f80c5dad7b
This commit makes the kernel not send the next queued HCI command until
a command complete arrives for the last HCI command sent to the
controller. This change avoids a problem with some buggy controllers
(seen on two SKUs of QCA9377) that send an extra command complete event
for the previous command after the kernel had already sent a new HCI
command to the controller.
The problem was reproduced when starting an active scanning procedure,
where an extra command complete event arrives for the LE_SET_RANDOM_ADDR
command. When this happends the kernel ends up not processing the
command complete for the following commmand, LE_SET_SCAN_PARAM, and
ultimately behaving as if a passive scanning procedure was being
performed, when in fact controller is performing an active scanning
procedure. This makes it impossible to discover BLE devices as no device
found events are sent to userspace.
This problem is reproducible on 100% of the attempts on the affected
controllers. The extra command complete event can be seen at timestamp
27.420131 on the btmon logs bellow.
Bluetooth monitor ver 5.50
= Note: Linux version 5.0.0+ (x86_64) 0.352340
= Note: Bluetooth subsystem version 2.22 0.352343
= New Index: 80:C5:F2:8F:87:84 (Primary,USB,hci0) [hci0] 0.352344
= Open Index: 80:C5:F2:8F:87:84 [hci0] 0.352345
= Index Info: 80:C5:F2:8F:87:84 (Qualcomm) [hci0] 0.352346
@ MGMT Open: bluetoothd (privileged) version 1.14 {0x0001} 0.352347
@ MGMT Open: btmon (privileged) version 1.14 {0x0002} 0.352366
@ MGMT Open: btmgmt (privileged) version 1.14 {0x0003} 27.302164
@ MGMT Command: Start Discovery (0x0023) plen 1 {0x0003} [hci0] 27.302310
Address type: 0x06
LE Public
LE Random
< HCI Command: LE Set Random Address (0x08|0x0005) plen 6 #1 [hci0] 27.302496
Address: 15:60:F2:91:B2:24 (Non-Resolvable)
> HCI Event: Command Complete (0x0e) plen 4 #2 [hci0] 27.419117
LE Set Random Address (0x08|0x0005) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Scan Parameters (0x08|0x000b) plen 7 #3 [hci0] 27.419244
Type: Active (0x01)
Interval: 11.250 msec (0x0012)
Window: 11.250 msec (0x0012)
Own address type: Random (0x01)
Filter policy: Accept all advertisement (0x00)
> HCI Event: Command Complete (0x0e) plen 4 #4 [hci0] 27.420131
LE Set Random Address (0x08|0x0005) ncmd 1
Status: Success (0x00)
< HCI Command: LE Set Scan Enable (0x08|0x000c) plen 2 #5 [hci0] 27.420259
Scanning: Enabled (0x01)
Filter duplicates: Enabled (0x01)
> HCI Event: Command Complete (0x0e) plen 4 #6 [hci0] 27.420969
LE Set Scan Parameters (0x08|0x000b) ncmd 1
Status: Success (0x00)
> HCI Event: Command Complete (0x0e) plen 4 #7 [hci0] 27.421983
LE Set Scan Enable (0x08|0x000c) ncmd 1
Status: Success (0x00)
@ MGMT Event: Command Complete (0x0001) plen 4 {0x0003} [hci0] 27.422059
Start Discovery (0x0023) plen 1
Status: Success (0x00)
Address type: 0x06
LE Public
LE Random
@ MGMT Event: Discovering (0x0013) plen 2 {0x0003} [hci0] 27.422067
Address type: 0x06
LE Public
LE Random
Discovery: Enabled (0x01)
@ MGMT Event: Discovering (0x0013) plen 2 {0x0002} [hci0] 27.422067
Address type: 0x06
LE Public
LE Random
Discovery: Enabled (0x01)
@ MGMT Event: Discovering (0x0013) plen 2 {0x0001} [hci0] 27.422067
Address type: 0x06
LE Public
LE Random
Discovery: Enabled (0x01)
Signed-off-by: João Paulo Rechi Vita <jprvita@endlessm.com>
Signed-off-by: Marcel Holtmann <marcel@holtmann.org>
141 lines
5.2 KiB
C
141 lines
5.2 KiB
C
/*
|
|
BlueZ - Bluetooth protocol stack for Linux
|
|
Copyright (C) 2014 Intel Corporation
|
|
|
|
This program is free software; you can redistribute it and/or modify
|
|
it under the terms of the GNU General Public License version 2 as
|
|
published by the Free Software Foundation;
|
|
|
|
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS
|
|
OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
|
|
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT OF THIRD PARTY RIGHTS.
|
|
IN NO EVENT SHALL THE COPYRIGHT HOLDER(S) AND AUTHOR(S) BE LIABLE FOR ANY
|
|
CLAIM, OR ANY SPECIAL INDIRECT OR CONSEQUENTIAL DAMAGES, OR ANY DAMAGES
|
|
WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
|
|
ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF
|
|
OR IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
|
|
|
|
ALL LIABILITY, INCLUDING LIABILITY FOR INFRINGEMENT OF ANY PATENTS,
|
|
COPYRIGHTS, TRADEMARKS OR OTHER RIGHTS, RELATING TO USE OF THIS
|
|
SOFTWARE IS DISCLAIMED.
|
|
*/
|
|
|
|
#include <asm/unaligned.h>
|
|
|
|
#define hci_req_sync_lock(hdev) mutex_lock(&hdev->req_lock)
|
|
#define hci_req_sync_unlock(hdev) mutex_unlock(&hdev->req_lock)
|
|
|
|
struct hci_request {
|
|
struct hci_dev *hdev;
|
|
struct sk_buff_head cmd_q;
|
|
|
|
/* If something goes wrong when building the HCI request, the error
|
|
* value is stored in this field.
|
|
*/
|
|
int err;
|
|
};
|
|
|
|
void hci_req_init(struct hci_request *req, struct hci_dev *hdev);
|
|
void hci_req_purge(struct hci_request *req);
|
|
bool hci_req_status_pend(struct hci_dev *hdev);
|
|
int hci_req_run(struct hci_request *req, hci_req_complete_t complete);
|
|
int hci_req_run_skb(struct hci_request *req, hci_req_complete_skb_t complete);
|
|
void hci_req_add(struct hci_request *req, u16 opcode, u32 plen,
|
|
const void *param);
|
|
void hci_req_add_ev(struct hci_request *req, u16 opcode, u32 plen,
|
|
const void *param, u8 event);
|
|
void hci_req_cmd_complete(struct hci_dev *hdev, u16 opcode, u8 status,
|
|
hci_req_complete_t *req_complete,
|
|
hci_req_complete_skb_t *req_complete_skb);
|
|
|
|
int hci_req_sync(struct hci_dev *hdev, int (*req)(struct hci_request *req,
|
|
unsigned long opt),
|
|
unsigned long opt, u32 timeout, u8 *hci_status);
|
|
int __hci_req_sync(struct hci_dev *hdev, int (*func)(struct hci_request *req,
|
|
unsigned long opt),
|
|
unsigned long opt, u32 timeout, u8 *hci_status);
|
|
void hci_req_sync_cancel(struct hci_dev *hdev, int err);
|
|
|
|
struct sk_buff *hci_prepare_cmd(struct hci_dev *hdev, u16 opcode, u32 plen,
|
|
const void *param);
|
|
|
|
int __hci_req_hci_power_on(struct hci_dev *hdev);
|
|
|
|
void __hci_req_write_fast_connectable(struct hci_request *req, bool enable);
|
|
void __hci_req_update_name(struct hci_request *req);
|
|
void __hci_req_update_eir(struct hci_request *req);
|
|
|
|
void hci_req_add_le_scan_disable(struct hci_request *req);
|
|
void hci_req_add_le_passive_scan(struct hci_request *req);
|
|
|
|
void hci_req_reenable_advertising(struct hci_dev *hdev);
|
|
void __hci_req_enable_advertising(struct hci_request *req);
|
|
void __hci_req_disable_advertising(struct hci_request *req);
|
|
void __hci_req_update_adv_data(struct hci_request *req, u8 instance);
|
|
int hci_req_update_adv_data(struct hci_dev *hdev, u8 instance);
|
|
void __hci_req_update_scan_rsp_data(struct hci_request *req, u8 instance);
|
|
|
|
int __hci_req_schedule_adv_instance(struct hci_request *req, u8 instance,
|
|
bool force);
|
|
void hci_req_clear_adv_instance(struct hci_dev *hdev, struct sock *sk,
|
|
struct hci_request *req, u8 instance,
|
|
bool force);
|
|
|
|
int __hci_req_setup_ext_adv_instance(struct hci_request *req, u8 instance);
|
|
int __hci_req_start_ext_adv(struct hci_request *req, u8 instance);
|
|
void __hci_req_enable_ext_advertising(struct hci_request *req);
|
|
void __hci_req_clear_ext_adv_sets(struct hci_request *req);
|
|
int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,
|
|
bool use_rpa, struct adv_info *adv_instance,
|
|
u8 *own_addr_type, bdaddr_t *rand_addr);
|
|
|
|
void __hci_req_update_class(struct hci_request *req);
|
|
|
|
/* Returns true if HCI commands were queued */
|
|
bool hci_req_stop_discovery(struct hci_request *req);
|
|
|
|
static inline void hci_req_update_scan(struct hci_dev *hdev)
|
|
{
|
|
queue_work(hdev->req_workqueue, &hdev->scan_update);
|
|
}
|
|
|
|
void __hci_req_update_scan(struct hci_request *req);
|
|
|
|
int hci_update_random_address(struct hci_request *req, bool require_privacy,
|
|
bool use_rpa, u8 *own_addr_type);
|
|
|
|
int hci_abort_conn(struct hci_conn *conn, u8 reason);
|
|
void __hci_abort_conn(struct hci_request *req, struct hci_conn *conn,
|
|
u8 reason);
|
|
|
|
static inline void hci_update_background_scan(struct hci_dev *hdev)
|
|
{
|
|
queue_work(hdev->req_workqueue, &hdev->bg_scan_update);
|
|
}
|
|
|
|
void hci_request_setup(struct hci_dev *hdev);
|
|
void hci_request_cancel_all(struct hci_dev *hdev);
|
|
|
|
u8 append_local_name(struct hci_dev *hdev, u8 *ptr, u8 ad_len);
|
|
|
|
static inline u16 eir_append_data(u8 *eir, u16 eir_len, u8 type,
|
|
u8 *data, u8 data_len)
|
|
{
|
|
eir[eir_len++] = sizeof(type) + data_len;
|
|
eir[eir_len++] = type;
|
|
memcpy(&eir[eir_len], data, data_len);
|
|
eir_len += data_len;
|
|
|
|
return eir_len;
|
|
}
|
|
|
|
static inline u16 eir_append_le16(u8 *eir, u16 eir_len, u8 type, u16 data)
|
|
{
|
|
eir[eir_len++] = sizeof(type) + sizeof(data);
|
|
eir[eir_len++] = type;
|
|
put_unaligned_le16(data, &eir[eir_len]);
|
|
eir_len += sizeof(data);
|
|
|
|
return eir_len;
|
|
}
|