1 /*
2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2011 ProFUSION Embedded Systems
5
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
11
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
24 */
25
26 /* Bluetooth HCI core. */
27
28 #include <linux/export.h>
29 #include <linux/rfkill.h>
30 #include <linux/debugfs.h>
31 #include <linux/crypto.h>
32 #include <linux/property.h>
33 #include <linux/suspend.h>
34 #include <linux/wait.h>
35 #include <asm/unaligned.h>
36
37 #include <net/bluetooth/bluetooth.h>
38 #include <net/bluetooth/hci_core.h>
39 #include <net/bluetooth/l2cap.h>
40 #include <net/bluetooth/mgmt.h>
41
42 #include "hci_request.h"
43 #include "hci_debugfs.h"
44 #include "smp.h"
45 #include "leds.h"
46 #include "msft.h"
47
48 static void hci_rx_work(struct work_struct *work);
49 static void hci_cmd_work(struct work_struct *work);
50 static void hci_tx_work(struct work_struct *work);
51
52 /* HCI device list */
53 LIST_HEAD(hci_dev_list);
54 DEFINE_RWLOCK(hci_dev_list_lock);
55
56 /* HCI callback list */
57 LIST_HEAD(hci_cb_list);
58 DEFINE_MUTEX(hci_cb_list_lock);
59
60 /* HCI ID Numbering */
61 static DEFINE_IDA(hci_index_ida);
62
63 /* ---- HCI debugfs entries ---- */
64
dut_mode_read(struct file * file,char __user * user_buf,size_t count,loff_t * ppos)65 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
66 size_t count, loff_t *ppos)
67 {
68 struct hci_dev *hdev = file->private_data;
69 char buf[3];
70
71 buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
72 buf[1] = '\n';
73 buf[2] = '\0';
74 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
75 }
76
dut_mode_write(struct file * file,const char __user * user_buf,size_t count,loff_t * ppos)77 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
78 size_t count, loff_t *ppos)
79 {
80 struct hci_dev *hdev = file->private_data;
81 struct sk_buff *skb;
82 bool enable;
83 int err;
84
85 if (!test_bit(HCI_UP, &hdev->flags))
86 return -ENETDOWN;
87
88 err = kstrtobool_from_user(user_buf, count, &enable);
89 if (err)
90 return err;
91
92 if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
93 return -EALREADY;
94
95 hci_req_sync_lock(hdev);
96 if (enable)
97 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
98 HCI_CMD_TIMEOUT);
99 else
100 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
101 HCI_CMD_TIMEOUT);
102 hci_req_sync_unlock(hdev);
103
104 if (IS_ERR(skb))
105 return PTR_ERR(skb);
106
107 kfree_skb(skb);
108
109 hci_dev_change_flag(hdev, HCI_DUT_MODE);
110
111 return count;
112 }
113
114 static const struct file_operations dut_mode_fops = {
115 .open = simple_open,
116 .read = dut_mode_read,
117 .write = dut_mode_write,
118 .llseek = default_llseek,
119 };
120
vendor_diag_read(struct file * file,char __user * user_buf,size_t count,loff_t * ppos)121 static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
122 size_t count, loff_t *ppos)
123 {
124 struct hci_dev *hdev = file->private_data;
125 char buf[3];
126
127 buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
128 buf[1] = '\n';
129 buf[2] = '\0';
130 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
131 }
132
vendor_diag_write(struct file * file,const char __user * user_buf,size_t count,loff_t * ppos)133 static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
134 size_t count, loff_t *ppos)
135 {
136 struct hci_dev *hdev = file->private_data;
137 bool enable;
138 int err;
139
140 err = kstrtobool_from_user(user_buf, count, &enable);
141 if (err)
142 return err;
143
144 /* When the diagnostic flags are not persistent and the transport
145 * is not active or in user channel operation, then there is no need
146 * for the vendor callback. Instead just store the desired value and
147 * the setting will be programmed when the controller gets powered on.
148 */
149 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
150 (!test_bit(HCI_RUNNING, &hdev->flags) ||
151 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)))
152 goto done;
153
154 hci_req_sync_lock(hdev);
155 err = hdev->set_diag(hdev, enable);
156 hci_req_sync_unlock(hdev);
157
158 if (err < 0)
159 return err;
160
161 done:
162 if (enable)
163 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
164 else
165 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
166
167 return count;
168 }
169
170 static const struct file_operations vendor_diag_fops = {
171 .open = simple_open,
172 .read = vendor_diag_read,
173 .write = vendor_diag_write,
174 .llseek = default_llseek,
175 };
176
hci_debugfs_create_basic(struct hci_dev * hdev)177 static void hci_debugfs_create_basic(struct hci_dev *hdev)
178 {
179 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
180 &dut_mode_fops);
181
182 if (hdev->set_diag)
183 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
184 &vendor_diag_fops);
185 }
186
hci_reset_req(struct hci_request * req,unsigned long opt)187 static int hci_reset_req(struct hci_request *req, unsigned long opt)
188 {
189 BT_DBG("%s %ld", req->hdev->name, opt);
190
191 /* Reset device */
192 set_bit(HCI_RESET, &req->hdev->flags);
193 hci_req_add(req, HCI_OP_RESET, 0, NULL);
194 return 0;
195 }
196
bredr_init(struct hci_request * req)197 static void bredr_init(struct hci_request *req)
198 {
199 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
200
201 /* Read Local Supported Features */
202 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
203
204 /* Read Local Version */
205 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
206
207 /* Read BD Address */
208 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
209 }
210
amp_init1(struct hci_request * req)211 static void amp_init1(struct hci_request *req)
212 {
213 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
214
215 /* Read Local Version */
216 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
217
218 /* Read Local Supported Commands */
219 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
220
221 /* Read Local AMP Info */
222 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
223
224 /* Read Data Blk size */
225 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
226
227 /* Read Flow Control Mode */
228 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
229
230 /* Read Location Data */
231 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
232 }
233
amp_init2(struct hci_request * req)234 static int amp_init2(struct hci_request *req)
235 {
236 /* Read Local Supported Features. Not all AMP controllers
237 * support this so it's placed conditionally in the second
238 * stage init.
239 */
240 if (req->hdev->commands[14] & 0x20)
241 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
242
243 return 0;
244 }
245
hci_init1_req(struct hci_request * req,unsigned long opt)246 static int hci_init1_req(struct hci_request *req, unsigned long opt)
247 {
248 struct hci_dev *hdev = req->hdev;
249
250 BT_DBG("%s %ld", hdev->name, opt);
251
252 /* Reset */
253 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
254 hci_reset_req(req, 0);
255
256 switch (hdev->dev_type) {
257 case HCI_PRIMARY:
258 bredr_init(req);
259 break;
260 case HCI_AMP:
261 amp_init1(req);
262 break;
263 default:
264 bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
265 break;
266 }
267
268 return 0;
269 }
270
bredr_setup(struct hci_request * req)271 static void bredr_setup(struct hci_request *req)
272 {
273 __le16 param;
274 __u8 flt_type;
275
276 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
277 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
278
279 /* Read Class of Device */
280 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
281
282 /* Read Local Name */
283 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
284
285 /* Read Voice Setting */
286 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
287
288 /* Read Number of Supported IAC */
289 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
290
291 /* Read Current IAC LAP */
292 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
293
294 /* Clear Event Filters */
295 flt_type = HCI_FLT_CLEAR_ALL;
296 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
297
298 /* Connection accept timeout ~20 secs */
299 param = cpu_to_le16(0x7d00);
300 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, ¶m);
301 }
302
le_setup(struct hci_request * req)303 static void le_setup(struct hci_request *req)
304 {
305 struct hci_dev *hdev = req->hdev;
306
307 /* Read LE Buffer Size */
308 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
309
310 /* Read LE Local Supported Features */
311 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
312
313 /* Read LE Supported States */
314 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
315
316 /* LE-only controllers have LE implicitly enabled */
317 if (!lmp_bredr_capable(hdev))
318 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
319 }
320
hci_setup_event_mask(struct hci_request * req)321 static void hci_setup_event_mask(struct hci_request *req)
322 {
323 struct hci_dev *hdev = req->hdev;
324
325 /* The second byte is 0xff instead of 0x9f (two reserved bits
326 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
327 * command otherwise.
328 */
329 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
330
331 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
332 * any event mask for pre 1.2 devices.
333 */
334 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
335 return;
336
337 if (lmp_bredr_capable(hdev)) {
338 events[4] |= 0x01; /* Flow Specification Complete */
339 } else {
340 /* Use a different default for LE-only devices */
341 memset(events, 0, sizeof(events));
342 events[1] |= 0x20; /* Command Complete */
343 events[1] |= 0x40; /* Command Status */
344 events[1] |= 0x80; /* Hardware Error */
345
346 /* If the controller supports the Disconnect command, enable
347 * the corresponding event. In addition enable packet flow
348 * control related events.
349 */
350 if (hdev->commands[0] & 0x20) {
351 events[0] |= 0x10; /* Disconnection Complete */
352 events[2] |= 0x04; /* Number of Completed Packets */
353 events[3] |= 0x02; /* Data Buffer Overflow */
354 }
355
356 /* If the controller supports the Read Remote Version
357 * Information command, enable the corresponding event.
358 */
359 if (hdev->commands[2] & 0x80)
360 events[1] |= 0x08; /* Read Remote Version Information
361 * Complete
362 */
363
364 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
365 events[0] |= 0x80; /* Encryption Change */
366 events[5] |= 0x80; /* Encryption Key Refresh Complete */
367 }
368 }
369
370 if (lmp_inq_rssi_capable(hdev) ||
371 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
372 events[4] |= 0x02; /* Inquiry Result with RSSI */
373
374 if (lmp_ext_feat_capable(hdev))
375 events[4] |= 0x04; /* Read Remote Extended Features Complete */
376
377 if (lmp_esco_capable(hdev)) {
378 events[5] |= 0x08; /* Synchronous Connection Complete */
379 events[5] |= 0x10; /* Synchronous Connection Changed */
380 }
381
382 if (lmp_sniffsubr_capable(hdev))
383 events[5] |= 0x20; /* Sniff Subrating */
384
385 if (lmp_pause_enc_capable(hdev))
386 events[5] |= 0x80; /* Encryption Key Refresh Complete */
387
388 if (lmp_ext_inq_capable(hdev))
389 events[5] |= 0x40; /* Extended Inquiry Result */
390
391 if (lmp_no_flush_capable(hdev))
392 events[7] |= 0x01; /* Enhanced Flush Complete */
393
394 if (lmp_lsto_capable(hdev))
395 events[6] |= 0x80; /* Link Supervision Timeout Changed */
396
397 if (lmp_ssp_capable(hdev)) {
398 events[6] |= 0x01; /* IO Capability Request */
399 events[6] |= 0x02; /* IO Capability Response */
400 events[6] |= 0x04; /* User Confirmation Request */
401 events[6] |= 0x08; /* User Passkey Request */
402 events[6] |= 0x10; /* Remote OOB Data Request */
403 events[6] |= 0x20; /* Simple Pairing Complete */
404 events[7] |= 0x04; /* User Passkey Notification */
405 events[7] |= 0x08; /* Keypress Notification */
406 events[7] |= 0x10; /* Remote Host Supported
407 * Features Notification
408 */
409 }
410
411 if (lmp_le_capable(hdev))
412 events[7] |= 0x20; /* LE Meta-Event */
413
414 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
415 }
416
hci_init2_req(struct hci_request * req,unsigned long opt)417 static int hci_init2_req(struct hci_request *req, unsigned long opt)
418 {
419 struct hci_dev *hdev = req->hdev;
420
421 if (hdev->dev_type == HCI_AMP)
422 return amp_init2(req);
423
424 if (lmp_bredr_capable(hdev))
425 bredr_setup(req);
426 else
427 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
428
429 if (lmp_le_capable(hdev))
430 le_setup(req);
431
432 /* All Bluetooth 1.2 and later controllers should support the
433 * HCI command for reading the local supported commands.
434 *
435 * Unfortunately some controllers indicate Bluetooth 1.2 support,
436 * but do not have support for this command. If that is the case,
437 * the driver can quirk the behavior and skip reading the local
438 * supported commands.
439 */
440 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
441 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
442 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
443
444 if (lmp_ssp_capable(hdev)) {
445 /* When SSP is available, then the host features page
446 * should also be available as well. However some
447 * controllers list the max_page as 0 as long as SSP
448 * has not been enabled. To achieve proper debugging
449 * output, force the minimum max_page to 1 at least.
450 */
451 hdev->max_page = 0x01;
452
453 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
454 u8 mode = 0x01;
455
456 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
457 sizeof(mode), &mode);
458 } else {
459 struct hci_cp_write_eir cp;
460
461 memset(hdev->eir, 0, sizeof(hdev->eir));
462 memset(&cp, 0, sizeof(cp));
463
464 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
465 }
466 }
467
468 if (lmp_inq_rssi_capable(hdev) ||
469 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
470 u8 mode;
471
472 /* If Extended Inquiry Result events are supported, then
473 * they are clearly preferred over Inquiry Result with RSSI
474 * events.
475 */
476 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
477
478 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
479 }
480
481 if (lmp_inq_tx_pwr_capable(hdev))
482 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
483
484 if (lmp_ext_feat_capable(hdev)) {
485 struct hci_cp_read_local_ext_features cp;
486
487 cp.page = 0x01;
488 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
489 sizeof(cp), &cp);
490 }
491
492 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
493 u8 enable = 1;
494 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
495 &enable);
496 }
497
498 return 0;
499 }
500
hci_setup_link_policy(struct hci_request * req)501 static void hci_setup_link_policy(struct hci_request *req)
502 {
503 struct hci_dev *hdev = req->hdev;
504 struct hci_cp_write_def_link_policy cp;
505 u16 link_policy = 0;
506
507 if (lmp_rswitch_capable(hdev))
508 link_policy |= HCI_LP_RSWITCH;
509 if (lmp_hold_capable(hdev))
510 link_policy |= HCI_LP_HOLD;
511 if (lmp_sniff_capable(hdev))
512 link_policy |= HCI_LP_SNIFF;
513 if (lmp_park_capable(hdev))
514 link_policy |= HCI_LP_PARK;
515
516 cp.policy = cpu_to_le16(link_policy);
517 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
518 }
519
hci_set_le_support(struct hci_request * req)520 static void hci_set_le_support(struct hci_request *req)
521 {
522 struct hci_dev *hdev = req->hdev;
523 struct hci_cp_write_le_host_supported cp;
524
525 /* LE-only devices do not support explicit enablement */
526 if (!lmp_bredr_capable(hdev))
527 return;
528
529 memset(&cp, 0, sizeof(cp));
530
531 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
532 cp.le = 0x01;
533 cp.simul = 0x00;
534 }
535
536 if (cp.le != lmp_host_le_capable(hdev))
537 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
538 &cp);
539 }
540
hci_set_event_mask_page_2(struct hci_request * req)541 static void hci_set_event_mask_page_2(struct hci_request *req)
542 {
543 struct hci_dev *hdev = req->hdev;
544 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
545 bool changed = false;
546
547 /* If Connectionless Slave Broadcast master role is supported
548 * enable all necessary events for it.
549 */
550 if (lmp_csb_master_capable(hdev)) {
551 events[1] |= 0x40; /* Triggered Clock Capture */
552 events[1] |= 0x80; /* Synchronization Train Complete */
553 events[2] |= 0x10; /* Slave Page Response Timeout */
554 events[2] |= 0x20; /* CSB Channel Map Change */
555 changed = true;
556 }
557
558 /* If Connectionless Slave Broadcast slave role is supported
559 * enable all necessary events for it.
560 */
561 if (lmp_csb_slave_capable(hdev)) {
562 events[2] |= 0x01; /* Synchronization Train Received */
563 events[2] |= 0x02; /* CSB Receive */
564 events[2] |= 0x04; /* CSB Timeout */
565 events[2] |= 0x08; /* Truncated Page Complete */
566 changed = true;
567 }
568
569 /* Enable Authenticated Payload Timeout Expired event if supported */
570 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
571 events[2] |= 0x80;
572 changed = true;
573 }
574
575 /* Some Broadcom based controllers indicate support for Set Event
576 * Mask Page 2 command, but then actually do not support it. Since
577 * the default value is all bits set to zero, the command is only
578 * required if the event mask has to be changed. In case no change
579 * to the event mask is needed, skip this command.
580 */
581 if (changed)
582 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
583 sizeof(events), events);
584 }
585
hci_init3_req(struct hci_request * req,unsigned long opt)586 static int hci_init3_req(struct hci_request *req, unsigned long opt)
587 {
588 struct hci_dev *hdev = req->hdev;
589 u8 p;
590
591 hci_setup_event_mask(req);
592
593 if (hdev->commands[6] & 0x20 &&
594 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
595 struct hci_cp_read_stored_link_key cp;
596
597 bacpy(&cp.bdaddr, BDADDR_ANY);
598 cp.read_all = 0x01;
599 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
600 }
601
602 if (hdev->commands[5] & 0x10)
603 hci_setup_link_policy(req);
604
605 if (hdev->commands[8] & 0x01)
606 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
607
608 if (hdev->commands[18] & 0x04 &&
609 !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
610 hci_req_add(req, HCI_OP_READ_DEF_ERR_DATA_REPORTING, 0, NULL);
611
612 /* Some older Broadcom based Bluetooth 1.2 controllers do not
613 * support the Read Page Scan Type command. Check support for
614 * this command in the bit mask of supported commands.
615 */
616 if (hdev->commands[13] & 0x01)
617 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
618
619 if (lmp_le_capable(hdev)) {
620 u8 events[8];
621
622 memset(events, 0, sizeof(events));
623
624 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
625 events[0] |= 0x10; /* LE Long Term Key Request */
626
627 /* If controller supports the Connection Parameters Request
628 * Link Layer Procedure, enable the corresponding event.
629 */
630 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
631 events[0] |= 0x20; /* LE Remote Connection
632 * Parameter Request
633 */
634
635 /* If the controller supports the Data Length Extension
636 * feature, enable the corresponding event.
637 */
638 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
639 events[0] |= 0x40; /* LE Data Length Change */
640
641 /* If the controller supports LL Privacy feature, enable
642 * the corresponding event.
643 */
644 if (hdev->le_features[0] & HCI_LE_LL_PRIVACY)
645 events[1] |= 0x02; /* LE Enhanced Connection
646 * Complete
647 */
648
649 /* If the controller supports Extended Scanner Filter
650 * Policies, enable the correspondig event.
651 */
652 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
653 events[1] |= 0x04; /* LE Direct Advertising
654 * Report
655 */
656
657 /* If the controller supports Channel Selection Algorithm #2
658 * feature, enable the corresponding event.
659 */
660 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
661 events[2] |= 0x08; /* LE Channel Selection
662 * Algorithm
663 */
664
665 /* If the controller supports the LE Set Scan Enable command,
666 * enable the corresponding advertising report event.
667 */
668 if (hdev->commands[26] & 0x08)
669 events[0] |= 0x02; /* LE Advertising Report */
670
671 /* If the controller supports the LE Create Connection
672 * command, enable the corresponding event.
673 */
674 if (hdev->commands[26] & 0x10)
675 events[0] |= 0x01; /* LE Connection Complete */
676
677 /* If the controller supports the LE Connection Update
678 * command, enable the corresponding event.
679 */
680 if (hdev->commands[27] & 0x04)
681 events[0] |= 0x04; /* LE Connection Update
682 * Complete
683 */
684
685 /* If the controller supports the LE Read Remote Used Features
686 * command, enable the corresponding event.
687 */
688 if (hdev->commands[27] & 0x20)
689 events[0] |= 0x08; /* LE Read Remote Used
690 * Features Complete
691 */
692
693 /* If the controller supports the LE Read Local P-256
694 * Public Key command, enable the corresponding event.
695 */
696 if (hdev->commands[34] & 0x02)
697 events[0] |= 0x80; /* LE Read Local P-256
698 * Public Key Complete
699 */
700
701 /* If the controller supports the LE Generate DHKey
702 * command, enable the corresponding event.
703 */
704 if (hdev->commands[34] & 0x04)
705 events[1] |= 0x01; /* LE Generate DHKey Complete */
706
707 /* If the controller supports the LE Set Default PHY or
708 * LE Set PHY commands, enable the corresponding event.
709 */
710 if (hdev->commands[35] & (0x20 | 0x40))
711 events[1] |= 0x08; /* LE PHY Update Complete */
712
713 /* If the controller supports LE Set Extended Scan Parameters
714 * and LE Set Extended Scan Enable commands, enable the
715 * corresponding event.
716 */
717 if (use_ext_scan(hdev))
718 events[1] |= 0x10; /* LE Extended Advertising
719 * Report
720 */
721
722 /* If the controller supports the LE Extended Advertising
723 * command, enable the corresponding event.
724 */
725 if (ext_adv_capable(hdev))
726 events[2] |= 0x02; /* LE Advertising Set
727 * Terminated
728 */
729
730 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
731 events);
732
733 /* Read LE Advertising Channel TX Power */
734 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
735 /* HCI TS spec forbids mixing of legacy and extended
736 * advertising commands wherein READ_ADV_TX_POWER is
737 * also included. So do not call it if extended adv
738 * is supported otherwise controller will return
739 * COMMAND_DISALLOWED for extended commands.
740 */
741 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
742 }
743
744 if (hdev->commands[26] & 0x40) {
745 /* Read LE White List Size */
746 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE,
747 0, NULL);
748 }
749
750 if (hdev->commands[26] & 0x80) {
751 /* Clear LE White List */
752 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
753 }
754
755 if (hdev->commands[34] & 0x40) {
756 /* Read LE Resolving List Size */
757 hci_req_add(req, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
758 0, NULL);
759 }
760
761 if (hdev->commands[34] & 0x20) {
762 /* Clear LE Resolving List */
763 hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL);
764 }
765
766 if (hdev->commands[35] & 0x04) {
767 __le16 rpa_timeout = cpu_to_le16(hdev->rpa_timeout);
768
769 /* Set RPA timeout */
770 hci_req_add(req, HCI_OP_LE_SET_RPA_TIMEOUT, 2,
771 &rpa_timeout);
772 }
773
774 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
775 /* Read LE Maximum Data Length */
776 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
777
778 /* Read LE Suggested Default Data Length */
779 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
780 }
781
782 if (ext_adv_capable(hdev)) {
783 /* Read LE Number of Supported Advertising Sets */
784 hci_req_add(req, HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
785 0, NULL);
786 }
787
788 hci_set_le_support(req);
789 }
790
791 /* Read features beyond page 1 if available */
792 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
793 struct hci_cp_read_local_ext_features cp;
794
795 cp.page = p;
796 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
797 sizeof(cp), &cp);
798 }
799
800 return 0;
801 }
802
hci_init4_req(struct hci_request * req,unsigned long opt)803 static int hci_init4_req(struct hci_request *req, unsigned long opt)
804 {
805 struct hci_dev *hdev = req->hdev;
806
807 /* Some Broadcom based Bluetooth controllers do not support the
808 * Delete Stored Link Key command. They are clearly indicating its
809 * absence in the bit mask of supported commands.
810 *
811 * Check the supported commands and only if the command is marked
812 * as supported send it. If not supported assume that the controller
813 * does not have actual support for stored link keys which makes this
814 * command redundant anyway.
815 *
816 * Some controllers indicate that they support handling deleting
817 * stored link keys, but they don't. The quirk lets a driver
818 * just disable this command.
819 */
820 if (hdev->commands[6] & 0x80 &&
821 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
822 struct hci_cp_delete_stored_link_key cp;
823
824 bacpy(&cp.bdaddr, BDADDR_ANY);
825 cp.delete_all = 0x01;
826 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
827 sizeof(cp), &cp);
828 }
829
830 /* Set event mask page 2 if the HCI command for it is supported */
831 if (hdev->commands[22] & 0x04)
832 hci_set_event_mask_page_2(req);
833
834 /* Read local codec list if the HCI command is supported */
835 if (hdev->commands[29] & 0x20)
836 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
837
838 /* Read local pairing options if the HCI command is supported */
839 if (hdev->commands[41] & 0x08)
840 hci_req_add(req, HCI_OP_READ_LOCAL_PAIRING_OPTS, 0, NULL);
841
842 /* Get MWS transport configuration if the HCI command is supported */
843 if (hdev->commands[30] & 0x08)
844 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
845
846 /* Check for Synchronization Train support */
847 if (lmp_sync_train_capable(hdev))
848 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
849
850 /* Enable Secure Connections if supported and configured */
851 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
852 bredr_sc_enabled(hdev)) {
853 u8 support = 0x01;
854
855 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
856 sizeof(support), &support);
857 }
858
859 /* Set erroneous data reporting if supported to the wideband speech
860 * setting value
861 */
862 if (hdev->commands[18] & 0x08 &&
863 !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks)) {
864 bool enabled = hci_dev_test_flag(hdev,
865 HCI_WIDEBAND_SPEECH_ENABLED);
866
867 if (enabled !=
868 (hdev->err_data_reporting == ERR_DATA_REPORTING_ENABLED)) {
869 struct hci_cp_write_def_err_data_reporting cp;
870
871 cp.err_data_reporting = enabled ?
872 ERR_DATA_REPORTING_ENABLED :
873 ERR_DATA_REPORTING_DISABLED;
874
875 hci_req_add(req, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
876 sizeof(cp), &cp);
877 }
878 }
879
880 /* Set Suggested Default Data Length to maximum if supported */
881 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
882 struct hci_cp_le_write_def_data_len cp;
883
884 cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
885 cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
886 hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
887 }
888
889 /* Set Default PHY parameters if command is supported */
890 if (hdev->commands[35] & 0x20) {
891 struct hci_cp_le_set_default_phy cp;
892
893 cp.all_phys = 0x00;
894 cp.tx_phys = hdev->le_tx_def_phys;
895 cp.rx_phys = hdev->le_rx_def_phys;
896
897 hci_req_add(req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp), &cp);
898 }
899
900 return 0;
901 }
902
__hci_init(struct hci_dev * hdev)903 static int __hci_init(struct hci_dev *hdev)
904 {
905 int err;
906
907 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
908 if (err < 0)
909 return err;
910
911 if (hci_dev_test_flag(hdev, HCI_SETUP))
912 hci_debugfs_create_basic(hdev);
913
914 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
915 if (err < 0)
916 return err;
917
918 /* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
919 * BR/EDR/LE type controllers. AMP controllers only need the
920 * first two stages of init.
921 */
922 if (hdev->dev_type != HCI_PRIMARY)
923 return 0;
924
925 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
926 if (err < 0)
927 return err;
928
929 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
930 if (err < 0)
931 return err;
932
933 /* This function is only called when the controller is actually in
934 * configured state. When the controller is marked as unconfigured,
935 * this initialization procedure is not run.
936 *
937 * It means that it is possible that a controller runs through its
938 * setup phase and then discovers missing settings. If that is the
939 * case, then this function will not be called. It then will only
940 * be called during the config phase.
941 *
942 * So only when in setup phase or config phase, create the debugfs
943 * entries and register the SMP channels.
944 */
945 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
946 !hci_dev_test_flag(hdev, HCI_CONFIG))
947 return 0;
948
949 hci_debugfs_create_common(hdev);
950
951 if (lmp_bredr_capable(hdev))
952 hci_debugfs_create_bredr(hdev);
953
954 if (lmp_le_capable(hdev))
955 hci_debugfs_create_le(hdev);
956
957 return 0;
958 }
959
hci_init0_req(struct hci_request * req,unsigned long opt)960 static int hci_init0_req(struct hci_request *req, unsigned long opt)
961 {
962 struct hci_dev *hdev = req->hdev;
963
964 BT_DBG("%s %ld", hdev->name, opt);
965
966 /* Reset */
967 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
968 hci_reset_req(req, 0);
969
970 /* Read Local Version */
971 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
972
973 /* Read BD Address */
974 if (hdev->set_bdaddr)
975 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
976
977 return 0;
978 }
979
__hci_unconf_init(struct hci_dev * hdev)980 static int __hci_unconf_init(struct hci_dev *hdev)
981 {
982 int err;
983
984 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
985 return 0;
986
987 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
988 if (err < 0)
989 return err;
990
991 if (hci_dev_test_flag(hdev, HCI_SETUP))
992 hci_debugfs_create_basic(hdev);
993
994 return 0;
995 }
996
hci_scan_req(struct hci_request * req,unsigned long opt)997 static int hci_scan_req(struct hci_request *req, unsigned long opt)
998 {
999 __u8 scan = opt;
1000
1001 BT_DBG("%s %x", req->hdev->name, scan);
1002
1003 /* Inquiry and Page scans */
1004 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1005 return 0;
1006 }
1007
hci_auth_req(struct hci_request * req,unsigned long opt)1008 static int hci_auth_req(struct hci_request *req, unsigned long opt)
1009 {
1010 __u8 auth = opt;
1011
1012 BT_DBG("%s %x", req->hdev->name, auth);
1013
1014 /* Authentication */
1015 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1016 return 0;
1017 }
1018
hci_encrypt_req(struct hci_request * req,unsigned long opt)1019 static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
1020 {
1021 __u8 encrypt = opt;
1022
1023 BT_DBG("%s %x", req->hdev->name, encrypt);
1024
1025 /* Encryption */
1026 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1027 return 0;
1028 }
1029
hci_linkpol_req(struct hci_request * req,unsigned long opt)1030 static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
1031 {
1032 __le16 policy = cpu_to_le16(opt);
1033
1034 BT_DBG("%s %x", req->hdev->name, policy);
1035
1036 /* Default link policy */
1037 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
1038 return 0;
1039 }
1040
1041 /* Get HCI device by index.
1042 * Device is held on return. */
hci_dev_get(int index)1043 struct hci_dev *hci_dev_get(int index)
1044 {
1045 struct hci_dev *hdev = NULL, *d;
1046
1047 BT_DBG("%d", index);
1048
1049 if (index < 0)
1050 return NULL;
1051
1052 read_lock(&hci_dev_list_lock);
1053 list_for_each_entry(d, &hci_dev_list, list) {
1054 if (d->id == index) {
1055 hdev = hci_dev_hold(d);
1056 break;
1057 }
1058 }
1059 read_unlock(&hci_dev_list_lock);
1060 return hdev;
1061 }
1062
1063 /* ---- Inquiry support ---- */
1064
hci_discovery_active(struct hci_dev * hdev)1065 bool hci_discovery_active(struct hci_dev *hdev)
1066 {
1067 struct discovery_state *discov = &hdev->discovery;
1068
1069 switch (discov->state) {
1070 case DISCOVERY_FINDING:
1071 case DISCOVERY_RESOLVING:
1072 return true;
1073
1074 default:
1075 return false;
1076 }
1077 }
1078
hci_discovery_set_state(struct hci_dev * hdev,int state)1079 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1080 {
1081 int old_state = hdev->discovery.state;
1082
1083 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1084
1085 if (old_state == state)
1086 return;
1087
1088 hdev->discovery.state = state;
1089
1090 switch (state) {
1091 case DISCOVERY_STOPPED:
1092 hci_update_background_scan(hdev);
1093
1094 if (old_state != DISCOVERY_STARTING)
1095 mgmt_discovering(hdev, 0);
1096 break;
1097 case DISCOVERY_STARTING:
1098 break;
1099 case DISCOVERY_FINDING:
1100 mgmt_discovering(hdev, 1);
1101 break;
1102 case DISCOVERY_RESOLVING:
1103 break;
1104 case DISCOVERY_STOPPING:
1105 break;
1106 }
1107 }
1108
hci_inquiry_cache_flush(struct hci_dev * hdev)1109 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1110 {
1111 struct discovery_state *cache = &hdev->discovery;
1112 struct inquiry_entry *p, *n;
1113
1114 list_for_each_entry_safe(p, n, &cache->all, all) {
1115 list_del(&p->all);
1116 kfree(p);
1117 }
1118
1119 INIT_LIST_HEAD(&cache->unknown);
1120 INIT_LIST_HEAD(&cache->resolve);
1121 }
1122
hci_inquiry_cache_lookup(struct hci_dev * hdev,bdaddr_t * bdaddr)1123 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1124 bdaddr_t *bdaddr)
1125 {
1126 struct discovery_state *cache = &hdev->discovery;
1127 struct inquiry_entry *e;
1128
1129 BT_DBG("cache %p, %pMR", cache, bdaddr);
1130
1131 list_for_each_entry(e, &cache->all, all) {
1132 if (!bacmp(&e->data.bdaddr, bdaddr))
1133 return e;
1134 }
1135
1136 return NULL;
1137 }
1138
hci_inquiry_cache_lookup_unknown(struct hci_dev * hdev,bdaddr_t * bdaddr)1139 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1140 bdaddr_t *bdaddr)
1141 {
1142 struct discovery_state *cache = &hdev->discovery;
1143 struct inquiry_entry *e;
1144
1145 BT_DBG("cache %p, %pMR", cache, bdaddr);
1146
1147 list_for_each_entry(e, &cache->unknown, list) {
1148 if (!bacmp(&e->data.bdaddr, bdaddr))
1149 return e;
1150 }
1151
1152 return NULL;
1153 }
1154
hci_inquiry_cache_lookup_resolve(struct hci_dev * hdev,bdaddr_t * bdaddr,int state)1155 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1156 bdaddr_t *bdaddr,
1157 int state)
1158 {
1159 struct discovery_state *cache = &hdev->discovery;
1160 struct inquiry_entry *e;
1161
1162 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1163
1164 list_for_each_entry(e, &cache->resolve, list) {
1165 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1166 return e;
1167 if (!bacmp(&e->data.bdaddr, bdaddr))
1168 return e;
1169 }
1170
1171 return NULL;
1172 }
1173
hci_inquiry_cache_update_resolve(struct hci_dev * hdev,struct inquiry_entry * ie)1174 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1175 struct inquiry_entry *ie)
1176 {
1177 struct discovery_state *cache = &hdev->discovery;
1178 struct list_head *pos = &cache->resolve;
1179 struct inquiry_entry *p;
1180
1181 list_del(&ie->list);
1182
1183 list_for_each_entry(p, &cache->resolve, list) {
1184 if (p->name_state != NAME_PENDING &&
1185 abs(p->data.rssi) >= abs(ie->data.rssi))
1186 break;
1187 pos = &p->list;
1188 }
1189
1190 list_add(&ie->list, pos);
1191 }
1192
hci_inquiry_cache_update(struct hci_dev * hdev,struct inquiry_data * data,bool name_known)1193 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1194 bool name_known)
1195 {
1196 struct discovery_state *cache = &hdev->discovery;
1197 struct inquiry_entry *ie;
1198 u32 flags = 0;
1199
1200 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1201
1202 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1203
1204 if (!data->ssp_mode)
1205 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1206
1207 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1208 if (ie) {
1209 if (!ie->data.ssp_mode)
1210 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1211
1212 if (ie->name_state == NAME_NEEDED &&
1213 data->rssi != ie->data.rssi) {
1214 ie->data.rssi = data->rssi;
1215 hci_inquiry_cache_update_resolve(hdev, ie);
1216 }
1217
1218 goto update;
1219 }
1220
1221 /* Entry not in the cache. Add new one. */
1222 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1223 if (!ie) {
1224 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1225 goto done;
1226 }
1227
1228 list_add(&ie->all, &cache->all);
1229
1230 if (name_known) {
1231 ie->name_state = NAME_KNOWN;
1232 } else {
1233 ie->name_state = NAME_NOT_KNOWN;
1234 list_add(&ie->list, &cache->unknown);
1235 }
1236
1237 update:
1238 if (name_known && ie->name_state != NAME_KNOWN &&
1239 ie->name_state != NAME_PENDING) {
1240 ie->name_state = NAME_KNOWN;
1241 list_del(&ie->list);
1242 }
1243
1244 memcpy(&ie->data, data, sizeof(*data));
1245 ie->timestamp = jiffies;
1246 cache->timestamp = jiffies;
1247
1248 if (ie->name_state == NAME_NOT_KNOWN)
1249 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1250
1251 done:
1252 return flags;
1253 }
1254
inquiry_cache_dump(struct hci_dev * hdev,int num,__u8 * buf)1255 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1256 {
1257 struct discovery_state *cache = &hdev->discovery;
1258 struct inquiry_info *info = (struct inquiry_info *) buf;
1259 struct inquiry_entry *e;
1260 int copied = 0;
1261
1262 list_for_each_entry(e, &cache->all, all) {
1263 struct inquiry_data *data = &e->data;
1264
1265 if (copied >= num)
1266 break;
1267
1268 bacpy(&info->bdaddr, &data->bdaddr);
1269 info->pscan_rep_mode = data->pscan_rep_mode;
1270 info->pscan_period_mode = data->pscan_period_mode;
1271 info->pscan_mode = data->pscan_mode;
1272 memcpy(info->dev_class, data->dev_class, 3);
1273 info->clock_offset = data->clock_offset;
1274
1275 info++;
1276 copied++;
1277 }
1278
1279 BT_DBG("cache %p, copied %d", cache, copied);
1280 return copied;
1281 }
1282
hci_inq_req(struct hci_request * req,unsigned long opt)1283 static int hci_inq_req(struct hci_request *req, unsigned long opt)
1284 {
1285 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1286 struct hci_dev *hdev = req->hdev;
1287 struct hci_cp_inquiry cp;
1288
1289 BT_DBG("%s", hdev->name);
1290
1291 if (test_bit(HCI_INQUIRY, &hdev->flags))
1292 return 0;
1293
1294 /* Start Inquiry */
1295 memcpy(&cp.lap, &ir->lap, 3);
1296 cp.length = ir->length;
1297 cp.num_rsp = ir->num_rsp;
1298 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1299
1300 return 0;
1301 }
1302
hci_inquiry(void __user * arg)1303 int hci_inquiry(void __user *arg)
1304 {
1305 __u8 __user *ptr = arg;
1306 struct hci_inquiry_req ir;
1307 struct hci_dev *hdev;
1308 int err = 0, do_inquiry = 0, max_rsp;
1309 long timeo;
1310 __u8 *buf;
1311
1312 if (copy_from_user(&ir, ptr, sizeof(ir)))
1313 return -EFAULT;
1314
1315 hdev = hci_dev_get(ir.dev_id);
1316 if (!hdev)
1317 return -ENODEV;
1318
1319 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1320 err = -EBUSY;
1321 goto done;
1322 }
1323
1324 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1325 err = -EOPNOTSUPP;
1326 goto done;
1327 }
1328
1329 if (hdev->dev_type != HCI_PRIMARY) {
1330 err = -EOPNOTSUPP;
1331 goto done;
1332 }
1333
1334 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1335 err = -EOPNOTSUPP;
1336 goto done;
1337 }
1338
1339 /* Restrict maximum inquiry length to 60 seconds */
1340 if (ir.length > 60) {
1341 err = -EINVAL;
1342 goto done;
1343 }
1344
1345 hci_dev_lock(hdev);
1346 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1347 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1348 hci_inquiry_cache_flush(hdev);
1349 do_inquiry = 1;
1350 }
1351 hci_dev_unlock(hdev);
1352
1353 timeo = ir.length * msecs_to_jiffies(2000);
1354
1355 if (do_inquiry) {
1356 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1357 timeo, NULL);
1358 if (err < 0)
1359 goto done;
1360
1361 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1362 * cleared). If it is interrupted by a signal, return -EINTR.
1363 */
1364 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1365 TASK_INTERRUPTIBLE)) {
1366 err = -EINTR;
1367 goto done;
1368 }
1369 }
1370
1371 /* for unlimited number of responses we will use buffer with
1372 * 255 entries
1373 */
1374 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1375
1376 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1377 * copy it to the user space.
1378 */
1379 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
1380 if (!buf) {
1381 err = -ENOMEM;
1382 goto done;
1383 }
1384
1385 hci_dev_lock(hdev);
1386 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1387 hci_dev_unlock(hdev);
1388
1389 BT_DBG("num_rsp %d", ir.num_rsp);
1390
1391 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1392 ptr += sizeof(ir);
1393 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1394 ir.num_rsp))
1395 err = -EFAULT;
1396 } else
1397 err = -EFAULT;
1398
1399 kfree(buf);
1400
1401 done:
1402 hci_dev_put(hdev);
1403 return err;
1404 }
1405
1406 /**
1407 * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address
1408 * (BD_ADDR) for a HCI device from
1409 * a firmware node property.
1410 * @hdev: The HCI device
1411 *
1412 * Search the firmware node for 'local-bd-address'.
1413 *
1414 * All-zero BD addresses are rejected, because those could be properties
1415 * that exist in the firmware tables, but were not updated by the firmware. For
1416 * example, the DTS could define 'local-bd-address', with zero BD addresses.
1417 */
hci_dev_get_bd_addr_from_property(struct hci_dev * hdev)1418 static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev)
1419 {
1420 struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
1421 bdaddr_t ba;
1422 int ret;
1423
1424 ret = fwnode_property_read_u8_array(fwnode, "local-bd-address",
1425 (u8 *)&ba, sizeof(ba));
1426 if (ret < 0 || !bacmp(&ba, BDADDR_ANY))
1427 return;
1428
1429 bacpy(&hdev->public_addr, &ba);
1430 }
1431
hci_dev_do_open(struct hci_dev * hdev)1432 static int hci_dev_do_open(struct hci_dev *hdev)
1433 {
1434 int ret = 0;
1435
1436 BT_DBG("%s %p", hdev->name, hdev);
1437
1438 hci_req_sync_lock(hdev);
1439
1440 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1441 ret = -ENODEV;
1442 goto done;
1443 }
1444
1445 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1446 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1447 /* Check for rfkill but allow the HCI setup stage to
1448 * proceed (which in itself doesn't cause any RF activity).
1449 */
1450 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1451 ret = -ERFKILL;
1452 goto done;
1453 }
1454
1455 /* Check for valid public address or a configured static
1456 * random adddress, but let the HCI setup proceed to
1457 * be able to determine if there is a public address
1458 * or not.
1459 *
1460 * In case of user channel usage, it is not important
1461 * if a public address or static random address is
1462 * available.
1463 *
1464 * This check is only valid for BR/EDR controllers
1465 * since AMP controllers do not have an address.
1466 */
1467 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1468 hdev->dev_type == HCI_PRIMARY &&
1469 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1470 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1471 ret = -EADDRNOTAVAIL;
1472 goto done;
1473 }
1474 }
1475
1476 if (test_bit(HCI_UP, &hdev->flags)) {
1477 ret = -EALREADY;
1478 goto done;
1479 }
1480
1481 if (hdev->open(hdev)) {
1482 ret = -EIO;
1483 goto done;
1484 }
1485
1486 set_bit(HCI_RUNNING, &hdev->flags);
1487 hci_sock_dev_event(hdev, HCI_DEV_OPEN);
1488
1489 atomic_set(&hdev->cmd_cnt, 1);
1490 set_bit(HCI_INIT, &hdev->flags);
1491
1492 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1493 test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
1494 bool invalid_bdaddr;
1495
1496 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1497
1498 if (hdev->setup)
1499 ret = hdev->setup(hdev);
1500
1501 /* The transport driver can set the quirk to mark the
1502 * BD_ADDR invalid before creating the HCI device or in
1503 * its setup callback.
1504 */
1505 invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR,
1506 &hdev->quirks);
1507
1508 if (ret)
1509 goto setup_failed;
1510
1511 if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
1512 if (!bacmp(&hdev->public_addr, BDADDR_ANY))
1513 hci_dev_get_bd_addr_from_property(hdev);
1514
1515 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1516 hdev->set_bdaddr) {
1517 ret = hdev->set_bdaddr(hdev,
1518 &hdev->public_addr);
1519
1520 /* If setting of the BD_ADDR from the device
1521 * property succeeds, then treat the address
1522 * as valid even if the invalid BD_ADDR
1523 * quirk indicates otherwise.
1524 */
1525 if (!ret)
1526 invalid_bdaddr = false;
1527 }
1528 }
1529
1530 setup_failed:
1531 /* The transport driver can set these quirks before
1532 * creating the HCI device or in its setup callback.
1533 *
1534 * For the invalid BD_ADDR quirk it is possible that
1535 * it becomes a valid address if the bootloader does
1536 * provide it (see above).
1537 *
1538 * In case any of them is set, the controller has to
1539 * start up as unconfigured.
1540 */
1541 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1542 invalid_bdaddr)
1543 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1544
1545 /* For an unconfigured controller it is required to
1546 * read at least the version information provided by
1547 * the Read Local Version Information command.
1548 *
1549 * If the set_bdaddr driver callback is provided, then
1550 * also the original Bluetooth public device address
1551 * will be read using the Read BD Address command.
1552 */
1553 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1554 ret = __hci_unconf_init(hdev);
1555 }
1556
1557 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1558 /* If public address change is configured, ensure that
1559 * the address gets programmed. If the driver does not
1560 * support changing the public address, fail the power
1561 * on procedure.
1562 */
1563 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1564 hdev->set_bdaddr)
1565 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1566 else
1567 ret = -EADDRNOTAVAIL;
1568 }
1569
1570 if (!ret) {
1571 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1572 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1573 ret = __hci_init(hdev);
1574 if (!ret && hdev->post_init)
1575 ret = hdev->post_init(hdev);
1576 }
1577 }
1578
1579 /* If the HCI Reset command is clearing all diagnostic settings,
1580 * then they need to be reprogrammed after the init procedure
1581 * completed.
1582 */
1583 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
1584 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1585 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1586 ret = hdev->set_diag(hdev, true);
1587
1588 msft_do_open(hdev);
1589
1590 clear_bit(HCI_INIT, &hdev->flags);
1591
1592 if (!ret) {
1593 hci_dev_hold(hdev);
1594 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1595 hci_adv_instances_set_rpa_expired(hdev, true);
1596 set_bit(HCI_UP, &hdev->flags);
1597 hci_sock_dev_event(hdev, HCI_DEV_UP);
1598 hci_leds_update_powered(hdev, true);
1599 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1600 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1601 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1602 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1603 hci_dev_test_flag(hdev, HCI_MGMT) &&
1604 hdev->dev_type == HCI_PRIMARY) {
1605 ret = __hci_req_hci_power_on(hdev);
1606 mgmt_power_on(hdev, ret);
1607 }
1608 } else {
1609 /* Init failed, cleanup */
1610 flush_work(&hdev->tx_work);
1611
1612 /* Since hci_rx_work() is possible to awake new cmd_work
1613 * it should be flushed first to avoid unexpected call of
1614 * hci_cmd_work()
1615 */
1616 flush_work(&hdev->rx_work);
1617 flush_work(&hdev->cmd_work);
1618
1619 skb_queue_purge(&hdev->cmd_q);
1620 skb_queue_purge(&hdev->rx_q);
1621
1622 if (hdev->flush)
1623 hdev->flush(hdev);
1624
1625 if (hdev->sent_cmd) {
1626 kfree_skb(hdev->sent_cmd);
1627 hdev->sent_cmd = NULL;
1628 }
1629
1630 clear_bit(HCI_RUNNING, &hdev->flags);
1631 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1632
1633 hdev->close(hdev);
1634 hdev->flags &= BIT(HCI_RAW);
1635 }
1636
1637 done:
1638 hci_req_sync_unlock(hdev);
1639 return ret;
1640 }
1641
1642 /* ---- HCI ioctl helpers ---- */
1643
hci_dev_open(__u16 dev)1644 int hci_dev_open(__u16 dev)
1645 {
1646 struct hci_dev *hdev;
1647 int err;
1648
1649 hdev = hci_dev_get(dev);
1650 if (!hdev)
1651 return -ENODEV;
1652
1653 /* Devices that are marked as unconfigured can only be powered
1654 * up as user channel. Trying to bring them up as normal devices
1655 * will result into a failure. Only user channel operation is
1656 * possible.
1657 *
1658 * When this function is called for a user channel, the flag
1659 * HCI_USER_CHANNEL will be set first before attempting to
1660 * open the device.
1661 */
1662 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1663 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1664 err = -EOPNOTSUPP;
1665 goto done;
1666 }
1667
1668 /* We need to ensure that no other power on/off work is pending
1669 * before proceeding to call hci_dev_do_open. This is
1670 * particularly important if the setup procedure has not yet
1671 * completed.
1672 */
1673 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1674 cancel_delayed_work(&hdev->power_off);
1675
1676 /* After this call it is guaranteed that the setup procedure
1677 * has finished. This means that error conditions like RFKILL
1678 * or no valid public or static random address apply.
1679 */
1680 flush_workqueue(hdev->req_workqueue);
1681
1682 /* For controllers not using the management interface and that
1683 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1684 * so that pairing works for them. Once the management interface
1685 * is in use this bit will be cleared again and userspace has
1686 * to explicitly enable it.
1687 */
1688 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1689 !hci_dev_test_flag(hdev, HCI_MGMT))
1690 hci_dev_set_flag(hdev, HCI_BONDABLE);
1691
1692 err = hci_dev_do_open(hdev);
1693
1694 done:
1695 hci_dev_put(hdev);
1696 return err;
1697 }
1698
1699 /* This function requires the caller holds hdev->lock */
hci_pend_le_actions_clear(struct hci_dev * hdev)1700 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1701 {
1702 struct hci_conn_params *p;
1703
1704 list_for_each_entry(p, &hdev->le_conn_params, list) {
1705 if (p->conn) {
1706 hci_conn_drop(p->conn);
1707 hci_conn_put(p->conn);
1708 p->conn = NULL;
1709 }
1710 list_del_init(&p->action);
1711 }
1712
1713 BT_DBG("All LE pending actions cleared");
1714 }
1715
hci_dev_do_close(struct hci_dev * hdev)1716 int hci_dev_do_close(struct hci_dev *hdev)
1717 {
1718 bool auto_off;
1719
1720 BT_DBG("%s %p", hdev->name, hdev);
1721
1722 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
1723 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1724 test_bit(HCI_UP, &hdev->flags)) {
1725 /* Execute vendor specific shutdown routine */
1726 if (hdev->shutdown)
1727 hdev->shutdown(hdev);
1728 }
1729
1730 cancel_delayed_work(&hdev->power_off);
1731
1732 hci_request_cancel_all(hdev);
1733 hci_req_sync_lock(hdev);
1734
1735 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1736 cancel_delayed_work_sync(&hdev->cmd_timer);
1737 hci_req_sync_unlock(hdev);
1738 return 0;
1739 }
1740
1741 hci_leds_update_powered(hdev, false);
1742
1743 /* Flush RX and TX works */
1744 flush_work(&hdev->tx_work);
1745 flush_work(&hdev->rx_work);
1746
1747 if (hdev->discov_timeout > 0) {
1748 hdev->discov_timeout = 0;
1749 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1750 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1751 }
1752
1753 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1754 cancel_delayed_work(&hdev->service_cache);
1755
1756 if (hci_dev_test_flag(hdev, HCI_MGMT)) {
1757 struct adv_info *adv_instance;
1758
1759 cancel_delayed_work_sync(&hdev->rpa_expired);
1760
1761 list_for_each_entry(adv_instance, &hdev->adv_instances, list)
1762 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1763 }
1764
1765 /* Avoid potential lockdep warnings from the *_flush() calls by
1766 * ensuring the workqueue is empty up front.
1767 */
1768 drain_workqueue(hdev->workqueue);
1769
1770 hci_dev_lock(hdev);
1771
1772 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1773
1774 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1775
1776 if (!auto_off && hdev->dev_type == HCI_PRIMARY &&
1777 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1778 hci_dev_test_flag(hdev, HCI_MGMT))
1779 __mgmt_power_off(hdev);
1780
1781 hci_inquiry_cache_flush(hdev);
1782 hci_pend_le_actions_clear(hdev);
1783 hci_conn_hash_flush(hdev);
1784 hci_dev_unlock(hdev);
1785
1786 smp_unregister(hdev);
1787
1788 hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1789
1790 msft_do_close(hdev);
1791
1792 if (hdev->flush)
1793 hdev->flush(hdev);
1794
1795 /* Reset device */
1796 skb_queue_purge(&hdev->cmd_q);
1797 atomic_set(&hdev->cmd_cnt, 1);
1798 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1799 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1800 set_bit(HCI_INIT, &hdev->flags);
1801 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1802 clear_bit(HCI_INIT, &hdev->flags);
1803 }
1804
1805 /* flush cmd work */
1806 flush_work(&hdev->cmd_work);
1807
1808 /* Drop queues */
1809 skb_queue_purge(&hdev->rx_q);
1810 skb_queue_purge(&hdev->cmd_q);
1811 skb_queue_purge(&hdev->raw_q);
1812
1813 /* Drop last sent command */
1814 if (hdev->sent_cmd) {
1815 cancel_delayed_work_sync(&hdev->cmd_timer);
1816 kfree_skb(hdev->sent_cmd);
1817 hdev->sent_cmd = NULL;
1818 }
1819
1820 clear_bit(HCI_RUNNING, &hdev->flags);
1821 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1822
1823 if (test_and_clear_bit(SUSPEND_POWERING_DOWN, hdev->suspend_tasks))
1824 wake_up(&hdev->suspend_wait_q);
1825
1826 /* After this point our queues are empty
1827 * and no tasks are scheduled. */
1828 hdev->close(hdev);
1829
1830 /* Clear flags */
1831 hdev->flags &= BIT(HCI_RAW);
1832 hci_dev_clear_volatile_flags(hdev);
1833
1834 /* Controller radio is available but is currently powered down */
1835 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1836
1837 memset(hdev->eir, 0, sizeof(hdev->eir));
1838 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1839 bacpy(&hdev->random_addr, BDADDR_ANY);
1840
1841 hci_req_sync_unlock(hdev);
1842
1843 hci_dev_put(hdev);
1844 return 0;
1845 }
1846
hci_dev_close(__u16 dev)1847 int hci_dev_close(__u16 dev)
1848 {
1849 struct hci_dev *hdev;
1850 int err;
1851
1852 hdev = hci_dev_get(dev);
1853 if (!hdev)
1854 return -ENODEV;
1855
1856 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1857 err = -EBUSY;
1858 goto done;
1859 }
1860
1861 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1862 cancel_delayed_work(&hdev->power_off);
1863
1864 err = hci_dev_do_close(hdev);
1865
1866 done:
1867 hci_dev_put(hdev);
1868 return err;
1869 }
1870
hci_dev_do_reset(struct hci_dev * hdev)1871 static int hci_dev_do_reset(struct hci_dev *hdev)
1872 {
1873 int ret;
1874
1875 BT_DBG("%s %p", hdev->name, hdev);
1876
1877 hci_req_sync_lock(hdev);
1878
1879 /* Drop queues */
1880 skb_queue_purge(&hdev->rx_q);
1881 skb_queue_purge(&hdev->cmd_q);
1882
1883 /* Avoid potential lockdep warnings from the *_flush() calls by
1884 * ensuring the workqueue is empty up front.
1885 */
1886 drain_workqueue(hdev->workqueue);
1887
1888 hci_dev_lock(hdev);
1889 hci_inquiry_cache_flush(hdev);
1890 hci_conn_hash_flush(hdev);
1891 hci_dev_unlock(hdev);
1892
1893 if (hdev->flush)
1894 hdev->flush(hdev);
1895
1896 atomic_set(&hdev->cmd_cnt, 1);
1897 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1898
1899 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1900
1901 hci_req_sync_unlock(hdev);
1902 return ret;
1903 }
1904
hci_dev_reset(__u16 dev)1905 int hci_dev_reset(__u16 dev)
1906 {
1907 struct hci_dev *hdev;
1908 int err;
1909
1910 hdev = hci_dev_get(dev);
1911 if (!hdev)
1912 return -ENODEV;
1913
1914 if (!test_bit(HCI_UP, &hdev->flags)) {
1915 err = -ENETDOWN;
1916 goto done;
1917 }
1918
1919 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1920 err = -EBUSY;
1921 goto done;
1922 }
1923
1924 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1925 err = -EOPNOTSUPP;
1926 goto done;
1927 }
1928
1929 err = hci_dev_do_reset(hdev);
1930
1931 done:
1932 hci_dev_put(hdev);
1933 return err;
1934 }
1935
hci_dev_reset_stat(__u16 dev)1936 int hci_dev_reset_stat(__u16 dev)
1937 {
1938 struct hci_dev *hdev;
1939 int ret = 0;
1940
1941 hdev = hci_dev_get(dev);
1942 if (!hdev)
1943 return -ENODEV;
1944
1945 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1946 ret = -EBUSY;
1947 goto done;
1948 }
1949
1950 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1951 ret = -EOPNOTSUPP;
1952 goto done;
1953 }
1954
1955 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1956
1957 done:
1958 hci_dev_put(hdev);
1959 return ret;
1960 }
1961
hci_update_scan_state(struct hci_dev * hdev,u8 scan)1962 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1963 {
1964 bool conn_changed, discov_changed;
1965
1966 BT_DBG("%s scan 0x%02x", hdev->name, scan);
1967
1968 if ((scan & SCAN_PAGE))
1969 conn_changed = !hci_dev_test_and_set_flag(hdev,
1970 HCI_CONNECTABLE);
1971 else
1972 conn_changed = hci_dev_test_and_clear_flag(hdev,
1973 HCI_CONNECTABLE);
1974
1975 if ((scan & SCAN_INQUIRY)) {
1976 discov_changed = !hci_dev_test_and_set_flag(hdev,
1977 HCI_DISCOVERABLE);
1978 } else {
1979 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1980 discov_changed = hci_dev_test_and_clear_flag(hdev,
1981 HCI_DISCOVERABLE);
1982 }
1983
1984 if (!hci_dev_test_flag(hdev, HCI_MGMT))
1985 return;
1986
1987 if (conn_changed || discov_changed) {
1988 /* In case this was disabled through mgmt */
1989 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
1990
1991 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1992 hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1993
1994 mgmt_new_settings(hdev);
1995 }
1996 }
1997
hci_dev_cmd(unsigned int cmd,void __user * arg)1998 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1999 {
2000 struct hci_dev *hdev;
2001 struct hci_dev_req dr;
2002 int err = 0;
2003
2004 if (copy_from_user(&dr, arg, sizeof(dr)))
2005 return -EFAULT;
2006
2007 hdev = hci_dev_get(dr.dev_id);
2008 if (!hdev)
2009 return -ENODEV;
2010
2011 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
2012 err = -EBUSY;
2013 goto done;
2014 }
2015
2016 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
2017 err = -EOPNOTSUPP;
2018 goto done;
2019 }
2020
2021 if (hdev->dev_type != HCI_PRIMARY) {
2022 err = -EOPNOTSUPP;
2023 goto done;
2024 }
2025
2026 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
2027 err = -EOPNOTSUPP;
2028 goto done;
2029 }
2030
2031 switch (cmd) {
2032 case HCISETAUTH:
2033 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2034 HCI_INIT_TIMEOUT, NULL);
2035 break;
2036
2037 case HCISETENCRYPT:
2038 if (!lmp_encrypt_capable(hdev)) {
2039 err = -EOPNOTSUPP;
2040 break;
2041 }
2042
2043 if (!test_bit(HCI_AUTH, &hdev->flags)) {
2044 /* Auth must be enabled first */
2045 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
2046 HCI_INIT_TIMEOUT, NULL);
2047 if (err)
2048 break;
2049 }
2050
2051 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
2052 HCI_INIT_TIMEOUT, NULL);
2053 break;
2054
2055 case HCISETSCAN:
2056 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
2057 HCI_INIT_TIMEOUT, NULL);
2058
2059 /* Ensure that the connectable and discoverable states
2060 * get correctly modified as this was a non-mgmt change.
2061 */
2062 if (!err)
2063 hci_update_scan_state(hdev, dr.dev_opt);
2064 break;
2065
2066 case HCISETLINKPOL:
2067 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
2068 HCI_INIT_TIMEOUT, NULL);
2069 break;
2070
2071 case HCISETLINKMODE:
2072 hdev->link_mode = ((__u16) dr.dev_opt) &
2073 (HCI_LM_MASTER | HCI_LM_ACCEPT);
2074 break;
2075
2076 case HCISETPTYPE:
2077 if (hdev->pkt_type == (__u16) dr.dev_opt)
2078 break;
2079
2080 hdev->pkt_type = (__u16) dr.dev_opt;
2081 mgmt_phy_configuration_changed(hdev, NULL);
2082 break;
2083
2084 case HCISETACLMTU:
2085 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
2086 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
2087 break;
2088
2089 case HCISETSCOMTU:
2090 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
2091 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
2092 break;
2093
2094 default:
2095 err = -EINVAL;
2096 break;
2097 }
2098
2099 done:
2100 hci_dev_put(hdev);
2101 return err;
2102 }
2103
hci_get_dev_list(void __user * arg)2104 int hci_get_dev_list(void __user *arg)
2105 {
2106 struct hci_dev *hdev;
2107 struct hci_dev_list_req *dl;
2108 struct hci_dev_req *dr;
2109 int n = 0, size, err;
2110 __u16 dev_num;
2111
2112 if (get_user(dev_num, (__u16 __user *) arg))
2113 return -EFAULT;
2114
2115 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2116 return -EINVAL;
2117
2118 size = sizeof(*dl) + dev_num * sizeof(*dr);
2119
2120 dl = kzalloc(size, GFP_KERNEL);
2121 if (!dl)
2122 return -ENOMEM;
2123
2124 dr = dl->dev_req;
2125
2126 read_lock(&hci_dev_list_lock);
2127 list_for_each_entry(hdev, &hci_dev_list, list) {
2128 unsigned long flags = hdev->flags;
2129
2130 /* When the auto-off is configured it means the transport
2131 * is running, but in that case still indicate that the
2132 * device is actually down.
2133 */
2134 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2135 flags &= ~BIT(HCI_UP);
2136
2137 (dr + n)->dev_id = hdev->id;
2138 (dr + n)->dev_opt = flags;
2139
2140 if (++n >= dev_num)
2141 break;
2142 }
2143 read_unlock(&hci_dev_list_lock);
2144
2145 dl->dev_num = n;
2146 size = sizeof(*dl) + n * sizeof(*dr);
2147
2148 err = copy_to_user(arg, dl, size);
2149 kfree(dl);
2150
2151 return err ? -EFAULT : 0;
2152 }
2153
hci_get_dev_info(void __user * arg)2154 int hci_get_dev_info(void __user *arg)
2155 {
2156 struct hci_dev *hdev;
2157 struct hci_dev_info di;
2158 unsigned long flags;
2159 int err = 0;
2160
2161 if (copy_from_user(&di, arg, sizeof(di)))
2162 return -EFAULT;
2163
2164 hdev = hci_dev_get(di.dev_id);
2165 if (!hdev)
2166 return -ENODEV;
2167
2168 /* When the auto-off is configured it means the transport
2169 * is running, but in that case still indicate that the
2170 * device is actually down.
2171 */
2172 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2173 flags = hdev->flags & ~BIT(HCI_UP);
2174 else
2175 flags = hdev->flags;
2176
2177 strcpy(di.name, hdev->name);
2178 di.bdaddr = hdev->bdaddr;
2179 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2180 di.flags = flags;
2181 di.pkt_type = hdev->pkt_type;
2182 if (lmp_bredr_capable(hdev)) {
2183 di.acl_mtu = hdev->acl_mtu;
2184 di.acl_pkts = hdev->acl_pkts;
2185 di.sco_mtu = hdev->sco_mtu;
2186 di.sco_pkts = hdev->sco_pkts;
2187 } else {
2188 di.acl_mtu = hdev->le_mtu;
2189 di.acl_pkts = hdev->le_pkts;
2190 di.sco_mtu = 0;
2191 di.sco_pkts = 0;
2192 }
2193 di.link_policy = hdev->link_policy;
2194 di.link_mode = hdev->link_mode;
2195
2196 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2197 memcpy(&di.features, &hdev->features, sizeof(di.features));
2198
2199 if (copy_to_user(arg, &di, sizeof(di)))
2200 err = -EFAULT;
2201
2202 hci_dev_put(hdev);
2203
2204 return err;
2205 }
2206
2207 /* ---- Interface to HCI drivers ---- */
2208
hci_rfkill_set_block(void * data,bool blocked)2209 static int hci_rfkill_set_block(void *data, bool blocked)
2210 {
2211 struct hci_dev *hdev = data;
2212
2213 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2214
2215 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2216 return -EBUSY;
2217
2218 if (blocked) {
2219 hci_dev_set_flag(hdev, HCI_RFKILLED);
2220 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2221 !hci_dev_test_flag(hdev, HCI_CONFIG))
2222 hci_dev_do_close(hdev);
2223 } else {
2224 hci_dev_clear_flag(hdev, HCI_RFKILLED);
2225 }
2226
2227 return 0;
2228 }
2229
2230 static const struct rfkill_ops hci_rfkill_ops = {
2231 .set_block = hci_rfkill_set_block,
2232 };
2233
hci_power_on(struct work_struct * work)2234 static void hci_power_on(struct work_struct *work)
2235 {
2236 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2237 int err;
2238
2239 BT_DBG("%s", hdev->name);
2240
2241 if (test_bit(HCI_UP, &hdev->flags) &&
2242 hci_dev_test_flag(hdev, HCI_MGMT) &&
2243 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
2244 cancel_delayed_work(&hdev->power_off);
2245 hci_req_sync_lock(hdev);
2246 err = __hci_req_hci_power_on(hdev);
2247 hci_req_sync_unlock(hdev);
2248 mgmt_power_on(hdev, err);
2249 return;
2250 }
2251
2252 err = hci_dev_do_open(hdev);
2253 if (err < 0) {
2254 hci_dev_lock(hdev);
2255 mgmt_set_powered_failed(hdev, err);
2256 hci_dev_unlock(hdev);
2257 return;
2258 }
2259
2260 /* During the HCI setup phase, a few error conditions are
2261 * ignored and they need to be checked now. If they are still
2262 * valid, it is important to turn the device back off.
2263 */
2264 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2265 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2266 (hdev->dev_type == HCI_PRIMARY &&
2267 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2268 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2269 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2270 hci_dev_do_close(hdev);
2271 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2272 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2273 HCI_AUTO_OFF_TIMEOUT);
2274 }
2275
2276 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2277 /* For unconfigured devices, set the HCI_RAW flag
2278 * so that userspace can easily identify them.
2279 */
2280 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2281 set_bit(HCI_RAW, &hdev->flags);
2282
2283 /* For fully configured devices, this will send
2284 * the Index Added event. For unconfigured devices,
2285 * it will send Unconfigued Index Added event.
2286 *
2287 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2288 * and no event will be send.
2289 */
2290 mgmt_index_added(hdev);
2291 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2292 /* When the controller is now configured, then it
2293 * is important to clear the HCI_RAW flag.
2294 */
2295 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2296 clear_bit(HCI_RAW, &hdev->flags);
2297
2298 /* Powering on the controller with HCI_CONFIG set only
2299 * happens with the transition from unconfigured to
2300 * configured. This will send the Index Added event.
2301 */
2302 mgmt_index_added(hdev);
2303 }
2304 }
2305
hci_power_off(struct work_struct * work)2306 static void hci_power_off(struct work_struct *work)
2307 {
2308 struct hci_dev *hdev = container_of(work, struct hci_dev,
2309 power_off.work);
2310
2311 BT_DBG("%s", hdev->name);
2312
2313 hci_dev_do_close(hdev);
2314 }
2315
hci_error_reset(struct work_struct * work)2316 static void hci_error_reset(struct work_struct *work)
2317 {
2318 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2319
2320 BT_DBG("%s", hdev->name);
2321
2322 if (hdev->hw_error)
2323 hdev->hw_error(hdev, hdev->hw_error_code);
2324 else
2325 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
2326
2327 if (hci_dev_do_close(hdev))
2328 return;
2329
2330 hci_dev_do_open(hdev);
2331 }
2332
hci_uuids_clear(struct hci_dev * hdev)2333 void hci_uuids_clear(struct hci_dev *hdev)
2334 {
2335 struct bt_uuid *uuid, *tmp;
2336
2337 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2338 list_del(&uuid->list);
2339 kfree(uuid);
2340 }
2341 }
2342
hci_link_keys_clear(struct hci_dev * hdev)2343 void hci_link_keys_clear(struct hci_dev *hdev)
2344 {
2345 struct link_key *key;
2346
2347 list_for_each_entry(key, &hdev->link_keys, list) {
2348 list_del_rcu(&key->list);
2349 kfree_rcu(key, rcu);
2350 }
2351 }
2352
hci_smp_ltks_clear(struct hci_dev * hdev)2353 void hci_smp_ltks_clear(struct hci_dev *hdev)
2354 {
2355 struct smp_ltk *k;
2356
2357 list_for_each_entry(k, &hdev->long_term_keys, list) {
2358 list_del_rcu(&k->list);
2359 kfree_rcu(k, rcu);
2360 }
2361 }
2362
hci_smp_irks_clear(struct hci_dev * hdev)2363 void hci_smp_irks_clear(struct hci_dev *hdev)
2364 {
2365 struct smp_irk *k;
2366
2367 list_for_each_entry(k, &hdev->identity_resolving_keys, list) {
2368 list_del_rcu(&k->list);
2369 kfree_rcu(k, rcu);
2370 }
2371 }
2372
hci_blocked_keys_clear(struct hci_dev * hdev)2373 void hci_blocked_keys_clear(struct hci_dev *hdev)
2374 {
2375 struct blocked_key *b;
2376
2377 list_for_each_entry(b, &hdev->blocked_keys, list) {
2378 list_del_rcu(&b->list);
2379 kfree_rcu(b, rcu);
2380 }
2381 }
2382
hci_is_blocked_key(struct hci_dev * hdev,u8 type,u8 val[16])2383 bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
2384 {
2385 bool blocked = false;
2386 struct blocked_key *b;
2387
2388 rcu_read_lock();
2389 list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
2390 if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
2391 blocked = true;
2392 break;
2393 }
2394 }
2395
2396 rcu_read_unlock();
2397 return blocked;
2398 }
2399
hci_find_link_key(struct hci_dev * hdev,bdaddr_t * bdaddr)2400 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2401 {
2402 struct link_key *k;
2403
2404 rcu_read_lock();
2405 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2406 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2407 rcu_read_unlock();
2408
2409 if (hci_is_blocked_key(hdev,
2410 HCI_BLOCKED_KEY_TYPE_LINKKEY,
2411 k->val)) {
2412 bt_dev_warn_ratelimited(hdev,
2413 "Link key blocked for %pMR",
2414 &k->bdaddr);
2415 return NULL;
2416 }
2417
2418 return k;
2419 }
2420 }
2421 rcu_read_unlock();
2422
2423 return NULL;
2424 }
2425
hci_persistent_key(struct hci_dev * hdev,struct hci_conn * conn,u8 key_type,u8 old_key_type)2426 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2427 u8 key_type, u8 old_key_type)
2428 {
2429 /* Legacy key */
2430 if (key_type < 0x03)
2431 return true;
2432
2433 /* Debug keys are insecure so don't store them persistently */
2434 if (key_type == HCI_LK_DEBUG_COMBINATION)
2435 return false;
2436
2437 /* Changed combination key and there's no previous one */
2438 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2439 return false;
2440
2441 /* Security mode 3 case */
2442 if (!conn)
2443 return true;
2444
2445 /* BR/EDR key derived using SC from an LE link */
2446 if (conn->type == LE_LINK)
2447 return true;
2448
2449 /* Neither local nor remote side had no-bonding as requirement */
2450 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2451 return true;
2452
2453 /* Local side had dedicated bonding as requirement */
2454 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2455 return true;
2456
2457 /* Remote side had dedicated bonding as requirement */
2458 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2459 return true;
2460
2461 /* If none of the above criteria match, then don't store the key
2462 * persistently */
2463 return false;
2464 }
2465
ltk_role(u8 type)2466 static u8 ltk_role(u8 type)
2467 {
2468 if (type == SMP_LTK)
2469 return HCI_ROLE_MASTER;
2470
2471 return HCI_ROLE_SLAVE;
2472 }
2473
hci_find_ltk(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,u8 role)2474 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2475 u8 addr_type, u8 role)
2476 {
2477 struct smp_ltk *k;
2478
2479 rcu_read_lock();
2480 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2481 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2482 continue;
2483
2484 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2485 rcu_read_unlock();
2486
2487 if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
2488 k->val)) {
2489 bt_dev_warn_ratelimited(hdev,
2490 "LTK blocked for %pMR",
2491 &k->bdaddr);
2492 return NULL;
2493 }
2494
2495 return k;
2496 }
2497 }
2498 rcu_read_unlock();
2499
2500 return NULL;
2501 }
2502
hci_find_irk_by_rpa(struct hci_dev * hdev,bdaddr_t * rpa)2503 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2504 {
2505 struct smp_irk *irk_to_return = NULL;
2506 struct smp_irk *irk;
2507
2508 rcu_read_lock();
2509 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2510 if (!bacmp(&irk->rpa, rpa)) {
2511 irk_to_return = irk;
2512 goto done;
2513 }
2514 }
2515
2516 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2517 if (smp_irk_matches(hdev, irk->val, rpa)) {
2518 bacpy(&irk->rpa, rpa);
2519 irk_to_return = irk;
2520 goto done;
2521 }
2522 }
2523
2524 done:
2525 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2526 irk_to_return->val)) {
2527 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
2528 &irk_to_return->bdaddr);
2529 irk_to_return = NULL;
2530 }
2531
2532 rcu_read_unlock();
2533
2534 return irk_to_return;
2535 }
2536
hci_find_irk_by_addr(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type)2537 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2538 u8 addr_type)
2539 {
2540 struct smp_irk *irk_to_return = NULL;
2541 struct smp_irk *irk;
2542
2543 /* Identity Address must be public or static random */
2544 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2545 return NULL;
2546
2547 rcu_read_lock();
2548 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2549 if (addr_type == irk->addr_type &&
2550 bacmp(bdaddr, &irk->bdaddr) == 0) {
2551 irk_to_return = irk;
2552 goto done;
2553 }
2554 }
2555
2556 done:
2557
2558 if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
2559 irk_to_return->val)) {
2560 bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
2561 &irk_to_return->bdaddr);
2562 irk_to_return = NULL;
2563 }
2564
2565 rcu_read_unlock();
2566
2567 return irk_to_return;
2568 }
2569
hci_add_link_key(struct hci_dev * hdev,struct hci_conn * conn,bdaddr_t * bdaddr,u8 * val,u8 type,u8 pin_len,bool * persistent)2570 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2571 bdaddr_t *bdaddr, u8 *val, u8 type,
2572 u8 pin_len, bool *persistent)
2573 {
2574 struct link_key *key, *old_key;
2575 u8 old_key_type;
2576
2577 old_key = hci_find_link_key(hdev, bdaddr);
2578 if (old_key) {
2579 old_key_type = old_key->type;
2580 key = old_key;
2581 } else {
2582 old_key_type = conn ? conn->key_type : 0xff;
2583 key = kzalloc(sizeof(*key), GFP_KERNEL);
2584 if (!key)
2585 return NULL;
2586 list_add_rcu(&key->list, &hdev->link_keys);
2587 }
2588
2589 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2590
2591 /* Some buggy controller combinations generate a changed
2592 * combination key for legacy pairing even when there's no
2593 * previous key */
2594 if (type == HCI_LK_CHANGED_COMBINATION &&
2595 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2596 type = HCI_LK_COMBINATION;
2597 if (conn)
2598 conn->key_type = type;
2599 }
2600
2601 bacpy(&key->bdaddr, bdaddr);
2602 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2603 key->pin_len = pin_len;
2604
2605 if (type == HCI_LK_CHANGED_COMBINATION)
2606 key->type = old_key_type;
2607 else
2608 key->type = type;
2609
2610 if (persistent)
2611 *persistent = hci_persistent_key(hdev, conn, type,
2612 old_key_type);
2613
2614 return key;
2615 }
2616
hci_add_ltk(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,u8 type,u8 authenticated,u8 tk[16],u8 enc_size,__le16 ediv,__le64 rand)2617 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2618 u8 addr_type, u8 type, u8 authenticated,
2619 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2620 {
2621 struct smp_ltk *key, *old_key;
2622 u8 role = ltk_role(type);
2623
2624 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2625 if (old_key)
2626 key = old_key;
2627 else {
2628 key = kzalloc(sizeof(*key), GFP_KERNEL);
2629 if (!key)
2630 return NULL;
2631 list_add_rcu(&key->list, &hdev->long_term_keys);
2632 }
2633
2634 bacpy(&key->bdaddr, bdaddr);
2635 key->bdaddr_type = addr_type;
2636 memcpy(key->val, tk, sizeof(key->val));
2637 key->authenticated = authenticated;
2638 key->ediv = ediv;
2639 key->rand = rand;
2640 key->enc_size = enc_size;
2641 key->type = type;
2642
2643 return key;
2644 }
2645
hci_add_irk(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,u8 val[16],bdaddr_t * rpa)2646 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2647 u8 addr_type, u8 val[16], bdaddr_t *rpa)
2648 {
2649 struct smp_irk *irk;
2650
2651 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2652 if (!irk) {
2653 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2654 if (!irk)
2655 return NULL;
2656
2657 bacpy(&irk->bdaddr, bdaddr);
2658 irk->addr_type = addr_type;
2659
2660 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2661 }
2662
2663 memcpy(irk->val, val, 16);
2664 bacpy(&irk->rpa, rpa);
2665
2666 return irk;
2667 }
2668
hci_remove_link_key(struct hci_dev * hdev,bdaddr_t * bdaddr)2669 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2670 {
2671 struct link_key *key;
2672
2673 key = hci_find_link_key(hdev, bdaddr);
2674 if (!key)
2675 return -ENOENT;
2676
2677 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2678
2679 list_del_rcu(&key->list);
2680 kfree_rcu(key, rcu);
2681
2682 return 0;
2683 }
2684
hci_remove_ltk(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type)2685 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2686 {
2687 struct smp_ltk *k;
2688 int removed = 0;
2689
2690 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2691 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2692 continue;
2693
2694 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2695
2696 list_del_rcu(&k->list);
2697 kfree_rcu(k, rcu);
2698 removed++;
2699 }
2700
2701 return removed ? 0 : -ENOENT;
2702 }
2703
hci_remove_irk(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type)2704 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2705 {
2706 struct smp_irk *k;
2707
2708 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2709 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2710 continue;
2711
2712 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2713
2714 list_del_rcu(&k->list);
2715 kfree_rcu(k, rcu);
2716 }
2717 }
2718
hci_bdaddr_is_paired(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type)2719 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2720 {
2721 struct smp_ltk *k;
2722 struct smp_irk *irk;
2723 u8 addr_type;
2724
2725 if (type == BDADDR_BREDR) {
2726 if (hci_find_link_key(hdev, bdaddr))
2727 return true;
2728 return false;
2729 }
2730
2731 /* Convert to HCI addr type which struct smp_ltk uses */
2732 if (type == BDADDR_LE_PUBLIC)
2733 addr_type = ADDR_LE_DEV_PUBLIC;
2734 else
2735 addr_type = ADDR_LE_DEV_RANDOM;
2736
2737 irk = hci_get_irk(hdev, bdaddr, addr_type);
2738 if (irk) {
2739 bdaddr = &irk->bdaddr;
2740 addr_type = irk->addr_type;
2741 }
2742
2743 rcu_read_lock();
2744 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2745 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2746 rcu_read_unlock();
2747 return true;
2748 }
2749 }
2750 rcu_read_unlock();
2751
2752 return false;
2753 }
2754
2755 /* HCI command timer function */
hci_cmd_timeout(struct work_struct * work)2756 static void hci_cmd_timeout(struct work_struct *work)
2757 {
2758 struct hci_dev *hdev = container_of(work, struct hci_dev,
2759 cmd_timer.work);
2760
2761 if (hdev->sent_cmd) {
2762 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2763 u16 opcode = __le16_to_cpu(sent->opcode);
2764
2765 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
2766 } else {
2767 bt_dev_err(hdev, "command tx timeout");
2768 }
2769
2770 if (hdev->cmd_timeout)
2771 hdev->cmd_timeout(hdev);
2772
2773 atomic_set(&hdev->cmd_cnt, 1);
2774 queue_work(hdev->workqueue, &hdev->cmd_work);
2775 }
2776
hci_find_remote_oob_data(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type)2777 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2778 bdaddr_t *bdaddr, u8 bdaddr_type)
2779 {
2780 struct oob_data *data;
2781
2782 list_for_each_entry(data, &hdev->remote_oob_data, list) {
2783 if (bacmp(bdaddr, &data->bdaddr) != 0)
2784 continue;
2785 if (data->bdaddr_type != bdaddr_type)
2786 continue;
2787 return data;
2788 }
2789
2790 return NULL;
2791 }
2792
hci_remove_remote_oob_data(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type)2793 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2794 u8 bdaddr_type)
2795 {
2796 struct oob_data *data;
2797
2798 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2799 if (!data)
2800 return -ENOENT;
2801
2802 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2803
2804 list_del(&data->list);
2805 kfree(data);
2806
2807 return 0;
2808 }
2809
hci_remote_oob_data_clear(struct hci_dev * hdev)2810 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2811 {
2812 struct oob_data *data, *n;
2813
2814 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2815 list_del(&data->list);
2816 kfree(data);
2817 }
2818 }
2819
hci_add_remote_oob_data(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,u8 * hash192,u8 * rand192,u8 * hash256,u8 * rand256)2820 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2821 u8 bdaddr_type, u8 *hash192, u8 *rand192,
2822 u8 *hash256, u8 *rand256)
2823 {
2824 struct oob_data *data;
2825
2826 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2827 if (!data) {
2828 data = kmalloc(sizeof(*data), GFP_KERNEL);
2829 if (!data)
2830 return -ENOMEM;
2831
2832 bacpy(&data->bdaddr, bdaddr);
2833 data->bdaddr_type = bdaddr_type;
2834 list_add(&data->list, &hdev->remote_oob_data);
2835 }
2836
2837 if (hash192 && rand192) {
2838 memcpy(data->hash192, hash192, sizeof(data->hash192));
2839 memcpy(data->rand192, rand192, sizeof(data->rand192));
2840 if (hash256 && rand256)
2841 data->present = 0x03;
2842 } else {
2843 memset(data->hash192, 0, sizeof(data->hash192));
2844 memset(data->rand192, 0, sizeof(data->rand192));
2845 if (hash256 && rand256)
2846 data->present = 0x02;
2847 else
2848 data->present = 0x00;
2849 }
2850
2851 if (hash256 && rand256) {
2852 memcpy(data->hash256, hash256, sizeof(data->hash256));
2853 memcpy(data->rand256, rand256, sizeof(data->rand256));
2854 } else {
2855 memset(data->hash256, 0, sizeof(data->hash256));
2856 memset(data->rand256, 0, sizeof(data->rand256));
2857 if (hash192 && rand192)
2858 data->present = 0x01;
2859 }
2860
2861 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2862
2863 return 0;
2864 }
2865
2866 /* This function requires the caller holds hdev->lock */
hci_find_adv_instance(struct hci_dev * hdev,u8 instance)2867 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2868 {
2869 struct adv_info *adv_instance;
2870
2871 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2872 if (adv_instance->instance == instance)
2873 return adv_instance;
2874 }
2875
2876 return NULL;
2877 }
2878
2879 /* This function requires the caller holds hdev->lock */
hci_get_next_instance(struct hci_dev * hdev,u8 instance)2880 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2881 {
2882 struct adv_info *cur_instance;
2883
2884 cur_instance = hci_find_adv_instance(hdev, instance);
2885 if (!cur_instance)
2886 return NULL;
2887
2888 if (cur_instance == list_last_entry(&hdev->adv_instances,
2889 struct adv_info, list))
2890 return list_first_entry(&hdev->adv_instances,
2891 struct adv_info, list);
2892 else
2893 return list_next_entry(cur_instance, list);
2894 }
2895
2896 /* This function requires the caller holds hdev->lock */
hci_remove_adv_instance(struct hci_dev * hdev,u8 instance)2897 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2898 {
2899 struct adv_info *adv_instance;
2900
2901 adv_instance = hci_find_adv_instance(hdev, instance);
2902 if (!adv_instance)
2903 return -ENOENT;
2904
2905 BT_DBG("%s removing %dMR", hdev->name, instance);
2906
2907 if (hdev->cur_adv_instance == instance) {
2908 if (hdev->adv_instance_timeout) {
2909 cancel_delayed_work(&hdev->adv_instance_expire);
2910 hdev->adv_instance_timeout = 0;
2911 }
2912 hdev->cur_adv_instance = 0x00;
2913 }
2914
2915 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2916
2917 list_del(&adv_instance->list);
2918 kfree(adv_instance);
2919
2920 hdev->adv_instance_cnt--;
2921
2922 return 0;
2923 }
2924
hci_adv_instances_set_rpa_expired(struct hci_dev * hdev,bool rpa_expired)2925 void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
2926 {
2927 struct adv_info *adv_instance, *n;
2928
2929 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
2930 adv_instance->rpa_expired = rpa_expired;
2931 }
2932
2933 /* This function requires the caller holds hdev->lock */
hci_adv_instances_clear(struct hci_dev * hdev)2934 void hci_adv_instances_clear(struct hci_dev *hdev)
2935 {
2936 struct adv_info *adv_instance, *n;
2937
2938 if (hdev->adv_instance_timeout) {
2939 cancel_delayed_work(&hdev->adv_instance_expire);
2940 hdev->adv_instance_timeout = 0;
2941 }
2942
2943 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
2944 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2945 list_del(&adv_instance->list);
2946 kfree(adv_instance);
2947 }
2948
2949 hdev->adv_instance_cnt = 0;
2950 hdev->cur_adv_instance = 0x00;
2951 }
2952
adv_instance_rpa_expired(struct work_struct * work)2953 static void adv_instance_rpa_expired(struct work_struct *work)
2954 {
2955 struct adv_info *adv_instance = container_of(work, struct adv_info,
2956 rpa_expired_cb.work);
2957
2958 BT_DBG("");
2959
2960 adv_instance->rpa_expired = true;
2961 }
2962
2963 /* This function requires the caller holds hdev->lock */
hci_add_adv_instance(struct hci_dev * hdev,u8 instance,u32 flags,u16 adv_data_len,u8 * adv_data,u16 scan_rsp_len,u8 * scan_rsp_data,u16 timeout,u16 duration)2964 int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2965 u16 adv_data_len, u8 *adv_data,
2966 u16 scan_rsp_len, u8 *scan_rsp_data,
2967 u16 timeout, u16 duration)
2968 {
2969 struct adv_info *adv_instance;
2970
2971 adv_instance = hci_find_adv_instance(hdev, instance);
2972 if (adv_instance) {
2973 memset(adv_instance->adv_data, 0,
2974 sizeof(adv_instance->adv_data));
2975 memset(adv_instance->scan_rsp_data, 0,
2976 sizeof(adv_instance->scan_rsp_data));
2977 } else {
2978 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
2979 instance < 1 || instance > hdev->le_num_of_adv_sets)
2980 return -EOVERFLOW;
2981
2982 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
2983 if (!adv_instance)
2984 return -ENOMEM;
2985
2986 adv_instance->pending = true;
2987 adv_instance->instance = instance;
2988 list_add(&adv_instance->list, &hdev->adv_instances);
2989 hdev->adv_instance_cnt++;
2990 }
2991
2992 adv_instance->flags = flags;
2993 adv_instance->adv_data_len = adv_data_len;
2994 adv_instance->scan_rsp_len = scan_rsp_len;
2995
2996 if (adv_data_len)
2997 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
2998
2999 if (scan_rsp_len)
3000 memcpy(adv_instance->scan_rsp_data,
3001 scan_rsp_data, scan_rsp_len);
3002
3003 adv_instance->timeout = timeout;
3004 adv_instance->remaining_time = timeout;
3005
3006 if (duration == 0)
3007 adv_instance->duration = hdev->def_multi_adv_rotation_duration;
3008 else
3009 adv_instance->duration = duration;
3010
3011 adv_instance->tx_power = HCI_TX_POWER_INVALID;
3012
3013 INIT_DELAYED_WORK(&adv_instance->rpa_expired_cb,
3014 adv_instance_rpa_expired);
3015
3016 BT_DBG("%s for %dMR", hdev->name, instance);
3017
3018 return 0;
3019 }
3020
3021 /* This function requires the caller holds hdev->lock */
hci_adv_monitors_clear(struct hci_dev * hdev)3022 void hci_adv_monitors_clear(struct hci_dev *hdev)
3023 {
3024 struct adv_monitor *monitor;
3025 int handle;
3026
3027 idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
3028 hci_free_adv_monitor(monitor);
3029
3030 idr_destroy(&hdev->adv_monitors_idr);
3031 }
3032
hci_free_adv_monitor(struct adv_monitor * monitor)3033 void hci_free_adv_monitor(struct adv_monitor *monitor)
3034 {
3035 struct adv_pattern *pattern;
3036 struct adv_pattern *tmp;
3037
3038 if (!monitor)
3039 return;
3040
3041 list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list)
3042 kfree(pattern);
3043
3044 kfree(monitor);
3045 }
3046
3047 /* This function requires the caller holds hdev->lock */
hci_add_adv_monitor(struct hci_dev * hdev,struct adv_monitor * monitor)3048 int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
3049 {
3050 int min, max, handle;
3051
3052 if (!monitor)
3053 return -EINVAL;
3054
3055 min = HCI_MIN_ADV_MONITOR_HANDLE;
3056 max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES;
3057 handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max,
3058 GFP_KERNEL);
3059 if (handle < 0)
3060 return handle;
3061
3062 hdev->adv_monitors_cnt++;
3063 monitor->handle = handle;
3064
3065 hci_update_background_scan(hdev);
3066
3067 return 0;
3068 }
3069
free_adv_monitor(int id,void * ptr,void * data)3070 static int free_adv_monitor(int id, void *ptr, void *data)
3071 {
3072 struct hci_dev *hdev = data;
3073 struct adv_monitor *monitor = ptr;
3074
3075 idr_remove(&hdev->adv_monitors_idr, monitor->handle);
3076 hci_free_adv_monitor(monitor);
3077 hdev->adv_monitors_cnt--;
3078
3079 return 0;
3080 }
3081
3082 /* This function requires the caller holds hdev->lock */
hci_remove_adv_monitor(struct hci_dev * hdev,u16 handle)3083 int hci_remove_adv_monitor(struct hci_dev *hdev, u16 handle)
3084 {
3085 struct adv_monitor *monitor;
3086
3087 if (handle) {
3088 monitor = idr_find(&hdev->adv_monitors_idr, handle);
3089 if (!monitor)
3090 return -ENOENT;
3091
3092 idr_remove(&hdev->adv_monitors_idr, monitor->handle);
3093 hci_free_adv_monitor(monitor);
3094 hdev->adv_monitors_cnt--;
3095 } else {
3096 /* Remove all monitors if handle is 0. */
3097 idr_for_each(&hdev->adv_monitors_idr, &free_adv_monitor, hdev);
3098 }
3099
3100 hci_update_background_scan(hdev);
3101
3102 return 0;
3103 }
3104
3105 /* This function requires the caller holds hdev->lock */
hci_is_adv_monitoring(struct hci_dev * hdev)3106 bool hci_is_adv_monitoring(struct hci_dev *hdev)
3107 {
3108 return !idr_is_empty(&hdev->adv_monitors_idr);
3109 }
3110
hci_bdaddr_list_lookup(struct list_head * bdaddr_list,bdaddr_t * bdaddr,u8 type)3111 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
3112 bdaddr_t *bdaddr, u8 type)
3113 {
3114 struct bdaddr_list *b;
3115
3116 list_for_each_entry(b, bdaddr_list, list) {
3117 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3118 return b;
3119 }
3120
3121 return NULL;
3122 }
3123
hci_bdaddr_list_lookup_with_irk(struct list_head * bdaddr_list,bdaddr_t * bdaddr,u8 type)3124 struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
3125 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
3126 u8 type)
3127 {
3128 struct bdaddr_list_with_irk *b;
3129
3130 list_for_each_entry(b, bdaddr_list, list) {
3131 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3132 return b;
3133 }
3134
3135 return NULL;
3136 }
3137
3138 struct bdaddr_list_with_flags *
hci_bdaddr_list_lookup_with_flags(struct list_head * bdaddr_list,bdaddr_t * bdaddr,u8 type)3139 hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list,
3140 bdaddr_t *bdaddr, u8 type)
3141 {
3142 struct bdaddr_list_with_flags *b;
3143
3144 list_for_each_entry(b, bdaddr_list, list) {
3145 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
3146 return b;
3147 }
3148
3149 return NULL;
3150 }
3151
hci_bdaddr_list_clear(struct list_head * bdaddr_list)3152 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
3153 {
3154 struct bdaddr_list *b, *n;
3155
3156 list_for_each_entry_safe(b, n, bdaddr_list, list) {
3157 list_del(&b->list);
3158 kfree(b);
3159 }
3160 }
3161
hci_bdaddr_list_add(struct list_head * list,bdaddr_t * bdaddr,u8 type)3162 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
3163 {
3164 struct bdaddr_list *entry;
3165
3166 if (!bacmp(bdaddr, BDADDR_ANY))
3167 return -EBADF;
3168
3169 if (hci_bdaddr_list_lookup(list, bdaddr, type))
3170 return -EEXIST;
3171
3172 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3173 if (!entry)
3174 return -ENOMEM;
3175
3176 bacpy(&entry->bdaddr, bdaddr);
3177 entry->bdaddr_type = type;
3178
3179 list_add(&entry->list, list);
3180
3181 return 0;
3182 }
3183
hci_bdaddr_list_add_with_irk(struct list_head * list,bdaddr_t * bdaddr,u8 type,u8 * peer_irk,u8 * local_irk)3184 int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3185 u8 type, u8 *peer_irk, u8 *local_irk)
3186 {
3187 struct bdaddr_list_with_irk *entry;
3188
3189 if (!bacmp(bdaddr, BDADDR_ANY))
3190 return -EBADF;
3191
3192 if (hci_bdaddr_list_lookup(list, bdaddr, type))
3193 return -EEXIST;
3194
3195 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3196 if (!entry)
3197 return -ENOMEM;
3198
3199 bacpy(&entry->bdaddr, bdaddr);
3200 entry->bdaddr_type = type;
3201
3202 if (peer_irk)
3203 memcpy(entry->peer_irk, peer_irk, 16);
3204
3205 if (local_irk)
3206 memcpy(entry->local_irk, local_irk, 16);
3207
3208 list_add(&entry->list, list);
3209
3210 return 0;
3211 }
3212
hci_bdaddr_list_add_with_flags(struct list_head * list,bdaddr_t * bdaddr,u8 type,u32 flags)3213 int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr,
3214 u8 type, u32 flags)
3215 {
3216 struct bdaddr_list_with_flags *entry;
3217
3218 if (!bacmp(bdaddr, BDADDR_ANY))
3219 return -EBADF;
3220
3221 if (hci_bdaddr_list_lookup(list, bdaddr, type))
3222 return -EEXIST;
3223
3224 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
3225 if (!entry)
3226 return -ENOMEM;
3227
3228 bacpy(&entry->bdaddr, bdaddr);
3229 entry->bdaddr_type = type;
3230 entry->current_flags = flags;
3231
3232 list_add(&entry->list, list);
3233
3234 return 0;
3235 }
3236
hci_bdaddr_list_del(struct list_head * list,bdaddr_t * bdaddr,u8 type)3237 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
3238 {
3239 struct bdaddr_list *entry;
3240
3241 if (!bacmp(bdaddr, BDADDR_ANY)) {
3242 hci_bdaddr_list_clear(list);
3243 return 0;
3244 }
3245
3246 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
3247 if (!entry)
3248 return -ENOENT;
3249
3250 list_del(&entry->list);
3251 kfree(entry);
3252
3253 return 0;
3254 }
3255
hci_bdaddr_list_del_with_irk(struct list_head * list,bdaddr_t * bdaddr,u8 type)3256 int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3257 u8 type)
3258 {
3259 struct bdaddr_list_with_irk *entry;
3260
3261 if (!bacmp(bdaddr, BDADDR_ANY)) {
3262 hci_bdaddr_list_clear(list);
3263 return 0;
3264 }
3265
3266 entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
3267 if (!entry)
3268 return -ENOENT;
3269
3270 list_del(&entry->list);
3271 kfree(entry);
3272
3273 return 0;
3274 }
3275
hci_bdaddr_list_del_with_flags(struct list_head * list,bdaddr_t * bdaddr,u8 type)3276 int hci_bdaddr_list_del_with_flags(struct list_head *list, bdaddr_t *bdaddr,
3277 u8 type)
3278 {
3279 struct bdaddr_list_with_flags *entry;
3280
3281 if (!bacmp(bdaddr, BDADDR_ANY)) {
3282 hci_bdaddr_list_clear(list);
3283 return 0;
3284 }
3285
3286 entry = hci_bdaddr_list_lookup_with_flags(list, bdaddr, type);
3287 if (!entry)
3288 return -ENOENT;
3289
3290 list_del(&entry->list);
3291 kfree(entry);
3292
3293 return 0;
3294 }
3295
3296 /* This function requires the caller holds hdev->lock */
hci_conn_params_lookup(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type)3297 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
3298 bdaddr_t *addr, u8 addr_type)
3299 {
3300 struct hci_conn_params *params;
3301
3302 list_for_each_entry(params, &hdev->le_conn_params, list) {
3303 if (bacmp(¶ms->addr, addr) == 0 &&
3304 params->addr_type == addr_type) {
3305 return params;
3306 }
3307 }
3308
3309 return NULL;
3310 }
3311
3312 /* This function requires the caller holds hdev->lock */
hci_pend_le_action_lookup(struct list_head * list,bdaddr_t * addr,u8 addr_type)3313 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
3314 bdaddr_t *addr, u8 addr_type)
3315 {
3316 struct hci_conn_params *param;
3317
3318 switch (addr_type) {
3319 case ADDR_LE_DEV_PUBLIC_RESOLVED:
3320 addr_type = ADDR_LE_DEV_PUBLIC;
3321 break;
3322 case ADDR_LE_DEV_RANDOM_RESOLVED:
3323 addr_type = ADDR_LE_DEV_RANDOM;
3324 break;
3325 }
3326
3327 list_for_each_entry(param, list, action) {
3328 if (bacmp(¶m->addr, addr) == 0 &&
3329 param->addr_type == addr_type)
3330 return param;
3331 }
3332
3333 return NULL;
3334 }
3335
3336 /* This function requires the caller holds hdev->lock */
hci_conn_params_add(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type)3337 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
3338 bdaddr_t *addr, u8 addr_type)
3339 {
3340 struct hci_conn_params *params;
3341
3342 params = hci_conn_params_lookup(hdev, addr, addr_type);
3343 if (params)
3344 return params;
3345
3346 params = kzalloc(sizeof(*params), GFP_KERNEL);
3347 if (!params) {
3348 bt_dev_err(hdev, "out of memory");
3349 return NULL;
3350 }
3351
3352 bacpy(¶ms->addr, addr);
3353 params->addr_type = addr_type;
3354
3355 list_add(¶ms->list, &hdev->le_conn_params);
3356 INIT_LIST_HEAD(¶ms->action);
3357
3358 params->conn_min_interval = hdev->le_conn_min_interval;
3359 params->conn_max_interval = hdev->le_conn_max_interval;
3360 params->conn_latency = hdev->le_conn_latency;
3361 params->supervision_timeout = hdev->le_supv_timeout;
3362 params->auto_connect = HCI_AUTO_CONN_DISABLED;
3363
3364 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3365
3366 return params;
3367 }
3368
hci_conn_params_free(struct hci_conn_params * params)3369 static void hci_conn_params_free(struct hci_conn_params *params)
3370 {
3371 if (params->conn) {
3372 hci_conn_drop(params->conn);
3373 hci_conn_put(params->conn);
3374 }
3375
3376 list_del(¶ms->action);
3377 list_del(¶ms->list);
3378 kfree(params);
3379 }
3380
3381 /* This function requires the caller holds hdev->lock */
hci_conn_params_del(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type)3382 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3383 {
3384 struct hci_conn_params *params;
3385
3386 params = hci_conn_params_lookup(hdev, addr, addr_type);
3387 if (!params)
3388 return;
3389
3390 hci_conn_params_free(params);
3391
3392 hci_update_background_scan(hdev);
3393
3394 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3395 }
3396
3397 /* This function requires the caller holds hdev->lock */
hci_conn_params_clear_disabled(struct hci_dev * hdev)3398 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
3399 {
3400 struct hci_conn_params *params, *tmp;
3401
3402 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3403 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3404 continue;
3405
3406 /* If trying to estabilish one time connection to disabled
3407 * device, leave the params, but mark them as just once.
3408 */
3409 if (params->explicit_connect) {
3410 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3411 continue;
3412 }
3413
3414 list_del(¶ms->list);
3415 kfree(params);
3416 }
3417
3418 BT_DBG("All LE disabled connection parameters were removed");
3419 }
3420
3421 /* This function requires the caller holds hdev->lock */
hci_conn_params_clear_all(struct hci_dev * hdev)3422 static void hci_conn_params_clear_all(struct hci_dev *hdev)
3423 {
3424 struct hci_conn_params *params, *tmp;
3425
3426 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
3427 hci_conn_params_free(params);
3428
3429 BT_DBG("All LE connection parameters were removed");
3430 }
3431
3432 /* Copy the Identity Address of the controller.
3433 *
3434 * If the controller has a public BD_ADDR, then by default use that one.
3435 * If this is a LE only controller without a public address, default to
3436 * the static random address.
3437 *
3438 * For debugging purposes it is possible to force controllers with a
3439 * public address to use the static random address instead.
3440 *
3441 * In case BR/EDR has been disabled on a dual-mode controller and
3442 * userspace has configured a static address, then that address
3443 * becomes the identity address instead of the public BR/EDR address.
3444 */
hci_copy_identity_address(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 * bdaddr_type)3445 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3446 u8 *bdaddr_type)
3447 {
3448 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
3449 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
3450 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3451 bacmp(&hdev->static_addr, BDADDR_ANY))) {
3452 bacpy(bdaddr, &hdev->static_addr);
3453 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3454 } else {
3455 bacpy(bdaddr, &hdev->bdaddr);
3456 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3457 }
3458 }
3459
hci_suspend_clear_tasks(struct hci_dev * hdev)3460 static void hci_suspend_clear_tasks(struct hci_dev *hdev)
3461 {
3462 int i;
3463
3464 for (i = 0; i < __SUSPEND_NUM_TASKS; i++)
3465 clear_bit(i, hdev->suspend_tasks);
3466
3467 wake_up(&hdev->suspend_wait_q);
3468 }
3469
hci_suspend_wait_event(struct hci_dev * hdev)3470 static int hci_suspend_wait_event(struct hci_dev *hdev)
3471 {
3472 #define WAKE_COND \
3473 (find_first_bit(hdev->suspend_tasks, __SUSPEND_NUM_TASKS) == \
3474 __SUSPEND_NUM_TASKS)
3475
3476 int i;
3477 int ret = wait_event_timeout(hdev->suspend_wait_q,
3478 WAKE_COND, SUSPEND_NOTIFIER_TIMEOUT);
3479
3480 if (ret == 0) {
3481 bt_dev_err(hdev, "Timed out waiting for suspend events");
3482 for (i = 0; i < __SUSPEND_NUM_TASKS; ++i) {
3483 if (test_bit(i, hdev->suspend_tasks))
3484 bt_dev_err(hdev, "Suspend timeout bit: %d", i);
3485 clear_bit(i, hdev->suspend_tasks);
3486 }
3487
3488 ret = -ETIMEDOUT;
3489 } else {
3490 ret = 0;
3491 }
3492
3493 return ret;
3494 }
3495
hci_prepare_suspend(struct work_struct * work)3496 static void hci_prepare_suspend(struct work_struct *work)
3497 {
3498 struct hci_dev *hdev =
3499 container_of(work, struct hci_dev, suspend_prepare);
3500
3501 hci_dev_lock(hdev);
3502 hci_req_prepare_suspend(hdev, hdev->suspend_state_next);
3503 hci_dev_unlock(hdev);
3504 }
3505
hci_change_suspend_state(struct hci_dev * hdev,enum suspended_state next)3506 static int hci_change_suspend_state(struct hci_dev *hdev,
3507 enum suspended_state next)
3508 {
3509 hdev->suspend_state_next = next;
3510 set_bit(SUSPEND_PREPARE_NOTIFIER, hdev->suspend_tasks);
3511 queue_work(hdev->req_workqueue, &hdev->suspend_prepare);
3512 return hci_suspend_wait_event(hdev);
3513 }
3514
hci_clear_wake_reason(struct hci_dev * hdev)3515 static void hci_clear_wake_reason(struct hci_dev *hdev)
3516 {
3517 hci_dev_lock(hdev);
3518
3519 hdev->wake_reason = 0;
3520 bacpy(&hdev->wake_addr, BDADDR_ANY);
3521 hdev->wake_addr_type = 0;
3522
3523 hci_dev_unlock(hdev);
3524 }
3525
hci_suspend_notifier(struct notifier_block * nb,unsigned long action,void * data)3526 static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
3527 void *data)
3528 {
3529 struct hci_dev *hdev =
3530 container_of(nb, struct hci_dev, suspend_notifier);
3531 int ret = 0;
3532 u8 state = BT_RUNNING;
3533
3534 /* If powering down, wait for completion. */
3535 if (mgmt_powering_down(hdev)) {
3536 set_bit(SUSPEND_POWERING_DOWN, hdev->suspend_tasks);
3537 ret = hci_suspend_wait_event(hdev);
3538 if (ret)
3539 goto done;
3540 }
3541
3542 /* Suspend notifier should only act on events when powered. */
3543 if (!hdev_is_powered(hdev) ||
3544 hci_dev_test_flag(hdev, HCI_UNREGISTER))
3545 goto done;
3546
3547 if (action == PM_SUSPEND_PREPARE) {
3548 /* Suspend consists of two actions:
3549 * - First, disconnect everything and make the controller not
3550 * connectable (disabling scanning)
3551 * - Second, program event filter/whitelist and enable scan
3552 */
3553 ret = hci_change_suspend_state(hdev, BT_SUSPEND_DISCONNECT);
3554 if (!ret)
3555 state = BT_SUSPEND_DISCONNECT;
3556
3557 /* Only configure whitelist if disconnect succeeded and wake
3558 * isn't being prevented.
3559 */
3560 if (!ret && !(hdev->prevent_wake && hdev->prevent_wake(hdev))) {
3561 ret = hci_change_suspend_state(hdev,
3562 BT_SUSPEND_CONFIGURE_WAKE);
3563 if (!ret)
3564 state = BT_SUSPEND_CONFIGURE_WAKE;
3565 }
3566
3567 hci_clear_wake_reason(hdev);
3568 mgmt_suspending(hdev, state);
3569
3570 } else if (action == PM_POST_SUSPEND) {
3571 ret = hci_change_suspend_state(hdev, BT_RUNNING);
3572
3573 mgmt_resuming(hdev, hdev->wake_reason, &hdev->wake_addr,
3574 hdev->wake_addr_type);
3575 }
3576
3577 done:
3578 /* We always allow suspend even if suspend preparation failed and
3579 * attempt to recover in resume.
3580 */
3581 if (ret)
3582 bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
3583 action, ret);
3584
3585 return NOTIFY_DONE;
3586 }
3587
3588 /* Alloc HCI device */
hci_alloc_dev(void)3589 struct hci_dev *hci_alloc_dev(void)
3590 {
3591 struct hci_dev *hdev;
3592
3593 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3594 if (!hdev)
3595 return NULL;
3596
3597 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3598 hdev->esco_type = (ESCO_HV1);
3599 hdev->link_mode = (HCI_LM_ACCEPT);
3600 hdev->num_iac = 0x01; /* One IAC support is mandatory */
3601 hdev->io_capability = 0x03; /* No Input No Output */
3602 hdev->manufacturer = 0xffff; /* Default to internal use */
3603 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3604 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3605 hdev->adv_instance_cnt = 0;
3606 hdev->cur_adv_instance = 0x00;
3607 hdev->adv_instance_timeout = 0;
3608
3609 hdev->sniff_max_interval = 800;
3610 hdev->sniff_min_interval = 80;
3611
3612 hdev->le_adv_channel_map = 0x07;
3613 hdev->le_adv_min_interval = 0x0800;
3614 hdev->le_adv_max_interval = 0x0800;
3615 hdev->le_scan_interval = 0x0060;
3616 hdev->le_scan_window = 0x0030;
3617 hdev->le_scan_int_suspend = 0x0400;
3618 hdev->le_scan_window_suspend = 0x0012;
3619 hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT;
3620 hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN;
3621 hdev->le_scan_int_connect = 0x0060;
3622 hdev->le_scan_window_connect = 0x0060;
3623 hdev->le_conn_min_interval = 0x0018;
3624 hdev->le_conn_max_interval = 0x0028;
3625 hdev->le_conn_latency = 0x0000;
3626 hdev->le_supv_timeout = 0x002a;
3627 hdev->le_def_tx_len = 0x001b;
3628 hdev->le_def_tx_time = 0x0148;
3629 hdev->le_max_tx_len = 0x001b;
3630 hdev->le_max_tx_time = 0x0148;
3631 hdev->le_max_rx_len = 0x001b;
3632 hdev->le_max_rx_time = 0x0148;
3633 hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
3634 hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
3635 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
3636 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
3637 hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
3638 hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
3639 hdev->def_le_autoconnect_timeout = HCI_LE_AUTOCONN_TIMEOUT;
3640
3641 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3642 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3643 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3644 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3645 hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
3646 hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
3647
3648 /* default 1.28 sec page scan */
3649 hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;
3650 hdev->def_page_scan_int = 0x0800;
3651 hdev->def_page_scan_window = 0x0012;
3652
3653 mutex_init(&hdev->lock);
3654 mutex_init(&hdev->req_lock);
3655
3656 INIT_LIST_HEAD(&hdev->mgmt_pending);
3657 INIT_LIST_HEAD(&hdev->blacklist);
3658 INIT_LIST_HEAD(&hdev->whitelist);
3659 INIT_LIST_HEAD(&hdev->uuids);
3660 INIT_LIST_HEAD(&hdev->link_keys);
3661 INIT_LIST_HEAD(&hdev->long_term_keys);
3662 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3663 INIT_LIST_HEAD(&hdev->remote_oob_data);
3664 INIT_LIST_HEAD(&hdev->le_white_list);
3665 INIT_LIST_HEAD(&hdev->le_resolv_list);
3666 INIT_LIST_HEAD(&hdev->le_conn_params);
3667 INIT_LIST_HEAD(&hdev->pend_le_conns);
3668 INIT_LIST_HEAD(&hdev->pend_le_reports);
3669 INIT_LIST_HEAD(&hdev->conn_hash.list);
3670 INIT_LIST_HEAD(&hdev->adv_instances);
3671 INIT_LIST_HEAD(&hdev->blocked_keys);
3672
3673 INIT_WORK(&hdev->rx_work, hci_rx_work);
3674 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3675 INIT_WORK(&hdev->tx_work, hci_tx_work);
3676 INIT_WORK(&hdev->power_on, hci_power_on);
3677 INIT_WORK(&hdev->error_reset, hci_error_reset);
3678 INIT_WORK(&hdev->suspend_prepare, hci_prepare_suspend);
3679
3680 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3681
3682 skb_queue_head_init(&hdev->rx_q);
3683 skb_queue_head_init(&hdev->cmd_q);
3684 skb_queue_head_init(&hdev->raw_q);
3685
3686 init_waitqueue_head(&hdev->req_wait_q);
3687 init_waitqueue_head(&hdev->suspend_wait_q);
3688
3689 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3690
3691 hci_request_setup(hdev);
3692
3693 hci_init_sysfs(hdev);
3694 discovery_init(hdev);
3695
3696 return hdev;
3697 }
3698 EXPORT_SYMBOL(hci_alloc_dev);
3699
3700 /* Free HCI device */
hci_free_dev(struct hci_dev * hdev)3701 void hci_free_dev(struct hci_dev *hdev)
3702 {
3703 /* will free via device release */
3704 put_device(&hdev->dev);
3705 }
3706 EXPORT_SYMBOL(hci_free_dev);
3707
3708 /* Register HCI device */
hci_register_dev(struct hci_dev * hdev)3709 int hci_register_dev(struct hci_dev *hdev)
3710 {
3711 int id, error;
3712
3713 if (!hdev->open || !hdev->close || !hdev->send)
3714 return -EINVAL;
3715
3716 /* Do not allow HCI_AMP devices to register at index 0,
3717 * so the index can be used as the AMP controller ID.
3718 */
3719 switch (hdev->dev_type) {
3720 case HCI_PRIMARY:
3721 id = ida_simple_get(&hci_index_ida, 0, HCI_MAX_ID, GFP_KERNEL);
3722 break;
3723 case HCI_AMP:
3724 id = ida_simple_get(&hci_index_ida, 1, HCI_MAX_ID, GFP_KERNEL);
3725 break;
3726 default:
3727 return -EINVAL;
3728 }
3729
3730 if (id < 0)
3731 return id;
3732
3733 snprintf(hdev->name, sizeof(hdev->name), "hci%d", id);
3734 hdev->id = id;
3735
3736 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3737
3738 hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
3739 if (!hdev->workqueue) {
3740 error = -ENOMEM;
3741 goto err;
3742 }
3743
3744 hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
3745 hdev->name);
3746 if (!hdev->req_workqueue) {
3747 destroy_workqueue(hdev->workqueue);
3748 error = -ENOMEM;
3749 goto err;
3750 }
3751
3752 if (!IS_ERR_OR_NULL(bt_debugfs))
3753 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3754
3755 dev_set_name(&hdev->dev, "%s", hdev->name);
3756
3757 error = device_add(&hdev->dev);
3758 if (error < 0)
3759 goto err_wqueue;
3760
3761 hci_leds_init(hdev);
3762
3763 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3764 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3765 hdev);
3766 if (hdev->rfkill) {
3767 if (rfkill_register(hdev->rfkill) < 0) {
3768 rfkill_destroy(hdev->rfkill);
3769 hdev->rfkill = NULL;
3770 }
3771 }
3772
3773 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3774 hci_dev_set_flag(hdev, HCI_RFKILLED);
3775
3776 hci_dev_set_flag(hdev, HCI_SETUP);
3777 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3778
3779 if (hdev->dev_type == HCI_PRIMARY) {
3780 /* Assume BR/EDR support until proven otherwise (such as
3781 * through reading supported features during init.
3782 */
3783 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3784 }
3785
3786 write_lock(&hci_dev_list_lock);
3787 list_add(&hdev->list, &hci_dev_list);
3788 write_unlock(&hci_dev_list_lock);
3789
3790 /* Devices that are marked for raw-only usage are unconfigured
3791 * and should not be included in normal operation.
3792 */
3793 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3794 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3795
3796 hci_sock_dev_event(hdev, HCI_DEV_REG);
3797 hci_dev_hold(hdev);
3798
3799 if (!hdev->suspend_notifier.notifier_call &&
3800 !test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
3801 hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
3802 error = register_pm_notifier(&hdev->suspend_notifier);
3803 if (error)
3804 goto err_wqueue;
3805 }
3806
3807 queue_work(hdev->req_workqueue, &hdev->power_on);
3808
3809 idr_init(&hdev->adv_monitors_idr);
3810
3811 return id;
3812
3813 err_wqueue:
3814 debugfs_remove_recursive(hdev->debugfs);
3815 destroy_workqueue(hdev->workqueue);
3816 destroy_workqueue(hdev->req_workqueue);
3817 err:
3818 ida_simple_remove(&hci_index_ida, hdev->id);
3819
3820 return error;
3821 }
3822 EXPORT_SYMBOL(hci_register_dev);
3823
3824 /* Unregister HCI device */
hci_unregister_dev(struct hci_dev * hdev)3825 void hci_unregister_dev(struct hci_dev *hdev)
3826 {
3827 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3828
3829 hci_dev_set_flag(hdev, HCI_UNREGISTER);
3830
3831 write_lock(&hci_dev_list_lock);
3832 list_del(&hdev->list);
3833 write_unlock(&hci_dev_list_lock);
3834
3835 cancel_work_sync(&hdev->power_on);
3836
3837 if (!test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
3838 hci_suspend_clear_tasks(hdev);
3839 unregister_pm_notifier(&hdev->suspend_notifier);
3840 cancel_work_sync(&hdev->suspend_prepare);
3841 }
3842
3843 hci_dev_do_close(hdev);
3844
3845 if (!test_bit(HCI_INIT, &hdev->flags) &&
3846 !hci_dev_test_flag(hdev, HCI_SETUP) &&
3847 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
3848 hci_dev_lock(hdev);
3849 mgmt_index_removed(hdev);
3850 hci_dev_unlock(hdev);
3851 }
3852
3853 /* mgmt_index_removed should take care of emptying the
3854 * pending list */
3855 BUG_ON(!list_empty(&hdev->mgmt_pending));
3856
3857 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
3858
3859 if (hdev->rfkill) {
3860 rfkill_unregister(hdev->rfkill);
3861 rfkill_destroy(hdev->rfkill);
3862 }
3863
3864 device_del(&hdev->dev);
3865 /* Actual cleanup is deferred until hci_cleanup_dev(). */
3866 hci_dev_put(hdev);
3867 }
3868 EXPORT_SYMBOL(hci_unregister_dev);
3869
3870 /* Cleanup HCI device */
hci_cleanup_dev(struct hci_dev * hdev)3871 void hci_cleanup_dev(struct hci_dev *hdev)
3872 {
3873 debugfs_remove_recursive(hdev->debugfs);
3874 kfree_const(hdev->hw_info);
3875 kfree_const(hdev->fw_info);
3876
3877 destroy_workqueue(hdev->workqueue);
3878 destroy_workqueue(hdev->req_workqueue);
3879
3880 hci_dev_lock(hdev);
3881 hci_bdaddr_list_clear(&hdev->blacklist);
3882 hci_bdaddr_list_clear(&hdev->whitelist);
3883 hci_uuids_clear(hdev);
3884 hci_link_keys_clear(hdev);
3885 hci_smp_ltks_clear(hdev);
3886 hci_smp_irks_clear(hdev);
3887 hci_remote_oob_data_clear(hdev);
3888 hci_adv_instances_clear(hdev);
3889 hci_adv_monitors_clear(hdev);
3890 hci_bdaddr_list_clear(&hdev->le_white_list);
3891 hci_bdaddr_list_clear(&hdev->le_resolv_list);
3892 hci_conn_params_clear_all(hdev);
3893 hci_discovery_filter_clear(hdev);
3894 hci_blocked_keys_clear(hdev);
3895 hci_dev_unlock(hdev);
3896
3897 ida_simple_remove(&hci_index_ida, hdev->id);
3898 }
3899
3900 /* Suspend HCI device */
hci_suspend_dev(struct hci_dev * hdev)3901 int hci_suspend_dev(struct hci_dev *hdev)
3902 {
3903 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
3904 return 0;
3905 }
3906 EXPORT_SYMBOL(hci_suspend_dev);
3907
3908 /* Resume HCI device */
hci_resume_dev(struct hci_dev * hdev)3909 int hci_resume_dev(struct hci_dev *hdev)
3910 {
3911 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
3912 return 0;
3913 }
3914 EXPORT_SYMBOL(hci_resume_dev);
3915
3916 /* Reset HCI device */
hci_reset_dev(struct hci_dev * hdev)3917 int hci_reset_dev(struct hci_dev *hdev)
3918 {
3919 static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3920 struct sk_buff *skb;
3921
3922 skb = bt_skb_alloc(3, GFP_ATOMIC);
3923 if (!skb)
3924 return -ENOMEM;
3925
3926 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
3927 skb_put_data(skb, hw_err, 3);
3928
3929 /* Send Hardware Error to upper stack */
3930 return hci_recv_frame(hdev, skb);
3931 }
3932 EXPORT_SYMBOL(hci_reset_dev);
3933
3934 /* Receive frame from HCI drivers */
hci_recv_frame(struct hci_dev * hdev,struct sk_buff * skb)3935 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
3936 {
3937 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
3938 && !test_bit(HCI_INIT, &hdev->flags))) {
3939 kfree_skb(skb);
3940 return -ENXIO;
3941 }
3942
3943 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
3944 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
3945 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT &&
3946 hci_skb_pkt_type(skb) != HCI_ISODATA_PKT) {
3947 kfree_skb(skb);
3948 return -EINVAL;
3949 }
3950
3951 /* Incoming skb */
3952 bt_cb(skb)->incoming = 1;
3953
3954 /* Time stamp */
3955 __net_timestamp(skb);
3956
3957 skb_queue_tail(&hdev->rx_q, skb);
3958 queue_work(hdev->workqueue, &hdev->rx_work);
3959
3960 return 0;
3961 }
3962 EXPORT_SYMBOL(hci_recv_frame);
3963
3964 /* Receive diagnostic message from HCI drivers */
hci_recv_diag(struct hci_dev * hdev,struct sk_buff * skb)3965 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
3966 {
3967 /* Mark as diagnostic packet */
3968 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
3969
3970 /* Time stamp */
3971 __net_timestamp(skb);
3972
3973 skb_queue_tail(&hdev->rx_q, skb);
3974 queue_work(hdev->workqueue, &hdev->rx_work);
3975
3976 return 0;
3977 }
3978 EXPORT_SYMBOL(hci_recv_diag);
3979
hci_set_hw_info(struct hci_dev * hdev,const char * fmt,...)3980 void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
3981 {
3982 va_list vargs;
3983
3984 va_start(vargs, fmt);
3985 kfree_const(hdev->hw_info);
3986 hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3987 va_end(vargs);
3988 }
3989 EXPORT_SYMBOL(hci_set_hw_info);
3990
hci_set_fw_info(struct hci_dev * hdev,const char * fmt,...)3991 void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
3992 {
3993 va_list vargs;
3994
3995 va_start(vargs, fmt);
3996 kfree_const(hdev->fw_info);
3997 hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3998 va_end(vargs);
3999 }
4000 EXPORT_SYMBOL(hci_set_fw_info);
4001
4002 /* ---- Interface to upper protocols ---- */
4003
hci_register_cb(struct hci_cb * cb)4004 int hci_register_cb(struct hci_cb *cb)
4005 {
4006 BT_DBG("%p name %s", cb, cb->name);
4007
4008 mutex_lock(&hci_cb_list_lock);
4009 list_add_tail(&cb->list, &hci_cb_list);
4010 mutex_unlock(&hci_cb_list_lock);
4011
4012 return 0;
4013 }
4014 EXPORT_SYMBOL(hci_register_cb);
4015
hci_unregister_cb(struct hci_cb * cb)4016 int hci_unregister_cb(struct hci_cb *cb)
4017 {
4018 BT_DBG("%p name %s", cb, cb->name);
4019
4020 mutex_lock(&hci_cb_list_lock);
4021 list_del(&cb->list);
4022 mutex_unlock(&hci_cb_list_lock);
4023
4024 return 0;
4025 }
4026 EXPORT_SYMBOL(hci_unregister_cb);
4027
hci_send_frame(struct hci_dev * hdev,struct sk_buff * skb)4028 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
4029 {
4030 int err;
4031
4032 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
4033 skb->len);
4034
4035 /* Time stamp */
4036 __net_timestamp(skb);
4037
4038 /* Send copy to monitor */
4039 hci_send_to_monitor(hdev, skb);
4040
4041 if (atomic_read(&hdev->promisc)) {
4042 /* Send copy to the sockets */
4043 hci_send_to_sock(hdev, skb);
4044 }
4045
4046 /* Get rid of skb owner, prior to sending to the driver. */
4047 skb_orphan(skb);
4048
4049 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
4050 kfree_skb(skb);
4051 return;
4052 }
4053
4054 err = hdev->send(hdev, skb);
4055 if (err < 0) {
4056 bt_dev_err(hdev, "sending frame failed (%d)", err);
4057 kfree_skb(skb);
4058 }
4059 }
4060
4061 /* Send HCI command */
hci_send_cmd(struct hci_dev * hdev,__u16 opcode,__u32 plen,const void * param)4062 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
4063 const void *param)
4064 {
4065 struct sk_buff *skb;
4066
4067 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
4068
4069 skb = hci_prepare_cmd(hdev, opcode, plen, param);
4070 if (!skb) {
4071 bt_dev_err(hdev, "no memory for command");
4072 return -ENOMEM;
4073 }
4074
4075 /* Stand-alone HCI commands must be flagged as
4076 * single-command requests.
4077 */
4078 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
4079
4080 skb_queue_tail(&hdev->cmd_q, skb);
4081 queue_work(hdev->workqueue, &hdev->cmd_work);
4082
4083 return 0;
4084 }
4085
__hci_cmd_send(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param)4086 int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
4087 const void *param)
4088 {
4089 struct sk_buff *skb;
4090
4091 if (hci_opcode_ogf(opcode) != 0x3f) {
4092 /* A controller receiving a command shall respond with either
4093 * a Command Status Event or a Command Complete Event.
4094 * Therefore, all standard HCI commands must be sent via the
4095 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
4096 * Some vendors do not comply with this rule for vendor-specific
4097 * commands and do not return any event. We want to support
4098 * unresponded commands for such cases only.
4099 */
4100 bt_dev_err(hdev, "unresponded command not supported");
4101 return -EINVAL;
4102 }
4103
4104 skb = hci_prepare_cmd(hdev, opcode, plen, param);
4105 if (!skb) {
4106 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
4107 opcode);
4108 return -ENOMEM;
4109 }
4110
4111 hci_send_frame(hdev, skb);
4112
4113 return 0;
4114 }
4115 EXPORT_SYMBOL(__hci_cmd_send);
4116
4117 /* Get data from the previously sent command */
hci_sent_cmd_data(struct hci_dev * hdev,__u16 opcode)4118 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
4119 {
4120 struct hci_command_hdr *hdr;
4121
4122 if (!hdev->sent_cmd)
4123 return NULL;
4124
4125 hdr = (void *) hdev->sent_cmd->data;
4126
4127 if (hdr->opcode != cpu_to_le16(opcode))
4128 return NULL;
4129
4130 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
4131
4132 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
4133 }
4134
4135 /* Send HCI command and wait for command commplete event */
hci_cmd_sync(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param,u32 timeout)4136 struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
4137 const void *param, u32 timeout)
4138 {
4139 struct sk_buff *skb;
4140
4141 if (!test_bit(HCI_UP, &hdev->flags))
4142 return ERR_PTR(-ENETDOWN);
4143
4144 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
4145
4146 hci_req_sync_lock(hdev);
4147 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
4148 hci_req_sync_unlock(hdev);
4149
4150 return skb;
4151 }
4152 EXPORT_SYMBOL(hci_cmd_sync);
4153
4154 /* Send ACL data */
hci_add_acl_hdr(struct sk_buff * skb,__u16 handle,__u16 flags)4155 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
4156 {
4157 struct hci_acl_hdr *hdr;
4158 int len = skb->len;
4159
4160 skb_push(skb, HCI_ACL_HDR_SIZE);
4161 skb_reset_transport_header(skb);
4162 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
4163 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
4164 hdr->dlen = cpu_to_le16(len);
4165 }
4166
hci_queue_acl(struct hci_chan * chan,struct sk_buff_head * queue,struct sk_buff * skb,__u16 flags)4167 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
4168 struct sk_buff *skb, __u16 flags)
4169 {
4170 struct hci_conn *conn = chan->conn;
4171 struct hci_dev *hdev = conn->hdev;
4172 struct sk_buff *list;
4173
4174 skb->len = skb_headlen(skb);
4175 skb->data_len = 0;
4176
4177 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
4178
4179 switch (hdev->dev_type) {
4180 case HCI_PRIMARY:
4181 hci_add_acl_hdr(skb, conn->handle, flags);
4182 break;
4183 case HCI_AMP:
4184 hci_add_acl_hdr(skb, chan->handle, flags);
4185 break;
4186 default:
4187 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
4188 return;
4189 }
4190
4191 list = skb_shinfo(skb)->frag_list;
4192 if (!list) {
4193 /* Non fragmented */
4194 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
4195
4196 skb_queue_tail(queue, skb);
4197 } else {
4198 /* Fragmented */
4199 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4200
4201 skb_shinfo(skb)->frag_list = NULL;
4202
4203 /* Queue all fragments atomically. We need to use spin_lock_bh
4204 * here because of 6LoWPAN links, as there this function is
4205 * called from softirq and using normal spin lock could cause
4206 * deadlocks.
4207 */
4208 spin_lock_bh(&queue->lock);
4209
4210 __skb_queue_tail(queue, skb);
4211
4212 flags &= ~ACL_START;
4213 flags |= ACL_CONT;
4214 do {
4215 skb = list; list = list->next;
4216
4217 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
4218 hci_add_acl_hdr(skb, conn->handle, flags);
4219
4220 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
4221
4222 __skb_queue_tail(queue, skb);
4223 } while (list);
4224
4225 spin_unlock_bh(&queue->lock);
4226 }
4227 }
4228
hci_send_acl(struct hci_chan * chan,struct sk_buff * skb,__u16 flags)4229 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
4230 {
4231 struct hci_dev *hdev = chan->conn->hdev;
4232
4233 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
4234
4235 hci_queue_acl(chan, &chan->data_q, skb, flags);
4236
4237 queue_work(hdev->workqueue, &hdev->tx_work);
4238 }
4239
4240 /* Send SCO data */
hci_send_sco(struct hci_conn * conn,struct sk_buff * skb)4241 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
4242 {
4243 struct hci_dev *hdev = conn->hdev;
4244 struct hci_sco_hdr hdr;
4245
4246 BT_DBG("%s len %d", hdev->name, skb->len);
4247
4248 hdr.handle = cpu_to_le16(conn->handle);
4249 hdr.dlen = skb->len;
4250
4251 skb_push(skb, HCI_SCO_HDR_SIZE);
4252 skb_reset_transport_header(skb);
4253 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
4254
4255 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
4256
4257 skb_queue_tail(&conn->data_q, skb);
4258 queue_work(hdev->workqueue, &hdev->tx_work);
4259 }
4260
4261 /* ---- HCI TX task (outgoing data) ---- */
4262
4263 /* HCI Connection scheduler */
hci_low_sent(struct hci_dev * hdev,__u8 type,int * quote)4264 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
4265 int *quote)
4266 {
4267 struct hci_conn_hash *h = &hdev->conn_hash;
4268 struct hci_conn *conn = NULL, *c;
4269 unsigned int num = 0, min = ~0;
4270
4271 /* We don't have to lock device here. Connections are always
4272 * added and removed with TX task disabled. */
4273
4274 rcu_read_lock();
4275
4276 list_for_each_entry_rcu(c, &h->list, list) {
4277 if (c->type != type || skb_queue_empty(&c->data_q))
4278 continue;
4279
4280 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
4281 continue;
4282
4283 num++;
4284
4285 if (c->sent < min) {
4286 min = c->sent;
4287 conn = c;
4288 }
4289
4290 if (hci_conn_num(hdev, type) == num)
4291 break;
4292 }
4293
4294 rcu_read_unlock();
4295
4296 if (conn) {
4297 int cnt, q;
4298
4299 switch (conn->type) {
4300 case ACL_LINK:
4301 cnt = hdev->acl_cnt;
4302 break;
4303 case SCO_LINK:
4304 case ESCO_LINK:
4305 cnt = hdev->sco_cnt;
4306 break;
4307 case LE_LINK:
4308 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4309 break;
4310 default:
4311 cnt = 0;
4312 bt_dev_err(hdev, "unknown link type %d", conn->type);
4313 }
4314
4315 q = cnt / num;
4316 *quote = q ? q : 1;
4317 } else
4318 *quote = 0;
4319
4320 BT_DBG("conn %p quote %d", conn, *quote);
4321 return conn;
4322 }
4323
hci_link_tx_to(struct hci_dev * hdev,__u8 type)4324 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
4325 {
4326 struct hci_conn_hash *h = &hdev->conn_hash;
4327 struct hci_conn *c;
4328
4329 bt_dev_err(hdev, "link tx timeout");
4330
4331 rcu_read_lock();
4332
4333 /* Kill stalled connections */
4334 list_for_each_entry_rcu(c, &h->list, list) {
4335 if (c->type == type && c->sent) {
4336 bt_dev_err(hdev, "killing stalled connection %pMR",
4337 &c->dst);
4338 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
4339 }
4340 }
4341
4342 rcu_read_unlock();
4343 }
4344
hci_chan_sent(struct hci_dev * hdev,__u8 type,int * quote)4345 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
4346 int *quote)
4347 {
4348 struct hci_conn_hash *h = &hdev->conn_hash;
4349 struct hci_chan *chan = NULL;
4350 unsigned int num = 0, min = ~0, cur_prio = 0;
4351 struct hci_conn *conn;
4352 int cnt, q, conn_num = 0;
4353
4354 BT_DBG("%s", hdev->name);
4355
4356 rcu_read_lock();
4357
4358 list_for_each_entry_rcu(conn, &h->list, list) {
4359 struct hci_chan *tmp;
4360
4361 if (conn->type != type)
4362 continue;
4363
4364 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4365 continue;
4366
4367 conn_num++;
4368
4369 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
4370 struct sk_buff *skb;
4371
4372 if (skb_queue_empty(&tmp->data_q))
4373 continue;
4374
4375 skb = skb_peek(&tmp->data_q);
4376 if (skb->priority < cur_prio)
4377 continue;
4378
4379 if (skb->priority > cur_prio) {
4380 num = 0;
4381 min = ~0;
4382 cur_prio = skb->priority;
4383 }
4384
4385 num++;
4386
4387 if (conn->sent < min) {
4388 min = conn->sent;
4389 chan = tmp;
4390 }
4391 }
4392
4393 if (hci_conn_num(hdev, type) == conn_num)
4394 break;
4395 }
4396
4397 rcu_read_unlock();
4398
4399 if (!chan)
4400 return NULL;
4401
4402 switch (chan->conn->type) {
4403 case ACL_LINK:
4404 cnt = hdev->acl_cnt;
4405 break;
4406 case AMP_LINK:
4407 cnt = hdev->block_cnt;
4408 break;
4409 case SCO_LINK:
4410 case ESCO_LINK:
4411 cnt = hdev->sco_cnt;
4412 break;
4413 case LE_LINK:
4414 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
4415 break;
4416 default:
4417 cnt = 0;
4418 bt_dev_err(hdev, "unknown link type %d", chan->conn->type);
4419 }
4420
4421 q = cnt / num;
4422 *quote = q ? q : 1;
4423 BT_DBG("chan %p quote %d", chan, *quote);
4424 return chan;
4425 }
4426
hci_prio_recalculate(struct hci_dev * hdev,__u8 type)4427 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
4428 {
4429 struct hci_conn_hash *h = &hdev->conn_hash;
4430 struct hci_conn *conn;
4431 int num = 0;
4432
4433 BT_DBG("%s", hdev->name);
4434
4435 rcu_read_lock();
4436
4437 list_for_each_entry_rcu(conn, &h->list, list) {
4438 struct hci_chan *chan;
4439
4440 if (conn->type != type)
4441 continue;
4442
4443 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4444 continue;
4445
4446 num++;
4447
4448 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
4449 struct sk_buff *skb;
4450
4451 if (chan->sent) {
4452 chan->sent = 0;
4453 continue;
4454 }
4455
4456 if (skb_queue_empty(&chan->data_q))
4457 continue;
4458
4459 skb = skb_peek(&chan->data_q);
4460 if (skb->priority >= HCI_PRIO_MAX - 1)
4461 continue;
4462
4463 skb->priority = HCI_PRIO_MAX - 1;
4464
4465 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
4466 skb->priority);
4467 }
4468
4469 if (hci_conn_num(hdev, type) == num)
4470 break;
4471 }
4472
4473 rcu_read_unlock();
4474
4475 }
4476
__get_blocks(struct hci_dev * hdev,struct sk_buff * skb)4477 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
4478 {
4479 /* Calculate count of blocks used by this packet */
4480 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
4481 }
4482
__check_timeout(struct hci_dev * hdev,unsigned int cnt,u8 type)4483 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type)
4484 {
4485 unsigned long last_tx;
4486
4487 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4488 return;
4489
4490 switch (type) {
4491 case LE_LINK:
4492 last_tx = hdev->le_last_tx;
4493 break;
4494 default:
4495 last_tx = hdev->acl_last_tx;
4496 break;
4497 }
4498
4499 /* tx timeout must be longer than maximum link supervision timeout
4500 * (40.9 seconds)
4501 */
4502 if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT))
4503 hci_link_tx_to(hdev, type);
4504 }
4505
4506 /* Schedule SCO */
hci_sched_sco(struct hci_dev * hdev)4507 static void hci_sched_sco(struct hci_dev *hdev)
4508 {
4509 struct hci_conn *conn;
4510 struct sk_buff *skb;
4511 int quote;
4512
4513 BT_DBG("%s", hdev->name);
4514
4515 if (!hci_conn_num(hdev, SCO_LINK))
4516 return;
4517
4518 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) {
4519 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4520 BT_DBG("skb %p len %d", skb, skb->len);
4521 hci_send_frame(hdev, skb);
4522
4523 conn->sent++;
4524 if (conn->sent == ~0)
4525 conn->sent = 0;
4526 }
4527 }
4528 }
4529
hci_sched_esco(struct hci_dev * hdev)4530 static void hci_sched_esco(struct hci_dev *hdev)
4531 {
4532 struct hci_conn *conn;
4533 struct sk_buff *skb;
4534 int quote;
4535
4536 BT_DBG("%s", hdev->name);
4537
4538 if (!hci_conn_num(hdev, ESCO_LINK))
4539 return;
4540
4541 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4542 "e))) {
4543 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4544 BT_DBG("skb %p len %d", skb, skb->len);
4545 hci_send_frame(hdev, skb);
4546
4547 conn->sent++;
4548 if (conn->sent == ~0)
4549 conn->sent = 0;
4550 }
4551 }
4552 }
4553
hci_sched_acl_pkt(struct hci_dev * hdev)4554 static void hci_sched_acl_pkt(struct hci_dev *hdev)
4555 {
4556 unsigned int cnt = hdev->acl_cnt;
4557 struct hci_chan *chan;
4558 struct sk_buff *skb;
4559 int quote;
4560
4561 __check_timeout(hdev, cnt, ACL_LINK);
4562
4563 while (hdev->acl_cnt &&
4564 (chan = hci_chan_sent(hdev, ACL_LINK, "e))) {
4565 u32 priority = (skb_peek(&chan->data_q))->priority;
4566 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4567 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4568 skb->len, skb->priority);
4569
4570 /* Stop if priority has changed */
4571 if (skb->priority < priority)
4572 break;
4573
4574 skb = skb_dequeue(&chan->data_q);
4575
4576 hci_conn_enter_active_mode(chan->conn,
4577 bt_cb(skb)->force_active);
4578
4579 hci_send_frame(hdev, skb);
4580 hdev->acl_last_tx = jiffies;
4581
4582 hdev->acl_cnt--;
4583 chan->sent++;
4584 chan->conn->sent++;
4585
4586 /* Send pending SCO packets right away */
4587 hci_sched_sco(hdev);
4588 hci_sched_esco(hdev);
4589 }
4590 }
4591
4592 if (cnt != hdev->acl_cnt)
4593 hci_prio_recalculate(hdev, ACL_LINK);
4594 }
4595
hci_sched_acl_blk(struct hci_dev * hdev)4596 static void hci_sched_acl_blk(struct hci_dev *hdev)
4597 {
4598 unsigned int cnt = hdev->block_cnt;
4599 struct hci_chan *chan;
4600 struct sk_buff *skb;
4601 int quote;
4602 u8 type;
4603
4604 BT_DBG("%s", hdev->name);
4605
4606 if (hdev->dev_type == HCI_AMP)
4607 type = AMP_LINK;
4608 else
4609 type = ACL_LINK;
4610
4611 __check_timeout(hdev, cnt, type);
4612
4613 while (hdev->block_cnt > 0 &&
4614 (chan = hci_chan_sent(hdev, type, "e))) {
4615 u32 priority = (skb_peek(&chan->data_q))->priority;
4616 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
4617 int blocks;
4618
4619 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4620 skb->len, skb->priority);
4621
4622 /* Stop if priority has changed */
4623 if (skb->priority < priority)
4624 break;
4625
4626 skb = skb_dequeue(&chan->data_q);
4627
4628 blocks = __get_blocks(hdev, skb);
4629 if (blocks > hdev->block_cnt)
4630 return;
4631
4632 hci_conn_enter_active_mode(chan->conn,
4633 bt_cb(skb)->force_active);
4634
4635 hci_send_frame(hdev, skb);
4636 hdev->acl_last_tx = jiffies;
4637
4638 hdev->block_cnt -= blocks;
4639 quote -= blocks;
4640
4641 chan->sent += blocks;
4642 chan->conn->sent += blocks;
4643 }
4644 }
4645
4646 if (cnt != hdev->block_cnt)
4647 hci_prio_recalculate(hdev, type);
4648 }
4649
hci_sched_acl(struct hci_dev * hdev)4650 static void hci_sched_acl(struct hci_dev *hdev)
4651 {
4652 BT_DBG("%s", hdev->name);
4653
4654 /* No ACL link over BR/EDR controller */
4655 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
4656 return;
4657
4658 /* No AMP link over AMP controller */
4659 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4660 return;
4661
4662 switch (hdev->flow_ctl_mode) {
4663 case HCI_FLOW_CTL_MODE_PACKET_BASED:
4664 hci_sched_acl_pkt(hdev);
4665 break;
4666
4667 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4668 hci_sched_acl_blk(hdev);
4669 break;
4670 }
4671 }
4672
hci_sched_le(struct hci_dev * hdev)4673 static void hci_sched_le(struct hci_dev *hdev)
4674 {
4675 struct hci_chan *chan;
4676 struct sk_buff *skb;
4677 int quote, cnt, tmp;
4678
4679 BT_DBG("%s", hdev->name);
4680
4681 if (!hci_conn_num(hdev, LE_LINK))
4682 return;
4683
4684 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
4685
4686 __check_timeout(hdev, cnt, LE_LINK);
4687
4688 tmp = cnt;
4689 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, "e))) {
4690 u32 priority = (skb_peek(&chan->data_q))->priority;
4691 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4692 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4693 skb->len, skb->priority);
4694
4695 /* Stop if priority has changed */
4696 if (skb->priority < priority)
4697 break;
4698
4699 skb = skb_dequeue(&chan->data_q);
4700
4701 hci_send_frame(hdev, skb);
4702 hdev->le_last_tx = jiffies;
4703
4704 cnt--;
4705 chan->sent++;
4706 chan->conn->sent++;
4707
4708 /* Send pending SCO packets right away */
4709 hci_sched_sco(hdev);
4710 hci_sched_esco(hdev);
4711 }
4712 }
4713
4714 if (hdev->le_pkts)
4715 hdev->le_cnt = cnt;
4716 else
4717 hdev->acl_cnt = cnt;
4718
4719 if (cnt != tmp)
4720 hci_prio_recalculate(hdev, LE_LINK);
4721 }
4722
hci_tx_work(struct work_struct * work)4723 static void hci_tx_work(struct work_struct *work)
4724 {
4725 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
4726 struct sk_buff *skb;
4727
4728 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
4729 hdev->sco_cnt, hdev->le_cnt);
4730
4731 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4732 /* Schedule queues and send stuff to HCI driver */
4733 hci_sched_sco(hdev);
4734 hci_sched_esco(hdev);
4735 hci_sched_acl(hdev);
4736 hci_sched_le(hdev);
4737 }
4738
4739 /* Send next queued raw (unknown type) packet */
4740 while ((skb = skb_dequeue(&hdev->raw_q)))
4741 hci_send_frame(hdev, skb);
4742 }
4743
4744 /* ----- HCI RX task (incoming data processing) ----- */
4745
4746 /* ACL data packet */
hci_acldata_packet(struct hci_dev * hdev,struct sk_buff * skb)4747 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4748 {
4749 struct hci_acl_hdr *hdr = (void *) skb->data;
4750 struct hci_conn *conn;
4751 __u16 handle, flags;
4752
4753 skb_pull(skb, HCI_ACL_HDR_SIZE);
4754
4755 handle = __le16_to_cpu(hdr->handle);
4756 flags = hci_flags(handle);
4757 handle = hci_handle(handle);
4758
4759 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4760 handle, flags);
4761
4762 hdev->stat.acl_rx++;
4763
4764 hci_dev_lock(hdev);
4765 conn = hci_conn_hash_lookup_handle(hdev, handle);
4766 hci_dev_unlock(hdev);
4767
4768 if (conn) {
4769 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
4770
4771 /* Send to upper protocol */
4772 l2cap_recv_acldata(conn, skb, flags);
4773 return;
4774 } else {
4775 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
4776 handle);
4777 }
4778
4779 kfree_skb(skb);
4780 }
4781
4782 /* SCO data packet */
hci_scodata_packet(struct hci_dev * hdev,struct sk_buff * skb)4783 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4784 {
4785 struct hci_sco_hdr *hdr = (void *) skb->data;
4786 struct hci_conn *conn;
4787 __u16 handle, flags;
4788
4789 skb_pull(skb, HCI_SCO_HDR_SIZE);
4790
4791 handle = __le16_to_cpu(hdr->handle);
4792 flags = hci_flags(handle);
4793 handle = hci_handle(handle);
4794
4795 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4796 handle, flags);
4797
4798 hdev->stat.sco_rx++;
4799
4800 hci_dev_lock(hdev);
4801 conn = hci_conn_hash_lookup_handle(hdev, handle);
4802 hci_dev_unlock(hdev);
4803
4804 if (conn) {
4805 /* Send to upper protocol */
4806 bt_cb(skb)->sco.pkt_status = flags & 0x03;
4807 sco_recv_scodata(conn, skb);
4808 return;
4809 } else {
4810 bt_dev_err(hdev, "SCO packet for unknown connection handle %d",
4811 handle);
4812 }
4813
4814 kfree_skb(skb);
4815 }
4816
hci_req_is_complete(struct hci_dev * hdev)4817 static bool hci_req_is_complete(struct hci_dev *hdev)
4818 {
4819 struct sk_buff *skb;
4820
4821 skb = skb_peek(&hdev->cmd_q);
4822 if (!skb)
4823 return true;
4824
4825 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
4826 }
4827
hci_resend_last(struct hci_dev * hdev)4828 static void hci_resend_last(struct hci_dev *hdev)
4829 {
4830 struct hci_command_hdr *sent;
4831 struct sk_buff *skb;
4832 u16 opcode;
4833
4834 if (!hdev->sent_cmd)
4835 return;
4836
4837 sent = (void *) hdev->sent_cmd->data;
4838 opcode = __le16_to_cpu(sent->opcode);
4839 if (opcode == HCI_OP_RESET)
4840 return;
4841
4842 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4843 if (!skb)
4844 return;
4845
4846 skb_queue_head(&hdev->cmd_q, skb);
4847 queue_work(hdev->workqueue, &hdev->cmd_work);
4848 }
4849
hci_req_cmd_complete(struct hci_dev * hdev,u16 opcode,u8 status,hci_req_complete_t * req_complete,hci_req_complete_skb_t * req_complete_skb)4850 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4851 hci_req_complete_t *req_complete,
4852 hci_req_complete_skb_t *req_complete_skb)
4853 {
4854 struct sk_buff *skb;
4855 unsigned long flags;
4856
4857 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4858
4859 /* If the completed command doesn't match the last one that was
4860 * sent we need to do special handling of it.
4861 */
4862 if (!hci_sent_cmd_data(hdev, opcode)) {
4863 /* Some CSR based controllers generate a spontaneous
4864 * reset complete event during init and any pending
4865 * command will never be completed. In such a case we
4866 * need to resend whatever was the last sent
4867 * command.
4868 */
4869 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4870 hci_resend_last(hdev);
4871
4872 return;
4873 }
4874
4875 /* If we reach this point this event matches the last command sent */
4876 hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
4877
4878 /* If the command succeeded and there's still more commands in
4879 * this request the request is not yet complete.
4880 */
4881 if (!status && !hci_req_is_complete(hdev))
4882 return;
4883
4884 /* If this was the last command in a request the complete
4885 * callback would be found in hdev->sent_cmd instead of the
4886 * command queue (hdev->cmd_q).
4887 */
4888 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4889 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
4890 return;
4891 }
4892
4893 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4894 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
4895 return;
4896 }
4897
4898 /* Remove all pending commands belonging to this request */
4899 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4900 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4901 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
4902 __skb_queue_head(&hdev->cmd_q, skb);
4903 break;
4904 }
4905
4906 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4907 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4908 else
4909 *req_complete = bt_cb(skb)->hci.req_complete;
4910 kfree_skb(skb);
4911 }
4912 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4913 }
4914
hci_rx_work(struct work_struct * work)4915 static void hci_rx_work(struct work_struct *work)
4916 {
4917 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
4918 struct sk_buff *skb;
4919
4920 BT_DBG("%s", hdev->name);
4921
4922 while ((skb = skb_dequeue(&hdev->rx_q))) {
4923 /* Send copy to monitor */
4924 hci_send_to_monitor(hdev, skb);
4925
4926 if (atomic_read(&hdev->promisc)) {
4927 /* Send copy to the sockets */
4928 hci_send_to_sock(hdev, skb);
4929 }
4930
4931 /* If the device has been opened in HCI_USER_CHANNEL,
4932 * the userspace has exclusive access to device.
4933 * When device is HCI_INIT, we still need to process
4934 * the data packets to the driver in order
4935 * to complete its setup().
4936 */
4937 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4938 !test_bit(HCI_INIT, &hdev->flags)) {
4939 kfree_skb(skb);
4940 continue;
4941 }
4942
4943 if (test_bit(HCI_INIT, &hdev->flags)) {
4944 /* Don't process data packets in this states. */
4945 switch (hci_skb_pkt_type(skb)) {
4946 case HCI_ACLDATA_PKT:
4947 case HCI_SCODATA_PKT:
4948 case HCI_ISODATA_PKT:
4949 kfree_skb(skb);
4950 continue;
4951 }
4952 }
4953
4954 /* Process frame */
4955 switch (hci_skb_pkt_type(skb)) {
4956 case HCI_EVENT_PKT:
4957 BT_DBG("%s Event packet", hdev->name);
4958 hci_event_packet(hdev, skb);
4959 break;
4960
4961 case HCI_ACLDATA_PKT:
4962 BT_DBG("%s ACL data packet", hdev->name);
4963 hci_acldata_packet(hdev, skb);
4964 break;
4965
4966 case HCI_SCODATA_PKT:
4967 BT_DBG("%s SCO data packet", hdev->name);
4968 hci_scodata_packet(hdev, skb);
4969 break;
4970
4971 default:
4972 kfree_skb(skb);
4973 break;
4974 }
4975 }
4976 }
4977
hci_cmd_work(struct work_struct * work)4978 static void hci_cmd_work(struct work_struct *work)
4979 {
4980 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4981 struct sk_buff *skb;
4982
4983 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4984 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4985
4986 /* Send queued commands */
4987 if (atomic_read(&hdev->cmd_cnt)) {
4988 skb = skb_dequeue(&hdev->cmd_q);
4989 if (!skb)
4990 return;
4991
4992 kfree_skb(hdev->sent_cmd);
4993
4994 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4995 if (hdev->sent_cmd) {
4996 if (hci_req_status_pend(hdev))
4997 hci_dev_set_flag(hdev, HCI_CMD_PENDING);
4998 atomic_dec(&hdev->cmd_cnt);
4999 hci_send_frame(hdev, skb);
5000 if (test_bit(HCI_RESET, &hdev->flags))
5001 cancel_delayed_work(&hdev->cmd_timer);
5002 else
5003 schedule_delayed_work(&hdev->cmd_timer,
5004 HCI_CMD_TIMEOUT);
5005 } else {
5006 skb_queue_head(&hdev->cmd_q, skb);
5007 queue_work(hdev->workqueue, &hdev->cmd_work);
5008 }
5009 }
5010 }
5011