2 BlueZ - Bluetooth protocol stack for Linux
3 Copyright (C) 2000-2001 Qualcomm Incorporated
4 Copyright (C) 2011 ProFUSION Embedded Systems
6 Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
8 This program is free software; you can redistribute it and/or modify
9 it under the terms of the GNU General Public License version 2 as
10 published by the Free Software Foundation;
12 THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13 OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14 FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15 IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16 CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17 WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18 ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19 OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
21 ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22 COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23 SOFTWARE IS DISCLAIMED.
26 /* Bluetooth HCI core. */
28 #include <linux/export.h>
29 #include <linux/idr.h>
30 #include <linux/rfkill.h>
31 #include <linux/debugfs.h>
32 #include <linux/crypto.h>
33 #include <asm/unaligned.h>
35 #include <net/bluetooth/bluetooth.h>
36 #include <net/bluetooth/hci_core.h>
37 #include <net/bluetooth/l2cap.h>
38 #include <net/bluetooth/mgmt.h>
40 #include "hci_request.h"
41 #include "hci_debugfs.h"
44 static void hci_rx_work(struct work_struct *work);
45 static void hci_cmd_work(struct work_struct *work);
46 static void hci_tx_work(struct work_struct *work);
49 LIST_HEAD(hci_dev_list);
50 DEFINE_RWLOCK(hci_dev_list_lock);
52 /* HCI callback list */
53 LIST_HEAD(hci_cb_list);
54 DEFINE_MUTEX(hci_cb_list_lock);
56 /* HCI ID Numbering */
57 static DEFINE_IDA(hci_index_ida);
59 /* ----- HCI requests ----- */
61 #define HCI_REQ_DONE 0
62 #define HCI_REQ_PEND 1
63 #define HCI_REQ_CANCELED 2
65 #define hci_req_lock(d) mutex_lock(&d->req_lock)
66 #define hci_req_unlock(d) mutex_unlock(&d->req_lock)
68 /* ---- HCI debugfs entries ---- */
70 static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
71 size_t count, loff_t *ppos)
73 struct hci_dev *hdev = file->private_data;
76 buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y': 'N';
79 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
82 static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
83 size_t count, loff_t *ppos)
85 struct hci_dev *hdev = file->private_data;
88 size_t buf_size = min(count, (sizeof(buf)-1));
91 if (!test_bit(HCI_UP, &hdev->flags))
94 if (copy_from_user(buf, user_buf, buf_size))
98 if (strtobool(buf, &enable))
101 if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
106 skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
109 skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
111 hci_req_unlock(hdev);
118 hci_dev_change_flag(hdev, HCI_DUT_MODE);
123 static const struct file_operations dut_mode_fops = {
125 .read = dut_mode_read,
126 .write = dut_mode_write,
127 .llseek = default_llseek,
130 static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
131 size_t count, loff_t *ppos)
133 struct hci_dev *hdev = file->private_data;
136 buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y': 'N';
139 return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
142 static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
143 size_t count, loff_t *ppos)
145 struct hci_dev *hdev = file->private_data;
147 size_t buf_size = min(count, (sizeof(buf)-1));
151 if (copy_from_user(buf, user_buf, buf_size))
154 buf[buf_size] = '\0';
155 if (strtobool(buf, &enable))
158 /* When the diagnostic flags are not persistent and the transport
159 * is not active, then there is no need for the vendor callback.
161 * Instead just store the desired value. If needed the setting
162 * will be programmed when the controller gets powered on.
164 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
165 !test_bit(HCI_RUNNING, &hdev->flags))
169 err = hdev->set_diag(hdev, enable);
170 hci_req_unlock(hdev);
177 hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
179 hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);
184 static const struct file_operations vendor_diag_fops = {
186 .read = vendor_diag_read,
187 .write = vendor_diag_write,
188 .llseek = default_llseek,
191 static void hci_debugfs_create_basic(struct hci_dev *hdev)
193 debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
197 debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
201 /* ---- HCI requests ---- */
203 static void hci_req_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
206 BT_DBG("%s result 0x%2.2x", hdev->name, result);
208 if (hdev->req_status == HCI_REQ_PEND) {
209 hdev->req_result = result;
210 hdev->req_status = HCI_REQ_DONE;
212 hdev->req_skb = skb_get(skb);
213 wake_up_interruptible(&hdev->req_wait_q);
217 static void hci_req_cancel(struct hci_dev *hdev, int err)
219 BT_DBG("%s err 0x%2.2x", hdev->name, err);
221 if (hdev->req_status == HCI_REQ_PEND) {
222 hdev->req_result = err;
223 hdev->req_status = HCI_REQ_CANCELED;
224 wake_up_interruptible(&hdev->req_wait_q);
228 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
229 const void *param, u8 event, u32 timeout)
231 DECLARE_WAITQUEUE(wait, current);
232 struct hci_request req;
236 BT_DBG("%s", hdev->name);
238 hci_req_init(&req, hdev);
240 hci_req_add_ev(&req, opcode, plen, param, event);
242 hdev->req_status = HCI_REQ_PEND;
244 add_wait_queue(&hdev->req_wait_q, &wait);
245 set_current_state(TASK_INTERRUPTIBLE);
247 err = hci_req_run_skb(&req, hci_req_sync_complete);
249 remove_wait_queue(&hdev->req_wait_q, &wait);
250 set_current_state(TASK_RUNNING);
254 schedule_timeout(timeout);
256 remove_wait_queue(&hdev->req_wait_q, &wait);
258 if (signal_pending(current))
259 return ERR_PTR(-EINTR);
261 switch (hdev->req_status) {
263 err = -bt_to_errno(hdev->req_result);
266 case HCI_REQ_CANCELED:
267 err = -hdev->req_result;
275 hdev->req_status = hdev->req_result = 0;
277 hdev->req_skb = NULL;
279 BT_DBG("%s end: err %d", hdev->name, err);
287 return ERR_PTR(-ENODATA);
291 EXPORT_SYMBOL(__hci_cmd_sync_ev);
293 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
294 const void *param, u32 timeout)
296 return __hci_cmd_sync_ev(hdev, opcode, plen, param, 0, timeout);
298 EXPORT_SYMBOL(__hci_cmd_sync);
300 /* Execute request and wait for completion. */
301 static int __hci_req_sync(struct hci_dev *hdev,
302 void (*func)(struct hci_request *req,
304 unsigned long opt, __u32 timeout)
306 struct hci_request req;
307 DECLARE_WAITQUEUE(wait, current);
310 BT_DBG("%s start", hdev->name);
312 hci_req_init(&req, hdev);
314 hdev->req_status = HCI_REQ_PEND;
318 add_wait_queue(&hdev->req_wait_q, &wait);
319 set_current_state(TASK_INTERRUPTIBLE);
321 err = hci_req_run_skb(&req, hci_req_sync_complete);
323 hdev->req_status = 0;
325 remove_wait_queue(&hdev->req_wait_q, &wait);
326 set_current_state(TASK_RUNNING);
328 /* ENODATA means the HCI request command queue is empty.
329 * This can happen when a request with conditionals doesn't
330 * trigger any commands to be sent. This is normal behavior
331 * and should not trigger an error return.
339 schedule_timeout(timeout);
341 remove_wait_queue(&hdev->req_wait_q, &wait);
343 if (signal_pending(current))
346 switch (hdev->req_status) {
348 err = -bt_to_errno(hdev->req_result);
351 case HCI_REQ_CANCELED:
352 err = -hdev->req_result;
360 hdev->req_status = hdev->req_result = 0;
362 BT_DBG("%s end: err %d", hdev->name, err);
367 static int hci_req_sync(struct hci_dev *hdev,
368 void (*req)(struct hci_request *req,
370 unsigned long opt, __u32 timeout)
374 if (!test_bit(HCI_UP, &hdev->flags))
377 /* Serialize all requests */
379 ret = __hci_req_sync(hdev, req, opt, timeout);
380 hci_req_unlock(hdev);
385 static void hci_reset_req(struct hci_request *req, unsigned long opt)
387 BT_DBG("%s %ld", req->hdev->name, opt);
390 set_bit(HCI_RESET, &req->hdev->flags);
391 hci_req_add(req, HCI_OP_RESET, 0, NULL);
394 static void bredr_init(struct hci_request *req)
396 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
398 /* Read Local Supported Features */
399 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
401 /* Read Local Version */
402 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
404 /* Read BD Address */
405 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
408 static void amp_init1(struct hci_request *req)
410 req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
412 /* Read Local Version */
413 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
415 /* Read Local Supported Commands */
416 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
418 /* Read Local AMP Info */
419 hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
421 /* Read Data Blk size */
422 hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
424 /* Read Flow Control Mode */
425 hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);
427 /* Read Location Data */
428 hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
431 static void amp_init2(struct hci_request *req)
433 /* Read Local Supported Features. Not all AMP controllers
434 * support this so it's placed conditionally in the second
437 if (req->hdev->commands[14] & 0x20)
438 hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
441 static void hci_init1_req(struct hci_request *req, unsigned long opt)
443 struct hci_dev *hdev = req->hdev;
445 BT_DBG("%s %ld", hdev->name, opt);
448 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
449 hci_reset_req(req, 0);
451 switch (hdev->dev_type) {
461 BT_ERR("Unknown device type %d", hdev->dev_type);
466 static void bredr_setup(struct hci_request *req)
471 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
472 hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
474 /* Read Class of Device */
475 hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
477 /* Read Local Name */
478 hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
480 /* Read Voice Setting */
481 hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
483 /* Read Number of Supported IAC */
484 hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);
486 /* Read Current IAC LAP */
487 hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);
489 /* Clear Event Filters */
490 flt_type = HCI_FLT_CLEAR_ALL;
491 hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
493 /* Connection accept timeout ~20 secs */
494 param = cpu_to_le16(0x7d00);
495 hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, ¶m);
498 static void le_setup(struct hci_request *req)
500 struct hci_dev *hdev = req->hdev;
502 /* Read LE Buffer Size */
503 hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
505 /* Read LE Local Supported Features */
506 hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
508 /* Read LE Supported States */
509 hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);
511 /* Read LE White List Size */
512 hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE, 0, NULL);
514 /* Clear LE White List */
515 hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
517 /* LE-only controllers have LE implicitly enabled */
518 if (!lmp_bredr_capable(hdev))
519 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
522 static void hci_setup_event_mask(struct hci_request *req)
524 struct hci_dev *hdev = req->hdev;
526 /* The second byte is 0xff instead of 0x9f (two reserved bits
527 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
530 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
532 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
533 * any event mask for pre 1.2 devices.
535 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
538 if (lmp_bredr_capable(hdev)) {
539 events[4] |= 0x01; /* Flow Specification Complete */
540 events[4] |= 0x02; /* Inquiry Result with RSSI */
541 events[4] |= 0x04; /* Read Remote Extended Features Complete */
542 events[5] |= 0x08; /* Synchronous Connection Complete */
543 events[5] |= 0x10; /* Synchronous Connection Changed */
545 /* Use a different default for LE-only devices */
546 memset(events, 0, sizeof(events));
547 events[0] |= 0x10; /* Disconnection Complete */
548 events[1] |= 0x08; /* Read Remote Version Information Complete */
549 events[1] |= 0x20; /* Command Complete */
550 events[1] |= 0x40; /* Command Status */
551 events[1] |= 0x80; /* Hardware Error */
552 events[2] |= 0x04; /* Number of Completed Packets */
553 events[3] |= 0x02; /* Data Buffer Overflow */
555 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
556 events[0] |= 0x80; /* Encryption Change */
557 events[5] |= 0x80; /* Encryption Key Refresh Complete */
561 if (lmp_inq_rssi_capable(hdev))
562 events[4] |= 0x02; /* Inquiry Result with RSSI */
564 if (lmp_sniffsubr_capable(hdev))
565 events[5] |= 0x20; /* Sniff Subrating */
567 if (lmp_pause_enc_capable(hdev))
568 events[5] |= 0x80; /* Encryption Key Refresh Complete */
570 if (lmp_ext_inq_capable(hdev))
571 events[5] |= 0x40; /* Extended Inquiry Result */
573 if (lmp_no_flush_capable(hdev))
574 events[7] |= 0x01; /* Enhanced Flush Complete */
576 if (lmp_lsto_capable(hdev))
577 events[6] |= 0x80; /* Link Supervision Timeout Changed */
579 if (lmp_ssp_capable(hdev)) {
580 events[6] |= 0x01; /* IO Capability Request */
581 events[6] |= 0x02; /* IO Capability Response */
582 events[6] |= 0x04; /* User Confirmation Request */
583 events[6] |= 0x08; /* User Passkey Request */
584 events[6] |= 0x10; /* Remote OOB Data Request */
585 events[6] |= 0x20; /* Simple Pairing Complete */
586 events[7] |= 0x04; /* User Passkey Notification */
587 events[7] |= 0x08; /* Keypress Notification */
588 events[7] |= 0x10; /* Remote Host Supported
589 * Features Notification
593 if (lmp_le_capable(hdev))
594 events[7] |= 0x20; /* LE Meta-Event */
596 hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
599 static void hci_init2_req(struct hci_request *req, unsigned long opt)
601 struct hci_dev *hdev = req->hdev;
603 if (hdev->dev_type == HCI_AMP)
604 return amp_init2(req);
606 if (lmp_bredr_capable(hdev))
609 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
611 if (lmp_le_capable(hdev))
614 /* All Bluetooth 1.2 and later controllers should support the
615 * HCI command for reading the local supported commands.
617 * Unfortunately some controllers indicate Bluetooth 1.2 support,
618 * but do not have support for this command. If that is the case,
619 * the driver can quirk the behavior and skip reading the local
620 * supported commands.
622 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
623 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
624 hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
626 if (lmp_ssp_capable(hdev)) {
627 /* When SSP is available, then the host features page
628 * should also be available as well. However some
629 * controllers list the max_page as 0 as long as SSP
630 * has not been enabled. To achieve proper debugging
631 * output, force the minimum max_page to 1 at least.
633 hdev->max_page = 0x01;
635 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
638 hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
639 sizeof(mode), &mode);
641 struct hci_cp_write_eir cp;
643 memset(hdev->eir, 0, sizeof(hdev->eir));
644 memset(&cp, 0, sizeof(cp));
646 hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
650 if (lmp_inq_rssi_capable(hdev) ||
651 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
654 /* If Extended Inquiry Result events are supported, then
655 * they are clearly preferred over Inquiry Result with RSSI
658 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
660 hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
663 if (lmp_inq_tx_pwr_capable(hdev))
664 hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
666 if (lmp_ext_feat_capable(hdev)) {
667 struct hci_cp_read_local_ext_features cp;
670 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
674 if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
676 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
681 static void hci_setup_link_policy(struct hci_request *req)
683 struct hci_dev *hdev = req->hdev;
684 struct hci_cp_write_def_link_policy cp;
687 if (lmp_rswitch_capable(hdev))
688 link_policy |= HCI_LP_RSWITCH;
689 if (lmp_hold_capable(hdev))
690 link_policy |= HCI_LP_HOLD;
691 if (lmp_sniff_capable(hdev))
692 link_policy |= HCI_LP_SNIFF;
693 if (lmp_park_capable(hdev))
694 link_policy |= HCI_LP_PARK;
696 cp.policy = cpu_to_le16(link_policy);
697 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
700 static void hci_set_le_support(struct hci_request *req)
702 struct hci_dev *hdev = req->hdev;
703 struct hci_cp_write_le_host_supported cp;
705 /* LE-only devices do not support explicit enablement */
706 if (!lmp_bredr_capable(hdev))
709 memset(&cp, 0, sizeof(cp));
711 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
716 if (cp.le != lmp_host_le_capable(hdev))
717 hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
721 static void hci_set_event_mask_page_2(struct hci_request *req)
723 struct hci_dev *hdev = req->hdev;
724 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
726 /* If Connectionless Slave Broadcast master role is supported
727 * enable all necessary events for it.
729 if (lmp_csb_master_capable(hdev)) {
730 events[1] |= 0x40; /* Triggered Clock Capture */
731 events[1] |= 0x80; /* Synchronization Train Complete */
732 events[2] |= 0x10; /* Slave Page Response Timeout */
733 events[2] |= 0x20; /* CSB Channel Map Change */
736 /* If Connectionless Slave Broadcast slave role is supported
737 * enable all necessary events for it.
739 if (lmp_csb_slave_capable(hdev)) {
740 events[2] |= 0x01; /* Synchronization Train Received */
741 events[2] |= 0x02; /* CSB Receive */
742 events[2] |= 0x04; /* CSB Timeout */
743 events[2] |= 0x08; /* Truncated Page Complete */
746 /* Enable Authenticated Payload Timeout Expired event if supported */
747 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING)
750 hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2, sizeof(events), events);
753 static void hci_init3_req(struct hci_request *req, unsigned long opt)
755 struct hci_dev *hdev = req->hdev;
758 hci_setup_event_mask(req);
760 if (hdev->commands[6] & 0x20 &&
761 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
762 struct hci_cp_read_stored_link_key cp;
764 bacpy(&cp.bdaddr, BDADDR_ANY);
766 hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
769 if (hdev->commands[5] & 0x10)
770 hci_setup_link_policy(req);
772 if (hdev->commands[8] & 0x01)
773 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);
775 /* Some older Broadcom based Bluetooth 1.2 controllers do not
776 * support the Read Page Scan Type command. Check support for
777 * this command in the bit mask of supported commands.
779 if (hdev->commands[13] & 0x01)
780 hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);
782 if (lmp_le_capable(hdev)) {
785 memset(events, 0, sizeof(events));
788 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
789 events[0] |= 0x10; /* LE Long Term Key Request */
791 /* If controller supports the Connection Parameters Request
792 * Link Layer Procedure, enable the corresponding event.
794 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
795 events[0] |= 0x20; /* LE Remote Connection
799 /* If the controller supports the Data Length Extension
800 * feature, enable the corresponding event.
802 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
803 events[0] |= 0x40; /* LE Data Length Change */
805 /* If the controller supports Extended Scanner Filter
806 * Policies, enable the correspondig event.
808 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
809 events[1] |= 0x04; /* LE Direct Advertising
813 /* If the controller supports the LE Read Local P-256
814 * Public Key command, enable the corresponding event.
816 if (hdev->commands[34] & 0x02)
817 events[0] |= 0x80; /* LE Read Local P-256
818 * Public Key Complete
821 /* If the controller supports the LE Generate DHKey
822 * command, enable the corresponding event.
824 if (hdev->commands[34] & 0x04)
825 events[1] |= 0x01; /* LE Generate DHKey Complete */
827 hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
830 if (hdev->commands[25] & 0x40) {
831 /* Read LE Advertising Channel TX Power */
832 hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
835 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
836 /* Read LE Maximum Data Length */
837 hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);
839 /* Read LE Suggested Default Data Length */
840 hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
843 hci_set_le_support(req);
846 /* Read features beyond page 1 if available */
847 for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
848 struct hci_cp_read_local_ext_features cp;
851 hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
856 static void hci_init4_req(struct hci_request *req, unsigned long opt)
858 struct hci_dev *hdev = req->hdev;
860 /* Some Broadcom based Bluetooth controllers do not support the
861 * Delete Stored Link Key command. They are clearly indicating its
862 * absence in the bit mask of supported commands.
864 * Check the supported commands and only if the the command is marked
865 * as supported send it. If not supported assume that the controller
866 * does not have actual support for stored link keys which makes this
867 * command redundant anyway.
869 * Some controllers indicate that they support handling deleting
870 * stored link keys, but they don't. The quirk lets a driver
871 * just disable this command.
873 if (hdev->commands[6] & 0x80 &&
874 !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
875 struct hci_cp_delete_stored_link_key cp;
877 bacpy(&cp.bdaddr, BDADDR_ANY);
878 cp.delete_all = 0x01;
879 hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
883 /* Set event mask page 2 if the HCI command for it is supported */
884 if (hdev->commands[22] & 0x04)
885 hci_set_event_mask_page_2(req);
887 /* Read local codec list if the HCI command is supported */
888 if (hdev->commands[29] & 0x20)
889 hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);
891 /* Get MWS transport configuration if the HCI command is supported */
892 if (hdev->commands[30] & 0x08)
893 hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);
895 /* Check for Synchronization Train support */
896 if (lmp_sync_train_capable(hdev))
897 hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
899 /* Enable Secure Connections if supported and configured */
900 if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
901 bredr_sc_enabled(hdev)) {
904 hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
905 sizeof(support), &support);
909 static int __hci_init(struct hci_dev *hdev)
913 err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT);
917 if (hci_dev_test_flag(hdev, HCI_SETUP))
918 hci_debugfs_create_basic(hdev);
920 err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT);
924 /* HCI_BREDR covers both single-mode LE, BR/EDR and dual-mode
925 * BR/EDR/LE type controllers. AMP controllers only need the
926 * first two stages of init.
928 if (hdev->dev_type != HCI_BREDR)
931 err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT);
935 err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT);
939 /* This function is only called when the controller is actually in
940 * configured state. When the controller is marked as unconfigured,
941 * this initialization procedure is not run.
943 * It means that it is possible that a controller runs through its
944 * setup phase and then discovers missing settings. If that is the
945 * case, then this function will not be called. It then will only
946 * be called during the config phase.
948 * So only when in setup phase or config phase, create the debugfs
949 * entries and register the SMP channels.
951 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
952 !hci_dev_test_flag(hdev, HCI_CONFIG))
955 hci_debugfs_create_common(hdev);
957 if (lmp_bredr_capable(hdev))
958 hci_debugfs_create_bredr(hdev);
960 if (lmp_le_capable(hdev))
961 hci_debugfs_create_le(hdev);
966 static void hci_init0_req(struct hci_request *req, unsigned long opt)
968 struct hci_dev *hdev = req->hdev;
970 BT_DBG("%s %ld", hdev->name, opt);
973 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
974 hci_reset_req(req, 0);
976 /* Read Local Version */
977 hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
979 /* Read BD Address */
980 if (hdev->set_bdaddr)
981 hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
984 static int __hci_unconf_init(struct hci_dev *hdev)
988 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
991 err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT);
995 if (hci_dev_test_flag(hdev, HCI_SETUP))
996 hci_debugfs_create_basic(hdev);
1001 static void hci_scan_req(struct hci_request *req, unsigned long opt)
1005 BT_DBG("%s %x", req->hdev->name, scan);
1007 /* Inquiry and Page scans */
1008 hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1011 static void hci_auth_req(struct hci_request *req, unsigned long opt)
1015 BT_DBG("%s %x", req->hdev->name, auth);
1017 /* Authentication */
1018 hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1021 static void hci_encrypt_req(struct hci_request *req, unsigned long opt)
1025 BT_DBG("%s %x", req->hdev->name, encrypt);
1028 hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1031 static void hci_linkpol_req(struct hci_request *req, unsigned long opt)
1033 __le16 policy = cpu_to_le16(opt);
1035 BT_DBG("%s %x", req->hdev->name, policy);
1037 /* Default link policy */
1038 hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
1041 /* Get HCI device by index.
1042 * Device is held on return. */
1043 struct hci_dev *hci_dev_get(int index)
1045 struct hci_dev *hdev = NULL, *d;
1047 BT_DBG("%d", index);
1052 read_lock(&hci_dev_list_lock);
1053 list_for_each_entry(d, &hci_dev_list, list) {
1054 if (d->id == index) {
1055 hdev = hci_dev_hold(d);
1059 read_unlock(&hci_dev_list_lock);
1063 /* ---- Inquiry support ---- */
1065 bool hci_discovery_active(struct hci_dev *hdev)
1067 struct discovery_state *discov = &hdev->discovery;
1069 switch (discov->state) {
1070 case DISCOVERY_FINDING:
1071 case DISCOVERY_RESOLVING:
1079 void hci_discovery_set_state(struct hci_dev *hdev, int state)
1081 int old_state = hdev->discovery.state;
1083 BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);
1085 if (old_state == state)
1088 hdev->discovery.state = state;
1091 case DISCOVERY_STOPPED:
1092 hci_update_background_scan(hdev);
1094 if (old_state != DISCOVERY_STARTING)
1095 mgmt_discovering(hdev, 0);
1097 case DISCOVERY_STARTING:
1099 case DISCOVERY_FINDING:
1100 mgmt_discovering(hdev, 1);
1102 case DISCOVERY_RESOLVING:
1104 case DISCOVERY_STOPPING:
1109 void hci_inquiry_cache_flush(struct hci_dev *hdev)
1111 struct discovery_state *cache = &hdev->discovery;
1112 struct inquiry_entry *p, *n;
1114 list_for_each_entry_safe(p, n, &cache->all, all) {
1119 INIT_LIST_HEAD(&cache->unknown);
1120 INIT_LIST_HEAD(&cache->resolve);
1123 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
1126 struct discovery_state *cache = &hdev->discovery;
1127 struct inquiry_entry *e;
1129 BT_DBG("cache %p, %pMR", cache, bdaddr);
1131 list_for_each_entry(e, &cache->all, all) {
1132 if (!bacmp(&e->data.bdaddr, bdaddr))
1139 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
1142 struct discovery_state *cache = &hdev->discovery;
1143 struct inquiry_entry *e;
1145 BT_DBG("cache %p, %pMR", cache, bdaddr);
1147 list_for_each_entry(e, &cache->unknown, list) {
1148 if (!bacmp(&e->data.bdaddr, bdaddr))
1155 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
1159 struct discovery_state *cache = &hdev->discovery;
1160 struct inquiry_entry *e;
1162 BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
1164 list_for_each_entry(e, &cache->resolve, list) {
1165 if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
1167 if (!bacmp(&e->data.bdaddr, bdaddr))
1174 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
1175 struct inquiry_entry *ie)
1177 struct discovery_state *cache = &hdev->discovery;
1178 struct list_head *pos = &cache->resolve;
1179 struct inquiry_entry *p;
1181 list_del(&ie->list);
1183 list_for_each_entry(p, &cache->resolve, list) {
1184 if (p->name_state != NAME_PENDING &&
1185 abs(p->data.rssi) >= abs(ie->data.rssi))
1190 list_add(&ie->list, pos);
1193 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
1196 struct discovery_state *cache = &hdev->discovery;
1197 struct inquiry_entry *ie;
1200 BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
1202 hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
1204 if (!data->ssp_mode)
1205 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1207 ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
1209 if (!ie->data.ssp_mode)
1210 flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
1212 if (ie->name_state == NAME_NEEDED &&
1213 data->rssi != ie->data.rssi) {
1214 ie->data.rssi = data->rssi;
1215 hci_inquiry_cache_update_resolve(hdev, ie);
1221 /* Entry not in the cache. Add new one. */
1222 ie = kzalloc(sizeof(*ie), GFP_KERNEL);
1224 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1228 list_add(&ie->all, &cache->all);
1231 ie->name_state = NAME_KNOWN;
1233 ie->name_state = NAME_NOT_KNOWN;
1234 list_add(&ie->list, &cache->unknown);
1238 if (name_known && ie->name_state != NAME_KNOWN &&
1239 ie->name_state != NAME_PENDING) {
1240 ie->name_state = NAME_KNOWN;
1241 list_del(&ie->list);
1244 memcpy(&ie->data, data, sizeof(*data));
1245 ie->timestamp = jiffies;
1246 cache->timestamp = jiffies;
1248 if (ie->name_state == NAME_NOT_KNOWN)
1249 flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
1255 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
1257 struct discovery_state *cache = &hdev->discovery;
1258 struct inquiry_info *info = (struct inquiry_info *) buf;
1259 struct inquiry_entry *e;
1262 list_for_each_entry(e, &cache->all, all) {
1263 struct inquiry_data *data = &e->data;
1268 bacpy(&info->bdaddr, &data->bdaddr);
1269 info->pscan_rep_mode = data->pscan_rep_mode;
1270 info->pscan_period_mode = data->pscan_period_mode;
1271 info->pscan_mode = data->pscan_mode;
1272 memcpy(info->dev_class, data->dev_class, 3);
1273 info->clock_offset = data->clock_offset;
1279 BT_DBG("cache %p, copied %d", cache, copied);
1283 static void hci_inq_req(struct hci_request *req, unsigned long opt)
1285 struct hci_inquiry_req *ir = (struct hci_inquiry_req *) opt;
1286 struct hci_dev *hdev = req->hdev;
1287 struct hci_cp_inquiry cp;
1289 BT_DBG("%s", hdev->name);
1291 if (test_bit(HCI_INQUIRY, &hdev->flags))
1295 memcpy(&cp.lap, &ir->lap, 3);
1296 cp.length = ir->length;
1297 cp.num_rsp = ir->num_rsp;
1298 hci_req_add(req, HCI_OP_INQUIRY, sizeof(cp), &cp);
1301 int hci_inquiry(void __user *arg)
1303 __u8 __user *ptr = arg;
1304 struct hci_inquiry_req ir;
1305 struct hci_dev *hdev;
1306 int err = 0, do_inquiry = 0, max_rsp;
1310 if (copy_from_user(&ir, ptr, sizeof(ir)))
1313 hdev = hci_dev_get(ir.dev_id);
1317 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1322 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1327 if (hdev->dev_type != HCI_BREDR) {
1332 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1338 if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
1339 inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
1340 hci_inquiry_cache_flush(hdev);
1343 hci_dev_unlock(hdev);
1345 timeo = ir.length * msecs_to_jiffies(2000);
1348 err = hci_req_sync(hdev, hci_inq_req, (unsigned long) &ir,
1353 /* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
1354 * cleared). If it is interrupted by a signal, return -EINTR.
1356 if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
1357 TASK_INTERRUPTIBLE))
1361 /* for unlimited number of responses we will use buffer with
1364 max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
1366 /* cache_dump can't sleep. Therefore we allocate temp buffer and then
1367 * copy it to the user space.
1369 buf = kmalloc(sizeof(struct inquiry_info) * max_rsp, GFP_KERNEL);
1376 ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
1377 hci_dev_unlock(hdev);
1379 BT_DBG("num_rsp %d", ir.num_rsp);
1381 if (!copy_to_user(ptr, &ir, sizeof(ir))) {
1383 if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
1396 static int hci_dev_do_open(struct hci_dev *hdev)
1400 BT_DBG("%s %p", hdev->name, hdev);
1404 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
1409 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1410 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
1411 /* Check for rfkill but allow the HCI setup stage to
1412 * proceed (which in itself doesn't cause any RF activity).
1414 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
1419 /* Check for valid public address or a configured static
1420 * random adddress, but let the HCI setup proceed to
1421 * be able to determine if there is a public address
1424 * In case of user channel usage, it is not important
1425 * if a public address or static random address is
1428 * This check is only valid for BR/EDR controllers
1429 * since AMP controllers do not have an address.
1431 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1432 hdev->dev_type == HCI_BREDR &&
1433 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
1434 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
1435 ret = -EADDRNOTAVAIL;
1440 if (test_bit(HCI_UP, &hdev->flags)) {
1445 if (hdev->open(hdev)) {
1450 set_bit(HCI_RUNNING, &hdev->flags);
1451 hci_sock_dev_event(hdev, HCI_DEV_OPEN);
1453 atomic_set(&hdev->cmd_cnt, 1);
1454 set_bit(HCI_INIT, &hdev->flags);
1456 if (hci_dev_test_flag(hdev, HCI_SETUP)) {
1457 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
1460 ret = hdev->setup(hdev);
1462 /* The transport driver can set these quirks before
1463 * creating the HCI device or in its setup callback.
1465 * In case any of them is set, the controller has to
1466 * start up as unconfigured.
1468 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
1469 test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks))
1470 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
1472 /* For an unconfigured controller it is required to
1473 * read at least the version information provided by
1474 * the Read Local Version Information command.
1476 * If the set_bdaddr driver callback is provided, then
1477 * also the original Bluetooth public device address
1478 * will be read using the Read BD Address command.
1480 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
1481 ret = __hci_unconf_init(hdev);
1484 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
1485 /* If public address change is configured, ensure that
1486 * the address gets programmed. If the driver does not
1487 * support changing the public address, fail the power
1490 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
1492 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
1494 ret = -EADDRNOTAVAIL;
1498 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1499 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1500 ret = __hci_init(hdev);
1501 if (!ret && hdev->post_init)
1502 ret = hdev->post_init(hdev);
1506 /* If the HCI Reset command is clearing all diagnostic settings,
1507 * then they need to be reprogrammed after the init procedure
1510 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
1511 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
1512 ret = hdev->set_diag(hdev, true);
1514 clear_bit(HCI_INIT, &hdev->flags);
1518 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1519 set_bit(HCI_UP, &hdev->flags);
1520 hci_sock_dev_event(hdev, HCI_DEV_UP);
1521 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
1522 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
1523 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1524 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1525 hdev->dev_type == HCI_BREDR) {
1527 mgmt_powered(hdev, 1);
1528 hci_dev_unlock(hdev);
1531 /* Init failed, cleanup */
1532 flush_work(&hdev->tx_work);
1533 flush_work(&hdev->cmd_work);
1534 flush_work(&hdev->rx_work);
1536 skb_queue_purge(&hdev->cmd_q);
1537 skb_queue_purge(&hdev->rx_q);
1542 if (hdev->sent_cmd) {
1543 kfree_skb(hdev->sent_cmd);
1544 hdev->sent_cmd = NULL;
1547 clear_bit(HCI_RUNNING, &hdev->flags);
1548 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1551 hdev->flags &= BIT(HCI_RAW);
1555 hci_req_unlock(hdev);
1559 /* ---- HCI ioctl helpers ---- */
1561 int hci_dev_open(__u16 dev)
1563 struct hci_dev *hdev;
1566 hdev = hci_dev_get(dev);
1570 /* Devices that are marked as unconfigured can only be powered
1571 * up as user channel. Trying to bring them up as normal devices
1572 * will result into a failure. Only user channel operation is
1575 * When this function is called for a user channel, the flag
1576 * HCI_USER_CHANNEL will be set first before attempting to
1579 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
1580 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1585 /* We need to ensure that no other power on/off work is pending
1586 * before proceeding to call hci_dev_do_open. This is
1587 * particularly important if the setup procedure has not yet
1590 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1591 cancel_delayed_work(&hdev->power_off);
1593 /* After this call it is guaranteed that the setup procedure
1594 * has finished. This means that error conditions like RFKILL
1595 * or no valid public or static random address apply.
1597 flush_workqueue(hdev->req_workqueue);
1599 /* For controllers not using the management interface and that
1600 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
1601 * so that pairing works for them. Once the management interface
1602 * is in use this bit will be cleared again and userspace has
1603 * to explicitly enable it.
1605 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1606 !hci_dev_test_flag(hdev, HCI_MGMT))
1607 hci_dev_set_flag(hdev, HCI_BONDABLE);
1609 err = hci_dev_do_open(hdev);
1616 /* This function requires the caller holds hdev->lock */
1617 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
1619 struct hci_conn_params *p;
1621 list_for_each_entry(p, &hdev->le_conn_params, list) {
1623 hci_conn_drop(p->conn);
1624 hci_conn_put(p->conn);
1627 list_del_init(&p->action);
1630 BT_DBG("All LE pending actions cleared");
1633 int hci_dev_do_close(struct hci_dev *hdev)
1637 BT_DBG("%s %p", hdev->name, hdev);
1639 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
1640 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
1641 test_bit(HCI_UP, &hdev->flags)) {
1642 /* Execute vendor specific shutdown routine */
1644 hdev->shutdown(hdev);
1647 cancel_delayed_work(&hdev->power_off);
1649 hci_req_cancel(hdev, ENODEV);
1652 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
1653 cancel_delayed_work_sync(&hdev->cmd_timer);
1654 hci_req_unlock(hdev);
1658 /* Flush RX and TX works */
1659 flush_work(&hdev->tx_work);
1660 flush_work(&hdev->rx_work);
1662 if (hdev->discov_timeout > 0) {
1663 cancel_delayed_work(&hdev->discov_off);
1664 hdev->discov_timeout = 0;
1665 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
1666 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1669 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
1670 cancel_delayed_work(&hdev->service_cache);
1672 cancel_delayed_work_sync(&hdev->le_scan_disable);
1673 cancel_delayed_work_sync(&hdev->le_scan_restart);
1675 if (hci_dev_test_flag(hdev, HCI_MGMT))
1676 cancel_delayed_work_sync(&hdev->rpa_expired);
1678 if (hdev->adv_instance_timeout) {
1679 cancel_delayed_work_sync(&hdev->adv_instance_expire);
1680 hdev->adv_instance_timeout = 0;
1683 /* Avoid potential lockdep warnings from the *_flush() calls by
1684 * ensuring the workqueue is empty up front.
1686 drain_workqueue(hdev->workqueue);
1690 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
1692 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
1694 if (!auto_off && hdev->dev_type == HCI_BREDR)
1695 mgmt_powered(hdev, 0);
1697 hci_inquiry_cache_flush(hdev);
1698 hci_pend_le_actions_clear(hdev);
1699 hci_conn_hash_flush(hdev);
1700 hci_dev_unlock(hdev);
1702 smp_unregister(hdev);
1704 hci_sock_dev_event(hdev, HCI_DEV_DOWN);
1710 skb_queue_purge(&hdev->cmd_q);
1711 atomic_set(&hdev->cmd_cnt, 1);
1712 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
1713 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1714 set_bit(HCI_INIT, &hdev->flags);
1715 __hci_req_sync(hdev, hci_reset_req, 0, HCI_CMD_TIMEOUT);
1716 clear_bit(HCI_INIT, &hdev->flags);
1719 /* flush cmd work */
1720 flush_work(&hdev->cmd_work);
1723 skb_queue_purge(&hdev->rx_q);
1724 skb_queue_purge(&hdev->cmd_q);
1725 skb_queue_purge(&hdev->raw_q);
1727 /* Drop last sent command */
1728 if (hdev->sent_cmd) {
1729 cancel_delayed_work_sync(&hdev->cmd_timer);
1730 kfree_skb(hdev->sent_cmd);
1731 hdev->sent_cmd = NULL;
1734 clear_bit(HCI_RUNNING, &hdev->flags);
1735 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
1737 /* After this point our queues are empty
1738 * and no tasks are scheduled. */
1742 hdev->flags &= BIT(HCI_RAW);
1743 hci_dev_clear_volatile_flags(hdev);
1745 /* Controller radio is available but is currently powered down */
1746 hdev->amp_status = AMP_STATUS_POWERED_DOWN;
1748 memset(hdev->eir, 0, sizeof(hdev->eir));
1749 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
1750 bacpy(&hdev->random_addr, BDADDR_ANY);
1752 hci_req_unlock(hdev);
1758 int hci_dev_close(__u16 dev)
1760 struct hci_dev *hdev;
1763 hdev = hci_dev_get(dev);
1767 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1772 if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
1773 cancel_delayed_work(&hdev->power_off);
1775 err = hci_dev_do_close(hdev);
1782 static int hci_dev_do_reset(struct hci_dev *hdev)
1786 BT_DBG("%s %p", hdev->name, hdev);
1791 skb_queue_purge(&hdev->rx_q);
1792 skb_queue_purge(&hdev->cmd_q);
1794 /* Avoid potential lockdep warnings from the *_flush() calls by
1795 * ensuring the workqueue is empty up front.
1797 drain_workqueue(hdev->workqueue);
1800 hci_inquiry_cache_flush(hdev);
1801 hci_conn_hash_flush(hdev);
1802 hci_dev_unlock(hdev);
1807 atomic_set(&hdev->cmd_cnt, 1);
1808 hdev->acl_cnt = 0; hdev->sco_cnt = 0; hdev->le_cnt = 0;
1810 ret = __hci_req_sync(hdev, hci_reset_req, 0, HCI_INIT_TIMEOUT);
1812 hci_req_unlock(hdev);
1816 int hci_dev_reset(__u16 dev)
1818 struct hci_dev *hdev;
1821 hdev = hci_dev_get(dev);
1825 if (!test_bit(HCI_UP, &hdev->flags)) {
1830 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1835 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1840 err = hci_dev_do_reset(hdev);
1847 int hci_dev_reset_stat(__u16 dev)
1849 struct hci_dev *hdev;
1852 hdev = hci_dev_get(dev);
1856 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1861 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1866 memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
1873 static void hci_update_scan_state(struct hci_dev *hdev, u8 scan)
1875 bool conn_changed, discov_changed;
1877 BT_DBG("%s scan 0x%02x", hdev->name, scan);
1879 if ((scan & SCAN_PAGE))
1880 conn_changed = !hci_dev_test_and_set_flag(hdev,
1883 conn_changed = hci_dev_test_and_clear_flag(hdev,
1886 if ((scan & SCAN_INQUIRY)) {
1887 discov_changed = !hci_dev_test_and_set_flag(hdev,
1890 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
1891 discov_changed = hci_dev_test_and_clear_flag(hdev,
1895 if (!hci_dev_test_flag(hdev, HCI_MGMT))
1898 if (conn_changed || discov_changed) {
1899 /* In case this was disabled through mgmt */
1900 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
1902 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1903 mgmt_update_adv_data(hdev);
1905 mgmt_new_settings(hdev);
1909 int hci_dev_cmd(unsigned int cmd, void __user *arg)
1911 struct hci_dev *hdev;
1912 struct hci_dev_req dr;
1915 if (copy_from_user(&dr, arg, sizeof(dr)))
1918 hdev = hci_dev_get(dr.dev_id);
1922 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
1927 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
1932 if (hdev->dev_type != HCI_BREDR) {
1937 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
1944 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1949 if (!lmp_encrypt_capable(hdev)) {
1954 if (!test_bit(HCI_AUTH, &hdev->flags)) {
1955 /* Auth must be enabled first */
1956 err = hci_req_sync(hdev, hci_auth_req, dr.dev_opt,
1962 err = hci_req_sync(hdev, hci_encrypt_req, dr.dev_opt,
1967 err = hci_req_sync(hdev, hci_scan_req, dr.dev_opt,
1970 /* Ensure that the connectable and discoverable states
1971 * get correctly modified as this was a non-mgmt change.
1974 hci_update_scan_state(hdev, dr.dev_opt);
1978 err = hci_req_sync(hdev, hci_linkpol_req, dr.dev_opt,
1982 case HCISETLINKMODE:
1983 hdev->link_mode = ((__u16) dr.dev_opt) &
1984 (HCI_LM_MASTER | HCI_LM_ACCEPT);
1988 hdev->pkt_type = (__u16) dr.dev_opt;
1992 hdev->acl_mtu = *((__u16 *) &dr.dev_opt + 1);
1993 hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
1997 hdev->sco_mtu = *((__u16 *) &dr.dev_opt + 1);
1998 hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
2011 int hci_get_dev_list(void __user *arg)
2013 struct hci_dev *hdev;
2014 struct hci_dev_list_req *dl;
2015 struct hci_dev_req *dr;
2016 int n = 0, size, err;
2019 if (get_user(dev_num, (__u16 __user *) arg))
2022 if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
2025 size = sizeof(*dl) + dev_num * sizeof(*dr);
2027 dl = kzalloc(size, GFP_KERNEL);
2033 read_lock(&hci_dev_list_lock);
2034 list_for_each_entry(hdev, &hci_dev_list, list) {
2035 unsigned long flags = hdev->flags;
2037 /* When the auto-off is configured it means the transport
2038 * is running, but in that case still indicate that the
2039 * device is actually down.
2041 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2042 flags &= ~BIT(HCI_UP);
2044 (dr + n)->dev_id = hdev->id;
2045 (dr + n)->dev_opt = flags;
2050 read_unlock(&hci_dev_list_lock);
2053 size = sizeof(*dl) + n * sizeof(*dr);
2055 err = copy_to_user(arg, dl, size);
2058 return err ? -EFAULT : 0;
2061 int hci_get_dev_info(void __user *arg)
2063 struct hci_dev *hdev;
2064 struct hci_dev_info di;
2065 unsigned long flags;
2068 if (copy_from_user(&di, arg, sizeof(di)))
2071 hdev = hci_dev_get(di.dev_id);
2075 /* When the auto-off is configured it means the transport
2076 * is running, but in that case still indicate that the
2077 * device is actually down.
2079 if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
2080 flags = hdev->flags & ~BIT(HCI_UP);
2082 flags = hdev->flags;
2084 strcpy(di.name, hdev->name);
2085 di.bdaddr = hdev->bdaddr;
2086 di.type = (hdev->bus & 0x0f) | ((hdev->dev_type & 0x03) << 4);
2088 di.pkt_type = hdev->pkt_type;
2089 if (lmp_bredr_capable(hdev)) {
2090 di.acl_mtu = hdev->acl_mtu;
2091 di.acl_pkts = hdev->acl_pkts;
2092 di.sco_mtu = hdev->sco_mtu;
2093 di.sco_pkts = hdev->sco_pkts;
2095 di.acl_mtu = hdev->le_mtu;
2096 di.acl_pkts = hdev->le_pkts;
2100 di.link_policy = hdev->link_policy;
2101 di.link_mode = hdev->link_mode;
2103 memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
2104 memcpy(&di.features, &hdev->features, sizeof(di.features));
2106 if (copy_to_user(arg, &di, sizeof(di)))
2114 /* ---- Interface to HCI drivers ---- */
2116 static int hci_rfkill_set_block(void *data, bool blocked)
2118 struct hci_dev *hdev = data;
2120 BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
2122 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2126 hci_dev_set_flag(hdev, HCI_RFKILLED);
2127 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
2128 !hci_dev_test_flag(hdev, HCI_CONFIG))
2129 hci_dev_do_close(hdev);
2131 hci_dev_clear_flag(hdev, HCI_RFKILLED);
2137 static const struct rfkill_ops hci_rfkill_ops = {
2138 .set_block = hci_rfkill_set_block,
2141 static void hci_power_on(struct work_struct *work)
2143 struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
2146 BT_DBG("%s", hdev->name);
2148 err = hci_dev_do_open(hdev);
2151 mgmt_set_powered_failed(hdev, err);
2152 hci_dev_unlock(hdev);
2156 /* During the HCI setup phase, a few error conditions are
2157 * ignored and they need to be checked now. If they are still
2158 * valid, it is important to turn the device back off.
2160 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
2161 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
2162 (hdev->dev_type == HCI_BREDR &&
2163 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
2164 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
2165 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
2166 hci_dev_do_close(hdev);
2167 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
2168 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
2169 HCI_AUTO_OFF_TIMEOUT);
2172 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
2173 /* For unconfigured devices, set the HCI_RAW flag
2174 * so that userspace can easily identify them.
2176 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2177 set_bit(HCI_RAW, &hdev->flags);
2179 /* For fully configured devices, this will send
2180 * the Index Added event. For unconfigured devices,
2181 * it will send Unconfigued Index Added event.
2183 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
2184 * and no event will be send.
2186 mgmt_index_added(hdev);
2187 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
2188 /* When the controller is now configured, then it
2189 * is important to clear the HCI_RAW flag.
2191 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
2192 clear_bit(HCI_RAW, &hdev->flags);
2194 /* Powering on the controller with HCI_CONFIG set only
2195 * happens with the transition from unconfigured to
2196 * configured. This will send the Index Added event.
2198 mgmt_index_added(hdev);
2202 static void hci_power_off(struct work_struct *work)
2204 struct hci_dev *hdev = container_of(work, struct hci_dev,
2207 BT_DBG("%s", hdev->name);
2209 hci_dev_do_close(hdev);
2212 static void hci_error_reset(struct work_struct *work)
2214 struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
2216 BT_DBG("%s", hdev->name);
2219 hdev->hw_error(hdev, hdev->hw_error_code);
2221 BT_ERR("%s hardware error 0x%2.2x", hdev->name,
2222 hdev->hw_error_code);
2224 if (hci_dev_do_close(hdev))
2227 hci_dev_do_open(hdev);
2230 static void hci_discov_off(struct work_struct *work)
2232 struct hci_dev *hdev;
2234 hdev = container_of(work, struct hci_dev, discov_off.work);
2236 BT_DBG("%s", hdev->name);
2238 mgmt_discoverable_timeout(hdev);
2241 static void hci_adv_timeout_expire(struct work_struct *work)
2243 struct hci_dev *hdev;
2245 hdev = container_of(work, struct hci_dev, adv_instance_expire.work);
2247 BT_DBG("%s", hdev->name);
2249 mgmt_adv_timeout_expired(hdev);
2252 void hci_uuids_clear(struct hci_dev *hdev)
2254 struct bt_uuid *uuid, *tmp;
2256 list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
2257 list_del(&uuid->list);
2262 void hci_link_keys_clear(struct hci_dev *hdev)
2264 struct link_key *key;
2266 list_for_each_entry_rcu(key, &hdev->link_keys, list) {
2267 list_del_rcu(&key->list);
2268 kfree_rcu(key, rcu);
2272 void hci_smp_ltks_clear(struct hci_dev *hdev)
2276 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2277 list_del_rcu(&k->list);
2282 void hci_smp_irks_clear(struct hci_dev *hdev)
2286 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2287 list_del_rcu(&k->list);
2292 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2297 list_for_each_entry_rcu(k, &hdev->link_keys, list) {
2298 if (bacmp(bdaddr, &k->bdaddr) == 0) {
2308 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
2309 u8 key_type, u8 old_key_type)
2312 if (key_type < 0x03)
2315 /* Debug keys are insecure so don't store them persistently */
2316 if (key_type == HCI_LK_DEBUG_COMBINATION)
2319 /* Changed combination key and there's no previous one */
2320 if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
2323 /* Security mode 3 case */
2327 /* BR/EDR key derived using SC from an LE link */
2328 if (conn->type == LE_LINK)
2331 /* Neither local nor remote side had no-bonding as requirement */
2332 if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
2335 /* Local side had dedicated bonding as requirement */
2336 if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
2339 /* Remote side had dedicated bonding as requirement */
2340 if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
2343 /* If none of the above criteria match, then don't store the key
2348 static u8 ltk_role(u8 type)
2350 if (type == SMP_LTK)
2351 return HCI_ROLE_MASTER;
2353 return HCI_ROLE_SLAVE;
2356 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2357 u8 addr_type, u8 role)
2362 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2363 if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
2366 if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
2376 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
2378 struct smp_irk *irk;
2381 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2382 if (!bacmp(&irk->rpa, rpa)) {
2388 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2389 if (smp_irk_matches(hdev, irk->val, rpa)) {
2390 bacpy(&irk->rpa, rpa);
2400 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
2403 struct smp_irk *irk;
2405 /* Identity Address must be public or static random */
2406 if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
2410 list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
2411 if (addr_type == irk->addr_type &&
2412 bacmp(bdaddr, &irk->bdaddr) == 0) {
2422 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
2423 bdaddr_t *bdaddr, u8 *val, u8 type,
2424 u8 pin_len, bool *persistent)
2426 struct link_key *key, *old_key;
2429 old_key = hci_find_link_key(hdev, bdaddr);
2431 old_key_type = old_key->type;
2434 old_key_type = conn ? conn->key_type : 0xff;
2435 key = kzalloc(sizeof(*key), GFP_KERNEL);
2438 list_add_rcu(&key->list, &hdev->link_keys);
2441 BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
2443 /* Some buggy controller combinations generate a changed
2444 * combination key for legacy pairing even when there's no
2446 if (type == HCI_LK_CHANGED_COMBINATION &&
2447 (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
2448 type = HCI_LK_COMBINATION;
2450 conn->key_type = type;
2453 bacpy(&key->bdaddr, bdaddr);
2454 memcpy(key->val, val, HCI_LINK_KEY_SIZE);
2455 key->pin_len = pin_len;
2457 if (type == HCI_LK_CHANGED_COMBINATION)
2458 key->type = old_key_type;
2463 *persistent = hci_persistent_key(hdev, conn, type,
2469 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2470 u8 addr_type, u8 type, u8 authenticated,
2471 u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
2473 struct smp_ltk *key, *old_key;
2474 u8 role = ltk_role(type);
2476 old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
2480 key = kzalloc(sizeof(*key), GFP_KERNEL);
2483 list_add_rcu(&key->list, &hdev->long_term_keys);
2486 bacpy(&key->bdaddr, bdaddr);
2487 key->bdaddr_type = addr_type;
2488 memcpy(key->val, tk, sizeof(key->val));
2489 key->authenticated = authenticated;
2492 key->enc_size = enc_size;
2498 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
2499 u8 addr_type, u8 val[16], bdaddr_t *rpa)
2501 struct smp_irk *irk;
2503 irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
2505 irk = kzalloc(sizeof(*irk), GFP_KERNEL);
2509 bacpy(&irk->bdaddr, bdaddr);
2510 irk->addr_type = addr_type;
2512 list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
2515 memcpy(irk->val, val, 16);
2516 bacpy(&irk->rpa, rpa);
2521 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
2523 struct link_key *key;
2525 key = hci_find_link_key(hdev, bdaddr);
2529 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2531 list_del_rcu(&key->list);
2532 kfree_rcu(key, rcu);
2537 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
2542 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2543 if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
2546 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2548 list_del_rcu(&k->list);
2553 return removed ? 0 : -ENOENT;
2556 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
2560 list_for_each_entry_rcu(k, &hdev->identity_resolving_keys, list) {
2561 if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
2564 BT_DBG("%s removing %pMR", hdev->name, bdaddr);
2566 list_del_rcu(&k->list);
2571 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
2574 struct smp_irk *irk;
2577 if (type == BDADDR_BREDR) {
2578 if (hci_find_link_key(hdev, bdaddr))
2583 /* Convert to HCI addr type which struct smp_ltk uses */
2584 if (type == BDADDR_LE_PUBLIC)
2585 addr_type = ADDR_LE_DEV_PUBLIC;
2587 addr_type = ADDR_LE_DEV_RANDOM;
2589 irk = hci_get_irk(hdev, bdaddr, addr_type);
2591 bdaddr = &irk->bdaddr;
2592 addr_type = irk->addr_type;
2596 list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
2597 if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
2607 /* HCI command timer function */
2608 static void hci_cmd_timeout(struct work_struct *work)
2610 struct hci_dev *hdev = container_of(work, struct hci_dev,
2613 if (hdev->sent_cmd) {
2614 struct hci_command_hdr *sent = (void *) hdev->sent_cmd->data;
2615 u16 opcode = __le16_to_cpu(sent->opcode);
2617 BT_ERR("%s command 0x%4.4x tx timeout", hdev->name, opcode);
2619 BT_ERR("%s command tx timeout", hdev->name);
2622 atomic_set(&hdev->cmd_cnt, 1);
2623 queue_work(hdev->workqueue, &hdev->cmd_work);
2626 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
2627 bdaddr_t *bdaddr, u8 bdaddr_type)
2629 struct oob_data *data;
2631 list_for_each_entry(data, &hdev->remote_oob_data, list) {
2632 if (bacmp(bdaddr, &data->bdaddr) != 0)
2634 if (data->bdaddr_type != bdaddr_type)
2642 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2645 struct oob_data *data;
2647 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2651 BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
2653 list_del(&data->list);
2659 void hci_remote_oob_data_clear(struct hci_dev *hdev)
2661 struct oob_data *data, *n;
2663 list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
2664 list_del(&data->list);
2669 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
2670 u8 bdaddr_type, u8 *hash192, u8 *rand192,
2671 u8 *hash256, u8 *rand256)
2673 struct oob_data *data;
2675 data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
2677 data = kmalloc(sizeof(*data), GFP_KERNEL);
2681 bacpy(&data->bdaddr, bdaddr);
2682 data->bdaddr_type = bdaddr_type;
2683 list_add(&data->list, &hdev->remote_oob_data);
2686 if (hash192 && rand192) {
2687 memcpy(data->hash192, hash192, sizeof(data->hash192));
2688 memcpy(data->rand192, rand192, sizeof(data->rand192));
2689 if (hash256 && rand256)
2690 data->present = 0x03;
2692 memset(data->hash192, 0, sizeof(data->hash192));
2693 memset(data->rand192, 0, sizeof(data->rand192));
2694 if (hash256 && rand256)
2695 data->present = 0x02;
2697 data->present = 0x00;
2700 if (hash256 && rand256) {
2701 memcpy(data->hash256, hash256, sizeof(data->hash256));
2702 memcpy(data->rand256, rand256, sizeof(data->rand256));
2704 memset(data->hash256, 0, sizeof(data->hash256));
2705 memset(data->rand256, 0, sizeof(data->rand256));
2706 if (hash192 && rand192)
2707 data->present = 0x01;
2710 BT_DBG("%s for %pMR", hdev->name, bdaddr);
2715 /* This function requires the caller holds hdev->lock */
2716 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
2718 struct adv_info *adv_instance;
2720 list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
2721 if (adv_instance->instance == instance)
2722 return adv_instance;
2728 /* This function requires the caller holds hdev->lock */
2729 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance) {
2730 struct adv_info *cur_instance;
2732 cur_instance = hci_find_adv_instance(hdev, instance);
2736 if (cur_instance == list_last_entry(&hdev->adv_instances,
2737 struct adv_info, list))
2738 return list_first_entry(&hdev->adv_instances,
2739 struct adv_info, list);
2741 return list_next_entry(cur_instance, list);
2744 /* This function requires the caller holds hdev->lock */
2745 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
2747 struct adv_info *adv_instance;
2749 adv_instance = hci_find_adv_instance(hdev, instance);
2753 BT_DBG("%s removing %dMR", hdev->name, instance);
2755 if (hdev->cur_adv_instance == instance && hdev->adv_instance_timeout) {
2756 cancel_delayed_work(&hdev->adv_instance_expire);
2757 hdev->adv_instance_timeout = 0;
2760 list_del(&adv_instance->list);
2761 kfree(adv_instance);
2763 hdev->adv_instance_cnt--;
2768 /* This function requires the caller holds hdev->lock */
2769 void hci_adv_instances_clear(struct hci_dev *hdev)
2771 struct adv_info *adv_instance, *n;
2773 if (hdev->adv_instance_timeout) {
2774 cancel_delayed_work(&hdev->adv_instance_expire);
2775 hdev->adv_instance_timeout = 0;
2778 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
2779 list_del(&adv_instance->list);
2780 kfree(adv_instance);
2783 hdev->adv_instance_cnt = 0;
2786 /* This function requires the caller holds hdev->lock */
2787 int hci_add_adv_instance(struct hci_dev *hdev, u8 instance, u32 flags,
2788 u16 adv_data_len, u8 *adv_data,
2789 u16 scan_rsp_len, u8 *scan_rsp_data,
2790 u16 timeout, u16 duration)
2792 struct adv_info *adv_instance;
2794 adv_instance = hci_find_adv_instance(hdev, instance);
2796 memset(adv_instance->adv_data, 0,
2797 sizeof(adv_instance->adv_data));
2798 memset(adv_instance->scan_rsp_data, 0,
2799 sizeof(adv_instance->scan_rsp_data));
2801 if (hdev->adv_instance_cnt >= HCI_MAX_ADV_INSTANCES ||
2802 instance < 1 || instance > HCI_MAX_ADV_INSTANCES)
2805 adv_instance = kzalloc(sizeof(*adv_instance), GFP_KERNEL);
2809 adv_instance->pending = true;
2810 adv_instance->instance = instance;
2811 list_add(&adv_instance->list, &hdev->adv_instances);
2812 hdev->adv_instance_cnt++;
2815 adv_instance->flags = flags;
2816 adv_instance->adv_data_len = adv_data_len;
2817 adv_instance->scan_rsp_len = scan_rsp_len;
2820 memcpy(adv_instance->adv_data, adv_data, adv_data_len);
2823 memcpy(adv_instance->scan_rsp_data,
2824 scan_rsp_data, scan_rsp_len);
2826 adv_instance->timeout = timeout;
2827 adv_instance->remaining_time = timeout;
2830 adv_instance->duration = HCI_DEFAULT_ADV_DURATION;
2832 adv_instance->duration = duration;
2834 BT_DBG("%s for %dMR", hdev->name, instance);
2839 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2840 bdaddr_t *bdaddr, u8 type)
2842 struct bdaddr_list *b;
2844 list_for_each_entry(b, bdaddr_list, list) {
2845 if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2852 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2854 struct list_head *p, *n;
2856 list_for_each_safe(p, n, bdaddr_list) {
2857 struct bdaddr_list *b = list_entry(p, struct bdaddr_list, list);
2864 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2866 struct bdaddr_list *entry;
2868 if (!bacmp(bdaddr, BDADDR_ANY))
2871 if (hci_bdaddr_list_lookup(list, bdaddr, type))
2874 entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2878 bacpy(&entry->bdaddr, bdaddr);
2879 entry->bdaddr_type = type;
2881 list_add(&entry->list, list);
2886 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2888 struct bdaddr_list *entry;
2890 if (!bacmp(bdaddr, BDADDR_ANY)) {
2891 hci_bdaddr_list_clear(list);
2895 entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2899 list_del(&entry->list);
2905 /* This function requires the caller holds hdev->lock */
2906 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2907 bdaddr_t *addr, u8 addr_type)
2909 struct hci_conn_params *params;
2911 list_for_each_entry(params, &hdev->le_conn_params, list) {
2912 if (bacmp(¶ms->addr, addr) == 0 &&
2913 params->addr_type == addr_type) {
2921 /* This function requires the caller holds hdev->lock */
2922 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2923 bdaddr_t *addr, u8 addr_type)
2925 struct hci_conn_params *param;
2927 list_for_each_entry(param, list, action) {
2928 if (bacmp(¶m->addr, addr) == 0 &&
2929 param->addr_type == addr_type)
2936 /* This function requires the caller holds hdev->lock */
2937 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2938 bdaddr_t *addr, u8 addr_type)
2940 struct hci_conn_params *params;
2942 params = hci_conn_params_lookup(hdev, addr, addr_type);
2946 params = kzalloc(sizeof(*params), GFP_KERNEL);
2948 BT_ERR("Out of memory");
2952 bacpy(¶ms->addr, addr);
2953 params->addr_type = addr_type;
2955 list_add(¶ms->list, &hdev->le_conn_params);
2956 INIT_LIST_HEAD(¶ms->action);
2958 params->conn_min_interval = hdev->le_conn_min_interval;
2959 params->conn_max_interval = hdev->le_conn_max_interval;
2960 params->conn_latency = hdev->le_conn_latency;
2961 params->supervision_timeout = hdev->le_supv_timeout;
2962 params->auto_connect = HCI_AUTO_CONN_DISABLED;
2964 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2969 static void hci_conn_params_free(struct hci_conn_params *params)
2972 hci_conn_drop(params->conn);
2973 hci_conn_put(params->conn);
2976 list_del(¶ms->action);
2977 list_del(¶ms->list);
2981 /* This function requires the caller holds hdev->lock */
2982 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2984 struct hci_conn_params *params;
2986 params = hci_conn_params_lookup(hdev, addr, addr_type);
2990 hci_conn_params_free(params);
2992 hci_update_background_scan(hdev);
2994 BT_DBG("addr %pMR (type %u)", addr, addr_type);
2997 /* This function requires the caller holds hdev->lock */
2998 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
3000 struct hci_conn_params *params, *tmp;
3002 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
3003 if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
3006 /* If trying to estabilish one time connection to disabled
3007 * device, leave the params, but mark them as just once.
3009 if (params->explicit_connect) {
3010 params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
3014 list_del(¶ms->list);
3018 BT_DBG("All LE disabled connection parameters were removed");
3021 /* This function requires the caller holds hdev->lock */
3022 void hci_conn_params_clear_all(struct hci_dev *hdev)
3024 struct hci_conn_params *params, *tmp;
3026 list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
3027 hci_conn_params_free(params);
3029 hci_update_background_scan(hdev);
3031 BT_DBG("All LE connection parameters were removed");
3034 static void inquiry_complete(struct hci_dev *hdev, u8 status, u16 opcode)
3037 BT_ERR("Failed to start inquiry: status %d", status);
3040 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3041 hci_dev_unlock(hdev);
3046 static void le_scan_disable_work_complete(struct hci_dev *hdev, u8 status,
3049 /* General inquiry access code (GIAC) */
3050 u8 lap[3] = { 0x33, 0x8b, 0x9e };
3051 struct hci_cp_inquiry cp;
3055 BT_ERR("Failed to disable LE scanning: status %d", status);
3059 hdev->discovery.scan_start = 0;
3061 switch (hdev->discovery.type) {
3062 case DISCOV_TYPE_LE:
3064 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
3065 hci_dev_unlock(hdev);
3068 case DISCOV_TYPE_INTERLEAVED:
3071 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
3073 /* If we were running LE only scan, change discovery
3074 * state. If we were running both LE and BR/EDR inquiry
3075 * simultaneously, and BR/EDR inquiry is already
3076 * finished, stop discovery, otherwise BR/EDR inquiry
3077 * will stop discovery when finished. If we will resolve
3078 * remote device name, do not change discovery state.
3080 if (!test_bit(HCI_INQUIRY, &hdev->flags) &&
3081 hdev->discovery.state != DISCOVERY_RESOLVING)
3082 hci_discovery_set_state(hdev,
3085 struct hci_request req;
3087 hci_inquiry_cache_flush(hdev);
3089 hci_req_init(&req, hdev);
3091 memset(&cp, 0, sizeof(cp));
3092 memcpy(&cp.lap, lap, sizeof(cp.lap));
3093 cp.length = DISCOV_INTERLEAVED_INQUIRY_LEN;
3094 hci_req_add(&req, HCI_OP_INQUIRY, sizeof(cp), &cp);
3096 err = hci_req_run(&req, inquiry_complete);
3098 BT_ERR("Inquiry request failed: err %d", err);
3099 hci_discovery_set_state(hdev,
3104 hci_dev_unlock(hdev);
3109 static void le_scan_disable_work(struct work_struct *work)
3111 struct hci_dev *hdev = container_of(work, struct hci_dev,
3112 le_scan_disable.work);
3113 struct hci_request req;
3116 BT_DBG("%s", hdev->name);
3118 cancel_delayed_work_sync(&hdev->le_scan_restart);
3120 hci_req_init(&req, hdev);
3122 hci_req_add_le_scan_disable(&req);
3124 err = hci_req_run(&req, le_scan_disable_work_complete);
3126 BT_ERR("Disable LE scanning request failed: err %d", err);
3129 static void le_scan_restart_work_complete(struct hci_dev *hdev, u8 status,
3132 unsigned long timeout, duration, scan_start, now;
3134 BT_DBG("%s", hdev->name);
3137 BT_ERR("Failed to restart LE scan: status %d", status);
3141 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
3142 !hdev->discovery.scan_start)
3145 /* When the scan was started, hdev->le_scan_disable has been queued
3146 * after duration from scan_start. During scan restart this job
3147 * has been canceled, and we need to queue it again after proper
3148 * timeout, to make sure that scan does not run indefinitely.
3150 duration = hdev->discovery.scan_duration;
3151 scan_start = hdev->discovery.scan_start;
3153 if (now - scan_start <= duration) {
3156 if (now >= scan_start)
3157 elapsed = now - scan_start;
3159 elapsed = ULONG_MAX - scan_start + now;
3161 timeout = duration - elapsed;
3165 queue_delayed_work(hdev->workqueue,
3166 &hdev->le_scan_disable, timeout);
3169 static void le_scan_restart_work(struct work_struct *work)
3171 struct hci_dev *hdev = container_of(work, struct hci_dev,
3172 le_scan_restart.work);
3173 struct hci_request req;
3174 struct hci_cp_le_set_scan_enable cp;
3177 BT_DBG("%s", hdev->name);
3179 /* If controller is not scanning we are done. */
3180 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
3183 hci_req_init(&req, hdev);
3185 hci_req_add_le_scan_disable(&req);
3187 memset(&cp, 0, sizeof(cp));
3188 cp.enable = LE_SCAN_ENABLE;
3189 cp.filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
3190 hci_req_add(&req, HCI_OP_LE_SET_SCAN_ENABLE, sizeof(cp), &cp);
3192 err = hci_req_run(&req, le_scan_restart_work_complete);
3194 BT_ERR("Restart LE scan request failed: err %d", err);
3197 /* Copy the Identity Address of the controller.
3199 * If the controller has a public BD_ADDR, then by default use that one.
3200 * If this is a LE only controller without a public address, default to
3201 * the static random address.
3203 * For debugging purposes it is possible to force controllers with a
3204 * public address to use the static random address instead.
3206 * In case BR/EDR has been disabled on a dual-mode controller and
3207 * userspace has configured a static address, then that address
3208 * becomes the identity address instead of the public BR/EDR address.
3210 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
3213 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
3214 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
3215 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
3216 bacmp(&hdev->static_addr, BDADDR_ANY))) {
3217 bacpy(bdaddr, &hdev->static_addr);
3218 *bdaddr_type = ADDR_LE_DEV_RANDOM;
3220 bacpy(bdaddr, &hdev->bdaddr);
3221 *bdaddr_type = ADDR_LE_DEV_PUBLIC;
3225 /* Alloc HCI device */
3226 struct hci_dev *hci_alloc_dev(void)
3228 struct hci_dev *hdev;
3230 hdev = kzalloc(sizeof(*hdev), GFP_KERNEL);
3234 hdev->pkt_type = (HCI_DM1 | HCI_DH1 | HCI_HV1);
3235 hdev->esco_type = (ESCO_HV1);
3236 hdev->link_mode = (HCI_LM_ACCEPT);
3237 hdev->num_iac = 0x01; /* One IAC support is mandatory */
3238 hdev->io_capability = 0x03; /* No Input No Output */
3239 hdev->manufacturer = 0xffff; /* Default to internal use */
3240 hdev->inq_tx_power = HCI_TX_POWER_INVALID;
3241 hdev->adv_tx_power = HCI_TX_POWER_INVALID;
3242 hdev->adv_instance_cnt = 0;
3243 hdev->cur_adv_instance = 0x00;
3244 hdev->adv_instance_timeout = 0;
3246 hdev->sniff_max_interval = 800;
3247 hdev->sniff_min_interval = 80;
3249 hdev->le_adv_channel_map = 0x07;
3250 hdev->le_adv_min_interval = 0x0800;
3251 hdev->le_adv_max_interval = 0x0800;
3252 hdev->le_scan_interval = 0x0060;
3253 hdev->le_scan_window = 0x0030;
3254 hdev->le_conn_min_interval = 0x0028;
3255 hdev->le_conn_max_interval = 0x0038;
3256 hdev->le_conn_latency = 0x0000;
3257 hdev->le_supv_timeout = 0x002a;
3258 hdev->le_def_tx_len = 0x001b;
3259 hdev->le_def_tx_time = 0x0148;
3260 hdev->le_max_tx_len = 0x001b;
3261 hdev->le_max_tx_time = 0x0148;
3262 hdev->le_max_rx_len = 0x001b;
3263 hdev->le_max_rx_time = 0x0148;
3265 hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
3266 hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
3267 hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
3268 hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
3270 mutex_init(&hdev->lock);
3271 mutex_init(&hdev->req_lock);
3273 INIT_LIST_HEAD(&hdev->mgmt_pending);
3274 INIT_LIST_HEAD(&hdev->blacklist);
3275 INIT_LIST_HEAD(&hdev->whitelist);
3276 INIT_LIST_HEAD(&hdev->uuids);
3277 INIT_LIST_HEAD(&hdev->link_keys);
3278 INIT_LIST_HEAD(&hdev->long_term_keys);
3279 INIT_LIST_HEAD(&hdev->identity_resolving_keys);
3280 INIT_LIST_HEAD(&hdev->remote_oob_data);
3281 INIT_LIST_HEAD(&hdev->le_white_list);
3282 INIT_LIST_HEAD(&hdev->le_conn_params);
3283 INIT_LIST_HEAD(&hdev->pend_le_conns);
3284 INIT_LIST_HEAD(&hdev->pend_le_reports);
3285 INIT_LIST_HEAD(&hdev->conn_hash.list);
3286 INIT_LIST_HEAD(&hdev->adv_instances);
3288 INIT_WORK(&hdev->rx_work, hci_rx_work);
3289 INIT_WORK(&hdev->cmd_work, hci_cmd_work);
3290 INIT_WORK(&hdev->tx_work, hci_tx_work);
3291 INIT_WORK(&hdev->power_on, hci_power_on);
3292 INIT_WORK(&hdev->error_reset, hci_error_reset);
3294 INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
3295 INIT_DELAYED_WORK(&hdev->discov_off, hci_discov_off);
3296 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable_work);
3297 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart_work);
3298 INIT_DELAYED_WORK(&hdev->adv_instance_expire, hci_adv_timeout_expire);
3300 skb_queue_head_init(&hdev->rx_q);
3301 skb_queue_head_init(&hdev->cmd_q);
3302 skb_queue_head_init(&hdev->raw_q);
3304 init_waitqueue_head(&hdev->req_wait_q);
3306 INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
3308 hci_init_sysfs(hdev);
3309 discovery_init(hdev);
3313 EXPORT_SYMBOL(hci_alloc_dev);
3315 /* Free HCI device */
3316 void hci_free_dev(struct hci_dev *hdev)
3318 /* will free via device release */
3319 put_device(&hdev->dev);
3321 EXPORT_SYMBOL(hci_free_dev);
3323 /* Register HCI device */
3324 int hci_register_dev(struct hci_dev *hdev)
3328 if (!hdev->open || !hdev->close || !hdev->send)
3331 /* Do not allow HCI_AMP devices to register at index 0,
3332 * so the index can be used as the AMP controller ID.
3334 switch (hdev->dev_type) {
3336 id = ida_simple_get(&hci_index_ida, 0, 0, GFP_KERNEL);
3339 id = ida_simple_get(&hci_index_ida, 1, 0, GFP_KERNEL);
3348 sprintf(hdev->name, "hci%d", id);
3351 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3353 hdev->workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3354 WQ_MEM_RECLAIM, 1, hdev->name);
3355 if (!hdev->workqueue) {
3360 hdev->req_workqueue = alloc_workqueue("%s", WQ_HIGHPRI | WQ_UNBOUND |
3361 WQ_MEM_RECLAIM, 1, hdev->name);
3362 if (!hdev->req_workqueue) {
3363 destroy_workqueue(hdev->workqueue);
3368 if (!IS_ERR_OR_NULL(bt_debugfs))
3369 hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
3371 dev_set_name(&hdev->dev, "%s", hdev->name);
3373 error = device_add(&hdev->dev);
3377 hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
3378 RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
3381 if (rfkill_register(hdev->rfkill) < 0) {
3382 rfkill_destroy(hdev->rfkill);
3383 hdev->rfkill = NULL;
3387 if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
3388 hci_dev_set_flag(hdev, HCI_RFKILLED);
3390 hci_dev_set_flag(hdev, HCI_SETUP);
3391 hci_dev_set_flag(hdev, HCI_AUTO_OFF);
3393 if (hdev->dev_type == HCI_BREDR) {
3394 /* Assume BR/EDR support until proven otherwise (such as
3395 * through reading supported features during init.
3397 hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
3400 write_lock(&hci_dev_list_lock);
3401 list_add(&hdev->list, &hci_dev_list);
3402 write_unlock(&hci_dev_list_lock);
3404 /* Devices that are marked for raw-only usage are unconfigured
3405 * and should not be included in normal operation.
3407 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3408 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
3410 hci_sock_dev_event(hdev, HCI_DEV_REG);
3413 queue_work(hdev->req_workqueue, &hdev->power_on);
3418 destroy_workqueue(hdev->workqueue);
3419 destroy_workqueue(hdev->req_workqueue);
3421 ida_simple_remove(&hci_index_ida, hdev->id);
3425 EXPORT_SYMBOL(hci_register_dev);
3427 /* Unregister HCI device */
3428 void hci_unregister_dev(struct hci_dev *hdev)
3432 BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
3434 hci_dev_set_flag(hdev, HCI_UNREGISTER);
3438 write_lock(&hci_dev_list_lock);
3439 list_del(&hdev->list);
3440 write_unlock(&hci_dev_list_lock);
3442 hci_dev_do_close(hdev);
3444 cancel_work_sync(&hdev->power_on);
3446 if (!test_bit(HCI_INIT, &hdev->flags) &&
3447 !hci_dev_test_flag(hdev, HCI_SETUP) &&
3448 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
3450 mgmt_index_removed(hdev);
3451 hci_dev_unlock(hdev);
3454 /* mgmt_index_removed should take care of emptying the
3456 BUG_ON(!list_empty(&hdev->mgmt_pending));
3458 hci_sock_dev_event(hdev, HCI_DEV_UNREG);
3461 rfkill_unregister(hdev->rfkill);
3462 rfkill_destroy(hdev->rfkill);
3465 device_del(&hdev->dev);
3467 debugfs_remove_recursive(hdev->debugfs);
3469 destroy_workqueue(hdev->workqueue);
3470 destroy_workqueue(hdev->req_workqueue);
3473 hci_bdaddr_list_clear(&hdev->blacklist);
3474 hci_bdaddr_list_clear(&hdev->whitelist);
3475 hci_uuids_clear(hdev);
3476 hci_link_keys_clear(hdev);
3477 hci_smp_ltks_clear(hdev);
3478 hci_smp_irks_clear(hdev);
3479 hci_remote_oob_data_clear(hdev);
3480 hci_adv_instances_clear(hdev);
3481 hci_bdaddr_list_clear(&hdev->le_white_list);
3482 hci_conn_params_clear_all(hdev);
3483 hci_discovery_filter_clear(hdev);
3484 hci_dev_unlock(hdev);
3488 ida_simple_remove(&hci_index_ida, id);
3490 EXPORT_SYMBOL(hci_unregister_dev);
3492 /* Suspend HCI device */
3493 int hci_suspend_dev(struct hci_dev *hdev)
3495 hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
3498 EXPORT_SYMBOL(hci_suspend_dev);
3500 /* Resume HCI device */
3501 int hci_resume_dev(struct hci_dev *hdev)
3503 hci_sock_dev_event(hdev, HCI_DEV_RESUME);
3506 EXPORT_SYMBOL(hci_resume_dev);
3508 /* Reset HCI device */
3509 int hci_reset_dev(struct hci_dev *hdev)
3511 const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
3512 struct sk_buff *skb;
3514 skb = bt_skb_alloc(3, GFP_ATOMIC);
3518 bt_cb(skb)->pkt_type = HCI_EVENT_PKT;
3519 memcpy(skb_put(skb, 3), hw_err, 3);
3521 /* Send Hardware Error to upper stack */
3522 return hci_recv_frame(hdev, skb);
3524 EXPORT_SYMBOL(hci_reset_dev);
3526 /* Receive frame from HCI drivers */
3527 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
3529 if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
3530 && !test_bit(HCI_INIT, &hdev->flags))) {
3535 if (bt_cb(skb)->pkt_type != HCI_EVENT_PKT &&
3536 bt_cb(skb)->pkt_type != HCI_ACLDATA_PKT &&
3537 bt_cb(skb)->pkt_type != HCI_SCODATA_PKT) {
3543 bt_cb(skb)->incoming = 1;
3546 __net_timestamp(skb);
3548 skb_queue_tail(&hdev->rx_q, skb);
3549 queue_work(hdev->workqueue, &hdev->rx_work);
3553 EXPORT_SYMBOL(hci_recv_frame);
3555 /* Receive diagnostic message from HCI drivers */
3556 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
3558 /* Mark as diagnostic packet */
3559 bt_cb(skb)->pkt_type = HCI_DIAG_PKT;
3562 __net_timestamp(skb);
3564 skb_queue_tail(&hdev->rx_q, skb);
3565 queue_work(hdev->workqueue, &hdev->rx_work);
3569 EXPORT_SYMBOL(hci_recv_diag);
3571 /* ---- Interface to upper protocols ---- */
3573 int hci_register_cb(struct hci_cb *cb)
3575 BT_DBG("%p name %s", cb, cb->name);
3577 mutex_lock(&hci_cb_list_lock);
3578 list_add_tail(&cb->list, &hci_cb_list);
3579 mutex_unlock(&hci_cb_list_lock);
3583 EXPORT_SYMBOL(hci_register_cb);
3585 int hci_unregister_cb(struct hci_cb *cb)
3587 BT_DBG("%p name %s", cb, cb->name);
3589 mutex_lock(&hci_cb_list_lock);
3590 list_del(&cb->list);
3591 mutex_unlock(&hci_cb_list_lock);
3595 EXPORT_SYMBOL(hci_unregister_cb);
3597 static void hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
3601 BT_DBG("%s type %d len %d", hdev->name, bt_cb(skb)->pkt_type, skb->len);
3604 __net_timestamp(skb);
3606 /* Send copy to monitor */
3607 hci_send_to_monitor(hdev, skb);
3609 if (atomic_read(&hdev->promisc)) {
3610 /* Send copy to the sockets */
3611 hci_send_to_sock(hdev, skb);
3614 /* Get rid of skb owner, prior to sending to the driver. */
3617 if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3622 err = hdev->send(hdev, skb);
3624 BT_ERR("%s sending frame failed (%d)", hdev->name, err);
3629 /* Send HCI command */
3630 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3633 struct sk_buff *skb;
3635 BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3637 skb = hci_prepare_cmd(hdev, opcode, plen, param);
3639 BT_ERR("%s no memory for command", hdev->name);
3643 /* Stand-alone HCI commands must be flagged as
3644 * single-command requests.
3646 bt_cb(skb)->hci.req_start = true;
3648 skb_queue_tail(&hdev->cmd_q, skb);
3649 queue_work(hdev->workqueue, &hdev->cmd_work);
3654 /* Get data from the previously sent command */
3655 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
3657 struct hci_command_hdr *hdr;
3659 if (!hdev->sent_cmd)
3662 hdr = (void *) hdev->sent_cmd->data;
3664 if (hdr->opcode != cpu_to_le16(opcode))
3667 BT_DBG("%s opcode 0x%4.4x", hdev->name, opcode);
3669 return hdev->sent_cmd->data + HCI_COMMAND_HDR_SIZE;
3672 /* Send HCI command and wait for command commplete event */
3673 struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
3674 const void *param, u32 timeout)
3676 struct sk_buff *skb;
3678 if (!test_bit(HCI_UP, &hdev->flags))
3679 return ERR_PTR(-ENETDOWN);
3681 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
3684 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
3685 hci_req_unlock(hdev);
3689 EXPORT_SYMBOL(hci_cmd_sync);
3692 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3694 struct hci_acl_hdr *hdr;
3697 skb_push(skb, HCI_ACL_HDR_SIZE);
3698 skb_reset_transport_header(skb);
3699 hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3700 hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3701 hdr->dlen = cpu_to_le16(len);
3704 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
3705 struct sk_buff *skb, __u16 flags)
3707 struct hci_conn *conn = chan->conn;
3708 struct hci_dev *hdev = conn->hdev;
3709 struct sk_buff *list;
3711 skb->len = skb_headlen(skb);
3714 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
3716 switch (hdev->dev_type) {
3718 hci_add_acl_hdr(skb, conn->handle, flags);
3721 hci_add_acl_hdr(skb, chan->handle, flags);
3724 BT_ERR("%s unknown dev_type %d", hdev->name, hdev->dev_type);
3728 list = skb_shinfo(skb)->frag_list;
3730 /* Non fragmented */
3731 BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3733 skb_queue_tail(queue, skb);
3736 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3738 skb_shinfo(skb)->frag_list = NULL;
3740 /* Queue all fragments atomically. We need to use spin_lock_bh
3741 * here because of 6LoWPAN links, as there this function is
3742 * called from softirq and using normal spin lock could cause
3745 spin_lock_bh(&queue->lock);
3747 __skb_queue_tail(queue, skb);
3749 flags &= ~ACL_START;
3752 skb = list; list = list->next;
3754 bt_cb(skb)->pkt_type = HCI_ACLDATA_PKT;
3755 hci_add_acl_hdr(skb, conn->handle, flags);
3757 BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3759 __skb_queue_tail(queue, skb);
3762 spin_unlock_bh(&queue->lock);
3766 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3768 struct hci_dev *hdev = chan->conn->hdev;
3770 BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
3772 hci_queue_acl(chan, &chan->data_q, skb, flags);
3774 queue_work(hdev->workqueue, &hdev->tx_work);
3778 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
3780 struct hci_dev *hdev = conn->hdev;
3781 struct hci_sco_hdr hdr;
3783 BT_DBG("%s len %d", hdev->name, skb->len);
3785 hdr.handle = cpu_to_le16(conn->handle);
3786 hdr.dlen = skb->len;
3788 skb_push(skb, HCI_SCO_HDR_SIZE);
3789 skb_reset_transport_header(skb);
3790 memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
3792 bt_cb(skb)->pkt_type = HCI_SCODATA_PKT;
3794 skb_queue_tail(&conn->data_q, skb);
3795 queue_work(hdev->workqueue, &hdev->tx_work);
3798 /* ---- HCI TX task (outgoing data) ---- */
3800 /* HCI Connection scheduler */
3801 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3804 struct hci_conn_hash *h = &hdev->conn_hash;
3805 struct hci_conn *conn = NULL, *c;
3806 unsigned int num = 0, min = ~0;
3808 /* We don't have to lock device here. Connections are always
3809 * added and removed with TX task disabled. */
3813 list_for_each_entry_rcu(c, &h->list, list) {
3814 if (c->type != type || skb_queue_empty(&c->data_q))
3817 if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3822 if (c->sent < min) {
3827 if (hci_conn_num(hdev, type) == num)
3836 switch (conn->type) {
3838 cnt = hdev->acl_cnt;
3842 cnt = hdev->sco_cnt;
3845 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3849 BT_ERR("Unknown link type");
3857 BT_DBG("conn %p quote %d", conn, *quote);
3861 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
3863 struct hci_conn_hash *h = &hdev->conn_hash;
3866 BT_ERR("%s link tx timeout", hdev->name);
3870 /* Kill stalled connections */
3871 list_for_each_entry_rcu(c, &h->list, list) {
3872 if (c->type == type && c->sent) {
3873 BT_ERR("%s killing stalled connection %pMR",
3874 hdev->name, &c->dst);
3875 hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3882 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3885 struct hci_conn_hash *h = &hdev->conn_hash;
3886 struct hci_chan *chan = NULL;
3887 unsigned int num = 0, min = ~0, cur_prio = 0;
3888 struct hci_conn *conn;
3889 int cnt, q, conn_num = 0;
3891 BT_DBG("%s", hdev->name);
3895 list_for_each_entry_rcu(conn, &h->list, list) {
3896 struct hci_chan *tmp;
3898 if (conn->type != type)
3901 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3906 list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
3907 struct sk_buff *skb;
3909 if (skb_queue_empty(&tmp->data_q))
3912 skb = skb_peek(&tmp->data_q);
3913 if (skb->priority < cur_prio)
3916 if (skb->priority > cur_prio) {
3919 cur_prio = skb->priority;
3924 if (conn->sent < min) {
3930 if (hci_conn_num(hdev, type) == conn_num)
3939 switch (chan->conn->type) {
3941 cnt = hdev->acl_cnt;
3944 cnt = hdev->block_cnt;
3948 cnt = hdev->sco_cnt;
3951 cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3955 BT_ERR("Unknown link type");
3960 BT_DBG("chan %p quote %d", chan, *quote);
3964 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3966 struct hci_conn_hash *h = &hdev->conn_hash;
3967 struct hci_conn *conn;
3970 BT_DBG("%s", hdev->name);
3974 list_for_each_entry_rcu(conn, &h->list, list) {
3975 struct hci_chan *chan;
3977 if (conn->type != type)
3980 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3985 list_for_each_entry_rcu(chan, &conn->chan_list, list) {
3986 struct sk_buff *skb;
3993 if (skb_queue_empty(&chan->data_q))
3996 skb = skb_peek(&chan->data_q);
3997 if (skb->priority >= HCI_PRIO_MAX - 1)
4000 skb->priority = HCI_PRIO_MAX - 1;
4002 BT_DBG("chan %p skb %p promoted to %d", chan, skb,
4006 if (hci_conn_num(hdev, type) == num)
4014 static inline int __get_blocks(struct hci_dev *hdev, struct sk_buff *skb)
4016 /* Calculate count of blocks used by this packet */
4017 return DIV_ROUND_UP(skb->len - HCI_ACL_HDR_SIZE, hdev->block_len);
4020 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt)
4022 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
4023 /* ACL tx timeout must be longer than maximum
4024 * link supervision timeout (40.9 seconds) */
4025 if (!cnt && time_after(jiffies, hdev->acl_last_tx +
4026 HCI_ACL_TX_TIMEOUT))
4027 hci_link_tx_to(hdev, ACL_LINK);
4031 static void hci_sched_acl_pkt(struct hci_dev *hdev)
4033 unsigned int cnt = hdev->acl_cnt;
4034 struct hci_chan *chan;
4035 struct sk_buff *skb;
4038 __check_timeout(hdev, cnt);
4040 while (hdev->acl_cnt &&
4041 (chan = hci_chan_sent(hdev, ACL_LINK, "e))) {
4042 u32 priority = (skb_peek(&chan->data_q))->priority;
4043 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4044 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4045 skb->len, skb->priority);
4047 /* Stop if priority has changed */
4048 if (skb->priority < priority)
4051 skb = skb_dequeue(&chan->data_q);
4053 hci_conn_enter_active_mode(chan->conn,
4054 bt_cb(skb)->force_active);
4056 hci_send_frame(hdev, skb);
4057 hdev->acl_last_tx = jiffies;
4065 if (cnt != hdev->acl_cnt)
4066 hci_prio_recalculate(hdev, ACL_LINK);
4069 static void hci_sched_acl_blk(struct hci_dev *hdev)
4071 unsigned int cnt = hdev->block_cnt;
4072 struct hci_chan *chan;
4073 struct sk_buff *skb;
4077 __check_timeout(hdev, cnt);
4079 BT_DBG("%s", hdev->name);
4081 if (hdev->dev_type == HCI_AMP)
4086 while (hdev->block_cnt > 0 &&
4087 (chan = hci_chan_sent(hdev, type, "e))) {
4088 u32 priority = (skb_peek(&chan->data_q))->priority;
4089 while (quote > 0 && (skb = skb_peek(&chan->data_q))) {
4092 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4093 skb->len, skb->priority);
4095 /* Stop if priority has changed */
4096 if (skb->priority < priority)
4099 skb = skb_dequeue(&chan->data_q);
4101 blocks = __get_blocks(hdev, skb);
4102 if (blocks > hdev->block_cnt)
4105 hci_conn_enter_active_mode(chan->conn,
4106 bt_cb(skb)->force_active);
4108 hci_send_frame(hdev, skb);
4109 hdev->acl_last_tx = jiffies;
4111 hdev->block_cnt -= blocks;
4114 chan->sent += blocks;
4115 chan->conn->sent += blocks;
4119 if (cnt != hdev->block_cnt)
4120 hci_prio_recalculate(hdev, type);
4123 static void hci_sched_acl(struct hci_dev *hdev)
4125 BT_DBG("%s", hdev->name);
4127 /* No ACL link over BR/EDR controller */
4128 if (!hci_conn_num(hdev, ACL_LINK) && hdev->dev_type == HCI_BREDR)
4131 /* No AMP link over AMP controller */
4132 if (!hci_conn_num(hdev, AMP_LINK) && hdev->dev_type == HCI_AMP)
4135 switch (hdev->flow_ctl_mode) {
4136 case HCI_FLOW_CTL_MODE_PACKET_BASED:
4137 hci_sched_acl_pkt(hdev);
4140 case HCI_FLOW_CTL_MODE_BLOCK_BASED:
4141 hci_sched_acl_blk(hdev);
4147 static void hci_sched_sco(struct hci_dev *hdev)
4149 struct hci_conn *conn;
4150 struct sk_buff *skb;
4153 BT_DBG("%s", hdev->name);
4155 if (!hci_conn_num(hdev, SCO_LINK))
4158 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, "e))) {
4159 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4160 BT_DBG("skb %p len %d", skb, skb->len);
4161 hci_send_frame(hdev, skb);
4164 if (conn->sent == ~0)
4170 static void hci_sched_esco(struct hci_dev *hdev)
4172 struct hci_conn *conn;
4173 struct sk_buff *skb;
4176 BT_DBG("%s", hdev->name);
4178 if (!hci_conn_num(hdev, ESCO_LINK))
4181 while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
4183 while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
4184 BT_DBG("skb %p len %d", skb, skb->len);
4185 hci_send_frame(hdev, skb);
4188 if (conn->sent == ~0)
4194 static void hci_sched_le(struct hci_dev *hdev)
4196 struct hci_chan *chan;
4197 struct sk_buff *skb;
4198 int quote, cnt, tmp;
4200 BT_DBG("%s", hdev->name);
4202 if (!hci_conn_num(hdev, LE_LINK))
4205 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
4206 /* LE tx timeout must be longer than maximum
4207 * link supervision timeout (40.9 seconds) */
4208 if (!hdev->le_cnt && hdev->le_pkts &&
4209 time_after(jiffies, hdev->le_last_tx + HZ * 45))
4210 hci_link_tx_to(hdev, LE_LINK);
4213 cnt = hdev->le_pkts ? hdev->le_cnt : hdev->acl_cnt;
4215 while (cnt && (chan = hci_chan_sent(hdev, LE_LINK, "e))) {
4216 u32 priority = (skb_peek(&chan->data_q))->priority;
4217 while (quote-- && (skb = skb_peek(&chan->data_q))) {
4218 BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
4219 skb->len, skb->priority);
4221 /* Stop if priority has changed */
4222 if (skb->priority < priority)
4225 skb = skb_dequeue(&chan->data_q);
4227 hci_send_frame(hdev, skb);
4228 hdev->le_last_tx = jiffies;
4239 hdev->acl_cnt = cnt;
4242 hci_prio_recalculate(hdev, LE_LINK);
4245 static void hci_tx_work(struct work_struct *work)
4247 struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
4248 struct sk_buff *skb;
4250 BT_DBG("%s acl %d sco %d le %d", hdev->name, hdev->acl_cnt,
4251 hdev->sco_cnt, hdev->le_cnt);
4253 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4254 /* Schedule queues and send stuff to HCI driver */
4255 hci_sched_acl(hdev);
4256 hci_sched_sco(hdev);
4257 hci_sched_esco(hdev);
4261 /* Send next queued raw (unknown type) packet */
4262 while ((skb = skb_dequeue(&hdev->raw_q)))
4263 hci_send_frame(hdev, skb);
4266 /* ----- HCI RX task (incoming data processing) ----- */
4268 /* ACL data packet */
4269 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4271 struct hci_acl_hdr *hdr = (void *) skb->data;
4272 struct hci_conn *conn;
4273 __u16 handle, flags;
4275 skb_pull(skb, HCI_ACL_HDR_SIZE);
4277 handle = __le16_to_cpu(hdr->handle);
4278 flags = hci_flags(handle);
4279 handle = hci_handle(handle);
4281 BT_DBG("%s len %d handle 0x%4.4x flags 0x%4.4x", hdev->name, skb->len,
4284 hdev->stat.acl_rx++;
4287 conn = hci_conn_hash_lookup_handle(hdev, handle);
4288 hci_dev_unlock(hdev);
4291 hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
4293 /* Send to upper protocol */
4294 l2cap_recv_acldata(conn, skb, flags);
4297 BT_ERR("%s ACL packet for unknown connection handle %d",
4298 hdev->name, handle);
4304 /* SCO data packet */
4305 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
4307 struct hci_sco_hdr *hdr = (void *) skb->data;
4308 struct hci_conn *conn;
4311 skb_pull(skb, HCI_SCO_HDR_SIZE);
4313 handle = __le16_to_cpu(hdr->handle);
4315 BT_DBG("%s len %d handle 0x%4.4x", hdev->name, skb->len, handle);
4317 hdev->stat.sco_rx++;
4320 conn = hci_conn_hash_lookup_handle(hdev, handle);
4321 hci_dev_unlock(hdev);
4324 /* Send to upper protocol */
4325 sco_recv_scodata(conn, skb);
4328 BT_ERR("%s SCO packet for unknown connection handle %d",
4329 hdev->name, handle);
4335 static bool hci_req_is_complete(struct hci_dev *hdev)
4337 struct sk_buff *skb;
4339 skb = skb_peek(&hdev->cmd_q);
4343 return bt_cb(skb)->hci.req_start;
4346 static void hci_resend_last(struct hci_dev *hdev)
4348 struct hci_command_hdr *sent;
4349 struct sk_buff *skb;
4352 if (!hdev->sent_cmd)
4355 sent = (void *) hdev->sent_cmd->data;
4356 opcode = __le16_to_cpu(sent->opcode);
4357 if (opcode == HCI_OP_RESET)
4360 skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4364 skb_queue_head(&hdev->cmd_q, skb);
4365 queue_work(hdev->workqueue, &hdev->cmd_work);
4368 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
4369 hci_req_complete_t *req_complete,
4370 hci_req_complete_skb_t *req_complete_skb)
4372 struct sk_buff *skb;
4373 unsigned long flags;
4375 BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
4377 /* If the completed command doesn't match the last one that was
4378 * sent we need to do special handling of it.
4380 if (!hci_sent_cmd_data(hdev, opcode)) {
4381 /* Some CSR based controllers generate a spontaneous
4382 * reset complete event during init and any pending
4383 * command will never be completed. In such a case we
4384 * need to resend whatever was the last sent
4387 if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
4388 hci_resend_last(hdev);
4393 /* If the command succeeded and there's still more commands in
4394 * this request the request is not yet complete.
4396 if (!status && !hci_req_is_complete(hdev))
4399 /* If this was the last command in a request the complete
4400 * callback would be found in hdev->sent_cmd instead of the
4401 * command queue (hdev->cmd_q).
4403 if (bt_cb(hdev->sent_cmd)->hci.req_complete) {
4404 *req_complete = bt_cb(hdev->sent_cmd)->hci.req_complete;
4408 if (bt_cb(hdev->sent_cmd)->hci.req_complete_skb) {
4409 *req_complete_skb = bt_cb(hdev->sent_cmd)->hci.req_complete_skb;
4413 /* Remove all pending commands belonging to this request */
4414 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
4415 while ((skb = __skb_dequeue(&hdev->cmd_q))) {
4416 if (bt_cb(skb)->hci.req_start) {
4417 __skb_queue_head(&hdev->cmd_q, skb);
4421 *req_complete = bt_cb(skb)->hci.req_complete;
4422 *req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
4425 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
4428 static void hci_rx_work(struct work_struct *work)
4430 struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
4431 struct sk_buff *skb;
4433 BT_DBG("%s", hdev->name);
4435 while ((skb = skb_dequeue(&hdev->rx_q))) {
4436 /* Send copy to monitor */
4437 hci_send_to_monitor(hdev, skb);
4439 if (atomic_read(&hdev->promisc)) {
4440 /* Send copy to the sockets */
4441 hci_send_to_sock(hdev, skb);
4444 if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4449 if (test_bit(HCI_INIT, &hdev->flags)) {
4450 /* Don't process data packets in this states. */
4451 switch (bt_cb(skb)->pkt_type) {
4452 case HCI_ACLDATA_PKT:
4453 case HCI_SCODATA_PKT:
4460 switch (bt_cb(skb)->pkt_type) {
4462 BT_DBG("%s Event packet", hdev->name);
4463 hci_event_packet(hdev, skb);
4466 case HCI_ACLDATA_PKT:
4467 BT_DBG("%s ACL data packet", hdev->name);
4468 hci_acldata_packet(hdev, skb);
4471 case HCI_SCODATA_PKT:
4472 BT_DBG("%s SCO data packet", hdev->name);
4473 hci_scodata_packet(hdev, skb);
4483 static void hci_cmd_work(struct work_struct *work)
4485 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4486 struct sk_buff *skb;
4488 BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4489 atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4491 /* Send queued commands */
4492 if (atomic_read(&hdev->cmd_cnt)) {
4493 skb = skb_dequeue(&hdev->cmd_q);
4497 kfree_skb(hdev->sent_cmd);
4499 hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4500 if (hdev->sent_cmd) {
4501 atomic_dec(&hdev->cmd_cnt);
4502 hci_send_frame(hdev, skb);
4503 if (test_bit(HCI_RESET, &hdev->flags))
4504 cancel_delayed_work(&hdev->cmd_timer);
4506 schedule_delayed_work(&hdev->cmd_timer,
4509 skb_queue_head(&hdev->cmd_q, skb);
4510 queue_work(hdev->workqueue, &hdev->cmd_work);