hci_core.c 124 KB
Newer Older
1
/*
Linus Torvalds's avatar
Linus Torvalds committed
2
3
   BlueZ - Bluetooth protocol stack for Linux
   Copyright (C) 2000-2001 Qualcomm Incorporated
4
   Copyright (C) 2011 ProFUSION Embedded Systems
Linus Torvalds's avatar
Linus Torvalds committed
5
6
7
8
9
10
11
12
13
14
15

   Written 2000,2001 by Maxim Krasnyansky <maxk@qualcomm.com>

   This program is free software; you can redistribute it and/or modify
   it under the terms of the GNU General Public License version 2 as
   published by the Free Software Foundation;

   THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
   OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
   FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
   IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
16
17
18
   CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
   WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
   ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
Linus Torvalds's avatar
Linus Torvalds committed
19
20
   OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.

21
22
   ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
   COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
Linus Torvalds's avatar
Linus Torvalds committed
23
24
25
26
27
   SOFTWARE IS DISCLAIMED.
*/

/* Bluetooth HCI core. */

28
29
#include <linux/export.h>
#include <linux/rfkill.h>
30
#include <linux/debugfs.h>
31
#include <linux/crypto.h>
32
#include <linux/property.h>
33
34
#include <linux/suspend.h>
#include <linux/wait.h>
35
#include <asm/unaligned.h>
Linus Torvalds's avatar
Linus Torvalds committed
36
37
38

#include <net/bluetooth/bluetooth.h>
#include <net/bluetooth/hci_core.h>
39
#include <net/bluetooth/l2cap.h>
40
#include <net/bluetooth/mgmt.h>
Linus Torvalds's avatar
Linus Torvalds committed
41

42
#include "hci_request.h"
43
#include "hci_debugfs.h"
44
#include "smp.h"
45
#include "leds.h"
46
#include "msft.h"
47
#include "aosp.h"
48

49
static void hci_rx_work(struct work_struct *work);
50
static void hci_cmd_work(struct work_struct *work);
51
static void hci_tx_work(struct work_struct *work);
Linus Torvalds's avatar
Linus Torvalds committed
52
53
54
55
56
57
58

/* HCI device list */
LIST_HEAD(hci_dev_list);
DEFINE_RWLOCK(hci_dev_list_lock);

/* HCI callback list */
LIST_HEAD(hci_cb_list);
59
DEFINE_MUTEX(hci_cb_list_lock);
Linus Torvalds's avatar
Linus Torvalds committed
60

61
62
63
/* HCI ID Numbering */
static DEFINE_IDA(hci_index_ida);

64
65
/* ---- HCI debugfs entries ---- */

66
67
68
69
70
71
static ssize_t dut_mode_read(struct file *file, char __user *user_buf,
			     size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	char buf[3];

72
	buf[0] = hci_dev_test_flag(hdev, HCI_DUT_MODE) ? 'Y' : 'N';
73
74
75
76
77
78
79
80
81
82
83
	buf[1] = '\n';
	buf[2] = '\0';
	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
}

static ssize_t dut_mode_write(struct file *file, const char __user *user_buf,
			      size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	struct sk_buff *skb;
	bool enable;
84
	int err;
85
86
87
88

	if (!test_bit(HCI_UP, &hdev->flags))
		return -ENETDOWN;

89
90
91
	err = kstrtobool_from_user(user_buf, count, &enable);
	if (err)
		return err;
92

93
	if (enable == hci_dev_test_flag(hdev, HCI_DUT_MODE))
94
95
		return -EALREADY;

96
	hci_req_sync_lock(hdev);
97
98
99
100
101
102
	if (enable)
		skb = __hci_cmd_sync(hdev, HCI_OP_ENABLE_DUT_MODE, 0, NULL,
				     HCI_CMD_TIMEOUT);
	else
		skb = __hci_cmd_sync(hdev, HCI_OP_RESET, 0, NULL,
				     HCI_CMD_TIMEOUT);
103
	hci_req_sync_unlock(hdev);
104
105
106
107
108
109

	if (IS_ERR(skb))
		return PTR_ERR(skb);

	kfree_skb(skb);

110
	hci_dev_change_flag(hdev, HCI_DUT_MODE);
111
112
113
114
115
116
117
118
119
120
121

	return count;
}

static const struct file_operations dut_mode_fops = {
	.open		= simple_open,
	.read		= dut_mode_read,
	.write		= dut_mode_write,
	.llseek		= default_llseek,
};

122
123
124
125
126
127
static ssize_t vendor_diag_read(struct file *file, char __user *user_buf,
				size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	char buf[3];

128
	buf[0] = hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) ? 'Y' : 'N';
129
130
131
132
133
134
135
136
137
138
139
140
	buf[1] = '\n';
	buf[2] = '\0';
	return simple_read_from_buffer(user_buf, count, ppos, buf, 2);
}

static ssize_t vendor_diag_write(struct file *file, const char __user *user_buf,
				 size_t count, loff_t *ppos)
{
	struct hci_dev *hdev = file->private_data;
	bool enable;
	int err;

141
142
143
	err = kstrtobool_from_user(user_buf, count, &enable);
	if (err)
		return err;
144

145
	/* When the diagnostic flags are not persistent and the transport
146
147
148
	 * is not active or in user channel operation, then there is no need
	 * for the vendor callback. Instead just store the desired value and
	 * the setting will be programmed when the controller gets powered on.
149
150
	 */
	if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
151
152
	    (!test_bit(HCI_RUNNING, &hdev->flags) ||
	     hci_dev_test_flag(hdev, HCI_USER_CHANNEL)))
153
154
		goto done;

155
	hci_req_sync_lock(hdev);
156
	err = hdev->set_diag(hdev, enable);
157
	hci_req_sync_unlock(hdev);
158
159
160
161

	if (err < 0)
		return err;

162
done:
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
	if (enable)
		hci_dev_set_flag(hdev, HCI_VENDOR_DIAG);
	else
		hci_dev_clear_flag(hdev, HCI_VENDOR_DIAG);

	return count;
}

static const struct file_operations vendor_diag_fops = {
	.open		= simple_open,
	.read		= vendor_diag_read,
	.write		= vendor_diag_write,
	.llseek		= default_llseek,
};

178
179
180
181
182
183
184
185
186
187
static void hci_debugfs_create_basic(struct hci_dev *hdev)
{
	debugfs_create_file("dut_mode", 0644, hdev->debugfs, hdev,
			    &dut_mode_fops);

	if (hdev->set_diag)
		debugfs_create_file("vendor_diag", 0644, hdev->debugfs, hdev,
				    &vendor_diag_fops);
}

188
static int hci_reset_req(struct hci_request *req, unsigned long opt)
Linus Torvalds's avatar
Linus Torvalds committed
189
{
190
	BT_DBG("%s %ld", req->hdev->name, opt);
Linus Torvalds's avatar
Linus Torvalds committed
191
192

	/* Reset device */
193
194
	set_bit(HCI_RESET, &req->hdev->flags);
	hci_req_add(req, HCI_OP_RESET, 0, NULL);
195
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
196
197
}

198
static void bredr_init(struct hci_request *req)
Linus Torvalds's avatar
Linus Torvalds committed
199
{
200
	req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_PACKET_BASED;
201

Linus Torvalds's avatar
Linus Torvalds committed
202
	/* Read Local Supported Features */
203
	hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
Linus Torvalds's avatar
Linus Torvalds committed
204

205
	/* Read Local Version */
206
	hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
207
208

	/* Read BD Address */
209
	hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
Linus Torvalds's avatar
Linus Torvalds committed
210
211
}

212
static void amp_init1(struct hci_request *req)
213
{
214
	req->hdev->flow_ctl_mode = HCI_FLOW_CTL_MODE_BLOCK_BASED;
215

216
	/* Read Local Version */
217
	hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);
218

219
220
221
	/* Read Local Supported Commands */
	hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);

222
	/* Read Local AMP Info */
223
	hci_req_add(req, HCI_OP_READ_LOCAL_AMP_INFO, 0, NULL);
224
225

	/* Read Data Blk size */
226
	hci_req_add(req, HCI_OP_READ_DATA_BLOCK_SIZE, 0, NULL);
227

228
229
230
	/* Read Flow Control Mode */
	hci_req_add(req, HCI_OP_READ_FLOW_CONTROL_MODE, 0, NULL);

231
232
	/* Read Location Data */
	hci_req_add(req, HCI_OP_READ_LOCATION_DATA, 0, NULL);
233
234
}

235
static int amp_init2(struct hci_request *req)
236
237
238
239
240
241
242
{
	/* Read Local Supported Features. Not all AMP controllers
	 * support this so it's placed conditionally in the second
	 * stage init.
	 */
	if (req->hdev->commands[14] & 0x20)
		hci_req_add(req, HCI_OP_READ_LOCAL_FEATURES, 0, NULL);
243
244

	return 0;
245
246
}

247
static int hci_init1_req(struct hci_request *req, unsigned long opt)
248
{
249
	struct hci_dev *hdev = req->hdev;
250
251
252

	BT_DBG("%s %ld", hdev->name, opt);

253
254
	/* Reset */
	if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
255
		hci_reset_req(req, 0);
256

257
	switch (hdev->dev_type) {
258
	case HCI_PRIMARY:
259
		bredr_init(req);
260
261
		break;
	case HCI_AMP:
262
		amp_init1(req);
263
264
		break;
	default:
265
		bt_dev_err(hdev, "Unknown device type %d", hdev->dev_type);
266
267
		break;
	}
268
269

	return 0;
270
271
}

272
static void bredr_setup(struct hci_request *req)
273
274
275
276
277
{
	__le16 param;
	__u8 flt_type;

	/* Read Buffer Size (ACL mtu, max pkt, etc.) */
278
	hci_req_add(req, HCI_OP_READ_BUFFER_SIZE, 0, NULL);
279
280

	/* Read Class of Device */
281
	hci_req_add(req, HCI_OP_READ_CLASS_OF_DEV, 0, NULL);
282
283

	/* Read Local Name */
284
	hci_req_add(req, HCI_OP_READ_LOCAL_NAME, 0, NULL);
285
286

	/* Read Voice Setting */
287
	hci_req_add(req, HCI_OP_READ_VOICE_SETTING, 0, NULL);
288

289
290
291
	/* Read Number of Supported IAC */
	hci_req_add(req, HCI_OP_READ_NUM_SUPPORTED_IAC, 0, NULL);

292
293
294
	/* Read Current IAC LAP */
	hci_req_add(req, HCI_OP_READ_CURRENT_IAC_LAP, 0, NULL);

295
296
	/* Clear Event Filters */
	flt_type = HCI_FLT_CLEAR_ALL;
297
	hci_req_add(req, HCI_OP_SET_EVENT_FLT, 1, &flt_type);
298
299

	/* Connection accept timeout ~20 secs */
300
	param = cpu_to_le16(0x7d00);
301
	hci_req_add(req, HCI_OP_WRITE_CA_TIMEOUT, 2, &param);
302
303
}

304
static void le_setup(struct hci_request *req)
305
{
306
307
	struct hci_dev *hdev = req->hdev;

308
	/* Read LE Buffer Size */
309
	hci_req_add(req, HCI_OP_LE_READ_BUFFER_SIZE, 0, NULL);
310
311

	/* Read LE Local Supported Features */
312
	hci_req_add(req, HCI_OP_LE_READ_LOCAL_FEATURES, 0, NULL);
313

314
315
316
	/* Read LE Supported States */
	hci_req_add(req, HCI_OP_LE_READ_SUPPORTED_STATES, 0, NULL);

317
318
	/* LE-only controllers have LE implicitly enabled */
	if (!lmp_bredr_capable(hdev))
319
		hci_dev_set_flag(hdev, HCI_LE_ENABLED);
320
321
}

322
static void hci_setup_event_mask(struct hci_request *req)
323
{
324
325
	struct hci_dev *hdev = req->hdev;

326
327
328
329
330
331
332
333
334
335
336
337
338
339
	/* The second byte is 0xff instead of 0x9f (two reserved bits
	 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
	 * command otherwise.
	 */
	u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };

	/* CSR 1.1 dongles does not accept any bitfield so don't try to set
	 * any event mask for pre 1.2 devices.
	 */
	if (hdev->hci_ver < BLUETOOTH_VER_1_2)
		return;

	if (lmp_bredr_capable(hdev)) {
		events[4] |= 0x01; /* Flow Specification Complete */
340
341
342
343
344
345
	} else {
		/* Use a different default for LE-only devices */
		memset(events, 0, sizeof(events));
		events[1] |= 0x20; /* Command Complete */
		events[1] |= 0x40; /* Command Status */
		events[1] |= 0x80; /* Hardware Error */
346
347
348
349
350
351
352
353
354
355
356
357
358
359
360
361
362
363

		/* If the controller supports the Disconnect command, enable
		 * the corresponding event. In addition enable packet flow
		 * control related events.
		 */
		if (hdev->commands[0] & 0x20) {
			events[0] |= 0x10; /* Disconnection Complete */
			events[2] |= 0x04; /* Number of Completed Packets */
			events[3] |= 0x02; /* Data Buffer Overflow */
		}

		/* If the controller supports the Read Remote Version
		 * Information command, enable the corresponding event.
		 */
		if (hdev->commands[2] & 0x80)
			events[1] |= 0x08; /* Read Remote Version Information
					    * Complete
					    */
364
365
366
367
368

		if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
			events[0] |= 0x80; /* Encryption Change */
			events[5] |= 0x80; /* Encryption Key Refresh Complete */
		}
369
370
	}

371
372
	if (lmp_inq_rssi_capable(hdev) ||
	    test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
373
374
		events[4] |= 0x02; /* Inquiry Result with RSSI */

375
376
377
378
379
380
381
382
	if (lmp_ext_feat_capable(hdev))
		events[4] |= 0x04; /* Read Remote Extended Features Complete */

	if (lmp_esco_capable(hdev)) {
		events[5] |= 0x08; /* Synchronous Connection Complete */
		events[5] |= 0x10; /* Synchronous Connection Changed */
	}

383
384
385
386
387
388
389
390
391
392
393
394
395
396
397
398
399
400
401
402
403
404
405
406
407
408
409
410
411
412
413
414
	if (lmp_sniffsubr_capable(hdev))
		events[5] |= 0x20; /* Sniff Subrating */

	if (lmp_pause_enc_capable(hdev))
		events[5] |= 0x80; /* Encryption Key Refresh Complete */

	if (lmp_ext_inq_capable(hdev))
		events[5] |= 0x40; /* Extended Inquiry Result */

	if (lmp_no_flush_capable(hdev))
		events[7] |= 0x01; /* Enhanced Flush Complete */

	if (lmp_lsto_capable(hdev))
		events[6] |= 0x80; /* Link Supervision Timeout Changed */

	if (lmp_ssp_capable(hdev)) {
		events[6] |= 0x01;	/* IO Capability Request */
		events[6] |= 0x02;	/* IO Capability Response */
		events[6] |= 0x04;	/* User Confirmation Request */
		events[6] |= 0x08;	/* User Passkey Request */
		events[6] |= 0x10;	/* Remote OOB Data Request */
		events[6] |= 0x20;	/* Simple Pairing Complete */
		events[7] |= 0x04;	/* User Passkey Notification */
		events[7] |= 0x08;	/* Keypress Notification */
		events[7] |= 0x10;	/* Remote Host Supported
					 * Features Notification
					 */
	}

	if (lmp_le_capable(hdev))
		events[7] |= 0x20;	/* LE Meta-Event */

415
	hci_req_add(req, HCI_OP_SET_EVENT_MASK, sizeof(events), events);
416
417
}

418
static int hci_init2_req(struct hci_request *req, unsigned long opt)
419
{
420
421
	struct hci_dev *hdev = req->hdev;

422
423
424
	if (hdev->dev_type == HCI_AMP)
		return amp_init2(req);

425
	if (lmp_bredr_capable(hdev))
426
		bredr_setup(req);
427
	else
428
		hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
429
430

	if (lmp_le_capable(hdev))
431
		le_setup(req);
432

433
434
435
436
437
438
439
	/* All Bluetooth 1.2 and later controllers should support the
	 * HCI command for reading the local supported commands.
	 *
	 * Unfortunately some controllers indicate Bluetooth 1.2 support,
	 * but do not have support for this command. If that is the case,
	 * the driver can quirk the behavior and skip reading the local
	 * supported commands.
440
	 */
441
442
	if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
	    !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
443
		hci_req_add(req, HCI_OP_READ_LOCAL_COMMANDS, 0, NULL);
444
445

	if (lmp_ssp_capable(hdev)) {
446
447
448
449
450
451
452
453
		/* When SSP is available, then the host features page
		 * should also be available as well. However some
		 * controllers list the max_page as 0 as long as SSP
		 * has not been enabled. To achieve proper debugging
		 * output, force the minimum max_page to 1 at least.
		 */
		hdev->max_page = 0x01;

454
		if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) {
455
			u8 mode = 0x01;
456

457
458
			hci_req_add(req, HCI_OP_WRITE_SSP_MODE,
				    sizeof(mode), &mode);
459
460
461
462
463
464
		} else {
			struct hci_cp_write_eir cp;

			memset(hdev->eir, 0, sizeof(hdev->eir));
			memset(&cp, 0, sizeof(cp));

465
			hci_req_add(req, HCI_OP_WRITE_EIR, sizeof(cp), &cp);
466
467
468
		}
	}

469
470
	if (lmp_inq_rssi_capable(hdev) ||
	    test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks)) {
471
472
473
474
475
476
477
478
479
480
		u8 mode;

		/* If Extended Inquiry Result events are supported, then
		 * they are clearly preferred over Inquiry Result with RSSI
		 * events.
		 */
		mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;

		hci_req_add(req, HCI_OP_WRITE_INQUIRY_MODE, 1, &mode);
	}
481
482

	if (lmp_inq_tx_pwr_capable(hdev))
483
		hci_req_add(req, HCI_OP_READ_INQ_RSP_TX_POWER, 0, NULL);
484
485
486
487
488

	if (lmp_ext_feat_capable(hdev)) {
		struct hci_cp_read_local_ext_features cp;

		cp.page = 0x01;
489
490
		hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
			    sizeof(cp), &cp);
491
492
	}

493
	if (hci_dev_test_flag(hdev, HCI_LINK_SECURITY)) {
494
		u8 enable = 1;
495
496
		hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, sizeof(enable),
			    &enable);
497
	}
498
499

	return 0;
500
501
}

502
static void hci_setup_link_policy(struct hci_request *req)
503
{
504
	struct hci_dev *hdev = req->hdev;
505
506
507
508
509
510
511
512
513
514
515
516
517
	struct hci_cp_write_def_link_policy cp;
	u16 link_policy = 0;

	if (lmp_rswitch_capable(hdev))
		link_policy |= HCI_LP_RSWITCH;
	if (lmp_hold_capable(hdev))
		link_policy |= HCI_LP_HOLD;
	if (lmp_sniff_capable(hdev))
		link_policy |= HCI_LP_SNIFF;
	if (lmp_park_capable(hdev))
		link_policy |= HCI_LP_PARK;

	cp.policy = cpu_to_le16(link_policy);
518
	hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, sizeof(cp), &cp);
519
520
}

521
static void hci_set_le_support(struct hci_request *req)
522
{
523
	struct hci_dev *hdev = req->hdev;
524
525
	struct hci_cp_write_le_host_supported cp;

526
527
528
529
	/* LE-only devices do not support explicit enablement */
	if (!lmp_bredr_capable(hdev))
		return;

530
531
	memset(&cp, 0, sizeof(cp));

532
	if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
533
		cp.le = 0x01;
534
		cp.simul = 0x00;
535
536
537
	}

	if (cp.le != lmp_host_le_capable(hdev))
538
539
		hci_req_add(req, HCI_OP_WRITE_LE_HOST_SUPPORTED, sizeof(cp),
			    &cp);
540
541
}

542
543
544
545
static void hci_set_event_mask_page_2(struct hci_request *req)
{
	struct hci_dev *hdev = req->hdev;
	u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
546
	bool changed = false;
547
548
549
550

	/* If Connectionless Slave Broadcast master role is supported
	 * enable all necessary events for it.
	 */
551
	if (lmp_csb_master_capable(hdev)) {
552
553
554
555
		events[1] |= 0x40;	/* Triggered Clock Capture */
		events[1] |= 0x80;	/* Synchronization Train Complete */
		events[2] |= 0x10;	/* Slave Page Response Timeout */
		events[2] |= 0x20;	/* CSB Channel Map Change */
556
		changed = true;
557
558
559
560
561
	}

	/* If Connectionless Slave Broadcast slave role is supported
	 * enable all necessary events for it.
	 */
562
	if (lmp_csb_slave_capable(hdev)) {
563
564
565
566
		events[2] |= 0x01;	/* Synchronization Train Received */
		events[2] |= 0x02;	/* CSB Receive */
		events[2] |= 0x04;	/* CSB Timeout */
		events[2] |= 0x08;	/* Truncated Page Complete */
567
		changed = true;
568
569
	}

570
	/* Enable Authenticated Payload Timeout Expired event if supported */
571
	if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
572
		events[2] |= 0x80;
573
574
		changed = true;
	}
575

576
577
578
579
580
581
582
583
584
	/* Some Broadcom based controllers indicate support for Set Event
	 * Mask Page 2 command, but then actually do not support it. Since
	 * the default value is all bits set to zero, the command is only
	 * required if the event mask has to be changed. In case no change
	 * to the event mask is needed, skip this command.
	 */
	if (changed)
		hci_req_add(req, HCI_OP_SET_EVENT_MASK_PAGE_2,
			    sizeof(events), events);
585
586
}

587
static int hci_init3_req(struct hci_request *req, unsigned long opt)
588
{
589
	struct hci_dev *hdev = req->hdev;
590
	u8 p;
591

592
593
	hci_setup_event_mask(req);

594
595
	if (hdev->commands[6] & 0x20 &&
	    !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
596
597
598
599
600
601
602
		struct hci_cp_read_stored_link_key cp;

		bacpy(&cp.bdaddr, BDADDR_ANY);
		cp.read_all = 0x01;
		hci_req_add(req, HCI_OP_READ_STORED_LINK_KEY, sizeof(cp), &cp);
	}

603
	if (hdev->commands[5] & 0x10)
604
		hci_setup_link_policy(req);
605

606
607
608
	if (hdev->commands[8] & 0x01)
		hci_req_add(req, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 0, NULL);

609
610
	if (hdev->commands[18] & 0x04 &&
	    !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
611
612
		hci_req_add(req, HCI_OP_READ_DEF_ERR_DATA_REPORTING, 0, NULL);

613
614
615
616
617
618
619
	/* Some older Broadcom based Bluetooth 1.2 controllers do not
	 * support the Read Page Scan Type command. Check support for
	 * this command in the bit mask of supported commands.
	 */
	if (hdev->commands[13] & 0x01)
		hci_req_add(req, HCI_OP_READ_PAGE_SCAN_TYPE, 0, NULL);

620
621
622
623
	if (lmp_le_capable(hdev)) {
		u8 events[8];

		memset(events, 0, sizeof(events));
624
625
626

		if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
			events[0] |= 0x10;	/* LE Long Term Key Request */
627
628
629
630
631
632
633
634
635

		/* If controller supports the Connection Parameters Request
		 * Link Layer Procedure, enable the corresponding event.
		 */
		if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
			events[0] |= 0x20;	/* LE Remote Connection
						 * Parameter Request
						 */

636
637
638
639
640
641
		/* If the controller supports the Data Length Extension
		 * feature, enable the corresponding event.
		 */
		if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
			events[0] |= 0x40;	/* LE Data Length Change */

642
643
644
645
646
647
648
649
		/* If the controller supports LL Privacy feature, enable
		 * the corresponding event.
		 */
		if (hdev->le_features[0] & HCI_LE_LL_PRIVACY)
			events[1] |= 0x02;	/* LE Enhanced Connection
						 * Complete
						 */

650
		/* If the controller supports Extended Scanner Filter
651
		 * Policies, enable the corresponding event.
652
653
654
655
656
657
		 */
		if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
			events[1] |= 0x04;	/* LE Direct Advertising
						 * Report
						 */

658
659
660
661
662
663
664
665
		/* If the controller supports Channel Selection Algorithm #2
		 * feature, enable the corresponding event.
		 */
		if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
			events[2] |= 0x08;	/* LE Channel Selection
						 * Algorithm
						 */

666
667
668
669
670
671
672
673
674
675
676
677
678
679
680
681
682
683
684
685
686
687
688
689
690
691
692
693
		/* If the controller supports the LE Set Scan Enable command,
		 * enable the corresponding advertising report event.
		 */
		if (hdev->commands[26] & 0x08)
			events[0] |= 0x02;	/* LE Advertising Report */

		/* If the controller supports the LE Create Connection
		 * command, enable the corresponding event.
		 */
		if (hdev->commands[26] & 0x10)
			events[0] |= 0x01;	/* LE Connection Complete */

		/* If the controller supports the LE Connection Update
		 * command, enable the corresponding event.
		 */
		if (hdev->commands[27] & 0x04)
			events[0] |= 0x04;	/* LE Connection Update
						 * Complete
						 */

		/* If the controller supports the LE Read Remote Used Features
		 * command, enable the corresponding event.
		 */
		if (hdev->commands[27] & 0x20)
			events[0] |= 0x08;	/* LE Read Remote Used
						 * Features Complete
						 */

694
695
696
697
698
699
700
701
702
703
704
705
706
707
		/* If the controller supports the LE Read Local P-256
		 * Public Key command, enable the corresponding event.
		 */
		if (hdev->commands[34] & 0x02)
			events[0] |= 0x80;	/* LE Read Local P-256
						 * Public Key Complete
						 */

		/* If the controller supports the LE Generate DHKey
		 * command, enable the corresponding event.
		 */
		if (hdev->commands[34] & 0x04)
			events[1] |= 0x01;	/* LE Generate DHKey Complete */

708
709
710
711
712
713
		/* If the controller supports the LE Set Default PHY or
		 * LE Set PHY commands, enable the corresponding event.
		 */
		if (hdev->commands[35] & (0x20 | 0x40))
			events[1] |= 0x08;        /* LE PHY Update Complete */

714
715
716
717
718
719
720
721
722
		/* If the controller supports LE Set Extended Scan Parameters
		 * and LE Set Extended Scan Enable commands, enable the
		 * corresponding event.
		 */
		if (use_ext_scan(hdev))
			events[1] |= 0x10;	/* LE Extended Advertising
						 * Report
						 */

723
724
725
726
727
728
729
730
		/* If the controller supports the LE Extended Advertising
		 * command, enable the corresponding event.
		 */
		if (ext_adv_capable(hdev))
			events[2] |= 0x02;	/* LE Advertising Set
						 * Terminated
						 */

731
732
733
		hci_req_add(req, HCI_OP_LE_SET_EVENT_MASK, sizeof(events),
			    events);

734
735
736
737
738
739
740
741
		/* Read LE Advertising Channel TX Power */
		if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
			/* HCI TS spec forbids mixing of legacy and extended
			 * advertising commands wherein READ_ADV_TX_POWER is
			 * also included. So do not call it if extended adv
			 * is supported otherwise controller will return
			 * COMMAND_DISALLOWED for extended commands.
			 */
742
743
744
			hci_req_add(req, HCI_OP_LE_READ_ADV_TX_POWER, 0, NULL);
		}

745
746
747
748
749
750
		if (hdev->commands[38] & 0x80) {
			/* Read LE Min/Max Tx Power*/
			hci_req_add(req, HCI_OP_LE_READ_TRANSMIT_POWER,
				    0, NULL);
		}

751
752
753
754
755
756
757
758
759
760
761
		if (hdev->commands[26] & 0x40) {
			/* Read LE White List Size */
			hci_req_add(req, HCI_OP_LE_READ_WHITE_LIST_SIZE,
				    0, NULL);
		}

		if (hdev->commands[26] & 0x80) {
			/* Clear LE White List */
			hci_req_add(req, HCI_OP_LE_CLEAR_WHITE_LIST, 0, NULL);
		}

762
763
764
765
766
767
		if (hdev->commands[34] & 0x40) {
			/* Read LE Resolving List Size */
			hci_req_add(req, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
				    0, NULL);
		}

768
769
770
771
772
		if (hdev->commands[34] & 0x20) {
			/* Clear LE Resolving List */
			hci_req_add(req, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL);
		}

773
		if (hdev->commands[35] & 0x04) {
774
775
776
777
778
779
780
			__le16 rpa_timeout = cpu_to_le16(hdev->rpa_timeout);

			/* Set RPA timeout */
			hci_req_add(req, HCI_OP_LE_SET_RPA_TIMEOUT, 2,
				    &rpa_timeout);
		}

781
782
783
784
785
786
787
788
		if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
			/* Read LE Maximum Data Length */
			hci_req_add(req, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL);

			/* Read LE Suggested Default Data Length */
			hci_req_add(req, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL);
		}

789
790
791
792
793
794
		if (ext_adv_capable(hdev)) {
			/* Read LE Number of Supported Advertising Sets */
			hci_req_add(req, HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
				    0, NULL);
		}

795
		hci_set_le_support(req);
796
	}
797
798
799
800
801
802
803
804
805

	/* Read features beyond page 1 if available */
	for (p = 2; p < HCI_MAX_PAGES && p <= hdev->max_page; p++) {
		struct hci_cp_read_local_ext_features cp;

		cp.page = p;
		hci_req_add(req, HCI_OP_READ_LOCAL_EXT_FEATURES,
			    sizeof(cp), &cp);
	}
806
807

	return 0;
808
809
}

810
static int hci_init4_req(struct hci_request *req, unsigned long opt)
811
812
813
{
	struct hci_dev *hdev = req->hdev;

814
815
816
817
	/* Some Broadcom based Bluetooth controllers do not support the
	 * Delete Stored Link Key command. They are clearly indicating its
	 * absence in the bit mask of supported commands.
	 *
818
	 * Check the supported commands and only if the command is marked
819
820
821
822
823
824
825
826
827
828
829
830
831
832
833
834
835
836
	 * as supported send it. If not supported assume that the controller
	 * does not have actual support for stored link keys which makes this
	 * command redundant anyway.
	 *
	 * Some controllers indicate that they support handling deleting
	 * stored link keys, but they don't. The quirk lets a driver
	 * just disable this command.
	 */
	if (hdev->commands[6] & 0x80 &&
	    !test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks)) {
		struct hci_cp_delete_stored_link_key cp;

		bacpy(&cp.bdaddr, BDADDR_ANY);
		cp.delete_all = 0x01;
		hci_req_add(req, HCI_OP_DELETE_STORED_LINK_KEY,
			    sizeof(cp), &cp);
	}

837
838
839
840
	/* Set event mask page 2 if the HCI command for it is supported */
	if (hdev->commands[22] & 0x04)
		hci_set_event_mask_page_2(req);

841
842
843
844
	/* Read local codec list if the HCI command is supported */
	if (hdev->commands[29] & 0x20)
		hci_req_add(req, HCI_OP_READ_LOCAL_CODECS, 0, NULL);

845
846
847
848
	/* Read local pairing options if the HCI command is supported */
	if (hdev->commands[41] & 0x08)
		hci_req_add(req, HCI_OP_READ_LOCAL_PAIRING_OPTS, 0, NULL);

849
850
851
852
	/* Get MWS transport configuration if the HCI command is supported */
	if (hdev->commands[30] & 0x08)
		hci_req_add(req, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 0, NULL);

853
	/* Check for Synchronization Train support */
854
	if (lmp_sync_train_capable(hdev))
855
		hci_req_add(req, HCI_OP_READ_SYNC_TRAIN_PARAMS, 0, NULL);
856
857

	/* Enable Secure Connections if supported and configured */
858
	if (hci_dev_test_flag(hdev, HCI_SSP_ENABLED) &&
859
	    bredr_sc_enabled(hdev)) {
860
		u8 support = 0x01;
861

862
863
864
		hci_req_add(req, HCI_OP_WRITE_SC_SUPPORT,
			    sizeof(support), &support);
	}
865

866
867
868
	/* Set erroneous data reporting if supported to the wideband speech
	 * setting value
	 */
869
870
	if (hdev->commands[18] & 0x08 &&
	    !test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks)) {
871
872
873
874
875
876
877
878
879
880
881
882
883
884
885
886
		bool enabled = hci_dev_test_flag(hdev,
						 HCI_WIDEBAND_SPEECH_ENABLED);

		if (enabled !=
		    (hdev->err_data_reporting == ERR_DATA_REPORTING_ENABLED)) {
			struct hci_cp_write_def_err_data_reporting cp;

			cp.err_data_reporting = enabled ?
						ERR_DATA_REPORTING_ENABLED :
						ERR_DATA_REPORTING_DISABLED;

			hci_req_add(req, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
				    sizeof(cp), &cp);
		}
	}

887
888
889
890
	/* Set Suggested Default Data Length to maximum if supported */
	if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) {
		struct hci_cp_le_write_def_data_len cp;

891
892
		cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
		cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
893
894
895
		hci_req_add(req, HCI_OP_LE_WRITE_DEF_DATA_LEN, sizeof(cp), &cp);
	}

896
897
898
899
	/* Set Default PHY parameters if command is supported */
	if (hdev->commands[35] & 0x20) {
		struct hci_cp_le_set_default_phy cp;

900
901
902
		cp.all_phys = 0x00;
		cp.tx_phys = hdev->le_tx_def_phys;
		cp.rx_phys = hdev->le_rx_def_phys;
903
904
905
906

		hci_req_add(req, HCI_OP_LE_SET_DEFAULT_PHY, sizeof(cp), &cp);
	}

907
	return 0;
908
909
}

910
911
912
913
static int __hci_init(struct hci_dev *hdev)
{
	int err;

914
	err = __hci_req_sync(hdev, hci_init1_req, 0, HCI_INIT_TIMEOUT, NULL);
915
916
917
	if (err < 0)
		return err;

918
919
	if (hci_dev_test_flag(hdev, HCI_SETUP))
		hci_debugfs_create_basic(hdev);
920

921
	err = __hci_req_sync(hdev, hci_init2_req, 0, HCI_INIT_TIMEOUT, NULL);
922
923
924
	if (err < 0)
		return err;

925
	/* HCI_PRIMARY covers both single-mode LE, BR/EDR and dual-mode
926
	 * BR/EDR/LE type controllers. AMP controllers only need the
927
	 * first two stages of init.
928
	 */
929
	if (hdev->dev_type != HCI_PRIMARY)
930
931
		return 0;

932
	err = __hci_req_sync(hdev, hci_init3_req, 0, HCI_INIT_TIMEOUT, NULL);
933
934
935
	if (err < 0)
		return err;

936
	err = __hci_req_sync(hdev, hci_init4_req, 0, HCI_INIT_TIMEOUT, NULL);
937
938
939
	if (err < 0)
		return err;

940
941
942
943
944
945
946
947
948
949
950
	/* This function is only called when the controller is actually in
	 * configured state. When the controller is marked as unconfigured,
	 * this initialization procedure is not run.
	 *
	 * It means that it is possible that a controller runs through its
	 * setup phase and then discovers missing settings. If that is the
	 * case, then this function will not be called. It then will only
	 * be called during the config phase.
	 *
	 * So only when in setup phase or config phase, create the debugfs
	 * entries and register the SMP channels.
951
	 */
952
953
	if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
	    !hci_dev_test_flag(hdev, HCI_CONFIG))
954
955
		return 0;

956
957
	hci_debugfs_create_common(hdev);

958
	if (lmp_bredr_capable(hdev))
959
		hci_debugfs_create_bredr(hdev);
960

961
	if (lmp_le_capable(hdev))
962
		hci_debugfs_create_le(hdev);
963

964
	return 0;
965
966
}

967
static int hci_init0_req(struct hci_request *req, unsigned long opt)
968
969
970
971
972
973
974
975
976
977
978
979
980
981
982
{
	struct hci_dev *hdev = req->hdev;

	BT_DBG("%s %ld", hdev->name, opt);

	/* Reset */
	if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks))
		hci_reset_req(req, 0);

	/* Read Local Version */
	hci_req_add(req, HCI_OP_READ_LOCAL_VERSION, 0, NULL);

	/* Read BD Address */
	if (hdev->set_bdaddr)
		hci_req_add(req, HCI_OP_READ_BD_ADDR, 0, NULL);
983
984

	return 0;
985
986
987
988
989
990
}

static int __hci_unconf_init(struct hci_dev *hdev)
{
	int err;

991
992
993
	if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
		return 0;

994
	err = __hci_req_sync(hdev, hci_init0_req, 0, HCI_INIT_TIMEOUT, NULL);
995
996
997
	if (err < 0)
		return err;

998
999
1000
	if (hci_dev_test_flag(hdev, HCI_SETUP))
		hci_debugfs_create_basic(hdev);

1001
1002
1003
	return 0;
}

1004
static int hci_scan_req(struct hci_request *req, unsigned long opt)
Linus Torvalds's avatar
Linus Torvalds committed
1005
1006
1007
{
	__u8 scan = opt;

1008
	BT_DBG("%s %x", req->hdev->name, scan);
Linus Torvalds's avatar
Linus Torvalds committed
1009
1010

	/* Inquiry and Page scans */
1011
	hci_req_add(req, HCI_OP_WRITE_SCAN_ENABLE, 1, &scan);
1012
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
1013
1014
}

1015
static int hci_auth_req(struct hci_request *req, unsigned long opt)
Linus Torvalds's avatar
Linus Torvalds committed
1016
1017
1018
{
	__u8 auth = opt;

1019
	BT_DBG("%s %x", req->hdev->name, auth);
Linus Torvalds's avatar
Linus Torvalds committed
1020
1021

	/* Authentication */
1022
	hci_req_add(req, HCI_OP_WRITE_AUTH_ENABLE, 1, &auth);
1023
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
1024
1025
}

1026
static int hci_encrypt_req(struct hci_request *req, unsigned long opt)
Linus Torvalds's avatar
Linus Torvalds committed
1027
1028
1029
{
	__u8 encrypt = opt;

1030
	BT_DBG("%s %x", req->hdev->name, encrypt);
Linus Torvalds's avatar
Linus Torvalds committed
1031

1032
	/* Encryption */
1033
	hci_req_add(req, HCI_OP_WRITE_ENCRYPT_MODE, 1, &encrypt);
1034
	return 0;
Linus Torvalds's avatar
Linus Torvalds committed
1035
1036
}

1037
static int hci_linkpol_req(struct hci_request *req, unsigned long opt)
1038
1039
1040
{
	__le16 policy = cpu_to_le16(opt);

1041
	BT_DBG("%s %x", req->hdev->name, policy);
1042
1043

	/* Default link policy */
1044
	hci_req_add(req, HCI_OP_WRITE_DEF_LINK_POLICY, 2, &policy);
1045
	return 0;
1046
1047
}

1048
/* Get HCI device by index.
Linus Torvalds's avatar
Linus Torvalds committed
1049
1050
1051
 * Device is held on return. */
struct hci_dev *hci_dev_get(int index)
{
1052
	struct hci_dev *hdev = NULL, *d;
Linus Torvalds's avatar
Linus Torvalds committed
1053
1054
1055
1056
1057
1058
1059

	BT_DBG("%d", index);

	if (index < 0)
		return NULL;

	read_lock(&hci_dev_list_lock);
1060
	list_for_each_entry(d, &hci_dev_list, list) {
Linus Torvalds's avatar
Linus Torvalds committed
1061
1062
1063
1064
1065
1066
1067
1068
1069
1070
		if (d->id == index) {
			hdev = hci_dev_hold(d);
			break;
		}
	}
	read_unlock(&hci_dev_list_lock);
	return hdev;
}

/* ---- Inquiry support ---- */
1071

1072
1073
1074
1075
bool hci_discovery_active(struct hci_dev *hdev)
{
	struct discovery_state *discov = &hdev->discovery;

1076
	switch (discov->state) {
1077
	case DISCOVERY_FINDING:
1078
	case DISCOVERY_RESOLVING:
1079
1080
		return true;

1081
1082
1083
	default:
		return false;
	}
1084
1085
}

1086
1087
void hci_discovery_set_state(struct hci_dev *hdev, int state)
{
1088
1089
	int old_state = hdev->discovery.state;

1090
1091
	BT_DBG("%s state %u -> %u", hdev->name, hdev->discovery.state, state);

1092
	if (old_state == state)
1093
1094
		return;

1095
1096
	hdev->discovery.state = state;

1097
1098
	switch (state) {
	case DISCOVERY_STOPPED:
1099
1100
		hci_update_background_scan(hdev);

1101
		if (old_state != DISCOVERY_STARTING)
1102
			mgmt_discovering(hdev, 0);
1103
1104
1105
		break;
	case DISCOVERY_STARTING:
		break;
1106
	case DISCOVERY_FINDING:
1107
1108
		mgmt_discovering(hdev, 1);
		break;
1109
1110
	case DISCOVERY_RESOLVING:
		break;
1111
1112
1113
1114
1115
	case DISCOVERY_STOPPING:
		break;
	}
}

1116