(hdev)) 961 hci_debugfs_create_le(hdev); 962 963 return 0; 964 } 965 966 static void hci_init0_req(struct hci_request *req, unsigned long opt) 967 { 968 struct hci_dev *hdev = req->hdev; 969 970 BT_DBG("%s %ld", hdev->name, opt); 971 972 /* Reset */ 973 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) 974 hci_reset_req(req, 0); 975 976 /* Read Local Version */ 977 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL); 978 979 /* Read BD Address */ 980 if (hdev->set_bdaddr) 981 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL); 982 } 983 984 static int __hci_unconf_init(struct hci_dev *hdev) 985 { 986 int err; 987 988 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 989 return 0; 990 991 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT); 992 if (err < 0) 993 return err; 994 995 if (hci_dev_test_flag(hdev, HCI_SETUP)) 996 hci_debugfs_create_basic(hdev); 997 998 return 0; 999 } 1000 1001 static void hci_scan_req(struct hci_request *req, unsigned long opt) 1002 { 1003 __u8 scan = opt; 1004 1005 BT_DBG("%s %x", req->hdev->name, scan); 1006 1007 /* Inquiry and Page scans */ 1008 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 1009 } 1010 1011 static void hci_auth_req(struct hci_request *req, unsigned long opt) 1012 { 1013 __u8 auth = opt; 1014 1015 BT_DBG("%s %x", req->hdev->name, auth); 1016 1017 /* Authentication */ 1018 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth); 1019 } 1020 1021 static void hci_encrypt_req(struct hci_request *req, unsigned long opt) 1022 { 1023 __u8 encrypt = opt; 1024 1025 BT_DBG("%s %x", req->hdev->name, encrypt); 1026 1027 /* Encryption */ 1028 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt); 1029 } 1030 1031 static void hci_linkpol_req(struct hci_request *req, unsigned long opt) 1032 { 1033 __le16 policy = cpu_to_le16(opt); 1034 1035 BT_DBG("%s %x", req->hdev->name, policy); 1036 1037 /* Default link policy */ 1038 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy); 1039 } 1040 1041 /* Get HCI device by index. 1042 * Device is held on return. */ 1043 struct hci_dev *hci_dev_get(int index) 1044 { 1045 struct hci_dev *hdev = NULL, *d; 1046 1047 BT_DBG("%d", index); 1048 1049 if (index < 0) 1050 return NULL; 1051 1052 read_lock(&hci_dev_list_lock); 1053 list_for_each_entry(d, &hci_dev_list, list) { 1054 if (d->id == index) { 1055 hdev = hci_dev_hold(d); 1056 break; 1057 } 1058 } 1059 read_unlock(&hci_dev_list_lock); 1060 return hdev; 1061 } 1062 1063 /* ---- Inquiry support ---- */ 1064 1065 bool hci_discovery_active(struct hci_dev *hdev) 1066 { 1067 struct discovery_state *discov = &hdev->discovery; 1068 1069 switch (discov->state) { 1070 case DISCOVERY_FINDING: 1071 case DISCOVERY_RESOLVING: 1072 return true; 1073 1074 default: 1075 return false; 1076 } 1077 } 1078 1079 void hci_discovery_set_state(struct hci_dev *hdev, int state) 1080 { 1081 int old_state = hdev->discovery.state; 1082 1083 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state); 1084 1085 if (old_state == state) 1086 return; 1087 1088 hdev->discovery.state = state; 1089 1090 switch (state) { 1091 case DISCOVERY_STOPPED: 1092 hci_update_background_scan(hdev); 1093 1094 if (old_state != DISCOVERY_STARTING) 1095 mgmt_discovering(hdev, 0); 1096 break; 1097 case DISCOVERY_STARTING: 1098 break; 1099 case DISCOVERY_FINDING: 1100 mgmt_discovering(hdev, 1); 1101 break; 1102 case DISCOVERY_RESOLVING: 1103 break; 1104 case DISCOVERY_STOPPING: 1105 break; 1106 } 1107 } 1108 1109 void hci_inquiry_cache_flush(struct hci_dev *hdev) 1110 { 1111 struct discovery_state *cache = &hdev->discovery; 1112 struct inquiry_entry *p, *n; 1113 1114 list_for_each_entry_safe(p, n, &cache->all, all) { 1115 list_del(&p->all); 1116 kfree(p); 1117 } 1118 1119 INIT_LIST_HEAD(&cache->unknown); 1120 INIT_LIST_HEAD(&cache->resolve); 1121 } 1122 1123 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, 1124 bdaddr_t *bdaddr) 1125 { 1126 struct discovery_state *cache = &hdev->discovery; 1127 struct inquiry_entry *e; 1128 1129 BT_DBG("cache %p, %pMR", cache, bdaddr); 1130 1131 list_for_each_entry(e, &cache->all, all) { 1132 if (!bacmp(&e->data.bdaddr, bdaddr)) 1133 return e; 1134 } 1135 1136 return NULL; 1137 } 1138 1139 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev, 1140 bdaddr_t *bdaddr) 1141 { 1142 struct discovery_state *cache = &hdev->discovery; 1143 struct inquiry_entry *e; 1144 1145 BT_DBG("cache %p, %pMR", cache, bdaddr); 1146 1147 list_for_each_entry(e, &cache->unknown, list) { 1148 if (!bacmp(&e->data.bdaddr, bdaddr)) 1149 return e; 1150 } 1151 1152 return NULL; 1153 } 1154 1155 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev, 1156 bdaddr_t *bdaddr, 1157 int state) 1158 { 1159 struct discovery_state *cache = &hdev->discovery; 1160 struct inquiry_entry *e; 1161 1162 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state); 1163 1164 list_for_each_entry(e, &cache->resolve, list) { 1165 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state) 1166 return e; 1167 if (!bacmp(&e->data.bdaddr, bdaddr)) 1168 return e; 1169 } 1170 1171 return NULL; 1172 } 1173 1174 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev, 1175 struct inquiry_entry *ie) 1176 { 1177 struct discovery_state *cache = &hdev->discovery; 1178 struct list_head *pos = &cache->resolve; 1179 struct inquiry_entry *p; 1180 1181 list_del(&ie->list); 1182 1183 list_for_each_entry(p, &cache->resolve, list) { 1184 if (p->name_state != NAME_PENDING && 1185 abs(p->data.rssi) >= abs(ie->data.rssi)) 1186 break; 1187 pos = &p->list; 1188 } 1189 1190 list_add(&ie->list, pos); 1191 } 1192 1193 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data, 1194 bool name_known) 1195 { 1196 struct discovery_state *cache = &hdev->discovery; 1197 struct inquiry_entry *ie; 1198 u32 flags = 0; 1199 1200 BT_DBG("cache %p, %pMR", cache, &data->bdaddr); 1201 1202 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR); 1203 1204 if (!data->ssp_mode) 1205 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING; 1206 1207 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr); 1208 if (ie) { 1209 if (!ie->data.ssp_mode) 1210 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING; 1211 1212 if (ie->name_state == NAME_NEEDED && 1213 data->rssi != ie->data.rssi) { 1214 ie->data.rssi = data->rssi; 1215 hci_inquiry_cache_update_resolve(hdev, ie); 1216 } 1217 1218 goto update; 1219 } 1220 1221 /* Entry not in the cache. Add new one. */ 1222 ie = kzalloc(sizeof(*ie), GFP_KERNEL); 1223 if (!ie) { 1224 flags |= MGMT_DEV_FOUND_CONFIRM_NAME; 1225 goto done; 1226 } 1227 1228 list_add(&ie->all, &cache->all); 1229 1230 if (name_known) { 1231 ie->name_state = NAME_KNOWN; 1232 } else { 1233 ie->name_state = NAME_NOT_KNOWN; 1234 list_add(&ie->list, &cache->unknown); 1235 } 1236 1237 update: 1238 if (name_known && ie->name_state != NAME_KNOWN && 1239 ie->name_state != NAME_PENDING) { 1240 ie->name_state = NAME_KNOWN; 1241 list_del(&ie->list); 1242 } 1243 1244 memcpy(&ie->data, data, sizeof(*data)); 1245 ie->timestamp = jiffies; 1246 cache->timestamp = jiffies; 1247 1248 if (ie->name_state == NAME_NOT_KNOWN) 1249 flags |= MGMT_DEV_FOUND_CONFIRM_NAME; 1250 1251 done: 1252 return flags; 1253 } 1254 1255 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf) 1256 { 1257 struct discovery_state *cache = &hdev->discovery; 1258 struct inquiry_info *info = (struct inquiry_info *) buf; 1259 struct inquiry_entry *e; 1260 int copied = 0; 1261 1262 list_for_each_entry(e, &cache->all, all) { 1263 struct inquiry_data *data = &e->data; 1264 1265 if (copied >= num) 1266 break; 1267 1268 bacpy(&info->bdaddr, &data->bdaddr); 1269 info->pscan_rep_mode = data->pscan_rep_mode; 1270 info->pscan_period_mode = data->pscan_period_mode; 1271 info->pscan_mode = data->pscan_mode; 1272 memcpy(info->dev_class, data->dev_class, 3); 1273 info->clock_offset = data->clock_offset; 1274 1275 info++; 1276 copied++; 1277 } 1278 1279 BT_DBG("cache %p, copied %d", cache, copied); 1280 return copied; 1281 } 1282 1283 static void hci_inq_req(struct hci_request *req, unsigned long opt) 1284 { 1285 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt; 1286 struct hci_dev *hdev = req->hdev; 1287 struct hci_cp_inquiry cp; 1288 1289 BT_DBG("%s", hdev->name); 1290 1291 if (test_bit(HCI_INQUIRY, &hdev->flags)) 1292 return; 1293 1294 /* Start Inquiry */ 1295 memcpy(&cp.lap, &ir->lap, 3); 1296 cp.length = ir->length; 1297 cp.num_rsp = ir->num_rsp; 1298 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp); 1299 } 1300 1301 int hci_inquiry(void __user *arg) 1302 { 1303 __u8 __user *ptr = arg; 1304 struct hci_inquiry_req ir; 1305 struct hci_dev *hdev; 1306 int err = 0, do_inquiry = 0, max_rsp; 1307 long timeo; 1308 __u8 *buf; 1309 1310 if (copy_from_user(&ir, ptr, sizeof(ir))) 1311 return -EFAULT; 1312 1313 hdev = hci_dev_get(ir.dev_id); 1314 if (!hdev) 1315 return -ENODEV; 1316 1317 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1318 err = -EBUSY; 1319 goto done; 1320 } 1321 1322 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 1323 err = -EOPNOTSUPP; 1324 goto done; 1325 } 1326 1327 if (hdev->dev_type != HCI_BREDR) { 1328 err = -EOPNOTSUPP; 1329 goto done; 1330 } 1331 1332 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1333 err = -EOPNOTSUPP; 1334 goto done; 1335 } 1336 1337 hci_dev_lock(hdev); 1338 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || 1339 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) { 1340 hci_inquiry_cache_flush(hdev); 1341 do_inquiry = 1; 1342 } 1343 hci_dev_unlock(hdev); 1344 1345 timeo = ir.length * msecs_to_jiffies(2000); 1346 1347 if (do_inquiry) { 1348 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir, 1349 timeo); 1350 if (err < 0) 1351 goto done; 1352 1353 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is 1354 * cleared). If it is interrupted by a signal, return -EINTR. 1355 */ 1356 if (wait_on_bit(&hdev->flags, HCI_INQUIRY, 1357 TASK_INTERRUPTIBLE)) 1358 return -EINTR; 1359 } 1360 1361 /* for unlimited number of responses we will use buffer with 1362 * 255 entries 1363 */ 1364 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp; 1365 1366 /* cache_dump can't sleep. Therefore we allocate temp buffer and then 1367 * copy it to the user space. 1368 */ 1369 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL); 1370 if (!buf) { 1371 err = -ENOMEM; 1372 goto done; 1373 } 1374 1375 hci_dev_lock(hdev); 1376 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf); 1377 hci_dev_unlock(hdev); 1378 1379 BT_DBG("num_rsp %d", ir.num_rsp); 1380 1381 if (!copy_to_user(ptr, &ir, sizeof(ir))) { 1382 ptr += sizeof(ir); 1383 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) * 1384 ir.num_rsp)) 1385 err = -EFAULT; 1386 } else 1387 err = -EFAULT; 1388 1389 kfree(buf); 1390 1391 done: 1392 hci_dev_put(hdev); 1393 return err; 1394 } 1395 1396 static int hci_dev_do_open(struct hci_dev *hdev) 1397 { 1398 int ret = 0; 1399 1400 BT_DBG("%s %p", hdev->name, hdev); 1401 1402 hci_req_lock(hdev); 1403 1404 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 1405 ret = -ENODEV; 1406 goto done; 1407 } 1408 1409 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 1410 !hci_dev_test_flag(hdev, HCI_CONFIG)) { 1411 /* Check for rfkill but allow the HCI setup stage to 1412 * proceed (which in itself doesn't cause any RF activity). 1413 */ 1414 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) { 1415 ret = -ERFKILL; 1416 goto done; 1417 } 1418 1419 /* Check for valid public address or a configured static 1420 * random adddress, but let the HCI setup proceed to 1421 * be able to determine if there is a public address 1422 * or not. 1423 * 1424 * In case of user channel usage, it is not important 1425 * if a public address or static random address is 1426 * available. 1427 * 1428 * This check is only valid for BR/EDR controllers 1429 * since AMP controllers do not have an address. 1430 */ 1431 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 1432 hdev->dev_type == HCI_BREDR && 1433 !bacmp(&hdev->bdaddr, BDADDR_ANY) && 1434 !bacmp(&hdev->static_addr, BDADDR_ANY)) { 1435 ret = -EADDRNOTAVAIL; 1436 goto done; 1437 } 1438 } 1439 1440 if (test_bit(HCI_UP, &hdev->flags)) { 1441 ret = -EALREADY; 1442 goto done; 1443 } 1444 1445 if (hdev->open(hdev)) { 1446 ret = -EIO; 1447 goto done; 1448 } 1449 1450 set_bit(HCI_RUNNING, &hdev->flags); 1451 hci_sock_dev_event(hdev, HCI_DEV_OPEN); 1452 1453 atomic_set(&hdev->cmd_cnt, 1); 1454 set_bit(HCI_INIT, &hdev->flags); 1455 1456 if (hci_dev_test_flag(hdev, HCI_SETUP)) { 1457 hci_sock_dev_event(hdev, HCI_DEV_SETUP); 1458 1459 if (hdev->setup) 1460 ret = hdev->setup(hdev); 1461 1462 /* The transport driver can set these quirks before 1463 * creating the HCI device or in its setup callback. 1464 * 1465 * In case any of them is set, the controller has to 1466 * start up as unconfigured. 1467 */ 1468 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) || 1469 test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks)) 1470 hci_dev_set_flag(hdev, HCI_UNCONFIGURED); 1471 1472 /* For an unconfigured controller it is required to 1473 * read at least the version information provided by 1474 * the Read Local Version Information command. 1475 * 1476 * If the set_bdaddr driver callback is provided, then 1477 * also the original Bluetooth public device address 1478 * will be read using the Read BD Address command. 1479 */ 1480 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 1481 ret = __hci_unconf_init(hdev); 1482 } 1483 1484 if (hci_dev_test_flag(hdev, HCI_CONFIG)) { 1485 /* If public address change is configured, ensure that 1486 * the address gets programmed. If the driver does not 1487 * support changing the public address, fail the power 1488 * on procedure. 1489 */ 1490 if (bacmp(&hdev->public_addr, BDADDR_ANY) && 1491 hdev->set_bdaddr) 1492 ret = hdev->set_bdaddr(hdev, &hdev->public_addr); 1493 else 1494 ret = -EADDRNOTAVAIL; 1495 } 1496 1497 if (!ret) { 1498 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 1499 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1500 ret = __hci_init(hdev); 1501 if (!ret && hdev->post_init) 1502 ret = hdev->post_init(hdev); 1503 } 1504 } 1505 1506 /* If the HCI Reset command is clearing all diagnostic settings, 1507 * then they need to be reprogrammed after the init procedure 1508 * completed. 1509 */ 1510 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) && 1511 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag) 1512 ret = hdev->set_diag(hdev, true); 1513 1514 clear_bit(HCI_INIT, &hdev->flags); 1515 1516 if (!ret) { 1517 hci_dev_hold(hdev); 1518 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1519 set_bit(HCI_UP, &hdev->flags); 1520 hci_sock_dev_event(hdev, HCI_DEV_UP); 1521 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 1522 !hci_dev_test_flag(hdev, HCI_CONFIG) && 1523 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 1524 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 1525 hdev->dev_type == HCI_BREDR) { 1526 hci_dev_lock(hdev); 1527 mgmt_powered(hdev, 1); 1528 hci_dev_unlock(hdev); 1529 } 1530 } else { 1531 /* Init failed, cleanup */ 1532 flush_work(&hdev->tx_work); 1533 flush_work(&hdev->cmd_work); 1534 flush_work(&hdev->rx_work); 1535 1536 skb_queue_purge(&hdev->cmd_q); 1537 skb_queue_purge(&hdev->rx_q); 1538 1539 if (hdev->flush) 1540 hdev->flush(hdev); 1541 1542 if (hdev->sent_cmd) { 1543 kfree_skb(hdev->sent_cmd); 1544 hdev->sent_cmd = NULL; 1545 } 1546 1547 clear_bit(HCI_RUNNING, &hdev->flags); 1548 hci_sock_dev_event(hdev, HCI_DEV_CLOSE); 1549 1550 hdev->close(hdev); 1551 hdev->flags &= BIT(HCI_RAW); 1552 } 1553 1554 done: 1555 hci_req_unlock(hdev); 1556 return ret; 1557 } 1558 1559 /* ---- HCI ioctl helpers ---- */ 1560 1561 int hci_dev_open(__u16 dev) 1562 { 1563 struct hci_dev *hdev; 1564 int err; 1565 1566 hdev = hci_dev_get(dev); 1567 if (!hdev) 1568 return -ENODEV; 1569 1570 /* Devices that are marked as unconfigured can only be powered 1571 * up as user channel. Trying to bring them up as normal devices 1572 * will result into a failure. Only user channel operation is 1573 * possible. 1574 * 1575 * When this function is called for a user channel, the flag 1576 * HCI_USER_CHANNEL will be set first before attempting to 1577 * open the device. 1578 */ 1579 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 1580 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1581 err = -EOPNOTSUPP; 1582 goto done; 1583 } 1584 1585 /* We need to ensure that no other power on/off work is pending 1586 * before proceeding to call hci_dev_do_open. This is 1587 * particularly important if the setup procedure has not yet 1588 * completed. 1589 */ 1590 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) 1591 cancel_delayed_work(&hdev->power_off); 1592 1593 /* After this call it is guaranteed that the setup procedure 1594 * has finished. This means that error conditions like RFKILL 1595 * or no valid public or static random address apply. 1596 */ 1597 flush_workqueue(hdev->req_workqueue); 1598 1599 /* For controllers not using the management interface and that 1600 * are brought up using legacy ioctl, set the HCI_BONDABLE bit 1601 * so that pairing works for them. Once the management interface 1602 * is in use this bit will be cleared again and userspace has 1603 * to explicitly enable it. 1604 */ 1605 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 1606 !hci_dev_test_flag(hdev, HCI_MGMT)) 1607 hci_dev_set_flag(hdev, HCI_BONDABLE); 1608 1609 err = hci_dev_do_open(hdev); 1610 1611 done: 1612 hci_dev_put(hdev); 1613 return err; 1614 } 1615 1616 /* This function requires the caller holds hdev->lock */ 1617 static void hci_pend_le_actions_clear(struct hci_dev *hdev) 1618 { 1619 struct hci_conn_params *p; 1620 1621 list_for_each_entry(p, &hdev->le_conn_params, list) { 1622 if (p->conn) { 1623 hci_conn_drop(p->conn); 1624 hci_conn_put(p->conn); 1625 p->conn = NULL; 1626 } 1627 list_del_init(&p->action); 1628 } 1629 1630 BT_DBG("All LE pending actions cleared"); 1631 } 1632 1633 int hci_dev_do_close(struct hci_dev *hdev) 1634 { 1635 bool auto_off; 1636 1637 BT_DBG("%s %p", hdev->name, hdev); 1638 1639 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && 1640 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 1641 test_bit(HCI_UP, &hdev->flags)) { 1642 /* Execute vendor specific shutdown routine */ 1643 if (hdev->shutdown) 1644 hdev->shutdown(hdev); 1645 } 1646 1647 cancel_delayed_work(&hdev->power_off); 1648 1649 hci_req_cancel(hdev, ENODEV); 1650 hci_req_lock(hdev); 1651 1652 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { 1653 cancel_delayed_work_sync(&hdev->cmd_timer); 1654 hci_req_unlock(hdev); 1655 return 0; 1656 } 1657 1658 /* Flush RX and TX works */ 1659 flush_work(&hdev->tx_work); 1660 flush_work(&hdev->rx_work); 1661 1662 if (hdev->discov_timeout > 0) { 1663 cancel_delayed_work(&hdev->discov_off); 1664 hdev->discov_timeout = 0; 1665 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 1666 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1667 } 1668 1669 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 1670 cancel_delayed_work(&hdev->service_cache); 1671 1672 cancel_delayed_work_sync(&hdev->le_scan_disable); 1673 cancel_delayed_work_sync(&hdev->le_scan_restart); 1674 1675 if (hci_dev_test_flag(hdev, HCI_MGMT)) 1676 cancel_delayed_work_sync(&hdev->rpa_expired); 1677 1678 if (hdev->adv_instance_timeout) { 1679 cancel_delayed_work_sync(&hdev->adv_instance_expire); 1680 hdev->adv_instance_timeout = 0; 1681 } 1682 1683 /* Avoid potential lockdep warnings from the *_flush() calls by 1684 * ensuring the workqueue is empty up front. 1685 */ 1686 drain_workqueue(hdev->workqueue); 1687 1688 hci_dev_lock(hdev); 1689 1690 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 1691 1692 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF); 1693 1694 if (!auto_off && hdev->dev_type == HCI_BREDR) 1695 mgmt_powered(hdev, 0); 1696 1697 hci_inquiry_cache_flush(hdev); 1698 hci_pend_le_actions_clear(hdev); 1699 hci_conn_hash_flush(hdev); 1700 hci_dev_unlock(hdev); 1701 1702 smp_unregister(hdev); 1703 1704 hci_sock_dev_event(hdev, HCI_DEV_DOWN); 1705 1706 if (hdev->flush) 1707 hdev->flush(hdev); 1708 1709 /* Reset device */ 1710 skb_queue_purge(&hdev->cmd_q); 1711 atomic_set(&hdev->cmd_cnt, 1); 1712 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) && 1713 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 1714 set_bit(HCI_INIT, &hdev->flags); 1715 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT); 1716 clear_bit(HCI_INIT, &hdev->flags); 1717 } 1718 1719 /* flush cmd work */ 1720 flush_work(&hdev->cmd_work); 1721 1722 /* Drop queues */ 1723 skb_queue_purge(&hdev->rx_q); 1724 skb_queue_purge(&hdev->cmd_q); 1725 skb_queue_purge(&hdev->raw_q); 1726 1727 /* Drop last sent command */ 1728 if (hdev->sent_cmd) { 1729 cancel_delayed_work_sync(&hdev->cmd_timer); 1730 kfree_skb(hdev->sent_cmd); 1731 hdev->sent_cmd = NULL; 1732 } 1733 1734 clear_bit(HCI_RUNNING, &hdev->flags); 1735 hci_sock_dev_event(hdev, HCI_DEV_CLOSE); 1736 1737 /* After this point our queues are empty 1738 * and no tasks are scheduled. */ 1739 hdev->close(hdev); 1740 1741 /* Clear flags */ 1742 hdev->flags &= BIT(HCI_RAW); 1743 hci_dev_clear_volatile_flags(hdev); 1744 1745 /* Controller radio is available but is currently powered down */ 1746 hdev->amp_status = AMP_STATUS_POWERED_DOWN; 1747 1748 memset(hdev->eir, 0, sizeof(hdev->eir)); 1749 memset(hdev->dev_class, 0, sizeof(hdev->dev_class)); 1750 bacpy(&hdev->random_addr, BDADDR_ANY); 1751 1752 hci_req_unlock(hdev); 1753 1754 hci_dev_put(hdev); 1755 return 0; 1756 } 1757 1758 int hci_dev_close(__u16 dev) 1759 { 1760 struct hci_dev *hdev; 1761 int err; 1762 1763 hdev = hci_dev_get(dev); 1764 if (!hdev) 1765 return -ENODEV; 1766 1767 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1768 err = -EBUSY; 1769 goto done; 1770 } 1771 1772 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) 1773 cancel_delayed_work(&hdev->power_off); 1774 1775 err = hci_dev_do_close(hdev); 1776 1777 done: 1778 hci_dev_put(hdev); 1779 return err; 1780 } 1781 1782 static int hci_dev_do_reset(struct hci_dev *hdev) 1783 { 1784 int ret; 1785 1786 BT_DBG("%s %p", hdev->name, hdev); 1787 1788 hci_req_lock(hdev); 1789 1790 /* Drop queues */ 1791 skb_queue_purge(&hdev->rx_q); 1792 skb_queue_purge(&hdev->cmd_q); 1793 1794 /* Avoid potential lockdep warnings from the *_flush() calls by 1795 * ensuring the workqueue is empty up front. 1796 */ 1797 drain_workqueue(hdev->workqueue); 1798 1799 hci_dev_lock(hdev); 1800 hci_inquiry_cache_flush(hdev); 1801 hci_conn_hash_flush(hdev); 1802 hci_dev_unlock(hdev); 1803 1804 if (hdev->flush) 1805 hdev->flush(hdev); 1806 1807 atomic_set(&hdev->cmd_cnt, 1); 1808 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0; 1809 1810 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT); 1811 1812 hci_req_unlock(hdev); 1813 return ret; 1814 } 1815 1816 int hci_dev_reset(__u16 dev) 1817 { 1818 struct hci_dev *hdev; 1819 int err; 1820 1821 hdev = hci_dev_get(dev); 1822 if (!hdev) 1823 return -ENODEV; 1824 1825 if (!test_bit(HCI_UP, &hdev->flags)) { 1826 err = -ENETDOWN; 1827 goto done; 1828 } 1829 1830 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1831 err = -EBUSY; 1832 goto done; 1833 } 1834 1835 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 1836 err = -EOPNOTSUPP; 1837 goto done; 1838 } 1839 1840 err = hci_dev_do_reset(hdev); 1841 1842 done: 1843 hci_dev_put(hdev); 1844 return err; 1845 } 1846 1847 int hci_dev_reset_stat(__u16 dev) 1848 { 1849 struct hci_dev *hdev; 1850 int ret = 0; 1851 1852 hdev = hci_dev_get(dev); 1853 if (!hdev) 1854 return -ENODEV; 1855 1856 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1857 ret = -EBUSY; 1858 goto done; 1859 } 1860 1861 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 1862 ret = -EOPNOTSUPP; 1863 goto done; 1864 } 1865 1866 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 1867 1868 done: 1869 hci_dev_put(hdev); 1870 return ret; 1871 } 1872 1873 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan) 1874 { 1875 bool conn_changed, discov_changed; 1876 1877 BT_DBG("%s scan 0x%02x", hdev->name, scan); 1878 1879 if ((scan & SCAN_PAGE)) 1880 conn_changed = !hci_dev_test_and_set_flag(hdev, 1881 HCI_CONNECTABLE); 1882 else 1883 conn_changed = hci_dev_test_and_clear_flag(hdev, 1884 HCI_CONNECTABLE); 1885 1886 if ((scan & SCAN_INQUIRY)) { 1887 discov_changed = !hci_dev_test_and_set_flag(hdev, 1888 HCI_DISCOVERABLE); 1889 } else { 1890 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 1891 discov_changed = hci_dev_test_and_clear_flag(hdev, 1892 HCI_DISCOVERABLE); 1893 } 1894 1895 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 1896 return; 1897 1898 if (conn_changed || discov_changed) { 1899 /* In case this was disabled through mgmt */ 1900 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 1901 1902 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1903 mgmt_update_adv_data(hdev); 1904 1905 mgmt_new_settings(hdev); 1906 } 1907 } 1908 1909 int hci_dev_cmd(unsigned int cmd, void __user *arg) 1910 { 1911 struct hci_dev *hdev; 1912 struct hci_dev_req dr; 1913 int err = 0; 1914 1915 if (copy_from_user(&dr, arg, sizeof(dr))) 1916 return -EFAULT; 1917 1918 hdev = hci_dev_get(dr.dev_id); 1919 if (!hdev) 1920 return -ENODEV; 1921 1922 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 1923 err = -EBUSY; 1924 goto done; 1925 } 1926 1927 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 1928 err = -EOPNOTSUPP; 1929 goto done; 1930 } 1931 1932 if (hdev->dev_type != HCI_BREDR) { 1933 err = -EOPNOTSUPP; 1934 goto done; 1935 } 1936 1937 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 1938 err = -EOPNOTSUPP; 1939 goto done; 1940 } 1941 1942 switch (cmd) { 1943 case HCISETAUTH: 1944 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt, 1945 HCI_INIT_TIMEOUT); 1946 break; 1947 1948 case HCISETENCRYPT: 1949 if (!lmp_encrypt_capable(hdev)) { 1950 err = -EOPNOTSUPP; 1951 break; 1952 } 1953 1954 if (!test_bit(HCI_AUTH, &hdev->flags)) { 1955 /* Auth must be enabled first */ 1956 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt, 1957 HCI_INIT_TIMEOUT); 1958 if (err) 1959 break; 1960 } 1961 1962 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt, 1963 HCI_INIT_TIMEOUT); 1964 break; 1965 1966 case HCISETSCAN: 1967 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt, 1968 HCI_INIT_TIMEOUT); 1969 1970 /* Ensure that the connectable and discoverable states 1971 * get correctly modified as this was a non-mgmt change. 1972 */ 1973 if (!err) 1974 hci_update_scan_state(hdev, dr.dev_opt); 1975 break; 1976 1977 case HCISETLINKPOL: 1978 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt, 1979 HCI_INIT_TIMEOUT); 1980 break; 1981 1982 case HCISETLINKMODE: 1983 hdev->link_mode = ((__u16) dr.dev_opt) & 1984 (HCI_LM_MASTER | HCI_LM_ACCEPT); 1985 break; 1986 1987 case HCISETPTYPE: 1988 hdev->pkt_type = (__u16) dr.dev_opt; 1989 break; 1990 1991 case HCISETACLMTU: 1992 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1); 1993 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0); 1994 break; 1995 1996 case HCISETSCOMTU: 1997 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1); 1998 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0); 1999 break; 2000 2001 default: 2002 err = -EINVAL; 2003 break; 2004 } 2005 2006 done: 2007 hci_dev_put(hdev); 2008 return err; 2009 } 2010 2011 int hci_get_dev_list(void __user *arg) 2012 { 2013 struct hci_dev *hdev; 2014 struct hci_dev_list_req *dl; 2015 struct hci_dev_req *dr; 2016 int n = 0, size, err; 2017 __u16 dev_num; 2018 2019 if (get_user(dev_num, (__u16 __user *) arg)) 2020 return -EFAULT; 2021 2022 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr)) 2023 return -EINVAL; 2024 2025 size = sizeof(*dl) + dev_num * sizeof(*dr); 2026 2027 dl = kzalloc(size, GFP_KERNEL); 2028 if (!dl) 2029 return -ENOMEM; 2030 2031 dr = dl->dev_req; 2032 2033 read_lock(&hci_dev_list_lock); 2034 list_for_each_entry(hdev, &hci_dev_list, list) { 2035 unsigned long flags = hdev->flags; 2036 2037 /* When the auto-off is configured it means the transport 2038 * is running, but in that case still indicate that the 2039 * device is actually down. 2040 */ 2041 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) 2042 flags &= ~BIT(HCI_UP); 2043 2044 (dr + n)->dev_id = hdev->id; 2045 (dr + n)->dev_opt = flags; 2046 2047 if (++n >= dev_num) 2048 break; 2049 } 2050 read_unlock(&hci_dev_list_lock); 2051 2052 dl->dev_num = n; 2053 size = sizeof(*dl) + n * sizeof(*dr); 2054 2055 err = copy_to_user(arg, dl, size); 2056 kfree(dl); 2057 2058 return err ? -EFAULT : 0; 2059 } 2060 2061 int hci_get_dev_info(void __user *arg) 2062 { 2063 struct hci_dev *hdev; 2064 struct hci_dev_info di; 2065 unsigned long flags; 2066 int err = 0; 2067 2068 if (copy_from_user(&di, arg, sizeof(di))) 2069 return -EFAULT; 2070 2071 hdev = hci_dev_get(di.dev_id); 2072 if (!hdev) 2073 return -ENODEV; 2074 2075 /* When the auto-off is configured it means the transport 2076 * is running, but in that case still indicate that the 2077 * device is actually down. 2078 */ 2079 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) 2080 flags = hdev->flags & ~BIT(HCI_UP); 2081 else 2082 flags = hdev->flags; 2083 2084 strcpy(di.name, hdev->name); 2085 di.bdaddr = hdev->bdaddr; 2086 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4); 2087 di.flags = flags; 2088 di.pkt_type = hdev->pkt_type; 2089 if (lmp_bredr_capable(hdev)) { 2090 di.acl_mtu = hdev->acl_mtu; 2091 di.acl_pkts = hdev->acl_pkts; 2092 di.sco_mtu = hdev->sco_mtu; 2093 di.sco_pkts = hdev->sco_pkts; 2094 } else { 2095 di.acl_mtu = hdev->le_mtu; 2096 di.acl_pkts = hdev->le_pkts; 2097 di.sco_mtu = 0; 2098 di.sco_pkts = 0; 2099 } 2100 di.link_policy = hdev->link_policy; 2101 di.link_mode = hdev->link_mode; 2102 2103 memcpy(&di.stat, &hdev->stat, sizeof(di.stat)); 2104 memcpy(&di.features, &hdev->features, sizeof(di.features)); 2105 2106 if (copy_to_user(arg, &di, sizeof(di))) 2107 err = -EFAULT; 2108 2109 hci_dev_put(hdev); 2110 2111 return err; 2112 } 2113 2114 /* ---- Interface to HCI drivers ---- */ 2115 2116 static int hci_rfkill_set_block(void *data, bool blocked) 2117 { 2118 struct hci_dev *hdev = data; 2119 2120 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked); 2121 2122 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) 2123 return -EBUSY; 2124 2125 if (blocked) { 2126 hci_dev_set_flag(hdev, HCI_RFKILLED); 2127 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 2128 !hci_dev_test_flag(hdev, HCI_CONFIG)) 2129 hci_dev_do_close(hdev); 2130 } else { 2131 hci_dev_clear_flag(hdev, HCI_RFKILLED); 2132 } 2133 2134 return 0; 2135 } 2136 2137 static const struct rfkill_ops hci_rfkill_ops = { 2138 .set_block = hci_rfkill_set_block, 2139 }; 2140 2141 static void hci_power_on(struct work_struct *work) 2142 { 2143 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on); 2144 int err; 2145 2146 BT_DBG("%s", hdev->name); 2147 2148 err = hci_dev_do_open(hdev); 2149 if (err < 0) { 2150 hci_dev_lock(hdev); 2151 mgmt_set_powered_failed(hdev, err); 2152 hci_dev_unlock(hdev); 2153 return; 2154 } 2155 2156 /* During the HCI setup phase, a few error conditions are 2157 * ignored and they need to be checked now. If they are still 2158 * valid, it is important to turn the device back off. 2159 */ 2160 if (hci_dev_test_flag(hdev, HCI_RFKILLED) || 2161 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) || 2162 (hdev->dev_type == HCI_BREDR && 2163 !bacmp(&hdev->bdaddr, BDADDR_ANY) && 2164 !bacmp(&hdev->static_addr, BDADDR_ANY))) { 2165 hci_dev_clear_flag(hdev, HCI_AUTO_OFF); 2166 hci_dev_do_close(hdev); 2167 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) { 2168 queue_delayed_work(hdev->req_workqueue, &hdev->power_off, 2169 HCI_AUTO_OFF_TIMEOUT); 2170 } 2171 2172 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) { 2173 /* For unconfigured devices, set the HCI_RAW flag 2174 * so that userspace can easily identify them. 2175 */ 2176 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 2177 set_bit(HCI_RAW, &hdev->flags); 2178 2179 /* For fully configured devices, this will send 2180 * the Index Added event. For unconfigured devices, 2181 * it will send Unconfigued Index Added event. 2182 * 2183 * Devices with HCI_QUIRK_RAW_DEVICE are ignored 2184 * and no event will be send. 2185 */ 2186 mgmt_index_added(hdev); 2187 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) { 2188 /* When the controller is now configured, then it 2189 * is important to clear the HCI_RAW flag. 2190 */ 2191 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 2192 clear_bit(HCI_RAW, &hdev->flags); 2193 2194 /* Powering on the controller with HCI_CONFIG set only 2195 * happens with the transition from unconfigured to 2196 * configured. This will send the Index Added event. 2197 */ 2198 mgmt_index_added(hdev); 2199 } 2200 } 2201 2202 static void hci_power_off(struct work_struct *work) 2203 { 2204 struct hci_dev *hdev = container_of(work, struct hci_dev, 2205 power_off.work); 2206 2207 BT_DBG("%s", hdev->name); 2208 2209 hci_dev_do_close(hdev); 2210 } 2211 2212 static void hci_error_reset(struct work_struct *work) 2213 { 2214 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset); 2215 2216 BT_DBG("%s", hdev->name); 2217 2218 if (hdev->hw_error) 2219 hdev->hw_error(hdev, hdev->hw_error_code); 2220 else 2221 BT_ERR("%s hardware error 0x%2.2x", hdev->name, 2222 hdev->hw_error_code); 2223 2224 if (hci_dev_do_close(hdev)) 2225 return; 2226 2227 hci_dev_do_open(hdev); 2228 } 2229 2230 static void hci_discov_off(struct work_struct *work) 2231 { 2232 struct hci_dev *hdev; 2233 2234 hdev = container_of(work, struct hci_dev, discov_off.work); 2235 2236 BT_DBG("%s", hdev->name); 2237 2238 mgmt_discoverable_timeout(hdev); 2239 } 2240 2241 static void hci_adv_timeout_expire(struct work_struct *work) 2242 { 2243 struct hci_dev *hdev; 2244 2245 hdev = container_of(work, struct hci_dev, adv_instance_expire.work); 2246 2247 BT_DBG("%s", hdev->name); 2248 2249 mgmt_adv_timeout_expired(hdev); 2250 } 2251 2252 void hci_uuids_clear(struct hci_dev *hdev) 2253 { 2254 struct bt_uuid *uuid, *tmp; 2255 2256 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) { 2257 list_del(&uuid->list); 2258 kfree(uuid); 2259 } 2260 } 2261 2262 void hci_link_keys_clear(struct hci_dev *hdev) 2263 { 2264 struct link_key *key; 2265 2266 list_for_each_entry_rcu(key, &hdev->link_keys, list) { 2267 list_del_rcu(&key->list); 2268 kfree_rcu(key, rcu); 2269 } 2270 } 2271 2272 void hci_smp_ltks_clear(struct hci_dev *hdev) 2273 { 2274 struct smp_ltk *k; 2275 2276 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) { 2277 list_del_rcu(&k->list); 2278 kfree_rcu(k, rcu); 2279 } 2280 } 2281 2282 void hci_smp_irks_clear(struct hci_dev *hdev) 2283 { 2284 struct smp_irk *k; 2285 2286 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) { 2287 list_del_rcu(&k->list); 2288 kfree_rcu(k, rcu); 2289 } 2290 } 2291 2292 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr) 2293 { 2294 struct link_key *k; 2295 2296 rcu_read_lock(); 2297 list_for_each_entry_rcu(k, &hdev->link_keys, list) { 2298 if (bacmp(bdaddr, &k->bdaddr) == 0) { 2299 rcu_read_unlock(); 2300 return k; 2301 } 2302 } 2303 rcu_read_unlock(); 2304 2305 return NULL; 2306 } 2307 2308 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn, 2309 u8 key_type, u8 old_key_type) 2310 { 2311 /* Legacy key */ 2312 if (key_type < 0x03) 2313 return true; 2314 2315 /* Debug keys are insecure so don't store them persistently */ 2316 if (key_type == HCI_LK_DEBUG_COMBINATION) 2317 return false; 2318 2319 /* Changed combination key and there's no previous one */ 2320 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff) 2321 return false; 2322 2323 /* Security mode 3 case */ 2324 if (!conn) 2325 return true; 2326 2327 /* BR/EDR key derived using SC from an LE link */ 2328 if (conn->type == LE_LINK) 2329 return true; 2330 2331 /* Neither local nor remote side had no-bonding as requirement */ 2332 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01) 2333 return true; 2334 2335 /* Local side had dedicated bonding as requirement */ 2336 if (conn->auth_type == 0x02 || conn->auth_type == 0x03) 2337 return true; 2338 2339 /* Remote side had dedicated bonding as requirement */ 2340 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) 2341 return true; 2342 2343 /* If none of the above criteria match, then don't store the key 2344 * persistently */ 2345 return false; 2346 } 2347 2348 static u8 ltk_role(u8 type) 2349 { 2350 if (type == SMP_LTK) 2351 return HCI_ROLE_MASTER; 2352 2353 return HCI_ROLE_SLAVE; 2354 } 2355 2356 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, 2357 u8 addr_type, u8 role) 2358 { 2359 struct smp_ltk *k; 2360 2361 rcu_read_lock(); 2362 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) { 2363 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr)) 2364 continue; 2365 2366 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) { 2367 rcu_read_unlock(); 2368 return k; 2369 } 2370 } 2371 rcu_read_unlock(); 2372 2373 return NULL; 2374 } 2375 2376 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa) 2377 { 2378 struct smp_irk *irk; 2379 2380 rcu_read_lock(); 2381 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) { 2382 if (!bacmp(&irk->rpa, rpa)) { 2383 rcu_read_unlock(); 2384 return irk; 2385 } 2386 } 2387 2388 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) { 2389 if (smp_irk_matches(hdev, irk->val, rpa)) { 2390 bacpy(&irk->rpa, rpa); 2391 rcu_read_unlock(); 2392 return irk; 2393 } 2394 } 2395 rcu_read_unlock(); 2396 2397 return NULL; 2398 } 2399 2400 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr, 2401 u8 addr_type) 2402 { 2403 struct smp_irk *irk; 2404 2405 /* Identity Address must be public or static random */ 2406 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0) 2407 return NULL; 2408 2409 rcu_read_lock(); 2410 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) { 2411 if (addr_type == irk->addr_type && 2412 bacmp(bdaddr, &irk->bdaddr) == 0) { 2413 rcu_read_unlock(); 2414 return irk; 2415 } 2416 } 2417 rcu_read_unlock(); 2418 2419 return NULL; 2420 } 2421 2422 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, 2423 bdaddr_t *bdaddr, u8 *val, u8 type, 2424 u8 pin_len, bool *persistent) 2425 { 2426 struct link_key *key, *old_key; 2427 u8 old_key_type; 2428 2429 old_key = hci_find_link_key(hdev, bdaddr); 2430 if (old_key) { 2431 old_key_type = old_key->type; 2432 key = old_key; 2433 } else { 2434 old_key_type = conn ? conn->key_type : 0xff; 2435 key = kzalloc(sizeof(*key), GFP_KERNEL); 2436 if (!key) 2437 return NULL; 2438 list_add_rcu(&key->list, &hdev->link_keys); 2439 } 2440 2441 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type); 2442 2443 /* Some buggy controller combinations generate a changed 2444 * combination key for legacy pairing even when there's no 2445 * previous key */ 2446 if (type == HCI_LK_CHANGED_COMBINATION && 2447 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) { 2448 type = HCI_LK_COMBINATION; 2449 if (conn) 2450 conn->key_type = type; 2451 } 2452 2453 bacpy(&key->bdaddr, bdaddr); 2454 memcpy(key->val, val, HCI_LINK_KEY_SIZE); 2455 key->pin_len = pin_len; 2456 2457 if (type == HCI_LK_CHANGED_COMBINATION) 2458 key->type = old_key_type; 2459 else 2460 key->type = type; 2461 2462 if (persistent) 2463 *persistent = hci_persistent_key(hdev, conn, type, 2464 old_key_type); 2465 2466 return key; 2467 } 2468 2469 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, 2470 u8 addr_type, u8 type, u8 authenticated, 2471 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand) 2472 { 2473 struct smp_ltk *key, *old_key; 2474 u8 role = ltk_role(type); 2475 2476 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role); 2477 if (old_key) 2478 key = old_key; 2479 else { 2480 key = kzalloc(sizeof(*key), GFP_KERNEL); 2481 if (!key) 2482 return NULL; 2483 list_add_rcu(&key->list, &hdev->long_term_keys); 2484 } 2485 2486 bacpy(&key->bdaddr, bdaddr); 2487 key->bdaddr_type = addr_type; 2488 memcpy(key->val, tk, sizeof(key->val)); 2489 key->authenticated = authenticated; 2490 key->ediv = ediv; 2491 key->rand = rand; 2492 key->enc_size = enc_size; 2493 key->type = type; 2494 2495 return key; 2496 } 2497 2498 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, 2499 u8 addr_type, u8 val[16], bdaddr_t *rpa) 2500 { 2501 struct smp_irk *irk; 2502 2503 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type); 2504 if (!irk) { 2505 irk = kzalloc(sizeof(*irk), GFP_KERNEL); 2506 if (!irk) 2507 return NULL; 2508 2509 bacpy(&irk->bdaddr, bdaddr); 2510 irk->addr_type = addr_type; 2511 2512 list_add_rcu(&irk->list, &hdev->identity_resolving_keys); 2513 } 2514 2515 memcpy(irk->val, val, 16); 2516 bacpy(&irk->rpa, rpa); 2517 2518 return irk; 2519 } 2520 2521 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr) 2522 { 2523 struct link_key *key; 2524 2525 key = hci_find_link_key(hdev, bdaddr); 2526 if (!key) 2527 return -ENOENT; 2528 2529 BT_DBG("%s removing %pMR", hdev->name, bdaddr); 2530 2531 list_del_rcu(&key->list); 2532 kfree_rcu(key, rcu); 2533 2534 return 0; 2535 } 2536 2537 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type) 2538 { 2539 struct smp_ltk *k; 2540 int removed = 0; 2541 2542 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) { 2543 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type) 2544 continue; 2545 2546 BT_DBG("%s removing %pMR", hdev->name, bdaddr); 2547 2548 list_del_rcu(&k->list); 2549 kfree_rcu(k, rcu); 2550 removed++; 2551 } 2552 2553 return removed ? 0 : -ENOENT; 2554 } 2555 2556 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type) 2557 { 2558 struct smp_irk *k; 2559 2560 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) { 2561 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type) 2562 continue; 2563 2564 BT_DBG("%s removing %pMR", hdev->name, bdaddr); 2565 2566 list_del_rcu(&k->list); 2567 kfree_rcu(k, rcu); 2568 } 2569 } 2570 2571 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 2572 { 2573 struct smp_ltk *k; 2574 struct smp_irk *irk; 2575 u8 addr_type; 2576 2577 if (type == BDADDR_BREDR) { 2578 if (hci_find_link_key(hdev, bdaddr)) 2579 return true; 2580 return false; 2581 } 2582 2583 /* Convert to HCI addr type which struct smp_ltk uses */ 2584 if (type == BDADDR_LE_PUBLIC) 2585 addr_type = ADDR_LE_DEV_PUBLIC; 2586 else 2587 addr_type = ADDR_LE_DEV_RANDOM; 2588 2589 irk = hci_get_irk(hdev, bdaddr, addr_type); 2590 if (irk) { 2591 bdaddr = &irk->bdaddr; 2592 addr_type = irk->addr_type; 2593 } 2594 2595 rcu_read_lock(); 2596 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) { 2597 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) { 2598 rcu_read_unlock(); 2599 return true; 2600 } 2601 } 2602 rcu_read_unlock(); 2603 2604 return false; 2605 } 2606 2607 /* HCI command timer function */ 2608 static void hci_cmd_timeout(struct work_struct *work) 2609 { 2610 struct hci_dev *hdev = container_of(work, struct hci_dev, 2611 cmd_timer.work); 2612 2613 if (hdev->sent_cmd) { 2614 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data; 2615 u16 opcode = __le16_to_cpu(sent->opcode); 2616 2617 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode); 2618 } else { 2619 BT_ERR("%s command tx timeout", hdev->name); 2620 } 2621 2622 atomic_set(&hdev->cmd_cnt, 1); 2623 queue_work(hdev->workqueue, &hdev->cmd_work); 2624 } 2625 2626 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev, 2627 bdaddr_t *bdaddr, u8 bdaddr_type) 2628 { 2629 struct oob_data *data; 2630 2631 list_for_each_entry(data, &hdev->remote_oob_data, list) { 2632 if (bacmp(bdaddr, &data->bdaddr) != 0) 2633 continue; 2634 if (data->bdaddr_type != bdaddr_type) 2635 continue; 2636 return data; 2637 } 2638 2639 return NULL; 2640 } 2641 2642 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, 2643 u8 bdaddr_type) 2644 { 2645 struct oob_data *data; 2646 2647 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type); 2648 if (!data) 2649 return -ENOENT; 2650 2651 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type); 2652 2653 list_del(&data->list); 2654 kfree(data); 2655 2656 return 0; 2657 } 2658 2659 void hci_remote_oob_data_clear(struct hci_dev *hdev) 2660 { 2661 struct oob_data *data, *n; 2662 2663 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) { 2664 list_del(&data->list); 2665 kfree(data); 2666 } 2667 } 2668 2669 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, 2670 u8 bdaddr_type, u8 *hash192, u8 *rand192, 2671 u8 *hash256, u8 *rand256) 2672 { 2673 struct oob_data *data; 2674 2675 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type); 2676 if (!data) { 2677 data = kmalloc(sizeof(*data), GFP_KERNEL); 2678 if (!data) 2679 return -ENOMEM; 2680 2681 bacpy(&data->bdaddr, bdaddr); 2682 data->bdaddr_type = bdaddr_type; 2683 list_add(&data->list, &hdev->remote_oob_data); 2684 } 2685 2686 if (hash192 && rand192) { 2687 memcpy(data->hash192, hash192, sizeof(data->hash192)); 2688 memcpy(data->rand192, rand192, sizeof(data->rand192)); 2689 if (hash256 && rand256) 2690 data->present = 0x03; 2691 } else { 2692 memset(data->hash192, 0, sizeof(data->hash192)); 2693 memset(data->rand192, 0, sizeof(data->rand192)); 2694 if (hash256 && rand256) 2695 data->present = 0x02; 2696 else 2697 data->present = 0x00; 2698 } 2699 2700 if (hash256 && rand256) { 2701 memcpy(data->hash256, hash256, sizeof(data->hash256)); 2702 memcpy(data->rand256, rand256, sizeof(data->rand256)); 2703 } else { 2704 memset(data->hash256, 0, sizeof(data->hash256)); 2705 memset(data->rand256, 0, sizeof(data->rand256)); 2706 if (hash192 && rand192) 2707 data->present = 0x01; 2708 } 2709 2710 BT_DBG("%s for %pMR", hdev->name, bdaddr); 2711 2712 return 0; 2713 } 2714 2715 /* This function requires the caller holds hdev->lock */ 2716 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance) 2717 { 2718 struct adv_info *adv_instance; 2719 2720 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 2721 if (adv_instance->instance == instance) 2722 return adv_instance; 2723 } 2724 2725 return NULL; 2726 } 2727 2728 /* This function requires the caller holds hdev->lock */ 2729 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance) { 2730 struct adv_info *cur_instance; 2731 2732 cur_instance = hci_find_adv_instance(hdev, instance); 2733 if (!cur_instance) 2734 return NULL; 2735 2736 if (cur_instance == list_last_entry(&hdev->adv_instances, 2737 struct adv_info, list)) 2738 return list_first_entry(&hdev->adv_instances, 2739 struct adv_info, list); 2740 else 2741 return list_next_entry(cur_instance, list); 2742 } 2743 2744 /* This function requires the caller holds hdev->lock */ 2745 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance) 2746 { 2747 struct adv_info *adv_instance; 2748 2749 adv_instance = hci_find_adv_instance(hdev, instance); 2750 if (!adv_instance) 2751 return -ENOENT; 2752 2753 BT_DBG("%s removing %dMR", hdev->name, instance); 2754 2755 if (hdev->cur_adv_instance == instance && hdev->adv_instance_timeout) { 2756 cancel_delayed_work(&hdev->adv_instance_expire); 2757 hdev->adv_instance_timeout = 0; 2758 } 2759 2760 list_del(&adv_instance->list); 2761 kfree(adv_instance); 2762 2763 hdev->adv_instance_cnt--; 2764 2765 return 0; 2766 } 2767 2768 /* This function requires the caller holds hdev->lock */ 2769 void hci_adv_instances_clear(struct hci_dev *hdev) 2770 { 2771 struct adv_info *adv_instance, *n; 2772 2773 if (hdev->adv_instance_timeout) { 2774 cancel_delayed_work(&hdev->adv_instance_expire); 2775 hdev->adv_instance_timeout = 0; 2776 } 2777 2778 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { 2779 list_del(&adv_instance->list); 2780 kfree(adv_instance); 2781 } 2782 2783 hdev->adv_instance_cnt = 0; 2784 } 2785 2786 /* This function requires the caller holds hdev->lock */ 2787 int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags, 2788 u16 adv_data_len, u8 *adv_data, 2789 u16 scan_rsp_len, u8 *scan_rsp_data, 2790 u16 timeout, u16 duration) 2791 { 2792 struct adv_info *adv_instance; 2793 2794 adv_instance = hci_find_adv_instance(hdev, instance); 2795 if (adv_instance) { 2796 memset(adv_instance->adv_data, 0, 2797 sizeof(adv_instance->adv_data)); 2798 memset(adv_instance->scan_rsp_data, 0, 2799 sizeof(adv_instance->scan_rsp_data)); 2800 } else { 2801 if (hdev->adv_instance_cnt >= HCI_MAX_ADV_INSTANCES || 2802 instance < 1 || instance > HCI_MAX_ADV_INSTANCES) 2803 return -EOVERFLOW; 2804 2805 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL); 2806 if (!adv_instance) 2807 return -ENOMEM; 2808 2809 adv_instance->pending = true; 2810 adv_instance->instance = instance; 2811 list_add(&adv_instance->list, &hdev->adv_instances); 2812 hdev->adv_instance_cnt++; 2813 } 2814 2815 adv_instance->flags = flags; 2816 adv_instance->adv_data_len = adv_data_len; 2817 adv_instance->scan_rsp_len = scan_rsp_len; 2818 2819 if (adv_data_len) 2820 memcpy(adv_instance->adv_data, adv_data, adv_data_len); 2821 2822 if (scan_rsp_len) 2823 memcpy(adv_instance->scan_rsp_data, 2824 scan_rsp_data, scan_rsp_len); 2825 2826 adv_instance->timeout = timeout; 2827 adv_instance->remaining_time = timeout; 2828 2829 if (duration == 0) 2830 adv_instance->duration = HCI_DEFAULT_ADV_DURATION; 2831 else 2832 adv_instance->duration = duration; 2833 2834 BT_DBG("%s for %dMR", hdev->name, instance); 2835 2836 return 0; 2837 } 2838 2839 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list, 2840 bdaddr_t *bdaddr, u8 type) 2841 { 2842 struct bdaddr_list *b; 2843 2844 list_for_each_entry(b, bdaddr_list, list) { 2845 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type) 2846 return b; 2847 } 2848 2849 return NULL; 2850 } 2851 2852 void hci_bdaddr_list_clear(struct list_head *bdaddr_list) 2853 { 2854 struct list_head *p, *n; 2855 2856 list_for_each_safe(p, n, bdaddr_list) { 2857 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list); 2858 2859 list_del(p); 2860 kfree(b); 2861 } 2862 } 2863 2864 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type) 2865 { 2866 struct bdaddr_list *entry; 2867 2868 if (!bacmp(bdaddr, BDADDR_ANY)) 2869 return -EBADF; 2870 2871 if (hci_bdaddr_list_lookup(list, bdaddr, type)) 2872 return -EEXIST; 2873 2874 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 2875 if (!entry) 2876 return -ENOMEM; 2877 2878 bacpy(&entry->bdaddr, bdaddr); 2879 entry->bdaddr_type = type; 2880 2881 list_add(&entry->list, list); 2882 2883 return 0; 2884 } 2885 2886 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type) 2887 { 2888 struct bdaddr_list *entry; 2889 2890 if (!bacmp(bdaddr, BDADDR_ANY)) { 2891 hci_bdaddr_list_clear(list); 2892 return 0; 2893 } 2894 2895 entry = hci_bdaddr_list_lookup(list, bdaddr, type); 2896 if (!entry) 2897 return -ENOENT; 2898 2899 list_del(&entry->list); 2900 kfree(entry); 2901 2902 return 0; 2903 } 2904 2905 /* This function requires the caller holds hdev->lock */ 2906 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev, 2907 bdaddr_t *addr, u8 addr_type) 2908 { 2909 struct hci_conn_params *params; 2910 2911 list_for_each_entry(params, &hdev->le_conn_params, list) { 2912 if (bacmp(¶ms->addr, addr) == 0 && 2913 params->addr_type == addr_type) { 2914 return params; 2915 } 2916 } 2917 2918 return NULL; 2919 } 2920 2921 /* This function requires the caller holds hdev->lock */ 2922 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list, 2923 bdaddr_t *addr, u8 addr_type) 2924 { 2925 struct hci_conn_params *param; 2926 2927 list_for_each_entry(param, list, action) { 2928 if (bacmp(¶m->addr, addr) == 0 && 2929 param->addr_type == addr_type) 2930 return param; 2931 } 2932 2933 return NULL; 2934 } 2935 2936 /* This function requires the caller holds hdev->lock */ 2937 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev, 2938 bdaddr_t *addr, u8 addr_type) 2939 { 2940 struct hci_conn_params *params; 2941 2942 params = hci_conn_params_lookup(hdev, addr, addr_type); 2943 if (params) 2944 return params; 2945 2946 params = kzalloc(sizeof(*params), GFP_KERNEL); 2947 if (!params) { 2948 BT_ERR("Out of memory"); 2949 return NULL; 2950 } 2951 2952 bacpy(¶ms->addr, addr); 2953 params->addr_type = addr_type; 2954 2955 list_add(¶ms->list, &hdev->le_conn_params); 2956 INIT_LIST_HEAD(¶ms->action); 2957 2958 params->conn_min_interval = hdev->le_conn_min_interval; 2959 params->conn_max_interval = hdev->le_conn_max_interval; 2960 params->conn_latency = hdev->le_conn_latency; 2961 params->supervision_timeout = hdev->le_supv_timeout; 2962 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2963 2964 BT_DBG("addr %pMR (type %u)", addr, addr_type); 2965 2966 return params; 2967 } 2968 2969 static void hci_conn_params_free(struct hci_conn_params *params) 2970 { 2971 if (params->conn) { 2972 hci_conn_drop(params->conn); 2973 hci_conn_put(params->conn); 2974 } 2975 2976 list_del(¶ms->action); 2977 list_del(¶ms->list); 2978 kfree(params); 2979 } 2980 2981 /* This function requires the caller holds hdev->lock */ 2982 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type) 2983 { 2984 struct hci_conn_params *params; 2985 2986 params = hci_conn_params_lookup(hdev, addr, addr_type); 2987 if (!params) 2988 return; 2989 2990 hci_conn_params_free(params); 2991 2992 hci_update_background_scan(hdev); 2993 2994 BT_DBG("addr %pMR (type %u)", addr, addr_type); 2995 } 2996 2997 /* This function requires the caller holds hdev->lock */ 2998 void hci_conn_params_clear_disabled(struct hci_dev *hdev) 2999 { 3000 struct hci_conn_params *params, *tmp; 3001 3002 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) { 3003 if (params->auto_connect != HCI_AUTO_CONN_DISABLED) 3004 continue; 3005 3006 /* If trying to estabilish one time connection to disabled 3007 * device, leave the params, but mark them as just once. 3008 */ 3009 if (params->explicit_connect) { 3010 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 3011 continue; 3012 } 3013 3014 list_del(¶ms->list); 3015 kfree(params); 3016 } 3017 3018 BT_DBG("All LE disabled connection parameters were removed"); 3019 } 3020 3021 /* This function requires the caller holds hdev->lock */ 3022 void hci_conn_params_clear_all(struct hci_dev *hdev) 3023 { 3024 struct hci_conn_params *params, *tmp; 3025 3026 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) 3027 hci_conn_params_free(params); 3028 3029 hci_update_background_scan(hdev); 3030 3031 BT_DBG("All LE connection parameters were removed"); 3032 } 3033 3034 static void inquiry_complete(struct hci_dev *hdev, u8 status, u16 opcode) 3035 { 3036 if (status) { 3037 BT_ERR("Failed to start inquiry: status %d", status); 3038 3039 hci_dev_lock(hdev); 3040 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 3041 hci_dev_unlock(hdev); 3042 return; 3043 } 3044 } 3045 3046 static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status, 3047 u16 opcode) 3048 { 3049 /* General inquiry access code (GIAC) */ 3050 u8 lap[3] = { 0x33, 0x8b, 0x9e }; 3051 struct hci_cp_inquiry cp; 3052 int err; 3053 3054 if (status) { 3055 BT_ERR("Failed to disable LE scanning: status %d", status); 3056 return; 3057 } 3058 3059 hdev->discovery.scan_start = 0; 3060 3061 switch (hdev->discovery.type) { 3062 case DISCOV_TYPE_LE: 3063 hci_dev_lock(hdev); 3064 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 3065 hci_dev_unlock(hdev); 3066 break; 3067 3068 case DISCOV_TYPE_INTERLEAVED: 3069 hci_dev_lock(hdev); 3070 3071 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, 3072 &hdev->quirks)) { 3073 /* If we were running LE only scan, change discovery 3074 * state. If we were running both LE and BR/EDR inquiry 3075 * simultaneously, and BR/EDR inquiry is already 3076 * finished, stop discovery, otherwise BR/EDR inquiry 3077 * will stop discovery when finished. If we will resolve 3078 * remote device name, do not change discovery state. 3079 */ 3080 if (!test_bit(HCI_INQUIRY, &hdev->flags) && 3081 hdev->discovery.state != DISCOVERY_RESOLVING) 3082 hci_discovery_set_state(hdev, 3083 DISCOVERY_STOPPED); 3084 } else { 3085 struct hci_request req; 3086 3087 hci_inquiry_cache_flush(hdev); 3088 3089 hci_req_init(&req, hdev); 3090 3091 memset(&cp, 0, sizeof(cp)); 3092 memcpy(&cp.lap, lap, sizeof(cp.lap)); 3093 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN; 3094 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp); 3095 3096 err = hci_req_run(&req, inquiry_complete); 3097 if (err) { 3098 BT_ERR("Inquiry request failed: err %d", err); 3099 hci_discovery_set_state(hdev, 3100 DISCOVERY_STOPPED); 3101 } 3102 } 3103 3104 hci_dev_unlock(hdev); 3105 break; 3106 } 3107 } 3108 3109 static void le_scan_disable_work(struct work_struct *work) 3110 { 3111 struct hci_dev *hdev = container_of(work, struct hci_dev, 3112 le_scan_disable.work); 3113 struct hci_request req; 3114 int err; 3115 3116 BT_DBG("%s", hdev->name); 3117 3118 cancel_delayed_work_sync(&hdev->le_scan_restart); 3119 3120 hci_req_init(&req, hdev); 3121 3122 hci_req_add_le_scan_disable(&req); 3123 3124 err = hci_req_run(&req, le_scan_disable_work_complete); 3125 if (err) 3126 BT_ERR("Disable LE scanning request failed: err %d", err); 3127 } 3128 3129 static void le_scan_restart_work_complete(struct hci_dev *hdev, u8 status, 3130 u16 opcode) 3131 { 3132 unsigned long timeout, duration, scan_start, now; 3133 3134 BT_DBG("%s", hdev->name); 3135 3136 if (status) { 3137 BT_ERR("Failed to restart LE scan: status %d", status); 3138 return; 3139 } 3140 3141 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) || 3142 !hdev->discovery.scan_start) 3143 return; 3144 3145 /* When the scan was started, hdev->le_scan_disable has been queued 3146 * after duration from scan_start. During scan restart this job 3147 * has been canceled, and we need to queue it again after proper 3148 * timeout, to make sure that scan does not run indefinitely. 3149 */ 3150 duration = hdev->discovery.scan_duration; 3151 scan_start = hdev->discovery.scan_start; 3152 now = jiffies; 3153 if (now - scan_start <= duration) { 3154 int elapsed; 3155 3156 if (now >= scan_start) 3157 elapsed = now - scan_start; 3158 else 3159 elapsed = ULONG_MAX - scan_start + now; 3160 3161 timeout = duration - elapsed; 3162 } else { 3163 timeout = 0; 3164 } 3165 queue_delayed_work(hdev->workqueue, 3166 &hdev->le_scan_disable, timeout); 3167 } 3168 3169 static void le_scan_restart_work(struct work_struct *work) 3170 { 3171 struct hci_dev *hdev = container_of(work, struct hci_dev, 3172 le_scan_restart.work); 3173 struct hci_request req; 3174 struct hci_cp_le_set_scan_enable cp; 3175 int err; 3176 3177 BT_DBG("%s", hdev->name); 3178 3179 /* If controller is not scanning we are done. */ 3180 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 3181 return; 3182 3183 hci_req_init(&req, hdev); 3184 3185 hci_req_add_le_scan_disable(&req); 3186 3187 memset(&cp, 0, sizeof(cp)); 3188 cp.enable = LE_SCAN_ENABLE; 3189 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE; 3190 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp); 3191 3192 err = hci_req_run(&req, le_scan_restart_work_complete); 3193 if (err) 3194 BT_ERR("Restart LE scan request failed: err %d", err); 3195 } 3196 3197 /* Copy the Identity Address of the controller. 3198 * 3199 * If the controller has a public BD_ADDR, then by default use that one. 3200 * If this is a LE only controller without a public address, default to 3201 * the static random address. 3202 * 3203 * For debugging purposes it is possible to force controllers with a 3204 * public address to use the static random address instead. 3205 * 3206 * In case BR/EDR has been disabled on a dual-mode controller and 3207 * userspace has configured a static address, then that address 3208 * becomes the identity address instead of the public BR/EDR address. 3209 */ 3210 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr, 3211 u8 *bdaddr_type) 3212 { 3213 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 3214 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 3215 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 3216 bacmp(&hdev->static_addr, BDADDR_ANY))) { 3217 bacpy(bdaddr, &hdev->static_addr); 3218 *bdaddr_type = ADDR_LE_DEV_RANDOM; 3219 } else { 3220 bacpy(bdaddr, &hdev->bdaddr); 3221 *bdaddr_type = ADDR_LE_DEV_PUBLIC; 3222 } 3223 } 3224 3225 /* Alloc HCI device */ 3226 struct hci_dev *hci_alloc_dev(void) 3227 { 3228 struct hci_dev *hdev; 3229 3230 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL); 3231 if (!hdev) 3232 return NULL; 3233 3234 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); 3235 hdev->esco_type = (ESCO_HV1); 3236 hdev->link_mode = (HCI_LM_ACCEPT); 3237 hdev->num_iac = 0x01; /* One IAC support is mandatory */ 3238 hdev->io_capability = 0x03; /* No Input No Output */ 3239 hdev->manufacturer = 0xffff; /* Default to internal use */ 3240 hdev->inq_tx_power = HCI_TX_POWER_INVALID; 3241 hdev->adv_tx_power = HCI_TX_POWER_INVALID; 3242 hdev->adv_instance_cnt = 0; 3243 hdev->cur_adv_instance = 0x00; 3244 hdev->adv_instance_timeout = 0; 3245 3246 hdev->sniff_max_interval = 800; 3247 hdev->sniff_min_interval = 80; 3248 3249 hdev->le_adv_channel_map = 0x07; 3250 hdev->le_adv_min_interval = 0x0800; 3251 hdev->le_adv_max_interval = 0x0800; 3252 hdev->le_scan_interval = 0x0060; 3253 hdev->le_scan_window = 0x0030; 3254 hdev->le_conn_min_interval = 0x0028; 3255 hdev->le_conn_max_interval = 0x0038; 3256 hdev->le_conn_latency = 0x0000; 3257 hdev->le_supv_timeout = 0x002a; 3258 hdev->le_def_tx_len = 0x001b; 3259 hdev->le_def_tx_time = 0x0148; 3260 hdev->le_max_tx_len = 0x001b; 3261 hdev->le_max_tx_time = 0x0148; 3262 hdev->le_max_rx_len = 0x001b; 3263 hdev->le_max_rx_time = 0x0148; 3264 3265 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT; 3266 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT; 3267 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE; 3268 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE; 3269 3270 mutex_init(&hdev->lock); 3271 mutex_init(&hdev->req_lock); 3272 3273 INIT_LIST_HEAD(&hdev->mgmt_pending); 3274 INIT_LIST_HEAD(&hdev->blacklist); 3275 INIT_LIST_HEAD(&hdev->whitelist); 3276 INIT_LIST_HEAD(&hdev->uuids); 3277 INIT_LIST_HEAD(&hdev->link_keys); 3278 INIT_LIST_HEAD(&hdev->long_term_keys); 3279 INIT_LIST_HEAD(&hdev->identity_resolving_keys); 3280 INIT_LIST_HEAD(&hdev->remote_oob_data); 3281 INIT_LIST_HEAD(&hdev->le_white_list); 3282 INIT_LIST_HEAD(&hdev->le_conn_params); 3283 INIT_LIST_HEAD(&hdev->pend_le_conns); 3284 INIT_LIST_HEAD(&hdev->pend_le_reports); 3285 INIT_LIST_HEAD(&hdev->conn_hash.list); 3286 INIT_LIST_HEAD(&hdev->adv_instances); 3287 3288 INIT_WORK(&hdev->rx_work, hci_rx_work); 3289 INIT_WORK(&hdev->cmd_work, hci_cmd_work); 3290 INIT_WORK(&hdev->tx_work, hci_tx_work); 3291 INIT_WORK(&hdev->power_on, hci_power_on); 3292 INIT_WORK(&hdev->error_reset, hci_error_reset); 3293 3294 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off); 3295 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off); 3296 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work); 3297 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work); 3298 INIT_DELAYED_WORK(&hdev->adv_instance_expire, hci_adv_timeout_expire); 3299 3300 skb_queue_head_init(&hdev->rx_q); 3301 skb_queue_head_init(&hdev->cmd_q); 3302 skb_queue_head_init(&hdev->raw_q); 3303 3304 init_waitqueue_head(&hdev->req_wait_q); 3305 3306 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout); 3307 3308 hci_init_sysfs(hdev); 3309 discovery_init(hdev); 3310 3311 return hdev; 3312 } 3313 EXPORT_SYMBOL(hci_alloc_dev); 3314 3315 /* Free HCI device */ 3316 void hci_free_dev(struct hci_dev *hdev) 3317 { 3318 /* will free via device release */ 3319 put_device(&hdev->dev); 3320 } 3321 EXPORT_SYMBOL(hci_free_dev); 3322 3323 /* Register HCI device */ 3324 int hci_register_dev(struct hci_dev *hdev) 3325 { 3326 int id, error; 3327 3328 if (!hdev->open || !hdev->close || !hdev->send) 3329 return -EINVAL; 3330 3331 /* Do not allow HCI_AMP devices to register at index 0, 3332 * so the index can be used as the AMP controller ID. 3333 */ 3334 switch (hdev->dev_type) { 3335 case HCI_BREDR: 3336 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL); 3337 break; 3338 case HCI_AMP: 3339 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL); 3340 break; 3341 default: 3342 return -EINVAL; 3343 } 3344 3345 if (id < 0) 3346 return id; 3347 3348 sprintf(hdev->name, "hci%d", id); 3349 hdev->id = id; 3350 3351 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); 3352 3353 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND | 3354 WQ_MEM_RECLAIM, 1, hdev->name); 3355 if (!hdev->workqueue) { 3356 error = -ENOMEM; 3357 goto err; 3358 } 3359 3360 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND | 3361 WQ_MEM_RECLAIM, 1, hdev->name); 3362 if (!hdev->req_workqueue) { 3363 destroy_workqueue(hdev->workqueue); 3364 error = -ENOMEM; 3365 goto err; 3366 } 3367 3368 if (!IS_ERR_OR_NULL(bt_debugfs)) 3369 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs); 3370 3371 dev_set_name(&hdev->dev, "%s", hdev->name); 3372 3373 error = device_add(&hdev->dev); 3374 if (error < 0) 3375 goto err_wqueue; 3376 3377 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev, 3378 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, 3379 hdev); 3380 if (hdev->rfkill) { 3381 if (rfkill_register(hdev->rfkill) < 0) { 3382 rfkill_destroy(hdev->rfkill); 3383 hdev->rfkill = NULL; 3384 } 3385 } 3386 3387 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) 3388 hci_dev_set_flag(hdev, HCI_RFKILLED); 3389 3390 hci_dev_set_flag(hdev, HCI_SETUP); 3391 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 3392 3393 if (hdev->dev_type == HCI_BREDR) { 3394 /* Assume BR/EDR support until proven otherwise (such as 3395 * through reading supported features during init. 3396 */ 3397 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 3398 } 3399 3400 write_lock(&hci_dev_list_lock); 3401 list_add(&hdev->list, &hci_dev_list); 3402 write_unlock(&hci_dev_list_lock); 3403 3404 /* Devices that are marked for raw-only usage are unconfigured 3405 * and should not be included in normal operation. 3406 */ 3407 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 3408 hci_dev_set_flag(hdev, HCI_UNCONFIGURED); 3409 3410 hci_sock_dev_event(hdev, HCI_DEV_REG); 3411 hci_dev_hold(hdev); 3412 3413 queue_work(hdev->req_workqueue, &hdev->power_on); 3414 3415 return id; 3416 3417 err_wqueue: 3418 destroy_workqueue(hdev->workqueue); 3419 destroy_workqueue(hdev->req_workqueue); 3420 err: 3421 ida_simple_remove(&hci_index_ida, hdev->id); 3422 3423 return error; 3424 } 3425 EXPORT_SYMBOL(hci_register_dev); 3426 3427 /* Unregister HCI device */ 3428 void hci_unregister_dev(struct hci_dev *hdev) 3429 { 3430 int id; 3431 3432 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); 3433 3434 hci_dev_set_flag(hdev, HCI_UNREGISTER); 3435 3436 id = hdev->id; 3437 3438 write_lock(&hci_dev_list_lock); 3439 list_del(&hdev->list); 3440 write_unlock(&hci_dev_list_lock); 3441 3442 hci_dev_do_close(hdev); 3443 3444 cancel_work_sync(&hdev->power_on); 3445 3446 if (!test_bit(HCI_INIT, &hdev->flags) && 3447 !hci_dev_test_flag(hdev, HCI_SETUP) && 3448 !hci_dev_test_flag(hdev, HCI_CONFIG)) { 3449 hci_dev_lock(hdev); 3450 mgmt_index_removed(hdev); 3451 hci_dev_unlock(hdev); 3452 } 3453 3454 /* mgmt_index_removed should take care of emptying the 3455 * pending list */ 3456 BUG_ON(!list_empty(&hdev->mgmt_pending)); 3457 3458 hci_sock_dev_event(hdev, HCI_DEV_UNREG); 3459 3460 if (hdev->rfkill) { 3461 rfkill_unregister(hdev->rfkill); 3462 rfkill_destroy(hdev->rfkill); 3463 } 3464 3465 device_del(&hdev->dev); 3466 3467 debugfs_remove_recursive(hdev->debugfs); 3468 3469 destroy_workqueue(hdev->workqueue); 3470 destroy_workqueue(hdev->req_workqueue); 3471 3472 hci_dev_lock(hdev); 3473 hci_bdaddr_list_clear(&hdev->blacklist); 3474 hci_bdaddr_list_clear(&hdev->whitelist); 3475 hci_uuids_clear(hdev); 3476 hci_link_keys_clear(hdev); 3477 hci_smp_ltks_clear(hdev); 3478 hci_smp_irks_clear(hdev); 3479 hci_remote_oob_data_clear(hdev); 3480 hci_adv_instances_clear(hdev); 3481 hci_bdaddr_list_clear(&hdev->le_white_list); 3482 hci_conn_params_clear_all(hdev); 3483 hci_discovery_filter_clear(hdev); 3484 hci_dev_unlock(hdev); 3485 3486 hci_dev_put(hdev); 3487 3488 ida_simple_remove(&hci_index_ida, id); 3489 } 3490 EXPORT_SYMBOL(hci_unregister_dev); 3491 3492 /* Suspend HCI device */ 3493 int hci_suspend_dev(struct hci_dev *hdev) 3494 { 3495 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND); 3496 return 0; 3497 } 3498 EXPORT_SYMBOL(hci_suspend_dev); 3499 3500 /* Resume HCI device */ 3501 int hci_resume_dev(struct hci_dev *hdev) 3502 { 3503 hci_sock_dev_event(hdev, HCI_DEV_RESUME); 3504 return 0; 3505 } 3506 EXPORT_SYMBOL(hci_resume_dev); 3507 3508 /* Reset HCI device */ 3509 int hci_reset_dev(struct hci_dev *hdev) 3510 { 3511 const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 }; 3512 struct sk_buff *skb; 3513 3514 skb = bt_skb_alloc(3, GFP_ATOMIC); 3515 if (!skb) 3516 return -ENOMEM; 3517 3518 bt_cb(skb)->pkt_type = HCI_EVENT_PKT; 3519 memcpy(skb_put(skb, 3), hw_err, 3); 3520 3521 /* Send Hardware Error to upper stack */ 3522 return hci_recv_frame(hdev, skb); 3523 } 3524 EXPORT_SYMBOL(hci_reset_dev); 3525 3526 /* Receive frame from HCI drivers */ 3527 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb) 3528 { 3529 if (!hdev || (!test_bit(HCI_UP, &hdev->flags) 3530 && !test_bit(HCI_INIT, &hdev->flags))) { 3531 kfree_skb(skb); 3532 return -ENXIO; 3533 } 3534 3535 if (bt_cb(skb)->pkt_type != HCI_EVENT_PKT && 3536 bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT && 3537 bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) { 3538 kfree_skb(skb); 3539 return -EINVAL; 3540 } 3541 3542 /* Incoming skb */ 3543 bt_cb(skb)->incoming = 1; 3544 3545 /* Time stamp */ 3546 __net_timestamp(skb); 3547 3548 skb_queue_tail(&hdev->rx_q, skb); 3549 queue_work(hdev->workqueue, &hdev->rx_work); 3550 3551 return 0; 3552 } 3553 EXPORT_SYMBOL(hci_recv_frame); 3554 3555 /* Receive diagnostic message from HCI drivers */ 3556 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb) 3557 { 3558 /* Mark as diagnostic packet */ 3559 bt_cb(skb)->pkt_type = HCI_DIAG_PKT; 3560 3561 /* Time stamp */ 3562 __net_timestamp(skb); 3563 3564 skb_queue_tail(&hdev->rx_q, skb); 3565 queue_work(hdev->workqueue, &hdev->rx_work); 3566 3567 return 0; 3568 } 3569 EXPORT_SYMBOL(hci_recv_diag); 3570 3571 /* ---- Interface to upper protocols ---- */ 3572 3573 int hci_register_cb(struct hci_cb *cb) 3574 { 3575 BT_DBG("%p name %s", cb, cb->name); 3576 3577 mutex_lock(&hci_cb_list_lock); 3578 list_add_tail(&cb->list, &hci_cb_list); 3579 mutex_unlock(&hci_cb_list_lock); 3580 3581 return 0; 3582 } 3583 EXPORT_SYMBOL(hci_register_cb); 3584 3585 int hci_unregister_cb(struct hci_cb *cb) 3586 { 3587 BT_DBG("%p name %s", cb, cb->name); 3588 3589 mutex_lock(&hci_cb_list_lock); 3590 list_del(&cb->list); 3591 mutex_unlock(&hci_cb_list_lock); 3592 3593 return 0; 3594 } 3595 EXPORT_SYMBOL(hci_unregister_cb); 3596 3597 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 3598 { 3599 int err; 3600 3601 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len); 3602 3603 /* Time stamp */ 3604 __net_timestamp(skb); 3605 3606 /* Send copy to monitor */ 3607 hci_send_to_monitor(hdev, skb); 3608 3609 if (atomic_read(&hdev->promisc)) { 3610 /* Send copy to the sockets */ 3611 hci_send_to_sock(hdev, skb); 3612 } 3613 3614 /* Get rid of skb owner, prior to sending to the driver. */ 3615 skb_orphan(skb); 3616 3617 if (!test_bit(HCI_RUNNING, &hdev->flags)) { 3618 kfree_skb(skb); 3619 return; 3620 } 3621 3622 err = hdev->send(hdev, skb); 3623 if (err < 0) { 3624 BT_ERR("%s sending frame failed (%d)", hdev->name, err); 3625 kfree_skb(skb); 3626 } 3627 } 3628 3629 /* Send HCI command */ 3630 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, 3631 const void *param) 3632 { 3633 struct sk_buff *skb; 3634 3635 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen); 3636 3637 skb = hci_prepare_cmd(hdev, opcode, plen, param); 3638 if (!skb) { 3639 BT_ERR("%s no memory for command", hdev->name); 3640 return -ENOMEM; 3641 } 3642 3643 /* Stand-alone HCI commands must be flagged as 3644 * single-command requests. 3645 */ 3646 bt_cb(skb)->hci.req_start = true; 3647 3648 skb_queue_tail(&hdev->cmd_q, skb); 3649 queue_work(hdev->workqueue, &hdev->cmd_work); 3650 3651 return 0; 3652 } 3653 3654 /* Get data from the previously sent command */ 3655 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode) 3656 { 3657 struct hci_command_hdr *hdr; 3658 3659 if (!hdev->sent_cmd) 3660 return NULL; 3661 3662 hdr = (void *) hdev->sent_cmd->data; 3663 3664 if (hdr->opcode != cpu_to_le16(opcode)) 3665 return NULL; 3666 3667 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode); 3668 3669 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE; 3670 } 3671 3672 /* Send HCI command and wait for command commplete event */ 3673 struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen, 3674 const void *param, u32 timeout) 3675 { 3676 struct sk_buff *skb; 3677 3678 if (!test_bit(HCI_UP, &hdev->flags)) 3679 return ERR_PTR(-ENETDOWN); 3680 3681 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen); 3682 3683 hci_req_lock(hdev); 3684 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout); 3685 hci_req_unlock(hdev); 3686 3687 return skb; 3688 } 3689 EXPORT_SYMBOL(hci_cmd_sync); 3690 3691 /* Send ACL data */ 3692 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags) 3693 { 3694 struct hci_acl_hdr *hdr; 3695 int len = skb->len; 3696 3697 skb_push(skb, HCI_ACL_HDR_SIZE); 3698 skb_reset_transport_header(skb); 3699 hdr = (struct hci_acl_hdr *)skb_transport_header(skb); 3700 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags)); 3701 hdr->dlen = cpu_to_le16(len); 3702 } 3703 3704 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue, 3705 struct sk_buff *skb, __u16 flags) 3706 { 3707 struct hci_conn *conn = chan->conn; 3708 struct hci_dev *hdev = conn->hdev; 3709 struct sk_buff *list; 3710 3711 skb->len = skb_headlen(skb); 3712 skb->data_len = 0; 3713 3714 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 3715 3716 switch (hdev->dev_type) { 3717 case HCI_BREDR: 3718 hci_add_acl_hdr(skb, conn->handle, flags); 3719 break; 3720 case HCI_AMP: 3721 hci_add_acl_hdr(skb, chan->handle, flags); 3722 break; 3723 default: 3724 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type); 3725 return; 3726 } 3727 3728 list = skb_shinfo(skb)->frag_list; 3729 if (!list) { 3730 /* Non fragmented */ 3731 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len); 3732 3733 skb_queue_tail(queue, skb); 3734 } else { 3735 /* Fragmented */ 3736 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 3737 3738 skb_shinfo(skb)->frag_list = NULL; 3739 3740 /* Queue all fragments atomically. We need to use spin_lock_bh 3741 * here because of 6LoWPAN links, as there this function is 3742 * called from softirq and using normal spin lock could cause 3743 * deadlocks. 3744 */ 3745 spin_lock_bh(&queue->lock); 3746 3747 __skb_queue_tail(queue, skb); 3748 3749 flags &= ~ACL_START; 3750 flags |= ACL_CONT; 3751 do { 3752 skb = list; list = list->next; 3753 3754 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT; 3755 hci_add_acl_hdr(skb, conn->handle, flags); 3756 3757 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 3758 3759 __skb_queue_tail(queue, skb); 3760 } while (list); 3761 3762 spin_unlock_bh(&queue->lock); 3763 } 3764 } 3765 3766 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags) 3767 { 3768 struct hci_dev *hdev = chan->conn->hdev; 3769 3770 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags); 3771 3772 hci_queue_acl(chan, &chan->data_q, skb, flags); 3773 3774 queue_work(hdev->workqueue, &hdev->tx_work); 3775 } 3776 3777 /* Send SCO data */ 3778 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb) 3779 { 3780 struct hci_dev *hdev = conn->hdev; 3781 struct hci_sco_hdr hdr; 3782 3783 BT_DBG("%s len %d", hdev->name, skb->len); 3784 3785 hdr.handle = cpu_to_le16(conn->handle); 3786 hdr.dlen = skb->len; 3787 3788 skb_push(skb, HCI_SCO_HDR_SIZE); 3789 skb_reset_transport_header(skb); 3790 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE); 3791 3792 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT; 3793 3794 skb_queue_tail(&conn->data_q, skb); 3795 queue_work(hdev->workqueue, &hdev->tx_work); 3796 } 3797 3798 /* ---- HCI TX task (outgoing data) ---- */ 3799 3800 /* HCI Connection scheduler */ 3801 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, 3802 int *quote) 3803 { 3804 struct hci_conn_hash *h = &hdev->conn_hash; 3805 struct hci_conn *conn = NULL, *c; 3806 unsigned int num = 0, min = ~0; 3807 3808 /* We don't have to lock device here. Connections are always 3809 * added and removed with TX task disabled. */ 3810 3811 rcu_read_lock(); 3812 3813 list_for_each_entry_rcu(c, &h->list, list) { 3814 if (c->type != type || skb_queue_empty(&c->data_q)) 3815 continue; 3816 3817 if (c->state != BT_CONNECTED && c->state != BT_CONFIG) 3818 continue; 3819 3820 num++; 3821 3822 if (c->sent < min) { 3823 min = c->sent; 3824 conn = c; 3825 } 3826 3827 if (hci_conn_num(hdev, type) == num) 3828 break; 3829 } 3830 3831 rcu_read_unlock(); 3832 3833 if (conn) { 3834 int cnt, q; 3835 3836 switch (conn->type) { 3837 case ACL_LINK: 3838 cnt = hdev->acl_cnt; 3839 break; 3840 case SCO_LINK: 3841 case ESCO_LINK: 3842 cnt = hdev->sco_cnt; 3843 break; 3844 case LE_LINK: 3845 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt; 3846 break; 3847 default: 3848 cnt = 0; 3849 BT_ERR("Unknown link type"); 3850 } 3851 3852 q = cnt / num; 3853 *quote = q ? q : 1; 3854 } else 3855 *quote = 0; 3856 3857 BT_DBG("conn %p quote %d", conn, *quote); 3858 return conn; 3859 } 3860 3861 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type) 3862 { 3863 struct hci_conn_hash *h = &hdev->conn_hash; 3864 struct hci_conn *c; 3865 3866 BT_ERR("%s link tx timeout", hdev->name); 3867 3868 rcu_read_lock(); 3869 3870 /* Kill stalled connections */ 3871 list_for_each_entry_rcu(c, &h->list, list) { 3872 if (c->type == type && c->sent) { 3873 BT_ERR("%s killing stalled connection %pMR", 3874 hdev->name, &c->dst); 3875 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM); 3876 } 3877 } 3878 3879 rcu_read_unlock(); 3880 } 3881 3882 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type, 3883 int *quote) 3884 { 3885 struct hci_conn_hash *h = &hdev->conn_hash; 3886 struct hci_chan *chan = NULL; 3887 unsigned int num = 0, min = ~0, cur_prio = 0; 3888 struct hci_conn *conn; 3889 int cnt, q, conn_num = 0; 3890 3891 BT_DBG("%s", hdev->name); 3892 3893 rcu_read_lock(); 3894 3895 list_for_each_entry_rcu(conn, &h->list, list) { 3896 struct hci_chan *tmp; 3897 3898 if (conn->type != type) 3899 continue; 3900 3901 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG) 3902 continue; 3903 3904 conn_num++; 3905 3906 list_for_each_entry_rcu(tmp, &conn->chan_list, list) { 3907 struct sk_buff *skb; 3908 3909 if (skb_queue_empty(&tmp->data_q)) 3910 continue; 3911 3912 skb = skb_peek(&tmp->data_q); 3913 if (skb->priority < cur_prio) 3914 continue; 3915 3916 if (skb->priority > cur_prio) { 3917 num = 0; 3918 min = ~0; 3919 cur_prio = skb->priority; 3920 } 3921 3922 num++; 3923 3924 if (conn->sent < min) { 3925 min = conn->sent; 3926 chan = tmp; 3927 } 3928 } 3929 3930 if (hci_conn_num(hdev, type) == conn_num) 3931 break; 3932 } 3933 3934 rcu_read_unlock(); 3935 3936 if (!chan) 3937 return NULL; 3938 3939 switch (chan->conn->type) { 3940 case ACL_LINK: 3941 cnt = hdev->acl_cnt; 3942 break; 3943 case AMP_LINK: 3944 cnt = hdev->block_cnt; 3945 break; 3946 case SCO_LINK: 3947 case ESCO_LINK: 3948 cnt = hdev->sco_cnt; 3949 break; 3950 case LE_LINK: 3951 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt; 3952 break; 3953 default: 3954 cnt = 0; 3955 BT_ERR("Unknown link type"); 3956 } 3957 3958 q = cnt / num; 3959 *quote = q ? q : 1; 3960 BT_DBG("chan %p quote %d", chan, *quote); 3961 return chan; 3962 } 3963 3964 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type) 3965 { 3966 struct hci_conn_hash *h = &hdev->conn_hash; 3967 struct hci_conn *conn; 3968 int num = 0; 3969 3970 BT_DBG("%s", hdev->name); 3971 3972 rcu_read_lock(); 3973 3974 list_for_each_entry_rcu(conn, &h->list, list) { 3975 struct hci_chan *chan; 3976 3977 if (conn->type != type) 3978 continue; 3979 3980 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG) 3981 continue; 3982 3983 num++; 3984 3985 list_for_each_entry_rcu(chan, &conn->chan_list, list) { 3986 struct sk_buff *skb; 3987 3988 if (chan->sent) { 3989 chan->sent = 0; 3990 continue; 3991 } 3992 3993 if (skb_queue_empty(&chan->data_q)) 3994 continue; 3995 3996 skb = skb_peek(&chan->data_q); 3997 if (skb->priority >= HCI_PRIO_MAX - 1) 3998 continue; 3999 4000 skb->priority = HCI_PRIO_MAX - 1; 4001 4002 BT_DBG("chan %p skb %p promoted to %d", chan, skb, 4003 skb->priority); 4004 } 4005 4006 if (hci_conn_num(hdev, type) == num) 4007 break; 4008 } 4009 4010 rcu_read_unlock(); 4011 4012 } 4013 4014 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb) 4015 { 4016 /* Calculate count of blocks used by this packet */ 4017 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len); 4018 } 4019 4020 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt) 4021 { 4022 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 4023 /* ACL tx timeout must be longer than maximum 4024 * link supervision timeout (40.9 seconds) */ 4025 if (!cnt && time_after(jiffies, hdev->acl_last_tx + 4026 HCI_ACL_TX_TIMEOUT)) 4027 hci_link_tx_to(hdev, ACL_LINK); 4028 } 4029 } 4030 4031 static void hci_sched_acl_pkt(struct hci_dev *hdev) 4032 { 4033 unsigned int cnt = hdev->acl_cnt; 4034 struct hci_chan *chan; 4035 struct sk_buff *skb; 4036 int quote; 4037 4038 __check_timeout(hdev, cnt); 4039 4040 while (hdev->acl_cnt && 4041 (chan = hci_chan_sent(hdev, ACL_LINK, "e))) { 4042 u32 priority = (skb_peek(&chan->data_q))->priority; 4043 while (quote-- && (skb = skb_peek(&chan->data_q))) { 4044 BT_DBG("chan %p skb %p len %d priority %u", chan, skb, 4045 skb->len, skb->priority); 4046 4047 /* Stop if priority has changed */ 4048 if (skb->priority < priority) 4049 break; 4050 4051 skb = skb_dequeue(&chan->data_q); 4052 4053 hci_conn_enter_active_mode(chan->conn, 4054 bt_cb(skb)->force_active); 4055 4056 hci_send_frame(hdev, skb); 4057 hdev->acl_last_tx = jiffies; 4058 4059 hdev->acl_cnt--; 4060 chan->sent++; 4061 chan->conn->sent++; 4062 } 4063 } 4064 4065 if (cnt != hdev->acl_cnt) 4066 hci_prio_recalculate(hdev, ACL_LINK); 4067 } 4068 4069 static void hci_sched_acl_blk(struct hci_dev *hdev) 4070 { 4071 unsigned int cnt = hdev->block_cnt; 4072 struct hci_chan *chan; 4073 struct sk_buff *skb; 4074 int quote; 4075 u8 type; 4076 4077 __check_timeout(hdev, cnt); 4078 4079 BT_DBG("%s", hdev->name); 4080 4081 if (hdev->dev_type == HCI_AMP) 4082 type = AMP_LINK; 4083 else 4084 type = ACL_LINK; 4085 4086 while (hdev->block_cnt > 0 && 4087 (chan = hci_chan_sent(hdev, type, "e))) { 4088 u32 priority = (skb_peek(&chan->data_q))->priority; 4089 while (quote > 0 && (skb = skb_peek(&chan->data_q))) { 4090 int blocks; 4091 4092 BT_DBG("chan %p skb %p len %d priority %u", chan, skb, 4093 skb->len, skb->priority); 4094 4095 /* Stop if priority has changed */ 4096 if (skb->priority < priority) 4097 break; 4098 4099 skb = skb_dequeue(&chan->data_q); 4100 4101 blocks = __get_blocks(hdev, skb); 4102 if (blocks > hdev->block_cnt) 4103 return; 4104 4105 hci_conn_enter_active_mode(chan->conn, 4106 bt_cb(skb)->force_active); 4107 4108 hci_send_frame(hdev, skb); 4109 hdev->acl_last_tx = jiffies; 4110 4111 hdev->block_cnt -= blocks; 4112 quote -= blocks; 4113 4114 chan->sent += blocks; 4115 chan->conn->sent += blocks; 4116 } 4117 } 4118 4119 if (cnt != hdev->block_cnt) 4120 hci_prio_recalculate(hdev, type); 4121 } 4122 4123 static void hci_sched_acl(struct hci_dev *hdev) 4124 { 4125 BT_DBG("%s", hdev->name); 4126 4127 /* No ACL link over BR/EDR controller */ 4128 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR) 4129 return; 4130 4131 /* No AMP link over AMP controller */ 4132 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP) 4133 return; 4134 4135 switch (hdev->flow_ctl_mode) { 4136 case HCI_FLOW_CTL_MODE_PACKET_BASED: 4137 hci_sched_acl_pkt(hdev); 4138 break; 4139 4140 case HCI_FLOW_CTL_MODE_BLOCK_BASED: 4141 hci_sched_acl_blk(hdev); 4142 break; 4143 } 4144 } 4145 4146 /* Schedule SCO */ 4147 static void hci_sched_sco(struct hci_dev *hdev) 4148 { 4149 struct hci_conn *conn; 4150 struct sk_buff *skb; 4151 int quote; 4152 4153 BT_DBG("%s", hdev->name); 4154 4155 if (!hci_conn_num(hdev, SCO_LINK)) 4156 return; 4157 4158 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) { 4159 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 4160 BT_DBG("skb %p len %d", skb, skb->len); 4161 hci_send_frame(hdev, skb); 4162 4163 conn->sent++; 4164 if (conn->sent == ~0) 4165 conn->sent = 0; 4166 } 4167 } 4168 } 4169 4170 static void hci_sched_esco(struct hci_dev *hdev) 4171 { 4172 struct hci_conn *conn; 4173 struct sk_buff *skb; 4174 int quote; 4175 4176 BT_DBG("%s", hdev->name); 4177 4178 if (!hci_conn_num(hdev, ESCO_LINK)) 4179 return; 4180 4181 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, 4182 "e))) { 4183 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 4184 BT_DBG("skb %p len %d", skb, skb->len); 4185 hci_send_frame(hdev, skb); 4186 4187 conn->sent++; 4188 if (conn->sent == ~0) 4189 conn->sent = 0; 4190 } 4191 } 4192 } 4193 4194 static void hci_sched_le(struct hci_dev *hdev) 4195 { 4196 struct hci_chan *chan; 4197 struct sk_buff *skb; 4198 int quote, cnt, tmp; 4199 4200 BT_DBG("%s", hdev->name); 4201 4202 if (!hci_conn_num(hdev, LE_LINK)) 4203 return; 4204 4205 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 4206 /* LE tx timeout must be longer than maximum 4207 * link supervision timeout (40.9 seconds) */ 4208 if (!hdev->le_cnt && hdev->le_pkts && 4209 time_after(jiffies, hdev->le_last_tx + HZ * 45)) 4210 hci_link_tx_to(hdev, LE_LINK); 4211 } 4212 4213 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt; 4214 tmp = cnt; 4215 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, "e))) { 4216 u32 priority = (skb_peek(&chan->data_q))->priority; 4217 while (quote-- && (skb = skb_peek(&chan->data_q))) { 4218 BT_DBG("chan %p skb %p len %d priority %u", chan, skb, 4219 skb->len, skb->priority); 4220 4221 /* Stop if priority has changed */ 4222 if (skb->priority < priority) 4223 break; 4224 4225 skb = skb_dequeue(&chan->data_q); 4226 4227 hci_send_frame(hdev, skb); 4228 hdev->le_last_tx = jiffies; 4229 4230 cnt--; 4231 chan->sent++; 4232 chan->conn->sent++; 4233 } 4234 } 4235 4236 if (hdev->le_pkts) 4237 hdev->le_cnt = cnt; 4238 else 4239 hdev->acl_cnt = cnt; 4240 4241 if (cnt != tmp) 4242 hci_prio_recalculate(hdev, LE_LINK); 4243 } 4244 4245 static void hci_tx_work(struct work_struct *work) 4246 { 4247 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work); 4248 struct sk_buff *skb; 4249 4250 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt, 4251 hdev->sco_cnt, hdev->le_cnt); 4252 4253 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 4254 /* Schedule queues and send stuff to HCI driver */ 4255 hci_sched_acl(hdev); 4256 hci_sched_sco(hdev); 4257 hci_sched_esco(hdev); 4258 hci_sched_le(hdev); 4259 } 4260 4261 /* Send next queued raw (unknown type) packet */ 4262 while ((skb = skb_dequeue(&hdev->raw_q))) 4263 hci_send_frame(hdev, skb); 4264 } 4265 4266 /* ----- HCI RX task (incoming data processing) ----- */ 4267 4268 /* ACL data packet */ 4269 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) 4270 { 4271 struct hci_acl_hdr *hdr = (void *) skb->data; 4272 struct hci_conn *conn; 4273 __u16 handle, flags; 4274 4275 skb_pull(skb, HCI_ACL_HDR_SIZE); 4276 4277 handle = __le16_to_cpu(hdr->handle); 4278 flags = hci_flags(handle); 4279 handle = hci_handle(handle); 4280 4281 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len, 4282 handle, flags); 4283 4284 hdev->stat.acl_rx++; 4285 4286 hci_dev_lock(hdev); 4287 conn = hci_conn_hash_lookup_handle(hdev, handle); 4288 hci_dev_unlock(hdev); 4289 4290 if (conn) { 4291 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF); 4292 4293 /* Send to upper protocol */ 4294 l2cap_recv_acldata(conn, skb, flags); 4295 return; 4296 } else { 4297 BT_ERR("%s ACL packet for unknown connection handle %d", 4298 hdev->name, handle); 4299 } 4300 4301 kfree_skb(skb); 4302 } 4303 4304 /* SCO data packet */ 4305 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb) 4306 { 4307 struct hci_sco_hdr *hdr = (void *) skb->data; 4308 struct hci_conn *conn; 4309 __u16 handle; 4310 4311 skb_pull(skb, HCI_SCO_HDR_SIZE); 4312 4313 handle = __le16_to_cpu(hdr->handle); 4314 4315 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle); 4316 4317 hdev->stat.sco_rx++; 4318 4319 hci_dev_lock(hdev); 4320 conn = hci_conn_hash_lookup_handle(hdev, handle); 4321 hci_dev_unlock(hdev); 4322 4323 if (conn) { 4324 /* Send to upper protocol */ 4325 sco_recv_scodata(conn, skb); 4326 return; 4327 } else { 4328 BT_ERR("%s SCO packet for unknown connection handle %d", 4329 hdev->name, handle); 4330 } 4331 4332 kfree_skb(skb); 4333 } 4334 4335 static bool hci_req_is_complete(struct hci_dev *hdev) 4336 { 4337 struct sk_buff *skb; 4338 4339 skb = skb_peek(&hdev->cmd_q); 4340 if (!skb) 4341 return true; 4342 4343 return bt_cb(skb)->hci.req_start; 4344 } 4345 4346 static void hci_resend_last(struct hci_dev *hdev) 4347 { 4348 struct hci_command_hdr *sent; 4349 struct sk_buff *skb; 4350 u16 opcode; 4351 4352 if (!hdev->sent_cmd) 4353 return; 4354 4355 sent = (void *) hdev->sent_cmd->data; 4356 opcode = __le16_to_cpu(sent->opcode); 4357 if (opcode == HCI_OP_RESET) 4358 return; 4359 4360 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL); 4361 if (!skb) 4362 return; 4363 4364 skb_queue_head(&hdev->cmd_q, skb); 4365 queue_work(hdev->workqueue, &hdev->cmd_work); 4366 } 4367 4368 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status, 4369 hci_req_complete_t *req_complete, 4370 hci_req_complete_skb_t *req_complete_skb) 4371 { 4372 struct sk_buff *skb; 4373 unsigned long flags; 4374 4375 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status); 4376 4377 /* If the completed command doesn't match the last one that was 4378 * sent we need to do special handling of it. 4379 */ 4380 if (!hci_sent_cmd_data(hdev, opcode)) { 4381 /* Some CSR based controllers generate a spontaneous 4382 * reset complete event during init and any pending 4383 * command will never be completed. In such a case we 4384 * need to resend whatever was the last sent 4385 * command. 4386 */ 4387 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET) 4388 hci_resend_last(hdev); 4389 4390 return; 4391 } 4392 4393 /* If the command succeeded and there's still more commands in 4394 * this request the request is not yet complete. 4395 */ 4396 if (!status && !hci_req_is_complete(hdev)) 4397 return; 4398 4399 /* If this was the last command in a request the complete 4400 * callback would be found in hdev->sent_cmd instead of the 4401 * command queue (hdev->cmd_q). 4402 */ 4403 if (bt_cb(hdev->sent_cmd)->hci.req_complete) { 4404 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete; 4405 return; 4406 } 4407 4408 if (bt_cb(hdev->sent_cmd)->hci.req_complete_skb) { 4409 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb; 4410 return; 4411 } 4412 4413 /* Remove all pending commands belonging to this request */ 4414 spin_lock_irqsave(&hdev->cmd_q.lock, flags); 4415 while ((skb = __skb_dequeue(&hdev->cmd_q))) { 4416 if (bt_cb(skb)->hci.req_start) { 4417 __skb_queue_head(&hdev->cmd_q, skb); 4418 break; 4419 } 4420 4421 *req_complete = bt_cb(skb)->hci.req_complete; 4422 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb; 4423 kfree_skb(skb); 4424 } 4425 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); 4426 } 4427 4428 static void hci_rx_work(struct work_struct *work) 4429 { 4430 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work); 4431 struct sk_buff *skb; 4432 4433 BT_DBG("%s", hdev->name); 4434 4435 while ((skb = skb_dequeue(&hdev->rx_q))) { 4436 /* Send copy to monitor */ 4437 hci_send_to_monitor(hdev, skb); 4438 4439 if (atomic_read(&hdev->promisc)) { 4440 /* Send copy to the sockets */ 4441 hci_send_to_sock(hdev, skb); 4442 } 4443 4444 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 4445 kfree_skb(skb); 4446 continue; 4447 } 4448 4449 if (test_bit(HCI_INIT, &hdev->flags)) { 4450 /* Don't process data packets in this states. */ 4451 switch (bt_cb(skb)->pkt_type) { 4452 case HCI_ACLDATA_PKT: 4453 case HCI_SCODATA_PKT: 4454 kfree_skb(skb); 4455 continue; 4456 } 4457 } 4458 4459 /* Process frame */ 4460 switch (bt_cb(skb)->pkt_type) { 4461 case HCI_EVENT_PKT: 4462 BT_DBG("%s Event packet", hdev->name); 4463 hci_event_packet(hdev, skb); 4464 break; 4465 4466 case HCI_ACLDATA_PKT: 4467 BT_DBG("%s ACL data packet", hdev->name); 4468 hci_acldata_packet(hdev, skb); 4469 break; 4470 4471 case HCI_SCODATA_PKT: 4472 BT_DBG("%s SCO data packet", hdev->name); 4473 hci_scodata_packet(hdev, skb); 4474 break; 4475 4476 default: 4477 kfree_skb(skb); 4478 break; 4479 } 4480 } 4481 } 4482 4483 static void hci_cmd_work(struct work_struct *work) 4484 { 4485 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work); 4486 struct sk_buff *skb; 4487 4488 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name, 4489 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q)); 4490 4491 /* Send queued commands */ 4492 if (atomic_read(&hdev->cmd_cnt)) { 4493 skb = skb_dequeue(&hdev->cmd_q); 4494 if (!skb) 4495 return; 4496 4497 kfree_skb(hdev->sent_cmd); 4498 4499 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL); 4500 if (hdev->sent_cmd) { 4501 atomic_dec(&hdev->cmd_cnt); 4502 hci_send_frame(hdev, skb); 4503 if (test_bit(HCI_RESET, &hdev->flags)) 4504 cancel_delayed_work(&hdev->cmd_timer); 4505 else 4506 schedule_delayed_work(&hdev->cmd_timer, 4507 HCI_CMD_TIMEOUT); 4508 } else { 4509 skb_queue_head(&hdev->cmd_q, skb); 4510 queue_work(hdev->workqueue, &hdev->cmd_work); 4511 } 4512 } 4513 } 4514