2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2011 ProFUSION Embedded Systems
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
26 /* Bluetooth HCI core. */
28 #include <linux/export.h>
29 #include <linux/idr.h>
30 #include <linux/rfkill.h>
31 #include <linux/debugfs.h>
32 #include <linux/crypto.h>
33 #include <linux/property.h>
34 #include <asm/unaligned.h>
36 #include <net/bluetooth/bluetooth.h>
37 #include <net/bluetooth/hci_core.h>
38 #include <net/bluetooth/l2cap.h>
39 #include <net/bluetooth/mgmt.h>
41 #include "hci_request.h"
42 #include "hci_debugfs.h"
46 static void hci_rx_work(struct work_struct *work);
47 static void hci_cmd_work(struct work_struct *work);
48 static void hci_tx_work(struct work_struct *work);
51 LIST_HEAD(hci_dev_list);
52 DEFINE_RWLOCK(hci_dev_list_lock);
54 /* HCI callback list */
55 LIST_HEAD(hci_cb_list);
56 DEFINE_MUTEX(hci_cb_list_lock);
58 /* HCI ID Numbering */
59 static DEFINE_IDA(hci_index_ida);
61 /* ---- HCI debugfs entries ---- */
63 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
64 size_t count, loff_t *ppos)
66 struct hci_dev *hdev = file->private_data;
69 buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
72 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
75 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
76 size_t count, loff_t *ppos)
78 struct hci_dev *hdev = file->private_data;
83 if (!test_bit(HCI_UP, &hdev->flags))
86 err = kstrtobool_from_user(user_buf, count, &enable);
90 if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
93 hci_req_sync_lock(hdev);
95 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
98 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
100 hci_req_sync_unlock(hdev);
107 hci_dev_change_flag(hdev, HCI_DUT_MODE);
112 static const struct file_operations dut_mode_fops = {
114 .read = dut_mode_read,
115 .write = dut_mode_write,
116 .llseek = default_llseek,
119 static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
120 size_t count, loff_t *ppos)
122 struct hci_dev *hdev = file->private_data;
125 buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
128 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
131 static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
132 size_t count, loff_t *ppos)
134 struct hci_dev *hdev = file->private_data;
138 err = kstrtobool_from_user(user_buf, count, &enable);
142 /* When the diagnostic flags are not persistent and the transport
143 * is not active or in user channel operation, then there is no need
144 * for the vendor callback. Instead just store the desired value and
145 * the setting will be programmed when the controller gets powered on.
147 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
148 (!test_bit(HCI_RUNNING, &hdev->flags) ||
149 hci_dev_test_flag(hdev, HCI_USER_CHANNEL)))
152 hci_req_sync_lock(hdev);
153 err = hdev->set_diag(hdev, enable);
154 hci_req_sync_unlock(hdev);
161 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
163 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
168 static const struct file_operations vendor_diag_fops = {
170 .read = vendor_diag_read,
171 .write = vendor_diag_write,
172 .llseek = default_llseek,
175 static void hci_debugfs_create_basic(struct hci_dev *hdev)
177 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
181 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
185 static int hci_reset_req(struct hci_request *req, unsigned long opt)
187 BT_DBG("%s %ld", req->hdev->name, opt);
190 set_bit(HCI_RESET, &req->hdev->flags);
191 hci_req_add(req, HCI_OP_RESET, 0, NULL);
195 static void bredr_init(struct hci_request *req)
197 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
199 /* Read Local Supported Features */
200 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
202 /* Read Local Version */
203 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
205 /* Read BD Address */
206 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
209 static void amp_init1(struct hci_request *req)
211 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
213 /* Read Local Version */
214 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
216 /* Read Local Supported Commands */
217 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
219 /* Read Local AMP Info */
220 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
222 /* Read Data Blk size */
223 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
225 /* Read Flow Control Mode */
226 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
228 /* Read Location Data */
229 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
232 static int amp_init2(struct hci_request *req)
234 /* Read Local Supported Features. Not all AMP controllers
235 * support this so it's placed conditionally in the second
238 if (req->hdev->commands[14] & 0x20)
239 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
244 static int hci_init1_req(struct hci_request *req, unsigned long opt)
246 struct hci_dev *hdev = req->hdev;
248 BT_DBG("%s %ld", hdev->name, opt);
251 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
252 hci_reset_req(req, 0);
254 switch (hdev->dev_type) {
262 bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
269 static void bredr_setup(struct hci_request *req)
274 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
275 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
277 /* Read Class of Device */
278 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
280 /* Read Local Name */
281 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
283 /* Read Voice Setting */
284 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
286 /* Read Number of Supported IAC */
287 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
289 /* Read Current IAC LAP */
290 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
292 /* Clear Event Filters */
293 flt_type = HCI_FLT_CLEAR_ALL;
294 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
296 /* Connection accept timeout ~20 secs */
297 param = cpu_to_le16(0x7d00);
298 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, ¶m);
301 static void le_setup(struct hci_request *req)
303 struct hci_dev *hdev = req->hdev;
305 /* Read LE Buffer Size */
306 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
308 /* Read LE Local Supported Features */
309 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
311 /* Read LE Supported States */
312 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
314 /* LE-only controllers have LE implicitly enabled */
315 if (!lmp_bredr_capable(hdev))
316 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
319 static void hci_setup_event_mask(struct hci_request *req)
321 struct hci_dev *hdev = req->hdev;
323 /* The second byte is 0xff instead of 0x9f (two reserved bits
324 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
327 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
329 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
330 * any event mask for pre 1.2 devices.
332 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
335 if (lmp_bredr_capable(hdev)) {
336 events[4] |= 0x01; /* Flow Specification Complete */
338 /* Use a different default for LE-only devices */
339 memset(events, 0, sizeof(events));
340 events[1] |= 0x20; /* Command Complete */
341 events[1] |= 0x40; /* Command Status */
342 events[1] |= 0x80; /* Hardware Error */
344 /* If the controller supports the Disconnect command, enable
345 * the corresponding event. In addition enable packet flow
346 * control related events.
348 if (hdev->commands[0] & 0x20) {
349 events[0] |= 0x10; /* Disconnection Complete */
350 events[2] |= 0x04; /* Number of Completed Packets */
351 events[3] |= 0x02; /* Data Buffer Overflow */
354 /* If the controller supports the Read Remote Version
355 * Information command, enable the corresponding event.
357 if (hdev->commands[2] & 0x80)
358 events[1] |= 0x08; /* Read Remote Version Information
362 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
363 events[0] |= 0x80; /* Encryption Change */
364 events[5] |= 0x80; /* Encryption Key Refresh Complete */
368 if (lmp_inq_rssi_capable(hdev) ||
369 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
370 events[4] |= 0x02; /* Inquiry Result with RSSI */
372 if (lmp_ext_feat_capable(hdev))
373 events[4] |= 0x04; /* Read Remote Extended Features Complete */
375 if (lmp_esco_capable(hdev)) {
376 events[5] |= 0x08; /* Synchronous Connection Complete */
377 events[5] |= 0x10; /* Synchronous Connection Changed */
380 if (lmp_sniffsubr_capable(hdev))
381 events[5] |= 0x20; /* Sniff Subrating */
383 if (lmp_pause_enc_capable(hdev))
384 events[5] |= 0x80; /* Encryption Key Refresh Complete */
386 if (lmp_ext_inq_capable(hdev))
387 events[5] |= 0x40; /* Extended Inquiry Result */
389 if (lmp_no_flush_capable(hdev))
390 events[7] |= 0x01; /* Enhanced Flush Complete */
392 if (lmp_lsto_capable(hdev))
393 events[6] |= 0x80; /* Link Supervision Timeout Changed */
395 if (lmp_ssp_capable(hdev)) {
396 events[6] |= 0x01; /* IO Capability Request */
397 events[6] |= 0x02; /* IO Capability Response */
398 events[6] |= 0x04; /* User Confirmation Request */
399 events[6] |= 0x08; /* User Passkey Request */
400 events[6] |= 0x10; /* Remote OOB Data Request */
401 events[6] |= 0x20; /* Simple Pairing Complete */
402 events[7] |= 0x04; /* User Passkey Notification */
403 events[7] |= 0x08; /* Keypress Notification */
404 events[7] |= 0x10; /* Remote Host Supported
405 * Features Notification
409 if (lmp_le_capable(hdev))
410 events[7] |= 0x20; /* LE Meta-Event */
412 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
415 static int hci_init2_req(struct hci_request *req, unsigned long opt)
417 struct hci_dev *hdev = req->hdev;
419 if (hdev->dev_type == HCI_AMP)
420 return amp_init2(req);
422 if (lmp_bredr_capable(hdev))
425 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
427 if (lmp_le_capable(hdev))
430 /* All Bluetooth 1.2 and later controllers should support the
431 * HCI command for reading the local supported commands.
433 * Unfortunately some controllers indicate Bluetooth 1.2 support,
434 * but do not have support for this command. If that is the case,
435 * the driver can quirk the behavior and skip reading the local
436 * supported commands.
438 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
439 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
440 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
442 if (lmp_ssp_capable(hdev)) {
443 /* When SSP is available, then the host features page
444 * should also be available as well. However some
445 * controllers list the max_page as 0 as long as SSP
446 * has not been enabled. To achieve proper debugging
447 * output, force the minimum max_page to 1 at least.
449 hdev->max_page = 0x01;
451 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
454 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
455 sizeof(mode), &mode);
457 struct hci_cp_write_eir cp;
459 memset(hdev->eir, 0, sizeof(hdev->eir));
460 memset(&cp, 0, sizeof(cp));
462 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
466 if (lmp_inq_rssi_capable(hdev) ||
467 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
470 /* If Extended Inquiry Result events are supported, then
471 * they are clearly preferred over Inquiry Result with RSSI
474 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
476 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
479 if (lmp_inq_tx_pwr_capable(hdev))
480 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
482 if (lmp_ext_feat_capable(hdev)) {
483 struct hci_cp_read_local_ext_features cp;
486 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
490 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
492 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
499 static void hci_setup_link_policy(struct hci_request *req)
501 struct hci_dev *hdev = req->hdev;
502 struct hci_cp_write_def_link_policy cp;
505 if (lmp_rswitch_capable(hdev))
506 link_policy |= HCI_LP_RSWITCH;
507 if (lmp_hold_capable(hdev))
508 link_policy |= HCI_LP_HOLD;
509 if (lmp_sniff_capable(hdev))
510 link_policy |= HCI_LP_SNIFF;
511 if (lmp_park_capable(hdev))
512 link_policy |= HCI_LP_PARK;
514 cp.policy = cpu_to_le16(link_policy);
515 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
518 static void hci_set_le_support(struct hci_request *req)
520 struct hci_dev *hdev = req->hdev;
521 struct hci_cp_write_le_host_supported cp;
523 /* LE-only devices do not support explicit enablement */
524 if (!lmp_bredr_capable(hdev))
527 memset(&cp, 0, sizeof(cp));
529 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
534 if (cp.le != lmp_host_le_capable(hdev))
535 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
539 static void hci_set_event_mask_page_2(struct hci_request *req)
541 struct hci_dev *hdev = req->hdev;
542 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
543 bool changed = false;
545 /* If Connectionless Slave Broadcast master role is supported
546 * enable all necessary events for it.
548 if (lmp_csb_master_capable(hdev)) {
549 events[1] |= 0x40; /* Triggered Clock Capture */
550 events[1] |= 0x80; /* Synchronization Train Complete */
551 events[2] |= 0x10; /* Slave Page Response Timeout */
552 events[2] |= 0x20; /* CSB Channel Map Change */
556 /* If Connectionless Slave Broadcast slave role is supported
557 * enable all necessary events for it.
559 if (lmp_csb_slave_capable(hdev)) {
560 events[2] |= 0x01; /* Synchronization Train Received */
561 events[2] |= 0x02; /* CSB Receive */
562 events[2] |= 0x04; /* CSB Timeout */
563 events[2] |= 0x08; /* Truncated Page Complete */
567 /* Enable Authenticated Payload Timeout Expired event if supported */
568 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
573 /* Some Broadcom based controllers indicate support for Set Event
574 * Mask Page 2 command, but then actually do not support it. Since
575 * the default value is all bits set to zero, the command is only
576 * required if the event mask has to be changed. In case no change
577 * to the event mask is needed, skip this command.
580 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
581 sizeof(events), events);
584 static int hci_init3_req(struct hci_request *req, unsigned long opt)
586 struct hci_dev *hdev = req->hdev;
589 hci_setup_event_mask(req);
591 if (hdev->commands[6] & 0x20 &&
592 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
593 struct hci_cp_read_stored_link_key cp;
595 bacpy(&cp.bdaddr, BDADDR_ANY);
597 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
600 if (hdev->commands[5] & 0x10)
601 hci_setup_link_policy(req);
603 if (hdev->commands[8] & 0x01)
604 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
606 /* Some older Broadcom based Bluetooth 1.2 controllers do not
607 * support the Read Page Scan Type command. Check support for
608 * this command in the bit mask of supported commands.
610 if (hdev->commands[13] & 0x01)
611 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
613 if (lmp_le_capable(hdev)) {
616 memset(events, 0, sizeof(events));
618 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
619 events[0] |= 0x10; /* LE Long Term Key Request */
621 /* If controller supports the Connection Parameters Request
622 * Link Layer Procedure, enable the corresponding event.
624 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
625 events[0] |= 0x20; /* LE Remote Connection
629 /* If the controller supports the Data Length Extension
630 * feature, enable the corresponding event.
632 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
633 events[0] |= 0x40; /* LE Data Length Change */
635 /* If the controller supports Extended Scanner Filter
636 * Policies, enable the correspondig event.
638 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
639 events[1] |= 0x04; /* LE Direct Advertising
643 /* If the controller supports Channel Selection Algorithm #2
644 * feature, enable the corresponding event.
646 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
647 events[2] |= 0x08; /* LE Channel Selection
651 /* If the controller supports the LE Set Scan Enable command,
652 * enable the corresponding advertising report event.
654 if (hdev->commands[26] & 0x08)
655 events[0] |= 0x02; /* LE Advertising Report */
657 /* If the controller supports the LE Create Connection
658 * command, enable the corresponding event.
660 if (hdev->commands[26] & 0x10)
661 events[0] |= 0x01; /* LE Connection Complete */
663 /* If the controller supports the LE Connection Update
664 * command, enable the corresponding event.
666 if (hdev->commands[27] & 0x04)
667 events[0] |= 0x04; /* LE Connection Update
671 /* If the controller supports the LE Read Remote Used Features
672 * command, enable the corresponding event.
674 if (hdev->commands[27] & 0x20)
675 events[0] |= 0x08; /* LE Read Remote Used
679 /* If the controller supports the LE Read Local P-256
680 * Public Key command, enable the corresponding event.
682 if (hdev->commands[34] & 0x02)
683 events[0] |= 0x80; /* LE Read Local P-256
684 * Public Key Complete
687 /* If the controller supports the LE Generate DHKey
688 * command, enable the corresponding event.
690 if (hdev->commands[34] & 0x04)
691 events[1] |= 0x01; /* LE Generate DHKey Complete */
693 /* If the controller supports the LE Set Default PHY or
694 * LE Set PHY commands, enable the corresponding event.
696 if (hdev->commands[35] & (0x20 | 0x40))
697 events[1] |= 0x08; /* LE PHY Update Complete */
699 /* If the controller supports LE Set Extended Scan Parameters
700 * and LE Set Extended Scan Enable commands, enable the
701 * corresponding event.
703 if (use_ext_scan(hdev))
704 events[1] |= 0x10; /* LE Extended Advertising
708 /* If the controller supports the LE Extended Create Connection
709 * command, enable the corresponding event.
711 if (use_ext_conn(hdev))
712 events[1] |= 0x02; /* LE Enhanced Connection
716 /* If the controller supports the LE Extended Advertising
717 * command, enable the corresponding event.
719 if (ext_adv_capable(hdev))
720 events[2] |= 0x02; /* LE Advertising Set
724 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
727 /* Read LE Advertising Channel TX Power */
728 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
729 /* HCI TS spec forbids mixing of legacy and extended
730 * advertising commands wherein READ_ADV_TX_POWER is
731 * also included. So do not call it if extended adv
732 * is supported otherwise controller will return
733 * COMMAND_DISALLOWED for extended commands.
735 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
738 if (hdev->commands[26] & 0x40) {
739 /* Read LE White List Size */
740 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE,
744 if (hdev->commands[26] & 0x80) {
745 /* Clear LE White List */
746 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
749 if (hdev->commands[34] & 0x40) {
750 /* Read LE Resolving List Size */
751 hci_req_add(req, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
755 if (hdev->commands[34] & 0x20) {
756 /* Clear LE Resolving List */
757 hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL);
760 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
761 /* Read LE Maximum Data Length */
762 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
764 /* Read LE Suggested Default Data Length */
765 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
768 if (ext_adv_capable(hdev)) {
769 /* Read LE Number of Supported Advertising Sets */
770 hci_req_add(req, HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
774 hci_set_le_support(req);
777 /* Read features beyond page 1 if available */
778 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
779 struct hci_cp_read_local_ext_features cp;
782 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
789 static int hci_init4_req(struct hci_request *req, unsigned long opt)
791 struct hci_dev *hdev = req->hdev;
793 /* Some Broadcom based Bluetooth controllers do not support the
794 * Delete Stored Link Key command. They are clearly indicating its
795 * absence in the bit mask of supported commands.
797 * Check the supported commands and only if the the command is marked
798 * as supported send it. If not supported assume that the controller
799 * does not have actual support for stored link keys which makes this
800 * command redundant anyway.
802 * Some controllers indicate that they support handling deleting
803 * stored link keys, but they don't. The quirk lets a driver
804 * just disable this command.
806 if (hdev->commands[6] & 0x80 &&
807 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
808 struct hci_cp_delete_stored_link_key cp;
810 bacpy(&cp.bdaddr, BDADDR_ANY);
811 cp.delete_all = 0x01;
812 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
816 /* Set event mask page 2 if the HCI command for it is supported */
817 if (hdev->commands[22] & 0x04)
818 hci_set_event_mask_page_2(req);
820 /* Read local codec list if the HCI command is supported */
821 if (hdev->commands[29] & 0x20)
822 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
824 /* Get MWS transport configuration if the HCI command is supported */
825 if (hdev->commands[30] & 0x08)
826 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
828 /* Check for Synchronization Train support */
829 if (lmp_sync_train_capable(hdev))
830 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
832 /* Enable Secure Connections if supported and configured */
833 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
834 bredr_sc_enabled(hdev)) {
837 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
838 sizeof(support), &support);
841 /* Set Suggested Default Data Length to maximum if supported */
842 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
843 struct hci_cp_le_write_def_data_len cp;
845 cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
846 cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
847 hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
850 /* Set Default PHY parameters if command is supported */
851 if (hdev->commands[35] & 0x20) {
852 struct hci_cp_le_set_default_phy cp;
855 cp.tx_phys = hdev->le_tx_def_phys;
856 cp.rx_phys = hdev->le_rx_def_phys;
858 hci_req_add(req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp), &cp);
864 static int __hci_init(struct hci_dev *hdev)
868 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
872 if (hci_dev_test_flag(hdev, HCI_SETUP))
873 hci_debugfs_create_basic(hdev);
875 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
879 /* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
880 * BR/EDR/LE type controllers. AMP controllers only need the
881 * first two stages of init.
883 if (hdev->dev_type != HCI_PRIMARY)
886 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
890 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
894 /* This function is only called when the controller is actually in
895 * configured state. When the controller is marked as unconfigured,
896 * this initialization procedure is not run.
898 * It means that it is possible that a controller runs through its
899 * setup phase and then discovers missing settings. If that is the
900 * case, then this function will not be called. It then will only
901 * be called during the config phase.
903 * So only when in setup phase or config phase, create the debugfs
904 * entries and register the SMP channels.
906 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
907 !hci_dev_test_flag(hdev, HCI_CONFIG))
910 hci_debugfs_create_common(hdev);
912 if (lmp_bredr_capable(hdev))
913 hci_debugfs_create_bredr(hdev);
915 if (lmp_le_capable(hdev))
916 hci_debugfs_create_le(hdev);
921 static int hci_init0_req(struct hci_request *req, unsigned long opt)
923 struct hci_dev *hdev = req->hdev;
925 BT_DBG("%s %ld", hdev->name, opt);
928 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
929 hci_reset_req(req, 0);
931 /* Read Local Version */
932 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
934 /* Read BD Address */
935 if (hdev->set_bdaddr)
936 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
941 static int __hci_unconf_init(struct hci_dev *hdev)
945 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
948 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
952 if (hci_dev_test_flag(hdev, HCI_SETUP))
953 hci_debugfs_create_basic(hdev);
958 static int hci_scan_req(struct hci_request *req, unsigned long opt)
962 BT_DBG("%s %x", req->hdev->name, scan);
964 /* Inquiry and Page scans */
965 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
969 static int hci_auth_req(struct hci_request *req, unsigned long opt)
973 BT_DBG("%s %x", req->hdev->name, auth);
976 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
980 static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
984 BT_DBG("%s %x", req->hdev->name, encrypt);
987 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
991 static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
993 __le16 policy = cpu_to_le16(opt);
995 BT_DBG("%s %x", req->hdev->name, policy);
997 /* Default link policy */
998 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
1002 /* Get HCI device by index.
1003 * Device is held on return. */
1004 struct hci_dev *hci_dev_get(int index)
1006 struct hci_dev *hdev = NULL, *d;
1008 BT_DBG("%d", index);
1013 read_lock(&hci_dev_list_lock);
1014 list_for_each_entry(d, &hci_dev_list, list) {
1015 if (d->id == index) {
1016 hdev = hci_dev_hold(d);
1020 read_unlock(&hci_dev_list_lock);
1024 /* ---- Inquiry support ---- */
1026 bool hci_discovery_active(struct hci_dev *hdev)
1028 struct discovery_state *discov = &hdev->discovery;
1030 switch (discov->state) {
1031 case DISCOVERY_FINDING:
1032 case DISCOVERY_RESOLVING:
1040 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1042 int old_state = hdev->discovery.state;
1044 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1046 if (old_state == state)
1049 hdev->discovery.state = state;
1052 case DISCOVERY_STOPPED:
1053 hci_update_background_scan(hdev);
1055 if (old_state != DISCOVERY_STARTING)
1056 mgmt_discovering(hdev, 0);
1058 case DISCOVERY_STARTING:
1060 case DISCOVERY_FINDING:
1061 mgmt_discovering(hdev, 1);
1063 case DISCOVERY_RESOLVING:
1065 case DISCOVERY_STOPPING:
1070 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1072 struct discovery_state *cache = &hdev->discovery;
1073 struct inquiry_entry *p, *n;
1075 list_for_each_entry_safe(p, n, &cache->all, all) {
1080 INIT_LIST_HEAD(&cache->unknown);
1081 INIT_LIST_HEAD(&cache->resolve);
1084 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1087 struct discovery_state *cache = &hdev->discovery;
1088 struct inquiry_entry *e;
1090 BT_DBG("cache %p, %pMR", cache, bdaddr);
1092 list_for_each_entry(e, &cache->all, all) {
1093 if (!bacmp(&e->data.bdaddr, bdaddr))
1100 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1103 struct discovery_state *cache = &hdev->discovery;
1104 struct inquiry_entry *e;
1106 BT_DBG("cache %p, %pMR", cache, bdaddr);
1108 list_for_each_entry(e, &cache->unknown, list) {
1109 if (!bacmp(&e->data.bdaddr, bdaddr))
1116 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1120 struct discovery_state *cache = &hdev->discovery;
1121 struct inquiry_entry *e;
1123 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1125 list_for_each_entry(e, &cache->resolve, list) {
1126 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1128 if (!bacmp(&e->data.bdaddr, bdaddr))
1135 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1136 struct inquiry_entry *ie)
1138 struct discovery_state *cache = &hdev->discovery;
1139 struct list_head *pos = &cache->resolve;
1140 struct inquiry_entry *p;
1142 list_del(&ie->list);
1144 list_for_each_entry(p, &cache->resolve, list) {
1145 if (p->name_state != NAME_PENDING &&
1146 abs(p->data.rssi) >= abs(ie->data.rssi))
1151 list_add(&ie->list, pos);
1154 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1157 struct discovery_state *cache = &hdev->discovery;
1158 struct inquiry_entry *ie;
1161 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1163 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1165 if (!data->ssp_mode)
1166 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1168 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1170 if (!ie->data.ssp_mode)
1171 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1173 if (ie->name_state == NAME_NEEDED &&
1174 data->rssi != ie->data.rssi) {
1175 ie->data.rssi = data->rssi;
1176 hci_inquiry_cache_update_resolve(hdev, ie);
1182 /* Entry not in the cache. Add new one. */
1183 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1185 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1189 list_add(&ie->all, &cache->all);
1192 ie->name_state = NAME_KNOWN;
1194 ie->name_state = NAME_NOT_KNOWN;
1195 list_add(&ie->list, &cache->unknown);
1199 if (name_known && ie->name_state != NAME_KNOWN &&
1200 ie->name_state != NAME_PENDING) {
1201 ie->name_state = NAME_KNOWN;
1202 list_del(&ie->list);
1205 memcpy(&ie->data, data, sizeof(*data));
1206 ie->timestamp = jiffies;
1207 cache->timestamp = jiffies;
1209 if (ie->name_state == NAME_NOT_KNOWN)
1210 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1216 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1218 struct discovery_state *cache = &hdev->discovery;
1219 struct inquiry_info *info = (struct inquiry_info *) buf;
1220 struct inquiry_entry *e;
1223 list_for_each_entry(e, &cache->all, all) {
1224 struct inquiry_data *data = &e->data;
1229 bacpy(&info->bdaddr, &data->bdaddr);
1230 info->pscan_rep_mode = data->pscan_rep_mode;
1231 info->pscan_period_mode = data->pscan_period_mode;
1232 info->pscan_mode = data->pscan_mode;
1233 memcpy(info->dev_class, data->dev_class, 3);
1234 info->clock_offset = data->clock_offset;
1240 BT_DBG("cache %p, copied %d", cache, copied);
1244 static int hci_inq_req(struct hci_request *req, unsigned long opt)
1246 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1247 struct hci_dev *hdev = req->hdev;
1248 struct hci_cp_inquiry cp;
1250 BT_DBG("%s", hdev->name);
1252 if (test_bit(HCI_INQUIRY, &hdev->flags))
1256 memcpy(&cp.lap, &ir->lap, 3);
1257 cp.length = ir->length;
1258 cp.num_rsp = ir->num_rsp;
1259 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1264 int hci_inquiry(void __user *arg)
1266 __u8 __user *ptr = arg;
1267 struct hci_inquiry_req ir;
1268 struct hci_dev *hdev;
1269 int err = 0, do_inquiry = 0, max_rsp;
1273 if (copy_from_user(&ir, ptr, sizeof(ir)))
1276 hdev = hci_dev_get(ir.dev_id);
1280 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1285 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1290 if (hdev->dev_type != HCI_PRIMARY) {
1295 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1301 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1302 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1303 hci_inquiry_cache_flush(hdev);
1306 hci_dev_unlock(hdev);
1308 timeo = ir.length * msecs_to_jiffies(2000);
1311 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1316 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1317 * cleared). If it is interrupted by a signal, return -EINTR.
1319 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1320 TASK_INTERRUPTIBLE))
1324 /* for unlimited number of responses we will use buffer with
1327 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1329 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1330 * copy it to the user space.
1332 buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
1339 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1340 hci_dev_unlock(hdev);
1342 BT_DBG("num_rsp %d", ir.num_rsp);
1344 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1346 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1360 * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address
1361 * (BD_ADDR) for a HCI device from
1362 * a firmware node property.
1363 * @hdev: The HCI device
1365 * Search the firmware node for 'local-bd-address'.
1367 * All-zero BD addresses are rejected, because those could be properties
1368 * that exist in the firmware tables, but were not updated by the firmware. For
1369 * example, the DTS could define 'local-bd-address', with zero BD addresses.
1371 static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev)
1373 struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
1377 ret = fwnode_property_read_u8_array(fwnode, "local-bd-address",
1378 (u8 *)&ba, sizeof(ba));
1379 if (ret < 0 || !bacmp(&ba, BDADDR_ANY))
1382 bacpy(&hdev->public_addr, &ba);
1385 static int hci_dev_do_open(struct hci_dev *hdev)
1389 BT_DBG("%s %p", hdev->name, hdev);
1391 hci_req_sync_lock(hdev);
1393 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1398 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1399 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1400 /* Check for rfkill but allow the HCI setup stage to
1401 * proceed (which in itself doesn't cause any RF activity).
1403 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1408 /* Check for valid public address or a configured static
1409 * random adddress, but let the HCI setup proceed to
1410 * be able to determine if there is a public address
1413 * In case of user channel usage, it is not important
1414 * if a public address or static random address is
1417 * This check is only valid for BR/EDR controllers
1418 * since AMP controllers do not have an address.
1420 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1421 hdev->dev_type == HCI_PRIMARY &&
1422 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1423 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1424 ret = -EADDRNOTAVAIL;
1429 if (test_bit(HCI_UP, &hdev->flags)) {
1434 if (hdev->open(hdev)) {
1439 set_bit(HCI_RUNNING, &hdev->flags);
1440 hci_sock_dev_event(hdev, HCI_DEV_OPEN);
1442 atomic_set(&hdev->cmd_cnt, 1);
1443 set_bit(HCI_INIT, &hdev->flags);
1445 if (hci_dev_test_flag(hdev, HCI_SETUP) ||
1446 test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks)) {
1447 bool invalid_bdaddr;
1449 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1452 ret = hdev->setup(hdev);
1454 /* The transport driver can set the quirk to mark the
1455 * BD_ADDR invalid before creating the HCI device or in
1456 * its setup callback.
1458 invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR,
1464 if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks)) {
1465 if (!bacmp(&hdev->public_addr, BDADDR_ANY))
1466 hci_dev_get_bd_addr_from_property(hdev);
1468 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1470 ret = hdev->set_bdaddr(hdev,
1471 &hdev->public_addr);
1473 /* If setting of the BD_ADDR from the device
1474 * property succeeds, then treat the address
1475 * as valid even if the invalid BD_ADDR
1476 * quirk indicates otherwise.
1479 invalid_bdaddr = false;
1484 /* The transport driver can set these quirks before
1485 * creating the HCI device or in its setup callback.
1487 * For the invalid BD_ADDR quirk it is possible that
1488 * it becomes a valid address if the bootloader does
1489 * provide it (see above).
1491 * In case any of them is set, the controller has to
1492 * start up as unconfigured.
1494 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1496 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1498 /* For an unconfigured controller it is required to
1499 * read at least the version information provided by
1500 * the Read Local Version Information command.
1502 * If the set_bdaddr driver callback is provided, then
1503 * also the original Bluetooth public device address
1504 * will be read using the Read BD Address command.
1506 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1507 ret = __hci_unconf_init(hdev);
1510 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1511 /* If public address change is configured, ensure that
1512 * the address gets programmed. If the driver does not
1513 * support changing the public address, fail the power
1516 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1518 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1520 ret = -EADDRNOTAVAIL;
1524 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1525 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1526 ret = __hci_init(hdev);
1527 if (!ret && hdev->post_init)
1528 ret = hdev->post_init(hdev);
1532 /* If the HCI Reset command is clearing all diagnostic settings,
1533 * then they need to be reprogrammed after the init procedure
1536 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
1537 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1538 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1539 ret = hdev->set_diag(hdev, true);
1541 clear_bit(HCI_INIT, &hdev->flags);
1545 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1546 hci_adv_instances_set_rpa_expired(hdev, true);
1547 set_bit(HCI_UP, &hdev->flags);
1548 hci_sock_dev_event(hdev, HCI_DEV_UP);
1549 hci_leds_update_powered(hdev, true);
1550 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1551 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1552 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1553 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1554 hci_dev_test_flag(hdev, HCI_MGMT) &&
1555 hdev->dev_type == HCI_PRIMARY) {
1556 ret = __hci_req_hci_power_on(hdev);
1557 mgmt_power_on(hdev, ret);
1560 /* Init failed, cleanup */
1561 flush_work(&hdev->tx_work);
1562 flush_work(&hdev->cmd_work);
1563 flush_work(&hdev->rx_work);
1565 skb_queue_purge(&hdev->cmd_q);
1566 skb_queue_purge(&hdev->rx_q);
1571 if (hdev->sent_cmd) {
1572 kfree_skb(hdev->sent_cmd);
1573 hdev->sent_cmd = NULL;
1576 clear_bit(HCI_RUNNING, &hdev->flags);
1577 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1580 hdev->flags &= BIT(HCI_RAW);
1584 hci_req_sync_unlock(hdev);
1588 /* ---- HCI ioctl helpers ---- */
1590 int hci_dev_open(__u16 dev)
1592 struct hci_dev *hdev;
1595 hdev = hci_dev_get(dev);
1599 /* Devices that are marked as unconfigured can only be powered
1600 * up as user channel. Trying to bring them up as normal devices
1601 * will result into a failure. Only user channel operation is
1604 * When this function is called for a user channel, the flag
1605 * HCI_USER_CHANNEL will be set first before attempting to
1608 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1609 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1614 /* We need to ensure that no other power on/off work is pending
1615 * before proceeding to call hci_dev_do_open. This is
1616 * particularly important if the setup procedure has not yet
1619 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1620 cancel_delayed_work(&hdev->power_off);
1622 /* After this call it is guaranteed that the setup procedure
1623 * has finished. This means that error conditions like RFKILL
1624 * or no valid public or static random address apply.
1626 flush_workqueue(hdev->req_workqueue);
1628 /* For controllers not using the management interface and that
1629 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1630 * so that pairing works for them. Once the management interface
1631 * is in use this bit will be cleared again and userspace has
1632 * to explicitly enable it.
1634 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1635 !hci_dev_test_flag(hdev, HCI_MGMT))
1636 hci_dev_set_flag(hdev, HCI_BONDABLE);
1638 err = hci_dev_do_open(hdev);
1645 /* This function requires the caller holds hdev->lock */
1646 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1648 struct hci_conn_params *p;
1650 list_for_each_entry(p, &hdev->le_conn_params, list) {
1652 hci_conn_drop(p->conn);
1653 hci_conn_put(p->conn);
1656 list_del_init(&p->action);
1659 BT_DBG("All LE pending actions cleared");
1662 int hci_dev_do_close(struct hci_dev *hdev)
1666 BT_DBG("%s %p", hdev->name, hdev);
1668 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
1669 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1670 test_bit(HCI_UP, &hdev->flags)) {
1671 /* Execute vendor specific shutdown routine */
1673 hdev->shutdown(hdev);
1676 cancel_delayed_work(&hdev->power_off);
1678 hci_request_cancel_all(hdev);
1679 hci_req_sync_lock(hdev);
1681 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1682 cancel_delayed_work_sync(&hdev->cmd_timer);
1683 hci_req_sync_unlock(hdev);
1687 hci_leds_update_powered(hdev, false);
1689 /* Flush RX and TX works */
1690 flush_work(&hdev->tx_work);
1691 flush_work(&hdev->rx_work);
1693 if (hdev->discov_timeout > 0) {
1694 hdev->discov_timeout = 0;
1695 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1696 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1699 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1700 cancel_delayed_work(&hdev->service_cache);
1702 if (hci_dev_test_flag(hdev, HCI_MGMT)) {
1703 struct adv_info *adv_instance;
1705 cancel_delayed_work_sync(&hdev->rpa_expired);
1707 list_for_each_entry(adv_instance, &hdev->adv_instances, list)
1708 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1711 /* Avoid potential lockdep warnings from the *_flush() calls by
1712 * ensuring the workqueue is empty up front.
1714 drain_workqueue(hdev->workqueue);
1718 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1720 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1722 if (!auto_off && hdev->dev_type == HCI_PRIMARY &&
1723 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1724 hci_dev_test_flag(hdev, HCI_MGMT))
1725 __mgmt_power_off(hdev);
1727 hci_inquiry_cache_flush(hdev);
1728 hci_pend_le_actions_clear(hdev);
1729 hci_conn_hash_flush(hdev);
1730 hci_dev_unlock(hdev);
1732 smp_unregister(hdev);
1734 hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1740 skb_queue_purge(&hdev->cmd_q);
1741 atomic_set(&hdev->cmd_cnt, 1);
1742 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1743 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1744 set_bit(HCI_INIT, &hdev->flags);
1745 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT, NULL);
1746 clear_bit(HCI_INIT, &hdev->flags);
1749 /* flush cmd work */
1750 flush_work(&hdev->cmd_work);
1753 skb_queue_purge(&hdev->rx_q);
1754 skb_queue_purge(&hdev->cmd_q);
1755 skb_queue_purge(&hdev->raw_q);
1757 /* Drop last sent command */
1758 if (hdev->sent_cmd) {
1759 cancel_delayed_work_sync(&hdev->cmd_timer);
1760 kfree_skb(hdev->sent_cmd);
1761 hdev->sent_cmd = NULL;
1764 clear_bit(HCI_RUNNING, &hdev->flags);
1765 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1767 /* After this point our queues are empty
1768 * and no tasks are scheduled. */
1772 hdev->flags &= BIT(HCI_RAW);
1773 hci_dev_clear_volatile_flags(hdev);
1775 /* Controller radio is available but is currently powered down */
1776 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1778 memset(hdev->eir, 0, sizeof(hdev->eir));
1779 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1780 bacpy(&hdev->random_addr, BDADDR_ANY);
1782 hci_req_sync_unlock(hdev);
1788 int hci_dev_close(__u16 dev)
1790 struct hci_dev *hdev;
1793 hdev = hci_dev_get(dev);
1797 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1802 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1803 cancel_delayed_work(&hdev->power_off);
1805 err = hci_dev_do_close(hdev);
1812 static int hci_dev_do_reset(struct hci_dev *hdev)
1816 BT_DBG("%s %p", hdev->name, hdev);
1818 hci_req_sync_lock(hdev);
1821 skb_queue_purge(&hdev->rx_q);
1822 skb_queue_purge(&hdev->cmd_q);
1824 /* Avoid potential lockdep warnings from the *_flush() calls by
1825 * ensuring the workqueue is empty up front.
1827 drain_workqueue(hdev->workqueue);
1830 hci_inquiry_cache_flush(hdev);
1831 hci_conn_hash_flush(hdev);
1832 hci_dev_unlock(hdev);
1837 atomic_set(&hdev->cmd_cnt, 1);
1838 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1840 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT, NULL);
1842 hci_req_sync_unlock(hdev);
1846 int hci_dev_reset(__u16 dev)
1848 struct hci_dev *hdev;
1851 hdev = hci_dev_get(dev);
1855 if (!test_bit(HCI_UP, &hdev->flags)) {
1860 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1865 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1870 err = hci_dev_do_reset(hdev);
1877 int hci_dev_reset_stat(__u16 dev)
1879 struct hci_dev *hdev;
1882 hdev = hci_dev_get(dev);
1886 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1891 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1896 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1903 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1905 bool conn_changed, discov_changed;
1907 BT_DBG("%s scan 0x%02x", hdev->name, scan);
1909 if ((scan & SCAN_PAGE))
1910 conn_changed = !hci_dev_test_and_set_flag(hdev,
1913 conn_changed = hci_dev_test_and_clear_flag(hdev,
1916 if ((scan & SCAN_INQUIRY)) {
1917 discov_changed = !hci_dev_test_and_set_flag(hdev,
1920 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1921 discov_changed = hci_dev_test_and_clear_flag(hdev,
1925 if (!hci_dev_test_flag(hdev, HCI_MGMT))
1928 if (conn_changed || discov_changed) {
1929 /* In case this was disabled through mgmt */
1930 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
1932 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1933 hci_req_update_adv_data(hdev, hdev->cur_adv_instance);
1935 mgmt_new_settings(hdev);
1939 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1941 struct hci_dev *hdev;
1942 struct hci_dev_req dr;
1945 if (copy_from_user(&dr, arg, sizeof(dr)))
1948 hdev = hci_dev_get(dr.dev_id);
1952 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1957 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1962 if (hdev->dev_type != HCI_PRIMARY) {
1967 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1974 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1975 HCI_INIT_TIMEOUT, NULL);
1979 if (!lmp_encrypt_capable(hdev)) {
1984 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1985 /* Auth must be enabled first */
1986 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1987 HCI_INIT_TIMEOUT, NULL);
1992 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1993 HCI_INIT_TIMEOUT, NULL);
1997 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1998 HCI_INIT_TIMEOUT, NULL);
2000 /* Ensure that the connectable and discoverable states
2001 * get correctly modified as this was a non-mgmt change.
2004 hci_update_scan_state(hdev, dr.dev_opt);
2008 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
2009 HCI_INIT_TIMEOUT, NULL);
2012 case HCISETLINKMODE:
2013 hdev->link_mode = ((__u16) dr.dev_opt) &
2014 (HCI_LM_MASTER | HCI_LM_ACCEPT);
2018 if (hdev->pkt_type == (__u16) dr.dev_opt)
2021 hdev->pkt_type = (__u16) dr.dev_opt;
2022 mgmt_phy_configuration_changed(hdev, NULL);
2026 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
2027 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
2031 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
2032 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
2045 int hci_get_dev_list(void __user *arg)
2047 struct hci_dev *hdev;
2048 struct hci_dev_list_req *dl;
2049 struct hci_dev_req *dr;
2050 int n = 0, size, err;
2053 if (get_user(dev_num, (__u16 __user *) arg))
2056 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2059 size = sizeof(*dl) + dev_num * sizeof(*dr);
2061 dl = kzalloc(size, GFP_KERNEL);
2067 read_lock(&hci_dev_list_lock);
2068 list_for_each_entry(hdev, &hci_dev_list, list) {
2069 unsigned long flags = hdev->flags;
2071 /* When the auto-off is configured it means the transport
2072 * is running, but in that case still indicate that the
2073 * device is actually down.
2075 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2076 flags &= ~BIT(HCI_UP);
2078 (dr + n)->dev_id = hdev->id;
2079 (dr + n)->dev_opt = flags;
2084 read_unlock(&hci_dev_list_lock);
2087 size = sizeof(*dl) + n * sizeof(*dr);
2089 err = copy_to_user(arg, dl, size);
2092 return err ? -EFAULT : 0;
2095 int hci_get_dev_info(void __user *arg)
2097 struct hci_dev *hdev;
2098 struct hci_dev_info di;
2099 unsigned long flags;
2102 if (copy_from_user(&di, arg, sizeof(di)))
2105 hdev = hci_dev_get(di.dev_id);
2109 /* When the auto-off is configured it means the transport
2110 * is running, but in that case still indicate that the
2111 * device is actually down.
2113 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2114 flags = hdev->flags & ~BIT(HCI_UP);
2116 flags = hdev->flags;
2118 strcpy(di.name, hdev->name);
2119 di.bdaddr = hdev->bdaddr;
2120 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2122 di.pkt_type = hdev->pkt_type;
2123 if (lmp_bredr_capable(hdev)) {
2124 di.acl_mtu = hdev->acl_mtu;
2125 di.acl_pkts = hdev->acl_pkts;
2126 di.sco_mtu = hdev->sco_mtu;
2127 di.sco_pkts = hdev->sco_pkts;
2129 di.acl_mtu = hdev->le_mtu;
2130 di.acl_pkts = hdev->le_pkts;
2134 di.link_policy = hdev->link_policy;
2135 di.link_mode = hdev->link_mode;
2137 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2138 memcpy(&di.features, &hdev->features, sizeof(di.features));
2140 if (copy_to_user(arg, &di, sizeof(di)))
2148 /* ---- Interface to HCI drivers ---- */
2150 static int hci_rfkill_set_block(void *data, bool blocked)
2152 struct hci_dev *hdev = data;
2154 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2156 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2160 hci_dev_set_flag(hdev, HCI_RFKILLED);
2161 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2162 !hci_dev_test_flag(hdev, HCI_CONFIG))
2163 hci_dev_do_close(hdev);
2165 hci_dev_clear_flag(hdev, HCI_RFKILLED);
2171 static const struct rfkill_ops hci_rfkill_ops = {
2172 .set_block = hci_rfkill_set_block,
2175 static void hci_power_on(struct work_struct *work)
2177 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2180 BT_DBG("%s", hdev->name);
2182 if (test_bit(HCI_UP, &hdev->flags) &&
2183 hci_dev_test_flag(hdev, HCI_MGMT) &&
2184 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
2185 cancel_delayed_work(&hdev->power_off);
2186 hci_req_sync_lock(hdev);
2187 err = __hci_req_hci_power_on(hdev);
2188 hci_req_sync_unlock(hdev);
2189 mgmt_power_on(hdev, err);
2193 err = hci_dev_do_open(hdev);
2196 mgmt_set_powered_failed(hdev, err);
2197 hci_dev_unlock(hdev);
2201 /* During the HCI setup phase, a few error conditions are
2202 * ignored and they need to be checked now. If they are still
2203 * valid, it is important to turn the device back off.
2205 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2206 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2207 (hdev->dev_type == HCI_PRIMARY &&
2208 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2209 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2210 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2211 hci_dev_do_close(hdev);
2212 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2213 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2214 HCI_AUTO_OFF_TIMEOUT);
2217 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2218 /* For unconfigured devices, set the HCI_RAW flag
2219 * so that userspace can easily identify them.
2221 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2222 set_bit(HCI_RAW, &hdev->flags);
2224 /* For fully configured devices, this will send
2225 * the Index Added event. For unconfigured devices,
2226 * it will send Unconfigued Index Added event.
2228 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2229 * and no event will be send.
2231 mgmt_index_added(hdev);
2232 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2233 /* When the controller is now configured, then it
2234 * is important to clear the HCI_RAW flag.
2236 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2237 clear_bit(HCI_RAW, &hdev->flags);
2239 /* Powering on the controller with HCI_CONFIG set only
2240 * happens with the transition from unconfigured to
2241 * configured. This will send the Index Added event.
2243 mgmt_index_added(hdev);
2247 static void hci_power_off(struct work_struct *work)
2249 struct hci_dev *hdev = container_of(work, struct hci_dev,
2252 BT_DBG("%s", hdev->name);
2254 hci_dev_do_close(hdev);
2257 static void hci_error_reset(struct work_struct *work)
2259 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2261 BT_DBG("%s", hdev->name);
2264 hdev->hw_error(hdev, hdev->hw_error_code);
2266 bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
2268 if (hci_dev_do_close(hdev))
2271 hci_dev_do_open(hdev);
2274 void hci_uuids_clear(struct hci_dev *hdev)
2276 struct bt_uuid *uuid, *tmp;
2278 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2279 list_del(&uuid->list);
2284 void hci_link_keys_clear(struct hci_dev *hdev)
2286 struct link_key *key;
2288 list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2289 list_del_rcu(&key->list);
2290 kfree_rcu(key, rcu);
2294 void hci_smp_ltks_clear(struct hci_dev *hdev)
2298 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2299 list_del_rcu(&k->list);
2304 void hci_smp_irks_clear(struct hci_dev *hdev)
2308 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2309 list_del_rcu(&k->list);
2314 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2319 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2320 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2330 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2331 u8 key_type, u8 old_key_type)
2334 if (key_type < 0x03)
2337 /* Debug keys are insecure so don't store them persistently */
2338 if (key_type == HCI_LK_DEBUG_COMBINATION)
2341 /* Changed combination key and there's no previous one */
2342 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2345 /* Security mode 3 case */
2349 /* BR/EDR key derived using SC from an LE link */
2350 if (conn->type == LE_LINK)
2353 /* Neither local nor remote side had no-bonding as requirement */
2354 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2357 /* Local side had dedicated bonding as requirement */
2358 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2361 /* Remote side had dedicated bonding as requirement */
2362 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2365 /* If none of the above criteria match, then don't store the key
2370 static u8 ltk_role(u8 type)
2372 if (type == SMP_LTK)
2373 return HCI_ROLE_MASTER;
2375 return HCI_ROLE_SLAVE;
2378 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2379 u8 addr_type, u8 role)
2384 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2385 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2388 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2398 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2400 struct smp_irk *irk;
2403 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2404 if (!bacmp(&irk->rpa, rpa)) {
2410 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2411 if (smp_irk_matches(hdev, irk->val, rpa)) {
2412 bacpy(&irk->rpa, rpa);
2422 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2425 struct smp_irk *irk;
2427 /* Identity Address must be public or static random */
2428 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2432 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2433 if (addr_type == irk->addr_type &&
2434 bacmp(bdaddr, &irk->bdaddr) == 0) {
2444 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2445 bdaddr_t *bdaddr, u8 *val, u8 type,
2446 u8 pin_len, bool *persistent)
2448 struct link_key *key, *old_key;
2451 old_key = hci_find_link_key(hdev, bdaddr);
2453 old_key_type = old_key->type;
2456 old_key_type = conn ? conn->key_type : 0xff;
2457 key = kzalloc(sizeof(*key), GFP_KERNEL);
2460 list_add_rcu(&key->list, &hdev->link_keys);
2463 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2465 /* Some buggy controller combinations generate a changed
2466 * combination key for legacy pairing even when there's no
2468 if (type == HCI_LK_CHANGED_COMBINATION &&
2469 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2470 type = HCI_LK_COMBINATION;
2472 conn->key_type = type;
2475 bacpy(&key->bdaddr, bdaddr);
2476 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2477 key->pin_len = pin_len;
2479 if (type == HCI_LK_CHANGED_COMBINATION)
2480 key->type = old_key_type;
2485 *persistent = hci_persistent_key(hdev, conn, type,
2491 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2492 u8 addr_type, u8 type, u8 authenticated,
2493 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2495 struct smp_ltk *key, *old_key;
2496 u8 role = ltk_role(type);
2498 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2502 key = kzalloc(sizeof(*key), GFP_KERNEL);
2505 list_add_rcu(&key->list, &hdev->long_term_keys);
2508 bacpy(&key->bdaddr, bdaddr);
2509 key->bdaddr_type = addr_type;
2510 memcpy(key->val, tk, sizeof(key->val));
2511 key->authenticated = authenticated;
2514 key->enc_size = enc_size;
2520 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2521 u8 addr_type, u8 val[16], bdaddr_t *rpa)
2523 struct smp_irk *irk;
2525 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2527 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2531 bacpy(&irk->bdaddr, bdaddr);
2532 irk->addr_type = addr_type;
2534 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2537 memcpy(irk->val, val, 16);
2538 bacpy(&irk->rpa, rpa);
2543 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2545 struct link_key *key;
2547 key = hci_find_link_key(hdev, bdaddr);
2551 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2553 list_del_rcu(&key->list);
2554 kfree_rcu(key, rcu);
2559 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2564 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2565 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2568 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2570 list_del_rcu(&k->list);
2575 return removed ? 0 : -ENOENT;
2578 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2582 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2583 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2586 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2588 list_del_rcu(&k->list);
2593 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2596 struct smp_irk *irk;
2599 if (type == BDADDR_BREDR) {
2600 if (hci_find_link_key(hdev, bdaddr))
2605 /* Convert to HCI addr type which struct smp_ltk uses */
2606 if (type == BDADDR_LE_PUBLIC)
2607 addr_type = ADDR_LE_DEV_PUBLIC;
2609 addr_type = ADDR_LE_DEV_RANDOM;
2611 irk = hci_get_irk(hdev, bdaddr, addr_type);
2613 bdaddr = &irk->bdaddr;
2614 addr_type = irk->addr_type;
2618 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2619 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2629 /* HCI command timer function */
2630 static void hci_cmd_timeout(struct work_struct *work)
2632 struct hci_dev *hdev = container_of(work, struct hci_dev,
2635 if (hdev->sent_cmd) {
2636 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2637 u16 opcode = __le16_to_cpu(sent->opcode);
2639 bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
2641 bt_dev_err(hdev, "command tx timeout");
2644 if (hdev->cmd_timeout)
2645 hdev->cmd_timeout(hdev);
2647 atomic_set(&hdev->cmd_cnt, 1);
2648 queue_work(hdev->workqueue, &hdev->cmd_work);
2651 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2652 bdaddr_t *bdaddr, u8 bdaddr_type)
2654 struct oob_data *data;
2656 list_for_each_entry(data, &hdev->remote_oob_data, list) {
2657 if (bacmp(bdaddr, &data->bdaddr) != 0)
2659 if (data->bdaddr_type != bdaddr_type)
2667 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2670 struct oob_data *data;
2672 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2676 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2678 list_del(&data->list);
2684 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2686 struct oob_data *data, *n;
2688 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2689 list_del(&data->list);
2694 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2695 u8 bdaddr_type, u8 *hash192, u8 *rand192,
2696 u8 *hash256, u8 *rand256)
2698 struct oob_data *data;
2700 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2702 data = kmalloc(sizeof(*data), GFP_KERNEL);
2706 bacpy(&data->bdaddr, bdaddr);
2707 data->bdaddr_type = bdaddr_type;
2708 list_add(&data->list, &hdev->remote_oob_data);
2711 if (hash192 && rand192) {
2712 memcpy(data->hash192, hash192, sizeof(data->hash192));
2713 memcpy(data->rand192, rand192, sizeof(data->rand192));
2714 if (hash256 && rand256)
2715 data->present = 0x03;
2717 memset(data->hash192, 0, sizeof(data->hash192));
2718 memset(data->rand192, 0, sizeof(data->rand192));
2719 if (hash256 && rand256)
2720 data->present = 0x02;
2722 data->present = 0x00;
2725 if (hash256 && rand256) {
2726 memcpy(data->hash256, hash256, sizeof(data->hash256));
2727 memcpy(data->rand256, rand256, sizeof(data->rand256));
2729 memset(data->hash256, 0, sizeof(data->hash256));
2730 memset(data->rand256, 0, sizeof(data->rand256));
2731 if (hash192 && rand192)
2732 data->present = 0x01;
2735 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2740 /* This function requires the caller holds hdev->lock */
2741 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2743 struct adv_info *adv_instance;
2745 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2746 if (adv_instance->instance == instance)
2747 return adv_instance;
2753 /* This function requires the caller holds hdev->lock */
2754 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
2756 struct adv_info *cur_instance;
2758 cur_instance = hci_find_adv_instance(hdev, instance);
2762 if (cur_instance == list_last_entry(&hdev->adv_instances,
2763 struct adv_info, list))
2764 return list_first_entry(&hdev->adv_instances,
2765 struct adv_info, list);
2767 return list_next_entry(cur_instance, list);
2770 /* This function requires the caller holds hdev->lock */
2771 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2773 struct adv_info *adv_instance;
2775 adv_instance = hci_find_adv_instance(hdev, instance);
2779 BT_DBG("%s removing %dMR", hdev->name, instance);
2781 if (hdev->cur_adv_instance == instance) {
2782 if (hdev->adv_instance_timeout) {
2783 cancel_delayed_work(&hdev->adv_instance_expire);
2784 hdev->adv_instance_timeout = 0;
2786 hdev->cur_adv_instance = 0x00;
2789 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2791 list_del(&adv_instance->list);
2792 kfree(adv_instance);
2794 hdev->adv_instance_cnt--;
2799 void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
2801 struct adv_info *adv_instance, *n;
2803 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
2804 adv_instance->rpa_expired = rpa_expired;
2807 /* This function requires the caller holds hdev->lock */
2808 void hci_adv_instances_clear(struct hci_dev *hdev)
2810 struct adv_info *adv_instance, *n;
2812 if (hdev->adv_instance_timeout) {
2813 cancel_delayed_work(&hdev->adv_instance_expire);
2814 hdev->adv_instance_timeout = 0;
2817 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
2818 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
2819 list_del(&adv_instance->list);
2820 kfree(adv_instance);
2823 hdev->adv_instance_cnt = 0;
2824 hdev->cur_adv_instance = 0x00;
2827 static void adv_instance_rpa_expired(struct work_struct *work)
2829 struct adv_info *adv_instance = container_of(work, struct adv_info,
2830 rpa_expired_cb.work);
2834 adv_instance->rpa_expired = true;
2837 /* This function requires the caller holds hdev->lock */
2838 int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2839 u16 adv_data_len, u8 *adv_data,
2840 u16 scan_rsp_len, u8 *scan_rsp_data,
2841 u16 timeout, u16 duration)
2843 struct adv_info *adv_instance;
2845 adv_instance = hci_find_adv_instance(hdev, instance);
2847 memset(adv_instance->adv_data, 0,
2848 sizeof(adv_instance->adv_data));
2849 memset(adv_instance->scan_rsp_data, 0,
2850 sizeof(adv_instance->scan_rsp_data));
2852 if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
2853 instance < 1 || instance > HCI_MAX_ADV_INSTANCES)
2856 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
2860 adv_instance->pending = true;
2861 adv_instance->instance = instance;
2862 list_add(&adv_instance->list, &hdev->adv_instances);
2863 hdev->adv_instance_cnt++;
2866 adv_instance->flags = flags;
2867 adv_instance->adv_data_len = adv_data_len;
2868 adv_instance->scan_rsp_len = scan_rsp_len;
2871 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
2874 memcpy(adv_instance->scan_rsp_data,
2875 scan_rsp_data, scan_rsp_len);
2877 adv_instance->timeout = timeout;
2878 adv_instance->remaining_time = timeout;
2881 adv_instance->duration = HCI_DEFAULT_ADV_DURATION;
2883 adv_instance->duration = duration;
2885 adv_instance->tx_power = HCI_TX_POWER_INVALID;
2887 INIT_DELAYED_WORK(&adv_instance->rpa_expired_cb,
2888 adv_instance_rpa_expired);
2890 BT_DBG("%s for %dMR", hdev->name, instance);
2895 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2896 bdaddr_t *bdaddr, u8 type)
2898 struct bdaddr_list *b;
2900 list_for_each_entry(b, bdaddr_list, list) {
2901 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2908 struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
2909 struct list_head *bdaddr_list, bdaddr_t *bdaddr,
2912 struct bdaddr_list_with_irk *b;
2914 list_for_each_entry(b, bdaddr_list, list) {
2915 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2922 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2924 struct bdaddr_list *b, *n;
2926 list_for_each_entry_safe(b, n, bdaddr_list, list) {
2932 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2934 struct bdaddr_list *entry;
2936 if (!bacmp(bdaddr, BDADDR_ANY))
2939 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2942 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2946 bacpy(&entry->bdaddr, bdaddr);
2947 entry->bdaddr_type = type;
2949 list_add(&entry->list, list);
2954 int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2955 u8 type, u8 *peer_irk, u8 *local_irk)
2957 struct bdaddr_list_with_irk *entry;
2959 if (!bacmp(bdaddr, BDADDR_ANY))
2962 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2965 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2969 bacpy(&entry->bdaddr, bdaddr);
2970 entry->bdaddr_type = type;
2973 memcpy(entry->peer_irk, peer_irk, 16);
2976 memcpy(entry->local_irk, local_irk, 16);
2978 list_add(&entry->list, list);
2983 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2985 struct bdaddr_list *entry;
2987 if (!bacmp(bdaddr, BDADDR_ANY)) {
2988 hci_bdaddr_list_clear(list);
2992 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2996 list_del(&entry->list);
3002 int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
3005 struct bdaddr_list_with_irk *entry;
3007 if (!bacmp(bdaddr, BDADDR_ANY)) {
3008 hci_bdaddr_list_clear(list);
3012 entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
3016 list_del(&entry->list);
3022 /* This function requires the caller holds hdev->lock */
3023 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
3024 bdaddr_t *addr, u8 addr_type)
3026 struct hci_conn_params *params;
3028 list_for_each_entry(params, &hdev->le_conn_params, list) {
3029 if (bacmp(¶ms->addr, addr) == 0 &&
3030 params->addr_type == addr_type) {
3038 /* This function requires the caller holds hdev->lock */
3039 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
3040 bdaddr_t *addr, u8 addr_type)
3042 struct hci_conn_params *param;
3044 list_for_each_entry(param, list, action) {
3045 if (bacmp(¶m->addr, addr) == 0 &&
3046 param->addr_type == addr_type)
3053 /* This function requires the caller holds hdev->lock */
3054 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
3055 bdaddr_t *addr, u8 addr_type)
3057 struct hci_conn_params *params;
3059 params = hci_conn_params_lookup(hdev, addr, addr_type);
3063 params = kzalloc(sizeof(*params), GFP_KERNEL);
3065 bt_dev_err(hdev, "out of memory");
3069 bacpy(¶ms->addr, addr);
3070 params->addr_type = addr_type;
3072 list_add(¶ms->list, &hdev->le_conn_params);
3073 INIT_LIST_HEAD(¶ms->action);
3075 params->conn_min_interval = hdev->le_conn_min_interval;
3076 params->conn_max_interval = hdev->le_conn_max_interval;
3077 params->conn_latency = hdev->le_conn_latency;
3078 params->supervision_timeout = hdev->le_supv_timeout;
3079 params->auto_connect = HCI_AUTO_CONN_DISABLED;
3081 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3086 static void hci_conn_params_free(struct hci_conn_params *params)
3089 hci_conn_drop(params->conn);
3090 hci_conn_put(params->conn);
3093 list_del(¶ms->action);
3094 list_del(¶ms->list);
3098 /* This function requires the caller holds hdev->lock */
3099 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
3101 struct hci_conn_params *params;
3103 params = hci_conn_params_lookup(hdev, addr, addr_type);
3107 hci_conn_params_free(params);
3109 hci_update_background_scan(hdev);
3111 BT_DBG("addr %pMR (type %u)", addr, addr_type);
3114 /* This function requires the caller holds hdev->lock */
3115 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
3117 struct hci_conn_params *params, *tmp;
3119 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3120 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3123 /* If trying to estabilish one time connection to disabled
3124 * device, leave the params, but mark them as just once.
3126 if (params->explicit_connect) {
3127 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3131 list_del(¶ms->list);
3135 BT_DBG("All LE disabled connection parameters were removed");
3138 /* This function requires the caller holds hdev->lock */
3139 static void hci_conn_params_clear_all(struct hci_dev *hdev)
3141 struct hci_conn_params *params, *tmp;
3143 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
3144 hci_conn_params_free(params);
3146 BT_DBG("All LE connection parameters were removed");
3149 /* Copy the Identity Address of the controller.
3151 * If the controller has a public BD_ADDR, then by default use that one.
3152 * If this is a LE only controller without a public address, default to
3153 * the static random address.
3155 * For debugging purposes it is possible to force controllers with a
3156 * public address to use the static random address instead.
3158 * In case BR/EDR has been disabled on a dual-mode controller and
3159 * userspace has configured a static address, then that address
3160 * becomes the identity address instead of the public BR/EDR address.
3162 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3165 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
3166 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
3167 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3168 bacmp(&hdev->static_addr, BDADDR_ANY))) {
3169 bacpy(bdaddr, &hdev->static_addr);
3170 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3172 bacpy(bdaddr, &hdev->bdaddr);
3173 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3177 /* Alloc HCI device */
3178 struct hci_dev *hci_alloc_dev(void)
3180 struct hci_dev *hdev;
3182 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3186 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3187 hdev->esco_type = (ESCO_HV1);
3188 hdev->link_mode = (HCI_LM_ACCEPT);
3189 hdev->num_iac = 0x01; /* One IAC support is mandatory */
3190 hdev->io_capability = 0x03; /* No Input No Output */
3191 hdev->manufacturer = 0xffff; /* Default to internal use */
3192 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3193 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3194 hdev->adv_instance_cnt = 0;
3195 hdev->cur_adv_instance = 0x00;
3196 hdev->adv_instance_timeout = 0;
3198 hdev->sniff_max_interval = 800;
3199 hdev->sniff_min_interval = 80;
3201 hdev->le_adv_channel_map = 0x07;
3202 hdev->le_adv_min_interval = 0x0800;
3203 hdev->le_adv_max_interval = 0x0800;
3204 hdev->le_scan_interval = 0x0060;
3205 hdev->le_scan_window = 0x0030;
3206 hdev->le_conn_min_interval = 0x0018;
3207 hdev->le_conn_max_interval = 0x0028;
3208 hdev->le_conn_latency = 0x0000;
3209 hdev->le_supv_timeout = 0x002a;
3210 hdev->le_def_tx_len = 0x001b;
3211 hdev->le_def_tx_time = 0x0148;
3212 hdev->le_max_tx_len = 0x001b;
3213 hdev->le_max_tx_time = 0x0148;
3214 hdev->le_max_rx_len = 0x001b;
3215 hdev->le_max_rx_time = 0x0148;
3216 hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
3217 hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
3218 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
3219 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
3220 hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
3222 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3223 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3224 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3225 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3226 hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
3227 hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
3229 mutex_init(&hdev->lock);
3230 mutex_init(&hdev->req_lock);
3232 INIT_LIST_HEAD(&hdev->mgmt_pending);
3233 INIT_LIST_HEAD(&hdev->blacklist);
3234 INIT_LIST_HEAD(&hdev->whitelist);
3235 INIT_LIST_HEAD(&hdev->uuids);
3236 INIT_LIST_HEAD(&hdev->link_keys);
3237 INIT_LIST_HEAD(&hdev->long_term_keys);
3238 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3239 INIT_LIST_HEAD(&hdev->remote_oob_data);
3240 INIT_LIST_HEAD(&hdev->le_white_list);
3241 INIT_LIST_HEAD(&hdev->le_resolv_list);
3242 INIT_LIST_HEAD(&hdev->le_conn_params);
3243 INIT_LIST_HEAD(&hdev->pend_le_conns);
3244 INIT_LIST_HEAD(&hdev->pend_le_reports);
3245 INIT_LIST_HEAD(&hdev->conn_hash.list);
3246 INIT_LIST_HEAD(&hdev->adv_instances);
3248 INIT_WORK(&hdev->rx_work, hci_rx_work);
3249 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3250 INIT_WORK(&hdev->tx_work, hci_tx_work);
3251 INIT_WORK(&hdev->power_on, hci_power_on);
3252 INIT_WORK(&hdev->error_reset, hci_error_reset);
3254 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3256 skb_queue_head_init(&hdev->rx_q);
3257 skb_queue_head_init(&hdev->cmd_q);
3258 skb_queue_head_init(&hdev->raw_q);
3260 init_waitqueue_head(&hdev->req_wait_q);
3262 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3264 hci_request_setup(hdev);
3266 hci_init_sysfs(hdev);
3267 discovery_init(hdev);
3271 EXPORT_SYMBOL(hci_alloc_dev);
3273 /* Free HCI device */
3274 void hci_free_dev(struct hci_dev *hdev)
3276 /* will free via device release */
3277 put_device(&hdev->dev);
3279 EXPORT_SYMBOL(hci_free_dev);
3281 /* Register HCI device */
3282 int hci_register_dev(struct hci_dev *hdev)
3286 if (!hdev->open || !hdev->close || !hdev->send)
3289 /* Do not allow HCI_AMP devices to register at index 0,
3290 * so the index can be used as the AMP controller ID.
3292 switch (hdev->dev_type) {
3294 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3297 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3306 sprintf(hdev->name, "hci%d", id);
3309 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3311 hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
3312 if (!hdev->workqueue) {
3317 hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
3319 if (!hdev->req_workqueue) {
3320 destroy_workqueue(hdev->workqueue);
3325 if (!IS_ERR_OR_NULL(bt_debugfs))
3326 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3328 dev_set_name(&hdev->dev, "%s", hdev->name);
3330 error = device_add(&hdev->dev);
3334 hci_leds_init(hdev);
3336 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3337 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3340 if (rfkill_register(hdev->rfkill) < 0) {
3341 rfkill_destroy(hdev->rfkill);
3342 hdev->rfkill = NULL;
3346 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3347 hci_dev_set_flag(hdev, HCI_RFKILLED);
3349 hci_dev_set_flag(hdev, HCI_SETUP);
3350 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3352 if (hdev->dev_type == HCI_PRIMARY) {
3353 /* Assume BR/EDR support until proven otherwise (such as
3354 * through reading supported features during init.
3356 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3359 write_lock(&hci_dev_list_lock);
3360 list_add(&hdev->list, &hci_dev_list);
3361 write_unlock(&hci_dev_list_lock);
3363 /* Devices that are marked for raw-only usage are unconfigured
3364 * and should not be included in normal operation.
3366 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3367 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3369 hci_sock_dev_event(hdev, HCI_DEV_REG);
3372 queue_work(hdev->req_workqueue, &hdev->power_on);
3377 destroy_workqueue(hdev->workqueue);
3378 destroy_workqueue(hdev->req_workqueue);
3380 ida_simple_remove(&hci_index_ida, hdev->id);
3384 EXPORT_SYMBOL(hci_register_dev);
3386 /* Unregister HCI device */
3387 void hci_unregister_dev(struct hci_dev *hdev)
3391 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3393 hci_dev_set_flag(hdev, HCI_UNREGISTER);
3397 write_lock(&hci_dev_list_lock);
3398 list_del(&hdev->list);
3399 write_unlock(&hci_dev_list_lock);
3401 cancel_work_sync(&hdev->power_on);
3403 hci_dev_do_close(hdev);
3405 if (!test_bit(HCI_INIT, &hdev->flags) &&
3406 !hci_dev_test_flag(hdev, HCI_SETUP) &&
3407 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
3409 mgmt_index_removed(hdev);
3410 hci_dev_unlock(hdev);
3413 /* mgmt_index_removed should take care of emptying the
3415 BUG_ON(!list_empty(&hdev->mgmt_pending));
3417 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
3420 rfkill_unregister(hdev->rfkill);
3421 rfkill_destroy(hdev->rfkill);
3424 device_del(&hdev->dev);
3426 debugfs_remove_recursive(hdev->debugfs);
3427 kfree_const(hdev->hw_info);
3428 kfree_const(hdev->fw_info);
3430 destroy_workqueue(hdev->workqueue);
3431 destroy_workqueue(hdev->req_workqueue);
3434 hci_bdaddr_list_clear(&hdev->blacklist);
3435 hci_bdaddr_list_clear(&hdev->whitelist);
3436 hci_uuids_clear(hdev);
3437 hci_link_keys_clear(hdev);
3438 hci_smp_ltks_clear(hdev);
3439 hci_smp_irks_clear(hdev);
3440 hci_remote_oob_data_clear(hdev);
3441 hci_adv_instances_clear(hdev);
3442 hci_bdaddr_list_clear(&hdev->le_white_list);
3443 hci_bdaddr_list_clear(&hdev->le_resolv_list);
3444 hci_conn_params_clear_all(hdev);
3445 hci_discovery_filter_clear(hdev);
3446 hci_dev_unlock(hdev);
3450 ida_simple_remove(&hci_index_ida, id);
3452 EXPORT_SYMBOL(hci_unregister_dev);
3454 /* Suspend HCI device */
3455 int hci_suspend_dev(struct hci_dev *hdev)
3457 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
3460 EXPORT_SYMBOL(hci_suspend_dev);
3462 /* Resume HCI device */
3463 int hci_resume_dev(struct hci_dev *hdev)
3465 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
3468 EXPORT_SYMBOL(hci_resume_dev);
3470 /* Reset HCI device */
3471 int hci_reset_dev(struct hci_dev *hdev)
3473 static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3474 struct sk_buff *skb;
3476 skb = bt_skb_alloc(3, GFP_ATOMIC);
3480 hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
3481 skb_put_data(skb, hw_err, 3);
3483 /* Send Hardware Error to upper stack */
3484 return hci_recv_frame(hdev, skb);
3486 EXPORT_SYMBOL(hci_reset_dev);
3488 /* Receive frame from HCI drivers */
3489 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
3491 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
3492 && !test_bit(HCI_INIT, &hdev->flags))) {
3497 if (hci_skb_pkt_type(skb) != HCI_EVENT_PKT &&
3498 hci_skb_pkt_type(skb) != HCI_ACLDATA_PKT &&
3499 hci_skb_pkt_type(skb) != HCI_SCODATA_PKT) {
3505 bt_cb(skb)->incoming = 1;
3508 __net_timestamp(skb);
3510 skb_queue_tail(&hdev->rx_q, skb);
3511 queue_work(hdev->workqueue, &hdev->rx_work);
3515 EXPORT_SYMBOL(hci_recv_frame);
3517 /* Receive diagnostic message from HCI drivers */
3518 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
3520 /* Mark as diagnostic packet */
3521 hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
3524 __net_timestamp(skb);
3526 skb_queue_tail(&hdev->rx_q, skb);
3527 queue_work(hdev->workqueue, &hdev->rx_work);
3531 EXPORT_SYMBOL(hci_recv_diag);
3533 void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
3537 va_start(vargs, fmt);
3538 kfree_const(hdev->hw_info);
3539 hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3542 EXPORT_SYMBOL(hci_set_hw_info);
3544 void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
3548 va_start(vargs, fmt);
3549 kfree_const(hdev->fw_info);
3550 hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
3553 EXPORT_SYMBOL(hci_set_fw_info);
3555 /* ---- Interface to upper protocols ---- */
3557 int hci_register_cb(struct hci_cb *cb)
3559 BT_DBG("%p name %s", cb, cb->name);
3561 mutex_lock(&hci_cb_list_lock);
3562 list_add_tail(&cb->list, &hci_cb_list);
3563 mutex_unlock(&hci_cb_list_lock);
3567 EXPORT_SYMBOL(hci_register_cb);
3569 int hci_unregister_cb(struct hci_cb *cb)
3571 BT_DBG("%p name %s", cb, cb->name);
3573 mutex_lock(&hci_cb_list_lock);
3574 list_del(&cb->list);
3575 mutex_unlock(&hci_cb_list_lock);
3579 EXPORT_SYMBOL(hci_unregister_cb);
3581 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
3585 BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3589 __net_timestamp(skb);
3591 /* Send copy to monitor */
3592 hci_send_to_monitor(hdev, skb);
3594 if (atomic_read(&hdev->promisc)) {
3595 /* Send copy to the sockets */
3596 hci_send_to_sock(hdev, skb);
3599 /* Get rid of skb owner, prior to sending to the driver. */
3602 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3607 err = hdev->send(hdev, skb);
3609 bt_dev_err(hdev, "sending frame failed (%d)", err);
3614 /* Send HCI command */
3615 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3618 struct sk_buff *skb;
3620 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3622 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3624 bt_dev_err(hdev, "no memory for command");
3628 /* Stand-alone HCI commands must be flagged as
3629 * single-command requests.
3631 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
3633 skb_queue_tail(&hdev->cmd_q, skb);
3634 queue_work(hdev->workqueue, &hdev->cmd_work);
3639 int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
3642 struct sk_buff *skb;
3644 if (hci_opcode_ogf(opcode) != 0x3f) {
3645 /* A controller receiving a command shall respond with either
3646 * a Command Status Event or a Command Complete Event.
3647 * Therefore, all standard HCI commands must be sent via the
3648 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
3649 * Some vendors do not comply with this rule for vendor-specific
3650 * commands and do not return any event. We want to support
3651 * unresponded commands for such cases only.
3653 bt_dev_err(hdev, "unresponded command not supported");
3657 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3659 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
3664 hci_send_frame(hdev, skb);
3668 EXPORT_SYMBOL(__hci_cmd_send);
3670 /* Get data from the previously sent command */
3671 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
3673 struct hci_command_hdr *hdr;
3675 if (!hdev->sent_cmd)
3678 hdr = (void *) hdev->sent_cmd->data;
3680 if (hdr->opcode != cpu_to_le16(opcode))
3683 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3685 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3688 /* Send HCI command and wait for command commplete event */
3689 struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
3690 const void *param, u32 timeout)
3692 struct sk_buff *skb;
3694 if (!test_bit(HCI_UP, &hdev->flags))
3695 return ERR_PTR(-ENETDOWN);
3697 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
3699 hci_req_sync_lock(hdev);
3700 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
3701 hci_req_sync_unlock(hdev);
3705 EXPORT_SYMBOL(hci_cmd_sync);
3708 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3710 struct hci_acl_hdr *hdr;
3713 skb_push(skb, HCI_ACL_HDR_SIZE);
3714 skb_reset_transport_header(skb);
3715 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3716 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3717 hdr->dlen = cpu_to_le16(len);
3720 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
3721 struct sk_buff *skb, __u16 flags)
3723 struct hci_conn *conn = chan->conn;
3724 struct hci_dev *hdev = conn->hdev;
3725 struct sk_buff *list;
3727 skb->len = skb_headlen(skb);
3730 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3732 switch (hdev->dev_type) {
3734 hci_add_acl_hdr(skb, conn->handle, flags);
3737 hci_add_acl_hdr(skb, chan->handle, flags);
3740 bt_dev_err(hdev, "unknown dev_type %d", hdev->dev_type);
3744 list = skb_shinfo(skb)->frag_list;
3746 /* Non fragmented */
3747 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3749 skb_queue_tail(queue, skb);
3752 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3754 skb_shinfo(skb)->frag_list = NULL;
3756 /* Queue all fragments atomically. We need to use spin_lock_bh
3757 * here because of 6LoWPAN links, as there this function is
3758 * called from softirq and using normal spin lock could cause
3761 spin_lock_bh(&queue->lock);
3763 __skb_queue_tail(queue, skb);
3765 flags &= ~ACL_START;
3768 skb = list; list = list->next;
3770 hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3771 hci_add_acl_hdr(skb, conn->handle, flags);
3773 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3775 __skb_queue_tail(queue, skb);
3778 spin_unlock_bh(&queue->lock);
3782 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3784 struct hci_dev *hdev = chan->conn->hdev;
3786 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
3788 hci_queue_acl(chan, &chan->data_q, skb, flags);
3790 queue_work(hdev->workqueue, &hdev->tx_work);
3794 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
3796 struct hci_dev *hdev = conn->hdev;
3797 struct hci_sco_hdr hdr;
3799 BT_DBG("%s len %d", hdev->name, skb->len);
3801 hdr.handle = cpu_to_le16(conn->handle);
3802 hdr.dlen = skb->len;
3804 skb_push(skb, HCI_SCO_HDR_SIZE);
3805 skb_reset_transport_header(skb);
3806 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
3808 hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
3810 skb_queue_tail(&conn->data_q, skb);
3811 queue_work(hdev->workqueue, &hdev->tx_work);
3814 /* ---- HCI TX task (outgoing data) ---- */
3816 /* HCI Connection scheduler */
3817 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3820 struct hci_conn_hash *h = &hdev->conn_hash;
3821 struct hci_conn *conn = NULL, *c;
3822 unsigned int num = 0, min = ~0;
3824 /* We don't have to lock device here. Connections are always
3825 * added and removed with TX task disabled. */
3829 list_for_each_entry_rcu(c, &h->list, list) {
3830 if (c->type != type || skb_queue_empty(&c->data_q))
3833 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3838 if (c->sent < min) {
3843 if (hci_conn_num(hdev, type) == num)
3852 switch (conn->type) {
3854 cnt = hdev->acl_cnt;
3858 cnt = hdev->sco_cnt;
3861 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3865 bt_dev_err(hdev, "unknown link type %d", conn->type);
3873 BT_DBG("conn %p quote %d", conn, *quote);
3877 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
3879 struct hci_conn_hash *h = &hdev->conn_hash;
3882 bt_dev_err(hdev, "link tx timeout");
3886 /* Kill stalled connections */
3887 list_for_each_entry_rcu(c, &h->list, list) {
3888 if (c->type == type && c->sent) {
3889 bt_dev_err(hdev, "killing stalled connection %pMR",
3891 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3898 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3901 struct hci_conn_hash *h = &hdev->conn_hash;
3902 struct hci_chan *chan = NULL;
3903 unsigned int num = 0, min = ~0, cur_prio = 0;
3904 struct hci_conn *conn;
3905 int cnt, q, conn_num = 0;
3907 BT_DBG("%s", hdev->name);
3911 list_for_each_entry_rcu(conn, &h->list, list) {
3912 struct hci_chan *tmp;
3914 if (conn->type != type)
3917 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3922 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
3923 struct sk_buff *skb;
3925 if (skb_queue_empty(&tmp->data_q))
3928 skb = skb_peek(&tmp->data_q);
3929 if (skb->priority < cur_prio)
3932 if (skb->priority > cur_prio) {
3935 cur_prio = skb->priority;
3940 if (conn->sent < min) {
3946 if (hci_conn_num(hdev, type) == conn_num)
3955 switch (chan->conn->type) {
3957 cnt = hdev->acl_cnt;
3960 cnt = hdev->block_cnt;
3964 cnt = hdev->sco_cnt;
3967 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3971 bt_dev_err(hdev, "unknown link type %d", chan->conn->type);
3976 BT_DBG("chan %p quote %d", chan, *quote);
3980 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3982 struct hci_conn_hash *h = &hdev->conn_hash;
3983 struct hci_conn *conn;
3986 BT_DBG("%s", hdev->name);
3990 list_for_each_entry_rcu(conn, &h->list, list) {
3991 struct hci_chan *chan;
3993 if (conn->type != type)
3996 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
4001 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
4002 struct sk_buff *skb;
4009 if (skb_queue_empty(&chan->data_q))
4012 skb = skb_peek(&chan->data_q);
4013 if (skb->priority >= HCI_PRIO_MAX - 1)
4016 skb->priority = HCI_PRIO_MAX - 1;
4018 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
4022 if (hci_conn_num(hdev, type) == num)
4030 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
4032 /* Calculate count of blocks used by this packet */
4033 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
4036 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
4038 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
4039 /* ACL tx timeout must be longer than maximum
4040 * link supervision timeout (40.9 seconds) */
4041 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
4042 HCI_ACL_TX_TIMEOUT))
4043 hci_link_tx_to(hdev, ACL_LINK);
4047 static void hci_sched_acl_pkt(struct hci_dev *hdev)
4049 unsigned int cnt = hdev->acl_cnt;
4050 struct hci_chan *chan;
4051 struct sk_buff *skb;
4054 __check_timeout(hdev, cnt);
4056 while (hdev->acl_cnt &&
4057 (chan = hci_chan_sent(hdev, ACL_LINK, "e))) {
4058 u32 priority = (skb_peek(&chan->data_q))->priority;
4059 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4060 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4061 skb->len, skb->priority);
4063 /* Stop if priority has changed */
4064 if (skb->priority < priority)
4067 skb = skb_dequeue(&chan->data_q);
4069 hci_conn_enter_active_mode(chan->conn,
4070 bt_cb(skb)->force_active);
4072 hci_send_frame(hdev, skb);
4073 hdev->acl_last_tx = jiffies;
4081 if (cnt != hdev->acl_cnt)
4082 hci_prio_recalculate(hdev, ACL_LINK);
4085 static void hci_sched_acl_blk(struct hci_dev *hdev)
4087 unsigned int cnt = hdev->block_cnt;
4088 struct hci_chan *chan;
4089 struct sk_buff *skb;
4093 __check_timeout(hdev, cnt);
4095 BT_DBG("%s", hdev->name);
4097 if (hdev->dev_type == HCI_AMP)
4102 while (hdev->block_cnt > 0 &&
4103 (chan = hci_chan_sent(hdev, type, "e))) {
4104 u32 priority = (skb_peek(&chan->data_q))->priority;
4105 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
4108 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4109 skb->len, skb->priority);
4111 /* Stop if priority has changed */
4112 if (skb->priority < priority)
4115 skb = skb_dequeue(&chan->data_q);
4117 blocks = __get_blocks(hdev, skb);
4118 if (blocks > hdev->block_cnt)
4121 hci_conn_enter_active_mode(chan->conn,
4122 bt_cb(skb)->force_active);
4124 hci_send_frame(hdev, skb);
4125 hdev->acl_last_tx = jiffies;
4127 hdev->block_cnt -= blocks;
4130 chan->sent += blocks;
4131 chan->conn->sent += blocks;
4135 if (cnt != hdev->block_cnt)
4136 hci_prio_recalculate(hdev, type);
4139 static void hci_sched_acl(struct hci_dev *hdev)
4141 BT_DBG("%s", hdev->name);
4143 /* No ACL link over BR/EDR controller */
4144 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_PRIMARY)
4147 /* No AMP link over AMP controller */
4148 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4151 switch (hdev->flow_ctl_mode) {
4152 case HCI_FLOW_CTL_MODE_PACKET_BASED:
4153 hci_sched_acl_pkt(hdev);
4156 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4157 hci_sched_acl_blk(hdev);
4163 static void hci_sched_sco(struct hci_dev *hdev)
4165 struct hci_conn *conn;
4166 struct sk_buff *skb;
4169 BT_DBG("%s", hdev->name);
4171 if (!hci_conn_num(hdev, SCO_LINK))
4174 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) {
4175 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4176 BT_DBG("skb %p len %d", skb, skb->len);
4177 hci_send_frame(hdev, skb);
4180 if (conn->sent == ~0)
4186 static void hci_sched_esco(struct hci_dev *hdev)
4188 struct hci_conn *conn;
4189 struct sk_buff *skb;
4192 BT_DBG("%s", hdev->name);
4194 if (!hci_conn_num(hdev, ESCO_LINK))
4197 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4199 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4200 BT_DBG("skb %p len %d", skb, skb->len);
4201 hci_send_frame(hdev, skb);
4204 if (conn->sent == ~0)
4210 static void hci_sched_le(struct hci_dev *hdev)
4212 struct hci_chan *chan;
4213 struct sk_buff *skb;
4214 int quote, cnt, tmp;
4216 BT_DBG("%s", hdev->name);
4218 if (!hci_conn_num(hdev, LE_LINK))
4221 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
4222 /* LE tx timeout must be longer than maximum
4223 * link supervision timeout (40.9 seconds) */
4224 if (!hdev->le_cnt && hdev->le_pkts &&
4225 time_after(jiffies, hdev->le_last_tx + HZ * 45))
4226 hci_link_tx_to(hdev, LE_LINK);
4229 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
4231 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, "e))) {
4232 u32 priority = (skb_peek(&chan->data_q))->priority;
4233 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4234 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4235 skb->len, skb->priority);
4237 /* Stop if priority has changed */
4238 if (skb->priority < priority)
4241 skb = skb_dequeue(&chan->data_q);
4243 hci_send_frame(hdev, skb);
4244 hdev->le_last_tx = jiffies;
4255 hdev->acl_cnt = cnt;
4258 hci_prio_recalculate(hdev, LE_LINK);
4261 static void hci_tx_work(struct work_struct *work)
4263 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
4264 struct sk_buff *skb;
4266 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
4267 hdev->sco_cnt, hdev->le_cnt);
4269 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4270 /* Schedule queues and send stuff to HCI driver */
4271 hci_sched_acl(hdev);
4272 hci_sched_sco(hdev);
4273 hci_sched_esco(hdev);
4277 /* Send next queued raw (unknown type) packet */
4278 while ((skb = skb_dequeue(&hdev->raw_q)))
4279 hci_send_frame(hdev, skb);
4282 /* ----- HCI RX task (incoming data processing) ----- */
4284 /* ACL data packet */
4285 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4287 struct hci_acl_hdr *hdr = (void *) skb->data;
4288 struct hci_conn *conn;
4289 __u16 handle, flags;
4291 skb_pull(skb, HCI_ACL_HDR_SIZE);
4293 handle = __le16_to_cpu(hdr->handle);
4294 flags = hci_flags(handle);
4295 handle = hci_handle(handle);
4297 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4300 hdev->stat.acl_rx++;
4303 conn = hci_conn_hash_lookup_handle(hdev, handle);
4304 hci_dev_unlock(hdev);
4307 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
4309 /* Send to upper protocol */
4310 l2cap_recv_acldata(conn, skb, flags);
4313 bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
4320 /* SCO data packet */
4321 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4323 struct hci_sco_hdr *hdr = (void *) skb->data;
4324 struct hci_conn *conn;
4327 skb_pull(skb, HCI_SCO_HDR_SIZE);
4329 handle = __le16_to_cpu(hdr->handle);
4331 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
4333 hdev->stat.sco_rx++;
4336 conn = hci_conn_hash_lookup_handle(hdev, handle);
4337 hci_dev_unlock(hdev);
4340 /* Send to upper protocol */
4341 sco_recv_scodata(conn, skb);
4344 bt_dev_err(hdev, "SCO packet for unknown connection handle %d",
4351 static bool hci_req_is_complete(struct hci_dev *hdev)
4353 struct sk_buff *skb;
4355 skb = skb_peek(&hdev->cmd_q);
4359 return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
4362 static void hci_resend_last(struct hci_dev *hdev)
4364 struct hci_command_hdr *sent;
4365 struct sk_buff *skb;
4368 if (!hdev->sent_cmd)
4371 sent = (void *) hdev->sent_cmd->data;
4372 opcode = __le16_to_cpu(sent->opcode);
4373 if (opcode == HCI_OP_RESET)
4376 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4380 skb_queue_head(&hdev->cmd_q, skb);
4381 queue_work(hdev->workqueue, &hdev->cmd_work);
4384 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4385 hci_req_complete_t *req_complete,
4386 hci_req_complete_skb_t *req_complete_skb)
4388 struct sk_buff *skb;
4389 unsigned long flags;
4391 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4393 /* If the completed command doesn't match the last one that was
4394 * sent we need to do special handling of it.
4396 if (!hci_sent_cmd_data(hdev, opcode)) {
4397 /* Some CSR based controllers generate a spontaneous
4398 * reset complete event during init and any pending
4399 * command will never be completed. In such a case we
4400 * need to resend whatever was the last sent
4403 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4404 hci_resend_last(hdev);
4409 /* If we reach this point this event matches the last command sent */
4410 hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
4412 /* If the command succeeded and there's still more commands in
4413 * this request the request is not yet complete.
4415 if (!status && !hci_req_is_complete(hdev))
4418 /* If this was the last command in a request the complete
4419 * callback would be found in hdev->sent_cmd instead of the
4420 * command queue (hdev->cmd_q).
4422 if (bt_cb(hdev->sent_cmd)->hci.req_flags & HCI_REQ_SKB) {
4423 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
4427 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4428 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
4432 /* Remove all pending commands belonging to this request */
4433 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4434 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4435 if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
4436 __skb_queue_head(&hdev->cmd_q, skb);
4440 if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
4441 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4443 *req_complete = bt_cb(skb)->hci.req_complete;
4446 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4449 static void hci_rx_work(struct work_struct *work)
4451 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
4452 struct sk_buff *skb;
4454 BT_DBG("%s", hdev->name);
4456 while ((skb = skb_dequeue(&hdev->rx_q))) {
4457 /* Send copy to monitor */
4458 hci_send_to_monitor(hdev, skb);
4460 if (atomic_read(&hdev->promisc)) {
4461 /* Send copy to the sockets */
4462 hci_send_to_sock(hdev, skb);
4465 /* If the device has been opened in HCI_USER_CHANNEL,
4466 * the userspace has exclusive access to device.
4467 * When device is HCI_INIT, we still need to process
4468 * the data packets to the driver in order
4469 * to complete its setup().
4471 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4472 !test_bit(HCI_INIT, &hdev->flags)) {
4477 if (test_bit(HCI_INIT, &hdev->flags)) {
4478 /* Don't process data packets in this states. */
4479 switch (hci_skb_pkt_type(skb)) {
4480 case HCI_ACLDATA_PKT:
4481 case HCI_SCODATA_PKT:
4488 switch (hci_skb_pkt_type(skb)) {
4490 BT_DBG("%s Event packet", hdev->name);
4491 hci_event_packet(hdev, skb);
4494 case HCI_ACLDATA_PKT:
4495 BT_DBG("%s ACL data packet", hdev->name);
4496 hci_acldata_packet(hdev, skb);
4499 case HCI_SCODATA_PKT:
4500 BT_DBG("%s SCO data packet", hdev->name);
4501 hci_scodata_packet(hdev, skb);
4511 static void hci_cmd_work(struct work_struct *work)
4513 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4514 struct sk_buff *skb;
4516 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4517 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4519 /* Send queued commands */
4520 if (atomic_read(&hdev->cmd_cnt)) {
4521 skb = skb_dequeue(&hdev->cmd_q);
4525 kfree_skb(hdev->sent_cmd);
4527 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4528 if (hdev->sent_cmd) {
4529 if (hci_req_status_pend(hdev))
4530 hci_dev_set_flag(hdev, HCI_CMD_PENDING);
4531 atomic_dec(&hdev->cmd_cnt);
4532 hci_send_frame(hdev, skb);
4533 if (test_bit(HCI_RESET, &hdev->flags))
4534 cancel_delayed_work(&hdev->cmd_timer);
4536 schedule_delayed_work(&hdev->cmd_timer,
4539 skb_queue_head(&hdev->cmd_q, skb);
4540 queue_work(hdev->workqueue, &hdev->cmd_work);