FILE
hci_sync.c
File preview with syntax highlighting.
linux-6.19.14/net/bluetooth/hci_sync.c
1// SPDX-License-Identifier: GPL-2.0 2/* 3 * BlueZ - Bluetooth protocol stack for Linux 4 * 5 * Copyright (C) 2021 Intel Corporation 6 * Copyright 2023 NXP 7 */ 8 9#include <linux/property.h> 10 11#include <net/bluetooth/bluetooth.h> 12#include <net/bluetooth/hci_core.h> 13#include <net/bluetooth/mgmt.h> 14 15#include "hci_codec.h" 16#include "hci_debugfs.h" 17#include "smp.h" 18#include "eir.h" 19#include "msft.h" 20#include "aosp.h" 21#include "leds.h" 22 23static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode, 24 struct sk_buff *skb) 25{ 26 bt_dev_dbg(hdev, "result 0x%2.2x", result); 27 28 if (READ_ONCE(hdev->req_status) != HCI_REQ_PEND) 29 return; 30 31 hdev->req_result = result; 32 WRITE_ONCE(hdev->req_status, HCI_REQ_DONE); 33 34 /* Free the request command so it is not used as response */ 35 kfree_skb(hdev->req_skb); 36 hdev->req_skb = NULL; 37 38 if (skb) { 39 struct sock *sk = hci_skb_sk(skb); 40 41 /* Drop sk reference if set */ 42 if (sk) 43 sock_put(sk); 44 45 hdev->req_rsp = skb_get(skb); 46 } 47 48 wake_up_interruptible(&hdev->req_wait_q); 49} 50 51struct sk_buff *hci_cmd_sync_alloc(struct hci_dev *hdev, u16 opcode, u32 plen, 52 const void *param, struct sock *sk) 53{ 54 int len = HCI_COMMAND_HDR_SIZE + plen; 55 struct hci_command_hdr *hdr; 56 struct sk_buff *skb; 57 58 skb = bt_skb_alloc(len, GFP_ATOMIC); 59 if (!skb) 60 return NULL; 61 62 hdr = skb_put(skb, HCI_COMMAND_HDR_SIZE); 63 hdr->opcode = cpu_to_le16(opcode); 64 hdr->plen = plen; 65 66 if (plen) 67 skb_put_data(skb, param, plen); 68 69 bt_dev_dbg(hdev, "skb len %d", skb->len); 70 71 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT; 72 hci_skb_opcode(skb) = opcode; 73 74 /* Grab a reference if command needs to be associated with a sock (e.g. 75 * likely mgmt socket that initiated the command). 76 */ 77 if (sk) { 78 hci_skb_sk(skb) = sk; 79 sock_hold(sk); 80 } 81 82 return skb; 83} 84 85static void hci_cmd_sync_add(struct hci_request *req, u16 opcode, u32 plen, 86 const void *param, u8 event, struct sock *sk) 87{ 88 struct hci_dev *hdev = req->hdev; 89 struct sk_buff *skb; 90 91 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen); 92 93 /* If an error occurred during request building, there is no point in 94 * queueing the HCI command. We can simply return. 95 */ 96 if (req->err) 97 return; 98 99 skb = hci_cmd_sync_alloc(hdev, opcode, plen, param, sk); 100 if (!skb) { 101 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)", 102 opcode); 103 req->err = -ENOMEM; 104 return; 105 } 106 107 if (skb_queue_empty(&req->cmd_q)) 108 bt_cb(skb)->hci.req_flags |= HCI_REQ_START; 109 110 hci_skb_event(skb) = event; 111 112 skb_queue_tail(&req->cmd_q, skb); 113} 114 115static int hci_req_sync_run(struct hci_request *req) 116{ 117 struct hci_dev *hdev = req->hdev; 118 struct sk_buff *skb; 119 unsigned long flags; 120 121 bt_dev_dbg(hdev, "length %u", skb_queue_len(&req->cmd_q)); 122 123 /* If an error occurred during request building, remove all HCI 124 * commands queued on the HCI request queue. 125 */ 126 if (req->err) { 127 skb_queue_purge(&req->cmd_q); 128 return req->err; 129 } 130 131 /* Do not allow empty requests */ 132 if (skb_queue_empty(&req->cmd_q)) 133 return -ENODATA; 134 135 skb = skb_peek_tail(&req->cmd_q); 136 bt_cb(skb)->hci.req_complete_skb = hci_cmd_sync_complete; 137 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB; 138 139 spin_lock_irqsave(&hdev->cmd_q.lock, flags); 140 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q); 141 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); 142 143 queue_work(hdev->workqueue, &hdev->cmd_work); 144 145 return 0; 146} 147 148static void hci_request_init(struct hci_request *req, struct hci_dev *hdev) 149{ 150 skb_queue_head_init(&req->cmd_q); 151 req->hdev = hdev; 152 req->err = 0; 153} 154 155/* This function requires the caller holds hdev->req_lock. */ 156struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, 157 const void *param, u8 event, u32 timeout, 158 struct sock *sk) 159{ 160 struct hci_request req; 161 struct sk_buff *skb; 162 int err = 0; 163 164 bt_dev_dbg(hdev, "Opcode 0x%4.4x", opcode); 165 166 hci_request_init(&req, hdev); 167 168 hci_cmd_sync_add(&req, opcode, plen, param, event, sk); 169 170 WRITE_ONCE(hdev->req_status, HCI_REQ_PEND); 171 172 err = hci_req_sync_run(&req); 173 if (err < 0) 174 return ERR_PTR(err); 175 176 err = wait_event_interruptible_timeout(hdev->req_wait_q, 177 READ_ONCE(hdev->req_status) != HCI_REQ_PEND, 178 timeout); 179 180 if (err == -ERESTARTSYS) 181 return ERR_PTR(-EINTR); 182 183 switch (READ_ONCE(hdev->req_status)) { 184 case HCI_REQ_DONE: 185 err = -bt_to_errno(hdev->req_result); 186 break; 187 188 case HCI_REQ_CANCELED: 189 err = -hdev->req_result; 190 break; 191 192 default: 193 err = -ETIMEDOUT; 194 break; 195 } 196 197 WRITE_ONCE(hdev->req_status, 0); 198 hdev->req_result = 0; 199 skb = hdev->req_rsp; 200 hdev->req_rsp = NULL; 201 202 bt_dev_dbg(hdev, "end: err %d", err); 203 204 if (err < 0) { 205 kfree_skb(skb); 206 return ERR_PTR(err); 207 } 208 209 /* If command return a status event skb will be set to NULL as there are 210 * no parameters. 211 */ 212 if (!skb) 213 return ERR_PTR(-ENODATA); 214 215 return skb; 216} 217EXPORT_SYMBOL(__hci_cmd_sync_sk); 218 219/* This function requires the caller holds hdev->req_lock. */ 220struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen, 221 const void *param, u32 timeout) 222{ 223 return __hci_cmd_sync_sk(hdev, opcode, plen, param, 0, timeout, NULL); 224} 225EXPORT_SYMBOL(__hci_cmd_sync); 226 227/* Send HCI command and wait for command complete event */ 228struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen, 229 const void *param, u32 timeout) 230{ 231 struct sk_buff *skb; 232 233 if (!test_bit(HCI_UP, &hdev->flags)) 234 return ERR_PTR(-ENETDOWN); 235 236 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen); 237 238 hci_req_sync_lock(hdev); 239 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout); 240 hci_req_sync_unlock(hdev); 241 242 return skb; 243} 244EXPORT_SYMBOL(hci_cmd_sync); 245 246/* This function requires the caller holds hdev->req_lock. */ 247struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen, 248 const void *param, u8 event, u32 timeout) 249{ 250 return __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, 251 NULL); 252} 253EXPORT_SYMBOL(__hci_cmd_sync_ev); 254 255/* This function requires the caller holds hdev->req_lock. */ 256int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen, 257 const void *param, u8 event, u32 timeout, 258 struct sock *sk) 259{ 260 struct sk_buff *skb; 261 u8 status; 262 263 skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk); 264 265 /* If command return a status event, skb will be set to -ENODATA */ 266 if (skb == ERR_PTR(-ENODATA)) 267 return 0; 268 269 if (IS_ERR(skb)) { 270 if (!event) 271 bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", opcode, 272 PTR_ERR(skb)); 273 return PTR_ERR(skb); 274 } 275 276 status = skb->data[0]; 277 278 kfree_skb(skb); 279 280 return status; 281} 282EXPORT_SYMBOL(__hci_cmd_sync_status_sk); 283 284int __hci_cmd_sync_status(struct hci_dev *hdev, u16 opcode, u32 plen, 285 const void *param, u32 timeout) 286{ 287 return __hci_cmd_sync_status_sk(hdev, opcode, plen, param, 0, timeout, 288 NULL); 289} 290EXPORT_SYMBOL(__hci_cmd_sync_status); 291 292int hci_cmd_sync_status(struct hci_dev *hdev, u16 opcode, u32 plen, 293 const void *param, u32 timeout) 294{ 295 int err; 296 297 hci_req_sync_lock(hdev); 298 err = __hci_cmd_sync_status(hdev, opcode, plen, param, timeout); 299 hci_req_sync_unlock(hdev); 300 301 return err; 302} 303EXPORT_SYMBOL(hci_cmd_sync_status); 304 305static void hci_cmd_sync_work(struct work_struct *work) 306{ 307 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_sync_work); 308 309 bt_dev_dbg(hdev, ""); 310 311 /* Dequeue all entries and run them */ 312 while (1) { 313 struct hci_cmd_sync_work_entry *entry; 314 315 mutex_lock(&hdev->cmd_sync_work_lock); 316 entry = list_first_entry_or_null(&hdev->cmd_sync_work_list, 317 struct hci_cmd_sync_work_entry, 318 list); 319 if (entry) 320 list_del(&entry->list); 321 mutex_unlock(&hdev->cmd_sync_work_lock); 322 323 if (!entry) 324 break; 325 326 bt_dev_dbg(hdev, "entry %p", entry); 327 328 if (entry->func) { 329 int err; 330 331 hci_req_sync_lock(hdev); 332 err = entry->func(hdev, entry->data); 333 if (entry->destroy) 334 entry->destroy(hdev, entry->data, err); 335 hci_req_sync_unlock(hdev); 336 } 337 338 kfree(entry); 339 } 340} 341 342static void hci_cmd_sync_cancel_work(struct work_struct *work) 343{ 344 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_sync_cancel_work); 345 346 cancel_delayed_work_sync(&hdev->cmd_timer); 347 cancel_delayed_work_sync(&hdev->ncmd_timer); 348 atomic_set(&hdev->cmd_cnt, 1); 349 350 wake_up_interruptible(&hdev->req_wait_q); 351} 352 353static int hci_scan_disable_sync(struct hci_dev *hdev); 354static int scan_disable_sync(struct hci_dev *hdev, void *data) 355{ 356 return hci_scan_disable_sync(hdev); 357} 358 359static int interleaved_inquiry_sync(struct hci_dev *hdev, void *data) 360{ 361 return hci_inquiry_sync(hdev, DISCOV_INTERLEAVED_INQUIRY_LEN, 0); 362} 363 364static void le_scan_disable(struct work_struct *work) 365{ 366 struct hci_dev *hdev = container_of(work, struct hci_dev, 367 le_scan_disable.work); 368 int status; 369 370 bt_dev_dbg(hdev, ""); 371 hci_dev_lock(hdev); 372 373 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 374 goto _return; 375 376 status = hci_cmd_sync_queue(hdev, scan_disable_sync, NULL, NULL); 377 if (status) { 378 bt_dev_err(hdev, "failed to disable LE scan: %d", status); 379 goto _return; 380 } 381 382 /* If we were running LE only scan, change discovery state. If 383 * we were running both LE and BR/EDR inquiry simultaneously, 384 * and BR/EDR inquiry is already finished, stop discovery, 385 * otherwise BR/EDR inquiry will stop discovery when finished. 386 * If we will resolve remote device name, do not change 387 * discovery state. 388 */ 389 390 if (hdev->discovery.type == DISCOV_TYPE_LE) 391 goto discov_stopped; 392 393 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED) 394 goto _return; 395 396 if (hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY)) { 397 if (!test_bit(HCI_INQUIRY, &hdev->flags) && 398 hdev->discovery.state != DISCOVERY_RESOLVING) 399 goto discov_stopped; 400 401 goto _return; 402 } 403 404 status = hci_cmd_sync_queue(hdev, interleaved_inquiry_sync, NULL, NULL); 405 if (status) { 406 bt_dev_err(hdev, "inquiry failed: status %d", status); 407 goto discov_stopped; 408 } 409 410 goto _return; 411 412discov_stopped: 413 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 414 415_return: 416 hci_dev_unlock(hdev); 417} 418 419static int hci_le_set_scan_enable_sync(struct hci_dev *hdev, u8 val, 420 u8 filter_dup); 421 422static int reenable_adv_sync(struct hci_dev *hdev, void *data) 423{ 424 bt_dev_dbg(hdev, ""); 425 426 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) && 427 list_empty(&hdev->adv_instances)) 428 return 0; 429 430 if (hdev->cur_adv_instance) { 431 return hci_schedule_adv_instance_sync(hdev, 432 hdev->cur_adv_instance, 433 true); 434 } else { 435 if (ext_adv_capable(hdev)) { 436 hci_start_ext_adv_sync(hdev, 0x00); 437 } else { 438 hci_update_adv_data_sync(hdev, 0x00); 439 hci_update_scan_rsp_data_sync(hdev, 0x00); 440 hci_enable_advertising_sync(hdev); 441 } 442 } 443 444 return 0; 445} 446 447static void reenable_adv(struct work_struct *work) 448{ 449 struct hci_dev *hdev = container_of(work, struct hci_dev, 450 reenable_adv_work); 451 int status; 452 453 bt_dev_dbg(hdev, ""); 454 455 hci_dev_lock(hdev); 456 457 status = hci_cmd_sync_queue(hdev, reenable_adv_sync, NULL, NULL); 458 if (status) 459 bt_dev_err(hdev, "failed to reenable ADV: %d", status); 460 461 hci_dev_unlock(hdev); 462} 463 464static void cancel_adv_timeout(struct hci_dev *hdev) 465{ 466 if (hdev->adv_instance_timeout) { 467 hdev->adv_instance_timeout = 0; 468 cancel_delayed_work(&hdev->adv_instance_expire); 469 } 470} 471 472/* For a single instance: 473 * - force == true: The instance will be removed even when its remaining 474 * lifetime is not zero. 475 * - force == false: the instance will be deactivated but kept stored unless 476 * the remaining lifetime is zero. 477 * 478 * For instance == 0x00: 479 * - force == true: All instances will be removed regardless of their timeout 480 * setting. 481 * - force == false: Only instances that have a timeout will be removed. 482 */ 483int hci_clear_adv_instance_sync(struct hci_dev *hdev, struct sock *sk, 484 u8 instance, bool force) 485{ 486 struct adv_info *adv_instance, *n, *next_instance = NULL; 487 int err; 488 u8 rem_inst; 489 490 /* Cancel any timeout concerning the removed instance(s). */ 491 if (!instance || hdev->cur_adv_instance == instance) 492 cancel_adv_timeout(hdev); 493 494 /* Get the next instance to advertise BEFORE we remove 495 * the current one. This can be the same instance again 496 * if there is only one instance. 497 */ 498 if (instance && hdev->cur_adv_instance == instance) 499 next_instance = hci_get_next_instance(hdev, instance); 500 501 if (instance == 0x00) { 502 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, 503 list) { 504 if (!(force || adv_instance->timeout)) 505 continue; 506 507 rem_inst = adv_instance->instance; 508 err = hci_remove_adv_instance(hdev, rem_inst); 509 if (!err) 510 mgmt_advertising_removed(sk, hdev, rem_inst); 511 } 512 } else { 513 adv_instance = hci_find_adv_instance(hdev, instance); 514 515 if (force || (adv_instance && adv_instance->timeout && 516 !adv_instance->remaining_time)) { 517 /* Don't advertise a removed instance. */ 518 if (next_instance && 519 next_instance->instance == instance) 520 next_instance = NULL; 521 522 err = hci_remove_adv_instance(hdev, instance); 523 if (!err) 524 mgmt_advertising_removed(sk, hdev, instance); 525 } 526 } 527 528 if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_ADVERTISING)) 529 return 0; 530 531 if (next_instance && !ext_adv_capable(hdev)) 532 return hci_schedule_adv_instance_sync(hdev, 533 next_instance->instance, 534 false); 535 536 return 0; 537} 538 539static int adv_timeout_expire_sync(struct hci_dev *hdev, void *data) 540{ 541 u8 instance = *(u8 *)data; 542 543 kfree(data); 544 545 hci_clear_adv_instance_sync(hdev, NULL, instance, false); 546 547 if (list_empty(&hdev->adv_instances)) 548 return hci_disable_advertising_sync(hdev); 549 550 return 0; 551} 552 553static void adv_timeout_expire(struct work_struct *work) 554{ 555 u8 *inst_ptr; 556 struct hci_dev *hdev = container_of(work, struct hci_dev, 557 adv_instance_expire.work); 558 559 bt_dev_dbg(hdev, ""); 560 561 hci_dev_lock(hdev); 562 563 hdev->adv_instance_timeout = 0; 564 565 if (hdev->cur_adv_instance == 0x00) 566 goto unlock; 567 568 inst_ptr = kmalloc(1, GFP_KERNEL); 569 if (!inst_ptr) 570 goto unlock; 571 572 *inst_ptr = hdev->cur_adv_instance; 573 hci_cmd_sync_queue(hdev, adv_timeout_expire_sync, inst_ptr, NULL); 574 575unlock: 576 hci_dev_unlock(hdev); 577} 578 579static bool is_interleave_scanning(struct hci_dev *hdev) 580{ 581 return hdev->interleave_scan_state != INTERLEAVE_SCAN_NONE; 582} 583 584static int hci_passive_scan_sync(struct hci_dev *hdev); 585 586static void interleave_scan_work(struct work_struct *work) 587{ 588 struct hci_dev *hdev = container_of(work, struct hci_dev, 589 interleave_scan.work); 590 unsigned long timeout; 591 592 if (hdev->interleave_scan_state == INTERLEAVE_SCAN_ALLOWLIST) { 593 timeout = msecs_to_jiffies(hdev->advmon_allowlist_duration); 594 } else if (hdev->interleave_scan_state == INTERLEAVE_SCAN_NO_FILTER) { 595 timeout = msecs_to_jiffies(hdev->advmon_no_filter_duration); 596 } else { 597 bt_dev_err(hdev, "unexpected error"); 598 return; 599 } 600 601 hci_passive_scan_sync(hdev); 602 603 hci_dev_lock(hdev); 604 605 switch (hdev->interleave_scan_state) { 606 case INTERLEAVE_SCAN_ALLOWLIST: 607 bt_dev_dbg(hdev, "next state: allowlist"); 608 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER; 609 break; 610 case INTERLEAVE_SCAN_NO_FILTER: 611 bt_dev_dbg(hdev, "next state: no filter"); 612 hdev->interleave_scan_state = INTERLEAVE_SCAN_ALLOWLIST; 613 break; 614 case INTERLEAVE_SCAN_NONE: 615 bt_dev_err(hdev, "unexpected error"); 616 } 617 618 hci_dev_unlock(hdev); 619 620 /* Don't continue interleaving if it was canceled */ 621 if (is_interleave_scanning(hdev)) 622 queue_delayed_work(hdev->req_workqueue, 623 &hdev->interleave_scan, timeout); 624} 625 626void hci_cmd_sync_init(struct hci_dev *hdev) 627{ 628 INIT_WORK(&hdev->cmd_sync_work, hci_cmd_sync_work); 629 INIT_LIST_HEAD(&hdev->cmd_sync_work_list); 630 mutex_init(&hdev->cmd_sync_work_lock); 631 mutex_init(&hdev->unregister_lock); 632 633 INIT_WORK(&hdev->cmd_sync_cancel_work, hci_cmd_sync_cancel_work); 634 INIT_WORK(&hdev->reenable_adv_work, reenable_adv); 635 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable); 636 INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire); 637 INIT_DELAYED_WORK(&hdev->interleave_scan, interleave_scan_work); 638} 639 640static void _hci_cmd_sync_cancel_entry(struct hci_dev *hdev, 641 struct hci_cmd_sync_work_entry *entry, 642 int err) 643{ 644 if (entry->destroy) 645 entry->destroy(hdev, entry->data, err); 646 647 list_del(&entry->list); 648 kfree(entry); 649} 650 651void hci_cmd_sync_clear(struct hci_dev *hdev) 652{ 653 struct hci_cmd_sync_work_entry *entry, *tmp; 654 655 cancel_work_sync(&hdev->cmd_sync_work); 656 cancel_work_sync(&hdev->reenable_adv_work); 657 658 mutex_lock(&hdev->cmd_sync_work_lock); 659 list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) 660 _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); 661 mutex_unlock(&hdev->cmd_sync_work_lock); 662} 663 664void hci_cmd_sync_cancel(struct hci_dev *hdev, int err) 665{ 666 bt_dev_dbg(hdev, "err 0x%2.2x", err); 667 668 if (READ_ONCE(hdev->req_status) == HCI_REQ_PEND) { 669 hdev->req_result = err; 670 WRITE_ONCE(hdev->req_status, HCI_REQ_CANCELED); 671 672 queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work); 673 } 674} 675EXPORT_SYMBOL(hci_cmd_sync_cancel); 676 677/* Cancel ongoing command request synchronously: 678 * 679 * - Set result and mark status to HCI_REQ_CANCELED 680 * - Wakeup command sync thread 681 */ 682void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err) 683{ 684 bt_dev_dbg(hdev, "err 0x%2.2x", err); 685 686 if (READ_ONCE(hdev->req_status) == HCI_REQ_PEND) { 687 /* req_result is __u32 so error must be positive to be properly 688 * propagated. 689 */ 690 hdev->req_result = err < 0 ? -err : err; 691 WRITE_ONCE(hdev->req_status, HCI_REQ_CANCELED); 692 693 wake_up_interruptible(&hdev->req_wait_q); 694 } 695} 696EXPORT_SYMBOL(hci_cmd_sync_cancel_sync); 697 698/* Submit HCI command to be run in as cmd_sync_work: 699 * 700 * - hdev must _not_ be unregistered 701 */ 702int hci_cmd_sync_submit(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 703 void *data, hci_cmd_sync_work_destroy_t destroy) 704{ 705 struct hci_cmd_sync_work_entry *entry; 706 int err = 0; 707 708 mutex_lock(&hdev->unregister_lock); 709 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 710 err = -ENODEV; 711 goto unlock; 712 } 713 714 entry = kmalloc(sizeof(*entry), GFP_KERNEL); 715 if (!entry) { 716 err = -ENOMEM; 717 goto unlock; 718 } 719 entry->func = func; 720 entry->data = data; 721 entry->destroy = destroy; 722 723 mutex_lock(&hdev->cmd_sync_work_lock); 724 list_add_tail(&entry->list, &hdev->cmd_sync_work_list); 725 mutex_unlock(&hdev->cmd_sync_work_lock); 726 727 queue_work(hdev->req_workqueue, &hdev->cmd_sync_work); 728 729unlock: 730 mutex_unlock(&hdev->unregister_lock); 731 return err; 732} 733EXPORT_SYMBOL(hci_cmd_sync_submit); 734 735/* Queue HCI command: 736 * 737 * - hdev must be running 738 */ 739int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 740 void *data, hci_cmd_sync_work_destroy_t destroy) 741{ 742 /* Only queue command if hdev is running which means it had been opened 743 * and is either on init phase or is already up. 744 */ 745 if (!test_bit(HCI_RUNNING, &hdev->flags)) 746 return -ENETDOWN; 747 748 return hci_cmd_sync_submit(hdev, func, data, destroy); 749} 750EXPORT_SYMBOL(hci_cmd_sync_queue); 751 752static struct hci_cmd_sync_work_entry * 753_hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 754 void *data, hci_cmd_sync_work_destroy_t destroy) 755{ 756 struct hci_cmd_sync_work_entry *entry, *tmp; 757 758 list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) { 759 if (func && entry->func != func) 760 continue; 761 762 if (data && entry->data != data) 763 continue; 764 765 if (destroy && entry->destroy != destroy) 766 continue; 767 768 return entry; 769 } 770 771 return NULL; 772} 773 774/* Queue HCI command entry once: 775 * 776 * - Lookup if an entry already exist and only if it doesn't creates a new entry 777 * and queue it. 778 */ 779int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 780 void *data, hci_cmd_sync_work_destroy_t destroy) 781{ 782 if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy)) 783 return -EEXIST; 784 785 return hci_cmd_sync_queue(hdev, func, data, destroy); 786} 787EXPORT_SYMBOL(hci_cmd_sync_queue_once); 788 789/* Run HCI command: 790 * 791 * - hdev must be running 792 * - if on cmd_sync_work then run immediately otherwise queue 793 */ 794int hci_cmd_sync_run(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 795 void *data, hci_cmd_sync_work_destroy_t destroy) 796{ 797 /* Only queue command if hdev is running which means it had been opened 798 * and is either on init phase or is already up. 799 */ 800 if (!test_bit(HCI_RUNNING, &hdev->flags)) 801 return -ENETDOWN; 802 803 /* If on cmd_sync_work then run immediately otherwise queue */ 804 if (current_work() == &hdev->cmd_sync_work) { 805 int err; 806 807 err = func(hdev, data); 808 if (destroy) 809 destroy(hdev, data, err); 810 811 return 0; 812 } 813 814 return hci_cmd_sync_submit(hdev, func, data, destroy); 815} 816EXPORT_SYMBOL(hci_cmd_sync_run); 817 818/* Run HCI command entry once: 819 * 820 * - Lookup if an entry already exist and only if it doesn't creates a new entry 821 * and run it. 822 * - if on cmd_sync_work then run immediately otherwise queue 823 */ 824int hci_cmd_sync_run_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 825 void *data, hci_cmd_sync_work_destroy_t destroy) 826{ 827 if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy)) 828 return 0; 829 830 return hci_cmd_sync_run(hdev, func, data, destroy); 831} 832EXPORT_SYMBOL(hci_cmd_sync_run_once); 833 834/* Lookup HCI command entry: 835 * 836 * - Return first entry that matches by function callback or data or 837 * destroy callback. 838 */ 839struct hci_cmd_sync_work_entry * 840hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 841 void *data, hci_cmd_sync_work_destroy_t destroy) 842{ 843 struct hci_cmd_sync_work_entry *entry; 844 845 mutex_lock(&hdev->cmd_sync_work_lock); 846 entry = _hci_cmd_sync_lookup_entry(hdev, func, data, destroy); 847 mutex_unlock(&hdev->cmd_sync_work_lock); 848 849 return entry; 850} 851EXPORT_SYMBOL(hci_cmd_sync_lookup_entry); 852 853/* Cancel HCI command entry */ 854void hci_cmd_sync_cancel_entry(struct hci_dev *hdev, 855 struct hci_cmd_sync_work_entry *entry) 856{ 857 mutex_lock(&hdev->cmd_sync_work_lock); 858 _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); 859 mutex_unlock(&hdev->cmd_sync_work_lock); 860} 861EXPORT_SYMBOL(hci_cmd_sync_cancel_entry); 862 863/* Dequeue one HCI command entry: 864 * 865 * - Lookup and cancel first entry that matches. 866 */ 867bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev, 868 hci_cmd_sync_work_func_t func, 869 void *data, hci_cmd_sync_work_destroy_t destroy) 870{ 871 struct hci_cmd_sync_work_entry *entry; 872 873 mutex_lock(&hdev->cmd_sync_work_lock); 874 875 entry = _hci_cmd_sync_lookup_entry(hdev, func, data, destroy); 876 if (!entry) { 877 mutex_unlock(&hdev->cmd_sync_work_lock); 878 return false; 879 } 880 881 _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); 882 883 mutex_unlock(&hdev->cmd_sync_work_lock); 884 885 return true; 886} 887EXPORT_SYMBOL(hci_cmd_sync_dequeue_once); 888 889/* Dequeue HCI command entry: 890 * 891 * - Lookup and cancel any entry that matches by function callback or data or 892 * destroy callback. 893 */ 894bool hci_cmd_sync_dequeue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 895 void *data, hci_cmd_sync_work_destroy_t destroy) 896{ 897 struct hci_cmd_sync_work_entry *entry; 898 bool ret = false; 899 900 mutex_lock(&hdev->cmd_sync_work_lock); 901 while ((entry = _hci_cmd_sync_lookup_entry(hdev, func, data, 902 destroy))) { 903 _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); 904 ret = true; 905 } 906 mutex_unlock(&hdev->cmd_sync_work_lock); 907 908 return ret; 909} 910EXPORT_SYMBOL(hci_cmd_sync_dequeue); 911 912int hci_update_eir_sync(struct hci_dev *hdev) 913{ 914 struct hci_cp_write_eir cp; 915 916 bt_dev_dbg(hdev, ""); 917 918 if (!hdev_is_powered(hdev)) 919 return 0; 920 921 if (!lmp_ext_inq_capable(hdev)) 922 return 0; 923 924 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 925 return 0; 926 927 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE)) 928 return 0; 929 930 memset(&cp, 0, sizeof(cp)); 931 932 eir_create(hdev, cp.data); 933 934 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0) 935 return 0; 936 937 memcpy(hdev->eir, cp.data, sizeof(cp.data)); 938 939 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp, 940 HCI_CMD_TIMEOUT); 941} 942 943static u8 get_service_classes(struct hci_dev *hdev) 944{ 945 struct bt_uuid *uuid; 946 u8 val = 0; 947 948 list_for_each_entry(uuid, &hdev->uuids, list) 949 val |= uuid->svc_hint; 950 951 return val; 952} 953 954int hci_update_class_sync(struct hci_dev *hdev) 955{ 956 u8 cod[3]; 957 958 bt_dev_dbg(hdev, ""); 959 960 if (!hdev_is_powered(hdev)) 961 return 0; 962 963 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 964 return 0; 965 966 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE)) 967 return 0; 968 969 cod[0] = hdev->minor_class; 970 cod[1] = hdev->major_class; 971 cod[2] = get_service_classes(hdev); 972 973 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 974 cod[1] |= 0x20; 975 976 if (memcmp(cod, hdev->dev_class, 3) == 0) 977 return 0; 978 979 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CLASS_OF_DEV, 980 sizeof(cod), cod, HCI_CMD_TIMEOUT); 981} 982 983static bool is_advertising_allowed(struct hci_dev *hdev, bool connectable) 984{ 985 /* If there is no connection we are OK to advertise. */ 986 if (hci_conn_num(hdev, LE_LINK) == 0) 987 return true; 988 989 /* Check le_states if there is any connection in peripheral role. */ 990 if (hdev->conn_hash.le_num_peripheral > 0) { 991 /* Peripheral connection state and non connectable mode 992 * bit 20. 993 */ 994 if (!connectable && !(hdev->le_states[2] & 0x10)) 995 return false; 996 997 /* Peripheral connection state and connectable mode bit 38 998 * and scannable bit 21. 999 */ 1000 if (connectable && (!(hdev->le_states[4] & 0x40) || 1001 !(hdev->le_states[2] & 0x20))) 1002 return false; 1003 } 1004 1005 /* Check le_states if there is any connection in central role. */ 1006 if (hci_conn_num(hdev, LE_LINK) != hdev->conn_hash.le_num_peripheral) { 1007 /* Central connection state and non connectable mode bit 18. */ 1008 if (!connectable && !(hdev->le_states[2] & 0x02)) 1009 return false; 1010 1011 /* Central connection state and connectable mode bit 35 and 1012 * scannable 19. 1013 */ 1014 if (connectable && (!(hdev->le_states[4] & 0x08) || 1015 !(hdev->le_states[2] & 0x08))) 1016 return false; 1017 } 1018 1019 return true; 1020} 1021 1022static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags) 1023{ 1024 /* If privacy is not enabled don't use RPA */ 1025 if (!hci_dev_test_flag(hdev, HCI_PRIVACY)) 1026 return false; 1027 1028 /* If basic privacy mode is enabled use RPA */ 1029 if (!hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 1030 return true; 1031 1032 /* If limited privacy mode is enabled don't use RPA if we're 1033 * both discoverable and bondable. 1034 */ 1035 if ((flags & MGMT_ADV_FLAG_DISCOV) && 1036 hci_dev_test_flag(hdev, HCI_BONDABLE)) 1037 return false; 1038 1039 /* We're neither bondable nor discoverable in the limited 1040 * privacy mode, therefore use RPA. 1041 */ 1042 return true; 1043} 1044 1045static int hci_set_random_addr_sync(struct hci_dev *hdev, bdaddr_t *rpa) 1046{ 1047 /* If a random_addr has been set we're advertising or initiating an LE 1048 * connection we can't go ahead and change the random address at this 1049 * time. This is because the eventual initiator address used for the 1050 * subsequently created connection will be undefined (some 1051 * controllers use the new address and others the one we had 1052 * when the operation started). 1053 * 1054 * In this kind of scenario skip the update and let the random 1055 * address be updated at the next cycle. 1056 */ 1057 if (bacmp(&hdev->random_addr, BDADDR_ANY) && 1058 (hci_dev_test_flag(hdev, HCI_LE_ADV) || 1059 hci_lookup_le_connect(hdev))) { 1060 bt_dev_dbg(hdev, "Deferring random address update"); 1061 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1062 return 0; 1063 } 1064 1065 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_RANDOM_ADDR, 1066 6, rpa, HCI_CMD_TIMEOUT); 1067} 1068 1069int hci_update_random_address_sync(struct hci_dev *hdev, bool require_privacy, 1070 bool rpa, u8 *own_addr_type) 1071{ 1072 int err; 1073 1074 /* If privacy is enabled use a resolvable private address. If 1075 * current RPA has expired or there is something else than 1076 * the current RPA in use, then generate a new one. 1077 */ 1078 if (rpa) { 1079 /* If Controller supports LL Privacy use own address type is 1080 * 0x03 1081 */ 1082 if (ll_privacy_capable(hdev)) 1083 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED; 1084 else 1085 *own_addr_type = ADDR_LE_DEV_RANDOM; 1086 1087 /* Check if RPA is valid */ 1088 if (rpa_valid(hdev)) 1089 return 0; 1090 1091 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa); 1092 if (err < 0) { 1093 bt_dev_err(hdev, "failed to generate new RPA"); 1094 return err; 1095 } 1096 1097 err = hci_set_random_addr_sync(hdev, &hdev->rpa); 1098 if (err) 1099 return err; 1100 1101 return 0; 1102 } 1103 1104 /* In case of required privacy without resolvable private address, 1105 * use an non-resolvable private address. This is useful for active 1106 * scanning and non-connectable advertising. 1107 */ 1108 if (require_privacy) { 1109 bdaddr_t nrpa; 1110 1111 while (true) { 1112 /* The non-resolvable private address is generated 1113 * from random six bytes with the two most significant 1114 * bits cleared. 1115 */ 1116 get_random_bytes(&nrpa, 6); 1117 nrpa.b[5] &= 0x3f; 1118 1119 /* The non-resolvable private address shall not be 1120 * equal to the public address. 1121 */ 1122 if (bacmp(&hdev->bdaddr, &nrpa)) 1123 break; 1124 } 1125 1126 *own_addr_type = ADDR_LE_DEV_RANDOM; 1127 1128 return hci_set_random_addr_sync(hdev, &nrpa); 1129 } 1130 1131 /* If forcing static address is in use or there is no public 1132 * address use the static address as random address (but skip 1133 * the HCI command if the current random address is already the 1134 * static one. 1135 * 1136 * In case BR/EDR has been disabled on a dual-mode controller 1137 * and a static address has been configured, then use that 1138 * address instead of the public BR/EDR address. 1139 */ 1140 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 1141 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 1142 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 1143 bacmp(&hdev->static_addr, BDADDR_ANY))) { 1144 *own_addr_type = ADDR_LE_DEV_RANDOM; 1145 if (bacmp(&hdev->static_addr, &hdev->random_addr)) 1146 return hci_set_random_addr_sync(hdev, 1147 &hdev->static_addr); 1148 return 0; 1149 } 1150 1151 /* Neither privacy nor static address is being used so use a 1152 * public address. 1153 */ 1154 *own_addr_type = ADDR_LE_DEV_PUBLIC; 1155 1156 return 0; 1157} 1158 1159static int hci_disable_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) 1160{ 1161 struct hci_cp_le_set_ext_adv_enable *cp; 1162 struct hci_cp_ext_adv_set *set; 1163 u8 data[sizeof(*cp) + sizeof(*set) * 1]; 1164 u8 size; 1165 struct adv_info *adv = NULL; 1166 1167 /* If request specifies an instance that doesn't exist, fail */ 1168 if (instance > 0) { 1169 adv = hci_find_adv_instance(hdev, instance); 1170 if (!adv) 1171 return -EINVAL; 1172 1173 /* If not enabled there is nothing to do */ 1174 if (!adv->enabled) 1175 return 0; 1176 } 1177 1178 memset(data, 0, sizeof(data)); 1179 1180 cp = (void *)data; 1181 set = (void *)cp->data; 1182 1183 /* Instance 0x00 indicates all advertising instances will be disabled */ 1184 cp->num_of_sets = !!instance; 1185 cp->enable = 0x00; 1186 1187 set->handle = adv ? adv->handle : instance; 1188 1189 size = sizeof(*cp) + sizeof(*set) * cp->num_of_sets; 1190 1191 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, 1192 size, data, HCI_CMD_TIMEOUT); 1193} 1194 1195static int hci_set_adv_set_random_addr_sync(struct hci_dev *hdev, u8 instance, 1196 bdaddr_t *random_addr) 1197{ 1198 struct hci_cp_le_set_adv_set_rand_addr cp; 1199 int err; 1200 1201 if (!instance) { 1202 /* Instance 0x00 doesn't have an adv_info, instead it uses 1203 * hdev->random_addr to track its address so whenever it needs 1204 * to be updated this also set the random address since 1205 * hdev->random_addr is shared with scan state machine. 1206 */ 1207 err = hci_set_random_addr_sync(hdev, random_addr); 1208 if (err) 1209 return err; 1210 } 1211 1212 memset(&cp, 0, sizeof(cp)); 1213 1214 cp.handle = instance; 1215 bacpy(&cp.bdaddr, random_addr); 1216 1217 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR, 1218 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1219} 1220 1221static int 1222hci_set_ext_adv_params_sync(struct hci_dev *hdev, struct adv_info *adv, 1223 const struct hci_cp_le_set_ext_adv_params *cp, 1224 struct hci_rp_le_set_ext_adv_params *rp) 1225{ 1226 struct sk_buff *skb; 1227 1228 skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(*cp), 1229 cp, HCI_CMD_TIMEOUT); 1230 1231 /* If command return a status event, skb will be set to -ENODATA */ 1232 if (skb == ERR_PTR(-ENODATA)) 1233 return 0; 1234 1235 if (IS_ERR(skb)) { 1236 bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", 1237 HCI_OP_LE_SET_EXT_ADV_PARAMS, PTR_ERR(skb)); 1238 return PTR_ERR(skb); 1239 } 1240 1241 if (skb->len != sizeof(*rp)) { 1242 bt_dev_err(hdev, "Invalid response length for 0x%4.4x: %u", 1243 HCI_OP_LE_SET_EXT_ADV_PARAMS, skb->len); 1244 kfree_skb(skb); 1245 return -EIO; 1246 } 1247 1248 memcpy(rp, skb->data, sizeof(*rp)); 1249 kfree_skb(skb); 1250 1251 if (!rp->status) { 1252 hdev->adv_addr_type = cp->own_addr_type; 1253 if (!cp->handle) { 1254 /* Store in hdev for instance 0 */ 1255 hdev->adv_tx_power = rp->tx_power; 1256 } else if (adv) { 1257 adv->tx_power = rp->tx_power; 1258 } 1259 } 1260 1261 return rp->status; 1262} 1263 1264static int hci_set_ext_adv_data_sync(struct hci_dev *hdev, u8 instance) 1265{ 1266 DEFINE_FLEX(struct hci_cp_le_set_ext_adv_data, pdu, data, length, 1267 HCI_MAX_EXT_AD_LENGTH); 1268 u8 len; 1269 struct adv_info *adv = NULL; 1270 int err; 1271 1272 if (instance) { 1273 adv = hci_find_adv_instance(hdev, instance); 1274 if (!adv || !adv->adv_data_changed) 1275 return 0; 1276 } 1277 1278 len = eir_create_adv_data(hdev, instance, pdu->data, 1279 HCI_MAX_EXT_AD_LENGTH); 1280 1281 pdu->length = len; 1282 pdu->handle = adv ? adv->handle : instance; 1283 pdu->operation = LE_SET_ADV_DATA_OP_COMPLETE; 1284 pdu->frag_pref = LE_SET_ADV_DATA_NO_FRAG; 1285 1286 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_DATA, 1287 struct_size(pdu, data, len), pdu, 1288 HCI_CMD_TIMEOUT); 1289 if (err) 1290 return err; 1291 1292 /* Update data if the command succeed */ 1293 if (adv) { 1294 adv->adv_data_changed = false; 1295 } else { 1296 memcpy(hdev->adv_data, pdu->data, len); 1297 hdev->adv_data_len = len; 1298 } 1299 1300 return 0; 1301} 1302 1303static int hci_set_adv_data_sync(struct hci_dev *hdev, u8 instance) 1304{ 1305 struct hci_cp_le_set_adv_data cp; 1306 u8 len; 1307 1308 memset(&cp, 0, sizeof(cp)); 1309 1310 len = eir_create_adv_data(hdev, instance, cp.data, sizeof(cp.data)); 1311 1312 /* There's nothing to do if the data hasn't changed */ 1313 if (hdev->adv_data_len == len && 1314 memcmp(cp.data, hdev->adv_data, len) == 0) 1315 return 0; 1316 1317 memcpy(hdev->adv_data, cp.data, sizeof(cp.data)); 1318 hdev->adv_data_len = len; 1319 1320 cp.length = len; 1321 1322 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_DATA, 1323 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1324} 1325 1326int hci_update_adv_data_sync(struct hci_dev *hdev, u8 instance) 1327{ 1328 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1329 return 0; 1330 1331 if (ext_adv_capable(hdev)) 1332 return hci_set_ext_adv_data_sync(hdev, instance); 1333 1334 return hci_set_adv_data_sync(hdev, instance); 1335} 1336 1337int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) 1338{ 1339 struct hci_cp_le_set_ext_adv_params cp; 1340 struct hci_rp_le_set_ext_adv_params rp; 1341 bool connectable, require_privacy; 1342 u32 flags; 1343 bdaddr_t random_addr; 1344 u8 own_addr_type; 1345 int err; 1346 struct adv_info *adv; 1347 bool secondary_adv; 1348 1349 if (instance > 0) { 1350 adv = hci_find_adv_instance(hdev, instance); 1351 if (!adv) 1352 return -EINVAL; 1353 } else { 1354 adv = NULL; 1355 } 1356 1357 /* Updating parameters of an active instance will return a 1358 * Command Disallowed error, so we must first disable the 1359 * instance if it is active. 1360 */ 1361 if (adv) { 1362 err = hci_disable_ext_adv_instance_sync(hdev, instance); 1363 if (err) 1364 return err; 1365 } 1366 1367 flags = hci_adv_instance_flags(hdev, instance); 1368 1369 /* If the "connectable" instance flag was not set, then choose between 1370 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting. 1371 */ 1372 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) || 1373 mgmt_get_connectable(hdev); 1374 1375 if (!is_advertising_allowed(hdev, connectable)) 1376 return -EPERM; 1377 1378 /* Set require_privacy to true only when non-connectable 1379 * advertising is used and it is not periodic. 1380 * In that case it is fine to use a non-resolvable private address. 1381 */ 1382 require_privacy = !connectable && !(adv && adv->periodic); 1383 1384 err = hci_get_random_address(hdev, require_privacy, 1385 adv_use_rpa(hdev, flags), adv, 1386 &own_addr_type, &random_addr); 1387 if (err < 0) 1388 return err; 1389 1390 memset(&cp, 0, sizeof(cp)); 1391 1392 if (adv) { 1393 hci_cpu_to_le24(adv->min_interval, cp.min_interval); 1394 hci_cpu_to_le24(adv->max_interval, cp.max_interval); 1395 cp.tx_power = adv->tx_power; 1396 cp.sid = adv->sid; 1397 } else { 1398 hci_cpu_to_le24(hdev->le_adv_min_interval, cp.min_interval); 1399 hci_cpu_to_le24(hdev->le_adv_max_interval, cp.max_interval); 1400 cp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 1401 cp.sid = 0x00; 1402 } 1403 1404 secondary_adv = (flags & MGMT_ADV_FLAG_SEC_MASK); 1405 1406 if (connectable) { 1407 if (secondary_adv) 1408 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_CONN_IND); 1409 else 1410 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_IND); 1411 } else if (hci_adv_instance_is_scannable(hdev, instance) || 1412 (flags & MGMT_ADV_PARAM_SCAN_RSP)) { 1413 if (secondary_adv) 1414 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_SCAN_IND); 1415 else 1416 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_SCAN_IND); 1417 } else { 1418 if (secondary_adv) 1419 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_NON_CONN_IND); 1420 else 1421 cp.evt_properties = cpu_to_le16(LE_LEGACY_NONCONN_IND); 1422 } 1423 1424 /* If Own_Address_Type equals 0x02 or 0x03, the Peer_Address parameter 1425 * contains the peer’s Identity Address and the Peer_Address_Type 1426 * parameter contains the peer’s Identity Type (i.e., 0x00 or 0x01). 1427 * These parameters are used to locate the corresponding local IRK in 1428 * the resolving list; this IRK is used to generate their own address 1429 * used in the advertisement. 1430 */ 1431 if (own_addr_type == ADDR_LE_DEV_RANDOM_RESOLVED) 1432 hci_copy_identity_address(hdev, &cp.peer_addr, 1433 &cp.peer_addr_type); 1434 1435 cp.own_addr_type = own_addr_type; 1436 cp.channel_map = hdev->le_adv_channel_map; 1437 cp.handle = adv ? adv->handle : instance; 1438 1439 if (flags & MGMT_ADV_FLAG_SEC_2M) { 1440 cp.primary_phy = HCI_ADV_PHY_1M; 1441 cp.secondary_phy = HCI_ADV_PHY_2M; 1442 } else if (flags & MGMT_ADV_FLAG_SEC_CODED) { 1443 cp.primary_phy = HCI_ADV_PHY_CODED; 1444 cp.secondary_phy = HCI_ADV_PHY_CODED; 1445 } else { 1446 /* In all other cases use 1M */ 1447 cp.primary_phy = HCI_ADV_PHY_1M; 1448 cp.secondary_phy = HCI_ADV_PHY_1M; 1449 } 1450 1451 err = hci_set_ext_adv_params_sync(hdev, adv, &cp, &rp); 1452 if (err) 1453 return err; 1454 1455 /* Update adv data as tx power is known now */ 1456 err = hci_set_ext_adv_data_sync(hdev, cp.handle); 1457 if (err) 1458 return err; 1459 1460 if ((own_addr_type == ADDR_LE_DEV_RANDOM || 1461 own_addr_type == ADDR_LE_DEV_RANDOM_RESOLVED) && 1462 bacmp(&random_addr, BDADDR_ANY)) { 1463 /* Check if random address need to be updated */ 1464 if (adv) { 1465 if (!bacmp(&random_addr, &adv->random_addr)) 1466 return 0; 1467 } else { 1468 if (!bacmp(&random_addr, &hdev->random_addr)) 1469 return 0; 1470 } 1471 1472 return hci_set_adv_set_random_addr_sync(hdev, instance, 1473 &random_addr); 1474 } 1475 1476 return 0; 1477} 1478 1479static int hci_set_ext_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance) 1480{ 1481 DEFINE_FLEX(struct hci_cp_le_set_ext_scan_rsp_data, pdu, data, length, 1482 HCI_MAX_EXT_AD_LENGTH); 1483 u8 len; 1484 struct adv_info *adv = NULL; 1485 int err; 1486 1487 if (instance) { 1488 adv = hci_find_adv_instance(hdev, instance); 1489 if (!adv || !adv->scan_rsp_changed) 1490 return 0; 1491 } 1492 1493 len = eir_create_scan_rsp(hdev, instance, pdu->data); 1494 1495 pdu->handle = adv ? adv->handle : instance; 1496 pdu->length = len; 1497 pdu->operation = LE_SET_ADV_DATA_OP_COMPLETE; 1498 pdu->frag_pref = LE_SET_ADV_DATA_NO_FRAG; 1499 1500 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_RSP_DATA, 1501 struct_size(pdu, data, len), pdu, 1502 HCI_CMD_TIMEOUT); 1503 if (err) 1504 return err; 1505 1506 if (adv) { 1507 adv->scan_rsp_changed = false; 1508 } else { 1509 memcpy(hdev->scan_rsp_data, pdu->data, len); 1510 hdev->scan_rsp_data_len = len; 1511 } 1512 1513 return 0; 1514} 1515 1516static int __hci_set_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance) 1517{ 1518 struct hci_cp_le_set_scan_rsp_data cp; 1519 u8 len; 1520 1521 memset(&cp, 0, sizeof(cp)); 1522 1523 len = eir_create_scan_rsp(hdev, instance, cp.data); 1524 1525 if (hdev->scan_rsp_data_len == len && 1526 !memcmp(cp.data, hdev->scan_rsp_data, len)) 1527 return 0; 1528 1529 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data)); 1530 hdev->scan_rsp_data_len = len; 1531 1532 cp.length = len; 1533 1534 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_RSP_DATA, 1535 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1536} 1537 1538int hci_update_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance) 1539{ 1540 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1541 return 0; 1542 1543 if (ext_adv_capable(hdev)) 1544 return hci_set_ext_scan_rsp_data_sync(hdev, instance); 1545 1546 return __hci_set_scan_rsp_data_sync(hdev, instance); 1547} 1548 1549int hci_enable_ext_advertising_sync(struct hci_dev *hdev, u8 instance) 1550{ 1551 struct hci_cp_le_set_ext_adv_enable *cp; 1552 struct hci_cp_ext_adv_set *set; 1553 u8 data[sizeof(*cp) + sizeof(*set) * 1]; 1554 struct adv_info *adv; 1555 1556 if (instance > 0) { 1557 adv = hci_find_adv_instance(hdev, instance); 1558 if (!adv) 1559 return -EINVAL; 1560 /* If already enabled there is nothing to do */ 1561 if (adv->enabled) 1562 return 0; 1563 } else { 1564 adv = NULL; 1565 } 1566 1567 cp = (void *)data; 1568 set = (void *)cp->data; 1569 1570 memset(cp, 0, sizeof(*cp)); 1571 1572 cp->enable = 0x01; 1573 cp->num_of_sets = 0x01; 1574 1575 memset(set, 0, sizeof(*set)); 1576 1577 set->handle = adv ? adv->handle : instance; 1578 1579 /* Set duration per instance since controller is responsible for 1580 * scheduling it. 1581 */ 1582 if (adv && adv->timeout) { 1583 u16 duration = adv->timeout * MSEC_PER_SEC; 1584 1585 /* Time = N * 10 ms */ 1586 set->duration = cpu_to_le16(duration / 10); 1587 } 1588 1589 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, 1590 sizeof(*cp) + 1591 sizeof(*set) * cp->num_of_sets, 1592 data, HCI_CMD_TIMEOUT); 1593} 1594 1595int hci_start_ext_adv_sync(struct hci_dev *hdev, u8 instance) 1596{ 1597 int err; 1598 1599 err = hci_setup_ext_adv_instance_sync(hdev, instance); 1600 if (err) 1601 return err; 1602 1603 err = hci_set_ext_scan_rsp_data_sync(hdev, instance); 1604 if (err) 1605 return err; 1606 1607 return hci_enable_ext_advertising_sync(hdev, instance); 1608} 1609 1610int hci_disable_per_advertising_sync(struct hci_dev *hdev, u8 instance) 1611{ 1612 struct hci_cp_le_set_per_adv_enable cp; 1613 struct adv_info *adv = NULL; 1614 1615 /* If periodic advertising already disabled there is nothing to do. */ 1616 adv = hci_find_adv_instance(hdev, instance); 1617 if (!adv || !adv->periodic_enabled) 1618 return 0; 1619 1620 memset(&cp, 0, sizeof(cp)); 1621 1622 cp.enable = 0x00; 1623 cp.handle = instance; 1624 1625 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE, 1626 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1627} 1628 1629static int hci_set_per_adv_params_sync(struct hci_dev *hdev, u8 instance, 1630 u16 min_interval, u16 max_interval) 1631{ 1632 struct hci_cp_le_set_per_adv_params cp; 1633 1634 memset(&cp, 0, sizeof(cp)); 1635 1636 if (!min_interval) 1637 min_interval = DISCOV_LE_PER_ADV_INT_MIN; 1638 1639 if (!max_interval) 1640 max_interval = DISCOV_LE_PER_ADV_INT_MAX; 1641 1642 cp.handle = instance; 1643 cp.min_interval = cpu_to_le16(min_interval); 1644 cp.max_interval = cpu_to_le16(max_interval); 1645 cp.periodic_properties = 0x0000; 1646 1647 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS, 1648 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1649} 1650 1651static int hci_set_per_adv_data_sync(struct hci_dev *hdev, u8 instance) 1652{ 1653 DEFINE_FLEX(struct hci_cp_le_set_per_adv_data, pdu, data, length, 1654 HCI_MAX_PER_AD_LENGTH); 1655 u8 len; 1656 struct adv_info *adv = NULL; 1657 1658 if (instance) { 1659 adv = hci_find_adv_instance(hdev, instance); 1660 if (!adv || !adv->periodic) 1661 return 0; 1662 } 1663 1664 len = eir_create_per_adv_data(hdev, instance, pdu->data); 1665 1666 pdu->length = len; 1667 pdu->handle = adv ? adv->handle : instance; 1668 pdu->operation = LE_SET_ADV_DATA_OP_COMPLETE; 1669 1670 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_DATA, 1671 struct_size(pdu, data, len), pdu, 1672 HCI_CMD_TIMEOUT); 1673} 1674 1675static int hci_enable_per_advertising_sync(struct hci_dev *hdev, u8 instance) 1676{ 1677 struct hci_cp_le_set_per_adv_enable cp; 1678 struct adv_info *adv = NULL; 1679 1680 /* If periodic advertising already enabled there is nothing to do. */ 1681 adv = hci_find_adv_instance(hdev, instance); 1682 if (adv && adv->periodic_enabled) 1683 return 0; 1684 1685 memset(&cp, 0, sizeof(cp)); 1686 1687 cp.enable = 0x01; 1688 cp.handle = instance; 1689 1690 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE, 1691 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1692} 1693 1694/* Checks if periodic advertising data contains a Basic Announcement and if it 1695 * does generates a Broadcast ID and add Broadcast Announcement. 1696 */ 1697static int hci_adv_bcast_annoucement(struct hci_dev *hdev, struct adv_info *adv) 1698{ 1699 u8 bid[3]; 1700 u8 ad[HCI_MAX_EXT_AD_LENGTH]; 1701 u8 len; 1702 1703 /* Skip if NULL adv as instance 0x00 is used for general purpose 1704 * advertising so it cannot used for the likes of Broadcast Announcement 1705 * as it can be overwritten at any point. 1706 */ 1707 if (!adv) 1708 return 0; 1709 1710 /* Check if PA data doesn't contains a Basic Audio Announcement then 1711 * there is nothing to do. 1712 */ 1713 if (!eir_get_service_data(adv->per_adv_data, adv->per_adv_data_len, 1714 0x1851, NULL)) 1715 return 0; 1716 1717 /* Check if advertising data already has a Broadcast Announcement since 1718 * the process may want to control the Broadcast ID directly and in that 1719 * case the kernel shall no interfere. 1720 */ 1721 if (eir_get_service_data(adv->adv_data, adv->adv_data_len, 0x1852, 1722 NULL)) 1723 return 0; 1724 1725 /* Generate Broadcast ID */ 1726 get_random_bytes(bid, sizeof(bid)); 1727 len = eir_append_service_data(ad, 0, 0x1852, bid, sizeof(bid)); 1728 memcpy(ad + len, adv->adv_data, adv->adv_data_len); 1729 hci_set_adv_instance_data(hdev, adv->instance, len + adv->adv_data_len, 1730 ad, 0, NULL); 1731 1732 return hci_update_adv_data_sync(hdev, adv->instance); 1733} 1734 1735int hci_start_per_adv_sync(struct hci_dev *hdev, u8 instance, u8 sid, 1736 u8 data_len, u8 *data, u32 flags, u16 min_interval, 1737 u16 max_interval, u16 sync_interval) 1738{ 1739 struct adv_info *adv = NULL; 1740 int err; 1741 bool added = false; 1742 1743 hci_disable_per_advertising_sync(hdev, instance); 1744 1745 if (instance) { 1746 adv = hci_find_adv_instance(hdev, instance); 1747 if (adv) { 1748 if (sid != HCI_SID_INVALID && adv->sid != sid) { 1749 /* If the SID don't match attempt to find by 1750 * SID. 1751 */ 1752 adv = hci_find_adv_sid(hdev, sid); 1753 if (!adv) { 1754 bt_dev_err(hdev, 1755 "Unable to find adv_info"); 1756 return -EINVAL; 1757 } 1758 } 1759 1760 /* Turn it into periodic advertising */ 1761 adv->periodic = true; 1762 adv->per_adv_data_len = data_len; 1763 if (data) 1764 memcpy(adv->per_adv_data, data, data_len); 1765 adv->flags = flags; 1766 } else if (!adv) { 1767 /* Create an instance if that could not be found */ 1768 adv = hci_add_per_instance(hdev, instance, sid, flags, 1769 data_len, data, 1770 sync_interval, 1771 sync_interval); 1772 if (IS_ERR(adv)) 1773 return PTR_ERR(adv); 1774 adv->pending = false; 1775 added = true; 1776 } 1777 } 1778 1779 /* Start advertising */ 1780 err = hci_start_ext_adv_sync(hdev, instance); 1781 if (err < 0) 1782 goto fail; 1783 1784 err = hci_adv_bcast_annoucement(hdev, adv); 1785 if (err < 0) 1786 goto fail; 1787 1788 err = hci_set_per_adv_params_sync(hdev, instance, min_interval, 1789 max_interval); 1790 if (err < 0) 1791 goto fail; 1792 1793 err = hci_set_per_adv_data_sync(hdev, instance); 1794 if (err < 0) 1795 goto fail; 1796 1797 err = hci_enable_per_advertising_sync(hdev, instance); 1798 if (err < 0) 1799 goto fail; 1800 1801 return 0; 1802 1803fail: 1804 if (added) 1805 hci_remove_adv_instance(hdev, instance); 1806 1807 return err; 1808} 1809 1810static int hci_start_adv_sync(struct hci_dev *hdev, u8 instance) 1811{ 1812 int err; 1813 1814 if (ext_adv_capable(hdev)) 1815 return hci_start_ext_adv_sync(hdev, instance); 1816 1817 err = hci_update_adv_data_sync(hdev, instance); 1818 if (err) 1819 return err; 1820 1821 err = hci_update_scan_rsp_data_sync(hdev, instance); 1822 if (err) 1823 return err; 1824 1825 return hci_enable_advertising_sync(hdev); 1826} 1827 1828int hci_enable_advertising_sync(struct hci_dev *hdev) 1829{ 1830 struct adv_info *adv_instance; 1831 struct hci_cp_le_set_adv_param cp; 1832 u8 own_addr_type, enable = 0x01; 1833 bool connectable; 1834 u16 adv_min_interval, adv_max_interval; 1835 u32 flags; 1836 u8 status; 1837 1838 if (ext_adv_capable(hdev)) 1839 return hci_enable_ext_advertising_sync(hdev, 1840 hdev->cur_adv_instance); 1841 1842 flags = hci_adv_instance_flags(hdev, hdev->cur_adv_instance); 1843 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 1844 1845 /* If the "connectable" instance flag was not set, then choose between 1846 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting. 1847 */ 1848 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) || 1849 mgmt_get_connectable(hdev); 1850 1851 if (!is_advertising_allowed(hdev, connectable)) 1852 return -EINVAL; 1853 1854 status = hci_disable_advertising_sync(hdev); 1855 if (status) 1856 return status; 1857 1858 /* Clear the HCI_LE_ADV bit temporarily so that the 1859 * hci_update_random_address knows that it's safe to go ahead 1860 * and write a new random address. The flag will be set back on 1861 * as soon as the SET_ADV_ENABLE HCI command completes. 1862 */ 1863 hci_dev_clear_flag(hdev, HCI_LE_ADV); 1864 1865 /* Set require_privacy to true only when non-connectable 1866 * advertising is used. In that case it is fine to use a 1867 * non-resolvable private address. 1868 */ 1869 status = hci_update_random_address_sync(hdev, !connectable, 1870 adv_use_rpa(hdev, flags), 1871 &own_addr_type); 1872 if (status) 1873 return status; 1874 1875 memset(&cp, 0, sizeof(cp)); 1876 1877 if (adv_instance) { 1878 adv_min_interval = adv_instance->min_interval; 1879 adv_max_interval = adv_instance->max_interval; 1880 } else { 1881 adv_min_interval = hdev->le_adv_min_interval; 1882 adv_max_interval = hdev->le_adv_max_interval; 1883 } 1884 1885 if (connectable) { 1886 cp.type = LE_ADV_IND; 1887 } else { 1888 if (hci_adv_instance_is_scannable(hdev, hdev->cur_adv_instance)) 1889 cp.type = LE_ADV_SCAN_IND; 1890 else 1891 cp.type = LE_ADV_NONCONN_IND; 1892 1893 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE) || 1894 hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) { 1895 adv_min_interval = DISCOV_LE_FAST_ADV_INT_MIN; 1896 adv_max_interval = DISCOV_LE_FAST_ADV_INT_MAX; 1897 } 1898 } 1899 1900 cp.min_interval = cpu_to_le16(adv_min_interval); 1901 cp.max_interval = cpu_to_le16(adv_max_interval); 1902 cp.own_address_type = own_addr_type; 1903 cp.channel_map = hdev->le_adv_channel_map; 1904 1905 status = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_PARAM, 1906 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1907 if (status) 1908 return status; 1909 1910 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE, 1911 sizeof(enable), &enable, HCI_CMD_TIMEOUT); 1912} 1913 1914static int enable_advertising_sync(struct hci_dev *hdev, void *data) 1915{ 1916 return hci_enable_advertising_sync(hdev); 1917} 1918 1919int hci_enable_advertising(struct hci_dev *hdev) 1920{ 1921 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) && 1922 list_empty(&hdev->adv_instances)) 1923 return 0; 1924 1925 return hci_cmd_sync_queue(hdev, enable_advertising_sync, NULL, NULL); 1926} 1927 1928int hci_remove_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance, 1929 struct sock *sk) 1930{ 1931 int err; 1932 1933 if (!ext_adv_capable(hdev)) 1934 return 0; 1935 1936 err = hci_disable_ext_adv_instance_sync(hdev, instance); 1937 if (err) 1938 return err; 1939 1940 /* If request specifies an instance that doesn't exist, fail */ 1941 if (instance > 0 && !hci_find_adv_instance(hdev, instance)) 1942 return -EINVAL; 1943 1944 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_REMOVE_ADV_SET, 1945 sizeof(instance), &instance, 0, 1946 HCI_CMD_TIMEOUT, sk); 1947} 1948 1949int hci_le_terminate_big_sync(struct hci_dev *hdev, u8 handle, u8 reason) 1950{ 1951 struct hci_cp_le_term_big cp; 1952 1953 memset(&cp, 0, sizeof(cp)); 1954 cp.handle = handle; 1955 cp.reason = reason; 1956 1957 return __hci_cmd_sync_status(hdev, HCI_OP_LE_TERM_BIG, 1958 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1959} 1960 1961int hci_schedule_adv_instance_sync(struct hci_dev *hdev, u8 instance, 1962 bool force) 1963{ 1964 struct adv_info *adv = NULL; 1965 u16 timeout; 1966 1967 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) && !ext_adv_capable(hdev)) 1968 return -EPERM; 1969 1970 if (hdev->adv_instance_timeout) 1971 return -EBUSY; 1972 1973 adv = hci_find_adv_instance(hdev, instance); 1974 if (!adv) 1975 return -ENOENT; 1976 1977 /* A zero timeout means unlimited advertising. As long as there is 1978 * only one instance, duration should be ignored. We still set a timeout 1979 * in case further instances are being added later on. 1980 * 1981 * If the remaining lifetime of the instance is more than the duration 1982 * then the timeout corresponds to the duration, otherwise it will be 1983 * reduced to the remaining instance lifetime. 1984 */ 1985 if (adv->timeout == 0 || adv->duration <= adv->remaining_time) 1986 timeout = adv->duration; 1987 else 1988 timeout = adv->remaining_time; 1989 1990 /* The remaining time is being reduced unless the instance is being 1991 * advertised without time limit. 1992 */ 1993 if (adv->timeout) 1994 adv->remaining_time = adv->remaining_time - timeout; 1995 1996 /* Only use work for scheduling instances with legacy advertising */ 1997 if (!ext_adv_capable(hdev)) { 1998 hdev->adv_instance_timeout = timeout; 1999 queue_delayed_work(hdev->req_workqueue, 2000 &hdev->adv_instance_expire, 2001 secs_to_jiffies(timeout)); 2002 } 2003 2004 /* If we're just re-scheduling the same instance again then do not 2005 * execute any HCI commands. This happens when a single instance is 2006 * being advertised. 2007 */ 2008 if (!force && hdev->cur_adv_instance == instance && 2009 hci_dev_test_flag(hdev, HCI_LE_ADV)) 2010 return 0; 2011 2012 hdev->cur_adv_instance = instance; 2013 2014 return hci_start_adv_sync(hdev, instance); 2015} 2016 2017static int hci_clear_adv_sets_sync(struct hci_dev *hdev, struct sock *sk) 2018{ 2019 int err; 2020 2021 if (!ext_adv_capable(hdev)) 2022 return 0; 2023 2024 /* Disable instance 0x00 to disable all instances */ 2025 err = hci_disable_ext_adv_instance_sync(hdev, 0x00); 2026 if (err) 2027 return err; 2028 2029 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CLEAR_ADV_SETS, 2030 0, NULL, 0, HCI_CMD_TIMEOUT, sk); 2031} 2032 2033static int hci_clear_adv_sync(struct hci_dev *hdev, struct sock *sk, bool force) 2034{ 2035 struct adv_info *adv, *n; 2036 2037 if (ext_adv_capable(hdev)) 2038 /* Remove all existing sets */ 2039 return hci_clear_adv_sets_sync(hdev, sk); 2040 2041 /* This is safe as long as there is no command send while the lock is 2042 * held. 2043 */ 2044 hci_dev_lock(hdev); 2045 2046 /* Cleanup non-ext instances */ 2047 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 2048 u8 instance = adv->instance; 2049 int err; 2050 2051 if (!(force || adv->timeout)) 2052 continue; 2053 2054 err = hci_remove_adv_instance(hdev, instance); 2055 if (!err) 2056 mgmt_advertising_removed(sk, hdev, instance); 2057 } 2058 2059 hci_dev_unlock(hdev); 2060 2061 return 0; 2062} 2063 2064static int hci_remove_adv_sync(struct hci_dev *hdev, u8 instance, 2065 struct sock *sk) 2066{ 2067 int err; 2068 2069 /* If we use extended advertising, instance has to be removed first. */ 2070 if (ext_adv_capable(hdev)) 2071 return hci_remove_ext_adv_instance_sync(hdev, instance, sk); 2072 2073 /* This is safe as long as there is no command send while the lock is 2074 * held. 2075 */ 2076 hci_dev_lock(hdev); 2077 2078 err = hci_remove_adv_instance(hdev, instance); 2079 if (!err) 2080 mgmt_advertising_removed(sk, hdev, instance); 2081 2082 hci_dev_unlock(hdev); 2083 2084 return err; 2085} 2086 2087/* For a single instance: 2088 * - force == true: The instance will be removed even when its remaining 2089 * lifetime is not zero. 2090 * - force == false: the instance will be deactivated but kept stored unless 2091 * the remaining lifetime is zero. 2092 * 2093 * For instance == 0x00: 2094 * - force == true: All instances will be removed regardless of their timeout 2095 * setting. 2096 * - force == false: Only instances that have a timeout will be removed. 2097 */ 2098int hci_remove_advertising_sync(struct hci_dev *hdev, struct sock *sk, 2099 u8 instance, bool force) 2100{ 2101 struct adv_info *next = NULL; 2102 int err; 2103 2104 /* Cancel any timeout concerning the removed instance(s). */ 2105 if (!instance || hdev->cur_adv_instance == instance) 2106 cancel_adv_timeout(hdev); 2107 2108 /* Get the next instance to advertise BEFORE we remove 2109 * the current one. This can be the same instance again 2110 * if there is only one instance. 2111 */ 2112 if (hdev->cur_adv_instance == instance) 2113 next = hci_get_next_instance(hdev, instance); 2114 2115 if (!instance) { 2116 err = hci_clear_adv_sync(hdev, sk, force); 2117 if (err) 2118 return err; 2119 } else { 2120 struct adv_info *adv = hci_find_adv_instance(hdev, instance); 2121 2122 if (force || (adv && adv->timeout && !adv->remaining_time)) { 2123 /* Don't advertise a removed instance. */ 2124 if (next && next->instance == instance) 2125 next = NULL; 2126 2127 err = hci_remove_adv_sync(hdev, instance, sk); 2128 if (err) 2129 return err; 2130 } 2131 } 2132 2133 if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_ADVERTISING)) 2134 return 0; 2135 2136 if (next && !ext_adv_capable(hdev)) 2137 hci_schedule_adv_instance_sync(hdev, next->instance, false); 2138 2139 return 0; 2140} 2141 2142int hci_read_rssi_sync(struct hci_dev *hdev, __le16 handle) 2143{ 2144 struct hci_cp_read_rssi cp; 2145 2146 cp.handle = handle; 2147 return __hci_cmd_sync_status(hdev, HCI_OP_READ_RSSI, 2148 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2149} 2150 2151int hci_read_clock_sync(struct hci_dev *hdev, struct hci_cp_read_clock *cp) 2152{ 2153 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CLOCK, 2154 sizeof(*cp), cp, HCI_CMD_TIMEOUT); 2155} 2156 2157int hci_read_tx_power_sync(struct hci_dev *hdev, __le16 handle, u8 type) 2158{ 2159 struct hci_cp_read_tx_power cp; 2160 2161 cp.handle = handle; 2162 cp.type = type; 2163 return __hci_cmd_sync_status(hdev, HCI_OP_READ_TX_POWER, 2164 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2165} 2166 2167int hci_disable_advertising_sync(struct hci_dev *hdev) 2168{ 2169 u8 enable = 0x00; 2170 2171 /* If controller is not advertising we are done. */ 2172 if (!hci_dev_test_flag(hdev, HCI_LE_ADV)) 2173 return 0; 2174 2175 if (ext_adv_capable(hdev)) 2176 return hci_disable_ext_adv_instance_sync(hdev, 0x00); 2177 2178 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE, 2179 sizeof(enable), &enable, HCI_CMD_TIMEOUT); 2180} 2181 2182static int hci_le_set_ext_scan_enable_sync(struct hci_dev *hdev, u8 val, 2183 u8 filter_dup) 2184{ 2185 struct hci_cp_le_set_ext_scan_enable cp; 2186 2187 memset(&cp, 0, sizeof(cp)); 2188 cp.enable = val; 2189 2190 if (hci_dev_test_flag(hdev, HCI_MESH)) 2191 cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE; 2192 else 2193 cp.filter_dup = filter_dup; 2194 2195 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE, 2196 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2197} 2198 2199static int hci_le_set_scan_enable_sync(struct hci_dev *hdev, u8 val, 2200 u8 filter_dup) 2201{ 2202 struct hci_cp_le_set_scan_enable cp; 2203 2204 if (use_ext_scan(hdev)) 2205 return hci_le_set_ext_scan_enable_sync(hdev, val, filter_dup); 2206 2207 memset(&cp, 0, sizeof(cp)); 2208 cp.enable = val; 2209 2210 if (val && hci_dev_test_flag(hdev, HCI_MESH)) 2211 cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE; 2212 else 2213 cp.filter_dup = filter_dup; 2214 2215 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_ENABLE, 2216 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2217} 2218 2219static int hci_le_set_addr_resolution_enable_sync(struct hci_dev *hdev, u8 val) 2220{ 2221 if (!ll_privacy_capable(hdev)) 2222 return 0; 2223 2224 /* If controller is not/already resolving we are done. */ 2225 if (val == hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) 2226 return 0; 2227 2228 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, 2229 sizeof(val), &val, HCI_CMD_TIMEOUT); 2230} 2231 2232static int hci_scan_disable_sync(struct hci_dev *hdev) 2233{ 2234 int err; 2235 2236 /* If controller is not scanning we are done. */ 2237 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 2238 return 0; 2239 2240 if (hdev->scanning_paused) { 2241 bt_dev_dbg(hdev, "Scanning is paused for suspend"); 2242 return 0; 2243 } 2244 2245 err = hci_le_set_scan_enable_sync(hdev, LE_SCAN_DISABLE, 0x00); 2246 if (err) { 2247 bt_dev_err(hdev, "Unable to disable scanning: %d", err); 2248 return err; 2249 } 2250 2251 return err; 2252} 2253 2254static bool scan_use_rpa(struct hci_dev *hdev) 2255{ 2256 return hci_dev_test_flag(hdev, HCI_PRIVACY); 2257} 2258 2259static void hci_start_interleave_scan(struct hci_dev *hdev) 2260{ 2261 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER; 2262 queue_delayed_work(hdev->req_workqueue, 2263 &hdev->interleave_scan, 0); 2264} 2265 2266static void cancel_interleave_scan(struct hci_dev *hdev) 2267{ 2268 bt_dev_dbg(hdev, "cancelling interleave scan"); 2269 2270 cancel_delayed_work_sync(&hdev->interleave_scan); 2271 2272 hdev->interleave_scan_state = INTERLEAVE_SCAN_NONE; 2273} 2274 2275/* Return true if interleave_scan wasn't started until exiting this function, 2276 * otherwise, return false 2277 */ 2278static bool hci_update_interleaved_scan_sync(struct hci_dev *hdev) 2279{ 2280 /* Do interleaved scan only if all of the following are true: 2281 * - There is at least one ADV monitor 2282 * - At least one pending LE connection or one device to be scanned for 2283 * - Monitor offloading is not supported 2284 * If so, we should alternate between allowlist scan and one without 2285 * any filters to save power. 2286 */ 2287 bool use_interleaving = hci_is_adv_monitoring(hdev) && 2288 !(list_empty(&hdev->pend_le_conns) && 2289 list_empty(&hdev->pend_le_reports)) && 2290 hci_get_adv_monitor_offload_ext(hdev) == 2291 HCI_ADV_MONITOR_EXT_NONE; 2292 bool is_interleaving = is_interleave_scanning(hdev); 2293 2294 if (use_interleaving && !is_interleaving) { 2295 hci_start_interleave_scan(hdev); 2296 bt_dev_dbg(hdev, "starting interleave scan"); 2297 return true; 2298 } 2299 2300 if (!use_interleaving && is_interleaving) 2301 cancel_interleave_scan(hdev); 2302 2303 return false; 2304} 2305 2306/* Removes connection to resolve list if needed.*/ 2307static int hci_le_del_resolve_list_sync(struct hci_dev *hdev, 2308 bdaddr_t *bdaddr, u8 bdaddr_type) 2309{ 2310 struct hci_cp_le_del_from_resolv_list cp; 2311 struct bdaddr_list_with_irk *entry; 2312 2313 if (!ll_privacy_capable(hdev)) 2314 return 0; 2315 2316 /* Check if the IRK has been programmed */ 2317 entry = hci_bdaddr_list_lookup_with_irk(&hdev->le_resolv_list, bdaddr, 2318 bdaddr_type); 2319 if (!entry) 2320 return 0; 2321 2322 cp.bdaddr_type = bdaddr_type; 2323 bacpy(&cp.bdaddr, bdaddr); 2324 2325 return __hci_cmd_sync_status(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST, 2326 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2327} 2328 2329static int hci_le_del_accept_list_sync(struct hci_dev *hdev, 2330 bdaddr_t *bdaddr, u8 bdaddr_type) 2331{ 2332 struct hci_cp_le_del_from_accept_list cp; 2333 int err; 2334 2335 /* Check if device is on accept list before removing it */ 2336 if (!hci_bdaddr_list_lookup(&hdev->le_accept_list, bdaddr, bdaddr_type)) 2337 return 0; 2338 2339 cp.bdaddr_type = bdaddr_type; 2340 bacpy(&cp.bdaddr, bdaddr); 2341 2342 /* Ignore errors when removing from resolving list as that is likely 2343 * that the device was never added. 2344 */ 2345 hci_le_del_resolve_list_sync(hdev, &cp.bdaddr, cp.bdaddr_type); 2346 2347 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST, 2348 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2349 if (err) { 2350 bt_dev_err(hdev, "Unable to remove from allow list: %d", err); 2351 return err; 2352 } 2353 2354 bt_dev_dbg(hdev, "Remove %pMR (0x%x) from allow list", &cp.bdaddr, 2355 cp.bdaddr_type); 2356 2357 return 0; 2358} 2359 2360struct conn_params { 2361 bdaddr_t addr; 2362 u8 addr_type; 2363 hci_conn_flags_t flags; 2364 u8 privacy_mode; 2365}; 2366 2367/* Adds connection to resolve list if needed. 2368 * Setting params to NULL programs local hdev->irk 2369 */ 2370static int hci_le_add_resolve_list_sync(struct hci_dev *hdev, 2371 struct conn_params *params) 2372{ 2373 struct hci_cp_le_add_to_resolv_list cp; 2374 struct smp_irk *irk; 2375 struct bdaddr_list_with_irk *entry; 2376 struct hci_conn_params *p; 2377 2378 if (!ll_privacy_capable(hdev)) 2379 return 0; 2380 2381 /* Attempt to program local identity address, type and irk if params is 2382 * NULL. 2383 */ 2384 if (!params) { 2385 if (!hci_dev_test_flag(hdev, HCI_PRIVACY)) 2386 return 0; 2387 2388 hci_copy_identity_address(hdev, &cp.bdaddr, &cp.bdaddr_type); 2389 memcpy(cp.peer_irk, hdev->irk, 16); 2390 goto done; 2391 } else if (!(params->flags & HCI_CONN_FLAG_ADDRESS_RESOLUTION)) 2392 return 0; 2393 2394 irk = hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type); 2395 if (!irk) 2396 return 0; 2397 2398 /* Check if the IK has _not_ been programmed yet. */ 2399 entry = hci_bdaddr_list_lookup_with_irk(&hdev->le_resolv_list, 2400 ¶ms->addr, 2401 params->addr_type); 2402 if (entry) 2403 return 0; 2404 2405 cp.bdaddr_type = params->addr_type; 2406 bacpy(&cp.bdaddr, ¶ms->addr); 2407 memcpy(cp.peer_irk, irk->val, 16); 2408 2409 /* Default privacy mode is always Network */ 2410 params->privacy_mode = HCI_NETWORK_PRIVACY; 2411 2412 rcu_read_lock(); 2413 p = hci_pend_le_action_lookup(&hdev->pend_le_conns, 2414 ¶ms->addr, params->addr_type); 2415 if (!p) 2416 p = hci_pend_le_action_lookup(&hdev->pend_le_reports, 2417 ¶ms->addr, params->addr_type); 2418 if (p) 2419 WRITE_ONCE(p->privacy_mode, HCI_NETWORK_PRIVACY); 2420 rcu_read_unlock(); 2421 2422done: 2423 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 2424 memcpy(cp.local_irk, hdev->irk, 16); 2425 else 2426 memset(cp.local_irk, 0, 16); 2427 2428 return __hci_cmd_sync_status(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST, 2429 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2430} 2431 2432/* Set Device Privacy Mode. */ 2433static int hci_le_set_privacy_mode_sync(struct hci_dev *hdev, 2434 struct conn_params *params) 2435{ 2436 struct hci_cp_le_set_privacy_mode cp; 2437 struct smp_irk *irk; 2438 2439 if (!ll_privacy_capable(hdev) || 2440 !(params->flags & HCI_CONN_FLAG_ADDRESS_RESOLUTION)) 2441 return 0; 2442 2443 /* If device privacy mode has already been set there is nothing to do */ 2444 if (params->privacy_mode == HCI_DEVICE_PRIVACY) 2445 return 0; 2446 2447 /* Check if HCI_CONN_FLAG_DEVICE_PRIVACY has been set as it also 2448 * indicates that LL Privacy has been enabled and 2449 * HCI_OP_LE_SET_PRIVACY_MODE is supported. 2450 */ 2451 if (!(params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)) 2452 return 0; 2453 2454 irk = hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type); 2455 if (!irk) 2456 return 0; 2457 2458 memset(&cp, 0, sizeof(cp)); 2459 cp.bdaddr_type = irk->addr_type; 2460 bacpy(&cp.bdaddr, &irk->bdaddr); 2461 cp.mode = HCI_DEVICE_PRIVACY; 2462 2463 /* Note: params->privacy_mode is not updated since it is a copy */ 2464 2465 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PRIVACY_MODE, 2466 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2467} 2468 2469/* Adds connection to allow list if needed, if the device uses RPA (has IRK) 2470 * this attempts to program the device in the resolving list as well and 2471 * properly set the privacy mode. 2472 */ 2473static int hci_le_add_accept_list_sync(struct hci_dev *hdev, 2474 struct conn_params *params, 2475 u8 *num_entries) 2476{ 2477 struct hci_cp_le_add_to_accept_list cp; 2478 int err; 2479 2480 /* During suspend, only wakeable devices can be in acceptlist */ 2481 if (hdev->suspended && 2482 !(params->flags & HCI_CONN_FLAG_REMOTE_WAKEUP)) { 2483 hci_le_del_accept_list_sync(hdev, ¶ms->addr, 2484 params->addr_type); 2485 return 0; 2486 } 2487 2488 /* Select filter policy to accept all advertising */ 2489 if (*num_entries >= hdev->le_accept_list_size) 2490 return -ENOSPC; 2491 2492 /* Attempt to program the device in the resolving list first to avoid 2493 * having to rollback in case it fails since the resolving list is 2494 * dynamic it can probably be smaller than the accept list. 2495 */ 2496 err = hci_le_add_resolve_list_sync(hdev, params); 2497 if (err) { 2498 bt_dev_err(hdev, "Unable to add to resolve list: %d", err); 2499 return err; 2500 } 2501 2502 /* Set Privacy Mode */ 2503 err = hci_le_set_privacy_mode_sync(hdev, params); 2504 if (err) { 2505 bt_dev_err(hdev, "Unable to set privacy mode: %d", err); 2506 return err; 2507 } 2508 2509 /* Check if already in accept list */ 2510 if (hci_bdaddr_list_lookup(&hdev->le_accept_list, ¶ms->addr, 2511 params->addr_type)) 2512 return 0; 2513 2514 *num_entries += 1; 2515 cp.bdaddr_type = params->addr_type; 2516 bacpy(&cp.bdaddr, ¶ms->addr); 2517 2518 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST, 2519 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2520 if (err) { 2521 bt_dev_err(hdev, "Unable to add to allow list: %d", err); 2522 /* Rollback the device from the resolving list */ 2523 hci_le_del_resolve_list_sync(hdev, &cp.bdaddr, cp.bdaddr_type); 2524 return err; 2525 } 2526 2527 bt_dev_dbg(hdev, "Add %pMR (0x%x) to allow list", &cp.bdaddr, 2528 cp.bdaddr_type); 2529 2530 return 0; 2531} 2532 2533/* This function disables/pause all advertising instances */ 2534static int hci_pause_advertising_sync(struct hci_dev *hdev) 2535{ 2536 int err; 2537 int old_state; 2538 2539 /* If controller is not advertising we are done. */ 2540 if (!hci_dev_test_flag(hdev, HCI_LE_ADV)) 2541 return 0; 2542 2543 /* If already been paused there is nothing to do. */ 2544 if (hdev->advertising_paused) 2545 return 0; 2546 2547 bt_dev_dbg(hdev, "Pausing directed advertising"); 2548 2549 /* Stop directed advertising */ 2550 old_state = hci_dev_test_flag(hdev, HCI_ADVERTISING); 2551 if (old_state) { 2552 /* When discoverable timeout triggers, then just make sure 2553 * the limited discoverable flag is cleared. Even in the case 2554 * of a timeout triggered from general discoverable, it is 2555 * safe to unconditionally clear the flag. 2556 */ 2557 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 2558 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 2559 hdev->discov_timeout = 0; 2560 } 2561 2562 bt_dev_dbg(hdev, "Pausing advertising instances"); 2563 2564 /* Call to disable any advertisements active on the controller. 2565 * This will succeed even if no advertisements are configured. 2566 */ 2567 err = hci_disable_advertising_sync(hdev); 2568 if (err) 2569 return err; 2570 2571 /* If we are using software rotation, pause the loop */ 2572 if (!ext_adv_capable(hdev)) 2573 cancel_adv_timeout(hdev); 2574 2575 hdev->advertising_paused = true; 2576 hdev->advertising_old_state = old_state; 2577 2578 return 0; 2579} 2580 2581/* This function enables all user advertising instances */ 2582static int hci_resume_advertising_sync(struct hci_dev *hdev) 2583{ 2584 struct adv_info *adv, *tmp; 2585 int err; 2586 2587 /* If advertising has not been paused there is nothing to do. */ 2588 if (!hdev->advertising_paused) 2589 return 0; 2590 2591 /* Resume directed advertising */ 2592 hdev->advertising_paused = false; 2593 if (hdev->advertising_old_state) { 2594 hci_dev_set_flag(hdev, HCI_ADVERTISING); 2595 hdev->advertising_old_state = 0; 2596 } 2597 2598 bt_dev_dbg(hdev, "Resuming advertising instances"); 2599 2600 if (ext_adv_capable(hdev)) { 2601 /* Call for each tracked instance to be re-enabled */ 2602 list_for_each_entry_safe(adv, tmp, &hdev->adv_instances, list) { 2603 err = hci_enable_ext_advertising_sync(hdev, 2604 adv->instance); 2605 if (!err) 2606 continue; 2607 2608 /* If the instance cannot be resumed remove it */ 2609 hci_remove_ext_adv_instance_sync(hdev, adv->instance, 2610 NULL); 2611 } 2612 2613 /* If current advertising instance is set to instance 0x00 2614 * then we need to re-enable it. 2615 */ 2616 if (hci_dev_test_and_clear_flag(hdev, HCI_LE_ADV_0)) 2617 err = hci_enable_ext_advertising_sync(hdev, 0x00); 2618 } else { 2619 /* Schedule for most recent instance to be restarted and begin 2620 * the software rotation loop 2621 */ 2622 err = hci_schedule_adv_instance_sync(hdev, 2623 hdev->cur_adv_instance, 2624 true); 2625 } 2626 2627 hdev->advertising_paused = false; 2628 2629 return err; 2630} 2631 2632static int hci_pause_addr_resolution(struct hci_dev *hdev) 2633{ 2634 int err; 2635 2636 if (!ll_privacy_capable(hdev)) 2637 return 0; 2638 2639 if (!hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) 2640 return 0; 2641 2642 /* Cannot disable addr resolution if scanning is enabled or 2643 * when initiating an LE connection. 2644 */ 2645 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) || 2646 hci_lookup_le_connect(hdev)) { 2647 bt_dev_err(hdev, "Command not allowed when scan/LE connect"); 2648 return -EPERM; 2649 } 2650 2651 /* Cannot disable addr resolution if advertising is enabled. */ 2652 err = hci_pause_advertising_sync(hdev); 2653 if (err) { 2654 bt_dev_err(hdev, "Pause advertising failed: %d", err); 2655 return err; 2656 } 2657 2658 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00); 2659 if (err) 2660 bt_dev_err(hdev, "Unable to disable Address Resolution: %d", 2661 err); 2662 2663 /* Return if address resolution is disabled and RPA is not used. */ 2664 if (!err && scan_use_rpa(hdev)) 2665 return 0; 2666 2667 hci_resume_advertising_sync(hdev); 2668 return err; 2669} 2670 2671struct sk_buff *hci_read_local_oob_data_sync(struct hci_dev *hdev, 2672 bool extended, struct sock *sk) 2673{ 2674 u16 opcode = extended ? HCI_OP_READ_LOCAL_OOB_EXT_DATA : 2675 HCI_OP_READ_LOCAL_OOB_DATA; 2676 2677 return __hci_cmd_sync_sk(hdev, opcode, 0, NULL, 0, HCI_CMD_TIMEOUT, sk); 2678} 2679 2680static struct conn_params *conn_params_copy(struct list_head *list, size_t *n) 2681{ 2682 struct hci_conn_params *params; 2683 struct conn_params *p; 2684 size_t i; 2685 2686 rcu_read_lock(); 2687 2688 i = 0; 2689 list_for_each_entry_rcu(params, list, action) 2690 ++i; 2691 *n = i; 2692 2693 rcu_read_unlock(); 2694 2695 p = kvcalloc(*n, sizeof(struct conn_params), GFP_KERNEL); 2696 if (!p) 2697 return NULL; 2698 2699 rcu_read_lock(); 2700 2701 i = 0; 2702 list_for_each_entry_rcu(params, list, action) { 2703 /* Racing adds are handled in next scan update */ 2704 if (i >= *n) 2705 break; 2706 2707 /* No hdev->lock, but: addr, addr_type are immutable. 2708 * privacy_mode is only written by us or in 2709 * hci_cc_le_set_privacy_mode that we wait for. 2710 * We should be idempotent so MGMT updating flags 2711 * while we are processing is OK. 2712 */ 2713 bacpy(&p[i].addr, ¶ms->addr); 2714 p[i].addr_type = params->addr_type; 2715 p[i].flags = READ_ONCE(params->flags); 2716 p[i].privacy_mode = READ_ONCE(params->privacy_mode); 2717 ++i; 2718 } 2719 2720 rcu_read_unlock(); 2721 2722 *n = i; 2723 return p; 2724} 2725 2726/* Clear LE Accept List */ 2727static int hci_le_clear_accept_list_sync(struct hci_dev *hdev) 2728{ 2729 if (!(hdev->commands[26] & 0x80)) 2730 return 0; 2731 2732 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CLEAR_ACCEPT_LIST, 0, NULL, 2733 HCI_CMD_TIMEOUT); 2734} 2735 2736/* Device must not be scanning when updating the accept list. 2737 * 2738 * Update is done using the following sequence: 2739 * 2740 * ll_privacy_capable((Disable Advertising) -> Disable Resolving List) -> 2741 * Remove Devices From Accept List -> 2742 * (has IRK && ll_privacy_capable(Remove Devices From Resolving List))-> 2743 * Add Devices to Accept List -> 2744 * (has IRK && ll_privacy_capable(Remove Devices From Resolving List)) -> 2745 * ll_privacy_capable(Enable Resolving List -> (Enable Advertising)) -> 2746 * Enable Scanning 2747 * 2748 * In case of failure advertising shall be restored to its original state and 2749 * return would disable accept list since either accept or resolving list could 2750 * not be programmed. 2751 * 2752 */ 2753static u8 hci_update_accept_list_sync(struct hci_dev *hdev) 2754{ 2755 struct conn_params *params; 2756 struct bdaddr_list *b, *t; 2757 u8 num_entries = 0; 2758 bool pend_conn, pend_report; 2759 u8 filter_policy; 2760 size_t i, n; 2761 int err; 2762 2763 /* Pause advertising if resolving list can be used as controllers 2764 * cannot accept resolving list modifications while advertising. 2765 */ 2766 if (ll_privacy_capable(hdev)) { 2767 err = hci_pause_advertising_sync(hdev); 2768 if (err) { 2769 bt_dev_err(hdev, "pause advertising failed: %d", err); 2770 return 0x00; 2771 } 2772 } 2773 2774 /* Disable address resolution while reprogramming accept list since 2775 * devices that do have an IRK will be programmed in the resolving list 2776 * when LL Privacy is enabled. 2777 */ 2778 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00); 2779 if (err) { 2780 bt_dev_err(hdev, "Unable to disable LL privacy: %d", err); 2781 goto done; 2782 } 2783 2784 /* Force address filtering if PA Sync is in progress */ 2785 if (hci_dev_test_flag(hdev, HCI_PA_SYNC)) { 2786 struct hci_conn *conn; 2787 2788 conn = hci_conn_hash_lookup_create_pa_sync(hdev); 2789 if (conn) { 2790 struct conn_params pa; 2791 2792 memset(&pa, 0, sizeof(pa)); 2793 2794 bacpy(&pa.addr, &conn->dst); 2795 pa.addr_type = conn->dst_type; 2796 2797 /* Clear first since there could be addresses left 2798 * behind. 2799 */ 2800 hci_le_clear_accept_list_sync(hdev); 2801 2802 num_entries = 1; 2803 err = hci_le_add_accept_list_sync(hdev, &pa, 2804 &num_entries); 2805 goto done; 2806 } 2807 } 2808 2809 /* Go through the current accept list programmed into the 2810 * controller one by one and check if that address is connected or is 2811 * still in the list of pending connections or list of devices to 2812 * report. If not present in either list, then remove it from 2813 * the controller. 2814 */ 2815 list_for_each_entry_safe(b, t, &hdev->le_accept_list, list) { 2816 if (hci_conn_hash_lookup_le(hdev, &b->bdaddr, b->bdaddr_type)) 2817 continue; 2818 2819 /* Pointers not dereferenced, no locks needed */ 2820 pend_conn = hci_pend_le_action_lookup(&hdev->pend_le_conns, 2821 &b->bdaddr, 2822 b->bdaddr_type); 2823 pend_report = hci_pend_le_action_lookup(&hdev->pend_le_reports, 2824 &b->bdaddr, 2825 b->bdaddr_type); 2826 2827 /* If the device is not likely to connect or report, 2828 * remove it from the acceptlist. 2829 */ 2830 if (!pend_conn && !pend_report) { 2831 hci_le_del_accept_list_sync(hdev, &b->bdaddr, 2832 b->bdaddr_type); 2833 continue; 2834 } 2835 2836 num_entries++; 2837 } 2838 2839 /* Since all no longer valid accept list entries have been 2840 * removed, walk through the list of pending connections 2841 * and ensure that any new device gets programmed into 2842 * the controller. 2843 * 2844 * If the list of the devices is larger than the list of 2845 * available accept list entries in the controller, then 2846 * just abort and return filer policy value to not use the 2847 * accept list. 2848 * 2849 * The list and params may be mutated while we wait for events, 2850 * so make a copy and iterate it. 2851 */ 2852 2853 params = conn_params_copy(&hdev->pend_le_conns, &n); 2854 if (!params) { 2855 err = -ENOMEM; 2856 goto done; 2857 } 2858 2859 for (i = 0; i < n; ++i) { 2860 err = hci_le_add_accept_list_sync(hdev, ¶ms[i], 2861 &num_entries); 2862 if (err) { 2863 kvfree(params); 2864 goto done; 2865 } 2866 } 2867 2868 kvfree(params); 2869 2870 /* After adding all new pending connections, walk through 2871 * the list of pending reports and also add these to the 2872 * accept list if there is still space. Abort if space runs out. 2873 */ 2874 2875 params = conn_params_copy(&hdev->pend_le_reports, &n); 2876 if (!params) { 2877 err = -ENOMEM; 2878 goto done; 2879 } 2880 2881 for (i = 0; i < n; ++i) { 2882 err = hci_le_add_accept_list_sync(hdev, ¶ms[i], 2883 &num_entries); 2884 if (err) { 2885 kvfree(params); 2886 goto done; 2887 } 2888 } 2889 2890 kvfree(params); 2891 2892 /* Use the allowlist unless the following conditions are all true: 2893 * - We are not currently suspending 2894 * - There are 1 or more ADV monitors registered and it's not offloaded 2895 * - Interleaved scanning is not currently using the allowlist 2896 */ 2897 if (!idr_is_empty(&hdev->adv_monitors_idr) && !hdev->suspended && 2898 hci_get_adv_monitor_offload_ext(hdev) == HCI_ADV_MONITOR_EXT_NONE && 2899 hdev->interleave_scan_state != INTERLEAVE_SCAN_ALLOWLIST) 2900 err = -EINVAL; 2901 2902done: 2903 filter_policy = err ? 0x00 : 0x01; 2904 2905 /* Enable address resolution when LL Privacy is enabled. */ 2906 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x01); 2907 if (err) 2908 bt_dev_err(hdev, "Unable to enable LL privacy: %d", err); 2909 2910 /* Resume advertising if it was paused */ 2911 if (ll_privacy_capable(hdev)) 2912 hci_resume_advertising_sync(hdev); 2913 2914 /* Select filter policy to use accept list */ 2915 return filter_policy; 2916} 2917 2918static void hci_le_scan_phy_params(struct hci_cp_le_scan_phy_params *cp, 2919 u8 type, u16 interval, u16 window) 2920{ 2921 cp->type = type; 2922 cp->interval = cpu_to_le16(interval); 2923 cp->window = cpu_to_le16(window); 2924} 2925 2926static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type, 2927 u16 interval, u16 window, 2928 u8 own_addr_type, u8 filter_policy) 2929{ 2930 struct hci_cp_le_set_ext_scan_params *cp; 2931 struct hci_cp_le_scan_phy_params *phy; 2932 u8 data[sizeof(*cp) + sizeof(*phy) * 2]; 2933 u8 num_phy = 0x00; 2934 2935 cp = (void *)data; 2936 phy = (void *)cp->data; 2937 2938 memset(data, 0, sizeof(data)); 2939 2940 cp->own_addr_type = own_addr_type; 2941 cp->filter_policy = filter_policy; 2942 2943 /* Check if PA Sync is in progress then select the PHY based on the 2944 * hci_conn.iso_qos. 2945 */ 2946 if (hci_dev_test_flag(hdev, HCI_PA_SYNC)) { 2947 struct hci_cp_le_add_to_accept_list *sent; 2948 2949 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST); 2950 if (sent) { 2951 struct hci_conn *conn; 2952 2953 conn = hci_conn_hash_lookup_ba(hdev, PA_LINK, 2954 &sent->bdaddr); 2955 if (conn) { 2956 struct bt_iso_qos *qos = &conn->iso_qos; 2957 2958 if (qos->bcast.in.phy & BT_ISO_PHY_1M || 2959 qos->bcast.in.phy & BT_ISO_PHY_2M) { 2960 cp->scanning_phys |= LE_SCAN_PHY_1M; 2961 hci_le_scan_phy_params(phy, type, 2962 interval, 2963 window); 2964 num_phy++; 2965 phy++; 2966 } 2967 2968 if (qos->bcast.in.phy & BT_ISO_PHY_CODED) { 2969 cp->scanning_phys |= LE_SCAN_PHY_CODED; 2970 hci_le_scan_phy_params(phy, type, 2971 interval * 3, 2972 window * 3); 2973 num_phy++; 2974 phy++; 2975 } 2976 2977 if (num_phy) 2978 goto done; 2979 } 2980 } 2981 } 2982 2983 if (scan_1m(hdev) || scan_2m(hdev)) { 2984 cp->scanning_phys |= LE_SCAN_PHY_1M; 2985 hci_le_scan_phy_params(phy, type, interval, window); 2986 num_phy++; 2987 phy++; 2988 } 2989 2990 if (scan_coded(hdev)) { 2991 cp->scanning_phys |= LE_SCAN_PHY_CODED; 2992 hci_le_scan_phy_params(phy, type, interval * 3, window * 3); 2993 num_phy++; 2994 phy++; 2995 } 2996 2997done: 2998 if (!num_phy) 2999 return -EINVAL; 3000 3001 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS, 3002 sizeof(*cp) + sizeof(*phy) * num_phy, 3003 data, HCI_CMD_TIMEOUT); 3004} 3005 3006static int hci_le_set_scan_param_sync(struct hci_dev *hdev, u8 type, 3007 u16 interval, u16 window, 3008 u8 own_addr_type, u8 filter_policy) 3009{ 3010 struct hci_cp_le_set_scan_param cp; 3011 3012 if (use_ext_scan(hdev)) 3013 return hci_le_set_ext_scan_param_sync(hdev, type, interval, 3014 window, own_addr_type, 3015 filter_policy); 3016 3017 memset(&cp, 0, sizeof(cp)); 3018 cp.type = type; 3019 cp.interval = cpu_to_le16(interval); 3020 cp.window = cpu_to_le16(window); 3021 cp.own_address_type = own_addr_type; 3022 cp.filter_policy = filter_policy; 3023 3024 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_PARAM, 3025 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 3026} 3027 3028static int hci_start_scan_sync(struct hci_dev *hdev, u8 type, u16 interval, 3029 u16 window, u8 own_addr_type, u8 filter_policy, 3030 u8 filter_dup) 3031{ 3032 int err; 3033 3034 if (hdev->scanning_paused) { 3035 bt_dev_dbg(hdev, "Scanning is paused for suspend"); 3036 return 0; 3037 } 3038 3039 err = hci_le_set_scan_param_sync(hdev, type, interval, window, 3040 own_addr_type, filter_policy); 3041 if (err) 3042 return err; 3043 3044 return hci_le_set_scan_enable_sync(hdev, LE_SCAN_ENABLE, filter_dup); 3045} 3046 3047static int hci_passive_scan_sync(struct hci_dev *hdev) 3048{ 3049 u8 own_addr_type; 3050 u8 filter_policy; 3051 u16 window, interval; 3052 u8 filter_dups = LE_SCAN_FILTER_DUP_ENABLE; 3053 int err; 3054 3055 if (hdev->scanning_paused) { 3056 bt_dev_dbg(hdev, "Scanning is paused for suspend"); 3057 return 0; 3058 } 3059 3060 err = hci_scan_disable_sync(hdev); 3061 if (err) { 3062 bt_dev_err(hdev, "disable scanning failed: %d", err); 3063 return err; 3064 } 3065 3066 /* Set require_privacy to false since no SCAN_REQ are send 3067 * during passive scanning. Not using an non-resolvable address 3068 * here is important so that peer devices using direct 3069 * advertising with our address will be correctly reported 3070 * by the controller. 3071 */ 3072 if (hci_update_random_address_sync(hdev, false, scan_use_rpa(hdev), 3073 &own_addr_type)) 3074 return 0; 3075 3076 if (hdev->enable_advmon_interleave_scan && 3077 hci_update_interleaved_scan_sync(hdev)) 3078 return 0; 3079 3080 bt_dev_dbg(hdev, "interleave state %d", hdev->interleave_scan_state); 3081 3082 /* Adding or removing entries from the accept list must 3083 * happen before enabling scanning. The controller does 3084 * not allow accept list modification while scanning. 3085 */ 3086 filter_policy = hci_update_accept_list_sync(hdev); 3087 3088 /* If suspended and filter_policy set to 0x00 (no acceptlist) then 3089 * passive scanning cannot be started since that would require the host 3090 * to be woken up to process the reports. 3091 */ 3092 if (hdev->suspended && !filter_policy) { 3093 /* Check if accept list is empty then there is no need to scan 3094 * while suspended. 3095 */ 3096 if (list_empty(&hdev->le_accept_list)) 3097 return 0; 3098 3099 /* If there are devices is the accept_list that means some 3100 * devices could not be programmed which in non-suspended case 3101 * means filter_policy needs to be set to 0x00 so the host needs 3102 * to filter, but since this is treating suspended case we 3103 * can ignore device needing host to filter to allow devices in 3104 * the acceptlist to be able to wakeup the system. 3105 */ 3106 filter_policy = 0x01; 3107 } 3108 3109 /* When the controller is using random resolvable addresses and 3110 * with that having LE privacy enabled, then controllers with 3111 * Extended Scanner Filter Policies support can now enable support 3112 * for handling directed advertising. 3113 * 3114 * So instead of using filter polices 0x00 (no acceptlist) 3115 * and 0x01 (acceptlist enabled) use the new filter policies 3116 * 0x02 (no acceptlist) and 0x03 (acceptlist enabled). 3117 */ 3118 if (hci_dev_test_flag(hdev, HCI_PRIVACY) && 3119 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)) 3120 filter_policy |= 0x02; 3121 3122 if (hdev->suspended) { 3123 window = hdev->le_scan_window_suspend; 3124 interval = hdev->le_scan_int_suspend; 3125 } else if (hci_is_le_conn_scanning(hdev)) { 3126 window = hdev->le_scan_window_connect; 3127 interval = hdev->le_scan_int_connect; 3128 } else if (hci_is_adv_monitoring(hdev)) { 3129 window = hdev->le_scan_window_adv_monitor; 3130 interval = hdev->le_scan_int_adv_monitor; 3131 3132 /* Disable duplicates filter when scanning for advertisement 3133 * monitor for the following reasons. 3134 * 3135 * For HW pattern filtering (ex. MSFT), Realtek and Qualcomm 3136 * controllers ignore RSSI_Sampling_Period when the duplicates 3137 * filter is enabled. 3138 * 3139 * For SW pattern filtering, when we're not doing interleaved 3140 * scanning, it is necessary to disable duplicates filter, 3141 * otherwise hosts can only receive one advertisement and it's 3142 * impossible to know if a peer is still in range. 3143 */ 3144 filter_dups = LE_SCAN_FILTER_DUP_DISABLE; 3145 } else { 3146 window = hdev->le_scan_window; 3147 interval = hdev->le_scan_interval; 3148 } 3149 3150 /* Disable all filtering for Mesh */ 3151 if (hci_dev_test_flag(hdev, HCI_MESH)) { 3152 filter_policy = 0; 3153 filter_dups = LE_SCAN_FILTER_DUP_DISABLE; 3154 } 3155 3156 bt_dev_dbg(hdev, "LE passive scan with acceptlist = %d", filter_policy); 3157 3158 return hci_start_scan_sync(hdev, LE_SCAN_PASSIVE, interval, window, 3159 own_addr_type, filter_policy, filter_dups); 3160} 3161 3162/* This function controls the passive scanning based on hdev->pend_le_conns 3163 * list. If there are pending LE connection we start the background scanning, 3164 * otherwise we stop it in the following sequence: 3165 * 3166 * If there are devices to scan: 3167 * 3168 * Disable Scanning -> Update Accept List -> 3169 * ll_privacy_capable((Disable Advertising) -> Disable Resolving List -> 3170 * Update Resolving List -> Enable Resolving List -> (Enable Advertising)) -> 3171 * Enable Scanning 3172 * 3173 * Otherwise: 3174 * 3175 * Disable Scanning 3176 */ 3177int hci_update_passive_scan_sync(struct hci_dev *hdev) 3178{ 3179 int err; 3180 3181 if (!test_bit(HCI_UP, &hdev->flags) || 3182 test_bit(HCI_INIT, &hdev->flags) || 3183 hci_dev_test_flag(hdev, HCI_SETUP) || 3184 hci_dev_test_flag(hdev, HCI_CONFIG) || 3185 hci_dev_test_flag(hdev, HCI_AUTO_OFF) || 3186 hci_dev_test_flag(hdev, HCI_UNREGISTER)) 3187 return 0; 3188 3189 /* No point in doing scanning if LE support hasn't been enabled */ 3190 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 3191 return 0; 3192 3193 /* If discovery is active don't interfere with it */ 3194 if (hdev->discovery.state != DISCOVERY_STOPPED) 3195 return 0; 3196 3197 /* Reset RSSI and UUID filters when starting background scanning 3198 * since these filters are meant for service discovery only. 3199 * 3200 * The Start Discovery and Start Service Discovery operations 3201 * ensure to set proper values for RSSI threshold and UUID 3202 * filter list. So it is safe to just reset them here. 3203 */ 3204 hci_discovery_filter_clear(hdev); 3205 3206 bt_dev_dbg(hdev, "ADV monitoring is %s", 3207 hci_is_adv_monitoring(hdev) ? "on" : "off"); 3208 3209 if (!hci_dev_test_flag(hdev, HCI_MESH) && 3210 list_empty(&hdev->pend_le_conns) && 3211 list_empty(&hdev->pend_le_reports) && 3212 !hci_is_adv_monitoring(hdev) && 3213 !hci_dev_test_flag(hdev, HCI_PA_SYNC)) { 3214 /* If there is no pending LE connections or devices 3215 * to be scanned for or no ADV monitors, we should stop the 3216 * background scanning. 3217 */ 3218 3219 bt_dev_dbg(hdev, "stopping background scanning"); 3220 3221 err = hci_scan_disable_sync(hdev); 3222 if (err) 3223 bt_dev_err(hdev, "stop background scanning failed: %d", 3224 err); 3225 } else { 3226 /* If there is at least one pending LE connection, we should 3227 * keep the background scan running. 3228 */ 3229 3230 /* If controller is connecting, we should not start scanning 3231 * since some controllers are not able to scan and connect at 3232 * the same time. 3233 */ 3234 if (hci_lookup_le_connect(hdev)) 3235 return 0; 3236 3237 bt_dev_dbg(hdev, "start background scanning"); 3238 3239 err = hci_passive_scan_sync(hdev); 3240 if (err) 3241 bt_dev_err(hdev, "start background scanning failed: %d", 3242 err); 3243 } 3244 3245 return err; 3246} 3247 3248static int update_scan_sync(struct hci_dev *hdev, void *data) 3249{ 3250 return hci_update_scan_sync(hdev); 3251} 3252 3253int hci_update_scan(struct hci_dev *hdev) 3254{ 3255 return hci_cmd_sync_queue(hdev, update_scan_sync, NULL, NULL); 3256} 3257 3258static int update_passive_scan_sync(struct hci_dev *hdev, void *data) 3259{ 3260 return hci_update_passive_scan_sync(hdev); 3261} 3262 3263int hci_update_passive_scan(struct hci_dev *hdev) 3264{ 3265 int err; 3266 3267 /* Only queue if it would have any effect */ 3268 if (!test_bit(HCI_UP, &hdev->flags) || 3269 test_bit(HCI_INIT, &hdev->flags) || 3270 hci_dev_test_flag(hdev, HCI_SETUP) || 3271 hci_dev_test_flag(hdev, HCI_CONFIG) || 3272 hci_dev_test_flag(hdev, HCI_AUTO_OFF) || 3273 hci_dev_test_flag(hdev, HCI_UNREGISTER)) 3274 return 0; 3275 3276 err = hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, 3277 NULL); 3278 return (err == -EEXIST) ? 0 : err; 3279} 3280 3281int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val) 3282{ 3283 int err; 3284 3285 if (!bredr_sc_enabled(hdev) || lmp_host_sc_capable(hdev)) 3286 return 0; 3287 3288 err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SC_SUPPORT, 3289 sizeof(val), &val, HCI_CMD_TIMEOUT); 3290 3291 if (!err) { 3292 if (val) { 3293 hdev->features[1][0] |= LMP_HOST_SC; 3294 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 3295 } else { 3296 hdev->features[1][0] &= ~LMP_HOST_SC; 3297 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 3298 } 3299 } 3300 3301 return err; 3302} 3303 3304int hci_write_ssp_mode_sync(struct hci_dev *hdev, u8 mode) 3305{ 3306 int err; 3307 3308 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED) || 3309 lmp_host_ssp_capable(hdev)) 3310 return 0; 3311 3312 if (!mode && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) { 3313 __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 3314 sizeof(mode), &mode, HCI_CMD_TIMEOUT); 3315 } 3316 3317 err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_MODE, 3318 sizeof(mode), &mode, HCI_CMD_TIMEOUT); 3319 if (err) 3320 return err; 3321 3322 return hci_write_sc_support_sync(hdev, 0x01); 3323} 3324 3325int hci_write_le_host_supported_sync(struct hci_dev *hdev, u8 le, u8 simul) 3326{ 3327 struct hci_cp_write_le_host_supported cp; 3328 3329 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) || 3330 !lmp_bredr_capable(hdev)) 3331 return 0; 3332 3333 /* Check first if we already have the right host state 3334 * (host features set) 3335 */ 3336 if (le == lmp_host_le_capable(hdev) && 3337 simul == lmp_host_le_br_capable(hdev)) 3338 return 0; 3339 3340 memset(&cp, 0, sizeof(cp)); 3341 3342 cp.le = le; 3343 cp.simul = simul; 3344 3345 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, 3346 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 3347} 3348 3349static int hci_powered_update_adv_sync(struct hci_dev *hdev) 3350{ 3351 struct adv_info *adv, *tmp; 3352 int err; 3353 3354 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 3355 return 0; 3356 3357 /* If RPA Resolution has not been enable yet it means the 3358 * resolving list is empty and we should attempt to program the 3359 * local IRK in order to support using own_addr_type 3360 * ADDR_LE_DEV_RANDOM_RESOLVED (0x03). 3361 */ 3362 if (!hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) { 3363 hci_le_add_resolve_list_sync(hdev, NULL); 3364 hci_le_set_addr_resolution_enable_sync(hdev, 0x01); 3365 } 3366 3367 /* Make sure the controller has a good default for 3368 * advertising data. This also applies to the case 3369 * where BR/EDR was toggled during the AUTO_OFF phase. 3370 */ 3371 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) && 3372 list_empty(&hdev->adv_instances)) { 3373 if (ext_adv_capable(hdev)) { 3374 err = hci_setup_ext_adv_instance_sync(hdev, 0x00); 3375 if (!err) 3376 hci_update_scan_rsp_data_sync(hdev, 0x00); 3377 } else { 3378 err = hci_update_adv_data_sync(hdev, 0x00); 3379 if (!err) 3380 hci_update_scan_rsp_data_sync(hdev, 0x00); 3381 } 3382 3383 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3384 hci_enable_advertising_sync(hdev); 3385 } 3386 3387 /* Call for each tracked instance to be scheduled */ 3388 list_for_each_entry_safe(adv, tmp, &hdev->adv_instances, list) 3389 hci_schedule_adv_instance_sync(hdev, adv->instance, true); 3390 3391 return 0; 3392} 3393 3394static int hci_write_auth_enable_sync(struct hci_dev *hdev) 3395{ 3396 u8 link_sec; 3397 3398 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY); 3399 if (link_sec == test_bit(HCI_AUTH, &hdev->flags)) 3400 return 0; 3401 3402 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_AUTH_ENABLE, 3403 sizeof(link_sec), &link_sec, 3404 HCI_CMD_TIMEOUT); 3405} 3406 3407int hci_write_fast_connectable_sync(struct hci_dev *hdev, bool enable) 3408{ 3409 struct hci_cp_write_page_scan_activity cp; 3410 u8 type; 3411 int err = 0; 3412 3413 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 3414 return 0; 3415 3416 if (hdev->hci_ver < BLUETOOTH_VER_1_2) 3417 return 0; 3418 3419 memset(&cp, 0, sizeof(cp)); 3420 3421 if (enable) { 3422 type = PAGE_SCAN_TYPE_INTERLACED; 3423 3424 /* 160 msec page scan interval */ 3425 cp.interval = cpu_to_le16(0x0100); 3426 } else { 3427 type = hdev->def_page_scan_type; 3428 cp.interval = cpu_to_le16(hdev->def_page_scan_int); 3429 } 3430 3431 cp.window = cpu_to_le16(hdev->def_page_scan_window); 3432 3433 if (__cpu_to_le16(hdev->page_scan_interval) != cp.interval || 3434 __cpu_to_le16(hdev->page_scan_window) != cp.window) { 3435 err = __hci_cmd_sync_status(hdev, 3436 HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, 3437 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 3438 if (err) 3439 return err; 3440 } 3441 3442 if (hdev->page_scan_type != type) 3443 err = __hci_cmd_sync_status(hdev, 3444 HCI_OP_WRITE_PAGE_SCAN_TYPE, 3445 sizeof(type), &type, 3446 HCI_CMD_TIMEOUT); 3447 3448 return err; 3449} 3450 3451static bool disconnected_accept_list_entries(struct hci_dev *hdev) 3452{ 3453 struct bdaddr_list *b; 3454 3455 list_for_each_entry(b, &hdev->accept_list, list) { 3456 struct hci_conn *conn; 3457 3458 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr); 3459 if (!conn) 3460 return true; 3461 3462 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG) 3463 return true; 3464 } 3465 3466 return false; 3467} 3468 3469static int hci_write_scan_enable_sync(struct hci_dev *hdev, u8 val) 3470{ 3471 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SCAN_ENABLE, 3472 sizeof(val), &val, 3473 HCI_CMD_TIMEOUT); 3474} 3475 3476int hci_update_scan_sync(struct hci_dev *hdev) 3477{ 3478 u8 scan; 3479 3480 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 3481 return 0; 3482 3483 if (!hdev_is_powered(hdev)) 3484 return 0; 3485 3486 if (mgmt_powering_down(hdev)) 3487 return 0; 3488 3489 if (hdev->scanning_paused) 3490 return 0; 3491 3492 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) || 3493 disconnected_accept_list_entries(hdev)) 3494 scan = SCAN_PAGE; 3495 else 3496 scan = SCAN_DISABLED; 3497 3498 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 3499 scan |= SCAN_INQUIRY; 3500 3501 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE) && 3502 test_bit(HCI_ISCAN, &hdev->flags) == !!(scan & SCAN_INQUIRY)) 3503 return 0; 3504 3505 return hci_write_scan_enable_sync(hdev, scan); 3506} 3507 3508int hci_update_name_sync(struct hci_dev *hdev, const u8 *name) 3509{ 3510 struct hci_cp_write_local_name cp; 3511 3512 memset(&cp, 0, sizeof(cp)); 3513 3514 memcpy(cp.name, name, sizeof(cp.name)); 3515 3516 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LOCAL_NAME, 3517 sizeof(cp), &cp, 3518 HCI_CMD_TIMEOUT); 3519} 3520 3521/* This function perform powered update HCI command sequence after the HCI init 3522 * sequence which end up resetting all states, the sequence is as follows: 3523 * 3524 * HCI_SSP_ENABLED(Enable SSP) 3525 * HCI_LE_ENABLED(Enable LE) 3526 * HCI_LE_ENABLED(ll_privacy_capable(Add local IRK to Resolving List) -> 3527 * Update adv data) 3528 * Enable Authentication 3529 * lmp_bredr_capable(Set Fast Connectable -> Set Scan Type -> Set Class -> 3530 * Set Name -> Set EIR) 3531 * HCI_FORCE_STATIC_ADDR | BDADDR_ANY && !HCI_BREDR_ENABLED (Set Static Address) 3532 */ 3533int hci_powered_update_sync(struct hci_dev *hdev) 3534{ 3535 int err; 3536 3537 /* Register the available SMP channels (BR/EDR and LE) only when 3538 * successfully powering on the controller. This late 3539 * registration is required so that LE SMP can clearly decide if 3540 * the public address or static address is used. 3541 */ 3542 smp_register(hdev); 3543 3544 err = hci_write_ssp_mode_sync(hdev, 0x01); 3545 if (err) 3546 return err; 3547 3548 err = hci_write_le_host_supported_sync(hdev, 0x01, 0x00); 3549 if (err) 3550 return err; 3551 3552 err = hci_powered_update_adv_sync(hdev); 3553 if (err) 3554 return err; 3555 3556 err = hci_write_auth_enable_sync(hdev); 3557 if (err) 3558 return err; 3559 3560 if (lmp_bredr_capable(hdev)) { 3561 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 3562 hci_write_fast_connectable_sync(hdev, true); 3563 else 3564 hci_write_fast_connectable_sync(hdev, false); 3565 hci_update_scan_sync(hdev); 3566 hci_update_class_sync(hdev); 3567 hci_update_name_sync(hdev, hdev->dev_name); 3568 hci_update_eir_sync(hdev); 3569 } 3570 3571 /* If forcing static address is in use or there is no public 3572 * address use the static address as random address (but skip 3573 * the HCI command if the current random address is already the 3574 * static one. 3575 * 3576 * In case BR/EDR has been disabled on a dual-mode controller 3577 * and a static address has been configured, then use that 3578 * address instead of the public BR/EDR address. 3579 */ 3580 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 3581 (!bacmp(&hdev->bdaddr, BDADDR_ANY) && 3582 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))) { 3583 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 3584 return hci_set_random_addr_sync(hdev, 3585 &hdev->static_addr); 3586 } 3587 3588 return 0; 3589} 3590 3591/** 3592 * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address 3593 * (BD_ADDR) for a HCI device from 3594 * a firmware node property. 3595 * @hdev: The HCI device 3596 * 3597 * Search the firmware node for 'local-bd-address'. 3598 * 3599 * All-zero BD addresses are rejected, because those could be properties 3600 * that exist in the firmware tables, but were not updated by the firmware. For 3601 * example, the DTS could define 'local-bd-address', with zero BD addresses. 3602 */ 3603static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev) 3604{ 3605 struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent); 3606 bdaddr_t ba; 3607 int ret; 3608 3609 ret = fwnode_property_read_u8_array(fwnode, "local-bd-address", 3610 (u8 *)&ba, sizeof(ba)); 3611 if (ret < 0 || !bacmp(&ba, BDADDR_ANY)) 3612 return; 3613 3614 if (hci_test_quirk(hdev, HCI_QUIRK_BDADDR_PROPERTY_BROKEN)) 3615 baswap(&hdev->public_addr, &ba); 3616 else 3617 bacpy(&hdev->public_addr, &ba); 3618} 3619 3620struct hci_init_stage { 3621 int (*func)(struct hci_dev *hdev); 3622}; 3623 3624/* Run init stage NULL terminated function table */ 3625static int hci_init_stage_sync(struct hci_dev *hdev, 3626 const struct hci_init_stage *stage) 3627{ 3628 size_t i; 3629 3630 for (i = 0; stage[i].func; i++) { 3631 int err; 3632 3633 err = stage[i].func(hdev); 3634 if (err) 3635 return err; 3636 } 3637 3638 return 0; 3639} 3640 3641/* Read Local Version */ 3642static int hci_read_local_version_sync(struct hci_dev *hdev) 3643{ 3644 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_VERSION, 3645 0, NULL, HCI_CMD_TIMEOUT); 3646} 3647 3648/* Read BD Address */ 3649static int hci_read_bd_addr_sync(struct hci_dev *hdev) 3650{ 3651 return __hci_cmd_sync_status(hdev, HCI_OP_READ_BD_ADDR, 3652 0, NULL, HCI_CMD_TIMEOUT); 3653} 3654 3655#define HCI_INIT(_func) \ 3656{ \ 3657 .func = _func, \ 3658} 3659 3660static const struct hci_init_stage hci_init0[] = { 3661 /* HCI_OP_READ_LOCAL_VERSION */ 3662 HCI_INIT(hci_read_local_version_sync), 3663 /* HCI_OP_READ_BD_ADDR */ 3664 HCI_INIT(hci_read_bd_addr_sync), 3665 {} 3666}; 3667 3668int hci_reset_sync(struct hci_dev *hdev) 3669{ 3670 int err; 3671 3672 set_bit(HCI_RESET, &hdev->flags); 3673 3674 err = __hci_cmd_sync_status(hdev, HCI_OP_RESET, 0, NULL, 3675 HCI_CMD_TIMEOUT); 3676 if (err) 3677 return err; 3678 3679 return 0; 3680} 3681 3682static int hci_init0_sync(struct hci_dev *hdev) 3683{ 3684 int err; 3685 3686 bt_dev_dbg(hdev, ""); 3687 3688 /* Reset */ 3689 if (!hci_test_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE)) { 3690 err = hci_reset_sync(hdev); 3691 if (err) 3692 return err; 3693 } 3694 3695 return hci_init_stage_sync(hdev, hci_init0); 3696} 3697 3698static int hci_unconf_init_sync(struct hci_dev *hdev) 3699{ 3700 int err; 3701 3702 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 3703 return 0; 3704 3705 err = hci_init0_sync(hdev); 3706 if (err < 0) 3707 return err; 3708 3709 if (hci_dev_test_flag(hdev, HCI_SETUP)) 3710 hci_debugfs_create_basic(hdev); 3711 3712 return 0; 3713} 3714 3715/* Read Local Supported Features. */ 3716static int hci_read_local_features_sync(struct hci_dev *hdev) 3717{ 3718 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_FEATURES, 3719 0, NULL, HCI_CMD_TIMEOUT); 3720} 3721 3722/* BR Controller init stage 1 command sequence */ 3723static const struct hci_init_stage br_init1[] = { 3724 /* HCI_OP_READ_LOCAL_FEATURES */ 3725 HCI_INIT(hci_read_local_features_sync), 3726 /* HCI_OP_READ_LOCAL_VERSION */ 3727 HCI_INIT(hci_read_local_version_sync), 3728 /* HCI_OP_READ_BD_ADDR */ 3729 HCI_INIT(hci_read_bd_addr_sync), 3730 {} 3731}; 3732 3733/* Read Local Commands */ 3734static int hci_read_local_cmds_sync(struct hci_dev *hdev) 3735{ 3736 /* All Bluetooth 1.2 and later controllers should support the 3737 * HCI command for reading the local supported commands. 3738 * 3739 * Unfortunately some controllers indicate Bluetooth 1.2 support, 3740 * but do not have support for this command. If that is the case, 3741 * the driver can quirk the behavior and skip reading the local 3742 * supported commands. 3743 */ 3744 if (hdev->hci_ver > BLUETOOTH_VER_1_1 && 3745 !hci_test_quirk(hdev, HCI_QUIRK_BROKEN_LOCAL_COMMANDS)) 3746 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_COMMANDS, 3747 0, NULL, HCI_CMD_TIMEOUT); 3748 3749 return 0; 3750} 3751 3752static int hci_init1_sync(struct hci_dev *hdev) 3753{ 3754 int err; 3755 3756 bt_dev_dbg(hdev, ""); 3757 3758 /* Reset */ 3759 if (!hci_test_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE)) { 3760 err = hci_reset_sync(hdev); 3761 if (err) 3762 return err; 3763 } 3764 3765 return hci_init_stage_sync(hdev, br_init1); 3766} 3767 3768/* Read Buffer Size (ACL mtu, max pkt, etc.) */ 3769static int hci_read_buffer_size_sync(struct hci_dev *hdev) 3770{ 3771 return __hci_cmd_sync_status(hdev, HCI_OP_READ_BUFFER_SIZE, 3772 0, NULL, HCI_CMD_TIMEOUT); 3773} 3774 3775/* Read Class of Device */ 3776static int hci_read_dev_class_sync(struct hci_dev *hdev) 3777{ 3778 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CLASS_OF_DEV, 3779 0, NULL, HCI_CMD_TIMEOUT); 3780} 3781 3782/* Read Local Name */ 3783static int hci_read_local_name_sync(struct hci_dev *hdev) 3784{ 3785 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_NAME, 3786 0, NULL, HCI_CMD_TIMEOUT); 3787} 3788 3789/* Read Voice Setting */ 3790static int hci_read_voice_setting_sync(struct hci_dev *hdev) 3791{ 3792 if (!read_voice_setting_capable(hdev)) 3793 return 0; 3794 3795 return __hci_cmd_sync_status(hdev, HCI_OP_READ_VOICE_SETTING, 3796 0, NULL, HCI_CMD_TIMEOUT); 3797} 3798 3799/* Read Number of Supported IAC */ 3800static int hci_read_num_supported_iac_sync(struct hci_dev *hdev) 3801{ 3802 return __hci_cmd_sync_status(hdev, HCI_OP_READ_NUM_SUPPORTED_IAC, 3803 0, NULL, HCI_CMD_TIMEOUT); 3804} 3805 3806/* Read Current IAC LAP */ 3807static int hci_read_current_iac_lap_sync(struct hci_dev *hdev) 3808{ 3809 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CURRENT_IAC_LAP, 3810 0, NULL, HCI_CMD_TIMEOUT); 3811} 3812 3813static int hci_set_event_filter_sync(struct hci_dev *hdev, u8 flt_type, 3814 u8 cond_type, bdaddr_t *bdaddr, 3815 u8 auto_accept) 3816{ 3817 struct hci_cp_set_event_filter cp; 3818 3819 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 3820 return 0; 3821 3822 if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL)) 3823 return 0; 3824 3825 memset(&cp, 0, sizeof(cp)); 3826 cp.flt_type = flt_type; 3827 3828 if (flt_type != HCI_FLT_CLEAR_ALL) { 3829 cp.cond_type = cond_type; 3830 bacpy(&cp.addr_conn_flt.bdaddr, bdaddr); 3831 cp.addr_conn_flt.auto_accept = auto_accept; 3832 } 3833 3834 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_FLT, 3835 flt_type == HCI_FLT_CLEAR_ALL ? 3836 sizeof(cp.flt_type) : sizeof(cp), &cp, 3837 HCI_CMD_TIMEOUT); 3838} 3839 3840static int hci_clear_event_filter_sync(struct hci_dev *hdev) 3841{ 3842 if (!hci_dev_test_flag(hdev, HCI_EVENT_FILTER_CONFIGURED)) 3843 return 0; 3844 3845 /* In theory the state machine should not reach here unless 3846 * a hci_set_event_filter_sync() call succeeds, but we do 3847 * the check both for parity and as a future reminder. 3848 */ 3849 if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL)) 3850 return 0; 3851 3852 return hci_set_event_filter_sync(hdev, HCI_FLT_CLEAR_ALL, 0x00, 3853 BDADDR_ANY, 0x00); 3854} 3855 3856/* Connection accept timeout ~20 secs */ 3857static int hci_write_ca_timeout_sync(struct hci_dev *hdev) 3858{ 3859 __le16 param = cpu_to_le16(0x7d00); 3860 3861 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CA_TIMEOUT, 3862 sizeof(param), ¶m, HCI_CMD_TIMEOUT); 3863} 3864 3865/* Enable SCO flow control if supported */ 3866static int hci_write_sync_flowctl_sync(struct hci_dev *hdev) 3867{ 3868 struct hci_cp_write_sync_flowctl cp; 3869 int err; 3870 3871 /* Check if the controller supports SCO and HCI_OP_WRITE_SYNC_FLOWCTL */ 3872 if (!lmp_sco_capable(hdev) || !(hdev->commands[10] & BIT(4)) || 3873 !hci_test_quirk(hdev, HCI_QUIRK_SYNC_FLOWCTL_SUPPORTED)) 3874 return 0; 3875 3876 memset(&cp, 0, sizeof(cp)); 3877 cp.enable = 0x01; 3878 3879 err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SYNC_FLOWCTL, 3880 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 3881 if (!err) 3882 hci_dev_set_flag(hdev, HCI_SCO_FLOWCTL); 3883 3884 return err; 3885} 3886 3887/* BR Controller init stage 2 command sequence */ 3888static const struct hci_init_stage br_init2[] = { 3889 /* HCI_OP_READ_BUFFER_SIZE */ 3890 HCI_INIT(hci_read_buffer_size_sync), 3891 /* HCI_OP_READ_CLASS_OF_DEV */ 3892 HCI_INIT(hci_read_dev_class_sync), 3893 /* HCI_OP_READ_LOCAL_NAME */ 3894 HCI_INIT(hci_read_local_name_sync), 3895 /* HCI_OP_READ_VOICE_SETTING */ 3896 HCI_INIT(hci_read_voice_setting_sync), 3897 /* HCI_OP_READ_NUM_SUPPORTED_IAC */ 3898 HCI_INIT(hci_read_num_supported_iac_sync), 3899 /* HCI_OP_READ_CURRENT_IAC_LAP */ 3900 HCI_INIT(hci_read_current_iac_lap_sync), 3901 /* HCI_OP_SET_EVENT_FLT */ 3902 HCI_INIT(hci_clear_event_filter_sync), 3903 /* HCI_OP_WRITE_CA_TIMEOUT */ 3904 HCI_INIT(hci_write_ca_timeout_sync), 3905 /* HCI_OP_WRITE_SYNC_FLOWCTL */ 3906 HCI_INIT(hci_write_sync_flowctl_sync), 3907 {} 3908}; 3909 3910static int hci_write_ssp_mode_1_sync(struct hci_dev *hdev) 3911{ 3912 u8 mode = 0x01; 3913 3914 if (!lmp_ssp_capable(hdev) || !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 3915 return 0; 3916 3917 /* When SSP is available, then the host features page 3918 * should also be available as well. However some 3919 * controllers list the max_page as 0 as long as SSP 3920 * has not been enabled. To achieve proper debugging 3921 * output, force the minimum max_page to 1 at least. 3922 */ 3923 hdev->max_page = 0x01; 3924 3925 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_MODE, 3926 sizeof(mode), &mode, HCI_CMD_TIMEOUT); 3927} 3928 3929static int hci_write_eir_sync(struct hci_dev *hdev) 3930{ 3931 struct hci_cp_write_eir cp; 3932 3933 if (!lmp_ssp_capable(hdev) || hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 3934 return 0; 3935 3936 memset(hdev->eir, 0, sizeof(hdev->eir)); 3937 memset(&cp, 0, sizeof(cp)); 3938 3939 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp, 3940 HCI_CMD_TIMEOUT); 3941} 3942 3943static int hci_write_inquiry_mode_sync(struct hci_dev *hdev) 3944{ 3945 u8 mode; 3946 3947 if (!lmp_inq_rssi_capable(hdev) && 3948 !hci_test_quirk(hdev, HCI_QUIRK_FIXUP_INQUIRY_MODE)) 3949 return 0; 3950 3951 /* If Extended Inquiry Result events are supported, then 3952 * they are clearly preferred over Inquiry Result with RSSI 3953 * events. 3954 */ 3955 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01; 3956 3957 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_INQUIRY_MODE, 3958 sizeof(mode), &mode, HCI_CMD_TIMEOUT); 3959} 3960 3961static int hci_read_inq_rsp_tx_power_sync(struct hci_dev *hdev) 3962{ 3963 if (!lmp_inq_tx_pwr_capable(hdev)) 3964 return 0; 3965 3966 return __hci_cmd_sync_status(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 3967 0, NULL, HCI_CMD_TIMEOUT); 3968} 3969 3970static int hci_read_local_ext_features_sync(struct hci_dev *hdev, u8 page) 3971{ 3972 struct hci_cp_read_local_ext_features cp; 3973 3974 if (!lmp_ext_feat_capable(hdev)) 3975 return 0; 3976 3977 memset(&cp, 0, sizeof(cp)); 3978 cp.page = page; 3979 3980 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, 3981 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 3982} 3983 3984static int hci_read_local_ext_features_1_sync(struct hci_dev *hdev) 3985{ 3986 return hci_read_local_ext_features_sync(hdev, 0x01); 3987} 3988 3989/* HCI Controller init stage 2 command sequence */ 3990static const struct hci_init_stage hci_init2[] = { 3991 /* HCI_OP_READ_LOCAL_COMMANDS */ 3992 HCI_INIT(hci_read_local_cmds_sync), 3993 /* HCI_OP_WRITE_SSP_MODE */ 3994 HCI_INIT(hci_write_ssp_mode_1_sync), 3995 /* HCI_OP_WRITE_EIR */ 3996 HCI_INIT(hci_write_eir_sync), 3997 /* HCI_OP_WRITE_INQUIRY_MODE */ 3998 HCI_INIT(hci_write_inquiry_mode_sync), 3999 /* HCI_OP_READ_INQ_RSP_TX_POWER */ 4000 HCI_INIT(hci_read_inq_rsp_tx_power_sync), 4001 /* HCI_OP_READ_LOCAL_EXT_FEATURES */ 4002 HCI_INIT(hci_read_local_ext_features_1_sync), 4003 /* HCI_OP_WRITE_AUTH_ENABLE */ 4004 HCI_INIT(hci_write_auth_enable_sync), 4005 {} 4006}; 4007 4008/* Read LE Buffer Size */ 4009static int hci_le_read_buffer_size_sync(struct hci_dev *hdev) 4010{ 4011 /* Use Read LE Buffer Size V2 if supported */ 4012 if (iso_capable(hdev) && hdev->commands[41] & 0x20) 4013 return __hci_cmd_sync_status(hdev, 4014 HCI_OP_LE_READ_BUFFER_SIZE_V2, 4015 0, NULL, HCI_CMD_TIMEOUT); 4016 4017 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 4018 0, NULL, HCI_CMD_TIMEOUT); 4019} 4020 4021/* Read LE Local Supported Features */ 4022static int hci_le_read_local_features_sync(struct hci_dev *hdev) 4023{ 4024 int err; 4025 4026 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_LOCAL_FEATURES, 4027 0, NULL, HCI_CMD_TIMEOUT); 4028 if (err) 4029 return err; 4030 4031 if (ll_ext_feature_capable(hdev) && hdev->commands[47] & BIT(2)) 4032 return __hci_cmd_sync_status(hdev, 4033 HCI_OP_LE_READ_ALL_LOCAL_FEATURES, 4034 0, NULL, HCI_CMD_TIMEOUT); 4035 4036 return err; 4037} 4038 4039/* Read LE Supported States */ 4040static int hci_le_read_supported_states_sync(struct hci_dev *hdev) 4041{ 4042 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_SUPPORTED_STATES, 4043 0, NULL, HCI_CMD_TIMEOUT); 4044} 4045 4046/* LE Controller init stage 2 command sequence */ 4047static const struct hci_init_stage le_init2[] = { 4048 /* HCI_OP_LE_READ_LOCAL_FEATURES */ 4049 HCI_INIT(hci_le_read_local_features_sync), 4050 /* HCI_OP_LE_READ_BUFFER_SIZE */ 4051 HCI_INIT(hci_le_read_buffer_size_sync), 4052 /* HCI_OP_LE_READ_SUPPORTED_STATES */ 4053 HCI_INIT(hci_le_read_supported_states_sync), 4054 {} 4055}; 4056 4057static int hci_init2_sync(struct hci_dev *hdev) 4058{ 4059 int err; 4060 4061 bt_dev_dbg(hdev, ""); 4062 4063 err = hci_init_stage_sync(hdev, hci_init2); 4064 if (err) 4065 return err; 4066 4067 if (lmp_bredr_capable(hdev)) { 4068 err = hci_init_stage_sync(hdev, br_init2); 4069 if (err) 4070 return err; 4071 } else { 4072 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 4073 } 4074 4075 if (lmp_le_capable(hdev)) { 4076 err = hci_init_stage_sync(hdev, le_init2); 4077 if (err) 4078 return err; 4079 /* LE-only controllers have LE implicitly enabled */ 4080 if (!lmp_bredr_capable(hdev)) 4081 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 4082 } 4083 4084 return 0; 4085} 4086 4087static int hci_set_event_mask_sync(struct hci_dev *hdev) 4088{ 4089 /* The second byte is 0xff instead of 0x9f (two reserved bits 4090 * disabled) since a Broadcom 1.2 dongle doesn't respond to the 4091 * command otherwise. 4092 */ 4093 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 }; 4094 4095 /* CSR 1.1 dongles does not accept any bitfield so don't try to set 4096 * any event mask for pre 1.2 devices. 4097 */ 4098 if (hdev->hci_ver < BLUETOOTH_VER_1_2) 4099 return 0; 4100 4101 if (lmp_bredr_capable(hdev)) { 4102 events[4] |= 0x01; /* Flow Specification Complete */ 4103 4104 /* Don't set Disconnect Complete and mode change when 4105 * suspended as that would wakeup the host when disconnecting 4106 * due to suspend. 4107 */ 4108 if (hdev->suspended) { 4109 events[0] &= 0xef; 4110 events[2] &= 0xf7; 4111 } 4112 } else { 4113 /* Use a different default for LE-only devices */ 4114 memset(events, 0, sizeof(events)); 4115 events[1] |= 0x20; /* Command Complete */ 4116 events[1] |= 0x40; /* Command Status */ 4117 events[1] |= 0x80; /* Hardware Error */ 4118 4119 /* If the controller supports the Disconnect command, enable 4120 * the corresponding event. In addition enable packet flow 4121 * control related events. 4122 */ 4123 if (hdev->commands[0] & 0x20) { 4124 /* Don't set Disconnect Complete when suspended as that 4125 * would wakeup the host when disconnecting due to 4126 * suspend. 4127 */ 4128 if (!hdev->suspended) 4129 events[0] |= 0x10; /* Disconnection Complete */ 4130 events[2] |= 0x04; /* Number of Completed Packets */ 4131 events[3] |= 0x02; /* Data Buffer Overflow */ 4132 } 4133 4134 /* If the controller supports the Read Remote Version 4135 * Information command, enable the corresponding event. 4136 */ 4137 if (hdev->commands[2] & 0x80) 4138 events[1] |= 0x08; /* Read Remote Version Information 4139 * Complete 4140 */ 4141 4142 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) { 4143 events[0] |= 0x80; /* Encryption Change */ 4144 events[5] |= 0x80; /* Encryption Key Refresh Complete */ 4145 } 4146 } 4147 4148 if (lmp_inq_rssi_capable(hdev) || 4149 hci_test_quirk(hdev, HCI_QUIRK_FIXUP_INQUIRY_MODE)) 4150 events[4] |= 0x02; /* Inquiry Result with RSSI */ 4151 4152 if (lmp_ext_feat_capable(hdev)) 4153 events[4] |= 0x04; /* Read Remote Extended Features Complete */ 4154 4155 if (lmp_esco_capable(hdev)) { 4156 events[5] |= 0x08; /* Synchronous Connection Complete */ 4157 events[5] |= 0x10; /* Synchronous Connection Changed */ 4158 } 4159 4160 if (lmp_sniffsubr_capable(hdev)) 4161 events[5] |= 0x20; /* Sniff Subrating */ 4162 4163 if (lmp_pause_enc_capable(hdev)) 4164 events[5] |= 0x80; /* Encryption Key Refresh Complete */ 4165 4166 if (lmp_ext_inq_capable(hdev)) 4167 events[5] |= 0x40; /* Extended Inquiry Result */ 4168 4169 if (lmp_no_flush_capable(hdev)) 4170 events[7] |= 0x01; /* Enhanced Flush Complete */ 4171 4172 if (lmp_lsto_capable(hdev)) 4173 events[6] |= 0x80; /* Link Supervision Timeout Changed */ 4174 4175 if (lmp_ssp_capable(hdev)) { 4176 events[6] |= 0x01; /* IO Capability Request */ 4177 events[6] |= 0x02; /* IO Capability Response */ 4178 events[6] |= 0x04; /* User Confirmation Request */ 4179 events[6] |= 0x08; /* User Passkey Request */ 4180 events[6] |= 0x10; /* Remote OOB Data Request */ 4181 events[6] |= 0x20; /* Simple Pairing Complete */ 4182 events[7] |= 0x04; /* User Passkey Notification */ 4183 events[7] |= 0x08; /* Keypress Notification */ 4184 events[7] |= 0x10; /* Remote Host Supported 4185 * Features Notification 4186 */ 4187 } 4188 4189 if (lmp_le_capable(hdev)) 4190 events[7] |= 0x20; /* LE Meta-Event */ 4191 4192 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_MASK, 4193 sizeof(events), events, HCI_CMD_TIMEOUT); 4194} 4195 4196static int hci_read_stored_link_key_sync(struct hci_dev *hdev) 4197{ 4198 struct hci_cp_read_stored_link_key cp; 4199 4200 if (!(hdev->commands[6] & 0x20) || 4201 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY)) 4202 return 0; 4203 4204 memset(&cp, 0, sizeof(cp)); 4205 bacpy(&cp.bdaddr, BDADDR_ANY); 4206 cp.read_all = 0x01; 4207 4208 return __hci_cmd_sync_status(hdev, HCI_OP_READ_STORED_LINK_KEY, 4209 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4210} 4211 4212static int hci_setup_link_policy_sync(struct hci_dev *hdev) 4213{ 4214 struct hci_cp_write_def_link_policy cp; 4215 u16 link_policy = 0; 4216 4217 if (!(hdev->commands[5] & 0x10)) 4218 return 0; 4219 4220 memset(&cp, 0, sizeof(cp)); 4221 4222 if (lmp_rswitch_capable(hdev)) 4223 link_policy |= HCI_LP_RSWITCH; 4224 if (lmp_hold_capable(hdev)) 4225 link_policy |= HCI_LP_HOLD; 4226 if (lmp_sniff_capable(hdev)) 4227 link_policy |= HCI_LP_SNIFF; 4228 if (lmp_park_capable(hdev)) 4229 link_policy |= HCI_LP_PARK; 4230 4231 cp.policy = cpu_to_le16(link_policy); 4232 4233 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 4234 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4235} 4236 4237static int hci_read_page_scan_activity_sync(struct hci_dev *hdev) 4238{ 4239 if (!(hdev->commands[8] & 0x01)) 4240 return 0; 4241 4242 return __hci_cmd_sync_status(hdev, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 4243 0, NULL, HCI_CMD_TIMEOUT); 4244} 4245 4246static int hci_read_def_err_data_reporting_sync(struct hci_dev *hdev) 4247{ 4248 if (!(hdev->commands[18] & 0x04) || 4249 !(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) || 4250 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_ERR_DATA_REPORTING)) 4251 return 0; 4252 4253 return __hci_cmd_sync_status(hdev, HCI_OP_READ_DEF_ERR_DATA_REPORTING, 4254 0, NULL, HCI_CMD_TIMEOUT); 4255} 4256 4257static int hci_read_page_scan_type_sync(struct hci_dev *hdev) 4258{ 4259 /* Some older Broadcom based Bluetooth 1.2 controllers do not 4260 * support the Read Page Scan Type command. Check support for 4261 * this command in the bit mask of supported commands. 4262 */ 4263 if (!(hdev->commands[13] & 0x01) || 4264 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE)) 4265 return 0; 4266 4267 return __hci_cmd_sync_status(hdev, HCI_OP_READ_PAGE_SCAN_TYPE, 4268 0, NULL, HCI_CMD_TIMEOUT); 4269} 4270 4271/* Read features beyond page 1 if available */ 4272static int hci_read_local_ext_features_all_sync(struct hci_dev *hdev) 4273{ 4274 u8 page; 4275 int err; 4276 4277 if (!lmp_ext_feat_capable(hdev)) 4278 return 0; 4279 4280 for (page = 2; page < HCI_MAX_PAGES && page <= hdev->max_page; 4281 page++) { 4282 err = hci_read_local_ext_features_sync(hdev, page); 4283 if (err) 4284 return err; 4285 } 4286 4287 return 0; 4288} 4289 4290/* HCI Controller init stage 3 command sequence */ 4291static const struct hci_init_stage hci_init3[] = { 4292 /* HCI_OP_SET_EVENT_MASK */ 4293 HCI_INIT(hci_set_event_mask_sync), 4294 /* HCI_OP_READ_STORED_LINK_KEY */ 4295 HCI_INIT(hci_read_stored_link_key_sync), 4296 /* HCI_OP_WRITE_DEF_LINK_POLICY */ 4297 HCI_INIT(hci_setup_link_policy_sync), 4298 /* HCI_OP_READ_PAGE_SCAN_ACTIVITY */ 4299 HCI_INIT(hci_read_page_scan_activity_sync), 4300 /* HCI_OP_READ_DEF_ERR_DATA_REPORTING */ 4301 HCI_INIT(hci_read_def_err_data_reporting_sync), 4302 /* HCI_OP_READ_PAGE_SCAN_TYPE */ 4303 HCI_INIT(hci_read_page_scan_type_sync), 4304 /* HCI_OP_READ_LOCAL_EXT_FEATURES */ 4305 HCI_INIT(hci_read_local_ext_features_all_sync), 4306 {} 4307}; 4308 4309static int hci_le_set_event_mask_sync(struct hci_dev *hdev) 4310{ 4311 u8 events[8]; 4312 4313 if (!lmp_le_capable(hdev)) 4314 return 0; 4315 4316 memset(events, 0, sizeof(events)); 4317 4318 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) 4319 events[0] |= 0x10; /* LE Long Term Key Request */ 4320 4321 /* If controller supports the Connection Parameters Request 4322 * Link Layer Procedure, enable the corresponding event. 4323 */ 4324 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC) 4325 /* LE Remote Connection Parameter Request */ 4326 events[0] |= 0x20; 4327 4328 /* If the controller supports the Data Length Extension 4329 * feature, enable the corresponding event. 4330 */ 4331 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) 4332 events[0] |= 0x40; /* LE Data Length Change */ 4333 4334 /* If the controller supports LL Privacy feature or LE Extended Adv, 4335 * enable the corresponding event. 4336 */ 4337 if (use_enhanced_conn_complete(hdev)) 4338 events[1] |= 0x02; /* LE Enhanced Connection Complete */ 4339 4340 /* Mark Device Privacy if Privacy Mode is supported */ 4341 if (privacy_mode_capable(hdev)) 4342 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY; 4343 4344 /* Mark Address Resolution if LL Privacy is supported */ 4345 if (ll_privacy_capable(hdev)) 4346 hdev->conn_flags |= HCI_CONN_FLAG_ADDRESS_RESOLUTION; 4347 4348 /* Mark PAST if supported */ 4349 if (past_capable(hdev)) 4350 hdev->conn_flags |= HCI_CONN_FLAG_PAST; 4351 4352 /* If the controller supports Extended Scanner Filter 4353 * Policies, enable the corresponding event. 4354 */ 4355 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY) 4356 events[1] |= 0x04; /* LE Direct Advertising Report */ 4357 4358 /* If the controller supports Channel Selection Algorithm #2 4359 * feature, enable the corresponding event. 4360 */ 4361 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2) 4362 events[2] |= 0x08; /* LE Channel Selection Algorithm */ 4363 4364 /* If the controller supports the LE Set Scan Enable command, 4365 * enable the corresponding advertising report event. 4366 */ 4367 if (hdev->commands[26] & 0x08) 4368 events[0] |= 0x02; /* LE Advertising Report */ 4369 4370 /* If the controller supports the LE Create Connection 4371 * command, enable the corresponding event. 4372 */ 4373 if (hdev->commands[26] & 0x10) 4374 events[0] |= 0x01; /* LE Connection Complete */ 4375 4376 /* If the controller supports the LE Connection Update 4377 * command, enable the corresponding event. 4378 */ 4379 if (hdev->commands[27] & 0x04) 4380 events[0] |= 0x04; /* LE Connection Update Complete */ 4381 4382 /* If the controller supports the LE Read Remote Used Features 4383 * command, enable the corresponding event. 4384 */ 4385 if (hdev->commands[27] & 0x20) 4386 /* LE Read Remote Used Features Complete */ 4387 events[0] |= 0x08; 4388 4389 /* If the controller supports the LE Read Local P-256 4390 * Public Key command, enable the corresponding event. 4391 */ 4392 if (hdev->commands[34] & 0x02) 4393 /* LE Read Local P-256 Public Key Complete */ 4394 events[0] |= 0x80; 4395 4396 /* If the controller supports the LE Generate DHKey 4397 * command, enable the corresponding event. 4398 */ 4399 if (hdev->commands[34] & 0x04) 4400 events[1] |= 0x01; /* LE Generate DHKey Complete */ 4401 4402 /* If the controller supports the LE Set Default PHY or 4403 * LE Set PHY commands, enable the corresponding event. 4404 */ 4405 if (hdev->commands[35] & (0x20 | 0x40)) 4406 events[1] |= 0x08; /* LE PHY Update Complete */ 4407 4408 /* If the controller supports LE Set Extended Scan Parameters 4409 * and LE Set Extended Scan Enable commands, enable the 4410 * corresponding event. 4411 */ 4412 if (use_ext_scan(hdev)) 4413 events[1] |= 0x10; /* LE Extended Advertising Report */ 4414 4415 /* If the controller supports the LE Extended Advertising 4416 * command, enable the corresponding event. 4417 */ 4418 if (ext_adv_capable(hdev)) 4419 events[2] |= 0x02; /* LE Advertising Set Terminated */ 4420 4421 if (past_receiver_capable(hdev)) 4422 events[2] |= 0x80; /* LE PAST Received */ 4423 4424 if (cis_capable(hdev)) { 4425 events[3] |= 0x01; /* LE CIS Established */ 4426 if (cis_peripheral_capable(hdev)) 4427 events[3] |= 0x02; /* LE CIS Request */ 4428 } 4429 4430 if (bis_capable(hdev)) { 4431 events[1] |= 0x20; /* LE PA Report */ 4432 events[1] |= 0x40; /* LE PA Sync Established */ 4433 events[1] |= 0x80; /* LE PA Sync Lost */ 4434 events[3] |= 0x04; /* LE Create BIG Complete */ 4435 events[3] |= 0x08; /* LE Terminate BIG Complete */ 4436 events[3] |= 0x10; /* LE BIG Sync Established */ 4437 events[3] |= 0x20; /* LE BIG Sync Loss */ 4438 events[4] |= 0x02; /* LE BIG Info Advertising Report */ 4439 } 4440 4441 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EVENT_MASK, 4442 sizeof(events), events, HCI_CMD_TIMEOUT); 4443} 4444 4445/* Read LE Advertising Channel TX Power */ 4446static int hci_le_read_adv_tx_power_sync(struct hci_dev *hdev) 4447{ 4448 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) { 4449 /* HCI TS spec forbids mixing of legacy and extended 4450 * advertising commands wherein READ_ADV_TX_POWER is 4451 * also included. So do not call it if extended adv 4452 * is supported otherwise controller will return 4453 * COMMAND_DISALLOWED for extended commands. 4454 */ 4455 return __hci_cmd_sync_status(hdev, 4456 HCI_OP_LE_READ_ADV_TX_POWER, 4457 0, NULL, HCI_CMD_TIMEOUT); 4458 } 4459 4460 return 0; 4461} 4462 4463/* Read LE Min/Max Tx Power*/ 4464static int hci_le_read_tx_power_sync(struct hci_dev *hdev) 4465{ 4466 if (!(hdev->commands[38] & 0x80) || 4467 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER)) 4468 return 0; 4469 4470 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_TRANSMIT_POWER, 4471 0, NULL, HCI_CMD_TIMEOUT); 4472} 4473 4474/* Read LE Accept List Size */ 4475static int hci_le_read_accept_list_size_sync(struct hci_dev *hdev) 4476{ 4477 if (!(hdev->commands[26] & 0x40)) 4478 return 0; 4479 4480 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_ACCEPT_LIST_SIZE, 4481 0, NULL, HCI_CMD_TIMEOUT); 4482} 4483 4484/* Read LE Resolving List Size */ 4485static int hci_le_read_resolv_list_size_sync(struct hci_dev *hdev) 4486{ 4487 if (!(hdev->commands[34] & 0x40)) 4488 return 0; 4489 4490 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_RESOLV_LIST_SIZE, 4491 0, NULL, HCI_CMD_TIMEOUT); 4492} 4493 4494/* Clear LE Resolving List */ 4495static int hci_le_clear_resolv_list_sync(struct hci_dev *hdev) 4496{ 4497 if (!(hdev->commands[34] & 0x20)) 4498 return 0; 4499 4500 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL, 4501 HCI_CMD_TIMEOUT); 4502} 4503 4504/* Set RPA timeout */ 4505static int hci_le_set_rpa_timeout_sync(struct hci_dev *hdev) 4506{ 4507 __le16 timeout = cpu_to_le16(hdev->rpa_timeout); 4508 4509 if (!(hdev->commands[35] & 0x04) || 4510 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT)) 4511 return 0; 4512 4513 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_RPA_TIMEOUT, 4514 sizeof(timeout), &timeout, 4515 HCI_CMD_TIMEOUT); 4516} 4517 4518/* Read LE Maximum Data Length */ 4519static int hci_le_read_max_data_len_sync(struct hci_dev *hdev) 4520{ 4521 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)) 4522 return 0; 4523 4524 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL, 4525 HCI_CMD_TIMEOUT); 4526} 4527 4528/* Read LE Suggested Default Data Length */ 4529static int hci_le_read_def_data_len_sync(struct hci_dev *hdev) 4530{ 4531 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)) 4532 return 0; 4533 4534 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL, 4535 HCI_CMD_TIMEOUT); 4536} 4537 4538/* Read LE Number of Supported Advertising Sets */ 4539static int hci_le_read_num_support_adv_sets_sync(struct hci_dev *hdev) 4540{ 4541 if (!ext_adv_capable(hdev)) 4542 return 0; 4543 4544 return __hci_cmd_sync_status(hdev, 4545 HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS, 4546 0, NULL, HCI_CMD_TIMEOUT); 4547} 4548 4549/* Write LE Host Supported */ 4550static int hci_set_le_support_sync(struct hci_dev *hdev) 4551{ 4552 struct hci_cp_write_le_host_supported cp; 4553 4554 /* LE-only devices do not support explicit enablement */ 4555 if (!lmp_bredr_capable(hdev)) 4556 return 0; 4557 4558 memset(&cp, 0, sizeof(cp)); 4559 4560 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 4561 cp.le = 0x01; 4562 cp.simul = 0x00; 4563 } 4564 4565 if (cp.le == lmp_host_le_capable(hdev)) 4566 return 0; 4567 4568 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, 4569 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4570} 4571 4572/* LE Set Host Feature */ 4573static int hci_le_set_host_feature_sync(struct hci_dev *hdev) 4574{ 4575 struct hci_cp_le_set_host_feature cp; 4576 4577 if (!cis_capable(hdev)) 4578 return 0; 4579 4580 memset(&cp, 0, sizeof(cp)); 4581 4582 /* Connected Isochronous Channels (Host Support) */ 4583 cp.bit_number = 32; 4584 cp.bit_value = iso_enabled(hdev) ? 0x01 : 0x00; 4585 4586 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_HOST_FEATURE, 4587 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4588} 4589 4590/* LE Controller init stage 3 command sequence */ 4591static const struct hci_init_stage le_init3[] = { 4592 /* HCI_OP_LE_SET_EVENT_MASK */ 4593 HCI_INIT(hci_le_set_event_mask_sync), 4594 /* HCI_OP_LE_READ_ADV_TX_POWER */ 4595 HCI_INIT(hci_le_read_adv_tx_power_sync), 4596 /* HCI_OP_LE_READ_TRANSMIT_POWER */ 4597 HCI_INIT(hci_le_read_tx_power_sync), 4598 /* HCI_OP_LE_READ_ACCEPT_LIST_SIZE */ 4599 HCI_INIT(hci_le_read_accept_list_size_sync), 4600 /* HCI_OP_LE_CLEAR_ACCEPT_LIST */ 4601 HCI_INIT(hci_le_clear_accept_list_sync), 4602 /* HCI_OP_LE_READ_RESOLV_LIST_SIZE */ 4603 HCI_INIT(hci_le_read_resolv_list_size_sync), 4604 /* HCI_OP_LE_CLEAR_RESOLV_LIST */ 4605 HCI_INIT(hci_le_clear_resolv_list_sync), 4606 /* HCI_OP_LE_SET_RPA_TIMEOUT */ 4607 HCI_INIT(hci_le_set_rpa_timeout_sync), 4608 /* HCI_OP_LE_READ_MAX_DATA_LEN */ 4609 HCI_INIT(hci_le_read_max_data_len_sync), 4610 /* HCI_OP_LE_READ_DEF_DATA_LEN */ 4611 HCI_INIT(hci_le_read_def_data_len_sync), 4612 /* HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS */ 4613 HCI_INIT(hci_le_read_num_support_adv_sets_sync), 4614 /* HCI_OP_WRITE_LE_HOST_SUPPORTED */ 4615 HCI_INIT(hci_set_le_support_sync), 4616 /* HCI_OP_LE_SET_HOST_FEATURE */ 4617 HCI_INIT(hci_le_set_host_feature_sync), 4618 {} 4619}; 4620 4621static int hci_init3_sync(struct hci_dev *hdev) 4622{ 4623 int err; 4624 4625 bt_dev_dbg(hdev, ""); 4626 4627 err = hci_init_stage_sync(hdev, hci_init3); 4628 if (err) 4629 return err; 4630 4631 if (lmp_le_capable(hdev)) 4632 return hci_init_stage_sync(hdev, le_init3); 4633 4634 return 0; 4635} 4636 4637static int hci_delete_stored_link_key_sync(struct hci_dev *hdev) 4638{ 4639 struct hci_cp_delete_stored_link_key cp; 4640 4641 /* Some Broadcom based Bluetooth controllers do not support the 4642 * Delete Stored Link Key command. They are clearly indicating its 4643 * absence in the bit mask of supported commands. 4644 * 4645 * Check the supported commands and only if the command is marked 4646 * as supported send it. If not supported assume that the controller 4647 * does not have actual support for stored link keys which makes this 4648 * command redundant anyway. 4649 * 4650 * Some controllers indicate that they support handling deleting 4651 * stored link keys, but they don't. The quirk lets a driver 4652 * just disable this command. 4653 */ 4654 if (!(hdev->commands[6] & 0x80) || 4655 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY)) 4656 return 0; 4657 4658 memset(&cp, 0, sizeof(cp)); 4659 bacpy(&cp.bdaddr, BDADDR_ANY); 4660 cp.delete_all = 0x01; 4661 4662 return __hci_cmd_sync_status(hdev, HCI_OP_DELETE_STORED_LINK_KEY, 4663 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4664} 4665 4666static int hci_set_event_mask_page_2_sync(struct hci_dev *hdev) 4667{ 4668 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 4669 bool changed = false; 4670 4671 /* Set event mask page 2 if the HCI command for it is supported */ 4672 if (!(hdev->commands[22] & 0x04)) 4673 return 0; 4674 4675 /* If Connectionless Peripheral Broadcast central role is supported 4676 * enable all necessary events for it. 4677 */ 4678 if (lmp_cpb_central_capable(hdev)) { 4679 events[1] |= 0x40; /* Triggered Clock Capture */ 4680 events[1] |= 0x80; /* Synchronization Train Complete */ 4681 events[2] |= 0x08; /* Truncated Page Complete */ 4682 events[2] |= 0x20; /* CPB Channel Map Change */ 4683 changed = true; 4684 } 4685 4686 /* If Connectionless Peripheral Broadcast peripheral role is supported 4687 * enable all necessary events for it. 4688 */ 4689 if (lmp_cpb_peripheral_capable(hdev)) { 4690 events[2] |= 0x01; /* Synchronization Train Received */ 4691 events[2] |= 0x02; /* CPB Receive */ 4692 events[2] |= 0x04; /* CPB Timeout */ 4693 events[2] |= 0x10; /* Peripheral Page Response Timeout */ 4694 changed = true; 4695 } 4696 4697 /* Enable Authenticated Payload Timeout Expired event if supported */ 4698 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) { 4699 events[2] |= 0x80; 4700 changed = true; 4701 } 4702 4703 /* Some Broadcom based controllers indicate support for Set Event 4704 * Mask Page 2 command, but then actually do not support it. Since 4705 * the default value is all bits set to zero, the command is only 4706 * required if the event mask has to be changed. In case no change 4707 * to the event mask is needed, skip this command. 4708 */ 4709 if (!changed) 4710 return 0; 4711 4712 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_MASK_PAGE_2, 4713 sizeof(events), events, HCI_CMD_TIMEOUT); 4714} 4715 4716/* Read local codec list if the HCI command is supported */ 4717static int hci_read_local_codecs_sync(struct hci_dev *hdev) 4718{ 4719 if (hdev->commands[45] & 0x04) 4720 hci_read_supported_codecs_v2(hdev); 4721 else if (hdev->commands[29] & 0x20) 4722 hci_read_supported_codecs(hdev); 4723 4724 return 0; 4725} 4726 4727/* Read local pairing options if the HCI command is supported */ 4728static int hci_read_local_pairing_opts_sync(struct hci_dev *hdev) 4729{ 4730 if (!(hdev->commands[41] & 0x08)) 4731 return 0; 4732 4733 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_PAIRING_OPTS, 4734 0, NULL, HCI_CMD_TIMEOUT); 4735} 4736 4737/* Get MWS transport configuration if the HCI command is supported */ 4738static int hci_get_mws_transport_config_sync(struct hci_dev *hdev) 4739{ 4740 if (!mws_transport_config_capable(hdev)) 4741 return 0; 4742 4743 return __hci_cmd_sync_status(hdev, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 4744 0, NULL, HCI_CMD_TIMEOUT); 4745} 4746 4747/* Check for Synchronization Train support */ 4748static int hci_read_sync_train_params_sync(struct hci_dev *hdev) 4749{ 4750 if (!lmp_sync_train_capable(hdev)) 4751 return 0; 4752 4753 return __hci_cmd_sync_status(hdev, HCI_OP_READ_SYNC_TRAIN_PARAMS, 4754 0, NULL, HCI_CMD_TIMEOUT); 4755} 4756 4757/* Enable Secure Connections if supported and configured */ 4758static int hci_write_sc_support_1_sync(struct hci_dev *hdev) 4759{ 4760 u8 support = 0x01; 4761 4762 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED) || 4763 !bredr_sc_enabled(hdev)) 4764 return 0; 4765 4766 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SC_SUPPORT, 4767 sizeof(support), &support, 4768 HCI_CMD_TIMEOUT); 4769} 4770 4771/* Set erroneous data reporting if supported to the wideband speech 4772 * setting value 4773 */ 4774static int hci_set_err_data_report_sync(struct hci_dev *hdev) 4775{ 4776 struct hci_cp_write_def_err_data_reporting cp; 4777 bool enabled = hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED); 4778 4779 if (!(hdev->commands[18] & 0x08) || 4780 !(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) || 4781 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_ERR_DATA_REPORTING)) 4782 return 0; 4783 4784 if (enabled == hdev->err_data_reporting) 4785 return 0; 4786 4787 memset(&cp, 0, sizeof(cp)); 4788 cp.err_data_reporting = enabled ? ERR_DATA_REPORTING_ENABLED : 4789 ERR_DATA_REPORTING_DISABLED; 4790 4791 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING, 4792 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4793} 4794 4795static const struct hci_init_stage hci_init4[] = { 4796 /* HCI_OP_DELETE_STORED_LINK_KEY */ 4797 HCI_INIT(hci_delete_stored_link_key_sync), 4798 /* HCI_OP_SET_EVENT_MASK_PAGE_2 */ 4799 HCI_INIT(hci_set_event_mask_page_2_sync), 4800 /* HCI_OP_READ_LOCAL_CODECS */ 4801 HCI_INIT(hci_read_local_codecs_sync), 4802 /* HCI_OP_READ_LOCAL_PAIRING_OPTS */ 4803 HCI_INIT(hci_read_local_pairing_opts_sync), 4804 /* HCI_OP_GET_MWS_TRANSPORT_CONFIG */ 4805 HCI_INIT(hci_get_mws_transport_config_sync), 4806 /* HCI_OP_READ_SYNC_TRAIN_PARAMS */ 4807 HCI_INIT(hci_read_sync_train_params_sync), 4808 /* HCI_OP_WRITE_SC_SUPPORT */ 4809 HCI_INIT(hci_write_sc_support_1_sync), 4810 /* HCI_OP_WRITE_DEF_ERR_DATA_REPORTING */ 4811 HCI_INIT(hci_set_err_data_report_sync), 4812 {} 4813}; 4814 4815/* Set Suggested Default Data Length to maximum if supported */ 4816static int hci_le_set_write_def_data_len_sync(struct hci_dev *hdev) 4817{ 4818 struct hci_cp_le_write_def_data_len cp; 4819 4820 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)) 4821 return 0; 4822 4823 memset(&cp, 0, sizeof(cp)); 4824 cp.tx_len = cpu_to_le16(hdev->le_max_tx_len); 4825 cp.tx_time = cpu_to_le16(hdev->le_max_tx_time); 4826 4827 return __hci_cmd_sync_status(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN, 4828 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4829} 4830 4831/* Set Default PHY parameters if command is supported, enables all supported 4832 * PHYs according to the LE Features bits. 4833 */ 4834static int hci_le_set_default_phy_sync(struct hci_dev *hdev) 4835{ 4836 struct hci_cp_le_set_default_phy cp; 4837 4838 if (!(hdev->commands[35] & 0x20)) { 4839 /* If the command is not supported it means only 1M PHY is 4840 * supported. 4841 */ 4842 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M; 4843 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M; 4844 return 0; 4845 } 4846 4847 memset(&cp, 0, sizeof(cp)); 4848 cp.all_phys = 0x00; 4849 cp.tx_phys = HCI_LE_SET_PHY_1M; 4850 cp.rx_phys = HCI_LE_SET_PHY_1M; 4851 4852 /* Enables 2M PHY if supported */ 4853 if (le_2m_capable(hdev)) { 4854 cp.tx_phys |= HCI_LE_SET_PHY_2M; 4855 cp.rx_phys |= HCI_LE_SET_PHY_2M; 4856 } 4857 4858 /* Enables Coded PHY if supported */ 4859 if (le_coded_capable(hdev)) { 4860 cp.tx_phys |= HCI_LE_SET_PHY_CODED; 4861 cp.rx_phys |= HCI_LE_SET_PHY_CODED; 4862 } 4863 4864 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4865 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4866} 4867 4868static const struct hci_init_stage le_init4[] = { 4869 /* HCI_OP_LE_WRITE_DEF_DATA_LEN */ 4870 HCI_INIT(hci_le_set_write_def_data_len_sync), 4871 /* HCI_OP_LE_SET_DEFAULT_PHY */ 4872 HCI_INIT(hci_le_set_default_phy_sync), 4873 {} 4874}; 4875 4876static int hci_init4_sync(struct hci_dev *hdev) 4877{ 4878 int err; 4879 4880 bt_dev_dbg(hdev, ""); 4881 4882 err = hci_init_stage_sync(hdev, hci_init4); 4883 if (err) 4884 return err; 4885 4886 if (lmp_le_capable(hdev)) 4887 return hci_init_stage_sync(hdev, le_init4); 4888 4889 return 0; 4890} 4891 4892static int hci_init_sync(struct hci_dev *hdev) 4893{ 4894 int err; 4895 4896 err = hci_init1_sync(hdev); 4897 if (err < 0) 4898 return err; 4899 4900 if (hci_dev_test_flag(hdev, HCI_SETUP)) 4901 hci_debugfs_create_basic(hdev); 4902 4903 err = hci_init2_sync(hdev); 4904 if (err < 0) 4905 return err; 4906 4907 err = hci_init3_sync(hdev); 4908 if (err < 0) 4909 return err; 4910 4911 err = hci_init4_sync(hdev); 4912 if (err < 0) 4913 return err; 4914 4915 /* This function is only called when the controller is actually in 4916 * configured state. When the controller is marked as unconfigured, 4917 * this initialization procedure is not run. 4918 * 4919 * It means that it is possible that a controller runs through its 4920 * setup phase and then discovers missing settings. If that is the 4921 * case, then this function will not be called. It then will only 4922 * be called during the config phase. 4923 * 4924 * So only when in setup phase or config phase, create the debugfs 4925 * entries and register the SMP channels. 4926 */ 4927 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 4928 !hci_dev_test_flag(hdev, HCI_CONFIG)) 4929 return 0; 4930 4931 if (hci_dev_test_and_set_flag(hdev, HCI_DEBUGFS_CREATED)) 4932 return 0; 4933 4934 hci_debugfs_create_common(hdev); 4935 4936 if (lmp_bredr_capable(hdev)) 4937 hci_debugfs_create_bredr(hdev); 4938 4939 if (lmp_le_capable(hdev)) 4940 hci_debugfs_create_le(hdev); 4941 4942 return 0; 4943} 4944 4945#define HCI_QUIRK_BROKEN(_quirk, _desc) { HCI_QUIRK_BROKEN_##_quirk, _desc } 4946 4947static const struct { 4948 unsigned long quirk; 4949 const char *desc; 4950} hci_broken_table[] = { 4951 HCI_QUIRK_BROKEN(LOCAL_COMMANDS, 4952 "HCI Read Local Supported Commands not supported"), 4953 HCI_QUIRK_BROKEN(STORED_LINK_KEY, 4954 "HCI Delete Stored Link Key command is advertised, " 4955 "but not supported."), 4956 HCI_QUIRK_BROKEN(ERR_DATA_REPORTING, 4957 "HCI Read Default Erroneous Data Reporting command is " 4958 "advertised, but not supported."), 4959 HCI_QUIRK_BROKEN(READ_TRANSMIT_POWER, 4960 "HCI Read Transmit Power Level command is advertised, " 4961 "but not supported."), 4962 HCI_QUIRK_BROKEN(FILTER_CLEAR_ALL, 4963 "HCI Set Event Filter command not supported."), 4964 HCI_QUIRK_BROKEN(ENHANCED_SETUP_SYNC_CONN, 4965 "HCI Enhanced Setup Synchronous Connection command is " 4966 "advertised, but not supported."), 4967 HCI_QUIRK_BROKEN(SET_RPA_TIMEOUT, 4968 "HCI LE Set Random Private Address Timeout command is " 4969 "advertised, but not supported."), 4970 HCI_QUIRK_BROKEN(EXT_CREATE_CONN, 4971 "HCI LE Extended Create Connection command is " 4972 "advertised, but not supported."), 4973 HCI_QUIRK_BROKEN(WRITE_AUTH_PAYLOAD_TIMEOUT, 4974 "HCI WRITE AUTH PAYLOAD TIMEOUT command leads " 4975 "to unexpected SMP errors when pairing " 4976 "and will not be used."), 4977 HCI_QUIRK_BROKEN(LE_CODED, 4978 "HCI LE Coded PHY feature bit is set, " 4979 "but its usage is not supported.") 4980}; 4981 4982/* This function handles hdev setup stage: 4983 * 4984 * Calls hdev->setup 4985 * Setup address if HCI_QUIRK_USE_BDADDR_PROPERTY is set. 4986 */ 4987static int hci_dev_setup_sync(struct hci_dev *hdev) 4988{ 4989 int ret = 0; 4990 bool invalid_bdaddr; 4991 size_t i; 4992 4993 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 4994 !hci_test_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP)) 4995 return 0; 4996 4997 bt_dev_dbg(hdev, ""); 4998 4999 hci_sock_dev_event(hdev, HCI_DEV_SETUP); 5000 5001 if (hdev->setup) 5002 ret = hdev->setup(hdev); 5003 5004 for (i = 0; i < ARRAY_SIZE(hci_broken_table); i++) { 5005 if (hci_test_quirk(hdev, hci_broken_table[i].quirk)) 5006 bt_dev_warn(hdev, "%s", hci_broken_table[i].desc); 5007 } 5008 5009 /* The transport driver can set the quirk to mark the 5010 * BD_ADDR invalid before creating the HCI device or in 5011 * its setup callback. 5012 */ 5013 invalid_bdaddr = hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 5014 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY); 5015 if (!ret) { 5016 if (hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY) && 5017 !bacmp(&hdev->public_addr, BDADDR_ANY)) 5018 hci_dev_get_bd_addr_from_property(hdev); 5019 5020 if (invalid_bdaddr && bacmp(&hdev->public_addr, BDADDR_ANY) && 5021 hdev->set_bdaddr) { 5022 ret = hdev->set_bdaddr(hdev, &hdev->public_addr); 5023 if (!ret) 5024 invalid_bdaddr = false; 5025 } 5026 } 5027 5028 /* The transport driver can set these quirks before 5029 * creating the HCI device or in its setup callback. 5030 * 5031 * For the invalid BD_ADDR quirk it is possible that 5032 * it becomes a valid address if the bootloader does 5033 * provide it (see above). 5034 * 5035 * In case any of them is set, the controller has to 5036 * start up as unconfigured. 5037 */ 5038 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || 5039 invalid_bdaddr) 5040 hci_dev_set_flag(hdev, HCI_UNCONFIGURED); 5041 5042 /* For an unconfigured controller it is required to 5043 * read at least the version information provided by 5044 * the Read Local Version Information command. 5045 * 5046 * If the set_bdaddr driver callback is provided, then 5047 * also the original Bluetooth public device address 5048 * will be read using the Read BD Address command. 5049 */ 5050 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 5051 return hci_unconf_init_sync(hdev); 5052 5053 return ret; 5054} 5055 5056/* This function handles hdev init stage: 5057 * 5058 * Calls hci_dev_setup_sync to perform setup stage 5059 * Calls hci_init_sync to perform HCI command init sequence 5060 */ 5061static int hci_dev_init_sync(struct hci_dev *hdev) 5062{ 5063 int ret; 5064 5065 bt_dev_dbg(hdev, ""); 5066 5067 atomic_set(&hdev->cmd_cnt, 1); 5068 set_bit(HCI_INIT, &hdev->flags); 5069 5070 ret = hci_dev_setup_sync(hdev); 5071 5072 if (hci_dev_test_flag(hdev, HCI_CONFIG)) { 5073 /* If public address change is configured, ensure that 5074 * the address gets programmed. If the driver does not 5075 * support changing the public address, fail the power 5076 * on procedure. 5077 */ 5078 if (bacmp(&hdev->public_addr, BDADDR_ANY) && 5079 hdev->set_bdaddr) 5080 ret = hdev->set_bdaddr(hdev, &hdev->public_addr); 5081 else 5082 ret = -EADDRNOTAVAIL; 5083 } 5084 5085 if (!ret) { 5086 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 5087 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 5088 ret = hci_init_sync(hdev); 5089 if (!ret && hdev->post_init) 5090 ret = hdev->post_init(hdev); 5091 } 5092 } 5093 5094 /* If the HCI Reset command is clearing all diagnostic settings, 5095 * then they need to be reprogrammed after the init procedure 5096 * completed. 5097 */ 5098 if (hci_test_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG) && 5099 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 5100 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag) 5101 ret = hdev->set_diag(hdev, true); 5102 5103 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 5104 msft_do_open(hdev); 5105 aosp_do_open(hdev); 5106 } 5107 5108 clear_bit(HCI_INIT, &hdev->flags); 5109 5110 return ret; 5111} 5112 5113int hci_dev_open_sync(struct hci_dev *hdev) 5114{ 5115 int ret; 5116 5117 bt_dev_dbg(hdev, ""); 5118 5119 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 5120 ret = -ENODEV; 5121 goto done; 5122 } 5123 5124 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 5125 !hci_dev_test_flag(hdev, HCI_CONFIG)) { 5126 /* Check for rfkill but allow the HCI setup stage to 5127 * proceed (which in itself doesn't cause any RF activity). 5128 */ 5129 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) { 5130 ret = -ERFKILL; 5131 goto done; 5132 } 5133 5134 /* Check for valid public address or a configured static 5135 * random address, but let the HCI setup proceed to 5136 * be able to determine if there is a public address 5137 * or not. 5138 * 5139 * In case of user channel usage, it is not important 5140 * if a public address or static random address is 5141 * available. 5142 */ 5143 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 5144 !bacmp(&hdev->bdaddr, BDADDR_ANY) && 5145 !bacmp(&hdev->static_addr, BDADDR_ANY)) { 5146 ret = -EADDRNOTAVAIL; 5147 goto done; 5148 } 5149 } 5150 5151 if (test_bit(HCI_UP, &hdev->flags)) { 5152 ret = -EALREADY; 5153 goto done; 5154 } 5155 5156 if (hdev->open(hdev)) { 5157 ret = -EIO; 5158 goto done; 5159 } 5160 5161 hci_devcd_reset(hdev); 5162 5163 set_bit(HCI_RUNNING, &hdev->flags); 5164 hci_sock_dev_event(hdev, HCI_DEV_OPEN); 5165 5166 ret = hci_dev_init_sync(hdev); 5167 if (!ret) { 5168 hci_dev_hold(hdev); 5169 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 5170 hci_adv_instances_set_rpa_expired(hdev, true); 5171 set_bit(HCI_UP, &hdev->flags); 5172 hci_sock_dev_event(hdev, HCI_DEV_UP); 5173 hci_leds_update_powered(hdev, true); 5174 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 5175 !hci_dev_test_flag(hdev, HCI_CONFIG) && 5176 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 5177 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 5178 hci_dev_test_flag(hdev, HCI_MGMT)) { 5179 ret = hci_powered_update_sync(hdev); 5180 mgmt_power_on(hdev, ret); 5181 } 5182 } else { 5183 /* Init failed, cleanup */ 5184 flush_work(&hdev->tx_work); 5185 5186 /* Since hci_rx_work() is possible to awake new cmd_work 5187 * it should be flushed first to avoid unexpected call of 5188 * hci_cmd_work() 5189 */ 5190 flush_work(&hdev->rx_work); 5191 flush_work(&hdev->cmd_work); 5192 5193 skb_queue_purge(&hdev->cmd_q); 5194 skb_queue_purge(&hdev->rx_q); 5195 5196 if (hdev->flush) 5197 hdev->flush(hdev); 5198 5199 if (hdev->sent_cmd) { 5200 cancel_delayed_work_sync(&hdev->cmd_timer); 5201 kfree_skb(hdev->sent_cmd); 5202 hdev->sent_cmd = NULL; 5203 } 5204 5205 if (hdev->req_skb) { 5206 kfree_skb(hdev->req_skb); 5207 hdev->req_skb = NULL; 5208 } 5209 5210 clear_bit(HCI_RUNNING, &hdev->flags); 5211 hci_sock_dev_event(hdev, HCI_DEV_CLOSE); 5212 5213 hdev->close(hdev); 5214 hdev->flags &= BIT(HCI_RAW); 5215 } 5216 5217done: 5218 return ret; 5219} 5220 5221/* This function requires the caller holds hdev->lock */ 5222static void hci_pend_le_actions_clear(struct hci_dev *hdev) 5223{ 5224 struct hci_conn_params *p; 5225 5226 list_for_each_entry(p, &hdev->le_conn_params, list) { 5227 hci_pend_le_list_del_init(p); 5228 if (p->conn) { 5229 hci_conn_drop(p->conn); 5230 hci_conn_put(p->conn); 5231 p->conn = NULL; 5232 } 5233 } 5234 5235 BT_DBG("All LE pending actions cleared"); 5236} 5237 5238static int hci_dev_shutdown(struct hci_dev *hdev) 5239{ 5240 int err = 0; 5241 /* Similar to how we first do setup and then set the exclusive access 5242 * bit for userspace, we must first unset userchannel and then clean up. 5243 * Otherwise, the kernel can't properly use the hci channel to clean up 5244 * the controller (some shutdown routines require sending additional 5245 * commands to the controller for example). 5246 */ 5247 bool was_userchannel = 5248 hci_dev_test_and_clear_flag(hdev, HCI_USER_CHANNEL); 5249 5250 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && 5251 test_bit(HCI_UP, &hdev->flags)) { 5252 /* Execute vendor specific shutdown routine */ 5253 if (hdev->shutdown) 5254 err = hdev->shutdown(hdev); 5255 } 5256 5257 if (was_userchannel) 5258 hci_dev_set_flag(hdev, HCI_USER_CHANNEL); 5259 5260 return err; 5261} 5262 5263int hci_dev_close_sync(struct hci_dev *hdev) 5264{ 5265 bool auto_off; 5266 int err = 0; 5267 5268 bt_dev_dbg(hdev, ""); 5269 5270 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 5271 disable_delayed_work(&hdev->power_off); 5272 disable_delayed_work(&hdev->ncmd_timer); 5273 disable_delayed_work(&hdev->le_scan_disable); 5274 } else { 5275 cancel_delayed_work(&hdev->power_off); 5276 cancel_delayed_work(&hdev->ncmd_timer); 5277 cancel_delayed_work(&hdev->le_scan_disable); 5278 } 5279 5280 hci_cmd_sync_cancel_sync(hdev, ENODEV); 5281 5282 cancel_interleave_scan(hdev); 5283 5284 if (hdev->adv_instance_timeout) { 5285 cancel_delayed_work_sync(&hdev->adv_instance_expire); 5286 hdev->adv_instance_timeout = 0; 5287 } 5288 5289 err = hci_dev_shutdown(hdev); 5290 5291 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { 5292 cancel_delayed_work_sync(&hdev->cmd_timer); 5293 return err; 5294 } 5295 5296 hci_leds_update_powered(hdev, false); 5297 5298 /* Flush RX and TX works */ 5299 flush_work(&hdev->tx_work); 5300 flush_work(&hdev->rx_work); 5301 5302 if (hdev->discov_timeout > 0) { 5303 hdev->discov_timeout = 0; 5304 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 5305 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 5306 } 5307 5308 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 5309 cancel_delayed_work(&hdev->service_cache); 5310 5311 if (hci_dev_test_flag(hdev, HCI_MGMT)) { 5312 struct adv_info *adv_instance; 5313 5314 cancel_delayed_work_sync(&hdev->rpa_expired); 5315 5316 list_for_each_entry(adv_instance, &hdev->adv_instances, list) 5317 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb); 5318 } 5319 5320 /* Avoid potential lockdep warnings from the *_flush() calls by 5321 * ensuring the workqueue is empty up front. 5322 */ 5323 drain_workqueue(hdev->workqueue); 5324 5325 hci_dev_lock(hdev); 5326 5327 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 5328 5329 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF); 5330 5331 if (!auto_off && !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 5332 hci_dev_test_flag(hdev, HCI_MGMT)) 5333 __mgmt_power_off(hdev); 5334 5335 hci_inquiry_cache_flush(hdev); 5336 hci_pend_le_actions_clear(hdev); 5337 hci_conn_hash_flush(hdev); 5338 /* Prevent data races on hdev->smp_data or hdev->smp_bredr_data */ 5339 smp_unregister(hdev); 5340 hci_dev_unlock(hdev); 5341 5342 hci_sock_dev_event(hdev, HCI_DEV_DOWN); 5343 5344 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 5345 aosp_do_close(hdev); 5346 msft_do_close(hdev); 5347 } 5348 5349 if (hdev->flush) 5350 hdev->flush(hdev); 5351 5352 /* Reset device */ 5353 skb_queue_purge(&hdev->cmd_q); 5354 atomic_set(&hdev->cmd_cnt, 1); 5355 if (hci_test_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE) && 5356 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 5357 set_bit(HCI_INIT, &hdev->flags); 5358 hci_reset_sync(hdev); 5359 clear_bit(HCI_INIT, &hdev->flags); 5360 } 5361 5362 /* flush cmd work */ 5363 flush_work(&hdev->cmd_work); 5364 5365 /* Drop queues */ 5366 skb_queue_purge(&hdev->rx_q); 5367 skb_queue_purge(&hdev->cmd_q); 5368 skb_queue_purge(&hdev->raw_q); 5369 5370 /* Drop last sent command */ 5371 if (hdev->sent_cmd) { 5372 cancel_delayed_work_sync(&hdev->cmd_timer); 5373 kfree_skb(hdev->sent_cmd); 5374 hdev->sent_cmd = NULL; 5375 } 5376 5377 /* Drop last request */ 5378 if (hdev->req_skb) { 5379 kfree_skb(hdev->req_skb); 5380 hdev->req_skb = NULL; 5381 } 5382 5383 clear_bit(HCI_RUNNING, &hdev->flags); 5384 hci_sock_dev_event(hdev, HCI_DEV_CLOSE); 5385 5386 /* After this point our queues are empty and no tasks are scheduled. */ 5387 hdev->close(hdev); 5388 5389 /* Clear flags */ 5390 hdev->flags &= BIT(HCI_RAW); 5391 hci_dev_clear_volatile_flags(hdev); 5392 5393 memset(hdev->eir, 0, sizeof(hdev->eir)); 5394 memset(hdev->dev_class, 0, sizeof(hdev->dev_class)); 5395 bacpy(&hdev->random_addr, BDADDR_ANY); 5396 hci_codec_list_clear(&hdev->local_codecs); 5397 5398 hci_dev_put(hdev); 5399 return err; 5400} 5401 5402/* This function perform power on HCI command sequence as follows: 5403 * 5404 * If controller is already up (HCI_UP) performs hci_powered_update_sync 5405 * sequence otherwise run hci_dev_open_sync which will follow with 5406 * hci_powered_update_sync after the init sequence is completed. 5407 */ 5408static int hci_power_on_sync(struct hci_dev *hdev) 5409{ 5410 int err; 5411 5412 if (test_bit(HCI_UP, &hdev->flags) && 5413 hci_dev_test_flag(hdev, HCI_MGMT) && 5414 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) { 5415 cancel_delayed_work(&hdev->power_off); 5416 return hci_powered_update_sync(hdev); 5417 } 5418 5419 err = hci_dev_open_sync(hdev); 5420 if (err < 0) 5421 return err; 5422 5423 /* During the HCI setup phase, a few error conditions are 5424 * ignored and they need to be checked now. If they are still 5425 * valid, it is important to return the device back off. 5426 */ 5427 if (hci_dev_test_flag(hdev, HCI_RFKILLED) || 5428 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) || 5429 (!bacmp(&hdev->bdaddr, BDADDR_ANY) && 5430 !bacmp(&hdev->static_addr, BDADDR_ANY))) { 5431 hci_dev_clear_flag(hdev, HCI_AUTO_OFF); 5432 hci_dev_close_sync(hdev); 5433 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) { 5434 queue_delayed_work(hdev->req_workqueue, &hdev->power_off, 5435 HCI_AUTO_OFF_TIMEOUT); 5436 } 5437 5438 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) { 5439 /* For unconfigured devices, set the HCI_RAW flag 5440 * so that userspace can easily identify them. 5441 */ 5442 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 5443 set_bit(HCI_RAW, &hdev->flags); 5444 5445 /* For fully configured devices, this will send 5446 * the Index Added event. For unconfigured devices, 5447 * it will send Unconfigued Index Added event. 5448 * 5449 * Devices with HCI_QUIRK_RAW_DEVICE are ignored 5450 * and no event will be send. 5451 */ 5452 mgmt_index_added(hdev); 5453 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) { 5454 /* When the controller is now configured, then it 5455 * is important to clear the HCI_RAW flag. 5456 */ 5457 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 5458 clear_bit(HCI_RAW, &hdev->flags); 5459 5460 /* Powering on the controller with HCI_CONFIG set only 5461 * happens with the transition from unconfigured to 5462 * configured. This will send the Index Added event. 5463 */ 5464 mgmt_index_added(hdev); 5465 } 5466 5467 return 0; 5468} 5469 5470static int hci_remote_name_cancel_sync(struct hci_dev *hdev, bdaddr_t *addr) 5471{ 5472 struct hci_cp_remote_name_req_cancel cp; 5473 5474 memset(&cp, 0, sizeof(cp)); 5475 bacpy(&cp.bdaddr, addr); 5476 5477 return __hci_cmd_sync_status(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL, 5478 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 5479} 5480 5481int hci_stop_discovery_sync(struct hci_dev *hdev) 5482{ 5483 struct discovery_state *d = &hdev->discovery; 5484 struct inquiry_entry *e; 5485 int err; 5486 5487 bt_dev_dbg(hdev, "state %u", hdev->discovery.state); 5488 5489 if (d->state == DISCOVERY_FINDING || d->state == DISCOVERY_STOPPING) { 5490 if (test_bit(HCI_INQUIRY, &hdev->flags)) { 5491 err = __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY_CANCEL, 5492 0, NULL, HCI_CMD_TIMEOUT); 5493 if (err) 5494 return err; 5495 } 5496 5497 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 5498 cancel_delayed_work(&hdev->le_scan_disable); 5499 5500 err = hci_scan_disable_sync(hdev); 5501 if (err) 5502 return err; 5503 } 5504 5505 } else { 5506 err = hci_scan_disable_sync(hdev); 5507 if (err) 5508 return err; 5509 } 5510 5511 /* Resume advertising if it was paused */ 5512 if (ll_privacy_capable(hdev)) 5513 hci_resume_advertising_sync(hdev); 5514 5515 /* No further actions needed for LE-only discovery */ 5516 if (d->type == DISCOV_TYPE_LE) 5517 return 0; 5518 5519 if (d->state == DISCOVERY_RESOLVING || d->state == DISCOVERY_STOPPING) { 5520 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, 5521 NAME_PENDING); 5522 if (!e) 5523 return 0; 5524 5525 /* Ignore cancel errors since it should interfere with stopping 5526 * of the discovery. 5527 */ 5528 hci_remote_name_cancel_sync(hdev, &e->data.bdaddr); 5529 } 5530 5531 return 0; 5532} 5533 5534static int hci_disconnect_sync(struct hci_dev *hdev, struct hci_conn *conn, 5535 u8 reason) 5536{ 5537 struct hci_cp_disconnect cp; 5538 5539 if (conn->type == BIS_LINK || conn->type == PA_LINK) { 5540 /* This is a BIS connection, hci_conn_del will 5541 * do the necessary cleanup. 5542 */ 5543 hci_dev_lock(hdev); 5544 hci_conn_failed(conn, reason); 5545 hci_dev_unlock(hdev); 5546 5547 return 0; 5548 } 5549 5550 memset(&cp, 0, sizeof(cp)); 5551 cp.handle = cpu_to_le16(conn->handle); 5552 cp.reason = reason; 5553 5554 /* Wait for HCI_EV_DISCONN_COMPLETE, not HCI_EV_CMD_STATUS, when the 5555 * reason is anything but HCI_ERROR_REMOTE_POWER_OFF. This reason is 5556 * used when suspending or powering off, where we don't want to wait 5557 * for the peer's response. 5558 */ 5559 if (reason != HCI_ERROR_REMOTE_POWER_OFF) 5560 return __hci_cmd_sync_status_sk(hdev, HCI_OP_DISCONNECT, 5561 sizeof(cp), &cp, 5562 HCI_EV_DISCONN_COMPLETE, 5563 HCI_CMD_TIMEOUT, NULL); 5564 5565 return __hci_cmd_sync_status(hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp, 5566 HCI_CMD_TIMEOUT); 5567} 5568 5569static int hci_le_connect_cancel_sync(struct hci_dev *hdev, 5570 struct hci_conn *conn, u8 reason) 5571{ 5572 /* Return reason if scanning since the connection shall probably be 5573 * cleanup directly. 5574 */ 5575 if (test_bit(HCI_CONN_SCANNING, &conn->flags)) 5576 return reason; 5577 5578 if (conn->role == HCI_ROLE_SLAVE || 5579 test_and_set_bit(HCI_CONN_CANCEL, &conn->flags)) 5580 return 0; 5581 5582 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 5583 0, NULL, HCI_CMD_TIMEOUT); 5584} 5585 5586static int hci_connect_cancel_sync(struct hci_dev *hdev, struct hci_conn *conn, 5587 u8 reason) 5588{ 5589 if (conn->type == LE_LINK) 5590 return hci_le_connect_cancel_sync(hdev, conn, reason); 5591 5592 if (conn->type == CIS_LINK) { 5593 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 5594 * page 1857: 5595 * 5596 * If this command is issued for a CIS on the Central and the 5597 * CIS is successfully terminated before being established, 5598 * then an HCI_LE_CIS_Established event shall also be sent for 5599 * this CIS with the Status Operation Cancelled by Host (0x44). 5600 */ 5601 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) 5602 return hci_disconnect_sync(hdev, conn, reason); 5603 5604 /* CIS with no Create CIS sent have nothing to cancel */ 5605 return HCI_ERROR_LOCAL_HOST_TERM; 5606 } 5607 5608 if (conn->type == BIS_LINK || conn->type == PA_LINK) { 5609 /* There is no way to cancel a BIS without terminating the BIG 5610 * which is done later on connection cleanup. 5611 */ 5612 return 0; 5613 } 5614 5615 if (hdev->hci_ver < BLUETOOTH_VER_1_2) 5616 return 0; 5617 5618 /* Wait for HCI_EV_CONN_COMPLETE, not HCI_EV_CMD_STATUS, when the 5619 * reason is anything but HCI_ERROR_REMOTE_POWER_OFF. This reason is 5620 * used when suspending or powering off, where we don't want to wait 5621 * for the peer's response. 5622 */ 5623 if (reason != HCI_ERROR_REMOTE_POWER_OFF) 5624 return __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN_CANCEL, 5625 6, &conn->dst, 5626 HCI_EV_CONN_COMPLETE, 5627 HCI_CMD_TIMEOUT, NULL); 5628 5629 return __hci_cmd_sync_status(hdev, HCI_OP_CREATE_CONN_CANCEL, 5630 6, &conn->dst, HCI_CMD_TIMEOUT); 5631} 5632 5633static int hci_reject_sco_sync(struct hci_dev *hdev, struct hci_conn *conn, 5634 u8 reason) 5635{ 5636 struct hci_cp_reject_sync_conn_req cp; 5637 5638 memset(&cp, 0, sizeof(cp)); 5639 bacpy(&cp.bdaddr, &conn->dst); 5640 cp.reason = reason; 5641 5642 /* SCO rejection has its own limited set of 5643 * allowed error values (0x0D-0x0F). 5644 */ 5645 if (reason < 0x0d || reason > 0x0f) 5646 cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES; 5647 5648 return __hci_cmd_sync_status(hdev, HCI_OP_REJECT_SYNC_CONN_REQ, 5649 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 5650} 5651 5652static int hci_le_reject_cis_sync(struct hci_dev *hdev, struct hci_conn *conn, 5653 u8 reason) 5654{ 5655 struct hci_cp_le_reject_cis cp; 5656 5657 memset(&cp, 0, sizeof(cp)); 5658 cp.handle = cpu_to_le16(conn->handle); 5659 cp.reason = reason; 5660 5661 return __hci_cmd_sync_status(hdev, HCI_OP_LE_REJECT_CIS, 5662 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 5663} 5664 5665static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, 5666 u8 reason) 5667{ 5668 struct hci_cp_reject_conn_req cp; 5669 5670 if (conn->type == CIS_LINK) 5671 return hci_le_reject_cis_sync(hdev, conn, reason); 5672 5673 if (conn->type == BIS_LINK || conn->type == PA_LINK) 5674 return -EINVAL; 5675 5676 if (conn->type == SCO_LINK || conn->type == ESCO_LINK) 5677 return hci_reject_sco_sync(hdev, conn, reason); 5678 5679 memset(&cp, 0, sizeof(cp)); 5680 bacpy(&cp.bdaddr, &conn->dst); 5681 cp.reason = reason; 5682 5683 return __hci_cmd_sync_status(hdev, HCI_OP_REJECT_CONN_REQ, 5684 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 5685} 5686 5687int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason) 5688{ 5689 int err = 0; 5690 u16 handle = conn->handle; 5691 bool disconnect = false; 5692 struct hci_conn *c; 5693 5694 switch (conn->state) { 5695 case BT_CONNECTED: 5696 case BT_CONFIG: 5697 err = hci_disconnect_sync(hdev, conn, reason); 5698 break; 5699 case BT_CONNECT: 5700 err = hci_connect_cancel_sync(hdev, conn, reason); 5701 break; 5702 case BT_CONNECT2: 5703 err = hci_reject_conn_sync(hdev, conn, reason); 5704 break; 5705 case BT_OPEN: 5706 case BT_BOUND: 5707 break; 5708 default: 5709 disconnect = true; 5710 break; 5711 } 5712 5713 hci_dev_lock(hdev); 5714 5715 /* Check if the connection has been cleaned up concurrently */ 5716 c = hci_conn_hash_lookup_handle(hdev, handle); 5717 if (!c || c != conn) { 5718 err = 0; 5719 goto unlock; 5720 } 5721 5722 /* Cleanup hci_conn object if it cannot be cancelled as it 5723 * likely means the controller and host stack are out of sync 5724 * or in case of LE it was still scanning so it can be cleanup 5725 * safely. 5726 */ 5727 if (disconnect) { 5728 conn->state = BT_CLOSED; 5729 hci_disconn_cfm(conn, reason); 5730 hci_conn_del(conn); 5731 } else { 5732 hci_conn_failed(conn, reason); 5733 } 5734 5735unlock: 5736 hci_dev_unlock(hdev); 5737 return err; 5738} 5739 5740static int hci_disconnect_all_sync(struct hci_dev *hdev, u8 reason) 5741{ 5742 struct list_head *head = &hdev->conn_hash.list; 5743 struct hci_conn *conn; 5744 5745 rcu_read_lock(); 5746 while ((conn = list_first_or_null_rcu(head, struct hci_conn, list))) { 5747 /* Make sure the connection is not freed while unlocking */ 5748 conn = hci_conn_get(conn); 5749 rcu_read_unlock(); 5750 /* Disregard possible errors since hci_conn_del shall have been 5751 * called even in case of errors had occurred since it would 5752 * then cause hci_conn_failed to be called which calls 5753 * hci_conn_del internally. 5754 */ 5755 hci_abort_conn_sync(hdev, conn, reason); 5756 hci_conn_put(conn); 5757 rcu_read_lock(); 5758 } 5759 rcu_read_unlock(); 5760 5761 return 0; 5762} 5763 5764/* This function perform power off HCI command sequence as follows: 5765 * 5766 * Clear Advertising 5767 * Stop Discovery 5768 * Disconnect all connections 5769 * hci_dev_close_sync 5770 */ 5771static int hci_power_off_sync(struct hci_dev *hdev) 5772{ 5773 int err; 5774 5775 /* If controller is already down there is nothing to do */ 5776 if (!test_bit(HCI_UP, &hdev->flags)) 5777 return 0; 5778 5779 hci_dev_set_flag(hdev, HCI_POWERING_DOWN); 5780 5781 if (test_bit(HCI_ISCAN, &hdev->flags) || 5782 test_bit(HCI_PSCAN, &hdev->flags)) { 5783 err = hci_write_scan_enable_sync(hdev, 0x00); 5784 if (err) 5785 goto out; 5786 } 5787 5788 err = hci_clear_adv_sync(hdev, NULL, false); 5789 if (err) 5790 goto out; 5791 5792 err = hci_stop_discovery_sync(hdev); 5793 if (err) 5794 goto out; 5795 5796 /* Terminated due to Power Off */ 5797 err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF); 5798 if (err) 5799 goto out; 5800 5801 err = hci_dev_close_sync(hdev); 5802 5803out: 5804 hci_dev_clear_flag(hdev, HCI_POWERING_DOWN); 5805 return err; 5806} 5807 5808int hci_set_powered_sync(struct hci_dev *hdev, u8 val) 5809{ 5810 if (val) 5811 return hci_power_on_sync(hdev); 5812 5813 return hci_power_off_sync(hdev); 5814} 5815 5816static int hci_write_iac_sync(struct hci_dev *hdev) 5817{ 5818 struct hci_cp_write_current_iac_lap cp; 5819 5820 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 5821 return 0; 5822 5823 memset(&cp, 0, sizeof(cp)); 5824 5825 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) { 5826 /* Limited discoverable mode */ 5827 cp.num_iac = min_t(u8, hdev->num_iac, 2); 5828 cp.iac_lap[0] = 0x00; /* LIAC */ 5829 cp.iac_lap[1] = 0x8b; 5830 cp.iac_lap[2] = 0x9e; 5831 cp.iac_lap[3] = 0x33; /* GIAC */ 5832 cp.iac_lap[4] = 0x8b; 5833 cp.iac_lap[5] = 0x9e; 5834 } else { 5835 /* General discoverable mode */ 5836 cp.num_iac = 1; 5837 cp.iac_lap[0] = 0x33; /* GIAC */ 5838 cp.iac_lap[1] = 0x8b; 5839 cp.iac_lap[2] = 0x9e; 5840 } 5841 5842 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CURRENT_IAC_LAP, 5843 (cp.num_iac * 3) + 1, &cp, 5844 HCI_CMD_TIMEOUT); 5845} 5846 5847int hci_update_discoverable_sync(struct hci_dev *hdev) 5848{ 5849 int err = 0; 5850 5851 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 5852 err = hci_write_iac_sync(hdev); 5853 if (err) 5854 return err; 5855 5856 err = hci_update_scan_sync(hdev); 5857 if (err) 5858 return err; 5859 5860 err = hci_update_class_sync(hdev); 5861 if (err) 5862 return err; 5863 } 5864 5865 /* Advertising instances don't use the global discoverable setting, so 5866 * only update AD if advertising was enabled using Set Advertising. 5867 */ 5868 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 5869 err = hci_update_adv_data_sync(hdev, 0x00); 5870 if (err) 5871 return err; 5872 5873 /* Discoverable mode affects the local advertising 5874 * address in limited privacy mode. 5875 */ 5876 if (hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) { 5877 if (ext_adv_capable(hdev)) 5878 err = hci_start_ext_adv_sync(hdev, 0x00); 5879 else 5880 err = hci_enable_advertising_sync(hdev); 5881 } 5882 } 5883 5884 return err; 5885} 5886 5887static int update_discoverable_sync(struct hci_dev *hdev, void *data) 5888{ 5889 return hci_update_discoverable_sync(hdev); 5890} 5891 5892int hci_update_discoverable(struct hci_dev *hdev) 5893{ 5894 /* Only queue if it would have any effect */ 5895 if (hdev_is_powered(hdev) && 5896 hci_dev_test_flag(hdev, HCI_ADVERTISING) && 5897 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 5898 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 5899 return hci_cmd_sync_queue(hdev, update_discoverable_sync, NULL, 5900 NULL); 5901 5902 return 0; 5903} 5904 5905int hci_update_connectable_sync(struct hci_dev *hdev) 5906{ 5907 int err; 5908 5909 err = hci_update_scan_sync(hdev); 5910 if (err) 5911 return err; 5912 5913 /* If BR/EDR is not enabled and we disable advertising as a 5914 * by-product of disabling connectable, we need to update the 5915 * advertising flags. 5916 */ 5917 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 5918 err = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 5919 5920 /* Update the advertising parameters if necessary */ 5921 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 5922 !list_empty(&hdev->adv_instances)) { 5923 if (ext_adv_capable(hdev)) 5924 err = hci_start_ext_adv_sync(hdev, 5925 hdev->cur_adv_instance); 5926 else 5927 err = hci_enable_advertising_sync(hdev); 5928 5929 if (err) 5930 return err; 5931 } 5932 5933 return hci_update_passive_scan_sync(hdev); 5934} 5935 5936int hci_inquiry_sync(struct hci_dev *hdev, u8 length, u8 num_rsp) 5937{ 5938 const u8 giac[3] = { 0x33, 0x8b, 0x9e }; 5939 const u8 liac[3] = { 0x00, 0x8b, 0x9e }; 5940 struct hci_cp_inquiry cp; 5941 5942 bt_dev_dbg(hdev, ""); 5943 5944 if (test_bit(HCI_INQUIRY, &hdev->flags)) 5945 return 0; 5946 5947 hci_dev_lock(hdev); 5948 hci_inquiry_cache_flush(hdev); 5949 hci_dev_unlock(hdev); 5950 5951 memset(&cp, 0, sizeof(cp)); 5952 5953 if (hdev->discovery.limited) 5954 memcpy(&cp.lap, liac, sizeof(cp.lap)); 5955 else 5956 memcpy(&cp.lap, giac, sizeof(cp.lap)); 5957 5958 cp.length = length; 5959 cp.num_rsp = num_rsp; 5960 5961 return __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY, 5962 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 5963} 5964 5965static int hci_active_scan_sync(struct hci_dev *hdev, uint16_t interval) 5966{ 5967 u8 own_addr_type; 5968 /* Accept list is not used for discovery */ 5969 u8 filter_policy = 0x00; 5970 /* Default is to enable duplicates filter */ 5971 u8 filter_dup = LE_SCAN_FILTER_DUP_ENABLE; 5972 int err; 5973 5974 bt_dev_dbg(hdev, ""); 5975 5976 /* If controller is scanning, it means the passive scanning is 5977 * running. Thus, we should temporarily stop it in order to set the 5978 * discovery scanning parameters. 5979 */ 5980 err = hci_scan_disable_sync(hdev); 5981 if (err) { 5982 bt_dev_err(hdev, "Unable to disable scanning: %d", err); 5983 return err; 5984 } 5985 5986 cancel_interleave_scan(hdev); 5987 5988 /* Pause address resolution for active scan and stop advertising if 5989 * privacy is enabled. 5990 */ 5991 err = hci_pause_addr_resolution(hdev); 5992 if (err) 5993 goto failed; 5994 5995 /* All active scans will be done with either a resolvable private 5996 * address (when privacy feature has been enabled) or non-resolvable 5997 * private address. 5998 */ 5999 err = hci_update_random_address_sync(hdev, true, scan_use_rpa(hdev), 6000 &own_addr_type); 6001 if (err < 0) 6002 own_addr_type = ADDR_LE_DEV_PUBLIC; 6003 6004 if (hci_is_adv_monitoring(hdev) || 6005 (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER) && 6006 hdev->discovery.result_filtering)) { 6007 /* Duplicate filter should be disabled when some advertisement 6008 * monitor is activated, otherwise AdvMon can only receive one 6009 * advertisement for one peer(*) during active scanning, and 6010 * might report loss to these peers. 6011 * 6012 * If controller does strict duplicate filtering and the 6013 * discovery requires result filtering disables controller based 6014 * filtering since that can cause reports that would match the 6015 * host filter to not be reported. 6016 */ 6017 filter_dup = LE_SCAN_FILTER_DUP_DISABLE; 6018 } 6019 6020 err = hci_start_scan_sync(hdev, LE_SCAN_ACTIVE, interval, 6021 hdev->le_scan_window_discovery, 6022 own_addr_type, filter_policy, filter_dup); 6023 if (!err) 6024 return err; 6025 6026failed: 6027 /* Resume advertising if it was paused */ 6028 if (ll_privacy_capable(hdev)) 6029 hci_resume_advertising_sync(hdev); 6030 6031 /* Resume passive scanning */ 6032 hci_update_passive_scan_sync(hdev); 6033 return err; 6034} 6035 6036static int hci_start_interleaved_discovery_sync(struct hci_dev *hdev) 6037{ 6038 int err; 6039 6040 bt_dev_dbg(hdev, ""); 6041 6042 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery * 2); 6043 if (err) 6044 return err; 6045 6046 return hci_inquiry_sync(hdev, DISCOV_BREDR_INQUIRY_LEN, 0); 6047} 6048 6049int hci_start_discovery_sync(struct hci_dev *hdev) 6050{ 6051 unsigned long timeout; 6052 int err; 6053 6054 bt_dev_dbg(hdev, "type %u", hdev->discovery.type); 6055 6056 switch (hdev->discovery.type) { 6057 case DISCOV_TYPE_BREDR: 6058 return hci_inquiry_sync(hdev, DISCOV_BREDR_INQUIRY_LEN, 0); 6059 case DISCOV_TYPE_INTERLEAVED: 6060 /* When running simultaneous discovery, the LE scanning time 6061 * should occupy the whole discovery time sine BR/EDR inquiry 6062 * and LE scanning are scheduled by the controller. 6063 * 6064 * For interleaving discovery in comparison, BR/EDR inquiry 6065 * and LE scanning are done sequentially with separate 6066 * timeouts. 6067 */ 6068 if (hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY)) { 6069 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT); 6070 /* During simultaneous discovery, we double LE scan 6071 * interval. We must leave some time for the controller 6072 * to do BR/EDR inquiry. 6073 */ 6074 err = hci_start_interleaved_discovery_sync(hdev); 6075 break; 6076 } 6077 6078 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout); 6079 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery); 6080 break; 6081 case DISCOV_TYPE_LE: 6082 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT); 6083 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery); 6084 break; 6085 default: 6086 return -EINVAL; 6087 } 6088 6089 if (err) 6090 return err; 6091 6092 bt_dev_dbg(hdev, "timeout %u ms", jiffies_to_msecs(timeout)); 6093 6094 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_disable, 6095 timeout); 6096 return 0; 6097} 6098 6099static void hci_suspend_monitor_sync(struct hci_dev *hdev) 6100{ 6101 switch (hci_get_adv_monitor_offload_ext(hdev)) { 6102 case HCI_ADV_MONITOR_EXT_MSFT: 6103 msft_suspend_sync(hdev); 6104 break; 6105 default: 6106 return; 6107 } 6108} 6109 6110/* This function disables discovery and mark it as paused */ 6111static int hci_pause_discovery_sync(struct hci_dev *hdev) 6112{ 6113 int old_state = hdev->discovery.state; 6114 int err; 6115 6116 /* If discovery already stopped/stopping/paused there nothing to do */ 6117 if (old_state == DISCOVERY_STOPPED || old_state == DISCOVERY_STOPPING || 6118 hdev->discovery_paused) 6119 return 0; 6120 6121 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6122 err = hci_stop_discovery_sync(hdev); 6123 if (err) 6124 return err; 6125 6126 hdev->discovery_paused = true; 6127 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6128 6129 return 0; 6130} 6131 6132static int hci_update_event_filter_sync(struct hci_dev *hdev) 6133{ 6134 struct bdaddr_list_with_flags *b; 6135 u8 scan = SCAN_DISABLED; 6136 bool scanning = test_bit(HCI_PSCAN, &hdev->flags); 6137 int err; 6138 6139 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 6140 return 0; 6141 6142 /* Some fake CSR controllers lock up after setting this type of 6143 * filter, so avoid sending the request altogether. 6144 */ 6145 if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL)) 6146 return 0; 6147 6148 /* Always clear event filter when starting */ 6149 hci_clear_event_filter_sync(hdev); 6150 6151 list_for_each_entry(b, &hdev->accept_list, list) { 6152 if (!(b->flags & HCI_CONN_FLAG_REMOTE_WAKEUP)) 6153 continue; 6154 6155 bt_dev_dbg(hdev, "Adding event filters for %pMR", &b->bdaddr); 6156 6157 err = hci_set_event_filter_sync(hdev, HCI_FLT_CONN_SETUP, 6158 HCI_CONN_SETUP_ALLOW_BDADDR, 6159 &b->bdaddr, 6160 HCI_CONN_SETUP_AUTO_ON); 6161 if (err) 6162 bt_dev_err(hdev, "Failed to set event filter for %pMR", 6163 &b->bdaddr); 6164 else 6165 scan = SCAN_PAGE; 6166 } 6167 6168 if (scan && !scanning) 6169 hci_write_scan_enable_sync(hdev, scan); 6170 else if (!scan && scanning) 6171 hci_write_scan_enable_sync(hdev, scan); 6172 6173 return 0; 6174} 6175 6176/* This function disables scan (BR and LE) and mark it as paused */ 6177static int hci_pause_scan_sync(struct hci_dev *hdev) 6178{ 6179 if (hdev->scanning_paused) 6180 return 0; 6181 6182 /* Disable page scan if enabled */ 6183 if (test_bit(HCI_PSCAN, &hdev->flags)) 6184 hci_write_scan_enable_sync(hdev, SCAN_DISABLED); 6185 6186 hci_scan_disable_sync(hdev); 6187 6188 hdev->scanning_paused = true; 6189 6190 return 0; 6191} 6192 6193/* This function performs the HCI suspend procedures in the follow order: 6194 * 6195 * Pause discovery (active scanning/inquiry) 6196 * Pause Directed Advertising/Advertising 6197 * Pause Scanning (passive scanning in case discovery was not active) 6198 * Disconnect all connections 6199 * Set suspend_status to BT_SUSPEND_DISCONNECT if hdev cannot wakeup 6200 * otherwise: 6201 * Update event mask (only set events that are allowed to wake up the host) 6202 * Update event filter (with devices marked with HCI_CONN_FLAG_REMOTE_WAKEUP) 6203 * Update passive scanning (lower duty cycle) 6204 * Set suspend_status to BT_SUSPEND_CONFIGURE_WAKE 6205 */ 6206int hci_suspend_sync(struct hci_dev *hdev) 6207{ 6208 int err; 6209 6210 /* If marked as suspended there nothing to do */ 6211 if (hdev->suspended) 6212 return 0; 6213 6214 /* Mark device as suspended */ 6215 hdev->suspended = true; 6216 6217 /* Pause discovery if not already stopped */ 6218 hci_pause_discovery_sync(hdev); 6219 6220 /* Pause other advertisements */ 6221 hci_pause_advertising_sync(hdev); 6222 6223 /* Suspend monitor filters */ 6224 hci_suspend_monitor_sync(hdev); 6225 6226 /* Prevent disconnects from causing scanning to be re-enabled */ 6227 hci_pause_scan_sync(hdev); 6228 6229 if (hci_conn_count(hdev)) { 6230 /* Soft disconnect everything (power off) */ 6231 err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF); 6232 if (err) { 6233 /* Set state to BT_RUNNING so resume doesn't notify */ 6234 hdev->suspend_state = BT_RUNNING; 6235 hci_resume_sync(hdev); 6236 return err; 6237 } 6238 6239 /* Update event mask so only the allowed event can wakeup the 6240 * host. 6241 */ 6242 hci_set_event_mask_sync(hdev); 6243 } 6244 6245 /* Only configure accept list if disconnect succeeded and wake 6246 * isn't being prevented. 6247 */ 6248 if (!hdev->wakeup || !hdev->wakeup(hdev)) { 6249 hdev->suspend_state = BT_SUSPEND_DISCONNECT; 6250 return 0; 6251 } 6252 6253 /* Unpause to take care of updating scanning params */ 6254 hdev->scanning_paused = false; 6255 6256 /* Enable event filter for paired devices */ 6257 hci_update_event_filter_sync(hdev); 6258 6259 /* Update LE passive scan if enabled */ 6260 hci_update_passive_scan_sync(hdev); 6261 6262 /* Pause scan changes again. */ 6263 hdev->scanning_paused = true; 6264 6265 hdev->suspend_state = BT_SUSPEND_CONFIGURE_WAKE; 6266 6267 return 0; 6268} 6269 6270/* This function resumes discovery */ 6271static int hci_resume_discovery_sync(struct hci_dev *hdev) 6272{ 6273 int err; 6274 6275 /* If discovery not paused there nothing to do */ 6276 if (!hdev->discovery_paused) 6277 return 0; 6278 6279 hdev->discovery_paused = false; 6280 6281 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6282 6283 err = hci_start_discovery_sync(hdev); 6284 6285 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED : 6286 DISCOVERY_FINDING); 6287 6288 return err; 6289} 6290 6291static void hci_resume_monitor_sync(struct hci_dev *hdev) 6292{ 6293 switch (hci_get_adv_monitor_offload_ext(hdev)) { 6294 case HCI_ADV_MONITOR_EXT_MSFT: 6295 msft_resume_sync(hdev); 6296 break; 6297 default: 6298 return; 6299 } 6300} 6301 6302/* This function resume scan and reset paused flag */ 6303static int hci_resume_scan_sync(struct hci_dev *hdev) 6304{ 6305 if (!hdev->scanning_paused) 6306 return 0; 6307 6308 hdev->scanning_paused = false; 6309 6310 hci_update_scan_sync(hdev); 6311 6312 /* Reset passive scanning to normal */ 6313 hci_update_passive_scan_sync(hdev); 6314 6315 return 0; 6316} 6317 6318/* This function performs the HCI suspend procedures in the follow order: 6319 * 6320 * Restore event mask 6321 * Clear event filter 6322 * Update passive scanning (normal duty cycle) 6323 * Resume Directed Advertising/Advertising 6324 * Resume discovery (active scanning/inquiry) 6325 */ 6326int hci_resume_sync(struct hci_dev *hdev) 6327{ 6328 /* If not marked as suspended there nothing to do */ 6329 if (!hdev->suspended) 6330 return 0; 6331 6332 hdev->suspended = false; 6333 6334 /* Restore event mask */ 6335 hci_set_event_mask_sync(hdev); 6336 6337 /* Clear any event filters and restore scan state */ 6338 hci_clear_event_filter_sync(hdev); 6339 6340 /* Resume scanning */ 6341 hci_resume_scan_sync(hdev); 6342 6343 /* Resume monitor filters */ 6344 hci_resume_monitor_sync(hdev); 6345 6346 /* Resume other advertisements */ 6347 hci_resume_advertising_sync(hdev); 6348 6349 /* Resume discovery */ 6350 hci_resume_discovery_sync(hdev); 6351 6352 return 0; 6353} 6354 6355static bool conn_use_rpa(struct hci_conn *conn) 6356{ 6357 struct hci_dev *hdev = conn->hdev; 6358 6359 return hci_dev_test_flag(hdev, HCI_PRIVACY); 6360} 6361 6362static int hci_le_ext_directed_advertising_sync(struct hci_dev *hdev, 6363 struct hci_conn *conn) 6364{ 6365 struct hci_cp_le_set_ext_adv_params cp; 6366 struct hci_rp_le_set_ext_adv_params rp; 6367 int err; 6368 bdaddr_t random_addr; 6369 u8 own_addr_type; 6370 6371 err = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn), 6372 &own_addr_type); 6373 if (err) 6374 return err; 6375 6376 /* Set require_privacy to false so that the remote device has a 6377 * chance of identifying us. 6378 */ 6379 err = hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL, 6380 &own_addr_type, &random_addr); 6381 if (err) 6382 return err; 6383 6384 memset(&cp, 0, sizeof(cp)); 6385 6386 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND); 6387 cp.channel_map = hdev->le_adv_channel_map; 6388 cp.tx_power = HCI_TX_POWER_INVALID; 6389 cp.primary_phy = HCI_ADV_PHY_1M; 6390 cp.secondary_phy = HCI_ADV_PHY_1M; 6391 cp.handle = 0x00; /* Use instance 0 for directed adv */ 6392 cp.own_addr_type = own_addr_type; 6393 cp.peer_addr_type = conn->dst_type; 6394 bacpy(&cp.peer_addr, &conn->dst); 6395 6396 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for 6397 * advertising_event_property LE_LEGACY_ADV_DIRECT_IND 6398 * does not supports advertising data when the advertising set already 6399 * contains some, the controller shall return erroc code 'Invalid 6400 * HCI Command Parameters(0x12). 6401 * So it is required to remove adv set for handle 0x00. since we use 6402 * instance 0 for directed adv. 6403 */ 6404 err = hci_remove_ext_adv_instance_sync(hdev, cp.handle, NULL); 6405 if (err) 6406 return err; 6407 6408 err = hci_set_ext_adv_params_sync(hdev, NULL, &cp, &rp); 6409 if (err) 6410 return err; 6411 6412 /* Update adv data as tx power is known now */ 6413 err = hci_set_ext_adv_data_sync(hdev, cp.handle); 6414 if (err) 6415 return err; 6416 6417 /* Check if random address need to be updated */ 6418 if (own_addr_type == ADDR_LE_DEV_RANDOM && 6419 bacmp(&random_addr, BDADDR_ANY) && 6420 bacmp(&random_addr, &hdev->random_addr)) { 6421 err = hci_set_adv_set_random_addr_sync(hdev, 0x00, 6422 &random_addr); 6423 if (err) 6424 return err; 6425 } 6426 6427 return hci_enable_ext_advertising_sync(hdev, 0x00); 6428} 6429 6430static int hci_le_directed_advertising_sync(struct hci_dev *hdev, 6431 struct hci_conn *conn) 6432{ 6433 struct hci_cp_le_set_adv_param cp; 6434 u8 status; 6435 u8 own_addr_type; 6436 u8 enable; 6437 6438 if (ext_adv_capable(hdev)) 6439 return hci_le_ext_directed_advertising_sync(hdev, conn); 6440 6441 /* Clear the HCI_LE_ADV bit temporarily so that the 6442 * hci_update_random_address knows that it's safe to go ahead 6443 * and write a new random address. The flag will be set back on 6444 * as soon as the SET_ADV_ENABLE HCI command completes. 6445 */ 6446 hci_dev_clear_flag(hdev, HCI_LE_ADV); 6447 6448 /* Set require_privacy to false so that the remote device has a 6449 * chance of identifying us. 6450 */ 6451 status = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn), 6452 &own_addr_type); 6453 if (status) 6454 return status; 6455 6456 memset(&cp, 0, sizeof(cp)); 6457 6458 /* Some controllers might reject command if intervals are not 6459 * within range for undirected advertising. 6460 * BCM20702A0 is known to be affected by this. 6461 */ 6462 cp.min_interval = cpu_to_le16(0x0020); 6463 cp.max_interval = cpu_to_le16(0x0020); 6464 6465 cp.type = LE_ADV_DIRECT_IND; 6466 cp.own_address_type = own_addr_type; 6467 cp.direct_addr_type = conn->dst_type; 6468 bacpy(&cp.direct_addr, &conn->dst); 6469 cp.channel_map = hdev->le_adv_channel_map; 6470 6471 status = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_PARAM, 6472 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 6473 if (status) 6474 return status; 6475 6476 enable = 0x01; 6477 6478 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE, 6479 sizeof(enable), &enable, HCI_CMD_TIMEOUT); 6480} 6481 6482static void set_ext_conn_params(struct hci_conn *conn, 6483 struct hci_cp_le_ext_conn_param *p) 6484{ 6485 struct hci_dev *hdev = conn->hdev; 6486 6487 memset(p, 0, sizeof(*p)); 6488 6489 p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect); 6490 p->scan_window = cpu_to_le16(hdev->le_scan_window_connect); 6491 p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 6492 p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 6493 p->conn_latency = cpu_to_le16(conn->le_conn_latency); 6494 p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout); 6495 p->min_ce_len = cpu_to_le16(0x0000); 6496 p->max_ce_len = cpu_to_le16(0x0000); 6497} 6498 6499static int hci_le_ext_create_conn_sync(struct hci_dev *hdev, 6500 struct hci_conn *conn, u8 own_addr_type) 6501{ 6502 struct hci_cp_le_ext_create_conn *cp; 6503 struct hci_cp_le_ext_conn_param *p; 6504 u8 data[sizeof(*cp) + sizeof(*p) * 3]; 6505 u32 plen; 6506 6507 cp = (void *)data; 6508 p = (void *)cp->data; 6509 6510 memset(cp, 0, sizeof(*cp)); 6511 6512 bacpy(&cp->peer_addr, &conn->dst); 6513 cp->peer_addr_type = conn->dst_type; 6514 cp->own_addr_type = own_addr_type; 6515 6516 plen = sizeof(*cp); 6517 6518 if (scan_1m(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_1M || 6519 conn->le_adv_sec_phy == HCI_ADV_PHY_1M)) { 6520 cp->phys |= LE_SCAN_PHY_1M; 6521 set_ext_conn_params(conn, p); 6522 6523 p++; 6524 plen += sizeof(*p); 6525 } 6526 6527 if (scan_2m(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_2M || 6528 conn->le_adv_sec_phy == HCI_ADV_PHY_2M)) { 6529 cp->phys |= LE_SCAN_PHY_2M; 6530 set_ext_conn_params(conn, p); 6531 6532 p++; 6533 plen += sizeof(*p); 6534 } 6535 6536 if (scan_coded(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_CODED || 6537 conn->le_adv_sec_phy == HCI_ADV_PHY_CODED)) { 6538 cp->phys |= LE_SCAN_PHY_CODED; 6539 set_ext_conn_params(conn, p); 6540 6541 plen += sizeof(*p); 6542 } 6543 6544 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_EXT_CREATE_CONN, 6545 plen, data, 6546 HCI_EV_LE_ENHANCED_CONN_COMPLETE, 6547 conn->conn_timeout, NULL); 6548} 6549 6550static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data) 6551{ 6552 struct hci_cp_le_create_conn cp; 6553 struct hci_conn_params *params; 6554 u8 own_addr_type; 6555 int err; 6556 struct hci_conn *conn = data; 6557 6558 if (!hci_conn_valid(hdev, conn)) 6559 return -ECANCELED; 6560 6561 bt_dev_dbg(hdev, "conn %p", conn); 6562 6563 clear_bit(HCI_CONN_SCANNING, &conn->flags); 6564 conn->state = BT_CONNECT; 6565 6566 /* If requested to connect as peripheral use directed advertising */ 6567 if (conn->role == HCI_ROLE_SLAVE) { 6568 /* If we're active scanning and simultaneous roles is not 6569 * enabled simply reject the attempt. 6570 */ 6571 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6572 hdev->le_scan_type == LE_SCAN_ACTIVE && 6573 !hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) { 6574 hci_conn_del(conn); 6575 return -EBUSY; 6576 } 6577 6578 /* Pause advertising while doing directed advertising. */ 6579 hci_pause_advertising_sync(hdev); 6580 6581 err = hci_le_directed_advertising_sync(hdev, conn); 6582 goto done; 6583 } 6584 6585 /* Disable advertising if simultaneous roles is not in use. */ 6586 if (!hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 6587 hci_pause_advertising_sync(hdev); 6588 6589 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 6590 if (params) { 6591 conn->le_conn_min_interval = params->conn_min_interval; 6592 conn->le_conn_max_interval = params->conn_max_interval; 6593 conn->le_conn_latency = params->conn_latency; 6594 conn->le_supv_timeout = params->supervision_timeout; 6595 } else { 6596 conn->le_conn_min_interval = hdev->le_conn_min_interval; 6597 conn->le_conn_max_interval = hdev->le_conn_max_interval; 6598 conn->le_conn_latency = hdev->le_conn_latency; 6599 conn->le_supv_timeout = hdev->le_supv_timeout; 6600 } 6601 6602 /* If controller is scanning, we stop it since some controllers are 6603 * not able to scan and connect at the same time. Also set the 6604 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete 6605 * handler for scan disabling knows to set the correct discovery 6606 * state. 6607 */ 6608 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 6609 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED); 6610 hci_scan_disable_sync(hdev); 6611 } 6612 6613 /* Update random address, but set require_privacy to false so 6614 * that we never connect with an non-resolvable address. 6615 */ 6616 err = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn), 6617 &own_addr_type); 6618 if (err) 6619 goto done; 6620 /* Send command LE Extended Create Connection if supported */ 6621 if (use_ext_conn(hdev)) { 6622 err = hci_le_ext_create_conn_sync(hdev, conn, own_addr_type); 6623 goto done; 6624 } 6625 6626 memset(&cp, 0, sizeof(cp)); 6627 6628 cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect); 6629 cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect); 6630 6631 bacpy(&cp.peer_addr, &conn->dst); 6632 cp.peer_addr_type = conn->dst_type; 6633 cp.own_address_type = own_addr_type; 6634 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 6635 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 6636 cp.conn_latency = cpu_to_le16(conn->le_conn_latency); 6637 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout); 6638 cp.min_ce_len = cpu_to_le16(0x0000); 6639 cp.max_ce_len = cpu_to_le16(0x0000); 6640 6641 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2261: 6642 * 6643 * If this event is unmasked and the HCI_LE_Connection_Complete event 6644 * is unmasked, only the HCI_LE_Enhanced_Connection_Complete event is 6645 * sent when a new connection has been created. 6646 */ 6647 err = __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CREATE_CONN, 6648 sizeof(cp), &cp, 6649 use_enhanced_conn_complete(hdev) ? 6650 HCI_EV_LE_ENHANCED_CONN_COMPLETE : 6651 HCI_EV_LE_CONN_COMPLETE, 6652 conn->conn_timeout, NULL); 6653 6654done: 6655 if (err == -ETIMEDOUT) 6656 hci_le_connect_cancel_sync(hdev, conn, 0x00); 6657 6658 /* Re-enable advertising after the connection attempt is finished. */ 6659 hci_resume_advertising_sync(hdev); 6660 return err; 6661} 6662 6663int hci_le_create_cis_sync(struct hci_dev *hdev) 6664{ 6665 DEFINE_FLEX(struct hci_cp_le_create_cis, cmd, cis, num_cis, 0x1f); 6666 size_t aux_num_cis = 0; 6667 struct hci_conn *conn; 6668 u8 cig = BT_ISO_QOS_CIG_UNSET; 6669 6670 /* The spec allows only one pending LE Create CIS command at a time. If 6671 * the command is pending now, don't do anything. We check for pending 6672 * connections after each CIS Established event. 6673 * 6674 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 6675 * page 2566: 6676 * 6677 * If the Host issues this command before all the 6678 * HCI_LE_CIS_Established events from the previous use of the 6679 * command have been generated, the Controller shall return the 6680 * error code Command Disallowed (0x0C). 6681 * 6682 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 6683 * page 2567: 6684 * 6685 * When the Controller receives the HCI_LE_Create_CIS command, the 6686 * Controller sends the HCI_Command_Status event to the Host. An 6687 * HCI_LE_CIS_Established event will be generated for each CIS when it 6688 * is established or if it is disconnected or considered lost before 6689 * being established; until all the events are generated, the command 6690 * remains pending. 6691 */ 6692 6693 hci_dev_lock(hdev); 6694 6695 rcu_read_lock(); 6696 6697 /* Wait until previous Create CIS has completed */ 6698 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 6699 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) 6700 goto done; 6701 } 6702 6703 /* Find CIG with all CIS ready */ 6704 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 6705 struct hci_conn *link; 6706 6707 if (hci_conn_check_create_cis(conn)) 6708 continue; 6709 6710 cig = conn->iso_qos.ucast.cig; 6711 6712 list_for_each_entry_rcu(link, &hdev->conn_hash.list, list) { 6713 if (hci_conn_check_create_cis(link) > 0 && 6714 link->iso_qos.ucast.cig == cig && 6715 link->state != BT_CONNECTED) { 6716 cig = BT_ISO_QOS_CIG_UNSET; 6717 break; 6718 } 6719 } 6720 6721 if (cig != BT_ISO_QOS_CIG_UNSET) 6722 break; 6723 } 6724 6725 if (cig == BT_ISO_QOS_CIG_UNSET) 6726 goto done; 6727 6728 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 6729 struct hci_cis *cis = &cmd->cis[aux_num_cis]; 6730 6731 if (hci_conn_check_create_cis(conn) || 6732 conn->iso_qos.ucast.cig != cig) 6733 continue; 6734 6735 set_bit(HCI_CONN_CREATE_CIS, &conn->flags); 6736 cis->acl_handle = cpu_to_le16(conn->parent->handle); 6737 cis->cis_handle = cpu_to_le16(conn->handle); 6738 aux_num_cis++; 6739 6740 if (aux_num_cis >= cmd->num_cis) 6741 break; 6742 } 6743 cmd->num_cis = aux_num_cis; 6744 6745done: 6746 rcu_read_unlock(); 6747 6748 hci_dev_unlock(hdev); 6749 6750 if (!aux_num_cis) 6751 return 0; 6752 6753 /* Wait for HCI_LE_CIS_Established */ 6754 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CREATE_CIS, 6755 struct_size(cmd, cis, cmd->num_cis), 6756 cmd, HCI_EVT_LE_CIS_ESTABLISHED, 6757 conn->conn_timeout, NULL); 6758} 6759 6760int hci_le_remove_cig_sync(struct hci_dev *hdev, u8 handle) 6761{ 6762 struct hci_cp_le_remove_cig cp; 6763 6764 memset(&cp, 0, sizeof(cp)); 6765 cp.cig_id = handle; 6766 6767 return __hci_cmd_sync_status(hdev, HCI_OP_LE_REMOVE_CIG, sizeof(cp), 6768 &cp, HCI_CMD_TIMEOUT); 6769} 6770 6771int hci_le_big_terminate_sync(struct hci_dev *hdev, u8 handle) 6772{ 6773 struct hci_cp_le_big_term_sync cp; 6774 6775 memset(&cp, 0, sizeof(cp)); 6776 cp.handle = handle; 6777 6778 return __hci_cmd_sync_status(hdev, HCI_OP_LE_BIG_TERM_SYNC, 6779 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 6780} 6781 6782int hci_le_pa_terminate_sync(struct hci_dev *hdev, u16 handle) 6783{ 6784 struct hci_cp_le_pa_term_sync cp; 6785 6786 memset(&cp, 0, sizeof(cp)); 6787 cp.handle = cpu_to_le16(handle); 6788 6789 return __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_TERM_SYNC, 6790 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 6791} 6792 6793int hci_get_random_address(struct hci_dev *hdev, bool require_privacy, 6794 bool use_rpa, struct adv_info *adv_instance, 6795 u8 *own_addr_type, bdaddr_t *rand_addr) 6796{ 6797 int err; 6798 6799 bacpy(rand_addr, BDADDR_ANY); 6800 6801 /* If privacy is enabled use a resolvable private address. If 6802 * current RPA has expired then generate a new one. 6803 */ 6804 if (use_rpa) { 6805 /* If Controller supports LL Privacy use own address type is 6806 * 0x03 6807 */ 6808 if (ll_privacy_capable(hdev)) 6809 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED; 6810 else 6811 *own_addr_type = ADDR_LE_DEV_RANDOM; 6812 6813 if (adv_instance) { 6814 if (adv_rpa_valid(adv_instance)) 6815 return 0; 6816 } else { 6817 if (rpa_valid(hdev)) 6818 return 0; 6819 } 6820 6821 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa); 6822 if (err < 0) { 6823 bt_dev_err(hdev, "failed to generate new RPA"); 6824 return err; 6825 } 6826 6827 bacpy(rand_addr, &hdev->rpa); 6828 6829 return 0; 6830 } 6831 6832 /* In case of required privacy without resolvable private address, 6833 * use an non-resolvable private address. This is useful for 6834 * non-connectable advertising. 6835 */ 6836 if (require_privacy) { 6837 bdaddr_t nrpa; 6838 6839 while (true) { 6840 /* The non-resolvable private address is generated 6841 * from random six bytes with the two most significant 6842 * bits cleared. 6843 */ 6844 get_random_bytes(&nrpa, 6); 6845 nrpa.b[5] &= 0x3f; 6846 6847 /* The non-resolvable private address shall not be 6848 * equal to the public address. 6849 */ 6850 if (bacmp(&hdev->bdaddr, &nrpa)) 6851 break; 6852 } 6853 6854 *own_addr_type = ADDR_LE_DEV_RANDOM; 6855 bacpy(rand_addr, &nrpa); 6856 6857 return 0; 6858 } 6859 6860 /* No privacy, use the current address */ 6861 hci_copy_identity_address(hdev, rand_addr, own_addr_type); 6862 6863 return 0; 6864} 6865 6866static int _update_adv_data_sync(struct hci_dev *hdev, void *data) 6867{ 6868 u8 instance = PTR_UINT(data); 6869 6870 return hci_update_adv_data_sync(hdev, instance); 6871} 6872 6873int hci_update_adv_data(struct hci_dev *hdev, u8 instance) 6874{ 6875 return hci_cmd_sync_queue(hdev, _update_adv_data_sync, 6876 UINT_PTR(instance), NULL); 6877} 6878 6879static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) 6880{ 6881 struct hci_conn *conn = data; 6882 struct inquiry_entry *ie; 6883 struct hci_cp_create_conn cp; 6884 int err; 6885 6886 if (!hci_conn_valid(hdev, conn)) 6887 return -ECANCELED; 6888 6889 /* Many controllers disallow HCI Create Connection while it is doing 6890 * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create 6891 * Connection. This may cause the MGMT discovering state to become false 6892 * without user space's request but it is okay since the MGMT Discovery 6893 * APIs do not promise that discovery should be done forever. Instead, 6894 * the user space monitors the status of MGMT discovering and it may 6895 * request for discovery again when this flag becomes false. 6896 */ 6897 if (test_bit(HCI_INQUIRY, &hdev->flags)) { 6898 err = __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY_CANCEL, 0, 6899 NULL, HCI_CMD_TIMEOUT); 6900 if (err) 6901 bt_dev_warn(hdev, "Failed to cancel inquiry %d", err); 6902 } 6903 6904 conn->state = BT_CONNECT; 6905 conn->out = true; 6906 conn->role = HCI_ROLE_MASTER; 6907 6908 conn->attempt++; 6909 6910 memset(&cp, 0, sizeof(cp)); 6911 bacpy(&cp.bdaddr, &conn->dst); 6912 cp.pscan_rep_mode = 0x02; 6913 6914 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 6915 if (ie) { 6916 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 6917 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 6918 cp.pscan_mode = ie->data.pscan_mode; 6919 cp.clock_offset = ie->data.clock_offset | 6920 cpu_to_le16(0x8000); 6921 } 6922 6923 memcpy(conn->dev_class, ie->data.dev_class, 3); 6924 } 6925 6926 cp.pkt_type = cpu_to_le16(conn->pkt_type); 6927 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 6928 cp.role_switch = 0x01; 6929 else 6930 cp.role_switch = 0x00; 6931 6932 return __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN, 6933 sizeof(cp), &cp, 6934 HCI_EV_CONN_COMPLETE, 6935 conn->conn_timeout, NULL); 6936} 6937 6938int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn) 6939{ 6940 int err; 6941 6942 err = hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, 6943 NULL); 6944 return (err == -EEXIST) ? 0 : err; 6945} 6946 6947static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) 6948{ 6949 struct hci_conn *conn = data; 6950 6951 bt_dev_dbg(hdev, "err %d", err); 6952 6953 if (err == -ECANCELED) 6954 return; 6955 6956 hci_dev_lock(hdev); 6957 6958 if (!hci_conn_valid(hdev, conn)) 6959 goto done; 6960 6961 if (!err) { 6962 hci_connect_le_scan_cleanup(conn, 0x00); 6963 goto done; 6964 } 6965 6966 /* Check if connection is still pending */ 6967 if (conn != hci_lookup_le_connect(hdev)) 6968 goto done; 6969 6970 /* Flush to make sure we send create conn cancel command if needed */ 6971 flush_delayed_work(&conn->le_conn_timeout); 6972 hci_conn_failed(conn, bt_status(err)); 6973 6974done: 6975 hci_dev_unlock(hdev); 6976} 6977 6978int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn) 6979{ 6980 int err; 6981 6982 err = hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, 6983 create_le_conn_complete); 6984 return (err == -EEXIST) ? 0 : err; 6985} 6986 6987int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn) 6988{ 6989 if (conn->state != BT_OPEN) 6990 return -EINVAL; 6991 6992 switch (conn->type) { 6993 case ACL_LINK: 6994 return !hci_cmd_sync_dequeue_once(hdev, 6995 hci_acl_create_conn_sync, 6996 conn, NULL); 6997 case LE_LINK: 6998 return !hci_cmd_sync_dequeue_once(hdev, hci_le_create_conn_sync, 6999 conn, create_le_conn_complete); 7000 } 7001 7002 return -ENOENT; 7003} 7004 7005int hci_le_conn_update_sync(struct hci_dev *hdev, struct hci_conn *conn, 7006 struct hci_conn_params *params) 7007{ 7008 struct hci_cp_le_conn_update cp; 7009 7010 memset(&cp, 0, sizeof(cp)); 7011 cp.handle = cpu_to_le16(conn->handle); 7012 cp.conn_interval_min = cpu_to_le16(params->conn_min_interval); 7013 cp.conn_interval_max = cpu_to_le16(params->conn_max_interval); 7014 cp.conn_latency = cpu_to_le16(params->conn_latency); 7015 cp.supervision_timeout = cpu_to_le16(params->supervision_timeout); 7016 cp.min_ce_len = cpu_to_le16(0x0000); 7017 cp.max_ce_len = cpu_to_le16(0x0000); 7018 7019 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CONN_UPDATE, 7020 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 7021} 7022 7023static void create_pa_complete(struct hci_dev *hdev, void *data, int err) 7024{ 7025 struct hci_conn *conn = data; 7026 struct hci_conn *pa_sync; 7027 7028 bt_dev_dbg(hdev, "err %d", err); 7029 7030 if (err == -ECANCELED) 7031 return; 7032 7033 hci_dev_lock(hdev); 7034 7035 if (hci_conn_valid(hdev, conn)) 7036 clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags); 7037 7038 if (!err) 7039 goto unlock; 7040 7041 /* Add connection to indicate PA sync error */ 7042 pa_sync = hci_conn_add_unset(hdev, PA_LINK, BDADDR_ANY, 0, 7043 HCI_ROLE_SLAVE); 7044 7045 if (IS_ERR(pa_sync)) 7046 goto unlock; 7047 7048 set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags); 7049 7050 /* Notify iso layer */ 7051 hci_connect_cfm(pa_sync, bt_status(err)); 7052 7053unlock: 7054 hci_dev_unlock(hdev); 7055} 7056 7057static int hci_le_past_params_sync(struct hci_dev *hdev, struct hci_conn *conn, 7058 struct hci_conn *acl, struct bt_iso_qos *qos) 7059{ 7060 struct hci_cp_le_past_params cp; 7061 int err; 7062 7063 memset(&cp, 0, sizeof(cp)); 7064 cp.handle = cpu_to_le16(acl->handle); 7065 /* An HCI_LE_Periodic_Advertising_Sync_Transfer_Received event is sent 7066 * to the Host. HCI_LE_Periodic_Advertising_Report events will be 7067 * enabled with duplicate filtering enabled. 7068 */ 7069 cp.mode = 0x03; 7070 cp.skip = cpu_to_le16(qos->bcast.skip); 7071 cp.sync_timeout = cpu_to_le16(qos->bcast.sync_timeout); 7072 cp.cte_type = qos->bcast.sync_cte_type; 7073 7074 /* HCI_LE_PAST_PARAMS command returns a command complete event so it 7075 * cannot wait for HCI_EV_LE_PAST_RECEIVED. 7076 */ 7077 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_PAST_PARAMS, 7078 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 7079 if (err) 7080 return err; 7081 7082 /* Wait for HCI_EV_LE_PAST_RECEIVED event */ 7083 return __hci_cmd_sync_status_sk(hdev, HCI_OP_NOP, 0, NULL, 7084 HCI_EV_LE_PAST_RECEIVED, 7085 conn->conn_timeout, NULL); 7086} 7087 7088static int hci_le_pa_create_sync(struct hci_dev *hdev, void *data) 7089{ 7090 struct hci_cp_le_pa_create_sync cp; 7091 struct hci_conn *conn = data, *le; 7092 struct bt_iso_qos *qos = &conn->iso_qos; 7093 int err; 7094 7095 if (!hci_conn_valid(hdev, conn)) 7096 return -ECANCELED; 7097 7098 if (conn->sync_handle != HCI_SYNC_HANDLE_INVALID) 7099 return -EINVAL; 7100 7101 if (hci_dev_test_and_set_flag(hdev, HCI_PA_SYNC)) 7102 return -EBUSY; 7103 7104 /* Stop scanning if SID has not been set and active scanning is enabled 7105 * so we use passive scanning which will be scanning using the allow 7106 * list programmed to contain only the connection address. 7107 */ 7108 if (conn->sid == HCI_SID_INVALID && 7109 hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 7110 hci_scan_disable_sync(hdev); 7111 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED); 7112 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 7113 } 7114 7115 /* Mark HCI_CONN_CREATE_PA_SYNC so hci_update_passive_scan_sync can 7116 * program the address in the allow list so PA advertisements can be 7117 * received. 7118 */ 7119 set_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags); 7120 7121 hci_update_passive_scan_sync(hdev); 7122 7123 /* Check if PAST is possible: 7124 * 7125 * 1. Check if an ACL connection with the destination address exists 7126 * 2. Check if that HCI_CONN_FLAG_PAST has been set which indicates that 7127 * user really intended to use PAST. 7128 */ 7129 le = hci_conn_hash_lookup_le(hdev, &conn->dst, conn->dst_type); 7130 if (le) { 7131 struct hci_conn_params *params; 7132 7133 params = hci_conn_params_lookup(hdev, &le->dst, le->dst_type); 7134 if (params && params->flags & HCI_CONN_FLAG_PAST) { 7135 err = hci_le_past_params_sync(hdev, conn, le, qos); 7136 if (!err) 7137 goto done; 7138 } 7139 } 7140 7141 /* SID has not been set listen for HCI_EV_LE_EXT_ADV_REPORT to update 7142 * it. 7143 */ 7144 if (conn->sid == HCI_SID_INVALID) { 7145 err = __hci_cmd_sync_status_sk(hdev, HCI_OP_NOP, 0, NULL, 7146 HCI_EV_LE_EXT_ADV_REPORT, 7147 conn->conn_timeout, NULL); 7148 if (err == -ETIMEDOUT) 7149 goto done; 7150 } 7151 7152 memset(&cp, 0, sizeof(cp)); 7153 cp.options = qos->bcast.options; 7154 cp.sid = conn->sid; 7155 cp.addr_type = conn->dst_type; 7156 bacpy(&cp.addr, &conn->dst); 7157 cp.skip = cpu_to_le16(qos->bcast.skip); 7158 cp.sync_timeout = cpu_to_le16(qos->bcast.sync_timeout); 7159 cp.sync_cte_type = qos->bcast.sync_cte_type; 7160 7161 /* The spec allows only one pending LE Periodic Advertising Create 7162 * Sync command at a time so we forcefully wait for PA Sync Established 7163 * event since cmd_work can only schedule one command at a time. 7164 * 7165 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 7166 * page 2493: 7167 * 7168 * If the Host issues this command when another HCI_LE_Periodic_ 7169 * Advertising_Create_Sync command is pending, the Controller shall 7170 * return the error code Command Disallowed (0x0C). 7171 */ 7172 err = __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_PA_CREATE_SYNC, 7173 sizeof(cp), &cp, 7174 HCI_EV_LE_PA_SYNC_ESTABLISHED, 7175 conn->conn_timeout, NULL); 7176 if (err == -ETIMEDOUT) 7177 __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC_CANCEL, 7178 0, NULL, HCI_CMD_TIMEOUT); 7179 7180done: 7181 hci_dev_clear_flag(hdev, HCI_PA_SYNC); 7182 7183 /* Update passive scan since HCI_PA_SYNC flag has been cleared */ 7184 hci_update_passive_scan_sync(hdev); 7185 7186 return err; 7187} 7188 7189int hci_connect_pa_sync(struct hci_dev *hdev, struct hci_conn *conn) 7190{ 7191 int err; 7192 7193 err = hci_cmd_sync_queue_once(hdev, hci_le_pa_create_sync, conn, 7194 create_pa_complete); 7195 return (err == -EEXIST) ? 0 : err; 7196} 7197 7198static void create_big_complete(struct hci_dev *hdev, void *data, int err) 7199{ 7200 struct hci_conn *conn = data; 7201 7202 bt_dev_dbg(hdev, "err %d", err); 7203 7204 if (err == -ECANCELED) 7205 return; 7206 7207 if (hci_conn_valid(hdev, conn)) 7208 clear_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags); 7209} 7210 7211static int hci_le_big_create_sync(struct hci_dev *hdev, void *data) 7212{ 7213 DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis, 7214 HCI_MAX_ISO_BIS); 7215 struct hci_conn *conn = data; 7216 struct bt_iso_qos *qos = &conn->iso_qos; 7217 int err; 7218 7219 if (!hci_conn_valid(hdev, conn)) 7220 return -ECANCELED; 7221 7222 set_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags); 7223 7224 memset(cp, 0, sizeof(*cp)); 7225 cp->handle = qos->bcast.big; 7226 cp->sync_handle = cpu_to_le16(conn->sync_handle); 7227 cp->encryption = qos->bcast.encryption; 7228 memcpy(cp->bcode, qos->bcast.bcode, sizeof(cp->bcode)); 7229 cp->mse = qos->bcast.mse; 7230 cp->timeout = cpu_to_le16(qos->bcast.timeout); 7231 cp->num_bis = conn->num_bis; 7232 memcpy(cp->bis, conn->bis, conn->num_bis); 7233 7234 /* The spec allows only one pending LE BIG Create Sync command at 7235 * a time, so we forcefully wait for BIG Sync Established event since 7236 * cmd_work can only schedule one command at a time. 7237 * 7238 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 7239 * page 2586: 7240 * 7241 * If the Host sends this command when the Controller is in the 7242 * process of synchronizing to any BIG, i.e. the HCI_LE_BIG_Sync_ 7243 * Established event has not been generated, the Controller shall 7244 * return the error code Command Disallowed (0x0C). 7245 */ 7246 err = __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_BIG_CREATE_SYNC, 7247 struct_size(cp, bis, cp->num_bis), cp, 7248 HCI_EVT_LE_BIG_SYNC_ESTABLISHED, 7249 conn->conn_timeout, NULL); 7250 if (err == -ETIMEDOUT) 7251 hci_le_big_terminate_sync(hdev, cp->handle); 7252 7253 return err; 7254} 7255 7256int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn) 7257{ 7258 int err; 7259 7260 err = hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync, conn, 7261 create_big_complete); 7262 return (err == -EEXIST) ? 0 : err; 7263} 7264 7265struct past_data { 7266 struct hci_conn *conn; 7267 struct hci_conn *le; 7268}; 7269 7270static void past_complete(struct hci_dev *hdev, void *data, int err) 7271{ 7272 struct past_data *past = data; 7273 7274 bt_dev_dbg(hdev, "err %d", err); 7275 7276 kfree(past); 7277} 7278 7279static int hci_le_past_set_info_sync(struct hci_dev *hdev, void *data) 7280{ 7281 struct past_data *past = data; 7282 struct hci_cp_le_past_set_info cp; 7283 7284 hci_dev_lock(hdev); 7285 7286 if (!hci_conn_valid(hdev, past->conn) || 7287 !hci_conn_valid(hdev, past->le)) { 7288 hci_dev_unlock(hdev); 7289 return -ECANCELED; 7290 } 7291 7292 memset(&cp, 0, sizeof(cp)); 7293 cp.handle = cpu_to_le16(past->le->handle); 7294 cp.adv_handle = past->conn->iso_qos.bcast.bis; 7295 7296 hci_dev_unlock(hdev); 7297 7298 return __hci_cmd_sync_status(hdev, HCI_OP_LE_PAST_SET_INFO, 7299 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 7300} 7301 7302static int hci_le_past_sync(struct hci_dev *hdev, void *data) 7303{ 7304 struct past_data *past = data; 7305 struct hci_cp_le_past cp; 7306 7307 hci_dev_lock(hdev); 7308 7309 if (!hci_conn_valid(hdev, past->conn) || 7310 !hci_conn_valid(hdev, past->le)) { 7311 hci_dev_unlock(hdev); 7312 return -ECANCELED; 7313 } 7314 7315 memset(&cp, 0, sizeof(cp)); 7316 cp.handle = cpu_to_le16(past->le->handle); 7317 cp.sync_handle = cpu_to_le16(past->conn->sync_handle); 7318 7319 hci_dev_unlock(hdev); 7320 7321 return __hci_cmd_sync_status(hdev, HCI_OP_LE_PAST, 7322 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 7323} 7324 7325int hci_past_sync(struct hci_conn *conn, struct hci_conn *le) 7326{ 7327 struct past_data *data; 7328 int err; 7329 7330 if (conn->type != BIS_LINK && conn->type != PA_LINK) 7331 return -EINVAL; 7332 7333 if (!past_sender_capable(conn->hdev)) 7334 return -EOPNOTSUPP; 7335 7336 data = kmalloc(sizeof(*data), GFP_KERNEL); 7337 if (!data) 7338 return -ENOMEM; 7339 7340 data->conn = conn; 7341 data->le = le; 7342 7343 if (conn->role == HCI_ROLE_MASTER) 7344 err = hci_cmd_sync_queue_once(conn->hdev, 7345 hci_le_past_set_info_sync, data, 7346 past_complete); 7347 else 7348 err = hci_cmd_sync_queue_once(conn->hdev, hci_le_past_sync, 7349 data, past_complete); 7350 7351 if (err) 7352 kfree(data); 7353 7354 return (err == -EEXIST) ? 0 : err; 7355} 7356 7357static void le_read_features_complete(struct hci_dev *hdev, void *data, int err) 7358{ 7359 struct hci_conn *conn = data; 7360 7361 bt_dev_dbg(hdev, "err %d", err); 7362 7363 hci_conn_drop(conn); 7364 hci_conn_put(conn); 7365} 7366 7367static int hci_le_read_all_remote_features_sync(struct hci_dev *hdev, 7368 void *data) 7369{ 7370 struct hci_conn *conn = data; 7371 struct hci_cp_le_read_all_remote_features cp; 7372 7373 memset(&cp, 0, sizeof(cp)); 7374 cp.handle = cpu_to_le16(conn->handle); 7375 cp.pages = 10; /* Attempt to read all pages */ 7376 7377 /* Wait for HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE event otherwise 7378 * hci_conn_drop may run prematurely causing a disconnection. 7379 */ 7380 return __hci_cmd_sync_status_sk(hdev, 7381 HCI_OP_LE_READ_ALL_REMOTE_FEATURES, 7382 sizeof(cp), &cp, 7383 HCI_EVT_LE_ALL_REMOTE_FEATURES_COMPLETE, 7384 HCI_CMD_TIMEOUT, NULL); 7385 7386 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_ALL_REMOTE_FEATURES, 7387 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 7388} 7389 7390static int hci_le_read_remote_features_sync(struct hci_dev *hdev, void *data) 7391{ 7392 struct hci_conn *conn = data; 7393 struct hci_cp_le_read_remote_features cp; 7394 7395 if (!hci_conn_valid(hdev, conn)) 7396 return -ECANCELED; 7397 7398 /* Check if LL Extended Feature Set is supported and 7399 * HCI_OP_LE_READ_ALL_REMOTE_FEATURES is supported then use that to read 7400 * all features. 7401 */ 7402 if (ll_ext_feature_capable(hdev) && hdev->commands[47] & BIT(3)) 7403 return hci_le_read_all_remote_features_sync(hdev, data); 7404 7405 memset(&cp, 0, sizeof(cp)); 7406 cp.handle = cpu_to_le16(conn->handle); 7407 7408 /* Wait for HCI_EV_LE_REMOTE_FEAT_COMPLETE event otherwise 7409 * hci_conn_drop may run prematurely causing a disconnection. 7410 */ 7411 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_READ_REMOTE_FEATURES, 7412 sizeof(cp), &cp, 7413 HCI_EV_LE_REMOTE_FEAT_COMPLETE, 7414 HCI_CMD_TIMEOUT, NULL); 7415} 7416 7417int hci_le_read_remote_features(struct hci_conn *conn) 7418{ 7419 struct hci_dev *hdev = conn->hdev; 7420 int err; 7421 7422 /* The remote features procedure is defined for central 7423 * role only. So only in case of an initiated connection 7424 * request the remote features. 7425 * 7426 * If the local controller supports peripheral-initiated features 7427 * exchange, then requesting the remote features in peripheral 7428 * role is possible. Otherwise just transition into the 7429 * connected state without requesting the remote features. 7430 */ 7431 if (conn->out || (hdev->le_features[0] & HCI_LE_PERIPHERAL_FEATURES)) { 7432 err = hci_cmd_sync_queue_once(hdev, 7433 hci_le_read_remote_features_sync, 7434 hci_conn_hold(hci_conn_get(conn)), 7435 le_read_features_complete); 7436 if (err) { 7437 hci_conn_drop(conn); 7438 hci_conn_put(conn); 7439 } 7440 } else { 7441 err = -EOPNOTSUPP; 7442 } 7443 7444 return (err == -EEXIST) ? 0 : err; 7445} 7446 7447static void pkt_type_changed(struct hci_dev *hdev, void *data, int err) 7448{ 7449 struct hci_cp_change_conn_ptype *cp = data; 7450 7451 bt_dev_dbg(hdev, "err %d", err); 7452 7453 kfree(cp); 7454} 7455 7456static int hci_change_conn_ptype_sync(struct hci_dev *hdev, void *data) 7457{ 7458 struct hci_cp_change_conn_ptype *cp = data; 7459 7460 return __hci_cmd_sync_status_sk(hdev, HCI_OP_CHANGE_CONN_PTYPE, 7461 sizeof(*cp), cp, 7462 HCI_EV_PKT_TYPE_CHANGE, 7463 HCI_CMD_TIMEOUT, NULL); 7464} 7465 7466int hci_acl_change_pkt_type(struct hci_conn *conn, u16 pkt_type) 7467{ 7468 struct hci_dev *hdev = conn->hdev; 7469 struct hci_cp_change_conn_ptype *cp; 7470 int err; 7471 7472 cp = kmalloc(sizeof(*cp), GFP_KERNEL); 7473 if (!cp) 7474 return -ENOMEM; 7475 7476 cp->handle = cpu_to_le16(conn->handle); 7477 cp->pkt_type = cpu_to_le16(pkt_type); 7478 7479 err = hci_cmd_sync_queue_once(hdev, hci_change_conn_ptype_sync, cp, 7480 pkt_type_changed); 7481 if (err) 7482 kfree(cp); 7483 7484 return (err == -EEXIST) ? 0 : err; 7485} 7486 7487static void le_phy_update_complete(struct hci_dev *hdev, void *data, int err) 7488{ 7489 struct hci_cp_le_set_phy *cp = data; 7490 7491 bt_dev_dbg(hdev, "err %d", err); 7492 7493 kfree(cp); 7494} 7495 7496static int hci_le_set_phy_sync(struct hci_dev *hdev, void *data) 7497{ 7498 struct hci_cp_le_set_phy *cp = data; 7499 7500 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_SET_PHY, 7501 sizeof(*cp), cp, 7502 HCI_EV_LE_PHY_UPDATE_COMPLETE, 7503 HCI_CMD_TIMEOUT, NULL); 7504} 7505 7506int hci_le_set_phy(struct hci_conn *conn, u8 tx_phys, u8 rx_phys) 7507{ 7508 struct hci_dev *hdev = conn->hdev; 7509 struct hci_cp_le_set_phy *cp; 7510 int err; 7511 7512 cp = kmalloc(sizeof(*cp), GFP_KERNEL); 7513 if (!cp) 7514 return -ENOMEM; 7515 7516 memset(cp, 0, sizeof(*cp)); 7517 cp->handle = cpu_to_le16(conn->handle); 7518 cp->tx_phys = tx_phys; 7519 cp->rx_phys = rx_phys; 7520 7521 err = hci_cmd_sync_queue_once(hdev, hci_le_set_phy_sync, cp, 7522 le_phy_update_complete); 7523 if (err) 7524 kfree(cp); 7525 7526 return (err == -EEXIST) ? 0 : err; 7527}
~/
Read-only file preview.