1 // SPDX-License-Identifier: GPL-2.0
2 /*
3 * BlueZ - Bluetooth protocol stack for Linux
4 *
5 * Copyright (C) 2021 Intel Corporation
6 * Copyright 2023 NXP
7 */
8
9 #include <linux/property.h>
10
11 #include <net/bluetooth/bluetooth.h>
12 #include <net/bluetooth/hci_core.h>
13 #include <net/bluetooth/mgmt.h>
14
15 #include "hci_request.h"
16 #include "hci_codec.h"
17 #include "hci_debugfs.h"
18 #include "smp.h"
19 #include "eir.h"
20 #include "msft.h"
21 #include "aosp.h"
22 #include "leds.h"
23
hci_cmd_sync_complete(struct hci_dev * hdev,u8 result,u16 opcode,struct sk_buff * skb)24 static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode,
25 struct sk_buff *skb)
26 {
27 bt_dev_dbg(hdev, "result 0x%2.2x", result);
28
29 if (hdev->req_status != HCI_REQ_PEND)
30 return;
31
32 hdev->req_result = result;
33 hdev->req_status = HCI_REQ_DONE;
34
35 /* Free the request command so it is not used as response */
36 kfree_skb(hdev->req_skb);
37 hdev->req_skb = NULL;
38
39 if (skb) {
40 struct sock *sk = hci_skb_sk(skb);
41
42 /* Drop sk reference if set */
43 if (sk)
44 sock_put(sk);
45
46 hdev->req_rsp = skb_get(skb);
47 }
48
49 wake_up_interruptible(&hdev->req_wait_q);
50 }
51
hci_cmd_sync_alloc(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param,struct sock * sk)52 static struct sk_buff *hci_cmd_sync_alloc(struct hci_dev *hdev, u16 opcode,
53 u32 plen, const void *param,
54 struct sock *sk)
55 {
56 int len = HCI_COMMAND_HDR_SIZE + plen;
57 struct hci_command_hdr *hdr;
58 struct sk_buff *skb;
59
60 skb = bt_skb_alloc(len, GFP_ATOMIC);
61 if (!skb)
62 return NULL;
63
64 hdr = skb_put(skb, HCI_COMMAND_HDR_SIZE);
65 hdr->opcode = cpu_to_le16(opcode);
66 hdr->plen = plen;
67
68 if (plen)
69 skb_put_data(skb, param, plen);
70
71 bt_dev_dbg(hdev, "skb len %d", skb->len);
72
73 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT;
74 hci_skb_opcode(skb) = opcode;
75
76 /* Grab a reference if command needs to be associated with a sock (e.g.
77 * likely mgmt socket that initiated the command).
78 */
79 if (sk) {
80 hci_skb_sk(skb) = sk;
81 sock_hold(sk);
82 }
83
84 return skb;
85 }
86
hci_cmd_sync_add(struct hci_request * req,u16 opcode,u32 plen,const void * param,u8 event,struct sock * sk)87 static void hci_cmd_sync_add(struct hci_request *req, u16 opcode, u32 plen,
88 const void *param, u8 event, struct sock *sk)
89 {
90 struct hci_dev *hdev = req->hdev;
91 struct sk_buff *skb;
92
93 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
94
95 /* If an error occurred during request building, there is no point in
96 * queueing the HCI command. We can simply return.
97 */
98 if (req->err)
99 return;
100
101 skb = hci_cmd_sync_alloc(hdev, opcode, plen, param, sk);
102 if (!skb) {
103 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)",
104 opcode);
105 req->err = -ENOMEM;
106 return;
107 }
108
109 if (skb_queue_empty(&req->cmd_q))
110 bt_cb(skb)->hci.req_flags |= HCI_REQ_START;
111
112 hci_skb_event(skb) = event;
113
114 skb_queue_tail(&req->cmd_q, skb);
115 }
116
hci_req_sync_run(struct hci_request * req)117 static int hci_req_sync_run(struct hci_request *req)
118 {
119 struct hci_dev *hdev = req->hdev;
120 struct sk_buff *skb;
121 unsigned long flags;
122
123 bt_dev_dbg(hdev, "length %u", skb_queue_len(&req->cmd_q));
124
125 /* If an error occurred during request building, remove all HCI
126 * commands queued on the HCI request queue.
127 */
128 if (req->err) {
129 skb_queue_purge(&req->cmd_q);
130 return req->err;
131 }
132
133 /* Do not allow empty requests */
134 if (skb_queue_empty(&req->cmd_q))
135 return -ENODATA;
136
137 skb = skb_peek_tail(&req->cmd_q);
138 bt_cb(skb)->hci.req_complete_skb = hci_cmd_sync_complete;
139 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB;
140
141 spin_lock_irqsave(&hdev->cmd_q.lock, flags);
142 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q);
143 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags);
144
145 queue_work(hdev->workqueue, &hdev->cmd_work);
146
147 return 0;
148 }
149
150 /* This function requires the caller holds hdev->req_lock. */
__hci_cmd_sync_sk(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param,u8 event,u32 timeout,struct sock * sk)151 struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen,
152 const void *param, u8 event, u32 timeout,
153 struct sock *sk)
154 {
155 struct hci_request req;
156 struct sk_buff *skb;
157 int err = 0;
158
159 bt_dev_dbg(hdev, "Opcode 0x%4.4x", opcode);
160
161 hci_req_init(&req, hdev);
162
163 hci_cmd_sync_add(&req, opcode, plen, param, event, sk);
164
165 hdev->req_status = HCI_REQ_PEND;
166
167 err = hci_req_sync_run(&req);
168 if (err < 0)
169 return ERR_PTR(err);
170
171 err = wait_event_interruptible_timeout(hdev->req_wait_q,
172 hdev->req_status != HCI_REQ_PEND,
173 timeout);
174
175 if (err == -ERESTARTSYS)
176 return ERR_PTR(-EINTR);
177
178 switch (hdev->req_status) {
179 case HCI_REQ_DONE:
180 err = -bt_to_errno(hdev->req_result);
181 break;
182
183 case HCI_REQ_CANCELED:
184 err = -hdev->req_result;
185 break;
186
187 default:
188 err = -ETIMEDOUT;
189 break;
190 }
191
192 hdev->req_status = 0;
193 hdev->req_result = 0;
194 skb = hdev->req_rsp;
195 hdev->req_rsp = NULL;
196
197 bt_dev_dbg(hdev, "end: err %d", err);
198
199 if (err < 0) {
200 kfree_skb(skb);
201 return ERR_PTR(err);
202 }
203
204 /* If command return a status event skb will be set to NULL as there are
205 * no parameters.
206 */
207 if (!skb)
208 return ERR_PTR(-ENODATA);
209
210 return skb;
211 }
212 EXPORT_SYMBOL(__hci_cmd_sync_sk);
213
214 /* This function requires the caller holds hdev->req_lock. */
__hci_cmd_sync(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param,u32 timeout)215 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
216 const void *param, u32 timeout)
217 {
218 return __hci_cmd_sync_sk(hdev, opcode, plen, param, 0, timeout, NULL);
219 }
220 EXPORT_SYMBOL(__hci_cmd_sync);
221
222 /* Send HCI command and wait for command complete event */
hci_cmd_sync(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param,u32 timeout)223 struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen,
224 const void *param, u32 timeout)
225 {
226 struct sk_buff *skb;
227
228 if (!test_bit(HCI_UP, &hdev->flags))
229 return ERR_PTR(-ENETDOWN);
230
231 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen);
232
233 hci_req_sync_lock(hdev);
234 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout);
235 hci_req_sync_unlock(hdev);
236
237 return skb;
238 }
239 EXPORT_SYMBOL(hci_cmd_sync);
240
241 /* This function requires the caller holds hdev->req_lock. */
__hci_cmd_sync_ev(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param,u8 event,u32 timeout)242 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen,
243 const void *param, u8 event, u32 timeout)
244 {
245 return __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout,
246 NULL);
247 }
248 EXPORT_SYMBOL(__hci_cmd_sync_ev);
249
250 /* This function requires the caller holds hdev->req_lock. */
__hci_cmd_sync_status_sk(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param,u8 event,u32 timeout,struct sock * sk)251 int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen,
252 const void *param, u8 event, u32 timeout,
253 struct sock *sk)
254 {
255 struct sk_buff *skb;
256 u8 status;
257
258 skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk);
259
260 /* If command return a status event, skb will be set to -ENODATA */
261 if (skb == ERR_PTR(-ENODATA))
262 return 0;
263
264 if (IS_ERR(skb)) {
265 if (!event)
266 bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", opcode,
267 PTR_ERR(skb));
268 return PTR_ERR(skb);
269 }
270
271 status = skb->data[0];
272
273 kfree_skb(skb);
274
275 return status;
276 }
277 EXPORT_SYMBOL(__hci_cmd_sync_status_sk);
278
__hci_cmd_sync_status(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param,u32 timeout)279 int __hci_cmd_sync_status(struct hci_dev *hdev, u16 opcode, u32 plen,
280 const void *param, u32 timeout)
281 {
282 return __hci_cmd_sync_status_sk(hdev, opcode, plen, param, 0, timeout,
283 NULL);
284 }
285 EXPORT_SYMBOL(__hci_cmd_sync_status);
286
hci_cmd_sync_status(struct hci_dev * hdev,u16 opcode,u32 plen,const void * param,u32 timeout)287 int hci_cmd_sync_status(struct hci_dev *hdev, u16 opcode, u32 plen,
288 const void *param, u32 timeout)
289 {
290 int err;
291
292 hci_req_sync_lock(hdev);
293 err = __hci_cmd_sync_status(hdev, opcode, plen, param, timeout);
294 hci_req_sync_unlock(hdev);
295
296 return err;
297 }
298 EXPORT_SYMBOL(hci_cmd_sync_status);
299
hci_cmd_sync_work(struct work_struct * work)300 static void hci_cmd_sync_work(struct work_struct *work)
301 {
302 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_sync_work);
303
304 bt_dev_dbg(hdev, "");
305
306 /* Dequeue all entries and run them */
307 while (1) {
308 struct hci_cmd_sync_work_entry *entry;
309
310 mutex_lock(&hdev->cmd_sync_work_lock);
311 entry = list_first_entry_or_null(&hdev->cmd_sync_work_list,
312 struct hci_cmd_sync_work_entry,
313 list);
314 if (entry)
315 list_del(&entry->list);
316 mutex_unlock(&hdev->cmd_sync_work_lock);
317
318 if (!entry)
319 break;
320
321 bt_dev_dbg(hdev, "entry %p", entry);
322
323 if (entry->func) {
324 int err;
325
326 hci_req_sync_lock(hdev);
327 err = entry->func(hdev, entry->data);
328 if (entry->destroy)
329 entry->destroy(hdev, entry->data, err);
330 hci_req_sync_unlock(hdev);
331 }
332
333 kfree(entry);
334 }
335 }
336
hci_cmd_sync_cancel_work(struct work_struct * work)337 static void hci_cmd_sync_cancel_work(struct work_struct *work)
338 {
339 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_sync_cancel_work);
340
341 cancel_delayed_work_sync(&hdev->cmd_timer);
342 cancel_delayed_work_sync(&hdev->ncmd_timer);
343 atomic_set(&hdev->cmd_cnt, 1);
344
345 wake_up_interruptible(&hdev->req_wait_q);
346 }
347
348 static int hci_scan_disable_sync(struct hci_dev *hdev);
scan_disable_sync(struct hci_dev * hdev,void * data)349 static int scan_disable_sync(struct hci_dev *hdev, void *data)
350 {
351 return hci_scan_disable_sync(hdev);
352 }
353
354 static int hci_inquiry_sync(struct hci_dev *hdev, u8 length);
interleaved_inquiry_sync(struct hci_dev * hdev,void * data)355 static int interleaved_inquiry_sync(struct hci_dev *hdev, void *data)
356 {
357 return hci_inquiry_sync(hdev, DISCOV_INTERLEAVED_INQUIRY_LEN);
358 }
359
le_scan_disable(struct work_struct * work)360 static void le_scan_disable(struct work_struct *work)
361 {
362 struct hci_dev *hdev = container_of(work, struct hci_dev,
363 le_scan_disable.work);
364 int status;
365
366 bt_dev_dbg(hdev, "");
367 hci_dev_lock(hdev);
368
369 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
370 goto _return;
371
372 cancel_delayed_work(&hdev->le_scan_restart);
373
374 status = hci_cmd_sync_queue(hdev, scan_disable_sync, NULL, NULL);
375 if (status) {
376 bt_dev_err(hdev, "failed to disable LE scan: %d", status);
377 goto _return;
378 }
379
380 hdev->discovery.scan_start = 0;
381
382 /* If we were running LE only scan, change discovery state. If
383 * we were running both LE and BR/EDR inquiry simultaneously,
384 * and BR/EDR inquiry is already finished, stop discovery,
385 * otherwise BR/EDR inquiry will stop discovery when finished.
386 * If we will resolve remote device name, do not change
387 * discovery state.
388 */
389
390 if (hdev->discovery.type == DISCOV_TYPE_LE)
391 goto discov_stopped;
392
393 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED)
394 goto _return;
395
396 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY, &hdev->quirks)) {
397 if (!test_bit(HCI_INQUIRY, &hdev->flags) &&
398 hdev->discovery.state != DISCOVERY_RESOLVING)
399 goto discov_stopped;
400
401 goto _return;
402 }
403
404 status = hci_cmd_sync_queue(hdev, interleaved_inquiry_sync, NULL, NULL);
405 if (status) {
406 bt_dev_err(hdev, "inquiry failed: status %d", status);
407 goto discov_stopped;
408 }
409
410 goto _return;
411
412 discov_stopped:
413 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
414
415 _return:
416 hci_dev_unlock(hdev);
417 }
418
419 static int hci_le_set_scan_enable_sync(struct hci_dev *hdev, u8 val,
420 u8 filter_dup);
hci_le_scan_restart_sync(struct hci_dev * hdev)421 static int hci_le_scan_restart_sync(struct hci_dev *hdev)
422 {
423 /* If controller is not scanning we are done. */
424 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
425 return 0;
426
427 if (hdev->scanning_paused) {
428 bt_dev_dbg(hdev, "Scanning is paused for suspend");
429 return 0;
430 }
431
432 hci_le_set_scan_enable_sync(hdev, LE_SCAN_DISABLE, 0x00);
433 return hci_le_set_scan_enable_sync(hdev, LE_SCAN_ENABLE,
434 LE_SCAN_FILTER_DUP_ENABLE);
435 }
436
le_scan_restart(struct work_struct * work)437 static void le_scan_restart(struct work_struct *work)
438 {
439 struct hci_dev *hdev = container_of(work, struct hci_dev,
440 le_scan_restart.work);
441 unsigned long timeout, duration, scan_start, now;
442 int status;
443
444 bt_dev_dbg(hdev, "");
445
446 status = hci_le_scan_restart_sync(hdev);
447 if (status) {
448 bt_dev_err(hdev, "failed to restart LE scan: status %d",
449 status);
450 return;
451 }
452
453 hci_dev_lock(hdev);
454
455 if (!test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) ||
456 !hdev->discovery.scan_start)
457 goto unlock;
458
459 /* When the scan was started, hdev->le_scan_disable has been queued
460 * after duration from scan_start. During scan restart this job
461 * has been canceled, and we need to queue it again after proper
462 * timeout, to make sure that scan does not run indefinitely.
463 */
464 duration = hdev->discovery.scan_duration;
465 scan_start = hdev->discovery.scan_start;
466 now = jiffies;
467 if (now - scan_start <= duration) {
468 int elapsed;
469
470 if (now >= scan_start)
471 elapsed = now - scan_start;
472 else
473 elapsed = ULONG_MAX - scan_start + now;
474
475 timeout = duration - elapsed;
476 } else {
477 timeout = 0;
478 }
479
480 queue_delayed_work(hdev->req_workqueue,
481 &hdev->le_scan_disable, timeout);
482
483 unlock:
484 hci_dev_unlock(hdev);
485 }
486
reenable_adv_sync(struct hci_dev * hdev,void * data)487 static int reenable_adv_sync(struct hci_dev *hdev, void *data)
488 {
489 bt_dev_dbg(hdev, "");
490
491 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
492 list_empty(&hdev->adv_instances))
493 return 0;
494
495 if (hdev->cur_adv_instance) {
496 return hci_schedule_adv_instance_sync(hdev,
497 hdev->cur_adv_instance,
498 true);
499 } else {
500 if (ext_adv_capable(hdev)) {
501 hci_start_ext_adv_sync(hdev, 0x00);
502 } else {
503 hci_update_adv_data_sync(hdev, 0x00);
504 hci_update_scan_rsp_data_sync(hdev, 0x00);
505 hci_enable_advertising_sync(hdev);
506 }
507 }
508
509 return 0;
510 }
511
reenable_adv(struct work_struct * work)512 static void reenable_adv(struct work_struct *work)
513 {
514 struct hci_dev *hdev = container_of(work, struct hci_dev,
515 reenable_adv_work);
516 int status;
517
518 bt_dev_dbg(hdev, "");
519
520 hci_dev_lock(hdev);
521
522 status = hci_cmd_sync_queue(hdev, reenable_adv_sync, NULL, NULL);
523 if (status)
524 bt_dev_err(hdev, "failed to reenable ADV: %d", status);
525
526 hci_dev_unlock(hdev);
527 }
528
cancel_adv_timeout(struct hci_dev * hdev)529 static void cancel_adv_timeout(struct hci_dev *hdev)
530 {
531 if (hdev->adv_instance_timeout) {
532 hdev->adv_instance_timeout = 0;
533 cancel_delayed_work(&hdev->adv_instance_expire);
534 }
535 }
536
537 /* For a single instance:
538 * - force == true: The instance will be removed even when its remaining
539 * lifetime is not zero.
540 * - force == false: the instance will be deactivated but kept stored unless
541 * the remaining lifetime is zero.
542 *
543 * For instance == 0x00:
544 * - force == true: All instances will be removed regardless of their timeout
545 * setting.
546 * - force == false: Only instances that have a timeout will be removed.
547 */
hci_clear_adv_instance_sync(struct hci_dev * hdev,struct sock * sk,u8 instance,bool force)548 int hci_clear_adv_instance_sync(struct hci_dev *hdev, struct sock *sk,
549 u8 instance, bool force)
550 {
551 struct adv_info *adv_instance, *n, *next_instance = NULL;
552 int err;
553 u8 rem_inst;
554
555 /* Cancel any timeout concerning the removed instance(s). */
556 if (!instance || hdev->cur_adv_instance == instance)
557 cancel_adv_timeout(hdev);
558
559 /* Get the next instance to advertise BEFORE we remove
560 * the current one. This can be the same instance again
561 * if there is only one instance.
562 */
563 if (instance && hdev->cur_adv_instance == instance)
564 next_instance = hci_get_next_instance(hdev, instance);
565
566 if (instance == 0x00) {
567 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances,
568 list) {
569 if (!(force || adv_instance->timeout))
570 continue;
571
572 rem_inst = adv_instance->instance;
573 err = hci_remove_adv_instance(hdev, rem_inst);
574 if (!err)
575 mgmt_advertising_removed(sk, hdev, rem_inst);
576 }
577 } else {
578 adv_instance = hci_find_adv_instance(hdev, instance);
579
580 if (force || (adv_instance && adv_instance->timeout &&
581 !adv_instance->remaining_time)) {
582 /* Don't advertise a removed instance. */
583 if (next_instance &&
584 next_instance->instance == instance)
585 next_instance = NULL;
586
587 err = hci_remove_adv_instance(hdev, instance);
588 if (!err)
589 mgmt_advertising_removed(sk, hdev, instance);
590 }
591 }
592
593 if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_ADVERTISING))
594 return 0;
595
596 if (next_instance && !ext_adv_capable(hdev))
597 return hci_schedule_adv_instance_sync(hdev,
598 next_instance->instance,
599 false);
600
601 return 0;
602 }
603
adv_timeout_expire_sync(struct hci_dev * hdev,void * data)604 static int adv_timeout_expire_sync(struct hci_dev *hdev, void *data)
605 {
606 u8 instance = *(u8 *)data;
607
608 kfree(data);
609
610 hci_clear_adv_instance_sync(hdev, NULL, instance, false);
611
612 if (list_empty(&hdev->adv_instances))
613 return hci_disable_advertising_sync(hdev);
614
615 return 0;
616 }
617
adv_timeout_expire(struct work_struct * work)618 static void adv_timeout_expire(struct work_struct *work)
619 {
620 u8 *inst_ptr;
621 struct hci_dev *hdev = container_of(work, struct hci_dev,
622 adv_instance_expire.work);
623
624 bt_dev_dbg(hdev, "");
625
626 hci_dev_lock(hdev);
627
628 hdev->adv_instance_timeout = 0;
629
630 if (hdev->cur_adv_instance == 0x00)
631 goto unlock;
632
633 inst_ptr = kmalloc(1, GFP_KERNEL);
634 if (!inst_ptr)
635 goto unlock;
636
637 *inst_ptr = hdev->cur_adv_instance;
638 hci_cmd_sync_queue(hdev, adv_timeout_expire_sync, inst_ptr, NULL);
639
640 unlock:
641 hci_dev_unlock(hdev);
642 }
643
hci_cmd_sync_init(struct hci_dev * hdev)644 void hci_cmd_sync_init(struct hci_dev *hdev)
645 {
646 INIT_WORK(&hdev->cmd_sync_work, hci_cmd_sync_work);
647 INIT_LIST_HEAD(&hdev->cmd_sync_work_list);
648 mutex_init(&hdev->cmd_sync_work_lock);
649 mutex_init(&hdev->unregister_lock);
650
651 INIT_WORK(&hdev->cmd_sync_cancel_work, hci_cmd_sync_cancel_work);
652 INIT_WORK(&hdev->reenable_adv_work, reenable_adv);
653 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable);
654 INIT_DELAYED_WORK(&hdev->le_scan_restart, le_scan_restart);
655 INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire);
656 }
657
_hci_cmd_sync_cancel_entry(struct hci_dev * hdev,struct hci_cmd_sync_work_entry * entry,int err)658 static void _hci_cmd_sync_cancel_entry(struct hci_dev *hdev,
659 struct hci_cmd_sync_work_entry *entry,
660 int err)
661 {
662 if (entry->destroy)
663 entry->destroy(hdev, entry->data, err);
664
665 list_del(&entry->list);
666 kfree(entry);
667 }
668
hci_cmd_sync_clear(struct hci_dev * hdev)669 void hci_cmd_sync_clear(struct hci_dev *hdev)
670 {
671 struct hci_cmd_sync_work_entry *entry, *tmp;
672
673 cancel_work_sync(&hdev->cmd_sync_work);
674 cancel_work_sync(&hdev->reenable_adv_work);
675
676 mutex_lock(&hdev->cmd_sync_work_lock);
677 list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list)
678 _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
679 mutex_unlock(&hdev->cmd_sync_work_lock);
680 }
681
hci_cmd_sync_cancel(struct hci_dev * hdev,int err)682 void hci_cmd_sync_cancel(struct hci_dev *hdev, int err)
683 {
684 bt_dev_dbg(hdev, "err 0x%2.2x", err);
685
686 if (hdev->req_status == HCI_REQ_PEND) {
687 hdev->req_result = err;
688 hdev->req_status = HCI_REQ_CANCELED;
689
690 queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work);
691 }
692 }
693 EXPORT_SYMBOL(hci_cmd_sync_cancel);
694
695 /* Cancel ongoing command request synchronously:
696 *
697 * - Set result and mark status to HCI_REQ_CANCELED
698 * - Wakeup command sync thread
699 */
hci_cmd_sync_cancel_sync(struct hci_dev * hdev,int err)700 void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err)
701 {
702 bt_dev_dbg(hdev, "err 0x%2.2x", err);
703
704 if (hdev->req_status == HCI_REQ_PEND) {
705 /* req_result is __u32 so error must be positive to be properly
706 * propagated.
707 */
708 hdev->req_result = err < 0 ? -err : err;
709 hdev->req_status = HCI_REQ_CANCELED;
710
711 wake_up_interruptible(&hdev->req_wait_q);
712 }
713 }
714 EXPORT_SYMBOL(hci_cmd_sync_cancel_sync);
715
716 /* Submit HCI command to be run in as cmd_sync_work:
717 *
718 * - hdev must _not_ be unregistered
719 */
hci_cmd_sync_submit(struct hci_dev * hdev,hci_cmd_sync_work_func_t func,void * data,hci_cmd_sync_work_destroy_t destroy)720 int hci_cmd_sync_submit(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
721 void *data, hci_cmd_sync_work_destroy_t destroy)
722 {
723 struct hci_cmd_sync_work_entry *entry;
724 int err = 0;
725
726 mutex_lock(&hdev->unregister_lock);
727 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
728 err = -ENODEV;
729 goto unlock;
730 }
731
732 entry = kmalloc(sizeof(*entry), GFP_KERNEL);
733 if (!entry) {
734 err = -ENOMEM;
735 goto unlock;
736 }
737 entry->func = func;
738 entry->data = data;
739 entry->destroy = destroy;
740
741 mutex_lock(&hdev->cmd_sync_work_lock);
742 list_add_tail(&entry->list, &hdev->cmd_sync_work_list);
743 mutex_unlock(&hdev->cmd_sync_work_lock);
744
745 queue_work(hdev->req_workqueue, &hdev->cmd_sync_work);
746
747 unlock:
748 mutex_unlock(&hdev->unregister_lock);
749 return err;
750 }
751 EXPORT_SYMBOL(hci_cmd_sync_submit);
752
753 /* Queue HCI command:
754 *
755 * - hdev must be running
756 */
hci_cmd_sync_queue(struct hci_dev * hdev,hci_cmd_sync_work_func_t func,void * data,hci_cmd_sync_work_destroy_t destroy)757 int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
758 void *data, hci_cmd_sync_work_destroy_t destroy)
759 {
760 /* Only queue command if hdev is running which means it had been opened
761 * and is either on init phase or is already up.
762 */
763 if (!test_bit(HCI_RUNNING, &hdev->flags))
764 return -ENETDOWN;
765
766 return hci_cmd_sync_submit(hdev, func, data, destroy);
767 }
768 EXPORT_SYMBOL(hci_cmd_sync_queue);
769
770 static struct hci_cmd_sync_work_entry *
_hci_cmd_sync_lookup_entry(struct hci_dev * hdev,hci_cmd_sync_work_func_t func,void * data,hci_cmd_sync_work_destroy_t destroy)771 _hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
772 void *data, hci_cmd_sync_work_destroy_t destroy)
773 {
774 struct hci_cmd_sync_work_entry *entry, *tmp;
775
776 list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) {
777 if (func && entry->func != func)
778 continue;
779
780 if (data && entry->data != data)
781 continue;
782
783 if (destroy && entry->destroy != destroy)
784 continue;
785
786 return entry;
787 }
788
789 return NULL;
790 }
791
792 /* Queue HCI command entry once:
793 *
794 * - Lookup if an entry already exist and only if it doesn't creates a new entry
795 * and queue it.
796 */
hci_cmd_sync_queue_once(struct hci_dev * hdev,hci_cmd_sync_work_func_t func,void * data,hci_cmd_sync_work_destroy_t destroy)797 int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
798 void *data, hci_cmd_sync_work_destroy_t destroy)
799 {
800 if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy))
801 return 0;
802
803 return hci_cmd_sync_queue(hdev, func, data, destroy);
804 }
805 EXPORT_SYMBOL(hci_cmd_sync_queue_once);
806
807 /* Run HCI command:
808 *
809 * - hdev must be running
810 * - if on cmd_sync_work then run immediately otherwise queue
811 */
hci_cmd_sync_run(struct hci_dev * hdev,hci_cmd_sync_work_func_t func,void * data,hci_cmd_sync_work_destroy_t destroy)812 int hci_cmd_sync_run(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
813 void *data, hci_cmd_sync_work_destroy_t destroy)
814 {
815 /* Only queue command if hdev is running which means it had been opened
816 * and is either on init phase or is already up.
817 */
818 if (!test_bit(HCI_RUNNING, &hdev->flags))
819 return -ENETDOWN;
820
821 /* If on cmd_sync_work then run immediately otherwise queue */
822 if (current_work() == &hdev->cmd_sync_work)
823 return func(hdev, data);
824
825 return hci_cmd_sync_submit(hdev, func, data, destroy);
826 }
827 EXPORT_SYMBOL(hci_cmd_sync_run);
828
829 /* Run HCI command entry once:
830 *
831 * - Lookup if an entry already exist and only if it doesn't creates a new entry
832 * and run it.
833 * - if on cmd_sync_work then run immediately otherwise queue
834 */
hci_cmd_sync_run_once(struct hci_dev * hdev,hci_cmd_sync_work_func_t func,void * data,hci_cmd_sync_work_destroy_t destroy)835 int hci_cmd_sync_run_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
836 void *data, hci_cmd_sync_work_destroy_t destroy)
837 {
838 if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy))
839 return 0;
840
841 return hci_cmd_sync_run(hdev, func, data, destroy);
842 }
843 EXPORT_SYMBOL(hci_cmd_sync_run_once);
844
845 /* Lookup HCI command entry:
846 *
847 * - Return first entry that matches by function callback or data or
848 * destroy callback.
849 */
850 struct hci_cmd_sync_work_entry *
hci_cmd_sync_lookup_entry(struct hci_dev * hdev,hci_cmd_sync_work_func_t func,void * data,hci_cmd_sync_work_destroy_t destroy)851 hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
852 void *data, hci_cmd_sync_work_destroy_t destroy)
853 {
854 struct hci_cmd_sync_work_entry *entry;
855
856 mutex_lock(&hdev->cmd_sync_work_lock);
857 entry = _hci_cmd_sync_lookup_entry(hdev, func, data, destroy);
858 mutex_unlock(&hdev->cmd_sync_work_lock);
859
860 return entry;
861 }
862 EXPORT_SYMBOL(hci_cmd_sync_lookup_entry);
863
864 /* Cancel HCI command entry */
hci_cmd_sync_cancel_entry(struct hci_dev * hdev,struct hci_cmd_sync_work_entry * entry)865 void hci_cmd_sync_cancel_entry(struct hci_dev *hdev,
866 struct hci_cmd_sync_work_entry *entry)
867 {
868 mutex_lock(&hdev->cmd_sync_work_lock);
869 _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
870 mutex_unlock(&hdev->cmd_sync_work_lock);
871 }
872 EXPORT_SYMBOL(hci_cmd_sync_cancel_entry);
873
874 /* Dequeue one HCI command entry:
875 *
876 * - Lookup and cancel first entry that matches.
877 */
hci_cmd_sync_dequeue_once(struct hci_dev * hdev,hci_cmd_sync_work_func_t func,void * data,hci_cmd_sync_work_destroy_t destroy)878 bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev,
879 hci_cmd_sync_work_func_t func,
880 void *data, hci_cmd_sync_work_destroy_t destroy)
881 {
882 struct hci_cmd_sync_work_entry *entry;
883
884 entry = hci_cmd_sync_lookup_entry(hdev, func, data, destroy);
885 if (!entry)
886 return false;
887
888 hci_cmd_sync_cancel_entry(hdev, entry);
889
890 return true;
891 }
892 EXPORT_SYMBOL(hci_cmd_sync_dequeue_once);
893
894 /* Dequeue HCI command entry:
895 *
896 * - Lookup and cancel any entry that matches by function callback or data or
897 * destroy callback.
898 */
hci_cmd_sync_dequeue(struct hci_dev * hdev,hci_cmd_sync_work_func_t func,void * data,hci_cmd_sync_work_destroy_t destroy)899 bool hci_cmd_sync_dequeue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func,
900 void *data, hci_cmd_sync_work_destroy_t destroy)
901 {
902 struct hci_cmd_sync_work_entry *entry;
903 bool ret = false;
904
905 mutex_lock(&hdev->cmd_sync_work_lock);
906 while ((entry = _hci_cmd_sync_lookup_entry(hdev, func, data,
907 destroy))) {
908 _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED);
909 ret = true;
910 }
911 mutex_unlock(&hdev->cmd_sync_work_lock);
912
913 return ret;
914 }
915 EXPORT_SYMBOL(hci_cmd_sync_dequeue);
916
hci_update_eir_sync(struct hci_dev * hdev)917 int hci_update_eir_sync(struct hci_dev *hdev)
918 {
919 struct hci_cp_write_eir cp;
920
921 bt_dev_dbg(hdev, "");
922
923 if (!hdev_is_powered(hdev))
924 return 0;
925
926 if (!lmp_ext_inq_capable(hdev))
927 return 0;
928
929 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
930 return 0;
931
932 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
933 return 0;
934
935 memset(&cp, 0, sizeof(cp));
936
937 eir_create(hdev, cp.data);
938
939 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0)
940 return 0;
941
942 memcpy(hdev->eir, cp.data, sizeof(cp.data));
943
944 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp,
945 HCI_CMD_TIMEOUT);
946 }
947
get_service_classes(struct hci_dev * hdev)948 static u8 get_service_classes(struct hci_dev *hdev)
949 {
950 struct bt_uuid *uuid;
951 u8 val = 0;
952
953 list_for_each_entry(uuid, &hdev->uuids, list)
954 val |= uuid->svc_hint;
955
956 return val;
957 }
958
hci_update_class_sync(struct hci_dev * hdev)959 int hci_update_class_sync(struct hci_dev *hdev)
960 {
961 u8 cod[3];
962
963 bt_dev_dbg(hdev, "");
964
965 if (!hdev_is_powered(hdev))
966 return 0;
967
968 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
969 return 0;
970
971 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE))
972 return 0;
973
974 cod[0] = hdev->minor_class;
975 cod[1] = hdev->major_class;
976 cod[2] = get_service_classes(hdev);
977
978 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE))
979 cod[1] |= 0x20;
980
981 if (memcmp(cod, hdev->dev_class, 3) == 0)
982 return 0;
983
984 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CLASS_OF_DEV,
985 sizeof(cod), cod, HCI_CMD_TIMEOUT);
986 }
987
is_advertising_allowed(struct hci_dev * hdev,bool connectable)988 static bool is_advertising_allowed(struct hci_dev *hdev, bool connectable)
989 {
990 /* If there is no connection we are OK to advertise. */
991 if (hci_conn_num(hdev, LE_LINK) == 0)
992 return true;
993
994 /* Check le_states if there is any connection in peripheral role. */
995 if (hdev->conn_hash.le_num_peripheral > 0) {
996 /* Peripheral connection state and non connectable mode
997 * bit 20.
998 */
999 if (!connectable && !(hdev->le_states[2] & 0x10))
1000 return false;
1001
1002 /* Peripheral connection state and connectable mode bit 38
1003 * and scannable bit 21.
1004 */
1005 if (connectable && (!(hdev->le_states[4] & 0x40) ||
1006 !(hdev->le_states[2] & 0x20)))
1007 return false;
1008 }
1009
1010 /* Check le_states if there is any connection in central role. */
1011 if (hci_conn_num(hdev, LE_LINK) != hdev->conn_hash.le_num_peripheral) {
1012 /* Central connection state and non connectable mode bit 18. */
1013 if (!connectable && !(hdev->le_states[2] & 0x02))
1014 return false;
1015
1016 /* Central connection state and connectable mode bit 35 and
1017 * scannable 19.
1018 */
1019 if (connectable && (!(hdev->le_states[4] & 0x08) ||
1020 !(hdev->le_states[2] & 0x08)))
1021 return false;
1022 }
1023
1024 return true;
1025 }
1026
adv_use_rpa(struct hci_dev * hdev,uint32_t flags)1027 static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags)
1028 {
1029 /* If privacy is not enabled don't use RPA */
1030 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
1031 return false;
1032
1033 /* If basic privacy mode is enabled use RPA */
1034 if (!hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
1035 return true;
1036
1037 /* If limited privacy mode is enabled don't use RPA if we're
1038 * both discoverable and bondable.
1039 */
1040 if ((flags & MGMT_ADV_FLAG_DISCOV) &&
1041 hci_dev_test_flag(hdev, HCI_BONDABLE))
1042 return false;
1043
1044 /* We're neither bondable nor discoverable in the limited
1045 * privacy mode, therefore use RPA.
1046 */
1047 return true;
1048 }
1049
hci_set_random_addr_sync(struct hci_dev * hdev,bdaddr_t * rpa)1050 static int hci_set_random_addr_sync(struct hci_dev *hdev, bdaddr_t *rpa)
1051 {
1052 /* If we're advertising or initiating an LE connection we can't
1053 * go ahead and change the random address at this time. This is
1054 * because the eventual initiator address used for the
1055 * subsequently created connection will be undefined (some
1056 * controllers use the new address and others the one we had
1057 * when the operation started).
1058 *
1059 * In this kind of scenario skip the update and let the random
1060 * address be updated at the next cycle.
1061 */
1062 if (hci_dev_test_flag(hdev, HCI_LE_ADV) ||
1063 hci_lookup_le_connect(hdev)) {
1064 bt_dev_dbg(hdev, "Deferring random address update");
1065 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
1066 return 0;
1067 }
1068
1069 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_RANDOM_ADDR,
1070 6, rpa, HCI_CMD_TIMEOUT);
1071 }
1072
hci_update_random_address_sync(struct hci_dev * hdev,bool require_privacy,bool rpa,u8 * own_addr_type)1073 int hci_update_random_address_sync(struct hci_dev *hdev, bool require_privacy,
1074 bool rpa, u8 *own_addr_type)
1075 {
1076 int err;
1077
1078 /* If privacy is enabled use a resolvable private address. If
1079 * current RPA has expired or there is something else than
1080 * the current RPA in use, then generate a new one.
1081 */
1082 if (rpa) {
1083 /* If Controller supports LL Privacy use own address type is
1084 * 0x03
1085 */
1086 if (use_ll_privacy(hdev))
1087 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED;
1088 else
1089 *own_addr_type = ADDR_LE_DEV_RANDOM;
1090
1091 /* Check if RPA is valid */
1092 if (rpa_valid(hdev))
1093 return 0;
1094
1095 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
1096 if (err < 0) {
1097 bt_dev_err(hdev, "failed to generate new RPA");
1098 return err;
1099 }
1100
1101 err = hci_set_random_addr_sync(hdev, &hdev->rpa);
1102 if (err)
1103 return err;
1104
1105 return 0;
1106 }
1107
1108 /* In case of required privacy without resolvable private address,
1109 * use an non-resolvable private address. This is useful for active
1110 * scanning and non-connectable advertising.
1111 */
1112 if (require_privacy) {
1113 bdaddr_t nrpa;
1114
1115 while (true) {
1116 /* The non-resolvable private address is generated
1117 * from random six bytes with the two most significant
1118 * bits cleared.
1119 */
1120 get_random_bytes(&nrpa, 6);
1121 nrpa.b[5] &= 0x3f;
1122
1123 /* The non-resolvable private address shall not be
1124 * equal to the public address.
1125 */
1126 if (bacmp(&hdev->bdaddr, &nrpa))
1127 break;
1128 }
1129
1130 *own_addr_type = ADDR_LE_DEV_RANDOM;
1131
1132 return hci_set_random_addr_sync(hdev, &nrpa);
1133 }
1134
1135 /* If forcing static address is in use or there is no public
1136 * address use the static address as random address (but skip
1137 * the HCI command if the current random address is already the
1138 * static one.
1139 *
1140 * In case BR/EDR has been disabled on a dual-mode controller
1141 * and a static address has been configured, then use that
1142 * address instead of the public BR/EDR address.
1143 */
1144 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
1145 !bacmp(&hdev->bdaddr, BDADDR_ANY) ||
1146 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) &&
1147 bacmp(&hdev->static_addr, BDADDR_ANY))) {
1148 *own_addr_type = ADDR_LE_DEV_RANDOM;
1149 if (bacmp(&hdev->static_addr, &hdev->random_addr))
1150 return hci_set_random_addr_sync(hdev,
1151 &hdev->static_addr);
1152 return 0;
1153 }
1154
1155 /* Neither privacy nor static address is being used so use a
1156 * public address.
1157 */
1158 *own_addr_type = ADDR_LE_DEV_PUBLIC;
1159
1160 return 0;
1161 }
1162
hci_disable_ext_adv_instance_sync(struct hci_dev * hdev,u8 instance)1163 static int hci_disable_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
1164 {
1165 struct hci_cp_le_set_ext_adv_enable *cp;
1166 struct hci_cp_ext_adv_set *set;
1167 u8 data[sizeof(*cp) + sizeof(*set) * 1];
1168 u8 size;
1169
1170 /* If request specifies an instance that doesn't exist, fail */
1171 if (instance > 0) {
1172 struct adv_info *adv;
1173
1174 adv = hci_find_adv_instance(hdev, instance);
1175 if (!adv)
1176 return -EINVAL;
1177
1178 /* If not enabled there is nothing to do */
1179 if (!adv->enabled)
1180 return 0;
1181 }
1182
1183 memset(data, 0, sizeof(data));
1184
1185 cp = (void *)data;
1186 set = (void *)cp->data;
1187
1188 /* Instance 0x00 indicates all advertising instances will be disabled */
1189 cp->num_of_sets = !!instance;
1190 cp->enable = 0x00;
1191
1192 set->handle = instance;
1193
1194 size = sizeof(*cp) + sizeof(*set) * cp->num_of_sets;
1195
1196 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE,
1197 size, data, HCI_CMD_TIMEOUT);
1198 }
1199
hci_set_adv_set_random_addr_sync(struct hci_dev * hdev,u8 instance,bdaddr_t * random_addr)1200 static int hci_set_adv_set_random_addr_sync(struct hci_dev *hdev, u8 instance,
1201 bdaddr_t *random_addr)
1202 {
1203 struct hci_cp_le_set_adv_set_rand_addr cp;
1204 int err;
1205
1206 if (!instance) {
1207 /* Instance 0x00 doesn't have an adv_info, instead it uses
1208 * hdev->random_addr to track its address so whenever it needs
1209 * to be updated this also set the random address since
1210 * hdev->random_addr is shared with scan state machine.
1211 */
1212 err = hci_set_random_addr_sync(hdev, random_addr);
1213 if (err)
1214 return err;
1215 }
1216
1217 memset(&cp, 0, sizeof(cp));
1218
1219 cp.handle = instance;
1220 bacpy(&cp.bdaddr, random_addr);
1221
1222 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR,
1223 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1224 }
1225
hci_setup_ext_adv_instance_sync(struct hci_dev * hdev,u8 instance)1226 int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance)
1227 {
1228 struct hci_cp_le_set_ext_adv_params cp;
1229 bool connectable;
1230 u32 flags;
1231 bdaddr_t random_addr;
1232 u8 own_addr_type;
1233 int err;
1234 struct adv_info *adv;
1235 bool secondary_adv;
1236
1237 if (instance > 0) {
1238 adv = hci_find_adv_instance(hdev, instance);
1239 if (!adv)
1240 return -EINVAL;
1241 } else {
1242 adv = NULL;
1243 }
1244
1245 /* Updating parameters of an active instance will return a
1246 * Command Disallowed error, so we must first disable the
1247 * instance if it is active.
1248 */
1249 if (adv && !adv->pending) {
1250 err = hci_disable_ext_adv_instance_sync(hdev, instance);
1251 if (err)
1252 return err;
1253 }
1254
1255 flags = hci_adv_instance_flags(hdev, instance);
1256
1257 /* If the "connectable" instance flag was not set, then choose between
1258 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1259 */
1260 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1261 mgmt_get_connectable(hdev);
1262
1263 if (!is_advertising_allowed(hdev, connectable))
1264 return -EPERM;
1265
1266 /* Set require_privacy to true only when non-connectable
1267 * advertising is used. In that case it is fine to use a
1268 * non-resolvable private address.
1269 */
1270 err = hci_get_random_address(hdev, !connectable,
1271 adv_use_rpa(hdev, flags), adv,
1272 &own_addr_type, &random_addr);
1273 if (err < 0)
1274 return err;
1275
1276 memset(&cp, 0, sizeof(cp));
1277
1278 if (adv) {
1279 hci_cpu_to_le24(adv->min_interval, cp.min_interval);
1280 hci_cpu_to_le24(adv->max_interval, cp.max_interval);
1281 cp.tx_power = adv->tx_power;
1282 } else {
1283 hci_cpu_to_le24(hdev->le_adv_min_interval, cp.min_interval);
1284 hci_cpu_to_le24(hdev->le_adv_max_interval, cp.max_interval);
1285 cp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE;
1286 }
1287
1288 secondary_adv = (flags & MGMT_ADV_FLAG_SEC_MASK);
1289
1290 if (connectable) {
1291 if (secondary_adv)
1292 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_CONN_IND);
1293 else
1294 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_IND);
1295 } else if (hci_adv_instance_is_scannable(hdev, instance) ||
1296 (flags & MGMT_ADV_PARAM_SCAN_RSP)) {
1297 if (secondary_adv)
1298 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_SCAN_IND);
1299 else
1300 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_SCAN_IND);
1301 } else {
1302 if (secondary_adv)
1303 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_NON_CONN_IND);
1304 else
1305 cp.evt_properties = cpu_to_le16(LE_LEGACY_NONCONN_IND);
1306 }
1307
1308 /* If Own_Address_Type equals 0x02 or 0x03, the Peer_Address parameter
1309 * contains the peer’s Identity Address and the Peer_Address_Type
1310 * parameter contains the peer’s Identity Type (i.e., 0x00 or 0x01).
1311 * These parameters are used to locate the corresponding local IRK in
1312 * the resolving list; this IRK is used to generate their own address
1313 * used in the advertisement.
1314 */
1315 if (own_addr_type == ADDR_LE_DEV_RANDOM_RESOLVED)
1316 hci_copy_identity_address(hdev, &cp.peer_addr,
1317 &cp.peer_addr_type);
1318
1319 cp.own_addr_type = own_addr_type;
1320 cp.channel_map = hdev->le_adv_channel_map;
1321 cp.handle = instance;
1322
1323 if (flags & MGMT_ADV_FLAG_SEC_2M) {
1324 cp.primary_phy = HCI_ADV_PHY_1M;
1325 cp.secondary_phy = HCI_ADV_PHY_2M;
1326 } else if (flags & MGMT_ADV_FLAG_SEC_CODED) {
1327 cp.primary_phy = HCI_ADV_PHY_CODED;
1328 cp.secondary_phy = HCI_ADV_PHY_CODED;
1329 } else {
1330 /* In all other cases use 1M */
1331 cp.primary_phy = HCI_ADV_PHY_1M;
1332 cp.secondary_phy = HCI_ADV_PHY_1M;
1333 }
1334
1335 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS,
1336 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1337 if (err)
1338 return err;
1339
1340 if ((own_addr_type == ADDR_LE_DEV_RANDOM ||
1341 own_addr_type == ADDR_LE_DEV_RANDOM_RESOLVED) &&
1342 bacmp(&random_addr, BDADDR_ANY)) {
1343 /* Check if random address need to be updated */
1344 if (adv) {
1345 if (!bacmp(&random_addr, &adv->random_addr))
1346 return 0;
1347 } else {
1348 if (!bacmp(&random_addr, &hdev->random_addr))
1349 return 0;
1350 }
1351
1352 return hci_set_adv_set_random_addr_sync(hdev, instance,
1353 &random_addr);
1354 }
1355
1356 return 0;
1357 }
1358
hci_set_ext_scan_rsp_data_sync(struct hci_dev * hdev,u8 instance)1359 static int hci_set_ext_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance)
1360 {
1361 struct {
1362 struct hci_cp_le_set_ext_scan_rsp_data cp;
1363 u8 data[HCI_MAX_EXT_AD_LENGTH];
1364 } pdu;
1365 u8 len;
1366 struct adv_info *adv = NULL;
1367 int err;
1368
1369 memset(&pdu, 0, sizeof(pdu));
1370
1371 if (instance) {
1372 adv = hci_find_adv_instance(hdev, instance);
1373 if (!adv || !adv->scan_rsp_changed)
1374 return 0;
1375 }
1376
1377 len = eir_create_scan_rsp(hdev, instance, pdu.data);
1378
1379 pdu.cp.handle = instance;
1380 pdu.cp.length = len;
1381 pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
1382 pdu.cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG;
1383
1384 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_RSP_DATA,
1385 sizeof(pdu.cp) + len, &pdu.cp,
1386 HCI_CMD_TIMEOUT);
1387 if (err)
1388 return err;
1389
1390 if (adv) {
1391 adv->scan_rsp_changed = false;
1392 } else {
1393 memcpy(hdev->scan_rsp_data, pdu.data, len);
1394 hdev->scan_rsp_data_len = len;
1395 }
1396
1397 return 0;
1398 }
1399
__hci_set_scan_rsp_data_sync(struct hci_dev * hdev,u8 instance)1400 static int __hci_set_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance)
1401 {
1402 struct hci_cp_le_set_scan_rsp_data cp;
1403 u8 len;
1404
1405 memset(&cp, 0, sizeof(cp));
1406
1407 len = eir_create_scan_rsp(hdev, instance, cp.data);
1408
1409 if (hdev->scan_rsp_data_len == len &&
1410 !memcmp(cp.data, hdev->scan_rsp_data, len))
1411 return 0;
1412
1413 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data));
1414 hdev->scan_rsp_data_len = len;
1415
1416 cp.length = len;
1417
1418 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_RSP_DATA,
1419 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1420 }
1421
hci_update_scan_rsp_data_sync(struct hci_dev * hdev,u8 instance)1422 int hci_update_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance)
1423 {
1424 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1425 return 0;
1426
1427 if (ext_adv_capable(hdev))
1428 return hci_set_ext_scan_rsp_data_sync(hdev, instance);
1429
1430 return __hci_set_scan_rsp_data_sync(hdev, instance);
1431 }
1432
hci_enable_ext_advertising_sync(struct hci_dev * hdev,u8 instance)1433 int hci_enable_ext_advertising_sync(struct hci_dev *hdev, u8 instance)
1434 {
1435 struct hci_cp_le_set_ext_adv_enable *cp;
1436 struct hci_cp_ext_adv_set *set;
1437 u8 data[sizeof(*cp) + sizeof(*set) * 1];
1438 struct adv_info *adv;
1439
1440 if (instance > 0) {
1441 adv = hci_find_adv_instance(hdev, instance);
1442 if (!adv)
1443 return -EINVAL;
1444 /* If already enabled there is nothing to do */
1445 if (adv->enabled)
1446 return 0;
1447 } else {
1448 adv = NULL;
1449 }
1450
1451 cp = (void *)data;
1452 set = (void *)cp->data;
1453
1454 memset(cp, 0, sizeof(*cp));
1455
1456 cp->enable = 0x01;
1457 cp->num_of_sets = 0x01;
1458
1459 memset(set, 0, sizeof(*set));
1460
1461 set->handle = instance;
1462
1463 /* Set duration per instance since controller is responsible for
1464 * scheduling it.
1465 */
1466 if (adv && adv->timeout) {
1467 u16 duration = adv->timeout * MSEC_PER_SEC;
1468
1469 /* Time = N * 10 ms */
1470 set->duration = cpu_to_le16(duration / 10);
1471 }
1472
1473 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE,
1474 sizeof(*cp) +
1475 sizeof(*set) * cp->num_of_sets,
1476 data, HCI_CMD_TIMEOUT);
1477 }
1478
hci_start_ext_adv_sync(struct hci_dev * hdev,u8 instance)1479 int hci_start_ext_adv_sync(struct hci_dev *hdev, u8 instance)
1480 {
1481 int err;
1482
1483 err = hci_setup_ext_adv_instance_sync(hdev, instance);
1484 if (err)
1485 return err;
1486
1487 err = hci_set_ext_scan_rsp_data_sync(hdev, instance);
1488 if (err)
1489 return err;
1490
1491 return hci_enable_ext_advertising_sync(hdev, instance);
1492 }
1493
hci_disable_per_advertising_sync(struct hci_dev * hdev,u8 instance)1494 int hci_disable_per_advertising_sync(struct hci_dev *hdev, u8 instance)
1495 {
1496 struct hci_cp_le_set_per_adv_enable cp;
1497 struct adv_info *adv = NULL;
1498
1499 /* If periodic advertising already disabled there is nothing to do. */
1500 adv = hci_find_adv_instance(hdev, instance);
1501 if (!adv || !adv->periodic || !adv->enabled)
1502 return 0;
1503
1504 memset(&cp, 0, sizeof(cp));
1505
1506 cp.enable = 0x00;
1507 cp.handle = instance;
1508
1509 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE,
1510 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1511 }
1512
hci_set_per_adv_params_sync(struct hci_dev * hdev,u8 instance,u16 min_interval,u16 max_interval)1513 static int hci_set_per_adv_params_sync(struct hci_dev *hdev, u8 instance,
1514 u16 min_interval, u16 max_interval)
1515 {
1516 struct hci_cp_le_set_per_adv_params cp;
1517
1518 memset(&cp, 0, sizeof(cp));
1519
1520 if (!min_interval)
1521 min_interval = DISCOV_LE_PER_ADV_INT_MIN;
1522
1523 if (!max_interval)
1524 max_interval = DISCOV_LE_PER_ADV_INT_MAX;
1525
1526 cp.handle = instance;
1527 cp.min_interval = cpu_to_le16(min_interval);
1528 cp.max_interval = cpu_to_le16(max_interval);
1529 cp.periodic_properties = 0x0000;
1530
1531 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS,
1532 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1533 }
1534
hci_set_per_adv_data_sync(struct hci_dev * hdev,u8 instance)1535 static int hci_set_per_adv_data_sync(struct hci_dev *hdev, u8 instance)
1536 {
1537 struct {
1538 struct hci_cp_le_set_per_adv_data cp;
1539 u8 data[HCI_MAX_PER_AD_LENGTH];
1540 } pdu;
1541 u8 len;
1542
1543 memset(&pdu, 0, sizeof(pdu));
1544
1545 if (instance) {
1546 struct adv_info *adv = hci_find_adv_instance(hdev, instance);
1547
1548 if (!adv || !adv->periodic)
1549 return 0;
1550 }
1551
1552 len = eir_create_per_adv_data(hdev, instance, pdu.data);
1553
1554 pdu.cp.length = len;
1555 pdu.cp.handle = instance;
1556 pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
1557
1558 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_DATA,
1559 sizeof(pdu.cp) + len, &pdu,
1560 HCI_CMD_TIMEOUT);
1561 }
1562
hci_enable_per_advertising_sync(struct hci_dev * hdev,u8 instance)1563 static int hci_enable_per_advertising_sync(struct hci_dev *hdev, u8 instance)
1564 {
1565 struct hci_cp_le_set_per_adv_enable cp;
1566 struct adv_info *adv = NULL;
1567
1568 /* If periodic advertising already enabled there is nothing to do. */
1569 adv = hci_find_adv_instance(hdev, instance);
1570 if (adv && adv->periodic && adv->enabled)
1571 return 0;
1572
1573 memset(&cp, 0, sizeof(cp));
1574
1575 cp.enable = 0x01;
1576 cp.handle = instance;
1577
1578 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE,
1579 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1580 }
1581
1582 /* Checks if periodic advertising data contains a Basic Announcement and if it
1583 * does generates a Broadcast ID and add Broadcast Announcement.
1584 */
hci_adv_bcast_annoucement(struct hci_dev * hdev,struct adv_info * adv)1585 static int hci_adv_bcast_annoucement(struct hci_dev *hdev, struct adv_info *adv)
1586 {
1587 u8 bid[3];
1588 u8 ad[4 + 3];
1589
1590 /* Skip if NULL adv as instance 0x00 is used for general purpose
1591 * advertising so it cannot used for the likes of Broadcast Announcement
1592 * as it can be overwritten at any point.
1593 */
1594 if (!adv)
1595 return 0;
1596
1597 /* Check if PA data doesn't contains a Basic Audio Announcement then
1598 * there is nothing to do.
1599 */
1600 if (!eir_get_service_data(adv->per_adv_data, adv->per_adv_data_len,
1601 0x1851, NULL))
1602 return 0;
1603
1604 /* Check if advertising data already has a Broadcast Announcement since
1605 * the process may want to control the Broadcast ID directly and in that
1606 * case the kernel shall no interfere.
1607 */
1608 if (eir_get_service_data(adv->adv_data, adv->adv_data_len, 0x1852,
1609 NULL))
1610 return 0;
1611
1612 /* Generate Broadcast ID */
1613 get_random_bytes(bid, sizeof(bid));
1614 eir_append_service_data(ad, 0, 0x1852, bid, sizeof(bid));
1615 hci_set_adv_instance_data(hdev, adv->instance, sizeof(ad), ad, 0, NULL);
1616
1617 return hci_update_adv_data_sync(hdev, adv->instance);
1618 }
1619
hci_start_per_adv_sync(struct hci_dev * hdev,u8 instance,u8 data_len,u8 * data,u32 flags,u16 min_interval,u16 max_interval,u16 sync_interval)1620 int hci_start_per_adv_sync(struct hci_dev *hdev, u8 instance, u8 data_len,
1621 u8 *data, u32 flags, u16 min_interval,
1622 u16 max_interval, u16 sync_interval)
1623 {
1624 struct adv_info *adv = NULL;
1625 int err;
1626 bool added = false;
1627
1628 hci_disable_per_advertising_sync(hdev, instance);
1629
1630 if (instance) {
1631 adv = hci_find_adv_instance(hdev, instance);
1632 /* Create an instance if that could not be found */
1633 if (!adv) {
1634 adv = hci_add_per_instance(hdev, instance, flags,
1635 data_len, data,
1636 sync_interval,
1637 sync_interval);
1638 if (IS_ERR(adv))
1639 return PTR_ERR(adv);
1640 adv->pending = false;
1641 added = true;
1642 }
1643 }
1644
1645 /* Start advertising */
1646 err = hci_start_ext_adv_sync(hdev, instance);
1647 if (err < 0)
1648 goto fail;
1649
1650 err = hci_adv_bcast_annoucement(hdev, adv);
1651 if (err < 0)
1652 goto fail;
1653
1654 err = hci_set_per_adv_params_sync(hdev, instance, min_interval,
1655 max_interval);
1656 if (err < 0)
1657 goto fail;
1658
1659 err = hci_set_per_adv_data_sync(hdev, instance);
1660 if (err < 0)
1661 goto fail;
1662
1663 err = hci_enable_per_advertising_sync(hdev, instance);
1664 if (err < 0)
1665 goto fail;
1666
1667 return 0;
1668
1669 fail:
1670 if (added)
1671 hci_remove_adv_instance(hdev, instance);
1672
1673 return err;
1674 }
1675
hci_start_adv_sync(struct hci_dev * hdev,u8 instance)1676 static int hci_start_adv_sync(struct hci_dev *hdev, u8 instance)
1677 {
1678 int err;
1679
1680 if (ext_adv_capable(hdev))
1681 return hci_start_ext_adv_sync(hdev, instance);
1682
1683 err = hci_update_adv_data_sync(hdev, instance);
1684 if (err)
1685 return err;
1686
1687 err = hci_update_scan_rsp_data_sync(hdev, instance);
1688 if (err)
1689 return err;
1690
1691 return hci_enable_advertising_sync(hdev);
1692 }
1693
hci_enable_advertising_sync(struct hci_dev * hdev)1694 int hci_enable_advertising_sync(struct hci_dev *hdev)
1695 {
1696 struct adv_info *adv_instance;
1697 struct hci_cp_le_set_adv_param cp;
1698 u8 own_addr_type, enable = 0x01;
1699 bool connectable;
1700 u16 adv_min_interval, adv_max_interval;
1701 u32 flags;
1702 u8 status;
1703
1704 if (ext_adv_capable(hdev))
1705 return hci_enable_ext_advertising_sync(hdev,
1706 hdev->cur_adv_instance);
1707
1708 flags = hci_adv_instance_flags(hdev, hdev->cur_adv_instance);
1709 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance);
1710
1711 /* If the "connectable" instance flag was not set, then choose between
1712 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting.
1713 */
1714 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) ||
1715 mgmt_get_connectable(hdev);
1716
1717 if (!is_advertising_allowed(hdev, connectable))
1718 return -EINVAL;
1719
1720 status = hci_disable_advertising_sync(hdev);
1721 if (status)
1722 return status;
1723
1724 /* Clear the HCI_LE_ADV bit temporarily so that the
1725 * hci_update_random_address knows that it's safe to go ahead
1726 * and write a new random address. The flag will be set back on
1727 * as soon as the SET_ADV_ENABLE HCI command completes.
1728 */
1729 hci_dev_clear_flag(hdev, HCI_LE_ADV);
1730
1731 /* Set require_privacy to true only when non-connectable
1732 * advertising is used. In that case it is fine to use a
1733 * non-resolvable private address.
1734 */
1735 status = hci_update_random_address_sync(hdev, !connectable,
1736 adv_use_rpa(hdev, flags),
1737 &own_addr_type);
1738 if (status)
1739 return status;
1740
1741 memset(&cp, 0, sizeof(cp));
1742
1743 if (adv_instance) {
1744 adv_min_interval = adv_instance->min_interval;
1745 adv_max_interval = adv_instance->max_interval;
1746 } else {
1747 adv_min_interval = hdev->le_adv_min_interval;
1748 adv_max_interval = hdev->le_adv_max_interval;
1749 }
1750
1751 if (connectable) {
1752 cp.type = LE_ADV_IND;
1753 } else {
1754 if (hci_adv_instance_is_scannable(hdev, hdev->cur_adv_instance))
1755 cp.type = LE_ADV_SCAN_IND;
1756 else
1757 cp.type = LE_ADV_NONCONN_IND;
1758
1759 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE) ||
1760 hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) {
1761 adv_min_interval = DISCOV_LE_FAST_ADV_INT_MIN;
1762 adv_max_interval = DISCOV_LE_FAST_ADV_INT_MAX;
1763 }
1764 }
1765
1766 cp.min_interval = cpu_to_le16(adv_min_interval);
1767 cp.max_interval = cpu_to_le16(adv_max_interval);
1768 cp.own_address_type = own_addr_type;
1769 cp.channel_map = hdev->le_adv_channel_map;
1770
1771 status = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_PARAM,
1772 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1773 if (status)
1774 return status;
1775
1776 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE,
1777 sizeof(enable), &enable, HCI_CMD_TIMEOUT);
1778 }
1779
enable_advertising_sync(struct hci_dev * hdev,void * data)1780 static int enable_advertising_sync(struct hci_dev *hdev, void *data)
1781 {
1782 return hci_enable_advertising_sync(hdev);
1783 }
1784
hci_enable_advertising(struct hci_dev * hdev)1785 int hci_enable_advertising(struct hci_dev *hdev)
1786 {
1787 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
1788 list_empty(&hdev->adv_instances))
1789 return 0;
1790
1791 return hci_cmd_sync_queue(hdev, enable_advertising_sync, NULL, NULL);
1792 }
1793
hci_remove_ext_adv_instance_sync(struct hci_dev * hdev,u8 instance,struct sock * sk)1794 int hci_remove_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance,
1795 struct sock *sk)
1796 {
1797 int err;
1798
1799 if (!ext_adv_capable(hdev))
1800 return 0;
1801
1802 err = hci_disable_ext_adv_instance_sync(hdev, instance);
1803 if (err)
1804 return err;
1805
1806 /* If request specifies an instance that doesn't exist, fail */
1807 if (instance > 0 && !hci_find_adv_instance(hdev, instance))
1808 return -EINVAL;
1809
1810 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_REMOVE_ADV_SET,
1811 sizeof(instance), &instance, 0,
1812 HCI_CMD_TIMEOUT, sk);
1813 }
1814
remove_ext_adv_sync(struct hci_dev * hdev,void * data)1815 static int remove_ext_adv_sync(struct hci_dev *hdev, void *data)
1816 {
1817 struct adv_info *adv = data;
1818 u8 instance = 0;
1819
1820 if (adv)
1821 instance = adv->instance;
1822
1823 return hci_remove_ext_adv_instance_sync(hdev, instance, NULL);
1824 }
1825
hci_remove_ext_adv_instance(struct hci_dev * hdev,u8 instance)1826 int hci_remove_ext_adv_instance(struct hci_dev *hdev, u8 instance)
1827 {
1828 struct adv_info *adv = NULL;
1829
1830 if (instance) {
1831 adv = hci_find_adv_instance(hdev, instance);
1832 if (!adv)
1833 return -EINVAL;
1834 }
1835
1836 return hci_cmd_sync_queue(hdev, remove_ext_adv_sync, adv, NULL);
1837 }
1838
hci_le_terminate_big_sync(struct hci_dev * hdev,u8 handle,u8 reason)1839 int hci_le_terminate_big_sync(struct hci_dev *hdev, u8 handle, u8 reason)
1840 {
1841 struct hci_cp_le_term_big cp;
1842
1843 memset(&cp, 0, sizeof(cp));
1844 cp.handle = handle;
1845 cp.reason = reason;
1846
1847 return __hci_cmd_sync_status(hdev, HCI_OP_LE_TERM_BIG,
1848 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1849 }
1850
hci_set_ext_adv_data_sync(struct hci_dev * hdev,u8 instance)1851 static int hci_set_ext_adv_data_sync(struct hci_dev *hdev, u8 instance)
1852 {
1853 struct {
1854 struct hci_cp_le_set_ext_adv_data cp;
1855 u8 data[HCI_MAX_EXT_AD_LENGTH];
1856 } pdu;
1857 u8 len;
1858 struct adv_info *adv = NULL;
1859 int err;
1860
1861 memset(&pdu, 0, sizeof(pdu));
1862
1863 if (instance) {
1864 adv = hci_find_adv_instance(hdev, instance);
1865 if (!adv || !adv->adv_data_changed)
1866 return 0;
1867 }
1868
1869 len = eir_create_adv_data(hdev, instance, pdu.data);
1870
1871 pdu.cp.length = len;
1872 pdu.cp.handle = instance;
1873 pdu.cp.operation = LE_SET_ADV_DATA_OP_COMPLETE;
1874 pdu.cp.frag_pref = LE_SET_ADV_DATA_NO_FRAG;
1875
1876 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_DATA,
1877 sizeof(pdu.cp) + len, &pdu.cp,
1878 HCI_CMD_TIMEOUT);
1879 if (err)
1880 return err;
1881
1882 /* Update data if the command succeed */
1883 if (adv) {
1884 adv->adv_data_changed = false;
1885 } else {
1886 memcpy(hdev->adv_data, pdu.data, len);
1887 hdev->adv_data_len = len;
1888 }
1889
1890 return 0;
1891 }
1892
hci_set_adv_data_sync(struct hci_dev * hdev,u8 instance)1893 static int hci_set_adv_data_sync(struct hci_dev *hdev, u8 instance)
1894 {
1895 struct hci_cp_le_set_adv_data cp;
1896 u8 len;
1897
1898 memset(&cp, 0, sizeof(cp));
1899
1900 len = eir_create_adv_data(hdev, instance, cp.data);
1901
1902 /* There's nothing to do if the data hasn't changed */
1903 if (hdev->adv_data_len == len &&
1904 memcmp(cp.data, hdev->adv_data, len) == 0)
1905 return 0;
1906
1907 memcpy(hdev->adv_data, cp.data, sizeof(cp.data));
1908 hdev->adv_data_len = len;
1909
1910 cp.length = len;
1911
1912 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_DATA,
1913 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
1914 }
1915
hci_update_adv_data_sync(struct hci_dev * hdev,u8 instance)1916 int hci_update_adv_data_sync(struct hci_dev *hdev, u8 instance)
1917 {
1918 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
1919 return 0;
1920
1921 if (ext_adv_capable(hdev))
1922 return hci_set_ext_adv_data_sync(hdev, instance);
1923
1924 return hci_set_adv_data_sync(hdev, instance);
1925 }
1926
hci_schedule_adv_instance_sync(struct hci_dev * hdev,u8 instance,bool force)1927 int hci_schedule_adv_instance_sync(struct hci_dev *hdev, u8 instance,
1928 bool force)
1929 {
1930 struct adv_info *adv = NULL;
1931 u16 timeout;
1932
1933 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) && !ext_adv_capable(hdev))
1934 return -EPERM;
1935
1936 if (hdev->adv_instance_timeout)
1937 return -EBUSY;
1938
1939 adv = hci_find_adv_instance(hdev, instance);
1940 if (!adv)
1941 return -ENOENT;
1942
1943 /* A zero timeout means unlimited advertising. As long as there is
1944 * only one instance, duration should be ignored. We still set a timeout
1945 * in case further instances are being added later on.
1946 *
1947 * If the remaining lifetime of the instance is more than the duration
1948 * then the timeout corresponds to the duration, otherwise it will be
1949 * reduced to the remaining instance lifetime.
1950 */
1951 if (adv->timeout == 0 || adv->duration <= adv->remaining_time)
1952 timeout = adv->duration;
1953 else
1954 timeout = adv->remaining_time;
1955
1956 /* The remaining time is being reduced unless the instance is being
1957 * advertised without time limit.
1958 */
1959 if (adv->timeout)
1960 adv->remaining_time = adv->remaining_time - timeout;
1961
1962 /* Only use work for scheduling instances with legacy advertising */
1963 if (!ext_adv_capable(hdev)) {
1964 hdev->adv_instance_timeout = timeout;
1965 queue_delayed_work(hdev->req_workqueue,
1966 &hdev->adv_instance_expire,
1967 msecs_to_jiffies(timeout * 1000));
1968 }
1969
1970 /* If we're just re-scheduling the same instance again then do not
1971 * execute any HCI commands. This happens when a single instance is
1972 * being advertised.
1973 */
1974 if (!force && hdev->cur_adv_instance == instance &&
1975 hci_dev_test_flag(hdev, HCI_LE_ADV))
1976 return 0;
1977
1978 hdev->cur_adv_instance = instance;
1979
1980 return hci_start_adv_sync(hdev, instance);
1981 }
1982
hci_clear_adv_sets_sync(struct hci_dev * hdev,struct sock * sk)1983 static int hci_clear_adv_sets_sync(struct hci_dev *hdev, struct sock *sk)
1984 {
1985 int err;
1986
1987 if (!ext_adv_capable(hdev))
1988 return 0;
1989
1990 /* Disable instance 0x00 to disable all instances */
1991 err = hci_disable_ext_adv_instance_sync(hdev, 0x00);
1992 if (err)
1993 return err;
1994
1995 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CLEAR_ADV_SETS,
1996 0, NULL, 0, HCI_CMD_TIMEOUT, sk);
1997 }
1998
hci_clear_adv_sync(struct hci_dev * hdev,struct sock * sk,bool force)1999 static int hci_clear_adv_sync(struct hci_dev *hdev, struct sock *sk, bool force)
2000 {
2001 struct adv_info *adv, *n;
2002 int err = 0;
2003
2004 if (ext_adv_capable(hdev))
2005 /* Remove all existing sets */
2006 err = hci_clear_adv_sets_sync(hdev, sk);
2007 if (ext_adv_capable(hdev))
2008 return err;
2009
2010 /* This is safe as long as there is no command send while the lock is
2011 * held.
2012 */
2013 hci_dev_lock(hdev);
2014
2015 /* Cleanup non-ext instances */
2016 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) {
2017 u8 instance = adv->instance;
2018 int err;
2019
2020 if (!(force || adv->timeout))
2021 continue;
2022
2023 err = hci_remove_adv_instance(hdev, instance);
2024 if (!err)
2025 mgmt_advertising_removed(sk, hdev, instance);
2026 }
2027
2028 hci_dev_unlock(hdev);
2029
2030 return 0;
2031 }
2032
hci_remove_adv_sync(struct hci_dev * hdev,u8 instance,struct sock * sk)2033 static int hci_remove_adv_sync(struct hci_dev *hdev, u8 instance,
2034 struct sock *sk)
2035 {
2036 int err = 0;
2037
2038 /* If we use extended advertising, instance has to be removed first. */
2039 if (ext_adv_capable(hdev))
2040 err = hci_remove_ext_adv_instance_sync(hdev, instance, sk);
2041 if (ext_adv_capable(hdev))
2042 return err;
2043
2044 /* This is safe as long as there is no command send while the lock is
2045 * held.
2046 */
2047 hci_dev_lock(hdev);
2048
2049 err = hci_remove_adv_instance(hdev, instance);
2050 if (!err)
2051 mgmt_advertising_removed(sk, hdev, instance);
2052
2053 hci_dev_unlock(hdev);
2054
2055 return err;
2056 }
2057
2058 /* For a single instance:
2059 * - force == true: The instance will be removed even when its remaining
2060 * lifetime is not zero.
2061 * - force == false: the instance will be deactivated but kept stored unless
2062 * the remaining lifetime is zero.
2063 *
2064 * For instance == 0x00:
2065 * - force == true: All instances will be removed regardless of their timeout
2066 * setting.
2067 * - force == false: Only instances that have a timeout will be removed.
2068 */
hci_remove_advertising_sync(struct hci_dev * hdev,struct sock * sk,u8 instance,bool force)2069 int hci_remove_advertising_sync(struct hci_dev *hdev, struct sock *sk,
2070 u8 instance, bool force)
2071 {
2072 struct adv_info *next = NULL;
2073 int err;
2074
2075 /* Cancel any timeout concerning the removed instance(s). */
2076 if (!instance || hdev->cur_adv_instance == instance)
2077 cancel_adv_timeout(hdev);
2078
2079 /* Get the next instance to advertise BEFORE we remove
2080 * the current one. This can be the same instance again
2081 * if there is only one instance.
2082 */
2083 if (hdev->cur_adv_instance == instance)
2084 next = hci_get_next_instance(hdev, instance);
2085
2086 if (!instance) {
2087 err = hci_clear_adv_sync(hdev, sk, force);
2088 if (err)
2089 return err;
2090 } else {
2091 struct adv_info *adv = hci_find_adv_instance(hdev, instance);
2092
2093 if (force || (adv && adv->timeout && !adv->remaining_time)) {
2094 /* Don't advertise a removed instance. */
2095 if (next && next->instance == instance)
2096 next = NULL;
2097
2098 err = hci_remove_adv_sync(hdev, instance, sk);
2099 if (err)
2100 return err;
2101 }
2102 }
2103
2104 if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_ADVERTISING))
2105 return 0;
2106
2107 if (next && !ext_adv_capable(hdev))
2108 hci_schedule_adv_instance_sync(hdev, next->instance, false);
2109
2110 return 0;
2111 }
2112
hci_read_rssi_sync(struct hci_dev * hdev,__le16 handle)2113 int hci_read_rssi_sync(struct hci_dev *hdev, __le16 handle)
2114 {
2115 struct hci_cp_read_rssi cp;
2116
2117 cp.handle = handle;
2118 return __hci_cmd_sync_status(hdev, HCI_OP_READ_RSSI,
2119 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2120 }
2121
hci_read_clock_sync(struct hci_dev * hdev,struct hci_cp_read_clock * cp)2122 int hci_read_clock_sync(struct hci_dev *hdev, struct hci_cp_read_clock *cp)
2123 {
2124 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CLOCK,
2125 sizeof(*cp), cp, HCI_CMD_TIMEOUT);
2126 }
2127
hci_read_tx_power_sync(struct hci_dev * hdev,__le16 handle,u8 type)2128 int hci_read_tx_power_sync(struct hci_dev *hdev, __le16 handle, u8 type)
2129 {
2130 struct hci_cp_read_tx_power cp;
2131
2132 cp.handle = handle;
2133 cp.type = type;
2134 return __hci_cmd_sync_status(hdev, HCI_OP_READ_TX_POWER,
2135 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2136 }
2137
hci_disable_advertising_sync(struct hci_dev * hdev)2138 int hci_disable_advertising_sync(struct hci_dev *hdev)
2139 {
2140 u8 enable = 0x00;
2141 int err = 0;
2142
2143 /* If controller is not advertising we are done. */
2144 if (!hci_dev_test_flag(hdev, HCI_LE_ADV))
2145 return 0;
2146
2147 if (ext_adv_capable(hdev))
2148 err = hci_disable_ext_adv_instance_sync(hdev, 0x00);
2149 if (ext_adv_capable(hdev))
2150 return err;
2151
2152 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE,
2153 sizeof(enable), &enable, HCI_CMD_TIMEOUT);
2154 }
2155
hci_le_set_ext_scan_enable_sync(struct hci_dev * hdev,u8 val,u8 filter_dup)2156 static int hci_le_set_ext_scan_enable_sync(struct hci_dev *hdev, u8 val,
2157 u8 filter_dup)
2158 {
2159 struct hci_cp_le_set_ext_scan_enable cp;
2160
2161 memset(&cp, 0, sizeof(cp));
2162 cp.enable = val;
2163
2164 if (hci_dev_test_flag(hdev, HCI_MESH))
2165 cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
2166 else
2167 cp.filter_dup = filter_dup;
2168
2169 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE,
2170 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2171 }
2172
hci_le_set_scan_enable_sync(struct hci_dev * hdev,u8 val,u8 filter_dup)2173 static int hci_le_set_scan_enable_sync(struct hci_dev *hdev, u8 val,
2174 u8 filter_dup)
2175 {
2176 struct hci_cp_le_set_scan_enable cp;
2177
2178 if (use_ext_scan(hdev))
2179 return hci_le_set_ext_scan_enable_sync(hdev, val, filter_dup);
2180
2181 memset(&cp, 0, sizeof(cp));
2182 cp.enable = val;
2183
2184 if (val && hci_dev_test_flag(hdev, HCI_MESH))
2185 cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
2186 else
2187 cp.filter_dup = filter_dup;
2188
2189 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_ENABLE,
2190 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2191 }
2192
hci_le_set_addr_resolution_enable_sync(struct hci_dev * hdev,u8 val)2193 static int hci_le_set_addr_resolution_enable_sync(struct hci_dev *hdev, u8 val)
2194 {
2195 if (!use_ll_privacy(hdev))
2196 return 0;
2197
2198 /* If controller is not/already resolving we are done. */
2199 if (val == hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
2200 return 0;
2201
2202 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE,
2203 sizeof(val), &val, HCI_CMD_TIMEOUT);
2204 }
2205
hci_scan_disable_sync(struct hci_dev * hdev)2206 static int hci_scan_disable_sync(struct hci_dev *hdev)
2207 {
2208 int err;
2209
2210 /* If controller is not scanning we are done. */
2211 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN))
2212 return 0;
2213
2214 if (hdev->scanning_paused) {
2215 bt_dev_dbg(hdev, "Scanning is paused for suspend");
2216 return 0;
2217 }
2218
2219 err = hci_le_set_scan_enable_sync(hdev, LE_SCAN_DISABLE, 0x00);
2220 if (err) {
2221 bt_dev_err(hdev, "Unable to disable scanning: %d", err);
2222 return err;
2223 }
2224
2225 return err;
2226 }
2227
scan_use_rpa(struct hci_dev * hdev)2228 static bool scan_use_rpa(struct hci_dev *hdev)
2229 {
2230 return hci_dev_test_flag(hdev, HCI_PRIVACY);
2231 }
2232
hci_start_interleave_scan(struct hci_dev * hdev)2233 static void hci_start_interleave_scan(struct hci_dev *hdev)
2234 {
2235 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER;
2236 queue_delayed_work(hdev->req_workqueue,
2237 &hdev->interleave_scan, 0);
2238 }
2239
is_interleave_scanning(struct hci_dev * hdev)2240 static bool is_interleave_scanning(struct hci_dev *hdev)
2241 {
2242 return hdev->interleave_scan_state != INTERLEAVE_SCAN_NONE;
2243 }
2244
cancel_interleave_scan(struct hci_dev * hdev)2245 static void cancel_interleave_scan(struct hci_dev *hdev)
2246 {
2247 bt_dev_dbg(hdev, "cancelling interleave scan");
2248
2249 cancel_delayed_work_sync(&hdev->interleave_scan);
2250
2251 hdev->interleave_scan_state = INTERLEAVE_SCAN_NONE;
2252 }
2253
2254 /* Return true if interleave_scan wasn't started until exiting this function,
2255 * otherwise, return false
2256 */
hci_update_interleaved_scan_sync(struct hci_dev * hdev)2257 static bool hci_update_interleaved_scan_sync(struct hci_dev *hdev)
2258 {
2259 /* Do interleaved scan only if all of the following are true:
2260 * - There is at least one ADV monitor
2261 * - At least one pending LE connection or one device to be scanned for
2262 * - Monitor offloading is not supported
2263 * If so, we should alternate between allowlist scan and one without
2264 * any filters to save power.
2265 */
2266 bool use_interleaving = hci_is_adv_monitoring(hdev) &&
2267 !(list_empty(&hdev->pend_le_conns) &&
2268 list_empty(&hdev->pend_le_reports)) &&
2269 hci_get_adv_monitor_offload_ext(hdev) ==
2270 HCI_ADV_MONITOR_EXT_NONE;
2271 bool is_interleaving = is_interleave_scanning(hdev);
2272
2273 if (use_interleaving && !is_interleaving) {
2274 hci_start_interleave_scan(hdev);
2275 bt_dev_dbg(hdev, "starting interleave scan");
2276 return true;
2277 }
2278
2279 if (!use_interleaving && is_interleaving)
2280 cancel_interleave_scan(hdev);
2281
2282 return false;
2283 }
2284
2285 /* Removes connection to resolve list if needed.*/
hci_le_del_resolve_list_sync(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type)2286 static int hci_le_del_resolve_list_sync(struct hci_dev *hdev,
2287 bdaddr_t *bdaddr, u8 bdaddr_type)
2288 {
2289 struct hci_cp_le_del_from_resolv_list cp;
2290 struct bdaddr_list_with_irk *entry;
2291
2292 if (!use_ll_privacy(hdev))
2293 return 0;
2294
2295 /* Check if the IRK has been programmed */
2296 entry = hci_bdaddr_list_lookup_with_irk(&hdev->le_resolv_list, bdaddr,
2297 bdaddr_type);
2298 if (!entry)
2299 return 0;
2300
2301 cp.bdaddr_type = bdaddr_type;
2302 bacpy(&cp.bdaddr, bdaddr);
2303
2304 return __hci_cmd_sync_status(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST,
2305 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2306 }
2307
hci_le_del_accept_list_sync(struct hci_dev * hdev,bdaddr_t * bdaddr,u8 bdaddr_type)2308 static int hci_le_del_accept_list_sync(struct hci_dev *hdev,
2309 bdaddr_t *bdaddr, u8 bdaddr_type)
2310 {
2311 struct hci_cp_le_del_from_accept_list cp;
2312 int err;
2313
2314 /* Check if device is on accept list before removing it */
2315 if (!hci_bdaddr_list_lookup(&hdev->le_accept_list, bdaddr, bdaddr_type))
2316 return 0;
2317
2318 cp.bdaddr_type = bdaddr_type;
2319 bacpy(&cp.bdaddr, bdaddr);
2320
2321 /* Ignore errors when removing from resolving list as that is likely
2322 * that the device was never added.
2323 */
2324 hci_le_del_resolve_list_sync(hdev, &cp.bdaddr, cp.bdaddr_type);
2325
2326 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST,
2327 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2328 if (err) {
2329 bt_dev_err(hdev, "Unable to remove from allow list: %d", err);
2330 return err;
2331 }
2332
2333 bt_dev_dbg(hdev, "Remove %pMR (0x%x) from allow list", &cp.bdaddr,
2334 cp.bdaddr_type);
2335
2336 return 0;
2337 }
2338
2339 struct conn_params {
2340 bdaddr_t addr;
2341 u8 addr_type;
2342 hci_conn_flags_t flags;
2343 u8 privacy_mode;
2344 };
2345
2346 /* Adds connection to resolve list if needed.
2347 * Setting params to NULL programs local hdev->irk
2348 */
hci_le_add_resolve_list_sync(struct hci_dev * hdev,struct conn_params * params)2349 static int hci_le_add_resolve_list_sync(struct hci_dev *hdev,
2350 struct conn_params *params)
2351 {
2352 struct hci_cp_le_add_to_resolv_list cp;
2353 struct smp_irk *irk;
2354 struct bdaddr_list_with_irk *entry;
2355 struct hci_conn_params *p;
2356
2357 if (!use_ll_privacy(hdev))
2358 return 0;
2359
2360 /* Attempt to program local identity address, type and irk if params is
2361 * NULL.
2362 */
2363 if (!params) {
2364 if (!hci_dev_test_flag(hdev, HCI_PRIVACY))
2365 return 0;
2366
2367 hci_copy_identity_address(hdev, &cp.bdaddr, &cp.bdaddr_type);
2368 memcpy(cp.peer_irk, hdev->irk, 16);
2369 goto done;
2370 }
2371
2372 irk = hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type);
2373 if (!irk)
2374 return 0;
2375
2376 /* Check if the IK has _not_ been programmed yet. */
2377 entry = hci_bdaddr_list_lookup_with_irk(&hdev->le_resolv_list,
2378 ¶ms->addr,
2379 params->addr_type);
2380 if (entry)
2381 return 0;
2382
2383 cp.bdaddr_type = params->addr_type;
2384 bacpy(&cp.bdaddr, ¶ms->addr);
2385 memcpy(cp.peer_irk, irk->val, 16);
2386
2387 /* Default privacy mode is always Network */
2388 params->privacy_mode = HCI_NETWORK_PRIVACY;
2389
2390 rcu_read_lock();
2391 p = hci_pend_le_action_lookup(&hdev->pend_le_conns,
2392 ¶ms->addr, params->addr_type);
2393 if (!p)
2394 p = hci_pend_le_action_lookup(&hdev->pend_le_reports,
2395 ¶ms->addr, params->addr_type);
2396 if (p)
2397 WRITE_ONCE(p->privacy_mode, HCI_NETWORK_PRIVACY);
2398 rcu_read_unlock();
2399
2400 done:
2401 if (hci_dev_test_flag(hdev, HCI_PRIVACY))
2402 memcpy(cp.local_irk, hdev->irk, 16);
2403 else
2404 memset(cp.local_irk, 0, 16);
2405
2406 return __hci_cmd_sync_status(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST,
2407 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2408 }
2409
2410 /* Set Device Privacy Mode. */
hci_le_set_privacy_mode_sync(struct hci_dev * hdev,struct conn_params * params)2411 static int hci_le_set_privacy_mode_sync(struct hci_dev *hdev,
2412 struct conn_params *params)
2413 {
2414 struct hci_cp_le_set_privacy_mode cp;
2415 struct smp_irk *irk;
2416
2417 /* If device privacy mode has already been set there is nothing to do */
2418 if (params->privacy_mode == HCI_DEVICE_PRIVACY)
2419 return 0;
2420
2421 /* Check if HCI_CONN_FLAG_DEVICE_PRIVACY has been set as it also
2422 * indicates that LL Privacy has been enabled and
2423 * HCI_OP_LE_SET_PRIVACY_MODE is supported.
2424 */
2425 if (!(params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY))
2426 return 0;
2427
2428 irk = hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type);
2429 if (!irk)
2430 return 0;
2431
2432 memset(&cp, 0, sizeof(cp));
2433 cp.bdaddr_type = irk->addr_type;
2434 bacpy(&cp.bdaddr, &irk->bdaddr);
2435 cp.mode = HCI_DEVICE_PRIVACY;
2436
2437 /* Note: params->privacy_mode is not updated since it is a copy */
2438
2439 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PRIVACY_MODE,
2440 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2441 }
2442
2443 /* Adds connection to allow list if needed, if the device uses RPA (has IRK)
2444 * this attempts to program the device in the resolving list as well and
2445 * properly set the privacy mode.
2446 */
hci_le_add_accept_list_sync(struct hci_dev * hdev,struct conn_params * params,u8 * num_entries)2447 static int hci_le_add_accept_list_sync(struct hci_dev *hdev,
2448 struct conn_params *params,
2449 u8 *num_entries)
2450 {
2451 struct hci_cp_le_add_to_accept_list cp;
2452 int err;
2453
2454 /* During suspend, only wakeable devices can be in acceptlist */
2455 if (hdev->suspended &&
2456 !(params->flags & HCI_CONN_FLAG_REMOTE_WAKEUP)) {
2457 hci_le_del_accept_list_sync(hdev, ¶ms->addr,
2458 params->addr_type);
2459 return 0;
2460 }
2461
2462 /* Select filter policy to accept all advertising */
2463 if (*num_entries >= hdev->le_accept_list_size)
2464 return -ENOSPC;
2465
2466 /* Accept list can not be used with RPAs */
2467 if (!use_ll_privacy(hdev) &&
2468 hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type))
2469 return -EINVAL;
2470
2471 /* Attempt to program the device in the resolving list first to avoid
2472 * having to rollback in case it fails since the resolving list is
2473 * dynamic it can probably be smaller than the accept list.
2474 */
2475 err = hci_le_add_resolve_list_sync(hdev, params);
2476 if (err) {
2477 bt_dev_err(hdev, "Unable to add to resolve list: %d", err);
2478 return err;
2479 }
2480
2481 /* Set Privacy Mode */
2482 err = hci_le_set_privacy_mode_sync(hdev, params);
2483 if (err) {
2484 bt_dev_err(hdev, "Unable to set privacy mode: %d", err);
2485 return err;
2486 }
2487
2488 /* Check if already in accept list */
2489 if (hci_bdaddr_list_lookup(&hdev->le_accept_list, ¶ms->addr,
2490 params->addr_type))
2491 return 0;
2492
2493 *num_entries += 1;
2494 cp.bdaddr_type = params->addr_type;
2495 bacpy(&cp.bdaddr, ¶ms->addr);
2496
2497 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST,
2498 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2499 if (err) {
2500 bt_dev_err(hdev, "Unable to add to allow list: %d", err);
2501 /* Rollback the device from the resolving list */
2502 hci_le_del_resolve_list_sync(hdev, &cp.bdaddr, cp.bdaddr_type);
2503 return err;
2504 }
2505
2506 bt_dev_dbg(hdev, "Add %pMR (0x%x) to allow list", &cp.bdaddr,
2507 cp.bdaddr_type);
2508
2509 return 0;
2510 }
2511
2512 /* This function disables/pause all advertising instances */
hci_pause_advertising_sync(struct hci_dev * hdev)2513 static int hci_pause_advertising_sync(struct hci_dev *hdev)
2514 {
2515 int err;
2516 int old_state;
2517
2518 /* If already been paused there is nothing to do. */
2519 if (hdev->advertising_paused)
2520 return 0;
2521
2522 bt_dev_dbg(hdev, "Pausing directed advertising");
2523
2524 /* Stop directed advertising */
2525 old_state = hci_dev_test_flag(hdev, HCI_ADVERTISING);
2526 if (old_state) {
2527 /* When discoverable timeout triggers, then just make sure
2528 * the limited discoverable flag is cleared. Even in the case
2529 * of a timeout triggered from general discoverable, it is
2530 * safe to unconditionally clear the flag.
2531 */
2532 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
2533 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
2534 hdev->discov_timeout = 0;
2535 }
2536
2537 bt_dev_dbg(hdev, "Pausing advertising instances");
2538
2539 /* Call to disable any advertisements active on the controller.
2540 * This will succeed even if no advertisements are configured.
2541 */
2542 err = hci_disable_advertising_sync(hdev);
2543 if (err)
2544 return err;
2545
2546 /* If we are using software rotation, pause the loop */
2547 if (!ext_adv_capable(hdev))
2548 cancel_adv_timeout(hdev);
2549
2550 hdev->advertising_paused = true;
2551 hdev->advertising_old_state = old_state;
2552
2553 return 0;
2554 }
2555
2556 /* This function enables all user advertising instances */
hci_resume_advertising_sync(struct hci_dev * hdev)2557 static int hci_resume_advertising_sync(struct hci_dev *hdev)
2558 {
2559 struct adv_info *adv, *tmp;
2560 int err;
2561
2562 /* If advertising has not been paused there is nothing to do. */
2563 if (!hdev->advertising_paused)
2564 return 0;
2565
2566 /* Resume directed advertising */
2567 hdev->advertising_paused = false;
2568 if (hdev->advertising_old_state) {
2569 hci_dev_set_flag(hdev, HCI_ADVERTISING);
2570 hdev->advertising_old_state = 0;
2571 }
2572
2573 bt_dev_dbg(hdev, "Resuming advertising instances");
2574
2575 if (ext_adv_capable(hdev)) {
2576 /* Call for each tracked instance to be re-enabled */
2577 list_for_each_entry_safe(adv, tmp, &hdev->adv_instances, list) {
2578 err = hci_enable_ext_advertising_sync(hdev,
2579 adv->instance);
2580 if (!err)
2581 continue;
2582
2583 /* If the instance cannot be resumed remove it */
2584 hci_remove_ext_adv_instance_sync(hdev, adv->instance,
2585 NULL);
2586 }
2587 } else {
2588 /* Schedule for most recent instance to be restarted and begin
2589 * the software rotation loop
2590 */
2591 err = hci_schedule_adv_instance_sync(hdev,
2592 hdev->cur_adv_instance,
2593 true);
2594 }
2595
2596 hdev->advertising_paused = false;
2597
2598 return err;
2599 }
2600
hci_pause_addr_resolution(struct hci_dev * hdev)2601 static int hci_pause_addr_resolution(struct hci_dev *hdev)
2602 {
2603 int err;
2604
2605 if (!use_ll_privacy(hdev))
2606 return 0;
2607
2608 if (!hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION))
2609 return 0;
2610
2611 /* Cannot disable addr resolution if scanning is enabled or
2612 * when initiating an LE connection.
2613 */
2614 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) ||
2615 hci_lookup_le_connect(hdev)) {
2616 bt_dev_err(hdev, "Command not allowed when scan/LE connect");
2617 return -EPERM;
2618 }
2619
2620 /* Cannot disable addr resolution if advertising is enabled. */
2621 err = hci_pause_advertising_sync(hdev);
2622 if (err) {
2623 bt_dev_err(hdev, "Pause advertising failed: %d", err);
2624 return err;
2625 }
2626
2627 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00);
2628 if (err)
2629 bt_dev_err(hdev, "Unable to disable Address Resolution: %d",
2630 err);
2631
2632 /* Return if address resolution is disabled and RPA is not used. */
2633 if (!err && scan_use_rpa(hdev))
2634 return 0;
2635
2636 hci_resume_advertising_sync(hdev);
2637 return err;
2638 }
2639
hci_read_local_oob_data_sync(struct hci_dev * hdev,bool extended,struct sock * sk)2640 struct sk_buff *hci_read_local_oob_data_sync(struct hci_dev *hdev,
2641 bool extended, struct sock *sk)
2642 {
2643 u16 opcode = extended ? HCI_OP_READ_LOCAL_OOB_EXT_DATA :
2644 HCI_OP_READ_LOCAL_OOB_DATA;
2645
2646 return __hci_cmd_sync_sk(hdev, opcode, 0, NULL, 0, HCI_CMD_TIMEOUT, sk);
2647 }
2648
conn_params_copy(struct list_head * list,size_t * n)2649 static struct conn_params *conn_params_copy(struct list_head *list, size_t *n)
2650 {
2651 struct hci_conn_params *params;
2652 struct conn_params *p;
2653 size_t i;
2654
2655 rcu_read_lock();
2656
2657 i = 0;
2658 list_for_each_entry_rcu(params, list, action)
2659 ++i;
2660 *n = i;
2661
2662 rcu_read_unlock();
2663
2664 p = kvcalloc(*n, sizeof(struct conn_params), GFP_KERNEL);
2665 if (!p)
2666 return NULL;
2667
2668 rcu_read_lock();
2669
2670 i = 0;
2671 list_for_each_entry_rcu(params, list, action) {
2672 /* Racing adds are handled in next scan update */
2673 if (i >= *n)
2674 break;
2675
2676 /* No hdev->lock, but: addr, addr_type are immutable.
2677 * privacy_mode is only written by us or in
2678 * hci_cc_le_set_privacy_mode that we wait for.
2679 * We should be idempotent so MGMT updating flags
2680 * while we are processing is OK.
2681 */
2682 bacpy(&p[i].addr, ¶ms->addr);
2683 p[i].addr_type = params->addr_type;
2684 p[i].flags = READ_ONCE(params->flags);
2685 p[i].privacy_mode = READ_ONCE(params->privacy_mode);
2686 ++i;
2687 }
2688
2689 rcu_read_unlock();
2690
2691 *n = i;
2692 return p;
2693 }
2694
2695 /* Device must not be scanning when updating the accept list.
2696 *
2697 * Update is done using the following sequence:
2698 *
2699 * use_ll_privacy((Disable Advertising) -> Disable Resolving List) ->
2700 * Remove Devices From Accept List ->
2701 * (has IRK && use_ll_privacy(Remove Devices From Resolving List))->
2702 * Add Devices to Accept List ->
2703 * (has IRK && use_ll_privacy(Remove Devices From Resolving List)) ->
2704 * use_ll_privacy(Enable Resolving List -> (Enable Advertising)) ->
2705 * Enable Scanning
2706 *
2707 * In case of failure advertising shall be restored to its original state and
2708 * return would disable accept list since either accept or resolving list could
2709 * not be programmed.
2710 *
2711 */
hci_update_accept_list_sync(struct hci_dev * hdev)2712 static u8 hci_update_accept_list_sync(struct hci_dev *hdev)
2713 {
2714 struct conn_params *params;
2715 struct bdaddr_list *b, *t;
2716 u8 num_entries = 0;
2717 bool pend_conn, pend_report;
2718 u8 filter_policy;
2719 size_t i, n;
2720 int err;
2721
2722 /* Pause advertising if resolving list can be used as controllers
2723 * cannot accept resolving list modifications while advertising.
2724 */
2725 if (use_ll_privacy(hdev)) {
2726 err = hci_pause_advertising_sync(hdev);
2727 if (err) {
2728 bt_dev_err(hdev, "pause advertising failed: %d", err);
2729 return 0x00;
2730 }
2731 }
2732
2733 /* Disable address resolution while reprogramming accept list since
2734 * devices that do have an IRK will be programmed in the resolving list
2735 * when LL Privacy is enabled.
2736 */
2737 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00);
2738 if (err) {
2739 bt_dev_err(hdev, "Unable to disable LL privacy: %d", err);
2740 goto done;
2741 }
2742
2743 /* Go through the current accept list programmed into the
2744 * controller one by one and check if that address is connected or is
2745 * still in the list of pending connections or list of devices to
2746 * report. If not present in either list, then remove it from
2747 * the controller.
2748 */
2749 list_for_each_entry_safe(b, t, &hdev->le_accept_list, list) {
2750 if (hci_conn_hash_lookup_le(hdev, &b->bdaddr, b->bdaddr_type))
2751 continue;
2752
2753 /* Pointers not dereferenced, no locks needed */
2754 pend_conn = hci_pend_le_action_lookup(&hdev->pend_le_conns,
2755 &b->bdaddr,
2756 b->bdaddr_type);
2757 pend_report = hci_pend_le_action_lookup(&hdev->pend_le_reports,
2758 &b->bdaddr,
2759 b->bdaddr_type);
2760
2761 /* If the device is not likely to connect or report,
2762 * remove it from the acceptlist.
2763 */
2764 if (!pend_conn && !pend_report) {
2765 hci_le_del_accept_list_sync(hdev, &b->bdaddr,
2766 b->bdaddr_type);
2767 continue;
2768 }
2769
2770 num_entries++;
2771 }
2772
2773 /* Since all no longer valid accept list entries have been
2774 * removed, walk through the list of pending connections
2775 * and ensure that any new device gets programmed into
2776 * the controller.
2777 *
2778 * If the list of the devices is larger than the list of
2779 * available accept list entries in the controller, then
2780 * just abort and return filer policy value to not use the
2781 * accept list.
2782 *
2783 * The list and params may be mutated while we wait for events,
2784 * so make a copy and iterate it.
2785 */
2786
2787 params = conn_params_copy(&hdev->pend_le_conns, &n);
2788 if (!params) {
2789 err = -ENOMEM;
2790 goto done;
2791 }
2792
2793 for (i = 0; i < n; ++i) {
2794 err = hci_le_add_accept_list_sync(hdev, ¶ms[i],
2795 &num_entries);
2796 if (err) {
2797 kvfree(params);
2798 goto done;
2799 }
2800 }
2801
2802 kvfree(params);
2803
2804 /* After adding all new pending connections, walk through
2805 * the list of pending reports and also add these to the
2806 * accept list if there is still space. Abort if space runs out.
2807 */
2808
2809 params = conn_params_copy(&hdev->pend_le_reports, &n);
2810 if (!params) {
2811 err = -ENOMEM;
2812 goto done;
2813 }
2814
2815 for (i = 0; i < n; ++i) {
2816 err = hci_le_add_accept_list_sync(hdev, ¶ms[i],
2817 &num_entries);
2818 if (err) {
2819 kvfree(params);
2820 goto done;
2821 }
2822 }
2823
2824 kvfree(params);
2825
2826 /* Use the allowlist unless the following conditions are all true:
2827 * - We are not currently suspending
2828 * - There are 1 or more ADV monitors registered and it's not offloaded
2829 * - Interleaved scanning is not currently using the allowlist
2830 */
2831 if (!idr_is_empty(&hdev->adv_monitors_idr) && !hdev->suspended &&
2832 hci_get_adv_monitor_offload_ext(hdev) == HCI_ADV_MONITOR_EXT_NONE &&
2833 hdev->interleave_scan_state != INTERLEAVE_SCAN_ALLOWLIST)
2834 err = -EINVAL;
2835
2836 done:
2837 filter_policy = err ? 0x00 : 0x01;
2838
2839 /* Enable address resolution when LL Privacy is enabled. */
2840 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x01);
2841 if (err)
2842 bt_dev_err(hdev, "Unable to enable LL privacy: %d", err);
2843
2844 /* Resume advertising if it was paused */
2845 if (use_ll_privacy(hdev))
2846 hci_resume_advertising_sync(hdev);
2847
2848 /* Select filter policy to use accept list */
2849 return filter_policy;
2850 }
2851
hci_le_scan_phy_params(struct hci_cp_le_scan_phy_params * cp,u8 type,u16 interval,u16 window)2852 static void hci_le_scan_phy_params(struct hci_cp_le_scan_phy_params *cp,
2853 u8 type, u16 interval, u16 window)
2854 {
2855 cp->type = type;
2856 cp->interval = cpu_to_le16(interval);
2857 cp->window = cpu_to_le16(window);
2858 }
2859
hci_le_set_ext_scan_param_sync(struct hci_dev * hdev,u8 type,u16 interval,u16 window,u8 own_addr_type,u8 filter_policy)2860 static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type,
2861 u16 interval, u16 window,
2862 u8 own_addr_type, u8 filter_policy)
2863 {
2864 struct hci_cp_le_set_ext_scan_params *cp;
2865 struct hci_cp_le_scan_phy_params *phy;
2866 u8 data[sizeof(*cp) + sizeof(*phy) * 2];
2867 u8 num_phy = 0x00;
2868
2869 cp = (void *)data;
2870 phy = (void *)cp->data;
2871
2872 memset(data, 0, sizeof(data));
2873
2874 cp->own_addr_type = own_addr_type;
2875 cp->filter_policy = filter_policy;
2876
2877 /* Check if PA Sync is in progress then select the PHY based on the
2878 * hci_conn.iso_qos.
2879 */
2880 if (hci_dev_test_flag(hdev, HCI_PA_SYNC)) {
2881 struct hci_cp_le_add_to_accept_list *sent;
2882
2883 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST);
2884 if (sent) {
2885 struct hci_conn *conn;
2886
2887 conn = hci_conn_hash_lookup_ba(hdev, ISO_LINK,
2888 &sent->bdaddr);
2889 if (conn) {
2890 struct bt_iso_qos *qos = &conn->iso_qos;
2891
2892 if (qos->bcast.in.phy & BT_ISO_PHY_1M ||
2893 qos->bcast.in.phy & BT_ISO_PHY_2M) {
2894 cp->scanning_phys |= LE_SCAN_PHY_1M;
2895 hci_le_scan_phy_params(phy, type,
2896 interval,
2897 window);
2898 num_phy++;
2899 phy++;
2900 }
2901
2902 if (qos->bcast.in.phy & BT_ISO_PHY_CODED) {
2903 cp->scanning_phys |= LE_SCAN_PHY_CODED;
2904 hci_le_scan_phy_params(phy, type,
2905 interval * 3,
2906 window * 3);
2907 num_phy++;
2908 phy++;
2909 }
2910
2911 if (num_phy)
2912 goto done;
2913 }
2914 }
2915 }
2916
2917 if (scan_1m(hdev) || scan_2m(hdev)) {
2918 cp->scanning_phys |= LE_SCAN_PHY_1M;
2919 hci_le_scan_phy_params(phy, type, interval, window);
2920 num_phy++;
2921 phy++;
2922 }
2923
2924 if (scan_coded(hdev)) {
2925 cp->scanning_phys |= LE_SCAN_PHY_CODED;
2926 hci_le_scan_phy_params(phy, type, interval * 3, window * 3);
2927 num_phy++;
2928 phy++;
2929 }
2930
2931 done:
2932 if (!num_phy)
2933 return -EINVAL;
2934
2935 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS,
2936 sizeof(*cp) + sizeof(*phy) * num_phy,
2937 data, HCI_CMD_TIMEOUT);
2938 }
2939
hci_le_set_scan_param_sync(struct hci_dev * hdev,u8 type,u16 interval,u16 window,u8 own_addr_type,u8 filter_policy)2940 static int hci_le_set_scan_param_sync(struct hci_dev *hdev, u8 type,
2941 u16 interval, u16 window,
2942 u8 own_addr_type, u8 filter_policy)
2943 {
2944 struct hci_cp_le_set_scan_param cp;
2945
2946 if (use_ext_scan(hdev))
2947 return hci_le_set_ext_scan_param_sync(hdev, type, interval,
2948 window, own_addr_type,
2949 filter_policy);
2950
2951 memset(&cp, 0, sizeof(cp));
2952 cp.type = type;
2953 cp.interval = cpu_to_le16(interval);
2954 cp.window = cpu_to_le16(window);
2955 cp.own_address_type = own_addr_type;
2956 cp.filter_policy = filter_policy;
2957
2958 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_PARAM,
2959 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
2960 }
2961
hci_start_scan_sync(struct hci_dev * hdev,u8 type,u16 interval,u16 window,u8 own_addr_type,u8 filter_policy,u8 filter_dup)2962 static int hci_start_scan_sync(struct hci_dev *hdev, u8 type, u16 interval,
2963 u16 window, u8 own_addr_type, u8 filter_policy,
2964 u8 filter_dup)
2965 {
2966 int err;
2967
2968 if (hdev->scanning_paused) {
2969 bt_dev_dbg(hdev, "Scanning is paused for suspend");
2970 return 0;
2971 }
2972
2973 err = hci_le_set_scan_param_sync(hdev, type, interval, window,
2974 own_addr_type, filter_policy);
2975 if (err)
2976 return err;
2977
2978 return hci_le_set_scan_enable_sync(hdev, LE_SCAN_ENABLE, filter_dup);
2979 }
2980
hci_passive_scan_sync(struct hci_dev * hdev)2981 static int hci_passive_scan_sync(struct hci_dev *hdev)
2982 {
2983 u8 own_addr_type;
2984 u8 filter_policy;
2985 u16 window, interval;
2986 u8 filter_dups = LE_SCAN_FILTER_DUP_ENABLE;
2987 int err;
2988
2989 if (hdev->scanning_paused) {
2990 bt_dev_dbg(hdev, "Scanning is paused for suspend");
2991 return 0;
2992 }
2993
2994 err = hci_scan_disable_sync(hdev);
2995 if (err) {
2996 bt_dev_err(hdev, "disable scanning failed: %d", err);
2997 return err;
2998 }
2999
3000 /* Set require_privacy to false since no SCAN_REQ are send
3001 * during passive scanning. Not using an non-resolvable address
3002 * here is important so that peer devices using direct
3003 * advertising with our address will be correctly reported
3004 * by the controller.
3005 */
3006 if (hci_update_random_address_sync(hdev, false, scan_use_rpa(hdev),
3007 &own_addr_type))
3008 return 0;
3009
3010 if (hdev->enable_advmon_interleave_scan &&
3011 hci_update_interleaved_scan_sync(hdev))
3012 return 0;
3013
3014 bt_dev_dbg(hdev, "interleave state %d", hdev->interleave_scan_state);
3015
3016 /* Adding or removing entries from the accept list must
3017 * happen before enabling scanning. The controller does
3018 * not allow accept list modification while scanning.
3019 */
3020 filter_policy = hci_update_accept_list_sync(hdev);
3021
3022 /* If suspended and filter_policy set to 0x00 (no acceptlist) then
3023 * passive scanning cannot be started since that would require the host
3024 * to be woken up to process the reports.
3025 */
3026 if (hdev->suspended && !filter_policy) {
3027 /* Check if accept list is empty then there is no need to scan
3028 * while suspended.
3029 */
3030 if (list_empty(&hdev->le_accept_list))
3031 return 0;
3032
3033 /* If there are devices is the accept_list that means some
3034 * devices could not be programmed which in non-suspended case
3035 * means filter_policy needs to be set to 0x00 so the host needs
3036 * to filter, but since this is treating suspended case we
3037 * can ignore device needing host to filter to allow devices in
3038 * the acceptlist to be able to wakeup the system.
3039 */
3040 filter_policy = 0x01;
3041 }
3042
3043 /* When the controller is using random resolvable addresses and
3044 * with that having LE privacy enabled, then controllers with
3045 * Extended Scanner Filter Policies support can now enable support
3046 * for handling directed advertising.
3047 *
3048 * So instead of using filter polices 0x00 (no acceptlist)
3049 * and 0x01 (acceptlist enabled) use the new filter policies
3050 * 0x02 (no acceptlist) and 0x03 (acceptlist enabled).
3051 */
3052 if (hci_dev_test_flag(hdev, HCI_PRIVACY) &&
3053 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY))
3054 filter_policy |= 0x02;
3055
3056 if (hdev->suspended) {
3057 window = hdev->le_scan_window_suspend;
3058 interval = hdev->le_scan_int_suspend;
3059 } else if (hci_is_le_conn_scanning(hdev)) {
3060 window = hdev->le_scan_window_connect;
3061 interval = hdev->le_scan_int_connect;
3062 } else if (hci_is_adv_monitoring(hdev)) {
3063 window = hdev->le_scan_window_adv_monitor;
3064 interval = hdev->le_scan_int_adv_monitor;
3065
3066 /* Disable duplicates filter when scanning for advertisement
3067 * monitor for the following reasons.
3068 *
3069 * For HW pattern filtering (ex. MSFT), Realtek and Qualcomm
3070 * controllers ignore RSSI_Sampling_Period when the duplicates
3071 * filter is enabled.
3072 *
3073 * For SW pattern filtering, when we're not doing interleaved
3074 * scanning, it is necessary to disable duplicates filter,
3075 * otherwise hosts can only receive one advertisement and it's
3076 * impossible to know if a peer is still in range.
3077 */
3078 filter_dups = LE_SCAN_FILTER_DUP_DISABLE;
3079 } else {
3080 window = hdev->le_scan_window;
3081 interval = hdev->le_scan_interval;
3082 }
3083
3084 /* Disable all filtering for Mesh */
3085 if (hci_dev_test_flag(hdev, HCI_MESH)) {
3086 filter_policy = 0;
3087 filter_dups = LE_SCAN_FILTER_DUP_DISABLE;
3088 }
3089
3090 bt_dev_dbg(hdev, "LE passive scan with acceptlist = %d", filter_policy);
3091
3092 return hci_start_scan_sync(hdev, LE_SCAN_PASSIVE, interval, window,
3093 own_addr_type, filter_policy, filter_dups);
3094 }
3095
3096 /* This function controls the passive scanning based on hdev->pend_le_conns
3097 * list. If there are pending LE connection we start the background scanning,
3098 * otherwise we stop it in the following sequence:
3099 *
3100 * If there are devices to scan:
3101 *
3102 * Disable Scanning -> Update Accept List ->
3103 * use_ll_privacy((Disable Advertising) -> Disable Resolving List ->
3104 * Update Resolving List -> Enable Resolving List -> (Enable Advertising)) ->
3105 * Enable Scanning
3106 *
3107 * Otherwise:
3108 *
3109 * Disable Scanning
3110 */
hci_update_passive_scan_sync(struct hci_dev * hdev)3111 int hci_update_passive_scan_sync(struct hci_dev *hdev)
3112 {
3113 int err;
3114
3115 if (!test_bit(HCI_UP, &hdev->flags) ||
3116 test_bit(HCI_INIT, &hdev->flags) ||
3117 hci_dev_test_flag(hdev, HCI_SETUP) ||
3118 hci_dev_test_flag(hdev, HCI_CONFIG) ||
3119 hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
3120 hci_dev_test_flag(hdev, HCI_UNREGISTER))
3121 return 0;
3122
3123 /* No point in doing scanning if LE support hasn't been enabled */
3124 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
3125 return 0;
3126
3127 /* If discovery is active don't interfere with it */
3128 if (hdev->discovery.state != DISCOVERY_STOPPED)
3129 return 0;
3130
3131 /* Reset RSSI and UUID filters when starting background scanning
3132 * since these filters are meant for service discovery only.
3133 *
3134 * The Start Discovery and Start Service Discovery operations
3135 * ensure to set proper values for RSSI threshold and UUID
3136 * filter list. So it is safe to just reset them here.
3137 */
3138 hci_discovery_filter_clear(hdev);
3139
3140 bt_dev_dbg(hdev, "ADV monitoring is %s",
3141 hci_is_adv_monitoring(hdev) ? "on" : "off");
3142
3143 if (!hci_dev_test_flag(hdev, HCI_MESH) &&
3144 list_empty(&hdev->pend_le_conns) &&
3145 list_empty(&hdev->pend_le_reports) &&
3146 !hci_is_adv_monitoring(hdev) &&
3147 !hci_dev_test_flag(hdev, HCI_PA_SYNC)) {
3148 /* If there is no pending LE connections or devices
3149 * to be scanned for or no ADV monitors, we should stop the
3150 * background scanning.
3151 */
3152
3153 bt_dev_dbg(hdev, "stopping background scanning");
3154
3155 err = hci_scan_disable_sync(hdev);
3156 if (err)
3157 bt_dev_err(hdev, "stop background scanning failed: %d",
3158 err);
3159 } else {
3160 /* If there is at least one pending LE connection, we should
3161 * keep the background scan running.
3162 */
3163
3164 /* If controller is connecting, we should not start scanning
3165 * since some controllers are not able to scan and connect at
3166 * the same time.
3167 */
3168 if (hci_lookup_le_connect(hdev))
3169 return 0;
3170
3171 bt_dev_dbg(hdev, "start background scanning");
3172
3173 err = hci_passive_scan_sync(hdev);
3174 if (err)
3175 bt_dev_err(hdev, "start background scanning failed: %d",
3176 err);
3177 }
3178
3179 return err;
3180 }
3181
update_scan_sync(struct hci_dev * hdev,void * data)3182 static int update_scan_sync(struct hci_dev *hdev, void *data)
3183 {
3184 return hci_update_scan_sync(hdev);
3185 }
3186
hci_update_scan(struct hci_dev * hdev)3187 int hci_update_scan(struct hci_dev *hdev)
3188 {
3189 return hci_cmd_sync_queue(hdev, update_scan_sync, NULL, NULL);
3190 }
3191
update_passive_scan_sync(struct hci_dev * hdev,void * data)3192 static int update_passive_scan_sync(struct hci_dev *hdev, void *data)
3193 {
3194 return hci_update_passive_scan_sync(hdev);
3195 }
3196
hci_update_passive_scan(struct hci_dev * hdev)3197 int hci_update_passive_scan(struct hci_dev *hdev)
3198 {
3199 /* Only queue if it would have any effect */
3200 if (!test_bit(HCI_UP, &hdev->flags) ||
3201 test_bit(HCI_INIT, &hdev->flags) ||
3202 hci_dev_test_flag(hdev, HCI_SETUP) ||
3203 hci_dev_test_flag(hdev, HCI_CONFIG) ||
3204 hci_dev_test_flag(hdev, HCI_AUTO_OFF) ||
3205 hci_dev_test_flag(hdev, HCI_UNREGISTER))
3206 return 0;
3207
3208 return hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL,
3209 NULL);
3210 }
3211
hci_write_sc_support_sync(struct hci_dev * hdev,u8 val)3212 int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val)
3213 {
3214 int err;
3215
3216 if (!bredr_sc_enabled(hdev) || lmp_host_sc_capable(hdev))
3217 return 0;
3218
3219 err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SC_SUPPORT,
3220 sizeof(val), &val, HCI_CMD_TIMEOUT);
3221
3222 if (!err) {
3223 if (val) {
3224 hdev->features[1][0] |= LMP_HOST_SC;
3225 hci_dev_set_flag(hdev, HCI_SC_ENABLED);
3226 } else {
3227 hdev->features[1][0] &= ~LMP_HOST_SC;
3228 hci_dev_clear_flag(hdev, HCI_SC_ENABLED);
3229 }
3230 }
3231
3232 return err;
3233 }
3234
hci_write_ssp_mode_sync(struct hci_dev * hdev,u8 mode)3235 int hci_write_ssp_mode_sync(struct hci_dev *hdev, u8 mode)
3236 {
3237 int err;
3238
3239 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED) ||
3240 lmp_host_ssp_capable(hdev))
3241 return 0;
3242
3243 if (!mode && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) {
3244 __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE,
3245 sizeof(mode), &mode, HCI_CMD_TIMEOUT);
3246 }
3247
3248 err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_MODE,
3249 sizeof(mode), &mode, HCI_CMD_TIMEOUT);
3250 if (err)
3251 return err;
3252
3253 return hci_write_sc_support_sync(hdev, 0x01);
3254 }
3255
hci_write_le_host_supported_sync(struct hci_dev * hdev,u8 le,u8 simul)3256 int hci_write_le_host_supported_sync(struct hci_dev *hdev, u8 le, u8 simul)
3257 {
3258 struct hci_cp_write_le_host_supported cp;
3259
3260 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) ||
3261 !lmp_bredr_capable(hdev))
3262 return 0;
3263
3264 /* Check first if we already have the right host state
3265 * (host features set)
3266 */
3267 if (le == lmp_host_le_capable(hdev) &&
3268 simul == lmp_host_le_br_capable(hdev))
3269 return 0;
3270
3271 memset(&cp, 0, sizeof(cp));
3272
3273 cp.le = le;
3274 cp.simul = simul;
3275
3276 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
3277 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
3278 }
3279
hci_powered_update_adv_sync(struct hci_dev * hdev)3280 static int hci_powered_update_adv_sync(struct hci_dev *hdev)
3281 {
3282 struct adv_info *adv, *tmp;
3283 int err;
3284
3285 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED))
3286 return 0;
3287
3288 /* If RPA Resolution has not been enable yet it means the
3289 * resolving list is empty and we should attempt to program the
3290 * local IRK in order to support using own_addr_type
3291 * ADDR_LE_DEV_RANDOM_RESOLVED (0x03).
3292 */
3293 if (!hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) {
3294 hci_le_add_resolve_list_sync(hdev, NULL);
3295 hci_le_set_addr_resolution_enable_sync(hdev, 0x01);
3296 }
3297
3298 /* Make sure the controller has a good default for
3299 * advertising data. This also applies to the case
3300 * where BR/EDR was toggled during the AUTO_OFF phase.
3301 */
3302 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
3303 list_empty(&hdev->adv_instances)) {
3304 if (ext_adv_capable(hdev)) {
3305 err = hci_setup_ext_adv_instance_sync(hdev, 0x00);
3306 if (!err)
3307 hci_update_scan_rsp_data_sync(hdev, 0x00);
3308 } else {
3309 err = hci_update_adv_data_sync(hdev, 0x00);
3310 if (!err)
3311 hci_update_scan_rsp_data_sync(hdev, 0x00);
3312 }
3313
3314 if (hci_dev_test_flag(hdev, HCI_ADVERTISING))
3315 hci_enable_advertising_sync(hdev);
3316 }
3317
3318 /* Call for each tracked instance to be scheduled */
3319 list_for_each_entry_safe(adv, tmp, &hdev->adv_instances, list)
3320 hci_schedule_adv_instance_sync(hdev, adv->instance, true);
3321
3322 return 0;
3323 }
3324
hci_write_auth_enable_sync(struct hci_dev * hdev)3325 static int hci_write_auth_enable_sync(struct hci_dev *hdev)
3326 {
3327 u8 link_sec;
3328
3329 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY);
3330 if (link_sec == test_bit(HCI_AUTH, &hdev->flags))
3331 return 0;
3332
3333 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_AUTH_ENABLE,
3334 sizeof(link_sec), &link_sec,
3335 HCI_CMD_TIMEOUT);
3336 }
3337
hci_write_fast_connectable_sync(struct hci_dev * hdev,bool enable)3338 int hci_write_fast_connectable_sync(struct hci_dev *hdev, bool enable)
3339 {
3340 struct hci_cp_write_page_scan_activity cp;
3341 u8 type;
3342 int err = 0;
3343
3344 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
3345 return 0;
3346
3347 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
3348 return 0;
3349
3350 memset(&cp, 0, sizeof(cp));
3351
3352 if (enable) {
3353 type = PAGE_SCAN_TYPE_INTERLACED;
3354
3355 /* 160 msec page scan interval */
3356 cp.interval = cpu_to_le16(0x0100);
3357 } else {
3358 type = hdev->def_page_scan_type;
3359 cp.interval = cpu_to_le16(hdev->def_page_scan_int);
3360 }
3361
3362 cp.window = cpu_to_le16(hdev->def_page_scan_window);
3363
3364 if (__cpu_to_le16(hdev->page_scan_interval) != cp.interval ||
3365 __cpu_to_le16(hdev->page_scan_window) != cp.window) {
3366 err = __hci_cmd_sync_status(hdev,
3367 HCI_OP_WRITE_PAGE_SCAN_ACTIVITY,
3368 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
3369 if (err)
3370 return err;
3371 }
3372
3373 if (hdev->page_scan_type != type)
3374 err = __hci_cmd_sync_status(hdev,
3375 HCI_OP_WRITE_PAGE_SCAN_TYPE,
3376 sizeof(type), &type,
3377 HCI_CMD_TIMEOUT);
3378
3379 return err;
3380 }
3381
disconnected_accept_list_entries(struct hci_dev * hdev)3382 static bool disconnected_accept_list_entries(struct hci_dev *hdev)
3383 {
3384 struct bdaddr_list *b;
3385
3386 list_for_each_entry(b, &hdev->accept_list, list) {
3387 struct hci_conn *conn;
3388
3389 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr);
3390 if (!conn)
3391 return true;
3392
3393 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG)
3394 return true;
3395 }
3396
3397 return false;
3398 }
3399
hci_write_scan_enable_sync(struct hci_dev * hdev,u8 val)3400 static int hci_write_scan_enable_sync(struct hci_dev *hdev, u8 val)
3401 {
3402 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SCAN_ENABLE,
3403 sizeof(val), &val,
3404 HCI_CMD_TIMEOUT);
3405 }
3406
hci_update_scan_sync(struct hci_dev * hdev)3407 int hci_update_scan_sync(struct hci_dev *hdev)
3408 {
3409 u8 scan;
3410
3411 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
3412 return 0;
3413
3414 if (!hdev_is_powered(hdev))
3415 return 0;
3416
3417 if (mgmt_powering_down(hdev))
3418 return 0;
3419
3420 if (hdev->scanning_paused)
3421 return 0;
3422
3423 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) ||
3424 disconnected_accept_list_entries(hdev))
3425 scan = SCAN_PAGE;
3426 else
3427 scan = SCAN_DISABLED;
3428
3429 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
3430 scan |= SCAN_INQUIRY;
3431
3432 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE) &&
3433 test_bit(HCI_ISCAN, &hdev->flags) == !!(scan & SCAN_INQUIRY))
3434 return 0;
3435
3436 return hci_write_scan_enable_sync(hdev, scan);
3437 }
3438
hci_update_name_sync(struct hci_dev * hdev)3439 int hci_update_name_sync(struct hci_dev *hdev)
3440 {
3441 struct hci_cp_write_local_name cp;
3442
3443 memset(&cp, 0, sizeof(cp));
3444
3445 memcpy(cp.name, hdev->dev_name, sizeof(cp.name));
3446
3447 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LOCAL_NAME,
3448 sizeof(cp), &cp,
3449 HCI_CMD_TIMEOUT);
3450 }
3451
3452 /* This function perform powered update HCI command sequence after the HCI init
3453 * sequence which end up resetting all states, the sequence is as follows:
3454 *
3455 * HCI_SSP_ENABLED(Enable SSP)
3456 * HCI_LE_ENABLED(Enable LE)
3457 * HCI_LE_ENABLED(use_ll_privacy(Add local IRK to Resolving List) ->
3458 * Update adv data)
3459 * Enable Authentication
3460 * lmp_bredr_capable(Set Fast Connectable -> Set Scan Type -> Set Class ->
3461 * Set Name -> Set EIR)
3462 * HCI_FORCE_STATIC_ADDR | BDADDR_ANY && !HCI_BREDR_ENABLED (Set Static Address)
3463 */
hci_powered_update_sync(struct hci_dev * hdev)3464 int hci_powered_update_sync(struct hci_dev *hdev)
3465 {
3466 int err;
3467
3468 /* Register the available SMP channels (BR/EDR and LE) only when
3469 * successfully powering on the controller. This late
3470 * registration is required so that LE SMP can clearly decide if
3471 * the public address or static address is used.
3472 */
3473 smp_register(hdev);
3474
3475 err = hci_write_ssp_mode_sync(hdev, 0x01);
3476 if (err)
3477 return err;
3478
3479 err = hci_write_le_host_supported_sync(hdev, 0x01, 0x00);
3480 if (err)
3481 return err;
3482
3483 err = hci_powered_update_adv_sync(hdev);
3484 if (err)
3485 return err;
3486
3487 err = hci_write_auth_enable_sync(hdev);
3488 if (err)
3489 return err;
3490
3491 if (lmp_bredr_capable(hdev)) {
3492 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE))
3493 hci_write_fast_connectable_sync(hdev, true);
3494 else
3495 hci_write_fast_connectable_sync(hdev, false);
3496 hci_update_scan_sync(hdev);
3497 hci_update_class_sync(hdev);
3498 hci_update_name_sync(hdev);
3499 hci_update_eir_sync(hdev);
3500 }
3501
3502 /* If forcing static address is in use or there is no public
3503 * address use the static address as random address (but skip
3504 * the HCI command if the current random address is already the
3505 * static one.
3506 *
3507 * In case BR/EDR has been disabled on a dual-mode controller
3508 * and a static address has been configured, then use that
3509 * address instead of the public BR/EDR address.
3510 */
3511 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) ||
3512 (!bacmp(&hdev->bdaddr, BDADDR_ANY) &&
3513 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))) {
3514 if (bacmp(&hdev->static_addr, BDADDR_ANY))
3515 return hci_set_random_addr_sync(hdev,
3516 &hdev->static_addr);
3517 }
3518
3519 return 0;
3520 }
3521
3522 /**
3523 * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address
3524 * (BD_ADDR) for a HCI device from
3525 * a firmware node property.
3526 * @hdev: The HCI device
3527 *
3528 * Search the firmware node for 'local-bd-address'.
3529 *
3530 * All-zero BD addresses are rejected, because those could be properties
3531 * that exist in the firmware tables, but were not updated by the firmware. For
3532 * example, the DTS could define 'local-bd-address', with zero BD addresses.
3533 */
hci_dev_get_bd_addr_from_property(struct hci_dev * hdev)3534 static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev)
3535 {
3536 struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent);
3537 bdaddr_t ba;
3538 int ret;
3539
3540 ret = fwnode_property_read_u8_array(fwnode, "local-bd-address",
3541 (u8 *)&ba, sizeof(ba));
3542 if (ret < 0 || !bacmp(&ba, BDADDR_ANY))
3543 return;
3544
3545 if (test_bit(HCI_QUIRK_BDADDR_PROPERTY_BROKEN, &hdev->quirks))
3546 baswap(&hdev->public_addr, &ba);
3547 else
3548 bacpy(&hdev->public_addr, &ba);
3549 }
3550
3551 struct hci_init_stage {
3552 int (*func)(struct hci_dev *hdev);
3553 };
3554
3555 /* Run init stage NULL terminated function table */
hci_init_stage_sync(struct hci_dev * hdev,const struct hci_init_stage * stage)3556 static int hci_init_stage_sync(struct hci_dev *hdev,
3557 const struct hci_init_stage *stage)
3558 {
3559 size_t i;
3560
3561 for (i = 0; stage[i].func; i++) {
3562 int err;
3563
3564 err = stage[i].func(hdev);
3565 if (err)
3566 return err;
3567 }
3568
3569 return 0;
3570 }
3571
3572 /* Read Local Version */
hci_read_local_version_sync(struct hci_dev * hdev)3573 static int hci_read_local_version_sync(struct hci_dev *hdev)
3574 {
3575 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_VERSION,
3576 0, NULL, HCI_CMD_TIMEOUT);
3577 }
3578
3579 /* Read BD Address */
hci_read_bd_addr_sync(struct hci_dev * hdev)3580 static int hci_read_bd_addr_sync(struct hci_dev *hdev)
3581 {
3582 return __hci_cmd_sync_status(hdev, HCI_OP_READ_BD_ADDR,
3583 0, NULL, HCI_CMD_TIMEOUT);
3584 }
3585
3586 #define HCI_INIT(_func) \
3587 { \
3588 .func = _func, \
3589 }
3590
3591 static const struct hci_init_stage hci_init0[] = {
3592 /* HCI_OP_READ_LOCAL_VERSION */
3593 HCI_INIT(hci_read_local_version_sync),
3594 /* HCI_OP_READ_BD_ADDR */
3595 HCI_INIT(hci_read_bd_addr_sync),
3596 {}
3597 };
3598
hci_reset_sync(struct hci_dev * hdev)3599 int hci_reset_sync(struct hci_dev *hdev)
3600 {
3601 int err;
3602
3603 set_bit(HCI_RESET, &hdev->flags);
3604
3605 err = __hci_cmd_sync_status(hdev, HCI_OP_RESET, 0, NULL,
3606 HCI_CMD_TIMEOUT);
3607 if (err)
3608 return err;
3609
3610 return 0;
3611 }
3612
hci_init0_sync(struct hci_dev * hdev)3613 static int hci_init0_sync(struct hci_dev *hdev)
3614 {
3615 int err;
3616
3617 bt_dev_dbg(hdev, "");
3618
3619 /* Reset */
3620 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
3621 err = hci_reset_sync(hdev);
3622 if (err)
3623 return err;
3624 }
3625
3626 return hci_init_stage_sync(hdev, hci_init0);
3627 }
3628
hci_unconf_init_sync(struct hci_dev * hdev)3629 static int hci_unconf_init_sync(struct hci_dev *hdev)
3630 {
3631 int err;
3632
3633 if (test_bit(HCI_QUIRK_RAW_DEVICE, &hdev->quirks))
3634 return 0;
3635
3636 err = hci_init0_sync(hdev);
3637 if (err < 0)
3638 return err;
3639
3640 if (hci_dev_test_flag(hdev, HCI_SETUP))
3641 hci_debugfs_create_basic(hdev);
3642
3643 return 0;
3644 }
3645
3646 /* Read Local Supported Features. */
hci_read_local_features_sync(struct hci_dev * hdev)3647 static int hci_read_local_features_sync(struct hci_dev *hdev)
3648 {
3649 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_FEATURES,
3650 0, NULL, HCI_CMD_TIMEOUT);
3651 }
3652
3653 /* BR Controller init stage 1 command sequence */
3654 static const struct hci_init_stage br_init1[] = {
3655 /* HCI_OP_READ_LOCAL_FEATURES */
3656 HCI_INIT(hci_read_local_features_sync),
3657 /* HCI_OP_READ_LOCAL_VERSION */
3658 HCI_INIT(hci_read_local_version_sync),
3659 /* HCI_OP_READ_BD_ADDR */
3660 HCI_INIT(hci_read_bd_addr_sync),
3661 {}
3662 };
3663
3664 /* Read Local Commands */
hci_read_local_cmds_sync(struct hci_dev * hdev)3665 static int hci_read_local_cmds_sync(struct hci_dev *hdev)
3666 {
3667 /* All Bluetooth 1.2 and later controllers should support the
3668 * HCI command for reading the local supported commands.
3669 *
3670 * Unfortunately some controllers indicate Bluetooth 1.2 support,
3671 * but do not have support for this command. If that is the case,
3672 * the driver can quirk the behavior and skip reading the local
3673 * supported commands.
3674 */
3675 if (hdev->hci_ver > BLUETOOTH_VER_1_1 &&
3676 !test_bit(HCI_QUIRK_BROKEN_LOCAL_COMMANDS, &hdev->quirks))
3677 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_COMMANDS,
3678 0, NULL, HCI_CMD_TIMEOUT);
3679
3680 return 0;
3681 }
3682
hci_init1_sync(struct hci_dev * hdev)3683 static int hci_init1_sync(struct hci_dev *hdev)
3684 {
3685 int err;
3686
3687 bt_dev_dbg(hdev, "");
3688
3689 /* Reset */
3690 if (!test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks)) {
3691 err = hci_reset_sync(hdev);
3692 if (err)
3693 return err;
3694 }
3695
3696 return hci_init_stage_sync(hdev, br_init1);
3697 }
3698
3699 /* Read Buffer Size (ACL mtu, max pkt, etc.) */
hci_read_buffer_size_sync(struct hci_dev * hdev)3700 static int hci_read_buffer_size_sync(struct hci_dev *hdev)
3701 {
3702 return __hci_cmd_sync_status(hdev, HCI_OP_READ_BUFFER_SIZE,
3703 0, NULL, HCI_CMD_TIMEOUT);
3704 }
3705
3706 /* Read Class of Device */
hci_read_dev_class_sync(struct hci_dev * hdev)3707 static int hci_read_dev_class_sync(struct hci_dev *hdev)
3708 {
3709 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CLASS_OF_DEV,
3710 0, NULL, HCI_CMD_TIMEOUT);
3711 }
3712
3713 /* Read Local Name */
hci_read_local_name_sync(struct hci_dev * hdev)3714 static int hci_read_local_name_sync(struct hci_dev *hdev)
3715 {
3716 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_NAME,
3717 0, NULL, HCI_CMD_TIMEOUT);
3718 }
3719
3720 /* Read Voice Setting */
hci_read_voice_setting_sync(struct hci_dev * hdev)3721 static int hci_read_voice_setting_sync(struct hci_dev *hdev)
3722 {
3723 return __hci_cmd_sync_status(hdev, HCI_OP_READ_VOICE_SETTING,
3724 0, NULL, HCI_CMD_TIMEOUT);
3725 }
3726
3727 /* Read Number of Supported IAC */
hci_read_num_supported_iac_sync(struct hci_dev * hdev)3728 static int hci_read_num_supported_iac_sync(struct hci_dev *hdev)
3729 {
3730 return __hci_cmd_sync_status(hdev, HCI_OP_READ_NUM_SUPPORTED_IAC,
3731 0, NULL, HCI_CMD_TIMEOUT);
3732 }
3733
3734 /* Read Current IAC LAP */
hci_read_current_iac_lap_sync(struct hci_dev * hdev)3735 static int hci_read_current_iac_lap_sync(struct hci_dev *hdev)
3736 {
3737 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CURRENT_IAC_LAP,
3738 0, NULL, HCI_CMD_TIMEOUT);
3739 }
3740
hci_set_event_filter_sync(struct hci_dev * hdev,u8 flt_type,u8 cond_type,bdaddr_t * bdaddr,u8 auto_accept)3741 static int hci_set_event_filter_sync(struct hci_dev *hdev, u8 flt_type,
3742 u8 cond_type, bdaddr_t *bdaddr,
3743 u8 auto_accept)
3744 {
3745 struct hci_cp_set_event_filter cp;
3746
3747 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
3748 return 0;
3749
3750 if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks))
3751 return 0;
3752
3753 memset(&cp, 0, sizeof(cp));
3754 cp.flt_type = flt_type;
3755
3756 if (flt_type != HCI_FLT_CLEAR_ALL) {
3757 cp.cond_type = cond_type;
3758 bacpy(&cp.addr_conn_flt.bdaddr, bdaddr);
3759 cp.addr_conn_flt.auto_accept = auto_accept;
3760 }
3761
3762 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_FLT,
3763 flt_type == HCI_FLT_CLEAR_ALL ?
3764 sizeof(cp.flt_type) : sizeof(cp), &cp,
3765 HCI_CMD_TIMEOUT);
3766 }
3767
hci_clear_event_filter_sync(struct hci_dev * hdev)3768 static int hci_clear_event_filter_sync(struct hci_dev *hdev)
3769 {
3770 if (!hci_dev_test_flag(hdev, HCI_EVENT_FILTER_CONFIGURED))
3771 return 0;
3772
3773 /* In theory the state machine should not reach here unless
3774 * a hci_set_event_filter_sync() call succeeds, but we do
3775 * the check both for parity and as a future reminder.
3776 */
3777 if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks))
3778 return 0;
3779
3780 return hci_set_event_filter_sync(hdev, HCI_FLT_CLEAR_ALL, 0x00,
3781 BDADDR_ANY, 0x00);
3782 }
3783
3784 /* Connection accept timeout ~20 secs */
hci_write_ca_timeout_sync(struct hci_dev * hdev)3785 static int hci_write_ca_timeout_sync(struct hci_dev *hdev)
3786 {
3787 __le16 param = cpu_to_le16(0x7d00);
3788
3789 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CA_TIMEOUT,
3790 sizeof(param), ¶m, HCI_CMD_TIMEOUT);
3791 }
3792
3793 /* BR Controller init stage 2 command sequence */
3794 static const struct hci_init_stage br_init2[] = {
3795 /* HCI_OP_READ_BUFFER_SIZE */
3796 HCI_INIT(hci_read_buffer_size_sync),
3797 /* HCI_OP_READ_CLASS_OF_DEV */
3798 HCI_INIT(hci_read_dev_class_sync),
3799 /* HCI_OP_READ_LOCAL_NAME */
3800 HCI_INIT(hci_read_local_name_sync),
3801 /* HCI_OP_READ_VOICE_SETTING */
3802 HCI_INIT(hci_read_voice_setting_sync),
3803 /* HCI_OP_READ_NUM_SUPPORTED_IAC */
3804 HCI_INIT(hci_read_num_supported_iac_sync),
3805 /* HCI_OP_READ_CURRENT_IAC_LAP */
3806 HCI_INIT(hci_read_current_iac_lap_sync),
3807 /* HCI_OP_SET_EVENT_FLT */
3808 HCI_INIT(hci_clear_event_filter_sync),
3809 /* HCI_OP_WRITE_CA_TIMEOUT */
3810 HCI_INIT(hci_write_ca_timeout_sync),
3811 {}
3812 };
3813
hci_write_ssp_mode_1_sync(struct hci_dev * hdev)3814 static int hci_write_ssp_mode_1_sync(struct hci_dev *hdev)
3815 {
3816 u8 mode = 0x01;
3817
3818 if (!lmp_ssp_capable(hdev) || !hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
3819 return 0;
3820
3821 /* When SSP is available, then the host features page
3822 * should also be available as well. However some
3823 * controllers list the max_page as 0 as long as SSP
3824 * has not been enabled. To achieve proper debugging
3825 * output, force the minimum max_page to 1 at least.
3826 */
3827 hdev->max_page = 0x01;
3828
3829 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_MODE,
3830 sizeof(mode), &mode, HCI_CMD_TIMEOUT);
3831 }
3832
hci_write_eir_sync(struct hci_dev * hdev)3833 static int hci_write_eir_sync(struct hci_dev *hdev)
3834 {
3835 struct hci_cp_write_eir cp;
3836
3837 if (!lmp_ssp_capable(hdev) || hci_dev_test_flag(hdev, HCI_SSP_ENABLED))
3838 return 0;
3839
3840 memset(hdev->eir, 0, sizeof(hdev->eir));
3841 memset(&cp, 0, sizeof(cp));
3842
3843 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp,
3844 HCI_CMD_TIMEOUT);
3845 }
3846
hci_write_inquiry_mode_sync(struct hci_dev * hdev)3847 static int hci_write_inquiry_mode_sync(struct hci_dev *hdev)
3848 {
3849 u8 mode;
3850
3851 if (!lmp_inq_rssi_capable(hdev) &&
3852 !test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
3853 return 0;
3854
3855 /* If Extended Inquiry Result events are supported, then
3856 * they are clearly preferred over Inquiry Result with RSSI
3857 * events.
3858 */
3859 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01;
3860
3861 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_INQUIRY_MODE,
3862 sizeof(mode), &mode, HCI_CMD_TIMEOUT);
3863 }
3864
hci_read_inq_rsp_tx_power_sync(struct hci_dev * hdev)3865 static int hci_read_inq_rsp_tx_power_sync(struct hci_dev *hdev)
3866 {
3867 if (!lmp_inq_tx_pwr_capable(hdev))
3868 return 0;
3869
3870 return __hci_cmd_sync_status(hdev, HCI_OP_READ_INQ_RSP_TX_POWER,
3871 0, NULL, HCI_CMD_TIMEOUT);
3872 }
3873
hci_read_local_ext_features_sync(struct hci_dev * hdev,u8 page)3874 static int hci_read_local_ext_features_sync(struct hci_dev *hdev, u8 page)
3875 {
3876 struct hci_cp_read_local_ext_features cp;
3877
3878 if (!lmp_ext_feat_capable(hdev))
3879 return 0;
3880
3881 memset(&cp, 0, sizeof(cp));
3882 cp.page = page;
3883
3884 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES,
3885 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
3886 }
3887
hci_read_local_ext_features_1_sync(struct hci_dev * hdev)3888 static int hci_read_local_ext_features_1_sync(struct hci_dev *hdev)
3889 {
3890 return hci_read_local_ext_features_sync(hdev, 0x01);
3891 }
3892
3893 /* HCI Controller init stage 2 command sequence */
3894 static const struct hci_init_stage hci_init2[] = {
3895 /* HCI_OP_READ_LOCAL_COMMANDS */
3896 HCI_INIT(hci_read_local_cmds_sync),
3897 /* HCI_OP_WRITE_SSP_MODE */
3898 HCI_INIT(hci_write_ssp_mode_1_sync),
3899 /* HCI_OP_WRITE_EIR */
3900 HCI_INIT(hci_write_eir_sync),
3901 /* HCI_OP_WRITE_INQUIRY_MODE */
3902 HCI_INIT(hci_write_inquiry_mode_sync),
3903 /* HCI_OP_READ_INQ_RSP_TX_POWER */
3904 HCI_INIT(hci_read_inq_rsp_tx_power_sync),
3905 /* HCI_OP_READ_LOCAL_EXT_FEATURES */
3906 HCI_INIT(hci_read_local_ext_features_1_sync),
3907 /* HCI_OP_WRITE_AUTH_ENABLE */
3908 HCI_INIT(hci_write_auth_enable_sync),
3909 {}
3910 };
3911
3912 /* Read LE Buffer Size */
hci_le_read_buffer_size_sync(struct hci_dev * hdev)3913 static int hci_le_read_buffer_size_sync(struct hci_dev *hdev)
3914 {
3915 /* Use Read LE Buffer Size V2 if supported */
3916 if (iso_capable(hdev) && hdev->commands[41] & 0x20)
3917 return __hci_cmd_sync_status(hdev,
3918 HCI_OP_LE_READ_BUFFER_SIZE_V2,
3919 0, NULL, HCI_CMD_TIMEOUT);
3920
3921 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_BUFFER_SIZE,
3922 0, NULL, HCI_CMD_TIMEOUT);
3923 }
3924
3925 /* Read LE Local Supported Features */
hci_le_read_local_features_sync(struct hci_dev * hdev)3926 static int hci_le_read_local_features_sync(struct hci_dev *hdev)
3927 {
3928 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_LOCAL_FEATURES,
3929 0, NULL, HCI_CMD_TIMEOUT);
3930 }
3931
3932 /* Read LE Supported States */
hci_le_read_supported_states_sync(struct hci_dev * hdev)3933 static int hci_le_read_supported_states_sync(struct hci_dev *hdev)
3934 {
3935 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_SUPPORTED_STATES,
3936 0, NULL, HCI_CMD_TIMEOUT);
3937 }
3938
3939 /* LE Controller init stage 2 command sequence */
3940 static const struct hci_init_stage le_init2[] = {
3941 /* HCI_OP_LE_READ_LOCAL_FEATURES */
3942 HCI_INIT(hci_le_read_local_features_sync),
3943 /* HCI_OP_LE_READ_BUFFER_SIZE */
3944 HCI_INIT(hci_le_read_buffer_size_sync),
3945 /* HCI_OP_LE_READ_SUPPORTED_STATES */
3946 HCI_INIT(hci_le_read_supported_states_sync),
3947 {}
3948 };
3949
hci_init2_sync(struct hci_dev * hdev)3950 static int hci_init2_sync(struct hci_dev *hdev)
3951 {
3952 int err;
3953
3954 bt_dev_dbg(hdev, "");
3955
3956 err = hci_init_stage_sync(hdev, hci_init2);
3957 if (err)
3958 return err;
3959
3960 if (lmp_bredr_capable(hdev)) {
3961 err = hci_init_stage_sync(hdev, br_init2);
3962 if (err)
3963 return err;
3964 } else {
3965 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED);
3966 }
3967
3968 if (lmp_le_capable(hdev)) {
3969 err = hci_init_stage_sync(hdev, le_init2);
3970 if (err)
3971 return err;
3972 /* LE-only controllers have LE implicitly enabled */
3973 if (!lmp_bredr_capable(hdev))
3974 hci_dev_set_flag(hdev, HCI_LE_ENABLED);
3975 }
3976
3977 return 0;
3978 }
3979
hci_set_event_mask_sync(struct hci_dev * hdev)3980 static int hci_set_event_mask_sync(struct hci_dev *hdev)
3981 {
3982 /* The second byte is 0xff instead of 0x9f (two reserved bits
3983 * disabled) since a Broadcom 1.2 dongle doesn't respond to the
3984 * command otherwise.
3985 */
3986 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 };
3987
3988 /* CSR 1.1 dongles does not accept any bitfield so don't try to set
3989 * any event mask for pre 1.2 devices.
3990 */
3991 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
3992 return 0;
3993
3994 if (lmp_bredr_capable(hdev)) {
3995 events[4] |= 0x01; /* Flow Specification Complete */
3996
3997 /* Don't set Disconnect Complete and mode change when
3998 * suspended as that would wakeup the host when disconnecting
3999 * due to suspend.
4000 */
4001 if (hdev->suspended) {
4002 events[0] &= 0xef;
4003 events[2] &= 0xf7;
4004 }
4005 } else {
4006 /* Use a different default for LE-only devices */
4007 memset(events, 0, sizeof(events));
4008 events[1] |= 0x20; /* Command Complete */
4009 events[1] |= 0x40; /* Command Status */
4010 events[1] |= 0x80; /* Hardware Error */
4011
4012 /* If the controller supports the Disconnect command, enable
4013 * the corresponding event. In addition enable packet flow
4014 * control related events.
4015 */
4016 if (hdev->commands[0] & 0x20) {
4017 /* Don't set Disconnect Complete when suspended as that
4018 * would wakeup the host when disconnecting due to
4019 * suspend.
4020 */
4021 if (!hdev->suspended)
4022 events[0] |= 0x10; /* Disconnection Complete */
4023 events[2] |= 0x04; /* Number of Completed Packets */
4024 events[3] |= 0x02; /* Data Buffer Overflow */
4025 }
4026
4027 /* If the controller supports the Read Remote Version
4028 * Information command, enable the corresponding event.
4029 */
4030 if (hdev->commands[2] & 0x80)
4031 events[1] |= 0x08; /* Read Remote Version Information
4032 * Complete
4033 */
4034
4035 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) {
4036 events[0] |= 0x80; /* Encryption Change */
4037 events[5] |= 0x80; /* Encryption Key Refresh Complete */
4038 }
4039 }
4040
4041 if (lmp_inq_rssi_capable(hdev) ||
4042 test_bit(HCI_QUIRK_FIXUP_INQUIRY_MODE, &hdev->quirks))
4043 events[4] |= 0x02; /* Inquiry Result with RSSI */
4044
4045 if (lmp_ext_feat_capable(hdev))
4046 events[4] |= 0x04; /* Read Remote Extended Features Complete */
4047
4048 if (lmp_esco_capable(hdev)) {
4049 events[5] |= 0x08; /* Synchronous Connection Complete */
4050 events[5] |= 0x10; /* Synchronous Connection Changed */
4051 }
4052
4053 if (lmp_sniffsubr_capable(hdev))
4054 events[5] |= 0x20; /* Sniff Subrating */
4055
4056 if (lmp_pause_enc_capable(hdev))
4057 events[5] |= 0x80; /* Encryption Key Refresh Complete */
4058
4059 if (lmp_ext_inq_capable(hdev))
4060 events[5] |= 0x40; /* Extended Inquiry Result */
4061
4062 if (lmp_no_flush_capable(hdev))
4063 events[7] |= 0x01; /* Enhanced Flush Complete */
4064
4065 if (lmp_lsto_capable(hdev))
4066 events[6] |= 0x80; /* Link Supervision Timeout Changed */
4067
4068 if (lmp_ssp_capable(hdev)) {
4069 events[6] |= 0x01; /* IO Capability Request */
4070 events[6] |= 0x02; /* IO Capability Response */
4071 events[6] |= 0x04; /* User Confirmation Request */
4072 events[6] |= 0x08; /* User Passkey Request */
4073 events[6] |= 0x10; /* Remote OOB Data Request */
4074 events[6] |= 0x20; /* Simple Pairing Complete */
4075 events[7] |= 0x04; /* User Passkey Notification */
4076 events[7] |= 0x08; /* Keypress Notification */
4077 events[7] |= 0x10; /* Remote Host Supported
4078 * Features Notification
4079 */
4080 }
4081
4082 if (lmp_le_capable(hdev))
4083 events[7] |= 0x20; /* LE Meta-Event */
4084
4085 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_MASK,
4086 sizeof(events), events, HCI_CMD_TIMEOUT);
4087 }
4088
hci_read_stored_link_key_sync(struct hci_dev * hdev)4089 static int hci_read_stored_link_key_sync(struct hci_dev *hdev)
4090 {
4091 struct hci_cp_read_stored_link_key cp;
4092
4093 if (!(hdev->commands[6] & 0x20) ||
4094 test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks))
4095 return 0;
4096
4097 memset(&cp, 0, sizeof(cp));
4098 bacpy(&cp.bdaddr, BDADDR_ANY);
4099 cp.read_all = 0x01;
4100
4101 return __hci_cmd_sync_status(hdev, HCI_OP_READ_STORED_LINK_KEY,
4102 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4103 }
4104
hci_setup_link_policy_sync(struct hci_dev * hdev)4105 static int hci_setup_link_policy_sync(struct hci_dev *hdev)
4106 {
4107 struct hci_cp_write_def_link_policy cp;
4108 u16 link_policy = 0;
4109
4110 if (!(hdev->commands[5] & 0x10))
4111 return 0;
4112
4113 memset(&cp, 0, sizeof(cp));
4114
4115 if (lmp_rswitch_capable(hdev))
4116 link_policy |= HCI_LP_RSWITCH;
4117 if (lmp_hold_capable(hdev))
4118 link_policy |= HCI_LP_HOLD;
4119 if (lmp_sniff_capable(hdev))
4120 link_policy |= HCI_LP_SNIFF;
4121 if (lmp_park_capable(hdev))
4122 link_policy |= HCI_LP_PARK;
4123
4124 cp.policy = cpu_to_le16(link_policy);
4125
4126 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_LINK_POLICY,
4127 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4128 }
4129
hci_read_page_scan_activity_sync(struct hci_dev * hdev)4130 static int hci_read_page_scan_activity_sync(struct hci_dev *hdev)
4131 {
4132 if (!(hdev->commands[8] & 0x01))
4133 return 0;
4134
4135 return __hci_cmd_sync_status(hdev, HCI_OP_READ_PAGE_SCAN_ACTIVITY,
4136 0, NULL, HCI_CMD_TIMEOUT);
4137 }
4138
hci_read_def_err_data_reporting_sync(struct hci_dev * hdev)4139 static int hci_read_def_err_data_reporting_sync(struct hci_dev *hdev)
4140 {
4141 if (!(hdev->commands[18] & 0x04) ||
4142 !(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) ||
4143 test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
4144 return 0;
4145
4146 return __hci_cmd_sync_status(hdev, HCI_OP_READ_DEF_ERR_DATA_REPORTING,
4147 0, NULL, HCI_CMD_TIMEOUT);
4148 }
4149
hci_read_page_scan_type_sync(struct hci_dev * hdev)4150 static int hci_read_page_scan_type_sync(struct hci_dev *hdev)
4151 {
4152 /* Some older Broadcom based Bluetooth 1.2 controllers do not
4153 * support the Read Page Scan Type command. Check support for
4154 * this command in the bit mask of supported commands.
4155 */
4156 if (!(hdev->commands[13] & 0x01))
4157 return 0;
4158
4159 return __hci_cmd_sync_status(hdev, HCI_OP_READ_PAGE_SCAN_TYPE,
4160 0, NULL, HCI_CMD_TIMEOUT);
4161 }
4162
4163 /* Read features beyond page 1 if available */
hci_read_local_ext_features_all_sync(struct hci_dev * hdev)4164 static int hci_read_local_ext_features_all_sync(struct hci_dev *hdev)
4165 {
4166 u8 page;
4167 int err;
4168
4169 if (!lmp_ext_feat_capable(hdev))
4170 return 0;
4171
4172 for (page = 2; page < HCI_MAX_PAGES && page <= hdev->max_page;
4173 page++) {
4174 err = hci_read_local_ext_features_sync(hdev, page);
4175 if (err)
4176 return err;
4177 }
4178
4179 return 0;
4180 }
4181
4182 /* HCI Controller init stage 3 command sequence */
4183 static const struct hci_init_stage hci_init3[] = {
4184 /* HCI_OP_SET_EVENT_MASK */
4185 HCI_INIT(hci_set_event_mask_sync),
4186 /* HCI_OP_READ_STORED_LINK_KEY */
4187 HCI_INIT(hci_read_stored_link_key_sync),
4188 /* HCI_OP_WRITE_DEF_LINK_POLICY */
4189 HCI_INIT(hci_setup_link_policy_sync),
4190 /* HCI_OP_READ_PAGE_SCAN_ACTIVITY */
4191 HCI_INIT(hci_read_page_scan_activity_sync),
4192 /* HCI_OP_READ_DEF_ERR_DATA_REPORTING */
4193 HCI_INIT(hci_read_def_err_data_reporting_sync),
4194 /* HCI_OP_READ_PAGE_SCAN_TYPE */
4195 HCI_INIT(hci_read_page_scan_type_sync),
4196 /* HCI_OP_READ_LOCAL_EXT_FEATURES */
4197 HCI_INIT(hci_read_local_ext_features_all_sync),
4198 {}
4199 };
4200
hci_le_set_event_mask_sync(struct hci_dev * hdev)4201 static int hci_le_set_event_mask_sync(struct hci_dev *hdev)
4202 {
4203 u8 events[8];
4204
4205 if (!lmp_le_capable(hdev))
4206 return 0;
4207
4208 memset(events, 0, sizeof(events));
4209
4210 if (hdev->le_features[0] & HCI_LE_ENCRYPTION)
4211 events[0] |= 0x10; /* LE Long Term Key Request */
4212
4213 /* If controller supports the Connection Parameters Request
4214 * Link Layer Procedure, enable the corresponding event.
4215 */
4216 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC)
4217 /* LE Remote Connection Parameter Request */
4218 events[0] |= 0x20;
4219
4220 /* If the controller supports the Data Length Extension
4221 * feature, enable the corresponding event.
4222 */
4223 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)
4224 events[0] |= 0x40; /* LE Data Length Change */
4225
4226 /* If the controller supports LL Privacy feature or LE Extended Adv,
4227 * enable the corresponding event.
4228 */
4229 if (use_enhanced_conn_complete(hdev))
4230 events[1] |= 0x02; /* LE Enhanced Connection Complete */
4231
4232 /* If the controller supports Extended Scanner Filter
4233 * Policies, enable the corresponding event.
4234 */
4235 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)
4236 events[1] |= 0x04; /* LE Direct Advertising Report */
4237
4238 /* If the controller supports Channel Selection Algorithm #2
4239 * feature, enable the corresponding event.
4240 */
4241 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2)
4242 events[2] |= 0x08; /* LE Channel Selection Algorithm */
4243
4244 /* If the controller supports the LE Set Scan Enable command,
4245 * enable the corresponding advertising report event.
4246 */
4247 if (hdev->commands[26] & 0x08)
4248 events[0] |= 0x02; /* LE Advertising Report */
4249
4250 /* If the controller supports the LE Create Connection
4251 * command, enable the corresponding event.
4252 */
4253 if (hdev->commands[26] & 0x10)
4254 events[0] |= 0x01; /* LE Connection Complete */
4255
4256 /* If the controller supports the LE Connection Update
4257 * command, enable the corresponding event.
4258 */
4259 if (hdev->commands[27] & 0x04)
4260 events[0] |= 0x04; /* LE Connection Update Complete */
4261
4262 /* If the controller supports the LE Read Remote Used Features
4263 * command, enable the corresponding event.
4264 */
4265 if (hdev->commands[27] & 0x20)
4266 /* LE Read Remote Used Features Complete */
4267 events[0] |= 0x08;
4268
4269 /* If the controller supports the LE Read Local P-256
4270 * Public Key command, enable the corresponding event.
4271 */
4272 if (hdev->commands[34] & 0x02)
4273 /* LE Read Local P-256 Public Key Complete */
4274 events[0] |= 0x80;
4275
4276 /* If the controller supports the LE Generate DHKey
4277 * command, enable the corresponding event.
4278 */
4279 if (hdev->commands[34] & 0x04)
4280 events[1] |= 0x01; /* LE Generate DHKey Complete */
4281
4282 /* If the controller supports the LE Set Default PHY or
4283 * LE Set PHY commands, enable the corresponding event.
4284 */
4285 if (hdev->commands[35] & (0x20 | 0x40))
4286 events[1] |= 0x08; /* LE PHY Update Complete */
4287
4288 /* If the controller supports LE Set Extended Scan Parameters
4289 * and LE Set Extended Scan Enable commands, enable the
4290 * corresponding event.
4291 */
4292 if (use_ext_scan(hdev))
4293 events[1] |= 0x10; /* LE Extended Advertising Report */
4294
4295 /* If the controller supports the LE Extended Advertising
4296 * command, enable the corresponding event.
4297 */
4298 if (ext_adv_capable(hdev))
4299 events[2] |= 0x02; /* LE Advertising Set Terminated */
4300
4301 if (cis_capable(hdev)) {
4302 events[3] |= 0x01; /* LE CIS Established */
4303 if (cis_peripheral_capable(hdev))
4304 events[3] |= 0x02; /* LE CIS Request */
4305 }
4306
4307 if (bis_capable(hdev)) {
4308 events[1] |= 0x20; /* LE PA Report */
4309 events[1] |= 0x40; /* LE PA Sync Established */
4310 events[3] |= 0x04; /* LE Create BIG Complete */
4311 events[3] |= 0x08; /* LE Terminate BIG Complete */
4312 events[3] |= 0x10; /* LE BIG Sync Established */
4313 events[3] |= 0x20; /* LE BIG Sync Loss */
4314 events[4] |= 0x02; /* LE BIG Info Advertising Report */
4315 }
4316
4317 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EVENT_MASK,
4318 sizeof(events), events, HCI_CMD_TIMEOUT);
4319 }
4320
4321 /* Read LE Advertising Channel TX Power */
hci_le_read_adv_tx_power_sync(struct hci_dev * hdev)4322 static int hci_le_read_adv_tx_power_sync(struct hci_dev *hdev)
4323 {
4324 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) {
4325 /* HCI TS spec forbids mixing of legacy and extended
4326 * advertising commands wherein READ_ADV_TX_POWER is
4327 * also included. So do not call it if extended adv
4328 * is supported otherwise controller will return
4329 * COMMAND_DISALLOWED for extended commands.
4330 */
4331 return __hci_cmd_sync_status(hdev,
4332 HCI_OP_LE_READ_ADV_TX_POWER,
4333 0, NULL, HCI_CMD_TIMEOUT);
4334 }
4335
4336 return 0;
4337 }
4338
4339 /* Read LE Min/Max Tx Power*/
hci_le_read_tx_power_sync(struct hci_dev * hdev)4340 static int hci_le_read_tx_power_sync(struct hci_dev *hdev)
4341 {
4342 if (!(hdev->commands[38] & 0x80) ||
4343 test_bit(HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER, &hdev->quirks))
4344 return 0;
4345
4346 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_TRANSMIT_POWER,
4347 0, NULL, HCI_CMD_TIMEOUT);
4348 }
4349
4350 /* Read LE Accept List Size */
hci_le_read_accept_list_size_sync(struct hci_dev * hdev)4351 static int hci_le_read_accept_list_size_sync(struct hci_dev *hdev)
4352 {
4353 if (!(hdev->commands[26] & 0x40))
4354 return 0;
4355
4356 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_ACCEPT_LIST_SIZE,
4357 0, NULL, HCI_CMD_TIMEOUT);
4358 }
4359
4360 /* Clear LE Accept List */
hci_le_clear_accept_list_sync(struct hci_dev * hdev)4361 static int hci_le_clear_accept_list_sync(struct hci_dev *hdev)
4362 {
4363 if (!(hdev->commands[26] & 0x80))
4364 return 0;
4365
4366 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CLEAR_ACCEPT_LIST, 0, NULL,
4367 HCI_CMD_TIMEOUT);
4368 }
4369
4370 /* Read LE Resolving List Size */
hci_le_read_resolv_list_size_sync(struct hci_dev * hdev)4371 static int hci_le_read_resolv_list_size_sync(struct hci_dev *hdev)
4372 {
4373 if (!(hdev->commands[34] & 0x40))
4374 return 0;
4375
4376 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_RESOLV_LIST_SIZE,
4377 0, NULL, HCI_CMD_TIMEOUT);
4378 }
4379
4380 /* Clear LE Resolving List */
hci_le_clear_resolv_list_sync(struct hci_dev * hdev)4381 static int hci_le_clear_resolv_list_sync(struct hci_dev *hdev)
4382 {
4383 if (!(hdev->commands[34] & 0x20))
4384 return 0;
4385
4386 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL,
4387 HCI_CMD_TIMEOUT);
4388 }
4389
4390 /* Set RPA timeout */
hci_le_set_rpa_timeout_sync(struct hci_dev * hdev)4391 static int hci_le_set_rpa_timeout_sync(struct hci_dev *hdev)
4392 {
4393 __le16 timeout = cpu_to_le16(hdev->rpa_timeout);
4394
4395 if (!(hdev->commands[35] & 0x04) ||
4396 test_bit(HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT, &hdev->quirks))
4397 return 0;
4398
4399 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_RPA_TIMEOUT,
4400 sizeof(timeout), &timeout,
4401 HCI_CMD_TIMEOUT);
4402 }
4403
4404 /* Read LE Maximum Data Length */
hci_le_read_max_data_len_sync(struct hci_dev * hdev)4405 static int hci_le_read_max_data_len_sync(struct hci_dev *hdev)
4406 {
4407 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT))
4408 return 0;
4409
4410 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL,
4411 HCI_CMD_TIMEOUT);
4412 }
4413
4414 /* Read LE Suggested Default Data Length */
hci_le_read_def_data_len_sync(struct hci_dev * hdev)4415 static int hci_le_read_def_data_len_sync(struct hci_dev *hdev)
4416 {
4417 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT))
4418 return 0;
4419
4420 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL,
4421 HCI_CMD_TIMEOUT);
4422 }
4423
4424 /* Read LE Number of Supported Advertising Sets */
hci_le_read_num_support_adv_sets_sync(struct hci_dev * hdev)4425 static int hci_le_read_num_support_adv_sets_sync(struct hci_dev *hdev)
4426 {
4427 if (!ext_adv_capable(hdev))
4428 return 0;
4429
4430 return __hci_cmd_sync_status(hdev,
4431 HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS,
4432 0, NULL, HCI_CMD_TIMEOUT);
4433 }
4434
4435 /* Write LE Host Supported */
hci_set_le_support_sync(struct hci_dev * hdev)4436 static int hci_set_le_support_sync(struct hci_dev *hdev)
4437 {
4438 struct hci_cp_write_le_host_supported cp;
4439
4440 /* LE-only devices do not support explicit enablement */
4441 if (!lmp_bredr_capable(hdev))
4442 return 0;
4443
4444 memset(&cp, 0, sizeof(cp));
4445
4446 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) {
4447 cp.le = 0x01;
4448 cp.simul = 0x00;
4449 }
4450
4451 if (cp.le == lmp_host_le_capable(hdev))
4452 return 0;
4453
4454 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED,
4455 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4456 }
4457
4458 /* LE Set Host Feature */
hci_le_set_host_feature_sync(struct hci_dev * hdev)4459 static int hci_le_set_host_feature_sync(struct hci_dev *hdev)
4460 {
4461 struct hci_cp_le_set_host_feature cp;
4462
4463 if (!iso_capable(hdev))
4464 return 0;
4465
4466 memset(&cp, 0, sizeof(cp));
4467
4468 /* Isochronous Channels (Host Support) */
4469 cp.bit_number = 32;
4470 cp.bit_value = 1;
4471
4472 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_HOST_FEATURE,
4473 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4474 }
4475
4476 /* LE Controller init stage 3 command sequence */
4477 static const struct hci_init_stage le_init3[] = {
4478 /* HCI_OP_LE_SET_EVENT_MASK */
4479 HCI_INIT(hci_le_set_event_mask_sync),
4480 /* HCI_OP_LE_READ_ADV_TX_POWER */
4481 HCI_INIT(hci_le_read_adv_tx_power_sync),
4482 /* HCI_OP_LE_READ_TRANSMIT_POWER */
4483 HCI_INIT(hci_le_read_tx_power_sync),
4484 /* HCI_OP_LE_READ_ACCEPT_LIST_SIZE */
4485 HCI_INIT(hci_le_read_accept_list_size_sync),
4486 /* HCI_OP_LE_CLEAR_ACCEPT_LIST */
4487 HCI_INIT(hci_le_clear_accept_list_sync),
4488 /* HCI_OP_LE_READ_RESOLV_LIST_SIZE */
4489 HCI_INIT(hci_le_read_resolv_list_size_sync),
4490 /* HCI_OP_LE_CLEAR_RESOLV_LIST */
4491 HCI_INIT(hci_le_clear_resolv_list_sync),
4492 /* HCI_OP_LE_SET_RPA_TIMEOUT */
4493 HCI_INIT(hci_le_set_rpa_timeout_sync),
4494 /* HCI_OP_LE_READ_MAX_DATA_LEN */
4495 HCI_INIT(hci_le_read_max_data_len_sync),
4496 /* HCI_OP_LE_READ_DEF_DATA_LEN */
4497 HCI_INIT(hci_le_read_def_data_len_sync),
4498 /* HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS */
4499 HCI_INIT(hci_le_read_num_support_adv_sets_sync),
4500 /* HCI_OP_WRITE_LE_HOST_SUPPORTED */
4501 HCI_INIT(hci_set_le_support_sync),
4502 /* HCI_OP_LE_SET_HOST_FEATURE */
4503 HCI_INIT(hci_le_set_host_feature_sync),
4504 {}
4505 };
4506
hci_init3_sync(struct hci_dev * hdev)4507 static int hci_init3_sync(struct hci_dev *hdev)
4508 {
4509 int err;
4510
4511 bt_dev_dbg(hdev, "");
4512
4513 err = hci_init_stage_sync(hdev, hci_init3);
4514 if (err)
4515 return err;
4516
4517 if (lmp_le_capable(hdev))
4518 return hci_init_stage_sync(hdev, le_init3);
4519
4520 return 0;
4521 }
4522
hci_delete_stored_link_key_sync(struct hci_dev * hdev)4523 static int hci_delete_stored_link_key_sync(struct hci_dev *hdev)
4524 {
4525 struct hci_cp_delete_stored_link_key cp;
4526
4527 /* Some Broadcom based Bluetooth controllers do not support the
4528 * Delete Stored Link Key command. They are clearly indicating its
4529 * absence in the bit mask of supported commands.
4530 *
4531 * Check the supported commands and only if the command is marked
4532 * as supported send it. If not supported assume that the controller
4533 * does not have actual support for stored link keys which makes this
4534 * command redundant anyway.
4535 *
4536 * Some controllers indicate that they support handling deleting
4537 * stored link keys, but they don't. The quirk lets a driver
4538 * just disable this command.
4539 */
4540 if (!(hdev->commands[6] & 0x80) ||
4541 test_bit(HCI_QUIRK_BROKEN_STORED_LINK_KEY, &hdev->quirks))
4542 return 0;
4543
4544 memset(&cp, 0, sizeof(cp));
4545 bacpy(&cp.bdaddr, BDADDR_ANY);
4546 cp.delete_all = 0x01;
4547
4548 return __hci_cmd_sync_status(hdev, HCI_OP_DELETE_STORED_LINK_KEY,
4549 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4550 }
4551
hci_set_event_mask_page_2_sync(struct hci_dev * hdev)4552 static int hci_set_event_mask_page_2_sync(struct hci_dev *hdev)
4553 {
4554 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 };
4555 bool changed = false;
4556
4557 /* Set event mask page 2 if the HCI command for it is supported */
4558 if (!(hdev->commands[22] & 0x04))
4559 return 0;
4560
4561 /* If Connectionless Peripheral Broadcast central role is supported
4562 * enable all necessary events for it.
4563 */
4564 if (lmp_cpb_central_capable(hdev)) {
4565 events[1] |= 0x40; /* Triggered Clock Capture */
4566 events[1] |= 0x80; /* Synchronization Train Complete */
4567 events[2] |= 0x08; /* Truncated Page Complete */
4568 events[2] |= 0x20; /* CPB Channel Map Change */
4569 changed = true;
4570 }
4571
4572 /* If Connectionless Peripheral Broadcast peripheral role is supported
4573 * enable all necessary events for it.
4574 */
4575 if (lmp_cpb_peripheral_capable(hdev)) {
4576 events[2] |= 0x01; /* Synchronization Train Received */
4577 events[2] |= 0x02; /* CPB Receive */
4578 events[2] |= 0x04; /* CPB Timeout */
4579 events[2] |= 0x10; /* Peripheral Page Response Timeout */
4580 changed = true;
4581 }
4582
4583 /* Enable Authenticated Payload Timeout Expired event if supported */
4584 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) {
4585 events[2] |= 0x80;
4586 changed = true;
4587 }
4588
4589 /* Some Broadcom based controllers indicate support for Set Event
4590 * Mask Page 2 command, but then actually do not support it. Since
4591 * the default value is all bits set to zero, the command is only
4592 * required if the event mask has to be changed. In case no change
4593 * to the event mask is needed, skip this command.
4594 */
4595 if (!changed)
4596 return 0;
4597
4598 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_MASK_PAGE_2,
4599 sizeof(events), events, HCI_CMD_TIMEOUT);
4600 }
4601
4602 /* Read local codec list if the HCI command is supported */
hci_read_local_codecs_sync(struct hci_dev * hdev)4603 static int hci_read_local_codecs_sync(struct hci_dev *hdev)
4604 {
4605 if (hdev->commands[45] & 0x04)
4606 hci_read_supported_codecs_v2(hdev);
4607 else if (hdev->commands[29] & 0x20)
4608 hci_read_supported_codecs(hdev);
4609
4610 return 0;
4611 }
4612
4613 /* Read local pairing options if the HCI command is supported */
hci_read_local_pairing_opts_sync(struct hci_dev * hdev)4614 static int hci_read_local_pairing_opts_sync(struct hci_dev *hdev)
4615 {
4616 if (!(hdev->commands[41] & 0x08))
4617 return 0;
4618
4619 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_PAIRING_OPTS,
4620 0, NULL, HCI_CMD_TIMEOUT);
4621 }
4622
4623 /* Get MWS transport configuration if the HCI command is supported */
hci_get_mws_transport_config_sync(struct hci_dev * hdev)4624 static int hci_get_mws_transport_config_sync(struct hci_dev *hdev)
4625 {
4626 if (!mws_transport_config_capable(hdev))
4627 return 0;
4628
4629 return __hci_cmd_sync_status(hdev, HCI_OP_GET_MWS_TRANSPORT_CONFIG,
4630 0, NULL, HCI_CMD_TIMEOUT);
4631 }
4632
4633 /* Check for Synchronization Train support */
hci_read_sync_train_params_sync(struct hci_dev * hdev)4634 static int hci_read_sync_train_params_sync(struct hci_dev *hdev)
4635 {
4636 if (!lmp_sync_train_capable(hdev))
4637 return 0;
4638
4639 return __hci_cmd_sync_status(hdev, HCI_OP_READ_SYNC_TRAIN_PARAMS,
4640 0, NULL, HCI_CMD_TIMEOUT);
4641 }
4642
4643 /* Enable Secure Connections if supported and configured */
hci_write_sc_support_1_sync(struct hci_dev * hdev)4644 static int hci_write_sc_support_1_sync(struct hci_dev *hdev)
4645 {
4646 u8 support = 0x01;
4647
4648 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED) ||
4649 !bredr_sc_enabled(hdev))
4650 return 0;
4651
4652 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SC_SUPPORT,
4653 sizeof(support), &support,
4654 HCI_CMD_TIMEOUT);
4655 }
4656
4657 /* Set erroneous data reporting if supported to the wideband speech
4658 * setting value
4659 */
hci_set_err_data_report_sync(struct hci_dev * hdev)4660 static int hci_set_err_data_report_sync(struct hci_dev *hdev)
4661 {
4662 struct hci_cp_write_def_err_data_reporting cp;
4663 bool enabled = hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED);
4664
4665 if (!(hdev->commands[18] & 0x08) ||
4666 !(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) ||
4667 test_bit(HCI_QUIRK_BROKEN_ERR_DATA_REPORTING, &hdev->quirks))
4668 return 0;
4669
4670 if (enabled == hdev->err_data_reporting)
4671 return 0;
4672
4673 memset(&cp, 0, sizeof(cp));
4674 cp.err_data_reporting = enabled ? ERR_DATA_REPORTING_ENABLED :
4675 ERR_DATA_REPORTING_DISABLED;
4676
4677 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING,
4678 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4679 }
4680
4681 static const struct hci_init_stage hci_init4[] = {
4682 /* HCI_OP_DELETE_STORED_LINK_KEY */
4683 HCI_INIT(hci_delete_stored_link_key_sync),
4684 /* HCI_OP_SET_EVENT_MASK_PAGE_2 */
4685 HCI_INIT(hci_set_event_mask_page_2_sync),
4686 /* HCI_OP_READ_LOCAL_CODECS */
4687 HCI_INIT(hci_read_local_codecs_sync),
4688 /* HCI_OP_READ_LOCAL_PAIRING_OPTS */
4689 HCI_INIT(hci_read_local_pairing_opts_sync),
4690 /* HCI_OP_GET_MWS_TRANSPORT_CONFIG */
4691 HCI_INIT(hci_get_mws_transport_config_sync),
4692 /* HCI_OP_READ_SYNC_TRAIN_PARAMS */
4693 HCI_INIT(hci_read_sync_train_params_sync),
4694 /* HCI_OP_WRITE_SC_SUPPORT */
4695 HCI_INIT(hci_write_sc_support_1_sync),
4696 /* HCI_OP_WRITE_DEF_ERR_DATA_REPORTING */
4697 HCI_INIT(hci_set_err_data_report_sync),
4698 {}
4699 };
4700
4701 /* Set Suggested Default Data Length to maximum if supported */
hci_le_set_write_def_data_len_sync(struct hci_dev * hdev)4702 static int hci_le_set_write_def_data_len_sync(struct hci_dev *hdev)
4703 {
4704 struct hci_cp_le_write_def_data_len cp;
4705
4706 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT))
4707 return 0;
4708
4709 memset(&cp, 0, sizeof(cp));
4710 cp.tx_len = cpu_to_le16(hdev->le_max_tx_len);
4711 cp.tx_time = cpu_to_le16(hdev->le_max_tx_time);
4712
4713 return __hci_cmd_sync_status(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN,
4714 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4715 }
4716
4717 /* Set Default PHY parameters if command is supported, enables all supported
4718 * PHYs according to the LE Features bits.
4719 */
hci_le_set_default_phy_sync(struct hci_dev * hdev)4720 static int hci_le_set_default_phy_sync(struct hci_dev *hdev)
4721 {
4722 struct hci_cp_le_set_default_phy cp;
4723
4724 if (!(hdev->commands[35] & 0x20)) {
4725 /* If the command is not supported it means only 1M PHY is
4726 * supported.
4727 */
4728 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M;
4729 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M;
4730 return 0;
4731 }
4732
4733 memset(&cp, 0, sizeof(cp));
4734 cp.all_phys = 0x00;
4735 cp.tx_phys = HCI_LE_SET_PHY_1M;
4736 cp.rx_phys = HCI_LE_SET_PHY_1M;
4737
4738 /* Enables 2M PHY if supported */
4739 if (le_2m_capable(hdev)) {
4740 cp.tx_phys |= HCI_LE_SET_PHY_2M;
4741 cp.rx_phys |= HCI_LE_SET_PHY_2M;
4742 }
4743
4744 /* Enables Coded PHY if supported */
4745 if (le_coded_capable(hdev)) {
4746 cp.tx_phys |= HCI_LE_SET_PHY_CODED;
4747 cp.rx_phys |= HCI_LE_SET_PHY_CODED;
4748 }
4749
4750 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_DEFAULT_PHY,
4751 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
4752 }
4753
4754 static const struct hci_init_stage le_init4[] = {
4755 /* HCI_OP_LE_WRITE_DEF_DATA_LEN */
4756 HCI_INIT(hci_le_set_write_def_data_len_sync),
4757 /* HCI_OP_LE_SET_DEFAULT_PHY */
4758 HCI_INIT(hci_le_set_default_phy_sync),
4759 {}
4760 };
4761
hci_init4_sync(struct hci_dev * hdev)4762 static int hci_init4_sync(struct hci_dev *hdev)
4763 {
4764 int err;
4765
4766 bt_dev_dbg(hdev, "");
4767
4768 err = hci_init_stage_sync(hdev, hci_init4);
4769 if (err)
4770 return err;
4771
4772 if (lmp_le_capable(hdev))
4773 return hci_init_stage_sync(hdev, le_init4);
4774
4775 return 0;
4776 }
4777
hci_init_sync(struct hci_dev * hdev)4778 static int hci_init_sync(struct hci_dev *hdev)
4779 {
4780 int err;
4781
4782 err = hci_init1_sync(hdev);
4783 if (err < 0)
4784 return err;
4785
4786 if (hci_dev_test_flag(hdev, HCI_SETUP))
4787 hci_debugfs_create_basic(hdev);
4788
4789 err = hci_init2_sync(hdev);
4790 if (err < 0)
4791 return err;
4792
4793 err = hci_init3_sync(hdev);
4794 if (err < 0)
4795 return err;
4796
4797 err = hci_init4_sync(hdev);
4798 if (err < 0)
4799 return err;
4800
4801 /* This function is only called when the controller is actually in
4802 * configured state. When the controller is marked as unconfigured,
4803 * this initialization procedure is not run.
4804 *
4805 * It means that it is possible that a controller runs through its
4806 * setup phase and then discovers missing settings. If that is the
4807 * case, then this function will not be called. It then will only
4808 * be called during the config phase.
4809 *
4810 * So only when in setup phase or config phase, create the debugfs
4811 * entries and register the SMP channels.
4812 */
4813 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
4814 !hci_dev_test_flag(hdev, HCI_CONFIG))
4815 return 0;
4816
4817 if (hci_dev_test_and_set_flag(hdev, HCI_DEBUGFS_CREATED))
4818 return 0;
4819
4820 hci_debugfs_create_common(hdev);
4821
4822 if (lmp_bredr_capable(hdev))
4823 hci_debugfs_create_bredr(hdev);
4824
4825 if (lmp_le_capable(hdev))
4826 hci_debugfs_create_le(hdev);
4827
4828 return 0;
4829 }
4830
4831 #define HCI_QUIRK_BROKEN(_quirk, _desc) { HCI_QUIRK_BROKEN_##_quirk, _desc }
4832
4833 static const struct {
4834 unsigned long quirk;
4835 const char *desc;
4836 } hci_broken_table[] = {
4837 HCI_QUIRK_BROKEN(LOCAL_COMMANDS,
4838 "HCI Read Local Supported Commands not supported"),
4839 HCI_QUIRK_BROKEN(STORED_LINK_KEY,
4840 "HCI Delete Stored Link Key command is advertised, "
4841 "but not supported."),
4842 HCI_QUIRK_BROKEN(ERR_DATA_REPORTING,
4843 "HCI Read Default Erroneous Data Reporting command is "
4844 "advertised, but not supported."),
4845 HCI_QUIRK_BROKEN(READ_TRANSMIT_POWER,
4846 "HCI Read Transmit Power Level command is advertised, "
4847 "but not supported."),
4848 HCI_QUIRK_BROKEN(FILTER_CLEAR_ALL,
4849 "HCI Set Event Filter command not supported."),
4850 HCI_QUIRK_BROKEN(ENHANCED_SETUP_SYNC_CONN,
4851 "HCI Enhanced Setup Synchronous Connection command is "
4852 "advertised, but not supported."),
4853 HCI_QUIRK_BROKEN(SET_RPA_TIMEOUT,
4854 "HCI LE Set Random Private Address Timeout command is "
4855 "advertised, but not supported."),
4856 HCI_QUIRK_BROKEN(LE_CODED,
4857 "HCI LE Coded PHY feature bit is set, "
4858 "but its usage is not supported.")
4859 };
4860
4861 /* This function handles hdev setup stage:
4862 *
4863 * Calls hdev->setup
4864 * Setup address if HCI_QUIRK_USE_BDADDR_PROPERTY is set.
4865 */
hci_dev_setup_sync(struct hci_dev * hdev)4866 static int hci_dev_setup_sync(struct hci_dev *hdev)
4867 {
4868 int ret = 0;
4869 bool invalid_bdaddr;
4870 size_t i;
4871
4872 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
4873 !test_bit(HCI_QUIRK_NON_PERSISTENT_SETUP, &hdev->quirks))
4874 return 0;
4875
4876 bt_dev_dbg(hdev, "");
4877
4878 hci_sock_dev_event(hdev, HCI_DEV_SETUP);
4879
4880 if (hdev->setup)
4881 ret = hdev->setup(hdev);
4882
4883 for (i = 0; i < ARRAY_SIZE(hci_broken_table); i++) {
4884 if (test_bit(hci_broken_table[i].quirk, &hdev->quirks))
4885 bt_dev_warn(hdev, "%s", hci_broken_table[i].desc);
4886 }
4887
4888 /* The transport driver can set the quirk to mark the
4889 * BD_ADDR invalid before creating the HCI device or in
4890 * its setup callback.
4891 */
4892 invalid_bdaddr = test_bit(HCI_QUIRK_INVALID_BDADDR, &hdev->quirks) ||
4893 test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks);
4894 if (!ret) {
4895 if (test_bit(HCI_QUIRK_USE_BDADDR_PROPERTY, &hdev->quirks) &&
4896 !bacmp(&hdev->public_addr, BDADDR_ANY))
4897 hci_dev_get_bd_addr_from_property(hdev);
4898
4899 if (invalid_bdaddr && bacmp(&hdev->public_addr, BDADDR_ANY) &&
4900 hdev->set_bdaddr) {
4901 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
4902 if (!ret)
4903 invalid_bdaddr = false;
4904 }
4905 }
4906
4907 /* The transport driver can set these quirks before
4908 * creating the HCI device or in its setup callback.
4909 *
4910 * For the invalid BD_ADDR quirk it is possible that
4911 * it becomes a valid address if the bootloader does
4912 * provide it (see above).
4913 *
4914 * In case any of them is set, the controller has to
4915 * start up as unconfigured.
4916 */
4917 if (test_bit(HCI_QUIRK_EXTERNAL_CONFIG, &hdev->quirks) ||
4918 invalid_bdaddr)
4919 hci_dev_set_flag(hdev, HCI_UNCONFIGURED);
4920
4921 /* For an unconfigured controller it is required to
4922 * read at least the version information provided by
4923 * the Read Local Version Information command.
4924 *
4925 * If the set_bdaddr driver callback is provided, then
4926 * also the original Bluetooth public device address
4927 * will be read using the Read BD Address command.
4928 */
4929 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
4930 return hci_unconf_init_sync(hdev);
4931
4932 return ret;
4933 }
4934
4935 /* This function handles hdev init stage:
4936 *
4937 * Calls hci_dev_setup_sync to perform setup stage
4938 * Calls hci_init_sync to perform HCI command init sequence
4939 */
hci_dev_init_sync(struct hci_dev * hdev)4940 static int hci_dev_init_sync(struct hci_dev *hdev)
4941 {
4942 int ret;
4943
4944 bt_dev_dbg(hdev, "");
4945
4946 atomic_set(&hdev->cmd_cnt, 1);
4947 set_bit(HCI_INIT, &hdev->flags);
4948
4949 ret = hci_dev_setup_sync(hdev);
4950
4951 if (hci_dev_test_flag(hdev, HCI_CONFIG)) {
4952 /* If public address change is configured, ensure that
4953 * the address gets programmed. If the driver does not
4954 * support changing the public address, fail the power
4955 * on procedure.
4956 */
4957 if (bacmp(&hdev->public_addr, BDADDR_ANY) &&
4958 hdev->set_bdaddr)
4959 ret = hdev->set_bdaddr(hdev, &hdev->public_addr);
4960 else
4961 ret = -EADDRNOTAVAIL;
4962 }
4963
4964 if (!ret) {
4965 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
4966 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4967 ret = hci_init_sync(hdev);
4968 if (!ret && hdev->post_init)
4969 ret = hdev->post_init(hdev);
4970 }
4971 }
4972
4973 /* If the HCI Reset command is clearing all diagnostic settings,
4974 * then they need to be reprogrammed after the init procedure
4975 * completed.
4976 */
4977 if (test_bit(HCI_QUIRK_NON_PERSISTENT_DIAG, &hdev->quirks) &&
4978 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
4979 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag)
4980 ret = hdev->set_diag(hdev, true);
4981
4982 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
4983 msft_do_open(hdev);
4984 aosp_do_open(hdev);
4985 }
4986
4987 clear_bit(HCI_INIT, &hdev->flags);
4988
4989 return ret;
4990 }
4991
hci_dev_open_sync(struct hci_dev * hdev)4992 int hci_dev_open_sync(struct hci_dev *hdev)
4993 {
4994 int ret;
4995
4996 bt_dev_dbg(hdev, "");
4997
4998 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) {
4999 ret = -ENODEV;
5000 goto done;
5001 }
5002
5003 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
5004 !hci_dev_test_flag(hdev, HCI_CONFIG)) {
5005 /* Check for rfkill but allow the HCI setup stage to
5006 * proceed (which in itself doesn't cause any RF activity).
5007 */
5008 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) {
5009 ret = -ERFKILL;
5010 goto done;
5011 }
5012
5013 /* Check for valid public address or a configured static
5014 * random address, but let the HCI setup proceed to
5015 * be able to determine if there is a public address
5016 * or not.
5017 *
5018 * In case of user channel usage, it is not important
5019 * if a public address or static random address is
5020 * available.
5021 */
5022 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
5023 !bacmp(&hdev->bdaddr, BDADDR_ANY) &&
5024 !bacmp(&hdev->static_addr, BDADDR_ANY)) {
5025 ret = -EADDRNOTAVAIL;
5026 goto done;
5027 }
5028 }
5029
5030 if (test_bit(HCI_UP, &hdev->flags)) {
5031 ret = -EALREADY;
5032 goto done;
5033 }
5034
5035 if (hdev->open(hdev)) {
5036 ret = -EIO;
5037 goto done;
5038 }
5039
5040 hci_devcd_reset(hdev);
5041
5042 set_bit(HCI_RUNNING, &hdev->flags);
5043 hci_sock_dev_event(hdev, HCI_DEV_OPEN);
5044
5045 ret = hci_dev_init_sync(hdev);
5046 if (!ret) {
5047 hci_dev_hold(hdev);
5048 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED);
5049 hci_adv_instances_set_rpa_expired(hdev, true);
5050 set_bit(HCI_UP, &hdev->flags);
5051 hci_sock_dev_event(hdev, HCI_DEV_UP);
5052 hci_leds_update_powered(hdev, true);
5053 if (!hci_dev_test_flag(hdev, HCI_SETUP) &&
5054 !hci_dev_test_flag(hdev, HCI_CONFIG) &&
5055 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) &&
5056 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
5057 hci_dev_test_flag(hdev, HCI_MGMT)) {
5058 ret = hci_powered_update_sync(hdev);
5059 mgmt_power_on(hdev, ret);
5060 }
5061 } else {
5062 /* Init failed, cleanup */
5063 flush_work(&hdev->tx_work);
5064
5065 /* Since hci_rx_work() is possible to awake new cmd_work
5066 * it should be flushed first to avoid unexpected call of
5067 * hci_cmd_work()
5068 */
5069 flush_work(&hdev->rx_work);
5070 flush_work(&hdev->cmd_work);
5071
5072 skb_queue_purge(&hdev->cmd_q);
5073 skb_queue_purge(&hdev->rx_q);
5074
5075 if (hdev->flush)
5076 hdev->flush(hdev);
5077
5078 if (hdev->sent_cmd) {
5079 cancel_delayed_work_sync(&hdev->cmd_timer);
5080 kfree_skb(hdev->sent_cmd);
5081 hdev->sent_cmd = NULL;
5082 }
5083
5084 if (hdev->req_skb) {
5085 kfree_skb(hdev->req_skb);
5086 hdev->req_skb = NULL;
5087 }
5088
5089 clear_bit(HCI_RUNNING, &hdev->flags);
5090 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
5091
5092 hdev->close(hdev);
5093 hdev->flags &= BIT(HCI_RAW);
5094 }
5095
5096 done:
5097 return ret;
5098 }
5099
5100 /* This function requires the caller holds hdev->lock */
hci_pend_le_actions_clear(struct hci_dev * hdev)5101 static void hci_pend_le_actions_clear(struct hci_dev *hdev)
5102 {
5103 struct hci_conn_params *p;
5104
5105 list_for_each_entry(p, &hdev->le_conn_params, list) {
5106 hci_pend_le_list_del_init(p);
5107 if (p->conn) {
5108 hci_conn_drop(p->conn);
5109 hci_conn_put(p->conn);
5110 p->conn = NULL;
5111 }
5112 }
5113
5114 BT_DBG("All LE pending actions cleared");
5115 }
5116
hci_dev_shutdown(struct hci_dev * hdev)5117 static int hci_dev_shutdown(struct hci_dev *hdev)
5118 {
5119 int err = 0;
5120 /* Similar to how we first do setup and then set the exclusive access
5121 * bit for userspace, we must first unset userchannel and then clean up.
5122 * Otherwise, the kernel can't properly use the hci channel to clean up
5123 * the controller (some shutdown routines require sending additional
5124 * commands to the controller for example).
5125 */
5126 bool was_userchannel =
5127 hci_dev_test_and_clear_flag(hdev, HCI_USER_CHANNEL);
5128
5129 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) &&
5130 test_bit(HCI_UP, &hdev->flags)) {
5131 /* Execute vendor specific shutdown routine */
5132 if (hdev->shutdown)
5133 err = hdev->shutdown(hdev);
5134 }
5135
5136 if (was_userchannel)
5137 hci_dev_set_flag(hdev, HCI_USER_CHANNEL);
5138
5139 return err;
5140 }
5141
hci_dev_close_sync(struct hci_dev * hdev)5142 int hci_dev_close_sync(struct hci_dev *hdev)
5143 {
5144 bool auto_off;
5145 int err = 0;
5146
5147 bt_dev_dbg(hdev, "");
5148
5149 cancel_delayed_work(&hdev->power_off);
5150 cancel_delayed_work(&hdev->ncmd_timer);
5151 cancel_delayed_work(&hdev->le_scan_disable);
5152 cancel_delayed_work(&hdev->le_scan_restart);
5153
5154 hci_request_cancel_all(hdev);
5155
5156 if (hdev->adv_instance_timeout) {
5157 cancel_delayed_work_sync(&hdev->adv_instance_expire);
5158 hdev->adv_instance_timeout = 0;
5159 }
5160
5161 err = hci_dev_shutdown(hdev);
5162
5163 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) {
5164 cancel_delayed_work_sync(&hdev->cmd_timer);
5165 return err;
5166 }
5167
5168 hci_leds_update_powered(hdev, false);
5169
5170 /* Flush RX and TX works */
5171 flush_work(&hdev->tx_work);
5172 flush_work(&hdev->rx_work);
5173
5174 if (hdev->discov_timeout > 0) {
5175 hdev->discov_timeout = 0;
5176 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE);
5177 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE);
5178 }
5179
5180 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE))
5181 cancel_delayed_work(&hdev->service_cache);
5182
5183 if (hci_dev_test_flag(hdev, HCI_MGMT)) {
5184 struct adv_info *adv_instance;
5185
5186 cancel_delayed_work_sync(&hdev->rpa_expired);
5187
5188 list_for_each_entry(adv_instance, &hdev->adv_instances, list)
5189 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb);
5190 }
5191
5192 /* Avoid potential lockdep warnings from the *_flush() calls by
5193 * ensuring the workqueue is empty up front.
5194 */
5195 drain_workqueue(hdev->workqueue);
5196
5197 hci_dev_lock(hdev);
5198
5199 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
5200
5201 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF);
5202
5203 if (!auto_off && !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) &&
5204 hci_dev_test_flag(hdev, HCI_MGMT))
5205 __mgmt_power_off(hdev);
5206
5207 hci_inquiry_cache_flush(hdev);
5208 hci_pend_le_actions_clear(hdev);
5209 hci_conn_hash_flush(hdev);
5210 /* Prevent data races on hdev->smp_data or hdev->smp_bredr_data */
5211 smp_unregister(hdev);
5212 hci_dev_unlock(hdev);
5213
5214 hci_sock_dev_event(hdev, HCI_DEV_DOWN);
5215
5216 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) {
5217 aosp_do_close(hdev);
5218 msft_do_close(hdev);
5219 }
5220
5221 if (hdev->flush)
5222 hdev->flush(hdev);
5223
5224 /* Reset device */
5225 skb_queue_purge(&hdev->cmd_q);
5226 atomic_set(&hdev->cmd_cnt, 1);
5227 if (test_bit(HCI_QUIRK_RESET_ON_CLOSE, &hdev->quirks) &&
5228 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) {
5229 set_bit(HCI_INIT, &hdev->flags);
5230 hci_reset_sync(hdev);
5231 clear_bit(HCI_INIT, &hdev->flags);
5232 }
5233
5234 /* flush cmd work */
5235 flush_work(&hdev->cmd_work);
5236
5237 /* Drop queues */
5238 skb_queue_purge(&hdev->rx_q);
5239 skb_queue_purge(&hdev->cmd_q);
5240 skb_queue_purge(&hdev->raw_q);
5241
5242 /* Drop last sent command */
5243 if (hdev->sent_cmd) {
5244 cancel_delayed_work_sync(&hdev->cmd_timer);
5245 kfree_skb(hdev->sent_cmd);
5246 hdev->sent_cmd = NULL;
5247 }
5248
5249 /* Drop last request */
5250 if (hdev->req_skb) {
5251 kfree_skb(hdev->req_skb);
5252 hdev->req_skb = NULL;
5253 }
5254
5255 clear_bit(HCI_RUNNING, &hdev->flags);
5256 hci_sock_dev_event(hdev, HCI_DEV_CLOSE);
5257
5258 /* After this point our queues are empty and no tasks are scheduled. */
5259 hdev->close(hdev);
5260
5261 /* Clear flags */
5262 hdev->flags &= BIT(HCI_RAW);
5263 hci_dev_clear_volatile_flags(hdev);
5264
5265 memset(hdev->eir, 0, sizeof(hdev->eir));
5266 memset(hdev->dev_class, 0, sizeof(hdev->dev_class));
5267 bacpy(&hdev->random_addr, BDADDR_ANY);
5268 hci_codec_list_clear(&hdev->local_codecs);
5269
5270 hci_dev_put(hdev);
5271 return err;
5272 }
5273
5274 /* This function perform power on HCI command sequence as follows:
5275 *
5276 * If controller is already up (HCI_UP) performs hci_powered_update_sync
5277 * sequence otherwise run hci_dev_open_sync which will follow with
5278 * hci_powered_update_sync after the init sequence is completed.
5279 */
hci_power_on_sync(struct hci_dev * hdev)5280 static int hci_power_on_sync(struct hci_dev *hdev)
5281 {
5282 int err;
5283
5284 if (test_bit(HCI_UP, &hdev->flags) &&
5285 hci_dev_test_flag(hdev, HCI_MGMT) &&
5286 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) {
5287 cancel_delayed_work(&hdev->power_off);
5288 return hci_powered_update_sync(hdev);
5289 }
5290
5291 err = hci_dev_open_sync(hdev);
5292 if (err < 0)
5293 return err;
5294
5295 /* During the HCI setup phase, a few error conditions are
5296 * ignored and they need to be checked now. If they are still
5297 * valid, it is important to return the device back off.
5298 */
5299 if (hci_dev_test_flag(hdev, HCI_RFKILLED) ||
5300 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) ||
5301 (!bacmp(&hdev->bdaddr, BDADDR_ANY) &&
5302 !bacmp(&hdev->static_addr, BDADDR_ANY))) {
5303 hci_dev_clear_flag(hdev, HCI_AUTO_OFF);
5304 hci_dev_close_sync(hdev);
5305 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) {
5306 queue_delayed_work(hdev->req_workqueue, &hdev->power_off,
5307 HCI_AUTO_OFF_TIMEOUT);
5308 }
5309
5310 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) {
5311 /* For unconfigured devices, set the HCI_RAW flag
5312 * so that userspace can easily identify them.
5313 */
5314 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5315 set_bit(HCI_RAW, &hdev->flags);
5316
5317 /* For fully configured devices, this will send
5318 * the Index Added event. For unconfigured devices,
5319 * it will send Unconfigued Index Added event.
5320 *
5321 * Devices with HCI_QUIRK_RAW_DEVICE are ignored
5322 * and no event will be send.
5323 */
5324 mgmt_index_added(hdev);
5325 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) {
5326 /* When the controller is now configured, then it
5327 * is important to clear the HCI_RAW flag.
5328 */
5329 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED))
5330 clear_bit(HCI_RAW, &hdev->flags);
5331
5332 /* Powering on the controller with HCI_CONFIG set only
5333 * happens with the transition from unconfigured to
5334 * configured. This will send the Index Added event.
5335 */
5336 mgmt_index_added(hdev);
5337 }
5338
5339 return 0;
5340 }
5341
hci_remote_name_cancel_sync(struct hci_dev * hdev,bdaddr_t * addr)5342 static int hci_remote_name_cancel_sync(struct hci_dev *hdev, bdaddr_t *addr)
5343 {
5344 struct hci_cp_remote_name_req_cancel cp;
5345
5346 memset(&cp, 0, sizeof(cp));
5347 bacpy(&cp.bdaddr, addr);
5348
5349 return __hci_cmd_sync_status(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL,
5350 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5351 }
5352
hci_stop_discovery_sync(struct hci_dev * hdev)5353 int hci_stop_discovery_sync(struct hci_dev *hdev)
5354 {
5355 struct discovery_state *d = &hdev->discovery;
5356 struct inquiry_entry *e;
5357 int err;
5358
5359 bt_dev_dbg(hdev, "state %u", hdev->discovery.state);
5360
5361 if (d->state == DISCOVERY_FINDING || d->state == DISCOVERY_STOPPING) {
5362 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
5363 err = __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY_CANCEL,
5364 0, NULL, HCI_CMD_TIMEOUT);
5365 if (err)
5366 return err;
5367 }
5368
5369 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
5370 cancel_delayed_work(&hdev->le_scan_disable);
5371 cancel_delayed_work(&hdev->le_scan_restart);
5372
5373 err = hci_scan_disable_sync(hdev);
5374 if (err)
5375 return err;
5376 }
5377
5378 } else {
5379 err = hci_scan_disable_sync(hdev);
5380 if (err)
5381 return err;
5382 }
5383
5384 /* Resume advertising if it was paused */
5385 if (use_ll_privacy(hdev))
5386 hci_resume_advertising_sync(hdev);
5387
5388 /* No further actions needed for LE-only discovery */
5389 if (d->type == DISCOV_TYPE_LE)
5390 return 0;
5391
5392 if (d->state == DISCOVERY_RESOLVING || d->state == DISCOVERY_STOPPING) {
5393 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY,
5394 NAME_PENDING);
5395 if (!e)
5396 return 0;
5397
5398 /* Ignore cancel errors since it should interfere with stopping
5399 * of the discovery.
5400 */
5401 hci_remote_name_cancel_sync(hdev, &e->data.bdaddr);
5402 }
5403
5404 return 0;
5405 }
5406
hci_disconnect_sync(struct hci_dev * hdev,struct hci_conn * conn,u8 reason)5407 static int hci_disconnect_sync(struct hci_dev *hdev, struct hci_conn *conn,
5408 u8 reason)
5409 {
5410 struct hci_cp_disconnect cp;
5411
5412 if (test_bit(HCI_CONN_BIG_CREATED, &conn->flags)) {
5413 /* This is a BIS connection, hci_conn_del will
5414 * do the necessary cleanup.
5415 */
5416 hci_dev_lock(hdev);
5417 hci_conn_failed(conn, reason);
5418 hci_dev_unlock(hdev);
5419
5420 return 0;
5421 }
5422
5423 memset(&cp, 0, sizeof(cp));
5424 cp.handle = cpu_to_le16(conn->handle);
5425 cp.reason = reason;
5426
5427 /* Wait for HCI_EV_DISCONN_COMPLETE, not HCI_EV_CMD_STATUS, when the
5428 * reason is anything but HCI_ERROR_REMOTE_POWER_OFF. This reason is
5429 * used when suspending or powering off, where we don't want to wait
5430 * for the peer's response.
5431 */
5432 if (reason != HCI_ERROR_REMOTE_POWER_OFF)
5433 return __hci_cmd_sync_status_sk(hdev, HCI_OP_DISCONNECT,
5434 sizeof(cp), &cp,
5435 HCI_EV_DISCONN_COMPLETE,
5436 HCI_CMD_TIMEOUT, NULL);
5437
5438 return __hci_cmd_sync_status(hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp,
5439 HCI_CMD_TIMEOUT);
5440 }
5441
hci_le_connect_cancel_sync(struct hci_dev * hdev,struct hci_conn * conn,u8 reason)5442 static int hci_le_connect_cancel_sync(struct hci_dev *hdev,
5443 struct hci_conn *conn, u8 reason)
5444 {
5445 /* Return reason if scanning since the connection shall probably be
5446 * cleanup directly.
5447 */
5448 if (test_bit(HCI_CONN_SCANNING, &conn->flags))
5449 return reason;
5450
5451 if (conn->role == HCI_ROLE_SLAVE ||
5452 test_and_set_bit(HCI_CONN_CANCEL, &conn->flags))
5453 return 0;
5454
5455 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CREATE_CONN_CANCEL,
5456 0, NULL, HCI_CMD_TIMEOUT);
5457 }
5458
hci_connect_cancel_sync(struct hci_dev * hdev,struct hci_conn * conn,u8 reason)5459 static int hci_connect_cancel_sync(struct hci_dev *hdev, struct hci_conn *conn,
5460 u8 reason)
5461 {
5462 if (conn->type == LE_LINK)
5463 return hci_le_connect_cancel_sync(hdev, conn, reason);
5464
5465 if (conn->type == ISO_LINK) {
5466 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
5467 * page 1857:
5468 *
5469 * If this command is issued for a CIS on the Central and the
5470 * CIS is successfully terminated before being established,
5471 * then an HCI_LE_CIS_Established event shall also be sent for
5472 * this CIS with the Status Operation Cancelled by Host (0x44).
5473 */
5474 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags))
5475 return hci_disconnect_sync(hdev, conn, reason);
5476
5477 /* CIS with no Create CIS sent have nothing to cancel */
5478 if (bacmp(&conn->dst, BDADDR_ANY))
5479 return HCI_ERROR_LOCAL_HOST_TERM;
5480
5481 /* There is no way to cancel a BIS without terminating the BIG
5482 * which is done later on connection cleanup.
5483 */
5484 return 0;
5485 }
5486
5487 if (hdev->hci_ver < BLUETOOTH_VER_1_2)
5488 return 0;
5489
5490 /* Wait for HCI_EV_CONN_COMPLETE, not HCI_EV_CMD_STATUS, when the
5491 * reason is anything but HCI_ERROR_REMOTE_POWER_OFF. This reason is
5492 * used when suspending or powering off, where we don't want to wait
5493 * for the peer's response.
5494 */
5495 if (reason != HCI_ERROR_REMOTE_POWER_OFF)
5496 return __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN_CANCEL,
5497 6, &conn->dst,
5498 HCI_EV_CONN_COMPLETE,
5499 HCI_CMD_TIMEOUT, NULL);
5500
5501 return __hci_cmd_sync_status(hdev, HCI_OP_CREATE_CONN_CANCEL,
5502 6, &conn->dst, HCI_CMD_TIMEOUT);
5503 }
5504
hci_reject_sco_sync(struct hci_dev * hdev,struct hci_conn * conn,u8 reason)5505 static int hci_reject_sco_sync(struct hci_dev *hdev, struct hci_conn *conn,
5506 u8 reason)
5507 {
5508 struct hci_cp_reject_sync_conn_req cp;
5509
5510 memset(&cp, 0, sizeof(cp));
5511 bacpy(&cp.bdaddr, &conn->dst);
5512 cp.reason = reason;
5513
5514 /* SCO rejection has its own limited set of
5515 * allowed error values (0x0D-0x0F).
5516 */
5517 if (reason < 0x0d || reason > 0x0f)
5518 cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES;
5519
5520 return __hci_cmd_sync_status(hdev, HCI_OP_REJECT_SYNC_CONN_REQ,
5521 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5522 }
5523
hci_le_reject_cis_sync(struct hci_dev * hdev,struct hci_conn * conn,u8 reason)5524 static int hci_le_reject_cis_sync(struct hci_dev *hdev, struct hci_conn *conn,
5525 u8 reason)
5526 {
5527 struct hci_cp_le_reject_cis cp;
5528
5529 memset(&cp, 0, sizeof(cp));
5530 cp.handle = cpu_to_le16(conn->handle);
5531 cp.reason = reason;
5532
5533 return __hci_cmd_sync_status(hdev, HCI_OP_LE_REJECT_CIS,
5534 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5535 }
5536
hci_reject_conn_sync(struct hci_dev * hdev,struct hci_conn * conn,u8 reason)5537 static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn,
5538 u8 reason)
5539 {
5540 struct hci_cp_reject_conn_req cp;
5541
5542 if (conn->type == ISO_LINK)
5543 return hci_le_reject_cis_sync(hdev, conn, reason);
5544
5545 if (conn->type == SCO_LINK || conn->type == ESCO_LINK)
5546 return hci_reject_sco_sync(hdev, conn, reason);
5547
5548 memset(&cp, 0, sizeof(cp));
5549 bacpy(&cp.bdaddr, &conn->dst);
5550 cp.reason = reason;
5551
5552 return __hci_cmd_sync_status(hdev, HCI_OP_REJECT_CONN_REQ,
5553 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5554 }
5555
hci_abort_conn_sync(struct hci_dev * hdev,struct hci_conn * conn,u8 reason)5556 int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason)
5557 {
5558 int err = 0;
5559 u16 handle = conn->handle;
5560 bool disconnect = false;
5561 struct hci_conn *c;
5562
5563 switch (conn->state) {
5564 case BT_CONNECTED:
5565 case BT_CONFIG:
5566 err = hci_disconnect_sync(hdev, conn, reason);
5567 break;
5568 case BT_CONNECT:
5569 err = hci_connect_cancel_sync(hdev, conn, reason);
5570 break;
5571 case BT_CONNECT2:
5572 err = hci_reject_conn_sync(hdev, conn, reason);
5573 break;
5574 case BT_OPEN:
5575 case BT_BOUND:
5576 break;
5577 default:
5578 disconnect = true;
5579 break;
5580 }
5581
5582 hci_dev_lock(hdev);
5583
5584 /* Check if the connection has been cleaned up concurrently */
5585 c = hci_conn_hash_lookup_handle(hdev, handle);
5586 if (!c || c != conn) {
5587 err = 0;
5588 goto unlock;
5589 }
5590
5591 /* Cleanup hci_conn object if it cannot be cancelled as it
5592 * likelly means the controller and host stack are out of sync
5593 * or in case of LE it was still scanning so it can be cleanup
5594 * safely.
5595 */
5596 if (disconnect) {
5597 conn->state = BT_CLOSED;
5598 hci_disconn_cfm(conn, reason);
5599 hci_conn_del(conn);
5600 } else {
5601 hci_conn_failed(conn, reason);
5602 }
5603
5604 unlock:
5605 hci_dev_unlock(hdev);
5606 return err;
5607 }
5608
hci_disconnect_all_sync(struct hci_dev * hdev,u8 reason)5609 static int hci_disconnect_all_sync(struct hci_dev *hdev, u8 reason)
5610 {
5611 struct list_head *head = &hdev->conn_hash.list;
5612 struct hci_conn *conn;
5613
5614 rcu_read_lock();
5615 while ((conn = list_first_or_null_rcu(head, struct hci_conn, list))) {
5616 /* Make sure the connection is not freed while unlocking */
5617 conn = hci_conn_get(conn);
5618 rcu_read_unlock();
5619 /* Disregard possible errors since hci_conn_del shall have been
5620 * called even in case of errors had occurred since it would
5621 * then cause hci_conn_failed to be called which calls
5622 * hci_conn_del internally.
5623 */
5624 hci_abort_conn_sync(hdev, conn, reason);
5625 hci_conn_put(conn);
5626 rcu_read_lock();
5627 }
5628 rcu_read_unlock();
5629
5630 return 0;
5631 }
5632
5633 /* This function perform power off HCI command sequence as follows:
5634 *
5635 * Clear Advertising
5636 * Stop Discovery
5637 * Disconnect all connections
5638 * hci_dev_close_sync
5639 */
hci_power_off_sync(struct hci_dev * hdev)5640 static int hci_power_off_sync(struct hci_dev *hdev)
5641 {
5642 int err;
5643
5644 /* If controller is already down there is nothing to do */
5645 if (!test_bit(HCI_UP, &hdev->flags))
5646 return 0;
5647
5648 if (test_bit(HCI_ISCAN, &hdev->flags) ||
5649 test_bit(HCI_PSCAN, &hdev->flags)) {
5650 err = hci_write_scan_enable_sync(hdev, 0x00);
5651 if (err)
5652 return err;
5653 }
5654
5655 err = hci_clear_adv_sync(hdev, NULL, false);
5656 if (err)
5657 return err;
5658
5659 err = hci_stop_discovery_sync(hdev);
5660 if (err)
5661 return err;
5662
5663 /* Terminated due to Power Off */
5664 err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF);
5665 if (err)
5666 return err;
5667
5668 return hci_dev_close_sync(hdev);
5669 }
5670
hci_set_powered_sync(struct hci_dev * hdev,u8 val)5671 int hci_set_powered_sync(struct hci_dev *hdev, u8 val)
5672 {
5673 if (val)
5674 return hci_power_on_sync(hdev);
5675
5676 return hci_power_off_sync(hdev);
5677 }
5678
hci_write_iac_sync(struct hci_dev * hdev)5679 static int hci_write_iac_sync(struct hci_dev *hdev)
5680 {
5681 struct hci_cp_write_current_iac_lap cp;
5682
5683 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE))
5684 return 0;
5685
5686 memset(&cp, 0, sizeof(cp));
5687
5688 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) {
5689 /* Limited discoverable mode */
5690 cp.num_iac = min_t(u8, hdev->num_iac, 2);
5691 cp.iac_lap[0] = 0x00; /* LIAC */
5692 cp.iac_lap[1] = 0x8b;
5693 cp.iac_lap[2] = 0x9e;
5694 cp.iac_lap[3] = 0x33; /* GIAC */
5695 cp.iac_lap[4] = 0x8b;
5696 cp.iac_lap[5] = 0x9e;
5697 } else {
5698 /* General discoverable mode */
5699 cp.num_iac = 1;
5700 cp.iac_lap[0] = 0x33; /* GIAC */
5701 cp.iac_lap[1] = 0x8b;
5702 cp.iac_lap[2] = 0x9e;
5703 }
5704
5705 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CURRENT_IAC_LAP,
5706 (cp.num_iac * 3) + 1, &cp,
5707 HCI_CMD_TIMEOUT);
5708 }
5709
hci_update_discoverable_sync(struct hci_dev * hdev)5710 int hci_update_discoverable_sync(struct hci_dev *hdev)
5711 {
5712 int err = 0;
5713
5714 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) {
5715 err = hci_write_iac_sync(hdev);
5716 if (err)
5717 return err;
5718
5719 err = hci_update_scan_sync(hdev);
5720 if (err)
5721 return err;
5722
5723 err = hci_update_class_sync(hdev);
5724 if (err)
5725 return err;
5726 }
5727
5728 /* Advertising instances don't use the global discoverable setting, so
5729 * only update AD if advertising was enabled using Set Advertising.
5730 */
5731 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) {
5732 err = hci_update_adv_data_sync(hdev, 0x00);
5733 if (err)
5734 return err;
5735
5736 /* Discoverable mode affects the local advertising
5737 * address in limited privacy mode.
5738 */
5739 if (hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) {
5740 if (ext_adv_capable(hdev))
5741 err = hci_start_ext_adv_sync(hdev, 0x00);
5742 else
5743 err = hci_enable_advertising_sync(hdev);
5744 }
5745 }
5746
5747 return err;
5748 }
5749
update_discoverable_sync(struct hci_dev * hdev,void * data)5750 static int update_discoverable_sync(struct hci_dev *hdev, void *data)
5751 {
5752 return hci_update_discoverable_sync(hdev);
5753 }
5754
hci_update_discoverable(struct hci_dev * hdev)5755 int hci_update_discoverable(struct hci_dev *hdev)
5756 {
5757 /* Only queue if it would have any effect */
5758 if (hdev_is_powered(hdev) &&
5759 hci_dev_test_flag(hdev, HCI_ADVERTISING) &&
5760 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) &&
5761 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY))
5762 return hci_cmd_sync_queue(hdev, update_discoverable_sync, NULL,
5763 NULL);
5764
5765 return 0;
5766 }
5767
hci_update_connectable_sync(struct hci_dev * hdev)5768 int hci_update_connectable_sync(struct hci_dev *hdev)
5769 {
5770 int err;
5771
5772 err = hci_update_scan_sync(hdev);
5773 if (err)
5774 return err;
5775
5776 /* If BR/EDR is not enabled and we disable advertising as a
5777 * by-product of disabling connectable, we need to update the
5778 * advertising flags.
5779 */
5780 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
5781 err = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance);
5782
5783 /* Update the advertising parameters if necessary */
5784 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) ||
5785 !list_empty(&hdev->adv_instances)) {
5786 if (ext_adv_capable(hdev))
5787 err = hci_start_ext_adv_sync(hdev,
5788 hdev->cur_adv_instance);
5789 else
5790 err = hci_enable_advertising_sync(hdev);
5791
5792 if (err)
5793 return err;
5794 }
5795
5796 return hci_update_passive_scan_sync(hdev);
5797 }
5798
hci_inquiry_sync(struct hci_dev * hdev,u8 length)5799 static int hci_inquiry_sync(struct hci_dev *hdev, u8 length)
5800 {
5801 const u8 giac[3] = { 0x33, 0x8b, 0x9e };
5802 const u8 liac[3] = { 0x00, 0x8b, 0x9e };
5803 struct hci_cp_inquiry cp;
5804
5805 bt_dev_dbg(hdev, "");
5806
5807 if (test_bit(HCI_INQUIRY, &hdev->flags))
5808 return 0;
5809
5810 hci_dev_lock(hdev);
5811 hci_inquiry_cache_flush(hdev);
5812 hci_dev_unlock(hdev);
5813
5814 memset(&cp, 0, sizeof(cp));
5815
5816 if (hdev->discovery.limited)
5817 memcpy(&cp.lap, liac, sizeof(cp.lap));
5818 else
5819 memcpy(&cp.lap, giac, sizeof(cp.lap));
5820
5821 cp.length = length;
5822
5823 return __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY,
5824 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
5825 }
5826
hci_active_scan_sync(struct hci_dev * hdev,uint16_t interval)5827 static int hci_active_scan_sync(struct hci_dev *hdev, uint16_t interval)
5828 {
5829 u8 own_addr_type;
5830 /* Accept list is not used for discovery */
5831 u8 filter_policy = 0x00;
5832 /* Default is to enable duplicates filter */
5833 u8 filter_dup = LE_SCAN_FILTER_DUP_ENABLE;
5834 int err;
5835
5836 bt_dev_dbg(hdev, "");
5837
5838 /* If controller is scanning, it means the passive scanning is
5839 * running. Thus, we should temporarily stop it in order to set the
5840 * discovery scanning parameters.
5841 */
5842 err = hci_scan_disable_sync(hdev);
5843 if (err) {
5844 bt_dev_err(hdev, "Unable to disable scanning: %d", err);
5845 return err;
5846 }
5847
5848 cancel_interleave_scan(hdev);
5849
5850 /* Pause address resolution for active scan and stop advertising if
5851 * privacy is enabled.
5852 */
5853 err = hci_pause_addr_resolution(hdev);
5854 if (err)
5855 goto failed;
5856
5857 /* All active scans will be done with either a resolvable private
5858 * address (when privacy feature has been enabled) or non-resolvable
5859 * private address.
5860 */
5861 err = hci_update_random_address_sync(hdev, true, scan_use_rpa(hdev),
5862 &own_addr_type);
5863 if (err < 0)
5864 own_addr_type = ADDR_LE_DEV_PUBLIC;
5865
5866 if (hci_is_adv_monitoring(hdev)) {
5867 /* Duplicate filter should be disabled when some advertisement
5868 * monitor is activated, otherwise AdvMon can only receive one
5869 * advertisement for one peer(*) during active scanning, and
5870 * might report loss to these peers.
5871 *
5872 * Note that different controllers have different meanings of
5873 * |duplicate|. Some of them consider packets with the same
5874 * address as duplicate, and others consider packets with the
5875 * same address and the same RSSI as duplicate. Although in the
5876 * latter case we don't need to disable duplicate filter, but
5877 * it is common to have active scanning for a short period of
5878 * time, the power impact should be neglectable.
5879 */
5880 filter_dup = LE_SCAN_FILTER_DUP_DISABLE;
5881 }
5882
5883 err = hci_start_scan_sync(hdev, LE_SCAN_ACTIVE, interval,
5884 hdev->le_scan_window_discovery,
5885 own_addr_type, filter_policy, filter_dup);
5886 if (!err)
5887 return err;
5888
5889 failed:
5890 /* Resume advertising if it was paused */
5891 if (use_ll_privacy(hdev))
5892 hci_resume_advertising_sync(hdev);
5893
5894 /* Resume passive scanning */
5895 hci_update_passive_scan_sync(hdev);
5896 return err;
5897 }
5898
hci_start_interleaved_discovery_sync(struct hci_dev * hdev)5899 static int hci_start_interleaved_discovery_sync(struct hci_dev *hdev)
5900 {
5901 int err;
5902
5903 bt_dev_dbg(hdev, "");
5904
5905 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery * 2);
5906 if (err)
5907 return err;
5908
5909 return hci_inquiry_sync(hdev, DISCOV_BREDR_INQUIRY_LEN);
5910 }
5911
hci_start_discovery_sync(struct hci_dev * hdev)5912 int hci_start_discovery_sync(struct hci_dev *hdev)
5913 {
5914 unsigned long timeout;
5915 int err;
5916
5917 bt_dev_dbg(hdev, "type %u", hdev->discovery.type);
5918
5919 switch (hdev->discovery.type) {
5920 case DISCOV_TYPE_BREDR:
5921 return hci_inquiry_sync(hdev, DISCOV_BREDR_INQUIRY_LEN);
5922 case DISCOV_TYPE_INTERLEAVED:
5923 /* When running simultaneous discovery, the LE scanning time
5924 * should occupy the whole discovery time sine BR/EDR inquiry
5925 * and LE scanning are scheduled by the controller.
5926 *
5927 * For interleaving discovery in comparison, BR/EDR inquiry
5928 * and LE scanning are done sequentially with separate
5929 * timeouts.
5930 */
5931 if (test_bit(HCI_QUIRK_SIMULTANEOUS_DISCOVERY,
5932 &hdev->quirks)) {
5933 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
5934 /* During simultaneous discovery, we double LE scan
5935 * interval. We must leave some time for the controller
5936 * to do BR/EDR inquiry.
5937 */
5938 err = hci_start_interleaved_discovery_sync(hdev);
5939 break;
5940 }
5941
5942 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout);
5943 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery);
5944 break;
5945 case DISCOV_TYPE_LE:
5946 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT);
5947 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery);
5948 break;
5949 default:
5950 return -EINVAL;
5951 }
5952
5953 if (err)
5954 return err;
5955
5956 bt_dev_dbg(hdev, "timeout %u ms", jiffies_to_msecs(timeout));
5957
5958 /* When service discovery is used and the controller has a
5959 * strict duplicate filter, it is important to remember the
5960 * start and duration of the scan. This is required for
5961 * restarting scanning during the discovery phase.
5962 */
5963 if (test_bit(HCI_QUIRK_STRICT_DUPLICATE_FILTER, &hdev->quirks) &&
5964 hdev->discovery.result_filtering) {
5965 hdev->discovery.scan_start = jiffies;
5966 hdev->discovery.scan_duration = timeout;
5967 }
5968
5969 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_disable,
5970 timeout);
5971 return 0;
5972 }
5973
hci_suspend_monitor_sync(struct hci_dev * hdev)5974 static void hci_suspend_monitor_sync(struct hci_dev *hdev)
5975 {
5976 switch (hci_get_adv_monitor_offload_ext(hdev)) {
5977 case HCI_ADV_MONITOR_EXT_MSFT:
5978 msft_suspend_sync(hdev);
5979 break;
5980 default:
5981 return;
5982 }
5983 }
5984
5985 /* This function disables discovery and mark it as paused */
hci_pause_discovery_sync(struct hci_dev * hdev)5986 static int hci_pause_discovery_sync(struct hci_dev *hdev)
5987 {
5988 int old_state = hdev->discovery.state;
5989 int err;
5990
5991 /* If discovery already stopped/stopping/paused there nothing to do */
5992 if (old_state == DISCOVERY_STOPPED || old_state == DISCOVERY_STOPPING ||
5993 hdev->discovery_paused)
5994 return 0;
5995
5996 hci_discovery_set_state(hdev, DISCOVERY_STOPPING);
5997 err = hci_stop_discovery_sync(hdev);
5998 if (err)
5999 return err;
6000
6001 hdev->discovery_paused = true;
6002 hdev->discovery_old_state = old_state;
6003 hci_discovery_set_state(hdev, DISCOVERY_STOPPED);
6004
6005 return 0;
6006 }
6007
hci_update_event_filter_sync(struct hci_dev * hdev)6008 static int hci_update_event_filter_sync(struct hci_dev *hdev)
6009 {
6010 struct bdaddr_list_with_flags *b;
6011 u8 scan = SCAN_DISABLED;
6012 bool scanning = test_bit(HCI_PSCAN, &hdev->flags);
6013 int err;
6014
6015 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))
6016 return 0;
6017
6018 /* Some fake CSR controllers lock up after setting this type of
6019 * filter, so avoid sending the request altogether.
6020 */
6021 if (test_bit(HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL, &hdev->quirks))
6022 return 0;
6023
6024 /* Always clear event filter when starting */
6025 hci_clear_event_filter_sync(hdev);
6026
6027 list_for_each_entry(b, &hdev->accept_list, list) {
6028 if (!(b->flags & HCI_CONN_FLAG_REMOTE_WAKEUP))
6029 continue;
6030
6031 bt_dev_dbg(hdev, "Adding event filters for %pMR", &b->bdaddr);
6032
6033 err = hci_set_event_filter_sync(hdev, HCI_FLT_CONN_SETUP,
6034 HCI_CONN_SETUP_ALLOW_BDADDR,
6035 &b->bdaddr,
6036 HCI_CONN_SETUP_AUTO_ON);
6037 if (err)
6038 bt_dev_dbg(hdev, "Failed to set event filter for %pMR",
6039 &b->bdaddr);
6040 else
6041 scan = SCAN_PAGE;
6042 }
6043
6044 if (scan && !scanning)
6045 hci_write_scan_enable_sync(hdev, scan);
6046 else if (!scan && scanning)
6047 hci_write_scan_enable_sync(hdev, scan);
6048
6049 return 0;
6050 }
6051
6052 /* This function disables scan (BR and LE) and mark it as paused */
hci_pause_scan_sync(struct hci_dev * hdev)6053 static int hci_pause_scan_sync(struct hci_dev *hdev)
6054 {
6055 if (hdev->scanning_paused)
6056 return 0;
6057
6058 /* Disable page scan if enabled */
6059 if (test_bit(HCI_PSCAN, &hdev->flags))
6060 hci_write_scan_enable_sync(hdev, SCAN_DISABLED);
6061
6062 hci_scan_disable_sync(hdev);
6063
6064 hdev->scanning_paused = true;
6065
6066 return 0;
6067 }
6068
6069 /* This function performs the HCI suspend procedures in the follow order:
6070 *
6071 * Pause discovery (active scanning/inquiry)
6072 * Pause Directed Advertising/Advertising
6073 * Pause Scanning (passive scanning in case discovery was not active)
6074 * Disconnect all connections
6075 * Set suspend_status to BT_SUSPEND_DISCONNECT if hdev cannot wakeup
6076 * otherwise:
6077 * Update event mask (only set events that are allowed to wake up the host)
6078 * Update event filter (with devices marked with HCI_CONN_FLAG_REMOTE_WAKEUP)
6079 * Update passive scanning (lower duty cycle)
6080 * Set suspend_status to BT_SUSPEND_CONFIGURE_WAKE
6081 */
hci_suspend_sync(struct hci_dev * hdev)6082 int hci_suspend_sync(struct hci_dev *hdev)
6083 {
6084 int err;
6085
6086 /* If marked as suspended there nothing to do */
6087 if (hdev->suspended)
6088 return 0;
6089
6090 /* Mark device as suspended */
6091 hdev->suspended = true;
6092
6093 /* Pause discovery if not already stopped */
6094 hci_pause_discovery_sync(hdev);
6095
6096 /* Pause other advertisements */
6097 hci_pause_advertising_sync(hdev);
6098
6099 /* Suspend monitor filters */
6100 hci_suspend_monitor_sync(hdev);
6101
6102 /* Prevent disconnects from causing scanning to be re-enabled */
6103 hci_pause_scan_sync(hdev);
6104
6105 if (hci_conn_count(hdev)) {
6106 /* Soft disconnect everything (power off) */
6107 err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF);
6108 if (err) {
6109 /* Set state to BT_RUNNING so resume doesn't notify */
6110 hdev->suspend_state = BT_RUNNING;
6111 hci_resume_sync(hdev);
6112 return err;
6113 }
6114
6115 /* Update event mask so only the allowed event can wakeup the
6116 * host.
6117 */
6118 hci_set_event_mask_sync(hdev);
6119 }
6120
6121 /* Only configure accept list if disconnect succeeded and wake
6122 * isn't being prevented.
6123 */
6124 if (!hdev->wakeup || !hdev->wakeup(hdev)) {
6125 hdev->suspend_state = BT_SUSPEND_DISCONNECT;
6126 return 0;
6127 }
6128
6129 /* Unpause to take care of updating scanning params */
6130 hdev->scanning_paused = false;
6131
6132 /* Enable event filter for paired devices */
6133 hci_update_event_filter_sync(hdev);
6134
6135 /* Update LE passive scan if enabled */
6136 hci_update_passive_scan_sync(hdev);
6137
6138 /* Pause scan changes again. */
6139 hdev->scanning_paused = true;
6140
6141 hdev->suspend_state = BT_SUSPEND_CONFIGURE_WAKE;
6142
6143 return 0;
6144 }
6145
6146 /* This function resumes discovery */
hci_resume_discovery_sync(struct hci_dev * hdev)6147 static int hci_resume_discovery_sync(struct hci_dev *hdev)
6148 {
6149 int err;
6150
6151 /* If discovery not paused there nothing to do */
6152 if (!hdev->discovery_paused)
6153 return 0;
6154
6155 hdev->discovery_paused = false;
6156
6157 hci_discovery_set_state(hdev, DISCOVERY_STARTING);
6158
6159 err = hci_start_discovery_sync(hdev);
6160
6161 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED :
6162 DISCOVERY_FINDING);
6163
6164 return err;
6165 }
6166
hci_resume_monitor_sync(struct hci_dev * hdev)6167 static void hci_resume_monitor_sync(struct hci_dev *hdev)
6168 {
6169 switch (hci_get_adv_monitor_offload_ext(hdev)) {
6170 case HCI_ADV_MONITOR_EXT_MSFT:
6171 msft_resume_sync(hdev);
6172 break;
6173 default:
6174 return;
6175 }
6176 }
6177
6178 /* This function resume scan and reset paused flag */
hci_resume_scan_sync(struct hci_dev * hdev)6179 static int hci_resume_scan_sync(struct hci_dev *hdev)
6180 {
6181 if (!hdev->scanning_paused)
6182 return 0;
6183
6184 hdev->scanning_paused = false;
6185
6186 hci_update_scan_sync(hdev);
6187
6188 /* Reset passive scanning to normal */
6189 hci_update_passive_scan_sync(hdev);
6190
6191 return 0;
6192 }
6193
6194 /* This function performs the HCI suspend procedures in the follow order:
6195 *
6196 * Restore event mask
6197 * Clear event filter
6198 * Update passive scanning (normal duty cycle)
6199 * Resume Directed Advertising/Advertising
6200 * Resume discovery (active scanning/inquiry)
6201 */
hci_resume_sync(struct hci_dev * hdev)6202 int hci_resume_sync(struct hci_dev *hdev)
6203 {
6204 /* If not marked as suspended there nothing to do */
6205 if (!hdev->suspended)
6206 return 0;
6207
6208 hdev->suspended = false;
6209
6210 /* Restore event mask */
6211 hci_set_event_mask_sync(hdev);
6212
6213 /* Clear any event filters and restore scan state */
6214 hci_clear_event_filter_sync(hdev);
6215
6216 /* Resume scanning */
6217 hci_resume_scan_sync(hdev);
6218
6219 /* Resume monitor filters */
6220 hci_resume_monitor_sync(hdev);
6221
6222 /* Resume other advertisements */
6223 hci_resume_advertising_sync(hdev);
6224
6225 /* Resume discovery */
6226 hci_resume_discovery_sync(hdev);
6227
6228 return 0;
6229 }
6230
conn_use_rpa(struct hci_conn * conn)6231 static bool conn_use_rpa(struct hci_conn *conn)
6232 {
6233 struct hci_dev *hdev = conn->hdev;
6234
6235 return hci_dev_test_flag(hdev, HCI_PRIVACY);
6236 }
6237
hci_le_ext_directed_advertising_sync(struct hci_dev * hdev,struct hci_conn * conn)6238 static int hci_le_ext_directed_advertising_sync(struct hci_dev *hdev,
6239 struct hci_conn *conn)
6240 {
6241 struct hci_cp_le_set_ext_adv_params cp;
6242 int err;
6243 bdaddr_t random_addr;
6244 u8 own_addr_type;
6245
6246 err = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn),
6247 &own_addr_type);
6248 if (err)
6249 return err;
6250
6251 /* Set require_privacy to false so that the remote device has a
6252 * chance of identifying us.
6253 */
6254 err = hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL,
6255 &own_addr_type, &random_addr);
6256 if (err)
6257 return err;
6258
6259 memset(&cp, 0, sizeof(cp));
6260
6261 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND);
6262 cp.channel_map = hdev->le_adv_channel_map;
6263 cp.tx_power = HCI_TX_POWER_INVALID;
6264 cp.primary_phy = HCI_ADV_PHY_1M;
6265 cp.secondary_phy = HCI_ADV_PHY_1M;
6266 cp.handle = 0x00; /* Use instance 0 for directed adv */
6267 cp.own_addr_type = own_addr_type;
6268 cp.peer_addr_type = conn->dst_type;
6269 bacpy(&cp.peer_addr, &conn->dst);
6270
6271 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for
6272 * advertising_event_property LE_LEGACY_ADV_DIRECT_IND
6273 * does not supports advertising data when the advertising set already
6274 * contains some, the controller shall return erroc code 'Invalid
6275 * HCI Command Parameters(0x12).
6276 * So it is required to remove adv set for handle 0x00. since we use
6277 * instance 0 for directed adv.
6278 */
6279 err = hci_remove_ext_adv_instance_sync(hdev, cp.handle, NULL);
6280 if (err)
6281 return err;
6282
6283 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS,
6284 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
6285 if (err)
6286 return err;
6287
6288 /* Check if random address need to be updated */
6289 if (own_addr_type == ADDR_LE_DEV_RANDOM &&
6290 bacmp(&random_addr, BDADDR_ANY) &&
6291 bacmp(&random_addr, &hdev->random_addr)) {
6292 err = hci_set_adv_set_random_addr_sync(hdev, 0x00,
6293 &random_addr);
6294 if (err)
6295 return err;
6296 }
6297
6298 return hci_enable_ext_advertising_sync(hdev, 0x00);
6299 }
6300
hci_le_directed_advertising_sync(struct hci_dev * hdev,struct hci_conn * conn)6301 static int hci_le_directed_advertising_sync(struct hci_dev *hdev,
6302 struct hci_conn *conn)
6303 {
6304 struct hci_cp_le_set_adv_param cp;
6305 u8 status;
6306 u8 own_addr_type;
6307 u8 enable;
6308
6309 if (ext_adv_capable(hdev))
6310 return hci_le_ext_directed_advertising_sync(hdev, conn);
6311
6312 /* Clear the HCI_LE_ADV bit temporarily so that the
6313 * hci_update_random_address knows that it's safe to go ahead
6314 * and write a new random address. The flag will be set back on
6315 * as soon as the SET_ADV_ENABLE HCI command completes.
6316 */
6317 hci_dev_clear_flag(hdev, HCI_LE_ADV);
6318
6319 /* Set require_privacy to false so that the remote device has a
6320 * chance of identifying us.
6321 */
6322 status = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn),
6323 &own_addr_type);
6324 if (status)
6325 return status;
6326
6327 memset(&cp, 0, sizeof(cp));
6328
6329 /* Some controllers might reject command if intervals are not
6330 * within range for undirected advertising.
6331 * BCM20702A0 is known to be affected by this.
6332 */
6333 cp.min_interval = cpu_to_le16(0x0020);
6334 cp.max_interval = cpu_to_le16(0x0020);
6335
6336 cp.type = LE_ADV_DIRECT_IND;
6337 cp.own_address_type = own_addr_type;
6338 cp.direct_addr_type = conn->dst_type;
6339 bacpy(&cp.direct_addr, &conn->dst);
6340 cp.channel_map = hdev->le_adv_channel_map;
6341
6342 status = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_PARAM,
6343 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
6344 if (status)
6345 return status;
6346
6347 enable = 0x01;
6348
6349 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE,
6350 sizeof(enable), &enable, HCI_CMD_TIMEOUT);
6351 }
6352
set_ext_conn_params(struct hci_conn * conn,struct hci_cp_le_ext_conn_param * p)6353 static void set_ext_conn_params(struct hci_conn *conn,
6354 struct hci_cp_le_ext_conn_param *p)
6355 {
6356 struct hci_dev *hdev = conn->hdev;
6357
6358 memset(p, 0, sizeof(*p));
6359
6360 p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
6361 p->scan_window = cpu_to_le16(hdev->le_scan_window_connect);
6362 p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
6363 p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
6364 p->conn_latency = cpu_to_le16(conn->le_conn_latency);
6365 p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
6366 p->min_ce_len = cpu_to_le16(0x0000);
6367 p->max_ce_len = cpu_to_le16(0x0000);
6368 }
6369
hci_le_ext_create_conn_sync(struct hci_dev * hdev,struct hci_conn * conn,u8 own_addr_type)6370 static int hci_le_ext_create_conn_sync(struct hci_dev *hdev,
6371 struct hci_conn *conn, u8 own_addr_type)
6372 {
6373 struct hci_cp_le_ext_create_conn *cp;
6374 struct hci_cp_le_ext_conn_param *p;
6375 u8 data[sizeof(*cp) + sizeof(*p) * 3];
6376 u32 plen;
6377
6378 cp = (void *)data;
6379 p = (void *)cp->data;
6380
6381 memset(cp, 0, sizeof(*cp));
6382
6383 bacpy(&cp->peer_addr, &conn->dst);
6384 cp->peer_addr_type = conn->dst_type;
6385 cp->own_addr_type = own_addr_type;
6386
6387 plen = sizeof(*cp);
6388
6389 if (scan_1m(hdev)) {
6390 cp->phys |= LE_SCAN_PHY_1M;
6391 set_ext_conn_params(conn, p);
6392
6393 p++;
6394 plen += sizeof(*p);
6395 }
6396
6397 if (scan_2m(hdev)) {
6398 cp->phys |= LE_SCAN_PHY_2M;
6399 set_ext_conn_params(conn, p);
6400
6401 p++;
6402 plen += sizeof(*p);
6403 }
6404
6405 if (scan_coded(hdev)) {
6406 cp->phys |= LE_SCAN_PHY_CODED;
6407 set_ext_conn_params(conn, p);
6408
6409 plen += sizeof(*p);
6410 }
6411
6412 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_EXT_CREATE_CONN,
6413 plen, data,
6414 HCI_EV_LE_ENHANCED_CONN_COMPLETE,
6415 conn->conn_timeout, NULL);
6416 }
6417
hci_le_create_conn_sync(struct hci_dev * hdev,void * data)6418 static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data)
6419 {
6420 struct hci_cp_le_create_conn cp;
6421 struct hci_conn_params *params;
6422 u8 own_addr_type;
6423 int err;
6424 struct hci_conn *conn = data;
6425
6426 if (!hci_conn_valid(hdev, conn))
6427 return -ECANCELED;
6428
6429 bt_dev_dbg(hdev, "conn %p", conn);
6430
6431 clear_bit(HCI_CONN_SCANNING, &conn->flags);
6432 conn->state = BT_CONNECT;
6433
6434 /* If requested to connect as peripheral use directed advertising */
6435 if (conn->role == HCI_ROLE_SLAVE) {
6436 /* If we're active scanning and simultaneous roles is not
6437 * enabled simply reject the attempt.
6438 */
6439 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) &&
6440 hdev->le_scan_type == LE_SCAN_ACTIVE &&
6441 !hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) {
6442 hci_conn_del(conn);
6443 return -EBUSY;
6444 }
6445
6446 /* Pause advertising while doing directed advertising. */
6447 hci_pause_advertising_sync(hdev);
6448
6449 err = hci_le_directed_advertising_sync(hdev, conn);
6450 goto done;
6451 }
6452
6453 /* Disable advertising if simultaneous roles is not in use. */
6454 if (!hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES))
6455 hci_pause_advertising_sync(hdev);
6456
6457 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type);
6458 if (params) {
6459 conn->le_conn_min_interval = params->conn_min_interval;
6460 conn->le_conn_max_interval = params->conn_max_interval;
6461 conn->le_conn_latency = params->conn_latency;
6462 conn->le_supv_timeout = params->supervision_timeout;
6463 } else {
6464 conn->le_conn_min_interval = hdev->le_conn_min_interval;
6465 conn->le_conn_max_interval = hdev->le_conn_max_interval;
6466 conn->le_conn_latency = hdev->le_conn_latency;
6467 conn->le_supv_timeout = hdev->le_supv_timeout;
6468 }
6469
6470 /* If controller is scanning, we stop it since some controllers are
6471 * not able to scan and connect at the same time. Also set the
6472 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete
6473 * handler for scan disabling knows to set the correct discovery
6474 * state.
6475 */
6476 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) {
6477 hci_scan_disable_sync(hdev);
6478 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED);
6479 }
6480
6481 /* Update random address, but set require_privacy to false so
6482 * that we never connect with an non-resolvable address.
6483 */
6484 err = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn),
6485 &own_addr_type);
6486 if (err)
6487 goto done;
6488
6489 if (use_ext_conn(hdev)) {
6490 err = hci_le_ext_create_conn_sync(hdev, conn, own_addr_type);
6491 goto done;
6492 }
6493
6494 memset(&cp, 0, sizeof(cp));
6495
6496 cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect);
6497 cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect);
6498
6499 bacpy(&cp.peer_addr, &conn->dst);
6500 cp.peer_addr_type = conn->dst_type;
6501 cp.own_address_type = own_addr_type;
6502 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval);
6503 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval);
6504 cp.conn_latency = cpu_to_le16(conn->le_conn_latency);
6505 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout);
6506 cp.min_ce_len = cpu_to_le16(0x0000);
6507 cp.max_ce_len = cpu_to_le16(0x0000);
6508
6509 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2261:
6510 *
6511 * If this event is unmasked and the HCI_LE_Connection_Complete event
6512 * is unmasked, only the HCI_LE_Enhanced_Connection_Complete event is
6513 * sent when a new connection has been created.
6514 */
6515 err = __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CREATE_CONN,
6516 sizeof(cp), &cp,
6517 use_enhanced_conn_complete(hdev) ?
6518 HCI_EV_LE_ENHANCED_CONN_COMPLETE :
6519 HCI_EV_LE_CONN_COMPLETE,
6520 conn->conn_timeout, NULL);
6521
6522 done:
6523 if (err == -ETIMEDOUT)
6524 hci_le_connect_cancel_sync(hdev, conn, 0x00);
6525
6526 /* Re-enable advertising after the connection attempt is finished. */
6527 hci_resume_advertising_sync(hdev);
6528 return err;
6529 }
6530
hci_le_create_cis_sync(struct hci_dev * hdev)6531 int hci_le_create_cis_sync(struct hci_dev *hdev)
6532 {
6533 struct {
6534 struct hci_cp_le_create_cis cp;
6535 struct hci_cis cis[0x1f];
6536 } cmd;
6537 struct hci_conn *conn;
6538 u8 cig = BT_ISO_QOS_CIG_UNSET;
6539
6540 /* The spec allows only one pending LE Create CIS command at a time. If
6541 * the command is pending now, don't do anything. We check for pending
6542 * connections after each CIS Established event.
6543 *
6544 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
6545 * page 2566:
6546 *
6547 * If the Host issues this command before all the
6548 * HCI_LE_CIS_Established events from the previous use of the
6549 * command have been generated, the Controller shall return the
6550 * error code Command Disallowed (0x0C).
6551 *
6552 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E
6553 * page 2567:
6554 *
6555 * When the Controller receives the HCI_LE_Create_CIS command, the
6556 * Controller sends the HCI_Command_Status event to the Host. An
6557 * HCI_LE_CIS_Established event will be generated for each CIS when it
6558 * is established or if it is disconnected or considered lost before
6559 * being established; until all the events are generated, the command
6560 * remains pending.
6561 */
6562
6563 memset(&cmd, 0, sizeof(cmd));
6564
6565 hci_dev_lock(hdev);
6566
6567 rcu_read_lock();
6568
6569 /* Wait until previous Create CIS has completed */
6570 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
6571 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags))
6572 goto done;
6573 }
6574
6575 /* Find CIG with all CIS ready */
6576 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
6577 struct hci_conn *link;
6578
6579 if (hci_conn_check_create_cis(conn))
6580 continue;
6581
6582 cig = conn->iso_qos.ucast.cig;
6583
6584 list_for_each_entry_rcu(link, &hdev->conn_hash.list, list) {
6585 if (hci_conn_check_create_cis(link) > 0 &&
6586 link->iso_qos.ucast.cig == cig &&
6587 link->state != BT_CONNECTED) {
6588 cig = BT_ISO_QOS_CIG_UNSET;
6589 break;
6590 }
6591 }
6592
6593 if (cig != BT_ISO_QOS_CIG_UNSET)
6594 break;
6595 }
6596
6597 if (cig == BT_ISO_QOS_CIG_UNSET)
6598 goto done;
6599
6600 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) {
6601 struct hci_cis *cis = &cmd.cis[cmd.cp.num_cis];
6602
6603 if (hci_conn_check_create_cis(conn) ||
6604 conn->iso_qos.ucast.cig != cig)
6605 continue;
6606
6607 set_bit(HCI_CONN_CREATE_CIS, &conn->flags);
6608 cis->acl_handle = cpu_to_le16(conn->parent->handle);
6609 cis->cis_handle = cpu_to_le16(conn->handle);
6610 cmd.cp.num_cis++;
6611
6612 if (cmd.cp.num_cis >= ARRAY_SIZE(cmd.cis))
6613 break;
6614 }
6615
6616 done:
6617 rcu_read_unlock();
6618
6619 hci_dev_unlock(hdev);
6620
6621 if (!cmd.cp.num_cis)
6622 return 0;
6623
6624 /* Wait for HCI_LE_CIS_Established */
6625 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CREATE_CIS,
6626 sizeof(cmd.cp) + sizeof(cmd.cis[0]) *
6627 cmd.cp.num_cis, &cmd,
6628 HCI_EVT_LE_CIS_ESTABLISHED,
6629 conn->conn_timeout, NULL);
6630 }
6631
hci_le_remove_cig_sync(struct hci_dev * hdev,u8 handle)6632 int hci_le_remove_cig_sync(struct hci_dev *hdev, u8 handle)
6633 {
6634 struct hci_cp_le_remove_cig cp;
6635
6636 memset(&cp, 0, sizeof(cp));
6637 cp.cig_id = handle;
6638
6639 return __hci_cmd_sync_status(hdev, HCI_OP_LE_REMOVE_CIG, sizeof(cp),
6640 &cp, HCI_CMD_TIMEOUT);
6641 }
6642
hci_le_big_terminate_sync(struct hci_dev * hdev,u8 handle)6643 int hci_le_big_terminate_sync(struct hci_dev *hdev, u8 handle)
6644 {
6645 struct hci_cp_le_big_term_sync cp;
6646
6647 memset(&cp, 0, sizeof(cp));
6648 cp.handle = handle;
6649
6650 return __hci_cmd_sync_status(hdev, HCI_OP_LE_BIG_TERM_SYNC,
6651 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
6652 }
6653
hci_le_pa_terminate_sync(struct hci_dev * hdev,u16 handle)6654 int hci_le_pa_terminate_sync(struct hci_dev *hdev, u16 handle)
6655 {
6656 struct hci_cp_le_pa_term_sync cp;
6657
6658 memset(&cp, 0, sizeof(cp));
6659 cp.handle = cpu_to_le16(handle);
6660
6661 return __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_TERM_SYNC,
6662 sizeof(cp), &cp, HCI_CMD_TIMEOUT);
6663 }
6664
hci_get_random_address(struct hci_dev * hdev,bool require_privacy,bool use_rpa,struct adv_info * adv_instance,u8 * own_addr_type,bdaddr_t * rand_addr)6665 int hci_get_random_address(struct hci_dev *hdev, bool require_privacy,
6666 bool use_rpa, struct adv_info *adv_instance,
6667 u8 *own_addr_type, bdaddr_t *rand_addr)
6668 {
6669 int err;
6670
6671 bacpy(rand_addr, BDADDR_ANY);
6672
6673 /* If privacy is enabled use a resolvable private address. If
6674 * current RPA has expired then generate a new one.
6675 */
6676 if (use_rpa) {
6677 /* If Controller supports LL Privacy use own address type is
6678 * 0x03
6679 */
6680 if (use_ll_privacy(hdev))
6681 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED;
6682 else
6683 *own_addr_type = ADDR_LE_DEV_RANDOM;
6684
6685 if (adv_instance) {
6686 if (adv_rpa_valid(adv_instance))
6687 return 0;
6688 } else {
6689 if (rpa_valid(hdev))
6690 return 0;
6691 }
6692
6693 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa);
6694 if (err < 0) {
6695 bt_dev_err(hdev, "failed to generate new RPA");
6696 return err;
6697 }
6698
6699 bacpy(rand_addr, &hdev->rpa);
6700
6701 return 0;
6702 }
6703
6704 /* In case of required privacy without resolvable private address,
6705 * use an non-resolvable private address. This is useful for
6706 * non-connectable advertising.
6707 */
6708 if (require_privacy) {
6709 bdaddr_t nrpa;
6710
6711 while (true) {
6712 /* The non-resolvable private address is generated
6713 * from random six bytes with the two most significant
6714 * bits cleared.
6715 */
6716 get_random_bytes(&nrpa, 6);
6717 nrpa.b[5] &= 0x3f;
6718
6719 /* The non-resolvable private address shall not be
6720 * equal to the public address.
6721 */
6722 if (bacmp(&hdev->bdaddr, &nrpa))
6723 break;
6724 }
6725
6726 *own_addr_type = ADDR_LE_DEV_RANDOM;
6727 bacpy(rand_addr, &nrpa);
6728
6729 return 0;
6730 }
6731
6732 /* No privacy so use a public address. */
6733 *own_addr_type = ADDR_LE_DEV_PUBLIC;
6734
6735 return 0;
6736 }
6737
_update_adv_data_sync(struct hci_dev * hdev,void * data)6738 static int _update_adv_data_sync(struct hci_dev *hdev, void *data)
6739 {
6740 u8 instance = PTR_UINT(data);
6741
6742 return hci_update_adv_data_sync(hdev, instance);
6743 }
6744
hci_update_adv_data(struct hci_dev * hdev,u8 instance)6745 int hci_update_adv_data(struct hci_dev *hdev, u8 instance)
6746 {
6747 return hci_cmd_sync_queue(hdev, _update_adv_data_sync,
6748 UINT_PTR(instance), NULL);
6749 }
6750
hci_acl_create_conn_sync(struct hci_dev * hdev,void * data)6751 static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data)
6752 {
6753 struct hci_conn *conn = data;
6754 struct inquiry_entry *ie;
6755 struct hci_cp_create_conn cp;
6756 int err;
6757
6758 if (!hci_conn_valid(hdev, conn))
6759 return -ECANCELED;
6760
6761 /* Many controllers disallow HCI Create Connection while it is doing
6762 * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create
6763 * Connection. This may cause the MGMT discovering state to become false
6764 * without user space's request but it is okay since the MGMT Discovery
6765 * APIs do not promise that discovery should be done forever. Instead,
6766 * the user space monitors the status of MGMT discovering and it may
6767 * request for discovery again when this flag becomes false.
6768 */
6769 if (test_bit(HCI_INQUIRY, &hdev->flags)) {
6770 err = __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY_CANCEL, 0,
6771 NULL, HCI_CMD_TIMEOUT);
6772 if (err)
6773 bt_dev_warn(hdev, "Failed to cancel inquiry %d", err);
6774 }
6775
6776 conn->state = BT_CONNECT;
6777 conn->out = true;
6778 conn->role = HCI_ROLE_MASTER;
6779
6780 conn->attempt++;
6781
6782 conn->link_policy = hdev->link_policy;
6783
6784 memset(&cp, 0, sizeof(cp));
6785 bacpy(&cp.bdaddr, &conn->dst);
6786 cp.pscan_rep_mode = 0x02;
6787
6788 ie = hci_inquiry_cache_lookup(hdev, &conn->dst);
6789 if (ie) {
6790 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) {
6791 cp.pscan_rep_mode = ie->data.pscan_rep_mode;
6792 cp.pscan_mode = ie->data.pscan_mode;
6793 cp.clock_offset = ie->data.clock_offset |
6794 cpu_to_le16(0x8000);
6795 }
6796
6797 memcpy(conn->dev_class, ie->data.dev_class, 3);
6798 }
6799
6800 cp.pkt_type = cpu_to_le16(conn->pkt_type);
6801 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER))
6802 cp.role_switch = 0x01;
6803 else
6804 cp.role_switch = 0x00;
6805
6806 return __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN,
6807 sizeof(cp), &cp,
6808 HCI_EV_CONN_COMPLETE,
6809 conn->conn_timeout, NULL);
6810 }
6811
hci_connect_acl_sync(struct hci_dev * hdev,struct hci_conn * conn)6812 int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn)
6813 {
6814 return hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn,
6815 NULL);
6816 }
6817
create_le_conn_complete(struct hci_dev * hdev,void * data,int err)6818 static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err)
6819 {
6820 struct hci_conn *conn = data;
6821
6822 bt_dev_dbg(hdev, "err %d", err);
6823
6824 if (err == -ECANCELED)
6825 return;
6826
6827 hci_dev_lock(hdev);
6828
6829 if (!hci_conn_valid(hdev, conn))
6830 goto done;
6831
6832 if (!err) {
6833 hci_connect_le_scan_cleanup(conn, 0x00);
6834 goto done;
6835 }
6836
6837 /* Check if connection is still pending */
6838 if (conn != hci_lookup_le_connect(hdev))
6839 goto done;
6840
6841 /* Flush to make sure we send create conn cancel command if needed */
6842 flush_delayed_work(&conn->le_conn_timeout);
6843 hci_conn_failed(conn, bt_status(err));
6844
6845 done:
6846 hci_dev_unlock(hdev);
6847 }
6848
hci_connect_le_sync(struct hci_dev * hdev,struct hci_conn * conn)6849 int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn)
6850 {
6851 return hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn,
6852 create_le_conn_complete);
6853 }
6854
hci_cancel_connect_sync(struct hci_dev * hdev,struct hci_conn * conn)6855 int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn)
6856 {
6857 if (conn->state != BT_OPEN)
6858 return -EINVAL;
6859
6860 switch (conn->type) {
6861 case ACL_LINK:
6862 return !hci_cmd_sync_dequeue_once(hdev,
6863 hci_acl_create_conn_sync,
6864 conn, NULL);
6865 case LE_LINK:
6866 return !hci_cmd_sync_dequeue_once(hdev, hci_le_create_conn_sync,
6867 conn, create_le_conn_complete);
6868 }
6869
6870 return -ENOENT;
6871 }
6872