xref: /linux/net/bluetooth/hci_core.c (revision 4003c9e78778e93188a09d6043a74f7154449d43)
1 /*
2    BlueZ - Bluetooth protocol stack for Linux
3    Copyright (C) 2000-2001 Qualcomm Incorporated
4    Copyright (C) 2011 ProFUSION Embedded Systems
5 
6    Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>
7 
8    This program is free software; you can redistribute it and/or modify
9    it under the terms of the GNU General Public License version 2 as
10    published by the Free Software Foundation;
11 
12    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
13    OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
14    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
15    IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16    CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
17    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
18    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
19    OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
20 
21    ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
22    COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
23    SOFTWARE IS DISCLAIMED.
24 */
25 
26 /* Bluetooth HCI core. */
27 
28 #include <linux/export.h>
29 #include <linux/rfkill.h>
30 #include <linux/debugfs.h>
31 #include <linux/crypto.h>
32 #include <linux/kcov.h>
33 #include <linux/property.h>
34 #include <linux/suspend.h>
35 #include <linux/wait.h>
36 #include <linux/unaligned.h>
37 
38 #include <net/bluetooth/bluetooth.h>
39 #include <net/bluetooth/hci_core.h>
40 #include <net/bluetooth/l2cap.h>
41 #include <net/bluetooth/mgmt.h>
42 
43 #include "hci_debugfs.h"
44 #include "smp.h"
45 #include "leds.h"
46 #include "msft.h"
47 #include "aosp.h"
48 #include "hci_codec.h"
49 
50 static void hci_rx_work(struct work_struct *work);
51 static void hci_cmd_work(struct work_struct *work);
52 static void hci_tx_work(struct work_struct *work);
53 
54 /* HCI device list */
55 LIST_HEAD(hci_dev_list);
56 DEFINE_RWLOCK(hci_dev_list_lock);
57 
58 /* HCI callback list */
59 LIST_HEAD(hci_cb_list);
60 DEFINE_MUTEX(hci_cb_list_lock);
61 
62 /* HCI ID Numbering */
63 static DEFINE_IDA(hci_index_ida);
64 
65 /* Get HCI device by index.
66  * Device is held on return. */
hci_dev_get(int index)67 struct hci_dev *hci_dev_get(int index)
68 {
69 	struct hci_dev *hdev = NULL, *d;
70 
71 	BT_DBG("%d", index);
72 
73 	if (index < 0)
74 		return NULL;
75 
76 	read_lock(&hci_dev_list_lock);
77 	list_for_each_entry(d, &hci_dev_list, list) {
78 		if (d->id == index) {
79 			hdev = hci_dev_hold(d);
80 			break;
81 		}
82 	}
83 	read_unlock(&hci_dev_list_lock);
84 	return hdev;
85 }
86 
87 /* ---- Inquiry support ---- */
88 
hci_discovery_active(struct hci_dev * hdev)89 bool hci_discovery_active(struct hci_dev *hdev)
90 {
91 	struct discovery_state *discov = &hdev->discovery;
92 
93 	switch (discov->state) {
94 	case DISCOVERY_FINDING:
95 	case DISCOVERY_RESOLVING:
96 		return true;
97 
98 	default:
99 		return false;
100 	}
101 }
102 
hci_discovery_set_state(struct hci_dev * hdev,int state)103 void hci_discovery_set_state(struct hci_dev *hdev, int state)
104 {
105 	int old_state = hdev->discovery.state;
106 
107 	if (old_state == state)
108 		return;
109 
110 	hdev->discovery.state = state;
111 
112 	switch (state) {
113 	case DISCOVERY_STOPPED:
114 		hci_update_passive_scan(hdev);
115 
116 		if (old_state != DISCOVERY_STARTING)
117 			mgmt_discovering(hdev, 0);
118 		break;
119 	case DISCOVERY_STARTING:
120 		break;
121 	case DISCOVERY_FINDING:
122 		mgmt_discovering(hdev, 1);
123 		break;
124 	case DISCOVERY_RESOLVING:
125 		break;
126 	case DISCOVERY_STOPPING:
127 		break;
128 	}
129 
130 	bt_dev_dbg(hdev, "state %u -> %u", old_state, state);
131 }
132 
hci_inquiry_cache_flush(struct hci_dev * hdev)133 void hci_inquiry_cache_flush(struct hci_dev *hdev)
134 {
135 	struct discovery_state *cache = &hdev->discovery;
136 	struct inquiry_entry *p, *n;
137 
138 	list_for_each_entry_safe(p, n, &cache->all, all) {
139 		list_del(&p->all);
140 		kfree(p);
141 	}
142 
143 	INIT_LIST_HEAD(&cache->unknown);
144 	INIT_LIST_HEAD(&cache->resolve);
145 }
146 
hci_inquiry_cache_lookup(struct hci_dev * hdev,bdaddr_t * bdaddr)147 struct inquiry_entry *hci_inquiry_cache_lookup(struct hci_dev *hdev,
148 					       bdaddr_t *bdaddr)
149 {
150 	struct discovery_state *cache = &hdev->discovery;
151 	struct inquiry_entry *e;
152 
153 	BT_DBG("cache %p, %pMR", cache, bdaddr);
154 
155 	list_for_each_entry(e, &cache->all, all) {
156 		if (!bacmp(&e->data.bdaddr, bdaddr))
157 			return e;
158 	}
159 
160 	return NULL;
161 }
162 
hci_inquiry_cache_lookup_unknown(struct hci_dev * hdev,bdaddr_t * bdaddr)163 struct inquiry_entry *hci_inquiry_cache_lookup_unknown(struct hci_dev *hdev,
164 						       bdaddr_t *bdaddr)
165 {
166 	struct discovery_state *cache = &hdev->discovery;
167 	struct inquiry_entry *e;
168 
169 	BT_DBG("cache %p, %pMR", cache, bdaddr);
170 
171 	list_for_each_entry(e, &cache->unknown, list) {
172 		if (!bacmp(&e->data.bdaddr, bdaddr))
173 			return e;
174 	}
175 
176 	return NULL;
177 }
178 
hci_inquiry_cache_lookup_resolve(struct hci_dev * hdev,bdaddr_t * bdaddr,int state)179 struct inquiry_entry *hci_inquiry_cache_lookup_resolve(struct hci_dev *hdev,
180 						       bdaddr_t *bdaddr,
181 						       int state)
182 {
183 	struct discovery_state *cache = &hdev->discovery;
184 	struct inquiry_entry *e;
185 
186 	BT_DBG("cache %p bdaddr %pMR state %d", cache, bdaddr, state);
187 
188 	list_for_each_entry(e, &cache->resolve, list) {
189 		if (!bacmp(bdaddr, BDADDR_ANY) && e->name_state == state)
190 			return e;
191 		if (!bacmp(&e->data.bdaddr, bdaddr))
192 			return e;
193 	}
194 
195 	return NULL;
196 }
197 
hci_inquiry_cache_update_resolve(struct hci_dev * hdev,struct inquiry_entry * ie)198 void hci_inquiry_cache_update_resolve(struct hci_dev *hdev,
199 				      struct inquiry_entry *ie)
200 {
201 	struct discovery_state *cache = &hdev->discovery;
202 	struct list_head *pos = &cache->resolve;
203 	struct inquiry_entry *p;
204 
205 	list_del(&ie->list);
206 
207 	list_for_each_entry(p, &cache->resolve, list) {
208 		if (p->name_state != NAME_PENDING &&
209 		    abs(p->data.rssi) >= abs(ie->data.rssi))
210 			break;
211 		pos = &p->list;
212 	}
213 
214 	list_add(&ie->list, pos);
215 }
216 
hci_inquiry_cache_update(struct hci_dev * hdev,struct inquiry_data * data,bool name_known)217 u32 hci_inquiry_cache_update(struct hci_dev *hdev, struct inquiry_data *data,
218 			     bool name_known)
219 {
220 	struct discovery_state *cache = &hdev->discovery;
221 	struct inquiry_entry *ie;
222 	u32 flags = 0;
223 
224 	BT_DBG("cache %p, %pMR", cache, &data->bdaddr);
225 
226 	hci_remove_remote_oob_data(hdev, &data->bdaddr, BDADDR_BREDR);
227 
228 	if (!data->ssp_mode)
229 		flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
230 
231 	ie = hci_inquiry_cache_lookup(hdev, &data->bdaddr);
232 	if (ie) {
233 		if (!ie->data.ssp_mode)
234 			flags |= MGMT_DEV_FOUND_LEGACY_PAIRING;
235 
236 		if (ie->name_state == NAME_NEEDED &&
237 		    data->rssi != ie->data.rssi) {
238 			ie->data.rssi = data->rssi;
239 			hci_inquiry_cache_update_resolve(hdev, ie);
240 		}
241 
242 		goto update;
243 	}
244 
245 	/* Entry not in the cache. Add new one. */
246 	ie = kzalloc(sizeof(*ie), GFP_KERNEL);
247 	if (!ie) {
248 		flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
249 		goto done;
250 	}
251 
252 	list_add(&ie->all, &cache->all);
253 
254 	if (name_known) {
255 		ie->name_state = NAME_KNOWN;
256 	} else {
257 		ie->name_state = NAME_NOT_KNOWN;
258 		list_add(&ie->list, &cache->unknown);
259 	}
260 
261 update:
262 	if (name_known && ie->name_state != NAME_KNOWN &&
263 	    ie->name_state != NAME_PENDING) {
264 		ie->name_state = NAME_KNOWN;
265 		list_del(&ie->list);
266 	}
267 
268 	memcpy(&ie->data, data, sizeof(*data));
269 	ie->timestamp = jiffies;
270 	cache->timestamp = jiffies;
271 
272 	if (ie->name_state == NAME_NOT_KNOWN)
273 		flags |= MGMT_DEV_FOUND_CONFIRM_NAME;
274 
275 done:
276 	return flags;
277 }
278 
inquiry_cache_dump(struct hci_dev * hdev,int num,__u8 * buf)279 static int inquiry_cache_dump(struct hci_dev *hdev, int num, __u8 *buf)
280 {
281 	struct discovery_state *cache = &hdev->discovery;
282 	struct inquiry_info *info = (struct inquiry_info *) buf;
283 	struct inquiry_entry *e;
284 	int copied = 0;
285 
286 	list_for_each_entry(e, &cache->all, all) {
287 		struct inquiry_data *data = &e->data;
288 
289 		if (copied >= num)
290 			break;
291 
292 		bacpy(&info->bdaddr, &data->bdaddr);
293 		info->pscan_rep_mode	= data->pscan_rep_mode;
294 		info->pscan_period_mode	= data->pscan_period_mode;
295 		info->pscan_mode	= data->pscan_mode;
296 		memcpy(info->dev_class, data->dev_class, 3);
297 		info->clock_offset	= data->clock_offset;
298 
299 		info++;
300 		copied++;
301 	}
302 
303 	BT_DBG("cache %p, copied %d", cache, copied);
304 	return copied;
305 }
306 
hci_inquiry(void __user * arg)307 int hci_inquiry(void __user *arg)
308 {
309 	__u8 __user *ptr = arg;
310 	struct hci_inquiry_req ir;
311 	struct hci_dev *hdev;
312 	int err = 0, do_inquiry = 0, max_rsp;
313 	__u8 *buf;
314 
315 	if (copy_from_user(&ir, ptr, sizeof(ir)))
316 		return -EFAULT;
317 
318 	hdev = hci_dev_get(ir.dev_id);
319 	if (!hdev)
320 		return -ENODEV;
321 
322 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
323 		err = -EBUSY;
324 		goto done;
325 	}
326 
327 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
328 		err = -EOPNOTSUPP;
329 		goto done;
330 	}
331 
332 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
333 		err = -EOPNOTSUPP;
334 		goto done;
335 	}
336 
337 	/* Restrict maximum inquiry length to 60 seconds */
338 	if (ir.length > 60) {
339 		err = -EINVAL;
340 		goto done;
341 	}
342 
343 	hci_dev_lock(hdev);
344 	if (inquiry_cache_age(hdev) > INQUIRY_CACHE_AGE_MAX ||
345 	    inquiry_cache_empty(hdev) || ir.flags & IREQ_CACHE_FLUSH) {
346 		hci_inquiry_cache_flush(hdev);
347 		do_inquiry = 1;
348 	}
349 	hci_dev_unlock(hdev);
350 
351 	if (do_inquiry) {
352 		hci_req_sync_lock(hdev);
353 		err = hci_inquiry_sync(hdev, ir.length, ir.num_rsp);
354 		hci_req_sync_unlock(hdev);
355 
356 		if (err < 0)
357 			goto done;
358 
359 		/* Wait until Inquiry procedure finishes (HCI_INQUIRY flag is
360 		 * cleared). If it is interrupted by a signal, return -EINTR.
361 		 */
362 		if (wait_on_bit(&hdev->flags, HCI_INQUIRY,
363 				TASK_INTERRUPTIBLE)) {
364 			err = -EINTR;
365 			goto done;
366 		}
367 	}
368 
369 	/* for unlimited number of responses we will use buffer with
370 	 * 255 entries
371 	 */
372 	max_rsp = (ir.num_rsp == 0) ? 255 : ir.num_rsp;
373 
374 	/* cache_dump can't sleep. Therefore we allocate temp buffer and then
375 	 * copy it to the user space.
376 	 */
377 	buf = kmalloc_array(max_rsp, sizeof(struct inquiry_info), GFP_KERNEL);
378 	if (!buf) {
379 		err = -ENOMEM;
380 		goto done;
381 	}
382 
383 	hci_dev_lock(hdev);
384 	ir.num_rsp = inquiry_cache_dump(hdev, max_rsp, buf);
385 	hci_dev_unlock(hdev);
386 
387 	BT_DBG("num_rsp %d", ir.num_rsp);
388 
389 	if (!copy_to_user(ptr, &ir, sizeof(ir))) {
390 		ptr += sizeof(ir);
391 		if (copy_to_user(ptr, buf, sizeof(struct inquiry_info) *
392 				 ir.num_rsp))
393 			err = -EFAULT;
394 	} else
395 		err = -EFAULT;
396 
397 	kfree(buf);
398 
399 done:
400 	hci_dev_put(hdev);
401 	return err;
402 }
403 
hci_dev_do_open(struct hci_dev * hdev)404 static int hci_dev_do_open(struct hci_dev *hdev)
405 {
406 	int ret = 0;
407 
408 	BT_DBG("%s %p", hdev->name, hdev);
409 
410 	hci_req_sync_lock(hdev);
411 
412 	ret = hci_dev_open_sync(hdev);
413 
414 	hci_req_sync_unlock(hdev);
415 	return ret;
416 }
417 
418 /* ---- HCI ioctl helpers ---- */
419 
hci_dev_open(__u16 dev)420 int hci_dev_open(__u16 dev)
421 {
422 	struct hci_dev *hdev;
423 	int err;
424 
425 	hdev = hci_dev_get(dev);
426 	if (!hdev)
427 		return -ENODEV;
428 
429 	/* Devices that are marked as unconfigured can only be powered
430 	 * up as user channel. Trying to bring them up as normal devices
431 	 * will result into a failure. Only user channel operation is
432 	 * possible.
433 	 *
434 	 * When this function is called for a user channel, the flag
435 	 * HCI_USER_CHANNEL will be set first before attempting to
436 	 * open the device.
437 	 */
438 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
439 	    !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
440 		err = -EOPNOTSUPP;
441 		goto done;
442 	}
443 
444 	/* We need to ensure that no other power on/off work is pending
445 	 * before proceeding to call hci_dev_do_open. This is
446 	 * particularly important if the setup procedure has not yet
447 	 * completed.
448 	 */
449 	if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
450 		cancel_delayed_work(&hdev->power_off);
451 
452 	/* After this call it is guaranteed that the setup procedure
453 	 * has finished. This means that error conditions like RFKILL
454 	 * or no valid public or static random address apply.
455 	 */
456 	flush_workqueue(hdev->req_workqueue);
457 
458 	/* For controllers not using the management interface and that
459 	 * are brought up using legacy ioctl, set the HCI_BONDABLE bit
460 	 * so that pairing works for them. Once the management interface
461 	 * is in use this bit will be cleared again and userspace has
462 	 * to explicitly enable it.
463 	 */
464 	if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
465 	    !hci_dev_test_flag(hdev, HCI_MGMT))
466 		hci_dev_set_flag(hdev, HCI_BONDABLE);
467 
468 	err = hci_dev_do_open(hdev);
469 
470 done:
471 	hci_dev_put(hdev);
472 	return err;
473 }
474 
hci_dev_do_close(struct hci_dev * hdev)475 int hci_dev_do_close(struct hci_dev *hdev)
476 {
477 	int err;
478 
479 	BT_DBG("%s %p", hdev->name, hdev);
480 
481 	hci_req_sync_lock(hdev);
482 
483 	err = hci_dev_close_sync(hdev);
484 
485 	hci_req_sync_unlock(hdev);
486 
487 	return err;
488 }
489 
hci_dev_close(__u16 dev)490 int hci_dev_close(__u16 dev)
491 {
492 	struct hci_dev *hdev;
493 	int err;
494 
495 	hdev = hci_dev_get(dev);
496 	if (!hdev)
497 		return -ENODEV;
498 
499 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
500 		err = -EBUSY;
501 		goto done;
502 	}
503 
504 	cancel_work_sync(&hdev->power_on);
505 	if (hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF))
506 		cancel_delayed_work(&hdev->power_off);
507 
508 	err = hci_dev_do_close(hdev);
509 
510 done:
511 	hci_dev_put(hdev);
512 	return err;
513 }
514 
hci_dev_do_reset(struct hci_dev * hdev)515 static int hci_dev_do_reset(struct hci_dev *hdev)
516 {
517 	int ret;
518 
519 	BT_DBG("%s %p", hdev->name, hdev);
520 
521 	hci_req_sync_lock(hdev);
522 
523 	/* Drop queues */
524 	skb_queue_purge(&hdev->rx_q);
525 	skb_queue_purge(&hdev->cmd_q);
526 
527 	/* Cancel these to avoid queueing non-chained pending work */
528 	hci_dev_set_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
529 	/* Wait for
530 	 *
531 	 *    if (!hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
532 	 *        queue_delayed_work(&hdev->{cmd,ncmd}_timer)
533 	 *
534 	 * inside RCU section to see the flag or complete scheduling.
535 	 */
536 	synchronize_rcu();
537 	/* Explicitly cancel works in case scheduled after setting the flag. */
538 	cancel_delayed_work(&hdev->cmd_timer);
539 	cancel_delayed_work(&hdev->ncmd_timer);
540 
541 	/* Avoid potential lockdep warnings from the *_flush() calls by
542 	 * ensuring the workqueue is empty up front.
543 	 */
544 	drain_workqueue(hdev->workqueue);
545 
546 	hci_dev_lock(hdev);
547 	hci_inquiry_cache_flush(hdev);
548 	hci_conn_hash_flush(hdev);
549 	hci_dev_unlock(hdev);
550 
551 	if (hdev->flush)
552 		hdev->flush(hdev);
553 
554 	hci_dev_clear_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE);
555 
556 	atomic_set(&hdev->cmd_cnt, 1);
557 	hdev->acl_cnt = 0;
558 	hdev->sco_cnt = 0;
559 	hdev->le_cnt = 0;
560 	hdev->iso_cnt = 0;
561 
562 	ret = hci_reset_sync(hdev);
563 
564 	hci_req_sync_unlock(hdev);
565 	return ret;
566 }
567 
hci_dev_reset(__u16 dev)568 int hci_dev_reset(__u16 dev)
569 {
570 	struct hci_dev *hdev;
571 	int err;
572 
573 	hdev = hci_dev_get(dev);
574 	if (!hdev)
575 		return -ENODEV;
576 
577 	if (!test_bit(HCI_UP, &hdev->flags)) {
578 		err = -ENETDOWN;
579 		goto done;
580 	}
581 
582 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
583 		err = -EBUSY;
584 		goto done;
585 	}
586 
587 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
588 		err = -EOPNOTSUPP;
589 		goto done;
590 	}
591 
592 	err = hci_dev_do_reset(hdev);
593 
594 done:
595 	hci_dev_put(hdev);
596 	return err;
597 }
598 
hci_dev_reset_stat(__u16 dev)599 int hci_dev_reset_stat(__u16 dev)
600 {
601 	struct hci_dev *hdev;
602 	int ret = 0;
603 
604 	hdev = hci_dev_get(dev);
605 	if (!hdev)
606 		return -ENODEV;
607 
608 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
609 		ret = -EBUSY;
610 		goto done;
611 	}
612 
613 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
614 		ret = -EOPNOTSUPP;
615 		goto done;
616 	}
617 
618 	memset(&hdev->stat, 0, sizeof(struct hci_dev_stats));
619 
620 done:
621 	hci_dev_put(hdev);
622 	return ret;
623 }
624 
hci_update_passive_scan_state(struct hci_dev * hdev,u8 scan)625 static void hci_update_passive_scan_state(struct hci_dev *hdev, u8 scan)
626 {
627 	bool conn_changed, discov_changed;
628 
629 	BT_DBG("%s scan 0x%02x", hdev->name, scan);
630 
631 	if ((scan & SCAN_PAGE))
632 		conn_changed = !hci_dev_test_and_set_flag(hdev,
633 							  HCI_CONNECTABLE);
634 	else
635 		conn_changed = hci_dev_test_and_clear_flag(hdev,
636 							   HCI_CONNECTABLE);
637 
638 	if ((scan & SCAN_INQUIRY)) {
639 		discov_changed = !hci_dev_test_and_set_flag(hdev,
640 							    HCI_DISCOVERABLE);
641 	} else {
642 		hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
643 		discov_changed = hci_dev_test_and_clear_flag(hdev,
644 							     HCI_DISCOVERABLE);
645 	}
646 
647 	if (!hci_dev_test_flag(hdev, HCI_MGMT))
648 		return;
649 
650 	if (conn_changed || discov_changed) {
651 		/* In case this was disabled through mgmt */
652 		hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
653 
654 		if (hci_dev_test_flag(hdev, HCI_LE_ENABLED))
655 			hci_update_adv_data(hdev, hdev->cur_adv_instance);
656 
657 		mgmt_new_settings(hdev);
658 	}
659 }
660 
hci_dev_cmd(unsigned int cmd,void __user * arg)661 int hci_dev_cmd(unsigned int cmd, void __user *arg)
662 {
663 	struct hci_dev *hdev;
664 	struct hci_dev_req dr;
665 	__le16 policy;
666 	int err = 0;
667 
668 	if (copy_from_user(&dr, arg, sizeof(dr)))
669 		return -EFAULT;
670 
671 	hdev = hci_dev_get(dr.dev_id);
672 	if (!hdev)
673 		return -ENODEV;
674 
675 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
676 		err = -EBUSY;
677 		goto done;
678 	}
679 
680 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
681 		err = -EOPNOTSUPP;
682 		goto done;
683 	}
684 
685 	if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
686 		err = -EOPNOTSUPP;
687 		goto done;
688 	}
689 
690 	switch (cmd) {
691 	case HCISETAUTH:
692 		err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_AUTH_ENABLE,
693 					  1, &dr.dev_opt, HCI_CMD_TIMEOUT);
694 		break;
695 
696 	case HCISETENCRYPT:
697 		if (!lmp_encrypt_capable(hdev)) {
698 			err = -EOPNOTSUPP;
699 			break;
700 		}
701 
702 		if (!test_bit(HCI_AUTH, &hdev->flags)) {
703 			/* Auth must be enabled first */
704 			err = hci_cmd_sync_status(hdev,
705 						  HCI_OP_WRITE_AUTH_ENABLE,
706 						  1, &dr.dev_opt,
707 						  HCI_CMD_TIMEOUT);
708 			if (err)
709 				break;
710 		}
711 
712 		err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_ENCRYPT_MODE,
713 					  1, &dr.dev_opt, HCI_CMD_TIMEOUT);
714 		break;
715 
716 	case HCISETSCAN:
717 		err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_SCAN_ENABLE,
718 					  1, &dr.dev_opt, HCI_CMD_TIMEOUT);
719 
720 		/* Ensure that the connectable and discoverable states
721 		 * get correctly modified as this was a non-mgmt change.
722 		 */
723 		if (!err)
724 			hci_update_passive_scan_state(hdev, dr.dev_opt);
725 		break;
726 
727 	case HCISETLINKPOL:
728 		policy = cpu_to_le16(dr.dev_opt);
729 
730 		err = hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
731 					  2, &policy, HCI_CMD_TIMEOUT);
732 		break;
733 
734 	case HCISETLINKMODE:
735 		hdev->link_mode = ((__u16) dr.dev_opt) &
736 					(HCI_LM_MASTER | HCI_LM_ACCEPT);
737 		break;
738 
739 	case HCISETPTYPE:
740 		if (hdev->pkt_type == (__u16) dr.dev_opt)
741 			break;
742 
743 		hdev->pkt_type = (__u16) dr.dev_opt;
744 		mgmt_phy_configuration_changed(hdev, NULL);
745 		break;
746 
747 	case HCISETACLMTU:
748 		hdev->acl_mtu  = *((__u16 *) &dr.dev_opt + 1);
749 		hdev->acl_pkts = *((__u16 *) &dr.dev_opt + 0);
750 		break;
751 
752 	case HCISETSCOMTU:
753 		hdev->sco_mtu  = *((__u16 *) &dr.dev_opt + 1);
754 		hdev->sco_pkts = *((__u16 *) &dr.dev_opt + 0);
755 		break;
756 
757 	default:
758 		err = -EINVAL;
759 		break;
760 	}
761 
762 done:
763 	hci_dev_put(hdev);
764 	return err;
765 }
766 
hci_get_dev_list(void __user * arg)767 int hci_get_dev_list(void __user *arg)
768 {
769 	struct hci_dev *hdev;
770 	struct hci_dev_list_req *dl;
771 	struct hci_dev_req *dr;
772 	int n = 0, err;
773 	__u16 dev_num;
774 
775 	if (get_user(dev_num, (__u16 __user *) arg))
776 		return -EFAULT;
777 
778 	if (!dev_num || dev_num > (PAGE_SIZE * 2) / sizeof(*dr))
779 		return -EINVAL;
780 
781 	dl = kzalloc(struct_size(dl, dev_req, dev_num), GFP_KERNEL);
782 	if (!dl)
783 		return -ENOMEM;
784 
785 	dl->dev_num = dev_num;
786 	dr = dl->dev_req;
787 
788 	read_lock(&hci_dev_list_lock);
789 	list_for_each_entry(hdev, &hci_dev_list, list) {
790 		unsigned long flags = hdev->flags;
791 
792 		/* When the auto-off is configured it means the transport
793 		 * is running, but in that case still indicate that the
794 		 * device is actually down.
795 		 */
796 		if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
797 			flags &= ~BIT(HCI_UP);
798 
799 		dr[n].dev_id  = hdev->id;
800 		dr[n].dev_opt = flags;
801 
802 		if (++n >= dev_num)
803 			break;
804 	}
805 	read_unlock(&hci_dev_list_lock);
806 
807 	dl->dev_num = n;
808 	err = copy_to_user(arg, dl, struct_size(dl, dev_req, n));
809 	kfree(dl);
810 
811 	return err ? -EFAULT : 0;
812 }
813 
hci_get_dev_info(void __user * arg)814 int hci_get_dev_info(void __user *arg)
815 {
816 	struct hci_dev *hdev;
817 	struct hci_dev_info di;
818 	unsigned long flags;
819 	int err = 0;
820 
821 	if (copy_from_user(&di, arg, sizeof(di)))
822 		return -EFAULT;
823 
824 	hdev = hci_dev_get(di.dev_id);
825 	if (!hdev)
826 		return -ENODEV;
827 
828 	/* When the auto-off is configured it means the transport
829 	 * is running, but in that case still indicate that the
830 	 * device is actually down.
831 	 */
832 	if (hci_dev_test_flag(hdev, HCI_AUTO_OFF))
833 		flags = hdev->flags & ~BIT(HCI_UP);
834 	else
835 		flags = hdev->flags;
836 
837 	strscpy(di.name, hdev->name, sizeof(di.name));
838 	di.bdaddr   = hdev->bdaddr;
839 	di.type     = (hdev->bus & 0x0f);
840 	di.flags    = flags;
841 	di.pkt_type = hdev->pkt_type;
842 	if (lmp_bredr_capable(hdev)) {
843 		di.acl_mtu  = hdev->acl_mtu;
844 		di.acl_pkts = hdev->acl_pkts;
845 		di.sco_mtu  = hdev->sco_mtu;
846 		di.sco_pkts = hdev->sco_pkts;
847 	} else {
848 		di.acl_mtu  = hdev->le_mtu;
849 		di.acl_pkts = hdev->le_pkts;
850 		di.sco_mtu  = 0;
851 		di.sco_pkts = 0;
852 	}
853 	di.link_policy = hdev->link_policy;
854 	di.link_mode   = hdev->link_mode;
855 
856 	memcpy(&di.stat, &hdev->stat, sizeof(di.stat));
857 	memcpy(&di.features, &hdev->features, sizeof(di.features));
858 
859 	if (copy_to_user(arg, &di, sizeof(di)))
860 		err = -EFAULT;
861 
862 	hci_dev_put(hdev);
863 
864 	return err;
865 }
866 
867 /* ---- Interface to HCI drivers ---- */
868 
hci_dev_do_poweroff(struct hci_dev * hdev)869 static int hci_dev_do_poweroff(struct hci_dev *hdev)
870 {
871 	int err;
872 
873 	BT_DBG("%s %p", hdev->name, hdev);
874 
875 	hci_req_sync_lock(hdev);
876 
877 	err = hci_set_powered_sync(hdev, false);
878 
879 	hci_req_sync_unlock(hdev);
880 
881 	return err;
882 }
883 
hci_rfkill_set_block(void * data,bool blocked)884 static int hci_rfkill_set_block(void *data, bool blocked)
885 {
886 	struct hci_dev *hdev = data;
887 	int err;
888 
889 	BT_DBG("%p name %s blocked %d", hdev, hdev->name, blocked);
890 
891 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
892 		return -EBUSY;
893 
894 	if (blocked == hci_dev_test_flag(hdev, HCI_RFKILLED))
895 		return 0;
896 
897 	if (blocked) {
898 		hci_dev_set_flag(hdev, HCI_RFKILLED);
899 
900 		if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
901 		    !hci_dev_test_flag(hdev, HCI_CONFIG)) {
902 			err = hci_dev_do_poweroff(hdev);
903 			if (err) {
904 				bt_dev_err(hdev, "Error when powering off device on rfkill (%d)",
905 					   err);
906 
907 				/* Make sure the device is still closed even if
908 				 * anything during power off sequence (eg.
909 				 * disconnecting devices) failed.
910 				 */
911 				hci_dev_do_close(hdev);
912 			}
913 		}
914 	} else {
915 		hci_dev_clear_flag(hdev, HCI_RFKILLED);
916 	}
917 
918 	return 0;
919 }
920 
921 static const struct rfkill_ops hci_rfkill_ops = {
922 	.set_block = hci_rfkill_set_block,
923 };
924 
hci_power_on(struct work_struct * work)925 static void hci_power_on(struct work_struct *work)
926 {
927 	struct hci_dev *hdev = container_of(work, struct hci_dev, power_on);
928 	int err;
929 
930 	BT_DBG("%s", hdev->name);
931 
932 	if (test_bit(HCI_UP, &hdev->flags) &&
933 	    hci_dev_test_flag(hdev, HCI_MGMT) &&
934 	    hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
935 		cancel_delayed_work(&hdev->power_off);
936 		err = hci_powered_update_sync(hdev);
937 		mgmt_power_on(hdev, err);
938 		return;
939 	}
940 
941 	err = hci_dev_do_open(hdev);
942 	if (err < 0) {
943 		hci_dev_lock(hdev);
944 		mgmt_set_powered_failed(hdev, err);
945 		hci_dev_unlock(hdev);
946 		return;
947 	}
948 
949 	/* During the HCI setup phase, a few error conditions are
950 	 * ignored and they need to be checked now. If they are still
951 	 * valid, it is important to turn the device back off.
952 	 */
953 	if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
954 	    hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
955 	    (!bacmp(&hdev->bdaddr, BDADDR_ANY) &&
956 	     !bacmp(&hdev->static_addr, BDADDR_ANY))) {
957 		hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
958 		hci_dev_do_close(hdev);
959 	} else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
960 		queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
961 				   HCI_AUTO_OFF_TIMEOUT);
962 	}
963 
964 	if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
965 		/* For unconfigured devices, set the HCI_RAW flag
966 		 * so that userspace can easily identify them.
967 		 */
968 		if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
969 			set_bit(HCI_RAW, &hdev->flags);
970 
971 		/* For fully configured devices, this will send
972 		 * the Index Added event. For unconfigured devices,
973 		 * it will send Unconfigued Index Added event.
974 		 *
975 		 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
976 		 * and no event will be send.
977 		 */
978 		mgmt_index_added(hdev);
979 	} else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
980 		/* When the controller is now configured, then it
981 		 * is important to clear the HCI_RAW flag.
982 		 */
983 		if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
984 			clear_bit(HCI_RAW, &hdev->flags);
985 
986 		/* Powering on the controller with HCI_CONFIG set only
987 		 * happens with the transition from unconfigured to
988 		 * configured. This will send the Index Added event.
989 		 */
990 		mgmt_index_added(hdev);
991 	}
992 }
993 
hci_power_off(struct work_struct * work)994 static void hci_power_off(struct work_struct *work)
995 {
996 	struct hci_dev *hdev = container_of(work, struct hci_dev,
997 					    power_off.work);
998 
999 	BT_DBG("%s", hdev->name);
1000 
1001 	hci_dev_do_close(hdev);
1002 }
1003 
hci_error_reset(struct work_struct * work)1004 static void hci_error_reset(struct work_struct *work)
1005 {
1006 	struct hci_dev *hdev = container_of(work, struct hci_dev, error_reset);
1007 
1008 	hci_dev_hold(hdev);
1009 	BT_DBG("%s", hdev->name);
1010 
1011 	if (hdev->hw_error)
1012 		hdev->hw_error(hdev, hdev->hw_error_code);
1013 	else
1014 		bt_dev_err(hdev, "hardware error 0x%2.2x", hdev->hw_error_code);
1015 
1016 	if (!hci_dev_do_close(hdev))
1017 		hci_dev_do_open(hdev);
1018 
1019 	hci_dev_put(hdev);
1020 }
1021 
hci_uuids_clear(struct hci_dev * hdev)1022 void hci_uuids_clear(struct hci_dev *hdev)
1023 {
1024 	struct bt_uuid *uuid, *tmp;
1025 
1026 	list_for_each_entry_safe(uuid, tmp, &hdev->uuids, list) {
1027 		list_del(&uuid->list);
1028 		kfree(uuid);
1029 	}
1030 }
1031 
hci_link_keys_clear(struct hci_dev * hdev)1032 void hci_link_keys_clear(struct hci_dev *hdev)
1033 {
1034 	struct link_key *key, *tmp;
1035 
1036 	list_for_each_entry_safe(key, tmp, &hdev->link_keys, list) {
1037 		list_del_rcu(&key->list);
1038 		kfree_rcu(key, rcu);
1039 	}
1040 }
1041 
hci_smp_ltks_clear(struct hci_dev * hdev)1042 void hci_smp_ltks_clear(struct hci_dev *hdev)
1043 {
1044 	struct smp_ltk *k, *tmp;
1045 
1046 	list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1047 		list_del_rcu(&k->list);
1048 		kfree_rcu(k, rcu);
1049 	}
1050 }
1051 
hci_smp_irks_clear(struct hci_dev * hdev)1052 void hci_smp_irks_clear(struct hci_dev *hdev)
1053 {
1054 	struct smp_irk *k, *tmp;
1055 
1056 	list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
1057 		list_del_rcu(&k->list);
1058 		kfree_rcu(k, rcu);
1059 	}
1060 }
1061 
hci_blocked_keys_clear(struct hci_dev * hdev)1062 void hci_blocked_keys_clear(struct hci_dev *hdev)
1063 {
1064 	struct blocked_key *b, *tmp;
1065 
1066 	list_for_each_entry_safe(b, tmp, &hdev->blocked_keys, list) {
1067 		list_del_rcu(&b->list);
1068 		kfree_rcu(b, rcu);
1069 	}
1070 }
1071 
hci_is_blocked_key(struct hci_dev * hdev,u8 type,u8 val[16])1072 bool hci_is_blocked_key(struct hci_dev *hdev, u8 type, u8 val[16])
1073 {
1074 	bool blocked = false;
1075 	struct blocked_key *b;
1076 
1077 	rcu_read_lock();
1078 	list_for_each_entry_rcu(b, &hdev->blocked_keys, list) {
1079 		if (b->type == type && !memcmp(b->val, val, sizeof(b->val))) {
1080 			blocked = true;
1081 			break;
1082 		}
1083 	}
1084 
1085 	rcu_read_unlock();
1086 	return blocked;
1087 }
1088 
hci_find_link_key(struct hci_dev * hdev,bdaddr_t * bdaddr)1089 struct link_key *hci_find_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1090 {
1091 	struct link_key *k;
1092 
1093 	rcu_read_lock();
1094 	list_for_each_entry_rcu(k, &hdev->link_keys, list) {
1095 		if (bacmp(bdaddr, &k->bdaddr) == 0) {
1096 			rcu_read_unlock();
1097 
1098 			if (hci_is_blocked_key(hdev,
1099 					       HCI_BLOCKED_KEY_TYPE_LINKKEY,
1100 					       k->val)) {
1101 				bt_dev_warn_ratelimited(hdev,
1102 							"Link key blocked for %pMR",
1103 							&k->bdaddr);
1104 				return NULL;
1105 			}
1106 
1107 			return k;
1108 		}
1109 	}
1110 	rcu_read_unlock();
1111 
1112 	return NULL;
1113 }
1114 
hci_persistent_key(struct hci_dev * hdev,struct hci_conn * conn,u8 key_type,u8 old_key_type)1115 static bool hci_persistent_key(struct hci_dev *hdev, struct hci_conn *conn,
1116 			       u8 key_type, u8 old_key_type)
1117 {
1118 	/* Legacy key */
1119 	if (key_type < 0x03)
1120 		return true;
1121 
1122 	/* Debug keys are insecure so don't store them persistently */
1123 	if (key_type == HCI_LK_DEBUG_COMBINATION)
1124 		return false;
1125 
1126 	/* Changed combination key and there's no previous one */
1127 	if (key_type == HCI_LK_CHANGED_COMBINATION && old_key_type == 0xff)
1128 		return false;
1129 
1130 	/* Security mode 3 case */
1131 	if (!conn)
1132 		return true;
1133 
1134 	/* BR/EDR key derived using SC from an LE link */
1135 	if (conn->type == LE_LINK)
1136 		return true;
1137 
1138 	/* Neither local nor remote side had no-bonding as requirement */
1139 	if (conn->auth_type > 0x01 && conn->remote_auth > 0x01)
1140 		return true;
1141 
1142 	/* Local side had dedicated bonding as requirement */
1143 	if (conn->auth_type == 0x02 || conn->auth_type == 0x03)
1144 		return true;
1145 
1146 	/* Remote side had dedicated bonding as requirement */
1147 	if (conn->remote_auth == 0x02 || conn->remote_auth == 0x03)
1148 		return true;
1149 
1150 	/* If none of the above criteria match, then don't store the key
1151 	 * persistently */
1152 	return false;
1153 }
1154 
ltk_role(u8 type)1155 static u8 ltk_role(u8 type)
1156 {
1157 	if (type == SMP_LTK)
1158 		return HCI_ROLE_MASTER;
1159 
1160 	return HCI_ROLE_SLAVE;
1161 }
1162 
hci_find_ltk(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,u8 role)1163 struct smp_ltk *hci_find_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1164 			     u8 addr_type, u8 role)
1165 {
1166 	struct smp_ltk *k;
1167 
1168 	rcu_read_lock();
1169 	list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
1170 		if (addr_type != k->bdaddr_type || bacmp(bdaddr, &k->bdaddr))
1171 			continue;
1172 
1173 		if (smp_ltk_is_sc(k) || ltk_role(k->type) == role) {
1174 			rcu_read_unlock();
1175 
1176 			if (hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_LTK,
1177 					       k->val)) {
1178 				bt_dev_warn_ratelimited(hdev,
1179 							"LTK blocked for %pMR",
1180 							&k->bdaddr);
1181 				return NULL;
1182 			}
1183 
1184 			return k;
1185 		}
1186 	}
1187 	rcu_read_unlock();
1188 
1189 	return NULL;
1190 }
1191 
hci_find_irk_by_rpa(struct hci_dev * hdev,bdaddr_t * rpa)1192 struct smp_irk *hci_find_irk_by_rpa(struct hci_dev *hdev, bdaddr_t *rpa)
1193 {
1194 	struct smp_irk *irk_to_return = NULL;
1195 	struct smp_irk *irk;
1196 
1197 	rcu_read_lock();
1198 	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
1199 		if (!bacmp(&irk->rpa, rpa)) {
1200 			irk_to_return = irk;
1201 			goto done;
1202 		}
1203 	}
1204 
1205 	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
1206 		if (smp_irk_matches(hdev, irk->val, rpa)) {
1207 			bacpy(&irk->rpa, rpa);
1208 			irk_to_return = irk;
1209 			goto done;
1210 		}
1211 	}
1212 
1213 done:
1214 	if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1215 						irk_to_return->val)) {
1216 		bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1217 					&irk_to_return->bdaddr);
1218 		irk_to_return = NULL;
1219 	}
1220 
1221 	rcu_read_unlock();
1222 
1223 	return irk_to_return;
1224 }
1225 
hci_find_irk_by_addr(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type)1226 struct smp_irk *hci_find_irk_by_addr(struct hci_dev *hdev, bdaddr_t *bdaddr,
1227 				     u8 addr_type)
1228 {
1229 	struct smp_irk *irk_to_return = NULL;
1230 	struct smp_irk *irk;
1231 
1232 	/* Identity Address must be public or static random */
1233 	if (addr_type == ADDR_LE_DEV_RANDOM && (bdaddr->b[5] & 0xc0) != 0xc0)
1234 		return NULL;
1235 
1236 	rcu_read_lock();
1237 	list_for_each_entry_rcu(irk, &hdev->identity_resolving_keys, list) {
1238 		if (addr_type == irk->addr_type &&
1239 		    bacmp(bdaddr, &irk->bdaddr) == 0) {
1240 			irk_to_return = irk;
1241 			goto done;
1242 		}
1243 	}
1244 
1245 done:
1246 
1247 	if (irk_to_return && hci_is_blocked_key(hdev, HCI_BLOCKED_KEY_TYPE_IRK,
1248 						irk_to_return->val)) {
1249 		bt_dev_warn_ratelimited(hdev, "Identity key blocked for %pMR",
1250 					&irk_to_return->bdaddr);
1251 		irk_to_return = NULL;
1252 	}
1253 
1254 	rcu_read_unlock();
1255 
1256 	return irk_to_return;
1257 }
1258 
hci_add_link_key(struct hci_dev * hdev,struct hci_conn * conn,bdaddr_t * bdaddr,u8 * val,u8 type,u8 pin_len,bool * persistent)1259 struct link_key *hci_add_link_key(struct hci_dev *hdev, struct hci_conn *conn,
1260 				  bdaddr_t *bdaddr, u8 *val, u8 type,
1261 				  u8 pin_len, bool *persistent)
1262 {
1263 	struct link_key *key, *old_key;
1264 	u8 old_key_type;
1265 
1266 	old_key = hci_find_link_key(hdev, bdaddr);
1267 	if (old_key) {
1268 		old_key_type = old_key->type;
1269 		key = old_key;
1270 	} else {
1271 		old_key_type = conn ? conn->key_type : 0xff;
1272 		key = kzalloc(sizeof(*key), GFP_KERNEL);
1273 		if (!key)
1274 			return NULL;
1275 		list_add_rcu(&key->list, &hdev->link_keys);
1276 	}
1277 
1278 	BT_DBG("%s key for %pMR type %u", hdev->name, bdaddr, type);
1279 
1280 	/* Some buggy controller combinations generate a changed
1281 	 * combination key for legacy pairing even when there's no
1282 	 * previous key */
1283 	if (type == HCI_LK_CHANGED_COMBINATION &&
1284 	    (!conn || conn->remote_auth == 0xff) && old_key_type == 0xff) {
1285 		type = HCI_LK_COMBINATION;
1286 		if (conn)
1287 			conn->key_type = type;
1288 	}
1289 
1290 	bacpy(&key->bdaddr, bdaddr);
1291 	memcpy(key->val, val, HCI_LINK_KEY_SIZE);
1292 	key->pin_len = pin_len;
1293 
1294 	if (type == HCI_LK_CHANGED_COMBINATION)
1295 		key->type = old_key_type;
1296 	else
1297 		key->type = type;
1298 
1299 	if (persistent)
1300 		*persistent = hci_persistent_key(hdev, conn, type,
1301 						 old_key_type);
1302 
1303 	return key;
1304 }
1305 
hci_add_ltk(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,u8 type,u8 authenticated,u8 tk[16],u8 enc_size,__le16 ediv,__le64 rand)1306 struct smp_ltk *hci_add_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1307 			    u8 addr_type, u8 type, u8 authenticated,
1308 			    u8 tk[16], u8 enc_size, __le16 ediv, __le64 rand)
1309 {
1310 	struct smp_ltk *key, *old_key;
1311 	u8 role = ltk_role(type);
1312 
1313 	old_key = hci_find_ltk(hdev, bdaddr, addr_type, role);
1314 	if (old_key)
1315 		key = old_key;
1316 	else {
1317 		key = kzalloc(sizeof(*key), GFP_KERNEL);
1318 		if (!key)
1319 			return NULL;
1320 		list_add_rcu(&key->list, &hdev->long_term_keys);
1321 	}
1322 
1323 	bacpy(&key->bdaddr, bdaddr);
1324 	key->bdaddr_type = addr_type;
1325 	memcpy(key->val, tk, sizeof(key->val));
1326 	key->authenticated = authenticated;
1327 	key->ediv = ediv;
1328 	key->rand = rand;
1329 	key->enc_size = enc_size;
1330 	key->type = type;
1331 
1332 	return key;
1333 }
1334 
hci_add_irk(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type,u8 val[16],bdaddr_t * rpa)1335 struct smp_irk *hci_add_irk(struct hci_dev *hdev, bdaddr_t *bdaddr,
1336 			    u8 addr_type, u8 val[16], bdaddr_t *rpa)
1337 {
1338 	struct smp_irk *irk;
1339 
1340 	irk = hci_find_irk_by_addr(hdev, bdaddr, addr_type);
1341 	if (!irk) {
1342 		irk = kzalloc(sizeof(*irk), GFP_KERNEL);
1343 		if (!irk)
1344 			return NULL;
1345 
1346 		bacpy(&irk->bdaddr, bdaddr);
1347 		irk->addr_type = addr_type;
1348 
1349 		list_add_rcu(&irk->list, &hdev->identity_resolving_keys);
1350 	}
1351 
1352 	memcpy(irk->val, val, 16);
1353 	bacpy(&irk->rpa, rpa);
1354 
1355 	return irk;
1356 }
1357 
hci_remove_link_key(struct hci_dev * hdev,bdaddr_t * bdaddr)1358 int hci_remove_link_key(struct hci_dev *hdev, bdaddr_t *bdaddr)
1359 {
1360 	struct link_key *key;
1361 
1362 	key = hci_find_link_key(hdev, bdaddr);
1363 	if (!key)
1364 		return -ENOENT;
1365 
1366 	BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1367 
1368 	list_del_rcu(&key->list);
1369 	kfree_rcu(key, rcu);
1370 
1371 	return 0;
1372 }
1373 
hci_remove_ltk(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type)1374 int hci_remove_ltk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 bdaddr_type)
1375 {
1376 	struct smp_ltk *k, *tmp;
1377 	int removed = 0;
1378 
1379 	list_for_each_entry_safe(k, tmp, &hdev->long_term_keys, list) {
1380 		if (bacmp(bdaddr, &k->bdaddr) || k->bdaddr_type != bdaddr_type)
1381 			continue;
1382 
1383 		BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1384 
1385 		list_del_rcu(&k->list);
1386 		kfree_rcu(k, rcu);
1387 		removed++;
1388 	}
1389 
1390 	return removed ? 0 : -ENOENT;
1391 }
1392 
hci_remove_irk(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 addr_type)1393 void hci_remove_irk(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 addr_type)
1394 {
1395 	struct smp_irk *k, *tmp;
1396 
1397 	list_for_each_entry_safe(k, tmp, &hdev->identity_resolving_keys, list) {
1398 		if (bacmp(bdaddr, &k->bdaddr) || k->addr_type != addr_type)
1399 			continue;
1400 
1401 		BT_DBG("%s removing %pMR", hdev->name, bdaddr);
1402 
1403 		list_del_rcu(&k->list);
1404 		kfree_rcu(k, rcu);
1405 	}
1406 }
1407 
hci_bdaddr_is_paired(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 type)1408 bool hci_bdaddr_is_paired(struct hci_dev *hdev, bdaddr_t *bdaddr, u8 type)
1409 {
1410 	struct smp_ltk *k;
1411 	struct smp_irk *irk;
1412 	u8 addr_type;
1413 
1414 	if (type == BDADDR_BREDR) {
1415 		if (hci_find_link_key(hdev, bdaddr))
1416 			return true;
1417 		return false;
1418 	}
1419 
1420 	/* Convert to HCI addr type which struct smp_ltk uses */
1421 	if (type == BDADDR_LE_PUBLIC)
1422 		addr_type = ADDR_LE_DEV_PUBLIC;
1423 	else
1424 		addr_type = ADDR_LE_DEV_RANDOM;
1425 
1426 	irk = hci_get_irk(hdev, bdaddr, addr_type);
1427 	if (irk) {
1428 		bdaddr = &irk->bdaddr;
1429 		addr_type = irk->addr_type;
1430 	}
1431 
1432 	rcu_read_lock();
1433 	list_for_each_entry_rcu(k, &hdev->long_term_keys, list) {
1434 		if (k->bdaddr_type == addr_type && !bacmp(bdaddr, &k->bdaddr)) {
1435 			rcu_read_unlock();
1436 			return true;
1437 		}
1438 	}
1439 	rcu_read_unlock();
1440 
1441 	return false;
1442 }
1443 
1444 /* HCI command timer function */
hci_cmd_timeout(struct work_struct * work)1445 static void hci_cmd_timeout(struct work_struct *work)
1446 {
1447 	struct hci_dev *hdev = container_of(work, struct hci_dev,
1448 					    cmd_timer.work);
1449 
1450 	if (hdev->req_skb) {
1451 		u16 opcode = hci_skb_opcode(hdev->req_skb);
1452 
1453 		bt_dev_err(hdev, "command 0x%4.4x tx timeout", opcode);
1454 
1455 		hci_cmd_sync_cancel_sync(hdev, ETIMEDOUT);
1456 	} else {
1457 		bt_dev_err(hdev, "command tx timeout");
1458 	}
1459 
1460 	if (hdev->reset)
1461 		hdev->reset(hdev);
1462 
1463 	atomic_set(&hdev->cmd_cnt, 1);
1464 	queue_work(hdev->workqueue, &hdev->cmd_work);
1465 }
1466 
1467 /* HCI ncmd timer function */
hci_ncmd_timeout(struct work_struct * work)1468 static void hci_ncmd_timeout(struct work_struct *work)
1469 {
1470 	struct hci_dev *hdev = container_of(work, struct hci_dev,
1471 					    ncmd_timer.work);
1472 
1473 	bt_dev_err(hdev, "Controller not accepting commands anymore: ncmd = 0");
1474 
1475 	/* During HCI_INIT phase no events can be injected if the ncmd timer
1476 	 * triggers since the procedure has its own timeout handling.
1477 	 */
1478 	if (test_bit(HCI_INIT, &hdev->flags))
1479 		return;
1480 
1481 	/* This is an irrecoverable state, inject hardware error event */
1482 	hci_reset_dev(hdev);
1483 }
1484 
hci_find_remote_oob_data(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type)1485 struct oob_data *hci_find_remote_oob_data(struct hci_dev *hdev,
1486 					  bdaddr_t *bdaddr, u8 bdaddr_type)
1487 {
1488 	struct oob_data *data;
1489 
1490 	list_for_each_entry(data, &hdev->remote_oob_data, list) {
1491 		if (bacmp(bdaddr, &data->bdaddr) != 0)
1492 			continue;
1493 		if (data->bdaddr_type != bdaddr_type)
1494 			continue;
1495 		return data;
1496 	}
1497 
1498 	return NULL;
1499 }
1500 
hci_remove_remote_oob_data(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type)1501 int hci_remove_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
1502 			       u8 bdaddr_type)
1503 {
1504 	struct oob_data *data;
1505 
1506 	data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
1507 	if (!data)
1508 		return -ENOENT;
1509 
1510 	BT_DBG("%s removing %pMR (%u)", hdev->name, bdaddr, bdaddr_type);
1511 
1512 	list_del(&data->list);
1513 	kfree(data);
1514 
1515 	return 0;
1516 }
1517 
hci_remote_oob_data_clear(struct hci_dev * hdev)1518 void hci_remote_oob_data_clear(struct hci_dev *hdev)
1519 {
1520 	struct oob_data *data, *n;
1521 
1522 	list_for_each_entry_safe(data, n, &hdev->remote_oob_data, list) {
1523 		list_del(&data->list);
1524 		kfree(data);
1525 	}
1526 }
1527 
hci_add_remote_oob_data(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type,u8 * hash192,u8 * rand192,u8 * hash256,u8 * rand256)1528 int hci_add_remote_oob_data(struct hci_dev *hdev, bdaddr_t *bdaddr,
1529 			    u8 bdaddr_type, u8 *hash192, u8 *rand192,
1530 			    u8 *hash256, u8 *rand256)
1531 {
1532 	struct oob_data *data;
1533 
1534 	data = hci_find_remote_oob_data(hdev, bdaddr, bdaddr_type);
1535 	if (!data) {
1536 		data = kmalloc(sizeof(*data), GFP_KERNEL);
1537 		if (!data)
1538 			return -ENOMEM;
1539 
1540 		bacpy(&data->bdaddr, bdaddr);
1541 		data->bdaddr_type = bdaddr_type;
1542 		list_add(&data->list, &hdev->remote_oob_data);
1543 	}
1544 
1545 	if (hash192 && rand192) {
1546 		memcpy(data->hash192, hash192, sizeof(data->hash192));
1547 		memcpy(data->rand192, rand192, sizeof(data->rand192));
1548 		if (hash256 && rand256)
1549 			data->present = 0x03;
1550 	} else {
1551 		memset(data->hash192, 0, sizeof(data->hash192));
1552 		memset(data->rand192, 0, sizeof(data->rand192));
1553 		if (hash256 && rand256)
1554 			data->present = 0x02;
1555 		else
1556 			data->present = 0x00;
1557 	}
1558 
1559 	if (hash256 && rand256) {
1560 		memcpy(data->hash256, hash256, sizeof(data->hash256));
1561 		memcpy(data->rand256, rand256, sizeof(data->rand256));
1562 	} else {
1563 		memset(data->hash256, 0, sizeof(data->hash256));
1564 		memset(data->rand256, 0, sizeof(data->rand256));
1565 		if (hash192 && rand192)
1566 			data->present = 0x01;
1567 	}
1568 
1569 	BT_DBG("%s for %pMR", hdev->name, bdaddr);
1570 
1571 	return 0;
1572 }
1573 
1574 /* This function requires the caller holds hdev->lock */
hci_find_adv_instance(struct hci_dev * hdev,u8 instance)1575 struct adv_info *hci_find_adv_instance(struct hci_dev *hdev, u8 instance)
1576 {
1577 	struct adv_info *adv_instance;
1578 
1579 	list_for_each_entry(adv_instance, &hdev->adv_instances, list) {
1580 		if (adv_instance->instance == instance)
1581 			return adv_instance;
1582 	}
1583 
1584 	return NULL;
1585 }
1586 
1587 /* This function requires the caller holds hdev->lock */
hci_get_next_instance(struct hci_dev * hdev,u8 instance)1588 struct adv_info *hci_get_next_instance(struct hci_dev *hdev, u8 instance)
1589 {
1590 	struct adv_info *cur_instance;
1591 
1592 	cur_instance = hci_find_adv_instance(hdev, instance);
1593 	if (!cur_instance)
1594 		return NULL;
1595 
1596 	if (cur_instance == list_last_entry(&hdev->adv_instances,
1597 					    struct adv_info, list))
1598 		return list_first_entry(&hdev->adv_instances,
1599 						 struct adv_info, list);
1600 	else
1601 		return list_next_entry(cur_instance, list);
1602 }
1603 
1604 /* This function requires the caller holds hdev->lock */
hci_remove_adv_instance(struct hci_dev * hdev,u8 instance)1605 int hci_remove_adv_instance(struct hci_dev *hdev, u8 instance)
1606 {
1607 	struct adv_info *adv_instance;
1608 
1609 	adv_instance = hci_find_adv_instance(hdev, instance);
1610 	if (!adv_instance)
1611 		return -ENOENT;
1612 
1613 	BT_DBG("%s removing %dMR", hdev->name, instance);
1614 
1615 	if (hdev->cur_adv_instance == instance) {
1616 		if (hdev->adv_instance_timeout) {
1617 			cancel_delayed_work(&hdev->adv_instance_expire);
1618 			hdev->adv_instance_timeout = 0;
1619 		}
1620 		hdev->cur_adv_instance = 0x00;
1621 	}
1622 
1623 	cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
1624 
1625 	list_del(&adv_instance->list);
1626 	kfree(adv_instance);
1627 
1628 	hdev->adv_instance_cnt--;
1629 
1630 	return 0;
1631 }
1632 
hci_adv_instances_set_rpa_expired(struct hci_dev * hdev,bool rpa_expired)1633 void hci_adv_instances_set_rpa_expired(struct hci_dev *hdev, bool rpa_expired)
1634 {
1635 	struct adv_info *adv_instance, *n;
1636 
1637 	list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list)
1638 		adv_instance->rpa_expired = rpa_expired;
1639 }
1640 
1641 /* This function requires the caller holds hdev->lock */
hci_adv_instances_clear(struct hci_dev * hdev)1642 void hci_adv_instances_clear(struct hci_dev *hdev)
1643 {
1644 	struct adv_info *adv_instance, *n;
1645 
1646 	if (hdev->adv_instance_timeout) {
1647 		disable_delayed_work(&hdev->adv_instance_expire);
1648 		hdev->adv_instance_timeout = 0;
1649 	}
1650 
1651 	list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, list) {
1652 		disable_delayed_work_sync(&adv_instance->rpa_expired_cb);
1653 		list_del(&adv_instance->list);
1654 		kfree(adv_instance);
1655 	}
1656 
1657 	hdev->adv_instance_cnt = 0;
1658 	hdev->cur_adv_instance = 0x00;
1659 }
1660 
adv_instance_rpa_expired(struct work_struct * work)1661 static void adv_instance_rpa_expired(struct work_struct *work)
1662 {
1663 	struct adv_info *adv_instance = container_of(work, struct adv_info,
1664 						     rpa_expired_cb.work);
1665 
1666 	BT_DBG("");
1667 
1668 	adv_instance->rpa_expired = true;
1669 }
1670 
1671 /* This function requires the caller holds hdev->lock */
hci_add_adv_instance(struct hci_dev * hdev,u8 instance,u32 flags,u16 adv_data_len,u8 * adv_data,u16 scan_rsp_len,u8 * scan_rsp_data,u16 timeout,u16 duration,s8 tx_power,u32 min_interval,u32 max_interval,u8 mesh_handle)1672 struct adv_info *hci_add_adv_instance(struct hci_dev *hdev, u8 instance,
1673 				      u32 flags, u16 adv_data_len, u8 *adv_data,
1674 				      u16 scan_rsp_len, u8 *scan_rsp_data,
1675 				      u16 timeout, u16 duration, s8 tx_power,
1676 				      u32 min_interval, u32 max_interval,
1677 				      u8 mesh_handle)
1678 {
1679 	struct adv_info *adv;
1680 
1681 	adv = hci_find_adv_instance(hdev, instance);
1682 	if (adv) {
1683 		memset(adv->adv_data, 0, sizeof(adv->adv_data));
1684 		memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1685 		memset(adv->per_adv_data, 0, sizeof(adv->per_adv_data));
1686 	} else {
1687 		if (hdev->adv_instance_cnt >= hdev->le_num_of_adv_sets ||
1688 		    instance < 1 || instance > hdev->le_num_of_adv_sets + 1)
1689 			return ERR_PTR(-EOVERFLOW);
1690 
1691 		adv = kzalloc(sizeof(*adv), GFP_KERNEL);
1692 		if (!adv)
1693 			return ERR_PTR(-ENOMEM);
1694 
1695 		adv->pending = true;
1696 		adv->instance = instance;
1697 
1698 		/* If controller support only one set and the instance is set to
1699 		 * 1 then there is no option other than using handle 0x00.
1700 		 */
1701 		if (hdev->le_num_of_adv_sets == 1 && instance == 1)
1702 			adv->handle = 0x00;
1703 		else
1704 			adv->handle = instance;
1705 
1706 		list_add(&adv->list, &hdev->adv_instances);
1707 		hdev->adv_instance_cnt++;
1708 	}
1709 
1710 	adv->flags = flags;
1711 	adv->min_interval = min_interval;
1712 	adv->max_interval = max_interval;
1713 	adv->tx_power = tx_power;
1714 	/* Defining a mesh_handle changes the timing units to ms,
1715 	 * rather than seconds, and ties the instance to the requested
1716 	 * mesh_tx queue.
1717 	 */
1718 	adv->mesh = mesh_handle;
1719 
1720 	hci_set_adv_instance_data(hdev, instance, adv_data_len, adv_data,
1721 				  scan_rsp_len, scan_rsp_data);
1722 
1723 	adv->timeout = timeout;
1724 	adv->remaining_time = timeout;
1725 
1726 	if (duration == 0)
1727 		adv->duration = hdev->def_multi_adv_rotation_duration;
1728 	else
1729 		adv->duration = duration;
1730 
1731 	INIT_DELAYED_WORK(&adv->rpa_expired_cb, adv_instance_rpa_expired);
1732 
1733 	BT_DBG("%s for %dMR", hdev->name, instance);
1734 
1735 	return adv;
1736 }
1737 
1738 /* This function requires the caller holds hdev->lock */
hci_add_per_instance(struct hci_dev * hdev,u8 instance,u32 flags,u8 data_len,u8 * data,u32 min_interval,u32 max_interval)1739 struct adv_info *hci_add_per_instance(struct hci_dev *hdev, u8 instance,
1740 				      u32 flags, u8 data_len, u8 *data,
1741 				      u32 min_interval, u32 max_interval)
1742 {
1743 	struct adv_info *adv;
1744 
1745 	adv = hci_add_adv_instance(hdev, instance, flags, 0, NULL, 0, NULL,
1746 				   0, 0, HCI_ADV_TX_POWER_NO_PREFERENCE,
1747 				   min_interval, max_interval, 0);
1748 	if (IS_ERR(adv))
1749 		return adv;
1750 
1751 	adv->periodic = true;
1752 	adv->per_adv_data_len = data_len;
1753 
1754 	if (data)
1755 		memcpy(adv->per_adv_data, data, data_len);
1756 
1757 	return adv;
1758 }
1759 
1760 /* This function requires the caller holds hdev->lock */
hci_set_adv_instance_data(struct hci_dev * hdev,u8 instance,u16 adv_data_len,u8 * adv_data,u16 scan_rsp_len,u8 * scan_rsp_data)1761 int hci_set_adv_instance_data(struct hci_dev *hdev, u8 instance,
1762 			      u16 adv_data_len, u8 *adv_data,
1763 			      u16 scan_rsp_len, u8 *scan_rsp_data)
1764 {
1765 	struct adv_info *adv;
1766 
1767 	adv = hci_find_adv_instance(hdev, instance);
1768 
1769 	/* If advertisement doesn't exist, we can't modify its data */
1770 	if (!adv)
1771 		return -ENOENT;
1772 
1773 	if (adv_data_len && ADV_DATA_CMP(adv, adv_data, adv_data_len)) {
1774 		memset(adv->adv_data, 0, sizeof(adv->adv_data));
1775 		memcpy(adv->adv_data, adv_data, adv_data_len);
1776 		adv->adv_data_len = adv_data_len;
1777 		adv->adv_data_changed = true;
1778 	}
1779 
1780 	if (scan_rsp_len && SCAN_RSP_CMP(adv, scan_rsp_data, scan_rsp_len)) {
1781 		memset(adv->scan_rsp_data, 0, sizeof(adv->scan_rsp_data));
1782 		memcpy(adv->scan_rsp_data, scan_rsp_data, scan_rsp_len);
1783 		adv->scan_rsp_len = scan_rsp_len;
1784 		adv->scan_rsp_changed = true;
1785 	}
1786 
1787 	/* Mark as changed if there are flags which would affect it */
1788 	if (((adv->flags & MGMT_ADV_FLAG_APPEARANCE) && hdev->appearance) ||
1789 	    adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1790 		adv->scan_rsp_changed = true;
1791 
1792 	return 0;
1793 }
1794 
1795 /* This function requires the caller holds hdev->lock */
hci_adv_instance_flags(struct hci_dev * hdev,u8 instance)1796 u32 hci_adv_instance_flags(struct hci_dev *hdev, u8 instance)
1797 {
1798 	u32 flags;
1799 	struct adv_info *adv;
1800 
1801 	if (instance == 0x00) {
1802 		/* Instance 0 always manages the "Tx Power" and "Flags"
1803 		 * fields
1804 		 */
1805 		flags = MGMT_ADV_FLAG_TX_POWER | MGMT_ADV_FLAG_MANAGED_FLAGS;
1806 
1807 		/* For instance 0, the HCI_ADVERTISING_CONNECTABLE setting
1808 		 * corresponds to the "connectable" instance flag.
1809 		 */
1810 		if (hci_dev_test_flag(hdev, HCI_ADVERTISING_CONNECTABLE))
1811 			flags |= MGMT_ADV_FLAG_CONNECTABLE;
1812 
1813 		if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
1814 			flags |= MGMT_ADV_FLAG_LIMITED_DISCOV;
1815 		else if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
1816 			flags |= MGMT_ADV_FLAG_DISCOV;
1817 
1818 		return flags;
1819 	}
1820 
1821 	adv = hci_find_adv_instance(hdev, instance);
1822 
1823 	/* Return 0 when we got an invalid instance identifier. */
1824 	if (!adv)
1825 		return 0;
1826 
1827 	return adv->flags;
1828 }
1829 
hci_adv_instance_is_scannable(struct hci_dev * hdev,u8 instance)1830 bool hci_adv_instance_is_scannable(struct hci_dev *hdev, u8 instance)
1831 {
1832 	struct adv_info *adv;
1833 
1834 	/* Instance 0x00 always set local name */
1835 	if (instance == 0x00)
1836 		return true;
1837 
1838 	adv = hci_find_adv_instance(hdev, instance);
1839 	if (!adv)
1840 		return false;
1841 
1842 	if (adv->flags & MGMT_ADV_FLAG_APPEARANCE ||
1843 	    adv->flags & MGMT_ADV_FLAG_LOCAL_NAME)
1844 		return true;
1845 
1846 	return adv->scan_rsp_len ? true : false;
1847 }
1848 
1849 /* This function requires the caller holds hdev->lock */
hci_adv_monitors_clear(struct hci_dev * hdev)1850 void hci_adv_monitors_clear(struct hci_dev *hdev)
1851 {
1852 	struct adv_monitor *monitor;
1853 	int handle;
1854 
1855 	idr_for_each_entry(&hdev->adv_monitors_idr, monitor, handle)
1856 		hci_free_adv_monitor(hdev, monitor);
1857 
1858 	idr_destroy(&hdev->adv_monitors_idr);
1859 }
1860 
1861 /* Frees the monitor structure and do some bookkeepings.
1862  * This function requires the caller holds hdev->lock.
1863  */
hci_free_adv_monitor(struct hci_dev * hdev,struct adv_monitor * monitor)1864 void hci_free_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
1865 {
1866 	struct adv_pattern *pattern;
1867 	struct adv_pattern *tmp;
1868 
1869 	if (!monitor)
1870 		return;
1871 
1872 	list_for_each_entry_safe(pattern, tmp, &monitor->patterns, list) {
1873 		list_del(&pattern->list);
1874 		kfree(pattern);
1875 	}
1876 
1877 	if (monitor->handle)
1878 		idr_remove(&hdev->adv_monitors_idr, monitor->handle);
1879 
1880 	if (monitor->state != ADV_MONITOR_STATE_NOT_REGISTERED) {
1881 		hdev->adv_monitors_cnt--;
1882 		mgmt_adv_monitor_removed(hdev, monitor->handle);
1883 	}
1884 
1885 	kfree(monitor);
1886 }
1887 
1888 /* Assigns handle to a monitor, and if offloading is supported and power is on,
1889  * also attempts to forward the request to the controller.
1890  * This function requires the caller holds hci_req_sync_lock.
1891  */
hci_add_adv_monitor(struct hci_dev * hdev,struct adv_monitor * monitor)1892 int hci_add_adv_monitor(struct hci_dev *hdev, struct adv_monitor *monitor)
1893 {
1894 	int min, max, handle;
1895 	int status = 0;
1896 
1897 	if (!monitor)
1898 		return -EINVAL;
1899 
1900 	hci_dev_lock(hdev);
1901 
1902 	min = HCI_MIN_ADV_MONITOR_HANDLE;
1903 	max = HCI_MIN_ADV_MONITOR_HANDLE + HCI_MAX_ADV_MONITOR_NUM_HANDLES;
1904 	handle = idr_alloc(&hdev->adv_monitors_idr, monitor, min, max,
1905 			   GFP_KERNEL);
1906 
1907 	hci_dev_unlock(hdev);
1908 
1909 	if (handle < 0)
1910 		return handle;
1911 
1912 	monitor->handle = handle;
1913 
1914 	if (!hdev_is_powered(hdev))
1915 		return status;
1916 
1917 	switch (hci_get_adv_monitor_offload_ext(hdev)) {
1918 	case HCI_ADV_MONITOR_EXT_NONE:
1919 		bt_dev_dbg(hdev, "add monitor %d status %d",
1920 			   monitor->handle, status);
1921 		/* Message was not forwarded to controller - not an error */
1922 		break;
1923 
1924 	case HCI_ADV_MONITOR_EXT_MSFT:
1925 		status = msft_add_monitor_pattern(hdev, monitor);
1926 		bt_dev_dbg(hdev, "add monitor %d msft status %d",
1927 			   handle, status);
1928 		break;
1929 	}
1930 
1931 	return status;
1932 }
1933 
1934 /* Attempts to tell the controller and free the monitor. If somehow the
1935  * controller doesn't have a corresponding handle, remove anyway.
1936  * This function requires the caller holds hci_req_sync_lock.
1937  */
hci_remove_adv_monitor(struct hci_dev * hdev,struct adv_monitor * monitor)1938 static int hci_remove_adv_monitor(struct hci_dev *hdev,
1939 				  struct adv_monitor *monitor)
1940 {
1941 	int status = 0;
1942 	int handle;
1943 
1944 	switch (hci_get_adv_monitor_offload_ext(hdev)) {
1945 	case HCI_ADV_MONITOR_EXT_NONE: /* also goes here when powered off */
1946 		bt_dev_dbg(hdev, "remove monitor %d status %d",
1947 			   monitor->handle, status);
1948 		goto free_monitor;
1949 
1950 	case HCI_ADV_MONITOR_EXT_MSFT:
1951 		handle = monitor->handle;
1952 		status = msft_remove_monitor(hdev, monitor);
1953 		bt_dev_dbg(hdev, "remove monitor %d msft status %d",
1954 			   handle, status);
1955 		break;
1956 	}
1957 
1958 	/* In case no matching handle registered, just free the monitor */
1959 	if (status == -ENOENT)
1960 		goto free_monitor;
1961 
1962 	return status;
1963 
1964 free_monitor:
1965 	if (status == -ENOENT)
1966 		bt_dev_warn(hdev, "Removing monitor with no matching handle %d",
1967 			    monitor->handle);
1968 	hci_free_adv_monitor(hdev, monitor);
1969 
1970 	return status;
1971 }
1972 
1973 /* This function requires the caller holds hci_req_sync_lock */
hci_remove_single_adv_monitor(struct hci_dev * hdev,u16 handle)1974 int hci_remove_single_adv_monitor(struct hci_dev *hdev, u16 handle)
1975 {
1976 	struct adv_monitor *monitor = idr_find(&hdev->adv_monitors_idr, handle);
1977 
1978 	if (!monitor)
1979 		return -EINVAL;
1980 
1981 	return hci_remove_adv_monitor(hdev, monitor);
1982 }
1983 
1984 /* This function requires the caller holds hci_req_sync_lock */
hci_remove_all_adv_monitor(struct hci_dev * hdev)1985 int hci_remove_all_adv_monitor(struct hci_dev *hdev)
1986 {
1987 	struct adv_monitor *monitor;
1988 	int idr_next_id = 0;
1989 	int status = 0;
1990 
1991 	while (1) {
1992 		monitor = idr_get_next(&hdev->adv_monitors_idr, &idr_next_id);
1993 		if (!monitor)
1994 			break;
1995 
1996 		status = hci_remove_adv_monitor(hdev, monitor);
1997 		if (status)
1998 			return status;
1999 
2000 		idr_next_id++;
2001 	}
2002 
2003 	return status;
2004 }
2005 
2006 /* This function requires the caller holds hdev->lock */
hci_is_adv_monitoring(struct hci_dev * hdev)2007 bool hci_is_adv_monitoring(struct hci_dev *hdev)
2008 {
2009 	return !idr_is_empty(&hdev->adv_monitors_idr);
2010 }
2011 
hci_get_adv_monitor_offload_ext(struct hci_dev * hdev)2012 int hci_get_adv_monitor_offload_ext(struct hci_dev *hdev)
2013 {
2014 	if (msft_monitor_supported(hdev))
2015 		return HCI_ADV_MONITOR_EXT_MSFT;
2016 
2017 	return HCI_ADV_MONITOR_EXT_NONE;
2018 }
2019 
hci_bdaddr_list_lookup(struct list_head * bdaddr_list,bdaddr_t * bdaddr,u8 type)2020 struct bdaddr_list *hci_bdaddr_list_lookup(struct list_head *bdaddr_list,
2021 					 bdaddr_t *bdaddr, u8 type)
2022 {
2023 	struct bdaddr_list *b;
2024 
2025 	list_for_each_entry(b, bdaddr_list, list) {
2026 		if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2027 			return b;
2028 	}
2029 
2030 	return NULL;
2031 }
2032 
hci_bdaddr_list_lookup_with_irk(struct list_head * bdaddr_list,bdaddr_t * bdaddr,u8 type)2033 struct bdaddr_list_with_irk *hci_bdaddr_list_lookup_with_irk(
2034 				struct list_head *bdaddr_list, bdaddr_t *bdaddr,
2035 				u8 type)
2036 {
2037 	struct bdaddr_list_with_irk *b;
2038 
2039 	list_for_each_entry(b, bdaddr_list, list) {
2040 		if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2041 			return b;
2042 	}
2043 
2044 	return NULL;
2045 }
2046 
2047 struct bdaddr_list_with_flags *
hci_bdaddr_list_lookup_with_flags(struct list_head * bdaddr_list,bdaddr_t * bdaddr,u8 type)2048 hci_bdaddr_list_lookup_with_flags(struct list_head *bdaddr_list,
2049 				  bdaddr_t *bdaddr, u8 type)
2050 {
2051 	struct bdaddr_list_with_flags *b;
2052 
2053 	list_for_each_entry(b, bdaddr_list, list) {
2054 		if (!bacmp(&b->bdaddr, bdaddr) && b->bdaddr_type == type)
2055 			return b;
2056 	}
2057 
2058 	return NULL;
2059 }
2060 
hci_bdaddr_list_clear(struct list_head * bdaddr_list)2061 void hci_bdaddr_list_clear(struct list_head *bdaddr_list)
2062 {
2063 	struct bdaddr_list *b, *n;
2064 
2065 	list_for_each_entry_safe(b, n, bdaddr_list, list) {
2066 		list_del(&b->list);
2067 		kfree(b);
2068 	}
2069 }
2070 
hci_bdaddr_list_add(struct list_head * list,bdaddr_t * bdaddr,u8 type)2071 int hci_bdaddr_list_add(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2072 {
2073 	struct bdaddr_list *entry;
2074 
2075 	if (!bacmp(bdaddr, BDADDR_ANY))
2076 		return -EBADF;
2077 
2078 	if (hci_bdaddr_list_lookup(list, bdaddr, type))
2079 		return -EEXIST;
2080 
2081 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2082 	if (!entry)
2083 		return -ENOMEM;
2084 
2085 	bacpy(&entry->bdaddr, bdaddr);
2086 	entry->bdaddr_type = type;
2087 
2088 	list_add(&entry->list, list);
2089 
2090 	return 0;
2091 }
2092 
hci_bdaddr_list_add_with_irk(struct list_head * list,bdaddr_t * bdaddr,u8 type,u8 * peer_irk,u8 * local_irk)2093 int hci_bdaddr_list_add_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2094 					u8 type, u8 *peer_irk, u8 *local_irk)
2095 {
2096 	struct bdaddr_list_with_irk *entry;
2097 
2098 	if (!bacmp(bdaddr, BDADDR_ANY))
2099 		return -EBADF;
2100 
2101 	if (hci_bdaddr_list_lookup(list, bdaddr, type))
2102 		return -EEXIST;
2103 
2104 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2105 	if (!entry)
2106 		return -ENOMEM;
2107 
2108 	bacpy(&entry->bdaddr, bdaddr);
2109 	entry->bdaddr_type = type;
2110 
2111 	if (peer_irk)
2112 		memcpy(entry->peer_irk, peer_irk, 16);
2113 
2114 	if (local_irk)
2115 		memcpy(entry->local_irk, local_irk, 16);
2116 
2117 	list_add(&entry->list, list);
2118 
2119 	return 0;
2120 }
2121 
hci_bdaddr_list_add_with_flags(struct list_head * list,bdaddr_t * bdaddr,u8 type,u32 flags)2122 int hci_bdaddr_list_add_with_flags(struct list_head *list, bdaddr_t *bdaddr,
2123 				   u8 type, u32 flags)
2124 {
2125 	struct bdaddr_list_with_flags *entry;
2126 
2127 	if (!bacmp(bdaddr, BDADDR_ANY))
2128 		return -EBADF;
2129 
2130 	if (hci_bdaddr_list_lookup(list, bdaddr, type))
2131 		return -EEXIST;
2132 
2133 	entry = kzalloc(sizeof(*entry), GFP_KERNEL);
2134 	if (!entry)
2135 		return -ENOMEM;
2136 
2137 	bacpy(&entry->bdaddr, bdaddr);
2138 	entry->bdaddr_type = type;
2139 	entry->flags = flags;
2140 
2141 	list_add(&entry->list, list);
2142 
2143 	return 0;
2144 }
2145 
hci_bdaddr_list_del(struct list_head * list,bdaddr_t * bdaddr,u8 type)2146 int hci_bdaddr_list_del(struct list_head *list, bdaddr_t *bdaddr, u8 type)
2147 {
2148 	struct bdaddr_list *entry;
2149 
2150 	if (!bacmp(bdaddr, BDADDR_ANY)) {
2151 		hci_bdaddr_list_clear(list);
2152 		return 0;
2153 	}
2154 
2155 	entry = hci_bdaddr_list_lookup(list, bdaddr, type);
2156 	if (!entry)
2157 		return -ENOENT;
2158 
2159 	list_del(&entry->list);
2160 	kfree(entry);
2161 
2162 	return 0;
2163 }
2164 
hci_bdaddr_list_del_with_irk(struct list_head * list,bdaddr_t * bdaddr,u8 type)2165 int hci_bdaddr_list_del_with_irk(struct list_head *list, bdaddr_t *bdaddr,
2166 							u8 type)
2167 {
2168 	struct bdaddr_list_with_irk *entry;
2169 
2170 	if (!bacmp(bdaddr, BDADDR_ANY)) {
2171 		hci_bdaddr_list_clear(list);
2172 		return 0;
2173 	}
2174 
2175 	entry = hci_bdaddr_list_lookup_with_irk(list, bdaddr, type);
2176 	if (!entry)
2177 		return -ENOENT;
2178 
2179 	list_del(&entry->list);
2180 	kfree(entry);
2181 
2182 	return 0;
2183 }
2184 
2185 /* This function requires the caller holds hdev->lock */
hci_conn_params_lookup(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type)2186 struct hci_conn_params *hci_conn_params_lookup(struct hci_dev *hdev,
2187 					       bdaddr_t *addr, u8 addr_type)
2188 {
2189 	struct hci_conn_params *params;
2190 
2191 	list_for_each_entry(params, &hdev->le_conn_params, list) {
2192 		if (bacmp(&params->addr, addr) == 0 &&
2193 		    params->addr_type == addr_type) {
2194 			return params;
2195 		}
2196 	}
2197 
2198 	return NULL;
2199 }
2200 
2201 /* This function requires the caller holds hdev->lock or rcu_read_lock */
hci_pend_le_action_lookup(struct list_head * list,bdaddr_t * addr,u8 addr_type)2202 struct hci_conn_params *hci_pend_le_action_lookup(struct list_head *list,
2203 						  bdaddr_t *addr, u8 addr_type)
2204 {
2205 	struct hci_conn_params *param;
2206 
2207 	rcu_read_lock();
2208 
2209 	list_for_each_entry_rcu(param, list, action) {
2210 		if (bacmp(&param->addr, addr) == 0 &&
2211 		    param->addr_type == addr_type) {
2212 			rcu_read_unlock();
2213 			return param;
2214 		}
2215 	}
2216 
2217 	rcu_read_unlock();
2218 
2219 	return NULL;
2220 }
2221 
2222 /* This function requires the caller holds hdev->lock */
hci_pend_le_list_del_init(struct hci_conn_params * param)2223 void hci_pend_le_list_del_init(struct hci_conn_params *param)
2224 {
2225 	if (list_empty(&param->action))
2226 		return;
2227 
2228 	list_del_rcu(&param->action);
2229 	synchronize_rcu();
2230 	INIT_LIST_HEAD(&param->action);
2231 }
2232 
2233 /* This function requires the caller holds hdev->lock */
hci_pend_le_list_add(struct hci_conn_params * param,struct list_head * list)2234 void hci_pend_le_list_add(struct hci_conn_params *param,
2235 			  struct list_head *list)
2236 {
2237 	list_add_rcu(&param->action, list);
2238 }
2239 
2240 /* This function requires the caller holds hdev->lock */
hci_conn_params_add(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type)2241 struct hci_conn_params *hci_conn_params_add(struct hci_dev *hdev,
2242 					    bdaddr_t *addr, u8 addr_type)
2243 {
2244 	struct hci_conn_params *params;
2245 
2246 	params = hci_conn_params_lookup(hdev, addr, addr_type);
2247 	if (params)
2248 		return params;
2249 
2250 	params = kzalloc(sizeof(*params), GFP_KERNEL);
2251 	if (!params) {
2252 		bt_dev_err(hdev, "out of memory");
2253 		return NULL;
2254 	}
2255 
2256 	bacpy(&params->addr, addr);
2257 	params->addr_type = addr_type;
2258 
2259 	list_add(&params->list, &hdev->le_conn_params);
2260 	INIT_LIST_HEAD(&params->action);
2261 
2262 	params->conn_min_interval = hdev->le_conn_min_interval;
2263 	params->conn_max_interval = hdev->le_conn_max_interval;
2264 	params->conn_latency = hdev->le_conn_latency;
2265 	params->supervision_timeout = hdev->le_supv_timeout;
2266 	params->auto_connect = HCI_AUTO_CONN_DISABLED;
2267 
2268 	BT_DBG("addr %pMR (type %u)", addr, addr_type);
2269 
2270 	return params;
2271 }
2272 
hci_conn_params_free(struct hci_conn_params * params)2273 void hci_conn_params_free(struct hci_conn_params *params)
2274 {
2275 	hci_pend_le_list_del_init(params);
2276 
2277 	if (params->conn) {
2278 		hci_conn_drop(params->conn);
2279 		hci_conn_put(params->conn);
2280 	}
2281 
2282 	list_del(&params->list);
2283 	kfree(params);
2284 }
2285 
2286 /* This function requires the caller holds hdev->lock */
hci_conn_params_del(struct hci_dev * hdev,bdaddr_t * addr,u8 addr_type)2287 void hci_conn_params_del(struct hci_dev *hdev, bdaddr_t *addr, u8 addr_type)
2288 {
2289 	struct hci_conn_params *params;
2290 
2291 	params = hci_conn_params_lookup(hdev, addr, addr_type);
2292 	if (!params)
2293 		return;
2294 
2295 	hci_conn_params_free(params);
2296 
2297 	hci_update_passive_scan(hdev);
2298 
2299 	BT_DBG("addr %pMR (type %u)", addr, addr_type);
2300 }
2301 
2302 /* This function requires the caller holds hdev->lock */
hci_conn_params_clear_disabled(struct hci_dev * hdev)2303 void hci_conn_params_clear_disabled(struct hci_dev *hdev)
2304 {
2305 	struct hci_conn_params *params, *tmp;
2306 
2307 	list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list) {
2308 		if (params->auto_connect != HCI_AUTO_CONN_DISABLED)
2309 			continue;
2310 
2311 		/* If trying to establish one time connection to disabled
2312 		 * device, leave the params, but mark them as just once.
2313 		 */
2314 		if (params->explicit_connect) {
2315 			params->auto_connect = HCI_AUTO_CONN_EXPLICIT;
2316 			continue;
2317 		}
2318 
2319 		hci_conn_params_free(params);
2320 	}
2321 
2322 	BT_DBG("All LE disabled connection parameters were removed");
2323 }
2324 
2325 /* This function requires the caller holds hdev->lock */
hci_conn_params_clear_all(struct hci_dev * hdev)2326 static void hci_conn_params_clear_all(struct hci_dev *hdev)
2327 {
2328 	struct hci_conn_params *params, *tmp;
2329 
2330 	list_for_each_entry_safe(params, tmp, &hdev->le_conn_params, list)
2331 		hci_conn_params_free(params);
2332 
2333 	BT_DBG("All LE connection parameters were removed");
2334 }
2335 
2336 /* Copy the Identity Address of the controller.
2337  *
2338  * If the controller has a public BD_ADDR, then by default use that one.
2339  * If this is a LE only controller without a public address, default to
2340  * the static random address.
2341  *
2342  * For debugging purposes it is possible to force controllers with a
2343  * public address to use the static random address instead.
2344  *
2345  * In case BR/EDR has been disabled on a dual-mode controller and
2346  * userspace has configured a static address, then that address
2347  * becomes the identity address instead of the public BR/EDR address.
2348  */
hci_copy_identity_address(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 * bdaddr_type)2349 void hci_copy_identity_address(struct hci_dev *hdev, bdaddr_t *bdaddr,
2350 			       u8 *bdaddr_type)
2351 {
2352 	if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
2353 	    !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
2354 	    (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
2355 	     bacmp(&hdev->static_addr, BDADDR_ANY))) {
2356 		bacpy(bdaddr, &hdev->static_addr);
2357 		*bdaddr_type = ADDR_LE_DEV_RANDOM;
2358 	} else {
2359 		bacpy(bdaddr, &hdev->bdaddr);
2360 		*bdaddr_type = ADDR_LE_DEV_PUBLIC;
2361 	}
2362 }
2363 
hci_clear_wake_reason(struct hci_dev * hdev)2364 static void hci_clear_wake_reason(struct hci_dev *hdev)
2365 {
2366 	hci_dev_lock(hdev);
2367 
2368 	hdev->wake_reason = 0;
2369 	bacpy(&hdev->wake_addr, BDADDR_ANY);
2370 	hdev->wake_addr_type = 0;
2371 
2372 	hci_dev_unlock(hdev);
2373 }
2374 
hci_suspend_notifier(struct notifier_block * nb,unsigned long action,void * data)2375 static int hci_suspend_notifier(struct notifier_block *nb, unsigned long action,
2376 				void *data)
2377 {
2378 	struct hci_dev *hdev =
2379 		container_of(nb, struct hci_dev, suspend_notifier);
2380 	int ret = 0;
2381 
2382 	/* Userspace has full control of this device. Do nothing. */
2383 	if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL))
2384 		return NOTIFY_DONE;
2385 
2386 	/* To avoid a potential race with hci_unregister_dev. */
2387 	hci_dev_hold(hdev);
2388 
2389 	switch (action) {
2390 	case PM_HIBERNATION_PREPARE:
2391 	case PM_SUSPEND_PREPARE:
2392 		ret = hci_suspend_dev(hdev);
2393 		break;
2394 	case PM_POST_HIBERNATION:
2395 	case PM_POST_SUSPEND:
2396 		ret = hci_resume_dev(hdev);
2397 		break;
2398 	}
2399 
2400 	if (ret)
2401 		bt_dev_err(hdev, "Suspend notifier action (%lu) failed: %d",
2402 			   action, ret);
2403 
2404 	hci_dev_put(hdev);
2405 	return NOTIFY_DONE;
2406 }
2407 
2408 /* Alloc HCI device */
hci_alloc_dev_priv(int sizeof_priv)2409 struct hci_dev *hci_alloc_dev_priv(int sizeof_priv)
2410 {
2411 	struct hci_dev *hdev;
2412 	unsigned int alloc_size;
2413 
2414 	alloc_size = sizeof(*hdev);
2415 	if (sizeof_priv) {
2416 		/* Fixme: May need ALIGN-ment? */
2417 		alloc_size += sizeof_priv;
2418 	}
2419 
2420 	hdev = kzalloc(alloc_size, GFP_KERNEL);
2421 	if (!hdev)
2422 		return NULL;
2423 
2424 	hdev->pkt_type  = (HCI_DM1 | HCI_DH1 | HCI_HV1);
2425 	hdev->esco_type = (ESCO_HV1);
2426 	hdev->link_mode = (HCI_LM_ACCEPT);
2427 	hdev->num_iac = 0x01;		/* One IAC support is mandatory */
2428 	hdev->io_capability = 0x03;	/* No Input No Output */
2429 	hdev->manufacturer = 0xffff;	/* Default to internal use */
2430 	hdev->inq_tx_power = HCI_TX_POWER_INVALID;
2431 	hdev->adv_tx_power = HCI_TX_POWER_INVALID;
2432 	hdev->adv_instance_cnt = 0;
2433 	hdev->cur_adv_instance = 0x00;
2434 	hdev->adv_instance_timeout = 0;
2435 
2436 	hdev->advmon_allowlist_duration = 300;
2437 	hdev->advmon_no_filter_duration = 500;
2438 	hdev->enable_advmon_interleave_scan = 0x00;	/* Default to disable */
2439 
2440 	hdev->sniff_max_interval = 800;
2441 	hdev->sniff_min_interval = 80;
2442 
2443 	hdev->le_adv_channel_map = 0x07;
2444 	hdev->le_adv_min_interval = 0x0800;
2445 	hdev->le_adv_max_interval = 0x0800;
2446 	hdev->le_scan_interval = DISCOV_LE_SCAN_INT_FAST;
2447 	hdev->le_scan_window = DISCOV_LE_SCAN_WIN_FAST;
2448 	hdev->le_scan_int_suspend = DISCOV_LE_SCAN_INT_SLOW1;
2449 	hdev->le_scan_window_suspend = DISCOV_LE_SCAN_WIN_SLOW1;
2450 	hdev->le_scan_int_discovery = DISCOV_LE_SCAN_INT;
2451 	hdev->le_scan_window_discovery = DISCOV_LE_SCAN_WIN;
2452 	hdev->le_scan_int_adv_monitor = DISCOV_LE_SCAN_INT_FAST;
2453 	hdev->le_scan_window_adv_monitor = DISCOV_LE_SCAN_WIN_FAST;
2454 	hdev->le_scan_int_connect = DISCOV_LE_SCAN_INT_CONN;
2455 	hdev->le_scan_window_connect = DISCOV_LE_SCAN_WIN_CONN;
2456 	hdev->le_conn_min_interval = 0x0018;
2457 	hdev->le_conn_max_interval = 0x0028;
2458 	hdev->le_conn_latency = 0x0000;
2459 	hdev->le_supv_timeout = 0x002a;
2460 	hdev->le_def_tx_len = 0x001b;
2461 	hdev->le_def_tx_time = 0x0148;
2462 	hdev->le_max_tx_len = 0x001b;
2463 	hdev->le_max_tx_time = 0x0148;
2464 	hdev->le_max_rx_len = 0x001b;
2465 	hdev->le_max_rx_time = 0x0148;
2466 	hdev->le_max_key_size = SMP_MAX_ENC_KEY_SIZE;
2467 	hdev->le_min_key_size = SMP_MIN_ENC_KEY_SIZE;
2468 	hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
2469 	hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
2470 	hdev->le_num_of_adv_sets = HCI_MAX_ADV_INSTANCES;
2471 	hdev->def_multi_adv_rotation_duration = HCI_DEFAULT_ADV_DURATION;
2472 	hdev->def_le_autoconnect_timeout = HCI_LE_CONN_TIMEOUT;
2473 	hdev->min_le_tx_power = HCI_TX_POWER_INVALID;
2474 	hdev->max_le_tx_power = HCI_TX_POWER_INVALID;
2475 
2476 	hdev->rpa_timeout = HCI_DEFAULT_RPA_TIMEOUT;
2477 	hdev->discov_interleaved_timeout = DISCOV_INTERLEAVED_TIMEOUT;
2478 	hdev->conn_info_min_age = DEFAULT_CONN_INFO_MIN_AGE;
2479 	hdev->conn_info_max_age = DEFAULT_CONN_INFO_MAX_AGE;
2480 	hdev->auth_payload_timeout = DEFAULT_AUTH_PAYLOAD_TIMEOUT;
2481 	hdev->min_enc_key_size = HCI_MIN_ENC_KEY_SIZE;
2482 
2483 	/* default 1.28 sec page scan */
2484 	hdev->def_page_scan_type = PAGE_SCAN_TYPE_STANDARD;
2485 	hdev->def_page_scan_int = 0x0800;
2486 	hdev->def_page_scan_window = 0x0012;
2487 
2488 	mutex_init(&hdev->lock);
2489 	mutex_init(&hdev->req_lock);
2490 
2491 	ida_init(&hdev->unset_handle_ida);
2492 
2493 	INIT_LIST_HEAD(&hdev->mesh_pending);
2494 	INIT_LIST_HEAD(&hdev->mgmt_pending);
2495 	INIT_LIST_HEAD(&hdev->reject_list);
2496 	INIT_LIST_HEAD(&hdev->accept_list);
2497 	INIT_LIST_HEAD(&hdev->uuids);
2498 	INIT_LIST_HEAD(&hdev->link_keys);
2499 	INIT_LIST_HEAD(&hdev->long_term_keys);
2500 	INIT_LIST_HEAD(&hdev->identity_resolving_keys);
2501 	INIT_LIST_HEAD(&hdev->remote_oob_data);
2502 	INIT_LIST_HEAD(&hdev->le_accept_list);
2503 	INIT_LIST_HEAD(&hdev->le_resolv_list);
2504 	INIT_LIST_HEAD(&hdev->le_conn_params);
2505 	INIT_LIST_HEAD(&hdev->pend_le_conns);
2506 	INIT_LIST_HEAD(&hdev->pend_le_reports);
2507 	INIT_LIST_HEAD(&hdev->conn_hash.list);
2508 	INIT_LIST_HEAD(&hdev->adv_instances);
2509 	INIT_LIST_HEAD(&hdev->blocked_keys);
2510 	INIT_LIST_HEAD(&hdev->monitored_devices);
2511 
2512 	INIT_LIST_HEAD(&hdev->local_codecs);
2513 	INIT_WORK(&hdev->rx_work, hci_rx_work);
2514 	INIT_WORK(&hdev->cmd_work, hci_cmd_work);
2515 	INIT_WORK(&hdev->tx_work, hci_tx_work);
2516 	INIT_WORK(&hdev->power_on, hci_power_on);
2517 	INIT_WORK(&hdev->error_reset, hci_error_reset);
2518 
2519 	hci_cmd_sync_init(hdev);
2520 
2521 	INIT_DELAYED_WORK(&hdev->power_off, hci_power_off);
2522 
2523 	skb_queue_head_init(&hdev->rx_q);
2524 	skb_queue_head_init(&hdev->cmd_q);
2525 	skb_queue_head_init(&hdev->raw_q);
2526 
2527 	init_waitqueue_head(&hdev->req_wait_q);
2528 
2529 	INIT_DELAYED_WORK(&hdev->cmd_timer, hci_cmd_timeout);
2530 	INIT_DELAYED_WORK(&hdev->ncmd_timer, hci_ncmd_timeout);
2531 
2532 	hci_devcd_setup(hdev);
2533 
2534 	hci_init_sysfs(hdev);
2535 	discovery_init(hdev);
2536 
2537 	return hdev;
2538 }
2539 EXPORT_SYMBOL(hci_alloc_dev_priv);
2540 
2541 /* Free HCI device */
hci_free_dev(struct hci_dev * hdev)2542 void hci_free_dev(struct hci_dev *hdev)
2543 {
2544 	/* will free via device release */
2545 	put_device(&hdev->dev);
2546 }
2547 EXPORT_SYMBOL(hci_free_dev);
2548 
2549 /* Register HCI device */
hci_register_dev(struct hci_dev * hdev)2550 int hci_register_dev(struct hci_dev *hdev)
2551 {
2552 	int id, error;
2553 
2554 	if (!hdev->open || !hdev->close || !hdev->send)
2555 		return -EINVAL;
2556 
2557 	id = ida_alloc_max(&hci_index_ida, HCI_MAX_ID - 1, GFP_KERNEL);
2558 	if (id < 0)
2559 		return id;
2560 
2561 	error = dev_set_name(&hdev->dev, "hci%u", id);
2562 	if (error)
2563 		return error;
2564 
2565 	hdev->name = dev_name(&hdev->dev);
2566 	hdev->id = id;
2567 
2568 	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2569 
2570 	hdev->workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI, hdev->name);
2571 	if (!hdev->workqueue) {
2572 		error = -ENOMEM;
2573 		goto err;
2574 	}
2575 
2576 	hdev->req_workqueue = alloc_ordered_workqueue("%s", WQ_HIGHPRI,
2577 						      hdev->name);
2578 	if (!hdev->req_workqueue) {
2579 		destroy_workqueue(hdev->workqueue);
2580 		error = -ENOMEM;
2581 		goto err;
2582 	}
2583 
2584 	if (!IS_ERR_OR_NULL(bt_debugfs))
2585 		hdev->debugfs = debugfs_create_dir(hdev->name, bt_debugfs);
2586 
2587 	error = device_add(&hdev->dev);
2588 	if (error < 0)
2589 		goto err_wqueue;
2590 
2591 	hci_leds_init(hdev);
2592 
2593 	hdev->rfkill = rfkill_alloc(hdev->name, &hdev->dev,
2594 				    RFKILL_TYPE_BLUETOOTH, &hci_rfkill_ops,
2595 				    hdev);
2596 	if (hdev->rfkill) {
2597 		if (rfkill_register(hdev->rfkill) < 0) {
2598 			rfkill_destroy(hdev->rfkill);
2599 			hdev->rfkill = NULL;
2600 		}
2601 	}
2602 
2603 	if (hdev->rfkill && rfkill_blocked(hdev->rfkill))
2604 		hci_dev_set_flag(hdev, HCI_RFKILLED);
2605 
2606 	hci_dev_set_flag(hdev, HCI_SETUP);
2607 	hci_dev_set_flag(hdev, HCI_AUTO_OFF);
2608 
2609 	/* Assume BR/EDR support until proven otherwise (such as
2610 	 * through reading supported features during init.
2611 	 */
2612 	hci_dev_set_flag(hdev, HCI_BREDR_ENABLED);
2613 
2614 	write_lock(&hci_dev_list_lock);
2615 	list_add(&hdev->list, &hci_dev_list);
2616 	write_unlock(&hci_dev_list_lock);
2617 
2618 	/* Devices that are marked for raw-only usage are unconfigured
2619 	 * and should not be included in normal operation.
2620 	 */
2621 	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
2622 		hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
2623 
2624 	/* Mark Remote Wakeup connection flag as supported if driver has wakeup
2625 	 * callback.
2626 	 */
2627 	if (hdev->wakeup)
2628 		hdev->conn_flags |= HCI_CONN_FLAG_REMOTE_WAKEUP;
2629 
2630 	hci_sock_dev_event(hdev, HCI_DEV_REG);
2631 	hci_dev_hold(hdev);
2632 
2633 	error = hci_register_suspend_notifier(hdev);
2634 	if (error)
2635 		BT_WARN("register suspend notifier failed error:%d\n", error);
2636 
2637 	queue_work(hdev->req_workqueue, &hdev->power_on);
2638 
2639 	idr_init(&hdev->adv_monitors_idr);
2640 	msft_register(hdev);
2641 
2642 	return id;
2643 
2644 err_wqueue:
2645 	debugfs_remove_recursive(hdev->debugfs);
2646 	destroy_workqueue(hdev->workqueue);
2647 	destroy_workqueue(hdev->req_workqueue);
2648 err:
2649 	ida_free(&hci_index_ida, hdev->id);
2650 
2651 	return error;
2652 }
2653 EXPORT_SYMBOL(hci_register_dev);
2654 
2655 /* Unregister HCI device */
hci_unregister_dev(struct hci_dev * hdev)2656 void hci_unregister_dev(struct hci_dev *hdev)
2657 {
2658 	BT_DBG("%p name %s bus %d", hdev, hdev->name, hdev->bus);
2659 
2660 	mutex_lock(&hdev->unregister_lock);
2661 	hci_dev_set_flag(hdev, HCI_UNREGISTER);
2662 	mutex_unlock(&hdev->unregister_lock);
2663 
2664 	write_lock(&hci_dev_list_lock);
2665 	list_del(&hdev->list);
2666 	write_unlock(&hci_dev_list_lock);
2667 
2668 	disable_work_sync(&hdev->rx_work);
2669 	disable_work_sync(&hdev->cmd_work);
2670 	disable_work_sync(&hdev->tx_work);
2671 	disable_work_sync(&hdev->power_on);
2672 	disable_work_sync(&hdev->error_reset);
2673 
2674 	hci_cmd_sync_clear(hdev);
2675 
2676 	hci_unregister_suspend_notifier(hdev);
2677 
2678 	hci_dev_do_close(hdev);
2679 
2680 	if (!test_bit(HCI_INIT, &hdev->flags) &&
2681 	    !hci_dev_test_flag(hdev, HCI_SETUP) &&
2682 	    !hci_dev_test_flag(hdev, HCI_CONFIG)) {
2683 		hci_dev_lock(hdev);
2684 		mgmt_index_removed(hdev);
2685 		hci_dev_unlock(hdev);
2686 	}
2687 
2688 	/* mgmt_index_removed should take care of emptying the
2689 	 * pending list */
2690 	BUG_ON(!list_empty(&hdev->mgmt_pending));
2691 
2692 	hci_sock_dev_event(hdev, HCI_DEV_UNREG);
2693 
2694 	if (hdev->rfkill) {
2695 		rfkill_unregister(hdev->rfkill);
2696 		rfkill_destroy(hdev->rfkill);
2697 	}
2698 
2699 	device_del(&hdev->dev);
2700 	/* Actual cleanup is deferred until hci_release_dev(). */
2701 	hci_dev_put(hdev);
2702 }
2703 EXPORT_SYMBOL(hci_unregister_dev);
2704 
2705 /* Release HCI device */
hci_release_dev(struct hci_dev * hdev)2706 void hci_release_dev(struct hci_dev *hdev)
2707 {
2708 	debugfs_remove_recursive(hdev->debugfs);
2709 	kfree_const(hdev->hw_info);
2710 	kfree_const(hdev->fw_info);
2711 
2712 	destroy_workqueue(hdev->workqueue);
2713 	destroy_workqueue(hdev->req_workqueue);
2714 
2715 	hci_dev_lock(hdev);
2716 	hci_bdaddr_list_clear(&hdev->reject_list);
2717 	hci_bdaddr_list_clear(&hdev->accept_list);
2718 	hci_uuids_clear(hdev);
2719 	hci_link_keys_clear(hdev);
2720 	hci_smp_ltks_clear(hdev);
2721 	hci_smp_irks_clear(hdev);
2722 	hci_remote_oob_data_clear(hdev);
2723 	hci_adv_instances_clear(hdev);
2724 	hci_adv_monitors_clear(hdev);
2725 	hci_bdaddr_list_clear(&hdev->le_accept_list);
2726 	hci_bdaddr_list_clear(&hdev->le_resolv_list);
2727 	hci_conn_params_clear_all(hdev);
2728 	hci_discovery_filter_clear(hdev);
2729 	hci_blocked_keys_clear(hdev);
2730 	hci_codec_list_clear(&hdev->local_codecs);
2731 	msft_release(hdev);
2732 	hci_dev_unlock(hdev);
2733 
2734 	ida_destroy(&hdev->unset_handle_ida);
2735 	ida_free(&hci_index_ida, hdev->id);
2736 	kfree_skb(hdev->sent_cmd);
2737 	kfree_skb(hdev->req_skb);
2738 	kfree_skb(hdev->recv_event);
2739 	kfree(hdev);
2740 }
2741 EXPORT_SYMBOL(hci_release_dev);
2742 
hci_register_suspend_notifier(struct hci_dev * hdev)2743 int hci_register_suspend_notifier(struct hci_dev *hdev)
2744 {
2745 	int ret = 0;
2746 
2747 	if (!hdev->suspend_notifier.notifier_call &&
2748 	    !test_bit(HCI_QUIRK_NO_SUSPEND_NOTIFIER, &hdev->quirks)) {
2749 		hdev->suspend_notifier.notifier_call = hci_suspend_notifier;
2750 		ret = register_pm_notifier(&hdev->suspend_notifier);
2751 	}
2752 
2753 	return ret;
2754 }
2755 
hci_unregister_suspend_notifier(struct hci_dev * hdev)2756 int hci_unregister_suspend_notifier(struct hci_dev *hdev)
2757 {
2758 	int ret = 0;
2759 
2760 	if (hdev->suspend_notifier.notifier_call) {
2761 		ret = unregister_pm_notifier(&hdev->suspend_notifier);
2762 		if (!ret)
2763 			hdev->suspend_notifier.notifier_call = NULL;
2764 	}
2765 
2766 	return ret;
2767 }
2768 
2769 /* Cancel ongoing command synchronously:
2770  *
2771  * - Cancel command timer
2772  * - Reset command counter
2773  * - Cancel command request
2774  */
hci_cancel_cmd_sync(struct hci_dev * hdev,int err)2775 static void hci_cancel_cmd_sync(struct hci_dev *hdev, int err)
2776 {
2777 	bt_dev_dbg(hdev, "err 0x%2.2x", err);
2778 
2779 	if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
2780 		disable_delayed_work_sync(&hdev->cmd_timer);
2781 		disable_delayed_work_sync(&hdev->ncmd_timer);
2782 	} else  {
2783 		cancel_delayed_work_sync(&hdev->cmd_timer);
2784 		cancel_delayed_work_sync(&hdev->ncmd_timer);
2785 	}
2786 
2787 	atomic_set(&hdev->cmd_cnt, 1);
2788 
2789 	hci_cmd_sync_cancel_sync(hdev, err);
2790 }
2791 
2792 /* Suspend HCI device */
hci_suspend_dev(struct hci_dev * hdev)2793 int hci_suspend_dev(struct hci_dev *hdev)
2794 {
2795 	int ret;
2796 
2797 	bt_dev_dbg(hdev, "");
2798 
2799 	/* Suspend should only act on when powered. */
2800 	if (!hdev_is_powered(hdev) ||
2801 	    hci_dev_test_flag(hdev, HCI_UNREGISTER))
2802 		return 0;
2803 
2804 	/* If powering down don't attempt to suspend */
2805 	if (mgmt_powering_down(hdev))
2806 		return 0;
2807 
2808 	/* Cancel potentially blocking sync operation before suspend */
2809 	hci_cancel_cmd_sync(hdev, EHOSTDOWN);
2810 
2811 	hci_req_sync_lock(hdev);
2812 	ret = hci_suspend_sync(hdev);
2813 	hci_req_sync_unlock(hdev);
2814 
2815 	hci_clear_wake_reason(hdev);
2816 	mgmt_suspending(hdev, hdev->suspend_state);
2817 
2818 	hci_sock_dev_event(hdev, HCI_DEV_SUSPEND);
2819 	return ret;
2820 }
2821 EXPORT_SYMBOL(hci_suspend_dev);
2822 
2823 /* Resume HCI device */
hci_resume_dev(struct hci_dev * hdev)2824 int hci_resume_dev(struct hci_dev *hdev)
2825 {
2826 	int ret;
2827 
2828 	bt_dev_dbg(hdev, "");
2829 
2830 	/* Resume should only act on when powered. */
2831 	if (!hdev_is_powered(hdev) ||
2832 	    hci_dev_test_flag(hdev, HCI_UNREGISTER))
2833 		return 0;
2834 
2835 	/* If powering down don't attempt to resume */
2836 	if (mgmt_powering_down(hdev))
2837 		return 0;
2838 
2839 	hci_req_sync_lock(hdev);
2840 	ret = hci_resume_sync(hdev);
2841 	hci_req_sync_unlock(hdev);
2842 
2843 	mgmt_resuming(hdev, hdev->wake_reason, &hdev->wake_addr,
2844 		      hdev->wake_addr_type);
2845 
2846 	hci_sock_dev_event(hdev, HCI_DEV_RESUME);
2847 	return ret;
2848 }
2849 EXPORT_SYMBOL(hci_resume_dev);
2850 
2851 /* Reset HCI device */
hci_reset_dev(struct hci_dev * hdev)2852 int hci_reset_dev(struct hci_dev *hdev)
2853 {
2854 	static const u8 hw_err[] = { HCI_EV_HARDWARE_ERROR, 0x01, 0x00 };
2855 	struct sk_buff *skb;
2856 
2857 	skb = bt_skb_alloc(3, GFP_ATOMIC);
2858 	if (!skb)
2859 		return -ENOMEM;
2860 
2861 	hci_skb_pkt_type(skb) = HCI_EVENT_PKT;
2862 	skb_put_data(skb, hw_err, 3);
2863 
2864 	bt_dev_err(hdev, "Injecting HCI hardware error event");
2865 
2866 	/* Send Hardware Error to upper stack */
2867 	return hci_recv_frame(hdev, skb);
2868 }
2869 EXPORT_SYMBOL(hci_reset_dev);
2870 
hci_dev_classify_pkt_type(struct hci_dev * hdev,struct sk_buff * skb)2871 static u8 hci_dev_classify_pkt_type(struct hci_dev *hdev, struct sk_buff *skb)
2872 {
2873 	if (hdev->classify_pkt_type)
2874 		return hdev->classify_pkt_type(hdev, skb);
2875 
2876 	return hci_skb_pkt_type(skb);
2877 }
2878 
2879 /* Receive frame from HCI drivers */
hci_recv_frame(struct hci_dev * hdev,struct sk_buff * skb)2880 int hci_recv_frame(struct hci_dev *hdev, struct sk_buff *skb)
2881 {
2882 	u8 dev_pkt_type;
2883 
2884 	if (!hdev || (!test_bit(HCI_UP, &hdev->flags)
2885 		      && !test_bit(HCI_INIT, &hdev->flags))) {
2886 		kfree_skb(skb);
2887 		return -ENXIO;
2888 	}
2889 
2890 	/* Check if the driver agree with packet type classification */
2891 	dev_pkt_type = hci_dev_classify_pkt_type(hdev, skb);
2892 	if (hci_skb_pkt_type(skb) != dev_pkt_type) {
2893 		hci_skb_pkt_type(skb) = dev_pkt_type;
2894 	}
2895 
2896 	switch (hci_skb_pkt_type(skb)) {
2897 	case HCI_EVENT_PKT:
2898 		break;
2899 	case HCI_ACLDATA_PKT:
2900 		/* Detect if ISO packet has been sent as ACL */
2901 		if (hci_conn_num(hdev, ISO_LINK)) {
2902 			__u16 handle = __le16_to_cpu(hci_acl_hdr(skb)->handle);
2903 			__u8 type;
2904 
2905 			type = hci_conn_lookup_type(hdev, hci_handle(handle));
2906 			if (type == ISO_LINK)
2907 				hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
2908 		}
2909 		break;
2910 	case HCI_SCODATA_PKT:
2911 		break;
2912 	case HCI_ISODATA_PKT:
2913 		break;
2914 	default:
2915 		kfree_skb(skb);
2916 		return -EINVAL;
2917 	}
2918 
2919 	/* Incoming skb */
2920 	bt_cb(skb)->incoming = 1;
2921 
2922 	/* Time stamp */
2923 	__net_timestamp(skb);
2924 
2925 	skb_queue_tail(&hdev->rx_q, skb);
2926 	queue_work(hdev->workqueue, &hdev->rx_work);
2927 
2928 	return 0;
2929 }
2930 EXPORT_SYMBOL(hci_recv_frame);
2931 
2932 /* Receive diagnostic message from HCI drivers */
hci_recv_diag(struct hci_dev * hdev,struct sk_buff * skb)2933 int hci_recv_diag(struct hci_dev *hdev, struct sk_buff *skb)
2934 {
2935 	/* Mark as diagnostic packet */
2936 	hci_skb_pkt_type(skb) = HCI_DIAG_PKT;
2937 
2938 	/* Time stamp */
2939 	__net_timestamp(skb);
2940 
2941 	skb_queue_tail(&hdev->rx_q, skb);
2942 	queue_work(hdev->workqueue, &hdev->rx_work);
2943 
2944 	return 0;
2945 }
2946 EXPORT_SYMBOL(hci_recv_diag);
2947 
hci_set_hw_info(struct hci_dev * hdev,const char * fmt,...)2948 void hci_set_hw_info(struct hci_dev *hdev, const char *fmt, ...)
2949 {
2950 	va_list vargs;
2951 
2952 	va_start(vargs, fmt);
2953 	kfree_const(hdev->hw_info);
2954 	hdev->hw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2955 	va_end(vargs);
2956 }
2957 EXPORT_SYMBOL(hci_set_hw_info);
2958 
hci_set_fw_info(struct hci_dev * hdev,const char * fmt,...)2959 void hci_set_fw_info(struct hci_dev *hdev, const char *fmt, ...)
2960 {
2961 	va_list vargs;
2962 
2963 	va_start(vargs, fmt);
2964 	kfree_const(hdev->fw_info);
2965 	hdev->fw_info = kvasprintf_const(GFP_KERNEL, fmt, vargs);
2966 	va_end(vargs);
2967 }
2968 EXPORT_SYMBOL(hci_set_fw_info);
2969 
2970 /* ---- Interface to upper protocols ---- */
2971 
hci_register_cb(struct hci_cb * cb)2972 int hci_register_cb(struct hci_cb *cb)
2973 {
2974 	BT_DBG("%p name %s", cb, cb->name);
2975 
2976 	mutex_lock(&hci_cb_list_lock);
2977 	list_add_tail(&cb->list, &hci_cb_list);
2978 	mutex_unlock(&hci_cb_list_lock);
2979 
2980 	return 0;
2981 }
2982 EXPORT_SYMBOL(hci_register_cb);
2983 
hci_unregister_cb(struct hci_cb * cb)2984 int hci_unregister_cb(struct hci_cb *cb)
2985 {
2986 	BT_DBG("%p name %s", cb, cb->name);
2987 
2988 	mutex_lock(&hci_cb_list_lock);
2989 	list_del(&cb->list);
2990 	mutex_unlock(&hci_cb_list_lock);
2991 
2992 	return 0;
2993 }
2994 EXPORT_SYMBOL(hci_unregister_cb);
2995 
hci_send_frame(struct hci_dev * hdev,struct sk_buff * skb)2996 static int hci_send_frame(struct hci_dev *hdev, struct sk_buff *skb)
2997 {
2998 	int err;
2999 
3000 	BT_DBG("%s type %d len %d", hdev->name, hci_skb_pkt_type(skb),
3001 	       skb->len);
3002 
3003 	/* Time stamp */
3004 	__net_timestamp(skb);
3005 
3006 	/* Send copy to monitor */
3007 	hci_send_to_monitor(hdev, skb);
3008 
3009 	if (atomic_read(&hdev->promisc)) {
3010 		/* Send copy to the sockets */
3011 		hci_send_to_sock(hdev, skb);
3012 	}
3013 
3014 	/* Get rid of skb owner, prior to sending to the driver. */
3015 	skb_orphan(skb);
3016 
3017 	if (!test_bit(HCI_RUNNING, &hdev->flags)) {
3018 		kfree_skb(skb);
3019 		return -EINVAL;
3020 	}
3021 
3022 	err = hdev->send(hdev, skb);
3023 	if (err < 0) {
3024 		bt_dev_err(hdev, "sending frame failed (%d)", err);
3025 		kfree_skb(skb);
3026 		return err;
3027 	}
3028 
3029 	return 0;
3030 }
3031 
3032 /* Send HCI command */
hci_send_cmd(struct hci_dev * hdev,__u16 opcode,__u32 plen,const void * param)3033 int hci_send_cmd(struct hci_dev *hdev, __u16 opcode, __u32 plen,
3034 		 const void *param)
3035 {
3036 	struct sk_buff *skb;
3037 
3038 	BT_DBG("%s opcode 0x%4.4x plen %d", hdev->name, opcode, plen);
3039 
3040 	skb = hci_cmd_sync_alloc(hdev, opcode, plen, param, NULL);
3041 	if (!skb) {
3042 		bt_dev_err(hdev, "no memory for command");
3043 		return -ENOMEM;
3044 	}
3045 
3046 	/* Stand-alone HCI commands must be flagged as
3047 	 * single-command requests.
3048 	 */
3049 	bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
3050 
3051 	skb_queue_tail(&hdev->cmd_q, skb);
3052 	queue_work(hdev->workqueue, &hdev->cmd_work);
3053 
3054 	return 0;
3055 }
3056 
__hci_cmd_send(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param)3057 int __hci_cmd_send(struct hci_dev *hdev, u16 opcode, u32 plen,
3058 		   const void *param)
3059 {
3060 	struct sk_buff *skb;
3061 
3062 	if (hci_opcode_ogf(opcode) != 0x3f) {
3063 		/* A controller receiving a command shall respond with either
3064 		 * a Command Status Event or a Command Complete Event.
3065 		 * Therefore, all standard HCI commands must be sent via the
3066 		 * standard API, using hci_send_cmd or hci_cmd_sync helpers.
3067 		 * Some vendors do not comply with this rule for vendor-specific
3068 		 * commands and do not return any event. We want to support
3069 		 * unresponded commands for such cases only.
3070 		 */
3071 		bt_dev_err(hdev, "unresponded command not supported");
3072 		return -EINVAL;
3073 	}
3074 
3075 	skb = hci_cmd_sync_alloc(hdev, opcode, plen, param, NULL);
3076 	if (!skb) {
3077 		bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
3078 			   opcode);
3079 		return -ENOMEM;
3080 	}
3081 
3082 	hci_send_frame(hdev, skb);
3083 
3084 	return 0;
3085 }
3086 EXPORT_SYMBOL(__hci_cmd_send);
3087 
3088 /* Get data from the previously sent command */
hci_cmd_data(struct sk_buff * skb,__u16 opcode)3089 static void *hci_cmd_data(struct sk_buff *skb, __u16 opcode)
3090 {
3091 	struct hci_command_hdr *hdr;
3092 
3093 	if (!skb || skb->len < HCI_COMMAND_HDR_SIZE)
3094 		return NULL;
3095 
3096 	hdr = (void *)skb->data;
3097 
3098 	if (hdr->opcode != cpu_to_le16(opcode))
3099 		return NULL;
3100 
3101 	return skb->data + HCI_COMMAND_HDR_SIZE;
3102 }
3103 
3104 /* Get data from the previously sent command */
hci_sent_cmd_data(struct hci_dev * hdev,__u16 opcode)3105 void *hci_sent_cmd_data(struct hci_dev *hdev, __u16 opcode)
3106 {
3107 	void *data;
3108 
3109 	/* Check if opcode matches last sent command */
3110 	data = hci_cmd_data(hdev->sent_cmd, opcode);
3111 	if (!data)
3112 		/* Check if opcode matches last request */
3113 		data = hci_cmd_data(hdev->req_skb, opcode);
3114 
3115 	return data;
3116 }
3117 
3118 /* Get data from last received event */
hci_recv_event_data(struct hci_dev * hdev,__u8 event)3119 void *hci_recv_event_data(struct hci_dev *hdev, __u8 event)
3120 {
3121 	struct hci_event_hdr *hdr;
3122 	int offset;
3123 
3124 	if (!hdev->recv_event)
3125 		return NULL;
3126 
3127 	hdr = (void *)hdev->recv_event->data;
3128 	offset = sizeof(*hdr);
3129 
3130 	if (hdr->evt != event) {
3131 		/* In case of LE metaevent check the subevent match */
3132 		if (hdr->evt == HCI_EV_LE_META) {
3133 			struct hci_ev_le_meta *ev;
3134 
3135 			ev = (void *)hdev->recv_event->data + offset;
3136 			offset += sizeof(*ev);
3137 			if (ev->subevent == event)
3138 				goto found;
3139 		}
3140 		return NULL;
3141 	}
3142 
3143 found:
3144 	bt_dev_dbg(hdev, "event 0x%2.2x", event);
3145 
3146 	return hdev->recv_event->data + offset;
3147 }
3148 
3149 /* Send ACL data */
hci_add_acl_hdr(struct sk_buff * skb,__u16 handle,__u16 flags)3150 static void hci_add_acl_hdr(struct sk_buff *skb, __u16 handle, __u16 flags)
3151 {
3152 	struct hci_acl_hdr *hdr;
3153 	int len = skb->len;
3154 
3155 	skb_push(skb, HCI_ACL_HDR_SIZE);
3156 	skb_reset_transport_header(skb);
3157 	hdr = (struct hci_acl_hdr *)skb_transport_header(skb);
3158 	hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3159 	hdr->dlen   = cpu_to_le16(len);
3160 }
3161 
hci_queue_acl(struct hci_chan * chan,struct sk_buff_head * queue,struct sk_buff * skb,__u16 flags)3162 static void hci_queue_acl(struct hci_chan *chan, struct sk_buff_head *queue,
3163 			  struct sk_buff *skb, __u16 flags)
3164 {
3165 	struct hci_conn *conn = chan->conn;
3166 	struct hci_dev *hdev = conn->hdev;
3167 	struct sk_buff *list;
3168 
3169 	skb->len = skb_headlen(skb);
3170 	skb->data_len = 0;
3171 
3172 	hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3173 
3174 	hci_add_acl_hdr(skb, conn->handle, flags);
3175 
3176 	list = skb_shinfo(skb)->frag_list;
3177 	if (!list) {
3178 		/* Non fragmented */
3179 		BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3180 
3181 		skb_queue_tail(queue, skb);
3182 	} else {
3183 		/* Fragmented */
3184 		BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3185 
3186 		skb_shinfo(skb)->frag_list = NULL;
3187 
3188 		/* Queue all fragments atomically. We need to use spin_lock_bh
3189 		 * here because of 6LoWPAN links, as there this function is
3190 		 * called from softirq and using normal spin lock could cause
3191 		 * deadlocks.
3192 		 */
3193 		spin_lock_bh(&queue->lock);
3194 
3195 		__skb_queue_tail(queue, skb);
3196 
3197 		flags &= ~ACL_START;
3198 		flags |= ACL_CONT;
3199 		do {
3200 			skb = list; list = list->next;
3201 
3202 			hci_skb_pkt_type(skb) = HCI_ACLDATA_PKT;
3203 			hci_add_acl_hdr(skb, conn->handle, flags);
3204 
3205 			BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3206 
3207 			__skb_queue_tail(queue, skb);
3208 		} while (list);
3209 
3210 		spin_unlock_bh(&queue->lock);
3211 	}
3212 }
3213 
hci_send_acl(struct hci_chan * chan,struct sk_buff * skb,__u16 flags)3214 void hci_send_acl(struct hci_chan *chan, struct sk_buff *skb, __u16 flags)
3215 {
3216 	struct hci_dev *hdev = chan->conn->hdev;
3217 
3218 	BT_DBG("%s chan %p flags 0x%4.4x", hdev->name, chan, flags);
3219 
3220 	hci_queue_acl(chan, &chan->data_q, skb, flags);
3221 
3222 	queue_work(hdev->workqueue, &hdev->tx_work);
3223 }
3224 
3225 /* Send SCO data */
hci_send_sco(struct hci_conn * conn,struct sk_buff * skb)3226 void hci_send_sco(struct hci_conn *conn, struct sk_buff *skb)
3227 {
3228 	struct hci_dev *hdev = conn->hdev;
3229 	struct hci_sco_hdr hdr;
3230 
3231 	BT_DBG("%s len %d", hdev->name, skb->len);
3232 
3233 	hdr.handle = cpu_to_le16(conn->handle);
3234 	hdr.dlen   = skb->len;
3235 
3236 	skb_push(skb, HCI_SCO_HDR_SIZE);
3237 	skb_reset_transport_header(skb);
3238 	memcpy(skb_transport_header(skb), &hdr, HCI_SCO_HDR_SIZE);
3239 
3240 	hci_skb_pkt_type(skb) = HCI_SCODATA_PKT;
3241 
3242 	skb_queue_tail(&conn->data_q, skb);
3243 	queue_work(hdev->workqueue, &hdev->tx_work);
3244 }
3245 
3246 /* Send ISO data */
hci_add_iso_hdr(struct sk_buff * skb,__u16 handle,__u8 flags)3247 static void hci_add_iso_hdr(struct sk_buff *skb, __u16 handle, __u8 flags)
3248 {
3249 	struct hci_iso_hdr *hdr;
3250 	int len = skb->len;
3251 
3252 	skb_push(skb, HCI_ISO_HDR_SIZE);
3253 	skb_reset_transport_header(skb);
3254 	hdr = (struct hci_iso_hdr *)skb_transport_header(skb);
3255 	hdr->handle = cpu_to_le16(hci_handle_pack(handle, flags));
3256 	hdr->dlen   = cpu_to_le16(len);
3257 }
3258 
hci_queue_iso(struct hci_conn * conn,struct sk_buff_head * queue,struct sk_buff * skb)3259 static void hci_queue_iso(struct hci_conn *conn, struct sk_buff_head *queue,
3260 			  struct sk_buff *skb)
3261 {
3262 	struct hci_dev *hdev = conn->hdev;
3263 	struct sk_buff *list;
3264 	__u16 flags;
3265 
3266 	skb->len = skb_headlen(skb);
3267 	skb->data_len = 0;
3268 
3269 	hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3270 
3271 	list = skb_shinfo(skb)->frag_list;
3272 
3273 	flags = hci_iso_flags_pack(list ? ISO_START : ISO_SINGLE, 0x00);
3274 	hci_add_iso_hdr(skb, conn->handle, flags);
3275 
3276 	if (!list) {
3277 		/* Non fragmented */
3278 		BT_DBG("%s nonfrag skb %p len %d", hdev->name, skb, skb->len);
3279 
3280 		skb_queue_tail(queue, skb);
3281 	} else {
3282 		/* Fragmented */
3283 		BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3284 
3285 		skb_shinfo(skb)->frag_list = NULL;
3286 
3287 		__skb_queue_tail(queue, skb);
3288 
3289 		do {
3290 			skb = list; list = list->next;
3291 
3292 			hci_skb_pkt_type(skb) = HCI_ISODATA_PKT;
3293 			flags = hci_iso_flags_pack(list ? ISO_CONT : ISO_END,
3294 						   0x00);
3295 			hci_add_iso_hdr(skb, conn->handle, flags);
3296 
3297 			BT_DBG("%s frag %p len %d", hdev->name, skb, skb->len);
3298 
3299 			__skb_queue_tail(queue, skb);
3300 		} while (list);
3301 	}
3302 }
3303 
hci_send_iso(struct hci_conn * conn,struct sk_buff * skb)3304 void hci_send_iso(struct hci_conn *conn, struct sk_buff *skb)
3305 {
3306 	struct hci_dev *hdev = conn->hdev;
3307 
3308 	BT_DBG("%s len %d", hdev->name, skb->len);
3309 
3310 	hci_queue_iso(conn, &conn->data_q, skb);
3311 
3312 	queue_work(hdev->workqueue, &hdev->tx_work);
3313 }
3314 
3315 /* ---- HCI TX task (outgoing data) ---- */
3316 
3317 /* HCI Connection scheduler */
hci_quote_sent(struct hci_conn * conn,int num,int * quote)3318 static inline void hci_quote_sent(struct hci_conn *conn, int num, int *quote)
3319 {
3320 	struct hci_dev *hdev;
3321 	int cnt, q;
3322 
3323 	if (!conn) {
3324 		*quote = 0;
3325 		return;
3326 	}
3327 
3328 	hdev = conn->hdev;
3329 
3330 	switch (conn->type) {
3331 	case ACL_LINK:
3332 		cnt = hdev->acl_cnt;
3333 		break;
3334 	case SCO_LINK:
3335 	case ESCO_LINK:
3336 		cnt = hdev->sco_cnt;
3337 		break;
3338 	case LE_LINK:
3339 		cnt = hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3340 		break;
3341 	case ISO_LINK:
3342 		cnt = hdev->iso_mtu ? hdev->iso_cnt :
3343 			hdev->le_mtu ? hdev->le_cnt : hdev->acl_cnt;
3344 		break;
3345 	default:
3346 		cnt = 0;
3347 		bt_dev_err(hdev, "unknown link type %d", conn->type);
3348 	}
3349 
3350 	q = cnt / num;
3351 	*quote = q ? q : 1;
3352 }
3353 
hci_low_sent(struct hci_dev * hdev,__u8 type,int * quote)3354 static struct hci_conn *hci_low_sent(struct hci_dev *hdev, __u8 type,
3355 				     int *quote)
3356 {
3357 	struct hci_conn_hash *h = &hdev->conn_hash;
3358 	struct hci_conn *conn = NULL, *c;
3359 	unsigned int num = 0, min = ~0;
3360 
3361 	/* We don't have to lock device here. Connections are always
3362 	 * added and removed with TX task disabled. */
3363 
3364 	rcu_read_lock();
3365 
3366 	list_for_each_entry_rcu(c, &h->list, list) {
3367 		if (c->type != type || skb_queue_empty(&c->data_q))
3368 			continue;
3369 
3370 		if (c->state != BT_CONNECTED && c->state != BT_CONFIG)
3371 			continue;
3372 
3373 		num++;
3374 
3375 		if (c->sent < min) {
3376 			min  = c->sent;
3377 			conn = c;
3378 		}
3379 
3380 		if (hci_conn_num(hdev, type) == num)
3381 			break;
3382 	}
3383 
3384 	rcu_read_unlock();
3385 
3386 	hci_quote_sent(conn, num, quote);
3387 
3388 	BT_DBG("conn %p quote %d", conn, *quote);
3389 	return conn;
3390 }
3391 
hci_link_tx_to(struct hci_dev * hdev,__u8 type)3392 static void hci_link_tx_to(struct hci_dev *hdev, __u8 type)
3393 {
3394 	struct hci_conn_hash *h = &hdev->conn_hash;
3395 	struct hci_conn *c;
3396 
3397 	bt_dev_err(hdev, "link tx timeout");
3398 
3399 	rcu_read_lock();
3400 
3401 	/* Kill stalled connections */
3402 	list_for_each_entry_rcu(c, &h->list, list) {
3403 		if (c->type == type && c->sent) {
3404 			bt_dev_err(hdev, "killing stalled connection %pMR",
3405 				   &c->dst);
3406 			/* hci_disconnect might sleep, so, we have to release
3407 			 * the RCU read lock before calling it.
3408 			 */
3409 			rcu_read_unlock();
3410 			hci_disconnect(c, HCI_ERROR_REMOTE_USER_TERM);
3411 			rcu_read_lock();
3412 		}
3413 	}
3414 
3415 	rcu_read_unlock();
3416 }
3417 
hci_chan_sent(struct hci_dev * hdev,__u8 type,int * quote)3418 static struct hci_chan *hci_chan_sent(struct hci_dev *hdev, __u8 type,
3419 				      int *quote)
3420 {
3421 	struct hci_conn_hash *h = &hdev->conn_hash;
3422 	struct hci_chan *chan = NULL;
3423 	unsigned int num = 0, min = ~0, cur_prio = 0;
3424 	struct hci_conn *conn;
3425 	int conn_num = 0;
3426 
3427 	BT_DBG("%s", hdev->name);
3428 
3429 	rcu_read_lock();
3430 
3431 	list_for_each_entry_rcu(conn, &h->list, list) {
3432 		struct hci_chan *tmp;
3433 
3434 		if (conn->type != type)
3435 			continue;
3436 
3437 		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3438 			continue;
3439 
3440 		conn_num++;
3441 
3442 		list_for_each_entry_rcu(tmp, &conn->chan_list, list) {
3443 			struct sk_buff *skb;
3444 
3445 			if (skb_queue_empty(&tmp->data_q))
3446 				continue;
3447 
3448 			skb = skb_peek(&tmp->data_q);
3449 			if (skb->priority < cur_prio)
3450 				continue;
3451 
3452 			if (skb->priority > cur_prio) {
3453 				num = 0;
3454 				min = ~0;
3455 				cur_prio = skb->priority;
3456 			}
3457 
3458 			num++;
3459 
3460 			if (conn->sent < min) {
3461 				min  = conn->sent;
3462 				chan = tmp;
3463 			}
3464 		}
3465 
3466 		if (hci_conn_num(hdev, type) == conn_num)
3467 			break;
3468 	}
3469 
3470 	rcu_read_unlock();
3471 
3472 	if (!chan)
3473 		return NULL;
3474 
3475 	hci_quote_sent(chan->conn, num, quote);
3476 
3477 	BT_DBG("chan %p quote %d", chan, *quote);
3478 	return chan;
3479 }
3480 
hci_prio_recalculate(struct hci_dev * hdev,__u8 type)3481 static void hci_prio_recalculate(struct hci_dev *hdev, __u8 type)
3482 {
3483 	struct hci_conn_hash *h = &hdev->conn_hash;
3484 	struct hci_conn *conn;
3485 	int num = 0;
3486 
3487 	BT_DBG("%s", hdev->name);
3488 
3489 	rcu_read_lock();
3490 
3491 	list_for_each_entry_rcu(conn, &h->list, list) {
3492 		struct hci_chan *chan;
3493 
3494 		if (conn->type != type)
3495 			continue;
3496 
3497 		if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3498 			continue;
3499 
3500 		num++;
3501 
3502 		list_for_each_entry_rcu(chan, &conn->chan_list, list) {
3503 			struct sk_buff *skb;
3504 
3505 			if (chan->sent) {
3506 				chan->sent = 0;
3507 				continue;
3508 			}
3509 
3510 			if (skb_queue_empty(&chan->data_q))
3511 				continue;
3512 
3513 			skb = skb_peek(&chan->data_q);
3514 			if (skb->priority >= HCI_PRIO_MAX - 1)
3515 				continue;
3516 
3517 			skb->priority = HCI_PRIO_MAX - 1;
3518 
3519 			BT_DBG("chan %p skb %p promoted to %d", chan, skb,
3520 			       skb->priority);
3521 		}
3522 
3523 		if (hci_conn_num(hdev, type) == num)
3524 			break;
3525 	}
3526 
3527 	rcu_read_unlock();
3528 
3529 }
3530 
__check_timeout(struct hci_dev * hdev,unsigned int cnt,u8 type)3531 static void __check_timeout(struct hci_dev *hdev, unsigned int cnt, u8 type)
3532 {
3533 	unsigned long last_tx;
3534 
3535 	if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
3536 		return;
3537 
3538 	switch (type) {
3539 	case LE_LINK:
3540 		last_tx = hdev->le_last_tx;
3541 		break;
3542 	default:
3543 		last_tx = hdev->acl_last_tx;
3544 		break;
3545 	}
3546 
3547 	/* tx timeout must be longer than maximum link supervision timeout
3548 	 * (40.9 seconds)
3549 	 */
3550 	if (!cnt && time_after(jiffies, last_tx + HCI_ACL_TX_TIMEOUT))
3551 		hci_link_tx_to(hdev, type);
3552 }
3553 
3554 /* Schedule SCO */
hci_sched_sco(struct hci_dev * hdev)3555 static void hci_sched_sco(struct hci_dev *hdev)
3556 {
3557 	struct hci_conn *conn;
3558 	struct sk_buff *skb;
3559 	int quote;
3560 
3561 	BT_DBG("%s", hdev->name);
3562 
3563 	if (!hci_conn_num(hdev, SCO_LINK))
3564 		return;
3565 
3566 	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, SCO_LINK, &quote))) {
3567 		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3568 			BT_DBG("skb %p len %d", skb, skb->len);
3569 			hci_send_frame(hdev, skb);
3570 
3571 			conn->sent++;
3572 			if (conn->sent == ~0)
3573 				conn->sent = 0;
3574 		}
3575 	}
3576 }
3577 
hci_sched_esco(struct hci_dev * hdev)3578 static void hci_sched_esco(struct hci_dev *hdev)
3579 {
3580 	struct hci_conn *conn;
3581 	struct sk_buff *skb;
3582 	int quote;
3583 
3584 	BT_DBG("%s", hdev->name);
3585 
3586 	if (!hci_conn_num(hdev, ESCO_LINK))
3587 		return;
3588 
3589 	while (hdev->sco_cnt && (conn = hci_low_sent(hdev, ESCO_LINK,
3590 						     &quote))) {
3591 		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3592 			BT_DBG("skb %p len %d", skb, skb->len);
3593 			hci_send_frame(hdev, skb);
3594 
3595 			conn->sent++;
3596 			if (conn->sent == ~0)
3597 				conn->sent = 0;
3598 		}
3599 	}
3600 }
3601 
hci_sched_acl_pkt(struct hci_dev * hdev)3602 static void hci_sched_acl_pkt(struct hci_dev *hdev)
3603 {
3604 	unsigned int cnt = hdev->acl_cnt;
3605 	struct hci_chan *chan;
3606 	struct sk_buff *skb;
3607 	int quote;
3608 
3609 	__check_timeout(hdev, cnt, ACL_LINK);
3610 
3611 	while (hdev->acl_cnt &&
3612 	       (chan = hci_chan_sent(hdev, ACL_LINK, &quote))) {
3613 		u32 priority = (skb_peek(&chan->data_q))->priority;
3614 		while (quote-- && (skb = skb_peek(&chan->data_q))) {
3615 			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3616 			       skb->len, skb->priority);
3617 
3618 			/* Stop if priority has changed */
3619 			if (skb->priority < priority)
3620 				break;
3621 
3622 			skb = skb_dequeue(&chan->data_q);
3623 
3624 			hci_conn_enter_active_mode(chan->conn,
3625 						   bt_cb(skb)->force_active);
3626 
3627 			hci_send_frame(hdev, skb);
3628 			hdev->acl_last_tx = jiffies;
3629 
3630 			hdev->acl_cnt--;
3631 			chan->sent++;
3632 			chan->conn->sent++;
3633 
3634 			/* Send pending SCO packets right away */
3635 			hci_sched_sco(hdev);
3636 			hci_sched_esco(hdev);
3637 		}
3638 	}
3639 
3640 	if (cnt != hdev->acl_cnt)
3641 		hci_prio_recalculate(hdev, ACL_LINK);
3642 }
3643 
hci_sched_acl(struct hci_dev * hdev)3644 static void hci_sched_acl(struct hci_dev *hdev)
3645 {
3646 	BT_DBG("%s", hdev->name);
3647 
3648 	/* No ACL link over BR/EDR controller */
3649 	if (!hci_conn_num(hdev, ACL_LINK))
3650 		return;
3651 
3652 	hci_sched_acl_pkt(hdev);
3653 }
3654 
hci_sched_le(struct hci_dev * hdev)3655 static void hci_sched_le(struct hci_dev *hdev)
3656 {
3657 	struct hci_chan *chan;
3658 	struct sk_buff *skb;
3659 	int quote, *cnt, tmp;
3660 
3661 	BT_DBG("%s", hdev->name);
3662 
3663 	if (!hci_conn_num(hdev, LE_LINK))
3664 		return;
3665 
3666 	cnt = hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
3667 
3668 	__check_timeout(hdev, *cnt, LE_LINK);
3669 
3670 	tmp = *cnt;
3671 	while (*cnt && (chan = hci_chan_sent(hdev, LE_LINK, &quote))) {
3672 		u32 priority = (skb_peek(&chan->data_q))->priority;
3673 		while (quote-- && (skb = skb_peek(&chan->data_q))) {
3674 			BT_DBG("chan %p skb %p len %d priority %u", chan, skb,
3675 			       skb->len, skb->priority);
3676 
3677 			/* Stop if priority has changed */
3678 			if (skb->priority < priority)
3679 				break;
3680 
3681 			skb = skb_dequeue(&chan->data_q);
3682 
3683 			hci_send_frame(hdev, skb);
3684 			hdev->le_last_tx = jiffies;
3685 
3686 			(*cnt)--;
3687 			chan->sent++;
3688 			chan->conn->sent++;
3689 
3690 			/* Send pending SCO packets right away */
3691 			hci_sched_sco(hdev);
3692 			hci_sched_esco(hdev);
3693 		}
3694 	}
3695 
3696 	if (*cnt != tmp)
3697 		hci_prio_recalculate(hdev, LE_LINK);
3698 }
3699 
3700 /* Schedule CIS */
hci_sched_iso(struct hci_dev * hdev)3701 static void hci_sched_iso(struct hci_dev *hdev)
3702 {
3703 	struct hci_conn *conn;
3704 	struct sk_buff *skb;
3705 	int quote, *cnt;
3706 
3707 	BT_DBG("%s", hdev->name);
3708 
3709 	if (!hci_conn_num(hdev, ISO_LINK))
3710 		return;
3711 
3712 	cnt = hdev->iso_pkts ? &hdev->iso_cnt :
3713 		hdev->le_pkts ? &hdev->le_cnt : &hdev->acl_cnt;
3714 	while (*cnt && (conn = hci_low_sent(hdev, ISO_LINK, &quote))) {
3715 		while (quote-- && (skb = skb_dequeue(&conn->data_q))) {
3716 			BT_DBG("skb %p len %d", skb, skb->len);
3717 			hci_send_frame(hdev, skb);
3718 
3719 			conn->sent++;
3720 			if (conn->sent == ~0)
3721 				conn->sent = 0;
3722 			(*cnt)--;
3723 		}
3724 	}
3725 }
3726 
hci_tx_work(struct work_struct * work)3727 static void hci_tx_work(struct work_struct *work)
3728 {
3729 	struct hci_dev *hdev = container_of(work, struct hci_dev, tx_work);
3730 	struct sk_buff *skb;
3731 
3732 	BT_DBG("%s acl %d sco %d le %d iso %d", hdev->name, hdev->acl_cnt,
3733 	       hdev->sco_cnt, hdev->le_cnt, hdev->iso_cnt);
3734 
3735 	if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
3736 		/* Schedule queues and send stuff to HCI driver */
3737 		hci_sched_sco(hdev);
3738 		hci_sched_esco(hdev);
3739 		hci_sched_iso(hdev);
3740 		hci_sched_acl(hdev);
3741 		hci_sched_le(hdev);
3742 	}
3743 
3744 	/* Send next queued raw (unknown type) packet */
3745 	while ((skb = skb_dequeue(&hdev->raw_q)))
3746 		hci_send_frame(hdev, skb);
3747 }
3748 
3749 /* ----- HCI RX task (incoming data processing) ----- */
3750 
3751 /* ACL data packet */
hci_acldata_packet(struct hci_dev * hdev,struct sk_buff * skb)3752 static void hci_acldata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3753 {
3754 	struct hci_acl_hdr *hdr;
3755 	struct hci_conn *conn;
3756 	__u16 handle, flags;
3757 
3758 	hdr = skb_pull_data(skb, sizeof(*hdr));
3759 	if (!hdr) {
3760 		bt_dev_err(hdev, "ACL packet too small");
3761 		goto drop;
3762 	}
3763 
3764 	handle = __le16_to_cpu(hdr->handle);
3765 	flags  = hci_flags(handle);
3766 	handle = hci_handle(handle);
3767 
3768 	bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
3769 		   handle, flags);
3770 
3771 	hdev->stat.acl_rx++;
3772 
3773 	hci_dev_lock(hdev);
3774 	conn = hci_conn_hash_lookup_handle(hdev, handle);
3775 	hci_dev_unlock(hdev);
3776 
3777 	if (conn) {
3778 		hci_conn_enter_active_mode(conn, BT_POWER_FORCE_ACTIVE_OFF);
3779 
3780 		/* Send to upper protocol */
3781 		l2cap_recv_acldata(conn, skb, flags);
3782 		return;
3783 	} else {
3784 		bt_dev_err(hdev, "ACL packet for unknown connection handle %d",
3785 			   handle);
3786 	}
3787 
3788 drop:
3789 	kfree_skb(skb);
3790 }
3791 
3792 /* SCO data packet */
hci_scodata_packet(struct hci_dev * hdev,struct sk_buff * skb)3793 static void hci_scodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3794 {
3795 	struct hci_sco_hdr *hdr;
3796 	struct hci_conn *conn;
3797 	__u16 handle, flags;
3798 
3799 	hdr = skb_pull_data(skb, sizeof(*hdr));
3800 	if (!hdr) {
3801 		bt_dev_err(hdev, "SCO packet too small");
3802 		goto drop;
3803 	}
3804 
3805 	handle = __le16_to_cpu(hdr->handle);
3806 	flags  = hci_flags(handle);
3807 	handle = hci_handle(handle);
3808 
3809 	bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
3810 		   handle, flags);
3811 
3812 	hdev->stat.sco_rx++;
3813 
3814 	hci_dev_lock(hdev);
3815 	conn = hci_conn_hash_lookup_handle(hdev, handle);
3816 	hci_dev_unlock(hdev);
3817 
3818 	if (conn) {
3819 		/* Send to upper protocol */
3820 		hci_skb_pkt_status(skb) = flags & 0x03;
3821 		sco_recv_scodata(conn, skb);
3822 		return;
3823 	} else {
3824 		bt_dev_err_ratelimited(hdev, "SCO packet for unknown connection handle %d",
3825 				       handle);
3826 	}
3827 
3828 drop:
3829 	kfree_skb(skb);
3830 }
3831 
hci_isodata_packet(struct hci_dev * hdev,struct sk_buff * skb)3832 static void hci_isodata_packet(struct hci_dev *hdev, struct sk_buff *skb)
3833 {
3834 	struct hci_iso_hdr *hdr;
3835 	struct hci_conn *conn;
3836 	__u16 handle, flags;
3837 
3838 	hdr = skb_pull_data(skb, sizeof(*hdr));
3839 	if (!hdr) {
3840 		bt_dev_err(hdev, "ISO packet too small");
3841 		goto drop;
3842 	}
3843 
3844 	handle = __le16_to_cpu(hdr->handle);
3845 	flags  = hci_flags(handle);
3846 	handle = hci_handle(handle);
3847 
3848 	bt_dev_dbg(hdev, "len %d handle 0x%4.4x flags 0x%4.4x", skb->len,
3849 		   handle, flags);
3850 
3851 	hci_dev_lock(hdev);
3852 	conn = hci_conn_hash_lookup_handle(hdev, handle);
3853 	hci_dev_unlock(hdev);
3854 
3855 	if (!conn) {
3856 		bt_dev_err(hdev, "ISO packet for unknown connection handle %d",
3857 			   handle);
3858 		goto drop;
3859 	}
3860 
3861 	/* Send to upper protocol */
3862 	iso_recv(conn, skb, flags);
3863 	return;
3864 
3865 drop:
3866 	kfree_skb(skb);
3867 }
3868 
hci_req_is_complete(struct hci_dev * hdev)3869 static bool hci_req_is_complete(struct hci_dev *hdev)
3870 {
3871 	struct sk_buff *skb;
3872 
3873 	skb = skb_peek(&hdev->cmd_q);
3874 	if (!skb)
3875 		return true;
3876 
3877 	return (bt_cb(skb)->hci.req_flags & HCI_REQ_START);
3878 }
3879 
hci_resend_last(struct hci_dev * hdev)3880 static void hci_resend_last(struct hci_dev *hdev)
3881 {
3882 	struct hci_command_hdr *sent;
3883 	struct sk_buff *skb;
3884 	u16 opcode;
3885 
3886 	if (!hdev->sent_cmd)
3887 		return;
3888 
3889 	sent = (void *) hdev->sent_cmd->data;
3890 	opcode = __le16_to_cpu(sent->opcode);
3891 	if (opcode == HCI_OP_RESET)
3892 		return;
3893 
3894 	skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
3895 	if (!skb)
3896 		return;
3897 
3898 	skb_queue_head(&hdev->cmd_q, skb);
3899 	queue_work(hdev->workqueue, &hdev->cmd_work);
3900 }
3901 
hci_req_cmd_complete(struct hci_dev * hdev,u16 opcode,u8 status,hci_req_complete_t * req_complete,hci_req_complete_skb_t * req_complete_skb)3902 void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
3903 			  hci_req_complete_t *req_complete,
3904 			  hci_req_complete_skb_t *req_complete_skb)
3905 {
3906 	struct sk_buff *skb;
3907 	unsigned long flags;
3908 
3909 	BT_DBG("opcode 0x%04x status 0x%02x", opcode, status);
3910 
3911 	/* If the completed command doesn't match the last one that was
3912 	 * sent we need to do special handling of it.
3913 	 */
3914 	if (!hci_sent_cmd_data(hdev, opcode)) {
3915 		/* Some CSR based controllers generate a spontaneous
3916 		 * reset complete event during init and any pending
3917 		 * command will never be completed. In such a case we
3918 		 * need to resend whatever was the last sent
3919 		 * command.
3920 		 */
3921 		if (test_bit(HCI_INIT, &hdev->flags) && opcode == HCI_OP_RESET)
3922 			hci_resend_last(hdev);
3923 
3924 		return;
3925 	}
3926 
3927 	/* If we reach this point this event matches the last command sent */
3928 	hci_dev_clear_flag(hdev, HCI_CMD_PENDING);
3929 
3930 	/* If the command succeeded and there's still more commands in
3931 	 * this request the request is not yet complete.
3932 	 */
3933 	if (!status && !hci_req_is_complete(hdev))
3934 		return;
3935 
3936 	skb = hdev->req_skb;
3937 
3938 	/* If this was the last command in a request the complete
3939 	 * callback would be found in hdev->req_skb instead of the
3940 	 * command queue (hdev->cmd_q).
3941 	 */
3942 	if (skb && bt_cb(skb)->hci.req_flags & HCI_REQ_SKB) {
3943 		*req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
3944 		return;
3945 	}
3946 
3947 	if (skb && bt_cb(skb)->hci.req_complete) {
3948 		*req_complete = bt_cb(skb)->hci.req_complete;
3949 		return;
3950 	}
3951 
3952 	/* Remove all pending commands belonging to this request */
3953 	spin_lock_irqsave(&hdev->cmd_q.lock, flags);
3954 	while ((skb = __skb_dequeue(&hdev->cmd_q))) {
3955 		if (bt_cb(skb)->hci.req_flags & HCI_REQ_START) {
3956 			__skb_queue_head(&hdev->cmd_q, skb);
3957 			break;
3958 		}
3959 
3960 		if (bt_cb(skb)->hci.req_flags & HCI_REQ_SKB)
3961 			*req_complete_skb = bt_cb(skb)->hci.req_complete_skb;
3962 		else
3963 			*req_complete = bt_cb(skb)->hci.req_complete;
3964 		dev_kfree_skb_irq(skb);
3965 	}
3966 	spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
3967 }
3968 
hci_rx_work(struct work_struct * work)3969 static void hci_rx_work(struct work_struct *work)
3970 {
3971 	struct hci_dev *hdev = container_of(work, struct hci_dev, rx_work);
3972 	struct sk_buff *skb;
3973 
3974 	BT_DBG("%s", hdev->name);
3975 
3976 	/* The kcov_remote functions used for collecting packet parsing
3977 	 * coverage information from this background thread and associate
3978 	 * the coverage with the syscall's thread which originally injected
3979 	 * the packet. This helps fuzzing the kernel.
3980 	 */
3981 	for (; (skb = skb_dequeue(&hdev->rx_q)); kcov_remote_stop()) {
3982 		kcov_remote_start_common(skb_get_kcov_handle(skb));
3983 
3984 		/* Send copy to monitor */
3985 		hci_send_to_monitor(hdev, skb);
3986 
3987 		if (atomic_read(&hdev->promisc)) {
3988 			/* Send copy to the sockets */
3989 			hci_send_to_sock(hdev, skb);
3990 		}
3991 
3992 		/* If the device has been opened in HCI_USER_CHANNEL,
3993 		 * the userspace has exclusive access to device.
3994 		 * When device is HCI_INIT, we still need to process
3995 		 * the data packets to the driver in order
3996 		 * to complete its setup().
3997 		 */
3998 		if (hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
3999 		    !test_bit(HCI_INIT, &hdev->flags)) {
4000 			kfree_skb(skb);
4001 			continue;
4002 		}
4003 
4004 		if (test_bit(HCI_INIT, &hdev->flags)) {
4005 			/* Don't process data packets in this states. */
4006 			switch (hci_skb_pkt_type(skb)) {
4007 			case HCI_ACLDATA_PKT:
4008 			case HCI_SCODATA_PKT:
4009 			case HCI_ISODATA_PKT:
4010 				kfree_skb(skb);
4011 				continue;
4012 			}
4013 		}
4014 
4015 		/* Process frame */
4016 		switch (hci_skb_pkt_type(skb)) {
4017 		case HCI_EVENT_PKT:
4018 			BT_DBG("%s Event packet", hdev->name);
4019 			hci_event_packet(hdev, skb);
4020 			break;
4021 
4022 		case HCI_ACLDATA_PKT:
4023 			BT_DBG("%s ACL data packet", hdev->name);
4024 			hci_acldata_packet(hdev, skb);
4025 			break;
4026 
4027 		case HCI_SCODATA_PKT:
4028 			BT_DBG("%s SCO data packet", hdev->name);
4029 			hci_scodata_packet(hdev, skb);
4030 			break;
4031 
4032 		case HCI_ISODATA_PKT:
4033 			BT_DBG("%s ISO data packet", hdev->name);
4034 			hci_isodata_packet(hdev, skb);
4035 			break;
4036 
4037 		default:
4038 			kfree_skb(skb);
4039 			break;
4040 		}
4041 	}
4042 }
4043 
hci_send_cmd_sync(struct hci_dev * hdev,struct sk_buff * skb)4044 static void hci_send_cmd_sync(struct hci_dev *hdev, struct sk_buff *skb)
4045 {
4046 	int err;
4047 
4048 	bt_dev_dbg(hdev, "skb %p", skb);
4049 
4050 	kfree_skb(hdev->sent_cmd);
4051 
4052 	hdev->sent_cmd = skb_clone(skb, GFP_KERNEL);
4053 	if (!hdev->sent_cmd) {
4054 		skb_queue_head(&hdev->cmd_q, skb);
4055 		queue_work(hdev->workqueue, &hdev->cmd_work);
4056 		return;
4057 	}
4058 
4059 	err = hci_send_frame(hdev, skb);
4060 	if (err < 0) {
4061 		hci_cmd_sync_cancel_sync(hdev, -err);
4062 		return;
4063 	}
4064 
4065 	if (hdev->req_status == HCI_REQ_PEND &&
4066 	    !hci_dev_test_and_set_flag(hdev, HCI_CMD_PENDING)) {
4067 		kfree_skb(hdev->req_skb);
4068 		hdev->req_skb = skb_clone(hdev->sent_cmd, GFP_KERNEL);
4069 	}
4070 
4071 	atomic_dec(&hdev->cmd_cnt);
4072 }
4073 
hci_cmd_work(struct work_struct * work)4074 static void hci_cmd_work(struct work_struct *work)
4075 {
4076 	struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_work);
4077 	struct sk_buff *skb;
4078 
4079 	BT_DBG("%s cmd_cnt %d cmd queued %d", hdev->name,
4080 	       atomic_read(&hdev->cmd_cnt), skb_queue_len(&hdev->cmd_q));
4081 
4082 	/* Send queued commands */
4083 	if (atomic_read(&hdev->cmd_cnt)) {
4084 		skb = skb_dequeue(&hdev->cmd_q);
4085 		if (!skb)
4086 			return;
4087 
4088 		hci_send_cmd_sync(hdev, skb);
4089 
4090 		rcu_read_lock();
4091 		if (test_bit(HCI_RESET, &hdev->flags) ||
4092 		    hci_dev_test_flag(hdev, HCI_CMD_DRAIN_WORKQUEUE))
4093 			cancel_delayed_work(&hdev->cmd_timer);
4094 		else
4095 			queue_delayed_work(hdev->workqueue, &hdev->cmd_timer,
4096 					   HCI_CMD_TIMEOUT);
4097 		rcu_read_unlock();
4098 	}
4099 }
4100