1 /* 2 BlueZ - Bluetooth protocol stack for Linux 3 Copyright (C) 2000-2001 Qualcomm Incorporated 4 Copyright (C) 2011 ProFUSION Embedded Systems 5 6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com> 7 8 This program is free software; you can redistribute it and/or modify 9 it under the terms of the GNU General Public License version 2 as 10 published by the Free Software Foundation; 11 12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS 13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS. 15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY 16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES 17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN 18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF 19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE. 20 21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS, 22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS 23 SOFTWARE IS DISCLAIMED. 24 */ 25 26 /* Bluetooth HCI core. */ 27 28 #include <linux/export.h> 29 #include <linux/rfkill.h> 30 #include <linux/debugfs.h> 31 #include <linux/crypto.h> 32 #include <linux/kcov.h> 33 #include <linux/property.h> 34 #include <linux/suspend.h> 35 #include <linux/wait.h> 36 #include <asm/unaligned.h> 37 38 #include <net/bluetooth/bluetooth.h> 39 #include <net/bluetooth/hci_core.h> 40 #include <net/bluetooth/l2cap.h> 41 #include <net/bluetooth/mgmt.h> 42 43 #include "hci_request.h" 44 #include "hci_debugfs.h" 45 #include "smp.h" 46 #include "leds.h" 47 #include "msft.h" 48 #include "aosp.h" 49 #include "hci_codec.h" 50 51 static void hci_rx_work(struct work_struct *work); 52 static void hci_cmd_work(struct work_struct *work); 53 static void hci_tx_work(struct work_struct *work); 54 55 /* HCI device list */ 56 LIST_HEAD(hci_dev_list); 57 DEFINE_RWLOCK(hci_dev_list_lock); 58 59 /* HCI callback list */ 60 LIST_HEAD(hci_cb_list); 61 DEFINE_MUTEX(hci_cb_list_lock); 62 63 /* HCI ID Numbering */ 64 static DEFINE_IDA(hci_index_ida); 65 66 static int hci_scan_req(struct hci_request *req, unsigned long opt) 67 { 68 __u8 scan = opt; 69 70 BT_DBG("%s %x", req->hdev->name, scan); 71 72 /* Inquiry and Page scans */ 73 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan); 74 return 0; 75 } 76 77 static int hci_auth_req(struct hci_request *req, unsigned long opt) 78 { 79 __u8 auth = opt; 80 81 BT_DBG("%s %x", req->hdev->name, auth); 82 83 /* Authentication */ 84 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth); 85 return 0; 86 } 87 88 static int hci_encrypt_req(struct hci_request *req, unsigned long opt) 89 { 90 __u8 encrypt = opt; 91 92 BT_DBG("%s %x", req->hdev->name, encrypt); 93 94 /* Encryption */ 95 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt); 96 return 0; 97 } 98 99 static int hci_linkpol_req(struct hci_request *req, unsigned long opt) 100 { 101 __le16 policy = cpu_to_le16(opt); 102 103 BT_DBG("%s %x", req->hdev->name, policy); 104 105 /* Default link policy */ 106 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy); 107 return 0; 108 } 109 110 /* Get HCI device by index. 111 * Device is held on return. */ 112 struct hci_dev *hci_dev_get(int index) 113 { 114 struct hci_dev *hdev = NULL, *d; 115 116 BT_DBG("%d", index); 117 118 if (index < 0) 119 return NULL; 120 121 read_lock(&hci_dev_list_lock); 122 list_for_each_entry(d, &hci_dev_list, list) { 123 if (d->id == index) { 124 hdev = hci_dev_hold(d); 125 break; 126 } 127 } 128 read_unlock(&hci_dev_list_lock); 129 return hdev; 130 } 131 132 /* ---- Inquiry support ---- */ 133 134 bool hci_discovery_active(struct hci_dev *hdev) 135 { 136 struct discovery_state *discov = &hdev->discovery; 137 138 switch (discov->state) { 139 case DISCOVERY_FINDING: 140 case DISCOVERY_RESOLVING: 141 return true; 142 143 default: 144 return false; 145 } 146 } 147 148 void hci_discovery_set_state(struct hci_dev *hdev, int state) 149 { 150 int old_state = hdev->discovery.state; 151 152 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state); 153 154 if (old_state == state) 155 return; 156 157 hdev->discovery.state = state; 158 159 switch (state) { 160 case DISCOVERY_STOPPED: 161 hci_update_passive_scan(hdev); 162 163 if (old_state != DISCOVERY_STARTING) 164 mgmt_discovering(hdev, 0); 165 break; 166 case DISCOVERY_STARTING: 167 break; 168 case DISCOVERY_FINDING: 169 mgmt_discovering(hdev, 1); 170 break; 171 case DISCOVERY_RESOLVING: 172 break; 173 case DISCOVERY_STOPPING: 174 break; 175 } 176 } 177 178 void hci_inquiry_cache_flush(struct hci_dev *hdev) 179 { 180 struct discovery_state *cache = &hdev->discovery; 181 struct inquiry_entry *p, *n; 182 183 list_for_each_entry_safe(p, n, &cache->all, all) { 184 list_del(&p->all); 185 kfree(p); 186 } 187 188 INIT_LIST_HEAD(&cache->unknown); 189 INIT_LIST_HEAD(&cache->resolve); 190 } 191 192 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev, 193 bdaddr_t *bdaddr) 194 { 195 struct discovery_state *cache = &hdev->discovery; 196 struct inquiry_entry *e; 197 198 BT_DBG("cache %p, %pMR", cache, bdaddr); 199 200 list_for_each_entry(e, &cache->all, all) { 201 if (!bacmp(&e->data.bdaddr, bdaddr)) 202 return e; 203 } 204 205 return NULL; 206 } 207 208 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev, 209 bdaddr_t *bdaddr) 210 { 211 struct discovery_state *cache = &hdev->discovery; 212 struct inquiry_entry *e; 213 214 BT_DBG("cache %p, %pMR", cache, bdaddr); 215 216 list_for_each_entry(e, &cache->unknown, list) { 217 if (!bacmp(&e->data.bdaddr, bdaddr)) 218 return e; 219 } 220 221 return NULL; 222 } 223 224 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev, 225 bdaddr_t *bdaddr, 226 int state) 227 { 228 struct discovery_state *cache = &hdev->discovery; 229 struct inquiry_entry *e; 230 231 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state); 232 233 list_for_each_entry(e, &cache->resolve, list) { 234 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state) 235 return e; 236 if (!bacmp(&e->data.bdaddr, bdaddr)) 237 return e; 238 } 239 240 return NULL; 241 } 242 243 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev, 244 struct inquiry_entry *ie) 245 { 246 struct discovery_state *cache = &hdev->discovery; 247 struct list_head *pos = &cache->resolve; 248 struct inquiry_entry *p; 249 250 list_del(&ie->list); 251 252 list_for_each_entry(p, &cache->resolve, list) { 253 if (p->name_state != NAME_PENDING && 254 abs(p->data.rssi) >= abs(ie->data.rssi)) 255 break; 256 pos = &p->list; 257 } 258 259 list_add(&ie->list, pos); 260 } 261 262 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data, 263 bool name_known) 264 { 265 struct discovery_state *cache = &hdev->discovery; 266 struct inquiry_entry *ie; 267 u32 flags = 0; 268 269 BT_DBG("cache %p, %pMR", cache, &data->bdaddr); 270 271 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR); 272 273 if (!data->ssp_mode) 274 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING; 275 276 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr); 277 if (ie) { 278 if (!ie->data.ssp_mode) 279 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING; 280 281 if (ie->name_state == NAME_NEEDED && 282 data->rssi != ie->data.rssi) { 283 ie->data.rssi = data->rssi; 284 hci_inquiry_cache_update_resolve(hdev, ie); 285 } 286 287 goto update; 288 } 289 290 /* Entry not in the cache. Add new one. */ 291 ie = kzalloc(sizeof(*ie), GFP_KERNEL); 292 if (!ie) { 293 flags |= MGMT_DEV_FOUND_CONFIRM_NAME; 294 goto done; 295 } 296 297 list_add(&ie->all, &cache->all); 298 299 if (name_known) { 300 ie->name_state = NAME_KNOWN; 301 } else { 302 ie->name_state = NAME_NOT_KNOWN; 303 list_add(&ie->list, &cache->unknown); 304 } 305 306 update: 307 if (name_known && ie->name_state != NAME_KNOWN && 308 ie->name_state != NAME_PENDING) { 309 ie->name_state = NAME_KNOWN; 310 list_del(&ie->list); 311 } 312 313 memcpy(&ie->data, data, sizeof(*data)); 314 ie->timestamp = jiffies; 315 cache->timestamp = jiffies; 316 317 if (ie->name_state == NAME_NOT_KNOWN) 318 flags |= MGMT_DEV_FOUND_CONFIRM_NAME; 319 320 done: 321 return flags; 322 } 323 324 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf) 325 { 326 struct discovery_state *cache = &hdev->discovery; 327 struct inquiry_info *info = (struct inquiry_info *) buf; 328 struct inquiry_entry *e; 329 int copied = 0; 330 331 list_for_each_entry(e, &cache->all, all) { 332 struct inquiry_data *data = &e->data; 333 334 if (copied >= num) 335 break; 336 337 bacpy(&info->bdaddr, &data->bdaddr); 338 info->pscan_rep_mode = data->pscan_rep_mode; 339 info->pscan_period_mode = data->pscan_period_mode; 340 info->pscan_mode = data->pscan_mode; 341 memcpy(info->dev_class, data->dev_class, 3); 342 info->clock_offset = data->clock_offset; 343 344 info++; 345 copied++; 346 } 347 348 BT_DBG("cache %p, copied %d", cache, copied); 349 return copied; 350 } 351 352 static int hci_inq_req(struct hci_request *req, unsigned long opt) 353 { 354 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt; 355 struct hci_dev *hdev = req->hdev; 356 struct hci_cp_inquiry cp; 357 358 BT_DBG("%s", hdev->name); 359 360 if (test_bit(HCI_INQUIRY, &hdev->flags)) 361 return 0; 362 363 /* Start Inquiry */ 364 memcpy(&cp.lap, &ir->lap, 3); 365 cp.length = ir->length; 366 cp.num_rsp = ir->num_rsp; 367 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp); 368 369 return 0; 370 } 371 372 int hci_inquiry(void __user *arg) 373 { 374 __u8 __user *ptr = arg; 375 struct hci_inquiry_req ir; 376 struct hci_dev *hdev; 377 int err = 0, do_inquiry = 0, max_rsp; 378 long timeo; 379 __u8 *buf; 380 381 if (copy_from_user(&ir, ptr, sizeof(ir))) 382 return -EFAULT; 383 384 hdev = hci_dev_get(ir.dev_id); 385 if (!hdev) 386 return -ENODEV; 387 388 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 389 err = -EBUSY; 390 goto done; 391 } 392 393 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 394 err = -EOPNOTSUPP; 395 goto done; 396 } 397 398 if (hdev->dev_type != HCI_PRIMARY) { 399 err = -EOPNOTSUPP; 400 goto done; 401 } 402 403 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 404 err = -EOPNOTSUPP; 405 goto done; 406 } 407 408 /* Restrict maximum inquiry length to 60 seconds */ 409 if (ir.length > 60) { 410 err = -EINVAL; 411 goto done; 412 } 413 414 hci_dev_lock(hdev); 415 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX || 416 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) { 417 hci_inquiry_cache_flush(hdev); 418 do_inquiry = 1; 419 } 420 hci_dev_unlock(hdev); 421 422 timeo = ir.length * msecs_to_jiffies(2000); 423 424 if (do_inquiry) { 425 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir, 426 timeo, NULL); 427 if (err < 0) 428 goto done; 429 430 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is 431 * cleared). If it is interrupted by a signal, return -EINTR. 432 */ 433 if (wait_on_bit(&hdev->flags, HCI_INQUIRY, 434 TASK_INTERRUPTIBLE)) { 435 err = -EINTR; 436 goto done; 437 } 438 } 439 440 /* for unlimited number of responses we will use buffer with 441 * 255 entries 442 */ 443 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp; 444 445 /* cache_dump can't sleep. Therefore we allocate temp buffer and then 446 * copy it to the user space. 447 */ 448 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL); 449 if (!buf) { 450 err = -ENOMEM; 451 goto done; 452 } 453 454 hci_dev_lock(hdev); 455 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf); 456 hci_dev_unlock(hdev); 457 458 BT_DBG("num_rsp %d", ir.num_rsp); 459 460 if (!copy_to_user(ptr, &ir, sizeof(ir))) { 461 ptr += sizeof(ir); 462 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) * 463 ir.num_rsp)) 464 err = -EFAULT; 465 } else 466 err = -EFAULT; 467 468 kfree(buf); 469 470 done: 471 hci_dev_put(hdev); 472 return err; 473 } 474 475 static int hci_dev_do_open(struct hci_dev *hdev) 476 { 477 int ret = 0; 478 479 BT_DBG("%s %p", hdev->name, hdev); 480 481 hci_req_sync_lock(hdev); 482 483 ret = hci_dev_open_sync(hdev); 484 485 hci_req_sync_unlock(hdev); 486 return ret; 487 } 488 489 /* ---- HCI ioctl helpers ---- */ 490 491 int hci_dev_open(__u16 dev) 492 { 493 struct hci_dev *hdev; 494 int err; 495 496 hdev = hci_dev_get(dev); 497 if (!hdev) 498 return -ENODEV; 499 500 /* Devices that are marked as unconfigured can only be powered 501 * up as user channel. Trying to bring them up as normal devices 502 * will result into a failure. Only user channel operation is 503 * possible. 504 * 505 * When this function is called for a user channel, the flag 506 * HCI_USER_CHANNEL will be set first before attempting to 507 * open the device. 508 */ 509 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 510 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 511 err = -EOPNOTSUPP; 512 goto done; 513 } 514 515 /* We need to ensure that no other power on/off work is pending 516 * before proceeding to call hci_dev_do_open. This is 517 * particularly important if the setup procedure has not yet 518 * completed. 519 */ 520 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) 521 cancel_delayed_work(&hdev->power_off); 522 523 /* After this call it is guaranteed that the setup procedure 524 * has finished. This means that error conditions like RFKILL 525 * or no valid public or static random address apply. 526 */ 527 flush_workqueue(hdev->req_workqueue); 528 529 /* For controllers not using the management interface and that 530 * are brought up using legacy ioctl, set the HCI_BONDABLE bit 531 * so that pairing works for them. Once the management interface 532 * is in use this bit will be cleared again and userspace has 533 * to explicitly enable it. 534 */ 535 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 536 !hci_dev_test_flag(hdev, HCI_MGMT)) 537 hci_dev_set_flag(hdev, HCI_BONDABLE); 538 539 err = hci_dev_do_open(hdev); 540 541 done: 542 hci_dev_put(hdev); 543 return err; 544 } 545 546 int hci_dev_do_close(struct hci_dev *hdev) 547 { 548 int err; 549 550 BT_DBG("%s %p", hdev->name, hdev); 551 552 hci_req_sync_lock(hdev); 553 554 err = hci_dev_close_sync(hdev); 555 556 hci_req_sync_unlock(hdev); 557 558 return err; 559 } 560 561 int hci_dev_close(__u16 dev) 562 { 563 struct hci_dev *hdev; 564 int err; 565 566 hdev = hci_dev_get(dev); 567 if (!hdev) 568 return -ENODEV; 569 570 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 571 err = -EBUSY; 572 goto done; 573 } 574 575 cancel_work_sync(&hdev->power_on); 576 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) 577 cancel_delayed_work(&hdev->power_off); 578 579 err = hci_dev_do_close(hdev); 580 581 done: 582 hci_dev_put(hdev); 583 return err; 584 } 585 586 static int hci_dev_do_reset(struct hci_dev *hdev) 587 { 588 int ret; 589 590 BT_DBG("%s %p", hdev->name, hdev); 591 592 hci_req_sync_lock(hdev); 593 594 /* Drop queues */ 595 skb_queue_purge(&hdev->rx_q); 596 skb_queue_purge(&hdev->cmd_q); 597 598 /* Cancel these to avoid queueing non-chained pending work */ 599 hci_dev_set_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE); 600 /* Wait for 601 * 602 * if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE)) 603 * queue_delayed_work(&hdev->{cmd,ncmd}_timer) 604 * 605 * inside RCU section to see the flag or complete scheduling. 606 */ 607 synchronize_rcu(); 608 /* Explicitly cancel works in case scheduled after setting the flag. */ 609 cancel_delayed_work(&hdev->cmd_timer); 610 cancel_delayed_work(&hdev->ncmd_timer); 611 612 /* Avoid potential lockdep warnings from the *_flush() calls by 613 * ensuring the workqueue is empty up front. 614 */ 615 drain_workqueue(hdev->workqueue); 616 617 hci_dev_lock(hdev); 618 hci_inquiry_cache_flush(hdev); 619 hci_conn_hash_flush(hdev); 620 hci_dev_unlock(hdev); 621 622 if (hdev->flush) 623 hdev->flush(hdev); 624 625 hci_dev_clear_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE); 626 627 atomic_set(&hdev->cmd_cnt, 1); 628 hdev->acl_cnt = 0; 629 hdev->sco_cnt = 0; 630 hdev->le_cnt = 0; 631 hdev->iso_cnt = 0; 632 633 ret = hci_reset_sync(hdev); 634 635 hci_req_sync_unlock(hdev); 636 return ret; 637 } 638 639 int hci_dev_reset(__u16 dev) 640 { 641 struct hci_dev *hdev; 642 int err; 643 644 hdev = hci_dev_get(dev); 645 if (!hdev) 646 return -ENODEV; 647 648 if (!test_bit(HCI_UP, &hdev->flags)) { 649 err = -ENETDOWN; 650 goto done; 651 } 652 653 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 654 err = -EBUSY; 655 goto done; 656 } 657 658 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 659 err = -EOPNOTSUPP; 660 goto done; 661 } 662 663 err = hci_dev_do_reset(hdev); 664 665 done: 666 hci_dev_put(hdev); 667 return err; 668 } 669 670 int hci_dev_reset_stat(__u16 dev) 671 { 672 struct hci_dev *hdev; 673 int ret = 0; 674 675 hdev = hci_dev_get(dev); 676 if (!hdev) 677 return -ENODEV; 678 679 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 680 ret = -EBUSY; 681 goto done; 682 } 683 684 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 685 ret = -EOPNOTSUPP; 686 goto done; 687 } 688 689 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats)); 690 691 done: 692 hci_dev_put(hdev); 693 return ret; 694 } 695 696 static void hci_update_passive_scan_state(struct hci_dev *hdev, u8 scan) 697 { 698 bool conn_changed, discov_changed; 699 700 BT_DBG("%s scan 0x%02x", hdev->name, scan); 701 702 if ((scan & SCAN_PAGE)) 703 conn_changed = !hci_dev_test_and_set_flag(hdev, 704 HCI_CONNECTABLE); 705 else 706 conn_changed = hci_dev_test_and_clear_flag(hdev, 707 HCI_CONNECTABLE); 708 709 if ((scan & SCAN_INQUIRY)) { 710 discov_changed = !hci_dev_test_and_set_flag(hdev, 711 HCI_DISCOVERABLE); 712 } else { 713 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 714 discov_changed = hci_dev_test_and_clear_flag(hdev, 715 HCI_DISCOVERABLE); 716 } 717 718 if (!hci_dev_test_flag(hdev, HCI_MGMT)) 719 return; 720 721 if (conn_changed || discov_changed) { 722 /* In case this was disabled through mgmt */ 723 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 724 725 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 726 hci_update_adv_data(hdev, hdev->cur_adv_instance); 727 728 mgmt_new_settings(hdev); 729 } 730 } 731 732 int hci_dev_cmd(unsigned int cmd, void __user *arg) 733 { 734 struct hci_dev *hdev; 735 struct hci_dev_req dr; 736 int err = 0; 737 738 if (copy_from_user(&dr, arg, sizeof(dr))) 739 return -EFAULT; 740 741 hdev = hci_dev_get(dr.dev_id); 742 if (!hdev) 743 return -ENODEV; 744 745 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 746 err = -EBUSY; 747 goto done; 748 } 749 750 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 751 err = -EOPNOTSUPP; 752 goto done; 753 } 754 755 if (hdev->dev_type != HCI_PRIMARY) { 756 err = -EOPNOTSUPP; 757 goto done; 758 } 759 760 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 761 err = -EOPNOTSUPP; 762 goto done; 763 } 764 765 switch (cmd) { 766 case HCISETAUTH: 767 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt, 768 HCI_INIT_TIMEOUT, NULL); 769 break; 770 771 case HCISETENCRYPT: 772 if (!lmp_encrypt_capable(hdev)) { 773 err = -EOPNOTSUPP; 774 break; 775 } 776 777 if (!test_bit(HCI_AUTH, &hdev->flags)) { 778 /* Auth must be enabled first */ 779 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt, 780 HCI_INIT_TIMEOUT, NULL); 781 if (err) 782 break; 783 } 784 785 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt, 786 HCI_INIT_TIMEOUT, NULL); 787 break; 788 789 case HCISETSCAN: 790 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt, 791 HCI_INIT_TIMEOUT, NULL); 792 793 /* Ensure that the connectable and discoverable states 794 * get correctly modified as this was a non-mgmt change. 795 */ 796 if (!err) 797 hci_update_passive_scan_state(hdev, dr.dev_opt); 798 break; 799 800 case HCISETLINKPOL: 801 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt, 802 HCI_INIT_TIMEOUT, NULL); 803 break; 804 805 case HCISETLINKMODE: 806 hdev->link_mode = ((__u16) dr.dev_opt) & 807 (HCI_LM_MASTER | HCI_LM_ACCEPT); 808 break; 809 810 case HCISETPTYPE: 811 if (hdev->pkt_type == (__u16) dr.dev_opt) 812 break; 813 814 hdev->pkt_type = (__u16) dr.dev_opt; 815 mgmt_phy_configuration_changed(hdev, NULL); 816 break; 817 818 case HCISETACLMTU: 819 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1); 820 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0); 821 break; 822 823 case HCISETSCOMTU: 824 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1); 825 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0); 826 break; 827 828 default: 829 err = -EINVAL; 830 break; 831 } 832 833 done: 834 hci_dev_put(hdev); 835 return err; 836 } 837 838 int hci_get_dev_list(void __user *arg) 839 { 840 struct hci_dev *hdev; 841 struct hci_dev_list_req *dl; 842 struct hci_dev_req *dr; 843 int n = 0, size, err; 844 __u16 dev_num; 845 846 if (get_user(dev_num, (__u16 __user *) arg)) 847 return -EFAULT; 848 849 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr)) 850 return -EINVAL; 851 852 size = sizeof(*dl) + dev_num * sizeof(*dr); 853 854 dl = kzalloc(size, GFP_KERNEL); 855 if (!dl) 856 return -ENOMEM; 857 858 dr = dl->dev_req; 859 860 read_lock(&hci_dev_list_lock); 861 list_for_each_entry(hdev, &hci_dev_list, list) { 862 unsigned long flags = hdev->flags; 863 864 /* When the auto-off is configured it means the transport 865 * is running, but in that case still indicate that the 866 * device is actually down. 867 */ 868 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) 869 flags &= ~BIT(HCI_UP); 870 871 (dr + n)->dev_id = hdev->id; 872 (dr + n)->dev_opt = flags; 873 874 if (++n >= dev_num) 875 break; 876 } 877 read_unlock(&hci_dev_list_lock); 878 879 dl->dev_num = n; 880 size = sizeof(*dl) + n * sizeof(*dr); 881 882 err = copy_to_user(arg, dl, size); 883 kfree(dl); 884 885 return err ? -EFAULT : 0; 886 } 887 888 int hci_get_dev_info(void __user *arg) 889 { 890 struct hci_dev *hdev; 891 struct hci_dev_info di; 892 unsigned long flags; 893 int err = 0; 894 895 if (copy_from_user(&di, arg, sizeof(di))) 896 return -EFAULT; 897 898 hdev = hci_dev_get(di.dev_id); 899 if (!hdev) 900 return -ENODEV; 901 902 /* When the auto-off is configured it means the transport 903 * is running, but in that case still indicate that the 904 * device is actually down. 905 */ 906 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) 907 flags = hdev->flags & ~BIT(HCI_UP); 908 else 909 flags = hdev->flags; 910 911 strcpy(di.name, hdev->name); 912 di.bdaddr = hdev->bdaddr; 913 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4); 914 di.flags = flags; 915 di.pkt_type = hdev->pkt_type; 916 if (lmp_bredr_capable(hdev)) { 917 di.acl_mtu = hdev->acl_mtu; 918 di.acl_pkts = hdev->acl_pkts; 919 di.sco_mtu = hdev->sco_mtu; 920 di.sco_pkts = hdev->sco_pkts; 921 } else { 922 di.acl_mtu = hdev->le_mtu; 923 di.acl_pkts = hdev->le_pkts; 924 di.sco_mtu = 0; 925 di.sco_pkts = 0; 926 } 927 di.link_policy = hdev->link_policy; 928 di.link_mode = hdev->link_mode; 929 930 memcpy(&di.stat, &hdev->stat, sizeof(di.stat)); 931 memcpy(&di.features, &hdev->features, sizeof(di.features)); 932 933 if (copy_to_user(arg, &di, sizeof(di))) 934 err = -EFAULT; 935 936 hci_dev_put(hdev); 937 938 return err; 939 } 940 941 /* ---- Interface to HCI drivers ---- */ 942 943 static int hci_rfkill_set_block(void *data, bool blocked) 944 { 945 struct hci_dev *hdev = data; 946 947 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked); 948 949 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) 950 return -EBUSY; 951 952 if (blocked) { 953 hci_dev_set_flag(hdev, HCI_RFKILLED); 954 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 955 !hci_dev_test_flag(hdev, HCI_CONFIG)) 956 hci_dev_do_close(hdev); 957 } else { 958 hci_dev_clear_flag(hdev, HCI_RFKILLED); 959 } 960 961 return 0; 962 } 963 964 static const struct rfkill_ops hci_rfkill_ops = { 965 .set_block = hci_rfkill_set_block, 966 }; 967 968 static void hci_power_on(struct work_struct *work) 969 { 970 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on); 971 int err; 972 973 BT_DBG("%s", hdev->name); 974 975 if (test_bit(HCI_UP, &hdev->flags) && 976 hci_dev_test_flag(hdev, HCI_MGMT) && 977 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) { 978 cancel_delayed_work(&hdev->power_off); 979 err = hci_powered_update_sync(hdev); 980 mgmt_power_on(hdev, err); 981 return; 982 } 983 984 err = hci_dev_do_open(hdev); 985 if (err < 0) { 986 hci_dev_lock(hdev); 987 mgmt_set_powered_failed(hdev, err); 988 hci_dev_unlock(hdev); 989 return; 990 } 991 992 /* During the HCI setup phase, a few error conditions are 993 * ignored and they need to be checked now. If they are still 994 * valid, it is important to turn the device back off. 995 */ 996 if (hci_dev_test_flag(hdev, HCI_RFKILLED) || 997 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) || 998 (hdev->dev_type == HCI_PRIMARY && 999 !bacmp(&hdev->bdaddr, BDADDR_ANY) && 1000 !bacmp(&hdev->static_addr, BDADDR_ANY))) { 1001 hci_dev_clear_flag(hdev, HCI_AUTO_OFF); 1002 hci_dev_do_close(hdev); 1003 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) { 1004 queue_delayed_work(hdev->req_workqueue, &hdev->power_off, 1005 HCI_AUTO_OFF_TIMEOUT); 1006 } 1007 1008 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) { 1009 /* For unconfigured devices, set the HCI_RAW flag 1010 * so that userspace can easily identify them. 1011 */ 1012 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 1013 set_bit(HCI_RAW, &hdev->flags); 1014 1015 /* For fully configured devices, this will send 1016 * the Index Added event. For unconfigured devices, 1017 * it will send Unconfigued Index Added event. 1018 * 1019 * Devices with HCI_QUIRK_RAW_DEVICE are ignored 1020 * and no event will be send. 1021 */ 1022 mgmt_index_added(hdev); 1023 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) { 1024 /* When the controller is now configured, then it 1025 * is important to clear the HCI_RAW flag. 1026 */ 1027 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 1028 clear_bit(HCI_RAW, &hdev->flags); 1029 1030 /* Powering on the controller with HCI_CONFIG set only 1031 * happens with the transition from unconfigured to 1032 * configured. This will send the Index Added event. 1033 */ 1034 mgmt_index_added(hdev); 1035 } 1036 } 1037 1038 static void hci_power_off(struct work_struct *work) 1039 { 1040 struct hci_dev *hdev = container_of(work, struct hci_dev, 1041 power_off.work); 1042 1043 BT_DBG("%s", hdev->name); 1044 1045 hci_dev_do_close(hdev); 1046 } 1047 1048 static void hci_error_reset(struct work_struct *work) 1049 { 1050 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset); 1051 1052 BT_DBG("%s", hdev->name); 1053 1054 if (hdev->hw_error) 1055 hdev->hw_error(hdev, hdev->hw_error_code); 1056 else 1057 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code); 1058 1059 if (hci_dev_do_close(hdev)) 1060 return; 1061 1062 hci_dev_do_open(hdev); 1063 } 1064 1065 void hci_uuids_clear(struct hci_dev *hdev) 1066 { 1067 struct bt_uuid *uuid, *tmp; 1068 1069 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) { 1070 list_del(&uuid->list); 1071 kfree(uuid); 1072 } 1073 } 1074 1075 void hci_link_keys_clear(struct hci_dev *hdev) 1076 { 1077 struct link_key *key, *tmp; 1078 1079 list_for_each_entry_safe(key, tmp, &hdev->link_keys, list) { 1080 list_del_rcu(&key->list); 1081 kfree_rcu(key, rcu); 1082 } 1083 } 1084 1085 void hci_smp_ltks_clear(struct hci_dev *hdev) 1086 { 1087 struct smp_ltk *k, *tmp; 1088 1089 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) { 1090 list_del_rcu(&k->list); 1091 kfree_rcu(k, rcu); 1092 } 1093 } 1094 1095 void hci_smp_irks_clear(struct hci_dev *hdev) 1096 { 1097 struct smp_irk *k, *tmp; 1098 1099 list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) { 1100 list_del_rcu(&k->list); 1101 kfree_rcu(k, rcu); 1102 } 1103 } 1104 1105 void hci_blocked_keys_clear(struct hci_dev *hdev) 1106 { 1107 struct blocked_key *b, *tmp; 1108 1109 list_for_each_entry_safe(b, tmp, &hdev->blocked_keys, list) { 1110 list_del_rcu(&b->list); 1111 kfree_rcu(b, rcu); 1112 } 1113 } 1114 1115 bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16]) 1116 { 1117 bool blocked = false; 1118 struct blocked_key *b; 1119 1120 rcu_read_lock(); 1121 list_for_each_entry_rcu(b, &hdev->blocked_keys, list) { 1122 if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) { 1123 blocked = true; 1124 break; 1125 } 1126 } 1127 1128 rcu_read_unlock(); 1129 return blocked; 1130 } 1131 1132 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr) 1133 { 1134 struct link_key *k; 1135 1136 rcu_read_lock(); 1137 list_for_each_entry_rcu(k, &hdev->link_keys, list) { 1138 if (bacmp(bdaddr, &k->bdaddr) == 0) { 1139 rcu_read_unlock(); 1140 1141 if (hci_is_blocked_key(hdev, 1142 HCI_BLOCKED_KEY_TYPE_LINKKEY, 1143 k->val)) { 1144 bt_dev_warn_ratelimited(hdev, 1145 "Link key blocked for %pMR", 1146 &k->bdaddr); 1147 return NULL; 1148 } 1149 1150 return k; 1151 } 1152 } 1153 rcu_read_unlock(); 1154 1155 return NULL; 1156 } 1157 1158 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn, 1159 u8 key_type, u8 old_key_type) 1160 { 1161 /* Legacy key */ 1162 if (key_type < 0x03) 1163 return true; 1164 1165 /* Debug keys are insecure so don't store them persistently */ 1166 if (key_type == HCI_LK_DEBUG_COMBINATION) 1167 return false; 1168 1169 /* Changed combination key and there's no previous one */ 1170 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff) 1171 return false; 1172 1173 /* Security mode 3 case */ 1174 if (!conn) 1175 return true; 1176 1177 /* BR/EDR key derived using SC from an LE link */ 1178 if (conn->type == LE_LINK) 1179 return true; 1180 1181 /* Neither local nor remote side had no-bonding as requirement */ 1182 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01) 1183 return true; 1184 1185 /* Local side had dedicated bonding as requirement */ 1186 if (conn->auth_type == 0x02 || conn->auth_type == 0x03) 1187 return true; 1188 1189 /* Remote side had dedicated bonding as requirement */ 1190 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03) 1191 return true; 1192 1193 /* If none of the above criteria match, then don't store the key 1194 * persistently */ 1195 return false; 1196 } 1197 1198 static u8 ltk_role(u8 type) 1199 { 1200 if (type == SMP_LTK) 1201 return HCI_ROLE_MASTER; 1202 1203 return HCI_ROLE_SLAVE; 1204 } 1205 1206 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, 1207 u8 addr_type, u8 role) 1208 { 1209 struct smp_ltk *k; 1210 1211 rcu_read_lock(); 1212 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) { 1213 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr)) 1214 continue; 1215 1216 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) { 1217 rcu_read_unlock(); 1218 1219 if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK, 1220 k->val)) { 1221 bt_dev_warn_ratelimited(hdev, 1222 "LTK blocked for %pMR", 1223 &k->bdaddr); 1224 return NULL; 1225 } 1226 1227 return k; 1228 } 1229 } 1230 rcu_read_unlock(); 1231 1232 return NULL; 1233 } 1234 1235 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa) 1236 { 1237 struct smp_irk *irk_to_return = NULL; 1238 struct smp_irk *irk; 1239 1240 rcu_read_lock(); 1241 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) { 1242 if (!bacmp(&irk->rpa, rpa)) { 1243 irk_to_return = irk; 1244 goto done; 1245 } 1246 } 1247 1248 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) { 1249 if (smp_irk_matches(hdev, irk->val, rpa)) { 1250 bacpy(&irk->rpa, rpa); 1251 irk_to_return = irk; 1252 goto done; 1253 } 1254 } 1255 1256 done: 1257 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK, 1258 irk_to_return->val)) { 1259 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR", 1260 &irk_to_return->bdaddr); 1261 irk_to_return = NULL; 1262 } 1263 1264 rcu_read_unlock(); 1265 1266 return irk_to_return; 1267 } 1268 1269 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr, 1270 u8 addr_type) 1271 { 1272 struct smp_irk *irk_to_return = NULL; 1273 struct smp_irk *irk; 1274 1275 /* Identity Address must be public or static random */ 1276 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0) 1277 return NULL; 1278 1279 rcu_read_lock(); 1280 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) { 1281 if (addr_type == irk->addr_type && 1282 bacmp(bdaddr, &irk->bdaddr) == 0) { 1283 irk_to_return = irk; 1284 goto done; 1285 } 1286 } 1287 1288 done: 1289 1290 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK, 1291 irk_to_return->val)) { 1292 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR", 1293 &irk_to_return->bdaddr); 1294 irk_to_return = NULL; 1295 } 1296 1297 rcu_read_unlock(); 1298 1299 return irk_to_return; 1300 } 1301 1302 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn, 1303 bdaddr_t *bdaddr, u8 *val, u8 type, 1304 u8 pin_len, bool *persistent) 1305 { 1306 struct link_key *key, *old_key; 1307 u8 old_key_type; 1308 1309 old_key = hci_find_link_key(hdev, bdaddr); 1310 if (old_key) { 1311 old_key_type = old_key->type; 1312 key = old_key; 1313 } else { 1314 old_key_type = conn ? conn->key_type : 0xff; 1315 key = kzalloc(sizeof(*key), GFP_KERNEL); 1316 if (!key) 1317 return NULL; 1318 list_add_rcu(&key->list, &hdev->link_keys); 1319 } 1320 1321 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type); 1322 1323 /* Some buggy controller combinations generate a changed 1324 * combination key for legacy pairing even when there's no 1325 * previous key */ 1326 if (type == HCI_LK_CHANGED_COMBINATION && 1327 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) { 1328 type = HCI_LK_COMBINATION; 1329 if (conn) 1330 conn->key_type = type; 1331 } 1332 1333 bacpy(&key->bdaddr, bdaddr); 1334 memcpy(key->val, val, HCI_LINK_KEY_SIZE); 1335 key->pin_len = pin_len; 1336 1337 if (type == HCI_LK_CHANGED_COMBINATION) 1338 key->type = old_key_type; 1339 else 1340 key->type = type; 1341 1342 if (persistent) 1343 *persistent = hci_persistent_key(hdev, conn, type, 1344 old_key_type); 1345 1346 return key; 1347 } 1348 1349 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, 1350 u8 addr_type, u8 type, u8 authenticated, 1351 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand) 1352 { 1353 struct smp_ltk *key, *old_key; 1354 u8 role = ltk_role(type); 1355 1356 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role); 1357 if (old_key) 1358 key = old_key; 1359 else { 1360 key = kzalloc(sizeof(*key), GFP_KERNEL); 1361 if (!key) 1362 return NULL; 1363 list_add_rcu(&key->list, &hdev->long_term_keys); 1364 } 1365 1366 bacpy(&key->bdaddr, bdaddr); 1367 key->bdaddr_type = addr_type; 1368 memcpy(key->val, tk, sizeof(key->val)); 1369 key->authenticated = authenticated; 1370 key->ediv = ediv; 1371 key->rand = rand; 1372 key->enc_size = enc_size; 1373 key->type = type; 1374 1375 return key; 1376 } 1377 1378 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, 1379 u8 addr_type, u8 val[16], bdaddr_t *rpa) 1380 { 1381 struct smp_irk *irk; 1382 1383 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type); 1384 if (!irk) { 1385 irk = kzalloc(sizeof(*irk), GFP_KERNEL); 1386 if (!irk) 1387 return NULL; 1388 1389 bacpy(&irk->bdaddr, bdaddr); 1390 irk->addr_type = addr_type; 1391 1392 list_add_rcu(&irk->list, &hdev->identity_resolving_keys); 1393 } 1394 1395 memcpy(irk->val, val, 16); 1396 bacpy(&irk->rpa, rpa); 1397 1398 return irk; 1399 } 1400 1401 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr) 1402 { 1403 struct link_key *key; 1404 1405 key = hci_find_link_key(hdev, bdaddr); 1406 if (!key) 1407 return -ENOENT; 1408 1409 BT_DBG("%s removing %pMR", hdev->name, bdaddr); 1410 1411 list_del_rcu(&key->list); 1412 kfree_rcu(key, rcu); 1413 1414 return 0; 1415 } 1416 1417 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type) 1418 { 1419 struct smp_ltk *k, *tmp; 1420 int removed = 0; 1421 1422 list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) { 1423 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type) 1424 continue; 1425 1426 BT_DBG("%s removing %pMR", hdev->name, bdaddr); 1427 1428 list_del_rcu(&k->list); 1429 kfree_rcu(k, rcu); 1430 removed++; 1431 } 1432 1433 return removed ? 0 : -ENOENT; 1434 } 1435 1436 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type) 1437 { 1438 struct smp_irk *k, *tmp; 1439 1440 list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) { 1441 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type) 1442 continue; 1443 1444 BT_DBG("%s removing %pMR", hdev->name, bdaddr); 1445 1446 list_del_rcu(&k->list); 1447 kfree_rcu(k, rcu); 1448 } 1449 } 1450 1451 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type) 1452 { 1453 struct smp_ltk *k; 1454 struct smp_irk *irk; 1455 u8 addr_type; 1456 1457 if (type == BDADDR_BREDR) { 1458 if (hci_find_link_key(hdev, bdaddr)) 1459 return true; 1460 return false; 1461 } 1462 1463 /* Convert to HCI addr type which struct smp_ltk uses */ 1464 if (type == BDADDR_LE_PUBLIC) 1465 addr_type = ADDR_LE_DEV_PUBLIC; 1466 else 1467 addr_type = ADDR_LE_DEV_RANDOM; 1468 1469 irk = hci_get_irk(hdev, bdaddr, addr_type); 1470 if (irk) { 1471 bdaddr = &irk->bdaddr; 1472 addr_type = irk->addr_type; 1473 } 1474 1475 rcu_read_lock(); 1476 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) { 1477 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) { 1478 rcu_read_unlock(); 1479 return true; 1480 } 1481 } 1482 rcu_read_unlock(); 1483 1484 return false; 1485 } 1486 1487 /* HCI command timer function */ 1488 static void hci_cmd_timeout(struct work_struct *work) 1489 { 1490 struct hci_dev *hdev = container_of(work, struct hci_dev, 1491 cmd_timer.work); 1492 1493 if (hdev->sent_cmd) { 1494 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data; 1495 u16 opcode = __le16_to_cpu(sent->opcode); 1496 1497 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode); 1498 } else { 1499 bt_dev_err(hdev, "command tx timeout"); 1500 } 1501 1502 if (hdev->cmd_timeout) 1503 hdev->cmd_timeout(hdev); 1504 1505 atomic_set(&hdev->cmd_cnt, 1); 1506 queue_work(hdev->workqueue, &hdev->cmd_work); 1507 } 1508 1509 /* HCI ncmd timer function */ 1510 static void hci_ncmd_timeout(struct work_struct *work) 1511 { 1512 struct hci_dev *hdev = container_of(work, struct hci_dev, 1513 ncmd_timer.work); 1514 1515 bt_dev_err(hdev, "Controller not accepting commands anymore: ncmd = 0"); 1516 1517 /* During HCI_INIT phase no events can be injected if the ncmd timer 1518 * triggers since the procedure has its own timeout handling. 1519 */ 1520 if (test_bit(HCI_INIT, &hdev->flags)) 1521 return; 1522 1523 /* This is an irrecoverable state, inject hardware error event */ 1524 hci_reset_dev(hdev); 1525 } 1526 1527 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev, 1528 bdaddr_t *bdaddr, u8 bdaddr_type) 1529 { 1530 struct oob_data *data; 1531 1532 list_for_each_entry(data, &hdev->remote_oob_data, list) { 1533 if (bacmp(bdaddr, &data->bdaddr) != 0) 1534 continue; 1535 if (data->bdaddr_type != bdaddr_type) 1536 continue; 1537 return data; 1538 } 1539 1540 return NULL; 1541 } 1542 1543 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, 1544 u8 bdaddr_type) 1545 { 1546 struct oob_data *data; 1547 1548 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type); 1549 if (!data) 1550 return -ENOENT; 1551 1552 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type); 1553 1554 list_del(&data->list); 1555 kfree(data); 1556 1557 return 0; 1558 } 1559 1560 void hci_remote_oob_data_clear(struct hci_dev *hdev) 1561 { 1562 struct oob_data *data, *n; 1563 1564 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) { 1565 list_del(&data->list); 1566 kfree(data); 1567 } 1568 } 1569 1570 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr, 1571 u8 bdaddr_type, u8 *hash192, u8 *rand192, 1572 u8 *hash256, u8 *rand256) 1573 { 1574 struct oob_data *data; 1575 1576 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type); 1577 if (!data) { 1578 data = kmalloc(sizeof(*data), GFP_KERNEL); 1579 if (!data) 1580 return -ENOMEM; 1581 1582 bacpy(&data->bdaddr, bdaddr); 1583 data->bdaddr_type = bdaddr_type; 1584 list_add(&data->list, &hdev->remote_oob_data); 1585 } 1586 1587 if (hash192 && rand192) { 1588 memcpy(data->hash192, hash192, sizeof(data->hash192)); 1589 memcpy(data->rand192, rand192, sizeof(data->rand192)); 1590 if (hash256 && rand256) 1591 data->present = 0x03; 1592 } else { 1593 memset(data->hash192, 0, sizeof(data->hash192)); 1594 memset(data->rand192, 0, sizeof(data->rand192)); 1595 if (hash256 && rand256) 1596 data->present = 0x02; 1597 else 1598 data->present = 0x00; 1599 } 1600 1601 if (hash256 && rand256) { 1602 memcpy(data->hash256, hash256, sizeof(data->hash256)); 1603 memcpy(data->rand256, rand256, sizeof(data->rand256)); 1604 } else { 1605 memset(data->hash256, 0, sizeof(data->hash256)); 1606 memset(data->rand256, 0, sizeof(data->rand256)); 1607 if (hash192 && rand192) 1608 data->present = 0x01; 1609 } 1610 1611 BT_DBG("%s for %pMR", hdev->name, bdaddr); 1612 1613 return 0; 1614 } 1615 1616 /* This function requires the caller holds hdev->lock */ 1617 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance) 1618 { 1619 struct adv_info *adv_instance; 1620 1621 list_for_each_entry(adv_instance, &hdev->adv_instances, list) { 1622 if (adv_instance->instance == instance) 1623 return adv_instance; 1624 } 1625 1626 return NULL; 1627 } 1628 1629 /* This function requires the caller holds hdev->lock */ 1630 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance) 1631 { 1632 struct adv_info *cur_instance; 1633 1634 cur_instance = hci_find_adv_instance(hdev, instance); 1635 if (!cur_instance) 1636 return NULL; 1637 1638 if (cur_instance == list_last_entry(&hdev->adv_instances, 1639 struct adv_info, list)) 1640 return list_first_entry(&hdev->adv_instances, 1641 struct adv_info, list); 1642 else 1643 return list_next_entry(cur_instance, list); 1644 } 1645 1646 /* This function requires the caller holds hdev->lock */ 1647 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance) 1648 { 1649 struct adv_info *adv_instance; 1650 1651 adv_instance = hci_find_adv_instance(hdev, instance); 1652 if (!adv_instance) 1653 return -ENOENT; 1654 1655 BT_DBG("%s removing %dMR", hdev->name, instance); 1656 1657 if (hdev->cur_adv_instance == instance) { 1658 if (hdev->adv_instance_timeout) { 1659 cancel_delayed_work(&hdev->adv_instance_expire); 1660 hdev->adv_instance_timeout = 0; 1661 } 1662 hdev->cur_adv_instance = 0x00; 1663 } 1664 1665 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb); 1666 1667 list_del(&adv_instance->list); 1668 kfree(adv_instance); 1669 1670 hdev->adv_instance_cnt--; 1671 1672 return 0; 1673 } 1674 1675 void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired) 1676 { 1677 struct adv_info *adv_instance, *n; 1678 1679 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) 1680 adv_instance->rpa_expired = rpa_expired; 1681 } 1682 1683 /* This function requires the caller holds hdev->lock */ 1684 void hci_adv_instances_clear(struct hci_dev *hdev) 1685 { 1686 struct adv_info *adv_instance, *n; 1687 1688 if (hdev->adv_instance_timeout) { 1689 cancel_delayed_work(&hdev->adv_instance_expire); 1690 hdev->adv_instance_timeout = 0; 1691 } 1692 1693 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) { 1694 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb); 1695 list_del(&adv_instance->list); 1696 kfree(adv_instance); 1697 } 1698 1699 hdev->adv_instance_cnt = 0; 1700 hdev->cur_adv_instance = 0x00; 1701 } 1702 1703 static void adv_instance_rpa_expired(struct work_struct *work) 1704 { 1705 struct adv_info *adv_instance = container_of(work, struct adv_info, 1706 rpa_expired_cb.work); 1707 1708 BT_DBG(""); 1709 1710 adv_instance->rpa_expired = true; 1711 } 1712 1713 /* This function requires the caller holds hdev->lock */ 1714 struct adv_info *hci_add_adv_instance(struct hci_dev *hdev, u8 instance, 1715 u32 flags, u16 adv_data_len, u8 *adv_data, 1716 u16 scan_rsp_len, u8 *scan_rsp_data, 1717 u16 timeout, u16 duration, s8 tx_power, 1718 u32 min_interval, u32 max_interval, 1719 u8 mesh_handle) 1720 { 1721 struct adv_info *adv; 1722 1723 adv = hci_find_adv_instance(hdev, instance); 1724 if (adv) { 1725 memset(adv->adv_data, 0, sizeof(adv->adv_data)); 1726 memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data)); 1727 memset(adv->per_adv_data, 0, sizeof(adv->per_adv_data)); 1728 } else { 1729 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets || 1730 instance < 1 || instance > hdev->le_num_of_adv_sets + 1) 1731 return ERR_PTR(-EOVERFLOW); 1732 1733 adv = kzalloc(sizeof(*adv), GFP_KERNEL); 1734 if (!adv) 1735 return ERR_PTR(-ENOMEM); 1736 1737 adv->pending = true; 1738 adv->instance = instance; 1739 list_add(&adv->list, &hdev->adv_instances); 1740 hdev->adv_instance_cnt++; 1741 } 1742 1743 adv->flags = flags; 1744 adv->min_interval = min_interval; 1745 adv->max_interval = max_interval; 1746 adv->tx_power = tx_power; 1747 /* Defining a mesh_handle changes the timing units to ms, 1748 * rather than seconds, and ties the instance to the requested 1749 * mesh_tx queue. 1750 */ 1751 adv->mesh = mesh_handle; 1752 1753 hci_set_adv_instance_data(hdev, instance, adv_data_len, adv_data, 1754 scan_rsp_len, scan_rsp_data); 1755 1756 adv->timeout = timeout; 1757 adv->remaining_time = timeout; 1758 1759 if (duration == 0) 1760 adv->duration = hdev->def_multi_adv_rotation_duration; 1761 else 1762 adv->duration = duration; 1763 1764 INIT_DELAYED_WORK(&adv->rpa_expired_cb, adv_instance_rpa_expired); 1765 1766 BT_DBG("%s for %dMR", hdev->name, instance); 1767 1768 return adv; 1769 } 1770 1771 /* This function requires the caller holds hdev->lock */ 1772 struct adv_info *hci_add_per_instance(struct hci_dev *hdev, u8 instance, 1773 u32 flags, u8 data_len, u8 *data, 1774 u32 min_interval, u32 max_interval) 1775 { 1776 struct adv_info *adv; 1777 1778 adv = hci_add_adv_instance(hdev, instance, flags, 0, NULL, 0, NULL, 1779 0, 0, HCI_ADV_TX_POWER_NO_PREFERENCE, 1780 min_interval, max_interval, 0); 1781 if (IS_ERR(adv)) 1782 return adv; 1783 1784 adv->periodic = true; 1785 adv->per_adv_data_len = data_len; 1786 1787 if (data) 1788 memcpy(adv->per_adv_data, data, data_len); 1789 1790 return adv; 1791 } 1792 1793 /* This function requires the caller holds hdev->lock */ 1794 int hci_set_adv_instance_data(struct hci_dev *hdev, u8 instance, 1795 u16 adv_data_len, u8 *adv_data, 1796 u16 scan_rsp_len, u8 *scan_rsp_data) 1797 { 1798 struct adv_info *adv; 1799 1800 adv = hci_find_adv_instance(hdev, instance); 1801 1802 /* If advertisement doesn't exist, we can't modify its data */ 1803 if (!adv) 1804 return -ENOENT; 1805 1806 if (adv_data_len && ADV_DATA_CMP(adv, adv_data, adv_data_len)) { 1807 memset(adv->adv_data, 0, sizeof(adv->adv_data)); 1808 memcpy(adv->adv_data, adv_data, adv_data_len); 1809 adv->adv_data_len = adv_data_len; 1810 adv->adv_data_changed = true; 1811 } 1812 1813 if (scan_rsp_len && SCAN_RSP_CMP(adv, scan_rsp_data, scan_rsp_len)) { 1814 memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data)); 1815 memcpy(adv->scan_rsp_data, scan_rsp_data, scan_rsp_len); 1816 adv->scan_rsp_len = scan_rsp_len; 1817 adv->scan_rsp_changed = true; 1818 } 1819 1820 /* Mark as changed if there are flags which would affect it */ 1821 if (((adv->flags & MGMT_ADV_FLAG_APPEARANCE) && hdev->appearance) || 1822 adv->flags & MGMT_ADV_FLAG_LOCAL_NAME) 1823 adv->scan_rsp_changed = true; 1824 1825 return 0; 1826 } 1827 1828 /* This function requires the caller holds hdev->lock */ 1829 u32 hci_adv_instance_flags(struct hci_dev *hdev, u8 instance) 1830 { 1831 u32 flags; 1832 struct adv_info *adv; 1833 1834 if (instance == 0x00) { 1835 /* Instance 0 always manages the "Tx Power" and "Flags" 1836 * fields 1837 */ 1838 flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS; 1839 1840 /* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting 1841 * corresponds to the "connectable" instance flag. 1842 */ 1843 if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE)) 1844 flags |= MGMT_ADV_FLAG_CONNECTABLE; 1845 1846 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 1847 flags |= MGMT_ADV_FLAG_LIMITED_DISCOV; 1848 else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 1849 flags |= MGMT_ADV_FLAG_DISCOV; 1850 1851 return flags; 1852 } 1853 1854 adv = hci_find_adv_instance(hdev, instance); 1855 1856 /* Return 0 when we got an invalid instance identifier. */ 1857 if (!adv) 1858 return 0; 1859 1860 return adv->flags; 1861 } 1862 1863 bool hci_adv_instance_is_scannable(struct hci_dev *hdev, u8 instance) 1864 { 1865 struct adv_info *adv; 1866 1867 /* Instance 0x00 always set local name */ 1868 if (instance == 0x00) 1869 return true; 1870 1871 adv = hci_find_adv_instance(hdev, instance); 1872 if (!adv) 1873 return false; 1874 1875 if (adv->flags & MGMT_ADV_FLAG_APPEARANCE || 1876 adv->flags & MGMT_ADV_FLAG_LOCAL_NAME) 1877 return true; 1878 1879 return adv->scan_rsp_len ? true : false; 1880 } 1881 1882 /* This function requires the caller holds hdev->lock */ 1883 void hci_adv_monitors_clear(struct hci_dev *hdev) 1884 { 1885 struct adv_monitor *monitor; 1886 int handle; 1887 1888 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle) 1889 hci_free_adv_monitor(hdev, monitor); 1890 1891 idr_destroy(&hdev->adv_monitors_idr); 1892 } 1893 1894 /* Frees the monitor structure and do some bookkeepings. 1895 * This function requires the caller holds hdev->lock. 1896 */ 1897 void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor) 1898 { 1899 struct adv_pattern *pattern; 1900 struct adv_pattern *tmp; 1901 1902 if (!monitor) 1903 return; 1904 1905 list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list) { 1906 list_del(&pattern->list); 1907 kfree(pattern); 1908 } 1909 1910 if (monitor->handle) 1911 idr_remove(&hdev->adv_monitors_idr, monitor->handle); 1912 1913 if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) { 1914 hdev->adv_monitors_cnt--; 1915 mgmt_adv_monitor_removed(hdev, monitor->handle); 1916 } 1917 1918 kfree(monitor); 1919 } 1920 1921 /* Assigns handle to a monitor, and if offloading is supported and power is on, 1922 * also attempts to forward the request to the controller. 1923 * This function requires the caller holds hci_req_sync_lock. 1924 */ 1925 int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor) 1926 { 1927 int min, max, handle; 1928 int status = 0; 1929 1930 if (!monitor) 1931 return -EINVAL; 1932 1933 hci_dev_lock(hdev); 1934 1935 min = HCI_MIN_ADV_MONITOR_HANDLE; 1936 max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES; 1937 handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max, 1938 GFP_KERNEL); 1939 1940 hci_dev_unlock(hdev); 1941 1942 if (handle < 0) 1943 return handle; 1944 1945 monitor->handle = handle; 1946 1947 if (!hdev_is_powered(hdev)) 1948 return status; 1949 1950 switch (hci_get_adv_monitor_offload_ext(hdev)) { 1951 case HCI_ADV_MONITOR_EXT_NONE: 1952 bt_dev_dbg(hdev, "add monitor %d status %d", 1953 monitor->handle, status); 1954 /* Message was not forwarded to controller - not an error */ 1955 break; 1956 1957 case HCI_ADV_MONITOR_EXT_MSFT: 1958 status = msft_add_monitor_pattern(hdev, monitor); 1959 bt_dev_dbg(hdev, "add monitor %d msft status %d", 1960 handle, status); 1961 break; 1962 } 1963 1964 return status; 1965 } 1966 1967 /* Attempts to tell the controller and free the monitor. If somehow the 1968 * controller doesn't have a corresponding handle, remove anyway. 1969 * This function requires the caller holds hci_req_sync_lock. 1970 */ 1971 static int hci_remove_adv_monitor(struct hci_dev *hdev, 1972 struct adv_monitor *monitor) 1973 { 1974 int status = 0; 1975 int handle; 1976 1977 switch (hci_get_adv_monitor_offload_ext(hdev)) { 1978 case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */ 1979 bt_dev_dbg(hdev, "remove monitor %d status %d", 1980 monitor->handle, status); 1981 goto free_monitor; 1982 1983 case HCI_ADV_MONITOR_EXT_MSFT: 1984 handle = monitor->handle; 1985 status = msft_remove_monitor(hdev, monitor); 1986 bt_dev_dbg(hdev, "remove monitor %d msft status %d", 1987 handle, status); 1988 break; 1989 } 1990 1991 /* In case no matching handle registered, just free the monitor */ 1992 if (status == -ENOENT) 1993 goto free_monitor; 1994 1995 return status; 1996 1997 free_monitor: 1998 if (status == -ENOENT) 1999 bt_dev_warn(hdev, "Removing monitor with no matching handle %d", 2000 monitor->handle); 2001 hci_free_adv_monitor(hdev, monitor); 2002 2003 return status; 2004 } 2005 2006 /* This function requires the caller holds hci_req_sync_lock */ 2007 int hci_remove_single_adv_monitor(struct hci_dev *hdev, u16 handle) 2008 { 2009 struct adv_monitor *monitor = idr_find(&hdev->adv_monitors_idr, handle); 2010 2011 if (!monitor) 2012 return -EINVAL; 2013 2014 return hci_remove_adv_monitor(hdev, monitor); 2015 } 2016 2017 /* This function requires the caller holds hci_req_sync_lock */ 2018 int hci_remove_all_adv_monitor(struct hci_dev *hdev) 2019 { 2020 struct adv_monitor *monitor; 2021 int idr_next_id = 0; 2022 int status = 0; 2023 2024 while (1) { 2025 monitor = idr_get_next(&hdev->adv_monitors_idr, &idr_next_id); 2026 if (!monitor) 2027 break; 2028 2029 status = hci_remove_adv_monitor(hdev, monitor); 2030 if (status) 2031 return status; 2032 2033 idr_next_id++; 2034 } 2035 2036 return status; 2037 } 2038 2039 /* This function requires the caller holds hdev->lock */ 2040 bool hci_is_adv_monitoring(struct hci_dev *hdev) 2041 { 2042 return !idr_is_empty(&hdev->adv_monitors_idr); 2043 } 2044 2045 int hci_get_adv_monitor_offload_ext(struct hci_dev *hdev) 2046 { 2047 if (msft_monitor_supported(hdev)) 2048 return HCI_ADV_MONITOR_EXT_MSFT; 2049 2050 return HCI_ADV_MONITOR_EXT_NONE; 2051 } 2052 2053 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list, 2054 bdaddr_t *bdaddr, u8 type) 2055 { 2056 struct bdaddr_list *b; 2057 2058 list_for_each_entry(b, bdaddr_list, list) { 2059 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type) 2060 return b; 2061 } 2062 2063 return NULL; 2064 } 2065 2066 struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk( 2067 struct list_head *bdaddr_list, bdaddr_t *bdaddr, 2068 u8 type) 2069 { 2070 struct bdaddr_list_with_irk *b; 2071 2072 list_for_each_entry(b, bdaddr_list, list) { 2073 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type) 2074 return b; 2075 } 2076 2077 return NULL; 2078 } 2079 2080 struct bdaddr_list_with_flags * 2081 hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list, 2082 bdaddr_t *bdaddr, u8 type) 2083 { 2084 struct bdaddr_list_with_flags *b; 2085 2086 list_for_each_entry(b, bdaddr_list, list) { 2087 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type) 2088 return b; 2089 } 2090 2091 return NULL; 2092 } 2093 2094 void hci_bdaddr_list_clear(struct list_head *bdaddr_list) 2095 { 2096 struct bdaddr_list *b, *n; 2097 2098 list_for_each_entry_safe(b, n, bdaddr_list, list) { 2099 list_del(&b->list); 2100 kfree(b); 2101 } 2102 } 2103 2104 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type) 2105 { 2106 struct bdaddr_list *entry; 2107 2108 if (!bacmp(bdaddr, BDADDR_ANY)) 2109 return -EBADF; 2110 2111 if (hci_bdaddr_list_lookup(list, bdaddr, type)) 2112 return -EEXIST; 2113 2114 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 2115 if (!entry) 2116 return -ENOMEM; 2117 2118 bacpy(&entry->bdaddr, bdaddr); 2119 entry->bdaddr_type = type; 2120 2121 list_add(&entry->list, list); 2122 2123 return 0; 2124 } 2125 2126 int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr, 2127 u8 type, u8 *peer_irk, u8 *local_irk) 2128 { 2129 struct bdaddr_list_with_irk *entry; 2130 2131 if (!bacmp(bdaddr, BDADDR_ANY)) 2132 return -EBADF; 2133 2134 if (hci_bdaddr_list_lookup(list, bdaddr, type)) 2135 return -EEXIST; 2136 2137 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 2138 if (!entry) 2139 return -ENOMEM; 2140 2141 bacpy(&entry->bdaddr, bdaddr); 2142 entry->bdaddr_type = type; 2143 2144 if (peer_irk) 2145 memcpy(entry->peer_irk, peer_irk, 16); 2146 2147 if (local_irk) 2148 memcpy(entry->local_irk, local_irk, 16); 2149 2150 list_add(&entry->list, list); 2151 2152 return 0; 2153 } 2154 2155 int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr, 2156 u8 type, u32 flags) 2157 { 2158 struct bdaddr_list_with_flags *entry; 2159 2160 if (!bacmp(bdaddr, BDADDR_ANY)) 2161 return -EBADF; 2162 2163 if (hci_bdaddr_list_lookup(list, bdaddr, type)) 2164 return -EEXIST; 2165 2166 entry = kzalloc(sizeof(*entry), GFP_KERNEL); 2167 if (!entry) 2168 return -ENOMEM; 2169 2170 bacpy(&entry->bdaddr, bdaddr); 2171 entry->bdaddr_type = type; 2172 entry->flags = flags; 2173 2174 list_add(&entry->list, list); 2175 2176 return 0; 2177 } 2178 2179 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type) 2180 { 2181 struct bdaddr_list *entry; 2182 2183 if (!bacmp(bdaddr, BDADDR_ANY)) { 2184 hci_bdaddr_list_clear(list); 2185 return 0; 2186 } 2187 2188 entry = hci_bdaddr_list_lookup(list, bdaddr, type); 2189 if (!entry) 2190 return -ENOENT; 2191 2192 list_del(&entry->list); 2193 kfree(entry); 2194 2195 return 0; 2196 } 2197 2198 int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr, 2199 u8 type) 2200 { 2201 struct bdaddr_list_with_irk *entry; 2202 2203 if (!bacmp(bdaddr, BDADDR_ANY)) { 2204 hci_bdaddr_list_clear(list); 2205 return 0; 2206 } 2207 2208 entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type); 2209 if (!entry) 2210 return -ENOENT; 2211 2212 list_del(&entry->list); 2213 kfree(entry); 2214 2215 return 0; 2216 } 2217 2218 int hci_bdaddr_list_del_with_flags(struct list_head *list, bdaddr_t *bdaddr, 2219 u8 type) 2220 { 2221 struct bdaddr_list_with_flags *entry; 2222 2223 if (!bacmp(bdaddr, BDADDR_ANY)) { 2224 hci_bdaddr_list_clear(list); 2225 return 0; 2226 } 2227 2228 entry = hci_bdaddr_list_lookup_with_flags(list, bdaddr, type); 2229 if (!entry) 2230 return -ENOENT; 2231 2232 list_del(&entry->list); 2233 kfree(entry); 2234 2235 return 0; 2236 } 2237 2238 /* This function requires the caller holds hdev->lock */ 2239 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev, 2240 bdaddr_t *addr, u8 addr_type) 2241 { 2242 struct hci_conn_params *params; 2243 2244 list_for_each_entry(params, &hdev->le_conn_params, list) { 2245 if (bacmp(¶ms->addr, addr) == 0 && 2246 params->addr_type == addr_type) { 2247 return params; 2248 } 2249 } 2250 2251 return NULL; 2252 } 2253 2254 /* This function requires the caller holds hdev->lock or rcu_read_lock */ 2255 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list, 2256 bdaddr_t *addr, u8 addr_type) 2257 { 2258 struct hci_conn_params *param; 2259 2260 rcu_read_lock(); 2261 2262 list_for_each_entry_rcu(param, list, action) { 2263 if (bacmp(¶m->addr, addr) == 0 && 2264 param->addr_type == addr_type) { 2265 rcu_read_unlock(); 2266 return param; 2267 } 2268 } 2269 2270 rcu_read_unlock(); 2271 2272 return NULL; 2273 } 2274 2275 /* This function requires the caller holds hdev->lock */ 2276 void hci_pend_le_list_del_init(struct hci_conn_params *param) 2277 { 2278 if (list_empty(¶m->action)) 2279 return; 2280 2281 list_del_rcu(¶m->action); 2282 synchronize_rcu(); 2283 INIT_LIST_HEAD(¶m->action); 2284 } 2285 2286 /* This function requires the caller holds hdev->lock */ 2287 void hci_pend_le_list_add(struct hci_conn_params *param, 2288 struct list_head *list) 2289 { 2290 list_add_rcu(¶m->action, list); 2291 } 2292 2293 /* This function requires the caller holds hdev->lock */ 2294 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev, 2295 bdaddr_t *addr, u8 addr_type) 2296 { 2297 struct hci_conn_params *params; 2298 2299 params = hci_conn_params_lookup(hdev, addr, addr_type); 2300 if (params) 2301 return params; 2302 2303 params = kzalloc(sizeof(*params), GFP_KERNEL); 2304 if (!params) { 2305 bt_dev_err(hdev, "out of memory"); 2306 return NULL; 2307 } 2308 2309 bacpy(¶ms->addr, addr); 2310 params->addr_type = addr_type; 2311 2312 list_add(¶ms->list, &hdev->le_conn_params); 2313 INIT_LIST_HEAD(¶ms->action); 2314 2315 params->conn_min_interval = hdev->le_conn_min_interval; 2316 params->conn_max_interval = hdev->le_conn_max_interval; 2317 params->conn_latency = hdev->le_conn_latency; 2318 params->supervision_timeout = hdev->le_supv_timeout; 2319 params->auto_connect = HCI_AUTO_CONN_DISABLED; 2320 2321 BT_DBG("addr %pMR (type %u)", addr, addr_type); 2322 2323 return params; 2324 } 2325 2326 void hci_conn_params_free(struct hci_conn_params *params) 2327 { 2328 hci_pend_le_list_del_init(params); 2329 2330 if (params->conn) { 2331 hci_conn_drop(params->conn); 2332 hci_conn_put(params->conn); 2333 } 2334 2335 list_del(¶ms->list); 2336 kfree(params); 2337 } 2338 2339 /* This function requires the caller holds hdev->lock */ 2340 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type) 2341 { 2342 struct hci_conn_params *params; 2343 2344 params = hci_conn_params_lookup(hdev, addr, addr_type); 2345 if (!params) 2346 return; 2347 2348 hci_conn_params_free(params); 2349 2350 hci_update_passive_scan(hdev); 2351 2352 BT_DBG("addr %pMR (type %u)", addr, addr_type); 2353 } 2354 2355 /* This function requires the caller holds hdev->lock */ 2356 void hci_conn_params_clear_disabled(struct hci_dev *hdev) 2357 { 2358 struct hci_conn_params *params, *tmp; 2359 2360 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) { 2361 if (params->auto_connect != HCI_AUTO_CONN_DISABLED) 2362 continue; 2363 2364 /* If trying to establish one time connection to disabled 2365 * device, leave the params, but mark them as just once. 2366 */ 2367 if (params->explicit_connect) { 2368 params->auto_connect = HCI_AUTO_CONN_EXPLICIT; 2369 continue; 2370 } 2371 2372 hci_conn_params_free(params); 2373 } 2374 2375 BT_DBG("All LE disabled connection parameters were removed"); 2376 } 2377 2378 /* This function requires the caller holds hdev->lock */ 2379 static void hci_conn_params_clear_all(struct hci_dev *hdev) 2380 { 2381 struct hci_conn_params *params, *tmp; 2382 2383 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) 2384 hci_conn_params_free(params); 2385 2386 BT_DBG("All LE connection parameters were removed"); 2387 } 2388 2389 /* Copy the Identity Address of the controller. 2390 * 2391 * If the controller has a public BD_ADDR, then by default use that one. 2392 * If this is a LE only controller without a public address, default to 2393 * the static random address. 2394 * 2395 * For debugging purposes it is possible to force controllers with a 2396 * public address to use the static random address instead. 2397 * 2398 * In case BR/EDR has been disabled on a dual-mode controller and 2399 * userspace has configured a static address, then that address 2400 * becomes the identity address instead of the public BR/EDR address. 2401 */ 2402 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr, 2403 u8 *bdaddr_type) 2404 { 2405 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 2406 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 2407 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 2408 bacmp(&hdev->static_addr, BDADDR_ANY))) { 2409 bacpy(bdaddr, &hdev->static_addr); 2410 *bdaddr_type = ADDR_LE_DEV_RANDOM; 2411 } else { 2412 bacpy(bdaddr, &hdev->bdaddr); 2413 *bdaddr_type = ADDR_LE_DEV_PUBLIC; 2414 } 2415 } 2416 2417 static void hci_clear_wake_reason(struct hci_dev *hdev) 2418 { 2419 hci_dev_lock(hdev); 2420 2421 hdev->wake_reason = 0; 2422 bacpy(&hdev->wake_addr, BDADDR_ANY); 2423 hdev->wake_addr_type = 0; 2424 2425 hci_dev_unlock(hdev); 2426 } 2427 2428 static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action, 2429 void *data) 2430 { 2431 struct hci_dev *hdev = 2432 container_of(nb, struct hci_dev, suspend_notifier); 2433 int ret = 0; 2434 2435 /* Userspace has full control of this device. Do nothing. */ 2436 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) 2437 return NOTIFY_DONE; 2438 2439 /* To avoid a potential race with hci_unregister_dev. */ 2440 hci_dev_hold(hdev); 2441 2442 if (action == PM_SUSPEND_PREPARE) 2443 ret = hci_suspend_dev(hdev); 2444 else if (action == PM_POST_SUSPEND) 2445 ret = hci_resume_dev(hdev); 2446 2447 if (ret) 2448 bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d", 2449 action, ret); 2450 2451 hci_dev_put(hdev); 2452 return NOTIFY_DONE; 2453 } 2454 2455 /* Alloc HCI device */ 2456 struct hci_dev *hci_alloc_dev_priv(int sizeof_priv) 2457 { 2458 struct hci_dev *hdev; 2459 unsigned int alloc_size; 2460 2461 alloc_size = sizeof(*hdev); 2462 if (sizeof_priv) { 2463 /* Fixme: May need ALIGN-ment? */ 2464 alloc_size += sizeof_priv; 2465 } 2466 2467 hdev = kzalloc(alloc_size, GFP_KERNEL); 2468 if (!hdev) 2469 return NULL; 2470 2471 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1); 2472 hdev->esco_type = (ESCO_HV1); 2473 hdev->link_mode = (HCI_LM_ACCEPT); 2474 hdev->num_iac = 0x01; /* One IAC support is mandatory */ 2475 hdev->io_capability = 0x03; /* No Input No Output */ 2476 hdev->manufacturer = 0xffff; /* Default to internal use */ 2477 hdev->inq_tx_power = HCI_TX_POWER_INVALID; 2478 hdev->adv_tx_power = HCI_TX_POWER_INVALID; 2479 hdev->adv_instance_cnt = 0; 2480 hdev->cur_adv_instance = 0x00; 2481 hdev->adv_instance_timeout = 0; 2482 2483 hdev->advmon_allowlist_duration = 300; 2484 hdev->advmon_no_filter_duration = 500; 2485 hdev->enable_advmon_interleave_scan = 0x00; /* Default to disable */ 2486 2487 hdev->sniff_max_interval = 800; 2488 hdev->sniff_min_interval = 80; 2489 2490 hdev->le_adv_channel_map = 0x07; 2491 hdev->le_adv_min_interval = 0x0800; 2492 hdev->le_adv_max_interval = 0x0800; 2493 hdev->le_scan_interval = 0x0060; 2494 hdev->le_scan_window = 0x0030; 2495 hdev->le_scan_int_suspend = 0x0400; 2496 hdev->le_scan_window_suspend = 0x0012; 2497 hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT; 2498 hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN; 2499 hdev->le_scan_int_adv_monitor = 0x0060; 2500 hdev->le_scan_window_adv_monitor = 0x0030; 2501 hdev->le_scan_int_connect = 0x0060; 2502 hdev->le_scan_window_connect = 0x0060; 2503 hdev->le_conn_min_interval = 0x0018; 2504 hdev->le_conn_max_interval = 0x0028; 2505 hdev->le_conn_latency = 0x0000; 2506 hdev->le_supv_timeout = 0x002a; 2507 hdev->le_def_tx_len = 0x001b; 2508 hdev->le_def_tx_time = 0x0148; 2509 hdev->le_max_tx_len = 0x001b; 2510 hdev->le_max_tx_time = 0x0148; 2511 hdev->le_max_rx_len = 0x001b; 2512 hdev->le_max_rx_time = 0x0148; 2513 hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE; 2514 hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE; 2515 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M; 2516 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M; 2517 hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES; 2518 hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION; 2519 hdev->def_le_autoconnect_timeout = HCI_LE_AUTOCONN_TIMEOUT; 2520 hdev->min_le_tx_power = HCI_TX_POWER_INVALID; 2521 hdev->max_le_tx_power = HCI_TX_POWER_INVALID; 2522 2523 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT; 2524 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT; 2525 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE; 2526 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE; 2527 hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT; 2528 hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE; 2529 2530 /* default 1.28 sec page scan */ 2531 hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD; 2532 hdev->def_page_scan_int = 0x0800; 2533 hdev->def_page_scan_window = 0x0012; 2534 2535 mutex_init(&hdev->lock); 2536 mutex_init(&hdev->req_lock); 2537 2538 INIT_LIST_HEAD(&hdev->mesh_pending); 2539 INIT_LIST_HEAD(&hdev->mgmt_pending); 2540 INIT_LIST_HEAD(&hdev->reject_list); 2541 INIT_LIST_HEAD(&hdev->accept_list); 2542 INIT_LIST_HEAD(&hdev->uuids); 2543 INIT_LIST_HEAD(&hdev->link_keys); 2544 INIT_LIST_HEAD(&hdev->long_term_keys); 2545 INIT_LIST_HEAD(&hdev->identity_resolving_keys); 2546 INIT_LIST_HEAD(&hdev->remote_oob_data); 2547 INIT_LIST_HEAD(&hdev->le_accept_list); 2548 INIT_LIST_HEAD(&hdev->le_resolv_list); 2549 INIT_LIST_HEAD(&hdev->le_conn_params); 2550 INIT_LIST_HEAD(&hdev->pend_le_conns); 2551 INIT_LIST_HEAD(&hdev->pend_le_reports); 2552 INIT_LIST_HEAD(&hdev->conn_hash.list); 2553 INIT_LIST_HEAD(&hdev->adv_instances); 2554 INIT_LIST_HEAD(&hdev->blocked_keys); 2555 INIT_LIST_HEAD(&hdev->monitored_devices); 2556 2557 INIT_LIST_HEAD(&hdev->local_codecs); 2558 INIT_WORK(&hdev->rx_work, hci_rx_work); 2559 INIT_WORK(&hdev->cmd_work, hci_cmd_work); 2560 INIT_WORK(&hdev->tx_work, hci_tx_work); 2561 INIT_WORK(&hdev->power_on, hci_power_on); 2562 INIT_WORK(&hdev->error_reset, hci_error_reset); 2563 2564 hci_cmd_sync_init(hdev); 2565 2566 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off); 2567 2568 skb_queue_head_init(&hdev->rx_q); 2569 skb_queue_head_init(&hdev->cmd_q); 2570 skb_queue_head_init(&hdev->raw_q); 2571 2572 init_waitqueue_head(&hdev->req_wait_q); 2573 2574 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout); 2575 INIT_DELAYED_WORK(&hdev->ncmd_timer, hci_ncmd_timeout); 2576 2577 hci_devcd_setup(hdev); 2578 hci_request_setup(hdev); 2579 2580 hci_init_sysfs(hdev); 2581 discovery_init(hdev); 2582 2583 return hdev; 2584 } 2585 EXPORT_SYMBOL(hci_alloc_dev_priv); 2586 2587 /* Free HCI device */ 2588 void hci_free_dev(struct hci_dev *hdev) 2589 { 2590 /* will free via device release */ 2591 put_device(&hdev->dev); 2592 } 2593 EXPORT_SYMBOL(hci_free_dev); 2594 2595 /* Register HCI device */ 2596 int hci_register_dev(struct hci_dev *hdev) 2597 { 2598 int id, error; 2599 2600 if (!hdev->open || !hdev->close || !hdev->send) 2601 return -EINVAL; 2602 2603 /* Do not allow HCI_AMP devices to register at index 0, 2604 * so the index can be used as the AMP controller ID. 2605 */ 2606 switch (hdev->dev_type) { 2607 case HCI_PRIMARY: 2608 id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL); 2609 break; 2610 case HCI_AMP: 2611 id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL); 2612 break; 2613 default: 2614 return -EINVAL; 2615 } 2616 2617 if (id < 0) 2618 return id; 2619 2620 error = dev_set_name(&hdev->dev, "hci%u", id); 2621 if (error) 2622 return error; 2623 2624 hdev->name = dev_name(&hdev->dev); 2625 hdev->id = id; 2626 2627 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); 2628 2629 hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name); 2630 if (!hdev->workqueue) { 2631 error = -ENOMEM; 2632 goto err; 2633 } 2634 2635 hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, 2636 hdev->name); 2637 if (!hdev->req_workqueue) { 2638 destroy_workqueue(hdev->workqueue); 2639 error = -ENOMEM; 2640 goto err; 2641 } 2642 2643 if (!IS_ERR_OR_NULL(bt_debugfs)) 2644 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs); 2645 2646 error = device_add(&hdev->dev); 2647 if (error < 0) 2648 goto err_wqueue; 2649 2650 hci_leds_init(hdev); 2651 2652 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev, 2653 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops, 2654 hdev); 2655 if (hdev->rfkill) { 2656 if (rfkill_register(hdev->rfkill) < 0) { 2657 rfkill_destroy(hdev->rfkill); 2658 hdev->rfkill = NULL; 2659 } 2660 } 2661 2662 if (hdev->rfkill && rfkill_blocked(hdev->rfkill)) 2663 hci_dev_set_flag(hdev, HCI_RFKILLED); 2664 2665 hci_dev_set_flag(hdev, HCI_SETUP); 2666 hci_dev_set_flag(hdev, HCI_AUTO_OFF); 2667 2668 if (hdev->dev_type == HCI_PRIMARY) { 2669 /* Assume BR/EDR support until proven otherwise (such as 2670 * through reading supported features during init. 2671 */ 2672 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED); 2673 } 2674 2675 write_lock(&hci_dev_list_lock); 2676 list_add(&hdev->list, &hci_dev_list); 2677 write_unlock(&hci_dev_list_lock); 2678 2679 /* Devices that are marked for raw-only usage are unconfigured 2680 * and should not be included in normal operation. 2681 */ 2682 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks)) 2683 hci_dev_set_flag(hdev, HCI_UNCONFIGURED); 2684 2685 /* Mark Remote Wakeup connection flag as supported if driver has wakeup 2686 * callback. 2687 */ 2688 if (hdev->wakeup) 2689 hdev->conn_flags |= HCI_CONN_FLAG_REMOTE_WAKEUP; 2690 2691 hci_sock_dev_event(hdev, HCI_DEV_REG); 2692 hci_dev_hold(hdev); 2693 2694 error = hci_register_suspend_notifier(hdev); 2695 if (error) 2696 BT_WARN("register suspend notifier failed error:%d\n", error); 2697 2698 queue_work(hdev->req_workqueue, &hdev->power_on); 2699 2700 idr_init(&hdev->adv_monitors_idr); 2701 msft_register(hdev); 2702 2703 return id; 2704 2705 err_wqueue: 2706 debugfs_remove_recursive(hdev->debugfs); 2707 destroy_workqueue(hdev->workqueue); 2708 destroy_workqueue(hdev->req_workqueue); 2709 err: 2710 ida_simple_remove(&hci_index_ida, hdev->id); 2711 2712 return error; 2713 } 2714 EXPORT_SYMBOL(hci_register_dev); 2715 2716 /* Unregister HCI device */ 2717 void hci_unregister_dev(struct hci_dev *hdev) 2718 { 2719 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus); 2720 2721 mutex_lock(&hdev->unregister_lock); 2722 hci_dev_set_flag(hdev, HCI_UNREGISTER); 2723 mutex_unlock(&hdev->unregister_lock); 2724 2725 write_lock(&hci_dev_list_lock); 2726 list_del(&hdev->list); 2727 write_unlock(&hci_dev_list_lock); 2728 2729 cancel_work_sync(&hdev->power_on); 2730 2731 hci_cmd_sync_clear(hdev); 2732 2733 hci_unregister_suspend_notifier(hdev); 2734 2735 msft_unregister(hdev); 2736 2737 hci_dev_do_close(hdev); 2738 2739 if (!test_bit(HCI_INIT, &hdev->flags) && 2740 !hci_dev_test_flag(hdev, HCI_SETUP) && 2741 !hci_dev_test_flag(hdev, HCI_CONFIG)) { 2742 hci_dev_lock(hdev); 2743 mgmt_index_removed(hdev); 2744 hci_dev_unlock(hdev); 2745 } 2746 2747 /* mgmt_index_removed should take care of emptying the 2748 * pending list */ 2749 BUG_ON(!list_empty(&hdev->mgmt_pending)); 2750 2751 hci_sock_dev_event(hdev, HCI_DEV_UNREG); 2752 2753 if (hdev->rfkill) { 2754 rfkill_unregister(hdev->rfkill); 2755 rfkill_destroy(hdev->rfkill); 2756 } 2757 2758 device_del(&hdev->dev); 2759 /* Actual cleanup is deferred until hci_release_dev(). */ 2760 hci_dev_put(hdev); 2761 } 2762 EXPORT_SYMBOL(hci_unregister_dev); 2763 2764 /* Release HCI device */ 2765 void hci_release_dev(struct hci_dev *hdev) 2766 { 2767 debugfs_remove_recursive(hdev->debugfs); 2768 kfree_const(hdev->hw_info); 2769 kfree_const(hdev->fw_info); 2770 2771 destroy_workqueue(hdev->workqueue); 2772 destroy_workqueue(hdev->req_workqueue); 2773 2774 hci_dev_lock(hdev); 2775 hci_bdaddr_list_clear(&hdev->reject_list); 2776 hci_bdaddr_list_clear(&hdev->accept_list); 2777 hci_uuids_clear(hdev); 2778 hci_link_keys_clear(hdev); 2779 hci_smp_ltks_clear(hdev); 2780 hci_smp_irks_clear(hdev); 2781 hci_remote_oob_data_clear(hdev); 2782 hci_adv_instances_clear(hdev); 2783 hci_adv_monitors_clear(hdev); 2784 hci_bdaddr_list_clear(&hdev->le_accept_list); 2785 hci_bdaddr_list_clear(&hdev->le_resolv_list); 2786 hci_conn_params_clear_all(hdev); 2787 hci_discovery_filter_clear(hdev); 2788 hci_blocked_keys_clear(hdev); 2789 hci_dev_unlock(hdev); 2790 2791 ida_simple_remove(&hci_index_ida, hdev->id); 2792 kfree_skb(hdev->sent_cmd); 2793 kfree_skb(hdev->recv_event); 2794 kfree(hdev); 2795 } 2796 EXPORT_SYMBOL(hci_release_dev); 2797 2798 int hci_register_suspend_notifier(struct hci_dev *hdev) 2799 { 2800 int ret = 0; 2801 2802 if (!hdev->suspend_notifier.notifier_call && 2803 !test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) { 2804 hdev->suspend_notifier.notifier_call = hci_suspend_notifier; 2805 ret = register_pm_notifier(&hdev->suspend_notifier); 2806 } 2807 2808 return ret; 2809 } 2810 2811 int hci_unregister_suspend_notifier(struct hci_dev *hdev) 2812 { 2813 int ret = 0; 2814 2815 if (hdev->suspend_notifier.notifier_call) { 2816 ret = unregister_pm_notifier(&hdev->suspend_notifier); 2817 if (!ret) 2818 hdev->suspend_notifier.notifier_call = NULL; 2819 } 2820 2821 return ret; 2822 } 2823 2824 /* Suspend HCI device */ 2825 int hci_suspend_dev(struct hci_dev *hdev) 2826 { 2827 int ret; 2828 2829 bt_dev_dbg(hdev, ""); 2830 2831 /* Suspend should only act on when powered. */ 2832 if (!hdev_is_powered(hdev) || 2833 hci_dev_test_flag(hdev, HCI_UNREGISTER)) 2834 return 0; 2835 2836 /* If powering down don't attempt to suspend */ 2837 if (mgmt_powering_down(hdev)) 2838 return 0; 2839 2840 /* Cancel potentially blocking sync operation before suspend */ 2841 __hci_cmd_sync_cancel(hdev, -EHOSTDOWN); 2842 2843 hci_req_sync_lock(hdev); 2844 ret = hci_suspend_sync(hdev); 2845 hci_req_sync_unlock(hdev); 2846 2847 hci_clear_wake_reason(hdev); 2848 mgmt_suspending(hdev, hdev->suspend_state); 2849 2850 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND); 2851 return ret; 2852 } 2853 EXPORT_SYMBOL(hci_suspend_dev); 2854 2855 /* Resume HCI device */ 2856 int hci_resume_dev(struct hci_dev *hdev) 2857 { 2858 int ret; 2859 2860 bt_dev_dbg(hdev, ""); 2861 2862 /* Resume should only act on when powered. */ 2863 if (!hdev_is_powered(hdev) || 2864 hci_dev_test_flag(hdev, HCI_UNREGISTER)) 2865 return 0; 2866 2867 /* If powering down don't attempt to resume */ 2868 if (mgmt_powering_down(hdev)) 2869 return 0; 2870 2871 hci_req_sync_lock(hdev); 2872 ret = hci_resume_sync(hdev); 2873 hci_req_sync_unlock(hdev); 2874 2875 mgmt_resuming(hdev, hdev->wake_reason, &hdev->wake_addr, 2876 hdev->wake_addr_type); 2877 2878 hci_sock_dev_event(hdev, HCI_DEV_RESUME); 2879 return ret; 2880 } 2881 EXPORT_SYMBOL(hci_resume_dev); 2882 2883 /* Reset HCI device */ 2884 int hci_reset_dev(struct hci_dev *hdev) 2885 { 2886 static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 }; 2887 struct sk_buff *skb; 2888 2889 skb = bt_skb_alloc(3, GFP_ATOMIC); 2890 if (!skb) 2891 return -ENOMEM; 2892 2893 hci_skb_pkt_type(skb) = HCI_EVENT_PKT; 2894 skb_put_data(skb, hw_err, 3); 2895 2896 bt_dev_err(hdev, "Injecting HCI hardware error event"); 2897 2898 /* Send Hardware Error to upper stack */ 2899 return hci_recv_frame(hdev, skb); 2900 } 2901 EXPORT_SYMBOL(hci_reset_dev); 2902 2903 /* Receive frame from HCI drivers */ 2904 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb) 2905 { 2906 if (!hdev || (!test_bit(HCI_UP, &hdev->flags) 2907 && !test_bit(HCI_INIT, &hdev->flags))) { 2908 kfree_skb(skb); 2909 return -ENXIO; 2910 } 2911 2912 switch (hci_skb_pkt_type(skb)) { 2913 case HCI_EVENT_PKT: 2914 break; 2915 case HCI_ACLDATA_PKT: 2916 /* Detect if ISO packet has been sent as ACL */ 2917 if (hci_conn_num(hdev, ISO_LINK)) { 2918 __u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle); 2919 __u8 type; 2920 2921 type = hci_conn_lookup_type(hdev, hci_handle(handle)); 2922 if (type == ISO_LINK) 2923 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT; 2924 } 2925 break; 2926 case HCI_SCODATA_PKT: 2927 break; 2928 case HCI_ISODATA_PKT: 2929 break; 2930 default: 2931 kfree_skb(skb); 2932 return -EINVAL; 2933 } 2934 2935 /* Incoming skb */ 2936 bt_cb(skb)->incoming = 1; 2937 2938 /* Time stamp */ 2939 __net_timestamp(skb); 2940 2941 skb_queue_tail(&hdev->rx_q, skb); 2942 queue_work(hdev->workqueue, &hdev->rx_work); 2943 2944 return 0; 2945 } 2946 EXPORT_SYMBOL(hci_recv_frame); 2947 2948 /* Receive diagnostic message from HCI drivers */ 2949 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb) 2950 { 2951 /* Mark as diagnostic packet */ 2952 hci_skb_pkt_type(skb) = HCI_DIAG_PKT; 2953 2954 /* Time stamp */ 2955 __net_timestamp(skb); 2956 2957 skb_queue_tail(&hdev->rx_q, skb); 2958 queue_work(hdev->workqueue, &hdev->rx_work); 2959 2960 return 0; 2961 } 2962 EXPORT_SYMBOL(hci_recv_diag); 2963 2964 void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...) 2965 { 2966 va_list vargs; 2967 2968 va_start(vargs, fmt); 2969 kfree_const(hdev->hw_info); 2970 hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs); 2971 va_end(vargs); 2972 } 2973 EXPORT_SYMBOL(hci_set_hw_info); 2974 2975 void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...) 2976 { 2977 va_list vargs; 2978 2979 va_start(vargs, fmt); 2980 kfree_const(hdev->fw_info); 2981 hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs); 2982 va_end(vargs); 2983 } 2984 EXPORT_SYMBOL(hci_set_fw_info); 2985 2986 /* ---- Interface to upper protocols ---- */ 2987 2988 int hci_register_cb(struct hci_cb *cb) 2989 { 2990 BT_DBG("%p name %s", cb, cb->name); 2991 2992 mutex_lock(&hci_cb_list_lock); 2993 list_add_tail(&cb->list, &hci_cb_list); 2994 mutex_unlock(&hci_cb_list_lock); 2995 2996 return 0; 2997 } 2998 EXPORT_SYMBOL(hci_register_cb); 2999 3000 int hci_unregister_cb(struct hci_cb *cb) 3001 { 3002 BT_DBG("%p name %s", cb, cb->name); 3003 3004 mutex_lock(&hci_cb_list_lock); 3005 list_del(&cb->list); 3006 mutex_unlock(&hci_cb_list_lock); 3007 3008 return 0; 3009 } 3010 EXPORT_SYMBOL(hci_unregister_cb); 3011 3012 static int hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb) 3013 { 3014 int err; 3015 3016 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb), 3017 skb->len); 3018 3019 /* Time stamp */ 3020 __net_timestamp(skb); 3021 3022 /* Send copy to monitor */ 3023 hci_send_to_monitor(hdev, skb); 3024 3025 if (atomic_read(&hdev->promisc)) { 3026 /* Send copy to the sockets */ 3027 hci_send_to_sock(hdev, skb); 3028 } 3029 3030 /* Get rid of skb owner, prior to sending to the driver. */ 3031 skb_orphan(skb); 3032 3033 if (!test_bit(HCI_RUNNING, &hdev->flags)) { 3034 kfree_skb(skb); 3035 return -EINVAL; 3036 } 3037 3038 err = hdev->send(hdev, skb); 3039 if (err < 0) { 3040 bt_dev_err(hdev, "sending frame failed (%d)", err); 3041 kfree_skb(skb); 3042 return err; 3043 } 3044 3045 return 0; 3046 } 3047 3048 /* Send HCI command */ 3049 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen, 3050 const void *param) 3051 { 3052 struct sk_buff *skb; 3053 3054 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen); 3055 3056 skb = hci_prepare_cmd(hdev, opcode, plen, param); 3057 if (!skb) { 3058 bt_dev_err(hdev, "no memory for command"); 3059 return -ENOMEM; 3060 } 3061 3062 /* Stand-alone HCI commands must be flagged as 3063 * single-command requests. 3064 */ 3065 bt_cb(skb)->hci.req_flags |= HCI_REQ_START; 3066 3067 skb_queue_tail(&hdev->cmd_q, skb); 3068 queue_work(hdev->workqueue, &hdev->cmd_work); 3069 3070 return 0; 3071 } 3072 3073 int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen, 3074 const void *param) 3075 { 3076 struct sk_buff *skb; 3077 3078 if (hci_opcode_ogf(opcode) != 0x3f) { 3079 /* A controller receiving a command shall respond with either 3080 * a Command Status Event or a Command Complete Event. 3081 * Therefore, all standard HCI commands must be sent via the 3082 * standard API, using hci_send_cmd or hci_cmd_sync helpers. 3083 * Some vendors do not comply with this rule for vendor-specific 3084 * commands and do not return any event. We want to support 3085 * unresponded commands for such cases only. 3086 */ 3087 bt_dev_err(hdev, "unresponded command not supported"); 3088 return -EINVAL; 3089 } 3090 3091 skb = hci_prepare_cmd(hdev, opcode, plen, param); 3092 if (!skb) { 3093 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)", 3094 opcode); 3095 return -ENOMEM; 3096 } 3097 3098 hci_send_frame(hdev, skb); 3099 3100 return 0; 3101 } 3102 EXPORT_SYMBOL(__hci_cmd_send); 3103 3104 /* Get data from the previously sent command */ 3105 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode) 3106 { 3107 struct hci_command_hdr *hdr; 3108 3109 if (!hdev->sent_cmd) 3110 return NULL; 3111 3112 hdr = (void *) hdev->sent_cmd->data; 3113 3114 if (hdr->opcode != cpu_to_le16(opcode)) 3115 return NULL; 3116 3117 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode); 3118 3119 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE; 3120 } 3121 3122 /* Get data from last received event */ 3123 void *hci_recv_event_data(struct hci_dev *hdev, __u8 event) 3124 { 3125 struct hci_event_hdr *hdr; 3126 int offset; 3127 3128 if (!hdev->recv_event) 3129 return NULL; 3130 3131 hdr = (void *)hdev->recv_event->data; 3132 offset = sizeof(*hdr); 3133 3134 if (hdr->evt != event) { 3135 /* In case of LE metaevent check the subevent match */ 3136 if (hdr->evt == HCI_EV_LE_META) { 3137 struct hci_ev_le_meta *ev; 3138 3139 ev = (void *)hdev->recv_event->data + offset; 3140 offset += sizeof(*ev); 3141 if (ev->subevent == event) 3142 goto found; 3143 } 3144 return NULL; 3145 } 3146 3147 found: 3148 bt_dev_dbg(hdev, "event 0x%2.2x", event); 3149 3150 return hdev->recv_event->data + offset; 3151 } 3152 3153 /* Send ACL data */ 3154 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags) 3155 { 3156 struct hci_acl_hdr *hdr; 3157 int len = skb->len; 3158 3159 skb_push(skb, HCI_ACL_HDR_SIZE); 3160 skb_reset_transport_header(skb); 3161 hdr = (struct hci_acl_hdr *)skb_transport_header(skb); 3162 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags)); 3163 hdr->dlen = cpu_to_le16(len); 3164 } 3165 3166 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue, 3167 struct sk_buff *skb, __u16 flags) 3168 { 3169 struct hci_conn *conn = chan->conn; 3170 struct hci_dev *hdev = conn->hdev; 3171 struct sk_buff *list; 3172 3173 skb->len = skb_headlen(skb); 3174 skb->data_len = 0; 3175 3176 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT; 3177 3178 switch (hdev->dev_type) { 3179 case HCI_PRIMARY: 3180 hci_add_acl_hdr(skb, conn->handle, flags); 3181 break; 3182 case HCI_AMP: 3183 hci_add_acl_hdr(skb, chan->handle, flags); 3184 break; 3185 default: 3186 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type); 3187 return; 3188 } 3189 3190 list = skb_shinfo(skb)->frag_list; 3191 if (!list) { 3192 /* Non fragmented */ 3193 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len); 3194 3195 skb_queue_tail(queue, skb); 3196 } else { 3197 /* Fragmented */ 3198 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 3199 3200 skb_shinfo(skb)->frag_list = NULL; 3201 3202 /* Queue all fragments atomically. We need to use spin_lock_bh 3203 * here because of 6LoWPAN links, as there this function is 3204 * called from softirq and using normal spin lock could cause 3205 * deadlocks. 3206 */ 3207 spin_lock_bh(&queue->lock); 3208 3209 __skb_queue_tail(queue, skb); 3210 3211 flags &= ~ACL_START; 3212 flags |= ACL_CONT; 3213 do { 3214 skb = list; list = list->next; 3215 3216 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT; 3217 hci_add_acl_hdr(skb, conn->handle, flags); 3218 3219 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 3220 3221 __skb_queue_tail(queue, skb); 3222 } while (list); 3223 3224 spin_unlock_bh(&queue->lock); 3225 } 3226 } 3227 3228 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags) 3229 { 3230 struct hci_dev *hdev = chan->conn->hdev; 3231 3232 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags); 3233 3234 hci_queue_acl(chan, &chan->data_q, skb, flags); 3235 3236 queue_work(hdev->workqueue, &hdev->tx_work); 3237 } 3238 3239 /* Send SCO data */ 3240 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb) 3241 { 3242 struct hci_dev *hdev = conn->hdev; 3243 struct hci_sco_hdr hdr; 3244 3245 BT_DBG("%s len %d", hdev->name, skb->len); 3246 3247 hdr.handle = cpu_to_le16(conn->handle); 3248 hdr.dlen = skb->len; 3249 3250 skb_push(skb, HCI_SCO_HDR_SIZE); 3251 skb_reset_transport_header(skb); 3252 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE); 3253 3254 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT; 3255 3256 skb_queue_tail(&conn->data_q, skb); 3257 queue_work(hdev->workqueue, &hdev->tx_work); 3258 } 3259 3260 /* Send ISO data */ 3261 static void hci_add_iso_hdr(struct sk_buff *skb, __u16 handle, __u8 flags) 3262 { 3263 struct hci_iso_hdr *hdr; 3264 int len = skb->len; 3265 3266 skb_push(skb, HCI_ISO_HDR_SIZE); 3267 skb_reset_transport_header(skb); 3268 hdr = (struct hci_iso_hdr *)skb_transport_header(skb); 3269 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags)); 3270 hdr->dlen = cpu_to_le16(len); 3271 } 3272 3273 static void hci_queue_iso(struct hci_conn *conn, struct sk_buff_head *queue, 3274 struct sk_buff *skb) 3275 { 3276 struct hci_dev *hdev = conn->hdev; 3277 struct sk_buff *list; 3278 __u16 flags; 3279 3280 skb->len = skb_headlen(skb); 3281 skb->data_len = 0; 3282 3283 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT; 3284 3285 list = skb_shinfo(skb)->frag_list; 3286 3287 flags = hci_iso_flags_pack(list ? ISO_START : ISO_SINGLE, 0x00); 3288 hci_add_iso_hdr(skb, conn->handle, flags); 3289 3290 if (!list) { 3291 /* Non fragmented */ 3292 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len); 3293 3294 skb_queue_tail(queue, skb); 3295 } else { 3296 /* Fragmented */ 3297 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 3298 3299 skb_shinfo(skb)->frag_list = NULL; 3300 3301 __skb_queue_tail(queue, skb); 3302 3303 do { 3304 skb = list; list = list->next; 3305 3306 hci_skb_pkt_type(skb) = HCI_ISODATA_PKT; 3307 flags = hci_iso_flags_pack(list ? ISO_CONT : ISO_END, 3308 0x00); 3309 hci_add_iso_hdr(skb, conn->handle, flags); 3310 3311 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len); 3312 3313 __skb_queue_tail(queue, skb); 3314 } while (list); 3315 } 3316 } 3317 3318 void hci_send_iso(struct hci_conn *conn, struct sk_buff *skb) 3319 { 3320 struct hci_dev *hdev = conn->hdev; 3321 3322 BT_DBG("%s len %d", hdev->name, skb->len); 3323 3324 hci_queue_iso(conn, &conn->data_q, skb); 3325 3326 queue_work(hdev->workqueue, &hdev->tx_work); 3327 } 3328 3329 /* ---- HCI TX task (outgoing data) ---- */ 3330 3331 /* HCI Connection scheduler */ 3332 static inline void hci_quote_sent(struct hci_conn *conn, int num, int *quote) 3333 { 3334 struct hci_dev *hdev; 3335 int cnt, q; 3336 3337 if (!conn) { 3338 *quote = 0; 3339 return; 3340 } 3341 3342 hdev = conn->hdev; 3343 3344 switch (conn->type) { 3345 case ACL_LINK: 3346 cnt = hdev->acl_cnt; 3347 break; 3348 case AMP_LINK: 3349 cnt = hdev->block_cnt; 3350 break; 3351 case SCO_LINK: 3352 case ESCO_LINK: 3353 cnt = hdev->sco_cnt; 3354 break; 3355 case LE_LINK: 3356 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt; 3357 break; 3358 case ISO_LINK: 3359 cnt = hdev->iso_mtu ? hdev->iso_cnt : 3360 hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt; 3361 break; 3362 default: 3363 cnt = 0; 3364 bt_dev_err(hdev, "unknown link type %d", conn->type); 3365 } 3366 3367 q = cnt / num; 3368 *quote = q ? q : 1; 3369 } 3370 3371 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type, 3372 int *quote) 3373 { 3374 struct hci_conn_hash *h = &hdev->conn_hash; 3375 struct hci_conn *conn = NULL, *c; 3376 unsigned int num = 0, min = ~0; 3377 3378 /* We don't have to lock device here. Connections are always 3379 * added and removed with TX task disabled. */ 3380 3381 rcu_read_lock(); 3382 3383 list_for_each_entry_rcu(c, &h->list, list) { 3384 if (c->type != type || skb_queue_empty(&c->data_q)) 3385 continue; 3386 3387 if (c->state != BT_CONNECTED && c->state != BT_CONFIG) 3388 continue; 3389 3390 num++; 3391 3392 if (c->sent < min) { 3393 min = c->sent; 3394 conn = c; 3395 } 3396 3397 if (hci_conn_num(hdev, type) == num) 3398 break; 3399 } 3400 3401 rcu_read_unlock(); 3402 3403 hci_quote_sent(conn, num, quote); 3404 3405 BT_DBG("conn %p quote %d", conn, *quote); 3406 return conn; 3407 } 3408 3409 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type) 3410 { 3411 struct hci_conn_hash *h = &hdev->conn_hash; 3412 struct hci_conn *c; 3413 3414 bt_dev_err(hdev, "link tx timeout"); 3415 3416 rcu_read_lock(); 3417 3418 /* Kill stalled connections */ 3419 list_for_each_entry_rcu(c, &h->list, list) { 3420 if (c->type == type && c->sent) { 3421 bt_dev_err(hdev, "killing stalled connection %pMR", 3422 &c->dst); 3423 /* hci_disconnect might sleep, so, we have to release 3424 * the RCU read lock before calling it. 3425 */ 3426 rcu_read_unlock(); 3427 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM); 3428 rcu_read_lock(); 3429 } 3430 } 3431 3432 rcu_read_unlock(); 3433 } 3434 3435 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type, 3436 int *quote) 3437 { 3438 struct hci_conn_hash *h = &hdev->conn_hash; 3439 struct hci_chan *chan = NULL; 3440 unsigned int num = 0, min = ~0, cur_prio = 0; 3441 struct hci_conn *conn; 3442 int conn_num = 0; 3443 3444 BT_DBG("%s", hdev->name); 3445 3446 rcu_read_lock(); 3447 3448 list_for_each_entry_rcu(conn, &h->list, list) { 3449 struct hci_chan *tmp; 3450 3451 if (conn->type != type) 3452 continue; 3453 3454 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG) 3455 continue; 3456 3457 conn_num++; 3458 3459 list_for_each_entry_rcu(tmp, &conn->chan_list, list) { 3460 struct sk_buff *skb; 3461 3462 if (skb_queue_empty(&tmp->data_q)) 3463 continue; 3464 3465 skb = skb_peek(&tmp->data_q); 3466 if (skb->priority < cur_prio) 3467 continue; 3468 3469 if (skb->priority > cur_prio) { 3470 num = 0; 3471 min = ~0; 3472 cur_prio = skb->priority; 3473 } 3474 3475 num++; 3476 3477 if (conn->sent < min) { 3478 min = conn->sent; 3479 chan = tmp; 3480 } 3481 } 3482 3483 if (hci_conn_num(hdev, type) == conn_num) 3484 break; 3485 } 3486 3487 rcu_read_unlock(); 3488 3489 if (!chan) 3490 return NULL; 3491 3492 hci_quote_sent(chan->conn, num, quote); 3493 3494 BT_DBG("chan %p quote %d", chan, *quote); 3495 return chan; 3496 } 3497 3498 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type) 3499 { 3500 struct hci_conn_hash *h = &hdev->conn_hash; 3501 struct hci_conn *conn; 3502 int num = 0; 3503 3504 BT_DBG("%s", hdev->name); 3505 3506 rcu_read_lock(); 3507 3508 list_for_each_entry_rcu(conn, &h->list, list) { 3509 struct hci_chan *chan; 3510 3511 if (conn->type != type) 3512 continue; 3513 3514 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG) 3515 continue; 3516 3517 num++; 3518 3519 list_for_each_entry_rcu(chan, &conn->chan_list, list) { 3520 struct sk_buff *skb; 3521 3522 if (chan->sent) { 3523 chan->sent = 0; 3524 continue; 3525 } 3526 3527 if (skb_queue_empty(&chan->data_q)) 3528 continue; 3529 3530 skb = skb_peek(&chan->data_q); 3531 if (skb->priority >= HCI_PRIO_MAX - 1) 3532 continue; 3533 3534 skb->priority = HCI_PRIO_MAX - 1; 3535 3536 BT_DBG("chan %p skb %p promoted to %d", chan, skb, 3537 skb->priority); 3538 } 3539 3540 if (hci_conn_num(hdev, type) == num) 3541 break; 3542 } 3543 3544 rcu_read_unlock(); 3545 3546 } 3547 3548 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb) 3549 { 3550 /* Calculate count of blocks used by this packet */ 3551 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len); 3552 } 3553 3554 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type) 3555 { 3556 unsigned long last_tx; 3557 3558 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 3559 return; 3560 3561 switch (type) { 3562 case LE_LINK: 3563 last_tx = hdev->le_last_tx; 3564 break; 3565 default: 3566 last_tx = hdev->acl_last_tx; 3567 break; 3568 } 3569 3570 /* tx timeout must be longer than maximum link supervision timeout 3571 * (40.9 seconds) 3572 */ 3573 if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT)) 3574 hci_link_tx_to(hdev, type); 3575 } 3576 3577 /* Schedule SCO */ 3578 static void hci_sched_sco(struct hci_dev *hdev) 3579 { 3580 struct hci_conn *conn; 3581 struct sk_buff *skb; 3582 int quote; 3583 3584 BT_DBG("%s", hdev->name); 3585 3586 if (!hci_conn_num(hdev, SCO_LINK)) 3587 return; 3588 3589 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) { 3590 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 3591 BT_DBG("skb %p len %d", skb, skb->len); 3592 hci_send_frame(hdev, skb); 3593 3594 conn->sent++; 3595 if (conn->sent == ~0) 3596 conn->sent = 0; 3597 } 3598 } 3599 } 3600 3601 static void hci_sched_esco(struct hci_dev *hdev) 3602 { 3603 struct hci_conn *conn; 3604 struct sk_buff *skb; 3605 int quote; 3606 3607 BT_DBG("%s", hdev->name); 3608 3609 if (!hci_conn_num(hdev, ESCO_LINK)) 3610 return; 3611 3612 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK, 3613 "e))) { 3614 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 3615 BT_DBG("skb %p len %d", skb, skb->len); 3616 hci_send_frame(hdev, skb); 3617 3618 conn->sent++; 3619 if (conn->sent == ~0) 3620 conn->sent = 0; 3621 } 3622 } 3623 } 3624 3625 static void hci_sched_acl_pkt(struct hci_dev *hdev) 3626 { 3627 unsigned int cnt = hdev->acl_cnt; 3628 struct hci_chan *chan; 3629 struct sk_buff *skb; 3630 int quote; 3631 3632 __check_timeout(hdev, cnt, ACL_LINK); 3633 3634 while (hdev->acl_cnt && 3635 (chan = hci_chan_sent(hdev, ACL_LINK, "e))) { 3636 u32 priority = (skb_peek(&chan->data_q))->priority; 3637 while (quote-- && (skb = skb_peek(&chan->data_q))) { 3638 BT_DBG("chan %p skb %p len %d priority %u", chan, skb, 3639 skb->len, skb->priority); 3640 3641 /* Stop if priority has changed */ 3642 if (skb->priority < priority) 3643 break; 3644 3645 skb = skb_dequeue(&chan->data_q); 3646 3647 hci_conn_enter_active_mode(chan->conn, 3648 bt_cb(skb)->force_active); 3649 3650 hci_send_frame(hdev, skb); 3651 hdev->acl_last_tx = jiffies; 3652 3653 hdev->acl_cnt--; 3654 chan->sent++; 3655 chan->conn->sent++; 3656 3657 /* Send pending SCO packets right away */ 3658 hci_sched_sco(hdev); 3659 hci_sched_esco(hdev); 3660 } 3661 } 3662 3663 if (cnt != hdev->acl_cnt) 3664 hci_prio_recalculate(hdev, ACL_LINK); 3665 } 3666 3667 static void hci_sched_acl_blk(struct hci_dev *hdev) 3668 { 3669 unsigned int cnt = hdev->block_cnt; 3670 struct hci_chan *chan; 3671 struct sk_buff *skb; 3672 int quote; 3673 u8 type; 3674 3675 BT_DBG("%s", hdev->name); 3676 3677 if (hdev->dev_type == HCI_AMP) 3678 type = AMP_LINK; 3679 else 3680 type = ACL_LINK; 3681 3682 __check_timeout(hdev, cnt, type); 3683 3684 while (hdev->block_cnt > 0 && 3685 (chan = hci_chan_sent(hdev, type, "e))) { 3686 u32 priority = (skb_peek(&chan->data_q))->priority; 3687 while (quote > 0 && (skb = skb_peek(&chan->data_q))) { 3688 int blocks; 3689 3690 BT_DBG("chan %p skb %p len %d priority %u", chan, skb, 3691 skb->len, skb->priority); 3692 3693 /* Stop if priority has changed */ 3694 if (skb->priority < priority) 3695 break; 3696 3697 skb = skb_dequeue(&chan->data_q); 3698 3699 blocks = __get_blocks(hdev, skb); 3700 if (blocks > hdev->block_cnt) 3701 return; 3702 3703 hci_conn_enter_active_mode(chan->conn, 3704 bt_cb(skb)->force_active); 3705 3706 hci_send_frame(hdev, skb); 3707 hdev->acl_last_tx = jiffies; 3708 3709 hdev->block_cnt -= blocks; 3710 quote -= blocks; 3711 3712 chan->sent += blocks; 3713 chan->conn->sent += blocks; 3714 } 3715 } 3716 3717 if (cnt != hdev->block_cnt) 3718 hci_prio_recalculate(hdev, type); 3719 } 3720 3721 static void hci_sched_acl(struct hci_dev *hdev) 3722 { 3723 BT_DBG("%s", hdev->name); 3724 3725 /* No ACL link over BR/EDR controller */ 3726 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY) 3727 return; 3728 3729 /* No AMP link over AMP controller */ 3730 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP) 3731 return; 3732 3733 switch (hdev->flow_ctl_mode) { 3734 case HCI_FLOW_CTL_MODE_PACKET_BASED: 3735 hci_sched_acl_pkt(hdev); 3736 break; 3737 3738 case HCI_FLOW_CTL_MODE_BLOCK_BASED: 3739 hci_sched_acl_blk(hdev); 3740 break; 3741 } 3742 } 3743 3744 static void hci_sched_le(struct hci_dev *hdev) 3745 { 3746 struct hci_chan *chan; 3747 struct sk_buff *skb; 3748 int quote, cnt, tmp; 3749 3750 BT_DBG("%s", hdev->name); 3751 3752 if (!hci_conn_num(hdev, LE_LINK)) 3753 return; 3754 3755 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt; 3756 3757 __check_timeout(hdev, cnt, LE_LINK); 3758 3759 tmp = cnt; 3760 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, "e))) { 3761 u32 priority = (skb_peek(&chan->data_q))->priority; 3762 while (quote-- && (skb = skb_peek(&chan->data_q))) { 3763 BT_DBG("chan %p skb %p len %d priority %u", chan, skb, 3764 skb->len, skb->priority); 3765 3766 /* Stop if priority has changed */ 3767 if (skb->priority < priority) 3768 break; 3769 3770 skb = skb_dequeue(&chan->data_q); 3771 3772 hci_send_frame(hdev, skb); 3773 hdev->le_last_tx = jiffies; 3774 3775 cnt--; 3776 chan->sent++; 3777 chan->conn->sent++; 3778 3779 /* Send pending SCO packets right away */ 3780 hci_sched_sco(hdev); 3781 hci_sched_esco(hdev); 3782 } 3783 } 3784 3785 if (hdev->le_pkts) 3786 hdev->le_cnt = cnt; 3787 else 3788 hdev->acl_cnt = cnt; 3789 3790 if (cnt != tmp) 3791 hci_prio_recalculate(hdev, LE_LINK); 3792 } 3793 3794 /* Schedule CIS */ 3795 static void hci_sched_iso(struct hci_dev *hdev) 3796 { 3797 struct hci_conn *conn; 3798 struct sk_buff *skb; 3799 int quote, *cnt; 3800 3801 BT_DBG("%s", hdev->name); 3802 3803 if (!hci_conn_num(hdev, ISO_LINK)) 3804 return; 3805 3806 cnt = hdev->iso_pkts ? &hdev->iso_cnt : 3807 hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt; 3808 while (*cnt && (conn = hci_low_sent(hdev, ISO_LINK, "e))) { 3809 while (quote-- && (skb = skb_dequeue(&conn->data_q))) { 3810 BT_DBG("skb %p len %d", skb, skb->len); 3811 hci_send_frame(hdev, skb); 3812 3813 conn->sent++; 3814 if (conn->sent == ~0) 3815 conn->sent = 0; 3816 (*cnt)--; 3817 } 3818 } 3819 } 3820 3821 static void hci_tx_work(struct work_struct *work) 3822 { 3823 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work); 3824 struct sk_buff *skb; 3825 3826 BT_DBG("%s acl %d sco %d le %d iso %d", hdev->name, hdev->acl_cnt, 3827 hdev->sco_cnt, hdev->le_cnt, hdev->iso_cnt); 3828 3829 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 3830 /* Schedule queues and send stuff to HCI driver */ 3831 hci_sched_sco(hdev); 3832 hci_sched_esco(hdev); 3833 hci_sched_iso(hdev); 3834 hci_sched_acl(hdev); 3835 hci_sched_le(hdev); 3836 } 3837 3838 /* Send next queued raw (unknown type) packet */ 3839 while ((skb = skb_dequeue(&hdev->raw_q))) 3840 hci_send_frame(hdev, skb); 3841 } 3842 3843 /* ----- HCI RX task (incoming data processing) ----- */ 3844 3845 /* ACL data packet */ 3846 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb) 3847 { 3848 struct hci_acl_hdr *hdr = (void *) skb->data; 3849 struct hci_conn *conn; 3850 __u16 handle, flags; 3851 3852 skb_pull(skb, HCI_ACL_HDR_SIZE); 3853 3854 handle = __le16_to_cpu(hdr->handle); 3855 flags = hci_flags(handle); 3856 handle = hci_handle(handle); 3857 3858 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len, 3859 handle, flags); 3860 3861 hdev->stat.acl_rx++; 3862 3863 hci_dev_lock(hdev); 3864 conn = hci_conn_hash_lookup_handle(hdev, handle); 3865 hci_dev_unlock(hdev); 3866 3867 if (conn) { 3868 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF); 3869 3870 /* Send to upper protocol */ 3871 l2cap_recv_acldata(conn, skb, flags); 3872 return; 3873 } else { 3874 bt_dev_err(hdev, "ACL packet for unknown connection handle %d", 3875 handle); 3876 } 3877 3878 kfree_skb(skb); 3879 } 3880 3881 /* SCO data packet */ 3882 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb) 3883 { 3884 struct hci_sco_hdr *hdr = (void *) skb->data; 3885 struct hci_conn *conn; 3886 __u16 handle, flags; 3887 3888 skb_pull(skb, HCI_SCO_HDR_SIZE); 3889 3890 handle = __le16_to_cpu(hdr->handle); 3891 flags = hci_flags(handle); 3892 handle = hci_handle(handle); 3893 3894 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len, 3895 handle, flags); 3896 3897 hdev->stat.sco_rx++; 3898 3899 hci_dev_lock(hdev); 3900 conn = hci_conn_hash_lookup_handle(hdev, handle); 3901 hci_dev_unlock(hdev); 3902 3903 if (conn) { 3904 /* Send to upper protocol */ 3905 hci_skb_pkt_status(skb) = flags & 0x03; 3906 sco_recv_scodata(conn, skb); 3907 return; 3908 } else { 3909 bt_dev_err_ratelimited(hdev, "SCO packet for unknown connection handle %d", 3910 handle); 3911 } 3912 3913 kfree_skb(skb); 3914 } 3915 3916 static void hci_isodata_packet(struct hci_dev *hdev, struct sk_buff *skb) 3917 { 3918 struct hci_iso_hdr *hdr; 3919 struct hci_conn *conn; 3920 __u16 handle, flags; 3921 3922 hdr = skb_pull_data(skb, sizeof(*hdr)); 3923 if (!hdr) { 3924 bt_dev_err(hdev, "ISO packet too small"); 3925 goto drop; 3926 } 3927 3928 handle = __le16_to_cpu(hdr->handle); 3929 flags = hci_flags(handle); 3930 handle = hci_handle(handle); 3931 3932 bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len, 3933 handle, flags); 3934 3935 hci_dev_lock(hdev); 3936 conn = hci_conn_hash_lookup_handle(hdev, handle); 3937 hci_dev_unlock(hdev); 3938 3939 if (!conn) { 3940 bt_dev_err(hdev, "ISO packet for unknown connection handle %d", 3941 handle); 3942 goto drop; 3943 } 3944 3945 /* Send to upper protocol */ 3946 iso_recv(conn, skb, flags); 3947 return; 3948 3949 drop: 3950 kfree_skb(skb); 3951 } 3952 3953 static bool hci_req_is_complete(struct hci_dev *hdev) 3954 { 3955 struct sk_buff *skb; 3956 3957 skb = skb_peek(&hdev->cmd_q); 3958 if (!skb) 3959 return true; 3960 3961 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START); 3962 } 3963 3964 static void hci_resend_last(struct hci_dev *hdev) 3965 { 3966 struct hci_command_hdr *sent; 3967 struct sk_buff *skb; 3968 u16 opcode; 3969 3970 if (!hdev->sent_cmd) 3971 return; 3972 3973 sent = (void *) hdev->sent_cmd->data; 3974 opcode = __le16_to_cpu(sent->opcode); 3975 if (opcode == HCI_OP_RESET) 3976 return; 3977 3978 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL); 3979 if (!skb) 3980 return; 3981 3982 skb_queue_head(&hdev->cmd_q, skb); 3983 queue_work(hdev->workqueue, &hdev->cmd_work); 3984 } 3985 3986 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status, 3987 hci_req_complete_t *req_complete, 3988 hci_req_complete_skb_t *req_complete_skb) 3989 { 3990 struct sk_buff *skb; 3991 unsigned long flags; 3992 3993 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status); 3994 3995 /* If the completed command doesn't match the last one that was 3996 * sent we need to do special handling of it. 3997 */ 3998 if (!hci_sent_cmd_data(hdev, opcode)) { 3999 /* Some CSR based controllers generate a spontaneous 4000 * reset complete event during init and any pending 4001 * command will never be completed. In such a case we 4002 * need to resend whatever was the last sent 4003 * command. 4004 */ 4005 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET) 4006 hci_resend_last(hdev); 4007 4008 return; 4009 } 4010 4011 /* If we reach this point this event matches the last command sent */ 4012 hci_dev_clear_flag(hdev, HCI_CMD_PENDING); 4013 4014 /* If the command succeeded and there's still more commands in 4015 * this request the request is not yet complete. 4016 */ 4017 if (!status && !hci_req_is_complete(hdev)) 4018 return; 4019 4020 /* If this was the last command in a request the complete 4021 * callback would be found in hdev->sent_cmd instead of the 4022 * command queue (hdev->cmd_q). 4023 */ 4024 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) { 4025 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb; 4026 return; 4027 } 4028 4029 if (bt_cb(hdev->sent_cmd)->hci.req_complete) { 4030 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete; 4031 return; 4032 } 4033 4034 /* Remove all pending commands belonging to this request */ 4035 spin_lock_irqsave(&hdev->cmd_q.lock, flags); 4036 while ((skb = __skb_dequeue(&hdev->cmd_q))) { 4037 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) { 4038 __skb_queue_head(&hdev->cmd_q, skb); 4039 break; 4040 } 4041 4042 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB) 4043 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb; 4044 else 4045 *req_complete = bt_cb(skb)->hci.req_complete; 4046 dev_kfree_skb_irq(skb); 4047 } 4048 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); 4049 } 4050 4051 static void hci_rx_work(struct work_struct *work) 4052 { 4053 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work); 4054 struct sk_buff *skb; 4055 4056 BT_DBG("%s", hdev->name); 4057 4058 /* The kcov_remote functions used for collecting packet parsing 4059 * coverage information from this background thread and associate 4060 * the coverage with the syscall's thread which originally injected 4061 * the packet. This helps fuzzing the kernel. 4062 */ 4063 for (; (skb = skb_dequeue(&hdev->rx_q)); kcov_remote_stop()) { 4064 kcov_remote_start_common(skb_get_kcov_handle(skb)); 4065 4066 /* Send copy to monitor */ 4067 hci_send_to_monitor(hdev, skb); 4068 4069 if (atomic_read(&hdev->promisc)) { 4070 /* Send copy to the sockets */ 4071 hci_send_to_sock(hdev, skb); 4072 } 4073 4074 /* If the device has been opened in HCI_USER_CHANNEL, 4075 * the userspace has exclusive access to device. 4076 * When device is HCI_INIT, we still need to process 4077 * the data packets to the driver in order 4078 * to complete its setup(). 4079 */ 4080 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 4081 !test_bit(HCI_INIT, &hdev->flags)) { 4082 kfree_skb(skb); 4083 continue; 4084 } 4085 4086 if (test_bit(HCI_INIT, &hdev->flags)) { 4087 /* Don't process data packets in this states. */ 4088 switch (hci_skb_pkt_type(skb)) { 4089 case HCI_ACLDATA_PKT: 4090 case HCI_SCODATA_PKT: 4091 case HCI_ISODATA_PKT: 4092 kfree_skb(skb); 4093 continue; 4094 } 4095 } 4096 4097 /* Process frame */ 4098 switch (hci_skb_pkt_type(skb)) { 4099 case HCI_EVENT_PKT: 4100 BT_DBG("%s Event packet", hdev->name); 4101 hci_event_packet(hdev, skb); 4102 break; 4103 4104 case HCI_ACLDATA_PKT: 4105 BT_DBG("%s ACL data packet", hdev->name); 4106 hci_acldata_packet(hdev, skb); 4107 break; 4108 4109 case HCI_SCODATA_PKT: 4110 BT_DBG("%s SCO data packet", hdev->name); 4111 hci_scodata_packet(hdev, skb); 4112 break; 4113 4114 case HCI_ISODATA_PKT: 4115 BT_DBG("%s ISO data packet", hdev->name); 4116 hci_isodata_packet(hdev, skb); 4117 break; 4118 4119 default: 4120 kfree_skb(skb); 4121 break; 4122 } 4123 } 4124 } 4125 4126 static void hci_cmd_work(struct work_struct *work) 4127 { 4128 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work); 4129 struct sk_buff *skb; 4130 4131 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name, 4132 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q)); 4133 4134 /* Send queued commands */ 4135 if (atomic_read(&hdev->cmd_cnt)) { 4136 skb = skb_dequeue(&hdev->cmd_q); 4137 if (!skb) 4138 return; 4139 4140 kfree_skb(hdev->sent_cmd); 4141 4142 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL); 4143 if (hdev->sent_cmd) { 4144 int res; 4145 if (hci_req_status_pend(hdev)) 4146 hci_dev_set_flag(hdev, HCI_CMD_PENDING); 4147 atomic_dec(&hdev->cmd_cnt); 4148 4149 res = hci_send_frame(hdev, skb); 4150 if (res < 0) 4151 __hci_cmd_sync_cancel(hdev, -res); 4152 4153 rcu_read_lock(); 4154 if (test_bit(HCI_RESET, &hdev->flags) || 4155 hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE)) 4156 cancel_delayed_work(&hdev->cmd_timer); 4157 else 4158 queue_delayed_work(hdev->workqueue, &hdev->cmd_timer, 4159 HCI_CMD_TIMEOUT); 4160 rcu_read_unlock(); 4161 } else { 4162 skb_queue_head(&hdev->cmd_q, skb); 4163 queue_work(hdev->workqueue, &hdev->cmd_work); 4164 } 4165 } 4166 } 4167