1 // SPDX-License-Identifier: GPL-2.0 2 /* 3 * BlueZ - Bluetooth protocol stack for Linux 4 * 5 * Copyright (C) 2021 Intel Corporation 6 * Copyright 2023 NXP 7 */ 8 9 #include <linux/property.h> 10 11 #include <net/bluetooth/bluetooth.h> 12 #include <net/bluetooth/hci_core.h> 13 #include <net/bluetooth/mgmt.h> 14 15 #include "hci_codec.h" 16 #include "hci_debugfs.h" 17 #include "smp.h" 18 #include "eir.h" 19 #include "msft.h" 20 #include "aosp.h" 21 #include "leds.h" 22 23 static void hci_cmd_sync_complete(struct hci_dev *hdev, u8 result, u16 opcode, 24 struct sk_buff *skb) 25 { 26 bt_dev_dbg(hdev, "result 0x%2.2x", result); 27 28 if (hdev->req_status != HCI_REQ_PEND) 29 return; 30 31 hdev->req_result = result; 32 hdev->req_status = HCI_REQ_DONE; 33 34 /* Free the request command so it is not used as response */ 35 kfree_skb(hdev->req_skb); 36 hdev->req_skb = NULL; 37 38 if (skb) { 39 struct sock *sk = hci_skb_sk(skb); 40 41 /* Drop sk reference if set */ 42 if (sk) 43 sock_put(sk); 44 45 hdev->req_rsp = skb_get(skb); 46 } 47 48 wake_up_interruptible(&hdev->req_wait_q); 49 } 50 51 struct sk_buff *hci_cmd_sync_alloc(struct hci_dev *hdev, u16 opcode, u32 plen, 52 const void *param, struct sock *sk) 53 { 54 int len = HCI_COMMAND_HDR_SIZE + plen; 55 struct hci_command_hdr *hdr; 56 struct sk_buff *skb; 57 58 skb = bt_skb_alloc(len, GFP_ATOMIC); 59 if (!skb) 60 return NULL; 61 62 hdr = skb_put(skb, HCI_COMMAND_HDR_SIZE); 63 hdr->opcode = cpu_to_le16(opcode); 64 hdr->plen = plen; 65 66 if (plen) 67 skb_put_data(skb, param, plen); 68 69 bt_dev_dbg(hdev, "skb len %d", skb->len); 70 71 hci_skb_pkt_type(skb) = HCI_COMMAND_PKT; 72 hci_skb_opcode(skb) = opcode; 73 74 /* Grab a reference if command needs to be associated with a sock (e.g. 75 * likely mgmt socket that initiated the command). 76 */ 77 if (sk) { 78 hci_skb_sk(skb) = sk; 79 sock_hold(sk); 80 } 81 82 return skb; 83 } 84 85 static void hci_cmd_sync_add(struct hci_request *req, u16 opcode, u32 plen, 86 const void *param, u8 event, struct sock *sk) 87 { 88 struct hci_dev *hdev = req->hdev; 89 struct sk_buff *skb; 90 91 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen); 92 93 /* If an error occurred during request building, there is no point in 94 * queueing the HCI command. We can simply return. 95 */ 96 if (req->err) 97 return; 98 99 skb = hci_cmd_sync_alloc(hdev, opcode, plen, param, sk); 100 if (!skb) { 101 bt_dev_err(hdev, "no memory for command (opcode 0x%4.4x)", 102 opcode); 103 req->err = -ENOMEM; 104 return; 105 } 106 107 if (skb_queue_empty(&req->cmd_q)) 108 bt_cb(skb)->hci.req_flags |= HCI_REQ_START; 109 110 hci_skb_event(skb) = event; 111 112 skb_queue_tail(&req->cmd_q, skb); 113 } 114 115 static int hci_req_sync_run(struct hci_request *req) 116 { 117 struct hci_dev *hdev = req->hdev; 118 struct sk_buff *skb; 119 unsigned long flags; 120 121 bt_dev_dbg(hdev, "length %u", skb_queue_len(&req->cmd_q)); 122 123 /* If an error occurred during request building, remove all HCI 124 * commands queued on the HCI request queue. 125 */ 126 if (req->err) { 127 skb_queue_purge(&req->cmd_q); 128 return req->err; 129 } 130 131 /* Do not allow empty requests */ 132 if (skb_queue_empty(&req->cmd_q)) 133 return -ENODATA; 134 135 skb = skb_peek_tail(&req->cmd_q); 136 bt_cb(skb)->hci.req_complete_skb = hci_cmd_sync_complete; 137 bt_cb(skb)->hci.req_flags |= HCI_REQ_SKB; 138 139 spin_lock_irqsave(&hdev->cmd_q.lock, flags); 140 skb_queue_splice_tail(&req->cmd_q, &hdev->cmd_q); 141 spin_unlock_irqrestore(&hdev->cmd_q.lock, flags); 142 143 queue_work(hdev->workqueue, &hdev->cmd_work); 144 145 return 0; 146 } 147 148 static void hci_request_init(struct hci_request *req, struct hci_dev *hdev) 149 { 150 skb_queue_head_init(&req->cmd_q); 151 req->hdev = hdev; 152 req->err = 0; 153 } 154 155 /* This function requires the caller holds hdev->req_lock. */ 156 struct sk_buff *__hci_cmd_sync_sk(struct hci_dev *hdev, u16 opcode, u32 plen, 157 const void *param, u8 event, u32 timeout, 158 struct sock *sk) 159 { 160 struct hci_request req; 161 struct sk_buff *skb; 162 int err = 0; 163 164 bt_dev_dbg(hdev, "Opcode 0x%4.4x", opcode); 165 166 hci_request_init(&req, hdev); 167 168 hci_cmd_sync_add(&req, opcode, plen, param, event, sk); 169 170 hdev->req_status = HCI_REQ_PEND; 171 172 err = hci_req_sync_run(&req); 173 if (err < 0) 174 return ERR_PTR(err); 175 176 err = wait_event_interruptible_timeout(hdev->req_wait_q, 177 hdev->req_status != HCI_REQ_PEND, 178 timeout); 179 180 if (err == -ERESTARTSYS) 181 return ERR_PTR(-EINTR); 182 183 switch (hdev->req_status) { 184 case HCI_REQ_DONE: 185 err = -bt_to_errno(hdev->req_result); 186 break; 187 188 case HCI_REQ_CANCELED: 189 err = -hdev->req_result; 190 break; 191 192 default: 193 err = -ETIMEDOUT; 194 break; 195 } 196 197 hdev->req_status = 0; 198 hdev->req_result = 0; 199 skb = hdev->req_rsp; 200 hdev->req_rsp = NULL; 201 202 bt_dev_dbg(hdev, "end: err %d", err); 203 204 if (err < 0) { 205 kfree_skb(skb); 206 return ERR_PTR(err); 207 } 208 209 /* If command return a status event skb will be set to NULL as there are 210 * no parameters. 211 */ 212 if (!skb) 213 return ERR_PTR(-ENODATA); 214 215 return skb; 216 } 217 EXPORT_SYMBOL(__hci_cmd_sync_sk); 218 219 /* This function requires the caller holds hdev->req_lock. */ 220 struct sk_buff *__hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen, 221 const void *param, u32 timeout) 222 { 223 return __hci_cmd_sync_sk(hdev, opcode, plen, param, 0, timeout, NULL); 224 } 225 EXPORT_SYMBOL(__hci_cmd_sync); 226 227 /* Send HCI command and wait for command complete event */ 228 struct sk_buff *hci_cmd_sync(struct hci_dev *hdev, u16 opcode, u32 plen, 229 const void *param, u32 timeout) 230 { 231 struct sk_buff *skb; 232 233 if (!test_bit(HCI_UP, &hdev->flags)) 234 return ERR_PTR(-ENETDOWN); 235 236 bt_dev_dbg(hdev, "opcode 0x%4.4x plen %d", opcode, plen); 237 238 hci_req_sync_lock(hdev); 239 skb = __hci_cmd_sync(hdev, opcode, plen, param, timeout); 240 hci_req_sync_unlock(hdev); 241 242 return skb; 243 } 244 EXPORT_SYMBOL(hci_cmd_sync); 245 246 /* This function requires the caller holds hdev->req_lock. */ 247 struct sk_buff *__hci_cmd_sync_ev(struct hci_dev *hdev, u16 opcode, u32 plen, 248 const void *param, u8 event, u32 timeout) 249 { 250 return __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, 251 NULL); 252 } 253 EXPORT_SYMBOL(__hci_cmd_sync_ev); 254 255 /* This function requires the caller holds hdev->req_lock. */ 256 int __hci_cmd_sync_status_sk(struct hci_dev *hdev, u16 opcode, u32 plen, 257 const void *param, u8 event, u32 timeout, 258 struct sock *sk) 259 { 260 struct sk_buff *skb; 261 u8 status; 262 263 skb = __hci_cmd_sync_sk(hdev, opcode, plen, param, event, timeout, sk); 264 265 /* If command return a status event, skb will be set to -ENODATA */ 266 if (skb == ERR_PTR(-ENODATA)) 267 return 0; 268 269 if (IS_ERR(skb)) { 270 if (!event) 271 bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", opcode, 272 PTR_ERR(skb)); 273 return PTR_ERR(skb); 274 } 275 276 status = skb->data[0]; 277 278 kfree_skb(skb); 279 280 return status; 281 } 282 EXPORT_SYMBOL(__hci_cmd_sync_status_sk); 283 284 int __hci_cmd_sync_status(struct hci_dev *hdev, u16 opcode, u32 plen, 285 const void *param, u32 timeout) 286 { 287 return __hci_cmd_sync_status_sk(hdev, opcode, plen, param, 0, timeout, 288 NULL); 289 } 290 EXPORT_SYMBOL(__hci_cmd_sync_status); 291 292 int hci_cmd_sync_status(struct hci_dev *hdev, u16 opcode, u32 plen, 293 const void *param, u32 timeout) 294 { 295 int err; 296 297 hci_req_sync_lock(hdev); 298 err = __hci_cmd_sync_status(hdev, opcode, plen, param, timeout); 299 hci_req_sync_unlock(hdev); 300 301 return err; 302 } 303 EXPORT_SYMBOL(hci_cmd_sync_status); 304 305 static void hci_cmd_sync_work(struct work_struct *work) 306 { 307 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_sync_work); 308 309 bt_dev_dbg(hdev, ""); 310 311 /* Dequeue all entries and run them */ 312 while (1) { 313 struct hci_cmd_sync_work_entry *entry; 314 315 mutex_lock(&hdev->cmd_sync_work_lock); 316 entry = list_first_entry_or_null(&hdev->cmd_sync_work_list, 317 struct hci_cmd_sync_work_entry, 318 list); 319 if (entry) 320 list_del(&entry->list); 321 mutex_unlock(&hdev->cmd_sync_work_lock); 322 323 if (!entry) 324 break; 325 326 bt_dev_dbg(hdev, "entry %p", entry); 327 328 if (entry->func) { 329 int err; 330 331 hci_req_sync_lock(hdev); 332 err = entry->func(hdev, entry->data); 333 if (entry->destroy) 334 entry->destroy(hdev, entry->data, err); 335 hci_req_sync_unlock(hdev); 336 } 337 338 kfree(entry); 339 } 340 } 341 342 static void hci_cmd_sync_cancel_work(struct work_struct *work) 343 { 344 struct hci_dev *hdev = container_of(work, struct hci_dev, cmd_sync_cancel_work); 345 346 cancel_delayed_work_sync(&hdev->cmd_timer); 347 cancel_delayed_work_sync(&hdev->ncmd_timer); 348 atomic_set(&hdev->cmd_cnt, 1); 349 350 wake_up_interruptible(&hdev->req_wait_q); 351 } 352 353 static int hci_scan_disable_sync(struct hci_dev *hdev); 354 static int scan_disable_sync(struct hci_dev *hdev, void *data) 355 { 356 return hci_scan_disable_sync(hdev); 357 } 358 359 static int interleaved_inquiry_sync(struct hci_dev *hdev, void *data) 360 { 361 return hci_inquiry_sync(hdev, DISCOV_INTERLEAVED_INQUIRY_LEN, 0); 362 } 363 364 static void le_scan_disable(struct work_struct *work) 365 { 366 struct hci_dev *hdev = container_of(work, struct hci_dev, 367 le_scan_disable.work); 368 int status; 369 370 bt_dev_dbg(hdev, ""); 371 hci_dev_lock(hdev); 372 373 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 374 goto _return; 375 376 status = hci_cmd_sync_queue(hdev, scan_disable_sync, NULL, NULL); 377 if (status) { 378 bt_dev_err(hdev, "failed to disable LE scan: %d", status); 379 goto _return; 380 } 381 382 /* If we were running LE only scan, change discovery state. If 383 * we were running both LE and BR/EDR inquiry simultaneously, 384 * and BR/EDR inquiry is already finished, stop discovery, 385 * otherwise BR/EDR inquiry will stop discovery when finished. 386 * If we will resolve remote device name, do not change 387 * discovery state. 388 */ 389 390 if (hdev->discovery.type == DISCOV_TYPE_LE) 391 goto discov_stopped; 392 393 if (hdev->discovery.type != DISCOV_TYPE_INTERLEAVED) 394 goto _return; 395 396 if (hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY)) { 397 if (!test_bit(HCI_INQUIRY, &hdev->flags) && 398 hdev->discovery.state != DISCOVERY_RESOLVING) 399 goto discov_stopped; 400 401 goto _return; 402 } 403 404 status = hci_cmd_sync_queue(hdev, interleaved_inquiry_sync, NULL, NULL); 405 if (status) { 406 bt_dev_err(hdev, "inquiry failed: status %d", status); 407 goto discov_stopped; 408 } 409 410 goto _return; 411 412 discov_stopped: 413 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 414 415 _return: 416 hci_dev_unlock(hdev); 417 } 418 419 static int hci_le_set_scan_enable_sync(struct hci_dev *hdev, u8 val, 420 u8 filter_dup); 421 422 static int reenable_adv_sync(struct hci_dev *hdev, void *data) 423 { 424 bt_dev_dbg(hdev, ""); 425 426 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) && 427 list_empty(&hdev->adv_instances)) 428 return 0; 429 430 if (hdev->cur_adv_instance) { 431 return hci_schedule_adv_instance_sync(hdev, 432 hdev->cur_adv_instance, 433 true); 434 } else { 435 if (ext_adv_capable(hdev)) { 436 hci_start_ext_adv_sync(hdev, 0x00); 437 } else { 438 hci_update_adv_data_sync(hdev, 0x00); 439 hci_update_scan_rsp_data_sync(hdev, 0x00); 440 hci_enable_advertising_sync(hdev); 441 } 442 } 443 444 return 0; 445 } 446 447 static void reenable_adv(struct work_struct *work) 448 { 449 struct hci_dev *hdev = container_of(work, struct hci_dev, 450 reenable_adv_work); 451 int status; 452 453 bt_dev_dbg(hdev, ""); 454 455 hci_dev_lock(hdev); 456 457 status = hci_cmd_sync_queue(hdev, reenable_adv_sync, NULL, NULL); 458 if (status) 459 bt_dev_err(hdev, "failed to reenable ADV: %d", status); 460 461 hci_dev_unlock(hdev); 462 } 463 464 static void cancel_adv_timeout(struct hci_dev *hdev) 465 { 466 if (hdev->adv_instance_timeout) { 467 hdev->adv_instance_timeout = 0; 468 cancel_delayed_work(&hdev->adv_instance_expire); 469 } 470 } 471 472 /* For a single instance: 473 * - force == true: The instance will be removed even when its remaining 474 * lifetime is not zero. 475 * - force == false: the instance will be deactivated but kept stored unless 476 * the remaining lifetime is zero. 477 * 478 * For instance == 0x00: 479 * - force == true: All instances will be removed regardless of their timeout 480 * setting. 481 * - force == false: Only instances that have a timeout will be removed. 482 */ 483 int hci_clear_adv_instance_sync(struct hci_dev *hdev, struct sock *sk, 484 u8 instance, bool force) 485 { 486 struct adv_info *adv_instance, *n, *next_instance = NULL; 487 int err; 488 u8 rem_inst; 489 490 /* Cancel any timeout concerning the removed instance(s). */ 491 if (!instance || hdev->cur_adv_instance == instance) 492 cancel_adv_timeout(hdev); 493 494 /* Get the next instance to advertise BEFORE we remove 495 * the current one. This can be the same instance again 496 * if there is only one instance. 497 */ 498 if (instance && hdev->cur_adv_instance == instance) 499 next_instance = hci_get_next_instance(hdev, instance); 500 501 if (instance == 0x00) { 502 list_for_each_entry_safe(adv_instance, n, &hdev->adv_instances, 503 list) { 504 if (!(force || adv_instance->timeout)) 505 continue; 506 507 rem_inst = adv_instance->instance; 508 err = hci_remove_adv_instance(hdev, rem_inst); 509 if (!err) 510 mgmt_advertising_removed(sk, hdev, rem_inst); 511 } 512 } else { 513 adv_instance = hci_find_adv_instance(hdev, instance); 514 515 if (force || (adv_instance && adv_instance->timeout && 516 !adv_instance->remaining_time)) { 517 /* Don't advertise a removed instance. */ 518 if (next_instance && 519 next_instance->instance == instance) 520 next_instance = NULL; 521 522 err = hci_remove_adv_instance(hdev, instance); 523 if (!err) 524 mgmt_advertising_removed(sk, hdev, instance); 525 } 526 } 527 528 if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_ADVERTISING)) 529 return 0; 530 531 if (next_instance && !ext_adv_capable(hdev)) 532 return hci_schedule_adv_instance_sync(hdev, 533 next_instance->instance, 534 false); 535 536 return 0; 537 } 538 539 static int adv_timeout_expire_sync(struct hci_dev *hdev, void *data) 540 { 541 u8 instance = *(u8 *)data; 542 543 kfree(data); 544 545 hci_clear_adv_instance_sync(hdev, NULL, instance, false); 546 547 if (list_empty(&hdev->adv_instances)) 548 return hci_disable_advertising_sync(hdev); 549 550 return 0; 551 } 552 553 static void adv_timeout_expire(struct work_struct *work) 554 { 555 u8 *inst_ptr; 556 struct hci_dev *hdev = container_of(work, struct hci_dev, 557 adv_instance_expire.work); 558 559 bt_dev_dbg(hdev, ""); 560 561 hci_dev_lock(hdev); 562 563 hdev->adv_instance_timeout = 0; 564 565 if (hdev->cur_adv_instance == 0x00) 566 goto unlock; 567 568 inst_ptr = kmalloc(1, GFP_KERNEL); 569 if (!inst_ptr) 570 goto unlock; 571 572 *inst_ptr = hdev->cur_adv_instance; 573 hci_cmd_sync_queue(hdev, adv_timeout_expire_sync, inst_ptr, NULL); 574 575 unlock: 576 hci_dev_unlock(hdev); 577 } 578 579 static bool is_interleave_scanning(struct hci_dev *hdev) 580 { 581 return hdev->interleave_scan_state != INTERLEAVE_SCAN_NONE; 582 } 583 584 static int hci_passive_scan_sync(struct hci_dev *hdev); 585 586 static void interleave_scan_work(struct work_struct *work) 587 { 588 struct hci_dev *hdev = container_of(work, struct hci_dev, 589 interleave_scan.work); 590 unsigned long timeout; 591 592 if (hdev->interleave_scan_state == INTERLEAVE_SCAN_ALLOWLIST) { 593 timeout = msecs_to_jiffies(hdev->advmon_allowlist_duration); 594 } else if (hdev->interleave_scan_state == INTERLEAVE_SCAN_NO_FILTER) { 595 timeout = msecs_to_jiffies(hdev->advmon_no_filter_duration); 596 } else { 597 bt_dev_err(hdev, "unexpected error"); 598 return; 599 } 600 601 hci_passive_scan_sync(hdev); 602 603 hci_dev_lock(hdev); 604 605 switch (hdev->interleave_scan_state) { 606 case INTERLEAVE_SCAN_ALLOWLIST: 607 bt_dev_dbg(hdev, "next state: allowlist"); 608 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER; 609 break; 610 case INTERLEAVE_SCAN_NO_FILTER: 611 bt_dev_dbg(hdev, "next state: no filter"); 612 hdev->interleave_scan_state = INTERLEAVE_SCAN_ALLOWLIST; 613 break; 614 case INTERLEAVE_SCAN_NONE: 615 bt_dev_err(hdev, "unexpected error"); 616 } 617 618 hci_dev_unlock(hdev); 619 620 /* Don't continue interleaving if it was canceled */ 621 if (is_interleave_scanning(hdev)) 622 queue_delayed_work(hdev->req_workqueue, 623 &hdev->interleave_scan, timeout); 624 } 625 626 void hci_cmd_sync_init(struct hci_dev *hdev) 627 { 628 INIT_WORK(&hdev->cmd_sync_work, hci_cmd_sync_work); 629 INIT_LIST_HEAD(&hdev->cmd_sync_work_list); 630 mutex_init(&hdev->cmd_sync_work_lock); 631 mutex_init(&hdev->unregister_lock); 632 633 INIT_WORK(&hdev->cmd_sync_cancel_work, hci_cmd_sync_cancel_work); 634 INIT_WORK(&hdev->reenable_adv_work, reenable_adv); 635 INIT_DELAYED_WORK(&hdev->le_scan_disable, le_scan_disable); 636 INIT_DELAYED_WORK(&hdev->adv_instance_expire, adv_timeout_expire); 637 INIT_DELAYED_WORK(&hdev->interleave_scan, interleave_scan_work); 638 } 639 640 static void _hci_cmd_sync_cancel_entry(struct hci_dev *hdev, 641 struct hci_cmd_sync_work_entry *entry, 642 int err) 643 { 644 if (entry->destroy) 645 entry->destroy(hdev, entry->data, err); 646 647 list_del(&entry->list); 648 kfree(entry); 649 } 650 651 void hci_cmd_sync_clear(struct hci_dev *hdev) 652 { 653 struct hci_cmd_sync_work_entry *entry, *tmp; 654 655 cancel_work_sync(&hdev->cmd_sync_work); 656 cancel_work_sync(&hdev->reenable_adv_work); 657 658 mutex_lock(&hdev->cmd_sync_work_lock); 659 list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) 660 _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); 661 mutex_unlock(&hdev->cmd_sync_work_lock); 662 } 663 664 void hci_cmd_sync_cancel(struct hci_dev *hdev, int err) 665 { 666 bt_dev_dbg(hdev, "err 0x%2.2x", err); 667 668 if (hdev->req_status == HCI_REQ_PEND) { 669 hdev->req_result = err; 670 hdev->req_status = HCI_REQ_CANCELED; 671 672 queue_work(hdev->workqueue, &hdev->cmd_sync_cancel_work); 673 } 674 } 675 EXPORT_SYMBOL(hci_cmd_sync_cancel); 676 677 /* Cancel ongoing command request synchronously: 678 * 679 * - Set result and mark status to HCI_REQ_CANCELED 680 * - Wakeup command sync thread 681 */ 682 void hci_cmd_sync_cancel_sync(struct hci_dev *hdev, int err) 683 { 684 bt_dev_dbg(hdev, "err 0x%2.2x", err); 685 686 if (hdev->req_status == HCI_REQ_PEND) { 687 /* req_result is __u32 so error must be positive to be properly 688 * propagated. 689 */ 690 hdev->req_result = err < 0 ? -err : err; 691 hdev->req_status = HCI_REQ_CANCELED; 692 693 wake_up_interruptible(&hdev->req_wait_q); 694 } 695 } 696 EXPORT_SYMBOL(hci_cmd_sync_cancel_sync); 697 698 /* Submit HCI command to be run in as cmd_sync_work: 699 * 700 * - hdev must _not_ be unregistered 701 */ 702 int hci_cmd_sync_submit(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 703 void *data, hci_cmd_sync_work_destroy_t destroy) 704 { 705 struct hci_cmd_sync_work_entry *entry; 706 int err = 0; 707 708 mutex_lock(&hdev->unregister_lock); 709 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 710 err = -ENODEV; 711 goto unlock; 712 } 713 714 entry = kmalloc(sizeof(*entry), GFP_KERNEL); 715 if (!entry) { 716 err = -ENOMEM; 717 goto unlock; 718 } 719 entry->func = func; 720 entry->data = data; 721 entry->destroy = destroy; 722 723 mutex_lock(&hdev->cmd_sync_work_lock); 724 list_add_tail(&entry->list, &hdev->cmd_sync_work_list); 725 mutex_unlock(&hdev->cmd_sync_work_lock); 726 727 queue_work(hdev->req_workqueue, &hdev->cmd_sync_work); 728 729 unlock: 730 mutex_unlock(&hdev->unregister_lock); 731 return err; 732 } 733 EXPORT_SYMBOL(hci_cmd_sync_submit); 734 735 /* Queue HCI command: 736 * 737 * - hdev must be running 738 */ 739 int hci_cmd_sync_queue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 740 void *data, hci_cmd_sync_work_destroy_t destroy) 741 { 742 /* Only queue command if hdev is running which means it had been opened 743 * and is either on init phase or is already up. 744 */ 745 if (!test_bit(HCI_RUNNING, &hdev->flags)) 746 return -ENETDOWN; 747 748 return hci_cmd_sync_submit(hdev, func, data, destroy); 749 } 750 EXPORT_SYMBOL(hci_cmd_sync_queue); 751 752 static struct hci_cmd_sync_work_entry * 753 _hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 754 void *data, hci_cmd_sync_work_destroy_t destroy) 755 { 756 struct hci_cmd_sync_work_entry *entry, *tmp; 757 758 list_for_each_entry_safe(entry, tmp, &hdev->cmd_sync_work_list, list) { 759 if (func && entry->func != func) 760 continue; 761 762 if (data && entry->data != data) 763 continue; 764 765 if (destroy && entry->destroy != destroy) 766 continue; 767 768 return entry; 769 } 770 771 return NULL; 772 } 773 774 /* Queue HCI command entry once: 775 * 776 * - Lookup if an entry already exist and only if it doesn't creates a new entry 777 * and queue it. 778 */ 779 int hci_cmd_sync_queue_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 780 void *data, hci_cmd_sync_work_destroy_t destroy) 781 { 782 if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy)) 783 return 0; 784 785 return hci_cmd_sync_queue(hdev, func, data, destroy); 786 } 787 EXPORT_SYMBOL(hci_cmd_sync_queue_once); 788 789 /* Run HCI command: 790 * 791 * - hdev must be running 792 * - if on cmd_sync_work then run immediately otherwise queue 793 */ 794 int hci_cmd_sync_run(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 795 void *data, hci_cmd_sync_work_destroy_t destroy) 796 { 797 /* Only queue command if hdev is running which means it had been opened 798 * and is either on init phase or is already up. 799 */ 800 if (!test_bit(HCI_RUNNING, &hdev->flags)) 801 return -ENETDOWN; 802 803 /* If on cmd_sync_work then run immediately otherwise queue */ 804 if (current_work() == &hdev->cmd_sync_work) 805 return func(hdev, data); 806 807 return hci_cmd_sync_submit(hdev, func, data, destroy); 808 } 809 EXPORT_SYMBOL(hci_cmd_sync_run); 810 811 /* Run HCI command entry once: 812 * 813 * - Lookup if an entry already exist and only if it doesn't creates a new entry 814 * and run it. 815 * - if on cmd_sync_work then run immediately otherwise queue 816 */ 817 int hci_cmd_sync_run_once(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 818 void *data, hci_cmd_sync_work_destroy_t destroy) 819 { 820 if (hci_cmd_sync_lookup_entry(hdev, func, data, destroy)) 821 return 0; 822 823 return hci_cmd_sync_run(hdev, func, data, destroy); 824 } 825 EXPORT_SYMBOL(hci_cmd_sync_run_once); 826 827 /* Lookup HCI command entry: 828 * 829 * - Return first entry that matches by function callback or data or 830 * destroy callback. 831 */ 832 struct hci_cmd_sync_work_entry * 833 hci_cmd_sync_lookup_entry(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 834 void *data, hci_cmd_sync_work_destroy_t destroy) 835 { 836 struct hci_cmd_sync_work_entry *entry; 837 838 mutex_lock(&hdev->cmd_sync_work_lock); 839 entry = _hci_cmd_sync_lookup_entry(hdev, func, data, destroy); 840 mutex_unlock(&hdev->cmd_sync_work_lock); 841 842 return entry; 843 } 844 EXPORT_SYMBOL(hci_cmd_sync_lookup_entry); 845 846 /* Cancel HCI command entry */ 847 void hci_cmd_sync_cancel_entry(struct hci_dev *hdev, 848 struct hci_cmd_sync_work_entry *entry) 849 { 850 mutex_lock(&hdev->cmd_sync_work_lock); 851 _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); 852 mutex_unlock(&hdev->cmd_sync_work_lock); 853 } 854 EXPORT_SYMBOL(hci_cmd_sync_cancel_entry); 855 856 /* Dequeue one HCI command entry: 857 * 858 * - Lookup and cancel first entry that matches. 859 */ 860 bool hci_cmd_sync_dequeue_once(struct hci_dev *hdev, 861 hci_cmd_sync_work_func_t func, 862 void *data, hci_cmd_sync_work_destroy_t destroy) 863 { 864 struct hci_cmd_sync_work_entry *entry; 865 866 entry = hci_cmd_sync_lookup_entry(hdev, func, data, destroy); 867 if (!entry) 868 return false; 869 870 hci_cmd_sync_cancel_entry(hdev, entry); 871 872 return true; 873 } 874 EXPORT_SYMBOL(hci_cmd_sync_dequeue_once); 875 876 /* Dequeue HCI command entry: 877 * 878 * - Lookup and cancel any entry that matches by function callback or data or 879 * destroy callback. 880 */ 881 bool hci_cmd_sync_dequeue(struct hci_dev *hdev, hci_cmd_sync_work_func_t func, 882 void *data, hci_cmd_sync_work_destroy_t destroy) 883 { 884 struct hci_cmd_sync_work_entry *entry; 885 bool ret = false; 886 887 mutex_lock(&hdev->cmd_sync_work_lock); 888 while ((entry = _hci_cmd_sync_lookup_entry(hdev, func, data, 889 destroy))) { 890 _hci_cmd_sync_cancel_entry(hdev, entry, -ECANCELED); 891 ret = true; 892 } 893 mutex_unlock(&hdev->cmd_sync_work_lock); 894 895 return ret; 896 } 897 EXPORT_SYMBOL(hci_cmd_sync_dequeue); 898 899 int hci_update_eir_sync(struct hci_dev *hdev) 900 { 901 struct hci_cp_write_eir cp; 902 903 bt_dev_dbg(hdev, ""); 904 905 if (!hdev_is_powered(hdev)) 906 return 0; 907 908 if (!lmp_ext_inq_capable(hdev)) 909 return 0; 910 911 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 912 return 0; 913 914 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE)) 915 return 0; 916 917 memset(&cp, 0, sizeof(cp)); 918 919 eir_create(hdev, cp.data); 920 921 if (memcmp(cp.data, hdev->eir, sizeof(cp.data)) == 0) 922 return 0; 923 924 memcpy(hdev->eir, cp.data, sizeof(cp.data)); 925 926 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp, 927 HCI_CMD_TIMEOUT); 928 } 929 930 static u8 get_service_classes(struct hci_dev *hdev) 931 { 932 struct bt_uuid *uuid; 933 u8 val = 0; 934 935 list_for_each_entry(uuid, &hdev->uuids, list) 936 val |= uuid->svc_hint; 937 938 return val; 939 } 940 941 int hci_update_class_sync(struct hci_dev *hdev) 942 { 943 u8 cod[3]; 944 945 bt_dev_dbg(hdev, ""); 946 947 if (!hdev_is_powered(hdev)) 948 return 0; 949 950 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 951 return 0; 952 953 if (hci_dev_test_flag(hdev, HCI_SERVICE_CACHE)) 954 return 0; 955 956 cod[0] = hdev->minor_class; 957 cod[1] = hdev->major_class; 958 cod[2] = get_service_classes(hdev); 959 960 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) 961 cod[1] |= 0x20; 962 963 if (memcmp(cod, hdev->dev_class, 3) == 0) 964 return 0; 965 966 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CLASS_OF_DEV, 967 sizeof(cod), cod, HCI_CMD_TIMEOUT); 968 } 969 970 static bool is_advertising_allowed(struct hci_dev *hdev, bool connectable) 971 { 972 /* If there is no connection we are OK to advertise. */ 973 if (hci_conn_num(hdev, LE_LINK) == 0) 974 return true; 975 976 /* Check le_states if there is any connection in peripheral role. */ 977 if (hdev->conn_hash.le_num_peripheral > 0) { 978 /* Peripheral connection state and non connectable mode 979 * bit 20. 980 */ 981 if (!connectable && !(hdev->le_states[2] & 0x10)) 982 return false; 983 984 /* Peripheral connection state and connectable mode bit 38 985 * and scannable bit 21. 986 */ 987 if (connectable && (!(hdev->le_states[4] & 0x40) || 988 !(hdev->le_states[2] & 0x20))) 989 return false; 990 } 991 992 /* Check le_states if there is any connection in central role. */ 993 if (hci_conn_num(hdev, LE_LINK) != hdev->conn_hash.le_num_peripheral) { 994 /* Central connection state and non connectable mode bit 18. */ 995 if (!connectable && !(hdev->le_states[2] & 0x02)) 996 return false; 997 998 /* Central connection state and connectable mode bit 35 and 999 * scannable 19. 1000 */ 1001 if (connectable && (!(hdev->le_states[4] & 0x08) || 1002 !(hdev->le_states[2] & 0x08))) 1003 return false; 1004 } 1005 1006 return true; 1007 } 1008 1009 static bool adv_use_rpa(struct hci_dev *hdev, uint32_t flags) 1010 { 1011 /* If privacy is not enabled don't use RPA */ 1012 if (!hci_dev_test_flag(hdev, HCI_PRIVACY)) 1013 return false; 1014 1015 /* If basic privacy mode is enabled use RPA */ 1016 if (!hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 1017 return true; 1018 1019 /* If limited privacy mode is enabled don't use RPA if we're 1020 * both discoverable and bondable. 1021 */ 1022 if ((flags & MGMT_ADV_FLAG_DISCOV) && 1023 hci_dev_test_flag(hdev, HCI_BONDABLE)) 1024 return false; 1025 1026 /* We're neither bondable nor discoverable in the limited 1027 * privacy mode, therefore use RPA. 1028 */ 1029 return true; 1030 } 1031 1032 static int hci_set_random_addr_sync(struct hci_dev *hdev, bdaddr_t *rpa) 1033 { 1034 /* If a random_addr has been set we're advertising or initiating an LE 1035 * connection we can't go ahead and change the random address at this 1036 * time. This is because the eventual initiator address used for the 1037 * subsequently created connection will be undefined (some 1038 * controllers use the new address and others the one we had 1039 * when the operation started). 1040 * 1041 * In this kind of scenario skip the update and let the random 1042 * address be updated at the next cycle. 1043 */ 1044 if (bacmp(&hdev->random_addr, BDADDR_ANY) && 1045 (hci_dev_test_flag(hdev, HCI_LE_ADV) || 1046 hci_lookup_le_connect(hdev))) { 1047 bt_dev_dbg(hdev, "Deferring random address update"); 1048 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 1049 return 0; 1050 } 1051 1052 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_RANDOM_ADDR, 1053 6, rpa, HCI_CMD_TIMEOUT); 1054 } 1055 1056 int hci_update_random_address_sync(struct hci_dev *hdev, bool require_privacy, 1057 bool rpa, u8 *own_addr_type) 1058 { 1059 int err; 1060 1061 /* If privacy is enabled use a resolvable private address. If 1062 * current RPA has expired or there is something else than 1063 * the current RPA in use, then generate a new one. 1064 */ 1065 if (rpa) { 1066 /* If Controller supports LL Privacy use own address type is 1067 * 0x03 1068 */ 1069 if (ll_privacy_capable(hdev)) 1070 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED; 1071 else 1072 *own_addr_type = ADDR_LE_DEV_RANDOM; 1073 1074 /* Check if RPA is valid */ 1075 if (rpa_valid(hdev)) 1076 return 0; 1077 1078 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa); 1079 if (err < 0) { 1080 bt_dev_err(hdev, "failed to generate new RPA"); 1081 return err; 1082 } 1083 1084 err = hci_set_random_addr_sync(hdev, &hdev->rpa); 1085 if (err) 1086 return err; 1087 1088 return 0; 1089 } 1090 1091 /* In case of required privacy without resolvable private address, 1092 * use an non-resolvable private address. This is useful for active 1093 * scanning and non-connectable advertising. 1094 */ 1095 if (require_privacy) { 1096 bdaddr_t nrpa; 1097 1098 while (true) { 1099 /* The non-resolvable private address is generated 1100 * from random six bytes with the two most significant 1101 * bits cleared. 1102 */ 1103 get_random_bytes(&nrpa, 6); 1104 nrpa.b[5] &= 0x3f; 1105 1106 /* The non-resolvable private address shall not be 1107 * equal to the public address. 1108 */ 1109 if (bacmp(&hdev->bdaddr, &nrpa)) 1110 break; 1111 } 1112 1113 *own_addr_type = ADDR_LE_DEV_RANDOM; 1114 1115 return hci_set_random_addr_sync(hdev, &nrpa); 1116 } 1117 1118 /* If forcing static address is in use or there is no public 1119 * address use the static address as random address (but skip 1120 * the HCI command if the current random address is already the 1121 * static one. 1122 * 1123 * In case BR/EDR has been disabled on a dual-mode controller 1124 * and a static address has been configured, then use that 1125 * address instead of the public BR/EDR address. 1126 */ 1127 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 1128 !bacmp(&hdev->bdaddr, BDADDR_ANY) || 1129 (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED) && 1130 bacmp(&hdev->static_addr, BDADDR_ANY))) { 1131 *own_addr_type = ADDR_LE_DEV_RANDOM; 1132 if (bacmp(&hdev->static_addr, &hdev->random_addr)) 1133 return hci_set_random_addr_sync(hdev, 1134 &hdev->static_addr); 1135 return 0; 1136 } 1137 1138 /* Neither privacy nor static address is being used so use a 1139 * public address. 1140 */ 1141 *own_addr_type = ADDR_LE_DEV_PUBLIC; 1142 1143 return 0; 1144 } 1145 1146 static int hci_disable_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) 1147 { 1148 struct hci_cp_le_set_ext_adv_enable *cp; 1149 struct hci_cp_ext_adv_set *set; 1150 u8 data[sizeof(*cp) + sizeof(*set) * 1]; 1151 u8 size; 1152 struct adv_info *adv = NULL; 1153 1154 /* If request specifies an instance that doesn't exist, fail */ 1155 if (instance > 0) { 1156 adv = hci_find_adv_instance(hdev, instance); 1157 if (!adv) 1158 return -EINVAL; 1159 1160 /* If not enabled there is nothing to do */ 1161 if (!adv->enabled) 1162 return 0; 1163 } 1164 1165 memset(data, 0, sizeof(data)); 1166 1167 cp = (void *)data; 1168 set = (void *)cp->data; 1169 1170 /* Instance 0x00 indicates all advertising instances will be disabled */ 1171 cp->num_of_sets = !!instance; 1172 cp->enable = 0x00; 1173 1174 set->handle = adv ? adv->handle : instance; 1175 1176 size = sizeof(*cp) + sizeof(*set) * cp->num_of_sets; 1177 1178 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, 1179 size, data, HCI_CMD_TIMEOUT); 1180 } 1181 1182 static int hci_set_adv_set_random_addr_sync(struct hci_dev *hdev, u8 instance, 1183 bdaddr_t *random_addr) 1184 { 1185 struct hci_cp_le_set_adv_set_rand_addr cp; 1186 int err; 1187 1188 if (!instance) { 1189 /* Instance 0x00 doesn't have an adv_info, instead it uses 1190 * hdev->random_addr to track its address so whenever it needs 1191 * to be updated this also set the random address since 1192 * hdev->random_addr is shared with scan state machine. 1193 */ 1194 err = hci_set_random_addr_sync(hdev, random_addr); 1195 if (err) 1196 return err; 1197 } 1198 1199 memset(&cp, 0, sizeof(cp)); 1200 1201 cp.handle = instance; 1202 bacpy(&cp.bdaddr, random_addr); 1203 1204 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_SET_RAND_ADDR, 1205 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1206 } 1207 1208 static int 1209 hci_set_ext_adv_params_sync(struct hci_dev *hdev, struct adv_info *adv, 1210 const struct hci_cp_le_set_ext_adv_params *cp, 1211 struct hci_rp_le_set_ext_adv_params *rp) 1212 { 1213 struct sk_buff *skb; 1214 1215 skb = __hci_cmd_sync(hdev, HCI_OP_LE_SET_EXT_ADV_PARAMS, sizeof(*cp), 1216 cp, HCI_CMD_TIMEOUT); 1217 1218 /* If command return a status event, skb will be set to -ENODATA */ 1219 if (skb == ERR_PTR(-ENODATA)) 1220 return 0; 1221 1222 if (IS_ERR(skb)) { 1223 bt_dev_err(hdev, "Opcode 0x%4.4x failed: %ld", 1224 HCI_OP_LE_SET_EXT_ADV_PARAMS, PTR_ERR(skb)); 1225 return PTR_ERR(skb); 1226 } 1227 1228 if (skb->len != sizeof(*rp)) { 1229 bt_dev_err(hdev, "Invalid response length for 0x%4.4x: %u", 1230 HCI_OP_LE_SET_EXT_ADV_PARAMS, skb->len); 1231 kfree_skb(skb); 1232 return -EIO; 1233 } 1234 1235 memcpy(rp, skb->data, sizeof(*rp)); 1236 kfree_skb(skb); 1237 1238 if (!rp->status) { 1239 hdev->adv_addr_type = cp->own_addr_type; 1240 if (!cp->handle) { 1241 /* Store in hdev for instance 0 */ 1242 hdev->adv_tx_power = rp->tx_power; 1243 } else if (adv) { 1244 adv->tx_power = rp->tx_power; 1245 } 1246 } 1247 1248 return rp->status; 1249 } 1250 1251 static int hci_set_ext_adv_data_sync(struct hci_dev *hdev, u8 instance) 1252 { 1253 DEFINE_FLEX(struct hci_cp_le_set_ext_adv_data, pdu, data, length, 1254 HCI_MAX_EXT_AD_LENGTH); 1255 u8 len; 1256 struct adv_info *adv = NULL; 1257 int err; 1258 1259 if (instance) { 1260 adv = hci_find_adv_instance(hdev, instance); 1261 if (!adv || !adv->adv_data_changed) 1262 return 0; 1263 } 1264 1265 len = eir_create_adv_data(hdev, instance, pdu->data, 1266 HCI_MAX_EXT_AD_LENGTH); 1267 1268 pdu->length = len; 1269 pdu->handle = adv ? adv->handle : instance; 1270 pdu->operation = LE_SET_ADV_DATA_OP_COMPLETE; 1271 pdu->frag_pref = LE_SET_ADV_DATA_NO_FRAG; 1272 1273 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_DATA, 1274 struct_size(pdu, data, len), pdu, 1275 HCI_CMD_TIMEOUT); 1276 if (err) 1277 return err; 1278 1279 /* Update data if the command succeed */ 1280 if (adv) { 1281 adv->adv_data_changed = false; 1282 } else { 1283 memcpy(hdev->adv_data, pdu->data, len); 1284 hdev->adv_data_len = len; 1285 } 1286 1287 return 0; 1288 } 1289 1290 static int hci_set_adv_data_sync(struct hci_dev *hdev, u8 instance) 1291 { 1292 struct hci_cp_le_set_adv_data cp; 1293 u8 len; 1294 1295 memset(&cp, 0, sizeof(cp)); 1296 1297 len = eir_create_adv_data(hdev, instance, cp.data, sizeof(cp.data)); 1298 1299 /* There's nothing to do if the data hasn't changed */ 1300 if (hdev->adv_data_len == len && 1301 memcmp(cp.data, hdev->adv_data, len) == 0) 1302 return 0; 1303 1304 memcpy(hdev->adv_data, cp.data, sizeof(cp.data)); 1305 hdev->adv_data_len = len; 1306 1307 cp.length = len; 1308 1309 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_DATA, 1310 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1311 } 1312 1313 int hci_update_adv_data_sync(struct hci_dev *hdev, u8 instance) 1314 { 1315 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1316 return 0; 1317 1318 if (ext_adv_capable(hdev)) 1319 return hci_set_ext_adv_data_sync(hdev, instance); 1320 1321 return hci_set_adv_data_sync(hdev, instance); 1322 } 1323 1324 int hci_setup_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance) 1325 { 1326 struct hci_cp_le_set_ext_adv_params cp; 1327 struct hci_rp_le_set_ext_adv_params rp; 1328 bool connectable, require_privacy; 1329 u32 flags; 1330 bdaddr_t random_addr; 1331 u8 own_addr_type; 1332 int err; 1333 struct adv_info *adv; 1334 bool secondary_adv; 1335 1336 if (instance > 0) { 1337 adv = hci_find_adv_instance(hdev, instance); 1338 if (!adv) 1339 return -EINVAL; 1340 } else { 1341 adv = NULL; 1342 } 1343 1344 /* Updating parameters of an active instance will return a 1345 * Command Disallowed error, so we must first disable the 1346 * instance if it is active. 1347 */ 1348 if (adv) { 1349 err = hci_disable_ext_adv_instance_sync(hdev, instance); 1350 if (err) 1351 return err; 1352 } 1353 1354 flags = hci_adv_instance_flags(hdev, instance); 1355 1356 /* If the "connectable" instance flag was not set, then choose between 1357 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting. 1358 */ 1359 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) || 1360 mgmt_get_connectable(hdev); 1361 1362 if (!is_advertising_allowed(hdev, connectable)) 1363 return -EPERM; 1364 1365 /* Set require_privacy to true only when non-connectable 1366 * advertising is used and it is not periodic. 1367 * In that case it is fine to use a non-resolvable private address. 1368 */ 1369 require_privacy = !connectable && !(adv && adv->periodic); 1370 1371 err = hci_get_random_address(hdev, require_privacy, 1372 adv_use_rpa(hdev, flags), adv, 1373 &own_addr_type, &random_addr); 1374 if (err < 0) 1375 return err; 1376 1377 memset(&cp, 0, sizeof(cp)); 1378 1379 if (adv) { 1380 hci_cpu_to_le24(adv->min_interval, cp.min_interval); 1381 hci_cpu_to_le24(adv->max_interval, cp.max_interval); 1382 cp.tx_power = adv->tx_power; 1383 cp.sid = adv->sid; 1384 } else { 1385 hci_cpu_to_le24(hdev->le_adv_min_interval, cp.min_interval); 1386 hci_cpu_to_le24(hdev->le_adv_max_interval, cp.max_interval); 1387 cp.tx_power = HCI_ADV_TX_POWER_NO_PREFERENCE; 1388 cp.sid = 0x00; 1389 } 1390 1391 secondary_adv = (flags & MGMT_ADV_FLAG_SEC_MASK); 1392 1393 if (connectable) { 1394 if (secondary_adv) 1395 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_CONN_IND); 1396 else 1397 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_IND); 1398 } else if (hci_adv_instance_is_scannable(hdev, instance) || 1399 (flags & MGMT_ADV_PARAM_SCAN_RSP)) { 1400 if (secondary_adv) 1401 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_SCAN_IND); 1402 else 1403 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_SCAN_IND); 1404 } else { 1405 if (secondary_adv) 1406 cp.evt_properties = cpu_to_le16(LE_EXT_ADV_NON_CONN_IND); 1407 else 1408 cp.evt_properties = cpu_to_le16(LE_LEGACY_NONCONN_IND); 1409 } 1410 1411 /* If Own_Address_Type equals 0x02 or 0x03, the Peer_Address parameter 1412 * contains the peer’s Identity Address and the Peer_Address_Type 1413 * parameter contains the peer’s Identity Type (i.e., 0x00 or 0x01). 1414 * These parameters are used to locate the corresponding local IRK in 1415 * the resolving list; this IRK is used to generate their own address 1416 * used in the advertisement. 1417 */ 1418 if (own_addr_type == ADDR_LE_DEV_RANDOM_RESOLVED) 1419 hci_copy_identity_address(hdev, &cp.peer_addr, 1420 &cp.peer_addr_type); 1421 1422 cp.own_addr_type = own_addr_type; 1423 cp.channel_map = hdev->le_adv_channel_map; 1424 cp.handle = adv ? adv->handle : instance; 1425 1426 if (flags & MGMT_ADV_FLAG_SEC_2M) { 1427 cp.primary_phy = HCI_ADV_PHY_1M; 1428 cp.secondary_phy = HCI_ADV_PHY_2M; 1429 } else if (flags & MGMT_ADV_FLAG_SEC_CODED) { 1430 cp.primary_phy = HCI_ADV_PHY_CODED; 1431 cp.secondary_phy = HCI_ADV_PHY_CODED; 1432 } else { 1433 /* In all other cases use 1M */ 1434 cp.primary_phy = HCI_ADV_PHY_1M; 1435 cp.secondary_phy = HCI_ADV_PHY_1M; 1436 } 1437 1438 err = hci_set_ext_adv_params_sync(hdev, adv, &cp, &rp); 1439 if (err) 1440 return err; 1441 1442 /* Update adv data as tx power is known now */ 1443 err = hci_set_ext_adv_data_sync(hdev, cp.handle); 1444 if (err) 1445 return err; 1446 1447 if ((own_addr_type == ADDR_LE_DEV_RANDOM || 1448 own_addr_type == ADDR_LE_DEV_RANDOM_RESOLVED) && 1449 bacmp(&random_addr, BDADDR_ANY)) { 1450 /* Check if random address need to be updated */ 1451 if (adv) { 1452 if (!bacmp(&random_addr, &adv->random_addr)) 1453 return 0; 1454 } else { 1455 if (!bacmp(&random_addr, &hdev->random_addr)) 1456 return 0; 1457 } 1458 1459 return hci_set_adv_set_random_addr_sync(hdev, instance, 1460 &random_addr); 1461 } 1462 1463 return 0; 1464 } 1465 1466 static int hci_set_ext_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance) 1467 { 1468 DEFINE_FLEX(struct hci_cp_le_set_ext_scan_rsp_data, pdu, data, length, 1469 HCI_MAX_EXT_AD_LENGTH); 1470 u8 len; 1471 struct adv_info *adv = NULL; 1472 int err; 1473 1474 if (instance) { 1475 adv = hci_find_adv_instance(hdev, instance); 1476 if (!adv || !adv->scan_rsp_changed) 1477 return 0; 1478 } 1479 1480 len = eir_create_scan_rsp(hdev, instance, pdu->data); 1481 1482 pdu->handle = adv ? adv->handle : instance; 1483 pdu->length = len; 1484 pdu->operation = LE_SET_ADV_DATA_OP_COMPLETE; 1485 pdu->frag_pref = LE_SET_ADV_DATA_NO_FRAG; 1486 1487 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_RSP_DATA, 1488 struct_size(pdu, data, len), pdu, 1489 HCI_CMD_TIMEOUT); 1490 if (err) 1491 return err; 1492 1493 if (adv) { 1494 adv->scan_rsp_changed = false; 1495 } else { 1496 memcpy(hdev->scan_rsp_data, pdu->data, len); 1497 hdev->scan_rsp_data_len = len; 1498 } 1499 1500 return 0; 1501 } 1502 1503 static int __hci_set_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance) 1504 { 1505 struct hci_cp_le_set_scan_rsp_data cp; 1506 u8 len; 1507 1508 memset(&cp, 0, sizeof(cp)); 1509 1510 len = eir_create_scan_rsp(hdev, instance, cp.data); 1511 1512 if (hdev->scan_rsp_data_len == len && 1513 !memcmp(cp.data, hdev->scan_rsp_data, len)) 1514 return 0; 1515 1516 memcpy(hdev->scan_rsp_data, cp.data, sizeof(cp.data)); 1517 hdev->scan_rsp_data_len = len; 1518 1519 cp.length = len; 1520 1521 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_RSP_DATA, 1522 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1523 } 1524 1525 int hci_update_scan_rsp_data_sync(struct hci_dev *hdev, u8 instance) 1526 { 1527 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 1528 return 0; 1529 1530 if (ext_adv_capable(hdev)) 1531 return hci_set_ext_scan_rsp_data_sync(hdev, instance); 1532 1533 return __hci_set_scan_rsp_data_sync(hdev, instance); 1534 } 1535 1536 int hci_enable_ext_advertising_sync(struct hci_dev *hdev, u8 instance) 1537 { 1538 struct hci_cp_le_set_ext_adv_enable *cp; 1539 struct hci_cp_ext_adv_set *set; 1540 u8 data[sizeof(*cp) + sizeof(*set) * 1]; 1541 struct adv_info *adv; 1542 1543 if (instance > 0) { 1544 adv = hci_find_adv_instance(hdev, instance); 1545 if (!adv) 1546 return -EINVAL; 1547 /* If already enabled there is nothing to do */ 1548 if (adv->enabled) 1549 return 0; 1550 } else { 1551 adv = NULL; 1552 } 1553 1554 cp = (void *)data; 1555 set = (void *)cp->data; 1556 1557 memset(cp, 0, sizeof(*cp)); 1558 1559 cp->enable = 0x01; 1560 cp->num_of_sets = 0x01; 1561 1562 memset(set, 0, sizeof(*set)); 1563 1564 set->handle = adv ? adv->handle : instance; 1565 1566 /* Set duration per instance since controller is responsible for 1567 * scheduling it. 1568 */ 1569 if (adv && adv->timeout) { 1570 u16 duration = adv->timeout * MSEC_PER_SEC; 1571 1572 /* Time = N * 10 ms */ 1573 set->duration = cpu_to_le16(duration / 10); 1574 } 1575 1576 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_ADV_ENABLE, 1577 sizeof(*cp) + 1578 sizeof(*set) * cp->num_of_sets, 1579 data, HCI_CMD_TIMEOUT); 1580 } 1581 1582 int hci_start_ext_adv_sync(struct hci_dev *hdev, u8 instance) 1583 { 1584 int err; 1585 1586 err = hci_setup_ext_adv_instance_sync(hdev, instance); 1587 if (err) 1588 return err; 1589 1590 err = hci_set_ext_scan_rsp_data_sync(hdev, instance); 1591 if (err) 1592 return err; 1593 1594 return hci_enable_ext_advertising_sync(hdev, instance); 1595 } 1596 1597 int hci_disable_per_advertising_sync(struct hci_dev *hdev, u8 instance) 1598 { 1599 struct hci_cp_le_set_per_adv_enable cp; 1600 struct adv_info *adv = NULL; 1601 1602 /* If periodic advertising already disabled there is nothing to do. */ 1603 adv = hci_find_adv_instance(hdev, instance); 1604 if (!adv || !adv->periodic || !adv->enabled) 1605 return 0; 1606 1607 memset(&cp, 0, sizeof(cp)); 1608 1609 cp.enable = 0x00; 1610 cp.handle = instance; 1611 1612 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE, 1613 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1614 } 1615 1616 static int hci_set_per_adv_params_sync(struct hci_dev *hdev, u8 instance, 1617 u16 min_interval, u16 max_interval) 1618 { 1619 struct hci_cp_le_set_per_adv_params cp; 1620 1621 memset(&cp, 0, sizeof(cp)); 1622 1623 if (!min_interval) 1624 min_interval = DISCOV_LE_PER_ADV_INT_MIN; 1625 1626 if (!max_interval) 1627 max_interval = DISCOV_LE_PER_ADV_INT_MAX; 1628 1629 cp.handle = instance; 1630 cp.min_interval = cpu_to_le16(min_interval); 1631 cp.max_interval = cpu_to_le16(max_interval); 1632 cp.periodic_properties = 0x0000; 1633 1634 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_PARAMS, 1635 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1636 } 1637 1638 static int hci_set_per_adv_data_sync(struct hci_dev *hdev, u8 instance) 1639 { 1640 DEFINE_FLEX(struct hci_cp_le_set_per_adv_data, pdu, data, length, 1641 HCI_MAX_PER_AD_LENGTH); 1642 u8 len; 1643 struct adv_info *adv = NULL; 1644 1645 if (instance) { 1646 adv = hci_find_adv_instance(hdev, instance); 1647 if (!adv || !adv->periodic) 1648 return 0; 1649 } 1650 1651 len = eir_create_per_adv_data(hdev, instance, pdu->data); 1652 1653 pdu->length = len; 1654 pdu->handle = adv ? adv->handle : instance; 1655 pdu->operation = LE_SET_ADV_DATA_OP_COMPLETE; 1656 1657 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_DATA, 1658 struct_size(pdu, data, len), pdu, 1659 HCI_CMD_TIMEOUT); 1660 } 1661 1662 static int hci_enable_per_advertising_sync(struct hci_dev *hdev, u8 instance) 1663 { 1664 struct hci_cp_le_set_per_adv_enable cp; 1665 struct adv_info *adv = NULL; 1666 1667 /* If periodic advertising already enabled there is nothing to do. */ 1668 adv = hci_find_adv_instance(hdev, instance); 1669 if (adv && adv->periodic && adv->enabled) 1670 return 0; 1671 1672 memset(&cp, 0, sizeof(cp)); 1673 1674 cp.enable = 0x01; 1675 cp.handle = instance; 1676 1677 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PER_ADV_ENABLE, 1678 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1679 } 1680 1681 /* Checks if periodic advertising data contains a Basic Announcement and if it 1682 * does generates a Broadcast ID and add Broadcast Announcement. 1683 */ 1684 static int hci_adv_bcast_annoucement(struct hci_dev *hdev, struct adv_info *adv) 1685 { 1686 u8 bid[3]; 1687 u8 ad[HCI_MAX_EXT_AD_LENGTH]; 1688 u8 len; 1689 1690 /* Skip if NULL adv as instance 0x00 is used for general purpose 1691 * advertising so it cannot used for the likes of Broadcast Announcement 1692 * as it can be overwritten at any point. 1693 */ 1694 if (!adv) 1695 return 0; 1696 1697 /* Check if PA data doesn't contains a Basic Audio Announcement then 1698 * there is nothing to do. 1699 */ 1700 if (!eir_get_service_data(adv->per_adv_data, adv->per_adv_data_len, 1701 0x1851, NULL)) 1702 return 0; 1703 1704 /* Check if advertising data already has a Broadcast Announcement since 1705 * the process may want to control the Broadcast ID directly and in that 1706 * case the kernel shall no interfere. 1707 */ 1708 if (eir_get_service_data(adv->adv_data, adv->adv_data_len, 0x1852, 1709 NULL)) 1710 return 0; 1711 1712 /* Generate Broadcast ID */ 1713 get_random_bytes(bid, sizeof(bid)); 1714 len = eir_append_service_data(ad, 0, 0x1852, bid, sizeof(bid)); 1715 memcpy(ad + len, adv->adv_data, adv->adv_data_len); 1716 hci_set_adv_instance_data(hdev, adv->instance, len + adv->adv_data_len, 1717 ad, 0, NULL); 1718 1719 return hci_update_adv_data_sync(hdev, adv->instance); 1720 } 1721 1722 int hci_start_per_adv_sync(struct hci_dev *hdev, u8 instance, u8 sid, 1723 u8 data_len, u8 *data, u32 flags, u16 min_interval, 1724 u16 max_interval, u16 sync_interval) 1725 { 1726 struct adv_info *adv = NULL; 1727 int err; 1728 bool added = false; 1729 1730 hci_disable_per_advertising_sync(hdev, instance); 1731 1732 if (instance) { 1733 adv = hci_find_adv_instance(hdev, instance); 1734 if (adv) { 1735 if (sid != HCI_SID_INVALID && adv->sid != sid) { 1736 /* If the SID don't match attempt to find by 1737 * SID. 1738 */ 1739 adv = hci_find_adv_sid(hdev, sid); 1740 if (!adv) { 1741 bt_dev_err(hdev, 1742 "Unable to find adv_info"); 1743 return -EINVAL; 1744 } 1745 } 1746 1747 /* Turn it into periodic advertising */ 1748 adv->periodic = true; 1749 adv->per_adv_data_len = data_len; 1750 if (data) 1751 memcpy(adv->per_adv_data, data, data_len); 1752 adv->flags = flags; 1753 } else if (!adv) { 1754 /* Create an instance if that could not be found */ 1755 adv = hci_add_per_instance(hdev, instance, sid, flags, 1756 data_len, data, 1757 sync_interval, 1758 sync_interval); 1759 if (IS_ERR(adv)) 1760 return PTR_ERR(adv); 1761 adv->pending = false; 1762 added = true; 1763 } 1764 } 1765 1766 /* Start advertising */ 1767 err = hci_start_ext_adv_sync(hdev, instance); 1768 if (err < 0) 1769 goto fail; 1770 1771 err = hci_adv_bcast_annoucement(hdev, adv); 1772 if (err < 0) 1773 goto fail; 1774 1775 err = hci_set_per_adv_params_sync(hdev, instance, min_interval, 1776 max_interval); 1777 if (err < 0) 1778 goto fail; 1779 1780 err = hci_set_per_adv_data_sync(hdev, instance); 1781 if (err < 0) 1782 goto fail; 1783 1784 err = hci_enable_per_advertising_sync(hdev, instance); 1785 if (err < 0) 1786 goto fail; 1787 1788 return 0; 1789 1790 fail: 1791 if (added) 1792 hci_remove_adv_instance(hdev, instance); 1793 1794 return err; 1795 } 1796 1797 static int hci_start_adv_sync(struct hci_dev *hdev, u8 instance) 1798 { 1799 int err; 1800 1801 if (ext_adv_capable(hdev)) 1802 return hci_start_ext_adv_sync(hdev, instance); 1803 1804 err = hci_update_adv_data_sync(hdev, instance); 1805 if (err) 1806 return err; 1807 1808 err = hci_update_scan_rsp_data_sync(hdev, instance); 1809 if (err) 1810 return err; 1811 1812 return hci_enable_advertising_sync(hdev); 1813 } 1814 1815 int hci_enable_advertising_sync(struct hci_dev *hdev) 1816 { 1817 struct adv_info *adv_instance; 1818 struct hci_cp_le_set_adv_param cp; 1819 u8 own_addr_type, enable = 0x01; 1820 bool connectable; 1821 u16 adv_min_interval, adv_max_interval; 1822 u32 flags; 1823 u8 status; 1824 1825 if (ext_adv_capable(hdev)) 1826 return hci_enable_ext_advertising_sync(hdev, 1827 hdev->cur_adv_instance); 1828 1829 flags = hci_adv_instance_flags(hdev, hdev->cur_adv_instance); 1830 adv_instance = hci_find_adv_instance(hdev, hdev->cur_adv_instance); 1831 1832 /* If the "connectable" instance flag was not set, then choose between 1833 * ADV_IND and ADV_NONCONN_IND based on the global connectable setting. 1834 */ 1835 connectable = (flags & MGMT_ADV_FLAG_CONNECTABLE) || 1836 mgmt_get_connectable(hdev); 1837 1838 if (!is_advertising_allowed(hdev, connectable)) 1839 return -EINVAL; 1840 1841 status = hci_disable_advertising_sync(hdev); 1842 if (status) 1843 return status; 1844 1845 /* Clear the HCI_LE_ADV bit temporarily so that the 1846 * hci_update_random_address knows that it's safe to go ahead 1847 * and write a new random address. The flag will be set back on 1848 * as soon as the SET_ADV_ENABLE HCI command completes. 1849 */ 1850 hci_dev_clear_flag(hdev, HCI_LE_ADV); 1851 1852 /* Set require_privacy to true only when non-connectable 1853 * advertising is used. In that case it is fine to use a 1854 * non-resolvable private address. 1855 */ 1856 status = hci_update_random_address_sync(hdev, !connectable, 1857 adv_use_rpa(hdev, flags), 1858 &own_addr_type); 1859 if (status) 1860 return status; 1861 1862 memset(&cp, 0, sizeof(cp)); 1863 1864 if (adv_instance) { 1865 adv_min_interval = adv_instance->min_interval; 1866 adv_max_interval = adv_instance->max_interval; 1867 } else { 1868 adv_min_interval = hdev->le_adv_min_interval; 1869 adv_max_interval = hdev->le_adv_max_interval; 1870 } 1871 1872 if (connectable) { 1873 cp.type = LE_ADV_IND; 1874 } else { 1875 if (hci_adv_instance_is_scannable(hdev, hdev->cur_adv_instance)) 1876 cp.type = LE_ADV_SCAN_IND; 1877 else 1878 cp.type = LE_ADV_NONCONN_IND; 1879 1880 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE) || 1881 hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) { 1882 adv_min_interval = DISCOV_LE_FAST_ADV_INT_MIN; 1883 adv_max_interval = DISCOV_LE_FAST_ADV_INT_MAX; 1884 } 1885 } 1886 1887 cp.min_interval = cpu_to_le16(adv_min_interval); 1888 cp.max_interval = cpu_to_le16(adv_max_interval); 1889 cp.own_address_type = own_addr_type; 1890 cp.channel_map = hdev->le_adv_channel_map; 1891 1892 status = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_PARAM, 1893 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1894 if (status) 1895 return status; 1896 1897 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE, 1898 sizeof(enable), &enable, HCI_CMD_TIMEOUT); 1899 } 1900 1901 static int enable_advertising_sync(struct hci_dev *hdev, void *data) 1902 { 1903 return hci_enable_advertising_sync(hdev); 1904 } 1905 1906 int hci_enable_advertising(struct hci_dev *hdev) 1907 { 1908 if (!hci_dev_test_flag(hdev, HCI_ADVERTISING) && 1909 list_empty(&hdev->adv_instances)) 1910 return 0; 1911 1912 return hci_cmd_sync_queue(hdev, enable_advertising_sync, NULL, NULL); 1913 } 1914 1915 int hci_remove_ext_adv_instance_sync(struct hci_dev *hdev, u8 instance, 1916 struct sock *sk) 1917 { 1918 int err; 1919 1920 if (!ext_adv_capable(hdev)) 1921 return 0; 1922 1923 err = hci_disable_ext_adv_instance_sync(hdev, instance); 1924 if (err) 1925 return err; 1926 1927 /* If request specifies an instance that doesn't exist, fail */ 1928 if (instance > 0 && !hci_find_adv_instance(hdev, instance)) 1929 return -EINVAL; 1930 1931 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_REMOVE_ADV_SET, 1932 sizeof(instance), &instance, 0, 1933 HCI_CMD_TIMEOUT, sk); 1934 } 1935 1936 int hci_le_terminate_big_sync(struct hci_dev *hdev, u8 handle, u8 reason) 1937 { 1938 struct hci_cp_le_term_big cp; 1939 1940 memset(&cp, 0, sizeof(cp)); 1941 cp.handle = handle; 1942 cp.reason = reason; 1943 1944 return __hci_cmd_sync_status(hdev, HCI_OP_LE_TERM_BIG, 1945 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 1946 } 1947 1948 int hci_schedule_adv_instance_sync(struct hci_dev *hdev, u8 instance, 1949 bool force) 1950 { 1951 struct adv_info *adv = NULL; 1952 u16 timeout; 1953 1954 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) && !ext_adv_capable(hdev)) 1955 return -EPERM; 1956 1957 if (hdev->adv_instance_timeout) 1958 return -EBUSY; 1959 1960 adv = hci_find_adv_instance(hdev, instance); 1961 if (!adv) 1962 return -ENOENT; 1963 1964 /* A zero timeout means unlimited advertising. As long as there is 1965 * only one instance, duration should be ignored. We still set a timeout 1966 * in case further instances are being added later on. 1967 * 1968 * If the remaining lifetime of the instance is more than the duration 1969 * then the timeout corresponds to the duration, otherwise it will be 1970 * reduced to the remaining instance lifetime. 1971 */ 1972 if (adv->timeout == 0 || adv->duration <= adv->remaining_time) 1973 timeout = adv->duration; 1974 else 1975 timeout = adv->remaining_time; 1976 1977 /* The remaining time is being reduced unless the instance is being 1978 * advertised without time limit. 1979 */ 1980 if (adv->timeout) 1981 adv->remaining_time = adv->remaining_time - timeout; 1982 1983 /* Only use work for scheduling instances with legacy advertising */ 1984 if (!ext_adv_capable(hdev)) { 1985 hdev->adv_instance_timeout = timeout; 1986 queue_delayed_work(hdev->req_workqueue, 1987 &hdev->adv_instance_expire, 1988 secs_to_jiffies(timeout)); 1989 } 1990 1991 /* If we're just re-scheduling the same instance again then do not 1992 * execute any HCI commands. This happens when a single instance is 1993 * being advertised. 1994 */ 1995 if (!force && hdev->cur_adv_instance == instance && 1996 hci_dev_test_flag(hdev, HCI_LE_ADV)) 1997 return 0; 1998 1999 hdev->cur_adv_instance = instance; 2000 2001 return hci_start_adv_sync(hdev, instance); 2002 } 2003 2004 static int hci_clear_adv_sets_sync(struct hci_dev *hdev, struct sock *sk) 2005 { 2006 int err; 2007 2008 if (!ext_adv_capable(hdev)) 2009 return 0; 2010 2011 /* Disable instance 0x00 to disable all instances */ 2012 err = hci_disable_ext_adv_instance_sync(hdev, 0x00); 2013 if (err) 2014 return err; 2015 2016 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CLEAR_ADV_SETS, 2017 0, NULL, 0, HCI_CMD_TIMEOUT, sk); 2018 } 2019 2020 static int hci_clear_adv_sync(struct hci_dev *hdev, struct sock *sk, bool force) 2021 { 2022 struct adv_info *adv, *n; 2023 2024 if (ext_adv_capable(hdev)) 2025 /* Remove all existing sets */ 2026 return hci_clear_adv_sets_sync(hdev, sk); 2027 2028 /* This is safe as long as there is no command send while the lock is 2029 * held. 2030 */ 2031 hci_dev_lock(hdev); 2032 2033 /* Cleanup non-ext instances */ 2034 list_for_each_entry_safe(adv, n, &hdev->adv_instances, list) { 2035 u8 instance = adv->instance; 2036 int err; 2037 2038 if (!(force || adv->timeout)) 2039 continue; 2040 2041 err = hci_remove_adv_instance(hdev, instance); 2042 if (!err) 2043 mgmt_advertising_removed(sk, hdev, instance); 2044 } 2045 2046 hci_dev_unlock(hdev); 2047 2048 return 0; 2049 } 2050 2051 static int hci_remove_adv_sync(struct hci_dev *hdev, u8 instance, 2052 struct sock *sk) 2053 { 2054 int err; 2055 2056 /* If we use extended advertising, instance has to be removed first. */ 2057 if (ext_adv_capable(hdev)) 2058 return hci_remove_ext_adv_instance_sync(hdev, instance, sk); 2059 2060 /* This is safe as long as there is no command send while the lock is 2061 * held. 2062 */ 2063 hci_dev_lock(hdev); 2064 2065 err = hci_remove_adv_instance(hdev, instance); 2066 if (!err) 2067 mgmt_advertising_removed(sk, hdev, instance); 2068 2069 hci_dev_unlock(hdev); 2070 2071 return err; 2072 } 2073 2074 /* For a single instance: 2075 * - force == true: The instance will be removed even when its remaining 2076 * lifetime is not zero. 2077 * - force == false: the instance will be deactivated but kept stored unless 2078 * the remaining lifetime is zero. 2079 * 2080 * For instance == 0x00: 2081 * - force == true: All instances will be removed regardless of their timeout 2082 * setting. 2083 * - force == false: Only instances that have a timeout will be removed. 2084 */ 2085 int hci_remove_advertising_sync(struct hci_dev *hdev, struct sock *sk, 2086 u8 instance, bool force) 2087 { 2088 struct adv_info *next = NULL; 2089 int err; 2090 2091 /* Cancel any timeout concerning the removed instance(s). */ 2092 if (!instance || hdev->cur_adv_instance == instance) 2093 cancel_adv_timeout(hdev); 2094 2095 /* Get the next instance to advertise BEFORE we remove 2096 * the current one. This can be the same instance again 2097 * if there is only one instance. 2098 */ 2099 if (hdev->cur_adv_instance == instance) 2100 next = hci_get_next_instance(hdev, instance); 2101 2102 if (!instance) { 2103 err = hci_clear_adv_sync(hdev, sk, force); 2104 if (err) 2105 return err; 2106 } else { 2107 struct adv_info *adv = hci_find_adv_instance(hdev, instance); 2108 2109 if (force || (adv && adv->timeout && !adv->remaining_time)) { 2110 /* Don't advertise a removed instance. */ 2111 if (next && next->instance == instance) 2112 next = NULL; 2113 2114 err = hci_remove_adv_sync(hdev, instance, sk); 2115 if (err) 2116 return err; 2117 } 2118 } 2119 2120 if (!hdev_is_powered(hdev) || hci_dev_test_flag(hdev, HCI_ADVERTISING)) 2121 return 0; 2122 2123 if (next && !ext_adv_capable(hdev)) 2124 hci_schedule_adv_instance_sync(hdev, next->instance, false); 2125 2126 return 0; 2127 } 2128 2129 int hci_read_rssi_sync(struct hci_dev *hdev, __le16 handle) 2130 { 2131 struct hci_cp_read_rssi cp; 2132 2133 cp.handle = handle; 2134 return __hci_cmd_sync_status(hdev, HCI_OP_READ_RSSI, 2135 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2136 } 2137 2138 int hci_read_clock_sync(struct hci_dev *hdev, struct hci_cp_read_clock *cp) 2139 { 2140 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CLOCK, 2141 sizeof(*cp), cp, HCI_CMD_TIMEOUT); 2142 } 2143 2144 int hci_read_tx_power_sync(struct hci_dev *hdev, __le16 handle, u8 type) 2145 { 2146 struct hci_cp_read_tx_power cp; 2147 2148 cp.handle = handle; 2149 cp.type = type; 2150 return __hci_cmd_sync_status(hdev, HCI_OP_READ_TX_POWER, 2151 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2152 } 2153 2154 int hci_disable_advertising_sync(struct hci_dev *hdev) 2155 { 2156 u8 enable = 0x00; 2157 2158 /* If controller is not advertising we are done. */ 2159 if (!hci_dev_test_flag(hdev, HCI_LE_ADV)) 2160 return 0; 2161 2162 if (ext_adv_capable(hdev)) 2163 return hci_disable_ext_adv_instance_sync(hdev, 0x00); 2164 2165 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE, 2166 sizeof(enable), &enable, HCI_CMD_TIMEOUT); 2167 } 2168 2169 static int hci_le_set_ext_scan_enable_sync(struct hci_dev *hdev, u8 val, 2170 u8 filter_dup) 2171 { 2172 struct hci_cp_le_set_ext_scan_enable cp; 2173 2174 memset(&cp, 0, sizeof(cp)); 2175 cp.enable = val; 2176 2177 if (hci_dev_test_flag(hdev, HCI_MESH)) 2178 cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE; 2179 else 2180 cp.filter_dup = filter_dup; 2181 2182 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_ENABLE, 2183 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2184 } 2185 2186 static int hci_le_set_scan_enable_sync(struct hci_dev *hdev, u8 val, 2187 u8 filter_dup) 2188 { 2189 struct hci_cp_le_set_scan_enable cp; 2190 2191 if (use_ext_scan(hdev)) 2192 return hci_le_set_ext_scan_enable_sync(hdev, val, filter_dup); 2193 2194 memset(&cp, 0, sizeof(cp)); 2195 cp.enable = val; 2196 2197 if (val && hci_dev_test_flag(hdev, HCI_MESH)) 2198 cp.filter_dup = LE_SCAN_FILTER_DUP_DISABLE; 2199 else 2200 cp.filter_dup = filter_dup; 2201 2202 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_ENABLE, 2203 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2204 } 2205 2206 static int hci_le_set_addr_resolution_enable_sync(struct hci_dev *hdev, u8 val) 2207 { 2208 if (!ll_privacy_capable(hdev)) 2209 return 0; 2210 2211 /* If controller is not/already resolving we are done. */ 2212 if (val == hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) 2213 return 0; 2214 2215 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADDR_RESOLV_ENABLE, 2216 sizeof(val), &val, HCI_CMD_TIMEOUT); 2217 } 2218 2219 static int hci_scan_disable_sync(struct hci_dev *hdev) 2220 { 2221 int err; 2222 2223 /* If controller is not scanning we are done. */ 2224 if (!hci_dev_test_flag(hdev, HCI_LE_SCAN)) 2225 return 0; 2226 2227 if (hdev->scanning_paused) { 2228 bt_dev_dbg(hdev, "Scanning is paused for suspend"); 2229 return 0; 2230 } 2231 2232 err = hci_le_set_scan_enable_sync(hdev, LE_SCAN_DISABLE, 0x00); 2233 if (err) { 2234 bt_dev_err(hdev, "Unable to disable scanning: %d", err); 2235 return err; 2236 } 2237 2238 return err; 2239 } 2240 2241 static bool scan_use_rpa(struct hci_dev *hdev) 2242 { 2243 return hci_dev_test_flag(hdev, HCI_PRIVACY); 2244 } 2245 2246 static void hci_start_interleave_scan(struct hci_dev *hdev) 2247 { 2248 hdev->interleave_scan_state = INTERLEAVE_SCAN_NO_FILTER; 2249 queue_delayed_work(hdev->req_workqueue, 2250 &hdev->interleave_scan, 0); 2251 } 2252 2253 static void cancel_interleave_scan(struct hci_dev *hdev) 2254 { 2255 bt_dev_dbg(hdev, "cancelling interleave scan"); 2256 2257 cancel_delayed_work_sync(&hdev->interleave_scan); 2258 2259 hdev->interleave_scan_state = INTERLEAVE_SCAN_NONE; 2260 } 2261 2262 /* Return true if interleave_scan wasn't started until exiting this function, 2263 * otherwise, return false 2264 */ 2265 static bool hci_update_interleaved_scan_sync(struct hci_dev *hdev) 2266 { 2267 /* Do interleaved scan only if all of the following are true: 2268 * - There is at least one ADV monitor 2269 * - At least one pending LE connection or one device to be scanned for 2270 * - Monitor offloading is not supported 2271 * If so, we should alternate between allowlist scan and one without 2272 * any filters to save power. 2273 */ 2274 bool use_interleaving = hci_is_adv_monitoring(hdev) && 2275 !(list_empty(&hdev->pend_le_conns) && 2276 list_empty(&hdev->pend_le_reports)) && 2277 hci_get_adv_monitor_offload_ext(hdev) == 2278 HCI_ADV_MONITOR_EXT_NONE; 2279 bool is_interleaving = is_interleave_scanning(hdev); 2280 2281 if (use_interleaving && !is_interleaving) { 2282 hci_start_interleave_scan(hdev); 2283 bt_dev_dbg(hdev, "starting interleave scan"); 2284 return true; 2285 } 2286 2287 if (!use_interleaving && is_interleaving) 2288 cancel_interleave_scan(hdev); 2289 2290 return false; 2291 } 2292 2293 /* Removes connection to resolve list if needed.*/ 2294 static int hci_le_del_resolve_list_sync(struct hci_dev *hdev, 2295 bdaddr_t *bdaddr, u8 bdaddr_type) 2296 { 2297 struct hci_cp_le_del_from_resolv_list cp; 2298 struct bdaddr_list_with_irk *entry; 2299 2300 if (!ll_privacy_capable(hdev)) 2301 return 0; 2302 2303 /* Check if the IRK has been programmed */ 2304 entry = hci_bdaddr_list_lookup_with_irk(&hdev->le_resolv_list, bdaddr, 2305 bdaddr_type); 2306 if (!entry) 2307 return 0; 2308 2309 cp.bdaddr_type = bdaddr_type; 2310 bacpy(&cp.bdaddr, bdaddr); 2311 2312 return __hci_cmd_sync_status(hdev, HCI_OP_LE_DEL_FROM_RESOLV_LIST, 2313 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2314 } 2315 2316 static int hci_le_del_accept_list_sync(struct hci_dev *hdev, 2317 bdaddr_t *bdaddr, u8 bdaddr_type) 2318 { 2319 struct hci_cp_le_del_from_accept_list cp; 2320 int err; 2321 2322 /* Check if device is on accept list before removing it */ 2323 if (!hci_bdaddr_list_lookup(&hdev->le_accept_list, bdaddr, bdaddr_type)) 2324 return 0; 2325 2326 cp.bdaddr_type = bdaddr_type; 2327 bacpy(&cp.bdaddr, bdaddr); 2328 2329 /* Ignore errors when removing from resolving list as that is likely 2330 * that the device was never added. 2331 */ 2332 hci_le_del_resolve_list_sync(hdev, &cp.bdaddr, cp.bdaddr_type); 2333 2334 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_DEL_FROM_ACCEPT_LIST, 2335 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2336 if (err) { 2337 bt_dev_err(hdev, "Unable to remove from allow list: %d", err); 2338 return err; 2339 } 2340 2341 bt_dev_dbg(hdev, "Remove %pMR (0x%x) from allow list", &cp.bdaddr, 2342 cp.bdaddr_type); 2343 2344 return 0; 2345 } 2346 2347 struct conn_params { 2348 bdaddr_t addr; 2349 u8 addr_type; 2350 hci_conn_flags_t flags; 2351 u8 privacy_mode; 2352 }; 2353 2354 /* Adds connection to resolve list if needed. 2355 * Setting params to NULL programs local hdev->irk 2356 */ 2357 static int hci_le_add_resolve_list_sync(struct hci_dev *hdev, 2358 struct conn_params *params) 2359 { 2360 struct hci_cp_le_add_to_resolv_list cp; 2361 struct smp_irk *irk; 2362 struct bdaddr_list_with_irk *entry; 2363 struct hci_conn_params *p; 2364 2365 if (!ll_privacy_capable(hdev)) 2366 return 0; 2367 2368 /* Attempt to program local identity address, type and irk if params is 2369 * NULL. 2370 */ 2371 if (!params) { 2372 if (!hci_dev_test_flag(hdev, HCI_PRIVACY)) 2373 return 0; 2374 2375 hci_copy_identity_address(hdev, &cp.bdaddr, &cp.bdaddr_type); 2376 memcpy(cp.peer_irk, hdev->irk, 16); 2377 goto done; 2378 } else if (!(params->flags & HCI_CONN_FLAG_ADDRESS_RESOLUTION)) 2379 return 0; 2380 2381 irk = hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type); 2382 if (!irk) 2383 return 0; 2384 2385 /* Check if the IK has _not_ been programmed yet. */ 2386 entry = hci_bdaddr_list_lookup_with_irk(&hdev->le_resolv_list, 2387 ¶ms->addr, 2388 params->addr_type); 2389 if (entry) 2390 return 0; 2391 2392 cp.bdaddr_type = params->addr_type; 2393 bacpy(&cp.bdaddr, ¶ms->addr); 2394 memcpy(cp.peer_irk, irk->val, 16); 2395 2396 /* Default privacy mode is always Network */ 2397 params->privacy_mode = HCI_NETWORK_PRIVACY; 2398 2399 rcu_read_lock(); 2400 p = hci_pend_le_action_lookup(&hdev->pend_le_conns, 2401 ¶ms->addr, params->addr_type); 2402 if (!p) 2403 p = hci_pend_le_action_lookup(&hdev->pend_le_reports, 2404 ¶ms->addr, params->addr_type); 2405 if (p) 2406 WRITE_ONCE(p->privacy_mode, HCI_NETWORK_PRIVACY); 2407 rcu_read_unlock(); 2408 2409 done: 2410 if (hci_dev_test_flag(hdev, HCI_PRIVACY)) 2411 memcpy(cp.local_irk, hdev->irk, 16); 2412 else 2413 memset(cp.local_irk, 0, 16); 2414 2415 return __hci_cmd_sync_status(hdev, HCI_OP_LE_ADD_TO_RESOLV_LIST, 2416 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2417 } 2418 2419 /* Set Device Privacy Mode. */ 2420 static int hci_le_set_privacy_mode_sync(struct hci_dev *hdev, 2421 struct conn_params *params) 2422 { 2423 struct hci_cp_le_set_privacy_mode cp; 2424 struct smp_irk *irk; 2425 2426 if (!ll_privacy_capable(hdev) || 2427 !(params->flags & HCI_CONN_FLAG_ADDRESS_RESOLUTION)) 2428 return 0; 2429 2430 /* If device privacy mode has already been set there is nothing to do */ 2431 if (params->privacy_mode == HCI_DEVICE_PRIVACY) 2432 return 0; 2433 2434 /* Check if HCI_CONN_FLAG_DEVICE_PRIVACY has been set as it also 2435 * indicates that LL Privacy has been enabled and 2436 * HCI_OP_LE_SET_PRIVACY_MODE is supported. 2437 */ 2438 if (!(params->flags & HCI_CONN_FLAG_DEVICE_PRIVACY)) 2439 return 0; 2440 2441 irk = hci_find_irk_by_addr(hdev, ¶ms->addr, params->addr_type); 2442 if (!irk) 2443 return 0; 2444 2445 memset(&cp, 0, sizeof(cp)); 2446 cp.bdaddr_type = irk->addr_type; 2447 bacpy(&cp.bdaddr, &irk->bdaddr); 2448 cp.mode = HCI_DEVICE_PRIVACY; 2449 2450 /* Note: params->privacy_mode is not updated since it is a copy */ 2451 2452 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_PRIVACY_MODE, 2453 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2454 } 2455 2456 /* Adds connection to allow list if needed, if the device uses RPA (has IRK) 2457 * this attempts to program the device in the resolving list as well and 2458 * properly set the privacy mode. 2459 */ 2460 static int hci_le_add_accept_list_sync(struct hci_dev *hdev, 2461 struct conn_params *params, 2462 u8 *num_entries) 2463 { 2464 struct hci_cp_le_add_to_accept_list cp; 2465 int err; 2466 2467 /* During suspend, only wakeable devices can be in acceptlist */ 2468 if (hdev->suspended && 2469 !(params->flags & HCI_CONN_FLAG_REMOTE_WAKEUP)) { 2470 hci_le_del_accept_list_sync(hdev, ¶ms->addr, 2471 params->addr_type); 2472 return 0; 2473 } 2474 2475 /* Select filter policy to accept all advertising */ 2476 if (*num_entries >= hdev->le_accept_list_size) 2477 return -ENOSPC; 2478 2479 /* Attempt to program the device in the resolving list first to avoid 2480 * having to rollback in case it fails since the resolving list is 2481 * dynamic it can probably be smaller than the accept list. 2482 */ 2483 err = hci_le_add_resolve_list_sync(hdev, params); 2484 if (err) { 2485 bt_dev_err(hdev, "Unable to add to resolve list: %d", err); 2486 return err; 2487 } 2488 2489 /* Set Privacy Mode */ 2490 err = hci_le_set_privacy_mode_sync(hdev, params); 2491 if (err) { 2492 bt_dev_err(hdev, "Unable to set privacy mode: %d", err); 2493 return err; 2494 } 2495 2496 /* Check if already in accept list */ 2497 if (hci_bdaddr_list_lookup(&hdev->le_accept_list, ¶ms->addr, 2498 params->addr_type)) 2499 return 0; 2500 2501 *num_entries += 1; 2502 cp.bdaddr_type = params->addr_type; 2503 bacpy(&cp.bdaddr, ¶ms->addr); 2504 2505 err = __hci_cmd_sync_status(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST, 2506 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 2507 if (err) { 2508 bt_dev_err(hdev, "Unable to add to allow list: %d", err); 2509 /* Rollback the device from the resolving list */ 2510 hci_le_del_resolve_list_sync(hdev, &cp.bdaddr, cp.bdaddr_type); 2511 return err; 2512 } 2513 2514 bt_dev_dbg(hdev, "Add %pMR (0x%x) to allow list", &cp.bdaddr, 2515 cp.bdaddr_type); 2516 2517 return 0; 2518 } 2519 2520 /* This function disables/pause all advertising instances */ 2521 static int hci_pause_advertising_sync(struct hci_dev *hdev) 2522 { 2523 int err; 2524 int old_state; 2525 2526 /* If controller is not advertising we are done. */ 2527 if (!hci_dev_test_flag(hdev, HCI_LE_ADV)) 2528 return 0; 2529 2530 /* If already been paused there is nothing to do. */ 2531 if (hdev->advertising_paused) 2532 return 0; 2533 2534 bt_dev_dbg(hdev, "Pausing directed advertising"); 2535 2536 /* Stop directed advertising */ 2537 old_state = hci_dev_test_flag(hdev, HCI_ADVERTISING); 2538 if (old_state) { 2539 /* When discoverable timeout triggers, then just make sure 2540 * the limited discoverable flag is cleared. Even in the case 2541 * of a timeout triggered from general discoverable, it is 2542 * safe to unconditionally clear the flag. 2543 */ 2544 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 2545 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 2546 hdev->discov_timeout = 0; 2547 } 2548 2549 bt_dev_dbg(hdev, "Pausing advertising instances"); 2550 2551 /* Call to disable any advertisements active on the controller. 2552 * This will succeed even if no advertisements are configured. 2553 */ 2554 err = hci_disable_advertising_sync(hdev); 2555 if (err) 2556 return err; 2557 2558 /* If we are using software rotation, pause the loop */ 2559 if (!ext_adv_capable(hdev)) 2560 cancel_adv_timeout(hdev); 2561 2562 hdev->advertising_paused = true; 2563 hdev->advertising_old_state = old_state; 2564 2565 return 0; 2566 } 2567 2568 /* This function enables all user advertising instances */ 2569 static int hci_resume_advertising_sync(struct hci_dev *hdev) 2570 { 2571 struct adv_info *adv, *tmp; 2572 int err; 2573 2574 /* If advertising has not been paused there is nothing to do. */ 2575 if (!hdev->advertising_paused) 2576 return 0; 2577 2578 /* Resume directed advertising */ 2579 hdev->advertising_paused = false; 2580 if (hdev->advertising_old_state) { 2581 hci_dev_set_flag(hdev, HCI_ADVERTISING); 2582 hdev->advertising_old_state = 0; 2583 } 2584 2585 bt_dev_dbg(hdev, "Resuming advertising instances"); 2586 2587 if (ext_adv_capable(hdev)) { 2588 /* Call for each tracked instance to be re-enabled */ 2589 list_for_each_entry_safe(adv, tmp, &hdev->adv_instances, list) { 2590 err = hci_enable_ext_advertising_sync(hdev, 2591 adv->instance); 2592 if (!err) 2593 continue; 2594 2595 /* If the instance cannot be resumed remove it */ 2596 hci_remove_ext_adv_instance_sync(hdev, adv->instance, 2597 NULL); 2598 } 2599 2600 /* If current advertising instance is set to instance 0x00 2601 * then we need to re-enable it. 2602 */ 2603 if (!hdev->cur_adv_instance) 2604 err = hci_enable_ext_advertising_sync(hdev, 2605 hdev->cur_adv_instance); 2606 } else { 2607 /* Schedule for most recent instance to be restarted and begin 2608 * the software rotation loop 2609 */ 2610 err = hci_schedule_adv_instance_sync(hdev, 2611 hdev->cur_adv_instance, 2612 true); 2613 } 2614 2615 hdev->advertising_paused = false; 2616 2617 return err; 2618 } 2619 2620 static int hci_pause_addr_resolution(struct hci_dev *hdev) 2621 { 2622 int err; 2623 2624 if (!ll_privacy_capable(hdev)) 2625 return 0; 2626 2627 if (!hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) 2628 return 0; 2629 2630 /* Cannot disable addr resolution if scanning is enabled or 2631 * when initiating an LE connection. 2632 */ 2633 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) || 2634 hci_lookup_le_connect(hdev)) { 2635 bt_dev_err(hdev, "Command not allowed when scan/LE connect"); 2636 return -EPERM; 2637 } 2638 2639 /* Cannot disable addr resolution if advertising is enabled. */ 2640 err = hci_pause_advertising_sync(hdev); 2641 if (err) { 2642 bt_dev_err(hdev, "Pause advertising failed: %d", err); 2643 return err; 2644 } 2645 2646 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00); 2647 if (err) 2648 bt_dev_err(hdev, "Unable to disable Address Resolution: %d", 2649 err); 2650 2651 /* Return if address resolution is disabled and RPA is not used. */ 2652 if (!err && scan_use_rpa(hdev)) 2653 return 0; 2654 2655 hci_resume_advertising_sync(hdev); 2656 return err; 2657 } 2658 2659 struct sk_buff *hci_read_local_oob_data_sync(struct hci_dev *hdev, 2660 bool extended, struct sock *sk) 2661 { 2662 u16 opcode = extended ? HCI_OP_READ_LOCAL_OOB_EXT_DATA : 2663 HCI_OP_READ_LOCAL_OOB_DATA; 2664 2665 return __hci_cmd_sync_sk(hdev, opcode, 0, NULL, 0, HCI_CMD_TIMEOUT, sk); 2666 } 2667 2668 static struct conn_params *conn_params_copy(struct list_head *list, size_t *n) 2669 { 2670 struct hci_conn_params *params; 2671 struct conn_params *p; 2672 size_t i; 2673 2674 rcu_read_lock(); 2675 2676 i = 0; 2677 list_for_each_entry_rcu(params, list, action) 2678 ++i; 2679 *n = i; 2680 2681 rcu_read_unlock(); 2682 2683 p = kvcalloc(*n, sizeof(struct conn_params), GFP_KERNEL); 2684 if (!p) 2685 return NULL; 2686 2687 rcu_read_lock(); 2688 2689 i = 0; 2690 list_for_each_entry_rcu(params, list, action) { 2691 /* Racing adds are handled in next scan update */ 2692 if (i >= *n) 2693 break; 2694 2695 /* No hdev->lock, but: addr, addr_type are immutable. 2696 * privacy_mode is only written by us or in 2697 * hci_cc_le_set_privacy_mode that we wait for. 2698 * We should be idempotent so MGMT updating flags 2699 * while we are processing is OK. 2700 */ 2701 bacpy(&p[i].addr, ¶ms->addr); 2702 p[i].addr_type = params->addr_type; 2703 p[i].flags = READ_ONCE(params->flags); 2704 p[i].privacy_mode = READ_ONCE(params->privacy_mode); 2705 ++i; 2706 } 2707 2708 rcu_read_unlock(); 2709 2710 *n = i; 2711 return p; 2712 } 2713 2714 /* Clear LE Accept List */ 2715 static int hci_le_clear_accept_list_sync(struct hci_dev *hdev) 2716 { 2717 if (!(hdev->commands[26] & 0x80)) 2718 return 0; 2719 2720 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CLEAR_ACCEPT_LIST, 0, NULL, 2721 HCI_CMD_TIMEOUT); 2722 } 2723 2724 /* Device must not be scanning when updating the accept list. 2725 * 2726 * Update is done using the following sequence: 2727 * 2728 * ll_privacy_capable((Disable Advertising) -> Disable Resolving List) -> 2729 * Remove Devices From Accept List -> 2730 * (has IRK && ll_privacy_capable(Remove Devices From Resolving List))-> 2731 * Add Devices to Accept List -> 2732 * (has IRK && ll_privacy_capable(Remove Devices From Resolving List)) -> 2733 * ll_privacy_capable(Enable Resolving List -> (Enable Advertising)) -> 2734 * Enable Scanning 2735 * 2736 * In case of failure advertising shall be restored to its original state and 2737 * return would disable accept list since either accept or resolving list could 2738 * not be programmed. 2739 * 2740 */ 2741 static u8 hci_update_accept_list_sync(struct hci_dev *hdev) 2742 { 2743 struct conn_params *params; 2744 struct bdaddr_list *b, *t; 2745 u8 num_entries = 0; 2746 bool pend_conn, pend_report; 2747 u8 filter_policy; 2748 size_t i, n; 2749 int err; 2750 2751 /* Pause advertising if resolving list can be used as controllers 2752 * cannot accept resolving list modifications while advertising. 2753 */ 2754 if (ll_privacy_capable(hdev)) { 2755 err = hci_pause_advertising_sync(hdev); 2756 if (err) { 2757 bt_dev_err(hdev, "pause advertising failed: %d", err); 2758 return 0x00; 2759 } 2760 } 2761 2762 /* Disable address resolution while reprogramming accept list since 2763 * devices that do have an IRK will be programmed in the resolving list 2764 * when LL Privacy is enabled. 2765 */ 2766 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x00); 2767 if (err) { 2768 bt_dev_err(hdev, "Unable to disable LL privacy: %d", err); 2769 goto done; 2770 } 2771 2772 /* Force address filtering if PA Sync is in progress */ 2773 if (hci_dev_test_flag(hdev, HCI_PA_SYNC)) { 2774 struct hci_conn *conn; 2775 2776 conn = hci_conn_hash_lookup_create_pa_sync(hdev); 2777 if (conn) { 2778 struct conn_params pa; 2779 2780 memset(&pa, 0, sizeof(pa)); 2781 2782 bacpy(&pa.addr, &conn->dst); 2783 pa.addr_type = conn->dst_type; 2784 2785 /* Clear first since there could be addresses left 2786 * behind. 2787 */ 2788 hci_le_clear_accept_list_sync(hdev); 2789 2790 num_entries = 1; 2791 err = hci_le_add_accept_list_sync(hdev, &pa, 2792 &num_entries); 2793 goto done; 2794 } 2795 } 2796 2797 /* Go through the current accept list programmed into the 2798 * controller one by one and check if that address is connected or is 2799 * still in the list of pending connections or list of devices to 2800 * report. If not present in either list, then remove it from 2801 * the controller. 2802 */ 2803 list_for_each_entry_safe(b, t, &hdev->le_accept_list, list) { 2804 if (hci_conn_hash_lookup_le(hdev, &b->bdaddr, b->bdaddr_type)) 2805 continue; 2806 2807 /* Pointers not dereferenced, no locks needed */ 2808 pend_conn = hci_pend_le_action_lookup(&hdev->pend_le_conns, 2809 &b->bdaddr, 2810 b->bdaddr_type); 2811 pend_report = hci_pend_le_action_lookup(&hdev->pend_le_reports, 2812 &b->bdaddr, 2813 b->bdaddr_type); 2814 2815 /* If the device is not likely to connect or report, 2816 * remove it from the acceptlist. 2817 */ 2818 if (!pend_conn && !pend_report) { 2819 hci_le_del_accept_list_sync(hdev, &b->bdaddr, 2820 b->bdaddr_type); 2821 continue; 2822 } 2823 2824 num_entries++; 2825 } 2826 2827 /* Since all no longer valid accept list entries have been 2828 * removed, walk through the list of pending connections 2829 * and ensure that any new device gets programmed into 2830 * the controller. 2831 * 2832 * If the list of the devices is larger than the list of 2833 * available accept list entries in the controller, then 2834 * just abort and return filer policy value to not use the 2835 * accept list. 2836 * 2837 * The list and params may be mutated while we wait for events, 2838 * so make a copy and iterate it. 2839 */ 2840 2841 params = conn_params_copy(&hdev->pend_le_conns, &n); 2842 if (!params) { 2843 err = -ENOMEM; 2844 goto done; 2845 } 2846 2847 for (i = 0; i < n; ++i) { 2848 err = hci_le_add_accept_list_sync(hdev, ¶ms[i], 2849 &num_entries); 2850 if (err) { 2851 kvfree(params); 2852 goto done; 2853 } 2854 } 2855 2856 kvfree(params); 2857 2858 /* After adding all new pending connections, walk through 2859 * the list of pending reports and also add these to the 2860 * accept list if there is still space. Abort if space runs out. 2861 */ 2862 2863 params = conn_params_copy(&hdev->pend_le_reports, &n); 2864 if (!params) { 2865 err = -ENOMEM; 2866 goto done; 2867 } 2868 2869 for (i = 0; i < n; ++i) { 2870 err = hci_le_add_accept_list_sync(hdev, ¶ms[i], 2871 &num_entries); 2872 if (err) { 2873 kvfree(params); 2874 goto done; 2875 } 2876 } 2877 2878 kvfree(params); 2879 2880 /* Use the allowlist unless the following conditions are all true: 2881 * - We are not currently suspending 2882 * - There are 1 or more ADV monitors registered and it's not offloaded 2883 * - Interleaved scanning is not currently using the allowlist 2884 */ 2885 if (!idr_is_empty(&hdev->adv_monitors_idr) && !hdev->suspended && 2886 hci_get_adv_monitor_offload_ext(hdev) == HCI_ADV_MONITOR_EXT_NONE && 2887 hdev->interleave_scan_state != INTERLEAVE_SCAN_ALLOWLIST) 2888 err = -EINVAL; 2889 2890 done: 2891 filter_policy = err ? 0x00 : 0x01; 2892 2893 /* Enable address resolution when LL Privacy is enabled. */ 2894 err = hci_le_set_addr_resolution_enable_sync(hdev, 0x01); 2895 if (err) 2896 bt_dev_err(hdev, "Unable to enable LL privacy: %d", err); 2897 2898 /* Resume advertising if it was paused */ 2899 if (ll_privacy_capable(hdev)) 2900 hci_resume_advertising_sync(hdev); 2901 2902 /* Select filter policy to use accept list */ 2903 return filter_policy; 2904 } 2905 2906 static void hci_le_scan_phy_params(struct hci_cp_le_scan_phy_params *cp, 2907 u8 type, u16 interval, u16 window) 2908 { 2909 cp->type = type; 2910 cp->interval = cpu_to_le16(interval); 2911 cp->window = cpu_to_le16(window); 2912 } 2913 2914 static int hci_le_set_ext_scan_param_sync(struct hci_dev *hdev, u8 type, 2915 u16 interval, u16 window, 2916 u8 own_addr_type, u8 filter_policy) 2917 { 2918 struct hci_cp_le_set_ext_scan_params *cp; 2919 struct hci_cp_le_scan_phy_params *phy; 2920 u8 data[sizeof(*cp) + sizeof(*phy) * 2]; 2921 u8 num_phy = 0x00; 2922 2923 cp = (void *)data; 2924 phy = (void *)cp->data; 2925 2926 memset(data, 0, sizeof(data)); 2927 2928 cp->own_addr_type = own_addr_type; 2929 cp->filter_policy = filter_policy; 2930 2931 /* Check if PA Sync is in progress then select the PHY based on the 2932 * hci_conn.iso_qos. 2933 */ 2934 if (hci_dev_test_flag(hdev, HCI_PA_SYNC)) { 2935 struct hci_cp_le_add_to_accept_list *sent; 2936 2937 sent = hci_sent_cmd_data(hdev, HCI_OP_LE_ADD_TO_ACCEPT_LIST); 2938 if (sent) { 2939 struct hci_conn *conn; 2940 2941 conn = hci_conn_hash_lookup_ba(hdev, PA_LINK, 2942 &sent->bdaddr); 2943 if (conn) { 2944 struct bt_iso_qos *qos = &conn->iso_qos; 2945 2946 if (qos->bcast.in.phy & BT_ISO_PHY_1M || 2947 qos->bcast.in.phy & BT_ISO_PHY_2M) { 2948 cp->scanning_phys |= LE_SCAN_PHY_1M; 2949 hci_le_scan_phy_params(phy, type, 2950 interval, 2951 window); 2952 num_phy++; 2953 phy++; 2954 } 2955 2956 if (qos->bcast.in.phy & BT_ISO_PHY_CODED) { 2957 cp->scanning_phys |= LE_SCAN_PHY_CODED; 2958 hci_le_scan_phy_params(phy, type, 2959 interval * 3, 2960 window * 3); 2961 num_phy++; 2962 phy++; 2963 } 2964 2965 if (num_phy) 2966 goto done; 2967 } 2968 } 2969 } 2970 2971 if (scan_1m(hdev) || scan_2m(hdev)) { 2972 cp->scanning_phys |= LE_SCAN_PHY_1M; 2973 hci_le_scan_phy_params(phy, type, interval, window); 2974 num_phy++; 2975 phy++; 2976 } 2977 2978 if (scan_coded(hdev)) { 2979 cp->scanning_phys |= LE_SCAN_PHY_CODED; 2980 hci_le_scan_phy_params(phy, type, interval * 3, window * 3); 2981 num_phy++; 2982 phy++; 2983 } 2984 2985 done: 2986 if (!num_phy) 2987 return -EINVAL; 2988 2989 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EXT_SCAN_PARAMS, 2990 sizeof(*cp) + sizeof(*phy) * num_phy, 2991 data, HCI_CMD_TIMEOUT); 2992 } 2993 2994 static int hci_le_set_scan_param_sync(struct hci_dev *hdev, u8 type, 2995 u16 interval, u16 window, 2996 u8 own_addr_type, u8 filter_policy) 2997 { 2998 struct hci_cp_le_set_scan_param cp; 2999 3000 if (use_ext_scan(hdev)) 3001 return hci_le_set_ext_scan_param_sync(hdev, type, interval, 3002 window, own_addr_type, 3003 filter_policy); 3004 3005 memset(&cp, 0, sizeof(cp)); 3006 cp.type = type; 3007 cp.interval = cpu_to_le16(interval); 3008 cp.window = cpu_to_le16(window); 3009 cp.own_address_type = own_addr_type; 3010 cp.filter_policy = filter_policy; 3011 3012 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_SCAN_PARAM, 3013 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 3014 } 3015 3016 static int hci_start_scan_sync(struct hci_dev *hdev, u8 type, u16 interval, 3017 u16 window, u8 own_addr_type, u8 filter_policy, 3018 u8 filter_dup) 3019 { 3020 int err; 3021 3022 if (hdev->scanning_paused) { 3023 bt_dev_dbg(hdev, "Scanning is paused for suspend"); 3024 return 0; 3025 } 3026 3027 err = hci_le_set_scan_param_sync(hdev, type, interval, window, 3028 own_addr_type, filter_policy); 3029 if (err) 3030 return err; 3031 3032 return hci_le_set_scan_enable_sync(hdev, LE_SCAN_ENABLE, filter_dup); 3033 } 3034 3035 static int hci_passive_scan_sync(struct hci_dev *hdev) 3036 { 3037 u8 own_addr_type; 3038 u8 filter_policy; 3039 u16 window, interval; 3040 u8 filter_dups = LE_SCAN_FILTER_DUP_ENABLE; 3041 int err; 3042 3043 if (hdev->scanning_paused) { 3044 bt_dev_dbg(hdev, "Scanning is paused for suspend"); 3045 return 0; 3046 } 3047 3048 err = hci_scan_disable_sync(hdev); 3049 if (err) { 3050 bt_dev_err(hdev, "disable scanning failed: %d", err); 3051 return err; 3052 } 3053 3054 /* Set require_privacy to false since no SCAN_REQ are send 3055 * during passive scanning. Not using an non-resolvable address 3056 * here is important so that peer devices using direct 3057 * advertising with our address will be correctly reported 3058 * by the controller. 3059 */ 3060 if (hci_update_random_address_sync(hdev, false, scan_use_rpa(hdev), 3061 &own_addr_type)) 3062 return 0; 3063 3064 if (hdev->enable_advmon_interleave_scan && 3065 hci_update_interleaved_scan_sync(hdev)) 3066 return 0; 3067 3068 bt_dev_dbg(hdev, "interleave state %d", hdev->interleave_scan_state); 3069 3070 /* Adding or removing entries from the accept list must 3071 * happen before enabling scanning. The controller does 3072 * not allow accept list modification while scanning. 3073 */ 3074 filter_policy = hci_update_accept_list_sync(hdev); 3075 3076 /* If suspended and filter_policy set to 0x00 (no acceptlist) then 3077 * passive scanning cannot be started since that would require the host 3078 * to be woken up to process the reports. 3079 */ 3080 if (hdev->suspended && !filter_policy) { 3081 /* Check if accept list is empty then there is no need to scan 3082 * while suspended. 3083 */ 3084 if (list_empty(&hdev->le_accept_list)) 3085 return 0; 3086 3087 /* If there are devices is the accept_list that means some 3088 * devices could not be programmed which in non-suspended case 3089 * means filter_policy needs to be set to 0x00 so the host needs 3090 * to filter, but since this is treating suspended case we 3091 * can ignore device needing host to filter to allow devices in 3092 * the acceptlist to be able to wakeup the system. 3093 */ 3094 filter_policy = 0x01; 3095 } 3096 3097 /* When the controller is using random resolvable addresses and 3098 * with that having LE privacy enabled, then controllers with 3099 * Extended Scanner Filter Policies support can now enable support 3100 * for handling directed advertising. 3101 * 3102 * So instead of using filter polices 0x00 (no acceptlist) 3103 * and 0x01 (acceptlist enabled) use the new filter policies 3104 * 0x02 (no acceptlist) and 0x03 (acceptlist enabled). 3105 */ 3106 if (hci_dev_test_flag(hdev, HCI_PRIVACY) && 3107 (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY)) 3108 filter_policy |= 0x02; 3109 3110 if (hdev->suspended) { 3111 window = hdev->le_scan_window_suspend; 3112 interval = hdev->le_scan_int_suspend; 3113 } else if (hci_is_le_conn_scanning(hdev)) { 3114 window = hdev->le_scan_window_connect; 3115 interval = hdev->le_scan_int_connect; 3116 } else if (hci_is_adv_monitoring(hdev)) { 3117 window = hdev->le_scan_window_adv_monitor; 3118 interval = hdev->le_scan_int_adv_monitor; 3119 3120 /* Disable duplicates filter when scanning for advertisement 3121 * monitor for the following reasons. 3122 * 3123 * For HW pattern filtering (ex. MSFT), Realtek and Qualcomm 3124 * controllers ignore RSSI_Sampling_Period when the duplicates 3125 * filter is enabled. 3126 * 3127 * For SW pattern filtering, when we're not doing interleaved 3128 * scanning, it is necessary to disable duplicates filter, 3129 * otherwise hosts can only receive one advertisement and it's 3130 * impossible to know if a peer is still in range. 3131 */ 3132 filter_dups = LE_SCAN_FILTER_DUP_DISABLE; 3133 } else { 3134 window = hdev->le_scan_window; 3135 interval = hdev->le_scan_interval; 3136 } 3137 3138 /* Disable all filtering for Mesh */ 3139 if (hci_dev_test_flag(hdev, HCI_MESH)) { 3140 filter_policy = 0; 3141 filter_dups = LE_SCAN_FILTER_DUP_DISABLE; 3142 } 3143 3144 bt_dev_dbg(hdev, "LE passive scan with acceptlist = %d", filter_policy); 3145 3146 return hci_start_scan_sync(hdev, LE_SCAN_PASSIVE, interval, window, 3147 own_addr_type, filter_policy, filter_dups); 3148 } 3149 3150 /* This function controls the passive scanning based on hdev->pend_le_conns 3151 * list. If there are pending LE connection we start the background scanning, 3152 * otherwise we stop it in the following sequence: 3153 * 3154 * If there are devices to scan: 3155 * 3156 * Disable Scanning -> Update Accept List -> 3157 * ll_privacy_capable((Disable Advertising) -> Disable Resolving List -> 3158 * Update Resolving List -> Enable Resolving List -> (Enable Advertising)) -> 3159 * Enable Scanning 3160 * 3161 * Otherwise: 3162 * 3163 * Disable Scanning 3164 */ 3165 int hci_update_passive_scan_sync(struct hci_dev *hdev) 3166 { 3167 int err; 3168 3169 if (!test_bit(HCI_UP, &hdev->flags) || 3170 test_bit(HCI_INIT, &hdev->flags) || 3171 hci_dev_test_flag(hdev, HCI_SETUP) || 3172 hci_dev_test_flag(hdev, HCI_CONFIG) || 3173 hci_dev_test_flag(hdev, HCI_AUTO_OFF) || 3174 hci_dev_test_flag(hdev, HCI_UNREGISTER)) 3175 return 0; 3176 3177 /* No point in doing scanning if LE support hasn't been enabled */ 3178 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 3179 return 0; 3180 3181 /* If discovery is active don't interfere with it */ 3182 if (hdev->discovery.state != DISCOVERY_STOPPED) 3183 return 0; 3184 3185 /* Reset RSSI and UUID filters when starting background scanning 3186 * since these filters are meant for service discovery only. 3187 * 3188 * The Start Discovery and Start Service Discovery operations 3189 * ensure to set proper values for RSSI threshold and UUID 3190 * filter list. So it is safe to just reset them here. 3191 */ 3192 hci_discovery_filter_clear(hdev); 3193 3194 bt_dev_dbg(hdev, "ADV monitoring is %s", 3195 hci_is_adv_monitoring(hdev) ? "on" : "off"); 3196 3197 if (!hci_dev_test_flag(hdev, HCI_MESH) && 3198 list_empty(&hdev->pend_le_conns) && 3199 list_empty(&hdev->pend_le_reports) && 3200 !hci_is_adv_monitoring(hdev) && 3201 !hci_dev_test_flag(hdev, HCI_PA_SYNC)) { 3202 /* If there is no pending LE connections or devices 3203 * to be scanned for or no ADV monitors, we should stop the 3204 * background scanning. 3205 */ 3206 3207 bt_dev_dbg(hdev, "stopping background scanning"); 3208 3209 err = hci_scan_disable_sync(hdev); 3210 if (err) 3211 bt_dev_err(hdev, "stop background scanning failed: %d", 3212 err); 3213 } else { 3214 /* If there is at least one pending LE connection, we should 3215 * keep the background scan running. 3216 */ 3217 3218 /* If controller is connecting, we should not start scanning 3219 * since some controllers are not able to scan and connect at 3220 * the same time. 3221 */ 3222 if (hci_lookup_le_connect(hdev)) 3223 return 0; 3224 3225 bt_dev_dbg(hdev, "start background scanning"); 3226 3227 err = hci_passive_scan_sync(hdev); 3228 if (err) 3229 bt_dev_err(hdev, "start background scanning failed: %d", 3230 err); 3231 } 3232 3233 return err; 3234 } 3235 3236 static int update_scan_sync(struct hci_dev *hdev, void *data) 3237 { 3238 return hci_update_scan_sync(hdev); 3239 } 3240 3241 int hci_update_scan(struct hci_dev *hdev) 3242 { 3243 return hci_cmd_sync_queue(hdev, update_scan_sync, NULL, NULL); 3244 } 3245 3246 static int update_passive_scan_sync(struct hci_dev *hdev, void *data) 3247 { 3248 return hci_update_passive_scan_sync(hdev); 3249 } 3250 3251 int hci_update_passive_scan(struct hci_dev *hdev) 3252 { 3253 /* Only queue if it would have any effect */ 3254 if (!test_bit(HCI_UP, &hdev->flags) || 3255 test_bit(HCI_INIT, &hdev->flags) || 3256 hci_dev_test_flag(hdev, HCI_SETUP) || 3257 hci_dev_test_flag(hdev, HCI_CONFIG) || 3258 hci_dev_test_flag(hdev, HCI_AUTO_OFF) || 3259 hci_dev_test_flag(hdev, HCI_UNREGISTER)) 3260 return 0; 3261 3262 return hci_cmd_sync_queue_once(hdev, update_passive_scan_sync, NULL, 3263 NULL); 3264 } 3265 3266 int hci_write_sc_support_sync(struct hci_dev *hdev, u8 val) 3267 { 3268 int err; 3269 3270 if (!bredr_sc_enabled(hdev) || lmp_host_sc_capable(hdev)) 3271 return 0; 3272 3273 err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SC_SUPPORT, 3274 sizeof(val), &val, HCI_CMD_TIMEOUT); 3275 3276 if (!err) { 3277 if (val) { 3278 hdev->features[1][0] |= LMP_HOST_SC; 3279 hci_dev_set_flag(hdev, HCI_SC_ENABLED); 3280 } else { 3281 hdev->features[1][0] &= ~LMP_HOST_SC; 3282 hci_dev_clear_flag(hdev, HCI_SC_ENABLED); 3283 } 3284 } 3285 3286 return err; 3287 } 3288 3289 int hci_write_ssp_mode_sync(struct hci_dev *hdev, u8 mode) 3290 { 3291 int err; 3292 3293 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED) || 3294 lmp_host_ssp_capable(hdev)) 3295 return 0; 3296 3297 if (!mode && hci_dev_test_flag(hdev, HCI_USE_DEBUG_KEYS)) { 3298 __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_DEBUG_MODE, 3299 sizeof(mode), &mode, HCI_CMD_TIMEOUT); 3300 } 3301 3302 err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_MODE, 3303 sizeof(mode), &mode, HCI_CMD_TIMEOUT); 3304 if (err) 3305 return err; 3306 3307 return hci_write_sc_support_sync(hdev, 0x01); 3308 } 3309 3310 int hci_write_le_host_supported_sync(struct hci_dev *hdev, u8 le, u8 simul) 3311 { 3312 struct hci_cp_write_le_host_supported cp; 3313 3314 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED) || 3315 !lmp_bredr_capable(hdev)) 3316 return 0; 3317 3318 /* Check first if we already have the right host state 3319 * (host features set) 3320 */ 3321 if (le == lmp_host_le_capable(hdev) && 3322 simul == lmp_host_le_br_capable(hdev)) 3323 return 0; 3324 3325 memset(&cp, 0, sizeof(cp)); 3326 3327 cp.le = le; 3328 cp.simul = simul; 3329 3330 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, 3331 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 3332 } 3333 3334 static int hci_powered_update_adv_sync(struct hci_dev *hdev) 3335 { 3336 struct adv_info *adv, *tmp; 3337 int err; 3338 3339 if (!hci_dev_test_flag(hdev, HCI_LE_ENABLED)) 3340 return 0; 3341 3342 /* If RPA Resolution has not been enable yet it means the 3343 * resolving list is empty and we should attempt to program the 3344 * local IRK in order to support using own_addr_type 3345 * ADDR_LE_DEV_RANDOM_RESOLVED (0x03). 3346 */ 3347 if (!hci_dev_test_flag(hdev, HCI_LL_RPA_RESOLUTION)) { 3348 hci_le_add_resolve_list_sync(hdev, NULL); 3349 hci_le_set_addr_resolution_enable_sync(hdev, 0x01); 3350 } 3351 3352 /* Make sure the controller has a good default for 3353 * advertising data. This also applies to the case 3354 * where BR/EDR was toggled during the AUTO_OFF phase. 3355 */ 3356 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) && 3357 list_empty(&hdev->adv_instances)) { 3358 if (ext_adv_capable(hdev)) { 3359 err = hci_setup_ext_adv_instance_sync(hdev, 0x00); 3360 if (!err) 3361 hci_update_scan_rsp_data_sync(hdev, 0x00); 3362 } else { 3363 err = hci_update_adv_data_sync(hdev, 0x00); 3364 if (!err) 3365 hci_update_scan_rsp_data_sync(hdev, 0x00); 3366 } 3367 3368 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) 3369 hci_enable_advertising_sync(hdev); 3370 } 3371 3372 /* Call for each tracked instance to be scheduled */ 3373 list_for_each_entry_safe(adv, tmp, &hdev->adv_instances, list) 3374 hci_schedule_adv_instance_sync(hdev, adv->instance, true); 3375 3376 return 0; 3377 } 3378 3379 static int hci_write_auth_enable_sync(struct hci_dev *hdev) 3380 { 3381 u8 link_sec; 3382 3383 link_sec = hci_dev_test_flag(hdev, HCI_LINK_SECURITY); 3384 if (link_sec == test_bit(HCI_AUTH, &hdev->flags)) 3385 return 0; 3386 3387 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_AUTH_ENABLE, 3388 sizeof(link_sec), &link_sec, 3389 HCI_CMD_TIMEOUT); 3390 } 3391 3392 int hci_write_fast_connectable_sync(struct hci_dev *hdev, bool enable) 3393 { 3394 struct hci_cp_write_page_scan_activity cp; 3395 u8 type; 3396 int err = 0; 3397 3398 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 3399 return 0; 3400 3401 if (hdev->hci_ver < BLUETOOTH_VER_1_2) 3402 return 0; 3403 3404 memset(&cp, 0, sizeof(cp)); 3405 3406 if (enable) { 3407 type = PAGE_SCAN_TYPE_INTERLACED; 3408 3409 /* 160 msec page scan interval */ 3410 cp.interval = cpu_to_le16(0x0100); 3411 } else { 3412 type = hdev->def_page_scan_type; 3413 cp.interval = cpu_to_le16(hdev->def_page_scan_int); 3414 } 3415 3416 cp.window = cpu_to_le16(hdev->def_page_scan_window); 3417 3418 if (__cpu_to_le16(hdev->page_scan_interval) != cp.interval || 3419 __cpu_to_le16(hdev->page_scan_window) != cp.window) { 3420 err = __hci_cmd_sync_status(hdev, 3421 HCI_OP_WRITE_PAGE_SCAN_ACTIVITY, 3422 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 3423 if (err) 3424 return err; 3425 } 3426 3427 if (hdev->page_scan_type != type) 3428 err = __hci_cmd_sync_status(hdev, 3429 HCI_OP_WRITE_PAGE_SCAN_TYPE, 3430 sizeof(type), &type, 3431 HCI_CMD_TIMEOUT); 3432 3433 return err; 3434 } 3435 3436 static bool disconnected_accept_list_entries(struct hci_dev *hdev) 3437 { 3438 struct bdaddr_list *b; 3439 3440 list_for_each_entry(b, &hdev->accept_list, list) { 3441 struct hci_conn *conn; 3442 3443 conn = hci_conn_hash_lookup_ba(hdev, ACL_LINK, &b->bdaddr); 3444 if (!conn) 3445 return true; 3446 3447 if (conn->state != BT_CONNECTED && conn->state != BT_CONFIG) 3448 return true; 3449 } 3450 3451 return false; 3452 } 3453 3454 static int hci_write_scan_enable_sync(struct hci_dev *hdev, u8 val) 3455 { 3456 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SCAN_ENABLE, 3457 sizeof(val), &val, 3458 HCI_CMD_TIMEOUT); 3459 } 3460 3461 int hci_update_scan_sync(struct hci_dev *hdev) 3462 { 3463 u8 scan; 3464 3465 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 3466 return 0; 3467 3468 if (!hdev_is_powered(hdev)) 3469 return 0; 3470 3471 if (mgmt_powering_down(hdev)) 3472 return 0; 3473 3474 if (hdev->scanning_paused) 3475 return 0; 3476 3477 if (hci_dev_test_flag(hdev, HCI_CONNECTABLE) || 3478 disconnected_accept_list_entries(hdev)) 3479 scan = SCAN_PAGE; 3480 else 3481 scan = SCAN_DISABLED; 3482 3483 if (hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 3484 scan |= SCAN_INQUIRY; 3485 3486 if (test_bit(HCI_PSCAN, &hdev->flags) == !!(scan & SCAN_PAGE) && 3487 test_bit(HCI_ISCAN, &hdev->flags) == !!(scan & SCAN_INQUIRY)) 3488 return 0; 3489 3490 return hci_write_scan_enable_sync(hdev, scan); 3491 } 3492 3493 int hci_update_name_sync(struct hci_dev *hdev, const u8 *name) 3494 { 3495 struct hci_cp_write_local_name cp; 3496 3497 memset(&cp, 0, sizeof(cp)); 3498 3499 memcpy(cp.name, name, sizeof(cp.name)); 3500 3501 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LOCAL_NAME, 3502 sizeof(cp), &cp, 3503 HCI_CMD_TIMEOUT); 3504 } 3505 3506 /* This function perform powered update HCI command sequence after the HCI init 3507 * sequence which end up resetting all states, the sequence is as follows: 3508 * 3509 * HCI_SSP_ENABLED(Enable SSP) 3510 * HCI_LE_ENABLED(Enable LE) 3511 * HCI_LE_ENABLED(ll_privacy_capable(Add local IRK to Resolving List) -> 3512 * Update adv data) 3513 * Enable Authentication 3514 * lmp_bredr_capable(Set Fast Connectable -> Set Scan Type -> Set Class -> 3515 * Set Name -> Set EIR) 3516 * HCI_FORCE_STATIC_ADDR | BDADDR_ANY && !HCI_BREDR_ENABLED (Set Static Address) 3517 */ 3518 int hci_powered_update_sync(struct hci_dev *hdev) 3519 { 3520 int err; 3521 3522 /* Register the available SMP channels (BR/EDR and LE) only when 3523 * successfully powering on the controller. This late 3524 * registration is required so that LE SMP can clearly decide if 3525 * the public address or static address is used. 3526 */ 3527 smp_register(hdev); 3528 3529 err = hci_write_ssp_mode_sync(hdev, 0x01); 3530 if (err) 3531 return err; 3532 3533 err = hci_write_le_host_supported_sync(hdev, 0x01, 0x00); 3534 if (err) 3535 return err; 3536 3537 err = hci_powered_update_adv_sync(hdev); 3538 if (err) 3539 return err; 3540 3541 err = hci_write_auth_enable_sync(hdev); 3542 if (err) 3543 return err; 3544 3545 if (lmp_bredr_capable(hdev)) { 3546 if (hci_dev_test_flag(hdev, HCI_FAST_CONNECTABLE)) 3547 hci_write_fast_connectable_sync(hdev, true); 3548 else 3549 hci_write_fast_connectable_sync(hdev, false); 3550 hci_update_scan_sync(hdev); 3551 hci_update_class_sync(hdev); 3552 hci_update_name_sync(hdev, hdev->dev_name); 3553 hci_update_eir_sync(hdev); 3554 } 3555 3556 /* If forcing static address is in use or there is no public 3557 * address use the static address as random address (but skip 3558 * the HCI command if the current random address is already the 3559 * static one. 3560 * 3561 * In case BR/EDR has been disabled on a dual-mode controller 3562 * and a static address has been configured, then use that 3563 * address instead of the public BR/EDR address. 3564 */ 3565 if (hci_dev_test_flag(hdev, HCI_FORCE_STATIC_ADDR) || 3566 (!bacmp(&hdev->bdaddr, BDADDR_ANY) && 3567 !hci_dev_test_flag(hdev, HCI_BREDR_ENABLED))) { 3568 if (bacmp(&hdev->static_addr, BDADDR_ANY)) 3569 return hci_set_random_addr_sync(hdev, 3570 &hdev->static_addr); 3571 } 3572 3573 return 0; 3574 } 3575 3576 /** 3577 * hci_dev_get_bd_addr_from_property - Get the Bluetooth Device Address 3578 * (BD_ADDR) for a HCI device from 3579 * a firmware node property. 3580 * @hdev: The HCI device 3581 * 3582 * Search the firmware node for 'local-bd-address'. 3583 * 3584 * All-zero BD addresses are rejected, because those could be properties 3585 * that exist in the firmware tables, but were not updated by the firmware. For 3586 * example, the DTS could define 'local-bd-address', with zero BD addresses. 3587 */ 3588 static void hci_dev_get_bd_addr_from_property(struct hci_dev *hdev) 3589 { 3590 struct fwnode_handle *fwnode = dev_fwnode(hdev->dev.parent); 3591 bdaddr_t ba; 3592 int ret; 3593 3594 ret = fwnode_property_read_u8_array(fwnode, "local-bd-address", 3595 (u8 *)&ba, sizeof(ba)); 3596 if (ret < 0 || !bacmp(&ba, BDADDR_ANY)) 3597 return; 3598 3599 if (hci_test_quirk(hdev, HCI_QUIRK_BDADDR_PROPERTY_BROKEN)) 3600 baswap(&hdev->public_addr, &ba); 3601 else 3602 bacpy(&hdev->public_addr, &ba); 3603 } 3604 3605 struct hci_init_stage { 3606 int (*func)(struct hci_dev *hdev); 3607 }; 3608 3609 /* Run init stage NULL terminated function table */ 3610 static int hci_init_stage_sync(struct hci_dev *hdev, 3611 const struct hci_init_stage *stage) 3612 { 3613 size_t i; 3614 3615 for (i = 0; stage[i].func; i++) { 3616 int err; 3617 3618 err = stage[i].func(hdev); 3619 if (err) 3620 return err; 3621 } 3622 3623 return 0; 3624 } 3625 3626 /* Read Local Version */ 3627 static int hci_read_local_version_sync(struct hci_dev *hdev) 3628 { 3629 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_VERSION, 3630 0, NULL, HCI_CMD_TIMEOUT); 3631 } 3632 3633 /* Read BD Address */ 3634 static int hci_read_bd_addr_sync(struct hci_dev *hdev) 3635 { 3636 return __hci_cmd_sync_status(hdev, HCI_OP_READ_BD_ADDR, 3637 0, NULL, HCI_CMD_TIMEOUT); 3638 } 3639 3640 #define HCI_INIT(_func) \ 3641 { \ 3642 .func = _func, \ 3643 } 3644 3645 static const struct hci_init_stage hci_init0[] = { 3646 /* HCI_OP_READ_LOCAL_VERSION */ 3647 HCI_INIT(hci_read_local_version_sync), 3648 /* HCI_OP_READ_BD_ADDR */ 3649 HCI_INIT(hci_read_bd_addr_sync), 3650 {} 3651 }; 3652 3653 int hci_reset_sync(struct hci_dev *hdev) 3654 { 3655 int err; 3656 3657 set_bit(HCI_RESET, &hdev->flags); 3658 3659 err = __hci_cmd_sync_status(hdev, HCI_OP_RESET, 0, NULL, 3660 HCI_CMD_TIMEOUT); 3661 if (err) 3662 return err; 3663 3664 return 0; 3665 } 3666 3667 static int hci_init0_sync(struct hci_dev *hdev) 3668 { 3669 int err; 3670 3671 bt_dev_dbg(hdev, ""); 3672 3673 /* Reset */ 3674 if (!hci_test_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE)) { 3675 err = hci_reset_sync(hdev); 3676 if (err) 3677 return err; 3678 } 3679 3680 return hci_init_stage_sync(hdev, hci_init0); 3681 } 3682 3683 static int hci_unconf_init_sync(struct hci_dev *hdev) 3684 { 3685 int err; 3686 3687 if (hci_test_quirk(hdev, HCI_QUIRK_RAW_DEVICE)) 3688 return 0; 3689 3690 err = hci_init0_sync(hdev); 3691 if (err < 0) 3692 return err; 3693 3694 if (hci_dev_test_flag(hdev, HCI_SETUP)) 3695 hci_debugfs_create_basic(hdev); 3696 3697 return 0; 3698 } 3699 3700 /* Read Local Supported Features. */ 3701 static int hci_read_local_features_sync(struct hci_dev *hdev) 3702 { 3703 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_FEATURES, 3704 0, NULL, HCI_CMD_TIMEOUT); 3705 } 3706 3707 /* BR Controller init stage 1 command sequence */ 3708 static const struct hci_init_stage br_init1[] = { 3709 /* HCI_OP_READ_LOCAL_FEATURES */ 3710 HCI_INIT(hci_read_local_features_sync), 3711 /* HCI_OP_READ_LOCAL_VERSION */ 3712 HCI_INIT(hci_read_local_version_sync), 3713 /* HCI_OP_READ_BD_ADDR */ 3714 HCI_INIT(hci_read_bd_addr_sync), 3715 {} 3716 }; 3717 3718 /* Read Local Commands */ 3719 static int hci_read_local_cmds_sync(struct hci_dev *hdev) 3720 { 3721 /* All Bluetooth 1.2 and later controllers should support the 3722 * HCI command for reading the local supported commands. 3723 * 3724 * Unfortunately some controllers indicate Bluetooth 1.2 support, 3725 * but do not have support for this command. If that is the case, 3726 * the driver can quirk the behavior and skip reading the local 3727 * supported commands. 3728 */ 3729 if (hdev->hci_ver > BLUETOOTH_VER_1_1 && 3730 !hci_test_quirk(hdev, HCI_QUIRK_BROKEN_LOCAL_COMMANDS)) 3731 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_COMMANDS, 3732 0, NULL, HCI_CMD_TIMEOUT); 3733 3734 return 0; 3735 } 3736 3737 static int hci_init1_sync(struct hci_dev *hdev) 3738 { 3739 int err; 3740 3741 bt_dev_dbg(hdev, ""); 3742 3743 /* Reset */ 3744 if (!hci_test_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE)) { 3745 err = hci_reset_sync(hdev); 3746 if (err) 3747 return err; 3748 } 3749 3750 return hci_init_stage_sync(hdev, br_init1); 3751 } 3752 3753 /* Read Buffer Size (ACL mtu, max pkt, etc.) */ 3754 static int hci_read_buffer_size_sync(struct hci_dev *hdev) 3755 { 3756 return __hci_cmd_sync_status(hdev, HCI_OP_READ_BUFFER_SIZE, 3757 0, NULL, HCI_CMD_TIMEOUT); 3758 } 3759 3760 /* Read Class of Device */ 3761 static int hci_read_dev_class_sync(struct hci_dev *hdev) 3762 { 3763 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CLASS_OF_DEV, 3764 0, NULL, HCI_CMD_TIMEOUT); 3765 } 3766 3767 /* Read Local Name */ 3768 static int hci_read_local_name_sync(struct hci_dev *hdev) 3769 { 3770 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_NAME, 3771 0, NULL, HCI_CMD_TIMEOUT); 3772 } 3773 3774 /* Read Voice Setting */ 3775 static int hci_read_voice_setting_sync(struct hci_dev *hdev) 3776 { 3777 if (!read_voice_setting_capable(hdev)) 3778 return 0; 3779 3780 return __hci_cmd_sync_status(hdev, HCI_OP_READ_VOICE_SETTING, 3781 0, NULL, HCI_CMD_TIMEOUT); 3782 } 3783 3784 /* Read Number of Supported IAC */ 3785 static int hci_read_num_supported_iac_sync(struct hci_dev *hdev) 3786 { 3787 return __hci_cmd_sync_status(hdev, HCI_OP_READ_NUM_SUPPORTED_IAC, 3788 0, NULL, HCI_CMD_TIMEOUT); 3789 } 3790 3791 /* Read Current IAC LAP */ 3792 static int hci_read_current_iac_lap_sync(struct hci_dev *hdev) 3793 { 3794 return __hci_cmd_sync_status(hdev, HCI_OP_READ_CURRENT_IAC_LAP, 3795 0, NULL, HCI_CMD_TIMEOUT); 3796 } 3797 3798 static int hci_set_event_filter_sync(struct hci_dev *hdev, u8 flt_type, 3799 u8 cond_type, bdaddr_t *bdaddr, 3800 u8 auto_accept) 3801 { 3802 struct hci_cp_set_event_filter cp; 3803 3804 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 3805 return 0; 3806 3807 if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL)) 3808 return 0; 3809 3810 memset(&cp, 0, sizeof(cp)); 3811 cp.flt_type = flt_type; 3812 3813 if (flt_type != HCI_FLT_CLEAR_ALL) { 3814 cp.cond_type = cond_type; 3815 bacpy(&cp.addr_conn_flt.bdaddr, bdaddr); 3816 cp.addr_conn_flt.auto_accept = auto_accept; 3817 } 3818 3819 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_FLT, 3820 flt_type == HCI_FLT_CLEAR_ALL ? 3821 sizeof(cp.flt_type) : sizeof(cp), &cp, 3822 HCI_CMD_TIMEOUT); 3823 } 3824 3825 static int hci_clear_event_filter_sync(struct hci_dev *hdev) 3826 { 3827 if (!hci_dev_test_flag(hdev, HCI_EVENT_FILTER_CONFIGURED)) 3828 return 0; 3829 3830 /* In theory the state machine should not reach here unless 3831 * a hci_set_event_filter_sync() call succeeds, but we do 3832 * the check both for parity and as a future reminder. 3833 */ 3834 if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL)) 3835 return 0; 3836 3837 return hci_set_event_filter_sync(hdev, HCI_FLT_CLEAR_ALL, 0x00, 3838 BDADDR_ANY, 0x00); 3839 } 3840 3841 /* Connection accept timeout ~20 secs */ 3842 static int hci_write_ca_timeout_sync(struct hci_dev *hdev) 3843 { 3844 __le16 param = cpu_to_le16(0x7d00); 3845 3846 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CA_TIMEOUT, 3847 sizeof(param), ¶m, HCI_CMD_TIMEOUT); 3848 } 3849 3850 /* Enable SCO flow control if supported */ 3851 static int hci_write_sync_flowctl_sync(struct hci_dev *hdev) 3852 { 3853 struct hci_cp_write_sync_flowctl cp; 3854 int err; 3855 3856 /* Check if the controller supports SCO and HCI_OP_WRITE_SYNC_FLOWCTL */ 3857 if (!lmp_sco_capable(hdev) || !(hdev->commands[10] & BIT(4)) || 3858 !hci_test_quirk(hdev, HCI_QUIRK_SYNC_FLOWCTL_SUPPORTED)) 3859 return 0; 3860 3861 memset(&cp, 0, sizeof(cp)); 3862 cp.enable = 0x01; 3863 3864 err = __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SYNC_FLOWCTL, 3865 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 3866 if (!err) 3867 hci_dev_set_flag(hdev, HCI_SCO_FLOWCTL); 3868 3869 return err; 3870 } 3871 3872 /* BR Controller init stage 2 command sequence */ 3873 static const struct hci_init_stage br_init2[] = { 3874 /* HCI_OP_READ_BUFFER_SIZE */ 3875 HCI_INIT(hci_read_buffer_size_sync), 3876 /* HCI_OP_READ_CLASS_OF_DEV */ 3877 HCI_INIT(hci_read_dev_class_sync), 3878 /* HCI_OP_READ_LOCAL_NAME */ 3879 HCI_INIT(hci_read_local_name_sync), 3880 /* HCI_OP_READ_VOICE_SETTING */ 3881 HCI_INIT(hci_read_voice_setting_sync), 3882 /* HCI_OP_READ_NUM_SUPPORTED_IAC */ 3883 HCI_INIT(hci_read_num_supported_iac_sync), 3884 /* HCI_OP_READ_CURRENT_IAC_LAP */ 3885 HCI_INIT(hci_read_current_iac_lap_sync), 3886 /* HCI_OP_SET_EVENT_FLT */ 3887 HCI_INIT(hci_clear_event_filter_sync), 3888 /* HCI_OP_WRITE_CA_TIMEOUT */ 3889 HCI_INIT(hci_write_ca_timeout_sync), 3890 /* HCI_OP_WRITE_SYNC_FLOWCTL */ 3891 HCI_INIT(hci_write_sync_flowctl_sync), 3892 {} 3893 }; 3894 3895 static int hci_write_ssp_mode_1_sync(struct hci_dev *hdev) 3896 { 3897 u8 mode = 0x01; 3898 3899 if (!lmp_ssp_capable(hdev) || !hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 3900 return 0; 3901 3902 /* When SSP is available, then the host features page 3903 * should also be available as well. However some 3904 * controllers list the max_page as 0 as long as SSP 3905 * has not been enabled. To achieve proper debugging 3906 * output, force the minimum max_page to 1 at least. 3907 */ 3908 hdev->max_page = 0x01; 3909 3910 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SSP_MODE, 3911 sizeof(mode), &mode, HCI_CMD_TIMEOUT); 3912 } 3913 3914 static int hci_write_eir_sync(struct hci_dev *hdev) 3915 { 3916 struct hci_cp_write_eir cp; 3917 3918 if (!lmp_ssp_capable(hdev) || hci_dev_test_flag(hdev, HCI_SSP_ENABLED)) 3919 return 0; 3920 3921 memset(hdev->eir, 0, sizeof(hdev->eir)); 3922 memset(&cp, 0, sizeof(cp)); 3923 3924 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_EIR, sizeof(cp), &cp, 3925 HCI_CMD_TIMEOUT); 3926 } 3927 3928 static int hci_write_inquiry_mode_sync(struct hci_dev *hdev) 3929 { 3930 u8 mode; 3931 3932 if (!lmp_inq_rssi_capable(hdev) && 3933 !hci_test_quirk(hdev, HCI_QUIRK_FIXUP_INQUIRY_MODE)) 3934 return 0; 3935 3936 /* If Extended Inquiry Result events are supported, then 3937 * they are clearly preferred over Inquiry Result with RSSI 3938 * events. 3939 */ 3940 mode = lmp_ext_inq_capable(hdev) ? 0x02 : 0x01; 3941 3942 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_INQUIRY_MODE, 3943 sizeof(mode), &mode, HCI_CMD_TIMEOUT); 3944 } 3945 3946 static int hci_read_inq_rsp_tx_power_sync(struct hci_dev *hdev) 3947 { 3948 if (!lmp_inq_tx_pwr_capable(hdev)) 3949 return 0; 3950 3951 return __hci_cmd_sync_status(hdev, HCI_OP_READ_INQ_RSP_TX_POWER, 3952 0, NULL, HCI_CMD_TIMEOUT); 3953 } 3954 3955 static int hci_read_local_ext_features_sync(struct hci_dev *hdev, u8 page) 3956 { 3957 struct hci_cp_read_local_ext_features cp; 3958 3959 if (!lmp_ext_feat_capable(hdev)) 3960 return 0; 3961 3962 memset(&cp, 0, sizeof(cp)); 3963 cp.page = page; 3964 3965 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_EXT_FEATURES, 3966 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 3967 } 3968 3969 static int hci_read_local_ext_features_1_sync(struct hci_dev *hdev) 3970 { 3971 return hci_read_local_ext_features_sync(hdev, 0x01); 3972 } 3973 3974 /* HCI Controller init stage 2 command sequence */ 3975 static const struct hci_init_stage hci_init2[] = { 3976 /* HCI_OP_READ_LOCAL_COMMANDS */ 3977 HCI_INIT(hci_read_local_cmds_sync), 3978 /* HCI_OP_WRITE_SSP_MODE */ 3979 HCI_INIT(hci_write_ssp_mode_1_sync), 3980 /* HCI_OP_WRITE_EIR */ 3981 HCI_INIT(hci_write_eir_sync), 3982 /* HCI_OP_WRITE_INQUIRY_MODE */ 3983 HCI_INIT(hci_write_inquiry_mode_sync), 3984 /* HCI_OP_READ_INQ_RSP_TX_POWER */ 3985 HCI_INIT(hci_read_inq_rsp_tx_power_sync), 3986 /* HCI_OP_READ_LOCAL_EXT_FEATURES */ 3987 HCI_INIT(hci_read_local_ext_features_1_sync), 3988 /* HCI_OP_WRITE_AUTH_ENABLE */ 3989 HCI_INIT(hci_write_auth_enable_sync), 3990 {} 3991 }; 3992 3993 /* Read LE Buffer Size */ 3994 static int hci_le_read_buffer_size_sync(struct hci_dev *hdev) 3995 { 3996 /* Use Read LE Buffer Size V2 if supported */ 3997 if (iso_capable(hdev) && hdev->commands[41] & 0x20) 3998 return __hci_cmd_sync_status(hdev, 3999 HCI_OP_LE_READ_BUFFER_SIZE_V2, 4000 0, NULL, HCI_CMD_TIMEOUT); 4001 4002 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_BUFFER_SIZE, 4003 0, NULL, HCI_CMD_TIMEOUT); 4004 } 4005 4006 /* Read LE Local Supported Features */ 4007 static int hci_le_read_local_features_sync(struct hci_dev *hdev) 4008 { 4009 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_LOCAL_FEATURES, 4010 0, NULL, HCI_CMD_TIMEOUT); 4011 } 4012 4013 /* Read LE Supported States */ 4014 static int hci_le_read_supported_states_sync(struct hci_dev *hdev) 4015 { 4016 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_SUPPORTED_STATES, 4017 0, NULL, HCI_CMD_TIMEOUT); 4018 } 4019 4020 /* LE Controller init stage 2 command sequence */ 4021 static const struct hci_init_stage le_init2[] = { 4022 /* HCI_OP_LE_READ_LOCAL_FEATURES */ 4023 HCI_INIT(hci_le_read_local_features_sync), 4024 /* HCI_OP_LE_READ_BUFFER_SIZE */ 4025 HCI_INIT(hci_le_read_buffer_size_sync), 4026 /* HCI_OP_LE_READ_SUPPORTED_STATES */ 4027 HCI_INIT(hci_le_read_supported_states_sync), 4028 {} 4029 }; 4030 4031 static int hci_init2_sync(struct hci_dev *hdev) 4032 { 4033 int err; 4034 4035 bt_dev_dbg(hdev, ""); 4036 4037 err = hci_init_stage_sync(hdev, hci_init2); 4038 if (err) 4039 return err; 4040 4041 if (lmp_bredr_capable(hdev)) { 4042 err = hci_init_stage_sync(hdev, br_init2); 4043 if (err) 4044 return err; 4045 } else { 4046 hci_dev_clear_flag(hdev, HCI_BREDR_ENABLED); 4047 } 4048 4049 if (lmp_le_capable(hdev)) { 4050 err = hci_init_stage_sync(hdev, le_init2); 4051 if (err) 4052 return err; 4053 /* LE-only controllers have LE implicitly enabled */ 4054 if (!lmp_bredr_capable(hdev)) 4055 hci_dev_set_flag(hdev, HCI_LE_ENABLED); 4056 } 4057 4058 return 0; 4059 } 4060 4061 static int hci_set_event_mask_sync(struct hci_dev *hdev) 4062 { 4063 /* The second byte is 0xff instead of 0x9f (two reserved bits 4064 * disabled) since a Broadcom 1.2 dongle doesn't respond to the 4065 * command otherwise. 4066 */ 4067 u8 events[8] = { 0xff, 0xff, 0xfb, 0xff, 0x00, 0x00, 0x00, 0x00 }; 4068 4069 /* CSR 1.1 dongles does not accept any bitfield so don't try to set 4070 * any event mask for pre 1.2 devices. 4071 */ 4072 if (hdev->hci_ver < BLUETOOTH_VER_1_2) 4073 return 0; 4074 4075 if (lmp_bredr_capable(hdev)) { 4076 events[4] |= 0x01; /* Flow Specification Complete */ 4077 4078 /* Don't set Disconnect Complete and mode change when 4079 * suspended as that would wakeup the host when disconnecting 4080 * due to suspend. 4081 */ 4082 if (hdev->suspended) { 4083 events[0] &= 0xef; 4084 events[2] &= 0xf7; 4085 } 4086 } else { 4087 /* Use a different default for LE-only devices */ 4088 memset(events, 0, sizeof(events)); 4089 events[1] |= 0x20; /* Command Complete */ 4090 events[1] |= 0x40; /* Command Status */ 4091 events[1] |= 0x80; /* Hardware Error */ 4092 4093 /* If the controller supports the Disconnect command, enable 4094 * the corresponding event. In addition enable packet flow 4095 * control related events. 4096 */ 4097 if (hdev->commands[0] & 0x20) { 4098 /* Don't set Disconnect Complete when suspended as that 4099 * would wakeup the host when disconnecting due to 4100 * suspend. 4101 */ 4102 if (!hdev->suspended) 4103 events[0] |= 0x10; /* Disconnection Complete */ 4104 events[2] |= 0x04; /* Number of Completed Packets */ 4105 events[3] |= 0x02; /* Data Buffer Overflow */ 4106 } 4107 4108 /* If the controller supports the Read Remote Version 4109 * Information command, enable the corresponding event. 4110 */ 4111 if (hdev->commands[2] & 0x80) 4112 events[1] |= 0x08; /* Read Remote Version Information 4113 * Complete 4114 */ 4115 4116 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) { 4117 events[0] |= 0x80; /* Encryption Change */ 4118 events[5] |= 0x80; /* Encryption Key Refresh Complete */ 4119 } 4120 } 4121 4122 if (lmp_inq_rssi_capable(hdev) || 4123 hci_test_quirk(hdev, HCI_QUIRK_FIXUP_INQUIRY_MODE)) 4124 events[4] |= 0x02; /* Inquiry Result with RSSI */ 4125 4126 if (lmp_ext_feat_capable(hdev)) 4127 events[4] |= 0x04; /* Read Remote Extended Features Complete */ 4128 4129 if (lmp_esco_capable(hdev)) { 4130 events[5] |= 0x08; /* Synchronous Connection Complete */ 4131 events[5] |= 0x10; /* Synchronous Connection Changed */ 4132 } 4133 4134 if (lmp_sniffsubr_capable(hdev)) 4135 events[5] |= 0x20; /* Sniff Subrating */ 4136 4137 if (lmp_pause_enc_capable(hdev)) 4138 events[5] |= 0x80; /* Encryption Key Refresh Complete */ 4139 4140 if (lmp_ext_inq_capable(hdev)) 4141 events[5] |= 0x40; /* Extended Inquiry Result */ 4142 4143 if (lmp_no_flush_capable(hdev)) 4144 events[7] |= 0x01; /* Enhanced Flush Complete */ 4145 4146 if (lmp_lsto_capable(hdev)) 4147 events[6] |= 0x80; /* Link Supervision Timeout Changed */ 4148 4149 if (lmp_ssp_capable(hdev)) { 4150 events[6] |= 0x01; /* IO Capability Request */ 4151 events[6] |= 0x02; /* IO Capability Response */ 4152 events[6] |= 0x04; /* User Confirmation Request */ 4153 events[6] |= 0x08; /* User Passkey Request */ 4154 events[6] |= 0x10; /* Remote OOB Data Request */ 4155 events[6] |= 0x20; /* Simple Pairing Complete */ 4156 events[7] |= 0x04; /* User Passkey Notification */ 4157 events[7] |= 0x08; /* Keypress Notification */ 4158 events[7] |= 0x10; /* Remote Host Supported 4159 * Features Notification 4160 */ 4161 } 4162 4163 if (lmp_le_capable(hdev)) 4164 events[7] |= 0x20; /* LE Meta-Event */ 4165 4166 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_MASK, 4167 sizeof(events), events, HCI_CMD_TIMEOUT); 4168 } 4169 4170 static int hci_read_stored_link_key_sync(struct hci_dev *hdev) 4171 { 4172 struct hci_cp_read_stored_link_key cp; 4173 4174 if (!(hdev->commands[6] & 0x20) || 4175 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY)) 4176 return 0; 4177 4178 memset(&cp, 0, sizeof(cp)); 4179 bacpy(&cp.bdaddr, BDADDR_ANY); 4180 cp.read_all = 0x01; 4181 4182 return __hci_cmd_sync_status(hdev, HCI_OP_READ_STORED_LINK_KEY, 4183 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4184 } 4185 4186 static int hci_setup_link_policy_sync(struct hci_dev *hdev) 4187 { 4188 struct hci_cp_write_def_link_policy cp; 4189 u16 link_policy = 0; 4190 4191 if (!(hdev->commands[5] & 0x10)) 4192 return 0; 4193 4194 memset(&cp, 0, sizeof(cp)); 4195 4196 if (lmp_rswitch_capable(hdev)) 4197 link_policy |= HCI_LP_RSWITCH; 4198 if (lmp_hold_capable(hdev)) 4199 link_policy |= HCI_LP_HOLD; 4200 if (lmp_sniff_capable(hdev)) 4201 link_policy |= HCI_LP_SNIFF; 4202 if (lmp_park_capable(hdev)) 4203 link_policy |= HCI_LP_PARK; 4204 4205 cp.policy = cpu_to_le16(link_policy); 4206 4207 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_LINK_POLICY, 4208 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4209 } 4210 4211 static int hci_read_page_scan_activity_sync(struct hci_dev *hdev) 4212 { 4213 if (!(hdev->commands[8] & 0x01)) 4214 return 0; 4215 4216 return __hci_cmd_sync_status(hdev, HCI_OP_READ_PAGE_SCAN_ACTIVITY, 4217 0, NULL, HCI_CMD_TIMEOUT); 4218 } 4219 4220 static int hci_read_def_err_data_reporting_sync(struct hci_dev *hdev) 4221 { 4222 if (!(hdev->commands[18] & 0x04) || 4223 !(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) || 4224 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_ERR_DATA_REPORTING)) 4225 return 0; 4226 4227 return __hci_cmd_sync_status(hdev, HCI_OP_READ_DEF_ERR_DATA_REPORTING, 4228 0, NULL, HCI_CMD_TIMEOUT); 4229 } 4230 4231 static int hci_read_page_scan_type_sync(struct hci_dev *hdev) 4232 { 4233 /* Some older Broadcom based Bluetooth 1.2 controllers do not 4234 * support the Read Page Scan Type command. Check support for 4235 * this command in the bit mask of supported commands. 4236 */ 4237 if (!(hdev->commands[13] & 0x01) || 4238 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_READ_PAGE_SCAN_TYPE)) 4239 return 0; 4240 4241 return __hci_cmd_sync_status(hdev, HCI_OP_READ_PAGE_SCAN_TYPE, 4242 0, NULL, HCI_CMD_TIMEOUT); 4243 } 4244 4245 /* Read features beyond page 1 if available */ 4246 static int hci_read_local_ext_features_all_sync(struct hci_dev *hdev) 4247 { 4248 u8 page; 4249 int err; 4250 4251 if (!lmp_ext_feat_capable(hdev)) 4252 return 0; 4253 4254 for (page = 2; page < HCI_MAX_PAGES && page <= hdev->max_page; 4255 page++) { 4256 err = hci_read_local_ext_features_sync(hdev, page); 4257 if (err) 4258 return err; 4259 } 4260 4261 return 0; 4262 } 4263 4264 /* HCI Controller init stage 3 command sequence */ 4265 static const struct hci_init_stage hci_init3[] = { 4266 /* HCI_OP_SET_EVENT_MASK */ 4267 HCI_INIT(hci_set_event_mask_sync), 4268 /* HCI_OP_READ_STORED_LINK_KEY */ 4269 HCI_INIT(hci_read_stored_link_key_sync), 4270 /* HCI_OP_WRITE_DEF_LINK_POLICY */ 4271 HCI_INIT(hci_setup_link_policy_sync), 4272 /* HCI_OP_READ_PAGE_SCAN_ACTIVITY */ 4273 HCI_INIT(hci_read_page_scan_activity_sync), 4274 /* HCI_OP_READ_DEF_ERR_DATA_REPORTING */ 4275 HCI_INIT(hci_read_def_err_data_reporting_sync), 4276 /* HCI_OP_READ_PAGE_SCAN_TYPE */ 4277 HCI_INIT(hci_read_page_scan_type_sync), 4278 /* HCI_OP_READ_LOCAL_EXT_FEATURES */ 4279 HCI_INIT(hci_read_local_ext_features_all_sync), 4280 {} 4281 }; 4282 4283 static int hci_le_set_event_mask_sync(struct hci_dev *hdev) 4284 { 4285 u8 events[8]; 4286 4287 if (!lmp_le_capable(hdev)) 4288 return 0; 4289 4290 memset(events, 0, sizeof(events)); 4291 4292 if (hdev->le_features[0] & HCI_LE_ENCRYPTION) 4293 events[0] |= 0x10; /* LE Long Term Key Request */ 4294 4295 /* If controller supports the Connection Parameters Request 4296 * Link Layer Procedure, enable the corresponding event. 4297 */ 4298 if (hdev->le_features[0] & HCI_LE_CONN_PARAM_REQ_PROC) 4299 /* LE Remote Connection Parameter Request */ 4300 events[0] |= 0x20; 4301 4302 /* If the controller supports the Data Length Extension 4303 * feature, enable the corresponding event. 4304 */ 4305 if (hdev->le_features[0] & HCI_LE_DATA_LEN_EXT) 4306 events[0] |= 0x40; /* LE Data Length Change */ 4307 4308 /* If the controller supports LL Privacy feature or LE Extended Adv, 4309 * enable the corresponding event. 4310 */ 4311 if (use_enhanced_conn_complete(hdev)) 4312 events[1] |= 0x02; /* LE Enhanced Connection Complete */ 4313 4314 /* Mark Device Privacy if Privacy Mode is supported */ 4315 if (privacy_mode_capable(hdev)) 4316 hdev->conn_flags |= HCI_CONN_FLAG_DEVICE_PRIVACY; 4317 4318 /* Mark Address Resolution if LL Privacy is supported */ 4319 if (ll_privacy_capable(hdev)) 4320 hdev->conn_flags |= HCI_CONN_FLAG_ADDRESS_RESOLUTION; 4321 4322 /* If the controller supports Extended Scanner Filter 4323 * Policies, enable the corresponding event. 4324 */ 4325 if (hdev->le_features[0] & HCI_LE_EXT_SCAN_POLICY) 4326 events[1] |= 0x04; /* LE Direct Advertising Report */ 4327 4328 /* If the controller supports Channel Selection Algorithm #2 4329 * feature, enable the corresponding event. 4330 */ 4331 if (hdev->le_features[1] & HCI_LE_CHAN_SEL_ALG2) 4332 events[2] |= 0x08; /* LE Channel Selection Algorithm */ 4333 4334 /* If the controller supports the LE Set Scan Enable command, 4335 * enable the corresponding advertising report event. 4336 */ 4337 if (hdev->commands[26] & 0x08) 4338 events[0] |= 0x02; /* LE Advertising Report */ 4339 4340 /* If the controller supports the LE Create Connection 4341 * command, enable the corresponding event. 4342 */ 4343 if (hdev->commands[26] & 0x10) 4344 events[0] |= 0x01; /* LE Connection Complete */ 4345 4346 /* If the controller supports the LE Connection Update 4347 * command, enable the corresponding event. 4348 */ 4349 if (hdev->commands[27] & 0x04) 4350 events[0] |= 0x04; /* LE Connection Update Complete */ 4351 4352 /* If the controller supports the LE Read Remote Used Features 4353 * command, enable the corresponding event. 4354 */ 4355 if (hdev->commands[27] & 0x20) 4356 /* LE Read Remote Used Features Complete */ 4357 events[0] |= 0x08; 4358 4359 /* If the controller supports the LE Read Local P-256 4360 * Public Key command, enable the corresponding event. 4361 */ 4362 if (hdev->commands[34] & 0x02) 4363 /* LE Read Local P-256 Public Key Complete */ 4364 events[0] |= 0x80; 4365 4366 /* If the controller supports the LE Generate DHKey 4367 * command, enable the corresponding event. 4368 */ 4369 if (hdev->commands[34] & 0x04) 4370 events[1] |= 0x01; /* LE Generate DHKey Complete */ 4371 4372 /* If the controller supports the LE Set Default PHY or 4373 * LE Set PHY commands, enable the corresponding event. 4374 */ 4375 if (hdev->commands[35] & (0x20 | 0x40)) 4376 events[1] |= 0x08; /* LE PHY Update Complete */ 4377 4378 /* If the controller supports LE Set Extended Scan Parameters 4379 * and LE Set Extended Scan Enable commands, enable the 4380 * corresponding event. 4381 */ 4382 if (use_ext_scan(hdev)) 4383 events[1] |= 0x10; /* LE Extended Advertising Report */ 4384 4385 /* If the controller supports the LE Extended Advertising 4386 * command, enable the corresponding event. 4387 */ 4388 if (ext_adv_capable(hdev)) 4389 events[2] |= 0x02; /* LE Advertising Set Terminated */ 4390 4391 if (cis_capable(hdev)) { 4392 events[3] |= 0x01; /* LE CIS Established */ 4393 if (cis_peripheral_capable(hdev)) 4394 events[3] |= 0x02; /* LE CIS Request */ 4395 } 4396 4397 if (bis_capable(hdev)) { 4398 events[1] |= 0x20; /* LE PA Report */ 4399 events[1] |= 0x40; /* LE PA Sync Established */ 4400 events[3] |= 0x04; /* LE Create BIG Complete */ 4401 events[3] |= 0x08; /* LE Terminate BIG Complete */ 4402 events[3] |= 0x10; /* LE BIG Sync Established */ 4403 events[3] |= 0x20; /* LE BIG Sync Loss */ 4404 events[4] |= 0x02; /* LE BIG Info Advertising Report */ 4405 } 4406 4407 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_EVENT_MASK, 4408 sizeof(events), events, HCI_CMD_TIMEOUT); 4409 } 4410 4411 /* Read LE Advertising Channel TX Power */ 4412 static int hci_le_read_adv_tx_power_sync(struct hci_dev *hdev) 4413 { 4414 if ((hdev->commands[25] & 0x40) && !ext_adv_capable(hdev)) { 4415 /* HCI TS spec forbids mixing of legacy and extended 4416 * advertising commands wherein READ_ADV_TX_POWER is 4417 * also included. So do not call it if extended adv 4418 * is supported otherwise controller will return 4419 * COMMAND_DISALLOWED for extended commands. 4420 */ 4421 return __hci_cmd_sync_status(hdev, 4422 HCI_OP_LE_READ_ADV_TX_POWER, 4423 0, NULL, HCI_CMD_TIMEOUT); 4424 } 4425 4426 return 0; 4427 } 4428 4429 /* Read LE Min/Max Tx Power*/ 4430 static int hci_le_read_tx_power_sync(struct hci_dev *hdev) 4431 { 4432 if (!(hdev->commands[38] & 0x80) || 4433 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_READ_TRANSMIT_POWER)) 4434 return 0; 4435 4436 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_TRANSMIT_POWER, 4437 0, NULL, HCI_CMD_TIMEOUT); 4438 } 4439 4440 /* Read LE Accept List Size */ 4441 static int hci_le_read_accept_list_size_sync(struct hci_dev *hdev) 4442 { 4443 if (!(hdev->commands[26] & 0x40)) 4444 return 0; 4445 4446 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_ACCEPT_LIST_SIZE, 4447 0, NULL, HCI_CMD_TIMEOUT); 4448 } 4449 4450 /* Read LE Resolving List Size */ 4451 static int hci_le_read_resolv_list_size_sync(struct hci_dev *hdev) 4452 { 4453 if (!(hdev->commands[34] & 0x40)) 4454 return 0; 4455 4456 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_RESOLV_LIST_SIZE, 4457 0, NULL, HCI_CMD_TIMEOUT); 4458 } 4459 4460 /* Clear LE Resolving List */ 4461 static int hci_le_clear_resolv_list_sync(struct hci_dev *hdev) 4462 { 4463 if (!(hdev->commands[34] & 0x20)) 4464 return 0; 4465 4466 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CLEAR_RESOLV_LIST, 0, NULL, 4467 HCI_CMD_TIMEOUT); 4468 } 4469 4470 /* Set RPA timeout */ 4471 static int hci_le_set_rpa_timeout_sync(struct hci_dev *hdev) 4472 { 4473 __le16 timeout = cpu_to_le16(hdev->rpa_timeout); 4474 4475 if (!(hdev->commands[35] & 0x04) || 4476 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_SET_RPA_TIMEOUT)) 4477 return 0; 4478 4479 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_RPA_TIMEOUT, 4480 sizeof(timeout), &timeout, 4481 HCI_CMD_TIMEOUT); 4482 } 4483 4484 /* Read LE Maximum Data Length */ 4485 static int hci_le_read_max_data_len_sync(struct hci_dev *hdev) 4486 { 4487 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)) 4488 return 0; 4489 4490 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_MAX_DATA_LEN, 0, NULL, 4491 HCI_CMD_TIMEOUT); 4492 } 4493 4494 /* Read LE Suggested Default Data Length */ 4495 static int hci_le_read_def_data_len_sync(struct hci_dev *hdev) 4496 { 4497 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)) 4498 return 0; 4499 4500 return __hci_cmd_sync_status(hdev, HCI_OP_LE_READ_DEF_DATA_LEN, 0, NULL, 4501 HCI_CMD_TIMEOUT); 4502 } 4503 4504 /* Read LE Number of Supported Advertising Sets */ 4505 static int hci_le_read_num_support_adv_sets_sync(struct hci_dev *hdev) 4506 { 4507 if (!ext_adv_capable(hdev)) 4508 return 0; 4509 4510 return __hci_cmd_sync_status(hdev, 4511 HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS, 4512 0, NULL, HCI_CMD_TIMEOUT); 4513 } 4514 4515 /* Write LE Host Supported */ 4516 static int hci_set_le_support_sync(struct hci_dev *hdev) 4517 { 4518 struct hci_cp_write_le_host_supported cp; 4519 4520 /* LE-only devices do not support explicit enablement */ 4521 if (!lmp_bredr_capable(hdev)) 4522 return 0; 4523 4524 memset(&cp, 0, sizeof(cp)); 4525 4526 if (hci_dev_test_flag(hdev, HCI_LE_ENABLED)) { 4527 cp.le = 0x01; 4528 cp.simul = 0x00; 4529 } 4530 4531 if (cp.le == lmp_host_le_capable(hdev)) 4532 return 0; 4533 4534 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_LE_HOST_SUPPORTED, 4535 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4536 } 4537 4538 /* LE Set Host Feature */ 4539 static int hci_le_set_host_feature_sync(struct hci_dev *hdev) 4540 { 4541 struct hci_cp_le_set_host_feature cp; 4542 4543 if (!iso_capable(hdev)) 4544 return 0; 4545 4546 memset(&cp, 0, sizeof(cp)); 4547 4548 /* Connected Isochronous Channels (Host Support) */ 4549 cp.bit_number = 32; 4550 cp.bit_value = iso_enabled(hdev) ? 0x01 : 0x00; 4551 4552 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_HOST_FEATURE, 4553 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4554 } 4555 4556 /* LE Controller init stage 3 command sequence */ 4557 static const struct hci_init_stage le_init3[] = { 4558 /* HCI_OP_LE_SET_EVENT_MASK */ 4559 HCI_INIT(hci_le_set_event_mask_sync), 4560 /* HCI_OP_LE_READ_ADV_TX_POWER */ 4561 HCI_INIT(hci_le_read_adv_tx_power_sync), 4562 /* HCI_OP_LE_READ_TRANSMIT_POWER */ 4563 HCI_INIT(hci_le_read_tx_power_sync), 4564 /* HCI_OP_LE_READ_ACCEPT_LIST_SIZE */ 4565 HCI_INIT(hci_le_read_accept_list_size_sync), 4566 /* HCI_OP_LE_CLEAR_ACCEPT_LIST */ 4567 HCI_INIT(hci_le_clear_accept_list_sync), 4568 /* HCI_OP_LE_READ_RESOLV_LIST_SIZE */ 4569 HCI_INIT(hci_le_read_resolv_list_size_sync), 4570 /* HCI_OP_LE_CLEAR_RESOLV_LIST */ 4571 HCI_INIT(hci_le_clear_resolv_list_sync), 4572 /* HCI_OP_LE_SET_RPA_TIMEOUT */ 4573 HCI_INIT(hci_le_set_rpa_timeout_sync), 4574 /* HCI_OP_LE_READ_MAX_DATA_LEN */ 4575 HCI_INIT(hci_le_read_max_data_len_sync), 4576 /* HCI_OP_LE_READ_DEF_DATA_LEN */ 4577 HCI_INIT(hci_le_read_def_data_len_sync), 4578 /* HCI_OP_LE_READ_NUM_SUPPORTED_ADV_SETS */ 4579 HCI_INIT(hci_le_read_num_support_adv_sets_sync), 4580 /* HCI_OP_WRITE_LE_HOST_SUPPORTED */ 4581 HCI_INIT(hci_set_le_support_sync), 4582 /* HCI_OP_LE_SET_HOST_FEATURE */ 4583 HCI_INIT(hci_le_set_host_feature_sync), 4584 {} 4585 }; 4586 4587 static int hci_init3_sync(struct hci_dev *hdev) 4588 { 4589 int err; 4590 4591 bt_dev_dbg(hdev, ""); 4592 4593 err = hci_init_stage_sync(hdev, hci_init3); 4594 if (err) 4595 return err; 4596 4597 if (lmp_le_capable(hdev)) 4598 return hci_init_stage_sync(hdev, le_init3); 4599 4600 return 0; 4601 } 4602 4603 static int hci_delete_stored_link_key_sync(struct hci_dev *hdev) 4604 { 4605 struct hci_cp_delete_stored_link_key cp; 4606 4607 /* Some Broadcom based Bluetooth controllers do not support the 4608 * Delete Stored Link Key command. They are clearly indicating its 4609 * absence in the bit mask of supported commands. 4610 * 4611 * Check the supported commands and only if the command is marked 4612 * as supported send it. If not supported assume that the controller 4613 * does not have actual support for stored link keys which makes this 4614 * command redundant anyway. 4615 * 4616 * Some controllers indicate that they support handling deleting 4617 * stored link keys, but they don't. The quirk lets a driver 4618 * just disable this command. 4619 */ 4620 if (!(hdev->commands[6] & 0x80) || 4621 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_STORED_LINK_KEY)) 4622 return 0; 4623 4624 memset(&cp, 0, sizeof(cp)); 4625 bacpy(&cp.bdaddr, BDADDR_ANY); 4626 cp.delete_all = 0x01; 4627 4628 return __hci_cmd_sync_status(hdev, HCI_OP_DELETE_STORED_LINK_KEY, 4629 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4630 } 4631 4632 static int hci_set_event_mask_page_2_sync(struct hci_dev *hdev) 4633 { 4634 u8 events[8] = { 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00 }; 4635 bool changed = false; 4636 4637 /* Set event mask page 2 if the HCI command for it is supported */ 4638 if (!(hdev->commands[22] & 0x04)) 4639 return 0; 4640 4641 /* If Connectionless Peripheral Broadcast central role is supported 4642 * enable all necessary events for it. 4643 */ 4644 if (lmp_cpb_central_capable(hdev)) { 4645 events[1] |= 0x40; /* Triggered Clock Capture */ 4646 events[1] |= 0x80; /* Synchronization Train Complete */ 4647 events[2] |= 0x08; /* Truncated Page Complete */ 4648 events[2] |= 0x20; /* CPB Channel Map Change */ 4649 changed = true; 4650 } 4651 4652 /* If Connectionless Peripheral Broadcast peripheral role is supported 4653 * enable all necessary events for it. 4654 */ 4655 if (lmp_cpb_peripheral_capable(hdev)) { 4656 events[2] |= 0x01; /* Synchronization Train Received */ 4657 events[2] |= 0x02; /* CPB Receive */ 4658 events[2] |= 0x04; /* CPB Timeout */ 4659 events[2] |= 0x10; /* Peripheral Page Response Timeout */ 4660 changed = true; 4661 } 4662 4663 /* Enable Authenticated Payload Timeout Expired event if supported */ 4664 if (lmp_ping_capable(hdev) || hdev->le_features[0] & HCI_LE_PING) { 4665 events[2] |= 0x80; 4666 changed = true; 4667 } 4668 4669 /* Some Broadcom based controllers indicate support for Set Event 4670 * Mask Page 2 command, but then actually do not support it. Since 4671 * the default value is all bits set to zero, the command is only 4672 * required if the event mask has to be changed. In case no change 4673 * to the event mask is needed, skip this command. 4674 */ 4675 if (!changed) 4676 return 0; 4677 4678 return __hci_cmd_sync_status(hdev, HCI_OP_SET_EVENT_MASK_PAGE_2, 4679 sizeof(events), events, HCI_CMD_TIMEOUT); 4680 } 4681 4682 /* Read local codec list if the HCI command is supported */ 4683 static int hci_read_local_codecs_sync(struct hci_dev *hdev) 4684 { 4685 if (hdev->commands[45] & 0x04) 4686 hci_read_supported_codecs_v2(hdev); 4687 else if (hdev->commands[29] & 0x20) 4688 hci_read_supported_codecs(hdev); 4689 4690 return 0; 4691 } 4692 4693 /* Read local pairing options if the HCI command is supported */ 4694 static int hci_read_local_pairing_opts_sync(struct hci_dev *hdev) 4695 { 4696 if (!(hdev->commands[41] & 0x08)) 4697 return 0; 4698 4699 return __hci_cmd_sync_status(hdev, HCI_OP_READ_LOCAL_PAIRING_OPTS, 4700 0, NULL, HCI_CMD_TIMEOUT); 4701 } 4702 4703 /* Get MWS transport configuration if the HCI command is supported */ 4704 static int hci_get_mws_transport_config_sync(struct hci_dev *hdev) 4705 { 4706 if (!mws_transport_config_capable(hdev)) 4707 return 0; 4708 4709 return __hci_cmd_sync_status(hdev, HCI_OP_GET_MWS_TRANSPORT_CONFIG, 4710 0, NULL, HCI_CMD_TIMEOUT); 4711 } 4712 4713 /* Check for Synchronization Train support */ 4714 static int hci_read_sync_train_params_sync(struct hci_dev *hdev) 4715 { 4716 if (!lmp_sync_train_capable(hdev)) 4717 return 0; 4718 4719 return __hci_cmd_sync_status(hdev, HCI_OP_READ_SYNC_TRAIN_PARAMS, 4720 0, NULL, HCI_CMD_TIMEOUT); 4721 } 4722 4723 /* Enable Secure Connections if supported and configured */ 4724 static int hci_write_sc_support_1_sync(struct hci_dev *hdev) 4725 { 4726 u8 support = 0x01; 4727 4728 if (!hci_dev_test_flag(hdev, HCI_SSP_ENABLED) || 4729 !bredr_sc_enabled(hdev)) 4730 return 0; 4731 4732 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_SC_SUPPORT, 4733 sizeof(support), &support, 4734 HCI_CMD_TIMEOUT); 4735 } 4736 4737 /* Set erroneous data reporting if supported to the wideband speech 4738 * setting value 4739 */ 4740 static int hci_set_err_data_report_sync(struct hci_dev *hdev) 4741 { 4742 struct hci_cp_write_def_err_data_reporting cp; 4743 bool enabled = hci_dev_test_flag(hdev, HCI_WIDEBAND_SPEECH_ENABLED); 4744 4745 if (!(hdev->commands[18] & 0x08) || 4746 !(hdev->features[0][6] & LMP_ERR_DATA_REPORTING) || 4747 hci_test_quirk(hdev, HCI_QUIRK_BROKEN_ERR_DATA_REPORTING)) 4748 return 0; 4749 4750 if (enabled == hdev->err_data_reporting) 4751 return 0; 4752 4753 memset(&cp, 0, sizeof(cp)); 4754 cp.err_data_reporting = enabled ? ERR_DATA_REPORTING_ENABLED : 4755 ERR_DATA_REPORTING_DISABLED; 4756 4757 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_DEF_ERR_DATA_REPORTING, 4758 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4759 } 4760 4761 static const struct hci_init_stage hci_init4[] = { 4762 /* HCI_OP_DELETE_STORED_LINK_KEY */ 4763 HCI_INIT(hci_delete_stored_link_key_sync), 4764 /* HCI_OP_SET_EVENT_MASK_PAGE_2 */ 4765 HCI_INIT(hci_set_event_mask_page_2_sync), 4766 /* HCI_OP_READ_LOCAL_CODECS */ 4767 HCI_INIT(hci_read_local_codecs_sync), 4768 /* HCI_OP_READ_LOCAL_PAIRING_OPTS */ 4769 HCI_INIT(hci_read_local_pairing_opts_sync), 4770 /* HCI_OP_GET_MWS_TRANSPORT_CONFIG */ 4771 HCI_INIT(hci_get_mws_transport_config_sync), 4772 /* HCI_OP_READ_SYNC_TRAIN_PARAMS */ 4773 HCI_INIT(hci_read_sync_train_params_sync), 4774 /* HCI_OP_WRITE_SC_SUPPORT */ 4775 HCI_INIT(hci_write_sc_support_1_sync), 4776 /* HCI_OP_WRITE_DEF_ERR_DATA_REPORTING */ 4777 HCI_INIT(hci_set_err_data_report_sync), 4778 {} 4779 }; 4780 4781 /* Set Suggested Default Data Length to maximum if supported */ 4782 static int hci_le_set_write_def_data_len_sync(struct hci_dev *hdev) 4783 { 4784 struct hci_cp_le_write_def_data_len cp; 4785 4786 if (!(hdev->le_features[0] & HCI_LE_DATA_LEN_EXT)) 4787 return 0; 4788 4789 memset(&cp, 0, sizeof(cp)); 4790 cp.tx_len = cpu_to_le16(hdev->le_max_tx_len); 4791 cp.tx_time = cpu_to_le16(hdev->le_max_tx_time); 4792 4793 return __hci_cmd_sync_status(hdev, HCI_OP_LE_WRITE_DEF_DATA_LEN, 4794 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4795 } 4796 4797 /* Set Default PHY parameters if command is supported, enables all supported 4798 * PHYs according to the LE Features bits. 4799 */ 4800 static int hci_le_set_default_phy_sync(struct hci_dev *hdev) 4801 { 4802 struct hci_cp_le_set_default_phy cp; 4803 4804 if (!(hdev->commands[35] & 0x20)) { 4805 /* If the command is not supported it means only 1M PHY is 4806 * supported. 4807 */ 4808 hdev->le_tx_def_phys = HCI_LE_SET_PHY_1M; 4809 hdev->le_rx_def_phys = HCI_LE_SET_PHY_1M; 4810 return 0; 4811 } 4812 4813 memset(&cp, 0, sizeof(cp)); 4814 cp.all_phys = 0x00; 4815 cp.tx_phys = HCI_LE_SET_PHY_1M; 4816 cp.rx_phys = HCI_LE_SET_PHY_1M; 4817 4818 /* Enables 2M PHY if supported */ 4819 if (le_2m_capable(hdev)) { 4820 cp.tx_phys |= HCI_LE_SET_PHY_2M; 4821 cp.rx_phys |= HCI_LE_SET_PHY_2M; 4822 } 4823 4824 /* Enables Coded PHY if supported */ 4825 if (le_coded_capable(hdev)) { 4826 cp.tx_phys |= HCI_LE_SET_PHY_CODED; 4827 cp.rx_phys |= HCI_LE_SET_PHY_CODED; 4828 } 4829 4830 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_DEFAULT_PHY, 4831 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 4832 } 4833 4834 static const struct hci_init_stage le_init4[] = { 4835 /* HCI_OP_LE_WRITE_DEF_DATA_LEN */ 4836 HCI_INIT(hci_le_set_write_def_data_len_sync), 4837 /* HCI_OP_LE_SET_DEFAULT_PHY */ 4838 HCI_INIT(hci_le_set_default_phy_sync), 4839 {} 4840 }; 4841 4842 static int hci_init4_sync(struct hci_dev *hdev) 4843 { 4844 int err; 4845 4846 bt_dev_dbg(hdev, ""); 4847 4848 err = hci_init_stage_sync(hdev, hci_init4); 4849 if (err) 4850 return err; 4851 4852 if (lmp_le_capable(hdev)) 4853 return hci_init_stage_sync(hdev, le_init4); 4854 4855 return 0; 4856 } 4857 4858 static int hci_init_sync(struct hci_dev *hdev) 4859 { 4860 int err; 4861 4862 err = hci_init1_sync(hdev); 4863 if (err < 0) 4864 return err; 4865 4866 if (hci_dev_test_flag(hdev, HCI_SETUP)) 4867 hci_debugfs_create_basic(hdev); 4868 4869 err = hci_init2_sync(hdev); 4870 if (err < 0) 4871 return err; 4872 4873 err = hci_init3_sync(hdev); 4874 if (err < 0) 4875 return err; 4876 4877 err = hci_init4_sync(hdev); 4878 if (err < 0) 4879 return err; 4880 4881 /* This function is only called when the controller is actually in 4882 * configured state. When the controller is marked as unconfigured, 4883 * this initialization procedure is not run. 4884 * 4885 * It means that it is possible that a controller runs through its 4886 * setup phase and then discovers missing settings. If that is the 4887 * case, then this function will not be called. It then will only 4888 * be called during the config phase. 4889 * 4890 * So only when in setup phase or config phase, create the debugfs 4891 * entries and register the SMP channels. 4892 */ 4893 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 4894 !hci_dev_test_flag(hdev, HCI_CONFIG)) 4895 return 0; 4896 4897 if (hci_dev_test_and_set_flag(hdev, HCI_DEBUGFS_CREATED)) 4898 return 0; 4899 4900 hci_debugfs_create_common(hdev); 4901 4902 if (lmp_bredr_capable(hdev)) 4903 hci_debugfs_create_bredr(hdev); 4904 4905 if (lmp_le_capable(hdev)) 4906 hci_debugfs_create_le(hdev); 4907 4908 return 0; 4909 } 4910 4911 #define HCI_QUIRK_BROKEN(_quirk, _desc) { HCI_QUIRK_BROKEN_##_quirk, _desc } 4912 4913 static const struct { 4914 unsigned long quirk; 4915 const char *desc; 4916 } hci_broken_table[] = { 4917 HCI_QUIRK_BROKEN(LOCAL_COMMANDS, 4918 "HCI Read Local Supported Commands not supported"), 4919 HCI_QUIRK_BROKEN(STORED_LINK_KEY, 4920 "HCI Delete Stored Link Key command is advertised, " 4921 "but not supported."), 4922 HCI_QUIRK_BROKEN(ERR_DATA_REPORTING, 4923 "HCI Read Default Erroneous Data Reporting command is " 4924 "advertised, but not supported."), 4925 HCI_QUIRK_BROKEN(READ_TRANSMIT_POWER, 4926 "HCI Read Transmit Power Level command is advertised, " 4927 "but not supported."), 4928 HCI_QUIRK_BROKEN(FILTER_CLEAR_ALL, 4929 "HCI Set Event Filter command not supported."), 4930 HCI_QUIRK_BROKEN(ENHANCED_SETUP_SYNC_CONN, 4931 "HCI Enhanced Setup Synchronous Connection command is " 4932 "advertised, but not supported."), 4933 HCI_QUIRK_BROKEN(SET_RPA_TIMEOUT, 4934 "HCI LE Set Random Private Address Timeout command is " 4935 "advertised, but not supported."), 4936 HCI_QUIRK_BROKEN(EXT_CREATE_CONN, 4937 "HCI LE Extended Create Connection command is " 4938 "advertised, but not supported."), 4939 HCI_QUIRK_BROKEN(WRITE_AUTH_PAYLOAD_TIMEOUT, 4940 "HCI WRITE AUTH PAYLOAD TIMEOUT command leads " 4941 "to unexpected SMP errors when pairing " 4942 "and will not be used."), 4943 HCI_QUIRK_BROKEN(LE_CODED, 4944 "HCI LE Coded PHY feature bit is set, " 4945 "but its usage is not supported.") 4946 }; 4947 4948 /* This function handles hdev setup stage: 4949 * 4950 * Calls hdev->setup 4951 * Setup address if HCI_QUIRK_USE_BDADDR_PROPERTY is set. 4952 */ 4953 static int hci_dev_setup_sync(struct hci_dev *hdev) 4954 { 4955 int ret = 0; 4956 bool invalid_bdaddr; 4957 size_t i; 4958 4959 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 4960 !hci_test_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_SETUP)) 4961 return 0; 4962 4963 bt_dev_dbg(hdev, ""); 4964 4965 hci_sock_dev_event(hdev, HCI_DEV_SETUP); 4966 4967 if (hdev->setup) 4968 ret = hdev->setup(hdev); 4969 4970 for (i = 0; i < ARRAY_SIZE(hci_broken_table); i++) { 4971 if (hci_test_quirk(hdev, hci_broken_table[i].quirk)) 4972 bt_dev_warn(hdev, "%s", hci_broken_table[i].desc); 4973 } 4974 4975 /* The transport driver can set the quirk to mark the 4976 * BD_ADDR invalid before creating the HCI device or in 4977 * its setup callback. 4978 */ 4979 invalid_bdaddr = hci_test_quirk(hdev, HCI_QUIRK_INVALID_BDADDR) || 4980 hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY); 4981 if (!ret) { 4982 if (hci_test_quirk(hdev, HCI_QUIRK_USE_BDADDR_PROPERTY) && 4983 !bacmp(&hdev->public_addr, BDADDR_ANY)) 4984 hci_dev_get_bd_addr_from_property(hdev); 4985 4986 if (invalid_bdaddr && bacmp(&hdev->public_addr, BDADDR_ANY) && 4987 hdev->set_bdaddr) { 4988 ret = hdev->set_bdaddr(hdev, &hdev->public_addr); 4989 if (!ret) 4990 invalid_bdaddr = false; 4991 } 4992 } 4993 4994 /* The transport driver can set these quirks before 4995 * creating the HCI device or in its setup callback. 4996 * 4997 * For the invalid BD_ADDR quirk it is possible that 4998 * it becomes a valid address if the bootloader does 4999 * provide it (see above). 5000 * 5001 * In case any of them is set, the controller has to 5002 * start up as unconfigured. 5003 */ 5004 if (hci_test_quirk(hdev, HCI_QUIRK_EXTERNAL_CONFIG) || 5005 invalid_bdaddr) 5006 hci_dev_set_flag(hdev, HCI_UNCONFIGURED); 5007 5008 /* For an unconfigured controller it is required to 5009 * read at least the version information provided by 5010 * the Read Local Version Information command. 5011 * 5012 * If the set_bdaddr driver callback is provided, then 5013 * also the original Bluetooth public device address 5014 * will be read using the Read BD Address command. 5015 */ 5016 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 5017 return hci_unconf_init_sync(hdev); 5018 5019 return ret; 5020 } 5021 5022 /* This function handles hdev init stage: 5023 * 5024 * Calls hci_dev_setup_sync to perform setup stage 5025 * Calls hci_init_sync to perform HCI command init sequence 5026 */ 5027 static int hci_dev_init_sync(struct hci_dev *hdev) 5028 { 5029 int ret; 5030 5031 bt_dev_dbg(hdev, ""); 5032 5033 atomic_set(&hdev->cmd_cnt, 1); 5034 set_bit(HCI_INIT, &hdev->flags); 5035 5036 ret = hci_dev_setup_sync(hdev); 5037 5038 if (hci_dev_test_flag(hdev, HCI_CONFIG)) { 5039 /* If public address change is configured, ensure that 5040 * the address gets programmed. If the driver does not 5041 * support changing the public address, fail the power 5042 * on procedure. 5043 */ 5044 if (bacmp(&hdev->public_addr, BDADDR_ANY) && 5045 hdev->set_bdaddr) 5046 ret = hdev->set_bdaddr(hdev, &hdev->public_addr); 5047 else 5048 ret = -EADDRNOTAVAIL; 5049 } 5050 5051 if (!ret) { 5052 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 5053 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 5054 ret = hci_init_sync(hdev); 5055 if (!ret && hdev->post_init) 5056 ret = hdev->post_init(hdev); 5057 } 5058 } 5059 5060 /* If the HCI Reset command is clearing all diagnostic settings, 5061 * then they need to be reprogrammed after the init procedure 5062 * completed. 5063 */ 5064 if (hci_test_quirk(hdev, HCI_QUIRK_NON_PERSISTENT_DIAG) && 5065 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 5066 hci_dev_test_flag(hdev, HCI_VENDOR_DIAG) && hdev->set_diag) 5067 ret = hdev->set_diag(hdev, true); 5068 5069 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 5070 msft_do_open(hdev); 5071 aosp_do_open(hdev); 5072 } 5073 5074 clear_bit(HCI_INIT, &hdev->flags); 5075 5076 return ret; 5077 } 5078 5079 int hci_dev_open_sync(struct hci_dev *hdev) 5080 { 5081 int ret; 5082 5083 bt_dev_dbg(hdev, ""); 5084 5085 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 5086 ret = -ENODEV; 5087 goto done; 5088 } 5089 5090 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 5091 !hci_dev_test_flag(hdev, HCI_CONFIG)) { 5092 /* Check for rfkill but allow the HCI setup stage to 5093 * proceed (which in itself doesn't cause any RF activity). 5094 */ 5095 if (hci_dev_test_flag(hdev, HCI_RFKILLED)) { 5096 ret = -ERFKILL; 5097 goto done; 5098 } 5099 5100 /* Check for valid public address or a configured static 5101 * random address, but let the HCI setup proceed to 5102 * be able to determine if there is a public address 5103 * or not. 5104 * 5105 * In case of user channel usage, it is not important 5106 * if a public address or static random address is 5107 * available. 5108 */ 5109 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 5110 !bacmp(&hdev->bdaddr, BDADDR_ANY) && 5111 !bacmp(&hdev->static_addr, BDADDR_ANY)) { 5112 ret = -EADDRNOTAVAIL; 5113 goto done; 5114 } 5115 } 5116 5117 if (test_bit(HCI_UP, &hdev->flags)) { 5118 ret = -EALREADY; 5119 goto done; 5120 } 5121 5122 if (hdev->open(hdev)) { 5123 ret = -EIO; 5124 goto done; 5125 } 5126 5127 hci_devcd_reset(hdev); 5128 5129 set_bit(HCI_RUNNING, &hdev->flags); 5130 hci_sock_dev_event(hdev, HCI_DEV_OPEN); 5131 5132 ret = hci_dev_init_sync(hdev); 5133 if (!ret) { 5134 hci_dev_hold(hdev); 5135 hci_dev_set_flag(hdev, HCI_RPA_EXPIRED); 5136 hci_adv_instances_set_rpa_expired(hdev, true); 5137 set_bit(HCI_UP, &hdev->flags); 5138 hci_sock_dev_event(hdev, HCI_DEV_UP); 5139 hci_leds_update_powered(hdev, true); 5140 if (!hci_dev_test_flag(hdev, HCI_SETUP) && 5141 !hci_dev_test_flag(hdev, HCI_CONFIG) && 5142 !hci_dev_test_flag(hdev, HCI_UNCONFIGURED) && 5143 !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 5144 hci_dev_test_flag(hdev, HCI_MGMT)) { 5145 ret = hci_powered_update_sync(hdev); 5146 mgmt_power_on(hdev, ret); 5147 } 5148 } else { 5149 /* Init failed, cleanup */ 5150 flush_work(&hdev->tx_work); 5151 5152 /* Since hci_rx_work() is possible to awake new cmd_work 5153 * it should be flushed first to avoid unexpected call of 5154 * hci_cmd_work() 5155 */ 5156 flush_work(&hdev->rx_work); 5157 flush_work(&hdev->cmd_work); 5158 5159 skb_queue_purge(&hdev->cmd_q); 5160 skb_queue_purge(&hdev->rx_q); 5161 5162 if (hdev->flush) 5163 hdev->flush(hdev); 5164 5165 if (hdev->sent_cmd) { 5166 cancel_delayed_work_sync(&hdev->cmd_timer); 5167 kfree_skb(hdev->sent_cmd); 5168 hdev->sent_cmd = NULL; 5169 } 5170 5171 if (hdev->req_skb) { 5172 kfree_skb(hdev->req_skb); 5173 hdev->req_skb = NULL; 5174 } 5175 5176 clear_bit(HCI_RUNNING, &hdev->flags); 5177 hci_sock_dev_event(hdev, HCI_DEV_CLOSE); 5178 5179 hdev->close(hdev); 5180 hdev->flags &= BIT(HCI_RAW); 5181 } 5182 5183 done: 5184 return ret; 5185 } 5186 5187 /* This function requires the caller holds hdev->lock */ 5188 static void hci_pend_le_actions_clear(struct hci_dev *hdev) 5189 { 5190 struct hci_conn_params *p; 5191 5192 list_for_each_entry(p, &hdev->le_conn_params, list) { 5193 hci_pend_le_list_del_init(p); 5194 if (p->conn) { 5195 hci_conn_drop(p->conn); 5196 hci_conn_put(p->conn); 5197 p->conn = NULL; 5198 } 5199 } 5200 5201 BT_DBG("All LE pending actions cleared"); 5202 } 5203 5204 static int hci_dev_shutdown(struct hci_dev *hdev) 5205 { 5206 int err = 0; 5207 /* Similar to how we first do setup and then set the exclusive access 5208 * bit for userspace, we must first unset userchannel and then clean up. 5209 * Otherwise, the kernel can't properly use the hci channel to clean up 5210 * the controller (some shutdown routines require sending additional 5211 * commands to the controller for example). 5212 */ 5213 bool was_userchannel = 5214 hci_dev_test_and_clear_flag(hdev, HCI_USER_CHANNEL); 5215 5216 if (!hci_dev_test_flag(hdev, HCI_UNREGISTER) && 5217 test_bit(HCI_UP, &hdev->flags)) { 5218 /* Execute vendor specific shutdown routine */ 5219 if (hdev->shutdown) 5220 err = hdev->shutdown(hdev); 5221 } 5222 5223 if (was_userchannel) 5224 hci_dev_set_flag(hdev, HCI_USER_CHANNEL); 5225 5226 return err; 5227 } 5228 5229 int hci_dev_close_sync(struct hci_dev *hdev) 5230 { 5231 bool auto_off; 5232 int err = 0; 5233 5234 bt_dev_dbg(hdev, ""); 5235 5236 if (hci_dev_test_flag(hdev, HCI_UNREGISTER)) { 5237 disable_delayed_work(&hdev->power_off); 5238 disable_delayed_work(&hdev->ncmd_timer); 5239 disable_delayed_work(&hdev->le_scan_disable); 5240 } else { 5241 cancel_delayed_work(&hdev->power_off); 5242 cancel_delayed_work(&hdev->ncmd_timer); 5243 cancel_delayed_work(&hdev->le_scan_disable); 5244 } 5245 5246 hci_cmd_sync_cancel_sync(hdev, ENODEV); 5247 5248 cancel_interleave_scan(hdev); 5249 5250 if (hdev->adv_instance_timeout) { 5251 cancel_delayed_work_sync(&hdev->adv_instance_expire); 5252 hdev->adv_instance_timeout = 0; 5253 } 5254 5255 err = hci_dev_shutdown(hdev); 5256 5257 if (!test_and_clear_bit(HCI_UP, &hdev->flags)) { 5258 cancel_delayed_work_sync(&hdev->cmd_timer); 5259 return err; 5260 } 5261 5262 hci_leds_update_powered(hdev, false); 5263 5264 /* Flush RX and TX works */ 5265 flush_work(&hdev->tx_work); 5266 flush_work(&hdev->rx_work); 5267 5268 if (hdev->discov_timeout > 0) { 5269 hdev->discov_timeout = 0; 5270 hci_dev_clear_flag(hdev, HCI_DISCOVERABLE); 5271 hci_dev_clear_flag(hdev, HCI_LIMITED_DISCOVERABLE); 5272 } 5273 5274 if (hci_dev_test_and_clear_flag(hdev, HCI_SERVICE_CACHE)) 5275 cancel_delayed_work(&hdev->service_cache); 5276 5277 if (hci_dev_test_flag(hdev, HCI_MGMT)) { 5278 struct adv_info *adv_instance; 5279 5280 cancel_delayed_work_sync(&hdev->rpa_expired); 5281 5282 list_for_each_entry(adv_instance, &hdev->adv_instances, list) 5283 cancel_delayed_work_sync(&adv_instance->rpa_expired_cb); 5284 } 5285 5286 /* Avoid potential lockdep warnings from the *_flush() calls by 5287 * ensuring the workqueue is empty up front. 5288 */ 5289 drain_workqueue(hdev->workqueue); 5290 5291 hci_dev_lock(hdev); 5292 5293 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 5294 5295 auto_off = hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF); 5296 5297 if (!auto_off && !hci_dev_test_flag(hdev, HCI_USER_CHANNEL) && 5298 hci_dev_test_flag(hdev, HCI_MGMT)) 5299 __mgmt_power_off(hdev); 5300 5301 hci_inquiry_cache_flush(hdev); 5302 hci_pend_le_actions_clear(hdev); 5303 hci_conn_hash_flush(hdev); 5304 /* Prevent data races on hdev->smp_data or hdev->smp_bredr_data */ 5305 smp_unregister(hdev); 5306 hci_dev_unlock(hdev); 5307 5308 hci_sock_dev_event(hdev, HCI_DEV_DOWN); 5309 5310 if (!hci_dev_test_flag(hdev, HCI_USER_CHANNEL)) { 5311 aosp_do_close(hdev); 5312 msft_do_close(hdev); 5313 } 5314 5315 if (hdev->flush) 5316 hdev->flush(hdev); 5317 5318 /* Reset device */ 5319 skb_queue_purge(&hdev->cmd_q); 5320 atomic_set(&hdev->cmd_cnt, 1); 5321 if (hci_test_quirk(hdev, HCI_QUIRK_RESET_ON_CLOSE) && 5322 !auto_off && !hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) { 5323 set_bit(HCI_INIT, &hdev->flags); 5324 hci_reset_sync(hdev); 5325 clear_bit(HCI_INIT, &hdev->flags); 5326 } 5327 5328 /* flush cmd work */ 5329 flush_work(&hdev->cmd_work); 5330 5331 /* Drop queues */ 5332 skb_queue_purge(&hdev->rx_q); 5333 skb_queue_purge(&hdev->cmd_q); 5334 skb_queue_purge(&hdev->raw_q); 5335 5336 /* Drop last sent command */ 5337 if (hdev->sent_cmd) { 5338 cancel_delayed_work_sync(&hdev->cmd_timer); 5339 kfree_skb(hdev->sent_cmd); 5340 hdev->sent_cmd = NULL; 5341 } 5342 5343 /* Drop last request */ 5344 if (hdev->req_skb) { 5345 kfree_skb(hdev->req_skb); 5346 hdev->req_skb = NULL; 5347 } 5348 5349 clear_bit(HCI_RUNNING, &hdev->flags); 5350 hci_sock_dev_event(hdev, HCI_DEV_CLOSE); 5351 5352 /* After this point our queues are empty and no tasks are scheduled. */ 5353 hdev->close(hdev); 5354 5355 /* Clear flags */ 5356 hdev->flags &= BIT(HCI_RAW); 5357 hci_dev_clear_volatile_flags(hdev); 5358 5359 memset(hdev->eir, 0, sizeof(hdev->eir)); 5360 memset(hdev->dev_class, 0, sizeof(hdev->dev_class)); 5361 bacpy(&hdev->random_addr, BDADDR_ANY); 5362 hci_codec_list_clear(&hdev->local_codecs); 5363 5364 hci_dev_put(hdev); 5365 return err; 5366 } 5367 5368 /* This function perform power on HCI command sequence as follows: 5369 * 5370 * If controller is already up (HCI_UP) performs hci_powered_update_sync 5371 * sequence otherwise run hci_dev_open_sync which will follow with 5372 * hci_powered_update_sync after the init sequence is completed. 5373 */ 5374 static int hci_power_on_sync(struct hci_dev *hdev) 5375 { 5376 int err; 5377 5378 if (test_bit(HCI_UP, &hdev->flags) && 5379 hci_dev_test_flag(hdev, HCI_MGMT) && 5380 hci_dev_test_and_clear_flag(hdev, HCI_AUTO_OFF)) { 5381 cancel_delayed_work(&hdev->power_off); 5382 return hci_powered_update_sync(hdev); 5383 } 5384 5385 err = hci_dev_open_sync(hdev); 5386 if (err < 0) 5387 return err; 5388 5389 /* During the HCI setup phase, a few error conditions are 5390 * ignored and they need to be checked now. If they are still 5391 * valid, it is important to return the device back off. 5392 */ 5393 if (hci_dev_test_flag(hdev, HCI_RFKILLED) || 5394 hci_dev_test_flag(hdev, HCI_UNCONFIGURED) || 5395 (!bacmp(&hdev->bdaddr, BDADDR_ANY) && 5396 !bacmp(&hdev->static_addr, BDADDR_ANY))) { 5397 hci_dev_clear_flag(hdev, HCI_AUTO_OFF); 5398 hci_dev_close_sync(hdev); 5399 } else if (hci_dev_test_flag(hdev, HCI_AUTO_OFF)) { 5400 queue_delayed_work(hdev->req_workqueue, &hdev->power_off, 5401 HCI_AUTO_OFF_TIMEOUT); 5402 } 5403 5404 if (hci_dev_test_and_clear_flag(hdev, HCI_SETUP)) { 5405 /* For unconfigured devices, set the HCI_RAW flag 5406 * so that userspace can easily identify them. 5407 */ 5408 if (hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 5409 set_bit(HCI_RAW, &hdev->flags); 5410 5411 /* For fully configured devices, this will send 5412 * the Index Added event. For unconfigured devices, 5413 * it will send Unconfigued Index Added event. 5414 * 5415 * Devices with HCI_QUIRK_RAW_DEVICE are ignored 5416 * and no event will be send. 5417 */ 5418 mgmt_index_added(hdev); 5419 } else if (hci_dev_test_and_clear_flag(hdev, HCI_CONFIG)) { 5420 /* When the controller is now configured, then it 5421 * is important to clear the HCI_RAW flag. 5422 */ 5423 if (!hci_dev_test_flag(hdev, HCI_UNCONFIGURED)) 5424 clear_bit(HCI_RAW, &hdev->flags); 5425 5426 /* Powering on the controller with HCI_CONFIG set only 5427 * happens with the transition from unconfigured to 5428 * configured. This will send the Index Added event. 5429 */ 5430 mgmt_index_added(hdev); 5431 } 5432 5433 return 0; 5434 } 5435 5436 static int hci_remote_name_cancel_sync(struct hci_dev *hdev, bdaddr_t *addr) 5437 { 5438 struct hci_cp_remote_name_req_cancel cp; 5439 5440 memset(&cp, 0, sizeof(cp)); 5441 bacpy(&cp.bdaddr, addr); 5442 5443 return __hci_cmd_sync_status(hdev, HCI_OP_REMOTE_NAME_REQ_CANCEL, 5444 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 5445 } 5446 5447 int hci_stop_discovery_sync(struct hci_dev *hdev) 5448 { 5449 struct discovery_state *d = &hdev->discovery; 5450 struct inquiry_entry *e; 5451 int err; 5452 5453 bt_dev_dbg(hdev, "state %u", hdev->discovery.state); 5454 5455 if (d->state == DISCOVERY_FINDING || d->state == DISCOVERY_STOPPING) { 5456 if (test_bit(HCI_INQUIRY, &hdev->flags)) { 5457 err = __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY_CANCEL, 5458 0, NULL, HCI_CMD_TIMEOUT); 5459 if (err) 5460 return err; 5461 } 5462 5463 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 5464 cancel_delayed_work(&hdev->le_scan_disable); 5465 5466 err = hci_scan_disable_sync(hdev); 5467 if (err) 5468 return err; 5469 } 5470 5471 } else { 5472 err = hci_scan_disable_sync(hdev); 5473 if (err) 5474 return err; 5475 } 5476 5477 /* Resume advertising if it was paused */ 5478 if (ll_privacy_capable(hdev)) 5479 hci_resume_advertising_sync(hdev); 5480 5481 /* No further actions needed for LE-only discovery */ 5482 if (d->type == DISCOV_TYPE_LE) 5483 return 0; 5484 5485 if (d->state == DISCOVERY_RESOLVING || d->state == DISCOVERY_STOPPING) { 5486 e = hci_inquiry_cache_lookup_resolve(hdev, BDADDR_ANY, 5487 NAME_PENDING); 5488 if (!e) 5489 return 0; 5490 5491 /* Ignore cancel errors since it should interfere with stopping 5492 * of the discovery. 5493 */ 5494 hci_remote_name_cancel_sync(hdev, &e->data.bdaddr); 5495 } 5496 5497 return 0; 5498 } 5499 5500 static int hci_disconnect_sync(struct hci_dev *hdev, struct hci_conn *conn, 5501 u8 reason) 5502 { 5503 struct hci_cp_disconnect cp; 5504 5505 if (conn->type == BIS_LINK || conn->type == PA_LINK) { 5506 /* This is a BIS connection, hci_conn_del will 5507 * do the necessary cleanup. 5508 */ 5509 hci_dev_lock(hdev); 5510 hci_conn_failed(conn, reason); 5511 hci_dev_unlock(hdev); 5512 5513 return 0; 5514 } 5515 5516 memset(&cp, 0, sizeof(cp)); 5517 cp.handle = cpu_to_le16(conn->handle); 5518 cp.reason = reason; 5519 5520 /* Wait for HCI_EV_DISCONN_COMPLETE, not HCI_EV_CMD_STATUS, when the 5521 * reason is anything but HCI_ERROR_REMOTE_POWER_OFF. This reason is 5522 * used when suspending or powering off, where we don't want to wait 5523 * for the peer's response. 5524 */ 5525 if (reason != HCI_ERROR_REMOTE_POWER_OFF) 5526 return __hci_cmd_sync_status_sk(hdev, HCI_OP_DISCONNECT, 5527 sizeof(cp), &cp, 5528 HCI_EV_DISCONN_COMPLETE, 5529 HCI_CMD_TIMEOUT, NULL); 5530 5531 return __hci_cmd_sync_status(hdev, HCI_OP_DISCONNECT, sizeof(cp), &cp, 5532 HCI_CMD_TIMEOUT); 5533 } 5534 5535 static int hci_le_connect_cancel_sync(struct hci_dev *hdev, 5536 struct hci_conn *conn, u8 reason) 5537 { 5538 /* Return reason if scanning since the connection shall probably be 5539 * cleanup directly. 5540 */ 5541 if (test_bit(HCI_CONN_SCANNING, &conn->flags)) 5542 return reason; 5543 5544 if (conn->role == HCI_ROLE_SLAVE || 5545 test_and_set_bit(HCI_CONN_CANCEL, &conn->flags)) 5546 return 0; 5547 5548 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CREATE_CONN_CANCEL, 5549 0, NULL, HCI_CMD_TIMEOUT); 5550 } 5551 5552 static int hci_connect_cancel_sync(struct hci_dev *hdev, struct hci_conn *conn, 5553 u8 reason) 5554 { 5555 if (conn->type == LE_LINK) 5556 return hci_le_connect_cancel_sync(hdev, conn, reason); 5557 5558 if (conn->type == CIS_LINK) { 5559 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 5560 * page 1857: 5561 * 5562 * If this command is issued for a CIS on the Central and the 5563 * CIS is successfully terminated before being established, 5564 * then an HCI_LE_CIS_Established event shall also be sent for 5565 * this CIS with the Status Operation Cancelled by Host (0x44). 5566 */ 5567 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) 5568 return hci_disconnect_sync(hdev, conn, reason); 5569 5570 /* CIS with no Create CIS sent have nothing to cancel */ 5571 return HCI_ERROR_LOCAL_HOST_TERM; 5572 } 5573 5574 if (conn->type == BIS_LINK || conn->type == PA_LINK) { 5575 /* There is no way to cancel a BIS without terminating the BIG 5576 * which is done later on connection cleanup. 5577 */ 5578 return 0; 5579 } 5580 5581 if (hdev->hci_ver < BLUETOOTH_VER_1_2) 5582 return 0; 5583 5584 /* Wait for HCI_EV_CONN_COMPLETE, not HCI_EV_CMD_STATUS, when the 5585 * reason is anything but HCI_ERROR_REMOTE_POWER_OFF. This reason is 5586 * used when suspending or powering off, where we don't want to wait 5587 * for the peer's response. 5588 */ 5589 if (reason != HCI_ERROR_REMOTE_POWER_OFF) 5590 return __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN_CANCEL, 5591 6, &conn->dst, 5592 HCI_EV_CONN_COMPLETE, 5593 HCI_CMD_TIMEOUT, NULL); 5594 5595 return __hci_cmd_sync_status(hdev, HCI_OP_CREATE_CONN_CANCEL, 5596 6, &conn->dst, HCI_CMD_TIMEOUT); 5597 } 5598 5599 static int hci_reject_sco_sync(struct hci_dev *hdev, struct hci_conn *conn, 5600 u8 reason) 5601 { 5602 struct hci_cp_reject_sync_conn_req cp; 5603 5604 memset(&cp, 0, sizeof(cp)); 5605 bacpy(&cp.bdaddr, &conn->dst); 5606 cp.reason = reason; 5607 5608 /* SCO rejection has its own limited set of 5609 * allowed error values (0x0D-0x0F). 5610 */ 5611 if (reason < 0x0d || reason > 0x0f) 5612 cp.reason = HCI_ERROR_REJ_LIMITED_RESOURCES; 5613 5614 return __hci_cmd_sync_status(hdev, HCI_OP_REJECT_SYNC_CONN_REQ, 5615 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 5616 } 5617 5618 static int hci_le_reject_cis_sync(struct hci_dev *hdev, struct hci_conn *conn, 5619 u8 reason) 5620 { 5621 struct hci_cp_le_reject_cis cp; 5622 5623 memset(&cp, 0, sizeof(cp)); 5624 cp.handle = cpu_to_le16(conn->handle); 5625 cp.reason = reason; 5626 5627 return __hci_cmd_sync_status(hdev, HCI_OP_LE_REJECT_CIS, 5628 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 5629 } 5630 5631 static int hci_reject_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, 5632 u8 reason) 5633 { 5634 struct hci_cp_reject_conn_req cp; 5635 5636 if (conn->type == CIS_LINK) 5637 return hci_le_reject_cis_sync(hdev, conn, reason); 5638 5639 if (conn->type == BIS_LINK || conn->type == PA_LINK) 5640 return -EINVAL; 5641 5642 if (conn->type == SCO_LINK || conn->type == ESCO_LINK) 5643 return hci_reject_sco_sync(hdev, conn, reason); 5644 5645 memset(&cp, 0, sizeof(cp)); 5646 bacpy(&cp.bdaddr, &conn->dst); 5647 cp.reason = reason; 5648 5649 return __hci_cmd_sync_status(hdev, HCI_OP_REJECT_CONN_REQ, 5650 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 5651 } 5652 5653 int hci_abort_conn_sync(struct hci_dev *hdev, struct hci_conn *conn, u8 reason) 5654 { 5655 int err = 0; 5656 u16 handle = conn->handle; 5657 bool disconnect = false; 5658 struct hci_conn *c; 5659 5660 switch (conn->state) { 5661 case BT_CONNECTED: 5662 case BT_CONFIG: 5663 err = hci_disconnect_sync(hdev, conn, reason); 5664 break; 5665 case BT_CONNECT: 5666 err = hci_connect_cancel_sync(hdev, conn, reason); 5667 break; 5668 case BT_CONNECT2: 5669 err = hci_reject_conn_sync(hdev, conn, reason); 5670 break; 5671 case BT_OPEN: 5672 case BT_BOUND: 5673 break; 5674 default: 5675 disconnect = true; 5676 break; 5677 } 5678 5679 hci_dev_lock(hdev); 5680 5681 /* Check if the connection has been cleaned up concurrently */ 5682 c = hci_conn_hash_lookup_handle(hdev, handle); 5683 if (!c || c != conn) { 5684 err = 0; 5685 goto unlock; 5686 } 5687 5688 /* Cleanup hci_conn object if it cannot be cancelled as it 5689 * likely means the controller and host stack are out of sync 5690 * or in case of LE it was still scanning so it can be cleanup 5691 * safely. 5692 */ 5693 if (disconnect) { 5694 conn->state = BT_CLOSED; 5695 hci_disconn_cfm(conn, reason); 5696 hci_conn_del(conn); 5697 } else { 5698 hci_conn_failed(conn, reason); 5699 } 5700 5701 unlock: 5702 hci_dev_unlock(hdev); 5703 return err; 5704 } 5705 5706 static int hci_disconnect_all_sync(struct hci_dev *hdev, u8 reason) 5707 { 5708 struct list_head *head = &hdev->conn_hash.list; 5709 struct hci_conn *conn; 5710 5711 rcu_read_lock(); 5712 while ((conn = list_first_or_null_rcu(head, struct hci_conn, list))) { 5713 /* Make sure the connection is not freed while unlocking */ 5714 conn = hci_conn_get(conn); 5715 rcu_read_unlock(); 5716 /* Disregard possible errors since hci_conn_del shall have been 5717 * called even in case of errors had occurred since it would 5718 * then cause hci_conn_failed to be called which calls 5719 * hci_conn_del internally. 5720 */ 5721 hci_abort_conn_sync(hdev, conn, reason); 5722 hci_conn_put(conn); 5723 rcu_read_lock(); 5724 } 5725 rcu_read_unlock(); 5726 5727 return 0; 5728 } 5729 5730 /* This function perform power off HCI command sequence as follows: 5731 * 5732 * Clear Advertising 5733 * Stop Discovery 5734 * Disconnect all connections 5735 * hci_dev_close_sync 5736 */ 5737 static int hci_power_off_sync(struct hci_dev *hdev) 5738 { 5739 int err; 5740 5741 /* If controller is already down there is nothing to do */ 5742 if (!test_bit(HCI_UP, &hdev->flags)) 5743 return 0; 5744 5745 hci_dev_set_flag(hdev, HCI_POWERING_DOWN); 5746 5747 if (test_bit(HCI_ISCAN, &hdev->flags) || 5748 test_bit(HCI_PSCAN, &hdev->flags)) { 5749 err = hci_write_scan_enable_sync(hdev, 0x00); 5750 if (err) 5751 goto out; 5752 } 5753 5754 err = hci_clear_adv_sync(hdev, NULL, false); 5755 if (err) 5756 goto out; 5757 5758 err = hci_stop_discovery_sync(hdev); 5759 if (err) 5760 goto out; 5761 5762 /* Terminated due to Power Off */ 5763 err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF); 5764 if (err) 5765 goto out; 5766 5767 err = hci_dev_close_sync(hdev); 5768 5769 out: 5770 hci_dev_clear_flag(hdev, HCI_POWERING_DOWN); 5771 return err; 5772 } 5773 5774 int hci_set_powered_sync(struct hci_dev *hdev, u8 val) 5775 { 5776 if (val) 5777 return hci_power_on_sync(hdev); 5778 5779 return hci_power_off_sync(hdev); 5780 } 5781 5782 static int hci_write_iac_sync(struct hci_dev *hdev) 5783 { 5784 struct hci_cp_write_current_iac_lap cp; 5785 5786 if (!hci_dev_test_flag(hdev, HCI_DISCOVERABLE)) 5787 return 0; 5788 5789 memset(&cp, 0, sizeof(cp)); 5790 5791 if (hci_dev_test_flag(hdev, HCI_LIMITED_DISCOVERABLE)) { 5792 /* Limited discoverable mode */ 5793 cp.num_iac = min_t(u8, hdev->num_iac, 2); 5794 cp.iac_lap[0] = 0x00; /* LIAC */ 5795 cp.iac_lap[1] = 0x8b; 5796 cp.iac_lap[2] = 0x9e; 5797 cp.iac_lap[3] = 0x33; /* GIAC */ 5798 cp.iac_lap[4] = 0x8b; 5799 cp.iac_lap[5] = 0x9e; 5800 } else { 5801 /* General discoverable mode */ 5802 cp.num_iac = 1; 5803 cp.iac_lap[0] = 0x33; /* GIAC */ 5804 cp.iac_lap[1] = 0x8b; 5805 cp.iac_lap[2] = 0x9e; 5806 } 5807 5808 return __hci_cmd_sync_status(hdev, HCI_OP_WRITE_CURRENT_IAC_LAP, 5809 (cp.num_iac * 3) + 1, &cp, 5810 HCI_CMD_TIMEOUT); 5811 } 5812 5813 int hci_update_discoverable_sync(struct hci_dev *hdev) 5814 { 5815 int err = 0; 5816 5817 if (hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) { 5818 err = hci_write_iac_sync(hdev); 5819 if (err) 5820 return err; 5821 5822 err = hci_update_scan_sync(hdev); 5823 if (err) 5824 return err; 5825 5826 err = hci_update_class_sync(hdev); 5827 if (err) 5828 return err; 5829 } 5830 5831 /* Advertising instances don't use the global discoverable setting, so 5832 * only update AD if advertising was enabled using Set Advertising. 5833 */ 5834 if (hci_dev_test_flag(hdev, HCI_ADVERTISING)) { 5835 err = hci_update_adv_data_sync(hdev, 0x00); 5836 if (err) 5837 return err; 5838 5839 /* Discoverable mode affects the local advertising 5840 * address in limited privacy mode. 5841 */ 5842 if (hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) { 5843 if (ext_adv_capable(hdev)) 5844 err = hci_start_ext_adv_sync(hdev, 0x00); 5845 else 5846 err = hci_enable_advertising_sync(hdev); 5847 } 5848 } 5849 5850 return err; 5851 } 5852 5853 static int update_discoverable_sync(struct hci_dev *hdev, void *data) 5854 { 5855 return hci_update_discoverable_sync(hdev); 5856 } 5857 5858 int hci_update_discoverable(struct hci_dev *hdev) 5859 { 5860 /* Only queue if it would have any effect */ 5861 if (hdev_is_powered(hdev) && 5862 hci_dev_test_flag(hdev, HCI_ADVERTISING) && 5863 hci_dev_test_flag(hdev, HCI_DISCOVERABLE) && 5864 hci_dev_test_flag(hdev, HCI_LIMITED_PRIVACY)) 5865 return hci_cmd_sync_queue(hdev, update_discoverable_sync, NULL, 5866 NULL); 5867 5868 return 0; 5869 } 5870 5871 int hci_update_connectable_sync(struct hci_dev *hdev) 5872 { 5873 int err; 5874 5875 err = hci_update_scan_sync(hdev); 5876 if (err) 5877 return err; 5878 5879 /* If BR/EDR is not enabled and we disable advertising as a 5880 * by-product of disabling connectable, we need to update the 5881 * advertising flags. 5882 */ 5883 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 5884 err = hci_update_adv_data_sync(hdev, hdev->cur_adv_instance); 5885 5886 /* Update the advertising parameters if necessary */ 5887 if (hci_dev_test_flag(hdev, HCI_ADVERTISING) || 5888 !list_empty(&hdev->adv_instances)) { 5889 if (ext_adv_capable(hdev)) 5890 err = hci_start_ext_adv_sync(hdev, 5891 hdev->cur_adv_instance); 5892 else 5893 err = hci_enable_advertising_sync(hdev); 5894 5895 if (err) 5896 return err; 5897 } 5898 5899 return hci_update_passive_scan_sync(hdev); 5900 } 5901 5902 int hci_inquiry_sync(struct hci_dev *hdev, u8 length, u8 num_rsp) 5903 { 5904 const u8 giac[3] = { 0x33, 0x8b, 0x9e }; 5905 const u8 liac[3] = { 0x00, 0x8b, 0x9e }; 5906 struct hci_cp_inquiry cp; 5907 5908 bt_dev_dbg(hdev, ""); 5909 5910 if (test_bit(HCI_INQUIRY, &hdev->flags)) 5911 return 0; 5912 5913 hci_dev_lock(hdev); 5914 hci_inquiry_cache_flush(hdev); 5915 hci_dev_unlock(hdev); 5916 5917 memset(&cp, 0, sizeof(cp)); 5918 5919 if (hdev->discovery.limited) 5920 memcpy(&cp.lap, liac, sizeof(cp.lap)); 5921 else 5922 memcpy(&cp.lap, giac, sizeof(cp.lap)); 5923 5924 cp.length = length; 5925 cp.num_rsp = num_rsp; 5926 5927 return __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY, 5928 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 5929 } 5930 5931 static int hci_active_scan_sync(struct hci_dev *hdev, uint16_t interval) 5932 { 5933 u8 own_addr_type; 5934 /* Accept list is not used for discovery */ 5935 u8 filter_policy = 0x00; 5936 /* Default is to enable duplicates filter */ 5937 u8 filter_dup = LE_SCAN_FILTER_DUP_ENABLE; 5938 int err; 5939 5940 bt_dev_dbg(hdev, ""); 5941 5942 /* If controller is scanning, it means the passive scanning is 5943 * running. Thus, we should temporarily stop it in order to set the 5944 * discovery scanning parameters. 5945 */ 5946 err = hci_scan_disable_sync(hdev); 5947 if (err) { 5948 bt_dev_err(hdev, "Unable to disable scanning: %d", err); 5949 return err; 5950 } 5951 5952 cancel_interleave_scan(hdev); 5953 5954 /* Pause address resolution for active scan and stop advertising if 5955 * privacy is enabled. 5956 */ 5957 err = hci_pause_addr_resolution(hdev); 5958 if (err) 5959 goto failed; 5960 5961 /* All active scans will be done with either a resolvable private 5962 * address (when privacy feature has been enabled) or non-resolvable 5963 * private address. 5964 */ 5965 err = hci_update_random_address_sync(hdev, true, scan_use_rpa(hdev), 5966 &own_addr_type); 5967 if (err < 0) 5968 own_addr_type = ADDR_LE_DEV_PUBLIC; 5969 5970 if (hci_is_adv_monitoring(hdev) || 5971 (hci_test_quirk(hdev, HCI_QUIRK_STRICT_DUPLICATE_FILTER) && 5972 hdev->discovery.result_filtering)) { 5973 /* Duplicate filter should be disabled when some advertisement 5974 * monitor is activated, otherwise AdvMon can only receive one 5975 * advertisement for one peer(*) during active scanning, and 5976 * might report loss to these peers. 5977 * 5978 * If controller does strict duplicate filtering and the 5979 * discovery requires result filtering disables controller based 5980 * filtering since that can cause reports that would match the 5981 * host filter to not be reported. 5982 */ 5983 filter_dup = LE_SCAN_FILTER_DUP_DISABLE; 5984 } 5985 5986 err = hci_start_scan_sync(hdev, LE_SCAN_ACTIVE, interval, 5987 hdev->le_scan_window_discovery, 5988 own_addr_type, filter_policy, filter_dup); 5989 if (!err) 5990 return err; 5991 5992 failed: 5993 /* Resume advertising if it was paused */ 5994 if (ll_privacy_capable(hdev)) 5995 hci_resume_advertising_sync(hdev); 5996 5997 /* Resume passive scanning */ 5998 hci_update_passive_scan_sync(hdev); 5999 return err; 6000 } 6001 6002 static int hci_start_interleaved_discovery_sync(struct hci_dev *hdev) 6003 { 6004 int err; 6005 6006 bt_dev_dbg(hdev, ""); 6007 6008 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery * 2); 6009 if (err) 6010 return err; 6011 6012 return hci_inquiry_sync(hdev, DISCOV_BREDR_INQUIRY_LEN, 0); 6013 } 6014 6015 int hci_start_discovery_sync(struct hci_dev *hdev) 6016 { 6017 unsigned long timeout; 6018 int err; 6019 6020 bt_dev_dbg(hdev, "type %u", hdev->discovery.type); 6021 6022 switch (hdev->discovery.type) { 6023 case DISCOV_TYPE_BREDR: 6024 return hci_inquiry_sync(hdev, DISCOV_BREDR_INQUIRY_LEN, 0); 6025 case DISCOV_TYPE_INTERLEAVED: 6026 /* When running simultaneous discovery, the LE scanning time 6027 * should occupy the whole discovery time sine BR/EDR inquiry 6028 * and LE scanning are scheduled by the controller. 6029 * 6030 * For interleaving discovery in comparison, BR/EDR inquiry 6031 * and LE scanning are done sequentially with separate 6032 * timeouts. 6033 */ 6034 if (hci_test_quirk(hdev, HCI_QUIRK_SIMULTANEOUS_DISCOVERY)) { 6035 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT); 6036 /* During simultaneous discovery, we double LE scan 6037 * interval. We must leave some time for the controller 6038 * to do BR/EDR inquiry. 6039 */ 6040 err = hci_start_interleaved_discovery_sync(hdev); 6041 break; 6042 } 6043 6044 timeout = msecs_to_jiffies(hdev->discov_interleaved_timeout); 6045 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery); 6046 break; 6047 case DISCOV_TYPE_LE: 6048 timeout = msecs_to_jiffies(DISCOV_LE_TIMEOUT); 6049 err = hci_active_scan_sync(hdev, hdev->le_scan_int_discovery); 6050 break; 6051 default: 6052 return -EINVAL; 6053 } 6054 6055 if (err) 6056 return err; 6057 6058 bt_dev_dbg(hdev, "timeout %u ms", jiffies_to_msecs(timeout)); 6059 6060 queue_delayed_work(hdev->req_workqueue, &hdev->le_scan_disable, 6061 timeout); 6062 return 0; 6063 } 6064 6065 static void hci_suspend_monitor_sync(struct hci_dev *hdev) 6066 { 6067 switch (hci_get_adv_monitor_offload_ext(hdev)) { 6068 case HCI_ADV_MONITOR_EXT_MSFT: 6069 msft_suspend_sync(hdev); 6070 break; 6071 default: 6072 return; 6073 } 6074 } 6075 6076 /* This function disables discovery and mark it as paused */ 6077 static int hci_pause_discovery_sync(struct hci_dev *hdev) 6078 { 6079 int old_state = hdev->discovery.state; 6080 int err; 6081 6082 /* If discovery already stopped/stopping/paused there nothing to do */ 6083 if (old_state == DISCOVERY_STOPPED || old_state == DISCOVERY_STOPPING || 6084 hdev->discovery_paused) 6085 return 0; 6086 6087 hci_discovery_set_state(hdev, DISCOVERY_STOPPING); 6088 err = hci_stop_discovery_sync(hdev); 6089 if (err) 6090 return err; 6091 6092 hdev->discovery_paused = true; 6093 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 6094 6095 return 0; 6096 } 6097 6098 static int hci_update_event_filter_sync(struct hci_dev *hdev) 6099 { 6100 struct bdaddr_list_with_flags *b; 6101 u8 scan = SCAN_DISABLED; 6102 bool scanning = test_bit(HCI_PSCAN, &hdev->flags); 6103 int err; 6104 6105 if (!hci_dev_test_flag(hdev, HCI_BREDR_ENABLED)) 6106 return 0; 6107 6108 /* Some fake CSR controllers lock up after setting this type of 6109 * filter, so avoid sending the request altogether. 6110 */ 6111 if (hci_test_quirk(hdev, HCI_QUIRK_BROKEN_FILTER_CLEAR_ALL)) 6112 return 0; 6113 6114 /* Always clear event filter when starting */ 6115 hci_clear_event_filter_sync(hdev); 6116 6117 list_for_each_entry(b, &hdev->accept_list, list) { 6118 if (!(b->flags & HCI_CONN_FLAG_REMOTE_WAKEUP)) 6119 continue; 6120 6121 bt_dev_dbg(hdev, "Adding event filters for %pMR", &b->bdaddr); 6122 6123 err = hci_set_event_filter_sync(hdev, HCI_FLT_CONN_SETUP, 6124 HCI_CONN_SETUP_ALLOW_BDADDR, 6125 &b->bdaddr, 6126 HCI_CONN_SETUP_AUTO_ON); 6127 if (err) 6128 bt_dev_err(hdev, "Failed to set event filter for %pMR", 6129 &b->bdaddr); 6130 else 6131 scan = SCAN_PAGE; 6132 } 6133 6134 if (scan && !scanning) 6135 hci_write_scan_enable_sync(hdev, scan); 6136 else if (!scan && scanning) 6137 hci_write_scan_enable_sync(hdev, scan); 6138 6139 return 0; 6140 } 6141 6142 /* This function disables scan (BR and LE) and mark it as paused */ 6143 static int hci_pause_scan_sync(struct hci_dev *hdev) 6144 { 6145 if (hdev->scanning_paused) 6146 return 0; 6147 6148 /* Disable page scan if enabled */ 6149 if (test_bit(HCI_PSCAN, &hdev->flags)) 6150 hci_write_scan_enable_sync(hdev, SCAN_DISABLED); 6151 6152 hci_scan_disable_sync(hdev); 6153 6154 hdev->scanning_paused = true; 6155 6156 return 0; 6157 } 6158 6159 /* This function performs the HCI suspend procedures in the follow order: 6160 * 6161 * Pause discovery (active scanning/inquiry) 6162 * Pause Directed Advertising/Advertising 6163 * Pause Scanning (passive scanning in case discovery was not active) 6164 * Disconnect all connections 6165 * Set suspend_status to BT_SUSPEND_DISCONNECT if hdev cannot wakeup 6166 * otherwise: 6167 * Update event mask (only set events that are allowed to wake up the host) 6168 * Update event filter (with devices marked with HCI_CONN_FLAG_REMOTE_WAKEUP) 6169 * Update passive scanning (lower duty cycle) 6170 * Set suspend_status to BT_SUSPEND_CONFIGURE_WAKE 6171 */ 6172 int hci_suspend_sync(struct hci_dev *hdev) 6173 { 6174 int err; 6175 6176 /* If marked as suspended there nothing to do */ 6177 if (hdev->suspended) 6178 return 0; 6179 6180 /* Mark device as suspended */ 6181 hdev->suspended = true; 6182 6183 /* Pause discovery if not already stopped */ 6184 hci_pause_discovery_sync(hdev); 6185 6186 /* Pause other advertisements */ 6187 hci_pause_advertising_sync(hdev); 6188 6189 /* Suspend monitor filters */ 6190 hci_suspend_monitor_sync(hdev); 6191 6192 /* Prevent disconnects from causing scanning to be re-enabled */ 6193 hci_pause_scan_sync(hdev); 6194 6195 if (hci_conn_count(hdev)) { 6196 /* Soft disconnect everything (power off) */ 6197 err = hci_disconnect_all_sync(hdev, HCI_ERROR_REMOTE_POWER_OFF); 6198 if (err) { 6199 /* Set state to BT_RUNNING so resume doesn't notify */ 6200 hdev->suspend_state = BT_RUNNING; 6201 hci_resume_sync(hdev); 6202 return err; 6203 } 6204 6205 /* Update event mask so only the allowed event can wakeup the 6206 * host. 6207 */ 6208 hci_set_event_mask_sync(hdev); 6209 } 6210 6211 /* Only configure accept list if disconnect succeeded and wake 6212 * isn't being prevented. 6213 */ 6214 if (!hdev->wakeup || !hdev->wakeup(hdev)) { 6215 hdev->suspend_state = BT_SUSPEND_DISCONNECT; 6216 return 0; 6217 } 6218 6219 /* Unpause to take care of updating scanning params */ 6220 hdev->scanning_paused = false; 6221 6222 /* Enable event filter for paired devices */ 6223 hci_update_event_filter_sync(hdev); 6224 6225 /* Update LE passive scan if enabled */ 6226 hci_update_passive_scan_sync(hdev); 6227 6228 /* Pause scan changes again. */ 6229 hdev->scanning_paused = true; 6230 6231 hdev->suspend_state = BT_SUSPEND_CONFIGURE_WAKE; 6232 6233 return 0; 6234 } 6235 6236 /* This function resumes discovery */ 6237 static int hci_resume_discovery_sync(struct hci_dev *hdev) 6238 { 6239 int err; 6240 6241 /* If discovery not paused there nothing to do */ 6242 if (!hdev->discovery_paused) 6243 return 0; 6244 6245 hdev->discovery_paused = false; 6246 6247 hci_discovery_set_state(hdev, DISCOVERY_STARTING); 6248 6249 err = hci_start_discovery_sync(hdev); 6250 6251 hci_discovery_set_state(hdev, err ? DISCOVERY_STOPPED : 6252 DISCOVERY_FINDING); 6253 6254 return err; 6255 } 6256 6257 static void hci_resume_monitor_sync(struct hci_dev *hdev) 6258 { 6259 switch (hci_get_adv_monitor_offload_ext(hdev)) { 6260 case HCI_ADV_MONITOR_EXT_MSFT: 6261 msft_resume_sync(hdev); 6262 break; 6263 default: 6264 return; 6265 } 6266 } 6267 6268 /* This function resume scan and reset paused flag */ 6269 static int hci_resume_scan_sync(struct hci_dev *hdev) 6270 { 6271 if (!hdev->scanning_paused) 6272 return 0; 6273 6274 hdev->scanning_paused = false; 6275 6276 hci_update_scan_sync(hdev); 6277 6278 /* Reset passive scanning to normal */ 6279 hci_update_passive_scan_sync(hdev); 6280 6281 return 0; 6282 } 6283 6284 /* This function performs the HCI suspend procedures in the follow order: 6285 * 6286 * Restore event mask 6287 * Clear event filter 6288 * Update passive scanning (normal duty cycle) 6289 * Resume Directed Advertising/Advertising 6290 * Resume discovery (active scanning/inquiry) 6291 */ 6292 int hci_resume_sync(struct hci_dev *hdev) 6293 { 6294 /* If not marked as suspended there nothing to do */ 6295 if (!hdev->suspended) 6296 return 0; 6297 6298 hdev->suspended = false; 6299 6300 /* Restore event mask */ 6301 hci_set_event_mask_sync(hdev); 6302 6303 /* Clear any event filters and restore scan state */ 6304 hci_clear_event_filter_sync(hdev); 6305 6306 /* Resume scanning */ 6307 hci_resume_scan_sync(hdev); 6308 6309 /* Resume monitor filters */ 6310 hci_resume_monitor_sync(hdev); 6311 6312 /* Resume other advertisements */ 6313 hci_resume_advertising_sync(hdev); 6314 6315 /* Resume discovery */ 6316 hci_resume_discovery_sync(hdev); 6317 6318 return 0; 6319 } 6320 6321 static bool conn_use_rpa(struct hci_conn *conn) 6322 { 6323 struct hci_dev *hdev = conn->hdev; 6324 6325 return hci_dev_test_flag(hdev, HCI_PRIVACY); 6326 } 6327 6328 static int hci_le_ext_directed_advertising_sync(struct hci_dev *hdev, 6329 struct hci_conn *conn) 6330 { 6331 struct hci_cp_le_set_ext_adv_params cp; 6332 struct hci_rp_le_set_ext_adv_params rp; 6333 int err; 6334 bdaddr_t random_addr; 6335 u8 own_addr_type; 6336 6337 err = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn), 6338 &own_addr_type); 6339 if (err) 6340 return err; 6341 6342 /* Set require_privacy to false so that the remote device has a 6343 * chance of identifying us. 6344 */ 6345 err = hci_get_random_address(hdev, false, conn_use_rpa(conn), NULL, 6346 &own_addr_type, &random_addr); 6347 if (err) 6348 return err; 6349 6350 memset(&cp, 0, sizeof(cp)); 6351 6352 cp.evt_properties = cpu_to_le16(LE_LEGACY_ADV_DIRECT_IND); 6353 cp.channel_map = hdev->le_adv_channel_map; 6354 cp.tx_power = HCI_TX_POWER_INVALID; 6355 cp.primary_phy = HCI_ADV_PHY_1M; 6356 cp.secondary_phy = HCI_ADV_PHY_1M; 6357 cp.handle = 0x00; /* Use instance 0 for directed adv */ 6358 cp.own_addr_type = own_addr_type; 6359 cp.peer_addr_type = conn->dst_type; 6360 bacpy(&cp.peer_addr, &conn->dst); 6361 6362 /* As per Core Spec 5.2 Vol 2, PART E, Sec 7.8.53, for 6363 * advertising_event_property LE_LEGACY_ADV_DIRECT_IND 6364 * does not supports advertising data when the advertising set already 6365 * contains some, the controller shall return erroc code 'Invalid 6366 * HCI Command Parameters(0x12). 6367 * So it is required to remove adv set for handle 0x00. since we use 6368 * instance 0 for directed adv. 6369 */ 6370 err = hci_remove_ext_adv_instance_sync(hdev, cp.handle, NULL); 6371 if (err) 6372 return err; 6373 6374 err = hci_set_ext_adv_params_sync(hdev, NULL, &cp, &rp); 6375 if (err) 6376 return err; 6377 6378 /* Update adv data as tx power is known now */ 6379 err = hci_set_ext_adv_data_sync(hdev, cp.handle); 6380 if (err) 6381 return err; 6382 6383 /* Check if random address need to be updated */ 6384 if (own_addr_type == ADDR_LE_DEV_RANDOM && 6385 bacmp(&random_addr, BDADDR_ANY) && 6386 bacmp(&random_addr, &hdev->random_addr)) { 6387 err = hci_set_adv_set_random_addr_sync(hdev, 0x00, 6388 &random_addr); 6389 if (err) 6390 return err; 6391 } 6392 6393 return hci_enable_ext_advertising_sync(hdev, 0x00); 6394 } 6395 6396 static int hci_le_directed_advertising_sync(struct hci_dev *hdev, 6397 struct hci_conn *conn) 6398 { 6399 struct hci_cp_le_set_adv_param cp; 6400 u8 status; 6401 u8 own_addr_type; 6402 u8 enable; 6403 6404 if (ext_adv_capable(hdev)) 6405 return hci_le_ext_directed_advertising_sync(hdev, conn); 6406 6407 /* Clear the HCI_LE_ADV bit temporarily so that the 6408 * hci_update_random_address knows that it's safe to go ahead 6409 * and write a new random address. The flag will be set back on 6410 * as soon as the SET_ADV_ENABLE HCI command completes. 6411 */ 6412 hci_dev_clear_flag(hdev, HCI_LE_ADV); 6413 6414 /* Set require_privacy to false so that the remote device has a 6415 * chance of identifying us. 6416 */ 6417 status = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn), 6418 &own_addr_type); 6419 if (status) 6420 return status; 6421 6422 memset(&cp, 0, sizeof(cp)); 6423 6424 /* Some controllers might reject command if intervals are not 6425 * within range for undirected advertising. 6426 * BCM20702A0 is known to be affected by this. 6427 */ 6428 cp.min_interval = cpu_to_le16(0x0020); 6429 cp.max_interval = cpu_to_le16(0x0020); 6430 6431 cp.type = LE_ADV_DIRECT_IND; 6432 cp.own_address_type = own_addr_type; 6433 cp.direct_addr_type = conn->dst_type; 6434 bacpy(&cp.direct_addr, &conn->dst); 6435 cp.channel_map = hdev->le_adv_channel_map; 6436 6437 status = __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_PARAM, 6438 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 6439 if (status) 6440 return status; 6441 6442 enable = 0x01; 6443 6444 return __hci_cmd_sync_status(hdev, HCI_OP_LE_SET_ADV_ENABLE, 6445 sizeof(enable), &enable, HCI_CMD_TIMEOUT); 6446 } 6447 6448 static void set_ext_conn_params(struct hci_conn *conn, 6449 struct hci_cp_le_ext_conn_param *p) 6450 { 6451 struct hci_dev *hdev = conn->hdev; 6452 6453 memset(p, 0, sizeof(*p)); 6454 6455 p->scan_interval = cpu_to_le16(hdev->le_scan_int_connect); 6456 p->scan_window = cpu_to_le16(hdev->le_scan_window_connect); 6457 p->conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 6458 p->conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 6459 p->conn_latency = cpu_to_le16(conn->le_conn_latency); 6460 p->supervision_timeout = cpu_to_le16(conn->le_supv_timeout); 6461 p->min_ce_len = cpu_to_le16(0x0000); 6462 p->max_ce_len = cpu_to_le16(0x0000); 6463 } 6464 6465 static int hci_le_ext_create_conn_sync(struct hci_dev *hdev, 6466 struct hci_conn *conn, u8 own_addr_type) 6467 { 6468 struct hci_cp_le_ext_create_conn *cp; 6469 struct hci_cp_le_ext_conn_param *p; 6470 u8 data[sizeof(*cp) + sizeof(*p) * 3]; 6471 u32 plen; 6472 6473 cp = (void *)data; 6474 p = (void *)cp->data; 6475 6476 memset(cp, 0, sizeof(*cp)); 6477 6478 bacpy(&cp->peer_addr, &conn->dst); 6479 cp->peer_addr_type = conn->dst_type; 6480 cp->own_addr_type = own_addr_type; 6481 6482 plen = sizeof(*cp); 6483 6484 if (scan_1m(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_1M || 6485 conn->le_adv_sec_phy == HCI_ADV_PHY_1M)) { 6486 cp->phys |= LE_SCAN_PHY_1M; 6487 set_ext_conn_params(conn, p); 6488 6489 p++; 6490 plen += sizeof(*p); 6491 } 6492 6493 if (scan_2m(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_2M || 6494 conn->le_adv_sec_phy == HCI_ADV_PHY_2M)) { 6495 cp->phys |= LE_SCAN_PHY_2M; 6496 set_ext_conn_params(conn, p); 6497 6498 p++; 6499 plen += sizeof(*p); 6500 } 6501 6502 if (scan_coded(hdev) && (conn->le_adv_phy == HCI_ADV_PHY_CODED || 6503 conn->le_adv_sec_phy == HCI_ADV_PHY_CODED)) { 6504 cp->phys |= LE_SCAN_PHY_CODED; 6505 set_ext_conn_params(conn, p); 6506 6507 plen += sizeof(*p); 6508 } 6509 6510 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_EXT_CREATE_CONN, 6511 plen, data, 6512 HCI_EV_LE_ENHANCED_CONN_COMPLETE, 6513 conn->conn_timeout, NULL); 6514 } 6515 6516 static int hci_le_create_conn_sync(struct hci_dev *hdev, void *data) 6517 { 6518 struct hci_cp_le_create_conn cp; 6519 struct hci_conn_params *params; 6520 u8 own_addr_type; 6521 int err; 6522 struct hci_conn *conn = data; 6523 6524 if (!hci_conn_valid(hdev, conn)) 6525 return -ECANCELED; 6526 6527 bt_dev_dbg(hdev, "conn %p", conn); 6528 6529 clear_bit(HCI_CONN_SCANNING, &conn->flags); 6530 conn->state = BT_CONNECT; 6531 6532 /* If requested to connect as peripheral use directed advertising */ 6533 if (conn->role == HCI_ROLE_SLAVE) { 6534 /* If we're active scanning and simultaneous roles is not 6535 * enabled simply reject the attempt. 6536 */ 6537 if (hci_dev_test_flag(hdev, HCI_LE_SCAN) && 6538 hdev->le_scan_type == LE_SCAN_ACTIVE && 6539 !hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) { 6540 hci_conn_del(conn); 6541 return -EBUSY; 6542 } 6543 6544 /* Pause advertising while doing directed advertising. */ 6545 hci_pause_advertising_sync(hdev); 6546 6547 err = hci_le_directed_advertising_sync(hdev, conn); 6548 goto done; 6549 } 6550 6551 /* Disable advertising if simultaneous roles is not in use. */ 6552 if (!hci_dev_test_flag(hdev, HCI_LE_SIMULTANEOUS_ROLES)) 6553 hci_pause_advertising_sync(hdev); 6554 6555 params = hci_conn_params_lookup(hdev, &conn->dst, conn->dst_type); 6556 if (params) { 6557 conn->le_conn_min_interval = params->conn_min_interval; 6558 conn->le_conn_max_interval = params->conn_max_interval; 6559 conn->le_conn_latency = params->conn_latency; 6560 conn->le_supv_timeout = params->supervision_timeout; 6561 } else { 6562 conn->le_conn_min_interval = hdev->le_conn_min_interval; 6563 conn->le_conn_max_interval = hdev->le_conn_max_interval; 6564 conn->le_conn_latency = hdev->le_conn_latency; 6565 conn->le_supv_timeout = hdev->le_supv_timeout; 6566 } 6567 6568 /* If controller is scanning, we stop it since some controllers are 6569 * not able to scan and connect at the same time. Also set the 6570 * HCI_LE_SCAN_INTERRUPTED flag so that the command complete 6571 * handler for scan disabling knows to set the correct discovery 6572 * state. 6573 */ 6574 if (hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 6575 hci_scan_disable_sync(hdev); 6576 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED); 6577 } 6578 6579 /* Update random address, but set require_privacy to false so 6580 * that we never connect with an non-resolvable address. 6581 */ 6582 err = hci_update_random_address_sync(hdev, false, conn_use_rpa(conn), 6583 &own_addr_type); 6584 if (err) 6585 goto done; 6586 /* Send command LE Extended Create Connection if supported */ 6587 if (use_ext_conn(hdev)) { 6588 err = hci_le_ext_create_conn_sync(hdev, conn, own_addr_type); 6589 goto done; 6590 } 6591 6592 memset(&cp, 0, sizeof(cp)); 6593 6594 cp.scan_interval = cpu_to_le16(hdev->le_scan_int_connect); 6595 cp.scan_window = cpu_to_le16(hdev->le_scan_window_connect); 6596 6597 bacpy(&cp.peer_addr, &conn->dst); 6598 cp.peer_addr_type = conn->dst_type; 6599 cp.own_address_type = own_addr_type; 6600 cp.conn_interval_min = cpu_to_le16(conn->le_conn_min_interval); 6601 cp.conn_interval_max = cpu_to_le16(conn->le_conn_max_interval); 6602 cp.conn_latency = cpu_to_le16(conn->le_conn_latency); 6603 cp.supervision_timeout = cpu_to_le16(conn->le_supv_timeout); 6604 cp.min_ce_len = cpu_to_le16(0x0000); 6605 cp.max_ce_len = cpu_to_le16(0x0000); 6606 6607 /* BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E page 2261: 6608 * 6609 * If this event is unmasked and the HCI_LE_Connection_Complete event 6610 * is unmasked, only the HCI_LE_Enhanced_Connection_Complete event is 6611 * sent when a new connection has been created. 6612 */ 6613 err = __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CREATE_CONN, 6614 sizeof(cp), &cp, 6615 use_enhanced_conn_complete(hdev) ? 6616 HCI_EV_LE_ENHANCED_CONN_COMPLETE : 6617 HCI_EV_LE_CONN_COMPLETE, 6618 conn->conn_timeout, NULL); 6619 6620 done: 6621 if (err == -ETIMEDOUT) 6622 hci_le_connect_cancel_sync(hdev, conn, 0x00); 6623 6624 /* Re-enable advertising after the connection attempt is finished. */ 6625 hci_resume_advertising_sync(hdev); 6626 return err; 6627 } 6628 6629 int hci_le_create_cis_sync(struct hci_dev *hdev) 6630 { 6631 DEFINE_FLEX(struct hci_cp_le_create_cis, cmd, cis, num_cis, 0x1f); 6632 size_t aux_num_cis = 0; 6633 struct hci_conn *conn; 6634 u8 cig = BT_ISO_QOS_CIG_UNSET; 6635 6636 /* The spec allows only one pending LE Create CIS command at a time. If 6637 * the command is pending now, don't do anything. We check for pending 6638 * connections after each CIS Established event. 6639 * 6640 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 6641 * page 2566: 6642 * 6643 * If the Host issues this command before all the 6644 * HCI_LE_CIS_Established events from the previous use of the 6645 * command have been generated, the Controller shall return the 6646 * error code Command Disallowed (0x0C). 6647 * 6648 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 6649 * page 2567: 6650 * 6651 * When the Controller receives the HCI_LE_Create_CIS command, the 6652 * Controller sends the HCI_Command_Status event to the Host. An 6653 * HCI_LE_CIS_Established event will be generated for each CIS when it 6654 * is established or if it is disconnected or considered lost before 6655 * being established; until all the events are generated, the command 6656 * remains pending. 6657 */ 6658 6659 hci_dev_lock(hdev); 6660 6661 rcu_read_lock(); 6662 6663 /* Wait until previous Create CIS has completed */ 6664 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 6665 if (test_bit(HCI_CONN_CREATE_CIS, &conn->flags)) 6666 goto done; 6667 } 6668 6669 /* Find CIG with all CIS ready */ 6670 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 6671 struct hci_conn *link; 6672 6673 if (hci_conn_check_create_cis(conn)) 6674 continue; 6675 6676 cig = conn->iso_qos.ucast.cig; 6677 6678 list_for_each_entry_rcu(link, &hdev->conn_hash.list, list) { 6679 if (hci_conn_check_create_cis(link) > 0 && 6680 link->iso_qos.ucast.cig == cig && 6681 link->state != BT_CONNECTED) { 6682 cig = BT_ISO_QOS_CIG_UNSET; 6683 break; 6684 } 6685 } 6686 6687 if (cig != BT_ISO_QOS_CIG_UNSET) 6688 break; 6689 } 6690 6691 if (cig == BT_ISO_QOS_CIG_UNSET) 6692 goto done; 6693 6694 list_for_each_entry_rcu(conn, &hdev->conn_hash.list, list) { 6695 struct hci_cis *cis = &cmd->cis[aux_num_cis]; 6696 6697 if (hci_conn_check_create_cis(conn) || 6698 conn->iso_qos.ucast.cig != cig) 6699 continue; 6700 6701 set_bit(HCI_CONN_CREATE_CIS, &conn->flags); 6702 cis->acl_handle = cpu_to_le16(conn->parent->handle); 6703 cis->cis_handle = cpu_to_le16(conn->handle); 6704 aux_num_cis++; 6705 6706 if (aux_num_cis >= cmd->num_cis) 6707 break; 6708 } 6709 cmd->num_cis = aux_num_cis; 6710 6711 done: 6712 rcu_read_unlock(); 6713 6714 hci_dev_unlock(hdev); 6715 6716 if (!aux_num_cis) 6717 return 0; 6718 6719 /* Wait for HCI_LE_CIS_Established */ 6720 return __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_CREATE_CIS, 6721 struct_size(cmd, cis, cmd->num_cis), 6722 cmd, HCI_EVT_LE_CIS_ESTABLISHED, 6723 conn->conn_timeout, NULL); 6724 } 6725 6726 int hci_le_remove_cig_sync(struct hci_dev *hdev, u8 handle) 6727 { 6728 struct hci_cp_le_remove_cig cp; 6729 6730 memset(&cp, 0, sizeof(cp)); 6731 cp.cig_id = handle; 6732 6733 return __hci_cmd_sync_status(hdev, HCI_OP_LE_REMOVE_CIG, sizeof(cp), 6734 &cp, HCI_CMD_TIMEOUT); 6735 } 6736 6737 int hci_le_big_terminate_sync(struct hci_dev *hdev, u8 handle) 6738 { 6739 struct hci_cp_le_big_term_sync cp; 6740 6741 memset(&cp, 0, sizeof(cp)); 6742 cp.handle = handle; 6743 6744 return __hci_cmd_sync_status(hdev, HCI_OP_LE_BIG_TERM_SYNC, 6745 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 6746 } 6747 6748 int hci_le_pa_terminate_sync(struct hci_dev *hdev, u16 handle) 6749 { 6750 struct hci_cp_le_pa_term_sync cp; 6751 6752 memset(&cp, 0, sizeof(cp)); 6753 cp.handle = cpu_to_le16(handle); 6754 6755 return __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_TERM_SYNC, 6756 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 6757 } 6758 6759 int hci_get_random_address(struct hci_dev *hdev, bool require_privacy, 6760 bool use_rpa, struct adv_info *adv_instance, 6761 u8 *own_addr_type, bdaddr_t *rand_addr) 6762 { 6763 int err; 6764 6765 bacpy(rand_addr, BDADDR_ANY); 6766 6767 /* If privacy is enabled use a resolvable private address. If 6768 * current RPA has expired then generate a new one. 6769 */ 6770 if (use_rpa) { 6771 /* If Controller supports LL Privacy use own address type is 6772 * 0x03 6773 */ 6774 if (ll_privacy_capable(hdev)) 6775 *own_addr_type = ADDR_LE_DEV_RANDOM_RESOLVED; 6776 else 6777 *own_addr_type = ADDR_LE_DEV_RANDOM; 6778 6779 if (adv_instance) { 6780 if (adv_rpa_valid(adv_instance)) 6781 return 0; 6782 } else { 6783 if (rpa_valid(hdev)) 6784 return 0; 6785 } 6786 6787 err = smp_generate_rpa(hdev, hdev->irk, &hdev->rpa); 6788 if (err < 0) { 6789 bt_dev_err(hdev, "failed to generate new RPA"); 6790 return err; 6791 } 6792 6793 bacpy(rand_addr, &hdev->rpa); 6794 6795 return 0; 6796 } 6797 6798 /* In case of required privacy without resolvable private address, 6799 * use an non-resolvable private address. This is useful for 6800 * non-connectable advertising. 6801 */ 6802 if (require_privacy) { 6803 bdaddr_t nrpa; 6804 6805 while (true) { 6806 /* The non-resolvable private address is generated 6807 * from random six bytes with the two most significant 6808 * bits cleared. 6809 */ 6810 get_random_bytes(&nrpa, 6); 6811 nrpa.b[5] &= 0x3f; 6812 6813 /* The non-resolvable private address shall not be 6814 * equal to the public address. 6815 */ 6816 if (bacmp(&hdev->bdaddr, &nrpa)) 6817 break; 6818 } 6819 6820 *own_addr_type = ADDR_LE_DEV_RANDOM; 6821 bacpy(rand_addr, &nrpa); 6822 6823 return 0; 6824 } 6825 6826 /* No privacy, use the current address */ 6827 hci_copy_identity_address(hdev, rand_addr, own_addr_type); 6828 6829 return 0; 6830 } 6831 6832 static int _update_adv_data_sync(struct hci_dev *hdev, void *data) 6833 { 6834 u8 instance = PTR_UINT(data); 6835 6836 return hci_update_adv_data_sync(hdev, instance); 6837 } 6838 6839 int hci_update_adv_data(struct hci_dev *hdev, u8 instance) 6840 { 6841 return hci_cmd_sync_queue(hdev, _update_adv_data_sync, 6842 UINT_PTR(instance), NULL); 6843 } 6844 6845 static int hci_acl_create_conn_sync(struct hci_dev *hdev, void *data) 6846 { 6847 struct hci_conn *conn = data; 6848 struct inquiry_entry *ie; 6849 struct hci_cp_create_conn cp; 6850 int err; 6851 6852 if (!hci_conn_valid(hdev, conn)) 6853 return -ECANCELED; 6854 6855 /* Many controllers disallow HCI Create Connection while it is doing 6856 * HCI Inquiry. So we cancel the Inquiry first before issuing HCI Create 6857 * Connection. This may cause the MGMT discovering state to become false 6858 * without user space's request but it is okay since the MGMT Discovery 6859 * APIs do not promise that discovery should be done forever. Instead, 6860 * the user space monitors the status of MGMT discovering and it may 6861 * request for discovery again when this flag becomes false. 6862 */ 6863 if (test_bit(HCI_INQUIRY, &hdev->flags)) { 6864 err = __hci_cmd_sync_status(hdev, HCI_OP_INQUIRY_CANCEL, 0, 6865 NULL, HCI_CMD_TIMEOUT); 6866 if (err) 6867 bt_dev_warn(hdev, "Failed to cancel inquiry %d", err); 6868 } 6869 6870 conn->state = BT_CONNECT; 6871 conn->out = true; 6872 conn->role = HCI_ROLE_MASTER; 6873 6874 conn->attempt++; 6875 6876 conn->link_policy = hdev->link_policy; 6877 6878 memset(&cp, 0, sizeof(cp)); 6879 bacpy(&cp.bdaddr, &conn->dst); 6880 cp.pscan_rep_mode = 0x02; 6881 6882 ie = hci_inquiry_cache_lookup(hdev, &conn->dst); 6883 if (ie) { 6884 if (inquiry_entry_age(ie) <= INQUIRY_ENTRY_AGE_MAX) { 6885 cp.pscan_rep_mode = ie->data.pscan_rep_mode; 6886 cp.pscan_mode = ie->data.pscan_mode; 6887 cp.clock_offset = ie->data.clock_offset | 6888 cpu_to_le16(0x8000); 6889 } 6890 6891 memcpy(conn->dev_class, ie->data.dev_class, 3); 6892 } 6893 6894 cp.pkt_type = cpu_to_le16(conn->pkt_type); 6895 if (lmp_rswitch_capable(hdev) && !(hdev->link_mode & HCI_LM_MASTER)) 6896 cp.role_switch = 0x01; 6897 else 6898 cp.role_switch = 0x00; 6899 6900 return __hci_cmd_sync_status_sk(hdev, HCI_OP_CREATE_CONN, 6901 sizeof(cp), &cp, 6902 HCI_EV_CONN_COMPLETE, 6903 conn->conn_timeout, NULL); 6904 } 6905 6906 int hci_connect_acl_sync(struct hci_dev *hdev, struct hci_conn *conn) 6907 { 6908 return hci_cmd_sync_queue_once(hdev, hci_acl_create_conn_sync, conn, 6909 NULL); 6910 } 6911 6912 static void create_le_conn_complete(struct hci_dev *hdev, void *data, int err) 6913 { 6914 struct hci_conn *conn = data; 6915 6916 bt_dev_dbg(hdev, "err %d", err); 6917 6918 if (err == -ECANCELED) 6919 return; 6920 6921 hci_dev_lock(hdev); 6922 6923 if (!hci_conn_valid(hdev, conn)) 6924 goto done; 6925 6926 if (!err) { 6927 hci_connect_le_scan_cleanup(conn, 0x00); 6928 goto done; 6929 } 6930 6931 /* Check if connection is still pending */ 6932 if (conn != hci_lookup_le_connect(hdev)) 6933 goto done; 6934 6935 /* Flush to make sure we send create conn cancel command if needed */ 6936 flush_delayed_work(&conn->le_conn_timeout); 6937 hci_conn_failed(conn, bt_status(err)); 6938 6939 done: 6940 hci_dev_unlock(hdev); 6941 } 6942 6943 int hci_connect_le_sync(struct hci_dev *hdev, struct hci_conn *conn) 6944 { 6945 return hci_cmd_sync_queue_once(hdev, hci_le_create_conn_sync, conn, 6946 create_le_conn_complete); 6947 } 6948 6949 int hci_cancel_connect_sync(struct hci_dev *hdev, struct hci_conn *conn) 6950 { 6951 if (conn->state != BT_OPEN) 6952 return -EINVAL; 6953 6954 switch (conn->type) { 6955 case ACL_LINK: 6956 return !hci_cmd_sync_dequeue_once(hdev, 6957 hci_acl_create_conn_sync, 6958 conn, NULL); 6959 case LE_LINK: 6960 return !hci_cmd_sync_dequeue_once(hdev, hci_le_create_conn_sync, 6961 conn, create_le_conn_complete); 6962 } 6963 6964 return -ENOENT; 6965 } 6966 6967 int hci_le_conn_update_sync(struct hci_dev *hdev, struct hci_conn *conn, 6968 struct hci_conn_params *params) 6969 { 6970 struct hci_cp_le_conn_update cp; 6971 6972 memset(&cp, 0, sizeof(cp)); 6973 cp.handle = cpu_to_le16(conn->handle); 6974 cp.conn_interval_min = cpu_to_le16(params->conn_min_interval); 6975 cp.conn_interval_max = cpu_to_le16(params->conn_max_interval); 6976 cp.conn_latency = cpu_to_le16(params->conn_latency); 6977 cp.supervision_timeout = cpu_to_le16(params->supervision_timeout); 6978 cp.min_ce_len = cpu_to_le16(0x0000); 6979 cp.max_ce_len = cpu_to_le16(0x0000); 6980 6981 return __hci_cmd_sync_status(hdev, HCI_OP_LE_CONN_UPDATE, 6982 sizeof(cp), &cp, HCI_CMD_TIMEOUT); 6983 } 6984 6985 static void create_pa_complete(struct hci_dev *hdev, void *data, int err) 6986 { 6987 struct hci_conn *conn = data; 6988 struct hci_conn *pa_sync; 6989 6990 bt_dev_dbg(hdev, "err %d", err); 6991 6992 if (err == -ECANCELED) 6993 return; 6994 6995 hci_dev_lock(hdev); 6996 6997 if (!hci_conn_valid(hdev, conn)) 6998 clear_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags); 6999 7000 if (!err) 7001 goto unlock; 7002 7003 /* Add connection to indicate PA sync error */ 7004 pa_sync = hci_conn_add_unset(hdev, PA_LINK, BDADDR_ANY, 7005 HCI_ROLE_SLAVE); 7006 7007 if (IS_ERR(pa_sync)) 7008 goto unlock; 7009 7010 set_bit(HCI_CONN_PA_SYNC_FAILED, &pa_sync->flags); 7011 7012 /* Notify iso layer */ 7013 hci_connect_cfm(pa_sync, bt_status(err)); 7014 7015 unlock: 7016 hci_dev_unlock(hdev); 7017 } 7018 7019 static int hci_le_pa_create_sync(struct hci_dev *hdev, void *data) 7020 { 7021 struct hci_cp_le_pa_create_sync cp; 7022 struct hci_conn *conn = data; 7023 struct bt_iso_qos *qos = &conn->iso_qos; 7024 int err; 7025 7026 if (!hci_conn_valid(hdev, conn)) 7027 return -ECANCELED; 7028 7029 if (conn->sync_handle != HCI_SYNC_HANDLE_INVALID) 7030 return -EINVAL; 7031 7032 if (hci_dev_test_and_set_flag(hdev, HCI_PA_SYNC)) 7033 return -EBUSY; 7034 7035 /* Stop scanning if SID has not been set and active scanning is enabled 7036 * so we use passive scanning which will be scanning using the allow 7037 * list programmed to contain only the connection address. 7038 */ 7039 if (conn->sid == HCI_SID_INVALID && 7040 hci_dev_test_flag(hdev, HCI_LE_SCAN)) { 7041 hci_scan_disable_sync(hdev); 7042 hci_dev_set_flag(hdev, HCI_LE_SCAN_INTERRUPTED); 7043 hci_discovery_set_state(hdev, DISCOVERY_STOPPED); 7044 } 7045 7046 /* Mark HCI_CONN_CREATE_PA_SYNC so hci_update_passive_scan_sync can 7047 * program the address in the allow list so PA advertisements can be 7048 * received. 7049 */ 7050 set_bit(HCI_CONN_CREATE_PA_SYNC, &conn->flags); 7051 7052 hci_update_passive_scan_sync(hdev); 7053 7054 /* SID has not been set listen for HCI_EV_LE_EXT_ADV_REPORT to update 7055 * it. 7056 */ 7057 if (conn->sid == HCI_SID_INVALID) { 7058 err = __hci_cmd_sync_status_sk(hdev, HCI_OP_NOP, 0, NULL, 7059 HCI_EV_LE_EXT_ADV_REPORT, 7060 conn->conn_timeout, NULL); 7061 if (err == -ETIMEDOUT) 7062 goto done; 7063 } 7064 7065 memset(&cp, 0, sizeof(cp)); 7066 cp.options = qos->bcast.options; 7067 cp.sid = conn->sid; 7068 cp.addr_type = conn->dst_type; 7069 bacpy(&cp.addr, &conn->dst); 7070 cp.skip = cpu_to_le16(qos->bcast.skip); 7071 cp.sync_timeout = cpu_to_le16(qos->bcast.sync_timeout); 7072 cp.sync_cte_type = qos->bcast.sync_cte_type; 7073 7074 /* The spec allows only one pending LE Periodic Advertising Create 7075 * Sync command at a time so we forcefully wait for PA Sync Established 7076 * event since cmd_work can only schedule one command at a time. 7077 * 7078 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 7079 * page 2493: 7080 * 7081 * If the Host issues this command when another HCI_LE_Periodic_ 7082 * Advertising_Create_Sync command is pending, the Controller shall 7083 * return the error code Command Disallowed (0x0C). 7084 */ 7085 err = __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_PA_CREATE_SYNC, 7086 sizeof(cp), &cp, 7087 HCI_EV_LE_PA_SYNC_ESTABLISHED, 7088 conn->conn_timeout, NULL); 7089 if (err == -ETIMEDOUT) 7090 __hci_cmd_sync_status(hdev, HCI_OP_LE_PA_CREATE_SYNC_CANCEL, 7091 0, NULL, HCI_CMD_TIMEOUT); 7092 7093 done: 7094 hci_dev_clear_flag(hdev, HCI_PA_SYNC); 7095 7096 /* Update passive scan since HCI_PA_SYNC flag has been cleared */ 7097 hci_update_passive_scan_sync(hdev); 7098 7099 return err; 7100 } 7101 7102 int hci_connect_pa_sync(struct hci_dev *hdev, struct hci_conn *conn) 7103 { 7104 return hci_cmd_sync_queue_once(hdev, hci_le_pa_create_sync, conn, 7105 create_pa_complete); 7106 } 7107 7108 static void create_big_complete(struct hci_dev *hdev, void *data, int err) 7109 { 7110 struct hci_conn *conn = data; 7111 7112 bt_dev_dbg(hdev, "err %d", err); 7113 7114 if (err == -ECANCELED) 7115 return; 7116 7117 if (hci_conn_valid(hdev, conn)) 7118 clear_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags); 7119 } 7120 7121 static int hci_le_big_create_sync(struct hci_dev *hdev, void *data) 7122 { 7123 DEFINE_FLEX(struct hci_cp_le_big_create_sync, cp, bis, num_bis, 0x11); 7124 struct hci_conn *conn = data; 7125 struct bt_iso_qos *qos = &conn->iso_qos; 7126 int err; 7127 7128 if (!hci_conn_valid(hdev, conn)) 7129 return -ECANCELED; 7130 7131 set_bit(HCI_CONN_CREATE_BIG_SYNC, &conn->flags); 7132 7133 memset(cp, 0, sizeof(*cp)); 7134 cp->handle = qos->bcast.big; 7135 cp->sync_handle = cpu_to_le16(conn->sync_handle); 7136 cp->encryption = qos->bcast.encryption; 7137 memcpy(cp->bcode, qos->bcast.bcode, sizeof(cp->bcode)); 7138 cp->mse = qos->bcast.mse; 7139 cp->timeout = cpu_to_le16(qos->bcast.timeout); 7140 cp->num_bis = conn->num_bis; 7141 memcpy(cp->bis, conn->bis, conn->num_bis); 7142 7143 /* The spec allows only one pending LE BIG Create Sync command at 7144 * a time, so we forcefully wait for BIG Sync Established event since 7145 * cmd_work can only schedule one command at a time. 7146 * 7147 * BLUETOOTH CORE SPECIFICATION Version 5.3 | Vol 4, Part E 7148 * page 2586: 7149 * 7150 * If the Host sends this command when the Controller is in the 7151 * process of synchronizing to any BIG, i.e. the HCI_LE_BIG_Sync_ 7152 * Established event has not been generated, the Controller shall 7153 * return the error code Command Disallowed (0x0C). 7154 */ 7155 err = __hci_cmd_sync_status_sk(hdev, HCI_OP_LE_BIG_CREATE_SYNC, 7156 struct_size(cp, bis, cp->num_bis), cp, 7157 HCI_EVT_LE_BIG_SYNC_ESTABLISHED, 7158 conn->conn_timeout, NULL); 7159 if (err == -ETIMEDOUT) 7160 hci_le_big_terminate_sync(hdev, cp->handle); 7161 7162 return err; 7163 } 7164 7165 int hci_connect_big_sync(struct hci_dev *hdev, struct hci_conn *conn) 7166 { 7167 return hci_cmd_sync_queue_once(hdev, hci_le_big_create_sync, conn, 7168 create_big_complete); 7169 } 7170